From 4ca4119fc978acba442b0dc49334bb0041bf11ca Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 11 Dec 2020 00:42:55 +0100
Subject: [PATCH 001/682] added

---
 client/src/cmdhficlass.c | 188 +++++++++++++++++++++++++++++++++------
 1 file changed, 162 insertions(+), 26 deletions(-)

diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c
index d884e7184..01b903272 100644
--- a/client/src/cmdhficlass.c
+++ b/client/src/cmdhficlass.c
@@ -1149,7 +1149,7 @@ static int CmdHFiClassEncryptBlk(const char *Cmd) {
 
     if (key_len > 0) {
         if (key_len != 16) {
-            PrintAndLogEx(ERR, "Transport key must be 16 hex ytes (32 HEX characters)");
+            PrintAndLogEx(ERR, "Transport key must be 16 hex bytes (32 HEX characters)");
             CLIParserFree(clictx);
             return PM3_EINVARG;
         }
@@ -1165,8 +1165,10 @@ static int CmdHFiClassEncryptBlk(const char *Cmd) {
     if (have_key == false && use_sc == false) {
         size_t keylen = 0;
         int res = loadFile_safe(ICLASS_DECRYPTION_BIN, "", (void **)&keyptr, &keylen);
-        if (res != PM3_SUCCESS)
+        if (res != PM3_SUCCESS) {
+            PrintAndLogEx(ERR, "Failed to find the transport key");
             return PM3_EINVARG;
+        }
 
         memcpy(key, keyptr, sizeof(key));
         free(keyptr);
@@ -3314,6 +3316,139 @@ static int CmdHFiClassPermuteKey(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
+static int CmdHFiClassEncode(const char *Cmd) {
+
+  CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf iclass encode",
+                  "Encode binary wiegand to block 7",
+                  "hf iclass encode --bin 10001111100000001010100011 --ki 0            -> FC 31 CN 337\n"
+                  "hf iclass encode --bin 10001111100000001010100011 --ki 0 --elite    -> FC 31 CN 337,  writing w elite key"
+                  );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1(NULL, "bin", "<bin>", "Binary string i.e 0001001001"),
+        arg_int1(NULL, "ki", "<dec>", "Key index to select key from memory 'hf iclass managekeys'"),
+        arg_lit0(NULL, "credit", "key is assumed to be the credit key"),
+        arg_lit0(NULL, "elite", "elite computations applied to key"),
+        arg_lit0(NULL, "raw", "no computations applied to key"),
+        arg_str0(NULL, "enckey", "<hex>", "3DES transport key, 16 hex bytes"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+
+    int bin_len = 63;
+    uint8_t bin[70] = {0};
+    CLIGetStrWithReturn(ctx, 1, bin, &bin_len);
+
+    int key_nr = arg_get_int_def(ctx, 2, -1);
+    bool auth = false;
+
+    uint8_t key[8] = {0};
+    if (key_nr >= 0) {
+        if (key_nr < ICLASS_KEYS_MAX) {
+            auth = true;
+            memcpy(key, iClass_Key_Table[key_nr], 8);
+            PrintAndLogEx(SUCCESS, "Using key[%d] " _GREEN_("%s"), key_nr, sprint_hex(iClass_Key_Table[key_nr], 8));
+        } else {
+            PrintAndLogEx(ERR, "Key number is invalid");
+            CLIParserFree(ctx);
+            return PM3_EINVARG;
+        }
+    }
+
+    bool use_credit_key = arg_get_lit(ctx, 3);
+    bool elite = arg_get_lit(ctx, 4);
+    bool rawkey = arg_get_lit(ctx, 5);
+
+    int enc_key_len = 0;
+    uint8_t enc_key[16] = {0};
+    uint8_t *enckeyptr = NULL;
+    bool have_enc_key = false;
+    CLIGetHexWithReturn(ctx, 6, enc_key, &enc_key_len);
+
+    CLIParserFree(ctx);
+
+    if ((rawkey + elite) > 1) {
+        PrintAndLogEx(ERR, "Can not use a combo of 'elite', 'raw'");
+        return PM3_EINVARG;
+    }
+
+    if (enc_key_len > 0) {
+        if (enc_key_len != 16) {
+            PrintAndLogEx(ERR, "Transport key must be 16 hex bytes (32 HEX characters)");
+            return PM3_EINVARG;
+        }
+        have_enc_key = true;
+    }
+
+    if (bin_len > 127) {
+        PrintAndLogEx(ERR, "Binary wiegand string must be less than 128 bits");
+        return PM3_EINVARG;
+    }
+
+    bool use_sc = IsCryptoHelperPresent(false);
+
+    if (have_enc_key == false && use_sc == false) {
+        size_t keylen = 0;
+        int res = loadFile_safe(ICLASS_DECRYPTION_BIN, "", (void **)&enckeyptr, &keylen);
+        if (res != PM3_SUCCESS) {
+            PrintAndLogEx(ERR, "Failed to find the transport key");
+            return PM3_EINVARG;
+        }
+        if (keylen != 16) {
+            PrintAndLogEx(ERR, "Failed to load transport key from file");
+            return PM3_EINVARG;
+        }
+
+        memcpy(enc_key, enckeyptr, sizeof(enc_key));
+        free(enckeyptr);
+    }
+
+    uint8_t data[8];
+    memset(data, 0, sizeof(data));
+
+    BitstreamOut bout = {data, 0, 0 };
+
+    for (int i = 0; i < 64 - bin_len - 1; i++) {
+        pushBit(&bout, 0);
+    }
+    // add binary sentinel bit.
+    pushBit(&bout, 1);
+   
+    // convert binary string to hex bytes
+    for (int i = 0; i < bin_len; i++) {
+        char c = bin[i];
+        if (c == '1')
+            pushBit(&bout, 1);
+        else if (c == '0')
+            pushBit(&bout, 0);
+        else {
+            PrintAndLogEx(WARNING, "Ignoring '%c'", c);
+        }
+    }
+
+    // encrypt with transport key
+    if (use_sc) {
+        Encrypt(data, data);
+    } else {
+        iclass_encrypt_block_data(data, enc_key);
+    }
+    PrintAndLogEx(SUCCESS, "encrypted block: " _YELLOW_("%s"), sprint_hex_inrow(data, sizeof(data)));
+
+    // write block 7
+    int isok = iclass_write_block(7, data, key, use_credit_key, elite, rawkey, false, false, auth);
+    switch (isok) {
+        case PM3_SUCCESS:
+            PrintAndLogEx(SUCCESS, "Write block 7/0x07 ( " _GREEN_("ok") " )");
+            break;
+        default:
+            PrintAndLogEx(SUCCESS, "Write block 7/0x07 ( " _RED_("fail") " )");
+            break;
+    }
+    return isok;
+}
+
 /*
 static int CmdHFiClassAutopwn(const char *Cmd) {
 
@@ -3340,35 +3475,36 @@ static int CmdHFiClassAutopwn(const char *Cmd) {
 
 static command_t CommandTable[] = {
     {"-----------", CmdHelp,                    AlwaysAvailable, "--------------------- " _CYAN_("operations") " ---------------------"},
-    {"help",        CmdHelp,                    AlwaysAvailable, "This help"},
-//    {"clone",       CmdHFiClassClone,           IfPm3Iclass,     "[options..] Create a HID credential to Picopass / iCLASS tag"},
-    {"dump",        CmdHFiClassDump,            IfPm3Iclass,     "[options..] Dump Picopass / iCLASS tag to file"},
-    {"info",        CmdHFiClassInfo,            AlwaysAvailable, "            Tag information"},
-    {"list",        CmdHFiClassList,            AlwaysAvailable, "            List iclass history"},
-    {"rdbl",        CmdHFiClass_ReadBlock,      IfPm3Iclass,     "[options..] Read Picopass / iCLASS block"},
-    {"reader",      CmdHFiClassReader,          IfPm3Iclass,     "            Act like an Picopass / iCLASS reader"},
-    {"restore",     CmdHFiClassRestore,        IfPm3Iclass,      "[options..] Restore a dump file onto a Picopass / iCLASS tag"},
-    {"sniff",       CmdHFiClassSniff,           IfPm3Iclass,     "            Eavesdrop Picopass / iCLASS communication"},
-    {"wrbl",        CmdHFiClass_WriteBlock,     IfPm3Iclass,     "[options..] Write Picopass / iCLASS block"},
+    {"help",        CmdHelp,                    AlwaysAvailable, "    This help"},
+//    {"clone",       CmdHFiClassClone,           IfPm3Iclass,     "[*] Create a HID credential to Picopass / iCLASS tag"},
+    {"dump",        CmdHFiClassDump,            IfPm3Iclass,     "[*] Dump Picopass / iCLASS tag to file"},
+    {"info",        CmdHFiClassInfo,            AlwaysAvailable, "    Tag information"},
+    {"list",        CmdHFiClassList,            AlwaysAvailable, "    List iclass history"},
+    {"rdbl",        CmdHFiClass_ReadBlock,      IfPm3Iclass,     "[*] Read Picopass / iCLASS block"},
+    {"reader",      CmdHFiClassReader,          IfPm3Iclass,     "    Act like an Picopass / iCLASS reader"},
+    {"restore",     CmdHFiClassRestore,        IfPm3Iclass,      "[*] Restore a dump file onto a Picopass / iCLASS tag"},
+    {"sniff",       CmdHFiClassSniff,           IfPm3Iclass,     "    Eavesdrop Picopass / iCLASS communication"},
+    {"wrbl",        CmdHFiClass_WriteBlock,     IfPm3Iclass,     "[*] Write Picopass / iCLASS block"},
 
     {"-----------", CmdHelp,                    AlwaysAvailable, "--------------------- " _CYAN_("recovery") " ---------------------"},
-//    {"autopwn",     CmdHFiClassAutopwn,         IfPm3Iclass,     "[options..] Automatic key recovery tool for iCLASS"},
-    {"chk",         CmdHFiClassCheckKeys,       IfPm3Iclass,     "[options..] Check keys"},
-    {"loclass",     CmdHFiClass_loclass,        AlwaysAvailable, "[options..] Use loclass to perform bruteforce reader attack"},
-    {"lookup",      CmdHFiClassLookUp,          AlwaysAvailable, "[options..] Uses authentication trace to check for key in dictionary file"},
+//    {"autopwn",     CmdHFiClassAutopwn,         IfPm3Iclass,     "[*] Automatic key recovery tool for iCLASS"},
+    {"chk",         CmdHFiClassCheckKeys,       IfPm3Iclass,     "[*] Check keys"},
+    {"loclass",     CmdHFiClass_loclass,        AlwaysAvailable, "[*] Use loclass to perform bruteforce reader attack"},
+    {"lookup",      CmdHFiClassLookUp,          AlwaysAvailable, "[*] Uses authentication trace to check for key in dictionary file"},
     {"-----------", CmdHelp,                    AlwaysAvailable, "--------------------- " _CYAN_("simulation") " ---------------------"},
-    {"sim",         CmdHFiClassSim,             IfPm3Iclass,     "[options..] Simulate iCLASS tag"},
-    {"eload",       CmdHFiClassELoad,           IfPm3Iclass,     "[f <fn>   ] Load Picopass / iCLASS dump file into emulator memory"},
-    {"esave",       CmdHFiClassESave,           IfPm3Iclass,     "[f <fn>   ] Save emulator memory to file"},
-    {"eview",       CmdHFiClassEView,           IfPm3Iclass,     "[options..] View emulator memory"},
+    {"sim",         CmdHFiClassSim,             IfPm3Iclass,     "[*] Simulate iCLASS tag"},
+    {"eload",       CmdHFiClassELoad,           IfPm3Iclass,     "[*] Load Picopass / iCLASS dump file into emulator memory"},
+    {"esave",       CmdHFiClassESave,           IfPm3Iclass,     "[*] Save emulator memory to file"},
+    {"eview",       CmdHFiClassEView,           IfPm3Iclass,     "[.] View emulator memory"},
 
     {"-----------", CmdHelp,                    AlwaysAvailable, "--------------------- " _CYAN_("utils") " ---------------------"},
-    {"calcnewkey",  CmdHFiClassCalcNewKey,      AlwaysAvailable, "[options..] Calc diversified keys (blocks 3 & 4) to write new keys"},
-    {"encrypt",     CmdHFiClassEncryptBlk,      AlwaysAvailable, "[options..] Encrypt given block data"},
-    {"decrypt",     CmdHFiClassDecrypt,         AlwaysAvailable, "[options..] Decrypt given block data or tag dump file" },
-    {"managekeys",  CmdHFiClassManageKeys,      AlwaysAvailable, "[options..] Manage keys to use with iclass commands"},
-    {"permutekey",  CmdHFiClassPermuteKey,      IfPm3Iclass,     "            Permute function from 'heart of darkness' paper"},
-    {"view",        CmdHFiClassView,            AlwaysAvailable, "[options..] Display content from tag dump file"},
+    {"calcnewkey",  CmdHFiClassCalcNewKey,      AlwaysAvailable, "[*] Calc diversified keys (blocks 3 & 4) to write new keys"},
+    {"encode",      CmdHFiClassEncode,          AlwaysAvailable, "[*] Encode binary wiegand to block 7"},
+    {"encrypt",     CmdHFiClassEncryptBlk,      AlwaysAvailable, "[*] Encrypt given block data"},
+    {"decrypt",     CmdHFiClassDecrypt,         AlwaysAvailable, "[*] Decrypt given block data or tag dump file" },
+    {"managekeys",  CmdHFiClassManageKeys,      AlwaysAvailable, "[*] Manage keys to use with iclass commands"},
+    {"permutekey",  CmdHFiClassPermuteKey,      IfPm3Iclass,     "    Permute function from 'heart of darkness' paper"},
+    {"view",        CmdHFiClassView,            AlwaysAvailable, "[*] Display content from tag dump file"},
     {NULL, NULL, NULL, NULL}
 };
 

From 21eebd4b761e1a7d398977e2867b1da49b7a1dda Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 11 Dec 2020 00:49:18 +0100
Subject: [PATCH 002/682] hf iclass encode - now writes a block6

---
 client/src/cmdhficlass.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c
index 01b903272..2d6992845 100644
--- a/client/src/cmdhficlass.c
+++ b/client/src/cmdhficlass.c
@@ -3446,6 +3446,16 @@ static int CmdHFiClassEncode(const char *Cmd) {
             PrintAndLogEx(SUCCESS, "Write block 7/0x07 ( " _RED_("fail") " )");
             break;
     }
+    uint8_t block6[] = {0x03, 0x03, 0x03, 0x03, 0x00, 0x03, 0xE0, 0x17};
+    isok = iclass_write_block(6, block6, key, use_credit_key, elite, rawkey, false, false, auth);
+    switch (isok) {
+        case PM3_SUCCESS:
+            PrintAndLogEx(SUCCESS, "Write block 6/0x06 ( " _GREEN_("ok") " )");
+            break;
+        default:
+            PrintAndLogEx(SUCCESS, "Write block 6/0x06 ( " _RED_("fail") " )");
+            break;
+    }
     return isok;
 }
 

From 0c0cdab17d99cad2526fe7e51a40e67182a7dd0f Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 11 Dec 2020 01:02:36 +0100
Subject: [PATCH 003/682] hf iclass encode - writes a credential 6,7,8,9

---
 client/src/cmdhficlass.c | 80 +++++++++++++++++++++-------------------
 1 file changed, 42 insertions(+), 38 deletions(-)

diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c
index 2d6992845..075a5562e 100644
--- a/client/src/cmdhficlass.c
+++ b/client/src/cmdhficlass.c
@@ -3365,6 +3365,7 @@ static int CmdHFiClassEncode(const char *Cmd) {
     uint8_t enc_key[16] = {0};
     uint8_t *enckeyptr = NULL;
     bool have_enc_key = false;
+    bool use_sc = false;
     CLIGetHexWithReturn(ctx, 6, enc_key, &enc_key_len);
 
     CLIParserFree(ctx);
@@ -3387,27 +3388,33 @@ static int CmdHFiClassEncode(const char *Cmd) {
         return PM3_EINVARG;
     }
 
-    bool use_sc = IsCryptoHelperPresent(false);
-
-    if (have_enc_key == false && use_sc == false) {
-        size_t keylen = 0;
-        int res = loadFile_safe(ICLASS_DECRYPTION_BIN, "", (void **)&enckeyptr, &keylen);
-        if (res != PM3_SUCCESS) {
-            PrintAndLogEx(ERR, "Failed to find the transport key");
-            return PM3_EINVARG;
+    if (have_enc_key == false) {
+        use_sc = IsCryptoHelperPresent(false);
+        if (use_sc == false) {
+            size_t keylen = 0;
+            int res = loadFile_safe(ICLASS_DECRYPTION_BIN, "", (void **)&enckeyptr, &keylen);
+            if (res != PM3_SUCCESS) {
+                PrintAndLogEx(ERR, "Failed to find the transport key");
+                return PM3_EINVARG;
+            }
+            if (keylen != 16) {
+                PrintAndLogEx(ERR, "Failed to load transport key from file");
+                return PM3_EINVARG;
+            }
+            memcpy(enc_key, enckeyptr, sizeof(enc_key));
+            free(enckeyptr);
         }
-        if (keylen != 16) {
-            PrintAndLogEx(ERR, "Failed to load transport key from file");
-            return PM3_EINVARG;
-        }
-
-        memcpy(enc_key, enckeyptr, sizeof(enc_key));
-        free(enckeyptr);
     }
 
+    uint8_t credential[] = {
+        0x03, 0x03, 0x03, 0x03, 0x00, 0x03, 0xE0, 0x17,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    };
+
     uint8_t data[8];
     memset(data, 0, sizeof(data));
-
     BitstreamOut bout = {data, 0, 0 };
 
     for (int i = 0; i < 64 - bin_len - 1; i++) {
@@ -3427,34 +3434,31 @@ static int CmdHFiClassEncode(const char *Cmd) {
             PrintAndLogEx(WARNING, "Ignoring '%c'", c);
         }
     }
+    memcpy(credential + 8, data, sizeof(data));
 
     // encrypt with transport key
     if (use_sc) {
-        Encrypt(data, data);
+        Encrypt(credential + 8, credential + 8);
+        Encrypt(credential + 16, credential + 16);
+        Encrypt(credential + 24, credential + 24);
     } else {
-        iclass_encrypt_block_data(data, enc_key);
+        iclass_encrypt_block_data(credential + 8, enc_key);
+        iclass_encrypt_block_data(credential + 16, enc_key);
+        iclass_encrypt_block_data(credential + 24, enc_key);
     }
-    PrintAndLogEx(SUCCESS, "encrypted block: " _YELLOW_("%s"), sprint_hex_inrow(data, sizeof(data)));
 
-    // write block 7
-    int isok = iclass_write_block(7, data, key, use_credit_key, elite, rawkey, false, false, auth);
-    switch (isok) {
-        case PM3_SUCCESS:
-            PrintAndLogEx(SUCCESS, "Write block 7/0x07 ( " _GREEN_("ok") " )");
-            break;
-        default:
-            PrintAndLogEx(SUCCESS, "Write block 7/0x07 ( " _RED_("fail") " )");
-            break;
-    }
-    uint8_t block6[] = {0x03, 0x03, 0x03, 0x03, 0x00, 0x03, 0xE0, 0x17};
-    isok = iclass_write_block(6, block6, key, use_credit_key, elite, rawkey, false, false, auth);
-    switch (isok) {
-        case PM3_SUCCESS:
-            PrintAndLogEx(SUCCESS, "Write block 6/0x06 ( " _GREEN_("ok") " )");
-            break;
-        default:
-            PrintAndLogEx(SUCCESS, "Write block 6/0x06 ( " _RED_("fail") " )");
-            break;
+    int isok = PM3_SUCCESS;
+    // write
+    for (uint8_t i=0; i<4; i++) {
+        isok = iclass_write_block(6 + i, credential + (i*8), key, use_credit_key, elite, rawkey, false, false, auth);
+        switch (isok) {
+            case PM3_SUCCESS:
+                PrintAndLogEx(SUCCESS, "Write block %d/0x0%x ( " _GREEN_("ok") " )  --> " _YELLOW_("%s"), 6 + i, 6 + i, sprint_hex_inrow(credential + (i*8), 8));
+                break;
+            default:
+                PrintAndLogEx(SUCCESS, "Write block %d/0x0%x ( " _RED_("fail") " )", 6 + i, 6 + i);
+                break;
+        }
     }
     return isok;
 }

From 7a3faa7de834d8b3b5b5aa80f0a62e6d310b53c1 Mon Sep 17 00:00:00 2001
From: cyberpunk-re <tiagor2010@gmail.com>
Date: Fri, 11 Dec 2020 00:17:51 +0000
Subject: [PATCH 004/682] fix  parsing for psk

---
 CHANGELOG.md         | 1 +
 client/src/cmddata.c | 3 ++-
 common/lfdemod.c     | 5 +++++
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6c6cba7e2..2f10e9c97 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+ - Fix `data rawdemod` parsing for psk2 and user defined clock (@cyberpunk-re)
  - Fix issue #844 - `lf t55xx config` => recompute block0 (@cyberpunk-re)
  - EM4x50: changed cli parameter from w (word) to d (data) (@tharexde)
  - EM4x50: new function 4x50 login: authenticate against tag (@tharexde)
diff --git a/client/src/cmddata.c b/client/src/cmddata.c
index daff73722..9a888f311 100644
--- a/client/src/cmddata.c
+++ b/client/src/cmddata.c
@@ -1367,6 +1367,7 @@ int CmdPSK1rawDemod(const char *Cmd) {
     if (strlen(Cmd) > 16 || cmdp == 'h') return usage_data_rawdemod_p1();
     int clk = 0, invert = 0, max_err = 100;
     sscanf(Cmd, "%i %i %i", &clk, &invert, &max_err);
+
     if (clk == 1) {
         invert = 1;
         clk = 0;
@@ -1428,7 +1429,7 @@ static int CmdRawDemod(const char *Cmd) {
     else if (str_startswith(Cmd, "am")) ans = Cmdaskmandemod(Cmd + 2);
     else if (str_startswith(Cmd, "ar")) ans = Cmdaskrawdemod(Cmd + 2);
     else if (str_startswith(Cmd, "nr") || Cmd[0] == 'n') ans = CmdNRZrawDemod(Cmd + 2);
-    else if (str_startswith(Cmd, "p1") || Cmd[0] == 'p') ans = CmdPSK1rawDemod(Cmd + 2);
+    else if (str_startswith(Cmd, "p1")) ans = CmdPSK1rawDemod(Cmd + 2);
     else if (str_startswith(Cmd, "p2")) ans = CmdPSK2rawDemod(Cmd + 2);
     else PrintAndLogEx(WARNING, "Unknown modulation entered - see help ('h') for parameter structure");
 
diff --git a/common/lfdemod.c b/common/lfdemod.c
index b6869ba43..24de41676 100644
--- a/common/lfdemod.c
+++ b/common/lfdemod.c
@@ -1081,6 +1081,11 @@ int DetectPSKClock(uint8_t *dest, size_t size, int clock, size_t *firstPhaseShif
     *firstPhaseShift = firstFullWave;
     if (g_debugMode == 2) prnt("DEBUG PSK: firstFullWave: %zu, waveLen: %d", firstFullWave, fullWaveLen);
 
+    // Avoid autodetect if user selected a clock
+    for(uint8_t validClk = 1; validClk < 8; validClk++) {
+        if(clock == clk[validClk]) return(clock);
+    }
+
     //test each valid clock from greatest to smallest to see which lines up
     for (clkCnt = 7; clkCnt >= 1 ; clkCnt--) {
         uint8_t tol = *fc / 2;

From 8d594db69edee3f2372df14d18bddfefce54b3fd Mon Sep 17 00:00:00 2001
From: cyberpunk-re <tiagor2010@gmail.com>
Date: Fri, 11 Dec 2020 00:19:57 +0000
Subject: [PATCH 005/682] remove newline

---
 client/src/cmddata.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/client/src/cmddata.c b/client/src/cmddata.c
index 9a888f311..7c6fd4785 100644
--- a/client/src/cmddata.c
+++ b/client/src/cmddata.c
@@ -1367,7 +1367,6 @@ int CmdPSK1rawDemod(const char *Cmd) {
     if (strlen(Cmd) > 16 || cmdp == 'h') return usage_data_rawdemod_p1();
     int clk = 0, invert = 0, max_err = 100;
     sscanf(Cmd, "%i %i %i", &clk, &invert, &max_err);
-
     if (clk == 1) {
         invert = 1;
         clk = 0;

From bee075ad09d0abcf0e854a826bc4d8f21bd0f7d1 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sun, 6 Dec 2020 03:22:20 +0300
Subject: [PATCH 006/682] emrtd: Push initial code

Can only read EF_CardAccess currently, but has abstractions for
selecting AIDs and reading files, which was the Hard Part so far

Based heavily on mrpkey by rfidiot
---
 client/CMakeLists.txt   |   1 +
 client/Makefile         |   1 +
 client/src/cmdhf.c      |  38 ++++---
 client/src/cmdhfemrtd.c | 247 ++++++++++++++++++++++++++++++++++++++++
 client/src/cmdhfemrtd.h |  19 ++++
 5 files changed, 288 insertions(+), 18 deletions(-)
 create mode 100644 client/src/cmdhfemrtd.c
 create mode 100644 client/src/cmdhfemrtd.h

diff --git a/client/CMakeLists.txt b/client/CMakeLists.txt
index 4ea7acf36..c67104158 100644
--- a/client/CMakeLists.txt
+++ b/client/CMakeLists.txt
@@ -228,6 +228,7 @@ set (TARGET_SOURCES
         ${PM3_ROOT}/client/src/cmdhf15.c
         ${PM3_ROOT}/client/src/cmdhfcryptorf.c
         ${PM3_ROOT}/client/src/cmdhfepa.c
+        ${PM3_ROOT}/client/src/cmdhfemrtd.c
         ${PM3_ROOT}/client/src/cmdhffelica.c
         ${PM3_ROOT}/client/src/cmdhffido.c
         ${PM3_ROOT}/client/src/cmdhficlass.c
diff --git a/client/Makefile b/client/Makefile
index 9c624722c..9cfc4fc4b 100644
--- a/client/Makefile
+++ b/client/Makefile
@@ -469,6 +469,7 @@ SRCS =  aiddesfire.c \
 		cmdhf15.c \
 		cmdhfcryptorf.c \
 		cmdhfepa.c \
+		cmdhfemrtd.c \
 		cmdhffelica.c \
 		cmdhffido.c \
 		cmdhficlass.c \
diff --git a/client/src/cmdhf.c b/client/src/cmdhf.c
index fa100e13d..94985579e 100644
--- a/client/src/cmdhf.c
+++ b/client/src/cmdhf.c
@@ -23,6 +23,7 @@
 #include "cmdhf14b.h"       // ISO14443-B
 #include "cmdhf15.h"        // ISO15693
 #include "cmdhfepa.h"
+#include "cmdhfemrtd.h"     // eMRTD
 #include "cmdhflegic.h"     // LEGIC
 #include "cmdhficlass.h"    // ICLASS
 #include "cmdhfmf.h"        // CLASSIC
@@ -357,24 +358,25 @@ int CmdHFPlot(const char *Cmd) {
 static command_t CommandTable[] = {
 
     {"--------",    CmdHelp,          AlwaysAvailable, "----------------------- " _CYAN_("High Frequency") " -----------------------"},
-    {"14a",         CmdHF14A,         AlwaysAvailable, "{ ISO14443A RFIDs...               }"},
-    {"14b",         CmdHF14B,         AlwaysAvailable, "{ ISO14443B RFIDs...               }"},
-    {"15",          CmdHF15,          AlwaysAvailable, "{ ISO15693 RFIDs...                }"},
-//    {"cryptorf",    CmdHFCryptoRF,    AlwaysAvailable, "{ CryptoRF RFIDs...                }"},
-    {"epa",         CmdHFEPA,         AlwaysAvailable, "{ German Identification Card...    }"},
-    {"felica",      CmdHFFelica,      AlwaysAvailable, "{ ISO18092 / FeliCa RFIDs...       }"},
-    {"fido",        CmdHFFido,        AlwaysAvailable, "{ FIDO and FIDO2 authenticators... }"},
-    {"iclass",      CmdHFiClass,      AlwaysAvailable, "{ ICLASS RFIDs...                  }"},
-    {"legic",       CmdHFLegic,       AlwaysAvailable, "{ LEGIC RFIDs...                   }"},
-    {"lto",         CmdHFLTO,         AlwaysAvailable, "{ LTO Cartridge Memory RFIDs...    }"},
-    {"mf",          CmdHFMF,          AlwaysAvailable, "{ MIFARE RFIDs...                  }"},
-    {"mfp",         CmdHFMFP,         AlwaysAvailable, "{ MIFARE Plus RFIDs...             }"},
-    {"mfu",         CmdHFMFUltra,     AlwaysAvailable, "{ MIFARE Ultralight RFIDs...       }"},
-    {"mfdes",       CmdHFMFDes,       AlwaysAvailable, "{ MIFARE Desfire RFIDs...          }"},
-    {"st",          CmdHF_ST,         AlwaysAvailable, "{ ST Rothult RFIDs...              }"},
-    {"thinfilm",    CmdHFThinfilm,    AlwaysAvailable, "{ Thinfilm RFIDs...                }"},
-    {"topaz",       CmdHFTopaz,       AlwaysAvailable, "{ TOPAZ (NFC Type 1) RFIDs...      }"},
-    {"waveshare",   CmdHFWaveshare,   AlwaysAvailable, "{ Waveshare NFC ePaper...          }"},
+    {"14a",         CmdHF14A,         AlwaysAvailable, "{ ISO14443A RFIDs...                  }"},
+    {"14b",         CmdHF14B,         AlwaysAvailable, "{ ISO14443B RFIDs...                  }"},
+    {"15",          CmdHF15,          AlwaysAvailable, "{ ISO15693 RFIDs...                   }"},
+//    {"cryptorf",    CmdHFCryptoRF,    AlwaysAvailable, "{ CryptoRF RFIDs...                   }"},
+    {"epa",         CmdHFEPA,         AlwaysAvailable, "{ German Identification Card...       }"},
+    {"emrtd",       CmdHFeMRTD,       AlwaysAvailable, "{ Machine Readable Travel Document... }"},
+    {"felica",      CmdHFFelica,      AlwaysAvailable, "{ ISO18092 / FeliCa RFIDs...          }"},
+    {"fido",        CmdHFFido,        AlwaysAvailable, "{ FIDO and FIDO2 authenticators...    }"},
+    {"iclass",      CmdHFiClass,      AlwaysAvailable, "{ ICLASS RFIDs...                     }"},
+    {"legic",       CmdHFLegic,       AlwaysAvailable, "{ LEGIC RFIDs...                      }"},
+    {"lto",         CmdHFLTO,         AlwaysAvailable, "{ LTO Cartridge Memory RFIDs...       }"},
+    {"mf",          CmdHFMF,          AlwaysAvailable, "{ MIFARE RFIDs...                     }"},
+    {"mfp",         CmdHFMFP,         AlwaysAvailable, "{ MIFARE Plus RFIDs...                }"},
+    {"mfu",         CmdHFMFUltra,     AlwaysAvailable, "{ MIFARE Ultralight RFIDs...          }"},
+    {"mfdes",       CmdHFMFDes,       AlwaysAvailable, "{ MIFARE Desfire RFIDs...             }"},
+    {"st",          CmdHF_ST,         AlwaysAvailable, "{ ST Rothult RFIDs...                 }"},
+    {"thinfilm",    CmdHFThinfilm,    AlwaysAvailable, "{ Thinfilm RFIDs...                   }"},
+    {"topaz",       CmdHFTopaz,       AlwaysAvailable, "{ TOPAZ (NFC Type 1) RFIDs...         }"},
+    {"waveshare",   CmdHFWaveshare,   AlwaysAvailable, "{ Waveshare NFC ePaper...             }"},
     {"-----------", CmdHelp,          AlwaysAvailable, "--------------------- " _CYAN_("General") " ---------------------"},
     {"help",        CmdHelp,          AlwaysAvailable, "This help"},
     {"list",        CmdTraceList,     AlwaysAvailable,    "List protocol data in trace buffer"},
diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
new file mode 100644
index 000000000..cc27a86f1
--- /dev/null
+++ b/client/src/cmdhfemrtd.c
@@ -0,0 +1,247 @@
+//-----------------------------------------------------------------------------
+// Copyright (C) 2020 A. Ozkal
+//
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// High frequency Electronic Machine Readable Travel Document commands
+//-----------------------------------------------------------------------------
+
+#include "cmdhfemrtd.h"
+#include <ctype.h>
+#include "fileutils.h"
+#include "cmdparser.h"     // command_t
+#include "comms.h"         // clearCommandBuffer
+#include "cmdtrace.h"
+#include "cliparser.h"
+#include "crc16.h"
+#include "cmdhf14a.h"
+#include "protocols.h"     // definitions of ISO14A/7816 protocol
+#include "emv/apduinfo.h"  // GetAPDUCodeDescription
+
+#define TIMEOUT 2000
+
+static int CmdHelp(const char *Cmd);
+
+static uint16_t get_sw(uint8_t *d, uint8_t n) {
+    if (n < 2)
+        return 0;
+
+    n -= 2;
+    return d[n] * 0x0100 + d[n + 1];
+}
+
+static int select_aid(const char *select_by, const char *file_id) {
+    bool activate_field = true;
+    bool keep_field_on = true;
+    uint8_t response[PM3_CMD_DATA_SIZE];
+    int resplen = 0;
+
+    size_t file_id_len = strlen(file_id) / 2;
+
+    char cmd[50];
+    sprintf(cmd, "00A4%s0C%02lu%s", select_by, file_id_len, file_id);
+    PrintAndLogEx(INFO, "Sending: %s", cmd);
+
+    uint8_t aSELECT_AID[80];
+    int aSELECT_AID_n = 0;
+    param_gethex_to_eol(cmd, 0, aSELECT_AID, sizeof(aSELECT_AID), &aSELECT_AID_n);
+    int res = ExchangeAPDU14a(aSELECT_AID, aSELECT_AID_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
+    if (res) {
+        DropField();
+        return false;
+    }
+
+    if (resplen < 2) {
+        DropField();
+        return false;
+    }
+    PrintAndLogEx(INFO, "Resp: %s", sprint_hex(response, resplen));
+
+    uint16_t sw = get_sw(response, resplen);
+    if (sw != 0x9000) {
+        PrintAndLogEx(ERR, "Selecting Card Access aid failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
+        DropField();
+        return false;
+    }
+    return true;
+}
+
+static int asn1datalength(uint8_t *datain, int datainlen) {
+    char* dataintext = sprint_hex_inrow(datain, datainlen);
+
+    // lazy - https://stackoverflow.com/a/4214350/3286892
+    char subbuff[8];
+    memcpy(subbuff, &dataintext[2], 2);
+    subbuff[2] = '\0';
+
+    int thing = (int)strtol(subbuff, NULL, 16);
+    if (thing <= 0x7f) {
+        return thing;
+    } else if (thing == 0x81) {
+        memcpy(subbuff, &dataintext[2], 3);
+        subbuff[3] = '\0';
+        return (int)strtol(subbuff, NULL, 16);
+    } else if (thing == 0x82) {
+        memcpy(subbuff, &dataintext[2], 5);
+        subbuff[5] = '\0';
+        return (int)strtol(subbuff, NULL, 16);
+    } else if (thing == 0x83) {
+        memcpy(subbuff, &dataintext[2], 7);
+        subbuff[7] = '\0';
+        return (int)strtol(subbuff, NULL, 16);
+    }
+    return false;
+}
+
+static int asn1fieldlength(uint8_t *datain, int datainlen) {
+    char* dataintext = sprint_hex_inrow(datain, datainlen);
+
+    // lazy - https://stackoverflow.com/a/4214350/3286892
+    char subbuff[8];
+    memcpy(subbuff, &dataintext[2], 2);
+    subbuff[2] = '\0';
+
+    int thing = (int)strtol(subbuff, NULL, 16);
+    if (thing <= 0x7f) {
+        return 2;
+    } else if (thing == 0x81) {
+        return 4;
+    } else if (thing == 0x82) {
+        return 6;
+    } else if (thing == 0x83) {
+        return 8;
+    }
+    return false;
+}
+
+static int _read_binary(int offset, int bytes_to_read, uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
+    bool activate_field = false;
+    bool keep_field_on = true;
+    uint8_t response[PM3_CMD_DATA_SIZE];
+    int resplen = 0;
+
+    char cmd[50];
+    sprintf(cmd, "00B0%04i%02i", offset, bytes_to_read);
+    PrintAndLogEx(INFO, "Sending: %s", cmd);
+
+    uint8_t aREAD_BINARY[80];
+    int aREAD_BINARY_n = 0;
+    param_gethex_to_eol(cmd, 0, aREAD_BINARY, sizeof(aREAD_BINARY), &aREAD_BINARY_n);
+    int res = ExchangeAPDU14a(aREAD_BINARY, aREAD_BINARY_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
+    if (res) {
+        DropField();
+        return false;
+    }
+    PrintAndLogEx(INFO, "Resp: %s", sprint_hex(response, resplen));
+
+    // drop sw
+    memcpy(dataout, &response, resplen - 2);
+    *dataoutlen = (resplen - 2);
+
+    uint16_t sw = get_sw(response, resplen);
+    if (sw != 0x9000) {
+        PrintAndLogEx(ERR, "Reading binary failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
+        DropField();
+        return false;
+    }
+    return true;
+}
+
+static int read_file(uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
+    uint8_t response[PM3_CMD_DATA_SIZE];
+    int resplen = 0;
+    uint8_t tempresponse[PM3_CMD_DATA_SIZE];
+    int tempresplen = 0;
+
+    if (!_read_binary(0, 4, response, sizeof(response), &resplen)) {
+        return false;
+    }
+
+    int datalen = asn1datalength(response, resplen);
+    int readlen = datalen - (3 - asn1fieldlength(response, resplen) / 2);
+    int offset = 4;
+    int toread;
+
+    while (readlen > 0) {
+        toread = readlen;
+        if (readlen > 118) {
+            toread = 118;
+        }
+
+        if (!_read_binary(offset, toread, tempresponse, sizeof(tempresponse), &tempresplen)) {
+            return false;
+        }
+
+        memcpy(&response[resplen], &tempresponse, tempresplen);
+        offset += toread;
+        readlen -= toread;
+        resplen += tempresplen;
+    }
+
+    memcpy(dataout, &response, resplen);
+    *dataoutlen = resplen;
+    return true;
+}
+
+int infoHF_EMRTD(void) {
+    // const uint8_t *data
+    if (select_aid("02", "011c")) {
+        uint8_t response[PM3_CMD_DATA_SIZE];
+        int resplen = 0;
+
+        read_file(response, sizeof(response), &resplen);
+
+        PrintAndLogEx(INFO, "EF_CardAccess: %s", sprint_hex(response, resplen));
+    } else {
+        PrintAndLogEx(INFO, "PACE unsupported. Will not read EF_CardAccess.");
+    }
+
+    DropField();
+    return PM3_SUCCESS;
+}
+
+static int cmd_hf_emrtd_info(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf emrtd info",
+                  "Get info about an eMRTD",
+                  "hf emrtd info"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
+    return infoHF_EMRTD();
+}
+
+static int cmd_hf_emrtd_list(const char *Cmd) {
+    char args[128] = {0};
+    if (strlen(Cmd) == 0) {
+        snprintf(args, sizeof(args), "-t 7816");
+    } else {
+        strncpy(args, Cmd, sizeof(args) - 1);
+    }
+    return CmdTraceList(args);
+}
+
+static command_t CommandTable[] = {
+    {"help",    CmdHelp,           AlwaysAvailable, "This help"},
+    {"info",    cmd_hf_emrtd_info, IfPm3Iso14443a,  "Tag information"},
+    {"list",    cmd_hf_emrtd_list, AlwaysAvailable, "List ISO 14443A/7816 history"},
+    {NULL, NULL, NULL, NULL}
+};
+
+static int CmdHelp(const char *Cmd) {
+    (void)Cmd; // Cmd is not used so far
+    CmdsHelp(CommandTable);
+    return PM3_SUCCESS;
+}
+
+int CmdHFeMRTD(const char *Cmd) {
+    clearCommandBuffer();
+    return CmdsParse(CommandTable, Cmd);
+}
diff --git a/client/src/cmdhfemrtd.h b/client/src/cmdhfemrtd.h
new file mode 100644
index 000000000..62b0a5bce
--- /dev/null
+++ b/client/src/cmdhfemrtd.h
@@ -0,0 +1,19 @@
+//-----------------------------------------------------------------------------
+// Copyright (C) 2020 A. Ozkal
+//
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// High frequency Electronic Machine Readable Travel Document commands
+//-----------------------------------------------------------------------------
+
+#ifndef CMDHFEMRTD_H__
+#define CMDHFEMRTD_H__
+
+#include "common.h"
+
+int CmdHFeMRTD(const char *Cmd);
+
+int infoHF_EMRTD(void);
+#endif

From 2c5ab219482abb5af103d3155aac2572279a3410 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sun, 6 Dec 2020 03:39:16 +0300
Subject: [PATCH 007/682] emtrd: Switch magic numbers over to named defines

---
 client/src/cmdhfemrtd.c | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index cc27a86f1..e4a10562c 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -22,6 +22,22 @@
 
 #define TIMEOUT 2000
 
+// ISO7816 commands
+#define SELECT "A4"
+#define GET_CHALLENGE "84"
+#define READ_BINARY "B0"
+#define P1_SELECT_BY_EF "02"
+#define P1_SELECT_BY_NAME "04"
+#define P2_PROPRIETARY "0C"
+
+// File IDs
+#define EF_CARDACCESS "011C"
+#define EF_COM "011E"
+#define EF_DG1 "0101"
+
+// App IDs
+#define AID_MRTD "A0000002471001"
+
 static int CmdHelp(const char *Cmd);
 
 static uint16_t get_sw(uint8_t *d, uint8_t n) {
@@ -41,7 +57,7 @@ static int select_aid(const char *select_by, const char *file_id) {
     size_t file_id_len = strlen(file_id) / 2;
 
     char cmd[50];
-    sprintf(cmd, "00A4%s0C%02lu%s", select_by, file_id_len, file_id);
+    sprintf(cmd, "00%s%s0C%02lu%s", SELECT, select_by, file_id_len, file_id);
     PrintAndLogEx(INFO, "Sending: %s", cmd);
 
     uint8_t aSELECT_AID[80];
@@ -57,7 +73,7 @@ static int select_aid(const char *select_by, const char *file_id) {
         DropField();
         return false;
     }
-    PrintAndLogEx(INFO, "Resp: %s", sprint_hex(response, resplen));
+    PrintAndLogEx(INFO, "Response: %s", sprint_hex(response, resplen));
 
     uint16_t sw = get_sw(response, resplen);
     if (sw != 0x9000) {
@@ -123,7 +139,7 @@ static int _read_binary(int offset, int bytes_to_read, uint8_t *dataout, int max
     int resplen = 0;
 
     char cmd[50];
-    sprintf(cmd, "00B0%04i%02i", offset, bytes_to_read);
+    sprintf(cmd, "00%s%04i%02i", READ_BINARY, offset, bytes_to_read);
     PrintAndLogEx(INFO, "Sending: %s", cmd);
 
     uint8_t aREAD_BINARY[80];
@@ -134,7 +150,7 @@ static int _read_binary(int offset, int bytes_to_read, uint8_t *dataout, int max
         DropField();
         return false;
     }
-    PrintAndLogEx(INFO, "Resp: %s", sprint_hex(response, resplen));
+    PrintAndLogEx(INFO, "Response: %s", sprint_hex(response, resplen));
 
     // drop sw
     memcpy(dataout, &response, resplen - 2);
@@ -187,7 +203,7 @@ static int read_file(uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
 
 int infoHF_EMRTD(void) {
     // const uint8_t *data
-    if (select_aid("02", "011c")) {
+    if (select_aid(P1_SELECT_BY_EF, EF_CARDACCESS)) {
         uint8_t response[PM3_CMD_DATA_SIZE];
         int resplen = 0;
 

From 885f4b52fd48be8a019f8171251b6615654ea8d8 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sun, 6 Dec 2020 03:42:41 +0300
Subject: [PATCH 008/682] emrtd: Rename select_aid to select_file

---
 client/src/cmdhfemrtd.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index e4a10562c..c1dd246b1 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -48,7 +48,7 @@ static uint16_t get_sw(uint8_t *d, uint8_t n) {
     return d[n] * 0x0100 + d[n + 1];
 }
 
-static int select_aid(const char *select_by, const char *file_id) {
+static int select_file(const char *select_by, const char *file_id) {
     bool activate_field = true;
     bool keep_field_on = true;
     uint8_t response[PM3_CMD_DATA_SIZE];
@@ -60,10 +60,10 @@ static int select_aid(const char *select_by, const char *file_id) {
     sprintf(cmd, "00%s%s0C%02lu%s", SELECT, select_by, file_id_len, file_id);
     PrintAndLogEx(INFO, "Sending: %s", cmd);
 
-    uint8_t aSELECT_AID[80];
-    int aSELECT_AID_n = 0;
-    param_gethex_to_eol(cmd, 0, aSELECT_AID, sizeof(aSELECT_AID), &aSELECT_AID_n);
-    int res = ExchangeAPDU14a(aSELECT_AID, aSELECT_AID_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
+    uint8_t aSELECT_FILE[80];
+    int aSELECT_FILE_n = 0;
+    param_gethex_to_eol(cmd, 0, aSELECT_FILE, sizeof(aSELECT_FILE), &aSELECT_FILE_n);
+    int res = ExchangeAPDU14a(aSELECT_FILE, aSELECT_FILE_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
     if (res) {
         DropField();
         return false;
@@ -77,7 +77,7 @@ static int select_aid(const char *select_by, const char *file_id) {
 
     uint16_t sw = get_sw(response, resplen);
     if (sw != 0x9000) {
-        PrintAndLogEx(ERR, "Selecting Card Access aid failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
+        PrintAndLogEx(ERR, "Selecting file failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
         DropField();
         return false;
     }
@@ -203,7 +203,7 @@ static int read_file(uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
 
 int infoHF_EMRTD(void) {
     // const uint8_t *data
-    if (select_aid(P1_SELECT_BY_EF, EF_CARDACCESS)) {
+    if (select_file(P1_SELECT_BY_EF, EF_CARDACCESS)) {
         uint8_t response[PM3_CMD_DATA_SIZE];
         int resplen = 0;
 

From 84a1059d9318a017f0ba8a0e2bfc620a98c65e1c Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sun, 6 Dec 2020 04:48:38 +0300
Subject: [PATCH 009/682] emrtd: Add BAC check

---
 client/src/cmdhfemrtd.c | 41 ++++++++++++++++++++++++++++++-----------
 1 file changed, 30 insertions(+), 11 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index c1dd246b1..c43f614ce 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -48,9 +48,7 @@ static uint16_t get_sw(uint8_t *d, uint8_t n) {
     return d[n] * 0x0100 + d[n + 1];
 }
 
-static int select_file(const char *select_by, const char *file_id) {
-    bool activate_field = true;
-    bool keep_field_on = true;
+static int select_file(const char *select_by, const char *file_id, bool activate_field, bool keep_field_on) {
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
 
@@ -70,7 +68,6 @@ static int select_file(const char *select_by, const char *file_id) {
     }
 
     if (resplen < 2) {
-        DropField();
         return false;
     }
     PrintAndLogEx(INFO, "Response: %s", sprint_hex(response, resplen));
@@ -78,7 +75,6 @@ static int select_file(const char *select_by, const char *file_id) {
     uint16_t sw = get_sw(response, resplen);
     if (sw != 0x9000) {
         PrintAndLogEx(ERR, "Selecting file failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
-        DropField();
         return false;
     }
     return true;
@@ -159,7 +155,6 @@ static int _read_binary(int offset, int bytes_to_read, uint8_t *dataout, int max
     uint16_t sw = get_sw(response, resplen);
     if (sw != 0x9000) {
         PrintAndLogEx(ERR, "Reading binary failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
-        DropField();
         return false;
     }
     return true;
@@ -202,18 +197,42 @@ static int read_file(uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
 }
 
 int infoHF_EMRTD(void) {
-    // const uint8_t *data
-    if (select_file(P1_SELECT_BY_EF, EF_CARDACCESS)) {
-        uint8_t response[PM3_CMD_DATA_SIZE];
-        int resplen = 0;
+    uint8_t response[PM3_CMD_DATA_SIZE];
+    int resplen = 0;
+    // bool BAC = true;
 
+    // Select and read EF_CardAccess
+    if (select_file(P1_SELECT_BY_EF, EF_CARDACCESS, true, true)) {
         read_file(response, sizeof(response), &resplen);
-
         PrintAndLogEx(INFO, "EF_CardAccess: %s", sprint_hex(response, resplen));
     } else {
         PrintAndLogEx(INFO, "PACE unsupported. Will not read EF_CardAccess.");
     }
 
+    // Select MRTD applet
+    if (select_file(P1_SELECT_BY_NAME, AID_MRTD, false, true) == false) {
+        PrintAndLogEx(ERR, "Couldn't select the MRTD application.");
+        return PM3_ESOFT;
+    }
+
+    // Select EF_COM
+    if (select_file(P1_SELECT_BY_EF, EF_COM, false, true) == false) {
+        // BAC = true;
+        PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt auth.");
+    } else {
+        // BAC = false;
+        // Select EF_DG1
+        select_file(P1_SELECT_BY_EF, EF_DG1, false, true);
+
+        if (read_file(response, sizeof(response), &resplen) == false) {
+            // BAC = true;
+            PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt auth.");
+        } else {
+            // BAC = false;
+            PrintAndLogEx(INFO, "EF_DG1: %s", sprint_hex(response, resplen));
+        }
+    }
+
     DropField();
     return PM3_SUCCESS;
 }

From 1149c56696d13e4dfd1473c003829e2daa47bb73 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sun, 6 Dec 2020 23:52:08 +0300
Subject: [PATCH 010/682] emrtd: Add kmrz calc

---
 client/src/cmdhfemrtd.c | 48 +++++++++++++++++++++++++++++++++++++++--
 client/src/cmdhfemrtd.h |  2 +-
 2 files changed, 47 insertions(+), 3 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index c43f614ce..1be269c67 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -80,6 +80,28 @@ static int select_file(const char *select_by, const char *file_id, bool activate
     return true;
 }
 
+static char calculate_check_digit(char *data) {
+    int mrz_weight[] = {7, 3, 1};
+    int cd = 0;
+    int value = 0;
+    char d;
+
+    for (int i = 0; i < strlen(data); i++) {
+        d = data[i];
+        if ('A' <= d && d <= 'Z') {
+            value = d - 55;
+        } else if ('a' <= d && d <= 'z') {
+            value = d - 87;
+        } else if (d == '<') {
+            value = 0;
+        } else {  // Numbers
+            value = d - 48;
+        }
+        cd += value * mrz_weight[i % 3];
+    }
+    return cd % 10;
+}
+
 static int asn1datalength(uint8_t *datain, int datainlen) {
     char* dataintext = sprint_hex_inrow(datain, datainlen);
 
@@ -196,7 +218,7 @@ static int read_file(uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
     return true;
 }
 
-int infoHF_EMRTD(void) {
+int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
     // bool BAC = true;
@@ -233,6 +255,14 @@ int infoHF_EMRTD(void) {
         }
     }
 
+    char documentnumbercd = calculate_check_digit(documentnumber);
+    char dobcd = calculate_check_digit(dob);
+    char expirycd = calculate_check_digit(expiry);
+
+    char kmrz[25];
+    sprintf(kmrz, "%s%i%s%i%s%i", documentnumber, documentnumbercd, dob, dobcd, expiry, expirycd);
+    PrintAndLogEx(INFO, "kmrz: %s", kmrz);
+
     DropField();
     return PM3_SUCCESS;
 }
@@ -246,11 +276,25 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
 
     void *argtable[] = {
         arg_param_begin,
+        arg_str1("n", "documentnumber", "<number>", "9 character document number"),
+        arg_str1("d", "dateofbirth", "<number>", "date of birth in YYMMDD format"),
+        arg_str1("e", "expiry", "<number>", "expiry in YYMMDD format"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    uint8_t docnum[9];
+    uint8_t dob[6];
+    uint8_t expiry[6];
+    int docnumlen = sizeof(docnum);
+    int doblen = sizeof(dob);
+    int expirylen = sizeof(expiry);
+    CLIGetStrWithReturn(ctx, 1, docnum, &docnumlen);
+    CLIGetStrWithReturn(ctx, 2, dob, &doblen);
+    CLIGetStrWithReturn(ctx, 3, expiry, &expirylen);
+
     CLIParserFree(ctx);
-    return infoHF_EMRTD();
+    return infoHF_EMRTD((char *)docnum, (char *)dob, (char *)expiry);
 }
 
 static int cmd_hf_emrtd_list(const char *Cmd) {
diff --git a/client/src/cmdhfemrtd.h b/client/src/cmdhfemrtd.h
index 62b0a5bce..ba9e3f2b3 100644
--- a/client/src/cmdhfemrtd.h
+++ b/client/src/cmdhfemrtd.h
@@ -15,5 +15,5 @@
 
 int CmdHFeMRTD(const char *Cmd);
 
-int infoHF_EMRTD(void);
+int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry);
 #endif

From 9f6309cc23cbf5cca11720f9435871ab2ed203c3 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 7 Dec 2020 00:40:01 +0300
Subject: [PATCH 011/682] emrtd: Add kseed calc, fix kmrz calc

---
 client/src/cmdhfemrtd.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 1be269c67..91f97d001 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -19,6 +19,7 @@
 #include "cmdhf14a.h"
 #include "protocols.h"     // definitions of ISO14A/7816 protocol
 #include "emv/apduinfo.h"  // GetAPDUCodeDescription
+#include "sha1.h"          // KSeed calculation
 
 #define TIMEOUT 2000
 
@@ -254,6 +255,9 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
             PrintAndLogEx(INFO, "EF_DG1: %s", sprint_hex(response, resplen));
         }
     }
+    PrintAndLogEx(INFO, "doc: %s", documentnumber);
+    PrintAndLogEx(INFO, "dob: %s", dob);
+    PrintAndLogEx(INFO, "exp: %s", expiry);
 
     char documentnumbercd = calculate_check_digit(documentnumber);
     char dobcd = calculate_check_digit(dob);
@@ -263,6 +267,10 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     sprintf(kmrz, "%s%i%s%i%s%i", documentnumber, documentnumbercd, dob, dobcd, expiry, expirycd);
     PrintAndLogEx(INFO, "kmrz: %s", kmrz);
 
+    unsigned char kseed[20] = {0x00};
+    mbedtls_sha1((unsigned char *)kmrz, strlen(kmrz), kseed);
+    PrintAndLogEx(INFO, "kseed: %s", sprint_hex_inrow(kseed, 16));
+
     DropField();
     return PM3_SUCCESS;
 }
@@ -283,9 +291,9 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
 
-    uint8_t docnum[9];
-    uint8_t dob[6];
-    uint8_t expiry[6];
+    uint8_t docnum[10];
+    uint8_t dob[7];
+    uint8_t expiry[7];
     int docnumlen = sizeof(docnum);
     int doblen = sizeof(dob);
     int expirylen = sizeof(expiry);

From 49e4321382611d01a303f1c9ad6b78eb2aa39fb6 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 7 Dec 2020 01:17:03 +0300
Subject: [PATCH 012/682] emrtd: Get challenge

also some code "cleanup" which makes this whole shit less mem safe but
shh
---
 client/src/cmdhfemrtd.c | 60 ++++++++++++++++++++++++++++++++++-------
 1 file changed, 51 insertions(+), 9 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 91f97d001..77ce7adc8 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -151,7 +151,39 @@ static int asn1fieldlength(uint8_t *datain, int datainlen) {
     return false;
 }
 
-static int _read_binary(int offset, int bytes_to_read, uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
+static int get_challenge(int length, uint8_t *dataout, int *dataoutlen) {
+    bool activate_field = false;
+    bool keep_field_on = true;
+    uint8_t response[PM3_CMD_DATA_SIZE];
+    int resplen = 0;
+
+    char cmd[50];
+    sprintf(cmd, "00%s0000%02X", GET_CHALLENGE, length);
+    PrintAndLogEx(INFO, "Sending: %s", cmd);
+
+    uint8_t aGET_CHALLENGE[80];
+    int aGET_CHALLENGE_n = 0;
+    param_gethex_to_eol(cmd, 0, aGET_CHALLENGE, sizeof(aGET_CHALLENGE), &aGET_CHALLENGE_n);
+    int res = ExchangeAPDU14a(aGET_CHALLENGE, aGET_CHALLENGE_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
+    if (res) {
+        DropField();
+        return false;
+    }
+    PrintAndLogEx(INFO, "Response: %s", sprint_hex(response, resplen));
+
+    // drop sw
+    memcpy(dataout, &response, resplen - 2);
+    *dataoutlen = (resplen - 2);
+
+    uint16_t sw = get_sw(response, resplen);
+    if (sw != 0x9000) {
+        PrintAndLogEx(ERR, "Getting challenge failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
+        return false;
+    }
+    return true;
+}
+
+static int _read_binary(int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen) {
     bool activate_field = false;
     bool keep_field_on = true;
     uint8_t response[PM3_CMD_DATA_SIZE];
@@ -183,13 +215,13 @@ static int _read_binary(int offset, int bytes_to_read, uint8_t *dataout, int max
     return true;
 }
 
-static int read_file(uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
+static int read_file(uint8_t *dataout, int *dataoutlen) {
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
     uint8_t tempresponse[PM3_CMD_DATA_SIZE];
     int tempresplen = 0;
 
-    if (!_read_binary(0, 4, response, sizeof(response), &resplen)) {
+    if (!_read_binary(0, 4, response, &resplen)) {
         return false;
     }
 
@@ -204,7 +236,7 @@ static int read_file(uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
             toread = 118;
         }
 
-        if (!_read_binary(offset, toread, tempresponse, sizeof(tempresponse), &tempresplen)) {
+        if (!_read_binary(offset, toread, tempresponse, &tempresplen)) {
             return false;
         }
 
@@ -221,12 +253,13 @@ static int read_file(uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
 
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     uint8_t response[PM3_CMD_DATA_SIZE];
+    uint8_t challenge[8];
     int resplen = 0;
     // bool BAC = true;
 
     // Select and read EF_CardAccess
     if (select_file(P1_SELECT_BY_EF, EF_CARDACCESS, true, true)) {
-        read_file(response, sizeof(response), &resplen);
+        read_file(response, &resplen);
         PrintAndLogEx(INFO, "EF_CardAccess: %s", sprint_hex(response, resplen));
     } else {
         PrintAndLogEx(INFO, "PACE unsupported. Will not read EF_CardAccess.");
@@ -235,6 +268,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     // Select MRTD applet
     if (select_file(P1_SELECT_BY_NAME, AID_MRTD, false, true) == false) {
         PrintAndLogEx(ERR, "Couldn't select the MRTD application.");
+        DropField();
         return PM3_ESOFT;
     }
 
@@ -247,7 +281,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
         // Select EF_DG1
         select_file(P1_SELECT_BY_EF, EF_DG1, false, true);
 
-        if (read_file(response, sizeof(response), &resplen) == false) {
+        if (read_file(response, &resplen) == false) {
             // BAC = true;
             PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt auth.");
         } else {
@@ -271,6 +305,14 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     mbedtls_sha1((unsigned char *)kmrz, strlen(kmrz), kseed);
     PrintAndLogEx(INFO, "kseed: %s", sprint_hex_inrow(kseed, 16));
 
+    // Get Challenge
+    if (get_challenge(8, challenge, &resplen) == false) {
+        PrintAndLogEx(ERR, "Couldn't get challenge.");
+        DropField();
+        return PM3_ESOFT;
+    }
+    PrintAndLogEx(INFO, "challenge: %s", sprint_hex_inrow(challenge, 8));
+
     DropField();
     return PM3_SUCCESS;
 }
@@ -294,9 +336,9 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
     uint8_t docnum[10];
     uint8_t dob[7];
     uint8_t expiry[7];
-    int docnumlen = sizeof(docnum);
-    int doblen = sizeof(dob);
-    int expirylen = sizeof(expiry);
+    int docnumlen = 9;
+    int doblen = 6;
+    int expirylen = 6;
     CLIGetStrWithReturn(ctx, 1, docnum, &docnumlen);
     CLIGetStrWithReturn(ctx, 2, dob, &doblen);
     CLIGetStrWithReturn(ctx, 3, expiry, &expirylen);

From b0fb5bfff64e95ce00225d0750a78f1ecb46df2f Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 7 Dec 2020 01:38:39 +0300
Subject: [PATCH 013/682] emrtd: Reduce code repetition

---
 client/src/cmdhfemrtd.c | 83 ++++++++++++-----------------------------
 1 file changed, 23 insertions(+), 60 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 77ce7adc8..17d12e08e 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -49,20 +49,16 @@ static uint16_t get_sw(uint8_t *d, uint8_t n) {
     return d[n] * 0x0100 + d[n + 1];
 }
 
-static int select_file(const char *select_by, const char *file_id, bool activate_field, bool keep_field_on) {
+static int exchange_commands(const char *cmd, uint8_t *dataout, int *dataoutlen, bool activate_field, bool keep_field_on) {
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
 
-    size_t file_id_len = strlen(file_id) / 2;
-
-    char cmd[50];
-    sprintf(cmd, "00%s%s0C%02lu%s", SELECT, select_by, file_id_len, file_id);
     PrintAndLogEx(INFO, "Sending: %s", cmd);
 
-    uint8_t aSELECT_FILE[80];
-    int aSELECT_FILE_n = 0;
-    param_gethex_to_eol(cmd, 0, aSELECT_FILE, sizeof(aSELECT_FILE), &aSELECT_FILE_n);
-    int res = ExchangeAPDU14a(aSELECT_FILE, aSELECT_FILE_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
+    uint8_t aCMD[80];
+    int aCMD_n = 0;
+    param_gethex_to_eol(cmd, 0, aCMD, sizeof(aCMD), &aCMD_n);
+    int res = ExchangeAPDU14a(aCMD, aCMD_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
     if (res) {
         DropField();
         return false;
@@ -73,9 +69,13 @@ static int select_file(const char *select_by, const char *file_id, bool activate
     }
     PrintAndLogEx(INFO, "Response: %s", sprint_hex(response, resplen));
 
+    // drop sw
+    memcpy(dataout, &response, resplen - 2);
+    *dataoutlen = (resplen - 2);
+
     uint16_t sw = get_sw(response, resplen);
     if (sw != 0x9000) {
-        PrintAndLogEx(ERR, "Selecting file failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
+        PrintAndLogEx(ERR, "Command %s failed (%04x - %s).", cmd, sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
         return false;
     }
     return true;
@@ -151,68 +151,31 @@ static int asn1fieldlength(uint8_t *datain, int datainlen) {
     return false;
 }
 
-static int get_challenge(int length, uint8_t *dataout, int *dataoutlen) {
-    bool activate_field = false;
-    bool keep_field_on = true;
+static int select_file(const char *select_by, const char *file_id, bool activate_field, bool keep_field_on) {
+    size_t file_id_len = strlen(file_id) / 2;
+
+    // Get data even tho we'll not use it
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
 
+    char cmd[50];
+    sprintf(cmd, "00%s%s0C%02lu%s", SELECT, select_by, file_id_len, file_id);
+
+    return exchange_commands(cmd, response, &resplen, activate_field, keep_field_on);
+}
+
+static int get_challenge(int length, uint8_t *dataout, int *dataoutlen) {
     char cmd[50];
     sprintf(cmd, "00%s0000%02X", GET_CHALLENGE, length);
-    PrintAndLogEx(INFO, "Sending: %s", cmd);
 
-    uint8_t aGET_CHALLENGE[80];
-    int aGET_CHALLENGE_n = 0;
-    param_gethex_to_eol(cmd, 0, aGET_CHALLENGE, sizeof(aGET_CHALLENGE), &aGET_CHALLENGE_n);
-    int res = ExchangeAPDU14a(aGET_CHALLENGE, aGET_CHALLENGE_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
-    if (res) {
-        DropField();
-        return false;
-    }
-    PrintAndLogEx(INFO, "Response: %s", sprint_hex(response, resplen));
-
-    // drop sw
-    memcpy(dataout, &response, resplen - 2);
-    *dataoutlen = (resplen - 2);
-
-    uint16_t sw = get_sw(response, resplen);
-    if (sw != 0x9000) {
-        PrintAndLogEx(ERR, "Getting challenge failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
-        return false;
-    }
-    return true;
+    return exchange_commands(cmd, dataout, dataoutlen, false, true);
 }
 
 static int _read_binary(int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen) {
-    bool activate_field = false;
-    bool keep_field_on = true;
-    uint8_t response[PM3_CMD_DATA_SIZE];
-    int resplen = 0;
-
     char cmd[50];
     sprintf(cmd, "00%s%04i%02i", READ_BINARY, offset, bytes_to_read);
-    PrintAndLogEx(INFO, "Sending: %s", cmd);
 
-    uint8_t aREAD_BINARY[80];
-    int aREAD_BINARY_n = 0;
-    param_gethex_to_eol(cmd, 0, aREAD_BINARY, sizeof(aREAD_BINARY), &aREAD_BINARY_n);
-    int res = ExchangeAPDU14a(aREAD_BINARY, aREAD_BINARY_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
-    if (res) {
-        DropField();
-        return false;
-    }
-    PrintAndLogEx(INFO, "Response: %s", sprint_hex(response, resplen));
-
-    // drop sw
-    memcpy(dataout, &response, resplen - 2);
-    *dataoutlen = (resplen - 2);
-
-    uint16_t sw = get_sw(response, resplen);
-    if (sw != 0x9000) {
-        PrintAndLogEx(ERR, "Reading binary failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
-        return false;
-    }
-    return true;
+    return exchange_commands(cmd, dataout, dataoutlen, false, true);
 }
 
 static int read_file(uint8_t *dataout, int *dataoutlen) {

From a7478443b31c6a066528462de76c24a7ed8df901 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Wed, 9 Dec 2020 01:15:09 +0300
Subject: [PATCH 014/682] emrtd: calc kenc and kmac

---
 client/src/cmdhfemrtd.c | 45 ++++++++++++++++++++++++++++++++++++-----
 1 file changed, 40 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 17d12e08e..75aafed3b 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -11,15 +11,17 @@
 #include "cmdhfemrtd.h"
 #include <ctype.h>
 #include "fileutils.h"
-#include "cmdparser.h"     // command_t
-#include "comms.h"         // clearCommandBuffer
+#include "cmdparser.h"              // command_t
+#include "comms.h"                  // clearCommandBuffer
 #include "cmdtrace.h"
 #include "cliparser.h"
 #include "crc16.h"
 #include "cmdhf14a.h"
-#include "protocols.h"     // definitions of ISO14A/7816 protocol
-#include "emv/apduinfo.h"  // GetAPDUCodeDescription
-#include "sha1.h"          // KSeed calculation
+#include "protocols.h"              // definitions of ISO14A/7816 protocol
+#include "emv/apduinfo.h"           // GetAPDUCodeDescription
+#include "sha1.h"                   // KSeed calculation etc
+#include "mifare/desfire_crypto.h"  // des_encrypt/des_decrypt
+#include "des.h"                    // mbedtls_des_key_set_parity
 
 #define TIMEOUT 2000
 
@@ -151,6 +153,29 @@ static int asn1fieldlength(uint8_t *datain, int datainlen) {
     return false;
 }
 
+
+static void deskey(uint8_t *seed, uint8_t *type, int length, uint8_t *dataout) {
+    PrintAndLogEx(INFO, "seed: %s", sprint_hex_inrow(seed, 16));
+
+    // combine seed and type
+    uint8_t data[50];
+    memcpy(data, seed, 16);
+    memcpy(data + 16, type, 4);
+    PrintAndLogEx(INFO, "data: %s", sprint_hex_inrow(data, 20));
+
+    // SHA1 the key
+    unsigned char key[20];
+    mbedtls_sha1(data, 20, key);
+    PrintAndLogEx(INFO, "key: %s", sprint_hex_inrow(key, 20));
+
+    // Set parity bits
+    mbedtls_des_key_set_parity(key);
+    mbedtls_des_key_set_parity(key + 8);
+    PrintAndLogEx(INFO, "post-parity key: %s", sprint_hex_inrow(key, 20));
+
+    memcpy(dataout, &key, length);
+}
+
 static int select_file(const char *select_by, const char *file_id, bool activate_field, bool keep_field_on) {
     size_t file_id_len = strlen(file_id) / 2;
 
@@ -217,6 +242,11 @@ static int read_file(uint8_t *dataout, int *dataoutlen) {
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     uint8_t response[PM3_CMD_DATA_SIZE];
     uint8_t challenge[8];
+    // TODO: get these _types into a better spot
+    uint8_t KENC_type[4] = {0x00, 0x00, 0x00, 0x01};
+    uint8_t KMAC_type[4] = {0x00, 0x00, 0x00, 0x02};
+    uint8_t kenc[50];
+    uint8_t kmac[50];
     int resplen = 0;
     // bool BAC = true;
 
@@ -268,6 +298,11 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     mbedtls_sha1((unsigned char *)kmrz, strlen(kmrz), kseed);
     PrintAndLogEx(INFO, "kseed: %s", sprint_hex_inrow(kseed, 16));
 
+    deskey(kseed, KENC_type, 16, kenc);
+    deskey(kseed, KMAC_type, 16, kmac);
+    PrintAndLogEx(INFO, "kenc: %s", sprint_hex_inrow(kenc, 16));
+    PrintAndLogEx(INFO, "kmac: %s", sprint_hex_inrow(kmac, 16));
+
     // Get Challenge
     if (get_challenge(8, challenge, &resplen) == false) {
         PrintAndLogEx(ERR, "Couldn't get challenge.");

From 69be5f8b253df22ac4bc40aa26202f710ee57c98 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Wed, 9 Dec 2020 04:48:17 +0300
Subject: [PATCH 015/682] emrtd: calculate S and e_ifd

---
 client/src/cmdhfemrtd.c | 43 +++++++++++++++++++++++++++++++++++------
 1 file changed, 37 insertions(+), 6 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 75aafed3b..5840c875b 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -8,6 +8,8 @@
 // High frequency Electronic Machine Readable Travel Document commands
 //-----------------------------------------------------------------------------
 
+// This code is heavily based on mrpkey.py of RFIDIOt
+
 #include "cmdhfemrtd.h"
 #include <ctype.h>
 #include "fileutils.h"
@@ -27,6 +29,7 @@
 
 // ISO7816 commands
 #define SELECT "A4"
+#define EXTERNAL_AUTHENTICATE "82"
 #define GET_CHALLENGE "84"
 #define READ_BINARY "B0"
 #define P1_SELECT_BY_EF "02"
@@ -241,14 +244,18 @@ static int read_file(uint8_t *dataout, int *dataoutlen) {
 
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     uint8_t response[PM3_CMD_DATA_SIZE];
-    uint8_t challenge[8];
-    // TODO: get these _types into a better spot
-    uint8_t KENC_type[4] = {0x00, 0x00, 0x00, 0x01};
-    uint8_t KMAC_type[4] = {0x00, 0x00, 0x00, 0x02};
+    uint8_t rnd_ic[8];
     uint8_t kenc[50];
     uint8_t kmac[50];
     int resplen = 0;
     // bool BAC = true;
+    uint8_t S[32];
+    // TODO: Code sponsored jointly by duracell and sony
+    uint8_t rnd_ifd[8] = {0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA};
+    uint8_t k_ifd[16] = {0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA};
+    // TODO: get these _types into a better spot
+    uint8_t KENC_type[4] = {0x00, 0x00, 0x00, 0x01};
+    uint8_t KMAC_type[4] = {0x00, 0x00, 0x00, 0x02};
 
     // Select and read EF_CardAccess
     if (select_file(P1_SELECT_BY_EF, EF_CARDACCESS, true, true)) {
@@ -304,12 +311,36 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     PrintAndLogEx(INFO, "kmac: %s", sprint_hex_inrow(kmac, 16));
 
     // Get Challenge
-    if (get_challenge(8, challenge, &resplen) == false) {
+    if (get_challenge(8, rnd_ic, &resplen) == false) {
         PrintAndLogEx(ERR, "Couldn't get challenge.");
         DropField();
         return PM3_ESOFT;
     }
-    PrintAndLogEx(INFO, "challenge: %s", sprint_hex_inrow(challenge, 8));
+    PrintAndLogEx(INFO, "rnd_ic: %s", sprint_hex_inrow(rnd_ic, 8));
+
+    memcpy(S, rnd_ifd, 8);
+    memcpy(S + 8, rnd_ic, 8);
+    memcpy(S + 16, k_ifd, 16);
+
+    mbedtls_des3_context ctx;
+    mbedtls_des3_set2key_enc(&ctx, kenc);
+
+    uint8_t iv[8] = { 0x00 };
+    uint8_t e_ifd[8] = { 0x00 };
+
+    mbedtls_des3_crypt_cbc(&ctx  // des3_context
+                           , MBEDTLS_DES_ENCRYPT    // int mode
+                           , sizeof(S)              // length
+                           , iv                     // iv[8]
+                           , S                      // input
+                           , e_ifd                  // output
+                          );
+
+    // TODO: get m_ifd by ISO 9797-1 Algo 3(e_ifd, m_mac)
+    // TODO: get cmd_data by e_ifd + m_ifd
+    // TODO: iso_7816_external_authenticate(passport.ToHex(cmd_data),Kmac)
+
+    PrintAndLogEx(INFO, "S: %s", sprint_hex_inrow(S, 32));
 
     DropField();
     return PM3_SUCCESS;

From 6086ede2ed66dff1a4bf9d98fc421eaa3e0be8f3 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Thu, 10 Dec 2020 22:53:01 +0300
Subject: [PATCH 016/682] emrtd: split 3des encryption to its own func

---
 client/src/cmdhfemrtd.c | 33 ++++++++++++++++++++++-----------
 1 file changed, 22 insertions(+), 11 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 5840c875b..d941ed36c 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -156,6 +156,18 @@ static int asn1fieldlength(uint8_t *datain, int datainlen) {
     return false;
 }
 
+static void des3_encrypt(uint8_t *iv, uint8_t *key, uint8_t *input, uint8_t *output) {
+    mbedtls_des3_context ctx;
+    mbedtls_des3_set2key_enc(&ctx, key);
+
+    mbedtls_des3_crypt_cbc(&ctx  // des3_context
+                           , MBEDTLS_DES_ENCRYPT    // int mode
+                           , sizeof(input)          // length
+                           , iv                     // iv[8]
+                           , input                  // input
+                           , output                 // output
+                          );
+}
 
 static void deskey(uint8_t *seed, uint8_t *type, int length, uint8_t *dataout) {
     PrintAndLogEx(INFO, "seed: %s", sprint_hex_inrow(seed, 16));
@@ -199,6 +211,13 @@ static int get_challenge(int length, uint8_t *dataout, int *dataoutlen) {
     return exchange_commands(cmd, dataout, dataoutlen, false, true);
 }
 
+// static int external_authenticate(const char *response, int length, uint8_t *dataout, int *dataoutlen) {
+//     char cmd[50];
+//     sprintf(cmd, "00%s00%02i%02X%02i", EXTERNAL_AUTHENTICATE, length, sprint_hex_inrow(response, length), length);
+
+//     return exchange_commands(cmd, dataout, dataoutlen, false, true);
+// }
+
 static int _read_binary(int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen) {
     char cmd[50];
     sprintf(cmd, "00%s%04i%02i", READ_BINARY, offset, bytes_to_read);
@@ -322,26 +341,18 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     memcpy(S + 8, rnd_ic, 8);
     memcpy(S + 16, k_ifd, 16);
 
-    mbedtls_des3_context ctx;
-    mbedtls_des3_set2key_enc(&ctx, kenc);
+    PrintAndLogEx(INFO, "S: %s", sprint_hex_inrow(S, 32));
 
     uint8_t iv[8] = { 0x00 };
     uint8_t e_ifd[8] = { 0x00 };
 
-    mbedtls_des3_crypt_cbc(&ctx  // des3_context
-                           , MBEDTLS_DES_ENCRYPT    // int mode
-                           , sizeof(S)              // length
-                           , iv                     // iv[8]
-                           , S                      // input
-                           , e_ifd                  // output
-                          );
+    des3_encrypt(iv, kenc, S, e_ifd);
+    PrintAndLogEx(INFO, "e_ifd: %s", sprint_hex_inrow(e_ifd, 8));
 
     // TODO: get m_ifd by ISO 9797-1 Algo 3(e_ifd, m_mac)
     // TODO: get cmd_data by e_ifd + m_ifd
     // TODO: iso_7816_external_authenticate(passport.ToHex(cmd_data),Kmac)
 
-    PrintAndLogEx(INFO, "S: %s", sprint_hex_inrow(S, 32));
-
     DropField();
     return PM3_SUCCESS;
 }

From ca04c44384f827605b1d7b0517be0f22cfda50c3 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 11 Dec 2020 04:52:29 +0300
Subject: [PATCH 017/682] emrtd: Implement retail_mac and external
 authentication

---
 client/src/cmdhfemrtd.c | 98 +++++++++++++++++++++++++++++++++++------
 1 file changed, 84 insertions(+), 14 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index d941ed36c..4aa9670de 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -60,7 +60,7 @@ static int exchange_commands(const char *cmd, uint8_t *dataout, int *dataoutlen,
 
     PrintAndLogEx(INFO, "Sending: %s", cmd);
 
-    uint8_t aCMD[80];
+    uint8_t aCMD[100];
     int aCMD_n = 0;
     param_gethex_to_eol(cmd, 0, aCMD, sizeof(aCMD), &aCMD_n);
     int res = ExchangeAPDU14a(aCMD, aCMD_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
@@ -156,19 +156,76 @@ static int asn1fieldlength(uint8_t *datain, int datainlen) {
     return false;
 }
 
-static void des3_encrypt(uint8_t *iv, uint8_t *key, uint8_t *input, uint8_t *output) {
+static void des_encrypt_ecb(uint8_t *key, uint8_t *input, uint8_t *output) {
+    mbedtls_des_context ctx_enc;
+    mbedtls_des_setkey_enc(&ctx_enc, key);
+    mbedtls_des_crypt_ecb(&ctx_enc, input, output);
+    mbedtls_des_free(&ctx_enc);
+}
+
+static void des_decrypt_ecb(uint8_t *key, uint8_t *input, uint8_t *output) {
+    mbedtls_des_context ctx_dec;
+    mbedtls_des_setkey_dec(&ctx_dec, key);
+    mbedtls_des_crypt_ecb(&ctx_dec, input, output);
+    mbedtls_des_free(&ctx_dec);
+}
+
+static void des3_encrypt_cbc(uint8_t *iv, uint8_t *key, uint8_t *input, int inputlen, uint8_t *output) {
     mbedtls_des3_context ctx;
     mbedtls_des3_set2key_enc(&ctx, key);
 
     mbedtls_des3_crypt_cbc(&ctx  // des3_context
                            , MBEDTLS_DES_ENCRYPT    // int mode
-                           , sizeof(input)          // length
+                           , inputlen               // length
                            , iv                     // iv[8]
                            , input                  // input
                            , output                 // output
                           );
+    mbedtls_des3_free(&ctx);
 }
 
+static void retail_mac(uint8_t *key, uint8_t *input, uint8_t *output) {
+    // This code assumes blocklength (n) = 8, and input len of 32 chars
+    // This code takes inspirations from https://github.com/devinvenable/iso9797algorithm3
+    uint8_t k0[8];
+    uint8_t k1[8];
+    uint8_t intermediate[8] = {0x00};
+    uint8_t intermediate_des[32];
+    uint8_t block[8];
+    uint8_t message[40];
+    uint8_t padding[8] = {0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+    // Populate keys
+    memcpy(k0, key, 8);
+    memcpy(k1, key + 8, 8);
+
+    // Prepare message
+    memcpy(message, input, 32);
+    // Normally this isn't how it works, but it's what mrpkey does...
+    memcpy(message + 32, padding, 8);
+
+    // Do chaining and encryption
+    for (int i = 0; i < (sizeof(message) / 8); i++) {
+        memcpy(block, message + (i * 8), 8);
+
+        // XOR
+        for (int x = 0; x < 8; x++) {
+            intermediate[x] = intermediate[x] ^ block[x];
+        }
+
+        des_encrypt_ecb(k0, intermediate, intermediate_des);
+        memcpy(intermediate, intermediate_des, 8);
+    }
+
+
+    des_decrypt_ecb(k1, intermediate, intermediate_des);
+    memcpy(intermediate, intermediate_des, 8);
+
+    des_encrypt_ecb(k0, intermediate, intermediate_des);
+    memcpy(output, intermediate_des, 8);
+}
+
+
 static void deskey(uint8_t *seed, uint8_t *type, int length, uint8_t *dataout) {
     PrintAndLogEx(INFO, "seed: %s", sprint_hex_inrow(seed, 16));
 
@@ -211,12 +268,13 @@ static int get_challenge(int length, uint8_t *dataout, int *dataoutlen) {
     return exchange_commands(cmd, dataout, dataoutlen, false, true);
 }
 
-// static int external_authenticate(const char *response, int length, uint8_t *dataout, int *dataoutlen) {
-//     char cmd[50];
-//     sprintf(cmd, "00%s00%02i%02X%02i", EXTERNAL_AUTHENTICATE, length, sprint_hex_inrow(response, length), length);
+static int external_authenticate(uint8_t *data, int length, uint8_t *dataout, int *dataoutlen) {
+    char cmd[100];
 
-//     return exchange_commands(cmd, dataout, dataoutlen, false, true);
-// }
+    sprintf(cmd, "00%s0000%02X%s%02X", EXTERNAL_AUTHENTICATE, length, sprint_hex_inrow(data, length), length);
+
+    return exchange_commands(cmd, dataout, dataoutlen, false, true);
+}
 
 static int _read_binary(int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen) {
     char cmd[50];
@@ -344,14 +402,26 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     PrintAndLogEx(INFO, "S: %s", sprint_hex_inrow(S, 32));
 
     uint8_t iv[8] = { 0x00 };
-    uint8_t e_ifd[8] = { 0x00 };
+    uint8_t e_ifd[32] = { 0x00 };
 
-    des3_encrypt(iv, kenc, S, e_ifd);
-    PrintAndLogEx(INFO, "e_ifd: %s", sprint_hex_inrow(e_ifd, 8));
+    des3_encrypt_cbc(iv, kenc, S, sizeof(S), e_ifd);
+    PrintAndLogEx(INFO, "e_ifd: %s", sprint_hex_inrow(e_ifd, 32));
 
-    // TODO: get m_ifd by ISO 9797-1 Algo 3(e_ifd, m_mac)
-    // TODO: get cmd_data by e_ifd + m_ifd
-    // TODO: iso_7816_external_authenticate(passport.ToHex(cmd_data),Kmac)
+    uint8_t m_ifd[8] = { 0x00 };
+
+    retail_mac(kmac, e_ifd, m_ifd);
+    PrintAndLogEx(INFO, "m_ifd: %s", sprint_hex_inrow(m_ifd, 8));
+
+    uint8_t cmd_data[40];
+    memcpy(cmd_data, e_ifd, 32);
+    memcpy(cmd_data + 32, m_ifd, 8);
+
+    // Do external authentication
+    if (external_authenticate(cmd_data, sizeof(cmd_data), response, &resplen) == false) {
+        PrintAndLogEx(ERR, "Couldn't do external authentication. Did you supply the correct MRZ info?");
+        DropField();
+        return PM3_ESOFT;
+    }
 
     DropField();
     return PM3_SUCCESS;

From 332b67655c6aca4ae29054957eb0461fe239f146 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 11 Dec 2020 05:38:14 +0300
Subject: [PATCH 018/682] emrtd: Improve logging

---
 client/src/cmdhfemrtd.c | 41 +++++++++++++++++++++--------------------
 1 file changed, 21 insertions(+), 20 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 4aa9670de..3145dd6e6 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -58,7 +58,7 @@ static int exchange_commands(const char *cmd, uint8_t *dataout, int *dataoutlen,
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
 
-    PrintAndLogEx(INFO, "Sending: %s", cmd);
+    PrintAndLogEx(DEBUG, "Sending: %s", cmd);
 
     uint8_t aCMD[100];
     int aCMD_n = 0;
@@ -72,7 +72,7 @@ static int exchange_commands(const char *cmd, uint8_t *dataout, int *dataoutlen,
     if (resplen < 2) {
         return false;
     }
-    PrintAndLogEx(INFO, "Response: %s", sprint_hex(response, resplen));
+    PrintAndLogEx(DEBUG, "Response: %s", sprint_hex(response, resplen));
 
     // drop sw
     memcpy(dataout, &response, resplen - 2);
@@ -80,7 +80,7 @@ static int exchange_commands(const char *cmd, uint8_t *dataout, int *dataoutlen,
 
     uint16_t sw = get_sw(response, resplen);
     if (sw != 0x9000) {
-        PrintAndLogEx(ERR, "Command %s failed (%04x - %s).", cmd, sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
+        PrintAndLogEx(DEBUG, "Command %s failed (%04x - %s).", cmd, sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
         return false;
     }
     return true;
@@ -227,23 +227,23 @@ static void retail_mac(uint8_t *key, uint8_t *input, uint8_t *output) {
 
 
 static void deskey(uint8_t *seed, uint8_t *type, int length, uint8_t *dataout) {
-    PrintAndLogEx(INFO, "seed: %s", sprint_hex_inrow(seed, 16));
+    PrintAndLogEx(DEBUG, "seed: %s", sprint_hex_inrow(seed, 16));
 
     // combine seed and type
     uint8_t data[50];
     memcpy(data, seed, 16);
     memcpy(data + 16, type, 4);
-    PrintAndLogEx(INFO, "data: %s", sprint_hex_inrow(data, 20));
+    PrintAndLogEx(DEBUG, "data: %s", sprint_hex_inrow(data, 20));
 
     // SHA1 the key
     unsigned char key[20];
     mbedtls_sha1(data, 20, key);
-    PrintAndLogEx(INFO, "key: %s", sprint_hex_inrow(key, 20));
+    PrintAndLogEx(DEBUG, "key: %s", sprint_hex_inrow(key, 20));
 
     // Set parity bits
     mbedtls_des_key_set_parity(key);
     mbedtls_des_key_set_parity(key + 8);
-    PrintAndLogEx(INFO, "post-parity key: %s", sprint_hex_inrow(key, 20));
+    PrintAndLogEx(DEBUG, "post-parity key: %s", sprint_hex_inrow(key, 20));
 
     memcpy(dataout, &key, length);
 }
@@ -352,7 +352,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     // Select EF_COM
     if (select_file(P1_SELECT_BY_EF, EF_COM, false, true) == false) {
         // BAC = true;
-        PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt auth.");
+        PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt external authentication.");
     } else {
         // BAC = false;
         // Select EF_DG1
@@ -360,15 +360,15 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
 
         if (read_file(response, &resplen) == false) {
             // BAC = true;
-            PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt auth.");
+            PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt external authentication.");
         } else {
             // BAC = false;
             PrintAndLogEx(INFO, "EF_DG1: %s", sprint_hex(response, resplen));
         }
     }
-    PrintAndLogEx(INFO, "doc: %s", documentnumber);
-    PrintAndLogEx(INFO, "dob: %s", dob);
-    PrintAndLogEx(INFO, "exp: %s", expiry);
+    PrintAndLogEx(DEBUG, "doc: %s", documentnumber);
+    PrintAndLogEx(DEBUG, "dob: %s", dob);
+    PrintAndLogEx(DEBUG, "exp: %s", expiry);
 
     char documentnumbercd = calculate_check_digit(documentnumber);
     char dobcd = calculate_check_digit(dob);
@@ -376,16 +376,16 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
 
     char kmrz[25];
     sprintf(kmrz, "%s%i%s%i%s%i", documentnumber, documentnumbercd, dob, dobcd, expiry, expirycd);
-    PrintAndLogEx(INFO, "kmrz: %s", kmrz);
+    PrintAndLogEx(DEBUG, "kmrz: %s", kmrz);
 
     unsigned char kseed[20] = {0x00};
     mbedtls_sha1((unsigned char *)kmrz, strlen(kmrz), kseed);
-    PrintAndLogEx(INFO, "kseed: %s", sprint_hex_inrow(kseed, 16));
+    PrintAndLogEx(DEBUG, "kseed: %s", sprint_hex_inrow(kseed, 16));
 
     deskey(kseed, KENC_type, 16, kenc);
     deskey(kseed, KMAC_type, 16, kmac);
-    PrintAndLogEx(INFO, "kenc: %s", sprint_hex_inrow(kenc, 16));
-    PrintAndLogEx(INFO, "kmac: %s", sprint_hex_inrow(kmac, 16));
+    PrintAndLogEx(DEBUG, "kenc: %s", sprint_hex_inrow(kenc, 16));
+    PrintAndLogEx(DEBUG, "kmac: %s", sprint_hex_inrow(kmac, 16));
 
     // Get Challenge
     if (get_challenge(8, rnd_ic, &resplen) == false) {
@@ -393,24 +393,24 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
         DropField();
         return PM3_ESOFT;
     }
-    PrintAndLogEx(INFO, "rnd_ic: %s", sprint_hex_inrow(rnd_ic, 8));
+    PrintAndLogEx(DEBUG, "rnd_ic: %s", sprint_hex_inrow(rnd_ic, 8));
 
     memcpy(S, rnd_ifd, 8);
     memcpy(S + 8, rnd_ic, 8);
     memcpy(S + 16, k_ifd, 16);
 
-    PrintAndLogEx(INFO, "S: %s", sprint_hex_inrow(S, 32));
+    PrintAndLogEx(DEBUG, "S: %s", sprint_hex_inrow(S, 32));
 
     uint8_t iv[8] = { 0x00 };
     uint8_t e_ifd[32] = { 0x00 };
 
     des3_encrypt_cbc(iv, kenc, S, sizeof(S), e_ifd);
-    PrintAndLogEx(INFO, "e_ifd: %s", sprint_hex_inrow(e_ifd, 32));
+    PrintAndLogEx(DEBUG, "e_ifd: %s", sprint_hex_inrow(e_ifd, 32));
 
     uint8_t m_ifd[8] = { 0x00 };
 
     retail_mac(kmac, e_ifd, m_ifd);
-    PrintAndLogEx(INFO, "m_ifd: %s", sprint_hex_inrow(m_ifd, 8));
+    PrintAndLogEx(DEBUG, "m_ifd: %s", sprint_hex_inrow(m_ifd, 8));
 
     uint8_t cmd_data[40];
     memcpy(cmd_data, e_ifd, 32);
@@ -422,6 +422,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
         DropField();
         return PM3_ESOFT;
     }
+    PrintAndLogEx(INFO, "External authentication successful.");
 
     DropField();
     return PM3_SUCCESS;

From 70ecfdf50295481f1516bd94919c373566b17312 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 11 Dec 2020 06:27:47 +0300
Subject: [PATCH 019/682] emrtd: Verify rnd_ifd

---
 client/src/cmdhfemrtd.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 3145dd6e6..45f1125bd 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -184,6 +184,20 @@ static void des3_encrypt_cbc(uint8_t *iv, uint8_t *key, uint8_t *input, int inpu
     mbedtls_des3_free(&ctx);
 }
 
+static void des3_decrypt_cbc(uint8_t *iv, uint8_t *key, uint8_t *input, int inputlen, uint8_t *output) {
+    mbedtls_des3_context ctx;
+    mbedtls_des3_set2key_dec(&ctx, key);
+
+    mbedtls_des3_crypt_cbc(&ctx  // des3_context
+                           , MBEDTLS_DES_DECRYPT    // int mode
+                           , inputlen               // length
+                           , iv                     // iv[8]
+                           , input                  // input
+                           , output                 // output
+                          );
+    mbedtls_des3_free(&ctx);
+}
+
 static void retail_mac(uint8_t *key, uint8_t *input, uint8_t *output) {
     // This code assumes blocklength (n) = 8, and input len of 32 chars
     // This code takes inspirations from https://github.com/devinvenable/iso9797algorithm3
@@ -424,6 +438,15 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     }
     PrintAndLogEx(INFO, "External authentication successful.");
 
+    uint8_t dec_output[32] = { 0x00 };
+    des3_decrypt_cbc(iv, kenc, response, 32, dec_output);
+
+    if (memcmp(rnd_ifd, dec_output + 8, 8) != 0) {
+        PrintAndLogEx(ERR, "Challenge failed, rnd_ifd does not match.");
+        DropField();
+        return PM3_ESOFT;
+    }
+
     DropField();
     return PM3_SUCCESS;
 }

From ca3471ffdf9707d4fc155527284df10b9c55441a Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 11 Dec 2020 06:52:26 +0300
Subject: [PATCH 020/682] emrtd: calculate session keys

---
 client/src/cmdhfemrtd.c | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 45f1125bd..49c7b9645 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -392,7 +392,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     sprintf(kmrz, "%s%i%s%i%s%i", documentnumber, documentnumbercd, dob, dobcd, expiry, expirycd);
     PrintAndLogEx(DEBUG, "kmrz: %s", kmrz);
 
-    unsigned char kseed[20] = {0x00};
+    uint8_t kseed[16] = {0x00};
     mbedtls_sha1((unsigned char *)kmrz, strlen(kmrz), kseed);
     PrintAndLogEx(DEBUG, "kseed: %s", sprint_hex_inrow(kseed, 16));
 
@@ -440,6 +440,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
 
     uint8_t dec_output[32] = { 0x00 };
     des3_decrypt_cbc(iv, kenc, response, 32, dec_output);
+    PrintAndLogEx(DEBUG, "dec_output: %s", sprint_hex_inrow(dec_output, 32));
 
     if (memcmp(rnd_ifd, dec_output + 8, 8) != 0) {
         PrintAndLogEx(ERR, "Challenge failed, rnd_ifd does not match.");
@@ -447,6 +448,33 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
         return PM3_ESOFT;
     }
 
+    uint8_t ssc[8] = { 0x00 };
+    uint8_t ks_enc[16] = { 0x00 };
+    uint8_t ks_mac[16] = { 0x00 };
+    uint8_t k_icc[16] = { 0x00 };
+    memcpy(k_icc, dec_output + 16, 16);
+
+    // Calculate session keys
+    for (int x = 0; x < 16; x++) {
+        kseed[x] = k_ifd[x] ^ k_icc[x];
+    }
+
+    PrintAndLogEx(DEBUG, "kseed: %s", sprint_hex_inrow(kseed, 16));
+
+    deskey(kseed, KENC_type, 16, ks_enc);
+    deskey(kseed, KMAC_type, 16, ks_mac);
+
+    PrintAndLogEx(DEBUG, "ks_enc: %s", sprint_hex_inrow(ks_enc, 16));
+    PrintAndLogEx(DEBUG, "ks_mac: %s", sprint_hex_inrow(ks_mac, 16));
+
+    memcpy(ssc, rnd_ic + 4, 4);
+    memcpy(ssc + 4, rnd_ifd + 4, 4);
+
+    PrintAndLogEx(DEBUG, "ssc: %s", sprint_hex_inrow(ssc, 8));
+
+    // TODO: Secure select
+    // TODO: Secure read
+
     DropField();
     return PM3_SUCCESS;
 }

From c281895e8fe6d3fa62861bde90e8d94948465610 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 11 Dec 2020 07:59:33 +0100
Subject: [PATCH 021/682] textual

---
 CHANGELOG.md | 48 +++++++++++++++++++++++++++++-------------------
 1 file changed, 29 insertions(+), 19 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2f10e9c97..e168a0db4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,29 +4,39 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
 
 ## [unreleased][unreleased]
  - Fix `data rawdemod` parsing for psk2 and user defined clock (@cyberpunk-re)
+ - Added `hf iclass encode` - encode a wiegand binary to a encrypted credential (@iceman1001)
+ - Changed `recoverpk.py` - now tests more ECDSA curves (@doegox)
+ - Added `hf 14a apdufuzz`- a naive apdu cla/ins/p1p2/len fuzzer (@iceman1001)
+ - Fix mixed up INC/DEC in MIFARE protocol defs (@vortixdev)
+ - Added `lf em 4x70 info` - new support for ID48 transponders (@cmolson)
+ - Fix multiple coverity scan issues (@iceman1001)
+ - Added a SIO item (@iceman1001)
+ - Fix `lf hid brute` - param (@iceman1001)
+ - Changed `lf em` layouts (@iceman1001)
+ - Change many commands to cliparser (@iceman1001, @tcprst, ...)
  - Fix issue #844 - `lf t55xx config` => recompute block0 (@cyberpunk-re)
- - EM4x50: changed cli parameter from w (word) to d (data) (@tharexde)
- - EM4x50: new function 4x50 login: authenticate against tag (@tharexde)
- - EM4x50: new function 4x50 brute: guess password within a given password range (@tharexde)
- - EM4x50: new function 4x50 chk: try passwords from dictionary (without option -> T55xx default dictionary or -f user dictionary) (@tharexde)
- - EM4x50: new function 4x50 reader: read data from tag (configured data -> standard read mode), incl. option -@  (@tharexde)
- - EM4x50: new function 4x50 sim: simulate dump from file or emulator/flash (@tharexde)
- - EM4x50: new function 4x50 restore: restore dump file (bin, eml, json) onto tag  (@tharexde)
- - EM4x50: new function 4x50 esave: dump em4x50 content in emulator memory to file (bin + eml + json) (@tharexde)
- - EM4x50: new function 4x50 eload: upload em4x50 file content (bin, eml, json) to emulator memory  (@tharexde)
- - EM4x50: added LED signals (@tharexde)
- - EM4x50: added json format for 4x50 dump (@tharexde)
- - EM4x50: relocated write requests in function 4x50 wipe from device to client (@tharexde)
- - EM4x50: renamed 4x50_write_password to 4x50 writepwd (@tharexde)
- - EM4x50: all hex input parameters now have to be given in lsb format (output is still msb + lsb) (@tharexde)
- - EM4x50: changed cli parameter from a (address) to b (block) (@tharexde)
- - EM4x50: switched to cliparser for all functions (@tharexde)
- - EM4x50: stabilized and accelerated tag detection (@tharexde)
- - EM4x50: removed global tag structure on device side (@tharexde)
+ - Change `lf em 4x50` - changed cli parameter from w (word) to d (data) (@tharexde)
+ - Added `lf em 4x50 login` - authenticate against tag (@tharexde)
+ - Added `lf em 4x50 brute` - guess password within a given password range (@tharexde)
+ - Added `lf em 4x50 chk` - try passwords from dictionary (without option -> T55xx default dictionary or -f user dictionary) (@tharexde)
+ - Added `lf em 4x50 reader` - read data from tag (configured data -> standard read mode), incl. option -@  (@tharexde)
+ - Added `lf em 4x50 sim` - simulate dump from file or emulator/flash (@tharexde)
+ - Added `lf em 4x50 restore` - restore dump file (bin, eml, json) onto tag  (@tharexde)
+ - Added `lf em 4x50 esave` - dump em4x50 content in emulator memory to file (bin + eml + json) (@tharexde)
+ - Added `lf em 4x50 eload` - upload em4x50 file content (bin, eml, json) to emulator memory  (@tharexde)
+ - Changed EM4x50 - added LED signals (@tharexde)
+ - Change `lf em 4x50 dump` - now support json format (@tharexde)
+ - Change `lf em 4x50 wipe` - relocated write requests from device to client (@tharexde)
+ - Renamed `lf em 4x50 write_passwordd` -> `writepwd` (@tharexde)
+ - Change `lf em 4x50` - all hex input parameters now have to be given in lsb format (output is still msb + lsb) (@tharexde)
+ - Change `lf em 4x50` - changed cli parameter from a (address) to b (block) (@tharexde)
+ - Change `lf em 4x50` - now supports cliparser (@tharexde)
+ - Change EM4x50 - stabilized and accelerated tag detection (@tharexde)
+ - Change EM4x50 - removed global tag structure on device side (@tharexde)
  - Fix `hf 15 sim` - Added basic response to GET_SYSTEM_INFO and READBLOCK requests in order to fix iso15693 tag sim (@cyberpunk-re)
  - Added `mf mfu sim t 7 n <numreads>` - MFU emulation now supports automatic exit after <num> blocks read. (@cyberpunk-re)
  - Added T55xx Guide to assist in learning how to use the T55xx chip (@mwalker33)
- - Fix 'hf iclass wrbl' - dealing with tags in unsecured vs secured pagemode now is correct (@iceman1001)
+ - Fix `hf iclass wrbl` - dealing with tags in unsecured vs secured pagemode now is correct (@iceman1001)
  - Change many commands to cliparser (@iceman1001, @tcprst, @mwalker33,...)
  - ...
  - Change `hf iclass chk/lookup/loclass` speedups (@iceman1001)

From ac1081fdfb138e47bdbee30240cfa8cf70a3f8d6 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Fri, 11 Dec 2020 14:34:10 +0100
Subject: [PATCH 022/682] recover_pk: some more

---
 tools/recover_pk.py | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/tools/recover_pk.py b/tools/recover_pk.py
index 45b0805be..9c393a2d2 100755
--- a/tools/recover_pk.py
+++ b/tools/recover_pk.py
@@ -199,6 +199,18 @@ CURVES = {
             0xCF5AC8395BAFEB13C02DA292DDED7A83
         )
     ),
+    # ! h=4, how to handle that?
+    "secp128r2": (
+        707,
+        0xFFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFF,
+        0x3FFFFFFF7FFFFFFFBE0024720613B5A3,
+        0xD6031998D1B3BBFEBF59CC9BBFF9AEE1,
+        0x5EEEFCA380D02919DC2C6558BB6D8A5D,
+        (
+            0x7B6AA5D85E572983E6FB32A7CDEBC140,
+            0x27B6916A894D3AEE7106FE805FC34B44
+        )
+    ),
     "secp192k1": (
         711,
         0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFEE37,
@@ -210,6 +222,7 @@ CURVES = {
             0x9B2F2F6D9C5628A7844163D015BE86344082AA88D95E2F9D
         )
     ),
+    # p192
     "secp192r1": (
         409,
         0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF,
@@ -232,6 +245,7 @@ CURVES = {
             0x7E089FED7FBA344282CAFBD6F7E319F7C0B0BD59E2CA4BDB556D61A5
         )
     ),
+    # p224
     "secp224r1": (
         713,
         0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001,
@@ -254,7 +268,7 @@ CURVES = {
             0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8
         )
     ),
-    ## openssl uses the name: prime256v1.
+    # p256, openssl uses the name: prime256v1.
     "secp256r1": (
         415,
         0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF,
@@ -266,6 +280,7 @@ CURVES = {
             0x4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5
         )
     ),
+    # p384
     "secp384r1": (
         715,
         0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF,
@@ -367,6 +382,8 @@ class EllipticCurve:
             return data
         elif callable(hash):
             return hash(data)
+        elif hash == "md5":
+            return hashlib.md5(data).digest()
         elif hash == "sha1":
             return hashlib.sha1(data).digest()
         elif hash == "sha256":
@@ -381,7 +398,7 @@ class EllipticCurve:
 def guess_curvename(signature):
     l = (len(signature) // 2) & 0xfe
     if   l == 32 :
-        curves = [ "secp128r1" ]
+        curves = [ "secp128r1", "secp128r2" ]
     elif l == 48:
         curves = [ "secp192k1", "secp192r1" ]
     elif l == 56:
@@ -501,7 +518,7 @@ def selftests():
         curvenames = guess_curvename(t['samples'][1])
         recovered = set()
         for c in curvenames:
-            for h in [None, "sha1", "sha256", "sha512"]:
+            for h in [None, "md5", "sha1", "sha256", "sha512"]:
                 recovered |= recover_multiple(t['samples'][::2], t['samples'][1::2], c, alghash=h)
         if (len(recovered) == 1):
             pk = recovered.pop()
@@ -536,7 +553,7 @@ if __name__ == "__main__":
     for c in curvenames:
         print("\nAssuming curve=%s" % c)
         print("========================")
-        for h in [None, "sha1", "sha256", "sha512"]:
+        for h in [None, "md5", "sha1", "sha256", "sha512"]:
             print("Assuming hash=%s" % h)
             recovered = recover_multiple(uids, sigs, c, alghash=h)
             if recovered:

From 2f42b875e19ff56f9cdccb6f744bb3c7b771a972 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 11 Dec 2020 21:07:52 +0300
Subject: [PATCH 023/682] emrtd: Impl secure file select

---
 client/src/cmdhfemrtd.c | 97 ++++++++++++++++++++++++++++++++++++-----
 1 file changed, 87 insertions(+), 10 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 49c7b9645..ad3ff69f6 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -198,28 +198,39 @@ static void des3_decrypt_cbc(uint8_t *iv, uint8_t *key, uint8_t *input, int inpu
     mbedtls_des3_free(&ctx);
 }
 
-static void retail_mac(uint8_t *key, uint8_t *input, uint8_t *output) {
-    // This code assumes blocklength (n) = 8, and input len of 32 chars
+static int pad_block(uint8_t *input, int inputlen, uint8_t *output) {
+    uint8_t padding[8] = {0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+    memcpy(output, input, inputlen);
+
+    int to_pad = (8 - (inputlen % 8));
+
+    for (int i = 0; i < to_pad; i++) {
+        output[inputlen + i] = padding[i];
+    }
+
+    return inputlen + to_pad;
+}
+
+static void retail_mac(uint8_t *key, uint8_t *input, int inputlen, uint8_t *output) {
+    // This code assumes blocklength (n) = 8, and input len of up to 56 chars
     // This code takes inspirations from https://github.com/devinvenable/iso9797algorithm3
     uint8_t k0[8];
     uint8_t k1[8];
     uint8_t intermediate[8] = {0x00};
     uint8_t intermediate_des[32];
     uint8_t block[8];
-    uint8_t message[40];
-    uint8_t padding[8] = {0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+    uint8_t message[64];
 
     // Populate keys
     memcpy(k0, key, 8);
     memcpy(k1, key + 8, 8);
 
     // Prepare message
-    memcpy(message, input, 32);
-    // Normally this isn't how it works, but it's what mrpkey does...
-    memcpy(message + 32, padding, 8);
+    int blocksize = pad_block(input, inputlen, message);
 
     // Do chaining and encryption
-    for (int i = 0; i < (sizeof(message) / 8); i++) {
+    for (int i = 0; i < (blocksize / 8); i++) {
         memcpy(block, message + (i * 8), 8);
 
         // XOR
@@ -333,6 +344,69 @@ static int read_file(uint8_t *dataout, int *dataoutlen) {
     return true;
 }
 
+static int secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_t *file) {
+    // Get data even tho we'll not use it
+    uint8_t response[PM3_CMD_DATA_SIZE];
+    int resplen = 0;
+
+    // TODO: fix sizes
+    uint8_t iv[8] = { 0x00 };
+    char command[200];
+    uint8_t cmd[200];
+    uint8_t data[100];
+    uint8_t temp[100] = {0x0c, 0xa4, 0x02, 0x0c};
+    uint8_t temp_2[100];
+
+    PrintAndLogEx(DEBUG, "keyenc: %s", sprint_hex_inrow(kenc, 16));
+    PrintAndLogEx(DEBUG, "keymac: %s", sprint_hex_inrow(kmac, 16));
+
+    int cmdlen = pad_block(temp, 4, cmd);
+    int datalen = pad_block(file, 2, data);
+    PrintAndLogEx(DEBUG, "cmd: %s", sprint_hex_inrow(cmd, cmdlen));
+    PrintAndLogEx(DEBUG, "data: %s", sprint_hex_inrow(data, datalen));
+
+    des3_encrypt_cbc(iv, kenc, data, datalen, temp_2);
+    PrintAndLogEx(DEBUG, "temp_2: %s", sprint_hex_inrow(temp_2, datalen));
+    uint8_t do87[103] = {0x87, 0x09, 0x01};
+    memcpy(do87 + 3, temp_2, datalen);
+    PrintAndLogEx(DEBUG, "do87: %s", sprint_hex_inrow(do87, datalen + 3));
+
+    uint8_t m[153];
+    memcpy(m, cmd, cmdlen);
+    memcpy(m + cmdlen, do87, (datalen + 3));
+    PrintAndLogEx(DEBUG, "m: %s", sprint_hex_inrow(m, datalen + cmdlen + 3));
+
+    // this is hacky
+    PrintAndLogEx(DEBUG, "ssc-b: %s", sprint_hex_inrow(ssc, 8));
+    (*(ssc + 7)) += 1;
+    PrintAndLogEx(DEBUG, "ssc-a: %s", sprint_hex_inrow(ssc, 8));
+
+    uint8_t n[161];
+    memcpy(n, ssc, 8);
+    memcpy(n + 8, m, (cmdlen + datalen + 3));
+    PrintAndLogEx(DEBUG, "n: %s", sprint_hex_inrow(n, (cmdlen + datalen + 11)));
+
+    uint8_t cc[8];
+    retail_mac(kmac, n, (cmdlen + datalen + 11), cc);
+    PrintAndLogEx(DEBUG, "cc: %s", sprint_hex_inrow(cc, 8));
+
+    uint8_t do8e[10] = {0x8E, 0x08};
+    memcpy(do8e + 2, cc, 8);
+    PrintAndLogEx(DEBUG, "do8e: %s", sprint_hex_inrow(do8e, 10));
+
+    int lc = datalen + 3 + 10;
+    PrintAndLogEx(DEBUG, "lc: %i", lc);
+
+    memcpy(data, do87, datalen + 3);
+    memcpy(data + (datalen + 3), do8e, 10);
+    PrintAndLogEx(DEBUG, "data: %s", sprint_hex_inrow(data, lc));
+
+    sprintf(command, "0C%s020C%02X%s00", SELECT, lc, sprint_hex_inrow(data, lc));
+    PrintAndLogEx(DEBUG, "command: %s", command);
+
+    return exchange_commands(command, response, &resplen, false, true);
+}
+
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     uint8_t response[PM3_CMD_DATA_SIZE];
     uint8_t rnd_ic[8];
@@ -423,7 +497,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
 
     uint8_t m_ifd[8] = { 0x00 };
 
-    retail_mac(kmac, e_ifd, m_ifd);
+    retail_mac(kmac, e_ifd, 32, m_ifd);
     PrintAndLogEx(DEBUG, "m_ifd: %s", sprint_hex_inrow(m_ifd, 8));
 
     uint8_t cmd_data[40];
@@ -472,7 +546,10 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
 
     PrintAndLogEx(DEBUG, "ssc: %s", sprint_hex_inrow(ssc, 8));
 
-    // TODO: Secure select
+    // Select EF_COM
+    uint8_t file_id[2] = {0x01, 0x1E};
+    secure_select_file(ks_enc, ks_mac, ssc, file_id);
+
     // TODO: Secure read
 
     DropField();

From 831672be203bde22e23a9a1ff37fc4e65d6549de Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 11 Dec 2020 21:14:47 +0300
Subject: [PATCH 024/682] emrtd: Clean up secure select file

---
 client/src/cmdhfemrtd.c | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index ad3ff69f6..f1df87fbb 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -349,13 +349,11 @@ static int secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
 
-    // TODO: fix sizes
     uint8_t iv[8] = { 0x00 };
-    char command[200];
-    uint8_t cmd[200];
-    uint8_t data[100];
-    uint8_t temp[100] = {0x0c, 0xa4, 0x02, 0x0c};
-    uint8_t temp_2[100];
+    char command[54];
+    uint8_t cmd[8];
+    uint8_t data[21];
+    uint8_t temp[8] = {0x0c, 0xa4, 0x02, 0x0c};
 
     PrintAndLogEx(DEBUG, "keyenc: %s", sprint_hex_inrow(kenc, 16));
     PrintAndLogEx(DEBUG, "keymac: %s", sprint_hex_inrow(kmac, 16));
@@ -365,23 +363,23 @@ static int secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_
     PrintAndLogEx(DEBUG, "cmd: %s", sprint_hex_inrow(cmd, cmdlen));
     PrintAndLogEx(DEBUG, "data: %s", sprint_hex_inrow(data, datalen));
 
-    des3_encrypt_cbc(iv, kenc, data, datalen, temp_2);
-    PrintAndLogEx(DEBUG, "temp_2: %s", sprint_hex_inrow(temp_2, datalen));
-    uint8_t do87[103] = {0x87, 0x09, 0x01};
-    memcpy(do87 + 3, temp_2, datalen);
+    des3_encrypt_cbc(iv, kenc, data, datalen, temp);
+    PrintAndLogEx(DEBUG, "temp: %s", sprint_hex_inrow(temp, datalen));
+    uint8_t do87[11] = {0x87, 0x09, 0x01};
+    memcpy(do87 + 3, temp, datalen);
     PrintAndLogEx(DEBUG, "do87: %s", sprint_hex_inrow(do87, datalen + 3));
 
-    uint8_t m[153];
+    uint8_t m[19];
     memcpy(m, cmd, cmdlen);
     memcpy(m + cmdlen, do87, (datalen + 3));
     PrintAndLogEx(DEBUG, "m: %s", sprint_hex_inrow(m, datalen + cmdlen + 3));
 
-    // this is hacky
+    // TODO: this is hacky
     PrintAndLogEx(DEBUG, "ssc-b: %s", sprint_hex_inrow(ssc, 8));
     (*(ssc + 7)) += 1;
     PrintAndLogEx(DEBUG, "ssc-a: %s", sprint_hex_inrow(ssc, 8));
 
-    uint8_t n[161];
+    uint8_t n[27];
     memcpy(n, ssc, 8);
     memcpy(n + 8, m, (cmdlen + datalen + 3));
     PrintAndLogEx(DEBUG, "n: %s", sprint_hex_inrow(n, (cmdlen + datalen + 11)));

From e93a258f8802fb3b5a6ce5dfbc380436e924beb6 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 11 Dec 2020 21:17:15 +0300
Subject: [PATCH 025/682] emrtd: make style pass

---
 client/src/cmdhfemrtd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index f1df87fbb..6ac998864 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -109,7 +109,7 @@ static char calculate_check_digit(char *data) {
 }
 
 static int asn1datalength(uint8_t *datain, int datainlen) {
-    char* dataintext = sprint_hex_inrow(datain, datainlen);
+    char *dataintext = sprint_hex_inrow(datain, datainlen);
 
     // lazy - https://stackoverflow.com/a/4214350/3286892
     char subbuff[8];
@@ -136,7 +136,7 @@ static int asn1datalength(uint8_t *datain, int datainlen) {
 }
 
 static int asn1fieldlength(uint8_t *datain, int datainlen) {
-    char* dataintext = sprint_hex_inrow(datain, datainlen);
+    char *dataintext = sprint_hex_inrow(datain, datainlen);
 
     // lazy - https://stackoverflow.com/a/4214350/3286892
     char subbuff[8];

From 80c033b93b65c01e3b323c3c4f2768991b4db315 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Fri, 11 Dec 2020 19:54:46 +0100
Subject: [PATCH 026/682] added function CmdEM4x50EView

---
 client/src/cmdlfem4x50.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/client/src/cmdlfem4x50.h b/client/src/cmdlfem4x50.h
index dab84ba6c..0d5c04bc6 100644
--- a/client/src/cmdlfem4x50.h
+++ b/client/src/cmdlfem4x50.h
@@ -33,5 +33,6 @@ int CmdEM4x50Reader(const char *Cmd);
 int CmdEM4x50ELoad(const char *Cmd);
 int CmdEM4x50ESave(const char *Cmd);
 int CmdEM4x50Chk(const char *Cmd);
+int CmdEM4x50EView(const char *Cmd);
 
 #endif

From ffd1fe1dde21900e923a9da8fcb356475bcb8a90 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Fri, 11 Dec 2020 19:55:15 +0100
Subject: [PATCH 027/682] added function CmdEM4x50EView

---
 client/src/cmdlfem4x50.c | 47 ++++++++++++++++++++++++++++++++++++++--
 1 file changed, 45 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c
index ccdf30394..d57786cb6 100644
--- a/client/src/cmdlfem4x50.c
+++ b/client/src/cmdlfem4x50.c
@@ -259,6 +259,48 @@ int CmdEM4x50ESave(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
+int CmdEM4x50EView(const char *Cmd) {
+
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf em 4x50 eview",
+                  "Displays em4x50 content of emulator memory.",
+                  "lf em 4x50 eview\n"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
+
+    // download emulator memory
+    PrintAndLogEx(SUCCESS, "Reading emulator memory...");
+    uint8_t data[DUMP_FILESIZE] = {0x0};
+    if (GetFromDevice(BIG_BUF_EML, data, DUMP_FILESIZE, 0, NULL, 0, NULL, 2500, false) == false) {
+        PrintAndLogEx(WARNING, "Fail, transfer from device time-out");
+        return PM3_ETIMEOUT;
+    }
+    
+    // valid em4x50 data?
+    uint32_t serial = bytes_to_num(data + 4 * EM4X50_DEVICE_SERIAL, 4);
+    uint32_t device_id = bytes_to_num(data + 4 * EM4X50_DEVICE_ID, 4);
+    if (serial == device_id) {
+        PrintAndLogEx(WARNING, "No valid em4x50 data in emulator memory.");
+        return PM3_ENODATA;
+    }
+
+    em4x50_word_t words[EM4X50_NO_WORDS];
+    for (int i = 0; i < EM4X50_NO_WORDS; i++) {
+        memcpy(words[i].byte, data + i * 4, 4);
+    }
+    print_result(words, 0, EM4X50_NO_WORDS - 1);
+    PrintAndLogEx(NORMAL, "");
+
+    return PM3_SUCCESS;
+}
+
 int CmdEM4x50Login(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "lf em 4x50 login",
@@ -1123,8 +1165,9 @@ static command_t CommandTable[] = {
     {"reader", CmdEM4x50Reader,      IfPm3EM4x50,     "show standard read mode data of EM4x50"},
     {"restore",CmdEM4x50Restore,     IfPm3EM4x50,     "restore EM4x50 dump to tag"},
     {"sim",    CmdEM4x50Sim,         IfPm3EM4x50,     "simulate EM4x50 tag"},
-    {"eload",  CmdEM4x50ELoad,       IfPm3EM4x50,     "upload dump of EM4x50 to flash memory"},
-    {"esave",  CmdEM4x50ESave,       IfPm3EM4x50,     "save flash memory to file"},
+    {"eload",  CmdEM4x50ELoad,       IfPm3EM4x50,     "upload dump of EM4x50 to emulator memory"},
+    {"esave",  CmdEM4x50ESave,       IfPm3EM4x50,     "save emulator memory to file"},
+    {"eview",  CmdEM4x50EView,       IfPm3EM4x50,     "view EM4x50 content in emulator memory"},
     {NULL, NULL, NULL, NULL}
 };
 

From 3e2e0299ffe415e67a5404a178b993068918fa0c Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 12 Dec 2020 01:50:54 +0300
Subject: [PATCH 028/682] emrtd: Impl secure read binary

---
 client/src/cmdhfemrtd.c | 85 +++++++++++++++++++++++++++++++++++------
 1 file changed, 73 insertions(+), 12 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 6ac998864..e9a129f0d 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -256,18 +256,19 @@ static void deskey(uint8_t *seed, uint8_t *type, int length, uint8_t *dataout) {
 
     // combine seed and type
     uint8_t data[50];
-    memcpy(data, seed, 16);
-    memcpy(data + 16, type, 4);
-    PrintAndLogEx(DEBUG, "data: %s", sprint_hex_inrow(data, 20));
+    memcpy(data, seed, length);
+    memcpy(data + length, type, 4);
+    PrintAndLogEx(DEBUG, "data: %s", sprint_hex_inrow(data, length + 4));
 
     // SHA1 the key
-    unsigned char key[20];
-    mbedtls_sha1(data, 20, key);
-    PrintAndLogEx(DEBUG, "key: %s", sprint_hex_inrow(key, 20));
+    unsigned char key[64];
+    mbedtls_sha1(data, length + 4, key);
+    PrintAndLogEx(DEBUG, "key: %s", sprint_hex_inrow(key, length + 4));
 
     // Set parity bits
-    mbedtls_des_key_set_parity(key);
-    mbedtls_des_key_set_parity(key + 8);
+    for (int i = 0; i < ((length + 4) / 8); i++) {
+        mbedtls_des_key_set_parity(key + (i * 8));
+    }
     PrintAndLogEx(DEBUG, "post-parity key: %s", sprint_hex_inrow(key, 20));
 
     memcpy(dataout, &key, length);
@@ -355,9 +356,6 @@ static int secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_
     uint8_t data[21];
     uint8_t temp[8] = {0x0c, 0xa4, 0x02, 0x0c};
 
-    PrintAndLogEx(DEBUG, "keyenc: %s", sprint_hex_inrow(kenc, 16));
-    PrintAndLogEx(DEBUG, "keymac: %s", sprint_hex_inrow(kmac, 16));
-
     int cmdlen = pad_block(temp, 4, cmd);
     int datalen = pad_block(file, 2, data);
     PrintAndLogEx(DEBUG, "cmd: %s", sprint_hex_inrow(cmd, cmdlen));
@@ -402,9 +400,71 @@ static int secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_
     sprintf(command, "0C%s020C%02X%s00", SELECT, lc, sprint_hex_inrow(data, lc));
     PrintAndLogEx(DEBUG, "command: %s", command);
 
+    // TODO: Impl CC check, which will handle incrementing itself
+    (*(ssc + 7)) += 1;
+
     return exchange_commands(command, response, &resplen, false, true);
 }
 
+static int secure_read_binary(uint8_t *kmac, uint8_t *ssc, int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen) {
+    char command[54];
+    uint8_t cmd[8];
+    uint8_t data[21];
+    uint8_t temp[8] = {0x0c, 0xb0};
+
+    PrintAndLogEx(DEBUG, "kmac: %s", sprint_hex_inrow(kmac, 20));
+
+    // TODO: hacky
+    char offsethex[5];
+    sprintf(offsethex, "%04X", offset);
+    char offsetbuffer[8];
+    memcpy(offsetbuffer, offsethex, 2);
+    int p1 = (int)strtol(offsetbuffer, NULL, 16);
+    memcpy(offsetbuffer, offsethex + 2, 2);
+    int p2 = (int)strtol(offsetbuffer, NULL, 16);
+    temp[2] = p1;
+    temp[3] = p2;
+
+    int cmdlen = pad_block(temp, 4, cmd);
+    PrintAndLogEx(DEBUG, "cmd: %s", sprint_hex_inrow(cmd, cmdlen));
+
+    uint8_t do97[3] = {0x97, 0x01, bytes_to_read};
+
+    uint8_t m[11];
+    memcpy(m, cmd, 8);
+    memcpy(m + 8, do97, 3);
+
+    // TODO: this is hacky
+    PrintAndLogEx(DEBUG, "ssc-b: %s", sprint_hex_inrow(ssc, 8));
+    (*(ssc + 7)) += 1;
+    PrintAndLogEx(DEBUG, "ssc-a: %s", sprint_hex_inrow(ssc, 8));
+
+    uint8_t n[19];
+    memcpy(n, ssc, 8);
+    memcpy(n + 8, m, 11);
+    PrintAndLogEx(DEBUG, "n: %s", sprint_hex_inrow(n, 19));
+
+    uint8_t cc[8];
+    retail_mac(kmac, n, 19, cc);
+    PrintAndLogEx(DEBUG, "cc: %s", sprint_hex_inrow(cc, 8));
+
+    uint8_t do8e[10] = {0x8E, 0x08};
+    memcpy(do8e + 2, cc, 8);
+    PrintAndLogEx(DEBUG, "do8e: %s", sprint_hex_inrow(do8e, 10));
+
+    int lc = 13;
+    PrintAndLogEx(DEBUG, "lc: %i", lc);
+
+    memcpy(data, do97, 3);
+    memcpy(data + 3, do8e, 10);
+    PrintAndLogEx(DEBUG, "data: %s", sprint_hex_inrow(data, lc));
+
+    sprintf(command, "0C%s%02X%02X%02X%s00", READ_BINARY, p1, p2, lc, sprint_hex_inrow(data, lc));
+    PrintAndLogEx(DEBUG, "command: %s", command);
+
+    return exchange_commands(command, dataout, dataoutlen, false, true);
+}
+
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     uint8_t response[PM3_CMD_DATA_SIZE];
     uint8_t rnd_ic[8];
@@ -548,7 +608,8 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     uint8_t file_id[2] = {0x01, 0x1E};
     secure_select_file(ks_enc, ks_mac, ssc, file_id);
 
-    // TODO: Secure read
+    secure_read_binary(ks_mac, ssc, 0, 4, response, &resplen);
+    // TODO: impl secure read file
 
     DropField();
     return PM3_SUCCESS;

From cf3b0bcbe1d1c969ad7c3638d853911e84f0cff2 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 12 Dec 2020 04:34:16 +0300
Subject: [PATCH 029/682] emrtd: Impl check_cc

---
 client/src/cmdhfemrtd.c | 59 +++++++++++++++++++++++++++++++++++------
 1 file changed, 51 insertions(+), 8 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index e9a129f0d..ae25140e2 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -345,7 +345,41 @@ static int read_file(uint8_t *dataout, int *dataoutlen) {
     return true;
 }
 
-static int secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_t *file) {
+static bool check_cc(uint8_t *ssc, uint8_t *key, uint8_t *rapdu, int rapdulength) {
+    // https://elixi.re/i/clarkson.png
+    uint8_t k[100];
+    uint8_t cc[100];
+
+    (*(ssc + 7)) += 1;
+
+    memcpy(k, ssc, 8);
+    int length = 0;
+    int length2 = 0;
+
+    if (*(rapdu) == 0x87) {
+        length += 2 + (*(rapdu + 1));
+        memcpy(k + 8, rapdu, length);
+        PrintAndLogEx(DEBUG, "len1: %i", length);
+    }
+
+    if ((*(rapdu + length)) == 0x99) {
+        length2 += 2 + (*(rapdu + (length + 1)));
+        memcpy(k + length + 8, rapdu + length, length2);
+        PrintAndLogEx(DEBUG, "len2: %i", length2);
+    }
+
+    int klength = length + length2 + 8;
+
+    retail_mac(key, k, klength, cc);
+    PrintAndLogEx(DEBUG, "cc: %s", sprint_hex_inrow(cc, 8));
+    PrintAndLogEx(DEBUG, "rapdu: %s", sprint_hex_inrow(rapdu, rapdulength));
+    PrintAndLogEx(DEBUG, "rapdu cut: %s", sprint_hex_inrow(rapdu + (rapdulength - 8), 8));
+    PrintAndLogEx(DEBUG, "k: %s", sprint_hex_inrow(k, klength));
+
+    return memcmp(cc, rapdu + (rapdulength - 8), 8) == 0;
+}
+
+static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_t *file) {
     // Get data even tho we'll not use it
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
@@ -400,13 +434,12 @@ static int secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_
     sprintf(command, "0C%s020C%02X%s00", SELECT, lc, sprint_hex_inrow(data, lc));
     PrintAndLogEx(DEBUG, "command: %s", command);
 
-    // TODO: Impl CC check, which will handle incrementing itself
-    (*(ssc + 7)) += 1;
+    exchange_commands(command, response, &resplen, false, true);
 
-    return exchange_commands(command, response, &resplen, false, true);
+    return check_cc(ssc, kmac, response, resplen);
 }
 
-static int secure_read_binary(uint8_t *kmac, uint8_t *ssc, int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen) {
+static bool secure_read_binary(uint8_t *kmac, uint8_t *ssc, int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen) {
     char command[54];
     uint8_t cmd[8];
     uint8_t data[21];
@@ -462,7 +495,9 @@ static int secure_read_binary(uint8_t *kmac, uint8_t *ssc, int offset, int bytes
     sprintf(command, "0C%s%02X%02X%02X%s00", READ_BINARY, p1, p2, lc, sprint_hex_inrow(data, lc));
     PrintAndLogEx(DEBUG, "command: %s", command);
 
-    return exchange_commands(command, dataout, dataoutlen, false, true);
+    exchange_commands(command, dataout, dataoutlen, false, true);
+
+    return check_cc(ssc, kmac, dataout, *dataoutlen);
 }
 
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
@@ -606,9 +641,17 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
 
     // Select EF_COM
     uint8_t file_id[2] = {0x01, 0x1E};
-    secure_select_file(ks_enc, ks_mac, ssc, file_id);
+    if (secure_select_file(ks_enc, ks_mac, ssc, file_id) == false) {
+        PrintAndLogEx(ERR, "Failed to secure select EF_COM, crypto checksum check failed.");
+        DropField();
+        return PM3_ESOFT;
+    }
 
-    secure_read_binary(ks_mac, ssc, 0, 4, response, &resplen);
+    if (secure_read_binary(ks_mac, ssc, 0, 4, response, &resplen) == false) {
+        PrintAndLogEx(ERR, "Failed to read EF_COM, crypto checksum check failed.");
+        DropField();
+        return PM3_ESOFT;
+    }
     // TODO: impl secure read file
 
     DropField();

From 4c52fac9e1d6e3c7b5904d4dbb146e868611e12c Mon Sep 17 00:00:00 2001
From: Christian Molson <christian@cmolabs.org>
Date: Fri, 11 Dec 2020 23:26:17 -0500
Subject: [PATCH 030/682] EM4x70 write support

---
 armsrc/appmain.c         |   4 +
 armsrc/em4x70.c          | 305 +++++++++++++++++++++++++--------------
 armsrc/em4x70.h          |   1 +
 client/src/cmdlfem4x70.c |  74 +++++++++-
 client/src/cmdlfem4x70.h |   1 +
 include/em4x70.h         |   6 +
 include/pm3_cmd.h        |   1 +
 7 files changed, 282 insertions(+), 110 deletions(-)

diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index c4cc6aaf2..0797eaa82 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -1170,6 +1170,10 @@ static void PacketReceived(PacketCommandNG *packet) {
             em4x70_info((em4x70_data_t *)packet->data.asBytes);
             break;
         }
+        case CMD_LF_EM4X70_WRITE: {
+            em4x70_write((em4x70_data_t *)packet->data.asBytes);
+            break;
+        }
 #endif
 
 #ifdef WITH_ISO15693
diff --git a/armsrc/em4x70.c b/armsrc/em4x70.c
index 1feb448c7..843cb0978 100644
--- a/armsrc/em4x70.c
+++ b/armsrc/em4x70.c
@@ -29,20 +29,23 @@ static bool command_parity = true;
 #define EM4X70_T_TAG_DIV                   224 // Divergency Time
 #define EM4X70_T_TAG_AUTH                 4224 // Authentication Time
 #define EM4X70_T_TAG_WEE                  3072 // EEPROM write Time
-#define EM4X70_T_TAG_TWALB                 128 // Write Access Time of Lock Bits
+#define EM4X70_T_TAG_TWALB                 672 // Write Access Time of Lock Bits
 
 #define EM4X70_T_WAITING_FOR_SNGLLIW       160   // Unsure
 
 #define TICKS_PER_FC                        12 // 1 fc = 8us, 1.5us per tick = 12 ticks
 #define EM4X70_MIN_AMPLITUDE                10 // Minimum difference between a high and low signal
 
-#define EM4X70_TAG_TOLERANCE                10
+#define EM4X70_TAG_TOLERANCE                 8
 #define EM4X70_TAG_WORD                     48
 
+#define EM4X70_COMMAND_RETRIES               5 // Attempts to send/read command
+#define EM4X70_MAX_RECEIVE_LENGTH           96 // Maximum bits to expect from any command
+
 
 /**
  * These IDs are from the EM4170 datasheet
- * Some versions of the chip require a fourth
+ * Some versions of the chip require a
  * (even) parity bit, others do not
  */
 #define EM4X70_COMMAND_ID                   0x01
@@ -58,10 +61,11 @@ static uint8_t gLow  = 0;
 #define IS_HIGH(sample) (sample>gLow ? true : false)
 #define IS_LOW(sample) (sample<gHigh ? true : false)
 #define IS_TIMEOUT(timeout_ticks) (GetTicks() > timeout_ticks)
+#define TICKS_ELAPSED(start_ticks) (GetTicks() - start_ticks)
 
 
-static uint8_t bits2byte(uint8_t *bits, int length);
-static void bits2bytes(uint8_t *bits, int length, uint8_t *out);
+static uint8_t bits2byte(const uint8_t *bits, int length);
+static void bits2bytes(const uint8_t *bits, int length, uint8_t *out);
 static int em4x70_receive(uint8_t *bits);
 static bool find_listen_window(bool command);
 
@@ -135,7 +139,7 @@ static bool get_signalproperties(void) {
 
         uint32_t start_ticks = GetTicks();
         //AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
-        while (GetTicks() - start_ticks < TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD) {
+        while (TICKS_ELAPSED(start_ticks) < TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD) {
 
             volatile uint8_t sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 
@@ -197,7 +201,7 @@ static uint32_t get_pulse_length(void) {
     if (IS_TIMEOUT(timeout))
         return 0;
 
-    return GetTicks() - start_ticks;
+    return TICKS_ELAPSED(start_ticks);
 }
 
 /**
@@ -236,51 +240,50 @@ static uint32_t get_pulse_invert_length(void) {
     if (IS_TIMEOUT(timeout))
         return 0;
 
-    return GetTicks() - start_ticks;
+    return TICKS_ELAPSED(start_ticks);
 
 }
 
-static bool check_pulse_length(uint32_t pl, int length, int margin) {
+static bool check_pulse_length(uint32_t pl, int length) {
     // check if pulse length <pl> corresponds to given length <length>
-    //Dbprintf("%s: pulse length %d vs %d", __func__, pl, length * TICKS_PER_FC);
-    return ((pl >= TICKS_PER_FC * (length - margin)) & (pl <= TICKS_PER_FC * (length + margin)));
+    return ((pl >= TICKS_PER_FC * (length - EM4X70_TAG_TOLERANCE)) & (pl <= TICKS_PER_FC * (length + EM4X70_TAG_TOLERANCE)));
 }
 
-static void em4x70_send_bit(int bit) {
+static void em4x70_send_bit(bool bit) {
 
     // send single bit according to EM4170 application note and datasheet
-
     uint32_t start_ticks = GetTicks();
 
     if (bit == 0) {
 
         // disable modulation (drop the field) for 4 cycles of carrier
         LOW(GPIO_SSC_DOUT);
-        while (GetTicks() - start_ticks <= TICKS_PER_FC * 4);
+        while (TICKS_ELAPSED(start_ticks) <= TICKS_PER_FC * 4);
 
         // enable modulation (activates the field) for remaining first
         // half of bit period
         HIGH(GPIO_SSC_DOUT);
-        while (GetTicks() - start_ticks <= TICKS_PER_FC * EM4X70_T_TAG_HALF_PERIOD);
+        while (TICKS_ELAPSED(start_ticks) <= TICKS_PER_FC * EM4X70_T_TAG_HALF_PERIOD);
 
         // disable modulation for second half of bit period
         LOW(GPIO_SSC_DOUT);
-        while (GetTicks() - start_ticks <= TICKS_PER_FC * EM4X70_T_TAG_FULL_PERIOD);
+        while (TICKS_ELAPSED(start_ticks) <= TICKS_PER_FC * EM4X70_T_TAG_FULL_PERIOD);
 
     } else {
 
         // bit = "1" means disable modulation for full bit period
         LOW(GPIO_SSC_DOUT);
-        while (GetTicks() - start_ticks <= TICKS_PER_FC * EM4X70_T_TAG_FULL_PERIOD);
+        while (TICKS_ELAPSED(start_ticks) <= TICKS_PER_FC * EM4X70_T_TAG_FULL_PERIOD);
     }
-    
 }
 
-
 /**
- * em4x70_send_command
+ * em4x70_send_nibble
+ * 
+ *  sends 4 bits of data + 1 bit of parity (with_parity)
+ * 
  */
-static void em4170_send_command(uint8_t command) {
+static void em4x70_send_nibble(uint8_t nibble, bool with_parity) {
     int parity = 0;
     int msb_bit = 0;
 
@@ -290,16 +293,100 @@ static void em4170_send_command(uint8_t command) {
         msb_bit = 1;
     
     for (int i = msb_bit; i < 4; i++) {
-        int bit = (command >> (3 - i)) & 1;
+        int bit = (nibble >> (3 - i)) & 1;
         em4x70_send_bit(bit);
         parity ^= bit;
     }
 
-    if(command_parity)
+    if(with_parity)
         em4x70_send_bit(parity);
-
 }
 
+static void em4x70_send_word(const uint16_t word) {
+
+    // Split into nibbles
+    uint8_t nibbles[4];
+    uint8_t j = 0;
+    for(int i = 0; i < 2; i++) {
+        uint8_t byte = (word >> (8*i)) & 0xff;
+        nibbles[j++] = (byte >> 4) & 0xf;
+        nibbles[j++] = byte & 0xf;
+    }
+
+    // send 16 bit word with parity bits according to EM4x70 datasheet
+    // sent as 4 x nibbles (4 bits + parity)
+    for (int i = 0; i < 4; i++) {
+        em4x70_send_nibble(nibbles[i], true);
+    }
+
+    // send column parities (4 bit)
+    em4x70_send_nibble(nibbles[0] ^ nibbles[1] ^ nibbles[2] ^ nibbles[3], false);
+
+    // send final stop bit (always "0")
+    em4x70_send_bit(0);
+}
+
+static bool check_ack(void) {
+
+    // returns true if signal structue corresponds to ACK, anything else is
+    // counted as NAK (-> false)
+    uint32_t start_ticks = GetTicks();
+    while (TICKS_ELAPSED(start_ticks) < TICKS_PER_FC * 4 * EM4X70_T_TAG_FULL_PERIOD) {
+        /*
+            ACK
+              64 (48+16)
+              64 (48+16)
+            NACK
+              64 (48+16)
+              48 (32+16)
+        */
+        if (check_pulse_length(get_pulse_length(), 2 * EM4X70_T_TAG_FULL_PERIOD)) {
+
+            // The received signal is either ACK or NAK.
+            if (check_pulse_length(get_pulse_length(), 2 * EM4X70_T_TAG_FULL_PERIOD)) {
+                return true;
+            } else {
+                // It's NAK -> stop searching
+                break;
+            }
+        }
+    }
+    return false;
+}
+
+static int write(const uint16_t word, const uint8_t address) {
+
+    // writes <word> to specified <address>
+    if (find_listen_window(true)) {
+
+        // send write command
+        em4x70_send_nibble(EM4X70_COMMAND_WRITE, true);
+
+        // send address data with parity bit
+        em4x70_send_nibble(address, true);
+
+        // send data word
+        em4x70_send_word(word);
+
+        // Wait TWA 
+        WaitTicks(TICKS_PER_FC * EM4X70_T_TAG_TWA);
+
+        // look for ACK sequence
+        if (check_ack()) {
+
+            // now EM4x70 needs T0 * EM4X70_T_TAG_TWEE (EEPROM write time)
+            // for saving data and should return with ACK
+            WaitTicks(TICKS_PER_FC * EM4X70_T_TAG_WEE);
+            if (check_ack()) {
+
+                return PM3_SUCCESS;
+            }
+        }
+    }
+    return PM3_ESOFT;
+}
+
+
 static bool find_listen_window(bool command) {
     
     int cnt = 0;
@@ -311,34 +398,33 @@ static bool find_listen_window(bool command) {
         96 ( 64 + 32 )
         64 ( 32 + 16 +16 )*/
 
-        if (check_pulse_length(get_pulse_invert_length(), 80, EM4X70_TAG_TOLERANCE)) {
-            if (check_pulse_length(get_pulse_invert_length(), 80, EM4X70_TAG_TOLERANCE)) {
-                if (check_pulse_length(get_pulse_length(), 96, EM4X70_TAG_TOLERANCE)) {
-                    if (check_pulse_length(get_pulse_length(), 64, EM4X70_TAG_TOLERANCE)) {
-                        if(command) {
-                            /* Here we are after the 64 duration edge.
-                             *   em4170 says we need to wait about 48 RF clock cycles.
-                             *   depends on the delay between tag and us
-                             * 
-                             *   I've found between 4-5 quarter periods (32-40) works best
-                             */
-                            WaitTicks(TICKS_PER_FC * 5 * EM4X70_T_TAG_QUARTER_PERIOD);
-                            // Send RM Command
-                            em4x70_send_bit(0);
-                            em4x70_send_bit(0);
-                        }
-                        return true;
-                    }
+        if ( check_pulse_length(get_pulse_invert_length(), 80) &&
+             check_pulse_length(get_pulse_invert_length(), 80) &&
+             check_pulse_length(get_pulse_length(), 96) &&
+             check_pulse_length(get_pulse_length(), 64) )
+            {
+
+                if(command) {
+                    /* Here we are after the 64 duration edge.
+                        *   em4170 says we need to wait about 48 RF clock cycles.
+                        *   depends on the delay between tag and us
+                        * 
+                        *   I've found between 4-5 quarter periods (32-40) works best
+                        */
+                    WaitTicks(TICKS_PER_FC * 4 * EM4X70_T_TAG_QUARTER_PERIOD);
+                    // Send RM Command
+                    em4x70_send_bit(0);
+                    em4x70_send_bit(0);
                 }
+                return true;
             }
-        }
         cnt++;
     }
 
     return false;
 }
 
-static void bits2bytes(uint8_t *bits, int length, uint8_t *out) {
+static void bits2bytes(const uint8_t *bits, int length, uint8_t *out) {
     
     if(length%8 != 0) {
         Dbprintf("Should have a multiple of 8 bits, was sent %d", length);
@@ -348,12 +434,11 @@ static void bits2bytes(uint8_t *bits, int length, uint8_t *out) {
 
     for(int i=1; i <= num_bytes; i++) {
         out[num_bytes-i] = bits2byte(bits, 8);
-        bits+=8;
-        //Dbprintf("Read: %02X", out[num_bytes-i]);
+        bits += 8;
     } 
 }
 
-static uint8_t bits2byte(uint8_t *bits, int length) {
+static uint8_t bits2byte(const uint8_t *bits, int length) {
 
     // converts <length> separate bits into a single "byte"
     uint8_t byte = 0;
@@ -368,22 +453,27 @@ static uint8_t bits2byte(uint8_t *bits, int length) {
     return byte;
 }
 
-/*static void print_array(uint8_t *bits, int len) {
-
-    if(len%8 != 0) {
-        Dbprintf("Should have a multiple of 8 bits, was sent %d", len);
-    }
+static bool send_command_and_read(uint8_t command, uint8_t resp_len_bits, uint8_t *out_bytes) {
     
-    int num_bytes = len / 8; // We should have a multiple of 8 here
+    int retries = EM4X70_COMMAND_RETRIES;
+    while(retries) {
+        retries--;
 
-    uint8_t bytes[8];
-
-    for(int i=0;i<num_bytes;i++) {
-        bytes[i] = bits2byte(bits, 8);
-        bits+=8;
-        Dbprintf("Read: %02X", bytes[i]);
+        if(find_listen_window(true)) {
+            uint8_t bits[EM4X70_MAX_RECEIVE_LENGTH] = {0};
+            em4x70_send_nibble(command, command_parity);
+            int len = em4x70_receive(bits);
+            if(len < resp_len_bits) {
+                Dbprintf("Invalid data received length: %d", len);
+                return false;
+            }
+            bits2bytes(bits, len, out_bytes);
+            return true;
+        }
     }
-}*/
+    return false;
+}
+
 
 
 /**
@@ -393,18 +483,8 @@ static uint8_t bits2byte(uint8_t *bits, int length) {
  */ 
 static bool em4x70_read_id(void) {
 
-    if(find_listen_window(true)) {
-        uint8_t bits[64] = {0};
-        em4170_send_command(EM4X70_COMMAND_ID);
-        int num = em4x70_receive(bits);
-        if(num < 32) {
-            Dbprintf("Invalid ID Received");
-            return false;
-        }
-        bits2bytes(bits, num, &tag.data[4]);
-        return true;
-    }
-    return false;
+    return send_command_and_read(EM4X70_COMMAND_ID, 32, &tag.data[4]);
+
 }
 
 /**
@@ -413,18 +493,9 @@ static bool em4x70_read_id(void) {
  *  read user memory 1 (4 bytes including lock bits)
  */
 static bool em4x70_read_um1(void) {
-    if(find_listen_window(true)) {
-        uint8_t bits[64] = {0};
-        em4170_send_command(EM4X70_COMMAND_UM1);
-        int num = em4x70_receive(bits);
-        if(num < 32) {
-            Dbprintf("Invalid UM1 data received");
-            return false;
-        }
-        bits2bytes(bits, num, &tag.data[0]);
-        return true;
-    }
-    return false;
+
+    return send_command_and_read(EM4X70_COMMAND_UM1, 32, &tag.data[0]);
+
 }
 
 
@@ -434,22 +505,12 @@ static bool em4x70_read_um1(void) {
  *  read user memory 2 (8 bytes)
  */
 static bool em4x70_read_um2(void) {
-    if(find_listen_window(true)) {
-        uint8_t bits[64] = {0};
-        em4170_send_command(EM4X70_COMMAND_UM2);
-        int num = em4x70_receive(bits);
-        if(num < 64) {
-            Dbprintf("Invalid UM2 data received");
-            return false;
-        }
-        bits2bytes(bits, num, &tag.data[24]);
-        return true;
-    }
-    return false;
+
+    return send_command_and_read(EM4X70_COMMAND_UM2, 64, &tag.data[24]);
+
 }
 
 static bool find_EM4X70_Tag(void) {
-    Dbprintf("%s: Start", __func__);
     // function is used to check wether a tag on the proxmark is an
     // EM4170 tag or not -> speed up "lf search" process
     return find_listen_window(false);
@@ -460,8 +521,6 @@ static int em4x70_receive(uint8_t *bits) {
     uint32_t pl;
     int bit_pos = 0;
     uint8_t edge = 0;
-
-    
     bool foundheader = false;
 
     // Read out the header
@@ -476,7 +535,7 @@ static int em4x70_receive(uint8_t *bits) {
     while(pulse_count < 12){
         pl = get_pulse_invert_length();
         pulse_count++;
-        if(check_pulse_length(pl, 3 * EM4X70_T_TAG_HALF_PERIOD, EM4X70_TAG_TOLERANCE)) {
+        if(check_pulse_length(pl, 3 * EM4X70_T_TAG_HALF_PERIOD)) {
             foundheader = true;
             break;
         }
@@ -494,19 +553,19 @@ static int em4x70_receive(uint8_t *bits) {
 
     // identify remaining bits based on pulse lengths
     // between two listen windows only pulse lengths of 1, 1.5 and 2 are possible
-    while (true) {
+    while (bit_pos < EM4X70_MAX_RECEIVE_LENGTH) {
 
         if(edge)
             pl = get_pulse_length();
         else
             pl = get_pulse_invert_length();
 
-        if (check_pulse_length(pl, EM4X70_T_TAG_FULL_PERIOD, EM4X70_T_TAG_QUARTER_PERIOD)) {
+        if (check_pulse_length(pl, EM4X70_T_TAG_FULL_PERIOD)) {
 
             // pulse length = 1
             bits[bit_pos++] = edge;
 
-        } else if (check_pulse_length(pl, 3 * EM4X70_T_TAG_HALF_PERIOD, EM4X70_T_TAG_QUARTER_PERIOD)) {
+        } else if (check_pulse_length(pl, 3 * EM4X70_T_TAG_HALF_PERIOD)) {
 
             // pulse length = 1.5 -> flip edge detection
             if(edge) {
@@ -519,7 +578,7 @@ static int em4x70_receive(uint8_t *bits) {
                 edge = 1;
             }
 
-        } else if (check_pulse_length(pl, 2 * EM4X70_T_TAG_FULL_PERIOD, EM4X70_T_TAG_QUARTER_PERIOD)) {
+        } else if (check_pulse_length(pl, 2 * EM4X70_T_TAG_FULL_PERIOD)) {
 
             // pulse length of 2
             if(edge) {
@@ -530,15 +589,16 @@ static int em4x70_receive(uint8_t *bits) {
                 bits[bit_pos++] = 0;
             }
 
-        } else if ( (edge && check_pulse_length(pl, 3 * EM4X70_T_TAG_FULL_PERIOD, EM4X70_T_TAG_QUARTER_PERIOD)) ||
-                    (!edge && check_pulse_length(pl, 80, EM4X70_T_TAG_QUARTER_PERIOD))) {
+        } else if ( (edge && check_pulse_length(pl, 3 * EM4X70_T_TAG_FULL_PERIOD)) ||
+                    (!edge && check_pulse_length(pl, 80))) {
 
             // LIW detected (either invert or normal)
             return --bit_pos;
         }
     }
-    return bit_pos;
 
+    // Should not get here
+    return --bit_pos;
 }
 
 void em4x70_info(em4x70_data_t *etd) {
@@ -561,3 +621,34 @@ void em4x70_info(em4x70_data_t *etd) {
     lf_finalize();
     reply_ng(CMD_LF_EM4X70_INFO, status, tag.data, sizeof(tag.data));
 }
+
+void em4x70_write(em4x70_data_t *etd) {
+
+    uint8_t status = 0;
+
+    command_parity = etd->parity;
+
+    init_tag();
+    EM4170_setup_read();
+
+    // Find the Tag
+    if (get_signalproperties() && find_EM4X70_Tag()) {
+        
+        // Write
+        status = write(etd->word, etd->address) == PM3_SUCCESS;
+
+        if(status) {
+            // Read Tag after writing
+            em4x70_read_id();
+            em4x70_read_um1();
+            em4x70_read_um2();
+        }
+
+    }
+
+    StopTicks();
+    lf_finalize();
+    reply_ng(CMD_LF_EM4X70_WRITE, status, tag.data, sizeof(tag.data));
+}
+
+
diff --git a/armsrc/em4x70.h b/armsrc/em4x70.h
index 80fd977a9..63a06136d 100644
--- a/armsrc/em4x70.h
+++ b/armsrc/em4x70.h
@@ -18,5 +18,6 @@ typedef struct {
 } em4x70_tag_t;
 
 void em4x70_info(em4x70_data_t *etd);
+void em4x70_write(em4x70_data_t *etd);
 
 #endif /* EM4x70_H */
diff --git a/client/src/cmdlfem4x70.c b/client/src/cmdlfem4x70.c
index ae0b3ad22..b3bd192b1 100644
--- a/client/src/cmdlfem4x70.c
+++ b/client/src/cmdlfem4x70.c
@@ -16,6 +16,9 @@
 #include "commonutil.h"
 #include "em4x70.h"
 
+#define BYTES2UINT16(x) ((x[1] << 8) | (x[0]))
+#define BYTES2UINT32(x) ((x[3] << 24) | (x[2] << 16) | (x[1] << 8) | (x[0]))
+
 
 static int CmdHelp(const char *Cmd);
 
@@ -33,7 +36,7 @@ static void print_info_result(uint8_t *data) {
         PrintAndLogEx(NORMAL, "%02X %02X", data[32-i], data[32-i-1]);
     }
     PrintAndLogEx(NORMAL, "Tag ID: %02X %02X %02X %02X", data[7], data[6], data[5], data[4]);
-    PrintAndLogEx(NORMAL, "Lockbit 0: %d", (data[3] & 0x40) ? 1:0);
+    PrintAndLogEx(NORMAL, "Lockbit 0: %d %s", (data[3] & 0x40) ? 1:0, (data[3] & 0x40) ? "LOCKED":"UNLOCKED");
     PrintAndLogEx(NORMAL, "Lockbit 1: %d", (data[3] & 0x80) ? 1:0);
     PrintAndLogEx(NORMAL, "");
 
@@ -83,7 +86,7 @@ int CmdEM4x70Info(const char *Cmd) {
                   "  ID48 does not use command parity (default).\n"
                   "  V4070 and EM4170 do require parity bit.",
                   "lf em 4x70 info\n"
-                  "lf em 4x70 -p -> adds parity bit to commands\n"
+                  "lf em 4x70 info -p -> adds parity bit to command\n"
                 );
 
     void *argtable[] = {
@@ -114,9 +117,74 @@ int CmdEM4x70Info(const char *Cmd) {
     return PM3_ESOFT;
 }
 
+int CmdEM4x70Write(const char *Cmd) {
+
+    // write one block/word (16 bits) to the tag at given block address (0-15)
+    em4x70_data_t etd = {0};
+
+    CLIParserContext *ctx;
+
+    CLIParserInit(&ctx, "lf em 4x10 write",
+                  "Write EM4x70\n",
+                  "lf em 4x70 write -b 15 d c0de -> write 'c0de' to block 15\n"
+                  "lf em 4x70 write -p -b 15 -d c0de -> adds parity bit to commands\n"
+                );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0("p", "parity", "Add parity bit when sending commands"),
+        arg_int1("b", "block",  "<dec>", "block/word address, dec"),
+        arg_str1("d", "data",   "<hex>", "data, 2 bytes"),
+        arg_param_end
+    };
+
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    
+    etd.parity = arg_get_lit(ctx, 1);
+    
+    int addr = arg_get_int(ctx, 2);
+    
+    int word_len = 0;
+    uint8_t word[2] = {0x0};
+    CLIGetHexWithReturn(ctx, 3, word, &word_len);
+
+    CLIParserFree(ctx);
+
+    if (addr < 0 || addr >= EM4X70_NUM_BLOCKS) {
+        PrintAndLogEx(FAILED, "block has to be within range [0, 15]");
+        return PM3_EINVARG;
+    } 
+    
+    if (word_len != 2) {
+        PrintAndLogEx(FAILED, "word/data length must be 2 bytes instead of %d", word_len);
+        return PM3_EINVARG;
+    }
+
+    etd.address = (uint8_t) addr;
+    etd.word = BYTES2UINT16(word);;
+
+    clearCommandBuffer();
+    SendCommandNG(CMD_LF_EM4X70_WRITE, (uint8_t *)&etd, sizeof(etd));
+
+    PacketResponseNG resp;
+    if (!WaitForResponseTimeout(CMD_LF_EM4X70_WRITE, &resp, TIMEOUT)) {
+        PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
+        return PM3_ETIMEOUT;
+    }
+
+    if (resp.status) {
+        print_info_result(resp.data.asBytes);
+        return PM3_SUCCESS;
+    }
+
+    PrintAndLogEx(FAILED, "Writing " _RED_("Failed"));
+    return PM3_ESOFT;
+}
+
 static command_t CommandTable[] = {
     {"help",   CmdHelp,         AlwaysAvailable, "This help"},
-    {"info",   CmdEM4x70Info,   IfPm3EM4x70,     "tag information EM4x70"},
+    {"info",   CmdEM4x70Info,   IfPm3EM4x70,     "Tag information EM4x70"},
+    {"write",  CmdEM4x70Write,  IfPm3EM4x70,     "Write EM4x70"},
     {NULL, NULL, NULL, NULL}
 };
 
diff --git a/client/src/cmdlfem4x70.h b/client/src/cmdlfem4x70.h
index a529678e7..a6adb83d5 100644
--- a/client/src/cmdlfem4x70.h
+++ b/client/src/cmdlfem4x70.h
@@ -18,6 +18,7 @@
 
 int CmdLFEM4X70(const char *Cmd);
 int CmdEM4x70Info(const char *Cmd);
+int CmdEM4x70Write(const char *Cmd);
 
 int em4x70_info(void);
 bool detect_4x70_block(void);
diff --git a/include/em4x70.h b/include/em4x70.h
index 503b5f2e8..47e8acdce 100644
--- a/include/em4x70.h
+++ b/include/em4x70.h
@@ -11,8 +11,14 @@
 #ifndef EM4X70_H__
 #define EM4X70_H__
 
+#define EM4X70_NUM_BLOCKS 16
+
 typedef struct {
     bool parity;
+
+    // Used for writing address
+    uint8_t address;
+    uint16_t word;
 } em4x70_data_t;
 
 #endif /* EM4X70_H__ */
diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h
index 217a468e2..9f2f7f0c1 100644
--- a/include/pm3_cmd.h
+++ b/include/pm3_cmd.h
@@ -517,6 +517,7 @@ typedef struct {
 #define CMD_LF_EM4X50_ESET                                                0x0252
 #define CMD_LF_EM4X50_CHK                                                 0x0253
 #define CMD_LF_EM4X70_INFO                                                0x0260
+#define CMD_LF_EM4X70_WRITE                                               0x0261
 // Sampling configuration for LF reader/sniffer
 #define CMD_LF_SAMPLING_SET_CONFIG                                        0x021D
 #define CMD_LF_FSK_SIMULATE                                               0x021E

From ed8c63a4f4ee45cb92330736f4c6476fff6ad105 Mon Sep 17 00:00:00 2001
From: Christian Molson <christian@cmolabs.org>
Date: Sat, 12 Dec 2020 01:20:26 -0500
Subject: [PATCH 031/682] EM4x70 Unlock support. Send pin code to unlock tag.

---
 armsrc/appmain.c         |  4 ++
 armsrc/em4x70.c          | 80 ++++++++++++++++++++++++++++++++++++++++
 armsrc/em4x70.h          |  1 +
 client/src/cmdlfem4x70.c | 72 +++++++++++++++++++++++++++++++++---
 client/src/cmdlfem4x70.h |  1 +
 include/em4x70.h         |  4 ++
 include/pm3_cmd.h        |  1 +
 7 files changed, 157 insertions(+), 6 deletions(-)

diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index 0797eaa82..e7d6fae8d 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -1174,6 +1174,10 @@ static void PacketReceived(PacketCommandNG *packet) {
             em4x70_write((em4x70_data_t *)packet->data.asBytes);
             break;
         }
+        case CMD_LF_EM4X70_UNLOCK: {
+            em4x70_unlock((em4x70_data_t *)packet->data.asBytes);
+            break;
+        }
 #endif
 
 #ifdef WITH_ISO15693
diff --git a/armsrc/em4x70.c b/armsrc/em4x70.c
index 843cb0978..0b6cf36e6 100644
--- a/armsrc/em4x70.c
+++ b/armsrc/em4x70.c
@@ -302,6 +302,12 @@ static void em4x70_send_nibble(uint8_t nibble, bool with_parity) {
         em4x70_send_bit(parity);
 }
 
+static void em4x70_send_byte(uint8_t byte) {
+    // Send byte msb first
+    for (int i = 0; i < 8; i++)
+        em4x70_send_bit((byte >> (7 - i)) & 1);
+}
+
 static void em4x70_send_word(const uint16_t word) {
 
     // Split into nibbles
@@ -354,6 +360,47 @@ static bool check_ack(void) {
     return false;
 }
 
+static int send_pin(const uint32_t pin) {
+
+    // sends pin code for unlocking
+    if (find_listen_window(true)) {
+
+        // send PIN command
+        em4x70_send_nibble(EM4X70_COMMAND_PIN, true);
+
+        // --> Send TAG ID (bytes 4-7)
+        for(int i=0; i < 4; i++) {
+            em4x70_send_byte(tag.data[7-i]);
+        }
+
+        // --> Send PIN
+        for(int i=0; i < 4 ; i++) {
+            em4x70_send_byte((pin>>(i*8)) & 0xff);
+        }
+
+        // Wait TWALB (write access lock bits)
+        WaitTicks(TICKS_PER_FC * EM4X70_T_TAG_TWALB);
+
+        // <-- Receive ACK
+        if (check_ack()) {
+
+            // <w> Writes Lock Bits
+            WaitTicks(TICKS_PER_FC * EM4X70_T_TAG_WEE);
+            // <-- Receive header + ID
+            uint8_t tag_id[64];
+            int num  = em4x70_receive(tag_id);
+            if(num < 32) {
+                Dbprintf("Invalid ID Received");
+                return PM3_ESOFT;
+            }
+            bits2bytes(tag_id, num, &tag.data[4]);
+            return PM3_SUCCESS;
+        }
+    }
+
+    return PM3_ESOFT;
+}
+
 static int write(const uint16_t word, const uint8_t address) {
 
     // writes <word> to specified <address>
@@ -651,4 +698,37 @@ void em4x70_write(em4x70_data_t *etd) {
     reply_ng(CMD_LF_EM4X70_WRITE, status, tag.data, sizeof(tag.data));
 }
 
+void em4x70_unlock(em4x70_data_t *etd) {
+
+    uint8_t status = 0;
+
+    command_parity = etd->parity;
+
+    init_tag();
+    EM4170_setup_read();
+
+    // Find the Tag
+    if (get_signalproperties() && find_EM4X70_Tag()) {
+        
+        // Read ID (required for send_pin command)
+        if(em4x70_read_id()) {
+            
+            // Send PIN
+            status = send_pin(etd->pin) == PM3_SUCCESS;
+
+            // If the write succeeded, read the rest of the tag
+            if(status) {
+                // Read Tag
+                // ID doesn't change
+                em4x70_read_um1();
+                em4x70_read_um2();
+            }
+        }
+    }
+
+    StopTicks();
+    lf_finalize();
+    reply_ng(CMD_LF_EM4X70_UNLOCK, status, tag.data, sizeof(tag.data));
+}
+
 
diff --git a/armsrc/em4x70.h b/armsrc/em4x70.h
index 63a06136d..2d9f077f8 100644
--- a/armsrc/em4x70.h
+++ b/armsrc/em4x70.h
@@ -19,5 +19,6 @@ typedef struct {
 
 void em4x70_info(em4x70_data_t *etd);
 void em4x70_write(em4x70_data_t *etd);
+void em4x70_unlock(em4x70_data_t *etd);
 
 #endif /* EM4x70_H */
diff --git a/client/src/cmdlfem4x70.c b/client/src/cmdlfem4x70.c
index b3bd192b1..0b9a18785 100644
--- a/client/src/cmdlfem4x70.c
+++ b/client/src/cmdlfem4x70.c
@@ -86,12 +86,12 @@ int CmdEM4x70Info(const char *Cmd) {
                   "  ID48 does not use command parity (default).\n"
                   "  V4070 and EM4170 do require parity bit.",
                   "lf em 4x70 info\n"
-                  "lf em 4x70 info -p -> adds parity bit to command\n"
+                  "lf em 4x70 info -x -> adds parity bit to command\n"
                 );
 
     void *argtable[] = {
         arg_param_begin,
-        arg_lit0("p", "parity", "Add parity bit when sending commands"),
+        arg_lit0("x", "parity", "Add parity bit when sending commands"),
         arg_param_end
     };
 
@@ -104,7 +104,7 @@ int CmdEM4x70Info(const char *Cmd) {
 
     PacketResponseNG resp;
     if (!WaitForResponseTimeout(CMD_LF_EM4X70_INFO, &resp, TIMEOUT)) {
-        PrintAndLogEx(WARNING, "timeout while waiting for reply.");
+        PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
         return PM3_ETIMEOUT;
     }
 
@@ -113,7 +113,7 @@ int CmdEM4x70Info(const char *Cmd) {
         return PM3_SUCCESS;
     }
 
-    PrintAndLogEx(FAILED, "reading tag " _RED_("failed"));
+    PrintAndLogEx(FAILED, "Reading " _RED_("Failed"));
     return PM3_ESOFT;
 }
 
@@ -127,12 +127,12 @@ int CmdEM4x70Write(const char *Cmd) {
     CLIParserInit(&ctx, "lf em 4x10 write",
                   "Write EM4x70\n",
                   "lf em 4x70 write -b 15 d c0de -> write 'c0de' to block 15\n"
-                  "lf em 4x70 write -p -b 15 -d c0de -> adds parity bit to commands\n"
+                  "lf em 4x70 write -x -b 15 -d c0de -> adds parity bit to commands\n"
                 );
 
     void *argtable[] = {
         arg_param_begin,
-        arg_lit0("p", "parity", "Add parity bit when sending commands"),
+        arg_lit0("x", "parity", "Add parity bit when sending commands"),
         arg_int1("b", "block",  "<dec>", "block/word address, dec"),
         arg_str1("d", "data",   "<hex>", "data, 2 bytes"),
         arg_param_end
@@ -181,10 +181,70 @@ int CmdEM4x70Write(const char *Cmd) {
     return PM3_ESOFT;
 }
 
+int CmdEM4x70Unlock(const char *Cmd) {
+
+    // send pin code to device, unlocking it for writing
+    em4x70_data_t etd = {0};
+
+    CLIParserContext *ctx;
+
+    CLIParserInit(&ctx, "lf em 4x10 unlock",
+                  "Unlock EM4x70 by sending PIN\n"
+                  "Default pin may be:\n"
+                  " AAAAAAAA\n"
+                  " 00000000\n",
+                  "lf em 4x70 unlock -p 11223344 -> Unlock with PIN\n"
+                  "lf em 4x70 unlock -x -p 11223344 -> Unlock with PIN using parity commands\n"
+                );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0("x", "parity", "Add parity bit when sending commands"),
+        arg_str1("p", "pin", "<hex>", "pin, 4 bytes"),
+        arg_param_end
+    };
+
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    
+    etd.parity = arg_get_lit(ctx, 1);
+    
+    int pin_len = 0;
+    uint8_t pin[4] = {0x0};
+    
+    CLIGetHexWithReturn(ctx, 2, pin, &pin_len);
+
+    CLIParserFree(ctx);
+
+    if (pin_len != 4) {
+        PrintAndLogEx(FAILED, "PIN length must be 4 bytes instead of %d", pin_len);
+        return PM3_EINVARG;
+    }
+
+    etd.pin = BYTES2UINT32(pin);
+
+    clearCommandBuffer();
+    SendCommandNG(CMD_LF_EM4X70_UNLOCK, (uint8_t *)&etd, sizeof(etd));
+
+    PacketResponseNG resp;
+    if (!WaitForResponseTimeout(CMD_LF_EM4X70_UNLOCK, &resp, TIMEOUT)) {
+        PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
+        return PM3_ETIMEOUT;
+    }
+
+    if (resp.status) {
+        print_info_result(resp.data.asBytes);
+        return PM3_SUCCESS;
+    }
+
+    PrintAndLogEx(FAILED, "Unlocking tag " _RED_("failed"));
+    return PM3_ESOFT;
+}
+
 static command_t CommandTable[] = {
     {"help",   CmdHelp,         AlwaysAvailable, "This help"},
     {"info",   CmdEM4x70Info,   IfPm3EM4x70,     "Tag information EM4x70"},
     {"write",  CmdEM4x70Write,  IfPm3EM4x70,     "Write EM4x70"},
+    {"unlock", CmdEM4x70Unlock, IfPm3EM4x70,     "Unlock EM4x70 for writing"},
     {NULL, NULL, NULL, NULL}
 };
 
diff --git a/client/src/cmdlfem4x70.h b/client/src/cmdlfem4x70.h
index a6adb83d5..3f7930673 100644
--- a/client/src/cmdlfem4x70.h
+++ b/client/src/cmdlfem4x70.h
@@ -19,6 +19,7 @@
 int CmdLFEM4X70(const char *Cmd);
 int CmdEM4x70Info(const char *Cmd);
 int CmdEM4x70Write(const char *Cmd);
+int CmdEM4x70Unlock(const char *Cmd);
 
 int em4x70_info(void);
 bool detect_4x70_block(void);
diff --git a/include/em4x70.h b/include/em4x70.h
index 47e8acdce..a9d94403d 100644
--- a/include/em4x70.h
+++ b/include/em4x70.h
@@ -19,6 +19,10 @@ typedef struct {
     // Used for writing address
     uint8_t address;
     uint16_t word;
+
+    // PIN to unlock
+    uint32_t pin;
+
 } em4x70_data_t;
 
 #endif /* EM4X70_H__ */
diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h
index 9f2f7f0c1..f5585f192 100644
--- a/include/pm3_cmd.h
+++ b/include/pm3_cmd.h
@@ -518,6 +518,7 @@ typedef struct {
 #define CMD_LF_EM4X50_CHK                                                 0x0253
 #define CMD_LF_EM4X70_INFO                                                0x0260
 #define CMD_LF_EM4X70_WRITE                                               0x0261
+#define CMD_LF_EM4X70_UNLOCK                                              0x0262
 // Sampling configuration for LF reader/sniffer
 #define CMD_LF_SAMPLING_SET_CONFIG                                        0x021D
 #define CMD_LF_FSK_SIMULATE                                               0x021E

From aaa4c7ac4fd5df216ff1ae39f0996833fab6de7c Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Sat, 12 Dec 2020 13:37:21 +0100
Subject: [PATCH 032/682] magic doc

---
 doc/magic_cards_notes.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/doc/magic_cards_notes.md b/doc/magic_cards_notes.md
index 4f9cb2f68..9e4cdce12 100644
--- a/doc/magic_cards_notes.md
+++ b/doc/magic_cards_notes.md
@@ -426,6 +426,12 @@ Note: it seems some cards only accept the "change UID" command.
 
 It accepts direct read of block0 (and only block0) without prior auth.
 
+Writing to block 0 has some side-effects:
+
+* It changes also the UID. Changing the UID *does not* change block 0.
+* ATQA and SAK bytes are automatically replaced by fixed values.
+* On 4-byte UID cards, BCC byte is automatically corrected.
+
 ### Characteristics
 
 * UID: 4b and 7b versions
@@ -452,6 +458,8 @@ Equivalent:
 ```
 # change just UID:
 hf 14a raw -s -c  -t 2000  90FBCCCC07 11223344556677
+# read block0:
+hf 14a raw -s -c 3000
 # write block0:
 hf 14a raw -s -c  -t 2000  90F0CCCC10 041219c3219316984200e32000000000
 # lock (uid/block0?) forever:

From 7b7698843f28be549dd2fe47521e1e42c51d5ccc Mon Sep 17 00:00:00 2001
From: Christian Molson <christian@cmolabs.org>
Date: Sat, 12 Dec 2020 08:29:33 -0500
Subject: [PATCH 033/682] EM4x70 fix info text, update parity options to use
 long options only

---
 client/src/cmdlfem4x70.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/client/src/cmdlfem4x70.c b/client/src/cmdlfem4x70.c
index 0b9a18785..2c845b377 100644
--- a/client/src/cmdlfem4x70.c
+++ b/client/src/cmdlfem4x70.c
@@ -80,18 +80,18 @@ int CmdEM4x70Info(const char *Cmd) {
 
     CLIParserContext *ctx;
 
-    CLIParserInit(&ctx, "lf em 4x10 info",
+    CLIParserInit(&ctx, "lf em 4x70 info",
                   "Tag Information EM4x70\n"
                   "  Tag variants include ID48 automotive transponder.\n"
                   "  ID48 does not use command parity (default).\n"
                   "  V4070 and EM4170 do require parity bit.",
                   "lf em 4x70 info\n"
-                  "lf em 4x70 info -x -> adds parity bit to command\n"
+                  "lf em 4x70 info --par -> adds parity bit to command\n"
                 );
 
     void *argtable[] = {
         arg_param_begin,
-        arg_lit0("x", "parity", "Add parity bit when sending commands"),
+        arg_lit0(NULL, "par", "Add parity bit when sending commands"),
         arg_param_end
     };
 
@@ -124,17 +124,17 @@ int CmdEM4x70Write(const char *Cmd) {
 
     CLIParserContext *ctx;
 
-    CLIParserInit(&ctx, "lf em 4x10 write",
+    CLIParserInit(&ctx, "lf em 4x70 write",
                   "Write EM4x70\n",
-                  "lf em 4x70 write -b 15 d c0de -> write 'c0de' to block 15\n"
-                  "lf em 4x70 write -x -b 15 -d c0de -> adds parity bit to commands\n"
+                  "lf em 4x70 write -b 15 -d c0de -> write 'c0de' to block 15\n"
+                  "lf em 4x70 write -b 15 -d c0de --par -> adds parity bit to commands\n"
                 );
 
     void *argtable[] = {
         arg_param_begin,
-        arg_lit0("x", "parity", "Add parity bit when sending commands"),
-        arg_int1("b", "block",  "<dec>", "block/word address, dec"),
-        arg_str1("d", "data",   "<hex>", "data, 2 bytes"),
+        arg_lit0(NULL, "par",    "Add parity bit when sending commands"),
+        arg_int1("b",  "block",  "<dec>", "block/word address, dec"),
+        arg_str1("d",  "data",   "<hex>", "data, 2 bytes"),
         arg_param_end
     };
 
@@ -188,19 +188,19 @@ int CmdEM4x70Unlock(const char *Cmd) {
 
     CLIParserContext *ctx;
 
-    CLIParserInit(&ctx, "lf em 4x10 unlock",
+    CLIParserInit(&ctx, "lf em 4x70 unlock",
                   "Unlock EM4x70 by sending PIN\n"
                   "Default pin may be:\n"
                   " AAAAAAAA\n"
                   " 00000000\n",
                   "lf em 4x70 unlock -p 11223344 -> Unlock with PIN\n"
-                  "lf em 4x70 unlock -x -p 11223344 -> Unlock with PIN using parity commands\n"
+                  "lf em 4x70 unlock -p 11223344 --par -> Unlock with PIN using parity commands\n"
                 );
 
     void *argtable[] = {
         arg_param_begin,
-        arg_lit0("x", "parity", "Add parity bit when sending commands"),
-        arg_str1("p", "pin", "<hex>", "pin, 4 bytes"),
+        arg_lit0(NULL, "par", "Add parity bit when sending commands"),
+        arg_str1("p",  "pin", "<hex>", "pin, 4 bytes"),
         arg_param_end
     };
 

From 7cd80611d3d354d247c5251e52362826bd0f2402 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Sat, 12 Dec 2020 14:46:40 +0100
Subject: [PATCH 034/682] #makestyleday

---
 armsrc/Standalone/lf_tharexde.c |  20 ++---
 armsrc/em4x50.c                 |  82 ++++++++---------
 armsrc/em4x70.c                 | 153 ++++++++++++++++----------------
 armsrc/iso15693.c               |  34 +++----
 armsrc/lfsampling.c             |   2 +-
 client/src/cmdhf14a.c           |  36 ++++----
 client/src/cmdhficlass.c        |  16 ++--
 client/src/cmdhfmfp.c           |   2 +-
 client/src/cmdlfawid.c          |   4 +-
 client/src/cmdlfdestron.c       |   6 +-
 client/src/cmdlfem410x.c        |  24 ++---
 client/src/cmdlfem4x05.c        |  30 +++----
 client/src/cmdlfem4x50.c        | 108 +++++++++++-----------
 client/src/cmdlfem4x70.c        |  36 ++++----
 client/src/cmdlffdxb.c          |  12 +--
 client/src/cmdlfgallagher.c     |   2 +-
 client/src/cmdlfguard.c         |  14 +--
 client/src/cmdlfhid.c           |  12 +--
 client/src/cmdlfindala.c        |  28 +++---
 client/src/cmdlfio.c            |  12 +--
 client/src/cmdlfjablotron.c     |   4 +-
 client/src/cmdlfmotorola.c      |   2 +-
 client/src/cmdlfnedap.c         |  34 +++----
 client/src/cmdlfpcf7931.c       |   4 +-
 client/src/cmdlft55xx.c         |   2 +-
 client/src/cmdlft55xx.h         |   2 +-
 client/src/cmdlfti.c            |   4 +-
 common/commonutil.c             |   2 +-
 common/lfdemod.c                |   4 +-
 doc/commands.md                 |  71 +++++++--------
 30 files changed, 381 insertions(+), 381 deletions(-)

diff --git a/armsrc/Standalone/lf_tharexde.c b/armsrc/Standalone/lf_tharexde.c
index 887100855..f5195513c 100644
--- a/armsrc/Standalone/lf_tharexde.c
+++ b/armsrc/Standalone/lf_tharexde.c
@@ -88,7 +88,7 @@ static int get_input_data_from_file(uint32_t *words, char *inputfile) {
 
         uint32_t size = size_in_spiffs(inputfile);
         uint8_t *mem = BigBuf_malloc(size);
-        
+
         Dbprintf(_YELLOW_("found input file %s"), inputfile);
 
         rdv40_spiffs_read_as_filetype(inputfile, mem, size, RDV40_SPIFFS_SAFETY_SAFE);
@@ -153,7 +153,7 @@ void RunMod(void) {
         if (button_pressed == BUTTON_SINGLE_CLICK) {
 
             SpinUp(100);
-            
+
             switch (state) {
 
                 case STATE_SIM:
@@ -168,7 +168,7 @@ void RunMod(void) {
                 default:
                     break;
             }
-            
+
             state_change = true;
 
         } else if (button_pressed == BUTTON_HOLD) {
@@ -261,9 +261,9 @@ void RunMod(void) {
 
                 log_exists = exists_in_spiffs(LF_EM4X50BRUTE_LOGFILE);
                 now = get_input_data_from_file(passwords, LF_EM4X50BRUTE_INPUTFILE);
-                
+
                 if (now == 2) {
-                    
+
                     // print some information
                     int no_iter = passwords[1] - passwords[0] + 1;
                     int dur_s = no_iter / EM4X50_PWD_SPEED;
@@ -277,7 +277,7 @@ void RunMod(void) {
                              no_iter, passwords[0], passwords[1]);
                     Dbprintf(_YELLOW_("estimated duration: %ih%im%is"),
                              dur_h, dur_m, dur_s);
-                   
+
                 } else {
                     Dbprintf(_RED_("error in input data"));
                     break;
@@ -287,7 +287,7 @@ void RunMod(void) {
             }
 
             pwd_found = em4x50_standalone_brute(passwords[0], passwords[1], &pwd);
-            
+
             if (pwd_found == PM3_ETIMEOUT) {
 
                 // timeout -> no EM4x50 tag on reader?
@@ -313,15 +313,15 @@ void RunMod(void) {
                     strcat((char *)entry, "\n");
                     append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry));
 
-                    
+
                 } else {
-                    
+
                     // stopped -> write to logfile
                     sprintf((char *)entry, "stopped search - last password: 0x%08"PRIx32, pwd);
                     Dbprintf(_YELLOW_("%s"), entry);
                     strcat((char *)entry, "\n");
                     append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry));
-                    
+
                     // replace start password by last tested password in
                     // inputfile (spiffs) so that brute forcing process will
                     // be continued when envoking brute force mode again
diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index 36923b6a5..8d977c91d 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -37,11 +37,11 @@
 #define EM4X50_T_TAG_WAITING_FOR_SIGNAL     75
 #define EM4X50_T_WAITING_FOR_DBLLIW         1550
 #define EM4X50_T_WAITING_FOR_SNGLLIW        140     // this value seems to be
-                                                    // critical;
-                                                    // if it's too low
-                                                    // (e.g. < 120) some cards
-                                                    // are no longer readable
-                                                    // although they're ok
+// critical;
+// if it's too low
+// (e.g. < 120) some cards
+// are no longer readable
+// although they're ok
 
 #define EM4X50_TAG_TOLERANCE                8
 #define EM4X50_TAG_WORD                     45
@@ -65,18 +65,18 @@ static void wait_timer(uint32_t period) {
 // extract and check parities
 // return result of parity check and extracted plain data
 static bool extract_parities(uint64_t word, uint32_t *data) {
-    
+
     uint8_t row_parities = 0x0, col_parities = 0x0;
     uint8_t row_parities_calculated = 0x0, col_parities_calculated = 0x0;
-    
+
     *data = 0x0;
-    
+
     // extract plain data (32 bits) from raw word (45 bits)
     for (int i = 0; i < 4; i++) {
         *data <<= 8;
         *data |= (word >> ((4 - i) * 9 + 1)) & 0xFF;
     }
-    
+
     // extract row parities (4 bits + stop bit) from raw word (45 bits)
     for (int i = 0; i < 5; i++) {
         row_parities <<= 1;
@@ -106,7 +106,7 @@ static bool extract_parities(uint64_t word, uint32_t *data) {
             col_parities_calculated ^= (*data >> ((3 - j) * 8 + (7 - i))) & 0x1;
         }
     }
-    
+
     if ((row_parities == row_parities_calculated) && (col_parities == col_parities_calculated))
         return true;
 
@@ -191,7 +191,7 @@ static bool get_signalproperties(void) {
 
         // about 2 samples per bit period
         wait_timer(T0 * EM4X50_T_TAG_HALF_PERIOD);
-      
+
         // ignore first samples
         if ((i > SIGNAL_IGNORE_FIRST_SAMPLES) && (AT91C_BASE_SSC->SSC_RHR > noise)) {
             signal_found = true;
@@ -229,7 +229,7 @@ static bool get_signalproperties(void) {
     gLow = sample_ref - pct * (sample_max_mean - sample_ref) / 100;
 
     LED_A_OFF();
-    
+
     return true;
 }
 
@@ -290,7 +290,7 @@ static uint32_t get_pulse_length(void) {
 
 // check if pulse length <pl> corresponds to given length <length>
 static bool check_pulse_length(uint32_t pl, int length) {
-    return ((pl >= T0 * (length - EM4X50_TAG_TOLERANCE)) && (pl <= T0 * (length + EM4X50_TAG_TOLERANCE)));   
+    return ((pl >= T0 * (length - EM4X50_TAG_TOLERANCE)) && (pl <= T0 * (length + EM4X50_TAG_TOLERANCE)));
 }
 
 // send single bit according to EM4x50 application note and datasheet
@@ -346,12 +346,12 @@ static void em4x50_reader_send_byte_with_parity(uint8_t byte) {
 // word hast be sent in msb notation
 static void em4x50_reader_send_word(const uint32_t word) {
     uint8_t bytes[4] = {0x0, 0x0, 0x0, 0x0};
-    
+
     for (int i = 0; i < 4; i++) {
         bytes[i] = (word >> (24 - (8 * i))) & 0xFF;
         em4x50_reader_send_byte_with_parity(bytes[i]);
     }
-    
+
     // send column parities
     em4x50_reader_send_byte(bytes[0] ^ bytes[1] ^ bytes[2] ^ bytes[3]);
 
@@ -362,7 +362,7 @@ static void em4x50_reader_send_word(const uint32_t word) {
 // find single listen window
 static bool find_single_listen_window(void) {
     int cnt_pulses = 0;
-    
+
     LED_B_ON();
 
     while (cnt_pulses < EM4X50_T_WAITING_FOR_SNGLLIW) {
@@ -392,7 +392,7 @@ static bool find_single_listen_window(void) {
 // -> 34 words + 34 single listen windows -> about 1600 pulses
 static int find_double_listen_window(bool bcommand) {
     int cnt_pulses = 0;
-    
+
     LED_B_ON();
 
     while (cnt_pulses < EM4X50_T_WAITING_FOR_DBLLIW) {
@@ -452,7 +452,7 @@ static int find_double_listen_window(bool bcommand) {
         cnt_pulses++;
     }
 
-    LED_B_OFF();    
+    LED_B_OFF();
     return PM3_EFAILED;
 }
 
@@ -480,7 +480,7 @@ static bool check_ack(bool bliw) {
 
         if (BUTTON_PRESS())
             return false;
-        
+
         if (check_pulse_length(get_pulse_length(), 2 * EM4X50_T_TAG_FULL_PERIOD)) {
 
             // The received signal is either ACK or NAK.
@@ -531,9 +531,9 @@ static int get_word_from_bitstream(uint32_t *data) {
     int cnt = 0;
     uint32_t pl = 0;
     uint64_t word = 0x0;
-    
+
     LED_C_ON();
-    
+
     *data = 0x0;
 
     // initial bit value depends on last pulse length of listen window
@@ -561,7 +561,7 @@ static int get_word_from_bitstream(uint32_t *data) {
 
         cnt++;
         word <<= 1;
-        
+
         pl = get_pulse_length();
 
         if (check_pulse_length(pl, EM4X50_T_TAG_FULL_PERIOD)) {
@@ -612,9 +612,9 @@ static int get_word_from_bitstream(uint32_t *data) {
             return (extract_parities(word, data)) ? --cnt : 0;
         }
     }
-    
+
     LED_C_OFF();
-    
+
     return PM3_EOPABORTED;
 }
 
@@ -696,7 +696,7 @@ bool em4x50_sim_send_word(uint32_t word) {
 
     // word has tobe sent in msb, not lsb
     word = reflect32(word);
-    
+
     // 4 bytes each with even row parity bit
     for (int i = 0; i < 4; i++) {
         if (em4x50_sim_send_byte_with_parity((word >> ((3 - i) * 8)) & 0xFF) == false) {
@@ -776,7 +776,7 @@ static bool login(uint32_t password) {
 
         // send password
         em4x50_reader_send_word(password);
-        
+
         wait_timer(T0 * EM4X50_T_TAG_TPP);
 
         // check if ACK is returned
@@ -799,7 +799,7 @@ static bool brute(uint32_t start, uint32_t stop, uint32_t *pwd) {
     for (*pwd = start; *pwd <= stop; (*pwd)++) {
 
         if (login(*pwd) == PM3_SUCCESS) {
-            
+
             pwd_found = true;
 
             // to be safe login 5 more times
@@ -809,11 +809,11 @@ static bool brute(uint32_t start, uint32_t stop, uint32_t *pwd) {
                     break;
                 }
             }
-            
+
             if (pwd_found)
                 break;
         }
-        
+
         // print password every 500 iterations
         if ((++cnt % 500) == 0) {
 
@@ -827,10 +827,10 @@ static bool brute(uint32_t start, uint32_t stop, uint32_t *pwd) {
             // print data
             Dbprintf("|%8i | 0x%08x | 0x%08x |", cnt, reflect32(*pwd), *pwd);
         }
-        
+
         if (BUTTON_PRESS())
             break;
- 
+
     }
 
     // print footer
@@ -852,7 +852,7 @@ void em4x50_login(uint32_t *password) {
     reply_ng(CMD_LF_EM4X50_LOGIN, status, NULL, 0);
 }
 
-// envoke password search  
+// envoke password search
 void em4x50_brute(em4x50_data_t *etd) {
     em4x50_setup_read();
 
@@ -903,7 +903,7 @@ void em4x50_chk(uint8_t *filename) {
             pwd = 0x0;
             for (int j = 0; j < 4; j++)
                 pwd |= (*(pwds + 4 * i + j)) << ((3 - j) * 8);
-                        
+
             if ((status = login(pwd)) == PM3_SUCCESS)
                 break;
         }
@@ -1063,7 +1063,7 @@ void em4x50_reader(void) {
 
 // writes <word> to specified <addresses>
 static int write(uint32_t word, uint32_t addresses) {
-    
+
     if (request_receive_mode() == PM3_SUCCESS) {
 
         // send write command
@@ -1079,7 +1079,7 @@ static int write(uint32_t word, uint32_t addresses) {
             reply_ng(CMD_LF_EM4X50_WRITE, PM3_ETEAROFF, NULL, 0);
             return PM3_ETEAROFF;
         } else {
-        
+
             // wait for T0 * EM4X50_T_TAG_TWA (write access time)
             wait_timer(T0 * EM4X50_T_TAG_TWA);
 
@@ -1175,7 +1175,7 @@ void em4x50_write(em4x50_data_t *etd) {
                     // if password is given renew login after reset
                     if (etd->pwd_given)
                         status = login(etd->password1);
-                            
+
                     if (status == PM3_SUCCESS) {
 
                         // call a selective read
@@ -1225,11 +1225,11 @@ void em4x50_sim(uint8_t *filename) {
     int status = PM3_SUCCESS;
     uint8_t *em4x50_mem = BigBuf_get_EM_addr();
     uint32_t words[EM4X50_NO_WORDS] = {0x0};
-    
+
 #ifdef WITH_FLASH
 
     if (strlen((char *)filename) != 0) {
-    
+
         BigBuf_free();
 
         int changed = rdv40_spiffs_lazy_mount();
@@ -1246,7 +1246,7 @@ void em4x50_sim(uint8_t *filename) {
 
     for (int i = 0; i < EM4X50_NO_WORDS; i++)
         words[i] = reflect32(bytes_to_num(em4x50_mem + (i * 4), 4));
-    
+
     // only if valid em4x50 data (e.g. uid == serial)
     if (words[EM4X50_DEVICE_SERIAL] != words[EM4X50_DEVICE_ID]) {
 
@@ -1261,7 +1261,7 @@ void em4x50_sim(uint8_t *filename) {
 
         // iceman,  will need a usb cmd check to break as well
         while (BUTTON_PRESS() == false) {
-            
+
             WDT_HIT();
             em4x50_sim_send_listen_window();
             for (int i = fwr; i <= lwr; i++) {
@@ -1277,7 +1277,7 @@ void em4x50_sim(uint8_t *filename) {
     } else {
         status = PM3_ENODATA;
     }
-    
+
     BigBuf_free();
     lf_finalize();
     reply_ng(CMD_LF_EM4X50_SIM, status, NULL, 0);
diff --git a/armsrc/em4x70.c b/armsrc/em4x70.c
index 0b6cf36e6..a1f04ed6d 100644
--- a/armsrc/em4x70.c
+++ b/armsrc/em4x70.c
@@ -70,7 +70,7 @@ static int em4x70_receive(uint8_t *bits);
 static bool find_listen_window(bool command);
 
 static void init_tag(void) {
-    memset(tag.data, 0x00, sizeof(tag.data)/sizeof(tag.data[0]));
+    memset(tag.data, 0x00, sizeof(tag.data) / sizeof(tag.data[0]));
 }
 
 static void EM4170_setup_read(void) {
@@ -114,7 +114,7 @@ static bool get_signalproperties(void) {
     uint8_t sample_max_mean = 0;
     uint8_t sample_max[no_periods];
     uint32_t sample_max_sum = 0;
-    
+
     memset(sample_max, 0x00, sizeof(sample_max));
 
     // wait until signal/noise > 1 (max. 32 periods)
@@ -158,7 +158,7 @@ static bool get_signalproperties(void) {
     gLow  = sample_ref - pct * (sample_max_mean - sample_ref) / 100;
 
     // Basic sanity check
-    if(gHigh - gLow < EM4X70_MIN_AMPLITUDE) {
+    if (gHigh - gLow < EM4X70_MIN_AMPLITUDE) {
         return false;
     }
 
@@ -168,9 +168,9 @@ static bool get_signalproperties(void) {
 
 /**
  *  get_pulse_length
- * 
+ *
  *      Times falling edge pulses
- */ 
+ */
 static uint32_t get_pulse_length(void) {
 
     uint8_t sample;
@@ -178,7 +178,7 @@ static uint32_t get_pulse_length(void) {
 
     do {
         sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-    }while (IS_HIGH(sample) && !IS_TIMEOUT(timeout));
+    } while (IS_HIGH(sample) && !IS_TIMEOUT(timeout));
 
     if (IS_TIMEOUT(timeout))
         return 0;
@@ -188,7 +188,7 @@ static uint32_t get_pulse_length(void) {
 
     do {
         sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-    }while (IS_LOW(sample) && !IS_TIMEOUT(timeout));
+    } while (IS_LOW(sample) && !IS_TIMEOUT(timeout));
 
     if (IS_TIMEOUT(timeout))
         return 0;
@@ -196,7 +196,7 @@ static uint32_t get_pulse_length(void) {
     timeout = (TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD) + GetTicks();
     do {
         sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-    }while (IS_HIGH(sample) && !IS_TIMEOUT(timeout));
+    } while (IS_HIGH(sample) && !IS_TIMEOUT(timeout));
 
     if (IS_TIMEOUT(timeout))
         return 0;
@@ -206,10 +206,10 @@ static uint32_t get_pulse_length(void) {
 
 /**
  *  get_pulse_invert_length
- * 
+ *
  *      Times rising edge pules
  *  TODO: convert to single function with get_pulse_length()
- */ 
+ */
 static uint32_t get_pulse_invert_length(void) {
 
     uint8_t sample;
@@ -217,7 +217,7 @@ static uint32_t get_pulse_invert_length(void) {
 
     do {
         sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-    }while (IS_LOW(sample) && !IS_TIMEOUT(timeout));
+    } while (IS_LOW(sample) && !IS_TIMEOUT(timeout));
 
     if (IS_TIMEOUT(timeout))
         return 0;
@@ -227,7 +227,7 @@ static uint32_t get_pulse_invert_length(void) {
 
     do {
         sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-    }while (IS_HIGH(sample) && !IS_TIMEOUT(timeout));
+    } while (IS_HIGH(sample) && !IS_TIMEOUT(timeout));
 
     if (IS_TIMEOUT(timeout))
         return 0;
@@ -235,7 +235,7 @@ static uint32_t get_pulse_invert_length(void) {
     timeout = GetTicks() + (TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD);
     do {
         sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-    }while (IS_LOW(sample) && !IS_TIMEOUT(timeout));
+    } while (IS_LOW(sample) && !IS_TIMEOUT(timeout));
 
     if (IS_TIMEOUT(timeout))
         return 0;
@@ -279,9 +279,9 @@ static void em4x70_send_bit(bool bit) {
 
 /**
  * em4x70_send_nibble
- * 
+ *
  *  sends 4 bits of data + 1 bit of parity (with_parity)
- * 
+ *
  */
 static void em4x70_send_nibble(uint8_t nibble, bool with_parity) {
     int parity = 0;
@@ -289,16 +289,16 @@ static void em4x70_send_nibble(uint8_t nibble, bool with_parity) {
 
     // Non automotive EM4x70 based tags are 3 bits + 1 parity.
     // So drop the MSB and send a parity bit instead after the command
-    if(command_parity)
+    if (command_parity)
         msb_bit = 1;
-    
+
     for (int i = msb_bit; i < 4; i++) {
         int bit = (nibble >> (3 - i)) & 1;
         em4x70_send_bit(bit);
         parity ^= bit;
     }
 
-    if(with_parity)
+    if (with_parity)
         em4x70_send_bit(parity);
 }
 
@@ -313,8 +313,8 @@ static void em4x70_send_word(const uint16_t word) {
     // Split into nibbles
     uint8_t nibbles[4];
     uint8_t j = 0;
-    for(int i = 0; i < 2; i++) {
-        uint8_t byte = (word >> (8*i)) & 0xff;
+    for (int i = 0; i < 2; i++) {
+        uint8_t byte = (word >> (8 * i)) & 0xff;
         nibbles[j++] = (byte >> 4) & 0xf;
         nibbles[j++] = byte & 0xf;
     }
@@ -369,13 +369,13 @@ static int send_pin(const uint32_t pin) {
         em4x70_send_nibble(EM4X70_COMMAND_PIN, true);
 
         // --> Send TAG ID (bytes 4-7)
-        for(int i=0; i < 4; i++) {
-            em4x70_send_byte(tag.data[7-i]);
+        for (int i = 0; i < 4; i++) {
+            em4x70_send_byte(tag.data[7 - i]);
         }
 
         // --> Send PIN
-        for(int i=0; i < 4 ; i++) {
-            em4x70_send_byte((pin>>(i*8)) & 0xff);
+        for (int i = 0; i < 4 ; i++) {
+            em4x70_send_byte((pin >> (i * 8)) & 0xff);
         }
 
         // Wait TWALB (write access lock bits)
@@ -389,7 +389,7 @@ static int send_pin(const uint32_t pin) {
             // <-- Receive header + ID
             uint8_t tag_id[64];
             int num  = em4x70_receive(tag_id);
-            if(num < 32) {
+            if (num < 32) {
                 Dbprintf("Invalid ID Received");
                 return PM3_ESOFT;
             }
@@ -415,7 +415,7 @@ static int write(const uint16_t word, const uint8_t address) {
         // send data word
         em4x70_send_word(word);
 
-        // Wait TWA 
+        // Wait TWA
         WaitTicks(TICKS_PER_FC * EM4X70_T_TAG_TWA);
 
         // look for ACK sequence
@@ -435,9 +435,9 @@ static int write(const uint16_t word, const uint8_t address) {
 
 
 static bool find_listen_window(bool command) {
-    
+
     int cnt = 0;
-    while(cnt < EM4X70_T_WAITING_FOR_SNGLLIW) {
+    while (cnt < EM4X70_T_WAITING_FOR_SNGLLIW) {
         /*
         80 ( 64 + 16 )
         80 ( 64 + 16 )
@@ -445,26 +445,25 @@ static bool find_listen_window(bool command) {
         96 ( 64 + 32 )
         64 ( 32 + 16 +16 )*/
 
-        if ( check_pulse_length(get_pulse_invert_length(), 80) &&
-             check_pulse_length(get_pulse_invert_length(), 80) &&
-             check_pulse_length(get_pulse_length(), 96) &&
-             check_pulse_length(get_pulse_length(), 64) )
-            {
+        if (check_pulse_length(get_pulse_invert_length(), 80) &&
+                check_pulse_length(get_pulse_invert_length(), 80) &&
+                check_pulse_length(get_pulse_length(), 96) &&
+                check_pulse_length(get_pulse_length(), 64)) {
 
-                if(command) {
-                    /* Here we are after the 64 duration edge.
-                        *   em4170 says we need to wait about 48 RF clock cycles.
-                        *   depends on the delay between tag and us
-                        * 
-                        *   I've found between 4-5 quarter periods (32-40) works best
-                        */
-                    WaitTicks(TICKS_PER_FC * 4 * EM4X70_T_TAG_QUARTER_PERIOD);
-                    // Send RM Command
-                    em4x70_send_bit(0);
-                    em4x70_send_bit(0);
-                }
-                return true;
+            if (command) {
+                /* Here we are after the 64 duration edge.
+                    *   em4170 says we need to wait about 48 RF clock cycles.
+                    *   depends on the delay between tag and us
+                    *
+                    *   I've found between 4-5 quarter periods (32-40) works best
+                    */
+                WaitTicks(TICKS_PER_FC * 4 * EM4X70_T_TAG_QUARTER_PERIOD);
+                // Send RM Command
+                em4x70_send_bit(0);
+                em4x70_send_bit(0);
             }
+            return true;
+        }
         cnt++;
     }
 
@@ -472,17 +471,17 @@ static bool find_listen_window(bool command) {
 }
 
 static void bits2bytes(const uint8_t *bits, int length, uint8_t *out) {
-    
-    if(length%8 != 0) {
+
+    if (length % 8 != 0) {
         Dbprintf("Should have a multiple of 8 bits, was sent %d", length);
     }
-    
+
     int num_bytes = length / 8; // We should have a multiple of 8 here
 
-    for(int i=1; i <= num_bytes; i++) {
-        out[num_bytes-i] = bits2byte(bits, 8);
+    for (int i = 1; i <= num_bytes; i++) {
+        out[num_bytes - i] = bits2byte(bits, 8);
         bits += 8;
-    } 
+    }
 }
 
 static uint8_t bits2byte(const uint8_t *bits, int length) {
@@ -501,16 +500,16 @@ static uint8_t bits2byte(const uint8_t *bits, int length) {
 }
 
 static bool send_command_and_read(uint8_t command, uint8_t resp_len_bits, uint8_t *out_bytes) {
-    
+
     int retries = EM4X70_COMMAND_RETRIES;
-    while(retries) {
+    while (retries) {
         retries--;
 
-        if(find_listen_window(true)) {
+        if (find_listen_window(true)) {
             uint8_t bits[EM4X70_MAX_RECEIVE_LENGTH] = {0};
             em4x70_send_nibble(command, command_parity);
             int len = em4x70_receive(bits);
-            if(len < resp_len_bits) {
+            if (len < resp_len_bits) {
                 Dbprintf("Invalid data received length: %d", len);
                 return false;
             }
@@ -525,9 +524,9 @@ static bool send_command_and_read(uint8_t command, uint8_t resp_len_bits, uint8_
 
 /**
  * em4x70_read_id
- * 
+ *
  *  read pre-programmed ID (4 bytes)
- */ 
+ */
 static bool em4x70_read_id(void) {
 
     return send_command_and_read(EM4X70_COMMAND_ID, 32, &tag.data[4]);
@@ -536,7 +535,7 @@ static bool em4x70_read_id(void) {
 
 /**
  *  em4x70_read_um1
- * 
+ *
  *  read user memory 1 (4 bytes including lock bits)
  */
 static bool em4x70_read_um1(void) {
@@ -548,7 +547,7 @@ static bool em4x70_read_um1(void) {
 
 /**
  *  em4x70_read_um2
- * 
+ *
  *  read user memory 2 (8 bytes)
  */
 static bool em4x70_read_um2(void) {
@@ -573,28 +572,28 @@ static int em4x70_receive(uint8_t *bits) {
     // Read out the header
     //   12 Manchester 1's (may miss some during settle period)
     //    4 Manchester 0's
-    
+
     // Skip a few leading 1's as it could be noisy
     WaitTicks(TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD);
 
     // wait until we get the transition from 1's to 0's which is 1.5 full windows
     int pulse_count = 0;
-    while(pulse_count < 12){
+    while (pulse_count < 12) {
         pl = get_pulse_invert_length();
         pulse_count++;
-        if(check_pulse_length(pl, 3 * EM4X70_T_TAG_HALF_PERIOD)) {
+        if (check_pulse_length(pl, 3 * EM4X70_T_TAG_HALF_PERIOD)) {
             foundheader = true;
             break;
         }
     }
 
-    if(!foundheader) {
+    if (!foundheader) {
         Dbprintf("Failed to find read header");
         return 0;
     }
 
     // Skip next 3 0's, header check consumes the first 0
-    for(int i = 0; i < 3; i++) {
+    for (int i = 0; i < 3; i++) {
         get_pulse_invert_length();
     }
 
@@ -602,7 +601,7 @@ static int em4x70_receive(uint8_t *bits) {
     // between two listen windows only pulse lengths of 1, 1.5 and 2 are possible
     while (bit_pos < EM4X70_MAX_RECEIVE_LENGTH) {
 
-        if(edge)
+        if (edge)
             pl = get_pulse_length();
         else
             pl = get_pulse_invert_length();
@@ -615,7 +614,7 @@ static int em4x70_receive(uint8_t *bits) {
         } else if (check_pulse_length(pl, 3 * EM4X70_T_TAG_HALF_PERIOD)) {
 
             // pulse length = 1.5 -> flip edge detection
-            if(edge) {
+            if (edge) {
                 bits[bit_pos++] = 0;
                 bits[bit_pos++] = 0;
                 edge = 0;
@@ -628,7 +627,7 @@ static int em4x70_receive(uint8_t *bits) {
         } else if (check_pulse_length(pl, 2 * EM4X70_T_TAG_FULL_PERIOD)) {
 
             // pulse length of 2
-            if(edge) {
+            if (edge) {
                 bits[bit_pos++] = 0;
                 bits[bit_pos++] = 1;
             } else {
@@ -636,8 +635,8 @@ static int em4x70_receive(uint8_t *bits) {
                 bits[bit_pos++] = 0;
             }
 
-        } else if ( (edge && check_pulse_length(pl, 3 * EM4X70_T_TAG_FULL_PERIOD)) ||
-                    (!edge && check_pulse_length(pl, 80))) {
+        } else if ((edge && check_pulse_length(pl, 3 * EM4X70_T_TAG_FULL_PERIOD)) ||
+                   (!edge && check_pulse_length(pl, 80))) {
 
             // LIW detected (either invert or normal)
             return --bit_pos;
@@ -651,7 +650,7 @@ static int em4x70_receive(uint8_t *bits) {
 void em4x70_info(em4x70_data_t *etd) {
 
     uint8_t status = 0;
-    
+
     // Support tags with and without command parity bits
     command_parity = etd->parity;
 
@@ -680,11 +679,11 @@ void em4x70_write(em4x70_data_t *etd) {
 
     // Find the Tag
     if (get_signalproperties() && find_EM4X70_Tag()) {
-        
+
         // Write
         status = write(etd->word, etd->address) == PM3_SUCCESS;
 
-        if(status) {
+        if (status) {
             // Read Tag after writing
             em4x70_read_id();
             em4x70_read_um1();
@@ -709,15 +708,15 @@ void em4x70_unlock(em4x70_data_t *etd) {
 
     // Find the Tag
     if (get_signalproperties() && find_EM4X70_Tag()) {
-        
+
         // Read ID (required for send_pin command)
-        if(em4x70_read_id()) {
-            
+        if (em4x70_read_id()) {
+
             // Send PIN
             status = send_pin(etd->pin) == PM3_SUCCESS;
 
             // If the write succeeded, read the rest of the tag
-            if(status) {
+            if (status) {
                 // Read Tag
                 // ID doesn't change
                 em4x70_read_um1();
diff --git a/armsrc/iso15693.c b/armsrc/iso15693.c
index b6d1b7ed8..ef4695e20 100644
--- a/armsrc/iso15693.c
+++ b/armsrc/iso15693.c
@@ -1727,7 +1727,7 @@ void SimTagIso15693(uint8_t *uid) {
         if ((cmd_len >= 5) && (cmd[0] & ISO15_REQ_INVENTORY) && (cmd[1] == ISO15_CMD_INVENTORY)) {
             bool slow = !(cmd[0] & ISO15_REQ_DATARATE_HIGH);
             uint32_t response_time = reader_eof_time + DELAY_ISO15693_VCD_TO_VICC_SIM;
-            
+
             // Build INVENTORY command
             uint8_t resp_inv[CMD_INV_RESP] = {0};
 
@@ -1743,30 +1743,30 @@ void SimTagIso15693(uint8_t *uid) {
             resp_inv[7] = uid[2];
             resp_inv[8] = uid[1];
             resp_inv[9] = uid[0];
-            
+
             // CRC
             AddCrc15(resp_inv, 10);
             CodeIso15693AsTag(resp_inv, CMD_INV_RESP);
-    
+
             tosend_t *ts = get_tosend();
-    
+
             TransmitTo15693Reader(ts->buf, ts->max, &response_time, 0, slow);
             LogTrace_ISO15693(resp_inv, CMD_INV_RESP, response_time * 32, (response_time * 32) + (ts->max * 32 * 64), NULL, false);
 
             chip_state = SELECTED;
         }
-        
+
         // GET_SYSTEM_INFO
         if ((cmd[1] == ISO15_CMD_SYSINFO)) {
             bool slow = !(cmd[0] & ISO15_REQ_DATARATE_HIGH);
             uint32_t response_time = reader_eof_time + DELAY_ISO15693_VCD_TO_VICC_SIM;
-            
+
             // Build GET_SYSTEM_INFO command
             uint8_t resp_sysinfo[CMD_SYSINFO_RESP] = {0};
-    
+
             resp_sysinfo[0] = 0;    // Response flags.
             resp_sysinfo[1] = 0x0F; // Information flags (0x0F - DSFID, AFI, Mem size, IC)
-    
+
             // 64-bit UID
             resp_sysinfo[2] = uid[7];
             resp_sysinfo[3] = uid[6];
@@ -1776,42 +1776,42 @@ void SimTagIso15693(uint8_t *uid) {
             resp_sysinfo[7] = uid[2];
             resp_sysinfo[8] = uid[1];
             resp_sysinfo[9] = uid[0];
-    
+
             resp_sysinfo[10] = 0;    // DSFID
             resp_sysinfo[11] = 0;    // AFI
 
             resp_sysinfo[12] = 0x1B; // Memory size.
             resp_sysinfo[13] = 0x03; // Memory size.
             resp_sysinfo[14] = 0x01; // IC reference.
-    
+
             // CRC
             AddCrc15(resp_sysinfo, 15);
             CodeIso15693AsTag(resp_sysinfo, CMD_SYSINFO_RESP);
-    
+
             tosend_t *ts = get_tosend();
-            
+
             TransmitTo15693Reader(ts->buf, ts->max, &response_time, 0, slow);
             LogTrace_ISO15693(resp_sysinfo, CMD_SYSINFO_RESP, response_time * 32, (response_time * 32) + (ts->max * 32 * 64), NULL, false);
         }
-        
+
         // READ_BLOCK
         if ((cmd[1] == ISO15_CMD_READ)) {
             bool slow = !(cmd[0] & ISO15_REQ_DATARATE_HIGH);
             uint32_t response_time = reader_eof_time + DELAY_ISO15693_VCD_TO_VICC_SIM;
-            
+
             // Build GET_SYSTEM_INFO command
             uint8_t resp_readblock[CMD_READBLOCK_RESP] = {0};
-    
+
             resp_readblock[0] = 0;    // Response flags.
             resp_readblock[1] = 0;    // Block data.
             resp_readblock[2] = 0;    // Block data.
             resp_readblock[3] = 0;    // Block data.
             resp_readblock[4] = 0;    // Block data.
-    
+
             // CRC
             AddCrc15(resp_readblock, 5);
             CodeIso15693AsTag(resp_readblock, CMD_READBLOCK_RESP);
-    
+
             tosend_t *ts = get_tosend();
 
             TransmitTo15693Reader(ts->buf, ts->max, &response_time, 0, slow);
diff --git a/armsrc/lfsampling.c b/armsrc/lfsampling.c
index 7a42367dc..ef1d128cc 100644
--- a/armsrc/lfsampling.c
+++ b/armsrc/lfsampling.c
@@ -515,7 +515,7 @@ void doCotagAcquisition(void) {
 
         if (BUTTON_PRESS())
             break;
-        
+
         if (checker == 4000) {
             if (data_available())
                 break;
diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index 576979aad..9957e8ed3 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -2135,7 +2135,7 @@ static int CmdHf14AFuzzapdu(const char *Cmd) {
                   "Tag must be on antenna before running.",
                   "hf 14a apdufuzz\n"
                   "hf 14a apdufuzz --cla 80\n"
-                  );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -2143,7 +2143,7 @@ static int CmdHf14AFuzzapdu(const char *Cmd) {
         arg_str0(NULL, "ins", "<hex>", "start INSTRUCTION value (1 hex byte)"),
         arg_str0(NULL, "p1", "<hex>", "start P1 value (1 hex byte)"),
         arg_str0(NULL, "p2", "<hex>", "start P2 value (1 hex byte)"),
-        arg_str0(NULL, "le", "<hex>", "start LENGTH value (1 hex byte)"),        
+        arg_str0(NULL, "le", "<hex>", "start LENGTH value (1 hex byte)"),
         arg_lit0("v", "verbose", "verbose output"),
         arg_param_end
     };
@@ -2152,7 +2152,7 @@ static int CmdHf14AFuzzapdu(const char *Cmd) {
     int cla_len = 0;
     uint8_t cla[1] = {0};
     CLIGetHexWithReturn(ctx, 1, cla, &cla_len);
-    
+
     int ins_len = 0;
     uint8_t ins[1] = {0};
     CLIGetHexWithReturn(ctx, 2, ins, &ins_len);
@@ -2176,12 +2176,12 @@ static int CmdHf14AFuzzapdu(const char *Cmd) {
     bool keep_field_on = true;
 
     uint8_t a = cla[0];
-    uint8_t b = ins[0]; 
+    uint8_t b = ins[0];
     uint8_t c = p1[0];
     uint8_t d = p2[0];
-    uint8_t e = le[0];    
+    uint8_t e = le[0];
 
-    PrintAndLogEx(SUCCESS, "Starting the apdu fuzzer [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " LE " _GREEN_("%02x")" ]", a,b,c,d,e);
+    PrintAndLogEx(SUCCESS, "Starting the apdu fuzzer [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " LE " _GREEN_("%02x")" ]", a, b, c, d, e);
     PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
 
     uint8_t response[PM3_CMD_DATA_SIZE];
@@ -2210,7 +2210,7 @@ static int CmdHf14AFuzzapdu(const char *Cmd) {
                         }
 
                         uint8_t foo[5] = {a, b, c, d, e};
-                        int foo_n = sizeof(foo);                    
+                        int foo_n = sizeof(foo);
 
                         if (verbose) {
                             PrintAndLogEx(INFO, "%s", sprint_hex(foo, sizeof(foo)));
@@ -2218,34 +2218,34 @@ static int CmdHf14AFuzzapdu(const char *Cmd) {
                         res = ExchangeAPDU14a(foo, foo_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
                         if (res) {
                             e++;
-                            continue;                                            
+                            continue;
                         }
 
                         uint16_t sw = get_sw(response, resplen);
                         if (sw != 0x6a86 &&
-                            sw != 0x6986 &&
-                            sw != 0x6d00
-                            ) {
-                            PrintAndLogEx(INFO, "%02X %02X %02X %02X %02X (%04x - %s)", a,b,c,d,e, sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
+                                sw != 0x6986 &&
+                                sw != 0x6d00
+                           ) {
+                            PrintAndLogEx(INFO, "%02X %02X %02X %02X %02X (%04x - %s)", a, b, c, d, e, sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
                         }
                         e++;
                         if (verbose) {
-                            PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a,b,c,d,e);
+                            PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a, b, c, d, e);
                         }
 
                     } while (e);
                     d++;
-                    PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a,b,c,d,e);
+                    PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a, b, c, d, e);
                 } while (d);
                 c++;
-                PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a,b,c,d,e);
+                PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a, b, c, d, e);
             } while (c);
             b++;
-            PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a,b,c,d,e);
+            PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a, b, c, d, e);
         } while (b);
         a++;
-        PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a,b,c,d,e);
-    } while(a);
+        PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a, b, c, d, e);
+    } while (a);
 
 out:
     PrintAndLogEx(SUCCESS, "time: %" PRIu64 " seconds\n", (msclock() - t1) / 1000);
diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c
index 075a5562e..0d182d9c3 100644
--- a/client/src/cmdhficlass.c
+++ b/client/src/cmdhficlass.c
@@ -624,7 +624,7 @@ static int CmdHFiClassReader(const char *Cmd) {
     CLIParserInit(&ctx, "hf iclass reader",
                   "Act as a iCLASS reader. Look for iCLASS tags until Enter or the pm3 button is pressed",
                   "hf iclass reader -@   -> continuous reader mode"
-                  );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -1700,7 +1700,7 @@ static int CmdHFiClassRestore(const char *Cmd) {
                   "hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 --ki 0\n"
                   "hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 --ki 0 --elite\n"
                   "hf iclass restore -f hf-iclass-AA162D30F8FF12F1-dump.bin --first 6 --last 18 -k 1122334455667788 --elite\n"
-                );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -3318,12 +3318,12 @@ static int CmdHFiClassPermuteKey(const char *Cmd) {
 
 static int CmdHFiClassEncode(const char *Cmd) {
 
-  CLIParserContext *ctx;
+    CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf iclass encode",
                   "Encode binary wiegand to block 7",
                   "hf iclass encode --bin 10001111100000001010100011 --ki 0            -> FC 31 CN 337\n"
                   "hf iclass encode --bin 10001111100000001010100011 --ki 0 --elite    -> FC 31 CN 337,  writing w elite key"
-                  );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -3422,7 +3422,7 @@ static int CmdHFiClassEncode(const char *Cmd) {
     }
     // add binary sentinel bit.
     pushBit(&bout, 1);
-   
+
     // convert binary string to hex bytes
     for (int i = 0; i < bin_len; i++) {
         char c = bin[i];
@@ -3449,11 +3449,11 @@ static int CmdHFiClassEncode(const char *Cmd) {
 
     int isok = PM3_SUCCESS;
     // write
-    for (uint8_t i=0; i<4; i++) {
-        isok = iclass_write_block(6 + i, credential + (i*8), key, use_credit_key, elite, rawkey, false, false, auth);
+    for (uint8_t i = 0; i < 4; i++) {
+        isok = iclass_write_block(6 + i, credential + (i * 8), key, use_credit_key, elite, rawkey, false, false, auth);
         switch (isok) {
             case PM3_SUCCESS:
-                PrintAndLogEx(SUCCESS, "Write block %d/0x0%x ( " _GREEN_("ok") " )  --> " _YELLOW_("%s"), 6 + i, 6 + i, sprint_hex_inrow(credential + (i*8), 8));
+                PrintAndLogEx(SUCCESS, "Write block %d/0x0%x ( " _GREEN_("ok") " )  --> " _YELLOW_("%s"), 6 + i, 6 + i, sprint_hex_inrow(credential + (i * 8), 8));
                 break;
             default:
                 PrintAndLogEx(SUCCESS, "Write block %d/0x0%x ( " _RED_("fail") " )", 6 + i, 6 + i);
diff --git a/client/src/cmdhfmfp.c b/client/src/cmdhfmfp.c
index 46d7bf0cf..ab41bcf41 100644
--- a/client/src/cmdhfmfp.c
+++ b/client/src/cmdhfmfp.c
@@ -276,7 +276,7 @@ static int CmdHFMFPInfo(const char *Cmd) {
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
-    
+
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "--- " _CYAN_("Tag Information") " ---------------------------");
     PrintAndLogEx(INFO, "-------------------------------------------------------------");
diff --git a/client/src/cmdlfawid.c b/client/src/cmdlfawid.c
index 6591e1364..c54c3cd1d 100644
--- a/client/src/cmdlfawid.c
+++ b/client/src/cmdlfawid.c
@@ -510,7 +510,7 @@ static int CmdAWIDBrute(const char *Cmd) {
             break;
     }
 
-   
+
     // truncate card number
     if ((cn & 0xFFFF) != cn) {
         cn &= 0xFFFF;
@@ -550,7 +550,7 @@ static int CmdAWIDBrute(const char *Cmd) {
         if (cn > 1) {
             if (down > 1) {
                 if (sendTry(fmtlen, fc, --down, delay, bits, size, verbose) != PM3_SUCCESS) {
-                return PM3_ESOFT;
+                    return PM3_ESOFT;
                 }
             }
         }
diff --git a/client/src/cmdlfdestron.c b/client/src/cmdlfdestron.c
index ec5e67a28..13f7a6398 100644
--- a/client/src/cmdlfdestron.c
+++ b/client/src/cmdlfdestron.c
@@ -190,9 +190,9 @@ static int CmdDestronClone(const char *Cmd) {
     blocks[1] = (blocks[1] & 0xFFFF) | 0xAAE20000;
 
     PrintAndLogEx(INFO, "Preparing to clone Destron tag to " _YELLOW_("%s") " with ID: " _YELLOW_("%s")
-            , cardtype
-            , sprint_hex_inrow(data, datalen)
-            );
+                  , cardtype
+                  , sprint_hex_inrow(data, datalen)
+                 );
 
 
     print_blocks(blocks, ARRAYLEN(blocks));
diff --git a/client/src/cmdlfem410x.c b/client/src/cmdlfem410x.c
index 790e3e070..c8b11a9db 100644
--- a/client/src/cmdlfem410x.c
+++ b/client/src/cmdlfem410x.c
@@ -118,7 +118,7 @@ void printEM410x(uint32_t hi, uint64_t id, bool verbose) {
         if (hi) {
             PrintAndLogEx(SUCCESS, "EM 410x ID "_GREEN_("%06X%016" PRIX64), hi, id);
         } else {
-            PrintAndLogEx(SUCCESS, "EM 410x ID "_GREEN_("%010" PRIX64), id);    
+            PrintAndLogEx(SUCCESS, "EM 410x ID "_GREEN_("%010" PRIX64), id);
         }
         return;
     }
@@ -395,7 +395,7 @@ static int CmdEM410xReader(const char *Cmd) {
 
 // emulate an EM410X tag
 static int CmdEM410xSim(const char *Cmd) {
-    
+
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "lf em 410x sim",
                   "Enables simulation of EM 410x card.\n"
@@ -433,7 +433,7 @@ static int CmdEM410xSim(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
-static int CmdEM410xBrute(const char *Cmd) {   
+static int CmdEM410xBrute(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "lf em 410x brute",
                   "bruteforcing by emulating EM 410x tag",
@@ -452,10 +452,10 @@ static int CmdEM410xBrute(const char *Cmd) {
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);
 
-    // clock default 64 in EM410x 
+    // clock default 64 in EM410x
     uint32_t clk = arg_get_u32_def(ctx, 1, 64);
 
-    // default pause time: 1 second 
+    // default pause time: 1 second
     uint32_t delay = arg_get_u32_def(ctx, 2, 1000);
 
     int fnlen = 0;
@@ -467,7 +467,7 @@ static int CmdEM410xBrute(const char *Cmd) {
         PrintAndLogEx(ERR, "Error: Please specify a filename");
         return PM3_EINVARG;
     }
-   
+
     uint32_t uidcnt = 0;
     uint8_t stUidBlock = 20;
     uint8_t *p = NULL;
@@ -543,10 +543,10 @@ static int CmdEM410xBrute(const char *Cmd) {
 
         memcpy(testuid, uidblock + 5 * c, 5);
         PrintAndLogEx(INFO, "Bruteforce %d / %d: simulating UID " _YELLOW_("%s")
-                , c + 1
-                , uidcnt
-                , sprint_hex_inrow(testuid, sizeof(testuid))
-                );
+                      , c + 1
+                      , uidcnt
+                      , sprint_hex_inrow(testuid, sizeof(testuid))
+                     );
 
         em410x_construct_emul_graph(testuid, clk);
 
@@ -585,7 +585,7 @@ static int CmdEM410xClone(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "lf em 410x clone",
                   "Writes EM410x ID to a T55x7 or Q5/T5555 tag",
-                  "lf em 410x clone --id 0F0368568B        -> write id to T55x7 tag\n" 
+                  "lf em 410x clone --id 0F0368568B        -> write id to T55x7 tag\n"
                   "lf em 410x clone --id 0F0368568B --q5   -> write id to Q5/T5555 tag"
                  );
 
@@ -598,7 +598,7 @@ static int CmdEM410xClone(const char *Cmd) {
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);
 
-    // clock default 64 in EM410x 
+    // clock default 64 in EM410x
     uint32_t clk = arg_get_u32_def(ctx, 1, 64);
     int uid_len = 0;
     uint8_t uid[5] = {0};
diff --git a/client/src/cmdlfem4x05.c b/client/src/cmdlfem4x05.c
index 0f968d23d..c0dc8c2ee 100644
--- a/client/src/cmdlfem4x05.c
+++ b/client/src/cmdlfem4x05.c
@@ -773,7 +773,7 @@ int CmdEM4x05Write(const char *Cmd) {
     void *argtable[] = {
         arg_param_begin,
         arg_int0("a", "addr", "<dec>", "memory address to write to. (0-13)"),
-        arg_str1("d", "data", "<hex>", "data to write, 4 bytes hex"),        
+        arg_str1("d", "data", "<hex>", "data to write, 4 bytes hex"),
         arg_str0("p", "pwd", "<hex>", "optional - password, 4 bytes hex"),
         arg_lit0(NULL, "po", "protect operation"),
         arg_param_end
@@ -784,14 +784,14 @@ int CmdEM4x05Write(const char *Cmd) {
     uint64_t inputpwd = arg_get_u64_hexstr_def(ctx, 3, 0xFFFFFFFFFFFFFFFF);
     bool protect_operation = arg_get_lit(ctx, 4);
     CLIParserFree(ctx);
- 
+
     if ((addr > 13) && (protect_operation == false)) {
         PrintAndLogEx(WARNING, "Address must be between 0 and 13");
         return PM3_EINVARG;
     }
 
-    bool use_pwd = false;   
-    uint32_t pwd = ( inputpwd != 0xFFFFFFFFFFFFFFFF) ? (inputpwd & 0xFFFFFFFF) : 0;
+    bool use_pwd = false;
+    uint32_t pwd = (inputpwd != 0xFFFFFFFFFFFFFFFF) ? (inputpwd & 0xFFFFFFFF) : 0;
     if (pwd == 0xFFFFFFFF) {
         if (protect_operation)
             PrintAndLogEx(INFO, "Writing protection words data %08X", data);
@@ -807,14 +807,14 @@ int CmdEM4x05Write(const char *Cmd) {
 
     int res = PM3_SUCCESS;
     // set Protect Words
-    if (protect_operation) { 
+    if (protect_operation) {
         res = em4x05_protect(pwd, use_pwd, data);
-        if ( res != PM3_SUCCESS) {
+        if (res != PM3_SUCCESS) {
             return res;
         }
     } else {
         res = em4x05_write_word_ext(addr, pwd, use_pwd, data);
-        if ( res != PM3_SUCCESS) {
+        if (res != PM3_SUCCESS) {
             return res;
         }
     }
@@ -888,25 +888,25 @@ int CmdEM4x05Wipe(const char *Cmd) {
 
     bool use_pwd = false;
     uint32_t pwd = 0;
-    if ( inputpwd != 0xFFFFFFFFFFFFFFFF) {
+    if (inputpwd != 0xFFFFFFFFFFFFFFFF) {
         pwd = (inputpwd & 0xFFFFFFFF);
         use_pwd = true;
     }
     // block 0 : User Data or Chip Info
     int res = em4x05_write_word_ext(0, pwd, use_pwd, chip_info);
-    if ( res != PM3_SUCCESS) {
+    if (res != PM3_SUCCESS) {
         return res;
     }
 
     // block 1 : UID - this should be read only for EM4205 and EM4305 not sure about others
     res = em4x05_write_word_ext(1, pwd, use_pwd, chip_UID);
-    if ( res != PM3_SUCCESS) {
+    if (res != PM3_SUCCESS) {
         PrintAndLogEx(INFO, "UID block write failed");
     }
 
     // block 2 : password
     res = em4x05_write_word_ext(2, pwd, use_pwd, block_data);
-    if ( res != PM3_SUCCESS) {
+    if (res != PM3_SUCCESS) {
         return res;
     }
 
@@ -914,20 +914,20 @@ int CmdEM4x05Wipe(const char *Cmd) {
     pwd = block_data;
     // block 3 : user data
     res = em4x05_write_word_ext(3, pwd, use_pwd, block_data);
-    if ( res != PM3_SUCCESS) {
+    if (res != PM3_SUCCESS) {
         return res;
     }
 
     // block 4 : config
     res = em4x05_write_word_ext(4, pwd, use_pwd, config);
-    if ( res != PM3_SUCCESS) {
+    if (res != PM3_SUCCESS) {
         return res;
     }
 
     // Remainder of user/data blocks
     for (addr = 5; addr < 14; addr++) {// Clear user data blocks
         res = em4x05_write_word_ext(addr, pwd, use_pwd, block_data);
-        if ( res != PM3_SUCCESS) {
+        if (res != PM3_SUCCESS) {
             return res;
         }
     }
@@ -2146,4 +2146,4 @@ static int CmdHelp(const char *Cmd) {
 int CmdLFEM4X05(const char *Cmd) {
     clearCommandBuffer();
     return CmdsParse(CommandTable, Cmd);
-}
\ No newline at end of file
+}
diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c
index ccdf30394..09df8cfe6 100644
--- a/client/src/cmdlfem4x50.c
+++ b/client/src/cmdlfem4x50.c
@@ -28,7 +28,7 @@ static void prepare_result(const uint8_t *data, int fwr, int lwr, em4x50_word_t
     // restructure received result in "em4x50_word_t" structure
     for (int i = fwr; i <= lwr; i++) {
         for (int j = 0; j < 4; j++) {
-            words[i].byte[j] = data[i * 4 + (3 - j)]; 
+            words[i].byte[j] = data[i * 4 + (3 - j)];
         }
     }
 }
@@ -131,7 +131,7 @@ static int em4x50_load_file(const char *filename, uint8_t *data, size_t data_len
 
     int res = 0;
     uint32_t serial = 0x0, device_id = 0x0;
-     
+
     if (str_endswith(filename, ".eml"))
         res = loadFileEML(filename, data, bytes_read) != PM3_SUCCESS;
     else if (str_endswith(filename, ".json"))
@@ -202,7 +202,7 @@ int CmdEM4x50ELoad(const char *Cmd) {
     // upload to emulator memory
     PrintAndLogEx(INFO, "Uploading dump " _YELLOW_("%s") " to emulator memory", filename);
     em4x50_seteml(data, 0, DUMP_FILESIZE);
-    
+
     PrintAndLogEx(INFO, "Done");
     return PM3_SUCCESS;
 }
@@ -236,7 +236,7 @@ int CmdEM4x50ESave(const char *Cmd) {
         PrintAndLogEx(WARNING, "Fail, transfer from device time-out");
         return PM3_ETIMEOUT;
     }
-    
+
     // valid em4x50 data?
     uint32_t serial = bytes_to_num(data + 4 * EM4X50_DEVICE_SERIAL, 4);
     uint32_t device_id = bytes_to_num(data + 4 * EM4X50_DEVICE_ID, 4);
@@ -244,7 +244,7 @@ int CmdEM4x50ESave(const char *Cmd) {
         PrintAndLogEx(WARNING, "No valid em4x50 data in flash memory.");
         return PM3_ENODATA;
     }
-    
+
     // user supplied filename?
     if (fnlen == 0) {
         PrintAndLogEx(INFO, "Using UID as filename");
@@ -272,7 +272,7 @@ int CmdEM4x50Login(const char *Cmd) {
         arg_param_end
     };
 
-    CLIExecWithReturn(ctx, Cmd, argtable, true);    
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
     int pwd_len = 0;
     uint8_t pwd[4] = {0x0};
     CLIGetHexWithReturn(ctx, 1, pwd, &pwd_len);
@@ -281,7 +281,7 @@ int CmdEM4x50Login(const char *Cmd) {
     if (pwd_len != 4) {
         PrintAndLogEx(FAILED, "password length must be 4 bytes");
         return PM3_EINVARG;
-    } 
+    }
 
     uint32_t password = BYTES2UINT32(pwd);
 
@@ -315,30 +315,30 @@ int CmdEM4x50Brute(const char *Cmd) {
         arg_param_end
     };
 
-    CLIExecWithReturn(ctx, Cmd, argtable, true);    
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
     int first_len = 0;
-    uint8_t first[4] = {0,0,0,0};
+    uint8_t first[4] = {0, 0, 0, 0};
     CLIGetHexWithReturn(ctx, 1, first, &first_len);
     int last_len = 0;
-    uint8_t last[4] = {0,0,0,0};
+    uint8_t last[4] = {0, 0, 0, 0};
     CLIGetHexWithReturn(ctx, 2, last, &last_len);
     CLIParserFree(ctx);
 
     if (first_len != 4) {
         PrintAndLogEx(FAILED, "password length must be 4 bytes");
         return PM3_EINVARG;
-    } 
-     if (last_len != 4) {
-            PrintAndLogEx(FAILED, "password length must be 4 bytes");
-            return PM3_EINVARG;
-    } 
+    }
+    if (last_len != 4) {
+        PrintAndLogEx(FAILED, "password length must be 4 bytes");
+        return PM3_EINVARG;
+    }
 
     em4x50_data_t etd;
     etd.password1 = BYTES2UINT32(first);
     etd.password2 = BYTES2UINT32(last);
 
     // 27 passwords/second (empirical value)
-    const int speed = 27;   
+    const int speed = 27;
 
     // print some information
     int no_iter = etd.password2 - etd.password1 + 1;
@@ -348,10 +348,10 @@ int CmdEM4x50Brute(const char *Cmd) {
 
     dur_s -= dur_h * 3600 + dur_m * 60;
     PrintAndLogEx(INFO, "Trying %i passwords in range [0x%08x, 0x%08x]"
-                , no_iter
-                , etd.password1
-                , etd.password2
-            );
+                  , no_iter
+                  , etd.password1
+                  , etd.password2
+                 );
     PrintAndLogEx(INFO, "Estimated duration: %ih%im%is", dur_h, dur_m, dur_s);
 
     // start
@@ -390,7 +390,7 @@ int CmdEM4x50Chk(const char *Cmd) {
     char filename[FILE_PATH_SIZE] = {0};
     CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
     CLIParserFree(ctx);
-        
+
     if (IfPm3Flash() == false) {
         PrintAndLogEx(WARNING, "no flash memory available");
         return PM3_EFLASH;
@@ -410,17 +410,17 @@ int CmdEM4x50Chk(const char *Cmd) {
     int res = loadFileDICTIONARY(filename, data, &datalen, 4, &key_count);
     if (res || !key_count)
         return PM3_EFILE;
-    
+
     PrintAndLogEx(INFO, "You can cancel this operation by pressing the pm3 button");
 
     int status = PM3_EFAILED;
     int keyblock = 2000;    // block with 2000 bytes -> 500 keys
     uint8_t destfn[32] = "em4x50_chk.bin";
 
-    PacketResponseNG resp; 
+    PacketResponseNG resp;
     int bytes_remaining = datalen;
     while (bytes_remaining > 0) {
-        
+
         PrintAndLogEx(INPLACE, "Remaining keys: %i ", bytes_remaining / 4);
 
         // upload to flash.
@@ -434,7 +434,7 @@ int CmdEM4x50Chk(const char *Cmd) {
         clearCommandBuffer();
         SendCommandNG(CMD_LF_EM4X50_CHK, destfn, sizeof(destfn));
         WaitForResponseTimeoutW(CMD_LF_EM4X50_CHK,  &resp, -1, false);
-        
+
         status = resp.status;
         if ((status == PM3_SUCCESS) || (status == PM3_EOPABORTED))
             break;
@@ -444,7 +444,7 @@ int CmdEM4x50Chk(const char *Cmd) {
     }
 
     PrintAndLogEx(NORMAL, "");
-        
+
     // print response
     if (status == PM3_SUCCESS) {
         PrintAndLogEx(SUCCESS, "Key " _GREEN_("found: %02x %02x %02x %02x"),
@@ -452,7 +452,7 @@ int CmdEM4x50Chk(const char *Cmd) {
                       resp.data.asBytes[2],
                       resp.data.asBytes[1],
                       resp.data.asBytes[0]
-                      );
+                     );
     } else {
         PrintAndLogEx(FAILED, "No key found");
     }
@@ -536,7 +536,7 @@ int CmdEM4x50Read(const char *Cmd) {
     };
 
     CLIExecWithReturn(ctx, Cmd, argtable, true);
-    
+
     int addr = arg_get_int_def(ctx, 1, 0);
     int pwd_len = 0;
     uint8_t pwd[4] = {0x0};
@@ -545,7 +545,7 @@ int CmdEM4x50Read(const char *Cmd) {
 
     if (addr <= 0 || addr >= EM4X50_NO_WORDS) {
         return PM3_EINVARG;
-    } 
+    }
 
     em4x50_data_t etd;
 
@@ -587,11 +587,11 @@ int CmdEM4x50Info(const char *Cmd) {
 
     CLIExecWithReturn(ctx, Cmd, argtable, true);
     int pwd_len = 0;
-    uint8_t pwd[4] = {0x0};    
+    uint8_t pwd[4] = {0x0};
     CLIGetHexWithReturn(ctx, 1, pwd, &pwd_len);
     CLIParserFree(ctx);
 
-    em4x50_data_t etd = {.pwd_given = false};    
+    em4x50_data_t etd = {.pwd_given = false};
     if (pwd_len) {
         if (pwd_len != 4) {
             PrintAndLogEx(FAILED, "password length must be 4 bytes instead of %d", pwd_len);
@@ -610,7 +610,7 @@ int CmdEM4x50Info(const char *Cmd) {
         return PM3_ETIMEOUT;
     }
 
-    if ( resp.status == PM3_SUCCESS)
+    if (resp.status == PM3_SUCCESS)
         print_info_result(resp.data.asBytes);
     else
         PrintAndLogEx(FAILED, "Reading tag " _RED_("failed"));
@@ -666,7 +666,7 @@ int CmdEM4x50Reader(const char *Cmd) {
 
                 PrintAndLogEx(INFO, _GREEN_(" %s") "| %s", sprint_hex(words[i].byte, 4), r);
             }
-            
+
             PrintAndLogEx(INFO, "-------------+-------------");
         }
     } while (cm && !kbd_enter_pressed());
@@ -771,11 +771,11 @@ int CmdEM4x50Write(const char *Cmd) {
         arg_str0("p", "pwd", "<hex>", "password, 4 bytes, lsb"),
         arg_param_end
     };
-    
+
     CLIExecWithReturn(ctx, Cmd, argtable, true);
 
     int addr = arg_get_int_def(ctx, 1, 0);
-    
+
     int word_len = 0;
     uint8_t word[4] = {0x0};
     CLIGetHexWithReturn(ctx, 2, word, &word_len);
@@ -784,18 +784,18 @@ int CmdEM4x50Write(const char *Cmd) {
     uint8_t pwd[4] = {0x0};
     CLIGetHexWithReturn(ctx, 3, pwd, &pwd_len);
     CLIParserFree(ctx);
-    
+
     if (addr <= 0 || addr >= EM4X50_NO_WORDS) {
         PrintAndLogEx(FAILED, "address has to be within range [0, 31]");
         return PM3_EINVARG;
-    } 
-    
+    }
+
     if (word_len != 4) {
         PrintAndLogEx(FAILED, "word/data length must be 4 bytes instead of %d", word_len);
         return PM3_EINVARG;
     }
 
-    em4x50_data_t etd = {.pwd_given = false};   
+    em4x50_data_t etd = {.pwd_given = false};
     if (pwd_len) {
         if (pwd_len != 4) {
             PrintAndLogEx(FAILED, "password length must be 4 bytes instead of %d", pwd_len);
@@ -853,7 +853,7 @@ int CmdEM4x50WritePwd(const char *Cmd) {
         arg_str1("n", "new", "<hex>", "new password, 4 hex bytes, lsb"),
         arg_param_end
     };
-    
+
     CLIExecWithReturn(ctx, Cmd, argtable, true);
     int pwd_len = 0;
     uint8_t pwd[4] = {0x0};
@@ -865,7 +865,7 @@ int CmdEM4x50WritePwd(const char *Cmd) {
 
     CLIParserFree(ctx);
 
-    em4x50_data_t etd;    
+    em4x50_data_t etd;
     if (pwd_len != 4) {
         PrintAndLogEx(FAILED, "password length must be 4 bytes instead of %d", pwd_len);
         return PM3_EINVARG;
@@ -898,9 +898,9 @@ int CmdEM4x50WritePwd(const char *Cmd) {
     }
 
     PrintAndLogEx(SUCCESS, "Writing new password %s (%s)"
-            , sprint_hex_inrow(npwd, sizeof(npwd))
-            , _GREEN_("ok")
-         );
+                  , sprint_hex_inrow(npwd, sizeof(npwd))
+                  , _GREEN_("ok")
+                 );
     return PM3_SUCCESS;
 }
 
@@ -919,7 +919,7 @@ int CmdEM4x50Wipe(const char *Cmd) {
         arg_param_end
     };
 
-    CLIExecWithReturn(ctx, Cmd, argtable, true);    
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
     int pwd_len = 0;
     uint8_t pwd[4] = {0x0};
     CLIGetHexWithReturn(ctx, 1, pwd, &pwd_len);
@@ -935,7 +935,7 @@ int CmdEM4x50Wipe(const char *Cmd) {
 
     etd.password1 = BYTES2UINT32(pwd);
     etd.pwd_given = true;
-    
+
     // clear password
     PacketResponseNG resp;
     clearCommandBuffer();
@@ -954,13 +954,13 @@ int CmdEM4x50Wipe(const char *Cmd) {
 
     // from now on new password 0x0
     etd.password1 = 0x0;
-    
+
     // clear data (words 1 to 31)
     for (int i = 1; i < EM4X50_DEVICE_SERIAL; i++) {
 
         // no login necessary for blocks 3 to 31
         etd.pwd_given = (i <= EM4X50_CONTROL);
-        
+
         PrintAndLogEx(INPLACE, "Wiping block %i", i);
 
         etd.addresses = i << 8 | i;
@@ -971,7 +971,7 @@ int CmdEM4x50Wipe(const char *Cmd) {
             return PM3_ETIMEOUT;
         }
 
-        if ( resp.status != PM3_SUCCESS) {
+        if (resp.status != PM3_SUCCESS) {
             PrintAndLogEx(NORMAL, "");
             PrintAndLogEx(FAILED, "Wiping data " _RED_("failed"));
             return PM3_ESOFT;
@@ -1002,7 +1002,7 @@ int CmdEM4x50Restore(const char *Cmd) {
         arg_param_end
     };
 
-    CLIExecWithReturn(ctx, Cmd, argtable, true);    
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
 
     int uidLen = 0;
     uint8_t uid[4] = {0x0};
@@ -1057,7 +1057,7 @@ int CmdEM4x50Restore(const char *Cmd) {
 
         etd.addresses = i << 8 | i;
         etd.word = reflect32(BYTES2UINT32((data + 4 * i)));
-        
+
         PacketResponseNG resp;
         clearCommandBuffer();
         SendCommandNG(CMD_LF_EM4X50_WRITE, (uint8_t *)&etd, sizeof(etd));
@@ -1074,7 +1074,7 @@ int CmdEM4x50Restore(const char *Cmd) {
         }
     }
 
-    PrintAndLogEx(NORMAL, ""); 
+    PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "Done");
     return PM3_SUCCESS;
 }
@@ -1118,10 +1118,10 @@ static command_t CommandTable[] = {
     {"login",  CmdEM4x50Login,       IfPm3EM4x50,     "login into EM4x50"},
     {"rdbl",   CmdEM4x50Read,        IfPm3EM4x50,     "read word data from EM4x50"},
     {"wrbl",   CmdEM4x50Write,       IfPm3EM4x50,     "write word data to EM4x50"},
-    {"writepwd",CmdEM4x50WritePwd,   IfPm3EM4x50,     "change password of EM4x50"},
+    {"writepwd", CmdEM4x50WritePwd,   IfPm3EM4x50,     "change password of EM4x50"},
     {"wipe",   CmdEM4x50Wipe,        IfPm3EM4x50,     "wipe EM4x50 tag"},
     {"reader", CmdEM4x50Reader,      IfPm3EM4x50,     "show standard read mode data of EM4x50"},
-    {"restore",CmdEM4x50Restore,     IfPm3EM4x50,     "restore EM4x50 dump to tag"},
+    {"restore", CmdEM4x50Restore,     IfPm3EM4x50,     "restore EM4x50 dump to tag"},
     {"sim",    CmdEM4x50Sim,         IfPm3EM4x50,     "simulate EM4x50 tag"},
     {"eload",  CmdEM4x50ELoad,       IfPm3EM4x50,     "upload dump of EM4x50 to flash memory"},
     {"esave",  CmdEM4x50ESave,       IfPm3EM4x50,     "save flash memory to file"},
diff --git a/client/src/cmdlfem4x70.c b/client/src/cmdlfem4x70.c
index 2c845b377..4db2aa650 100644
--- a/client/src/cmdlfem4x70.c
+++ b/client/src/cmdlfem4x70.c
@@ -31,26 +31,26 @@ static void print_info_result(uint8_t *data) {
     // data section
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, _YELLOW_("EM4x70 data:"));
-    
-    for(int i=1; i <= 32; i+=2) {
-        PrintAndLogEx(NORMAL, "%02X %02X", data[32-i], data[32-i-1]);
+
+    for (int i = 1; i <= 32; i += 2) {
+        PrintAndLogEx(NORMAL, "%02X %02X", data[32 - i], data[32 - i - 1]);
     }
     PrintAndLogEx(NORMAL, "Tag ID: %02X %02X %02X %02X", data[7], data[6], data[5], data[4]);
-    PrintAndLogEx(NORMAL, "Lockbit 0: %d %s", (data[3] & 0x40) ? 1:0, (data[3] & 0x40) ? "LOCKED":"UNLOCKED");
-    PrintAndLogEx(NORMAL, "Lockbit 1: %d", (data[3] & 0x80) ? 1:0);
+    PrintAndLogEx(NORMAL, "Lockbit 0: %d %s", (data[3] & 0x40) ? 1 : 0, (data[3] & 0x40) ? "LOCKED" : "UNLOCKED");
+    PrintAndLogEx(NORMAL, "Lockbit 1: %d", (data[3] & 0x80) ? 1 : 0);
     PrintAndLogEx(NORMAL, "");
 
 }
 
 int em4x70_info(void) {
-    
+
     em4x70_data_t edata = {
         .parity = false // TODO: try both? or default to true
     };
 
     clearCommandBuffer();
     SendCommandNG(CMD_LF_EM4X70_INFO, (uint8_t *)&edata, sizeof(edata));
-    
+
     PacketResponseNG resp;
     if (!WaitForResponseTimeout(CMD_LF_EM4X70_INFO, &resp, TIMEOUT)) {
         PrintAndLogEx(WARNING, "(em4x70) timeout while waiting for reply.");
@@ -87,7 +87,7 @@ int CmdEM4x70Info(const char *Cmd) {
                   "  V4070 and EM4170 do require parity bit.",
                   "lf em 4x70 info\n"
                   "lf em 4x70 info --par -> adds parity bit to command\n"
-                );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -128,7 +128,7 @@ int CmdEM4x70Write(const char *Cmd) {
                   "Write EM4x70\n",
                   "lf em 4x70 write -b 15 -d c0de -> write 'c0de' to block 15\n"
                   "lf em 4x70 write -b 15 -d c0de --par -> adds parity bit to commands\n"
-                );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -139,11 +139,11 @@ int CmdEM4x70Write(const char *Cmd) {
     };
 
     CLIExecWithReturn(ctx, Cmd, argtable, true);
-    
+
     etd.parity = arg_get_lit(ctx, 1);
-    
+
     int addr = arg_get_int(ctx, 2);
-    
+
     int word_len = 0;
     uint8_t word[2] = {0x0};
     CLIGetHexWithReturn(ctx, 3, word, &word_len);
@@ -153,8 +153,8 @@ int CmdEM4x70Write(const char *Cmd) {
     if (addr < 0 || addr >= EM4X70_NUM_BLOCKS) {
         PrintAndLogEx(FAILED, "block has to be within range [0, 15]");
         return PM3_EINVARG;
-    } 
-    
+    }
+
     if (word_len != 2) {
         PrintAndLogEx(FAILED, "word/data length must be 2 bytes instead of %d", word_len);
         return PM3_EINVARG;
@@ -195,7 +195,7 @@ int CmdEM4x70Unlock(const char *Cmd) {
                   " 00000000\n",
                   "lf em 4x70 unlock -p 11223344 -> Unlock with PIN\n"
                   "lf em 4x70 unlock -p 11223344 --par -> Unlock with PIN using parity commands\n"
-                );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -205,12 +205,12 @@ int CmdEM4x70Unlock(const char *Cmd) {
     };
 
     CLIExecWithReturn(ctx, Cmd, argtable, true);
-    
+
     etd.parity = arg_get_lit(ctx, 1);
-    
+
     int pin_len = 0;
     uint8_t pin[4] = {0x0};
-    
+
     CLIGetHexWithReturn(ctx, 2, pin, &pin_len);
 
     CLIParserFree(ctx);
diff --git a/client/src/cmdlffdxb.c b/client/src/cmdlffdxb.c
index f44182483..529f63019 100644
--- a/client/src/cmdlffdxb.c
+++ b/client/src/cmdlffdxb.c
@@ -727,7 +727,7 @@ static int CmdFdxBClone(const char *Cmd) {
     }
 
     uint32_t extended = 0;
-    bool has_extended = false; 
+    bool has_extended = false;
     if (extended_len) {
         extended = bytes_to_num(edata, extended_len);
         has_extended = true;
@@ -773,10 +773,10 @@ static int CmdFdxBClone(const char *Cmd) {
     free(bs);
 
     PrintAndLogEx(INFO, "Preparing to clone FDX-B to " _YELLOW_("%s") " with animal ID: " _GREEN_("%04u-%"PRIu64)
-            , cardtype
-            , country_code
-            , national_code
-            );
+                  , cardtype
+                  , country_code
+                  , national_code
+                 );
     print_blocks(blocks,  ARRAYLEN(blocks));
 
     int res;
@@ -820,7 +820,7 @@ static int CmdFdxBSim(const char *Cmd) {
     CLIParserFree(ctx);
 
     uint32_t extended = 0;
-    bool has_extended = false; 
+    bool has_extended = false;
     if (extended_len) {
         extended = bytes_to_num(edata, extended_len);
         has_extended = true;
diff --git a/client/src/cmdlfgallagher.c b/client/src/cmdlfgallagher.c
index cf0488877..12b6b9b49 100644
--- a/client/src/cmdlfgallagher.c
+++ b/client/src/cmdlfgallagher.c
@@ -233,7 +233,7 @@ static int CmdGallagherClone(const char *Cmd) {
 
 static int CmdGallagherSim(const char *Cmd) {
 
-   CLIParserContext *ctx;
+    CLIParserContext *ctx;
     CLIParserInit(&ctx, "lf gallagher sim",
                   "Enables simulation of GALLAGHER card with specified card number.\n"
                   "Simulation runs until the button is pressed or another USB command is issued.\n",
diff --git a/client/src/cmdlfguard.c b/client/src/cmdlfguard.c
index ec49b46c5..929079158 100644
--- a/client/src/cmdlfguard.c
+++ b/client/src/cmdlfguard.c
@@ -226,10 +226,10 @@ static int CmdGuardClone(const char *Cmd) {
     free(bs);
 
     PrintAndLogEx(INFO, "Preparing to clone Guardall to " _YELLOW_("%s") " with Facility Code: " _GREEN_("%u") " Card Number: " _GREEN_("%u")
-            , cardtype
-            , facilitycode
-            , cardnumber
-            );
+                  , cardtype
+                  , facilitycode
+                  , cardnumber
+                 );
     print_blocks(blocks,  ARRAYLEN(blocks));
 
     int res;
@@ -281,9 +281,9 @@ static int CmdGuardSim(const char *Cmd) {
     }
 
     PrintAndLogEx(SUCCESS, "Simulating Guardall Prox - Facility Code: " _YELLOW_("%u") " CardNumber: " _YELLOW_("%u")
-            , facilitycode
-            , cardnumber
-            );
+                  , facilitycode
+                  , cardnumber
+                 );
 
     // Guard uses:  clk: 64, invert: 0, encoding: 2 (ASK Biphase)
     lf_asksim_t *payload = calloc(1, sizeof(lf_asksim_t) + sizeof(bs));
diff --git a/client/src/cmdlfhid.c b/client/src/cmdlfhid.c
index 3e10def56..108550539 100644
--- a/client/src/cmdlfhid.c
+++ b/client/src/cmdlfhid.c
@@ -60,16 +60,16 @@ static int sendTry(uint8_t format_idx, wiegand_card_t *card, uint32_t delay, boo
 
     if (HIDPack(format_idx, card, &packed) == false) {
         PrintAndLogEx(WARNING, "The card data could not be encoded in the selected format.");
-        return PM3_ESOFT;        
+        return PM3_ESOFT;
     }
 
     if (verbose) {
         PrintAndLogEx(INFO, "Trying FC: " _YELLOW_("%u") " CN: " _YELLOW_("%"PRIu64) " Issue level: " _YELLOW_("%u") " OEM: " _YELLOW_("%u")
-                , card->FacilityCode
-                , card->CardNumber
-                , card->IssueLevel
-                , card->OEM
-                );
+                      , card->FacilityCode
+                      , card->CardNumber
+                      , card->IssueLevel
+                      , card->OEM
+                     );
     }
 
     lf_hidsim_t payload;
diff --git a/client/src/cmdlfindala.c b/client/src/cmdlfindala.c
index df2bd4f46..da2662af1 100644
--- a/client/src/cmdlfindala.c
+++ b/client/src/cmdlfindala.c
@@ -250,7 +250,7 @@ static int CmdIndalaDemod(const char *Cmd) {
                   "lf indala demod --clock 32      -> demod a Indala tag from GraphBuffer using a clock of RF/32\n"
                   "lf indala demod --clock 32 -i    -> demod a Indala tag from GraphBuffer using a clock of RF/32 and inverting data\n"
                   "lf indala demod --clock 64 -i --maxerror 0  -> demod a Indala tag from GraphBuffer using a clock of RF/64, inverting data and allowing 0 demod errors"
-                );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -281,7 +281,7 @@ static int CmdIndalaDemodAlt(const char *Cmd) {
                   "It's now considered obsolete but remains because it has sometimes its advantages.",
                   "lf indala altdemod\n"
                   "lf indala altdemod --long     -> demod a Indala tag from GraphBuffer as 224 bit long format"
-                );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -583,9 +583,9 @@ static int CmdIndalaSim(const char *Cmd) {
     // lf simpsk 1 c 32 r 2 d 0102030405060708
 
     PrintAndLogEx(SUCCESS, "Simulating " _YELLOW_("%s") " Indala raw " _YELLOW_("%s")
-        , (is_long_uid) ? "224b" : "64b"
-        , sprint_hex_inrow(raw, raw_len)
-        );
+                  , (is_long_uid) ? "224b" : "64b"
+                  , sprint_hex_inrow(raw, raw_len)
+                 );
     PrintAndLogEx(SUCCESS, "Press pm3-button to abort simulation or run another command");
 
     // indala PSK,  clock 32, carrier 0
@@ -665,7 +665,7 @@ static int CmdIndalaClone(const char *Cmd) {
     uint8_t max = 0;
     uint32_t blocks[8] = {0};
     char cardtype[16] = {"T55x7"};
-    
+
     if (is_long_uid) {
 
         blocks[0] = T55x7_BITRATE_RF_32 | T55x7_MODULATION_PSK2 | (7 << T55x7_MAXBLOCK_SHIFT);
@@ -673,7 +673,7 @@ static int CmdIndalaClone(const char *Cmd) {
             blocks[0] = T5555_FIXED | T5555_SET_BITRATE(32) | T5555_MODULATION_PSK2 | (7 << T5555_MAXBLOCK_SHIFT);
             snprintf(cardtype, sizeof(cardtype), "Q5/T5555");
         }
-        
+
         if (em) {
             blocks[0] = EM4305_INDALA_224_CONFIG_BLOCK;
             snprintf(cardtype, sizeof(cardtype), "EM4305/4469");
@@ -691,9 +691,9 @@ static int CmdIndalaClone(const char *Cmd) {
         // 224 BIT UID
         // config for Indala (RF/32;PSK2 with RF/2;Maxblock=7)
         PrintAndLogEx(INFO, "Preparing to clone Indala 224bit to " _YELLOW_("%s") " raw " _GREEN_("%s")
-            , cardtype
-            , sprint_hex_inrow(raw, raw_len)
-            );
+                      , cardtype
+                      , sprint_hex_inrow(raw, raw_len)
+                     );
 
 
     } else {
@@ -737,7 +737,7 @@ static int CmdIndalaClone(const char *Cmd) {
             blocks[0] = T5555_FIXED | T5555_SET_BITRATE(32) | T5555_MODULATION_PSK1 | (2 << T5555_MAXBLOCK_SHIFT);
             snprintf(cardtype, sizeof(cardtype), "Q5/T5555");
         }
-        
+
         if (em) {
             blocks[0] = EM4305_INDALA_64_CONFIG_BLOCK;
             snprintf(cardtype, sizeof(cardtype), "EM4305/4469");
@@ -749,9 +749,9 @@ static int CmdIndalaClone(const char *Cmd) {
 
         // config for Indala 64 format (RF/32;PSK1 with RF/2;Maxblock=2)
         PrintAndLogEx(INFO, "Preparing to clone Indala 64bit to " _YELLOW_("%s") " raw " _GREEN_("%s")
-                , cardtype
-                , sprint_hex_inrow(raw, raw_len)
-                );
+                      , cardtype
+                      , sprint_hex_inrow(raw, raw_len)
+                     );
     }
 
     print_blocks(blocks, max);
diff --git a/client/src/cmdlfio.c b/client/src/cmdlfio.c
index 3adc0ed90..fd9ce6d1d 100644
--- a/client/src/cmdlfio.c
+++ b/client/src/cmdlfio.c
@@ -318,12 +318,12 @@ static int CmdIOProxClone(const char *Cmd) {
     blocks[2] = bytebits_to_byte(bits + 32, 32);
 
     PrintAndLogEx(INFO, "Preparing to clone ioProx to " _YELLOW_("%s") " with Version: " _GREEN_("%u") " FC: " _GREEN_("%u (0x%02x)") " CN: " _GREEN_("%u")
-            , cardtype
-            , version
-            , fc
-            , fc
-            , cn
-            );
+                  , cardtype
+                  , version
+                  , fc
+                  , fc
+                  , cn
+                 );
     print_blocks(blocks,  ARRAYLEN(blocks));
 
     int res;
diff --git a/client/src/cmdlfjablotron.c b/client/src/cmdlfjablotron.c
index 7e1f81557..6e8a35d2c 100644
--- a/client/src/cmdlfjablotron.c
+++ b/client/src/cmdlfjablotron.c
@@ -219,11 +219,11 @@ static int CmdJablotronClone(const char *Cmd) {
 
     free(bits);
 
-   uint64_t id = getJablontronCardId(fullcode);
+    uint64_t id = getJablontronCardId(fullcode);
 
     PrintAndLogEx(INFO, "Preparing to clone Jablotron to " _YELLOW_("%s") " with FullCode: " _GREEN_("%"PRIx64)"  id: " _GREEN_("%"PRIx64), cardtype, fullcode, id);
     print_blocks(blocks,  ARRAYLEN(blocks));
-    
+
     int res;
     if (em) {
         res = em4x05_clone_tag(blocks, ARRAYLEN(blocks), 0, false);
diff --git a/client/src/cmdlfmotorola.c b/client/src/cmdlfmotorola.c
index 3f2ce059c..336bdf7b2 100644
--- a/client/src/cmdlfmotorola.c
+++ b/client/src/cmdlfmotorola.c
@@ -264,7 +264,7 @@ static int CmdMotorolaSim(const char *Cmd) {
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
     CLIParserFree(ctx);
-    
+
     // PSK sim.
     PrintAndLogEx(INFO, " PSK1 at 66 kHz... Interesting.");
     PrintAndLogEx(INFO, " To be implemented, feel free to contribute!");
diff --git a/client/src/cmdlfnedap.c b/client/src/cmdlfnedap.c
index 1e87c85bf..20cb5eec5 100644
--- a/client/src/cmdlfnedap.c
+++ b/client/src/cmdlfnedap.c
@@ -145,13 +145,13 @@ int demodNedap(bool verbose) {
         badgeId = r1 * 10000 + r2 * 1000 + r3 * 100 + r4 * 10 + r5;
 
         PrintAndLogEx(SUCCESS, "NEDAP (%s) - ID: " _YELLOW_("%05u") " subtype: " _YELLOW_("%1u")" customer code: " _YELLOW_("%u / 0x%03X") " Raw: " _YELLOW_("%s")
-                , (size == 128) ? "128b" : "64b"
-                , badgeId
-                , subtype
-                , customerCode
-                , customerCode
-                , sprint_hex_inrow(data, size / 8)
-                );
+                      , (size == 128) ? "128b" : "64b"
+                      , badgeId
+                      , subtype
+                      , customerCode
+                      , customerCode
+                      , sprint_hex_inrow(data, size / 8)
+                     );
         PrintAndLogEx(DEBUG, "Checksum (%s) 0x%04X",  _GREEN_("ok"), checksum);
 
     } else {
@@ -373,7 +373,7 @@ static int CmdLFNedapClone(const char *Cmd) {
         arg_u64_0(NULL, "st", "<dec>", "optional - sub type (default 5)"),
         arg_u64_1(NULL, "cc", "<dec>", "customer code (0-4095)"),
         arg_u64_1(NULL, "id", "<dec>", "ID (0-99999)"),
-        arg_lit0("l", "long", "optional - long (128), default to short (64)"),        
+        arg_lit0("l", "long", "optional - long (128), default to short (64)"),
         arg_lit0(NULL, "q5", "optional - specify writing to Q5/T5555 tag"),
         arg_lit0(NULL, "em", "optional - specify writing to EM4305/4469 tag"),
         arg_param_end
@@ -395,17 +395,17 @@ static int CmdLFNedapClone(const char *Cmd) {
     }
     if (sub_type > 0xF) {
         PrintAndLogEx(FAILED, "out-of-range, valid subtype is between 0-15");
-        return PM3_EINVARG;    
+        return PM3_EINVARG;
     }
 
     if (customer_code > 0xFFF) {
         PrintAndLogEx(FAILED, "out-of-range, valid customer code is between 0-4095");
-        return PM3_EINVARG;    
+        return PM3_EINVARG;
     }
 
     if (id > 99999) {
         PrintAndLogEx(FAILED, "out-of-range, id max value is 99999");
-        return PM3_EINVARG;    
+        return PM3_EINVARG;
     }
 
     PrintAndLogEx(SUCCESS, "NEDAP (%s) - ID: " _GREEN_("%05u") " subtype: " _GREEN_("%1u") " customer code: " _GREEN_("%u / 0x%03X")
@@ -454,7 +454,7 @@ static int CmdLFNedapClone(const char *Cmd) {
     NedapGen(sub_type, customer_code, id, is_long, data);
 
     for (uint8_t i = 1; i < max ; i++) {
-        blocks[i] = bytes_to_num (data + ((i - 1) * 4), 4);
+        blocks[i] = bytes_to_num(data + ((i - 1) * 4), 4);
     }
 
     PrintAndLogEx(SUCCESS, "Preparing to clone NEDAP to " _YELLOW_("%s") " tag", cardtype);
@@ -492,7 +492,7 @@ static int CmdLFNedapSim(const char *Cmd) {
         arg_u64_0(NULL, "st", "<dec>", "optional - sub type (default 5)"),
         arg_u64_1(NULL, "cc", "<dec>", "customer code (0-4095)"),
         arg_u64_1(NULL, "id", "<dec>", "ID (0-99999)"),
-        arg_lit0("l", "long", "optional - long (128), default to short (64)"),        
+        arg_lit0("l", "long", "optional - long (128), default to short (64)"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);
@@ -502,20 +502,20 @@ static int CmdLFNedapSim(const char *Cmd) {
     uint32_t id = arg_get_u32_def(ctx, 3, 0);
     bool is_long = arg_get_lit(ctx, 4);
     CLIParserFree(ctx);
-    
+
     if (sub_type > 0xF) {
         PrintAndLogEx(FAILED, "out-of-range, valid subtype is between 0-15");
-        return PM3_EINVARG;    
+        return PM3_EINVARG;
     }
 
     if (customer_code > 0xFFF) {
         PrintAndLogEx(FAILED, "out-of-range, valid customer code is between 0-4095");
-        return PM3_EINVARG;    
+        return PM3_EINVARG;
     }
 
     if (id > 99999) {
         PrintAndLogEx(FAILED, "out-of-range, id max value is 99999");
-        return PM3_EINVARG;    
+        return PM3_EINVARG;
     }
 
     PrintAndLogEx(SUCCESS, "NEDAP (%s) - ID: " _GREEN_("%05u") " subtype: " _GREEN_("%1u") " customer code: " _GREEN_("%u / 0x%03X")
diff --git a/client/src/cmdlfpcf7931.c b/client/src/cmdlfpcf7931.c
index 48a029e2b..bd744f8ba 100644
--- a/client/src/cmdlfpcf7931.c
+++ b/client/src/cmdlfpcf7931.c
@@ -125,7 +125,7 @@ static int CmdLFPCF7931Config(const char *Cmd) {
     }
 
     if (pwd_len) {
-       memcpy(configPcf.Pwd, pwd, sizeof(configPcf.Pwd));
+        memcpy(configPcf.Pwd, pwd, sizeof(configPcf.Pwd));
     }
     if (delay != -1) {
         configPcf.InitDelay = (delay & 0xFFFF);
@@ -134,7 +134,7 @@ static int CmdLFPCF7931Config(const char *Cmd) {
         configPcf.OffsetWidth = (ow & 0xFFFF);
     }
     if (op != 0xFFFF) {
-        configPcf.OffsetPosition =(op & 0xFFFF);
+        configPcf.OffsetPosition = (op & 0xFFFF);
     }
 
     pcf7931_printConfig();
diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index a3f5ca20b..d67770ba3 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -2806,7 +2806,7 @@ char *GetModelStrFromCID(uint32_t cid) {
 }
 
 char *GetConfigBlock0Source(uint8_t id) {
-   
+
     static char buf[40];
     char *retStr = buf;
 
diff --git a/client/src/cmdlft55xx.h b/client/src/cmdlft55xx.h
index 90fbaa85d..d87194b25 100644
--- a/client/src/cmdlft55xx.h
+++ b/client/src/cmdlft55xx.h
@@ -129,7 +129,7 @@ typedef struct {
         notSet     = 0x00,
         autoDetect = 0x01,
         userSet    = 0x02,
-        tagRead    = 0x03, 
+        tagRead    = 0x03,
     } block0Status;
     enum {
         RF_8 = 0x00,
diff --git a/client/src/cmdlfti.c b/client/src/cmdlfti.c
index b02ad2e34..3e8138332 100644
--- a/client/src/cmdlfti.c
+++ b/client/src/cmdlfti.c
@@ -330,7 +330,7 @@ static int CmdTIWrite(const char *Cmd) {
         arg_param_begin,
         arg_str1("r", "raw", "<hex>", "raw hex data. 8 bytes max"),
         arg_str0(NULL, "crc", "<hex>", "optional - crc"),
-        arg_param_end        
+        arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);
 
@@ -354,7 +354,7 @@ static int CmdTIWrite(const char *Cmd) {
     payload.crc = bytes_to_num(crc, crc_len);
 
     clearCommandBuffer();
-    SendCommandNG(CMD_LF_TI_WRITE, (uint8_t*)&payload, sizeof(payload));
+    SendCommandNG(CMD_LF_TI_WRITE, (uint8_t *)&payload, sizeof(payload));
     PrintAndLogEx(SUCCESS, "Done");
     PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf ti reader`") " to verify");
     return PM3_SUCCESS;
diff --git a/common/commonutil.c b/common/commonutil.c
index 70114bba1..802f362d8 100644
--- a/common/commonutil.c
+++ b/common/commonutil.c
@@ -109,7 +109,7 @@ uint32_t reflect32(uint32_t b) {
     // swap bytes
     v = ((v >> 8) & 0x00FF00FF) | ((v & 0x00FF00FF) << 8);
     // swap 2-byte long pairs
-    v = ( v >> 16             ) | ( v               << 16);
+    v = (v >> 16) | (v               << 16);
     return v;
 }
 
diff --git a/common/lfdemod.c b/common/lfdemod.c
index 24de41676..171417143 100644
--- a/common/lfdemod.c
+++ b/common/lfdemod.c
@@ -1082,8 +1082,8 @@ int DetectPSKClock(uint8_t *dest, size_t size, int clock, size_t *firstPhaseShif
     if (g_debugMode == 2) prnt("DEBUG PSK: firstFullWave: %zu, waveLen: %d", firstFullWave, fullWaveLen);
 
     // Avoid autodetect if user selected a clock
-    for(uint8_t validClk = 1; validClk < 8; validClk++) {
-        if(clock == clk[validClk]) return(clock);
+    for (uint8_t validClk = 1; validClk < 8; validClk++) {
+        if (clock == clk[validClk]) return (clock);
     }
 
     //test each valid clock from greatest to smallest to see which lines up
diff --git a/doc/commands.md b/doc/commands.md
index 44489d546..58578c26e 100644
--- a/doc/commands.md
+++ b/doc/commands.md
@@ -38,7 +38,6 @@ Check column "offline" for their availability.
 |`analyse nuid           `|Y       |`create NUID from 7byte UID`
 |`analyse demodbuff      `|Y       |`Load binary string to demodbuffer`
 |`analyse freq           `|Y       |`Calc wave lengths`
-|`analyse foo            `|Y       |`muxer`
 
 
 ### data
@@ -143,6 +142,7 @@ Check column "offline" for their availability.
 |`hf 14a raw             `|N       |`Send raw hex data to tag`
 |`hf 14a antifuzz        `|N       |`Fuzzing the anticollision phase.  Warning! Readers may react strange`
 |`hf 14a config          `|N       |`Configure 14a settings (use with caution)`
+|`hf 14a apdufuzz        `|N       |`Fuzz APDU - CLA/INS/P1P2`
 
 
 ### hf 14b
@@ -248,28 +248,29 @@ Check column "offline" for their availability.
 
 |command                  |offline |description
 |-------                  |------- |-----------
-|`hf iclass help         `|Y       |`This help`
-|`hf iclass dump         `|N       |`[options..] Dump Picopass / iCLASS tag to file`
-|`hf iclass info         `|Y       |`            Tag information`
-|`hf iclass list         `|Y       |`            List iclass history`
-|`hf iclass rdbl         `|N       |`[options..] Read Picopass / iCLASS block`
-|`hf iclass reader       `|N       |`            Act like an Picopass / iCLASS reader`
-|`hf iclass restore      `|N       |`[options..] Restore a dump file onto a Picopass / iCLASS tag`
-|`hf iclass sniff        `|N       |`            Eavesdrop Picopass / iCLASS communication`
-|`hf iclass wrbl         `|N       |`[options..] Write Picopass / iCLASS block`
-|`hf iclass chk          `|N       |`[options..] Check keys`
-|`hf iclass loclass      `|Y       |`[options..] Use loclass to perform bruteforce reader attack`
-|`hf iclass lookup       `|Y       |`[options..] Uses authentication trace to check for key in dictionary file`
-|`hf iclass sim          `|N       |`[options..] Simulate iCLASS tag`
-|`hf iclass eload        `|N       |`[f <fn>   ] Load Picopass / iCLASS dump file into emulator memory`
-|`hf iclass esave        `|N       |`[f <fn>   ] Save emulator memory to file`
-|`hf iclass eview        `|N       |`[options..] View emulator memory`
-|`hf iclass calcnewkey   `|Y       |`[options..] Calc diversified keys (blocks 3 & 4) to write new keys`
-|`hf iclass encrypt      `|Y       |`[options..] Encrypt given block data`
-|`hf iclass decrypt      `|Y       |`[options..] Decrypt given block data or tag dump file`
-|`hf iclass managekeys   `|Y       |`[options..] Manage keys to use with iclass commands`
-|`hf iclass permutekey   `|N       |`            Permute function from 'heart of darkness' paper`
-|`hf iclass view         `|Y       |`[options..] Display content from tag dump file`
+|`hf iclass help         `|Y       |`    This help`
+|`hf iclass dump         `|N       |`[*] Dump Picopass / iCLASS tag to file`
+|`hf iclass info         `|Y       |`    Tag information`
+|`hf iclass list         `|Y       |`    List iclass history`
+|`hf iclass rdbl         `|N       |`[*] Read Picopass / iCLASS block`
+|`hf iclass reader       `|N       |`    Act like an Picopass / iCLASS reader`
+|`hf iclass restore      `|N       |`[*] Restore a dump file onto a Picopass / iCLASS tag`
+|`hf iclass sniff        `|N       |`    Eavesdrop Picopass / iCLASS communication`
+|`hf iclass wrbl         `|N       |`[*] Write Picopass / iCLASS block`
+|`hf iclass chk          `|N       |`[*] Check keys`
+|`hf iclass loclass      `|Y       |`[*] Use loclass to perform bruteforce reader attack`
+|`hf iclass lookup       `|Y       |`[*] Uses authentication trace to check for key in dictionary file`
+|`hf iclass sim          `|N       |`[*] Simulate iCLASS tag`
+|`hf iclass eload        `|N       |`[*] Load Picopass / iCLASS dump file into emulator memory`
+|`hf iclass esave        `|N       |`[*] Save emulator memory to file`
+|`hf iclass eview        `|N       |`[.] View emulator memory`
+|`hf iclass calcnewkey   `|Y       |`[*] Calc diversified keys (blocks 3 & 4) to write new keys`
+|`hf iclass encode       `|Y       |`[*] Encode binary wiegand to block 7`
+|`hf iclass encrypt      `|Y       |`[*] Encrypt given block data`
+|`hf iclass decrypt      `|Y       |`[*] Decrypt given block data or tag dump file`
+|`hf iclass managekeys   `|Y       |`[*] Manage keys to use with iclass commands`
+|`hf iclass permutekey   `|N       |`    Permute function from 'heart of darkness' paper`
+|`hf iclass view         `|Y       |`[*] Display content from tag dump file`
 
 
 ### hf legic
@@ -577,10 +578,10 @@ Check column "offline" for their availability.
 |command                  |offline |description
 |-------                  |------- |-----------
 |`lf em help             `|Y       |`This help`
-|`lf em 410x             `|Y       |`EM 410x commands...`
-|`lf em 4x05             `|Y       |`EM 4x05 commands...`
-|`lf em 4x50             `|Y       |`EM 4x50 commands...`
-|`lf em 4x70             `|Y       |`EM 4x70 commands...`
+|`lf em 410x             `|Y       |`EM 4102 commands...`
+|`lf em 4x05             `|Y       |`EM 4205 / 4305 / 4369 / 4469 commands...`
+|`lf em 4x50             `|Y       |`EM 4350 / 4450 commands...`
+|`lf em 4x70             `|Y       |`EM 4070 / 4170 commands...`
 
 
 ### lf fdxb
@@ -672,9 +673,9 @@ Check column "offline" for their availability.
 |command                  |offline |description
 |-------                  |------- |-----------
 |`lf indala help         `|Y       |`this help`
-|`lf indala demod        `|Y       |`demodulate an indala tag (PSK1) from GraphBuffer`
-|`lf indala altdemod     `|Y       |`alternative method to Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)`
-|`lf indala reader       `|N       |`read an Indala Prox tag from the antenna`
+|`lf indala demod        `|Y       |`demodulate an Indala tag (PSK1) from GraphBuffer`
+|`lf indala altdemod     `|Y       |`alternative method to demodulate samples for Indala 64 bit UID (option '224' for 224 bit)`
+|`lf indala reader       `|N       |`read an Indala tag from the antenna`
 |`lf indala clone        `|N       |`clone Indala tag to T55x7 or Q5/T5555`
 |`lf indala sim          `|N       |`simulate Indala tag`
 
@@ -686,10 +687,10 @@ Check column "offline" for their availability.
 |command                  |offline |description
 |-------                  |------- |-----------
 |`lf io help             `|Y       |`this help`
-|`lf io demod            `|Y       |`demodulate an IOProx tag from the GraphBuffer`
+|`lf io demod            `|Y       |`demodulate an ioProx tag from the GraphBuffer`
 |`lf io reader           `|N       |`attempt to read and extract tag data`
-|`lf io clone            `|N       |`clone IOProx tag to T55x7 or Q5/T5555`
-|`lf io sim              `|N       |`simulate IOProx tag`
+|`lf io clone            `|N       |`clone ioProx tag to T55x7 or Q5/T5555`
+|`lf io sim              `|N       |`simulate ioProx tag`
 |`lf io watch            `|N       |`continuously watch for cards. Reader mode`
 
 
@@ -1001,7 +1002,7 @@ Check column "offline" for their availability.
 |-------                  |------- |-----------
 |`wiegand help           `|Y       |`This help`
 |`wiegand list           `|Y       |`List available wiegand formats`
-|`wiegand encode         `|Y       |`Encode to wiegand raw hex`
-|`wiegand decode         `|Y       |`Convert raw hex to decoded wiegand format`
+|`wiegand encode         `|Y       |`Encode to wiegand raw hex (currently for HID Prox)`
+|`wiegand decode         `|Y       |`Convert raw hex to decoded wiegand format (currently for HID Prox)`
 
 

From a6024a8622f86727f2880ed6aea3a2421bf45cd0 Mon Sep 17 00:00:00 2001
From: Christian Molson <christian@cmolabs.org>
Date: Sat, 12 Dec 2020 09:59:30 -0500
Subject: [PATCH 035/682] EM4x70 Authentication support

---
 armsrc/appmain.c         |  4 +++
 armsrc/em4x70.c          | 63 +++++++++++++++++++++++++++++++++++++-
 armsrc/em4x70.h          |  1 +
 client/src/cmdlfem4x70.c | 65 ++++++++++++++++++++++++++++++++++++++++
 client/src/cmdlfem4x70.h |  1 +
 include/em4x70.h         |  4 +++
 include/pm3_cmd.h        |  1 +
 7 files changed, 138 insertions(+), 1 deletion(-)

diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index e7d6fae8d..57c2f36c7 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -1178,6 +1178,10 @@ static void PacketReceived(PacketCommandNG *packet) {
             em4x70_unlock((em4x70_data_t *)packet->data.asBytes);
             break;
         }
+        case CMD_LF_EM4X70_AUTH: {
+            em4x70_auth((em4x70_data_t *)packet->data.asBytes);
+            break;
+        }
 #endif
 
 #ifdef WITH_ISO15693
diff --git a/armsrc/em4x70.c b/armsrc/em4x70.c
index 0b6cf36e6..991d6df93 100644
--- a/armsrc/em4x70.c
+++ b/armsrc/em4x70.c
@@ -360,6 +360,46 @@ static bool check_ack(void) {
     return false;
 }
 
+static int authenticate(const uint8_t *rnd, const uint8_t *frnd, uint8_t *response) {
+
+    if (find_listen_window(true)) {
+
+        em4x70_send_nibble(EM4X70_COMMAND_AUTH, true);
+        
+        // Send 56-bit Random number
+        for(int i=0;i<7;i++) {
+            em4x70_send_byte(rnd[i]);
+        }
+        
+        // Send 7 x 0's (Diversity bits)
+        for(int i=0; i<7; i++) {
+            em4x70_send_bit(0);
+        }
+        
+        // Send 28-bit f(RN)
+
+        // Send first 24 bits
+        for(int i=0; i < 3; i++) {
+            em4x70_send_byte(frnd[i]);
+        }
+        
+        // Send last 4 bits (no parity)
+        em4x70_send_nibble((frnd[3] >> 4) & 0xf, false);
+
+        // Receive header, 20-bit g(RN), LIW
+        uint8_t grnd[EM4X70_MAX_RECEIVE_LENGTH] = {0};
+        int num = em4x70_receive(grnd);
+        if(num < 10) {
+            Dbprintf("Auth failed");
+            return PM3_ESOFT;
+        }
+        bits2bytes(grnd, 24, response);
+        return PM3_SUCCESS;
+    }
+
+    return PM3_ESOFT;
+}
+
 static int send_pin(const uint32_t pin) {
 
     // sends pin code for unlocking
@@ -387,7 +427,7 @@ static int send_pin(const uint32_t pin) {
             // <w> Writes Lock Bits
             WaitTicks(TICKS_PER_FC * EM4X70_T_TAG_WEE);
             // <-- Receive header + ID
-            uint8_t tag_id[64];
+            uint8_t tag_id[EM4X70_MAX_RECEIVE_LENGTH];
             int num  = em4x70_receive(tag_id);
             if(num < 32) {
                 Dbprintf("Invalid ID Received");
@@ -731,4 +771,25 @@ void em4x70_unlock(em4x70_data_t *etd) {
     reply_ng(CMD_LF_EM4X70_UNLOCK, status, tag.data, sizeof(tag.data));
 }
 
+void em4x70_auth(em4x70_data_t *etd) {
+
+    uint8_t status = 0;
+    uint8_t response[3] = {0};
+
+    command_parity = etd->parity;
+
+    init_tag();
+    EM4170_setup_read();
+
+    // Find the Tag
+    if (get_signalproperties() && find_EM4X70_Tag()) {
+
+        // Authenticate and get tag response
+        status = authenticate(etd->rnd, etd->frnd, response) == PM3_SUCCESS;
+    }
+
+    StopTicks();
+    lf_finalize();
+    reply_ng(CMD_LF_EM4X70_AUTH, status, response, sizeof(response));
+}
 
diff --git a/armsrc/em4x70.h b/armsrc/em4x70.h
index 2d9f077f8..17ac243ae 100644
--- a/armsrc/em4x70.h
+++ b/armsrc/em4x70.h
@@ -20,5 +20,6 @@ typedef struct {
 void em4x70_info(em4x70_data_t *etd);
 void em4x70_write(em4x70_data_t *etd);
 void em4x70_unlock(em4x70_data_t *etd);
+void em4x70_auth(em4x70_data_t *etd);
 
 #endif /* EM4x70_H */
diff --git a/client/src/cmdlfem4x70.c b/client/src/cmdlfem4x70.c
index 2c845b377..da4690db9 100644
--- a/client/src/cmdlfem4x70.c
+++ b/client/src/cmdlfem4x70.c
@@ -240,11 +240,76 @@ int CmdEM4x70Unlock(const char *Cmd) {
     return PM3_ESOFT;
 }
 
+int CmdEM4x70Auth(const char *Cmd) {
+
+    // Authenticate transponder
+    // Send 56-bit random number + pre-computed f(rnd, k) to transponder.
+    // Transponder will respond with a response
+    em4x70_data_t etd = {0};
+
+    CLIParserContext *ctx;
+
+    CLIParserInit(&ctx, "lf em 4x70 auth",
+                  "Authenticate against an EM4x70 by sending random number (RN) and F(RN)\n"
+                  "  If F(RN) is incorrect based on the tag crypt key, the tag will not respond",
+                  "lf em 4x70 auth -r 11223344556677 -f 11223344\n"
+                );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0("x", "par", "Add parity bit when sending commands"),
+        arg_str1("r", "rnd", "<hex>", "Random 56-bit"),
+        arg_str1("f", "frn", "<hex>", "F(RN) 28-bit as 4 hex bytes"),
+        arg_param_end
+    };
+
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    
+    etd.parity = arg_get_lit(ctx, 1);
+    
+    int rnd_len = 7;
+    CLIGetHexWithReturn(ctx, 2, etd.rnd, &rnd_len);
+
+    int frnd_len = 4;
+    CLIGetHexWithReturn(ctx, 3, etd.frnd, &frnd_len);
+
+    CLIParserFree(ctx);
+
+    if (rnd_len != 7) {
+        PrintAndLogEx(FAILED, "Random number length must be 7 bytes instead of %d", rnd_len);
+        return PM3_EINVARG;
+    }
+
+    if (frnd_len != 4) {
+        PrintAndLogEx(FAILED, "F(RN) length must be 4 bytes instead of %d", frnd_len);
+        return PM3_EINVARG;
+    }
+
+    clearCommandBuffer();
+    SendCommandNG(CMD_LF_EM4X70_AUTH, (uint8_t *)&etd, sizeof(etd));
+
+    PacketResponseNG resp;
+    if (!WaitForResponseTimeout(CMD_LF_EM4X70_AUTH, &resp, TIMEOUT)) {
+        PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
+        return PM3_ETIMEOUT;
+    }
+
+    if (resp.status) {
+        // Response is 20-bit from tag
+        PrintAndLogEx(INFO, "Tag Auth Response: %02X %02X %02X", resp.data.asBytes[2], resp.data.asBytes[1], resp.data.asBytes[0]);
+        return PM3_SUCCESS;
+    }
+
+    PrintAndLogEx(FAILED, "TAG Authentication " _RED_("Failed"));
+    return PM3_ESOFT;
+}
+
 static command_t CommandTable[] = {
     {"help",   CmdHelp,         AlwaysAvailable, "This help"},
     {"info",   CmdEM4x70Info,   IfPm3EM4x70,     "Tag information EM4x70"},
     {"write",  CmdEM4x70Write,  IfPm3EM4x70,     "Write EM4x70"},
     {"unlock", CmdEM4x70Unlock, IfPm3EM4x70,     "Unlock EM4x70 for writing"},
+    {"auth",   CmdEM4x70Auth,   IfPm3EM4x70,     "Authenticate EM4x70"},
     {NULL, NULL, NULL, NULL}
 };
 
diff --git a/client/src/cmdlfem4x70.h b/client/src/cmdlfem4x70.h
index 3f7930673..755ff74d2 100644
--- a/client/src/cmdlfem4x70.h
+++ b/client/src/cmdlfem4x70.h
@@ -20,6 +20,7 @@ int CmdLFEM4X70(const char *Cmd);
 int CmdEM4x70Info(const char *Cmd);
 int CmdEM4x70Write(const char *Cmd);
 int CmdEM4x70Unlock(const char *Cmd);
+int CmdEM4x70Auth(const char *Cmd);
 
 int em4x70_info(void);
 bool detect_4x70_block(void);
diff --git a/include/em4x70.h b/include/em4x70.h
index a9d94403d..0703c3900 100644
--- a/include/em4x70.h
+++ b/include/em4x70.h
@@ -23,6 +23,10 @@ typedef struct {
     // PIN to unlock
     uint32_t pin;
 
+    // Used for authentication
+    uint8_t rnd[7];
+    uint8_t frnd[4];
+
 } em4x70_data_t;
 
 #endif /* EM4X70_H__ */
diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h
index f5585f192..95ef41ebb 100644
--- a/include/pm3_cmd.h
+++ b/include/pm3_cmd.h
@@ -519,6 +519,7 @@ typedef struct {
 #define CMD_LF_EM4X70_INFO                                                0x0260
 #define CMD_LF_EM4X70_WRITE                                               0x0261
 #define CMD_LF_EM4X70_UNLOCK                                              0x0262
+#define CMD_LF_EM4X70_AUTH                                                0x0263
 // Sampling configuration for LF reader/sniffer
 #define CMD_LF_SAMPLING_SET_CONFIG                                        0x021D
 #define CMD_LF_FSK_SIMULATE                                               0x021E

From 701914430f19222f798b03dfe148ca9d27ddcbbf Mon Sep 17 00:00:00 2001
From: Christian Molson <christian@cmolabs.org>
Date: Sat, 12 Dec 2020 10:02:43 -0500
Subject: [PATCH 036/682] em4x70 makestyle

---
 armsrc/em4x70.c          | 16 ++++++++--------
 client/src/cmdlfem4x70.c |  6 +++---
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/armsrc/em4x70.c b/armsrc/em4x70.c
index fd34716a2..0bb18e7d2 100644
--- a/armsrc/em4x70.c
+++ b/armsrc/em4x70.c
@@ -365,31 +365,31 @@ static int authenticate(const uint8_t *rnd, const uint8_t *frnd, uint8_t *respon
     if (find_listen_window(true)) {
 
         em4x70_send_nibble(EM4X70_COMMAND_AUTH, true);
-        
+
         // Send 56-bit Random number
-        for(int i=0;i<7;i++) {
+        for (int i = 0; i < 7; i++) {
             em4x70_send_byte(rnd[i]);
         }
-        
+
         // Send 7 x 0's (Diversity bits)
-        for(int i=0; i<7; i++) {
+        for (int i = 0; i < 7; i++) {
             em4x70_send_bit(0);
         }
-        
+
         // Send 28-bit f(RN)
 
         // Send first 24 bits
-        for(int i=0; i < 3; i++) {
+        for (int i = 0; i < 3; i++) {
             em4x70_send_byte(frnd[i]);
         }
-        
+
         // Send last 4 bits (no parity)
         em4x70_send_nibble((frnd[3] >> 4) & 0xf, false);
 
         // Receive header, 20-bit g(RN), LIW
         uint8_t grnd[EM4X70_MAX_RECEIVE_LENGTH] = {0};
         int num = em4x70_receive(grnd);
-        if(num < 10) {
+        if (num < 10) {
             Dbprintf("Auth failed");
             return PM3_ESOFT;
         }
diff --git a/client/src/cmdlfem4x70.c b/client/src/cmdlfem4x70.c
index 877ee6d63..4172f0dc4 100644
--- a/client/src/cmdlfem4x70.c
+++ b/client/src/cmdlfem4x70.c
@@ -253,7 +253,7 @@ int CmdEM4x70Auth(const char *Cmd) {
                   "Authenticate against an EM4x70 by sending random number (RN) and F(RN)\n"
                   "  If F(RN) is incorrect based on the tag crypt key, the tag will not respond",
                   "lf em 4x70 auth -r 11223344556677 -f 11223344\n"
-                );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -264,9 +264,9 @@ int CmdEM4x70Auth(const char *Cmd) {
     };
 
     CLIExecWithReturn(ctx, Cmd, argtable, true);
-    
+
     etd.parity = arg_get_lit(ctx, 1);
-    
+
     int rnd_len = 7;
     CLIGetHexWithReturn(ctx, 2, etd.rnd, &rnd_len);
 

From 89099cf1a18a32232ed5cd7a4303bf8592f2bed7 Mon Sep 17 00:00:00 2001
From: Christian Molson <christian@cmolabs.org>
Date: Sat, 12 Dec 2020 10:31:00 -0500
Subject: [PATCH 037/682] EM4x70 remove short command options from
 authentication.

---
 client/src/cmdlfem4x70.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdlfem4x70.c b/client/src/cmdlfem4x70.c
index 4172f0dc4..a13d29073 100644
--- a/client/src/cmdlfem4x70.c
+++ b/client/src/cmdlfem4x70.c
@@ -252,14 +252,14 @@ int CmdEM4x70Auth(const char *Cmd) {
     CLIParserInit(&ctx, "lf em 4x70 auth",
                   "Authenticate against an EM4x70 by sending random number (RN) and F(RN)\n"
                   "  If F(RN) is incorrect based on the tag crypt key, the tag will not respond",
-                  "lf em 4x70 auth -r 11223344556677 -f 11223344\n"
+                  "lf em 4x70 auth --rnd 11223344556677 --frn 11223344\n"
                  );
 
     void *argtable[] = {
         arg_param_begin,
-        arg_lit0("x", "par", "Add parity bit when sending commands"),
-        arg_str1("r", "rnd", "<hex>", "Random 56-bit"),
-        arg_str1("f", "frn", "<hex>", "F(RN) 28-bit as 4 hex bytes"),
+        arg_lit0(NULL, "par", "Add parity bit when sending commands"),
+        arg_str1(NULL, "rnd", "<hex>", "Random 56-bit"),
+        arg_str1(NULL, "frn", "<hex>", "F(RN) 28-bit as 4 hex bytes"),
         arg_param_end
     };
 

From a895fbd3c689df3075c363bf395b712ccfaef768 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 12 Dec 2020 20:26:54 +0300
Subject: [PATCH 038/682] emrtd: Implement secure_read_file

---
 client/src/cmdhfemrtd.c | 107 ++++++++++++++++++++++++++++++++--------
 1 file changed, 87 insertions(+), 20 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index ae25140e2..aa0b6c9b8 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -60,7 +60,7 @@ static int exchange_commands(const char *cmd, uint8_t *dataout, int *dataoutlen,
 
     PrintAndLogEx(DEBUG, "Sending: %s", cmd);
 
-    uint8_t aCMD[100];
+    uint8_t aCMD[500];
     int aCMD_n = 0;
     param_gethex_to_eol(cmd, 0, aCMD, sizeof(aCMD), &aCMD_n);
     int res = ExchangeAPDU14a(aCMD, aCMD_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
@@ -113,10 +113,8 @@ static int asn1datalength(uint8_t *datain, int datainlen) {
 
     // lazy - https://stackoverflow.com/a/4214350/3286892
     char subbuff[8];
-    memcpy(subbuff, &dataintext[2], 2);
-    subbuff[2] = '\0';
 
-    int thing = (int)strtol(subbuff, NULL, 16);
+    int thing = *(datain + 1);
     if (thing <= 0x7f) {
         return thing;
     } else if (thing == 0x81) {
@@ -136,14 +134,7 @@ static int asn1datalength(uint8_t *datain, int datainlen) {
 }
 
 static int asn1fieldlength(uint8_t *datain, int datainlen) {
-    char *dataintext = sprint_hex_inrow(datain, datainlen);
-
-    // lazy - https://stackoverflow.com/a/4214350/3286892
-    char subbuff[8];
-    memcpy(subbuff, &dataintext[2], 2);
-    subbuff[2] = '\0';
-
-    int thing = (int)strtol(subbuff, NULL, 16);
+    int thing = *(datain + 1);
     if (thing <= 0x7f) {
         return 2;
     } else if (thing == 0x81) {
@@ -213,14 +204,14 @@ static int pad_block(uint8_t *input, int inputlen, uint8_t *output) {
 }
 
 static void retail_mac(uint8_t *key, uint8_t *input, int inputlen, uint8_t *output) {
-    // This code assumes blocklength (n) = 8, and input len of up to 56 chars
+    // This code assumes blocklength (n) = 8, and input len of up to 240 or so chars
     // This code takes inspirations from https://github.com/devinvenable/iso9797algorithm3
     uint8_t k0[8];
     uint8_t k1[8];
     uint8_t intermediate[8] = {0x00};
-    uint8_t intermediate_des[32];
+    uint8_t intermediate_des[256];
     uint8_t block[8];
-    uint8_t message[64];
+    uint8_t message[256];
 
     // Populate keys
     memcpy(k0, key, 8);
@@ -439,7 +430,7 @@ static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8
     return check_cc(ssc, kmac, response, resplen);
 }
 
-static bool secure_read_binary(uint8_t *kmac, uint8_t *ssc, int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen) {
+static bool _secure_read_binary(uint8_t *kmac, uint8_t *ssc, int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen) {
     char command[54];
     uint8_t cmd[8];
     uint8_t data[21];
@@ -500,8 +491,69 @@ static bool secure_read_binary(uint8_t *kmac, uint8_t *ssc, int offset, int byte
     return check_cc(ssc, kmac, dataout, *dataoutlen);
 }
 
+static bool _secure_read_binary_decrypt(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen) {
+    uint8_t response[500];
+    uint8_t temp[500];
+    int resplen, cutat = 0;
+    uint8_t iv[8] = { 0x00 };
+
+    if (_secure_read_binary(kmac, ssc, offset, bytes_to_read, response, &resplen) == false) {
+        return false;
+    }
+
+    PrintAndLogEx(DEBUG, "0offset %i on %i: ? (crypt: %s)", offset, bytes_to_read, sprint_hex_inrow(response, resplen));
+
+    cutat = ((int) response[1]) - 1;
+
+    PrintAndLogEx(DEBUG, "1offset %i on %i: ? (crypt: %s)", offset, bytes_to_read, sprint_hex_inrow(response, resplen));
+    des3_decrypt_cbc(iv, kenc, response + 3, cutat, temp);
+    PrintAndLogEx(DEBUG, "2eoffset %i on %i: ? (crypt: %s)", offset, bytes_to_read, sprint_hex_inrow(response, resplen));
+    PrintAndLogEx(DEBUG, "2aoffset %i on %i: %s", offset, bytes_to_read, sprint_hex_inrow(temp, cutat));
+    PrintAndLogEx(DEBUG, "2boffset %i on %i: c %s", offset, bytes_to_read, sprint_hex_inrow(response, resplen));
+    memcpy(dataout, temp, bytes_to_read);
+    PrintAndLogEx(DEBUG, "3offset %i on %i: %s (crypt: %s)", offset, bytes_to_read, sprint_hex_inrow(temp, cutat), sprint_hex_inrow(response, resplen));
+    *dataoutlen = bytes_to_read;
+    return true;
+}
+
+static int secure_read_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_t *dataout, int *dataoutlen) {
+    uint8_t response[500];
+    int resplen = 0;
+    uint8_t tempresponse[500];
+    int tempresplen = 0;
+
+    if (!_secure_read_binary_decrypt(kenc, kmac, ssc, 0, 4, response, &resplen)) {
+        return false;
+    }
+
+    int datalen = asn1datalength(response, resplen);
+    int readlen = datalen - (3 - asn1fieldlength(response, resplen) / 2);
+    int offset = 4;
+    int toread;
+
+    while (readlen > 0) {
+        toread = readlen;
+        if (readlen > 118) {
+            toread = 118;
+        }
+
+        if (!_secure_read_binary_decrypt(kenc, kmac, ssc, offset, toread, tempresponse, &tempresplen)) {
+            return false;
+        }
+
+        memcpy(response + resplen, tempresponse, tempresplen);
+        offset += toread;
+        readlen -= toread;
+        resplen += tempresplen;
+    }
+
+    memcpy(dataout, &response, resplen);
+    *dataoutlen = resplen;
+    return true;
+}
+
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
-    uint8_t response[PM3_CMD_DATA_SIZE];
+    uint8_t response[500];
     uint8_t rnd_ic[8];
     uint8_t kenc[50];
     uint8_t kmac[50];
@@ -647,12 +699,27 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
         return PM3_ESOFT;
     }
 
-    if (secure_read_binary(ks_mac, ssc, 0, 4, response, &resplen) == false) {
-        PrintAndLogEx(ERR, "Failed to read EF_COM, crypto checksum check failed.");
+    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen) == false) {
+        PrintAndLogEx(ERR, "Failed to read EF_COM.");
         DropField();
         return PM3_ESOFT;
     }
-    // TODO: impl secure read file
+    PrintAndLogEx(INFO, "EF_COM: %s", sprint_hex_inrow(response, resplen));
+
+    // Select EF_DG1
+    file_id[1] = 0x01;
+    if (secure_select_file(ks_enc, ks_mac, ssc, file_id) == false) {
+        PrintAndLogEx(ERR, "Failed to secure select EF_DG1, crypto checksum check failed.");
+        DropField();
+        return PM3_ESOFT;
+    }
+
+    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen) == false) {
+        PrintAndLogEx(ERR, "Failed to read EF_DG1.");
+        DropField();
+        return PM3_ESOFT;
+    }
+    PrintAndLogEx(INFO, "EF_DG1: %s", sprint_hex_inrow(response, resplen));
 
     DropField();
     return PM3_SUCCESS;

From 42e6763ea1dc139a2ce331e4b2bd0f8fd5684164 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 12 Dec 2020 20:55:16 +0300
Subject: [PATCH 039/682] emrtd: Improve and clean asn1datalength and
 asn1fieldlength

---
 client/src/cmdhfemrtd.c | 69 ++++++++++++++++++-----------------------
 1 file changed, 30 insertions(+), 39 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index aa0b6c9b8..8a6cf05a8 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -108,41 +108,34 @@ static char calculate_check_digit(char *data) {
     return cd % 10;
 }
 
-static int asn1datalength(uint8_t *datain, int datainlen) {
-    char *dataintext = sprint_hex_inrow(datain, datainlen);
-
-    // lazy - https://stackoverflow.com/a/4214350/3286892
-    char subbuff[8];
-
-    int thing = *(datain + 1);
-    if (thing <= 0x7f) {
-        return thing;
-    } else if (thing == 0x81) {
-        memcpy(subbuff, &dataintext[2], 3);
-        subbuff[3] = '\0';
-        return (int)strtol(subbuff, NULL, 16);
-    } else if (thing == 0x82) {
-        memcpy(subbuff, &dataintext[2], 5);
-        subbuff[5] = '\0';
-        return (int)strtol(subbuff, NULL, 16);
-    } else if (thing == 0x83) {
-        memcpy(subbuff, &dataintext[2], 7);
-        subbuff[7] = '\0';
-        return (int)strtol(subbuff, NULL, 16);
+static int asn1datalength(uint8_t *datain, int datainlen, int offset) {
+    PrintAndLogEx(DEBUG, "asn1datalength, datain: %s", sprint_hex_inrow(datain, datainlen));
+    int lenfield = (int) *(datain + offset);
+    PrintAndLogEx(DEBUG, "asn1datalength, lenfield: %i", lenfield);
+    if (lenfield <= 0x7f) {
+        return lenfield;
+    } else if (lenfield == 0x81) {
+        return ((int) *(datain + offset + 1));
+    } else if (lenfield == 0x82) {
+        return ((int) *(datain + offset + 1) << 8) | ((int) *(datain + offset + 2));
+    } else if (lenfield == 0x83) {
+        return (((int) *(datain + offset + 1) << 16) | ((int) *(datain + offset + 2)) << 8) | ((int) *(datain + offset + 3));
     }
     return false;
 }
 
-static int asn1fieldlength(uint8_t *datain, int datainlen) {
-    int thing = *(datain + 1);
-    if (thing <= 0x7f) {
+static int asn1fieldlength(uint8_t *datain, int datainlen, int offset) {
+    PrintAndLogEx(DEBUG, "asn1fieldlength, datain: %s", sprint_hex_inrow(datain, datainlen));
+    int lenfield = (int) *(datain + offset);
+    PrintAndLogEx(DEBUG, "asn1fieldlength, thing: %i", lenfield);
+    if (lenfield <= 0x7f) {
+        return 1;
+    } else if (lenfield == 0x81) {
         return 2;
-    } else if (thing == 0x81) {
+    } else if (lenfield == 0x82) {
+        return 3;
+    } else if (lenfield == 0x83) {
         return 4;
-    } else if (thing == 0x82) {
-        return 6;
-    } else if (thing == 0x83) {
-        return 8;
     }
     return false;
 }
@@ -310,8 +303,8 @@ static int read_file(uint8_t *dataout, int *dataoutlen) {
         return false;
     }
 
-    int datalen = asn1datalength(response, resplen);
-    int readlen = datalen - (3 - asn1fieldlength(response, resplen) / 2);
+    int datalen = asn1datalength(response, resplen, 1);
+    int readlen = datalen - (3 - asn1fieldlength(response, resplen, 1));
     int offset = 4;
     int toread;
 
@@ -501,22 +494,20 @@ static bool _secure_read_binary_decrypt(uint8_t *kenc, uint8_t *kmac, uint8_t *s
         return false;
     }
 
-    PrintAndLogEx(DEBUG, "0offset %i on %i: ? (crypt: %s)", offset, bytes_to_read, sprint_hex_inrow(response, resplen));
+    PrintAndLogEx(DEBUG, "secreadbindec, offset %i on read %i: encrypted: %s", offset, bytes_to_read, sprint_hex_inrow(response, resplen));
 
     cutat = ((int) response[1]) - 1;
 
-    PrintAndLogEx(DEBUG, "1offset %i on %i: ? (crypt: %s)", offset, bytes_to_read, sprint_hex_inrow(response, resplen));
     des3_decrypt_cbc(iv, kenc, response + 3, cutat, temp);
-    PrintAndLogEx(DEBUG, "2eoffset %i on %i: ? (crypt: %s)", offset, bytes_to_read, sprint_hex_inrow(response, resplen));
-    PrintAndLogEx(DEBUG, "2aoffset %i on %i: %s", offset, bytes_to_read, sprint_hex_inrow(temp, cutat));
-    PrintAndLogEx(DEBUG, "2boffset %i on %i: c %s", offset, bytes_to_read, sprint_hex_inrow(response, resplen));
     memcpy(dataout, temp, bytes_to_read);
-    PrintAndLogEx(DEBUG, "3offset %i on %i: %s (crypt: %s)", offset, bytes_to_read, sprint_hex_inrow(temp, cutat), sprint_hex_inrow(response, resplen));
+    PrintAndLogEx(DEBUG, "secreadbindec, offset %i on read %i: decrypted: %s", offset, bytes_to_read, sprint_hex_inrow(temp, cutat));
+    PrintAndLogEx(DEBUG, "secreadbindec, offset %i on read %i: decrypted and cut: %s", offset, bytes_to_read, sprint_hex_inrow(dataout, bytes_to_read));
     *dataoutlen = bytes_to_read;
     return true;
 }
 
 static int secure_read_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_t *dataout, int *dataoutlen) {
+    // TODO: join this with regular read file
     uint8_t response[500];
     int resplen = 0;
     uint8_t tempresponse[500];
@@ -526,8 +517,8 @@ static int secure_read_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_t
         return false;
     }
 
-    int datalen = asn1datalength(response, resplen);
-    int readlen = datalen - (3 - asn1fieldlength(response, resplen) / 2);
+    int datalen = asn1datalength(response, resplen, 1);
+    int readlen = datalen - (3 - asn1fieldlength(response, resplen, 1));
     int offset = 4;
     int toread;
 

From 3dd4f580c8a95315e67f4ff5b16c68050542c2ca Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 12 Dec 2020 21:11:17 +0300
Subject: [PATCH 040/682] emrtd: Have secure_select_file accept string
 filenames

---
 client/src/cmdhfemrtd.c | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 8a6cf05a8..9f3732874 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -363,11 +363,24 @@ static bool check_cc(uint8_t *ssc, uint8_t *key, uint8_t *rapdu, int rapdulength
     return memcmp(cc, rapdu + (rapdulength - 8), 8) == 0;
 }
 
-static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_t *file) {
+static void _convert_filename(const char *file, uint8_t *dataout) {
+    char temp[3];
+    memcpy(temp, file, 2);
+    dataout[0] = (int)strtol(temp, NULL, 16);
+    memcpy(temp, file + 2, 2);
+    dataout[1] = (int)strtol(temp, NULL, 16);
+}
+
+static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, const char *file) {
     // Get data even tho we'll not use it
+    // TODO: make a func to send without receive
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
 
+    // convert filename of string to bytes
+    uint8_t file_id[2];
+    _convert_filename(file, file_id);
+
     uint8_t iv[8] = { 0x00 };
     char command[54];
     uint8_t cmd[8];
@@ -375,7 +388,7 @@ static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8
     uint8_t temp[8] = {0x0c, 0xa4, 0x02, 0x0c};
 
     int cmdlen = pad_block(temp, 4, cmd);
-    int datalen = pad_block(file, 2, data);
+    int datalen = pad_block(file_id, 2, data);
     PrintAndLogEx(DEBUG, "cmd: %s", sprint_hex_inrow(cmd, cmdlen));
     PrintAndLogEx(DEBUG, "data: %s", sprint_hex_inrow(data, datalen));
 
@@ -683,8 +696,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     PrintAndLogEx(DEBUG, "ssc: %s", sprint_hex_inrow(ssc, 8));
 
     // Select EF_COM
-    uint8_t file_id[2] = {0x01, 0x1E};
-    if (secure_select_file(ks_enc, ks_mac, ssc, file_id) == false) {
+    if (secure_select_file(ks_enc, ks_mac, ssc, EF_COM) == false) {
         PrintAndLogEx(ERR, "Failed to secure select EF_COM, crypto checksum check failed.");
         DropField();
         return PM3_ESOFT;
@@ -698,8 +710,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     PrintAndLogEx(INFO, "EF_COM: %s", sprint_hex_inrow(response, resplen));
 
     // Select EF_DG1
-    file_id[1] = 0x01;
-    if (secure_select_file(ks_enc, ks_mac, ssc, file_id) == false) {
+    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG1) == false) {
         PrintAndLogEx(ERR, "Failed to secure select EF_DG1, crypto checksum check failed.");
         DropField();
         return PM3_ESOFT;

From c2531e7ed0dda3ab1aebc12e4eda67b0558a67e7 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 12 Dec 2020 21:19:51 +0300
Subject: [PATCH 041/682] emrtd: Rename from hf emrtd info to dump, code
 cleanup

---
 client/src/cmdhfemrtd.c | 32 +++++++++++++++++---------------
 client/src/cmdhfemrtd.h |  2 +-
 2 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 9f3732874..c2611dc8f 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -54,7 +54,8 @@ static uint16_t get_sw(uint8_t *d, uint8_t n) {
     return d[n] * 0x0100 + d[n + 1];
 }
 
-static int exchange_commands(const char *cmd, uint8_t *dataout, int *dataoutlen, bool activate_field, bool keep_field_on) {
+static bool exchange_commands(const char *cmd, uint8_t *dataout, int *dataoutlen, bool activate_field, bool keep_field_on) {
+    // TODO: Account for 14b too
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
 
@@ -86,6 +87,13 @@ static int exchange_commands(const char *cmd, uint8_t *dataout, int *dataoutlen,
     return true;
 }
 
+static int exchange_commands_noout(const char *cmd, bool activate_field, bool keep_field_on) {
+    uint8_t response[PM3_CMD_DATA_SIZE];
+    int resplen = 0;
+
+    return exchange_commands(cmd, response, &resplen, activate_field, keep_field_on);
+}
+
 static char calculate_check_digit(char *data) {
     int mrz_weight[] = {7, 3, 1};
     int cd = 0;
@@ -261,14 +269,10 @@ static void deskey(uint8_t *seed, uint8_t *type, int length, uint8_t *dataout) {
 static int select_file(const char *select_by, const char *file_id, bool activate_field, bool keep_field_on) {
     size_t file_id_len = strlen(file_id) / 2;
 
-    // Get data even tho we'll not use it
-    uint8_t response[PM3_CMD_DATA_SIZE];
-    int resplen = 0;
-
     char cmd[50];
     sprintf(cmd, "00%s%s0C%02lu%s", SELECT, select_by, file_id_len, file_id);
 
-    return exchange_commands(cmd, response, &resplen, activate_field, keep_field_on);
+    return exchange_commands_noout(cmd, activate_field, keep_field_on);
 }
 
 static int get_challenge(int length, uint8_t *dataout, int *dataoutlen) {
@@ -372,8 +376,6 @@ static void _convert_filename(const char *file, uint8_t *dataout) {
 }
 
 static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, const char *file) {
-    // Get data even tho we'll not use it
-    // TODO: make a func to send without receive
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
 
@@ -556,7 +558,7 @@ static int secure_read_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_t
     return true;
 }
 
-int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
+int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     uint8_t response[500];
     uint8_t rnd_ic[8];
     uint8_t kenc[50];
@@ -727,11 +729,11 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     return PM3_SUCCESS;
 }
 
-static int cmd_hf_emrtd_info(const char *Cmd) {
+static int cmd_hf_emrtd_dump(const char *Cmd) {
     CLIParserContext *ctx;
-    CLIParserInit(&ctx, "hf emrtd info",
-                  "Get info about an eMRTD",
-                  "hf emrtd info"
+    CLIParserInit(&ctx, "hf emrtd dump",
+                  "Dump all files on an eMRTD",
+                  "hf emrtd dump"
                  );
 
     void *argtable[] = {
@@ -754,7 +756,7 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
     CLIGetStrWithReturn(ctx, 3, expiry, &expirylen);
 
     CLIParserFree(ctx);
-    return infoHF_EMRTD((char *)docnum, (char *)dob, (char *)expiry);
+    return dumpHF_EMRTD((char *)docnum, (char *)dob, (char *)expiry);
 }
 
 static int cmd_hf_emrtd_list(const char *Cmd) {
@@ -769,7 +771,7 @@ static int cmd_hf_emrtd_list(const char *Cmd) {
 
 static command_t CommandTable[] = {
     {"help",    CmdHelp,           AlwaysAvailable, "This help"},
-    {"info",    cmd_hf_emrtd_info, IfPm3Iso14443a,  "Tag information"},
+    {"dump",    cmd_hf_emrtd_dump, IfPm3Iso14443,   "Dump eMRTD files to binary files"},
     {"list",    cmd_hf_emrtd_list, AlwaysAvailable, "List ISO 14443A/7816 history"},
     {NULL, NULL, NULL, NULL}
 };
diff --git a/client/src/cmdhfemrtd.h b/client/src/cmdhfemrtd.h
index ba9e3f2b3..5899ad27a 100644
--- a/client/src/cmdhfemrtd.h
+++ b/client/src/cmdhfemrtd.h
@@ -15,5 +15,5 @@
 
 int CmdHFeMRTD(const char *Cmd);
 
-int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry);
+int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry);
 #endif

From d1d5d8ee740d2fe9992020c98e235dd2d8e62d03 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 12 Dec 2020 21:54:23 +0300
Subject: [PATCH 042/682] emrtd: account for larger file reads, read ef_dg2

---
 client/src/cmdhfemrtd.c | 64 ++++++++++++++++++++++++++++++++---------
 1 file changed, 51 insertions(+), 13 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index c2611dc8f..c00919835 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -40,6 +40,22 @@
 #define EF_CARDACCESS "011C"
 #define EF_COM "011E"
 #define EF_DG1 "0101"
+#define EF_DG2 "0102"
+#define EF_DG3 "0103"
+#define EF_DG4 "0104"
+#define EF_DG5 "0105"
+#define EF_DG6 "0106"
+#define EF_DG7 "0107"
+#define EF_DG8 "0108"
+#define EF_DG9 "0109"
+#define EF_DG10 "010A"
+#define EF_DG11 "010B"
+#define EF_DG12 "010C"
+#define EF_DG13 "010D"
+#define EF_DG14 "010E"
+#define EF_DG15 "010F"
+#define EF_DG16 "0110"
+#define EF_SOD "011D"
 
 // App IDs
 #define AID_MRTD "A0000002471001"
@@ -333,12 +349,26 @@ static int read_file(uint8_t *dataout, int *dataoutlen) {
     return true;
 }
 
+static void bump_ssc(uint8_t *ssc) {
+    PrintAndLogEx(DEBUG, "ssc-b: %s", sprint_hex_inrow(ssc, 8));
+    for (int i = 7; i > 0; i--) {
+        if ((*(ssc + i)) == 0xFF) {
+            // Set anything already FF to 0, we'll do + 1 on num to left anyways
+            (*(ssc + i)) = 0;
+            continue;
+        }
+        (*(ssc + i)) += 1;
+        PrintAndLogEx(DEBUG, "ssc-a: %s", sprint_hex_inrow(ssc, 8));
+        return;
+    }
+}
+
 static bool check_cc(uint8_t *ssc, uint8_t *key, uint8_t *rapdu, int rapdulength) {
     // https://elixi.re/i/clarkson.png
-    uint8_t k[100];
-    uint8_t cc[100];
+    uint8_t k[500];
+    uint8_t cc[500];
 
-    (*(ssc + 7)) += 1;
+    bump_ssc(ssc);
 
     memcpy(k, ssc, 8);
     int length = 0;
@@ -405,10 +435,7 @@ static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, const
     memcpy(m + cmdlen, do87, (datalen + 3));
     PrintAndLogEx(DEBUG, "m: %s", sprint_hex_inrow(m, datalen + cmdlen + 3));
 
-    // TODO: this is hacky
-    PrintAndLogEx(DEBUG, "ssc-b: %s", sprint_hex_inrow(ssc, 8));
-    (*(ssc + 7)) += 1;
-    PrintAndLogEx(DEBUG, "ssc-a: %s", sprint_hex_inrow(ssc, 8));
+    bump_ssc(ssc);
 
     uint8_t n[27];
     memcpy(n, ssc, 8);
@@ -466,10 +493,7 @@ static bool _secure_read_binary(uint8_t *kmac, uint8_t *ssc, int offset, int byt
     memcpy(m, cmd, 8);
     memcpy(m + 8, do97, 3);
 
-    // TODO: this is hacky
-    PrintAndLogEx(DEBUG, "ssc-b: %s", sprint_hex_inrow(ssc, 8));
-    (*(ssc + 7)) += 1;
-    PrintAndLogEx(DEBUG, "ssc-a: %s", sprint_hex_inrow(ssc, 8));
+    bump_ssc(ssc);
 
     uint8_t n[19];
     memcpy(n, ssc, 8);
@@ -523,7 +547,7 @@ static bool _secure_read_binary_decrypt(uint8_t *kenc, uint8_t *kmac, uint8_t *s
 
 static int secure_read_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_t *dataout, int *dataoutlen) {
     // TODO: join this with regular read file
-    uint8_t response[500];
+    uint8_t response[25000];
     int resplen = 0;
     uint8_t tempresponse[500];
     int tempresplen = 0;
@@ -559,7 +583,7 @@ static int secure_read_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_t
 }
 
 int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
-    uint8_t response[500];
+    uint8_t response[25000];
     uint8_t rnd_ic[8];
     uint8_t kenc[50];
     uint8_t kmac[50];
@@ -725,6 +749,20 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     }
     PrintAndLogEx(INFO, "EF_DG1: %s", sprint_hex_inrow(response, resplen));
 
+    // Select EF_DG2
+    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG2) == false) {
+        PrintAndLogEx(ERR, "Failed to secure select EF_DG2, crypto checksum check failed.");
+        DropField();
+        return PM3_ESOFT;
+    }
+
+    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen) == false) {
+        PrintAndLogEx(ERR, "Failed to read EF_DG2.");
+        DropField();
+        return PM3_ESOFT;
+    }
+    PrintAndLogEx(INFO, "EF_DG2 (len: %i): %s", resplen, sprint_hex_inrow(response, resplen));
+
     DropField();
     return PM3_SUCCESS;
 }

From ac82a80afa7d4ba8e159beebe1e337fbd73953c1 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 12 Dec 2020 22:10:40 +0300
Subject: [PATCH 043/682] emrtd: Read more files, save read files

---
 client/src/cmdhfemrtd.c | 82 ++++++++++++++++++++++++++++++++++++++---
 1 file changed, 77 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index c00919835..65dc1c200 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -12,7 +12,7 @@
 
 #include "cmdhfemrtd.h"
 #include <ctype.h>
-#include "fileutils.h"
+#include "fileutils.h"              // saveFile
 #include "cmdparser.h"              // command_t
 #include "comms.h"                  // clearCommandBuffer
 #include "cmdtrace.h"
@@ -600,7 +600,8 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     // Select and read EF_CardAccess
     if (select_file(P1_SELECT_BY_EF, EF_CARDACCESS, true, true)) {
         read_file(response, &resplen);
-        PrintAndLogEx(INFO, "EF_CardAccess: %s", sprint_hex(response, resplen));
+        PrintAndLogEx(INFO, "Read EF_CardAccess, len: %i.", resplen);
+        PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
     } else {
         PrintAndLogEx(INFO, "PACE unsupported. Will not read EF_CardAccess.");
     }
@@ -733,8 +734,11 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
         DropField();
         return PM3_ESOFT;
     }
-    PrintAndLogEx(INFO, "EF_COM: %s", sprint_hex_inrow(response, resplen));
+    PrintAndLogEx(INFO, "Read EF_COM, len: %i.", resplen);
+    PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
+    saveFile("EF_COM", ".BIN", response, resplen);
 
+    // TODO: Don't read a hardcoded list of files, reduce code repetition
     // Select EF_DG1
     if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG1) == false) {
         PrintAndLogEx(ERR, "Failed to secure select EF_DG1, crypto checksum check failed.");
@@ -747,7 +751,9 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
         DropField();
         return PM3_ESOFT;
     }
-    PrintAndLogEx(INFO, "EF_DG1: %s", sprint_hex_inrow(response, resplen));
+    PrintAndLogEx(INFO, "Read EF_DG1, len: %i.", resplen);
+    PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
+    saveFile("EF_DG1", ".BIN", response, resplen);
 
     // Select EF_DG2
     if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG2) == false) {
@@ -761,7 +767,73 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
         DropField();
         return PM3_ESOFT;
     }
-    PrintAndLogEx(INFO, "EF_DG2 (len: %i): %s", resplen, sprint_hex_inrow(response, resplen));
+    PrintAndLogEx(INFO, "Read EF_DG2, len: %i.", resplen);
+    PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
+    saveFile("EF_DG2", ".BIN", response, resplen);
+
+    // Select EF_SOD
+    if (secure_select_file(ks_enc, ks_mac, ssc, EF_SOD) == false) {
+        PrintAndLogEx(ERR, "Failed to secure select EF_SOD, crypto checksum check failed.");
+        DropField();
+        return PM3_ESOFT;
+    }
+
+    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen) == false) {
+        PrintAndLogEx(ERR, "Failed to read EF_SOD.");
+        DropField();
+        return PM3_ESOFT;
+    }
+    PrintAndLogEx(INFO, "Read EF_SOD, len: %i.", resplen);
+    PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
+    saveFile("EF_SOD", ".BIN", response, resplen);
+
+    // Select EF_DG11
+    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG11) == false) {
+        PrintAndLogEx(ERR, "Failed to secure select EF_DG11, crypto checksum check failed.");
+        DropField();
+        return PM3_ESOFT;
+    }
+
+    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen) == false) {
+        PrintAndLogEx(ERR, "Failed to read EF_DG11.");
+        DropField();
+        return PM3_ESOFT;
+    }
+    PrintAndLogEx(INFO, "Read EF_DG11, len: %i.", resplen);
+    PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
+    saveFile("EF_DG11", ".BIN", response, resplen);
+
+    // Select EF_DG12
+    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG12) == false) {
+        PrintAndLogEx(ERR, "Failed to secure select EF_DG12, crypto checksum check failed.");
+        DropField();
+        return PM3_ESOFT;
+    }
+
+    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen) == false) {
+        PrintAndLogEx(ERR, "Failed to read EF_DG12.");
+        DropField();
+        return PM3_ESOFT;
+    }
+    PrintAndLogEx(INFO, "Read EF_DG12, len: %i.", resplen);
+    PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
+    saveFile("EF_DG12", ".BIN", response, resplen);
+
+    // Select EF_DG14
+    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG14) == false) {
+        PrintAndLogEx(ERR, "Failed to secure select EF_DG14, crypto checksum check failed.");
+        DropField();
+        return PM3_ESOFT;
+    }
+
+    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen) == false) {
+        PrintAndLogEx(ERR, "Failed to read EF_DG14.");
+        DropField();
+        return PM3_ESOFT;
+    }
+    PrintAndLogEx(INFO, "Read EF_DG14, len: %i.", resplen);
+    PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
+    saveFile("EF_DG14", ".BIN", response, resplen);
 
     DropField();
     return PM3_SUCCESS;

From 21fc1d634f9cb75a86cb4afa855ef8ff5c116b12 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sun, 13 Dec 2020 01:49:17 +0300
Subject: [PATCH 044/682] emrtd: Add 14b support and better presence detection

---
 client/src/cmdhf14b.c   |   2 +-
 client/src/cmdhf14b.h   |   2 +
 client/src/cmdhfemrtd.c | 129 +++++++++++++++++++++++++---------------
 3 files changed, 85 insertions(+), 48 deletions(-)

diff --git a/client/src/cmdhf14b.c b/client/src/cmdhf14b.c
index 3f4890581..eb1a4f67a 100644
--- a/client/src/cmdhf14b.c
+++ b/client/src/cmdhf14b.c
@@ -1488,7 +1488,7 @@ static int handle_14b_apdu(bool chainingin, uint8_t *datain, int datainlen, bool
     return PM3_SUCCESS;
 }
 
-static int exchange_14b_apdu(uint8_t *datain, int datainlen, bool activate_field, bool leave_signal_on, uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
+int exchange_14b_apdu(uint8_t *datain, int datainlen, bool activate_field, bool leave_signal_on, uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
     *dataoutlen = 0;
     bool chaining = false;
     int res;
diff --git a/client/src/cmdhf14b.h b/client/src/cmdhf14b.h
index 2058ea8ba..d236bb6cf 100644
--- a/client/src/cmdhf14b.h
+++ b/client/src/cmdhf14b.h
@@ -15,6 +15,8 @@
 
 int CmdHF14B(const char *Cmd);
 
+int exchange_14b_apdu(uint8_t *datain, int datainlen, bool activate_field, bool leave_signal_on, uint8_t *dataout, int maxdataoutlen, int *dataoutlen);
+
 int infoHF14B(bool verbose);
 int readHF14B(bool verbose);
 #endif
diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 65dc1c200..f8f89f557 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -24,6 +24,8 @@
 #include "sha1.h"                   // KSeed calculation etc
 #include "mifare/desfire_crypto.h"  // des_encrypt/des_decrypt
 #include "des.h"                    // mbedtls_des_key_set_parity
+#include "cmdhf14b.h"               // exchange_14b_apdu
+#include "iso14b.h"                 // ISO14B_CONNECT etc
 
 #define TIMEOUT 2000
 
@@ -70,8 +72,7 @@ static uint16_t get_sw(uint8_t *d, uint8_t n) {
     return d[n] * 0x0100 + d[n + 1];
 }
 
-static bool exchange_commands(const char *cmd, uint8_t *dataout, int *dataoutlen, bool activate_field, bool keep_field_on) {
-    // TODO: Account for 14b too
+static bool exchange_commands(const char *cmd, uint8_t *dataout, int *dataoutlen, bool activate_field, bool keep_field_on, bool use_14b) {
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
 
@@ -80,7 +81,12 @@ static bool exchange_commands(const char *cmd, uint8_t *dataout, int *dataoutlen
     uint8_t aCMD[500];
     int aCMD_n = 0;
     param_gethex_to_eol(cmd, 0, aCMD, sizeof(aCMD), &aCMD_n);
-    int res = ExchangeAPDU14a(aCMD, aCMD_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
+    int res;
+    if (use_14b) {
+        res = exchange_14b_apdu(aCMD, aCMD_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
+    } else {
+        res = ExchangeAPDU14a(aCMD, aCMD_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
+    }
     if (res) {
         DropField();
         return false;
@@ -103,11 +109,11 @@ static bool exchange_commands(const char *cmd, uint8_t *dataout, int *dataoutlen
     return true;
 }
 
-static int exchange_commands_noout(const char *cmd, bool activate_field, bool keep_field_on) {
+static int exchange_commands_noout(const char *cmd, bool activate_field, bool keep_field_on, bool use_14b) {
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
 
-    return exchange_commands(cmd, response, &resplen, activate_field, keep_field_on);
+    return exchange_commands(cmd, response, &resplen, activate_field, keep_field_on, use_14b);
 }
 
 static char calculate_check_digit(char *data) {
@@ -282,44 +288,44 @@ static void deskey(uint8_t *seed, uint8_t *type, int length, uint8_t *dataout) {
     memcpy(dataout, &key, length);
 }
 
-static int select_file(const char *select_by, const char *file_id, bool activate_field, bool keep_field_on) {
+static int select_file(const char *select_by, const char *file_id, bool use_14b) {
     size_t file_id_len = strlen(file_id) / 2;
 
     char cmd[50];
     sprintf(cmd, "00%s%s0C%02lu%s", SELECT, select_by, file_id_len, file_id);
 
-    return exchange_commands_noout(cmd, activate_field, keep_field_on);
+    return exchange_commands_noout(cmd, false, true, use_14b);
 }
 
-static int get_challenge(int length, uint8_t *dataout, int *dataoutlen) {
+static int get_challenge(int length, uint8_t *dataout, int *dataoutlen, bool use_14b) {
     char cmd[50];
     sprintf(cmd, "00%s0000%02X", GET_CHALLENGE, length);
 
-    return exchange_commands(cmd, dataout, dataoutlen, false, true);
+    return exchange_commands(cmd, dataout, dataoutlen, false, true, use_14b);
 }
 
-static int external_authenticate(uint8_t *data, int length, uint8_t *dataout, int *dataoutlen) {
+static int external_authenticate(uint8_t *data, int length, uint8_t *dataout, int *dataoutlen, bool use_14b) {
     char cmd[100];
 
     sprintf(cmd, "00%s0000%02X%s%02X", EXTERNAL_AUTHENTICATE, length, sprint_hex_inrow(data, length), length);
 
-    return exchange_commands(cmd, dataout, dataoutlen, false, true);
+    return exchange_commands(cmd, dataout, dataoutlen, false, true, use_14b);
 }
 
-static int _read_binary(int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen) {
+static int _read_binary(int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen, bool use_14b) {
     char cmd[50];
     sprintf(cmd, "00%s%04i%02i", READ_BINARY, offset, bytes_to_read);
 
-    return exchange_commands(cmd, dataout, dataoutlen, false, true);
+    return exchange_commands(cmd, dataout, dataoutlen, false, true, use_14b);
 }
 
-static int read_file(uint8_t *dataout, int *dataoutlen) {
+static int read_file(uint8_t *dataout, int *dataoutlen, bool use_14b) {
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
     uint8_t tempresponse[PM3_CMD_DATA_SIZE];
     int tempresplen = 0;
 
-    if (!_read_binary(0, 4, response, &resplen)) {
+    if (!_read_binary(0, 4, response, &resplen, use_14b)) {
         return false;
     }
 
@@ -334,7 +340,7 @@ static int read_file(uint8_t *dataout, int *dataoutlen) {
             toread = 118;
         }
 
-        if (!_read_binary(offset, toread, tempresponse, &tempresplen)) {
+        if (!_read_binary(offset, toread, tempresponse, &tempresplen, use_14b)) {
             return false;
         }
 
@@ -405,7 +411,7 @@ static void _convert_filename(const char *file, uint8_t *dataout) {
     dataout[1] = (int)strtol(temp, NULL, 16);
 }
 
-static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, const char *file) {
+static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, const char *file, bool use_14b) {
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
 
@@ -460,12 +466,12 @@ static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, const
     sprintf(command, "0C%s020C%02X%s00", SELECT, lc, sprint_hex_inrow(data, lc));
     PrintAndLogEx(DEBUG, "command: %s", command);
 
-    exchange_commands(command, response, &resplen, false, true);
+    exchange_commands(command, response, &resplen, false, true, use_14b);
 
     return check_cc(ssc, kmac, response, resplen);
 }
 
-static bool _secure_read_binary(uint8_t *kmac, uint8_t *ssc, int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen) {
+static bool _secure_read_binary(uint8_t *kmac, uint8_t *ssc, int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen, bool use_14b) {
     char command[54];
     uint8_t cmd[8];
     uint8_t data[21];
@@ -518,18 +524,18 @@ static bool _secure_read_binary(uint8_t *kmac, uint8_t *ssc, int offset, int byt
     sprintf(command, "0C%s%02X%02X%02X%s00", READ_BINARY, p1, p2, lc, sprint_hex_inrow(data, lc));
     PrintAndLogEx(DEBUG, "command: %s", command);
 
-    exchange_commands(command, dataout, dataoutlen, false, true);
+    exchange_commands(command, dataout, dataoutlen, false, true, use_14b);
 
     return check_cc(ssc, kmac, dataout, *dataoutlen);
 }
 
-static bool _secure_read_binary_decrypt(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen) {
+static bool _secure_read_binary_decrypt(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen, bool use_14b) {
     uint8_t response[500];
     uint8_t temp[500];
     int resplen, cutat = 0;
     uint8_t iv[8] = { 0x00 };
 
-    if (_secure_read_binary(kmac, ssc, offset, bytes_to_read, response, &resplen) == false) {
+    if (_secure_read_binary(kmac, ssc, offset, bytes_to_read, response, &resplen, use_14b) == false) {
         return false;
     }
 
@@ -545,14 +551,14 @@ static bool _secure_read_binary_decrypt(uint8_t *kenc, uint8_t *kmac, uint8_t *s
     return true;
 }
 
-static int secure_read_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_t *dataout, int *dataoutlen) {
+static int secure_read_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_t *dataout, int *dataoutlen, bool use_14b) {
     // TODO: join this with regular read file
     uint8_t response[25000];
     int resplen = 0;
     uint8_t tempresponse[500];
     int tempresplen = 0;
 
-    if (!_secure_read_binary_decrypt(kenc, kmac, ssc, 0, 4, response, &resplen)) {
+    if (!_secure_read_binary_decrypt(kenc, kmac, ssc, 0, 4, response, &resplen, use_14b)) {
         return false;
     }
 
@@ -567,7 +573,7 @@ static int secure_read_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_t
             toread = 118;
         }
 
-        if (!_secure_read_binary_decrypt(kenc, kmac, ssc, offset, toread, tempresponse, &tempresplen)) {
+        if (!_secure_read_binary_decrypt(kenc, kmac, ssc, offset, toread, tempresponse, &tempresplen, use_14b)) {
             return false;
         }
 
@@ -597,9 +603,38 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     uint8_t KENC_type[4] = {0x00, 0x00, 0x00, 0x01};
     uint8_t KMAC_type[4] = {0x00, 0x00, 0x00, 0x02};
 
+    bool use_14b = false;
+
+    // Try to 14a
+    SendCommandMIX(CMD_HF_ISO14443A_READER, ISO14A_CONNECT | ISO14A_NO_DISCONNECT, 0, 0, NULL, 0);
+    PacketResponseNG resp;
+    bool failed_14a = false;
+    if (!WaitForResponseTimeout(CMD_ACK, &resp, 2500)) {
+        DropField();
+        failed_14a = true;
+    }
+
+    if (failed_14a || resp.oldarg[0] == 0) {
+        PrintAndLogEx(INFO, "No eMRTD spotted with 14a, trying 14b.");
+        // If not 14a, try to 14b
+        SendCommandMIX(CMD_HF_ISO14443B_COMMAND, ISO14B_CONNECT | ISO14B_SELECT_STD, 0, 0, NULL, 0);
+        if (!WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, 2500)) {
+            DropField();
+            PrintAndLogEx(INFO, "No eMRTD spotted with 14b, exiting.");
+            return PM3_ESOFT;
+        }
+
+        if (resp.oldarg[0] != 0) {
+            DropField();
+            PrintAndLogEx(INFO, "No eMRTD spotted with 14b, exiting.");
+            return PM3_ESOFT;
+        }
+        use_14b = true;
+    }
+
     // Select and read EF_CardAccess
-    if (select_file(P1_SELECT_BY_EF, EF_CARDACCESS, true, true)) {
-        read_file(response, &resplen);
+    if (select_file(P1_SELECT_BY_EF, EF_CARDACCESS, use_14b)) {
+        read_file(response, &resplen, use_14b);
         PrintAndLogEx(INFO, "Read EF_CardAccess, len: %i.", resplen);
         PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
     } else {
@@ -607,22 +642,22 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     }
 
     // Select MRTD applet
-    if (select_file(P1_SELECT_BY_NAME, AID_MRTD, false, true) == false) {
+    if (select_file(P1_SELECT_BY_NAME, AID_MRTD, use_14b) == false) {
         PrintAndLogEx(ERR, "Couldn't select the MRTD application.");
         DropField();
         return PM3_ESOFT;
     }
 
     // Select EF_COM
-    if (select_file(P1_SELECT_BY_EF, EF_COM, false, true) == false) {
+    if (select_file(P1_SELECT_BY_EF, EF_COM, use_14b) == false) {
         // BAC = true;
         PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt external authentication.");
     } else {
         // BAC = false;
         // Select EF_DG1
-        select_file(P1_SELECT_BY_EF, EF_DG1, false, true);
+        select_file(P1_SELECT_BY_EF, EF_DG1, use_14b);
 
-        if (read_file(response, &resplen) == false) {
+        if (read_file(response, &resplen, use_14b) == false) {
             // BAC = true;
             PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt external authentication.");
         } else {
@@ -652,7 +687,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     PrintAndLogEx(DEBUG, "kmac: %s", sprint_hex_inrow(kmac, 16));
 
     // Get Challenge
-    if (get_challenge(8, rnd_ic, &resplen) == false) {
+    if (get_challenge(8, rnd_ic, &resplen, use_14b) == false) {
         PrintAndLogEx(ERR, "Couldn't get challenge.");
         DropField();
         return PM3_ESOFT;
@@ -681,7 +716,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     memcpy(cmd_data + 32, m_ifd, 8);
 
     // Do external authentication
-    if (external_authenticate(cmd_data, sizeof(cmd_data), response, &resplen) == false) {
+    if (external_authenticate(cmd_data, sizeof(cmd_data), response, &resplen, use_14b) == false) {
         PrintAndLogEx(ERR, "Couldn't do external authentication. Did you supply the correct MRZ info?");
         DropField();
         return PM3_ESOFT;
@@ -723,13 +758,13 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     PrintAndLogEx(DEBUG, "ssc: %s", sprint_hex_inrow(ssc, 8));
 
     // Select EF_COM
-    if (secure_select_file(ks_enc, ks_mac, ssc, EF_COM) == false) {
+    if (secure_select_file(ks_enc, ks_mac, ssc, EF_COM, use_14b) == false) {
         PrintAndLogEx(ERR, "Failed to secure select EF_COM, crypto checksum check failed.");
         DropField();
         return PM3_ESOFT;
     }
 
-    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen) == false) {
+    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen, use_14b) == false) {
         PrintAndLogEx(ERR, "Failed to read EF_COM.");
         DropField();
         return PM3_ESOFT;
@@ -740,13 +775,13 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
 
     // TODO: Don't read a hardcoded list of files, reduce code repetition
     // Select EF_DG1
-    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG1) == false) {
+    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG1, use_14b) == false) {
         PrintAndLogEx(ERR, "Failed to secure select EF_DG1, crypto checksum check failed.");
         DropField();
         return PM3_ESOFT;
     }
 
-    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen) == false) {
+    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen, use_14b) == false) {
         PrintAndLogEx(ERR, "Failed to read EF_DG1.");
         DropField();
         return PM3_ESOFT;
@@ -756,13 +791,13 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     saveFile("EF_DG1", ".BIN", response, resplen);
 
     // Select EF_DG2
-    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG2) == false) {
+    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG2, use_14b) == false) {
         PrintAndLogEx(ERR, "Failed to secure select EF_DG2, crypto checksum check failed.");
         DropField();
         return PM3_ESOFT;
     }
 
-    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen) == false) {
+    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen, use_14b) == false) {
         PrintAndLogEx(ERR, "Failed to read EF_DG2.");
         DropField();
         return PM3_ESOFT;
@@ -772,13 +807,13 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     saveFile("EF_DG2", ".BIN", response, resplen);
 
     // Select EF_SOD
-    if (secure_select_file(ks_enc, ks_mac, ssc, EF_SOD) == false) {
+    if (secure_select_file(ks_enc, ks_mac, ssc, EF_SOD, use_14b) == false) {
         PrintAndLogEx(ERR, "Failed to secure select EF_SOD, crypto checksum check failed.");
         DropField();
         return PM3_ESOFT;
     }
 
-    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen) == false) {
+    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen, use_14b) == false) {
         PrintAndLogEx(ERR, "Failed to read EF_SOD.");
         DropField();
         return PM3_ESOFT;
@@ -788,13 +823,13 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     saveFile("EF_SOD", ".BIN", response, resplen);
 
     // Select EF_DG11
-    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG11) == false) {
+    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG11, use_14b) == false) {
         PrintAndLogEx(ERR, "Failed to secure select EF_DG11, crypto checksum check failed.");
         DropField();
         return PM3_ESOFT;
     }
 
-    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen) == false) {
+    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen, use_14b) == false) {
         PrintAndLogEx(ERR, "Failed to read EF_DG11.");
         DropField();
         return PM3_ESOFT;
@@ -804,13 +839,13 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     saveFile("EF_DG11", ".BIN", response, resplen);
 
     // Select EF_DG12
-    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG12) == false) {
+    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG12, use_14b) == false) {
         PrintAndLogEx(ERR, "Failed to secure select EF_DG12, crypto checksum check failed.");
         DropField();
         return PM3_ESOFT;
     }
 
-    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen) == false) {
+    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen, use_14b) == false) {
         PrintAndLogEx(ERR, "Failed to read EF_DG12.");
         DropField();
         return PM3_ESOFT;
@@ -820,13 +855,13 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     saveFile("EF_DG12", ".BIN", response, resplen);
 
     // Select EF_DG14
-    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG14) == false) {
+    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG14, use_14b) == false) {
         PrintAndLogEx(ERR, "Failed to secure select EF_DG14, crypto checksum check failed.");
         DropField();
         return PM3_ESOFT;
     }
 
-    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen) == false) {
+    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen, use_14b) == false) {
         PrintAndLogEx(ERR, "Failed to read EF_DG14.");
         DropField();
         return PM3_ESOFT;

From cd625ca7593c64f1420088e56c814a4bdd18d307 Mon Sep 17 00:00:00 2001
From: ikarus <ikarus4ever@web.de>
Date: Sat, 12 Dec 2020 23:59:09 +0100
Subject: [PATCH 045/682] Reworked hf 14a apdufuzz (now apdufind).

* Renamed to apdufind. Fuzzing is something different than this simple enumeration.
* Removed Le as parameter. This is just the maximum response bytes expected. Not much to find here with this simple tool.
* Sweep through all values, even if a start value was given (don't stop at 0).
* Changed sweep oder to INS->P1->P2->CLA. This way instructions are more quickly found.
* Show response data, if there are any (hex & ascii).
* Retry command with Le = 0x0100 (extended length APDU) if there was a length error return code.
* Improved the output with general information.
* Fixed bug: It's now possible to run the command without parameters.
---
 client/src/cmdhf14a.c | 172 +++++++++++++++++++++++-------------------
 1 file changed, 96 insertions(+), 76 deletions(-)

diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index 576979aad..075c0e4f5 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -2127,128 +2127,148 @@ static uint16_t get_sw(uint8_t *d, uint8_t n) {
     n -= 2;
     return d[n] * 0x0100 + d[n + 1];
 }
-static int CmdHf14AFuzzapdu(const char *Cmd) {
+
+static int CmdHf14AFindapdu(const char *Cmd) {
     CLIParserContext *ctx;
-    CLIParserInit(&ctx, "hf 14a apdufuzz",
-                  "Fuzz APDU's of ISO7816 protocol to find valid CLS/INS/P1P2/LE commands.\n"
+    CLIParserInit(&ctx, "hf 14a apdufind",
+                  "Enumerate APDU's of ISO7816 protocol to find valid CLS/INS/P1P2 commands.\n"
                   "It loops all 256 possible values for each byte.\n"
+                  "The loop oder is INS->P1->P2->CLA\n"
                   "Tag must be on antenna before running.",
-                  "hf 14a apdufuzz\n"
-                  "hf 14a apdufuzz --cla 80\n"
+                  "hf 14a apdufind\n"
+                  "hf 14a apdufind --cla 80\n"
                   );
 
     void *argtable[] = {
         arg_param_begin,
-        arg_str0(NULL, "cla", "<hex>", "start CLASS value (1 hex byte)"),
-        arg_str0(NULL, "ins", "<hex>", "start INSTRUCTION value (1 hex byte)"),
+        arg_str0("c", "cla", "<hex>", "start CLASS value (1 hex byte)"),
+        arg_str0("i", "ins", "<hex>", "start INSTRUCTION value (1 hex byte)"),
         arg_str0(NULL, "p1", "<hex>", "start P1 value (1 hex byte)"),
         arg_str0(NULL, "p2", "<hex>", "start P2 value (1 hex byte)"),
-        arg_str0(NULL, "le", "<hex>", "start LENGTH value (1 hex byte)"),        
         arg_lit0("v", "verbose", "verbose output"),
         arg_param_end
     };
-    CLIExecWithReturn(ctx, Cmd, argtable, false);
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
 
     int cla_len = 0;
-    uint8_t cla[1] = {0};
-    CLIGetHexWithReturn(ctx, 1, cla, &cla_len);
-    
+    uint8_t cla_arg[1] = {0};
+    CLIGetHexWithReturn(ctx, 1, cla_arg, &cla_len);
+
     int ins_len = 0;
-    uint8_t ins[1] = {0};
-    CLIGetHexWithReturn(ctx, 2, ins, &ins_len);
+    uint8_t ins_arg[1] = {0};
+    CLIGetHexWithReturn(ctx, 2, ins_arg, &ins_len);
 
     int p1_len = 0;
-    uint8_t p1[1] = {0};
-    CLIGetHexWithReturn(ctx, 3, p1, &p1_len);
+    uint8_t p1_arg[1] = {0};
+    CLIGetHexWithReturn(ctx, 3, p1_arg, &p1_len);
 
     int p2_len = 0;
-    uint8_t p2[1] = {0};
-    CLIGetHexWithReturn(ctx, 4, p2, &p2_len);
+    uint8_t p2_arg[1] = {0};
+    CLIGetHexWithReturn(ctx, 4, p2_arg, &p2_len);
 
-    int le_len = 0;
-    uint8_t le[1] = {0};
-    CLIGetHexWithReturn(ctx, 5, le, &le_len);
-
-    bool verbose = arg_get_lit(ctx, 6);
+    bool verbose = arg_get_lit(ctx, 5);
     CLIParserFree(ctx);
 
     bool activate_field = true;
     bool keep_field_on = true;
-
-    uint8_t a = cla[0];
-    uint8_t b = ins[0]; 
-    uint8_t c = p1[0];
-    uint8_t d = p2[0];
-    uint8_t e = le[0];    
-
-    PrintAndLogEx(SUCCESS, "Starting the apdu fuzzer [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " LE " _GREEN_("%02x")" ]", a,b,c,d,e);
-    PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
-
+    uint8_t cla = cla_arg[0];
+    uint8_t ins = ins_arg[0];
+    uint8_t p1 = p1_arg[0];
+    uint8_t p2 = p2_arg[0];
     uint8_t response[PM3_CMD_DATA_SIZE];
-    int resplen = 0;
-
+    int response_n = 0;
     uint8_t aSELECT_AID[80];
     int aSELECT_AID_n = 0;
+
+    // Check if the tag reponde to APDUs.
+    PrintAndLogEx(INFO, "Sending a test APDU (select file command) to check if the tag is responding to APDU");
     param_gethex_to_eol("00a404000aa000000440000101000100", 0, aSELECT_AID, sizeof(aSELECT_AID), &aSELECT_AID_n);
-    int res = ExchangeAPDU14a(aSELECT_AID, aSELECT_AID_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
+    int res = ExchangeAPDU14a(aSELECT_AID, aSELECT_AID_n, activate_field, keep_field_on, response, sizeof(response), &response_n);
     if (res) {
         DropField();
+        PrintAndLogEx(FAILED, "Tag did not responde to a test APDU (select file command). Aborting");
         return res;
     }
+    PrintAndLogEx(SUCCESS, "Got response. Starting the APDU finder [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla,ins,p1,p2);
+    PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
 
-    if (activate_field)
-        activate_field = false;
-
+    activate_field = false;
     uint64_t t1 = msclock();
+
+    // Enumerate APDUs.
     do {
         do {
             do {
                 do {
-                    do {
-                        if (kbd_enter_pressed()) {
-                            goto out;
-                        }
+                    // Exit (was the Enter key pressed)?
+                    if (kbd_enter_pressed()) {
+                        PrintAndLogEx(INFO, "User interrupted detected. Aborting");
+                        goto out;
+                    }
 
-                        uint8_t foo[5] = {a, b, c, d, e};
-                        int foo_n = sizeof(foo);                    
+                    if (verbose) {
+                        PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla,ins,p1,p2);
+                    }
 
-                        if (verbose) {
-                            PrintAndLogEx(INFO, "%s", sprint_hex(foo, sizeof(foo)));
-                        }
-                        res = ExchangeAPDU14a(foo, foo_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
+                    // Send APDU.
+                    uint8_t command[4] = {cla, ins, p1, p2};
+                    int command_n = sizeof(command);
+                    res = ExchangeAPDU14a(command, command_n, activate_field, keep_field_on, response, sizeof(response), &response_n);
+                    if (res) {
+                        continue;
+                    }
+
+                    // Was there and length error? If so, try with Le length (case 2 instad of case 1,
+                    // https://stackoverflow.com/a/30679558). Le = 0x00 will get interpreted as extended length APDU
+                    // with Le being 0x0100.
+                    uint16_t sw = get_sw(response, response_n);
+                    bool command_with_le = false;
+                    if (sw == 0x6700) {
+                        PrintAndLogEx(INFO, "Got response for APDU: %02X%02X%02X%02X (%04x - %s)", cla,ins,p1,p2,
+                                    sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
+                        PrintAndLogEx(INFO, "Resending current command with Le = 0x0100 (extended length APDU)");
+                        uint8_t command2[7] = {cla, ins, p1, p2, 0x00};
+                        int command2_n = sizeof(command2);
+                        res = ExchangeAPDU14a(command2, command2_n, activate_field, keep_field_on, response, sizeof(response), &response_n);
                         if (res) {
-                            e++;
-                            continue;                                            
+                            continue;
                         }
+                        command_with_le = true;
+                    }
 
-                        uint16_t sw = get_sw(response, resplen);
-                        if (sw != 0x6a86 &&
-                            sw != 0x6986 &&
-                            sw != 0x6d00
-                            ) {
-                            PrintAndLogEx(INFO, "%02X %02X %02X %02X %02X (%04x - %s)", a,b,c,d,e, sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
+                    // Check response.
+                    // TODO: What response values should be considerd "valid" or "instersting"?
+                    sw = get_sw(response, response_n);
+                    if (sw != 0x6a86 &&
+                        sw != 0x6986 &&
+                        sw != 0x6d00
+                        ) {
+                        if (command_with_le) {
+                            PrintAndLogEx(INFO, "Got response for APDU: %02X%02X%02X%02X00 (%04x - %s)", cla,ins,p1,p2,
+                                    sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
+                        } else {
+                            PrintAndLogEx(INFO, "Got response for APDU: %02X%02X%02X%02X (%04x - %s)", cla,ins,p1,p2,
+                                    sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
                         }
-                        e++;
-                        if (verbose) {
-                            PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a,b,c,d,e);
+                        // Show response data.
+                        if (response_n > 2) {
+                            PrintAndLogEx(INFO, "Response data is: %s | %s", sprint_hex_inrow(response, response_n-2),
+                                    sprint_ascii(response, response_n-2));
                         }
-
-                    } while (e);
-                    d++;
-                    PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a,b,c,d,e);
-                } while (d);
-                c++;
-                PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a,b,c,d,e);
-            } while (c);
-            b++;
-            PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a,b,c,d,e);
-        } while (b);
-        a++;
-        PrintAndLogEx(INFO, "Status: %02X %02X %02X %02X %02X", a,b,c,d,e);
-    } while(a);
+                    }
+                } while (++ins != ins_arg[0]);
+                p1++;
+                PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla,ins,p1,p2);
+            } while (p1 != p1_arg[0]);
+            p2++;
+            PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla,ins,p1,p2);
+        } while (p2 != p2_arg[0]);
+        cla++;
+        PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla,ins,p1,p2);
+    } while (cla != cla_arg[0]);
 
 out:
-    PrintAndLogEx(SUCCESS, "time: %" PRIu64 " seconds\n", (msclock() - t1) / 1000);
+    PrintAndLogEx(SUCCESS, "Runtime: %" PRIu64 " seconds\n", (msclock() - t1) / 1000);
     DropField();
     return PM3_SUCCESS;
 }
@@ -2266,7 +2286,7 @@ static command_t CommandTable[] = {
     {"raw",         CmdHF14ACmdRaw,       IfPm3Iso14443a,  "Send raw hex data to tag"},
     {"antifuzz",    CmdHF14AAntiFuzz,     IfPm3Iso14443a,  "Fuzzing the anticollision phase.  Warning! Readers may react strange"},
     {"config",      CmdHf14AConfig,       IfPm3Iso14443a,  "Configure 14a settings (use with caution)"},
-    {"apdufuzz",    CmdHf14AFuzzapdu,     IfPm3Iso14443a,  "Fuzz APDU - CLA/INS/P1P2"},
+    {"apdufind",    CmdHf14AFindapdu,     IfPm3Iso14443a,  "Enuerate APDUs - CLA/INS/P1P2"},
     {NULL, NULL, NULL, NULL}
 };
 

From baa86de247aa2f771ac6af16c038236725fd03a4 Mon Sep 17 00:00:00 2001
From: ikarus <ikarus4ever@web.de>
Date: Sun, 13 Dec 2020 00:16:56 +0100
Subject: [PATCH 046/682] Fixed merge conflict (make style).

---
 client/src/cmdhf14a.c | 34 +++++++++++++++++-----------------
 doc/commands.md       |  2 +-
 2 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index 075c0e4f5..e984019b8 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -2137,7 +2137,7 @@ static int CmdHf14AFindapdu(const char *Cmd) {
                   "Tag must be on antenna before running.",
                   "hf 14a apdufind\n"
                   "hf 14a apdufind --cla 80\n"
-                  );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -2189,7 +2189,7 @@ static int CmdHf14AFindapdu(const char *Cmd) {
         PrintAndLogEx(FAILED, "Tag did not responde to a test APDU (select file command). Aborting");
         return res;
     }
-    PrintAndLogEx(SUCCESS, "Got response. Starting the APDU finder [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla,ins,p1,p2);
+    PrintAndLogEx(SUCCESS, "Got response. Starting the APDU finder [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
     PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
 
     activate_field = false;
@@ -2207,7 +2207,7 @@ static int CmdHf14AFindapdu(const char *Cmd) {
                     }
 
                     if (verbose) {
-                        PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla,ins,p1,p2);
+                        PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
                     }
 
                     // Send APDU.
@@ -2224,8 +2224,8 @@ static int CmdHf14AFindapdu(const char *Cmd) {
                     uint16_t sw = get_sw(response, response_n);
                     bool command_with_le = false;
                     if (sw == 0x6700) {
-                        PrintAndLogEx(INFO, "Got response for APDU: %02X%02X%02X%02X (%04x - %s)", cla,ins,p1,p2,
-                                    sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
+                        PrintAndLogEx(INFO, "Got response for APDU: %02X%02X%02X%02X (%04x - %s)", cla, ins, p1, p2,
+                                      sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
                         PrintAndLogEx(INFO, "Resending current command with Le = 0x0100 (extended length APDU)");
                         uint8_t command2[7] = {cla, ins, p1, p2, 0x00};
                         int command2_n = sizeof(command2);
@@ -2240,31 +2240,31 @@ static int CmdHf14AFindapdu(const char *Cmd) {
                     // TODO: What response values should be considerd "valid" or "instersting"?
                     sw = get_sw(response, response_n);
                     if (sw != 0x6a86 &&
-                        sw != 0x6986 &&
-                        sw != 0x6d00
-                        ) {
+                            sw != 0x6986 &&
+                            sw != 0x6d00
+                       ) {
                         if (command_with_le) {
-                            PrintAndLogEx(INFO, "Got response for APDU: %02X%02X%02X%02X00 (%04x - %s)", cla,ins,p1,p2,
-                                    sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
+                            PrintAndLogEx(INFO, "Got response for APDU: %02X%02X%02X%02X00 (%04x - %s)", cla, ins, p1, p2,
+                                          sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
                         } else {
-                            PrintAndLogEx(INFO, "Got response for APDU: %02X%02X%02X%02X (%04x - %s)", cla,ins,p1,p2,
-                                    sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
+                            PrintAndLogEx(INFO, "Got response for APDU: %02X%02X%02X%02X (%04x - %s)", cla, ins, p1, p2,
+                                          sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
                         }
                         // Show response data.
                         if (response_n > 2) {
-                            PrintAndLogEx(INFO, "Response data is: %s | %s", sprint_hex_inrow(response, response_n-2),
-                                    sprint_ascii(response, response_n-2));
+                            PrintAndLogEx(INFO, "Response data is: %s | %s", sprint_hex_inrow(response, response_n - 2),
+                                          sprint_ascii(response, response_n - 2));
                         }
                     }
                 } while (++ins != ins_arg[0]);
                 p1++;
-                PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla,ins,p1,p2);
+                PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
             } while (p1 != p1_arg[0]);
             p2++;
-            PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla,ins,p1,p2);
+            PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
         } while (p2 != p2_arg[0]);
         cla++;
-        PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla,ins,p1,p2);
+        PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
     } while (cla != cla_arg[0]);
 
 out:
diff --git a/doc/commands.md b/doc/commands.md
index 58578c26e..7bc9342c5 100644
--- a/doc/commands.md
+++ b/doc/commands.md
@@ -142,7 +142,7 @@ Check column "offline" for their availability.
 |`hf 14a raw             `|N       |`Send raw hex data to tag`
 |`hf 14a antifuzz        `|N       |`Fuzzing the anticollision phase.  Warning! Readers may react strange`
 |`hf 14a config          `|N       |`Configure 14a settings (use with caution)`
-|`hf 14a apdufuzz        `|N       |`Fuzz APDU - CLA/INS/P1P2`
+|`hf 14a apdufind        `|N       |`Enuerate APDUs - CLA/INS/P1P2`
 
 
 ### hf 14b

From a9713bbe6162474f0ff87a433abc7c9b944cd0a6 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sun, 13 Dec 2020 01:17:41 +0100
Subject: [PATCH 047/682] fix #1094 - add Le

---
 client/src/emv/emvcore.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/emv/emvcore.c b/client/src/emv/emvcore.c
index 7982ff711..f9cbe4f82 100644
--- a/client/src/emv/emvcore.c
+++ b/client/src/emv/emvcore.c
@@ -617,7 +617,7 @@ int EMVSelectApplication(struct tlvdb *tlv, uint8_t *AID, size_t *AIDlen) {
 }
 
 int EMVGPO(EMVCommandChannel channel, bool LeaveFieldON, uint8_t *PDOL, size_t PDOLLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {
-    return EMVExchange(channel, LeaveFieldON, (sAPDU) {0x80, 0xa8, 0x00, 0x00, PDOLLen, PDOL}, Result, MaxResultLen, ResultLen, sw, tlv);
+    return EMVExchangeEx(channel, false, LeaveFieldON, (sAPDU) {0x80, 0xa8, 0x00, 0x00, PDOLLen, PDOL}, true, Result, MaxResultLen, ResultLen, sw, tlv);
 }
 
 int EMVReadRecord(EMVCommandChannel channel, bool LeaveFieldON, uint8_t SFI, uint8_t SFIrec, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv) {

From 81981a73fee587d3af1ecfc6883efa442ff19838 Mon Sep 17 00:00:00 2001
From: ikarus <ikarus4ever@web.de>
Date: Sun, 13 Dec 2020 01:25:55 +0100
Subject: [PATCH 048/682] APDU finder: increment P1/P2 alternating & add
 Changelog entry.

---
 CHANGELOG.md          |   1 +
 client/src/cmdhf14a.c | 111 ++++++++++++++++++++++--------------------
 2 files changed, 58 insertions(+), 54 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e168a0db4..f613c4c70 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -116,6 +116,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
  - Change, use system Whereami library if available (@doegox)
  - Change, use system Zlib library if available (@doegox)
  - Fix release version information (@doegox)
+ - Add `hf 14a apdufind` to find hidden APDUs (@iceman1001 & @ikarus23)
 
 ## [ice coffee.4.9237][2020-05-21]
  - Updated documentation (@doegox, @iceman1001)
diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index e984019b8..0f020b54a 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -2133,7 +2133,7 @@ static int CmdHf14AFindapdu(const char *Cmd) {
     CLIParserInit(&ctx, "hf 14a apdufind",
                   "Enumerate APDU's of ISO7816 protocol to find valid CLS/INS/P1P2 commands.\n"
                   "It loops all 256 possible values for each byte.\n"
-                  "The loop oder is INS->P1->P2->CLA\n"
+                  "The loop oder is INS -> P1/P2 (alternating) -> CLA\n"
                   "Tag must be on antenna before running.",
                   "hf 14a apdufind\n"
                   "hf 14a apdufind --cla 80\n"
@@ -2193,76 +2193,79 @@ static int CmdHf14AFindapdu(const char *Cmd) {
     PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
 
     activate_field = false;
+    bool inc_p1 = true;
     uint64_t t1 = msclock();
 
     // Enumerate APDUs.
     do {
         do {
             do {
-                do {
-                    // Exit (was the Enter key pressed)?
-                    if (kbd_enter_pressed()) {
-                        PrintAndLogEx(INFO, "User interrupted detected. Aborting");
-                        goto out;
-                    }
+                // Exit (was the Enter key pressed)?
+                if (kbd_enter_pressed()) {
+                    PrintAndLogEx(INFO, "User interrupted detected. Aborting");
+                    goto out;
+                }
 
-                    if (verbose) {
-                        PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
-                    }
+                if (verbose) {
+                    PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
+                }
 
-                    // Send APDU.
-                    uint8_t command[4] = {cla, ins, p1, p2};
-                    int command_n = sizeof(command);
-                    res = ExchangeAPDU14a(command, command_n, activate_field, keep_field_on, response, sizeof(response), &response_n);
+                // Send APDU.
+                uint8_t command[4] = {cla, ins, p1, p2};
+                int command_n = sizeof(command);
+                res = ExchangeAPDU14a(command, command_n, activate_field, keep_field_on, response, sizeof(response), &response_n);
+                if (res) {
+                    continue;
+                }
+
+                // Was there and length error? If so, try with Le length (case 2 instad of case 1,
+                // https://stackoverflow.com/a/30679558). Le = 0x00 will get interpreted as extended length APDU
+                // with Le being 0x0100.
+                uint16_t sw = get_sw(response, response_n);
+                bool command_with_le = false;
+                if (sw == 0x6700) {
+                    PrintAndLogEx(INFO, "Got response for APDU: %02X%02X%02X%02X (%04X - %s)", cla, ins, p1, p2,
+                                  sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
+                    PrintAndLogEx(INFO, "Resending current command with Le = 0x0100 (extended length APDU)");
+                    uint8_t command2[7] = {cla, ins, p1, p2, 0x00};
+                    int command2_n = sizeof(command2);
+                    res = ExchangeAPDU14a(command2, command2_n, activate_field, keep_field_on, response, sizeof(response), &response_n);
                     if (res) {
                         continue;
                     }
+                    command_with_le = true;
+                }
 
-                    // Was there and length error? If so, try with Le length (case 2 instad of case 1,
-                    // https://stackoverflow.com/a/30679558). Le = 0x00 will get interpreted as extended length APDU
-                    // with Le being 0x0100.
-                    uint16_t sw = get_sw(response, response_n);
-                    bool command_with_le = false;
-                    if (sw == 0x6700) {
-                        PrintAndLogEx(INFO, "Got response for APDU: %02X%02X%02X%02X (%04x - %s)", cla, ins, p1, p2,
+                // Check response.
+                // TODO: What response values should be considerd "valid" or "instersting"?
+                sw = get_sw(response, response_n);
+                if (sw != 0x6a86 &&
+                        sw != 0x6986 &&
+                        sw != 0x6d00
+                   ) {
+                    if (command_with_le) {
+                        PrintAndLogEx(INFO, "Got response for APDU: %02X%02X%02X%02X00 (%04X - %s)", cla, ins, p1, p2,
+                                      sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
+                    } else {
+                        PrintAndLogEx(INFO, "Got response for APDU: %02X%02X%02X%02X (%04X - %s)", cla, ins, p1, p2,
                                       sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
-                        PrintAndLogEx(INFO, "Resending current command with Le = 0x0100 (extended length APDU)");
-                        uint8_t command2[7] = {cla, ins, p1, p2, 0x00};
-                        int command2_n = sizeof(command2);
-                        res = ExchangeAPDU14a(command2, command2_n, activate_field, keep_field_on, response, sizeof(response), &response_n);
-                        if (res) {
-                            continue;
-                        }
-                        command_with_le = true;
                     }
-
-                    // Check response.
-                    // TODO: What response values should be considerd "valid" or "instersting"?
-                    sw = get_sw(response, response_n);
-                    if (sw != 0x6a86 &&
-                            sw != 0x6986 &&
-                            sw != 0x6d00
-                       ) {
-                        if (command_with_le) {
-                            PrintAndLogEx(INFO, "Got response for APDU: %02X%02X%02X%02X00 (%04x - %s)", cla, ins, p1, p2,
-                                          sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
-                        } else {
-                            PrintAndLogEx(INFO, "Got response for APDU: %02X%02X%02X%02X (%04x - %s)", cla, ins, p1, p2,
-                                          sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
-                        }
-                        // Show response data.
-                        if (response_n > 2) {
-                            PrintAndLogEx(INFO, "Response data is: %s | %s", sprint_hex_inrow(response, response_n - 2),
-                                          sprint_ascii(response, response_n - 2));
-                        }
+                    // Show response data.
+                    if (response_n > 2) {
+                        PrintAndLogEx(SUCCESS, "Response data is: %s | %s", sprint_hex_inrow(response, response_n - 2),
+                                      sprint_ascii(response, response_n - 2));
                     }
-                } while (++ins != ins_arg[0]);
+                }
+            } while (++ins != ins_arg[0]);
+            // Increment P1/P2 in an alternating fashion.
+            if (inc_p1) {
                 p1++;
-                PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
-            } while (p1 != p1_arg[0]);
-            p2++;
+            } else {
+                p2++;
+            }
+            inc_p1 = !inc_p1;
             PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
-        } while (p2 != p2_arg[0]);
+        } while (p1 != p1_arg[0] || p2 != p2_arg[0]);
         cla++;
         PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
     } while (cla != cla_arg[0]);

From 9db2a04449a6cb89881ea540146a1726ea4102c7 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sun, 13 Dec 2020 01:44:03 +0100
Subject: [PATCH 049/682] fix: rem - now handles cliparse and strings correct

---
 client/src/cmdmain.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdmain.c b/client/src/cmdmain.c
index 9b26512f1..4d393756f 100644
--- a/client/src/cmdmain.c
+++ b/client/src/cmdmain.c
@@ -165,19 +165,35 @@ int CmdRem(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "rem",
                   "Add a text line in log file",
-                  "rem"
+                  "rem my message    -> adds a timestamp with `my message`"
                  );
 
     void *argtable[] = {
         arg_param_begin,
+        arg_strx1(NULL, NULL, NULL, "message line you want inserted"),
         arg_param_end
     };
-    CLIExecWithReturn(ctx, Cmd, argtable, true);
-    CLIParserFree(ctx);
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
 
+    struct arg_str* foo = arg_get_str(ctx, 1);
+    size_t count = 0;
+    size_t len = 0;
+    do {
+        count += strlen(foo->sval[len]);
+    } while (len++ < (foo->count - 1));
+
+    char s[count + foo->count];
+    memset(s, 0, sizeof(s));
+
+    len = 0;
+    do {
+        snprintf(s + strlen(s), sizeof(s) - strlen(s), "%s ", foo->sval[len]);
+    } while (len++ < (foo->count - 1));
+
+    CLIParserFree(ctx);
     char buf[22] = {0};
     AppendDate(buf, sizeof(buf), NULL);
-    PrintAndLogEx(NORMAL, "%s remark: %s", buf, Cmd);
+    PrintAndLogEx(SUCCESS, "%s remark: %s", buf, s);
     return PM3_SUCCESS;
 }
 

From d5d5cc1fe65b8c80cca5f7551120cb41ede30e5b Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 14 Dec 2020 00:21:10 +0300
Subject: [PATCH 050/682] emrtd: Add further checks to secure_select and
 secure_read

---
 client/src/cmdhfemrtd.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index f8f89f557..3dec8accb 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -466,7 +466,9 @@ static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, const
     sprintf(command, "0C%s020C%02X%s00", SELECT, lc, sprint_hex_inrow(data, lc));
     PrintAndLogEx(DEBUG, "command: %s", command);
 
-    exchange_commands(command, response, &resplen, false, true, use_14b);
+    if (exchange_commands(command, response, &resplen, false, true, use_14b) == false) {
+        return false;
+    }
 
     return check_cc(ssc, kmac, response, resplen);
 }
@@ -524,7 +526,9 @@ static bool _secure_read_binary(uint8_t *kmac, uint8_t *ssc, int offset, int byt
     sprintf(command, "0C%s%02X%02X%02X%s00", READ_BINARY, p1, p2, lc, sprint_hex_inrow(data, lc));
     PrintAndLogEx(DEBUG, "command: %s", command);
 
-    exchange_commands(command, dataout, dataoutlen, false, true, use_14b);
+    if (exchange_commands(command, dataout, dataoutlen, false, true, use_14b) == false) {
+        return false;
+    }
 
     return check_cc(ssc, kmac, dataout, *dataoutlen);
 }

From a85e8a40d4955471e3ac7a68ff86583ac2faaece Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 14 Dec 2020 01:30:11 +0300
Subject: [PATCH 051/682] emrtd: Get file list from ef_com (but not parse yet)

---
 client/src/cmdhfemrtd.c | 134 ++++++++++++----------------------------
 1 file changed, 38 insertions(+), 96 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 3dec8accb..7dac49477 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -78,7 +78,7 @@ static bool exchange_commands(const char *cmd, uint8_t *dataout, int *dataoutlen
 
     PrintAndLogEx(DEBUG, "Sending: %s", cmd);
 
-    uint8_t aCMD[500];
+    uint8_t aCMD[PM3_CMD_DATA_SIZE];
     int aCMD_n = 0;
     param_gethex_to_eol(cmd, 0, aCMD, sizeof(aCMD), &aCMD_n);
     int res;
@@ -404,7 +404,7 @@ static bool check_cc(uint8_t *ssc, uint8_t *key, uint8_t *rapdu, int rapdulength
 }
 
 static void _convert_filename(const char *file, uint8_t *dataout) {
-    char temp[3];
+    char temp[3] = {0x00};
     memcpy(temp, file, 2);
     dataout[0] = (int)strtol(temp, NULL, 16);
     memcpy(temp, file + 2, 2);
@@ -592,6 +592,34 @@ static int secure_read_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_t
     return true;
 }
 
+static bool ef_com_get_file_list(uint8_t *datain, int *datainlen, uint8_t *dataout, int *dataoutlen) {
+    int offset = 2;
+    int elementidlen = 0;
+    int elementlen = 0;
+    while (offset < *datainlen) {
+        PrintAndLogEx(DEBUG, "ef_com_get_file_list, offset: %i, data: %X", offset, *(datain + offset));
+        // Determine element ID length to set as offset on asn1datalength
+        if (*(datain + offset) == 0x5f) {
+            elementidlen = 2;
+        } else {
+            elementidlen = 1;
+        }
+
+        // Get the length of the element
+        elementlen = asn1datalength(datain + offset, *datainlen - offset, elementidlen);
+
+        // If the element is what we're looking for, get the data and return true
+        if (*(datain + offset) == 0x5c) {
+            *dataoutlen = elementlen;
+            memcpy(dataout, datain + offset + elementidlen + 1, elementlen);
+            return true;
+        }
+        offset += elementidlen + elementlen + 1;
+    }
+    // Return false if we can't find the relevant element
+    return false;
+}
+
 int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     uint8_t response[25000];
     uint8_t rnd_ic[8];
@@ -763,7 +791,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
 
     // Select EF_COM
     if (secure_select_file(ks_enc, ks_mac, ssc, EF_COM, use_14b) == false) {
-        PrintAndLogEx(ERR, "Failed to secure select EF_COM, crypto checksum check failed.");
+        PrintAndLogEx(ERR, "Failed to secure select EF_COM.");
         DropField();
         return PM3_ESOFT;
     }
@@ -775,104 +803,18 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     }
     PrintAndLogEx(INFO, "Read EF_COM, len: %i.", resplen);
     PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
-    saveFile("EF_COM", ".BIN", response, resplen);
+    // saveFile("EF_COM", ".BIN", response, resplen);
 
-    // TODO: Don't read a hardcoded list of files, reduce code repetition
-    // Select EF_DG1
-    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG1, use_14b) == false) {
-        PrintAndLogEx(ERR, "Failed to secure select EF_DG1, crypto checksum check failed.");
+    uint8_t filelist[50];
+    int filelistlen = 0;
+
+    if (ef_com_get_file_list(response, &resplen, filelist, &filelistlen) == false) {
+        PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
         DropField();
         return PM3_ESOFT;
     }
 
-    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen, use_14b) == false) {
-        PrintAndLogEx(ERR, "Failed to read EF_DG1.");
-        DropField();
-        return PM3_ESOFT;
-    }
-    PrintAndLogEx(INFO, "Read EF_DG1, len: %i.", resplen);
-    PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
-    saveFile("EF_DG1", ".BIN", response, resplen);
-
-    // Select EF_DG2
-    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG2, use_14b) == false) {
-        PrintAndLogEx(ERR, "Failed to secure select EF_DG2, crypto checksum check failed.");
-        DropField();
-        return PM3_ESOFT;
-    }
-
-    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen, use_14b) == false) {
-        PrintAndLogEx(ERR, "Failed to read EF_DG2.");
-        DropField();
-        return PM3_ESOFT;
-    }
-    PrintAndLogEx(INFO, "Read EF_DG2, len: %i.", resplen);
-    PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
-    saveFile("EF_DG2", ".BIN", response, resplen);
-
-    // Select EF_SOD
-    if (secure_select_file(ks_enc, ks_mac, ssc, EF_SOD, use_14b) == false) {
-        PrintAndLogEx(ERR, "Failed to secure select EF_SOD, crypto checksum check failed.");
-        DropField();
-        return PM3_ESOFT;
-    }
-
-    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen, use_14b) == false) {
-        PrintAndLogEx(ERR, "Failed to read EF_SOD.");
-        DropField();
-        return PM3_ESOFT;
-    }
-    PrintAndLogEx(INFO, "Read EF_SOD, len: %i.", resplen);
-    PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
-    saveFile("EF_SOD", ".BIN", response, resplen);
-
-    // Select EF_DG11
-    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG11, use_14b) == false) {
-        PrintAndLogEx(ERR, "Failed to secure select EF_DG11, crypto checksum check failed.");
-        DropField();
-        return PM3_ESOFT;
-    }
-
-    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen, use_14b) == false) {
-        PrintAndLogEx(ERR, "Failed to read EF_DG11.");
-        DropField();
-        return PM3_ESOFT;
-    }
-    PrintAndLogEx(INFO, "Read EF_DG11, len: %i.", resplen);
-    PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
-    saveFile("EF_DG11", ".BIN", response, resplen);
-
-    // Select EF_DG12
-    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG12, use_14b) == false) {
-        PrintAndLogEx(ERR, "Failed to secure select EF_DG12, crypto checksum check failed.");
-        DropField();
-        return PM3_ESOFT;
-    }
-
-    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen, use_14b) == false) {
-        PrintAndLogEx(ERR, "Failed to read EF_DG12.");
-        DropField();
-        return PM3_ESOFT;
-    }
-    PrintAndLogEx(INFO, "Read EF_DG12, len: %i.", resplen);
-    PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
-    saveFile("EF_DG12", ".BIN", response, resplen);
-
-    // Select EF_DG14
-    if (secure_select_file(ks_enc, ks_mac, ssc, EF_DG14, use_14b) == false) {
-        PrintAndLogEx(ERR, "Failed to secure select EF_DG14, crypto checksum check failed.");
-        DropField();
-        return PM3_ESOFT;
-    }
-
-    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen, use_14b) == false) {
-        PrintAndLogEx(ERR, "Failed to read EF_DG14.");
-        DropField();
-        return PM3_ESOFT;
-    }
-    PrintAndLogEx(INFO, "Read EF_DG14, len: %i.", resplen);
-    PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
-    saveFile("EF_DG14", ".BIN", response, resplen);
+    PrintAndLogEx(DEBUG, "File List: %s", sprint_hex_inrow(filelist, filelistlen));
 
     DropField();
     return PM3_SUCCESS;

From 41a7bdef1c3dc8b209b70617272a31dc585367d3 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 14 Dec 2020 02:11:39 +0300
Subject: [PATCH 052/682] emrtd: Detect file list on card and dump what is
 available

---
 client/src/cmdhfemrtd.c | 120 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 119 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 7dac49477..b0ee1a7b0 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -620,6 +620,113 @@ static bool ef_com_get_file_list(uint8_t *datain, int *datainlen, uint8_t *datao
     return false;
 }
 
+static bool file_tag_to_file_id(uint8_t *datain, char *filenameout, char *dataout) {
+    // imagine bothering with a hashmap or writing good code
+    // couldn't be me
+    switch (*datain) {
+        case 0x60:
+            memcpy(dataout, EF_COM, 4);
+            memcpy(filenameout, "EF_COM", 6);
+            break;
+        case 0x61:
+            memcpy(dataout, EF_DG1, 4);
+            memcpy(filenameout, "EF_DG1", 6);
+            break;
+        case 0x75:
+            memcpy(dataout, EF_DG2, 4);
+            memcpy(filenameout, "EF_DG2", 6);
+            break;
+        // These cases are commented out as they require PACE
+        // Trying to read a PACE file without doing PACE auth kills the session
+        // case 0x63:
+        //     memcpy(dataout, EF_DG3, 4);
+        //     memcpy(filenameout, "EF_DG3", 6);
+        //     break;
+        // case 0x76:
+        //     memcpy(dataout, EF_DG4, 4);
+        //     memcpy(filenameout, "EF_DG4", 6);
+        //     break;
+        case 0x65:
+            memcpy(dataout, EF_DG5, 4);
+            memcpy(filenameout, "EF_DG5", 6);
+            break;
+        case 0x66:
+            memcpy(dataout, EF_DG6, 4);
+            memcpy(filenameout, "EF_DG6", 6);
+            break;
+        case 0x67:
+            memcpy(dataout, EF_DG7, 4);
+            memcpy(filenameout, "EF_DG7", 6);
+            break;
+        case 0x68:
+            memcpy(dataout, EF_DG8, 4);
+            memcpy(filenameout, "EF_DG8", 6);
+            break;
+        case 0x69:
+            memcpy(dataout, EF_DG9, 4);
+            memcpy(filenameout, "EF_DG9", 6);
+            break;
+        case 0x6a:
+            memcpy(dataout, EF_DG10, 4);
+            memcpy(filenameout, "EF_DG10", 7);
+            break;
+        case 0x6b:
+            memcpy(dataout, EF_DG11, 4);
+            memcpy(filenameout, "EF_DG11", 7);
+            break;
+        case 0x6c:
+            memcpy(dataout, EF_DG12, 4);
+            memcpy(filenameout, "EF_DG12", 7);
+            break;
+        case 0x6d:
+            memcpy(dataout, EF_DG13, 4);
+            memcpy(filenameout, "EF_DG13", 7);
+            break;
+        case 0x6e:
+            memcpy(dataout, EF_DG14, 4);
+            memcpy(filenameout, "EF_DG14", 7);
+            break;
+        case 0x6f:
+            memcpy(dataout, EF_DG15, 4);
+            memcpy(filenameout, "EF_DG15", 7);
+            break;
+        case 0x70:
+            memcpy(dataout, EF_DG16, 4);
+            memcpy(filenameout, "EF_DG16", 7);
+            break;
+        case 0x77:
+            memcpy(dataout, EF_SOD, 4);
+            memcpy(filenameout, "EF_SOD", 6);
+            break;
+        default:
+            return false;
+    }
+    return true;
+}
+
+static bool dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, const char *file, const char *name, bool use_14b) {
+    uint8_t response[35000];
+    int resplen = 0;
+
+    if (secure_select_file(ks_enc, ks_mac, ssc, file, use_14b) == false) {
+        PrintAndLogEx(ERR, "Failed to secure select %s, crypto checksum check failed.", name);
+        DropField();
+        return false;
+    }
+
+    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen, use_14b) == false) {
+        PrintAndLogEx(ERR, "Failed to read %s.", name);
+        DropField();
+        return false;
+    }
+
+    PrintAndLogEx(INFO, "Read %s, len: %i.", name, resplen);
+    PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
+    saveFile(name, ".BIN", response, resplen);
+
+    return true;
+}
+
 int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     uint8_t response[25000];
     uint8_t rnd_ic[8];
@@ -803,7 +910,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     }
     PrintAndLogEx(INFO, "Read EF_COM, len: %i.", resplen);
     PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
-    // saveFile("EF_COM", ".BIN", response, resplen);
+    saveFile("EF_COM", ".BIN", response, resplen);
 
     uint8_t filelist[50];
     int filelistlen = 0;
@@ -816,6 +923,17 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
 
     PrintAndLogEx(DEBUG, "File List: %s", sprint_hex_inrow(filelist, filelistlen));
 
+    for (int i = 0; i < filelistlen; i++) {
+        char file_id[5] = {0x00};
+        char file_name[8] = {0x00};
+        if (file_tag_to_file_id(&filelist[i], file_name, file_id) == false) {
+            PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
+            continue;
+        }
+        PrintAndLogEx(DEBUG, "Current file: %s", file_name);
+        dump_file(ks_enc, ks_mac, ssc, file_id, file_name, use_14b);
+    }
+
     DropField();
     return PM3_SUCCESS;
 }

From a5aed0dffd558cd35993c2c42503c89327eb42e6 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 14 Dec 2020 02:42:37 +0300
Subject: [PATCH 053/682] emrtd: Force dumping EF_SOD

---
 client/src/cmdhfemrtd.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index b0ee1a7b0..a476352a3 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -804,6 +804,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
             PrintAndLogEx(INFO, "EF_DG1: %s", sprint_hex(response, resplen));
         }
     }
+    // TODO: account for the case of no BAC
     PrintAndLogEx(DEBUG, "doc: %s", documentnumber);
     PrintAndLogEx(DEBUG, "dob: %s", dob);
     PrintAndLogEx(DEBUG, "exp: %s", expiry);
@@ -934,6 +935,8 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
         dump_file(ks_enc, ks_mac, ssc, file_id, file_name, use_14b);
     }
 
+    dump_file(ks_enc, ks_mac, ssc, EF_SOD, "EF_SOD", use_14b);
+
     DropField();
     return PM3_SUCCESS;
 }

From 1e16b2d2d9b949a74e5455ccbb7f2f1a0b8c8bba Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 14 Dec 2020 17:26:47 +0300
Subject: [PATCH 054/682] emrtd: Code cleanup, impl PRNG

---
 client/src/cmdhfemrtd.c | 37 ++++++++++++++++++++-----------------
 1 file changed, 20 insertions(+), 17 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index a476352a3..5fdf0e7ca 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -26,6 +26,9 @@
 #include "des.h"                    // mbedtls_des_key_set_parity
 #include "cmdhf14b.h"               // exchange_14b_apdu
 #include "iso14b.h"                 // ISO14B_CONNECT etc
+#include "crapto1/crapto1.h"        // prng_successor
+#include "commonutil.h"             // num_to_bytes
+#include "util_posix.h"             // msclock
 
 #define TIMEOUT 2000
 
@@ -62,6 +65,9 @@
 // App IDs
 #define AID_MRTD "A0000002471001"
 
+uint8_t KENC_type[4] = {0x00, 0x00, 0x00, 0x01};
+uint8_t KMAC_type[4] = {0x00, 0x00, 0x00, 0x02};
+
 static int CmdHelp(const char *Cmd);
 
 static uint16_t get_sw(uint8_t *d, uint8_t n) {
@@ -481,16 +487,9 @@ static bool _secure_read_binary(uint8_t *kmac, uint8_t *ssc, int offset, int byt
 
     PrintAndLogEx(DEBUG, "kmac: %s", sprint_hex_inrow(kmac, 20));
 
-    // TODO: hacky
-    char offsethex[5];
-    sprintf(offsethex, "%04X", offset);
-    char offsetbuffer[8];
-    memcpy(offsetbuffer, offsethex, 2);
-    int p1 = (int)strtol(offsetbuffer, NULL, 16);
-    memcpy(offsetbuffer, offsethex + 2, 2);
-    int p2 = (int)strtol(offsetbuffer, NULL, 16);
-    temp[2] = p1;
-    temp[3] = p2;
+    // Set p1 and p2
+    temp[2] = (uint8_t)(offset >> 8);
+    temp[3] = (uint8_t)(offset >> 0);
 
     int cmdlen = pad_block(temp, 4, cmd);
     PrintAndLogEx(DEBUG, "cmd: %s", sprint_hex_inrow(cmd, cmdlen));
@@ -523,7 +522,7 @@ static bool _secure_read_binary(uint8_t *kmac, uint8_t *ssc, int offset, int byt
     memcpy(data + 3, do8e, 10);
     PrintAndLogEx(DEBUG, "data: %s", sprint_hex_inrow(data, lc));
 
-    sprintf(command, "0C%s%02X%02X%02X%s00", READ_BINARY, p1, p2, lc, sprint_hex_inrow(data, lc));
+    sprintf(command, "0C%s%04X%02X%s00", READ_BINARY, offset, lc, sprint_hex_inrow(data, lc));
     PrintAndLogEx(DEBUG, "command: %s", command);
 
     if (exchange_commands(command, dataout, dataoutlen, false, true, use_14b) == false) {
@@ -727,6 +726,13 @@ static bool dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, const char
     return true;
 }
 
+static void rng(int length, uint8_t *dataout) {
+    // Do very very secure prng operations
+    for (int i = 0; i < (length / 4); i++) {
+        num_to_bytes(prng_successor(msclock() + i, 32), 4, &dataout[i * 4]);
+    }
+}
+
 int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     uint8_t response[25000];
     uint8_t rnd_ic[8];
@@ -735,12 +741,9 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     int resplen = 0;
     // bool BAC = true;
     uint8_t S[32];
-    // TODO: Code sponsored jointly by duracell and sony
-    uint8_t rnd_ifd[8] = {0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA};
-    uint8_t k_ifd[16] = {0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA};
-    // TODO: get these _types into a better spot
-    uint8_t KENC_type[4] = {0x00, 0x00, 0x00, 0x01};
-    uint8_t KMAC_type[4] = {0x00, 0x00, 0x00, 0x02};
+    uint8_t rnd_ifd[8], k_ifd[16];
+    rng(8, rnd_ifd);
+    rng(16, k_ifd);
 
     bool use_14b = false;
 

From 8ed358e3bed27df3d323f437ae5bc5b53258cbd5 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 14 Dec 2020 17:28:54 +0300
Subject: [PATCH 055/682] emrtd: Mark DESKey as const

---
 client/src/cmdhfemrtd.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 5fdf0e7ca..4b658d95e 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -65,8 +65,9 @@
 // App IDs
 #define AID_MRTD "A0000002471001"
 
-uint8_t KENC_type[4] = {0x00, 0x00, 0x00, 0x01};
-uint8_t KMAC_type[4] = {0x00, 0x00, 0x00, 0x02};
+// DESKey Types
+const uint8_t KENC_type[4] = {0x00, 0x00, 0x00, 0x01};
+const uint8_t KMAC_type[4] = {0x00, 0x00, 0x00, 0x02};
 
 static int CmdHelp(const char *Cmd);
 
@@ -271,7 +272,7 @@ static void retail_mac(uint8_t *key, uint8_t *input, int inputlen, uint8_t *outp
 }
 
 
-static void deskey(uint8_t *seed, uint8_t *type, int length, uint8_t *dataout) {
+static void deskey(uint8_t *seed, const uint8_t *type, int length, uint8_t *dataout) {
     PrintAndLogEx(DEBUG, "seed: %s", sprint_hex_inrow(seed, 16));
 
     // combine seed and type

From 19922e1d23db9e5e33704a9f182e261baf7d99b1 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 14 Dec 2020 17:30:58 +0300
Subject: [PATCH 056/682] emrtd: Clean up includes, further document used files

---
 client/src/cmdhfemrtd.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 4b658d95e..0490c783a 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -14,11 +14,9 @@
 #include <ctype.h>
 #include "fileutils.h"              // saveFile
 #include "cmdparser.h"              // command_t
-#include "comms.h"                  // clearCommandBuffer
-#include "cmdtrace.h"
-#include "cliparser.h"
-#include "crc16.h"
-#include "cmdhf14a.h"
+#include "cmdtrace.h"               // CmdTraceList
+#include "cliparser.h"              // CLIParserContext etc
+#include "cmdhf14a.h"               // ExchangeAPDU14a
 #include "protocols.h"              // definitions of ISO14A/7816 protocol
 #include "emv/apduinfo.h"           // GetAPDUCodeDescription
 #include "sha1.h"                   // KSeed calculation etc

From eaea632eb31c542d8c5cd2538a98102195fe594e Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 14 Dec 2020 17:45:53 +0300
Subject: [PATCH 057/682] emrtd: Join secure and insecure reads

---
 client/src/cmdhfemrtd.c | 335 +++++++++++++++++++---------------------
 1 file changed, 157 insertions(+), 178 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 0490c783a..43f10ad19 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -269,7 +269,6 @@ static void retail_mac(uint8_t *key, uint8_t *input, int inputlen, uint8_t *outp
     memcpy(output, intermediate_des, 8);
 }
 
-
 static void deskey(uint8_t *seed, const uint8_t *type, int length, uint8_t *dataout) {
     PrintAndLogEx(DEBUG, "seed: %s", sprint_hex_inrow(seed, 16));
 
@@ -324,42 +323,6 @@ static int _read_binary(int offset, int bytes_to_read, uint8_t *dataout, int *da
     return exchange_commands(cmd, dataout, dataoutlen, false, true, use_14b);
 }
 
-static int read_file(uint8_t *dataout, int *dataoutlen, bool use_14b) {
-    uint8_t response[PM3_CMD_DATA_SIZE];
-    int resplen = 0;
-    uint8_t tempresponse[PM3_CMD_DATA_SIZE];
-    int tempresplen = 0;
-
-    if (!_read_binary(0, 4, response, &resplen, use_14b)) {
-        return false;
-    }
-
-    int datalen = asn1datalength(response, resplen, 1);
-    int readlen = datalen - (3 - asn1fieldlength(response, resplen, 1));
-    int offset = 4;
-    int toread;
-
-    while (readlen > 0) {
-        toread = readlen;
-        if (readlen > 118) {
-            toread = 118;
-        }
-
-        if (!_read_binary(offset, toread, tempresponse, &tempresplen, use_14b)) {
-            return false;
-        }
-
-        memcpy(&response[resplen], &tempresponse, tempresplen);
-        offset += toread;
-        readlen -= toread;
-        resplen += tempresplen;
-    }
-
-    memcpy(dataout, &response, resplen);
-    *dataoutlen = resplen;
-    return true;
-}
-
 static void bump_ssc(uint8_t *ssc) {
     PrintAndLogEx(DEBUG, "ssc-b: %s", sprint_hex_inrow(ssc, 8));
     for (int i = 7; i > 0; i--) {
@@ -553,21 +516,28 @@ static bool _secure_read_binary_decrypt(uint8_t *kenc, uint8_t *kmac, uint8_t *s
     return true;
 }
 
-static int secure_read_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_t *dataout, int *dataoutlen, bool use_14b) {
-    // TODO: join this with regular read file
-    uint8_t response[25000];
+
+static int read_file(uint8_t *dataout, int *dataoutlen, uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, bool use_14b) {
+    uint8_t response[35000];
     int resplen = 0;
     uint8_t tempresponse[500];
     int tempresplen = 0;
+    int toread = 4;
+    int offset = 0;
 
-    if (!_secure_read_binary_decrypt(kenc, kmac, ssc, 0, 4, response, &resplen, use_14b)) {
-        return false;
+    if (kenc == NULL) {
+        if (_read_binary(offset, toread, response, &resplen, use_14b) == false) {
+            return false;
+        }
+    } else {
+        if (_secure_read_binary_decrypt(kenc, kmac, ssc, offset, toread, response, &resplen, use_14b) == false) {
+            return false;
+        }
     }
 
     int datalen = asn1datalength(response, resplen, 1);
     int readlen = datalen - (3 - asn1fieldlength(response, resplen, 1));
-    int offset = 4;
-    int toread;
+    offset = 4;
 
     while (readlen > 0) {
         toread = readlen;
@@ -575,8 +545,14 @@ static int secure_read_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, uint8_t
             toread = 118;
         }
 
-        if (!_secure_read_binary_decrypt(kenc, kmac, ssc, offset, toread, tempresponse, &tempresplen, use_14b)) {
-            return false;
+        if (kenc == NULL) {
+            if (_read_binary(offset, toread, tempresponse, &tempresplen, use_14b) == false) {
+                return false;
+            }
+        } else {
+            if (_secure_read_binary_decrypt(kenc, kmac, ssc, offset, toread, tempresponse, &tempresplen, use_14b) == false) {
+                return false;
+            }
         }
 
         memcpy(response + resplen, tempresponse, tempresplen);
@@ -712,7 +688,7 @@ static bool dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, const char
         return false;
     }
 
-    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen, use_14b) == false) {
+    if (read_file(response, &resplen, ks_enc, ks_mac, ssc, use_14b) == false) {
         PrintAndLogEx(ERR, "Failed to read %s.", name);
         DropField();
         return false;
@@ -738,7 +714,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     uint8_t kenc[50];
     uint8_t kmac[50];
     int resplen = 0;
-    // bool BAC = true;
+    bool BAC = false;
     uint8_t S[32];
     uint8_t rnd_ifd[8], k_ifd[16];
     rng(8, rnd_ifd);
@@ -775,7 +751,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
 
     // Select and read EF_CardAccess
     if (select_file(P1_SELECT_BY_EF, EF_CARDACCESS, use_14b)) {
-        read_file(response, &resplen, use_14b);
+        read_file(response, &resplen, NULL, NULL, NULL, use_14b);
         PrintAndLogEx(INFO, "Read EF_CardAccess, len: %i.", resplen);
         PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
     } else {
@@ -791,153 +767,156 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
 
     // Select EF_COM
     if (select_file(P1_SELECT_BY_EF, EF_COM, use_14b) == false) {
-        // BAC = true;
+        BAC = true;
         PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt external authentication.");
     } else {
-        // BAC = false;
+        BAC = false;
         // Select EF_DG1
         select_file(P1_SELECT_BY_EF, EF_DG1, use_14b);
 
-        if (read_file(response, &resplen, use_14b) == false) {
-            // BAC = true;
+        if (read_file(response, &resplen, NULL, NULL, NULL, use_14b) == false) {
+            BAC = true;
             PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt external authentication.");
         } else {
-            // BAC = false;
+            BAC = false;
             PrintAndLogEx(INFO, "EF_DG1: %s", sprint_hex(response, resplen));
         }
     }
-    // TODO: account for the case of no BAC
-    PrintAndLogEx(DEBUG, "doc: %s", documentnumber);
-    PrintAndLogEx(DEBUG, "dob: %s", dob);
-    PrintAndLogEx(DEBUG, "exp: %s", expiry);
 
-    char documentnumbercd = calculate_check_digit(documentnumber);
-    char dobcd = calculate_check_digit(dob);
-    char expirycd = calculate_check_digit(expiry);
+    if (BAC) {
+        // TODO: account for the case of no BAC
+        PrintAndLogEx(DEBUG, "doc: %s", documentnumber);
+        PrintAndLogEx(DEBUG, "dob: %s", dob);
+        PrintAndLogEx(DEBUG, "exp: %s", expiry);
 
-    char kmrz[25];
-    sprintf(kmrz, "%s%i%s%i%s%i", documentnumber, documentnumbercd, dob, dobcd, expiry, expirycd);
-    PrintAndLogEx(DEBUG, "kmrz: %s", kmrz);
+        char documentnumbercd = calculate_check_digit(documentnumber);
+        char dobcd = calculate_check_digit(dob);
+        char expirycd = calculate_check_digit(expiry);
 
-    uint8_t kseed[16] = {0x00};
-    mbedtls_sha1((unsigned char *)kmrz, strlen(kmrz), kseed);
-    PrintAndLogEx(DEBUG, "kseed: %s", sprint_hex_inrow(kseed, 16));
+        char kmrz[25];
+        sprintf(kmrz, "%s%i%s%i%s%i", documentnumber, documentnumbercd, dob, dobcd, expiry, expirycd);
+        PrintAndLogEx(DEBUG, "kmrz: %s", kmrz);
 
-    deskey(kseed, KENC_type, 16, kenc);
-    deskey(kseed, KMAC_type, 16, kmac);
-    PrintAndLogEx(DEBUG, "kenc: %s", sprint_hex_inrow(kenc, 16));
-    PrintAndLogEx(DEBUG, "kmac: %s", sprint_hex_inrow(kmac, 16));
+        uint8_t kseed[16] = { 0x00 };
+        mbedtls_sha1((unsigned char *)kmrz, strlen(kmrz), kseed);
+        PrintAndLogEx(DEBUG, "kseed: %s", sprint_hex_inrow(kseed, 16));
 
-    // Get Challenge
-    if (get_challenge(8, rnd_ic, &resplen, use_14b) == false) {
-        PrintAndLogEx(ERR, "Couldn't get challenge.");
-        DropField();
-        return PM3_ESOFT;
-    }
-    PrintAndLogEx(DEBUG, "rnd_ic: %s", sprint_hex_inrow(rnd_ic, 8));
+        deskey(kseed, KENC_type, 16, kenc);
+        deskey(kseed, KMAC_type, 16, kmac);
+        PrintAndLogEx(DEBUG, "kenc: %s", sprint_hex_inrow(kenc, 16));
+        PrintAndLogEx(DEBUG, "kmac: %s", sprint_hex_inrow(kmac, 16));
 
-    memcpy(S, rnd_ifd, 8);
-    memcpy(S + 8, rnd_ic, 8);
-    memcpy(S + 16, k_ifd, 16);
-
-    PrintAndLogEx(DEBUG, "S: %s", sprint_hex_inrow(S, 32));
-
-    uint8_t iv[8] = { 0x00 };
-    uint8_t e_ifd[32] = { 0x00 };
-
-    des3_encrypt_cbc(iv, kenc, S, sizeof(S), e_ifd);
-    PrintAndLogEx(DEBUG, "e_ifd: %s", sprint_hex_inrow(e_ifd, 32));
-
-    uint8_t m_ifd[8] = { 0x00 };
-
-    retail_mac(kmac, e_ifd, 32, m_ifd);
-    PrintAndLogEx(DEBUG, "m_ifd: %s", sprint_hex_inrow(m_ifd, 8));
-
-    uint8_t cmd_data[40];
-    memcpy(cmd_data, e_ifd, 32);
-    memcpy(cmd_data + 32, m_ifd, 8);
-
-    // Do external authentication
-    if (external_authenticate(cmd_data, sizeof(cmd_data), response, &resplen, use_14b) == false) {
-        PrintAndLogEx(ERR, "Couldn't do external authentication. Did you supply the correct MRZ info?");
-        DropField();
-        return PM3_ESOFT;
-    }
-    PrintAndLogEx(INFO, "External authentication successful.");
-
-    uint8_t dec_output[32] = { 0x00 };
-    des3_decrypt_cbc(iv, kenc, response, 32, dec_output);
-    PrintAndLogEx(DEBUG, "dec_output: %s", sprint_hex_inrow(dec_output, 32));
-
-    if (memcmp(rnd_ifd, dec_output + 8, 8) != 0) {
-        PrintAndLogEx(ERR, "Challenge failed, rnd_ifd does not match.");
-        DropField();
-        return PM3_ESOFT;
-    }
-
-    uint8_t ssc[8] = { 0x00 };
-    uint8_t ks_enc[16] = { 0x00 };
-    uint8_t ks_mac[16] = { 0x00 };
-    uint8_t k_icc[16] = { 0x00 };
-    memcpy(k_icc, dec_output + 16, 16);
-
-    // Calculate session keys
-    for (int x = 0; x < 16; x++) {
-        kseed[x] = k_ifd[x] ^ k_icc[x];
-    }
-
-    PrintAndLogEx(DEBUG, "kseed: %s", sprint_hex_inrow(kseed, 16));
-
-    deskey(kseed, KENC_type, 16, ks_enc);
-    deskey(kseed, KMAC_type, 16, ks_mac);
-
-    PrintAndLogEx(DEBUG, "ks_enc: %s", sprint_hex_inrow(ks_enc, 16));
-    PrintAndLogEx(DEBUG, "ks_mac: %s", sprint_hex_inrow(ks_mac, 16));
-
-    memcpy(ssc, rnd_ic + 4, 4);
-    memcpy(ssc + 4, rnd_ifd + 4, 4);
-
-    PrintAndLogEx(DEBUG, "ssc: %s", sprint_hex_inrow(ssc, 8));
-
-    // Select EF_COM
-    if (secure_select_file(ks_enc, ks_mac, ssc, EF_COM, use_14b) == false) {
-        PrintAndLogEx(ERR, "Failed to secure select EF_COM.");
-        DropField();
-        return PM3_ESOFT;
-    }
-
-    if (secure_read_file(ks_enc, ks_mac, ssc, response, &resplen, use_14b) == false) {
-        PrintAndLogEx(ERR, "Failed to read EF_COM.");
-        DropField();
-        return PM3_ESOFT;
-    }
-    PrintAndLogEx(INFO, "Read EF_COM, len: %i.", resplen);
-    PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
-    saveFile("EF_COM", ".BIN", response, resplen);
-
-    uint8_t filelist[50];
-    int filelistlen = 0;
-
-    if (ef_com_get_file_list(response, &resplen, filelist, &filelistlen) == false) {
-        PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
-        DropField();
-        return PM3_ESOFT;
-    }
-
-    PrintAndLogEx(DEBUG, "File List: %s", sprint_hex_inrow(filelist, filelistlen));
-
-    for (int i = 0; i < filelistlen; i++) {
-        char file_id[5] = {0x00};
-        char file_name[8] = {0x00};
-        if (file_tag_to_file_id(&filelist[i], file_name, file_id) == false) {
-            PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
-            continue;
+        // Get Challenge
+        if (get_challenge(8, rnd_ic, &resplen, use_14b) == false) {
+            PrintAndLogEx(ERR, "Couldn't get challenge.");
+            DropField();
+            return PM3_ESOFT;
         }
-        PrintAndLogEx(DEBUG, "Current file: %s", file_name);
-        dump_file(ks_enc, ks_mac, ssc, file_id, file_name, use_14b);
-    }
+        PrintAndLogEx(DEBUG, "rnd_ic: %s", sprint_hex_inrow(rnd_ic, 8));
 
-    dump_file(ks_enc, ks_mac, ssc, EF_SOD, "EF_SOD", use_14b);
+        memcpy(S, rnd_ifd, 8);
+        memcpy(S + 8, rnd_ic, 8);
+        memcpy(S + 16, k_ifd, 16);
+
+        PrintAndLogEx(DEBUG, "S: %s", sprint_hex_inrow(S, 32));
+
+        uint8_t iv[8] = { 0x00 };
+        uint8_t e_ifd[32] = { 0x00 };
+
+        des3_encrypt_cbc(iv, kenc, S, sizeof(S), e_ifd);
+        PrintAndLogEx(DEBUG, "e_ifd: %s", sprint_hex_inrow(e_ifd, 32));
+
+        uint8_t m_ifd[8] = { 0x00 };
+
+        retail_mac(kmac, e_ifd, 32, m_ifd);
+        PrintAndLogEx(DEBUG, "m_ifd: %s", sprint_hex_inrow(m_ifd, 8));
+
+        uint8_t cmd_data[40];
+        memcpy(cmd_data, e_ifd, 32);
+        memcpy(cmd_data + 32, m_ifd, 8);
+
+        // Do external authentication
+        if (external_authenticate(cmd_data, sizeof(cmd_data), response, &resplen, use_14b) == false) {
+            PrintAndLogEx(ERR, "Couldn't do external authentication. Did you supply the correct MRZ info?");
+            DropField();
+            return PM3_ESOFT;
+        }
+        PrintAndLogEx(INFO, "External authentication successful.");
+
+        uint8_t dec_output[32] = { 0x00 };
+        des3_decrypt_cbc(iv, kenc, response, 32, dec_output);
+        PrintAndLogEx(DEBUG, "dec_output: %s", sprint_hex_inrow(dec_output, 32));
+
+        if (memcmp(rnd_ifd, dec_output + 8, 8) != 0) {
+            PrintAndLogEx(ERR, "Challenge failed, rnd_ifd does not match.");
+            DropField();
+            return PM3_ESOFT;
+        }
+
+        uint8_t ssc[8] = { 0x00 };
+        uint8_t ks_enc[16] = { 0x00 };
+        uint8_t ks_mac[16] = { 0x00 };
+        uint8_t k_icc[16] = { 0x00 };
+        memcpy(k_icc, dec_output + 16, 16);
+
+        // Calculate session keys
+        for (int x = 0; x < 16; x++) {
+            kseed[x] = k_ifd[x] ^ k_icc[x];
+        }
+
+        PrintAndLogEx(DEBUG, "kseed: %s", sprint_hex_inrow(kseed, 16));
+
+        deskey(kseed, KENC_type, 16, ks_enc);
+        deskey(kseed, KMAC_type, 16, ks_mac);
+
+        PrintAndLogEx(DEBUG, "ks_enc: %s", sprint_hex_inrow(ks_enc, 16));
+        PrintAndLogEx(DEBUG, "ks_mac: %s", sprint_hex_inrow(ks_mac, 16));
+
+        memcpy(ssc, rnd_ic + 4, 4);
+        memcpy(ssc + 4, rnd_ifd + 4, 4);
+
+        PrintAndLogEx(DEBUG, "ssc: %s", sprint_hex_inrow(ssc, 8));
+
+        // Select EF_COM
+        if (secure_select_file(ks_enc, ks_mac, ssc, EF_COM, use_14b) == false) {
+            PrintAndLogEx(ERR, "Failed to secure select EF_COM.");
+            DropField();
+            return PM3_ESOFT;
+        }
+
+        if (read_file(response, &resplen, ks_enc, ks_mac, ssc, use_14b) == false) {
+            PrintAndLogEx(ERR, "Failed to read EF_COM.");
+            DropField();
+            return PM3_ESOFT;
+        }
+        PrintAndLogEx(INFO, "Read EF_COM, len: %i.", resplen);
+        PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
+        saveFile("EF_COM", ".BIN", response, resplen);
+
+        uint8_t filelist[50];
+        int filelistlen = 0;
+
+        if (ef_com_get_file_list(response, &resplen, filelist, &filelistlen) == false) {
+            PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
+            DropField();
+            return PM3_ESOFT;
+        }
+
+        PrintAndLogEx(DEBUG, "File List: %s", sprint_hex_inrow(filelist, filelistlen));
+
+        for (int i = 0; i < filelistlen; i++) {
+            char file_id[5] = {0x00};
+            char file_name[8] = {0x00};
+            if (file_tag_to_file_id(&filelist[i], file_name, file_id) == false) {
+                PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
+                continue;
+            }
+            PrintAndLogEx(DEBUG, "Current file: %s", file_name);
+            dump_file(ks_enc, ks_mac, ssc, file_id, file_name, use_14b);
+        }
+
+        dump_file(ks_enc, ks_mac, ssc, EF_SOD, "EF_SOD", use_14b);
+    }
 
     DropField();
     return PM3_SUCCESS;

From 0bca61aa999a16a581a4e6c30e188d86c47a180e Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 14 Dec 2020 18:05:45 +0300
Subject: [PATCH 058/682] emrtd: Continue work on supporting non-BAC passports

---
 client/src/cmdhfemrtd.c | 154 +++++++++++++++++++++-------------------
 1 file changed, 81 insertions(+), 73 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 43f10ad19..957620b86 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -379,7 +379,7 @@ static void _convert_filename(const char *file, uint8_t *dataout) {
     dataout[1] = (int)strtol(temp, NULL, 16);
 }
 
-static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, const char *file, bool use_14b) {
+static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, const char *select_by, const char *file, bool use_14b) {
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
 
@@ -391,7 +391,7 @@ static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, const
     char command[54];
     uint8_t cmd[8];
     uint8_t data[21];
-    uint8_t temp[8] = {0x0c, 0xa4, 0x02, 0x0c};
+    uint8_t temp[8] = {0x0c, 0xa4, strtol(select_by, NULL, 16), 0x0c};
 
     int cmdlen = pad_block(temp, 4, cmd);
     int datalen = pad_block(file_id, 2, data);
@@ -431,7 +431,7 @@ static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, const
     memcpy(data + (datalen + 3), do8e, 10);
     PrintAndLogEx(DEBUG, "data: %s", sprint_hex_inrow(data, lc));
 
-    sprintf(command, "0C%s020C%02X%s00", SELECT, lc, sprint_hex_inrow(data, lc));
+    sprintf(command, "0C%s%s0C%02X%s00", SELECT, select_by, lc, sprint_hex_inrow(data, lc));
     PrintAndLogEx(DEBUG, "command: %s", command);
 
     if (exchange_commands(command, response, &resplen, false, true, use_14b) == false) {
@@ -517,7 +517,7 @@ static bool _secure_read_binary_decrypt(uint8_t *kenc, uint8_t *kmac, uint8_t *s
 }
 
 
-static int read_file(uint8_t *dataout, int *dataoutlen, uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, bool use_14b) {
+static int read_file(uint8_t *dataout, int *dataoutlen, uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, bool use_secure, bool use_14b) {
     uint8_t response[35000];
     int resplen = 0;
     uint8_t tempresponse[500];
@@ -525,12 +525,12 @@ static int read_file(uint8_t *dataout, int *dataoutlen, uint8_t *kenc, uint8_t *
     int toread = 4;
     int offset = 0;
 
-    if (kenc == NULL) {
-        if (_read_binary(offset, toread, response, &resplen, use_14b) == false) {
+    if (use_secure == true) {
+        if (_secure_read_binary_decrypt(kenc, kmac, ssc, offset, toread, response, &resplen, use_14b) == false) {
             return false;
         }
     } else {
-        if (_secure_read_binary_decrypt(kenc, kmac, ssc, offset, toread, response, &resplen, use_14b) == false) {
+        if (_read_binary(offset, toread, response, &resplen, use_14b) == false) {
             return false;
         }
     }
@@ -678,19 +678,31 @@ static bool file_tag_to_file_id(uint8_t *datain, char *filenameout, char *dataou
     return true;
 }
 
-static bool dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, const char *file, const char *name, bool use_14b) {
+static bool select_and_read(uint8_t *dataout, int *dataoutlen, const char *file, uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, bool use_secure, bool use_14b) {
+    if (use_secure == true) {
+        if (secure_select_file(ks_enc, ks_mac, ssc, P1_SELECT_BY_EF, file, use_14b) == false) {
+            PrintAndLogEx(ERR, "Failed to secure select %s.", file);
+            return false;
+        }
+    } else {
+        if (select_file(P1_SELECT_BY_EF, file, use_14b) == false) {
+            PrintAndLogEx(ERR, "Failed to select %s.", file);
+            return false;
+        }
+    }
+
+    if (read_file(dataout, dataoutlen, ks_enc, ks_mac, ssc, use_secure, use_14b) == false) {
+        PrintAndLogEx(ERR, "Failed to read %s.", file);
+        return false;
+    }
+    return true;
+}
+
+static bool dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, const char *file, const char *name, bool use_secure, bool use_14b) {
     uint8_t response[35000];
     int resplen = 0;
 
-    if (secure_select_file(ks_enc, ks_mac, ssc, file, use_14b) == false) {
-        PrintAndLogEx(ERR, "Failed to secure select %s, crypto checksum check failed.", name);
-        DropField();
-        return false;
-    }
-
-    if (read_file(response, &resplen, ks_enc, ks_mac, ssc, use_14b) == false) {
-        PrintAndLogEx(ERR, "Failed to read %s.", name);
-        DropField();
+    if (select_and_read(response, &resplen, file, ks_enc, ks_mac, ssc, use_secure, use_14b) == false) {
         return false;
     }
 
@@ -709,17 +721,12 @@ static void rng(int length, uint8_t *dataout) {
 }
 
 int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
-    uint8_t response[25000];
-    uint8_t rnd_ic[8];
-    uint8_t kenc[50];
-    uint8_t kmac[50];
+    uint8_t response[35000] = { 0x00 };
+    uint8_t ssc[8] = { 0x00 };
+    uint8_t ks_enc[16] = { 0x00 };
+    uint8_t ks_mac[16] = { 0x00 };
     int resplen = 0;
     bool BAC = false;
-    uint8_t S[32];
-    uint8_t rnd_ifd[8], k_ifd[16];
-    rng(8, rnd_ifd);
-    rng(16, k_ifd);
-
     bool use_14b = false;
 
     // Try to 14a
@@ -751,7 +758,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
 
     // Select and read EF_CardAccess
     if (select_file(P1_SELECT_BY_EF, EF_CARDACCESS, use_14b)) {
-        read_file(response, &resplen, NULL, NULL, NULL, use_14b);
+        read_file(response, &resplen, NULL, NULL, NULL, false, use_14b);
         PrintAndLogEx(INFO, "Read EF_CardAccess, len: %i.", resplen);
         PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
     } else {
@@ -774,7 +781,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
         // Select EF_DG1
         select_file(P1_SELECT_BY_EF, EF_DG1, use_14b);
 
-        if (read_file(response, &resplen, NULL, NULL, NULL, use_14b) == false) {
+        if (read_file(response, &resplen, NULL, NULL, NULL, false, use_14b) == false) {
             BAC = true;
             PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt external authentication.");
         } else {
@@ -784,7 +791,16 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
     }
 
     if (BAC) {
-        // TODO: account for the case of no BAC
+        uint8_t rnd_ic[8] = { 0x00 };
+        uint8_t kenc[50] = { 0x00 };
+        uint8_t kmac[50] = { 0x00 };
+        uint8_t k_icc[16] = { 0x00 };
+        uint8_t S[32] = { 0x00 };
+
+        uint8_t rnd_ifd[8], k_ifd[16];
+        rng(8, rnd_ifd);
+        rng(16, k_ifd);
+
         PrintAndLogEx(DEBUG, "doc: %s", documentnumber);
         PrintAndLogEx(DEBUG, "dob: %s", dob);
         PrintAndLogEx(DEBUG, "exp: %s", expiry);
@@ -853,10 +869,6 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
             return PM3_ESOFT;
         }
 
-        uint8_t ssc[8] = { 0x00 };
-        uint8_t ks_enc[16] = { 0x00 };
-        uint8_t ks_mac[16] = { 0x00 };
-        uint8_t k_icc[16] = { 0x00 };
         memcpy(k_icc, dec_output + 16, 16);
 
         // Calculate session keys
@@ -876,48 +888,44 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
         memcpy(ssc + 4, rnd_ifd + 4, 4);
 
         PrintAndLogEx(DEBUG, "ssc: %s", sprint_hex_inrow(ssc, 8));
-
-        // Select EF_COM
-        if (secure_select_file(ks_enc, ks_mac, ssc, EF_COM, use_14b) == false) {
-            PrintAndLogEx(ERR, "Failed to secure select EF_COM.");
-            DropField();
-            return PM3_ESOFT;
-        }
-
-        if (read_file(response, &resplen, ks_enc, ks_mac, ssc, use_14b) == false) {
-            PrintAndLogEx(ERR, "Failed to read EF_COM.");
-            DropField();
-            return PM3_ESOFT;
-        }
-        PrintAndLogEx(INFO, "Read EF_COM, len: %i.", resplen);
-        PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
-        saveFile("EF_COM", ".BIN", response, resplen);
-
-        uint8_t filelist[50];
-        int filelistlen = 0;
-
-        if (ef_com_get_file_list(response, &resplen, filelist, &filelistlen) == false) {
-            PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
-            DropField();
-            return PM3_ESOFT;
-        }
-
-        PrintAndLogEx(DEBUG, "File List: %s", sprint_hex_inrow(filelist, filelistlen));
-
-        for (int i = 0; i < filelistlen; i++) {
-            char file_id[5] = {0x00};
-            char file_name[8] = {0x00};
-            if (file_tag_to_file_id(&filelist[i], file_name, file_id) == false) {
-                PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
-                continue;
-            }
-            PrintAndLogEx(DEBUG, "Current file: %s", file_name);
-            dump_file(ks_enc, ks_mac, ssc, file_id, file_name, use_14b);
-        }
-
-        dump_file(ks_enc, ks_mac, ssc, EF_SOD, "EF_SOD", use_14b);
     }
 
+    // Select EF_COM
+    if (select_and_read(response, &resplen, EF_COM, ks_enc, ks_mac, ssc, BAC, use_14b) == false) {
+        PrintAndLogEx(ERR, "Failed to read EF_COM.");
+        DropField();
+        return PM3_ESOFT;
+    }
+    PrintAndLogEx(INFO, "Read EF_COM, len: %i.", resplen);
+    PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
+    saveFile("EF_COM", ".BIN", response, resplen);
+
+    uint8_t filelist[50];
+    int filelistlen = 0;
+
+    if (ef_com_get_file_list(response, &resplen, filelist, &filelistlen) == false) {
+        PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
+        DropField();
+        return PM3_ESOFT;
+    }
+
+    PrintAndLogEx(DEBUG, "File List: %s", sprint_hex_inrow(filelist, filelistlen));
+
+    // Dump all files in the file list
+    for (int i = 0; i < filelistlen; i++) {
+        char file_id[5] = { 0x00 };
+        char file_name[8] = { 0x00 };
+        if (file_tag_to_file_id(&filelist[i], file_name, file_id) == false) {
+            PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
+            continue;
+        }
+        PrintAndLogEx(DEBUG, "Current file: %s", file_name);
+        dump_file(ks_enc, ks_mac, ssc, file_id, file_name, BAC, use_14b);
+    }
+
+    // Dump EF_SOD
+    dump_file(ks_enc, ks_mac, ssc, EF_SOD, "EF_SOD", BAC, use_14b);
+
     DropField();
     return PM3_SUCCESS;
 }

From d197d5df347478e71f59d6bfe0b3f48e7b64402d Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 14 Dec 2020 18:24:24 +0300
Subject: [PATCH 059/682] emrtd: Complete non-BAC support

---
 client/src/cmdhfemrtd.c | 39 +++++++++++++++++++++++++--------------
 client/src/cmdhfemrtd.h |  2 +-
 2 files changed, 26 insertions(+), 15 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 957620b86..a1e5406af 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -720,7 +720,7 @@ static void rng(int length, uint8_t *dataout) {
     }
 }
 
-int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
+int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available) {
     uint8_t response[35000] = { 0x00 };
     uint8_t ssc[8] = { 0x00 };
     uint8_t ks_enc[16] = { 0x00 };
@@ -790,6 +790,13 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry) {
         }
     }
 
+    if (BAC == true && BAC_available == false) {
+        PrintAndLogEx(ERR, "This eMRTD enforces Basic Access Control, but you didn't supplied MRZ data. Cannot proceed.");
+        PrintAndLogEx(HINT, "Check out hf emrtd dump --help, supply data with -n -d and -e.");
+        DropField();
+        return PM3_ESOFT;
+    }
+
     if (BAC) {
         uint8_t rnd_ic[8] = { 0x00 };
         uint8_t kenc[50] = { 0x00 };
@@ -939,25 +946,29 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
 
     void *argtable[] = {
         arg_param_begin,
-        arg_str1("n", "documentnumber", "<number>", "9 character document number"),
-        arg_str1("d", "dateofbirth", "<number>", "date of birth in YYMMDD format"),
-        arg_str1("e", "expiry", "<number>", "expiry in YYMMDD format"),
+        arg_str0("n", "documentnumber", "<alphanum>", "9 character document number"),
+        arg_str0("d", "dateofbirth", "<YYMMDD>", "date of birth in YYMMDD format"),
+        arg_str0("e", "expiry", "<YYMMDD>", "expiry in YYMMDD format"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
 
-    uint8_t docnum[10];
-    uint8_t dob[7];
-    uint8_t expiry[7];
-    int docnumlen = 9;
-    int doblen = 6;
-    int expirylen = 6;
-    CLIGetStrWithReturn(ctx, 1, docnum, &docnumlen);
-    CLIGetStrWithReturn(ctx, 2, dob, &doblen);
-    CLIGetStrWithReturn(ctx, 3, expiry, &expirylen);
+    uint8_t docnum[10] = { 0x00 };
+    uint8_t dob[7] = { 0x00 };
+    uint8_t expiry[7] = { 0x00 };
+    bool BAC = true;
+    int slen = 0;  // unused
+    // Go through all args, if even one isn't supplied, mark BAC as unavailable
+    if (CLIParamStrToBuf(arg_get_str(ctx, 1), docnum, 9, &slen) != 0 || slen == 0) {
+        BAC = false;
+    } else if (CLIParamStrToBuf(arg_get_str(ctx, 2), dob, 6, &slen) != 0 || slen == 0) {
+        BAC = false;
+    } else if (CLIParamStrToBuf(arg_get_str(ctx, 3), expiry, 6, &slen) != 0 || slen == 0) {
+        BAC = false;
+    }
 
     CLIParserFree(ctx);
-    return dumpHF_EMRTD((char *)docnum, (char *)dob, (char *)expiry);
+    return dumpHF_EMRTD((char *)docnum, (char *)dob, (char *)expiry, BAC);
 }
 
 static int cmd_hf_emrtd_list(const char *Cmd) {
diff --git a/client/src/cmdhfemrtd.h b/client/src/cmdhfemrtd.h
index 5899ad27a..84500fc8b 100644
--- a/client/src/cmdhfemrtd.h
+++ b/client/src/cmdhfemrtd.h
@@ -15,5 +15,5 @@
 
 int CmdHFeMRTD(const char *Cmd);
 
-int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry);
+int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available);
 #endif

From 457311ffd9a09d2ad8255353f36351fd6e6a3ef8 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 14 Dec 2020 18:25:49 +0300
Subject: [PATCH 060/682] emrtd: make clean pass

---
 client/src/cmdhfemrtd.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index a1e5406af..1ca3b9213 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -145,23 +145,23 @@ static char calculate_check_digit(char *data) {
 
 static int asn1datalength(uint8_t *datain, int datainlen, int offset) {
     PrintAndLogEx(DEBUG, "asn1datalength, datain: %s", sprint_hex_inrow(datain, datainlen));
-    int lenfield = (int) *(datain + offset);
+    int lenfield = (int) * (datain + offset);
     PrintAndLogEx(DEBUG, "asn1datalength, lenfield: %i", lenfield);
     if (lenfield <= 0x7f) {
         return lenfield;
     } else if (lenfield == 0x81) {
-        return ((int) *(datain + offset + 1));
+        return ((int) * (datain + offset + 1));
     } else if (lenfield == 0x82) {
-        return ((int) *(datain + offset + 1) << 8) | ((int) *(datain + offset + 2));
+        return ((int) * (datain + offset + 1) << 8) | ((int) * (datain + offset + 2));
     } else if (lenfield == 0x83) {
-        return (((int) *(datain + offset + 1) << 16) | ((int) *(datain + offset + 2)) << 8) | ((int) *(datain + offset + 3));
+        return (((int) * (datain + offset + 1) << 16) | ((int) * (datain + offset + 2)) << 8) | ((int) * (datain + offset + 3));
     }
     return false;
 }
 
 static int asn1fieldlength(uint8_t *datain, int datainlen, int offset) {
     PrintAndLogEx(DEBUG, "asn1fieldlength, datain: %s", sprint_hex_inrow(datain, datainlen));
-    int lenfield = (int) *(datain + offset);
+    int lenfield = (int) * (datain + offset);
     PrintAndLogEx(DEBUG, "asn1fieldlength, thing: %i", lenfield);
     if (lenfield <= 0x7f) {
         return 1;

From bc00e92af012cd43896aa7dc64459cd1da6c0bf0 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 14 Dec 2020 19:08:03 +0300
Subject: [PATCH 061/682] emrtd: Switch from size_t to int to make CI happy

---
 client/src/cmdhfemrtd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 1ca3b9213..a3d98955e 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -293,10 +293,10 @@ static void deskey(uint8_t *seed, const uint8_t *type, int length, uint8_t *data
 }
 
 static int select_file(const char *select_by, const char *file_id, bool use_14b) {
-    size_t file_id_len = strlen(file_id) / 2;
+    int file_id_len = strlen(file_id) / 2;
 
     char cmd[50];
-    sprintf(cmd, "00%s%s0C%02lu%s", SELECT, select_by, file_id_len, file_id);
+    sprintf(cmd, "00%s%s0C%02X%s", SELECT, select_by, file_id_len, file_id);
 
     return exchange_commands_noout(cmd, false, true, use_14b);
 }

From 3339ba110f91cc24833a814a1248167a7b89da70 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 14 Dec 2020 20:09:20 +0300
Subject: [PATCH 062/682] emrtd: Split BAC into its own function

---
 client/src/cmdhfemrtd.c | 223 +++++++++++++++++++++-------------------
 1 file changed, 119 insertions(+), 104 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index a3d98955e..d08a789f9 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -28,7 +28,11 @@
 #include "commonutil.h"             // num_to_bytes
 #include "util_posix.h"             // msclock
 
-#define TIMEOUT 2000
+// Max file size in bytes. Used in several places.
+// Average EF_DG2 seems to be around 20-25kB or so, but ICAO doesn't set an upper limit
+// Iris data seems to be suggested to be around 35kB per eye (Presumably bumping up the file size to around 70kB)
+// but as we cannot read that until we implement PACE, 35k seems to be a safe point.
+#define MAX_FILE_SIZE 35000
 
 // ISO7816 commands
 #define SELECT "A4"
@@ -518,7 +522,7 @@ static bool _secure_read_binary_decrypt(uint8_t *kenc, uint8_t *kmac, uint8_t *s
 
 
 static int read_file(uint8_t *dataout, int *dataoutlen, uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, bool use_secure, bool use_14b) {
-    uint8_t response[35000];
+    uint8_t response[MAX_FILE_SIZE];
     int resplen = 0;
     uint8_t tempresponse[500];
     int tempresplen = 0;
@@ -699,7 +703,7 @@ static bool select_and_read(uint8_t *dataout, int *dataoutlen, const char *file,
 }
 
 static bool dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, const char *file, const char *name, bool use_secure, bool use_14b) {
-    uint8_t response[35000];
+    uint8_t response[MAX_FILE_SIZE];
     int resplen = 0;
 
     if (select_and_read(response, &resplen, file, ks_enc, ks_mac, ssc, use_secure, use_14b) == false) {
@@ -720,12 +724,114 @@ static void rng(int length, uint8_t *dataout) {
     }
 }
 
+static bool do_bac(char *documentnumber, char *dob, char *expiry, uint8_t *ssc, uint8_t *ks_enc, uint8_t *ks_mac, bool use_14b) {
+    uint8_t response[MAX_FILE_SIZE] = { 0x00 };
+    int resplen = 0;
+
+    uint8_t rnd_ic[8] = { 0x00 };
+    uint8_t kenc[50] = { 0x00 };
+    uint8_t kmac[50] = { 0x00 };
+    uint8_t k_icc[16] = { 0x00 };
+    uint8_t S[32] = { 0x00 };
+
+    uint8_t rnd_ifd[8], k_ifd[16];
+    rng(8, rnd_ifd);
+    rng(16, k_ifd);
+
+    PrintAndLogEx(DEBUG, "doc: %s", documentnumber);
+    PrintAndLogEx(DEBUG, "dob: %s", dob);
+    PrintAndLogEx(DEBUG, "exp: %s", expiry);
+
+    char documentnumbercd = calculate_check_digit(documentnumber);
+    char dobcd = calculate_check_digit(dob);
+    char expirycd = calculate_check_digit(expiry);
+
+    char kmrz[25];
+    sprintf(kmrz, "%s%i%s%i%s%i", documentnumber, documentnumbercd, dob, dobcd, expiry, expirycd);
+    PrintAndLogEx(DEBUG, "kmrz: %s", kmrz);
+
+    uint8_t kseed[16] = { 0x00 };
+    mbedtls_sha1((unsigned char *)kmrz, strlen(kmrz), kseed);
+    PrintAndLogEx(DEBUG, "kseed: %s", sprint_hex_inrow(kseed, 16));
+
+    deskey(kseed, KENC_type, 16, kenc);
+    deskey(kseed, KMAC_type, 16, kmac);
+    PrintAndLogEx(DEBUG, "kenc: %s", sprint_hex_inrow(kenc, 16));
+    PrintAndLogEx(DEBUG, "kmac: %s", sprint_hex_inrow(kmac, 16));
+
+    // Get Challenge
+    if (get_challenge(8, rnd_ic, &resplen, use_14b) == false) {
+        PrintAndLogEx(ERR, "Couldn't get challenge.");
+        return false;
+    }
+    PrintAndLogEx(DEBUG, "rnd_ic: %s", sprint_hex_inrow(rnd_ic, 8));
+
+    memcpy(S, rnd_ifd, 8);
+    memcpy(S + 8, rnd_ic, 8);
+    memcpy(S + 16, k_ifd, 16);
+
+    PrintAndLogEx(DEBUG, "S: %s", sprint_hex_inrow(S, 32));
+
+    uint8_t iv[8] = { 0x00 };
+    uint8_t e_ifd[32] = { 0x00 };
+
+    des3_encrypt_cbc(iv, kenc, S, sizeof(S), e_ifd);
+    PrintAndLogEx(DEBUG, "e_ifd: %s", sprint_hex_inrow(e_ifd, 32));
+
+    uint8_t m_ifd[8] = { 0x00 };
+
+    retail_mac(kmac, e_ifd, 32, m_ifd);
+    PrintAndLogEx(DEBUG, "m_ifd: %s", sprint_hex_inrow(m_ifd, 8));
+
+    uint8_t cmd_data[40];
+    memcpy(cmd_data, e_ifd, 32);
+    memcpy(cmd_data + 32, m_ifd, 8);
+
+    // Do external authentication
+    if (external_authenticate(cmd_data, sizeof(cmd_data), response, &resplen, use_14b) == false) {
+        PrintAndLogEx(ERR, "Couldn't do external authentication. Did you supply the correct MRZ info?");
+        return false;
+    }
+    PrintAndLogEx(INFO, "External authentication successful.");
+
+    uint8_t dec_output[32] = { 0x00 };
+    des3_decrypt_cbc(iv, kenc, response, 32, dec_output);
+    PrintAndLogEx(DEBUG, "dec_output: %s", sprint_hex_inrow(dec_output, 32));
+
+    if (memcmp(rnd_ifd, dec_output + 8, 8) != 0) {
+        PrintAndLogEx(ERR, "Challenge failed, rnd_ifd does not match.");
+        return false;
+    }
+
+    memcpy(k_icc, dec_output + 16, 16);
+
+    // Calculate session keys
+    for (int x = 0; x < 16; x++) {
+        kseed[x] = k_ifd[x] ^ k_icc[x];
+    }
+
+    PrintAndLogEx(DEBUG, "kseed: %s", sprint_hex_inrow(kseed, 16));
+
+    deskey(kseed, KENC_type, 16, ks_enc);
+    deskey(kseed, KMAC_type, 16, ks_mac);
+
+    PrintAndLogEx(DEBUG, "ks_enc: %s", sprint_hex_inrow(ks_enc, 16));
+    PrintAndLogEx(DEBUG, "ks_mac: %s", sprint_hex_inrow(ks_mac, 16));
+
+    memcpy(ssc, rnd_ic + 4, 4);
+    memcpy(ssc + 4, rnd_ifd + 4, 4);
+
+    PrintAndLogEx(DEBUG, "ssc: %s", sprint_hex_inrow(ssc, 8));
+
+    return true;
+}
+
 int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available) {
-    uint8_t response[35000] = { 0x00 };
+    uint8_t response[MAX_FILE_SIZE] = { 0x00 };
+    int resplen = 0;
     uint8_t ssc[8] = { 0x00 };
     uint8_t ks_enc[16] = { 0x00 };
     uint8_t ks_mac[16] = { 0x00 };
-    int resplen = 0;
     bool BAC = false;
     bool use_14b = false;
 
@@ -790,111 +896,20 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         }
     }
 
-    if (BAC == true && BAC_available == false) {
-        PrintAndLogEx(ERR, "This eMRTD enforces Basic Access Control, but you didn't supplied MRZ data. Cannot proceed.");
-        PrintAndLogEx(HINT, "Check out hf emrtd dump --help, supply data with -n -d and -e.");
-        DropField();
-        return PM3_ESOFT;
-    }
-
+    // Do Basic Access Aontrol
     if (BAC) {
-        uint8_t rnd_ic[8] = { 0x00 };
-        uint8_t kenc[50] = { 0x00 };
-        uint8_t kmac[50] = { 0x00 };
-        uint8_t k_icc[16] = { 0x00 };
-        uint8_t S[32] = { 0x00 };
-
-        uint8_t rnd_ifd[8], k_ifd[16];
-        rng(8, rnd_ifd);
-        rng(16, k_ifd);
-
-        PrintAndLogEx(DEBUG, "doc: %s", documentnumber);
-        PrintAndLogEx(DEBUG, "dob: %s", dob);
-        PrintAndLogEx(DEBUG, "exp: %s", expiry);
-
-        char documentnumbercd = calculate_check_digit(documentnumber);
-        char dobcd = calculate_check_digit(dob);
-        char expirycd = calculate_check_digit(expiry);
-
-        char kmrz[25];
-        sprintf(kmrz, "%s%i%s%i%s%i", documentnumber, documentnumbercd, dob, dobcd, expiry, expirycd);
-        PrintAndLogEx(DEBUG, "kmrz: %s", kmrz);
-
-        uint8_t kseed[16] = { 0x00 };
-        mbedtls_sha1((unsigned char *)kmrz, strlen(kmrz), kseed);
-        PrintAndLogEx(DEBUG, "kseed: %s", sprint_hex_inrow(kseed, 16));
-
-        deskey(kseed, KENC_type, 16, kenc);
-        deskey(kseed, KMAC_type, 16, kmac);
-        PrintAndLogEx(DEBUG, "kenc: %s", sprint_hex_inrow(kenc, 16));
-        PrintAndLogEx(DEBUG, "kmac: %s", sprint_hex_inrow(kmac, 16));
-
-        // Get Challenge
-        if (get_challenge(8, rnd_ic, &resplen, use_14b) == false) {
-            PrintAndLogEx(ERR, "Couldn't get challenge.");
-            DropField();
-            return PM3_ESOFT;
-        }
-        PrintAndLogEx(DEBUG, "rnd_ic: %s", sprint_hex_inrow(rnd_ic, 8));
-
-        memcpy(S, rnd_ifd, 8);
-        memcpy(S + 8, rnd_ic, 8);
-        memcpy(S + 16, k_ifd, 16);
-
-        PrintAndLogEx(DEBUG, "S: %s", sprint_hex_inrow(S, 32));
-
-        uint8_t iv[8] = { 0x00 };
-        uint8_t e_ifd[32] = { 0x00 };
-
-        des3_encrypt_cbc(iv, kenc, S, sizeof(S), e_ifd);
-        PrintAndLogEx(DEBUG, "e_ifd: %s", sprint_hex_inrow(e_ifd, 32));
-
-        uint8_t m_ifd[8] = { 0x00 };
-
-        retail_mac(kmac, e_ifd, 32, m_ifd);
-        PrintAndLogEx(DEBUG, "m_ifd: %s", sprint_hex_inrow(m_ifd, 8));
-
-        uint8_t cmd_data[40];
-        memcpy(cmd_data, e_ifd, 32);
-        memcpy(cmd_data + 32, m_ifd, 8);
-
-        // Do external authentication
-        if (external_authenticate(cmd_data, sizeof(cmd_data), response, &resplen, use_14b) == false) {
-            PrintAndLogEx(ERR, "Couldn't do external authentication. Did you supply the correct MRZ info?");
-            DropField();
-            return PM3_ESOFT;
-        }
-        PrintAndLogEx(INFO, "External authentication successful.");
-
-        uint8_t dec_output[32] = { 0x00 };
-        des3_decrypt_cbc(iv, kenc, response, 32, dec_output);
-        PrintAndLogEx(DEBUG, "dec_output: %s", sprint_hex_inrow(dec_output, 32));
-
-        if (memcmp(rnd_ifd, dec_output + 8, 8) != 0) {
-            PrintAndLogEx(ERR, "Challenge failed, rnd_ifd does not match.");
+        // If BAC isn't available, exit out and warn user.
+        if (!BAC_available) {
+            PrintAndLogEx(ERR, "This eMRTD enforces Basic Access Control, but you didn't supplied MRZ data. Cannot proceed.");
+            PrintAndLogEx(HINT, "Check out hf emrtd dump --help, supply data with -n -d and -e.");
             DropField();
             return PM3_ESOFT;
         }
 
-        memcpy(k_icc, dec_output + 16, 16);
-
-        // Calculate session keys
-        for (int x = 0; x < 16; x++) {
-            kseed[x] = k_ifd[x] ^ k_icc[x];
+        if (do_bac(documentnumber, dob, expiry, ssc, ks_enc, ks_mac, use_14b) == false) {
+            DropField();
+            return PM3_ESOFT;
         }
-
-        PrintAndLogEx(DEBUG, "kseed: %s", sprint_hex_inrow(kseed, 16));
-
-        deskey(kseed, KENC_type, 16, ks_enc);
-        deskey(kseed, KMAC_type, 16, ks_mac);
-
-        PrintAndLogEx(DEBUG, "ks_enc: %s", sprint_hex_inrow(ks_enc, 16));
-        PrintAndLogEx(DEBUG, "ks_mac: %s", sprint_hex_inrow(ks_mac, 16));
-
-        memcpy(ssc, rnd_ic + 4, 4);
-        memcpy(ssc + 4, rnd_ifd + 4, 4);
-
-        PrintAndLogEx(DEBUG, "ssc: %s", sprint_hex_inrow(ssc, 8));
     }
 
     // Select EF_COM

From 5f8612cf92c70219599990d2d57c4be49452d4fd Mon Sep 17 00:00:00 2001
From: Christian Molson <christian@cmolabs.org>
Date: Mon, 14 Dec 2020 14:30:43 -0500
Subject: [PATCH 063/682] em4x70: Improve client print out of tag information

---
 client/src/cmdlfem4x70.c | 56 ++++++++++++++++++++++++++++++++--------
 1 file changed, 45 insertions(+), 11 deletions(-)

diff --git a/client/src/cmdlfem4x70.c b/client/src/cmdlfem4x70.c
index a13d29073..05d8d52b4 100644
--- a/client/src/cmdlfem4x70.c
+++ b/client/src/cmdlfem4x70.c
@@ -16,28 +16,62 @@
 #include "commonutil.h"
 #include "em4x70.h"
 
+#define LOCKBIT_0 BITMASK(6)
+#define LOCKBIT_1 BITMASK(7)
+
 #define BYTES2UINT16(x) ((x[1] << 8) | (x[0]))
 #define BYTES2UINT32(x) ((x[3] << 24) | (x[2] << 16) | (x[1] << 8) | (x[0]))
 
+#define INDEX_TO_BLOCK(x) (((32-x)/2)-1)
 
 static int CmdHelp(const char *Cmd);
 
-static void print_info_result(uint8_t *data) {
+static void print_info_result(const uint8_t *data) {
 
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "--- " _CYAN_("Tag Information") " ---------------------------");
-    PrintAndLogEx(INFO, "-------------------------------------------------------------");
+    PrintAndLogEx(INFO, "-----------------------------------------------");
 
-    // data section
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(INFO, _YELLOW_("EM4x70 data:"));
+    PrintAndLogEx(INFO, "Block |   data   | info");
+    PrintAndLogEx(INFO, "------+----------+-----------------------------");
 
-    for (int i = 1; i <= 32; i += 2) {
-        PrintAndLogEx(NORMAL, "%02X %02X", data[32 - i], data[32 - i - 1]);
+    // Print out each section as memory map in datasheet
+
+    // Start with UM2
+    for (int i = 0; i < 8; i += 2) {
+        PrintAndLogEx(INFO, " %2d   |   %02X %02X  |  UM2", INDEX_TO_BLOCK(i), data[31 - i], data[31 - i - 1]);
     }
-    PrintAndLogEx(NORMAL, "Tag ID: %02X %02X %02X %02X", data[7], data[6], data[5], data[4]);
-    PrintAndLogEx(NORMAL, "Lockbit 0: %d %s", (data[3] & 0x40) ? 1 : 0, (data[3] & 0x40) ? "LOCKED" : "UNLOCKED");
-    PrintAndLogEx(NORMAL, "Lockbit 1: %d", (data[3] & 0x80) ? 1 : 0);
+    PrintAndLogEx(INFO, "------+----------+-----------------------------");
+
+    // Print PIN  (will never have data)
+    for (int i = 8; i < 12; i += 2) {
+        PrintAndLogEx(INFO, " %2d   |   -- --  |  PIN write only", INDEX_TO_BLOCK(i));
+    }
+    PrintAndLogEx(INFO, "------+----------+-----------------------------");
+
+    // Print Crypt Key (will never have data)
+    for (int i = 12; i < 24; i += 2) {
+        PrintAndLogEx(INFO, " %2d   |   -- --  |  KEY write-only", INDEX_TO_BLOCK(i));
+    }
+    PrintAndLogEx(INFO, "------+----------+-----------------------------");
+
+    // Print ID
+    for (int i = 24; i < 28; i += 2) {
+        PrintAndLogEx(INFO, " %2d   |   %02X %02X  |  ID", INDEX_TO_BLOCK(i), data[31 - i], data[31 - i - 1]);
+    }
+    PrintAndLogEx(INFO, "------+----------+-----------------------------");
+
+    // Print UM1
+    for (int i = 28; i < 32; i += 2) {
+        PrintAndLogEx(INFO, " %2d   |   %02X %02X  |  UM1", INDEX_TO_BLOCK(i), data[31 - i], data[31 - i - 1]);
+    }
+    PrintAndLogEx(INFO, "------+----------+-----------------------------");
+
+    PrintAndLogEx(INFO, "");
+    PrintAndLogEx(INFO, "Tag ID:    %02X %02X %02X %02X", data[7], data[6], data[5], data[4]);
+    PrintAndLogEx(INFO, "Lockbit 0: %d", (data[3] & LOCKBIT_0) ? 1 : 0);
+    PrintAndLogEx(INFO, "Lockbit 1: %d", (data[3] & LOCKBIT_1) ? 1 : 0);
+    PrintAndLogEx(INFO, "Tag is %s.", (data[3] & LOCKBIT_0) ? _RED_("LOCKED") : _GREEN_("UNLOCKED"));
     PrintAndLogEx(NORMAL, "");
 
 }
@@ -53,7 +87,7 @@ int em4x70_info(void) {
 
     PacketResponseNG resp;
     if (!WaitForResponseTimeout(CMD_LF_EM4X70_INFO, &resp, TIMEOUT)) {
-        PrintAndLogEx(WARNING, "(em4x70) timeout while waiting for reply.");
+        PrintAndLogEx(WARNING, "(em4x70) Timeout while waiting for reply.");
         return PM3_ETIMEOUT;
     }
 

From 006e5d2be036c3e2b81428c913a87d0ee649a574 Mon Sep 17 00:00:00 2001
From: ikarus <ikarus4ever@web.de>
Date: Mon, 14 Dec 2020 21:48:02 +0100
Subject: [PATCH 064/682] APDU finder: Reset the tag every x seconds (default
 is 5 minutes).

---
 client/src/cmdhf14a.c | 47 ++++++++++++++++++++++++++-----------------
 1 file changed, 28 insertions(+), 19 deletions(-)

diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index 0f020b54a..71ca030ef 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -2129,6 +2129,12 @@ static uint16_t get_sw(uint8_t *d, uint8_t n) {
 }
 
 static int CmdHf14AFindapdu(const char *Cmd) {
+    // TODO: What response values should be considerd "valid" or "instersting" (worth dispalying)?
+    // TODO: Option to select AID/File (and skip INS 0xA4).
+    // TODO: Validate the decoding of the APDU (not specific to this command, check
+    //       https://cardwerk.com/smartcards/smartcard_standard_ISO7816-4_5_basic_organizations.aspx#chap5_3_2).
+    // TODO: Check all cases (APDUs) with no data bytes (no/short/extended length).
+    // TODO: Option to blacklist instructions (or whole APDUs).
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf 14a apdufind",
                   "Enumerate APDU's of ISO7816 protocol to find valid CLS/INS/P1P2 commands.\n"
@@ -2141,11 +2147,12 @@ static int CmdHf14AFindapdu(const char *Cmd) {
 
     void *argtable[] = {
         arg_param_begin,
-        arg_str0("c", "cla", "<hex>", "start CLASS value (1 hex byte)"),
-        arg_str0("i", "ins", "<hex>", "start INSTRUCTION value (1 hex byte)"),
-        arg_str0(NULL, "p1", "<hex>", "start P1 value (1 hex byte)"),
-        arg_str0(NULL, "p2", "<hex>", "start P2 value (1 hex byte)"),
-        arg_lit0("v", "verbose", "verbose output"),
+        arg_str0("c",  "cla",    "<hex>",    "Start value of CLASS (1 hex byte)"),
+        arg_str0("i",  "ins",    "<hex>",    "Start value of INSTRUCTION (1 hex byte)"),
+        arg_str0(NULL, "p1",     "<hex>",    "Start value of P1 (1 hex byte)"),
+        arg_str0(NULL, "p2",     "<hex>",    "Start value of P2 (1 hex byte)"),
+        arg_u64_0("r", "reset",  "<number>", "Minimum secondes before resetting the tag (to prevent timeout issues). Default is 5 minutes"),
+        arg_lit0("v",  "verbose",            "Verbose output"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
@@ -2153,20 +2160,18 @@ static int CmdHf14AFindapdu(const char *Cmd) {
     int cla_len = 0;
     uint8_t cla_arg[1] = {0};
     CLIGetHexWithReturn(ctx, 1, cla_arg, &cla_len);
-
     int ins_len = 0;
     uint8_t ins_arg[1] = {0};
     CLIGetHexWithReturn(ctx, 2, ins_arg, &ins_len);
-
     int p1_len = 0;
     uint8_t p1_arg[1] = {0};
     CLIGetHexWithReturn(ctx, 3, p1_arg, &p1_len);
-
     int p2_len = 0;
     uint8_t p2_arg[1] = {0};
     CLIGetHexWithReturn(ctx, 4, p2_arg, &p2_len);
+    uint64_t reset_time = arg_get_u64_def(ctx, 5, 5 * 60); // Reset every 5 minutes.
+    bool verbose = arg_get_lit(ctx, 6);
 
-    bool verbose = arg_get_lit(ctx, 5);
     CLIParserFree(ctx);
 
     bool activate_field = true;
@@ -2180,21 +2185,20 @@ static int CmdHf14AFindapdu(const char *Cmd) {
     uint8_t aSELECT_AID[80];
     int aSELECT_AID_n = 0;
 
-    // Check if the tag reponde to APDUs.
+    // Check if the tag reponds to APDUs.
     PrintAndLogEx(INFO, "Sending a test APDU (select file command) to check if the tag is responding to APDU");
     param_gethex_to_eol("00a404000aa000000440000101000100", 0, aSELECT_AID, sizeof(aSELECT_AID), &aSELECT_AID_n);
-    int res = ExchangeAPDU14a(aSELECT_AID, aSELECT_AID_n, activate_field, keep_field_on, response, sizeof(response), &response_n);
+    int res = ExchangeAPDU14a(aSELECT_AID, aSELECT_AID_n, true, false, response, sizeof(response), &response_n);
     if (res) {
-        DropField();
         PrintAndLogEx(FAILED, "Tag did not responde to a test APDU (select file command). Aborting");
         return res;
     }
     PrintAndLogEx(SUCCESS, "Got response. Starting the APDU finder [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
     PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
 
-    activate_field = false;
     bool inc_p1 = true;
-    uint64_t t1 = msclock();
+    uint64_t t_start = msclock();
+    uint64_t t_last_select = msclock();
 
     // Enumerate APDUs.
     do {
@@ -2224,7 +2228,7 @@ static int CmdHf14AFindapdu(const char *Cmd) {
                 uint16_t sw = get_sw(response, response_n);
                 bool command_with_le = false;
                 if (sw == 0x6700) {
-                    PrintAndLogEx(INFO, "Got response for APDU: %02X%02X%02X%02X (%04X - %s)", cla, ins, p1, p2,
+                    PrintAndLogEx(INFO, "Got response for APDU \"%02X%02X%02X%02X\": %04X (%s)", cla, ins, p1, p2,
                                   sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
                     PrintAndLogEx(INFO, "Resending current command with Le = 0x0100 (extended length APDU)");
                     uint8_t command2[7] = {cla, ins, p1, p2, 0x00};
@@ -2237,17 +2241,16 @@ static int CmdHf14AFindapdu(const char *Cmd) {
                 }
 
                 // Check response.
-                // TODO: What response values should be considerd "valid" or "instersting"?
                 sw = get_sw(response, response_n);
                 if (sw != 0x6a86 &&
                         sw != 0x6986 &&
                         sw != 0x6d00
                    ) {
                     if (command_with_le) {
-                        PrintAndLogEx(INFO, "Got response for APDU: %02X%02X%02X%02X00 (%04X - %s)", cla, ins, p1, p2,
+                        PrintAndLogEx(INFO, "Got response for APDU \"%02X%02X%02X%02X00\": %04X (%s)", cla, ins, p1, p2,
                                       sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
                     } else {
-                        PrintAndLogEx(INFO, "Got response for APDU: %02X%02X%02X%02X (%04X - %s)", cla, ins, p1, p2,
+                        PrintAndLogEx(INFO, "Got response for APDU \"%02X%02X%02X%02X\": %04X (%s)", cla, ins, p1, p2,
                                       sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
                     }
                     // Show response data.
@@ -2264,6 +2267,12 @@ static int CmdHf14AFindapdu(const char *Cmd) {
                 p2++;
             }
             inc_p1 = !inc_p1;
+            // Check if re-selecting the card is needed.
+            if (((msclock() - t_last_select) / 1000) >  reset_time) {
+                DropField();
+                t_last_select = msclock();
+                PrintAndLogEx(INFO, "Reseting the tag to prevent timeout issues");
+            }
             PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
         } while (p1 != p1_arg[0] || p2 != p2_arg[0]);
         cla++;
@@ -2271,7 +2280,7 @@ static int CmdHf14AFindapdu(const char *Cmd) {
     } while (cla != cla_arg[0]);
 
 out:
-    PrintAndLogEx(SUCCESS, "Runtime: %" PRIu64 " seconds\n", (msclock() - t1) / 1000);
+    PrintAndLogEx(SUCCESS, "Runtime: %" PRIu64 " seconds\n", (msclock() - t_start) / 1000);
     DropField();
     return PM3_SUCCESS;
 }

From 334000d44412f022854043002c485feaedf693d6 Mon Sep 17 00:00:00 2001
From: Christian Molson <christian@cmolabs.org>
Date: Mon, 14 Dec 2020 16:17:29 -0500
Subject: [PATCH 065/682] em4x70: Used fixed threshold for high/low. Since we
 measure only pulse lengths (high+low) we just need to make sure the value is
 higher than noise threshold

---
 armsrc/em4x70.c | 71 +++++++++++--------------------------------------
 1 file changed, 15 insertions(+), 56 deletions(-)

diff --git a/armsrc/em4x70.c b/armsrc/em4x70.c
index 0bb18e7d2..697412f87 100644
--- a/armsrc/em4x70.c
+++ b/armsrc/em4x70.c
@@ -55,15 +55,18 @@ static bool command_parity = true;
 #define EM4X70_COMMAND_WRITE                0x05
 #define EM4X70_COMMAND_UM2                  0x07
 
-static uint8_t gHigh = 0;
-static uint8_t gLow  = 0;
+// Constants used to determing high/low state of signal
+#define EM4X70_NOISE_THRESHOLD  13  // May depend on noise in environment
+#define HIGH_SIGNAL_THRESHOLD  (127 + EM4X70_NOISE_THRESHOLD)
+#define LOW_SIGNAL_THRESHOLD   (127 - EM4X70_NOISE_THRESHOLD)
 
-#define IS_HIGH(sample) (sample>gLow ? true : false)
-#define IS_LOW(sample) (sample<gHigh ? true : false)
+#define IS_HIGH(sample) (sample > LOW_SIGNAL_THRESHOLD ? true : false)
+#define IS_LOW(sample) (sample < HIGH_SIGNAL_THRESHOLD ? true : false)
+
+// Timing related macros
 #define IS_TIMEOUT(timeout_ticks) (GetTicks() > timeout_ticks)
 #define TICKS_ELAPSED(start_ticks) (GetTicks() - start_ticks)
 
-
 static uint8_t bits2byte(const uint8_t *bits, int length);
 static void bits2bytes(const uint8_t *bits, int length, uint8_t *out);
 static int em4x70_receive(uint8_t *bits);
@@ -106,64 +109,20 @@ static void EM4170_setup_read(void) {
 
 static bool get_signalproperties(void) {
 
-    // calculate signal properties (mean amplitudes) from measured data:
-    // 32 amplitudes (maximum values) -> mean amplitude value -> gHigh -> gLow
-    bool signal_found = false;
-    int no_periods = 32, pct = 50, noise = 140; // pct originally 75, found 50 was working better for me
-    uint8_t sample_ref = 127;
-    uint8_t sample_max_mean = 0;
-    uint8_t sample_max[no_periods];
-    uint32_t sample_max_sum = 0;
-
-    memset(sample_max, 0x00, sizeof(sample_max));
+    // Simple check to ensure we see a signal above the noise threshold
+    uint32_t no_periods = 32;
 
     // wait until signal/noise > 1 (max. 32 periods)
-    for (int i = 0; i < TICKS_PER_FC * EM4X70_T_TAG_FULL_PERIOD * no_periods; i++) {
+    for (int i = 0; i < EM4X70_T_TAG_FULL_PERIOD * no_periods; i++) {
 
         // about 2 samples per bit period
-        WaitTicks(TICKS_PER_FC * EM4X70_T_TAG_HALF_PERIOD);
+        WaitTicks(EM4X70_T_TAG_HALF_PERIOD);
 
-        if (AT91C_BASE_SSC->SSC_RHR > noise) {
-            signal_found = true;
-            break;
+        if (AT91C_BASE_SSC->SSC_RHR > HIGH_SIGNAL_THRESHOLD) {
+            return true;
         }
-
     }
-
-    if (signal_found == false)
-        return false;
-
-    // calculate mean maximum value of 32 periods, each period has a length of
-    // 3 single "full periods" to eliminate the influence of a listen window
-    for (int i = 0; i < no_periods; i++) {
-
-        uint32_t start_ticks = GetTicks();
-        //AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
-        while (TICKS_ELAPSED(start_ticks) < TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD) {
-
-            volatile uint8_t sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-
-            if (sample > sample_max[i])
-                sample_max[i] = sample;
-
-        }
-
-        sample_max_sum += sample_max[i];
-    }
-
-    sample_max_mean = sample_max_sum / no_periods;
-
-    // set global envelope variables
-    gHigh = sample_ref + pct * (sample_max_mean - sample_ref) / 100;
-    gLow  = sample_ref - pct * (sample_max_mean - sample_ref) / 100;
-
-    // Basic sanity check
-    if (gHigh - gLow < EM4X70_MIN_AMPLITUDE) {
-        return false;
-    }
-
-    Dbprintf("%s: gHigh %d gLow: %d", __func__, gHigh, gLow);
-    return true;
+    return false;
 }
 
 /**

From b9b92c6bc3d0975bfd3c3d952a1e858096788dfe Mon Sep 17 00:00:00 2001
From: ikarus <ikarus4ever@web.de>
Date: Mon, 14 Dec 2020 23:27:47 +0100
Subject: [PATCH 066/682] APDU finder: Prevent reactivating the field
 (speedup).

---
 client/src/cmdhf14a.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index 71ca030ef..d9ff4c3b7 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -2198,7 +2198,7 @@ static int CmdHf14AFindapdu(const char *Cmd) {
 
     bool inc_p1 = true;
     uint64_t t_start = msclock();
-    uint64_t t_last_select = msclock();
+    uint64_t t_last_reset = msclock();
 
     // Enumerate APDUs.
     do {
@@ -2259,6 +2259,7 @@ static int CmdHf14AFindapdu(const char *Cmd) {
                                       sprint_ascii(response, response_n - 2));
                     }
                 }
+                activate_field = false; // Do not reativate the filed until the next reset.
             } while (++ins != ins_arg[0]);
             // Increment P1/P2 in an alternating fashion.
             if (inc_p1) {
@@ -2268,10 +2269,12 @@ static int CmdHf14AFindapdu(const char *Cmd) {
             }
             inc_p1 = !inc_p1;
             // Check if re-selecting the card is needed.
-            if (((msclock() - t_last_select) / 1000) >  reset_time) {
+            uint64_t t_since_last_reset = ((msclock() - t_last_reset) / 1000);
+            if (t_since_last_reset > reset_time) {
                 DropField();
-                t_last_select = msclock();
-                PrintAndLogEx(INFO, "Reseting the tag to prevent timeout issues");
+                activate_field = true;
+                t_last_reset = msclock();
+                PrintAndLogEx(INFO, "Last reset was %" PRIu64 " seconds ago. Reseting the tag to prevent timeout issues", t_since_last_reset);
             }
             PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
         } while (p1 != p1_arg[0] || p2 != p2_arg[0]);

From d76bdd250b5b782897cf29cf3e01c9db9087b770 Mon Sep 17 00:00:00 2001
From: ikarus <ikarus4ever@web.de>
Date: Mon, 14 Dec 2020 23:32:19 +0100
Subject: [PATCH 067/682] Fixed changelog.

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f613c4c70..a4898db8b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
  - Added `hf iclass encode` - encode a wiegand binary to a encrypted credential (@iceman1001)
  - Changed `recoverpk.py` - now tests more ECDSA curves (@doegox)
  - Added `hf 14a apdufuzz`- a naive apdu cla/ins/p1p2/len fuzzer (@iceman1001)
+ - Improved `hf 14a apdufuzz/apdufind` to find hidden APDUs (@ikarus23)
  - Fix mixed up INC/DEC in MIFARE protocol defs (@vortixdev)
  - Added `lf em 4x70 info` - new support for ID48 transponders (@cmolson)
  - Fix multiple coverity scan issues (@iceman1001)
@@ -116,7 +117,6 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
  - Change, use system Whereami library if available (@doegox)
  - Change, use system Zlib library if available (@doegox)
  - Fix release version information (@doegox)
- - Add `hf 14a apdufind` to find hidden APDUs (@iceman1001 & @ikarus23)
 
 ## [ice coffee.4.9237][2020-05-21]
  - Updated documentation (@doegox, @iceman1001)

From 4969a0bca304142557b7acc059ffd962acd81d0e Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 15 Dec 2020 02:19:42 +0300
Subject: [PATCH 068/682] emrtd: Fix a crash

---
 client/src/cmdhfemrtd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index d08a789f9..bc0f13f3e 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -392,7 +392,7 @@ static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, const
     _convert_filename(file, file_id);
 
     uint8_t iv[8] = { 0x00 };
-    char command[54];
+    char command[PM3_CMD_DATA_SIZE];
     uint8_t cmd[8];
     uint8_t data[21];
     uint8_t temp[8] = {0x0c, 0xa4, strtol(select_by, NULL, 16), 0x0c};

From fbfe1d051c1998d0ac95af031775349467d2fff0 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 15 Dec 2020 02:55:23 +0300
Subject: [PATCH 069/682] emrtd: loads of renames

---
 client/src/cmdhfemrtd.c | 249 ++++++++++++++++++++--------------------
 1 file changed, 124 insertions(+), 125 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index bc0f13f3e..ea90fa433 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -32,40 +32,40 @@
 // Average EF_DG2 seems to be around 20-25kB or so, but ICAO doesn't set an upper limit
 // Iris data seems to be suggested to be around 35kB per eye (Presumably bumping up the file size to around 70kB)
 // but as we cannot read that until we implement PACE, 35k seems to be a safe point.
-#define MAX_FILE_SIZE 35000
+#define EMRTD_MAX_FILE_SIZE 35000
 
 // ISO7816 commands
-#define SELECT "A4"
-#define EXTERNAL_AUTHENTICATE "82"
-#define GET_CHALLENGE "84"
-#define READ_BINARY "B0"
-#define P1_SELECT_BY_EF "02"
-#define P1_SELECT_BY_NAME "04"
-#define P2_PROPRIETARY "0C"
+#define EMRTD_SELECT "A4"
+#define EMRTD_EXTERNAL_AUTHENTICATE "82"
+#define EMRTD_GET_CHALLENGE "84"
+#define EMRTD_READ_BINARY "B0"
+#define EMRTD_P1_SELECT_BY_EF "02"
+#define EMRTD_P1_SELECT_BY_NAME "04"
+#define EMRTD_P2_PROPRIETARY "0C"
 
 // File IDs
-#define EF_CARDACCESS "011C"
-#define EF_COM "011E"
-#define EF_DG1 "0101"
-#define EF_DG2 "0102"
-#define EF_DG3 "0103"
-#define EF_DG4 "0104"
-#define EF_DG5 "0105"
-#define EF_DG6 "0106"
-#define EF_DG7 "0107"
-#define EF_DG8 "0108"
-#define EF_DG9 "0109"
-#define EF_DG10 "010A"
-#define EF_DG11 "010B"
-#define EF_DG12 "010C"
-#define EF_DG13 "010D"
-#define EF_DG14 "010E"
-#define EF_DG15 "010F"
-#define EF_DG16 "0110"
-#define EF_SOD "011D"
+#define EMRTD_EF_CARDACCESS "011C"
+#define EMRTD_EF_COM "011E"
+#define EMRTD_EF_DG1 "0101"
+#define EMRTD_EF_DG2 "0102"
+#define EMRTD_EF_DG3 "0103"
+#define EMRTD_EF_DG4 "0104"
+#define EMRTD_EF_DG5 "0105"
+#define EMRTD_EF_DG6 "0106"
+#define EMRTD_EF_DG7 "0107"
+#define EMRTD_EF_DG8 "0108"
+#define EMRTD_EF_DG9 "0109"
+#define EMRTD_EF_DG10 "010A"
+#define EMRTD_EF_DG11 "010B"
+#define EMRTD_EF_DG12 "010C"
+#define EMRTD_EF_DG13 "010D"
+#define EMRTD_EF_DG14 "010E"
+#define EMRTD_EF_DG15 "010F"
+#define EMRTD_EF_DG16 "0110"
+#define EMRTD_EF_SOD "011D"
 
 // App IDs
-#define AID_MRTD "A0000002471001"
+#define EMRTD_AID_MRTD "A0000002471001"
 
 // DESKey Types
 const uint8_t KENC_type[4] = {0x00, 0x00, 0x00, 0x01};
@@ -81,7 +81,7 @@ static uint16_t get_sw(uint8_t *d, uint8_t n) {
     return d[n] * 0x0100 + d[n + 1];
 }
 
-static bool exchange_commands(const char *cmd, uint8_t *dataout, int *dataoutlen, bool activate_field, bool keep_field_on, bool use_14b) {
+static bool emrtd_exchange_commands(const char *cmd, uint8_t *dataout, int *dataoutlen, bool activate_field, bool keep_field_on, bool use_14b) {
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
 
@@ -118,14 +118,14 @@ static bool exchange_commands(const char *cmd, uint8_t *dataout, int *dataoutlen
     return true;
 }
 
-static int exchange_commands_noout(const char *cmd, bool activate_field, bool keep_field_on, bool use_14b) {
+static int emrtd_exchange_commands_noout(const char *cmd, bool activate_field, bool keep_field_on, bool use_14b) {
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
 
-    return exchange_commands(cmd, response, &resplen, activate_field, keep_field_on, use_14b);
+    return emrtd_exchange_commands(cmd, response, &resplen, activate_field, keep_field_on, use_14b);
 }
 
-static char calculate_check_digit(char *data) {
+static char emrtd_calculate_check_digit(char *data) {
     int mrz_weight[] = {7, 3, 1};
     int cd = 0;
     int value = 0;
@@ -147,7 +147,7 @@ static char calculate_check_digit(char *data) {
     return cd % 10;
 }
 
-static int asn1datalength(uint8_t *datain, int datainlen, int offset) {
+static int emrtd_get_asn1_data_length(uint8_t *datain, int datainlen, int offset) {
     PrintAndLogEx(DEBUG, "asn1datalength, datain: %s", sprint_hex_inrow(datain, datainlen));
     int lenfield = (int) * (datain + offset);
     PrintAndLogEx(DEBUG, "asn1datalength, lenfield: %i", lenfield);
@@ -163,7 +163,7 @@ static int asn1datalength(uint8_t *datain, int datainlen, int offset) {
     return false;
 }
 
-static int asn1fieldlength(uint8_t *datain, int datainlen, int offset) {
+static int emrtd_get_asn1_field_length(uint8_t *datain, int datainlen, int offset) {
     PrintAndLogEx(DEBUG, "asn1fieldlength, datain: %s", sprint_hex_inrow(datain, datainlen));
     int lenfield = (int) * (datain + offset);
     PrintAndLogEx(DEBUG, "asn1fieldlength, thing: %i", lenfield);
@@ -273,7 +273,7 @@ static void retail_mac(uint8_t *key, uint8_t *input, int inputlen, uint8_t *outp
     memcpy(output, intermediate_des, 8);
 }
 
-static void deskey(uint8_t *seed, const uint8_t *type, int length, uint8_t *dataout) {
+static void emrtd_deskey(uint8_t *seed, const uint8_t *type, int length, uint8_t *dataout) {
     PrintAndLogEx(DEBUG, "seed: %s", sprint_hex_inrow(seed, 16));
 
     // combine seed and type
@@ -296,38 +296,38 @@ static void deskey(uint8_t *seed, const uint8_t *type, int length, uint8_t *data
     memcpy(dataout, &key, length);
 }
 
-static int select_file(const char *select_by, const char *file_id, bool use_14b) {
+static int emrtd_select_file(const char *select_by, const char *file_id, bool use_14b) {
     int file_id_len = strlen(file_id) / 2;
 
     char cmd[50];
-    sprintf(cmd, "00%s%s0C%02X%s", SELECT, select_by, file_id_len, file_id);
+    sprintf(cmd, "00%s%s0C%02X%s", EMRTD_SELECT, select_by, file_id_len, file_id);
 
-    return exchange_commands_noout(cmd, false, true, use_14b);
+    return emrtd_exchange_commands_noout(cmd, false, true, use_14b);
 }
 
-static int get_challenge(int length, uint8_t *dataout, int *dataoutlen, bool use_14b) {
+static int emrtd_get_challenge(int length, uint8_t *dataout, int *dataoutlen, bool use_14b) {
     char cmd[50];
-    sprintf(cmd, "00%s0000%02X", GET_CHALLENGE, length);
+    sprintf(cmd, "00%s0000%02X", EMRTD_GET_CHALLENGE, length);
 
-    return exchange_commands(cmd, dataout, dataoutlen, false, true, use_14b);
+    return emrtd_exchange_commands(cmd, dataout, dataoutlen, false, true, use_14b);
 }
 
-static int external_authenticate(uint8_t *data, int length, uint8_t *dataout, int *dataoutlen, bool use_14b) {
+static int emrtd_external_authenticate(uint8_t *data, int length, uint8_t *dataout, int *dataoutlen, bool use_14b) {
     char cmd[100];
 
-    sprintf(cmd, "00%s0000%02X%s%02X", EXTERNAL_AUTHENTICATE, length, sprint_hex_inrow(data, length), length);
+    sprintf(cmd, "00%s0000%02X%s%02X", EMRTD_EXTERNAL_AUTHENTICATE, length, sprint_hex_inrow(data, length), length);
 
-    return exchange_commands(cmd, dataout, dataoutlen, false, true, use_14b);
+    return emrtd_exchange_commands(cmd, dataout, dataoutlen, false, true, use_14b);
 }
 
-static int _read_binary(int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen, bool use_14b) {
+static int _emrtd_read_binary(int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen, bool use_14b) {
     char cmd[50];
-    sprintf(cmd, "00%s%04i%02i", READ_BINARY, offset, bytes_to_read);
+    sprintf(cmd, "00%s%04i%02i", EMRTD_READ_BINARY, offset, bytes_to_read);
 
-    return exchange_commands(cmd, dataout, dataoutlen, false, true, use_14b);
+    return emrtd_exchange_commands(cmd, dataout, dataoutlen, false, true, use_14b);
 }
 
-static void bump_ssc(uint8_t *ssc) {
+static void emrtd_bump_ssc(uint8_t *ssc) {
     PrintAndLogEx(DEBUG, "ssc-b: %s", sprint_hex_inrow(ssc, 8));
     for (int i = 7; i > 0; i--) {
         if ((*(ssc + i)) == 0xFF) {
@@ -341,12 +341,12 @@ static void bump_ssc(uint8_t *ssc) {
     }
 }
 
-static bool check_cc(uint8_t *ssc, uint8_t *key, uint8_t *rapdu, int rapdulength) {
+static bool emrtd_check_cc(uint8_t *ssc, uint8_t *key, uint8_t *rapdu, int rapdulength) {
     // https://elixi.re/i/clarkson.png
     uint8_t k[500];
     uint8_t cc[500];
 
-    bump_ssc(ssc);
+    emrtd_bump_ssc(ssc);
 
     memcpy(k, ssc, 8);
     int length = 0;
@@ -375,7 +375,7 @@ static bool check_cc(uint8_t *ssc, uint8_t *key, uint8_t *rapdu, int rapdulength
     return memcmp(cc, rapdu + (rapdulength - 8), 8) == 0;
 }
 
-static void _convert_filename(const char *file, uint8_t *dataout) {
+static void _emrtd_convert_filename(const char *file, uint8_t *dataout) {
     char temp[3] = {0x00};
     memcpy(temp, file, 2);
     dataout[0] = (int)strtol(temp, NULL, 16);
@@ -383,13 +383,13 @@ static void _convert_filename(const char *file, uint8_t *dataout) {
     dataout[1] = (int)strtol(temp, NULL, 16);
 }
 
-static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, const char *select_by, const char *file, bool use_14b) {
+static bool emrtd_secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, const char *select_by, const char *file, bool use_14b) {
     uint8_t response[PM3_CMD_DATA_SIZE];
     int resplen = 0;
 
     // convert filename of string to bytes
     uint8_t file_id[2];
-    _convert_filename(file, file_id);
+    _emrtd_convert_filename(file, file_id);
 
     uint8_t iv[8] = { 0x00 };
     char command[PM3_CMD_DATA_SIZE];
@@ -413,7 +413,7 @@ static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, const
     memcpy(m + cmdlen, do87, (datalen + 3));
     PrintAndLogEx(DEBUG, "m: %s", sprint_hex_inrow(m, datalen + cmdlen + 3));
 
-    bump_ssc(ssc);
+    emrtd_bump_ssc(ssc);
 
     uint8_t n[27];
     memcpy(n, ssc, 8);
@@ -435,17 +435,17 @@ static bool secure_select_file(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, const
     memcpy(data + (datalen + 3), do8e, 10);
     PrintAndLogEx(DEBUG, "data: %s", sprint_hex_inrow(data, lc));
 
-    sprintf(command, "0C%s%s0C%02X%s00", SELECT, select_by, lc, sprint_hex_inrow(data, lc));
+    sprintf(command, "0C%s%s0C%02X%s00", EMRTD_SELECT, select_by, lc, sprint_hex_inrow(data, lc));
     PrintAndLogEx(DEBUG, "command: %s", command);
 
-    if (exchange_commands(command, response, &resplen, false, true, use_14b) == false) {
+    if (emrtd_exchange_commands(command, response, &resplen, false, true, use_14b) == false) {
         return false;
     }
 
-    return check_cc(ssc, kmac, response, resplen);
+    return emrtd_check_cc(ssc, kmac, response, resplen);
 }
 
-static bool _secure_read_binary(uint8_t *kmac, uint8_t *ssc, int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen, bool use_14b) {
+static bool _emrtd_secure_read_binary(uint8_t *kmac, uint8_t *ssc, int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen, bool use_14b) {
     char command[54];
     uint8_t cmd[8];
     uint8_t data[21];
@@ -466,7 +466,7 @@ static bool _secure_read_binary(uint8_t *kmac, uint8_t *ssc, int offset, int byt
     memcpy(m, cmd, 8);
     memcpy(m + 8, do97, 3);
 
-    bump_ssc(ssc);
+    emrtd_bump_ssc(ssc);
 
     uint8_t n[19];
     memcpy(n, ssc, 8);
@@ -488,23 +488,23 @@ static bool _secure_read_binary(uint8_t *kmac, uint8_t *ssc, int offset, int byt
     memcpy(data + 3, do8e, 10);
     PrintAndLogEx(DEBUG, "data: %s", sprint_hex_inrow(data, lc));
 
-    sprintf(command, "0C%s%04X%02X%s00", READ_BINARY, offset, lc, sprint_hex_inrow(data, lc));
+    sprintf(command, "0C%s%04X%02X%s00", EMRTD_READ_BINARY, offset, lc, sprint_hex_inrow(data, lc));
     PrintAndLogEx(DEBUG, "command: %s", command);
 
-    if (exchange_commands(command, dataout, dataoutlen, false, true, use_14b) == false) {
+    if (emrtd_exchange_commands(command, dataout, dataoutlen, false, true, use_14b) == false) {
         return false;
     }
 
-    return check_cc(ssc, kmac, dataout, *dataoutlen);
+    return emrtd_check_cc(ssc, kmac, dataout, *dataoutlen);
 }
 
-static bool _secure_read_binary_decrypt(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen, bool use_14b) {
+static bool _emrtd_secure_read_binary_decrypt(uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen, bool use_14b) {
     uint8_t response[500];
     uint8_t temp[500];
     int resplen, cutat = 0;
     uint8_t iv[8] = { 0x00 };
 
-    if (_secure_read_binary(kmac, ssc, offset, bytes_to_read, response, &resplen, use_14b) == false) {
+    if (_emrtd_secure_read_binary(kmac, ssc, offset, bytes_to_read, response, &resplen, use_14b) == false) {
         return false;
     }
 
@@ -521,8 +521,8 @@ static bool _secure_read_binary_decrypt(uint8_t *kenc, uint8_t *kmac, uint8_t *s
 }
 
 
-static int read_file(uint8_t *dataout, int *dataoutlen, uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, bool use_secure, bool use_14b) {
-    uint8_t response[MAX_FILE_SIZE];
+static int emrtd_read_file(uint8_t *dataout, int *dataoutlen, uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, bool use_secure, bool use_14b) {
+    uint8_t response[EMRTD_MAX_FILE_SIZE];
     int resplen = 0;
     uint8_t tempresponse[500];
     int tempresplen = 0;
@@ -530,17 +530,17 @@ static int read_file(uint8_t *dataout, int *dataoutlen, uint8_t *kenc, uint8_t *
     int offset = 0;
 
     if (use_secure == true) {
-        if (_secure_read_binary_decrypt(kenc, kmac, ssc, offset, toread, response, &resplen, use_14b) == false) {
+        if (_emrtd_secure_read_binary_decrypt(kenc, kmac, ssc, offset, toread, response, &resplen, use_14b) == false) {
             return false;
         }
     } else {
-        if (_read_binary(offset, toread, response, &resplen, use_14b) == false) {
+        if (_emrtd_read_binary(offset, toread, response, &resplen, use_14b) == false) {
             return false;
         }
     }
 
-    int datalen = asn1datalength(response, resplen, 1);
-    int readlen = datalen - (3 - asn1fieldlength(response, resplen, 1));
+    int datalen = emrtd_get_asn1_data_length(response, resplen, 1);
+    int readlen = datalen - (3 - emrtd_get_asn1_field_length(response, resplen, 1));
     offset = 4;
 
     while (readlen > 0) {
@@ -550,11 +550,11 @@ static int read_file(uint8_t *dataout, int *dataoutlen, uint8_t *kenc, uint8_t *
         }
 
         if (kenc == NULL) {
-            if (_read_binary(offset, toread, tempresponse, &tempresplen, use_14b) == false) {
+            if (_emrtd_read_binary(offset, toread, tempresponse, &tempresplen, use_14b) == false) {
                 return false;
             }
         } else {
-            if (_secure_read_binary_decrypt(kenc, kmac, ssc, offset, toread, tempresponse, &tempresplen, use_14b) == false) {
+            if (_emrtd_secure_read_binary_decrypt(kenc, kmac, ssc, offset, toread, tempresponse, &tempresplen, use_14b) == false) {
                 return false;
             }
         }
@@ -570,7 +570,7 @@ static int read_file(uint8_t *dataout, int *dataoutlen, uint8_t *kenc, uint8_t *
     return true;
 }
 
-static bool ef_com_get_file_list(uint8_t *datain, int *datainlen, uint8_t *dataout, int *dataoutlen) {
+static bool emrtd_ef_com_get_file_list(uint8_t *datain, int *datainlen, uint8_t *dataout, int *dataoutlen) {
     int offset = 2;
     int elementidlen = 0;
     int elementlen = 0;
@@ -584,7 +584,7 @@ static bool ef_com_get_file_list(uint8_t *datain, int *datainlen, uint8_t *datao
         }
 
         // Get the length of the element
-        elementlen = asn1datalength(datain + offset, *datainlen - offset, elementidlen);
+        elementlen = emrtd_get_asn1_data_length(datain + offset, *datainlen - offset, elementidlen);
 
         // If the element is what we're looking for, get the data and return true
         if (*(datain + offset) == 0x5c) {
@@ -598,82 +598,81 @@ static bool ef_com_get_file_list(uint8_t *datain, int *datainlen, uint8_t *datao
     return false;
 }
 
-static bool file_tag_to_file_id(uint8_t *datain, char *filenameout, char *dataout) {
+static bool emrtd_file_tag_to_file_id(uint8_t *datain, char *filenameout, char *dataout) {
     // imagine bothering with a hashmap or writing good code
     // couldn't be me
     switch (*datain) {
         case 0x60:
-            memcpy(dataout, EF_COM, 4);
+            memcpy(dataout, EMRTD_EF_COM, 4);
             memcpy(filenameout, "EF_COM", 6);
             break;
         case 0x61:
-            memcpy(dataout, EF_DG1, 4);
+            memcpy(dataout, EMRTD_EF_DG1, 4);
             memcpy(filenameout, "EF_DG1", 6);
             break;
         case 0x75:
-            memcpy(dataout, EF_DG2, 4);
+            memcpy(dataout, EMRTD_EF_DG2, 4);
             memcpy(filenameout, "EF_DG2", 6);
             break;
         // These cases are commented out as they require PACE
-        // Trying to read a PACE file without doing PACE auth kills the session
         // case 0x63:
-        //     memcpy(dataout, EF_DG3, 4);
+        //     memcpy(dataout, EMRTD_EF_DG3, 4);
         //     memcpy(filenameout, "EF_DG3", 6);
         //     break;
         // case 0x76:
-        //     memcpy(dataout, EF_DG4, 4);
+        //     memcpy(dataout, EMRTD_EF_DG4, 4);
         //     memcpy(filenameout, "EF_DG4", 6);
         //     break;
         case 0x65:
-            memcpy(dataout, EF_DG5, 4);
+            memcpy(dataout, EMRTD_EF_DG5, 4);
             memcpy(filenameout, "EF_DG5", 6);
             break;
         case 0x66:
-            memcpy(dataout, EF_DG6, 4);
+            memcpy(dataout, EMRTD_EF_DG6, 4);
             memcpy(filenameout, "EF_DG6", 6);
             break;
         case 0x67:
-            memcpy(dataout, EF_DG7, 4);
+            memcpy(dataout, EMRTD_EF_DG7, 4);
             memcpy(filenameout, "EF_DG7", 6);
             break;
         case 0x68:
-            memcpy(dataout, EF_DG8, 4);
+            memcpy(dataout, EMRTD_EF_DG8, 4);
             memcpy(filenameout, "EF_DG8", 6);
             break;
         case 0x69:
-            memcpy(dataout, EF_DG9, 4);
+            memcpy(dataout, EMRTD_EF_DG9, 4);
             memcpy(filenameout, "EF_DG9", 6);
             break;
         case 0x6a:
-            memcpy(dataout, EF_DG10, 4);
+            memcpy(dataout, EMRTD_EF_DG10, 4);
             memcpy(filenameout, "EF_DG10", 7);
             break;
         case 0x6b:
-            memcpy(dataout, EF_DG11, 4);
+            memcpy(dataout, EMRTD_EF_DG11, 4);
             memcpy(filenameout, "EF_DG11", 7);
             break;
         case 0x6c:
-            memcpy(dataout, EF_DG12, 4);
+            memcpy(dataout, EMRTD_EF_DG12, 4);
             memcpy(filenameout, "EF_DG12", 7);
             break;
         case 0x6d:
-            memcpy(dataout, EF_DG13, 4);
+            memcpy(dataout, EMRTD_EF_DG13, 4);
             memcpy(filenameout, "EF_DG13", 7);
             break;
         case 0x6e:
-            memcpy(dataout, EF_DG14, 4);
+            memcpy(dataout, EMRTD_EF_DG14, 4);
             memcpy(filenameout, "EF_DG14", 7);
             break;
         case 0x6f:
-            memcpy(dataout, EF_DG15, 4);
+            memcpy(dataout, EMRTD_EF_DG15, 4);
             memcpy(filenameout, "EF_DG15", 7);
             break;
         case 0x70:
-            memcpy(dataout, EF_DG16, 4);
+            memcpy(dataout, EMRTD_EF_DG16, 4);
             memcpy(filenameout, "EF_DG16", 7);
             break;
         case 0x77:
-            memcpy(dataout, EF_SOD, 4);
+            memcpy(dataout, EMRTD_EF_SOD, 4);
             memcpy(filenameout, "EF_SOD", 6);
             break;
         default:
@@ -682,31 +681,31 @@ static bool file_tag_to_file_id(uint8_t *datain, char *filenameout, char *dataou
     return true;
 }
 
-static bool select_and_read(uint8_t *dataout, int *dataoutlen, const char *file, uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, bool use_secure, bool use_14b) {
+static bool emrtd_select_and_read(uint8_t *dataout, int *dataoutlen, const char *file, uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, bool use_secure, bool use_14b) {
     if (use_secure == true) {
-        if (secure_select_file(ks_enc, ks_mac, ssc, P1_SELECT_BY_EF, file, use_14b) == false) {
+        if (emrtd_secure_select_file(ks_enc, ks_mac, ssc, EMRTD_P1_SELECT_BY_EF, file, use_14b) == false) {
             PrintAndLogEx(ERR, "Failed to secure select %s.", file);
             return false;
         }
     } else {
-        if (select_file(P1_SELECT_BY_EF, file, use_14b) == false) {
+        if (emrtd_select_file(EMRTD_P1_SELECT_BY_EF, file, use_14b) == false) {
             PrintAndLogEx(ERR, "Failed to select %s.", file);
             return false;
         }
     }
 
-    if (read_file(dataout, dataoutlen, ks_enc, ks_mac, ssc, use_secure, use_14b) == false) {
+    if (emrtd_read_file(dataout, dataoutlen, ks_enc, ks_mac, ssc, use_secure, use_14b) == false) {
         PrintAndLogEx(ERR, "Failed to read %s.", file);
         return false;
     }
     return true;
 }
 
-static bool dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, const char *file, const char *name, bool use_secure, bool use_14b) {
-    uint8_t response[MAX_FILE_SIZE];
+static bool emrtd_dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, const char *file, const char *name, bool use_secure, bool use_14b) {
+    uint8_t response[EMRTD_MAX_FILE_SIZE];
     int resplen = 0;
 
-    if (select_and_read(response, &resplen, file, ks_enc, ks_mac, ssc, use_secure, use_14b) == false) {
+    if (emrtd_select_and_read(response, &resplen, file, ks_enc, ks_mac, ssc, use_secure, use_14b) == false) {
         return false;
     }
 
@@ -724,8 +723,8 @@ static void rng(int length, uint8_t *dataout) {
     }
 }
 
-static bool do_bac(char *documentnumber, char *dob, char *expiry, uint8_t *ssc, uint8_t *ks_enc, uint8_t *ks_mac, bool use_14b) {
-    uint8_t response[MAX_FILE_SIZE] = { 0x00 };
+static bool emrtd_do_bac(char *documentnumber, char *dob, char *expiry, uint8_t *ssc, uint8_t *ks_enc, uint8_t *ks_mac, bool use_14b) {
+    uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     int resplen = 0;
 
     uint8_t rnd_ic[8] = { 0x00 };
@@ -742,9 +741,9 @@ static bool do_bac(char *documentnumber, char *dob, char *expiry, uint8_t *ssc,
     PrintAndLogEx(DEBUG, "dob: %s", dob);
     PrintAndLogEx(DEBUG, "exp: %s", expiry);
 
-    char documentnumbercd = calculate_check_digit(documentnumber);
-    char dobcd = calculate_check_digit(dob);
-    char expirycd = calculate_check_digit(expiry);
+    char documentnumbercd = emrtd_calculate_check_digit(documentnumber);
+    char dobcd = emrtd_calculate_check_digit(dob);
+    char expirycd = emrtd_calculate_check_digit(expiry);
 
     char kmrz[25];
     sprintf(kmrz, "%s%i%s%i%s%i", documentnumber, documentnumbercd, dob, dobcd, expiry, expirycd);
@@ -754,13 +753,13 @@ static bool do_bac(char *documentnumber, char *dob, char *expiry, uint8_t *ssc,
     mbedtls_sha1((unsigned char *)kmrz, strlen(kmrz), kseed);
     PrintAndLogEx(DEBUG, "kseed: %s", sprint_hex_inrow(kseed, 16));
 
-    deskey(kseed, KENC_type, 16, kenc);
-    deskey(kseed, KMAC_type, 16, kmac);
+    emrtd_deskey(kseed, KENC_type, 16, kenc);
+    emrtd_deskey(kseed, KMAC_type, 16, kmac);
     PrintAndLogEx(DEBUG, "kenc: %s", sprint_hex_inrow(kenc, 16));
     PrintAndLogEx(DEBUG, "kmac: %s", sprint_hex_inrow(kmac, 16));
 
     // Get Challenge
-    if (get_challenge(8, rnd_ic, &resplen, use_14b) == false) {
+    if (emrtd_get_challenge(8, rnd_ic, &resplen, use_14b) == false) {
         PrintAndLogEx(ERR, "Couldn't get challenge.");
         return false;
     }
@@ -788,7 +787,7 @@ static bool do_bac(char *documentnumber, char *dob, char *expiry, uint8_t *ssc,
     memcpy(cmd_data + 32, m_ifd, 8);
 
     // Do external authentication
-    if (external_authenticate(cmd_data, sizeof(cmd_data), response, &resplen, use_14b) == false) {
+    if (emrtd_external_authenticate(cmd_data, sizeof(cmd_data), response, &resplen, use_14b) == false) {
         PrintAndLogEx(ERR, "Couldn't do external authentication. Did you supply the correct MRZ info?");
         return false;
     }
@@ -812,8 +811,8 @@ static bool do_bac(char *documentnumber, char *dob, char *expiry, uint8_t *ssc,
 
     PrintAndLogEx(DEBUG, "kseed: %s", sprint_hex_inrow(kseed, 16));
 
-    deskey(kseed, KENC_type, 16, ks_enc);
-    deskey(kseed, KMAC_type, 16, ks_mac);
+    emrtd_deskey(kseed, KENC_type, 16, ks_enc);
+    emrtd_deskey(kseed, KMAC_type, 16, ks_mac);
 
     PrintAndLogEx(DEBUG, "ks_enc: %s", sprint_hex_inrow(ks_enc, 16));
     PrintAndLogEx(DEBUG, "ks_mac: %s", sprint_hex_inrow(ks_mac, 16));
@@ -827,7 +826,7 @@ static bool do_bac(char *documentnumber, char *dob, char *expiry, uint8_t *ssc,
 }
 
 int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available) {
-    uint8_t response[MAX_FILE_SIZE] = { 0x00 };
+    uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     int resplen = 0;
     uint8_t ssc[8] = { 0x00 };
     uint8_t ks_enc[16] = { 0x00 };
@@ -863,8 +862,8 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     }
 
     // Select and read EF_CardAccess
-    if (select_file(P1_SELECT_BY_EF, EF_CARDACCESS, use_14b)) {
-        read_file(response, &resplen, NULL, NULL, NULL, false, use_14b);
+    if (emrtd_select_file(EMRTD_P1_SELECT_BY_EF, EMRTD_EF_CARDACCESS, use_14b)) {
+        emrtd_read_file(response, &resplen, NULL, NULL, NULL, false, use_14b);
         PrintAndLogEx(INFO, "Read EF_CardAccess, len: %i.", resplen);
         PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
     } else {
@@ -872,22 +871,22 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     }
 
     // Select MRTD applet
-    if (select_file(P1_SELECT_BY_NAME, AID_MRTD, use_14b) == false) {
+    if (emrtd_select_file(EMRTD_P1_SELECT_BY_NAME, EMRTD_AID_MRTD, use_14b) == false) {
         PrintAndLogEx(ERR, "Couldn't select the MRTD application.");
         DropField();
         return PM3_ESOFT;
     }
 
     // Select EF_COM
-    if (select_file(P1_SELECT_BY_EF, EF_COM, use_14b) == false) {
+    if (emrtd_select_file(EMRTD_P1_SELECT_BY_EF, EMRTD_EF_COM, use_14b) == false) {
         BAC = true;
         PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt external authentication.");
     } else {
         BAC = false;
         // Select EF_DG1
-        select_file(P1_SELECT_BY_EF, EF_DG1, use_14b);
+        emrtd_select_file(EMRTD_P1_SELECT_BY_EF, EMRTD_EF_DG1, use_14b);
 
-        if (read_file(response, &resplen, NULL, NULL, NULL, false, use_14b) == false) {
+        if (emrtd_read_file(response, &resplen, NULL, NULL, NULL, false, use_14b) == false) {
             BAC = true;
             PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt external authentication.");
         } else {
@@ -906,14 +905,14 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
             return PM3_ESOFT;
         }
 
-        if (do_bac(documentnumber, dob, expiry, ssc, ks_enc, ks_mac, use_14b) == false) {
+        if (emrtd_do_bac(documentnumber, dob, expiry, ssc, ks_enc, ks_mac, use_14b) == false) {
             DropField();
             return PM3_ESOFT;
         }
     }
 
     // Select EF_COM
-    if (select_and_read(response, &resplen, EF_COM, ks_enc, ks_mac, ssc, BAC, use_14b) == false) {
+    if (emrtd_select_and_read(response, &resplen, EMRTD_EF_COM, ks_enc, ks_mac, ssc, BAC, use_14b) == false) {
         PrintAndLogEx(ERR, "Failed to read EF_COM.");
         DropField();
         return PM3_ESOFT;
@@ -925,7 +924,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     uint8_t filelist[50];
     int filelistlen = 0;
 
-    if (ef_com_get_file_list(response, &resplen, filelist, &filelistlen) == false) {
+    if (emrtd_ef_com_get_file_list(response, &resplen, filelist, &filelistlen) == false) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
         DropField();
         return PM3_ESOFT;
@@ -937,16 +936,16 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     for (int i = 0; i < filelistlen; i++) {
         char file_id[5] = { 0x00 };
         char file_name[8] = { 0x00 };
-        if (file_tag_to_file_id(&filelist[i], file_name, file_id) == false) {
+        if (emrtd_file_tag_to_file_id(&filelist[i], file_name, file_id) == false) {
             PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
             continue;
         }
         PrintAndLogEx(DEBUG, "Current file: %s", file_name);
-        dump_file(ks_enc, ks_mac, ssc, file_id, file_name, BAC, use_14b);
+        emrtd_dump_file(ks_enc, ks_mac, ssc, file_id, file_name, BAC, use_14b);
     }
 
     // Dump EF_SOD
-    dump_file(ks_enc, ks_mac, ssc, EF_SOD, "EF_SOD", BAC, use_14b);
+    emrtd_dump_file(ks_enc, ks_mac, ssc, EMRTD_EF_SOD, "EF_SOD", BAC, use_14b);
 
     DropField();
     return PM3_SUCCESS;

From 40654b8ac6af2a32eb6403ce3d8eabffdbd12b26 Mon Sep 17 00:00:00 2001
From: Christian Molson <christian@cmolabs.org>
Date: Mon, 14 Dec 2020 19:44:07 -0500
Subject: [PATCH 070/682] em4x70: Clean up conversion of RF periods to ticks

---
 armsrc/em4x70.c | 90 ++++++++++++++++++++++++++-----------------------
 1 file changed, 47 insertions(+), 43 deletions(-)

diff --git a/armsrc/em4x70.c b/armsrc/em4x70.c
index 697412f87..52bf21b11 100644
--- a/armsrc/em4x70.c
+++ b/armsrc/em4x70.c
@@ -21,28 +21,32 @@ static em4x70_tag_t tag = { 0 };
 // EM4170 requires a parity bit on commands, other variants do not.
 static bool command_parity = true;
 
-#define EM4X70_T_TAG_QUARTER_PERIOD         8
-#define EM4X70_T_TAG_HALF_PERIOD            16
-#define EM4X70_T_TAG_THREE_QUARTER_PERIOD   24
-#define EM4X70_T_TAG_FULL_PERIOD            32
-#define EM4X70_T_TAG_TWA                   128 // Write Access Time
-#define EM4X70_T_TAG_DIV                   224 // Divergency Time
-#define EM4X70_T_TAG_AUTH                 4224 // Authentication Time
-#define EM4X70_T_TAG_WEE                  3072 // EEPROM write Time
-#define EM4X70_T_TAG_TWALB                 672 // Write Access Time of Lock Bits
+// Conversion from Ticks to RF periods
+// 1 us = 1.5 ticks
+// 1RF Period = 8us = 12 Ticks
+#define TICKS_PER_FC                        12
 
-#define EM4X70_T_WAITING_FOR_SNGLLIW       160   // Unsure
+// Chip timing from datasheet
+// Converted into Ticks for timing functions
+#define EM4X70_T_TAG_QUARTER_PERIOD          (8 * TICKS_PER_FC)
+#define EM4X70_T_TAG_HALF_PERIOD            (16 * TICKS_PER_FC)
+#define EM4X70_T_TAG_THREE_QUARTER_PERIOD   (24 * TICKS_PER_FC)
+#define EM4X70_T_TAG_FULL_PERIOD            (32 * TICKS_PER_FC) // 1 Bit Period
+#define EM4X70_T_TAG_TWA                   (128 * TICKS_PER_FC) // Write Access Time
+#define EM4X70_T_TAG_DIV                   (224 * TICKS_PER_FC) // Divergency Time
+#define EM4X70_T_TAG_AUTH                 (4224 * TICKS_PER_FC) // Authentication Time
+#define EM4X70_T_TAG_WEE                  (3072 * TICKS_PER_FC) // EEPROM write Time
+#define EM4X70_T_TAG_TWALB                 (672 * TICKS_PER_FC) // Write Access Time of Lock Bits
+#define EM4X70_T_TAG_BITMOD                  (4 * TICKS_PER_FC) // Initial time to stop modulation when sending 0
+#define EM4X70_T_TAG_TOLERANCE               (8 * TICKS_PER_FC) // Tolerance in RF periods for receive/LIW
 
-#define TICKS_PER_FC                        12 // 1 fc = 8us, 1.5us per tick = 12 ticks
-#define EM4X70_MIN_AMPLITUDE                10 // Minimum difference between a high and low signal
+#define EM4X70_T_TAG_TIMEOUT                 (4 * EM4X70_T_TAG_FULL_PERIOD) // Timeout if we ever get a pulse longer than this
+#define EM4X70_T_WAITING_FOR_LIW             50 // Pulses to wait for listen window
 
-#define EM4X70_TAG_TOLERANCE                 8
-#define EM4X70_TAG_WORD                     48
 
 #define EM4X70_COMMAND_RETRIES               5 // Attempts to send/read command
 #define EM4X70_MAX_RECEIVE_LENGTH           96 // Maximum bits to expect from any command
 
-
 /**
  * These IDs are from the EM4170 datasheet
  * Some versions of the chip require a
@@ -133,7 +137,7 @@ static bool get_signalproperties(void) {
 static uint32_t get_pulse_length(void) {
 
     uint8_t sample;
-    uint32_t timeout = GetTicks() + (TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD);
+    uint32_t timeout = GetTicks() + EM4X70_T_TAG_TIMEOUT;
 
     do {
         sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
@@ -143,7 +147,7 @@ static uint32_t get_pulse_length(void) {
         return 0;
 
     uint32_t start_ticks = GetTicks();
-    timeout = start_ticks + (TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD);
+    timeout = start_ticks + EM4X70_T_TAG_TIMEOUT;
 
     do {
         sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
@@ -152,7 +156,7 @@ static uint32_t get_pulse_length(void) {
     if (IS_TIMEOUT(timeout))
         return 0;
 
-    timeout = (TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD) + GetTicks();
+    timeout = GetTicks() + EM4X70_T_TAG_TIMEOUT;
     do {
         sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
     } while (IS_HIGH(sample) && !IS_TIMEOUT(timeout));
@@ -172,7 +176,7 @@ static uint32_t get_pulse_length(void) {
 static uint32_t get_pulse_invert_length(void) {
 
     uint8_t sample;
-    uint32_t timeout = GetTicks() + (TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD);
+    uint32_t timeout = GetTicks() + EM4X70_T_TAG_TIMEOUT;
 
     do {
         sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
@@ -182,7 +186,7 @@ static uint32_t get_pulse_invert_length(void) {
         return 0;
 
     uint32_t start_ticks = GetTicks();
-    timeout = start_ticks + (TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD);
+    timeout = start_ticks + EM4X70_T_TAG_TIMEOUT;
 
     do {
         sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
@@ -191,7 +195,7 @@ static uint32_t get_pulse_invert_length(void) {
     if (IS_TIMEOUT(timeout))
         return 0;
 
-    timeout = GetTicks() + (TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD);
+    timeout = GetTicks() + EM4X70_T_TAG_TIMEOUT;
     do {
         sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
     } while (IS_LOW(sample) && !IS_TIMEOUT(timeout));
@@ -203,9 +207,9 @@ static uint32_t get_pulse_invert_length(void) {
 
 }
 
-static bool check_pulse_length(uint32_t pl, int length) {
+static bool check_pulse_length(uint32_t pl, uint32_t length) {
     // check if pulse length <pl> corresponds to given length <length>
-    return ((pl >= TICKS_PER_FC * (length - EM4X70_TAG_TOLERANCE)) & (pl <= TICKS_PER_FC * (length + EM4X70_TAG_TOLERANCE)));
+    return ((pl >= (length - EM4X70_T_TAG_TOLERANCE)) & (pl <= (length + EM4X70_T_TAG_TOLERANCE)));
 }
 
 static void em4x70_send_bit(bool bit) {
@@ -215,24 +219,24 @@ static void em4x70_send_bit(bool bit) {
 
     if (bit == 0) {
 
-        // disable modulation (drop the field) for 4 cycles of carrier
+        // disable modulation (drop the field) n cycles of carrier
         LOW(GPIO_SSC_DOUT);
-        while (TICKS_ELAPSED(start_ticks) <= TICKS_PER_FC * 4);
+        while (TICKS_ELAPSED(start_ticks) <= EM4X70_T_TAG_BITMOD);
 
         // enable modulation (activates the field) for remaining first
         // half of bit period
         HIGH(GPIO_SSC_DOUT);
-        while (TICKS_ELAPSED(start_ticks) <= TICKS_PER_FC * EM4X70_T_TAG_HALF_PERIOD);
+        while (TICKS_ELAPSED(start_ticks) <= EM4X70_T_TAG_HALF_PERIOD);
 
         // disable modulation for second half of bit period
         LOW(GPIO_SSC_DOUT);
-        while (TICKS_ELAPSED(start_ticks) <= TICKS_PER_FC * EM4X70_T_TAG_FULL_PERIOD);
+        while (TICKS_ELAPSED(start_ticks) <= EM4X70_T_TAG_FULL_PERIOD);
 
     } else {
 
         // bit = "1" means disable modulation for full bit period
         LOW(GPIO_SSC_DOUT);
-        while (TICKS_ELAPSED(start_ticks) <= TICKS_PER_FC * EM4X70_T_TAG_FULL_PERIOD);
+        while (TICKS_ELAPSED(start_ticks) <= EM4X70_T_TAG_FULL_PERIOD);
     }
 }
 
@@ -296,7 +300,7 @@ static bool check_ack(void) {
     // returns true if signal structue corresponds to ACK, anything else is
     // counted as NAK (-> false)
     uint32_t start_ticks = GetTicks();
-    while (TICKS_ELAPSED(start_ticks) < TICKS_PER_FC * 4 * EM4X70_T_TAG_FULL_PERIOD) {
+    while (TICKS_ELAPSED(start_ticks) < (4 * EM4X70_T_TAG_FULL_PERIOD)) {
         /*
             ACK
               64 (48+16)
@@ -378,13 +382,13 @@ static int send_pin(const uint32_t pin) {
         }
 
         // Wait TWALB (write access lock bits)
-        WaitTicks(TICKS_PER_FC * EM4X70_T_TAG_TWALB);
+        WaitTicks(EM4X70_T_TAG_TWALB);
 
         // <-- Receive ACK
         if (check_ack()) {
 
             // <w> Writes Lock Bits
-            WaitTicks(TICKS_PER_FC * EM4X70_T_TAG_WEE);
+            WaitTicks(EM4X70_T_TAG_WEE);
             // <-- Receive header + ID
             uint8_t tag_id[EM4X70_MAX_RECEIVE_LENGTH];
             int num  = em4x70_receive(tag_id);
@@ -415,14 +419,14 @@ static int write(const uint16_t word, const uint8_t address) {
         em4x70_send_word(word);
 
         // Wait TWA
-        WaitTicks(TICKS_PER_FC * EM4X70_T_TAG_TWA);
+        WaitTicks(EM4X70_T_TAG_TWA);
 
         // look for ACK sequence
         if (check_ack()) {
 
             // now EM4x70 needs T0 * EM4X70_T_TAG_TWEE (EEPROM write time)
             // for saving data and should return with ACK
-            WaitTicks(TICKS_PER_FC * EM4X70_T_TAG_WEE);
+            WaitTicks(EM4X70_T_TAG_WEE);
             if (check_ack()) {
 
                 return PM3_SUCCESS;
@@ -436,7 +440,7 @@ static int write(const uint16_t word, const uint8_t address) {
 static bool find_listen_window(bool command) {
 
     int cnt = 0;
-    while (cnt < EM4X70_T_WAITING_FOR_SNGLLIW) {
+    while (cnt < EM4X70_T_WAITING_FOR_LIW) {
         /*
         80 ( 64 + 16 )
         80 ( 64 + 16 )
@@ -444,10 +448,10 @@ static bool find_listen_window(bool command) {
         96 ( 64 + 32 )
         64 ( 32 + 16 +16 )*/
 
-        if (check_pulse_length(get_pulse_invert_length(), 80) &&
-                check_pulse_length(get_pulse_invert_length(), 80) &&
-                check_pulse_length(get_pulse_length(), 96) &&
-                check_pulse_length(get_pulse_length(), 64)) {
+        if (check_pulse_length(get_pulse_invert_length(),     (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_HALF_PERIOD) &&
+                check_pulse_length(get_pulse_invert_length(), (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_HALF_PERIOD) &&
+                check_pulse_length(get_pulse_length(),        (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_FULL_PERIOD) &&
+                check_pulse_length(get_pulse_length(),         EM4X70_T_TAG_FULL_PERIOD + (2*EM4X70_T_TAG_HALF_PERIOD))) {
 
             if (command) {
                 /* Here we are after the 64 duration edge.
@@ -456,7 +460,7 @@ static bool find_listen_window(bool command) {
                     *
                     *   I've found between 4-5 quarter periods (32-40) works best
                     */
-                WaitTicks(TICKS_PER_FC * 4 * EM4X70_T_TAG_QUARTER_PERIOD);
+                WaitTicks( 4 * EM4X70_T_TAG_QUARTER_PERIOD );
                 // Send RM Command
                 em4x70_send_bit(0);
                 em4x70_send_bit(0);
@@ -573,7 +577,7 @@ static int em4x70_receive(uint8_t *bits) {
     //    4 Manchester 0's
 
     // Skip a few leading 1's as it could be noisy
-    WaitTicks(TICKS_PER_FC * 3 * EM4X70_T_TAG_FULL_PERIOD);
+    WaitTicks(6 * EM4X70_T_TAG_FULL_PERIOD);
 
     // wait until we get the transition from 1's to 0's which is 1.5 full windows
     int pulse_count = 0;
@@ -597,7 +601,7 @@ static int em4x70_receive(uint8_t *bits) {
     }
 
     // identify remaining bits based on pulse lengths
-    // between two listen windows only pulse lengths of 1, 1.5 and 2 are possible
+    // between listen windows only pulse lengths of 1, 1.5 and 2 are possible
     while (bit_pos < EM4X70_MAX_RECEIVE_LENGTH) {
 
         if (edge)
@@ -634,8 +638,8 @@ static int em4x70_receive(uint8_t *bits) {
                 bits[bit_pos++] = 0;
             }
 
-        } else if ((edge && check_pulse_length(pl, 3 * EM4X70_T_TAG_FULL_PERIOD)) ||
-                   (!edge && check_pulse_length(pl, 80))) {
+        } else if ((edge && check_pulse_length(pl, (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_FULL_PERIOD)) ||
+                   (!edge && check_pulse_length(pl, (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_HALF_PERIOD))) {
 
             // LIW detected (either invert or normal)
             return --bit_pos;

From f87aa869c6e245048be3c183b42d9ff8c1991383 Mon Sep 17 00:00:00 2001
From: Christian Molson <christian@cmolabs.org>
Date: Sun, 13 Dec 2020 16:23:25 -0500
Subject: [PATCH 071/682] em4x70: clean up edge detection code

---
 armsrc/em4x70.c | 90 +++++++++++++++++++++----------------------------
 armsrc/em4x70.h |  5 +++
 2 files changed, 44 insertions(+), 51 deletions(-)

diff --git a/armsrc/em4x70.c b/armsrc/em4x70.c
index 52bf21b11..1c713905c 100644
--- a/armsrc/em4x70.c
+++ b/armsrc/em4x70.c
@@ -130,36 +130,27 @@ static bool get_signalproperties(void) {
 }
 
 /**
- *  get_pulse_length
+ *  get_falling_pulse_length
  *
- *      Times falling edge pulses
+ *      Returns time between falling edge pulse in ticks
  */
-static uint32_t get_pulse_length(void) {
+static uint32_t get_falling_pulse_length(void) {
 
-    uint8_t sample;
     uint32_t timeout = GetTicks() + EM4X70_T_TAG_TIMEOUT;
 
-    do {
-        sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-    } while (IS_HIGH(sample) && !IS_TIMEOUT(timeout));
+    while (IS_HIGH(AT91C_BASE_SSC->SSC_RHR) && !IS_TIMEOUT(timeout));
 
     if (IS_TIMEOUT(timeout))
         return 0;
 
     uint32_t start_ticks = GetTicks();
-    timeout = start_ticks + EM4X70_T_TAG_TIMEOUT;
 
-    do {
-        sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-    } while (IS_LOW(sample) && !IS_TIMEOUT(timeout));
+    while (IS_LOW(AT91C_BASE_SSC->SSC_RHR) && !IS_TIMEOUT(timeout));
 
     if (IS_TIMEOUT(timeout))
         return 0;
 
-    timeout = GetTicks() + EM4X70_T_TAG_TIMEOUT;
-    do {
-        sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-    } while (IS_HIGH(sample) && !IS_TIMEOUT(timeout));
+    while (IS_HIGH(AT91C_BASE_SSC->SSC_RHR) && !IS_TIMEOUT(timeout));
 
     if (IS_TIMEOUT(timeout))
         return 0;
@@ -168,37 +159,27 @@ static uint32_t get_pulse_length(void) {
 }
 
 /**
- *  get_pulse_invert_length
+ *  get_rising_pulse_length
  *
- *      Times rising edge pules
- *  TODO: convert to single function with get_pulse_length()
+ *      Returns time between rising edge pulse in ticks
  */
-static uint32_t get_pulse_invert_length(void) {
+static uint32_t get_rising_pulse_length(void) {
 
-    uint8_t sample;
     uint32_t timeout = GetTicks() + EM4X70_T_TAG_TIMEOUT;
 
-    do {
-        sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-    } while (IS_LOW(sample) && !IS_TIMEOUT(timeout));
+    while (IS_LOW(AT91C_BASE_SSC->SSC_RHR) && !IS_TIMEOUT(timeout));
 
     if (IS_TIMEOUT(timeout))
         return 0;
 
     uint32_t start_ticks = GetTicks();
-    timeout = start_ticks + EM4X70_T_TAG_TIMEOUT;
 
-    do {
-        sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-    } while (IS_HIGH(sample) && !IS_TIMEOUT(timeout));
+    while (IS_HIGH(AT91C_BASE_SSC->SSC_RHR) && !IS_TIMEOUT(timeout));
 
     if (IS_TIMEOUT(timeout))
         return 0;
 
-    timeout = GetTicks() + EM4X70_T_TAG_TIMEOUT;
-    do {
-        sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-    } while (IS_LOW(sample) && !IS_TIMEOUT(timeout));
+    while (IS_LOW(AT91C_BASE_SSC->SSC_RHR) && !IS_TIMEOUT(timeout));
 
     if (IS_TIMEOUT(timeout))
         return 0;
@@ -207,6 +188,16 @@ static uint32_t get_pulse_invert_length(void) {
 
 }
 
+static uint32_t get_pulse_length(edge_detection_t edge) {
+
+    if(edge == RISING_EDGE)
+        return get_rising_pulse_length();
+    else if(edge == FALLING_EDGE)
+        return get_falling_pulse_length();
+
+    return 0;
+}
+
 static bool check_pulse_length(uint32_t pl, uint32_t length) {
     // check if pulse length <pl> corresponds to given length <length>
     return ((pl >= (length - EM4X70_T_TAG_TOLERANCE)) & (pl <= (length + EM4X70_T_TAG_TOLERANCE)));
@@ -309,10 +300,10 @@ static bool check_ack(void) {
               64 (48+16)
               48 (32+16)
         */
-        if (check_pulse_length(get_pulse_length(), 2 * EM4X70_T_TAG_FULL_PERIOD)) {
+        if (check_pulse_length(get_pulse_length(FALLING_EDGE), 2 * EM4X70_T_TAG_FULL_PERIOD)) {
 
             // The received signal is either ACK or NAK.
-            if (check_pulse_length(get_pulse_length(), 2 * EM4X70_T_TAG_FULL_PERIOD)) {
+            if (check_pulse_length(get_pulse_length(FALLING_EDGE), 2 * EM4X70_T_TAG_FULL_PERIOD)) {
                 return true;
             } else {
                 // It's NAK -> stop searching
@@ -448,10 +439,10 @@ static bool find_listen_window(bool command) {
         96 ( 64 + 32 )
         64 ( 32 + 16 +16 )*/
 
-        if (check_pulse_length(get_pulse_invert_length(),     (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_HALF_PERIOD) &&
-                check_pulse_length(get_pulse_invert_length(), (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_HALF_PERIOD) &&
-                check_pulse_length(get_pulse_length(),        (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_FULL_PERIOD) &&
-                check_pulse_length(get_pulse_length(),         EM4X70_T_TAG_FULL_PERIOD + (2*EM4X70_T_TAG_HALF_PERIOD))) {
+        if (check_pulse_length(get_pulse_length(RISING_EDGE),     (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_HALF_PERIOD) &&
+                check_pulse_length(get_pulse_length(RISING_EDGE), (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_HALF_PERIOD) &&
+                check_pulse_length(get_pulse_length(FALLING_EDGE),        (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_FULL_PERIOD) &&
+                check_pulse_length(get_pulse_length(FALLING_EDGE),         EM4X70_T_TAG_FULL_PERIOD + (2*EM4X70_T_TAG_HALF_PERIOD))) {
 
             if (command) {
                 /* Here we are after the 64 duration edge.
@@ -569,7 +560,7 @@ static int em4x70_receive(uint8_t *bits) {
 
     uint32_t pl;
     int bit_pos = 0;
-    uint8_t edge = 0;
+    edge_detection_t edge = RISING_EDGE;
     bool foundheader = false;
 
     // Read out the header
@@ -582,7 +573,7 @@ static int em4x70_receive(uint8_t *bits) {
     // wait until we get the transition from 1's to 0's which is 1.5 full windows
     int pulse_count = 0;
     while (pulse_count < 12) {
-        pl = get_pulse_invert_length();
+        pl = get_pulse_length(edge);
         pulse_count++;
         if (check_pulse_length(pl, 3 * EM4X70_T_TAG_HALF_PERIOD)) {
             foundheader = true;
@@ -597,40 +588,37 @@ static int em4x70_receive(uint8_t *bits) {
 
     // Skip next 3 0's, header check consumes the first 0
     for (int i = 0; i < 3; i++) {
-        get_pulse_invert_length();
+        get_pulse_length(edge);
     }
 
     // identify remaining bits based on pulse lengths
     // between listen windows only pulse lengths of 1, 1.5 and 2 are possible
     while (bit_pos < EM4X70_MAX_RECEIVE_LENGTH) {
 
-        if (edge)
-            pl = get_pulse_length();
-        else
-            pl = get_pulse_invert_length();
+        pl = get_pulse_length(edge);
 
         if (check_pulse_length(pl, EM4X70_T_TAG_FULL_PERIOD)) {
 
             // pulse length = 1
-            bits[bit_pos++] = edge;
+            bits[bit_pos++] = edge == FALLING_EDGE ? 1 : 0;
 
         } else if (check_pulse_length(pl, 3 * EM4X70_T_TAG_HALF_PERIOD)) {
 
             // pulse length = 1.5 -> flip edge detection
-            if (edge) {
+            if (edge == FALLING_EDGE) {
                 bits[bit_pos++] = 0;
                 bits[bit_pos++] = 0;
-                edge = 0;
+                edge = RISING_EDGE;
             } else {
                 bits[bit_pos++] = 1;
                 bits[bit_pos++] = 1;
-                edge = 1;
+                edge = FALLING_EDGE;
             }
 
         } else if (check_pulse_length(pl, 2 * EM4X70_T_TAG_FULL_PERIOD)) {
 
             // pulse length of 2
-            if (edge) {
+            if (edge == FALLING_EDGE) {
                 bits[bit_pos++] = 0;
                 bits[bit_pos++] = 1;
             } else {
@@ -638,8 +626,8 @@ static int em4x70_receive(uint8_t *bits) {
                 bits[bit_pos++] = 0;
             }
 
-        } else if ((edge && check_pulse_length(pl, (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_FULL_PERIOD)) ||
-                   (!edge && check_pulse_length(pl, (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_HALF_PERIOD))) {
+        } else if (((edge == FALLING_EDGE) && check_pulse_length(pl, (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_FULL_PERIOD)) ||
+                   ((edge == RISING_EDGE) && check_pulse_length(pl, (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_HALF_PERIOD))) {
 
             // LIW detected (either invert or normal)
             return --bit_pos;
diff --git a/armsrc/em4x70.h b/armsrc/em4x70.h
index 17ac243ae..7331a2201 100644
--- a/armsrc/em4x70.h
+++ b/armsrc/em4x70.h
@@ -17,6 +17,11 @@ typedef struct {
     uint8_t data[32];
 } em4x70_tag_t;
 
+typedef enum {
+    RISING_EDGE,
+    FALLING_EDGE
+}edge_detection_t;
+
 void em4x70_info(em4x70_data_t *etd);
 void em4x70_write(em4x70_data_t *etd);
 void em4x70_unlock(em4x70_data_t *etd);

From a2c21f1d07110ca9551444257389814cd668602b Mon Sep 17 00:00:00 2001
From: Christian Molson <christian@cmolabs.org>
Date: Sun, 13 Dec 2020 16:40:27 -0500
Subject: [PATCH 072/682] em4x70: fix function names

---
 armsrc/em4x70.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/armsrc/em4x70.c b/armsrc/em4x70.c
index 1c713905c..71f9cb6b7 100644
--- a/armsrc/em4x70.c
+++ b/armsrc/em4x70.c
@@ -80,7 +80,7 @@ static void init_tag(void) {
     memset(tag.data, 0x00, sizeof(tag.data) / sizeof(tag.data[0]));
 }
 
-static void EM4170_setup_read(void) {
+static void em4x70_setup_read(void) {
 
     FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
     FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
@@ -550,7 +550,7 @@ static bool em4x70_read_um2(void) {
 
 }
 
-static bool find_EM4X70_Tag(void) {
+static bool find_em4x70_Tag(void) {
     // function is used to check wether a tag on the proxmark is an
     // EM4170 tag or not -> speed up "lf search" process
     return find_listen_window(false);
@@ -646,10 +646,10 @@ void em4x70_info(em4x70_data_t *etd) {
     command_parity = etd->parity;
 
     init_tag();
-    EM4170_setup_read();
+    em4x70_setup_read();
 
     // Find the Tag
-    if (get_signalproperties() && find_EM4X70_Tag()) {
+    if (get_signalproperties() && find_em4x70_Tag()) {
         // Read ID, UM1 and UM2
         status = em4x70_read_id() && em4x70_read_um1() && em4x70_read_um2();
     }
@@ -666,10 +666,10 @@ void em4x70_write(em4x70_data_t *etd) {
     command_parity = etd->parity;
 
     init_tag();
-    EM4170_setup_read();
+    em4x70_setup_read();
 
     // Find the Tag
-    if (get_signalproperties() && find_EM4X70_Tag()) {
+    if (get_signalproperties() && find_em4x70_Tag()) {
 
         // Write
         status = write(etd->word, etd->address) == PM3_SUCCESS;
@@ -695,10 +695,10 @@ void em4x70_unlock(em4x70_data_t *etd) {
     command_parity = etd->parity;
 
     init_tag();
-    EM4170_setup_read();
+    em4x70_setup_read();
 
     // Find the Tag
-    if (get_signalproperties() && find_EM4X70_Tag()) {
+    if (get_signalproperties() && find_em4x70_Tag()) {
 
         // Read ID (required for send_pin command)
         if (em4x70_read_id()) {
@@ -729,10 +729,10 @@ void em4x70_auth(em4x70_data_t *etd) {
     command_parity = etd->parity;
 
     init_tag();
-    EM4170_setup_read();
+    em4x70_setup_read();
 
     // Find the Tag
-    if (get_signalproperties() && find_EM4X70_Tag()) {
+    if (get_signalproperties() && find_em4x70_Tag()) {
 
         // Authenticate and get tag response
         status = authenticate(etd->rnd, etd->frnd, response) == PM3_SUCCESS;

From afbef5ba73267baaf98a7028610955caf88a3fb2 Mon Sep 17 00:00:00 2001
From: Christian Molson <christian@cmolabs.org>
Date: Mon, 14 Dec 2020 00:38:41 -0500
Subject: [PATCH 073/682] em4x70: clean up check_ack function

---
 armsrc/em4x70.c | 33 ++++++++++-----------------------
 1 file changed, 10 insertions(+), 23 deletions(-)

diff --git a/armsrc/em4x70.c b/armsrc/em4x70.c
index 71f9cb6b7..ad11e8f19 100644
--- a/armsrc/em4x70.c
+++ b/armsrc/em4x70.c
@@ -287,30 +287,17 @@ static void em4x70_send_word(const uint16_t word) {
 }
 
 static bool check_ack(void) {
-
     // returns true if signal structue corresponds to ACK, anything else is
     // counted as NAK (-> false)
-    uint32_t start_ticks = GetTicks();
-    while (TICKS_ELAPSED(start_ticks) < (4 * EM4X70_T_TAG_FULL_PERIOD)) {
-        /*
-            ACK
-              64 (48+16)
-              64 (48+16)
-            NACK
-              64 (48+16)
-              48 (32+16)
-        */
-        if (check_pulse_length(get_pulse_length(FALLING_EDGE), 2 * EM4X70_T_TAG_FULL_PERIOD)) {
-
-            // The received signal is either ACK or NAK.
-            if (check_pulse_length(get_pulse_length(FALLING_EDGE), 2 * EM4X70_T_TAG_FULL_PERIOD)) {
-                return true;
-            } else {
-                // It's NAK -> stop searching
-                break;
-            }
-        }
-    }
+    // ACK  64 + 64
+    // NACK 64 + 48
+    if (check_pulse_length(get_pulse_length(FALLING_EDGE), 2 * EM4X70_T_TAG_FULL_PERIOD) &&
+        check_pulse_length(get_pulse_length(FALLING_EDGE), 2 * EM4X70_T_TAG_FULL_PERIOD)) {
+        // ACK
+        return true;
+    } 
+    
+    // Othewise it was a NACK or Listen Window
     return false;
 }
 
@@ -415,7 +402,7 @@ static int write(const uint16_t word, const uint8_t address) {
         // look for ACK sequence
         if (check_ack()) {
 
-            // now EM4x70 needs T0 * EM4X70_T_TAG_TWEE (EEPROM write time)
+            // now EM4x70 needs EM4X70_T_TAG_TWEE (EEPROM write time)
             // for saving data and should return with ACK
             WaitTicks(EM4X70_T_TAG_WEE);
             if (check_ack()) {

From ff762027d960e19bc44824d873f8c22d199d49d1 Mon Sep 17 00:00:00 2001
From: Christian Molson <christian@cmolabs.org>
Date: Tue, 15 Dec 2020 08:57:11 -0500
Subject: [PATCH 074/682] em4x70: Update receive function with expected bits to
 receive.

---
 armsrc/em4x70.c | 57 ++++++++++++++++++++++++-------------------------
 1 file changed, 28 insertions(+), 29 deletions(-)

diff --git a/armsrc/em4x70.c b/armsrc/em4x70.c
index ad11e8f19..61b7e76cb 100644
--- a/armsrc/em4x70.c
+++ b/armsrc/em4x70.c
@@ -42,7 +42,7 @@ static bool command_parity = true;
 
 #define EM4X70_T_TAG_TIMEOUT                 (4 * EM4X70_T_TAG_FULL_PERIOD) // Timeout if we ever get a pulse longer than this
 #define EM4X70_T_WAITING_FOR_LIW             50 // Pulses to wait for listen window
-
+#define EM4X70_T_READ_HEADER_LEN             16 // Read header length (16 bit periods)
 
 #define EM4X70_COMMAND_RETRIES               5 // Attempts to send/read command
 #define EM4X70_MAX_RECEIVE_LENGTH           96 // Maximum bits to expect from any command
@@ -73,7 +73,7 @@ static bool command_parity = true;
 
 static uint8_t bits2byte(const uint8_t *bits, int length);
 static void bits2bytes(const uint8_t *bits, int length, uint8_t *out);
-static int em4x70_receive(uint8_t *bits);
+static int em4x70_receive(uint8_t *bits, size_t length);
 static bool find_listen_window(bool command);
 
 static void init_tag(void) {
@@ -329,8 +329,8 @@ static int authenticate(const uint8_t *rnd, const uint8_t *frnd, uint8_t *respon
 
         // Receive header, 20-bit g(RN), LIW
         uint8_t grnd[EM4X70_MAX_RECEIVE_LENGTH] = {0};
-        int num = em4x70_receive(grnd);
-        if (num < 10) {
+        int num = em4x70_receive(grnd, 20);
+        if (num < 20) {
             Dbprintf("Auth failed");
             return PM3_ESOFT;
         }
@@ -369,7 +369,7 @@ static int send_pin(const uint32_t pin) {
             WaitTicks(EM4X70_T_TAG_WEE);
             // <-- Receive header + ID
             uint8_t tag_id[EM4X70_MAX_RECEIVE_LENGTH];
-            int num  = em4x70_receive(tag_id);
+            int num  = em4x70_receive(tag_id, 32);
             if (num < 32) {
                 Dbprintf("Invalid ID Received");
                 return PM3_ESOFT;
@@ -480,7 +480,7 @@ static uint8_t bits2byte(const uint8_t *bits, int length) {
     return byte;
 }
 
-static bool send_command_and_read(uint8_t command, uint8_t resp_len_bits, uint8_t *out_bytes) {
+static bool send_command_and_read(uint8_t command, uint8_t *bytes, size_t length) {
 
     int retries = EM4X70_COMMAND_RETRIES;
     while (retries) {
@@ -488,13 +488,14 @@ static bool send_command_and_read(uint8_t command, uint8_t resp_len_bits, uint8_
 
         if (find_listen_window(true)) {
             uint8_t bits[EM4X70_MAX_RECEIVE_LENGTH] = {0};
+            size_t out_length_bits = length * 8;
             em4x70_send_nibble(command, command_parity);
-            int len = em4x70_receive(bits);
-            if (len < resp_len_bits) {
-                Dbprintf("Invalid data received length: %d", len);
+            int len = em4x70_receive(bits, out_length_bits);
+            if (len < out_length_bits) {
+                Dbprintf("Invalid data received length: %d, expected %d", len, out_length_bits);
                 return false;
             }
-            bits2bytes(bits, len, out_bytes);
+            bits2bytes(bits, len, bytes);
             return true;
         }
     }
@@ -510,7 +511,7 @@ static bool send_command_and_read(uint8_t command, uint8_t resp_len_bits, uint8_
  */
 static bool em4x70_read_id(void) {
 
-    return send_command_and_read(EM4X70_COMMAND_ID, 32, &tag.data[4]);
+    return send_command_and_read(EM4X70_COMMAND_ID, &tag.data[4], 4);
 
 }
 
@@ -521,7 +522,7 @@ static bool em4x70_read_id(void) {
  */
 static bool em4x70_read_um1(void) {
 
-    return send_command_and_read(EM4X70_COMMAND_UM1, 32, &tag.data[0]);
+    return send_command_and_read(EM4X70_COMMAND_UM1, &tag.data[0], 4);
 
 }
 
@@ -533,7 +534,7 @@ static bool em4x70_read_um1(void) {
  */
 static bool em4x70_read_um2(void) {
 
-    return send_command_and_read(EM4X70_COMMAND_UM2, 64, &tag.data[24]);
+    return send_command_and_read(EM4X70_COMMAND_UM2, &tag.data[24], 8);
 
 }
 
@@ -543,7 +544,7 @@ static bool find_em4x70_Tag(void) {
     return find_listen_window(false);
 }
 
-static int em4x70_receive(uint8_t *bits) {
+static int em4x70_receive(uint8_t *bits, size_t length) {
 
     uint32_t pl;
     int bit_pos = 0;
@@ -558,10 +559,8 @@ static int em4x70_receive(uint8_t *bits) {
     WaitTicks(6 * EM4X70_T_TAG_FULL_PERIOD);
 
     // wait until we get the transition from 1's to 0's which is 1.5 full windows
-    int pulse_count = 0;
-    while (pulse_count < 12) {
+    for(int i = 0; i < EM4X70_T_READ_HEADER_LEN; i++) {
         pl = get_pulse_length(edge);
-        pulse_count++;
         if (check_pulse_length(pl, 3 * EM4X70_T_TAG_HALF_PERIOD)) {
             foundheader = true;
             break;
@@ -575,23 +574,26 @@ static int em4x70_receive(uint8_t *bits) {
 
     // Skip next 3 0's, header check consumes the first 0
     for (int i = 0; i < 3; i++) {
-        get_pulse_length(edge);
+        // If pulse length is not 1 bit, then abort early
+        if(!check_pulse_length(get_pulse_length(edge), EM4X70_T_TAG_FULL_PERIOD)) {
+            return 0;
+        }
     }
 
     // identify remaining bits based on pulse lengths
     // between listen windows only pulse lengths of 1, 1.5 and 2 are possible
-    while (bit_pos < EM4X70_MAX_RECEIVE_LENGTH) {
+    while (bit_pos < length) {
 
         pl = get_pulse_length(edge);
 
         if (check_pulse_length(pl, EM4X70_T_TAG_FULL_PERIOD)) {
 
-            // pulse length = 1
+            // pulse length 1 -> assign bit
             bits[bit_pos++] = edge == FALLING_EDGE ? 1 : 0;
 
         } else if (check_pulse_length(pl, 3 * EM4X70_T_TAG_HALF_PERIOD)) {
 
-            // pulse length = 1.5 -> flip edge detection
+            // pulse length 1.5 -> 2 bits + flip edge detection
             if (edge == FALLING_EDGE) {
                 bits[bit_pos++] = 0;
                 bits[bit_pos++] = 0;
@@ -604,7 +606,7 @@ static int em4x70_receive(uint8_t *bits) {
 
         } else if (check_pulse_length(pl, 2 * EM4X70_T_TAG_FULL_PERIOD)) {
 
-            // pulse length of 2
+            // pulse length of 2 -> two bits
             if (edge == FALLING_EDGE) {
                 bits[bit_pos++] = 0;
                 bits[bit_pos++] = 1;
@@ -613,16 +615,13 @@ static int em4x70_receive(uint8_t *bits) {
                 bits[bit_pos++] = 0;
             }
 
-        } else if (((edge == FALLING_EDGE) && check_pulse_length(pl, (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_FULL_PERIOD)) ||
-                   ((edge == RISING_EDGE) && check_pulse_length(pl, (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_HALF_PERIOD))) {
-
-            // LIW detected (either invert or normal)
-            return --bit_pos;
+        } else {
+            // Listen Window, or invalid bit
+            break;
         }
     }
 
-    // Should not get here
-    return --bit_pos;
+    return bit_pos;
 }
 
 void em4x70_info(em4x70_data_t *etd) {

From dc35f79bd2542d5e7712b7e26068423c0599a86e Mon Sep 17 00:00:00 2001
From: Christian Molson <christian@cmolabs.org>
Date: Tue, 15 Dec 2020 11:22:43 -0500
Subject: [PATCH 075/682] em4x70: Add write pin convenience function to write
 and verify a new pin

---
 armsrc/appmain.c         |  4 +++
 armsrc/em4x70.c          | 49 ++++++++++++++++++++++++++---
 armsrc/em4x70.h          |  1 +
 client/src/cmdlfem4x70.c | 68 +++++++++++++++++++++++++++++++++++++---
 client/src/cmdlfem4x70.h |  1 +
 include/em4x70.h         |  4 +++
 include/pm3_cmd.h        |  1 +
 7 files changed, 118 insertions(+), 10 deletions(-)

diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index 57c2f36c7..af6e6c956 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -1182,6 +1182,10 @@ static void PacketReceived(PacketCommandNG *packet) {
             em4x70_auth((em4x70_data_t *)packet->data.asBytes);
             break;
         }
+        case CMD_LF_EM4X70_WRITEPIN: {
+            em4x70_write_pin((em4x70_data_t *)packet->data.asBytes);
+            break;
+        }
 #endif
 
 #ifdef WITH_ISO15693
diff --git a/armsrc/em4x70.c b/armsrc/em4x70.c
index 61b7e76cb..758b6e08e 100644
--- a/armsrc/em4x70.c
+++ b/armsrc/em4x70.c
@@ -538,7 +538,7 @@ static bool em4x70_read_um2(void) {
 
 }
 
-static bool find_em4x70_Tag(void) {
+static bool find_em4x70_tag(void) {
     // function is used to check wether a tag on the proxmark is an
     // EM4170 tag or not -> speed up "lf search" process
     return find_listen_window(false);
@@ -635,7 +635,7 @@ void em4x70_info(em4x70_data_t *etd) {
     em4x70_setup_read();
 
     // Find the Tag
-    if (get_signalproperties() && find_em4x70_Tag()) {
+    if (get_signalproperties() && find_em4x70_tag()) {
         // Read ID, UM1 and UM2
         status = em4x70_read_id() && em4x70_read_um1() && em4x70_read_um2();
     }
@@ -655,7 +655,7 @@ void em4x70_write(em4x70_data_t *etd) {
     em4x70_setup_read();
 
     // Find the Tag
-    if (get_signalproperties() && find_em4x70_Tag()) {
+    if (get_signalproperties() && find_em4x70_tag()) {
 
         // Write
         status = write(etd->word, etd->address) == PM3_SUCCESS;
@@ -684,7 +684,7 @@ void em4x70_unlock(em4x70_data_t *etd) {
     em4x70_setup_read();
 
     // Find the Tag
-    if (get_signalproperties() && find_em4x70_Tag()) {
+    if (get_signalproperties() && find_em4x70_tag()) {
 
         // Read ID (required for send_pin command)
         if (em4x70_read_id()) {
@@ -718,7 +718,7 @@ void em4x70_auth(em4x70_data_t *etd) {
     em4x70_setup_read();
 
     // Find the Tag
-    if (get_signalproperties() && find_em4x70_Tag()) {
+    if (get_signalproperties() && find_em4x70_tag()) {
 
         // Authenticate and get tag response
         status = authenticate(etd->rnd, etd->frnd, response) == PM3_SUCCESS;
@@ -729,3 +729,42 @@ void em4x70_auth(em4x70_data_t *etd) {
     reply_ng(CMD_LF_EM4X70_AUTH, status, response, sizeof(response));
 }
 
+void em4x70_write_pin(em4x70_data_t *etd) {
+
+    uint8_t status = 0;
+
+    command_parity = etd->parity;
+
+    init_tag();
+    em4x70_setup_read();
+
+    // Find the Tag
+    if (get_signalproperties() && find_em4x70_tag()) {
+
+        // Read ID (required for send_pin command)
+        if (em4x70_read_id()) {
+
+            // Write new PIN
+            if( (write( etd->pin & 0xFFFF,        EM4X70_PIN_WORD_UPPER) == PM3_SUCCESS) &&
+                (write((etd->pin >> 16) & 0xFFFF, EM4X70_PIN_WORD_LOWER) == PM3_SUCCESS)) {
+
+                // Now Try to authenticate using the new PIN
+
+                // Send PIN
+                status = send_pin(etd->pin) == PM3_SUCCESS;
+
+                // If the write succeeded, read the rest of the tag
+                if (status) {
+                    // Read Tag
+                    // ID doesn't change
+                    em4x70_read_um1();
+                    em4x70_read_um2();
+                }
+            }
+        }
+    }
+
+    StopTicks();
+    lf_finalize();
+    reply_ng(CMD_LF_EM4X70_WRITEPIN, status, tag.data, sizeof(tag.data));
+}
diff --git a/armsrc/em4x70.h b/armsrc/em4x70.h
index 7331a2201..41bfe824d 100644
--- a/armsrc/em4x70.h
+++ b/armsrc/em4x70.h
@@ -26,5 +26,6 @@ void em4x70_info(em4x70_data_t *etd);
 void em4x70_write(em4x70_data_t *etd);
 void em4x70_unlock(em4x70_data_t *etd);
 void em4x70_auth(em4x70_data_t *etd);
+void em4x70_write_pin(em4x70_data_t *etd);
 
 #endif /* EM4x70_H */
diff --git a/client/src/cmdlfem4x70.c b/client/src/cmdlfem4x70.c
index 05d8d52b4..b2ccb3a0e 100644
--- a/client/src/cmdlfem4x70.c
+++ b/client/src/cmdlfem4x70.c
@@ -338,12 +338,70 @@ int CmdEM4x70Auth(const char *Cmd) {
     return PM3_ESOFT;
 }
 
+int CmdEM4x70WritePIN(const char *Cmd) {
+
+    // send pin code to device, unlocking it for writing
+    em4x70_data_t etd = {0};
+
+    CLIParserContext *ctx;
+
+    CLIParserInit(&ctx, "lf em 4x70 writepin",
+                  "Write PIN\n",
+                  "lf em 4x70 writepin -p 11223344 -> Write PIN\n"
+                  "lf em 4x70 writepin -p 11223344 --par -> Write PIN using parity commands\n"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0(NULL, "par", "Add parity bit when sending commands"),
+        arg_str1("p",  "pin", "<hex>", "pin, 4 bytes"),
+        arg_param_end
+    };
+
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    etd.parity = arg_get_lit(ctx, 1);
+
+    int pin_len = 0;
+    uint8_t pin[4] = {0x0};
+
+    CLIGetHexWithReturn(ctx, 2, pin, &pin_len);
+
+    CLIParserFree(ctx);
+
+    if (pin_len != 4) {
+        PrintAndLogEx(FAILED, "PIN length must be 4 bytes instead of %d", pin_len);
+        return PM3_EINVARG;
+    }
+
+    etd.pin = BYTES2UINT32(pin);
+
+    clearCommandBuffer();
+    SendCommandNG(CMD_LF_EM4X70_WRITEPIN, (uint8_t *)&etd, sizeof(etd));
+
+    PacketResponseNG resp;
+    if (!WaitForResponseTimeout(CMD_LF_EM4X70_WRITEPIN, &resp, TIMEOUT)) {
+        PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
+        return PM3_ETIMEOUT;
+    }
+
+    if (resp.status) {
+        print_info_result(resp.data.asBytes);
+        PrintAndLogEx(INFO, "Writing new PIN: " _GREEN_("SUCCESS"));
+        return PM3_SUCCESS;
+    }
+
+    PrintAndLogEx(FAILED, "Writing new PIN: " _RED_("FAILED"));
+    return PM3_ESOFT;
+}
+
 static command_t CommandTable[] = {
-    {"help",   CmdHelp,         AlwaysAvailable, "This help"},
-    {"info",   CmdEM4x70Info,   IfPm3EM4x70,     "Tag information EM4x70"},
-    {"write",  CmdEM4x70Write,  IfPm3EM4x70,     "Write EM4x70"},
-    {"unlock", CmdEM4x70Unlock, IfPm3EM4x70,     "Unlock EM4x70 for writing"},
-    {"auth",   CmdEM4x70Auth,   IfPm3EM4x70,     "Authenticate EM4x70"},
+    {"help",     CmdHelp,           AlwaysAvailable, "This help"},
+    {"info",     CmdEM4x70Info,     IfPm3EM4x70,     "Tag information EM4x70"},
+    {"write",    CmdEM4x70Write,    IfPm3EM4x70,     "Write EM4x70"},
+    {"unlock",   CmdEM4x70Unlock,   IfPm3EM4x70,     "Unlock EM4x70 for writing"},
+    {"auth",     CmdEM4x70Auth,     IfPm3EM4x70,     "Authenticate EM4x70"},
+    {"writepin", CmdEM4x70WritePIN, IfPm3EM4x70,     "Write PIN"},
     {NULL, NULL, NULL, NULL}
 };
 
diff --git a/client/src/cmdlfem4x70.h b/client/src/cmdlfem4x70.h
index 755ff74d2..09a9b9361 100644
--- a/client/src/cmdlfem4x70.h
+++ b/client/src/cmdlfem4x70.h
@@ -21,6 +21,7 @@ int CmdEM4x70Info(const char *Cmd);
 int CmdEM4x70Write(const char *Cmd);
 int CmdEM4x70Unlock(const char *Cmd);
 int CmdEM4x70Auth(const char *Cmd);
+int CmdEM4x70WritePIN(const char *Cmd);
 
 int em4x70_info(void);
 bool detect_4x70_block(void);
diff --git a/include/em4x70.h b/include/em4x70.h
index 0703c3900..4d08d622b 100644
--- a/include/em4x70.h
+++ b/include/em4x70.h
@@ -13,6 +13,10 @@
 
 #define EM4X70_NUM_BLOCKS 16
 
+// Common word/block addresses
+#define EM4X70_PIN_WORD_LOWER 10
+#define EM4X70_PIN_WORD_UPPER 11
+
 typedef struct {
     bool parity;
 
diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h
index 95ef41ebb..0249d15a7 100644
--- a/include/pm3_cmd.h
+++ b/include/pm3_cmd.h
@@ -520,6 +520,7 @@ typedef struct {
 #define CMD_LF_EM4X70_WRITE                                               0x0261
 #define CMD_LF_EM4X70_UNLOCK                                              0x0262
 #define CMD_LF_EM4X70_AUTH                                                0x0263
+#define CMD_LF_EM4X70_WRITEPIN                                            0x0264
 // Sampling configuration for LF reader/sniffer
 #define CMD_LF_SAMPLING_SET_CONFIG                                        0x021D
 #define CMD_LF_FSK_SIMULATE                                               0x021E

From 60f36b468de51834bf8bda79fabb1ab1be17939c Mon Sep 17 00:00:00 2001
From: Christian Molson <christian@cmolabs.org>
Date: Tue, 15 Dec 2020 12:32:30 -0500
Subject: [PATCH 076/682] em4x70: Add write key convenience function. Use real
 values in writekey/auth help text so people with blank tags can program a
 test key and test authentication.

---
 armsrc/appmain.c         |  4 +++
 armsrc/em4x70.c          | 38 +++++++++++++++++++++++++++
 armsrc/em4x70.h          |  1 +
 client/src/cmdlfem4x70.c | 55 ++++++++++++++++++++++++++++++++++++++--
 client/src/cmdlfem4x70.h |  1 +
 include/em4x70.h         |  3 +++
 include/pm3_cmd.h        |  1 +
 7 files changed, 101 insertions(+), 2 deletions(-)

diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index af6e6c956..fe8566363 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -1186,6 +1186,10 @@ static void PacketReceived(PacketCommandNG *packet) {
             em4x70_write_pin((em4x70_data_t *)packet->data.asBytes);
             break;
         }
+        case CMD_LF_EM4X70_WRITEKEY: {
+            em4x70_write_key((em4x70_data_t *)packet->data.asBytes);
+            break;
+        }
 #endif
 
 #ifdef WITH_ISO15693
diff --git a/armsrc/em4x70.c b/armsrc/em4x70.c
index 758b6e08e..1a6f37d56 100644
--- a/armsrc/em4x70.c
+++ b/armsrc/em4x70.c
@@ -768,3 +768,41 @@ void em4x70_write_pin(em4x70_data_t *etd) {
     lf_finalize();
     reply_ng(CMD_LF_EM4X70_WRITEPIN, status, tag.data, sizeof(tag.data));
 }
+
+void em4x70_write_key(em4x70_data_t *etd) {
+
+    uint8_t status = 0;
+
+    command_parity = etd->parity;
+
+    init_tag();
+    em4x70_setup_read();
+
+    // Find the Tag
+    if (get_signalproperties() && find_em4x70_tag()) {
+
+        // Read ID to ensure we can write to card
+        if (em4x70_read_id()) {
+            status = 1;
+            
+            // Write each crypto block
+            for(int i = 0; i < 6; i++) {
+
+                uint16_t key_word = (etd->crypt_key[(i*2)+1] << 8) + etd->crypt_key[i*2];
+                // Write each word, abort if any failure occurs
+                if (write(key_word, 9-i) != PM3_SUCCESS) {
+                    status = 0;
+                    break;
+                }
+            }
+            // TODO: Ideally here we would perform a test authentication
+            //       to ensure the new key was written correctly. This is
+            //       what the datasheet suggests. We can't do that until
+            //       we have the crypto algorithm implemented.
+        }
+    }
+
+    StopTicks();
+    lf_finalize();
+    reply_ng(CMD_LF_EM4X70_WRITEKEY, status, tag.data, sizeof(tag.data));
+}
diff --git a/armsrc/em4x70.h b/armsrc/em4x70.h
index 41bfe824d..abebe0e8b 100644
--- a/armsrc/em4x70.h
+++ b/armsrc/em4x70.h
@@ -27,5 +27,6 @@ void em4x70_write(em4x70_data_t *etd);
 void em4x70_unlock(em4x70_data_t *etd);
 void em4x70_auth(em4x70_data_t *etd);
 void em4x70_write_pin(em4x70_data_t *etd);
+void em4x70_write_key(em4x70_data_t *etd);
 
 #endif /* EM4x70_H */
diff --git a/client/src/cmdlfem4x70.c b/client/src/cmdlfem4x70.c
index b2ccb3a0e..032daf4b2 100644
--- a/client/src/cmdlfem4x70.c
+++ b/client/src/cmdlfem4x70.c
@@ -286,7 +286,7 @@ int CmdEM4x70Auth(const char *Cmd) {
     CLIParserInit(&ctx, "lf em 4x70 auth",
                   "Authenticate against an EM4x70 by sending random number (RN) and F(RN)\n"
                   "  If F(RN) is incorrect based on the tag crypt key, the tag will not respond",
-                  "lf em 4x70 auth --rnd 11223344556677 --frn 11223344\n"
+                  "lf em 4x70 auth --rnd 45F54ADA252AAC --frn 4866BB70 --> Test authentication, tag will respond if successful\n"
                  );
 
     void *argtable[] = {
@@ -340,7 +340,6 @@ int CmdEM4x70Auth(const char *Cmd) {
 
 int CmdEM4x70WritePIN(const char *Cmd) {
 
-    // send pin code to device, unlocking it for writing
     em4x70_data_t etd = {0};
 
     CLIParserContext *ctx;
@@ -395,6 +394,57 @@ int CmdEM4x70WritePIN(const char *Cmd) {
     return PM3_ESOFT;
 }
 
+int CmdEM4x70WriteKey(const char *Cmd) {
+
+    // Write new crypt key to tag
+    em4x70_data_t etd = {0};
+
+    CLIParserContext *ctx;
+
+    CLIParserInit(&ctx, "lf em 4x70 writekey",
+                  "Write new 96-bit key to tag\n",
+                  "lf em 4x70 writekey -k F32AA98CF5BE4ADFA6D3480B\n"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0(NULL, "par", "Add parity bit when sending commands"),
+        arg_str1("k",  "key", "<hex>", "Crypt Key as 12 hex bytes"),
+        arg_param_end
+    };
+
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    etd.parity = arg_get_lit(ctx, 1);
+
+    int key_len = 12;
+    CLIGetHexWithReturn(ctx, 2, etd.crypt_key, &key_len);
+
+    CLIParserFree(ctx);
+
+    if (key_len != 12) {
+        PrintAndLogEx(FAILED, "Crypt key length must be 12 bytes instead of %d", key_len);
+        return PM3_EINVARG;
+    }
+
+    clearCommandBuffer();
+    SendCommandNG(CMD_LF_EM4X70_WRITEKEY, (uint8_t *)&etd, sizeof(etd));
+
+    PacketResponseNG resp;
+    if (!WaitForResponseTimeout(CMD_LF_EM4X70_WRITEKEY, &resp, TIMEOUT)) {
+        PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
+        return PM3_ETIMEOUT;
+    }
+
+    if (resp.status) {
+        PrintAndLogEx(INFO, "Writing new crypt key: " _GREEN_("SUCCESS"));
+        return PM3_SUCCESS;
+    }
+
+    PrintAndLogEx(FAILED, "Writing new crypt key: " _RED_("FAILED"));
+    return PM3_ESOFT;
+}
+
 static command_t CommandTable[] = {
     {"help",     CmdHelp,           AlwaysAvailable, "This help"},
     {"info",     CmdEM4x70Info,     IfPm3EM4x70,     "Tag information EM4x70"},
@@ -402,6 +452,7 @@ static command_t CommandTable[] = {
     {"unlock",   CmdEM4x70Unlock,   IfPm3EM4x70,     "Unlock EM4x70 for writing"},
     {"auth",     CmdEM4x70Auth,     IfPm3EM4x70,     "Authenticate EM4x70"},
     {"writepin", CmdEM4x70WritePIN, IfPm3EM4x70,     "Write PIN"},
+    {"writekey", CmdEM4x70WriteKey, IfPm3EM4x70,     "Write Crypt Key"},
     {NULL, NULL, NULL, NULL}
 };
 
diff --git a/client/src/cmdlfem4x70.h b/client/src/cmdlfem4x70.h
index 09a9b9361..f0f221b06 100644
--- a/client/src/cmdlfem4x70.h
+++ b/client/src/cmdlfem4x70.h
@@ -22,6 +22,7 @@ int CmdEM4x70Write(const char *Cmd);
 int CmdEM4x70Unlock(const char *Cmd);
 int CmdEM4x70Auth(const char *Cmd);
 int CmdEM4x70WritePIN(const char *Cmd);
+int CmdEM4x70WriteKey(const char *Cmd);
 
 int em4x70_info(void);
 bool detect_4x70_block(void);
diff --git a/include/em4x70.h b/include/em4x70.h
index 4d08d622b..183e7398d 100644
--- a/include/em4x70.h
+++ b/include/em4x70.h
@@ -31,6 +31,9 @@ typedef struct {
     uint8_t rnd[7];
     uint8_t frnd[4];
 
+    // Used to write new key
+    uint8_t crypt_key[12];
+
 } em4x70_data_t;
 
 #endif /* EM4X70_H__ */
diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h
index 0249d15a7..e3dc29aee 100644
--- a/include/pm3_cmd.h
+++ b/include/pm3_cmd.h
@@ -521,6 +521,7 @@ typedef struct {
 #define CMD_LF_EM4X70_UNLOCK                                              0x0262
 #define CMD_LF_EM4X70_AUTH                                                0x0263
 #define CMD_LF_EM4X70_WRITEPIN                                            0x0264
+#define CMD_LF_EM4X70_WRITEKEY                                            0x0265
 // Sampling configuration for LF reader/sniffer
 #define CMD_LF_SAMPLING_SET_CONFIG                                        0x021D
 #define CMD_LF_FSK_SIMULATE                                               0x021E

From c7e56481648ce5f13f03536fa2d9e801ba76b1de Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 15 Dec 2020 21:35:21 +0100
Subject: [PATCH 077/682] maur default key

---
 client/dictionaries/mfdes_default_keys.dic | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/client/dictionaries/mfdes_default_keys.dic b/client/dictionaries/mfdes_default_keys.dic
index 4c863c3f5..a26d13d32 100644
--- a/client/dictionaries/mfdes_default_keys.dic
+++ b/client/dictionaries/mfdes_default_keys.dic
@@ -8,6 +8,7 @@
 43464F494D48504E4C4359454E528841                    #NHIF
 6AC292FAA1315B4D858AB3A3D7D5933A
 404142434445464748494a4b4c4d4e4f
+3112B738D8862CCD34302EB299AAB456                  # Gallagher AES (https://pastebin.com/GkbGLz8r)
 00112233445566778899aabbccddeeff
 2b7e151628aed2a6abf7158809cf4f3c
 fbeed618357133667c85e08f7236a8de
@@ -43,4 +44,4 @@ eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
 404142434445464748494a4b4c4d4e4f
 303132333435363738393a3b3c3d3e3f
 9CABF398358405AE2F0E2B3D31C99A8A              # Default key
-605F5E5D5C5B5A59605F5E5D5C5B5A59              # access control
\ No newline at end of file
+605F5E5D5C5B5A59605F5E5D5C5B5A59              # access control

From 84873aa3cfa3d31951f7a8b8ccb042d02534c8a3 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 15 Dec 2020 17:17:54 +0300
Subject: [PATCH 078/682] emrtd: pad document number

---
 client/src/cmdhfemrtd.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index ea90fa433..7637541d7 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -221,6 +221,12 @@ static void des3_decrypt_cbc(uint8_t *iv, uint8_t *key, uint8_t *input, int inpu
     mbedtls_des3_free(&ctx);
 }
 
+static void emrtd_pad_docnum(char *input) {
+    for (int i = strlen(input); i < 9; i++) {
+        input[i] = '<';
+    }
+}
+
 static int pad_block(uint8_t *input, int inputlen, uint8_t *output) {
     uint8_t padding[8] = {0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
 
@@ -834,6 +840,8 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     bool BAC = false;
     bool use_14b = false;
 
+    emrtd_pad_docnum(documentnumber);
+
     // Try to 14a
     SendCommandMIX(CMD_HF_ISO14443A_READER, ISO14A_CONNECT | ISO14A_NO_DISCONNECT, 0, 0, NULL, 0);
     PacketResponseNG resp;
@@ -960,7 +968,7 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
 
     void *argtable[] = {
         arg_param_begin,
-        arg_str0("n", "documentnumber", "<alphanum>", "9 character document number"),
+        arg_str0("n", "documentnumber", "<alphanum>", "document number, up to 9 chars"),
         arg_str0("d", "dateofbirth", "<YYMMDD>", "date of birth in YYMMDD format"),
         arg_str0("e", "expiry", "<YYMMDD>", "expiry in YYMMDD format"),
         arg_param_end

From ac3392402fee65bdbdd17588d1b6c5f884031fc3 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Wed, 16 Dec 2020 22:18:14 +0300
Subject: [PATCH 079/682] emrtd: Split auth into a separate function

This is done to prepare for info command
---
 client/src/cmdhfemrtd.c | 68 +++++++++++++++++++++++------------------
 1 file changed, 38 insertions(+), 30 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 7637541d7..2251ddac8 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -797,7 +797,7 @@ static bool emrtd_do_bac(char *documentnumber, char *dob, char *expiry, uint8_t
         PrintAndLogEx(ERR, "Couldn't do external authentication. Did you supply the correct MRZ info?");
         return false;
     }
-    PrintAndLogEx(INFO, "External authentication successful.");
+    PrintAndLogEx(INFO, "External authentication with BAC successful.");
 
     uint8_t dec_output[32] = { 0x00 };
     des3_decrypt_cbc(iv, kenc, response, 32, dec_output);
@@ -831,14 +831,9 @@ static bool emrtd_do_bac(char *documentnumber, char *dob, char *expiry, uint8_t
     return true;
 }
 
-int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available) {
+static bool emrtd_do_auth(char *documentnumber, char *dob, char *expiry, bool BAC_available, bool *BAC, uint8_t *ssc, uint8_t *ks_enc, uint8_t *ks_mac, bool *use_14b) {
     uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     int resplen = 0;
-    uint8_t ssc[8] = { 0x00 };
-    uint8_t ks_enc[16] = { 0x00 };
-    uint8_t ks_mac[16] = { 0x00 };
-    bool BAC = false;
-    bool use_14b = false;
 
     emrtd_pad_docnum(documentnumber);
 
@@ -856,22 +851,20 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         // If not 14a, try to 14b
         SendCommandMIX(CMD_HF_ISO14443B_COMMAND, ISO14B_CONNECT | ISO14B_SELECT_STD, 0, 0, NULL, 0);
         if (!WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, 2500)) {
-            DropField();
             PrintAndLogEx(INFO, "No eMRTD spotted with 14b, exiting.");
-            return PM3_ESOFT;
+            return false;
         }
 
         if (resp.oldarg[0] != 0) {
-            DropField();
             PrintAndLogEx(INFO, "No eMRTD spotted with 14b, exiting.");
-            return PM3_ESOFT;
+            return false;
         }
-        use_14b = true;
+        *use_14b = true;
     }
 
     // Select and read EF_CardAccess
-    if (emrtd_select_file(EMRTD_P1_SELECT_BY_EF, EMRTD_EF_CARDACCESS, use_14b)) {
-        emrtd_read_file(response, &resplen, NULL, NULL, NULL, false, use_14b);
+    if (emrtd_select_file(EMRTD_P1_SELECT_BY_EF, EMRTD_EF_CARDACCESS, *use_14b)) {
+        emrtd_read_file(response, &resplen, NULL, NULL, NULL, false, *use_14b);
         PrintAndLogEx(INFO, "Read EF_CardAccess, len: %i.", resplen);
         PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
     } else {
@@ -879,46 +872,61 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     }
 
     // Select MRTD applet
-    if (emrtd_select_file(EMRTD_P1_SELECT_BY_NAME, EMRTD_AID_MRTD, use_14b) == false) {
+    if (emrtd_select_file(EMRTD_P1_SELECT_BY_NAME, EMRTD_AID_MRTD, *use_14b) == false) {
         PrintAndLogEx(ERR, "Couldn't select the MRTD application.");
-        DropField();
-        return PM3_ESOFT;
+        return false;
     }
 
     // Select EF_COM
-    if (emrtd_select_file(EMRTD_P1_SELECT_BY_EF, EMRTD_EF_COM, use_14b) == false) {
-        BAC = true;
+    if (emrtd_select_file(EMRTD_P1_SELECT_BY_EF, EMRTD_EF_COM, *use_14b) == false) {
+        *BAC = true;
         PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt external authentication.");
     } else {
-        BAC = false;
+        *BAC = false;
         // Select EF_DG1
-        emrtd_select_file(EMRTD_P1_SELECT_BY_EF, EMRTD_EF_DG1, use_14b);
+        emrtd_select_file(EMRTD_P1_SELECT_BY_EF, EMRTD_EF_DG1, *use_14b);
 
-        if (emrtd_read_file(response, &resplen, NULL, NULL, NULL, false, use_14b) == false) {
-            BAC = true;
+        if (emrtd_read_file(response, &resplen, NULL, NULL, NULL, false, *use_14b) == false) {
+            *BAC = true;
             PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt external authentication.");
         } else {
-            BAC = false;
+            *BAC = false;
             PrintAndLogEx(INFO, "EF_DG1: %s", sprint_hex(response, resplen));
         }
     }
 
     // Do Basic Access Aontrol
-    if (BAC) {
+    if (*BAC) {
         // If BAC isn't available, exit out and warn user.
         if (!BAC_available) {
             PrintAndLogEx(ERR, "This eMRTD enforces Basic Access Control, but you didn't supplied MRZ data. Cannot proceed.");
             PrintAndLogEx(HINT, "Check out hf emrtd dump --help, supply data with -n -d and -e.");
-            DropField();
-            return PM3_ESOFT;
+            return false;
         }
 
-        if (emrtd_do_bac(documentnumber, dob, expiry, ssc, ks_enc, ks_mac, use_14b) == false) {
-            DropField();
-            return PM3_ESOFT;
+        if (emrtd_do_bac(documentnumber, dob, expiry, ssc, ks_enc, ks_mac, *use_14b) == false) {
+            return false;
         }
     }
 
+    return true;
+}
+
+int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available) {
+    uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    int resplen = 0;
+    uint8_t ssc[8] = { 0x00 };
+    uint8_t ks_enc[16] = { 0x00 };
+    uint8_t ks_mac[16] = { 0x00 };
+    bool BAC = false;
+    bool use_14b = false;
+
+    // Select and authenticate with the eMRTD
+    if (emrtd_do_auth(documentnumber, dob, expiry, BAC_available, &BAC, ssc, ks_enc, ks_mac, &use_14b) == false) {
+        DropField();
+        return PM3_ESOFT;
+    }
+
     // Select EF_COM
     if (emrtd_select_and_read(response, &resplen, EMRTD_EF_COM, ks_enc, ks_mac, ssc, BAC, use_14b) == false) {
         PrintAndLogEx(ERR, "Failed to read EF_COM.");

From daaa3578ecb247a77385bf3d09e7bee713187d40 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Wed, 16 Dec 2020 20:44:04 +0100
Subject: [PATCH 080/682] replaced hardcoded values

---
 armsrc/em4x50.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index 36923b6a5..a73d8c5dc 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -45,6 +45,7 @@
 
 #define EM4X50_TAG_TOLERANCE                8
 #define EM4X50_TAG_WORD                     45
+#define EM4X50_TAG_MAX_NO_BYTES             136
 
 #define EM4X50_COMMAND_LOGIN                0x01
 #define EM4X50_COMMAND_RESET                0x80
@@ -1015,8 +1016,7 @@ void em4x50_read(em4x50_data_t *etd) {
     LOW(GPIO_SSC_DOUT);
     lf_finalize();
 
-    // iceman:  this hardcoded 136 value....
-    reply_ng(CMD_LF_EM4X50_READ, status, (uint8_t *)words, 136);
+    reply_ng(CMD_LF_EM4X50_READ, status, (uint8_t *)words, EM4X50_TAG_MAX_NO_BYTES);
 }
 
 // collects as much information as possible via selective read mode
@@ -1041,8 +1041,7 @@ void em4x50_info(em4x50_data_t *etd) {
 
     lf_finalize();
 
-    // iceman:  this hardcoded 136 value....
-    reply_ng(CMD_LF_EM4X50_INFO, status, (uint8_t *)words, 136);
+    reply_ng(CMD_LF_EM4X50_INFO, status, (uint8_t *)words, EM4X50_TAG_MAX_NO_BYTES);
 }
 
 // reads data that tag transmits "voluntarily" -> standard read mode
@@ -1193,7 +1192,7 @@ void em4x50_write(em4x50_data_t *etd) {
     }
 
     lf_finalize();
-    reply_ng(CMD_LF_EM4X50_WRITE, status, (uint8_t *)words, 136);
+    reply_ng(CMD_LF_EM4X50_WRITE, status, (uint8_t *)words, EM4X50_TAG_MAX_NO_BYTES);
 }
 
 // simple change of password

From 503e48d409e8dc353cc65a55f0acdf07d49fa4da Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Wed, 16 Dec 2020 23:53:40 +0300
Subject: [PATCH 081/682] emrtd: Start work on the hf emrtd info command

---
 client/src/cmdhfemrtd.c | 69 ++++++++++++++++++++++++++++++++++++++++-
 client/src/cmdhfemrtd.h |  1 +
 2 files changed, 69 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 2251ddac8..f0f238615 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -899,7 +899,7 @@ static bool emrtd_do_auth(char *documentnumber, char *dob, char *expiry, bool BA
     if (*BAC) {
         // If BAC isn't available, exit out and warn user.
         if (!BAC_available) {
-            PrintAndLogEx(ERR, "This eMRTD enforces Basic Access Control, but you didn't supplied MRZ data. Cannot proceed.");
+            PrintAndLogEx(ERR, "This eMRTD enforces Basic Access Control, but you didn't supply MRZ data. Cannot proceed.");
             PrintAndLogEx(HINT, "Check out hf emrtd dump --help, supply data with -n -d and -e.");
             return false;
         }
@@ -967,6 +967,38 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     return PM3_SUCCESS;
 }
 
+int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available) {
+    // TODO: support just loading a dump file
+    uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    int resplen = 0;
+    uint8_t ssc[8] = { 0x00 };
+    uint8_t ks_enc[16] = { 0x00 };
+    uint8_t ks_mac[16] = { 0x00 };
+    bool BAC = false;
+    bool use_14b = false;
+
+    // Select and authenticate with the eMRTD
+    bool auth_result = emrtd_do_auth(documentnumber, dob, expiry, BAC_available, &BAC, ssc, ks_enc, ks_mac, &use_14b);
+    PrintAndLogEx(SUCCESS, "Communication standard: %s", use_14b ? _YELLOW_("ISO/IEC 14443(B)") : _YELLOW_("ISO/IEC 14443(A)"));
+    PrintAndLogEx(SUCCESS, "BAC: %s", BAC ? _GREEN_("Enforced") : _RED_("Not enforced"));
+    PrintAndLogEx(SUCCESS, "Authentication result: %s", auth_result ? _GREEN_("Successful") : _RED_("Failed"));
+
+    if (!auth_result) {
+        DropField();
+        return PM3_ESOFT;
+    }
+
+    // Select EF_DG1
+    if (emrtd_select_and_read(response, &resplen, EMRTD_EF_DG1, ks_enc, ks_mac, ssc, BAC, use_14b) == false) {
+        PrintAndLogEx(ERR, "Failed to read EF_DG1.");
+        DropField();
+        return PM3_ESOFT;
+    }
+
+    DropField();
+    return PM3_SUCCESS;
+}
+
 static int cmd_hf_emrtd_dump(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf emrtd dump",
@@ -1001,6 +1033,40 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
     return dumpHF_EMRTD((char *)docnum, (char *)dob, (char *)expiry, BAC);
 }
 
+static int cmd_hf_emrtd_info(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf emrtd info",
+                  "Display info about an eMRTD",
+                  "hf emrtd info"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("n", "documentnumber", "<alphanum>", "document number, up to 9 chars"),
+        arg_str0("d", "dateofbirth", "<YYMMDD>", "date of birth in YYMMDD format"),
+        arg_str0("e", "expiry", "<YYMMDD>", "expiry in YYMMDD format"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    uint8_t docnum[10] = { 0x00 };
+    uint8_t dob[7] = { 0x00 };
+    uint8_t expiry[7] = { 0x00 };
+    bool BAC = true;
+    int slen = 0;  // unused
+    // Go through all args, if even one isn't supplied, mark BAC as unavailable
+    if (CLIParamStrToBuf(arg_get_str(ctx, 1), docnum, 9, &slen) != 0 || slen == 0) {
+        BAC = false;
+    } else if (CLIParamStrToBuf(arg_get_str(ctx, 2), dob, 6, &slen) != 0 || slen == 0) {
+        BAC = false;
+    } else if (CLIParamStrToBuf(arg_get_str(ctx, 3), expiry, 6, &slen) != 0 || slen == 0) {
+        BAC = false;
+    }
+
+    CLIParserFree(ctx);
+    return infoHF_EMRTD((char *)docnum, (char *)dob, (char *)expiry, BAC);
+}
+
 static int cmd_hf_emrtd_list(const char *Cmd) {
     char args[128] = {0};
     if (strlen(Cmd) == 0) {
@@ -1014,6 +1080,7 @@ static int cmd_hf_emrtd_list(const char *Cmd) {
 static command_t CommandTable[] = {
     {"help",    CmdHelp,           AlwaysAvailable, "This help"},
     {"dump",    cmd_hf_emrtd_dump, IfPm3Iso14443,   "Dump eMRTD files to binary files"},
+    {"info",    cmd_hf_emrtd_info, IfPm3Iso14443,   "Display info about an eMRTD"},
     {"list",    cmd_hf_emrtd_list, AlwaysAvailable, "List ISO 14443A/7816 history"},
     {NULL, NULL, NULL, NULL}
 };
diff --git a/client/src/cmdhfemrtd.h b/client/src/cmdhfemrtd.h
index 84500fc8b..f19a71ac0 100644
--- a/client/src/cmdhfemrtd.h
+++ b/client/src/cmdhfemrtd.h
@@ -16,4 +16,5 @@
 int CmdHFeMRTD(const char *Cmd);
 
 int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available);
+int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available);
 #endif

From 4b9ffef63a30751d329277584a5e535ef5a2d2bc Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 17 Dec 2020 00:00:26 +0100
Subject: [PATCH 082/682] change 14b apdu - longer timeout,   emrt now autopad
 too short document numbers

---
 client/src/cmdhf14b.c   |  3 +-
 client/src/cmdhfemrtd.c | 61 +++++++++++++++++++++++------------------
 2 files changed, 36 insertions(+), 28 deletions(-)

diff --git a/client/src/cmdhf14b.c b/client/src/cmdhf14b.c
index eb1a4f67a..e21509fe8 100644
--- a/client/src/cmdhf14b.c
+++ b/client/src/cmdhf14b.c
@@ -26,6 +26,7 @@
 #include "mifare/ndef.h"   // NDEFRecordsDecodeAndPrint
 
 #define TIMEOUT 2000
+#define APDU_TIMEOUT 4000
 
 // iso14b apdu input frame length
 static uint16_t apdu_frame_length = 0;
@@ -1438,7 +1439,7 @@ static int handle_14b_apdu(bool chainingin, uint8_t *datain, int datainlen, bool
         SendCommandMIX(CMD_HF_ISO14443B_COMMAND, ISO14B_APDU | flags, 0, 0, NULL, 0);
 
     PacketResponseNG resp;
-    if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, TIMEOUT)) {
+    if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, APDU_TIMEOUT)) {
         uint8_t *recv = resp.data.asBytes;
         int rlen = resp.oldarg[0];
         uint8_t res = resp.oldarg[1];
diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index ea90fa433..926124225 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -274,24 +274,24 @@ static void retail_mac(uint8_t *key, uint8_t *input, int inputlen, uint8_t *outp
 }
 
 static void emrtd_deskey(uint8_t *seed, const uint8_t *type, int length, uint8_t *dataout) {
-    PrintAndLogEx(DEBUG, "seed: %s", sprint_hex_inrow(seed, 16));
+    PrintAndLogEx(DEBUG, "seed.............. %s", sprint_hex_inrow(seed, 16));
 
     // combine seed and type
     uint8_t data[50];
     memcpy(data, seed, length);
     memcpy(data + length, type, 4);
-    PrintAndLogEx(DEBUG, "data: %s", sprint_hex_inrow(data, length + 4));
+    PrintAndLogEx(DEBUG, "data.............. %s", sprint_hex_inrow(data, length + 4));
 
     // SHA1 the key
     unsigned char key[64];
     mbedtls_sha1(data, length + 4, key);
-    PrintAndLogEx(DEBUG, "key: %s", sprint_hex_inrow(key, length + 4));
+    PrintAndLogEx(DEBUG, "key............... %s", sprint_hex_inrow(key, length + 4));
 
     // Set parity bits
     for (int i = 0; i < ((length + 4) / 8); i++) {
         mbedtls_des_key_set_parity(key + (i * 8));
     }
-    PrintAndLogEx(DEBUG, "post-parity key: %s", sprint_hex_inrow(key, 20));
+    PrintAndLogEx(DEBUG, "post-parity key... %s", sprint_hex_inrow(key, 20));
 
     memcpy(dataout, &key, length);
 }
@@ -314,9 +314,7 @@ static int emrtd_get_challenge(int length, uint8_t *dataout, int *dataoutlen, bo
 
 static int emrtd_external_authenticate(uint8_t *data, int length, uint8_t *dataout, int *dataoutlen, bool use_14b) {
     char cmd[100];
-
     sprintf(cmd, "00%s0000%02X%s%02X", EMRTD_EXTERNAL_AUTHENTICATE, length, sprint_hex_inrow(data, length), length);
-
     return emrtd_exchange_commands(cmd, dataout, dataoutlen, false, true, use_14b);
 }
 
@@ -718,9 +716,10 @@ static bool emrtd_dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, cons
 
 static void rng(int length, uint8_t *dataout) {
     // Do very very secure prng operations
-    for (int i = 0; i < (length / 4); i++) {
-        num_to_bytes(prng_successor(msclock() + i, 32), 4, &dataout[i * 4]);
-    }
+    //for (int i = 0; i < (length / 4); i++) {
+    //    num_to_bytes(prng_successor(msclock() + i, 32), 4, &dataout[i * 4]);
+    //}
+    memset(dataout, 0x00, length);   
 }
 
 static bool emrtd_do_bac(char *documentnumber, char *dob, char *expiry, uint8_t *ssc, uint8_t *ks_enc, uint8_t *ks_mac, bool use_14b) {
@@ -737,9 +736,9 @@ static bool emrtd_do_bac(char *documentnumber, char *dob, char *expiry, uint8_t
     rng(8, rnd_ifd);
     rng(16, k_ifd);
 
-    PrintAndLogEx(DEBUG, "doc: %s", documentnumber);
-    PrintAndLogEx(DEBUG, "dob: %s", dob);
-    PrintAndLogEx(DEBUG, "exp: %s", expiry);
+    PrintAndLogEx(DEBUG, "doc............... " _GREEN_("%s"), documentnumber);
+    PrintAndLogEx(DEBUG, "dob............... " _GREEN_("%s"), dob);
+    PrintAndLogEx(DEBUG, "exp............... " _GREEN_("%s"), expiry);
 
     char documentnumbercd = emrtd_calculate_check_digit(documentnumber);
     char dobcd = emrtd_calculate_check_digit(dob);
@@ -747,40 +746,40 @@ static bool emrtd_do_bac(char *documentnumber, char *dob, char *expiry, uint8_t
 
     char kmrz[25];
     sprintf(kmrz, "%s%i%s%i%s%i", documentnumber, documentnumbercd, dob, dobcd, expiry, expirycd);
-    PrintAndLogEx(DEBUG, "kmrz: %s", kmrz);
+    PrintAndLogEx(DEBUG, "kmrz.............. " _GREEN_("%s"), kmrz);
 
     uint8_t kseed[16] = { 0x00 };
     mbedtls_sha1((unsigned char *)kmrz, strlen(kmrz), kseed);
-    PrintAndLogEx(DEBUG, "kseed: %s", sprint_hex_inrow(kseed, 16));
+    PrintAndLogEx(DEBUG, "kseed (sha1)...... %s ", sprint_hex_inrow(kseed, 16));
 
     emrtd_deskey(kseed, KENC_type, 16, kenc);
     emrtd_deskey(kseed, KMAC_type, 16, kmac);
-    PrintAndLogEx(DEBUG, "kenc: %s", sprint_hex_inrow(kenc, 16));
-    PrintAndLogEx(DEBUG, "kmac: %s", sprint_hex_inrow(kmac, 16));
+    PrintAndLogEx(DEBUG, "kenc.............. %s", sprint_hex_inrow(kenc, 16));
+    PrintAndLogEx(DEBUG, "kmac.............. %s", sprint_hex_inrow(kmac, 16));
 
     // Get Challenge
     if (emrtd_get_challenge(8, rnd_ic, &resplen, use_14b) == false) {
         PrintAndLogEx(ERR, "Couldn't get challenge.");
         return false;
     }
-    PrintAndLogEx(DEBUG, "rnd_ic: %s", sprint_hex_inrow(rnd_ic, 8));
+    PrintAndLogEx(DEBUG, "rnd_ic............ %s", sprint_hex_inrow(rnd_ic, 8));
 
     memcpy(S, rnd_ifd, 8);
     memcpy(S + 8, rnd_ic, 8);
     memcpy(S + 16, k_ifd, 16);
 
-    PrintAndLogEx(DEBUG, "S: %s", sprint_hex_inrow(S, 32));
+    PrintAndLogEx(DEBUG, "S................. %s", sprint_hex_inrow(S, 32));
 
     uint8_t iv[8] = { 0x00 };
     uint8_t e_ifd[32] = { 0x00 };
 
     des3_encrypt_cbc(iv, kenc, S, sizeof(S), e_ifd);
-    PrintAndLogEx(DEBUG, "e_ifd: %s", sprint_hex_inrow(e_ifd, 32));
+    PrintAndLogEx(DEBUG, "e_ifd............. %s", sprint_hex_inrow(e_ifd, 32));
 
     uint8_t m_ifd[8] = { 0x00 };
 
     retail_mac(kmac, e_ifd, 32, m_ifd);
-    PrintAndLogEx(DEBUG, "m_ifd: %s", sprint_hex_inrow(m_ifd, 8));
+    PrintAndLogEx(DEBUG, "m_ifd............. %s", sprint_hex_inrow(m_ifd, 8));
 
     uint8_t cmd_data[40];
     memcpy(cmd_data, e_ifd, 32);
@@ -795,7 +794,7 @@ static bool emrtd_do_bac(char *documentnumber, char *dob, char *expiry, uint8_t
 
     uint8_t dec_output[32] = { 0x00 };
     des3_decrypt_cbc(iv, kenc, response, 32, dec_output);
-    PrintAndLogEx(DEBUG, "dec_output: %s", sprint_hex_inrow(dec_output, 32));
+    PrintAndLogEx(DEBUG, "dec_output........ %s", sprint_hex_inrow(dec_output, 32));
 
     if (memcmp(rnd_ifd, dec_output + 8, 8) != 0) {
         PrintAndLogEx(ERR, "Challenge failed, rnd_ifd does not match.");
@@ -809,18 +808,18 @@ static bool emrtd_do_bac(char *documentnumber, char *dob, char *expiry, uint8_t
         kseed[x] = k_ifd[x] ^ k_icc[x];
     }
 
-    PrintAndLogEx(DEBUG, "kseed: %s", sprint_hex_inrow(kseed, 16));
+    PrintAndLogEx(DEBUG, "kseed............ %s", sprint_hex_inrow(kseed, 16));
 
     emrtd_deskey(kseed, KENC_type, 16, ks_enc);
     emrtd_deskey(kseed, KMAC_type, 16, ks_mac);
 
-    PrintAndLogEx(DEBUG, "ks_enc: %s", sprint_hex_inrow(ks_enc, 16));
-    PrintAndLogEx(DEBUG, "ks_mac: %s", sprint_hex_inrow(ks_mac, 16));
+    PrintAndLogEx(DEBUG, "ks_enc........ %s", sprint_hex_inrow(ks_enc, 16));
+    PrintAndLogEx(DEBUG, "ks_mac........ %s", sprint_hex_inrow(ks_mac, 16));
 
     memcpy(ssc, rnd_ic + 4, 4);
     memcpy(ssc + 4, rnd_ifd + 4, 4);
 
-    PrintAndLogEx(DEBUG, "ssc: %s", sprint_hex_inrow(ssc, 8));
+    PrintAndLogEx(DEBUG, "ssc........... %s", sprint_hex_inrow(ssc, 8));
 
     return true;
 }
@@ -975,9 +974,17 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
     // Go through all args, if even one isn't supplied, mark BAC as unavailable
     if (CLIParamStrToBuf(arg_get_str(ctx, 1), docnum, 9, &slen) != 0 || slen == 0) {
         BAC = false;
-    } else if (CLIParamStrToBuf(arg_get_str(ctx, 2), dob, 6, &slen) != 0 || slen == 0) {
+    } else {
+        if ( slen != 9) {
+            memset(docnum + slen, 0x3c, 9 - slen);
+        }
+    }
+    
+    if (CLIParamStrToBuf(arg_get_str(ctx, 2), dob, 6, &slen) != 0 || slen == 0) {
         BAC = false;
-    } else if (CLIParamStrToBuf(arg_get_str(ctx, 3), expiry, 6, &slen) != 0 || slen == 0) {
+    } 
+    
+    if (CLIParamStrToBuf(arg_get_str(ctx, 3), expiry, 6, &slen) != 0 || slen == 0) {
         BAC = false;
     }
 

From 76da4ce427c08999640906a99575d3bec41c88f0 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 17 Dec 2020 00:00:26 +0100
Subject: [PATCH 083/682] change 14b apdu - longer timeout, emrt now autopad
 too short document numbers

---
 client/src/cmdhf14b.c   |  3 +-
 client/src/cmdhfemrtd.c | 61 +++++++++++++++++++++++------------------
 2 files changed, 36 insertions(+), 28 deletions(-)

diff --git a/client/src/cmdhf14b.c b/client/src/cmdhf14b.c
index eb1a4f67a..e21509fe8 100644
--- a/client/src/cmdhf14b.c
+++ b/client/src/cmdhf14b.c
@@ -26,6 +26,7 @@
 #include "mifare/ndef.h"   // NDEFRecordsDecodeAndPrint
 
 #define TIMEOUT 2000
+#define APDU_TIMEOUT 4000
 
 // iso14b apdu input frame length
 static uint16_t apdu_frame_length = 0;
@@ -1438,7 +1439,7 @@ static int handle_14b_apdu(bool chainingin, uint8_t *datain, int datainlen, bool
         SendCommandMIX(CMD_HF_ISO14443B_COMMAND, ISO14B_APDU | flags, 0, 0, NULL, 0);
 
     PacketResponseNG resp;
-    if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, TIMEOUT)) {
+    if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, APDU_TIMEOUT)) {
         uint8_t *recv = resp.data.asBytes;
         int rlen = resp.oldarg[0];
         uint8_t res = resp.oldarg[1];
diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index f0f238615..1781fbb41 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -280,24 +280,24 @@ static void retail_mac(uint8_t *key, uint8_t *input, int inputlen, uint8_t *outp
 }
 
 static void emrtd_deskey(uint8_t *seed, const uint8_t *type, int length, uint8_t *dataout) {
-    PrintAndLogEx(DEBUG, "seed: %s", sprint_hex_inrow(seed, 16));
+    PrintAndLogEx(DEBUG, "seed.............. %s", sprint_hex_inrow(seed, 16));
 
     // combine seed and type
     uint8_t data[50];
     memcpy(data, seed, length);
     memcpy(data + length, type, 4);
-    PrintAndLogEx(DEBUG, "data: %s", sprint_hex_inrow(data, length + 4));
+    PrintAndLogEx(DEBUG, "data.............. %s", sprint_hex_inrow(data, length + 4));
 
     // SHA1 the key
     unsigned char key[64];
     mbedtls_sha1(data, length + 4, key);
-    PrintAndLogEx(DEBUG, "key: %s", sprint_hex_inrow(key, length + 4));
+    PrintAndLogEx(DEBUG, "key............... %s", sprint_hex_inrow(key, length + 4));
 
     // Set parity bits
     for (int i = 0; i < ((length + 4) / 8); i++) {
         mbedtls_des_key_set_parity(key + (i * 8));
     }
-    PrintAndLogEx(DEBUG, "post-parity key: %s", sprint_hex_inrow(key, 20));
+    PrintAndLogEx(DEBUG, "post-parity key... %s", sprint_hex_inrow(key, 20));
 
     memcpy(dataout, &key, length);
 }
@@ -320,9 +320,7 @@ static int emrtd_get_challenge(int length, uint8_t *dataout, int *dataoutlen, bo
 
 static int emrtd_external_authenticate(uint8_t *data, int length, uint8_t *dataout, int *dataoutlen, bool use_14b) {
     char cmd[100];
-
     sprintf(cmd, "00%s0000%02X%s%02X", EMRTD_EXTERNAL_AUTHENTICATE, length, sprint_hex_inrow(data, length), length);
-
     return emrtd_exchange_commands(cmd, dataout, dataoutlen, false, true, use_14b);
 }
 
@@ -724,9 +722,10 @@ static bool emrtd_dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, cons
 
 static void rng(int length, uint8_t *dataout) {
     // Do very very secure prng operations
-    for (int i = 0; i < (length / 4); i++) {
-        num_to_bytes(prng_successor(msclock() + i, 32), 4, &dataout[i * 4]);
-    }
+    //for (int i = 0; i < (length / 4); i++) {
+    //    num_to_bytes(prng_successor(msclock() + i, 32), 4, &dataout[i * 4]);
+    //}
+    memset(dataout, 0x00, length);   
 }
 
 static bool emrtd_do_bac(char *documentnumber, char *dob, char *expiry, uint8_t *ssc, uint8_t *ks_enc, uint8_t *ks_mac, bool use_14b) {
@@ -743,9 +742,9 @@ static bool emrtd_do_bac(char *documentnumber, char *dob, char *expiry, uint8_t
     rng(8, rnd_ifd);
     rng(16, k_ifd);
 
-    PrintAndLogEx(DEBUG, "doc: %s", documentnumber);
-    PrintAndLogEx(DEBUG, "dob: %s", dob);
-    PrintAndLogEx(DEBUG, "exp: %s", expiry);
+    PrintAndLogEx(DEBUG, "doc............... " _GREEN_("%s"), documentnumber);
+    PrintAndLogEx(DEBUG, "dob............... " _GREEN_("%s"), dob);
+    PrintAndLogEx(DEBUG, "exp............... " _GREEN_("%s"), expiry);
 
     char documentnumbercd = emrtd_calculate_check_digit(documentnumber);
     char dobcd = emrtd_calculate_check_digit(dob);
@@ -753,40 +752,40 @@ static bool emrtd_do_bac(char *documentnumber, char *dob, char *expiry, uint8_t
 
     char kmrz[25];
     sprintf(kmrz, "%s%i%s%i%s%i", documentnumber, documentnumbercd, dob, dobcd, expiry, expirycd);
-    PrintAndLogEx(DEBUG, "kmrz: %s", kmrz);
+    PrintAndLogEx(DEBUG, "kmrz.............. " _GREEN_("%s"), kmrz);
 
     uint8_t kseed[16] = { 0x00 };
     mbedtls_sha1((unsigned char *)kmrz, strlen(kmrz), kseed);
-    PrintAndLogEx(DEBUG, "kseed: %s", sprint_hex_inrow(kseed, 16));
+    PrintAndLogEx(DEBUG, "kseed (sha1)...... %s ", sprint_hex_inrow(kseed, 16));
 
     emrtd_deskey(kseed, KENC_type, 16, kenc);
     emrtd_deskey(kseed, KMAC_type, 16, kmac);
-    PrintAndLogEx(DEBUG, "kenc: %s", sprint_hex_inrow(kenc, 16));
-    PrintAndLogEx(DEBUG, "kmac: %s", sprint_hex_inrow(kmac, 16));
+    PrintAndLogEx(DEBUG, "kenc.............. %s", sprint_hex_inrow(kenc, 16));
+    PrintAndLogEx(DEBUG, "kmac.............. %s", sprint_hex_inrow(kmac, 16));
 
     // Get Challenge
     if (emrtd_get_challenge(8, rnd_ic, &resplen, use_14b) == false) {
         PrintAndLogEx(ERR, "Couldn't get challenge.");
         return false;
     }
-    PrintAndLogEx(DEBUG, "rnd_ic: %s", sprint_hex_inrow(rnd_ic, 8));
+    PrintAndLogEx(DEBUG, "rnd_ic............ %s", sprint_hex_inrow(rnd_ic, 8));
 
     memcpy(S, rnd_ifd, 8);
     memcpy(S + 8, rnd_ic, 8);
     memcpy(S + 16, k_ifd, 16);
 
-    PrintAndLogEx(DEBUG, "S: %s", sprint_hex_inrow(S, 32));
+    PrintAndLogEx(DEBUG, "S................. %s", sprint_hex_inrow(S, 32));
 
     uint8_t iv[8] = { 0x00 };
     uint8_t e_ifd[32] = { 0x00 };
 
     des3_encrypt_cbc(iv, kenc, S, sizeof(S), e_ifd);
-    PrintAndLogEx(DEBUG, "e_ifd: %s", sprint_hex_inrow(e_ifd, 32));
+    PrintAndLogEx(DEBUG, "e_ifd............. %s", sprint_hex_inrow(e_ifd, 32));
 
     uint8_t m_ifd[8] = { 0x00 };
 
     retail_mac(kmac, e_ifd, 32, m_ifd);
-    PrintAndLogEx(DEBUG, "m_ifd: %s", sprint_hex_inrow(m_ifd, 8));
+    PrintAndLogEx(DEBUG, "m_ifd............. %s", sprint_hex_inrow(m_ifd, 8));
 
     uint8_t cmd_data[40];
     memcpy(cmd_data, e_ifd, 32);
@@ -801,7 +800,7 @@ static bool emrtd_do_bac(char *documentnumber, char *dob, char *expiry, uint8_t
 
     uint8_t dec_output[32] = { 0x00 };
     des3_decrypt_cbc(iv, kenc, response, 32, dec_output);
-    PrintAndLogEx(DEBUG, "dec_output: %s", sprint_hex_inrow(dec_output, 32));
+    PrintAndLogEx(DEBUG, "dec_output........ %s", sprint_hex_inrow(dec_output, 32));
 
     if (memcmp(rnd_ifd, dec_output + 8, 8) != 0) {
         PrintAndLogEx(ERR, "Challenge failed, rnd_ifd does not match.");
@@ -815,18 +814,18 @@ static bool emrtd_do_bac(char *documentnumber, char *dob, char *expiry, uint8_t
         kseed[x] = k_ifd[x] ^ k_icc[x];
     }
 
-    PrintAndLogEx(DEBUG, "kseed: %s", sprint_hex_inrow(kseed, 16));
+    PrintAndLogEx(DEBUG, "kseed............ %s", sprint_hex_inrow(kseed, 16));
 
     emrtd_deskey(kseed, KENC_type, 16, ks_enc);
     emrtd_deskey(kseed, KMAC_type, 16, ks_mac);
 
-    PrintAndLogEx(DEBUG, "ks_enc: %s", sprint_hex_inrow(ks_enc, 16));
-    PrintAndLogEx(DEBUG, "ks_mac: %s", sprint_hex_inrow(ks_mac, 16));
+    PrintAndLogEx(DEBUG, "ks_enc........ %s", sprint_hex_inrow(ks_enc, 16));
+    PrintAndLogEx(DEBUG, "ks_mac........ %s", sprint_hex_inrow(ks_mac, 16));
 
     memcpy(ssc, rnd_ic + 4, 4);
     memcpy(ssc + 4, rnd_ifd + 4, 4);
 
-    PrintAndLogEx(DEBUG, "ssc: %s", sprint_hex_inrow(ssc, 8));
+    PrintAndLogEx(DEBUG, "ssc........... %s", sprint_hex_inrow(ssc, 8));
 
     return true;
 }
@@ -1023,9 +1022,17 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
     // Go through all args, if even one isn't supplied, mark BAC as unavailable
     if (CLIParamStrToBuf(arg_get_str(ctx, 1), docnum, 9, &slen) != 0 || slen == 0) {
         BAC = false;
-    } else if (CLIParamStrToBuf(arg_get_str(ctx, 2), dob, 6, &slen) != 0 || slen == 0) {
+    } else {
+        if ( slen != 9) {
+            memset(docnum + slen, 0x3c, 9 - slen);
+        }
+    }
+    
+    if (CLIParamStrToBuf(arg_get_str(ctx, 2), dob, 6, &slen) != 0 || slen == 0) {
         BAC = false;
-    } else if (CLIParamStrToBuf(arg_get_str(ctx, 3), expiry, 6, &slen) != 0 || slen == 0) {
+    } 
+    
+    if (CLIParamStrToBuf(arg_get_str(ctx, 3), expiry, 6, &slen) != 0 || slen == 0) {
         BAC = false;
     }
 

From 9066aa1d261c6e77d728693a3b465c3be78b0e3d Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Thu, 17 Dec 2020 03:44:39 +0300
Subject: [PATCH 084/682] emrtd: Support passports on hf emrtd info

---
 client/src/cmdhfemrtd.c | 216 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 214 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 1781fbb41..f77cc6676 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -602,6 +602,35 @@ static bool emrtd_ef_com_get_file_list(uint8_t *datain, int *datainlen, uint8_t
     return false;
 }
 
+static bool emrtd_ef_dg1_get_mrz(uint8_t *datain, int *datainlen, uint8_t *dataout, int *dataoutlen) {
+    // TODO: combine with emrtd_ef_com_get_file_list
+    int offset = 2;
+    int elementidlen = 0;
+    int elementlen = 0;
+    while (offset < *datainlen) {
+        PrintAndLogEx(DEBUG, "emrtd_ef_dg1_get_mrz, offset: %i, data: %X", offset, *(datain + offset));
+        // Determine element ID length to set as offset on asn1datalength
+        if (*(datain + offset) == 0x5f) {
+            elementidlen = 2;
+        } else {
+            elementidlen = 1;
+        }
+
+        // Get the length of the element
+        elementlen = emrtd_get_asn1_data_length(datain + offset, *datainlen - offset, elementidlen);
+
+        // If the element is what we're looking for, get the data and return true
+        if (*(datain + offset) == 0x5f && *(datain + offset + 1) == 0x1f) {
+            *dataoutlen = elementlen;
+            memcpy(dataout, datain + offset + elementidlen + 1, elementlen);
+            return true;
+        }
+        offset += elementidlen + elementlen + 1;
+    }
+    // Return false if we can't find the relevant element
+    return false;
+}
+
 static bool emrtd_file_tag_to_file_id(uint8_t *datain, char *filenameout, char *dataout) {
     // imagine bothering with a hashmap or writing good code
     // couldn't be me
@@ -966,6 +995,135 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     return PM3_SUCCESS;
 }
 
+static bool emrtd_mrz_verify_check_digit(char *mrz, int offset, int datalen) {
+    char tempdata[90] = { 0x00 };
+    char calculated_check_digit[3];
+
+    memcpy(tempdata, mrz + offset, datalen);
+    int check_digit = emrtd_calculate_check_digit(tempdata);
+
+    sprintf(calculated_check_digit, "%i", check_digit);
+
+    PrintAndLogEx(DEBUG, "emrtd_mrz_verify_check_digit, expected: %c", mrz[offset + datalen]);
+    PrintAndLogEx(DEBUG, "emrtd_mrz_verify_check_digit, calculated: %c", calculated_check_digit[0]);
+
+    return calculated_check_digit[0] == mrz[offset + datalen];
+}
+
+static void emrtd_print_legal_sex(char *legal_sex) {
+    char sex[12] = { 0x00 };
+    switch (*legal_sex) {
+        case 'M':
+            strncpy(sex, "Male", 5);
+            break;
+        case 'F':
+            strncpy(sex, "Female", 7);
+            break;
+        case '<':
+            strncpy(sex, "Unspecified", 12);
+            break;
+    }
+    PrintAndLogEx(SUCCESS, "Legal Sex Marker......: " _YELLOW_("%s"), sex);
+}
+
+static int emrtd_mrz_determine_length(char *mrz, int offset, int max_length) {
+    int i;
+    for (i = max_length; i >= 0; i--) {
+        if (mrz[offset + i - 1] != '<') {
+            break;
+        }
+    }
+    return i;
+}
+
+static int emrtd_mrz_determine_separator(char *mrz, int offset, int max_length) {
+    int i;
+    for (i = max_length; i >= 0; i--) {
+        if (mrz[offset + i - 1] == '<' && mrz[offset + i] == '<') {
+            break;
+        }
+    }
+    return i - 1;
+}
+
+static void emrtd_print_optional_elements(char *mrz, int offset) {
+    int i = emrtd_mrz_determine_length(mrz, offset, 14);
+
+    // Only print optional elements if they're available
+    if (i != 0) {
+        PrintAndLogEx(SUCCESS, "Optional elements.....: " _YELLOW_("%.*s"), i, mrz + offset);
+    }
+
+    if (!emrtd_mrz_verify_check_digit(mrz, offset, 14)) {
+        PrintAndLogEx(SUCCESS, _RED_("Optional element check digit is invalid."));
+    }
+}
+
+static void emrtd_print_passport_number(char *mrz, int offset) {
+    int i = emrtd_mrz_determine_length(mrz, offset, 9);
+
+    PrintAndLogEx(SUCCESS, "Passport Number.......: " _YELLOW_("%.*s"), i, mrz + offset);
+
+    if (!emrtd_mrz_verify_check_digit(mrz, offset, 9)) {
+        PrintAndLogEx(SUCCESS, _RED_("Passport number check digit is invalid."));
+    }
+}
+
+static void emrtd_print_name(char *mrz, int offset, int max_length) {
+    char final_name[100] = { 0x00 };
+    int i = emrtd_mrz_determine_length(mrz, offset, max_length);
+    int sep = emrtd_mrz_determine_separator(mrz, offset, i);
+    int namelen = (i - (sep + 2));
+
+    memcpy(final_name, mrz + offset + sep + 2, namelen);
+    final_name[namelen] = ' ';
+    memcpy(final_name + namelen + 1, mrz + offset, sep);
+
+    PrintAndLogEx(SUCCESS, "Legal Name............: " _YELLOW_("%s"), final_name);
+}
+
+static void emrtd_mrz_convert_date(char *mrz, int offset, char *final_date, bool is_expiry) {
+    char temp_year[3] = { 0x00 };
+
+    memcpy(temp_year, mrz + offset, 2);
+    // If it's > 20, assume 19xx.
+    if (strtol(temp_year, NULL, 10) < 20 || is_expiry) {
+        final_date[0] = '2';
+        final_date[1] = '0';
+    } else {
+        final_date[0] = '1';
+        final_date[1] = '9';
+    }
+
+    memcpy(final_date + 2, mrz + offset, 2);
+    final_date[4] = '-';
+    memcpy(final_date + 5, mrz + offset + 2, 2);
+    final_date[7] = '-';
+    memcpy(final_date + 8, mrz + offset + 4, 2);
+}
+
+static void emrtd_print_dob(char *mrz, int offset) {
+    char final_date[12] = { 0x00 };
+    emrtd_mrz_convert_date(mrz, offset, final_date, false);
+
+    PrintAndLogEx(SUCCESS, "Date of birth.........: " _YELLOW_("%s"), final_date);
+
+    if (!emrtd_mrz_verify_check_digit(mrz, offset, 6)) {
+        PrintAndLogEx(SUCCESS, _RED_("Date of Birth check digit is invalid."));
+    }
+}
+
+static void emrtd_print_expiry(char *mrz, int offset) {
+    char final_date[12] = { 0x00 };
+    emrtd_mrz_convert_date(mrz, offset, final_date, true);
+
+    PrintAndLogEx(SUCCESS, "Date of expiry........: " _YELLOW_("%s"), final_date);
+
+    if (!emrtd_mrz_verify_check_digit(mrz, offset, 6)) {
+        PrintAndLogEx(SUCCESS, _RED_("Date of expiry check digit is invalid."));
+    }
+}
+
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available) {
     // TODO: support just loading a dump file
     uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
@@ -976,11 +1134,13 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     bool BAC = false;
     bool use_14b = false;
 
+    int td_variant = 0;
+
     // Select and authenticate with the eMRTD
     bool auth_result = emrtd_do_auth(documentnumber, dob, expiry, BAC_available, &BAC, ssc, ks_enc, ks_mac, &use_14b);
     PrintAndLogEx(SUCCESS, "Communication standard: %s", use_14b ? _YELLOW_("ISO/IEC 14443(B)") : _YELLOW_("ISO/IEC 14443(A)"));
-    PrintAndLogEx(SUCCESS, "BAC: %s", BAC ? _GREEN_("Enforced") : _RED_("Not enforced"));
-    PrintAndLogEx(SUCCESS, "Authentication result: %s", auth_result ? _GREEN_("Successful") : _RED_("Failed"));
+    PrintAndLogEx(SUCCESS, "BAC...................: %s", BAC ? _GREEN_("Enforced") : _RED_("Not enforced"));
+    PrintAndLogEx(SUCCESS, "Authentication result.: %s", auth_result ? _GREEN_("Successful") : _RED_("Failed"));
 
     if (!auth_result) {
         DropField();
@@ -994,6 +1154,58 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         return PM3_ESOFT;
     }
 
+    // MRZ on TD1 is 90 characters, 30 on each row.
+    // MRZ on TD3 is 88 characters, 44 on each row.
+    char mrz[90] = { 0x00 };
+    int mrzlen = 0;
+
+    if (emrtd_ef_dg1_get_mrz(response, &resplen, (uint8_t *) mrz, &mrzlen) == false) {
+        PrintAndLogEx(ERR, "Failed to read MRZ from EF_DG1.");
+        DropField();
+        return PM3_ESOFT;
+    }
+
+    // Determine and print the document type
+    if (mrz[0] == 'I' && mrz[1] == 'P') {
+        td_variant = 1;
+        PrintAndLogEx(SUCCESS, "Document Type.........: " _YELLOW_("Passport Card"));
+    } else if (mrz[0] == 'I') {
+        td_variant = 1;
+        PrintAndLogEx(SUCCESS, "Document Type.........: " _YELLOW_("ID Card"));
+    } else if (mrz[0] == 'P') {
+        td_variant = 3;
+        PrintAndLogEx(SUCCESS, "Document Type.........: " _YELLOW_("Passport"));
+    } else {
+        td_variant = 1;
+        PrintAndLogEx(SUCCESS, "Document Type.........: " _YELLOW_("Unknown"));
+        PrintAndLogEx(INFO, "Assuming ID-style MRZ.");
+    }
+    PrintAndLogEx(SUCCESS, "Document Form Factor..: " _YELLOW_("TD%i"), td_variant);
+
+    // // Print the MRZ
+    // if (td_variant == 1) {
+    //     PrintAndLogEx(SUCCESS, "MRZ Row 1: " _YELLOW_("%.30s"), mrz);
+    //     PrintAndLogEx(SUCCESS, "MRZ Row 2: " _YELLOW_("%.30s"), mrz + 30);
+    //     PrintAndLogEx(SUCCESS, "MRZ Row 3: " _YELLOW_("%.30s"), mrz + 60);
+    // } else if (td_variant == 3) {
+    //     PrintAndLogEx(SUCCESS, "MRZ Row 1: " _YELLOW_("%.44s"), mrz);
+    //     PrintAndLogEx(SUCCESS, "MRZ Row 2: " _YELLOW_("%.44s"), mrz + 44);
+    // }
+
+    // Passport form factor
+    if (td_variant == 3) {
+        PrintAndLogEx(SUCCESS, "Issuing state.........: " _YELLOW_("%.3s"), mrz + 2);
+        emrtd_print_name(mrz, 5, 38);
+        emrtd_print_passport_number(mrz, 44);
+        PrintAndLogEx(SUCCESS, "Nationality...........: " _YELLOW_("%.3s"), mrz + 44 + 10);
+        emrtd_print_dob(mrz, 44 + 13);
+        emrtd_print_legal_sex(&mrz[44 + 20]);
+        emrtd_print_expiry(mrz, 44 + 21);
+        emrtd_print_optional_elements(mrz, 44 + 28);
+
+        // TODO: verify composite check digit here
+    }
+
     DropField();
     return PM3_SUCCESS;
 }

From 2e3e4835ed6e77d56eaaa0d42cd4b4d1e21561e0 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Thu, 17 Dec 2020 04:03:09 +0300
Subject: [PATCH 085/682] emrtd: Support ID cards on hf emrtd info

---
 client/src/cmdhfemrtd.c | 50 +++++++++++++++++++++++++----------------
 1 file changed, 31 insertions(+), 19 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index f77cc6676..2b33aa368 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1046,26 +1046,26 @@ static int emrtd_mrz_determine_separator(char *mrz, int offset, int max_length)
     return i - 1;
 }
 
-static void emrtd_print_optional_elements(char *mrz, int offset) {
-    int i = emrtd_mrz_determine_length(mrz, offset, 14);
+static void emrtd_print_optional_elements(char *mrz, int offset, int length, bool verify_check_digit) {
+    int i = emrtd_mrz_determine_length(mrz, offset, length);
 
     // Only print optional elements if they're available
     if (i != 0) {
         PrintAndLogEx(SUCCESS, "Optional elements.....: " _YELLOW_("%.*s"), i, mrz + offset);
     }
 
-    if (!emrtd_mrz_verify_check_digit(mrz, offset, 14)) {
+    if (verify_check_digit && !emrtd_mrz_verify_check_digit(mrz, offset, length)) {
         PrintAndLogEx(SUCCESS, _RED_("Optional element check digit is invalid."));
     }
 }
 
-static void emrtd_print_passport_number(char *mrz, int offset) {
+static void emrtd_print_document_number(char *mrz, int offset) {
     int i = emrtd_mrz_determine_length(mrz, offset, 9);
 
-    PrintAndLogEx(SUCCESS, "Passport Number.......: " _YELLOW_("%.*s"), i, mrz + offset);
+    PrintAndLogEx(SUCCESS, "Document Number.......: " _YELLOW_("%.*s"), i, mrz + offset);
 
     if (!emrtd_mrz_verify_check_digit(mrz, offset, 9)) {
-        PrintAndLogEx(SUCCESS, _RED_("Passport number check digit is invalid."));
+        PrintAndLogEx(SUCCESS, _RED_("Document number check digit is invalid."));
     }
 }
 
@@ -1182,28 +1182,40 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     }
     PrintAndLogEx(SUCCESS, "Document Form Factor..: " _YELLOW_("TD%i"), td_variant);
 
-    // // Print the MRZ
-    // if (td_variant == 1) {
-    //     PrintAndLogEx(SUCCESS, "MRZ Row 1: " _YELLOW_("%.30s"), mrz);
-    //     PrintAndLogEx(SUCCESS, "MRZ Row 2: " _YELLOW_("%.30s"), mrz + 30);
-    //     PrintAndLogEx(SUCCESS, "MRZ Row 3: " _YELLOW_("%.30s"), mrz + 60);
-    // } else if (td_variant == 3) {
-    //     PrintAndLogEx(SUCCESS, "MRZ Row 1: " _YELLOW_("%.44s"), mrz);
-    //     PrintAndLogEx(SUCCESS, "MRZ Row 2: " _YELLOW_("%.44s"), mrz + 44);
-    // }
+    // Print the MRZ
+    if (td_variant == 1) {
+        PrintAndLogEx(DEBUG, "MRZ Row 1: " _YELLOW_("%.30s"), mrz);
+        PrintAndLogEx(DEBUG, "MRZ Row 2: " _YELLOW_("%.30s"), mrz + 30);
+        PrintAndLogEx(DEBUG, "MRZ Row 3: " _YELLOW_("%.30s"), mrz + 60);
+    } else if (td_variant == 3) {
+        PrintAndLogEx(DEBUG, "MRZ Row 1: " _YELLOW_("%.44s"), mrz);
+        PrintAndLogEx(DEBUG, "MRZ Row 2: " _YELLOW_("%.44s"), mrz + 44);
+    }
+
+    PrintAndLogEx(SUCCESS, "Issuing state.........: " _YELLOW_("%.3s"), mrz + 2);
 
-    // Passport form factor
     if (td_variant == 3) {
-        PrintAndLogEx(SUCCESS, "Issuing state.........: " _YELLOW_("%.3s"), mrz + 2);
+        // Passport form factor
         emrtd_print_name(mrz, 5, 38);
-        emrtd_print_passport_number(mrz, 44);
+        emrtd_print_document_number(mrz, 44);
         PrintAndLogEx(SUCCESS, "Nationality...........: " _YELLOW_("%.3s"), mrz + 44 + 10);
         emrtd_print_dob(mrz, 44 + 13);
         emrtd_print_legal_sex(&mrz[44 + 20]);
         emrtd_print_expiry(mrz, 44 + 21);
-        emrtd_print_optional_elements(mrz, 44 + 28);
+        emrtd_print_optional_elements(mrz, 44 + 28, 14, true);
 
         // TODO: verify composite check digit here
+    } else if (td_variant == 1) {
+        // ID form factor
+        emrtd_print_document_number(mrz, 5);
+        emrtd_print_optional_elements(mrz, 15, 15, false);
+        emrtd_print_dob(mrz, 30);
+        emrtd_print_legal_sex(&mrz[30 + 7]);
+        emrtd_print_expiry(mrz, 30 + 8);
+        PrintAndLogEx(SUCCESS, "Nationality...........: " _YELLOW_("%.3s"), mrz + 30 + 15);
+        emrtd_print_optional_elements(mrz, 30 + 18, 11, false);
+        // TODO: verify composite check digit here
+        emrtd_print_name(mrz, 60, 30);
     }
 
     DropField();

From 8e72830686930ba435bee127ede6bff89503ece3 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Thu, 17 Dec 2020 04:15:00 +0300
Subject: [PATCH 086/682] emrtd: Merge two functions into
 emrtd_lds_get_data_by_tag

---
 client/src/cmdhfemrtd.c | 41 ++++++-----------------------------------
 1 file changed, 6 insertions(+), 35 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 2b33aa368..2d4d8a8ee 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -574,14 +574,14 @@ static int emrtd_read_file(uint8_t *dataout, int *dataoutlen, uint8_t *kenc, uin
     return true;
 }
 
-static bool emrtd_ef_com_get_file_list(uint8_t *datain, int *datainlen, uint8_t *dataout, int *dataoutlen) {
+static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int *datainlen, uint8_t *dataout, int *dataoutlen, int tag1, int tag2, bool twobytetag) {
     int offset = 2;
     int elementidlen = 0;
     int elementlen = 0;
     while (offset < *datainlen) {
-        PrintAndLogEx(DEBUG, "ef_com_get_file_list, offset: %i, data: %X", offset, *(datain + offset));
+        PrintAndLogEx(DEBUG, "emrtd_lds_get_data_by_tag, offset: %i, data: %X", offset, *(datain + offset));
         // Determine element ID length to set as offset on asn1datalength
-        if (*(datain + offset) == 0x5f) {
+        if ((*(datain + offset) == 0x5f) || (*(datain + offset) == 0x7f)) {
             elementidlen = 2;
         } else {
             elementidlen = 1;
@@ -591,36 +591,7 @@ static bool emrtd_ef_com_get_file_list(uint8_t *datain, int *datainlen, uint8_t
         elementlen = emrtd_get_asn1_data_length(datain + offset, *datainlen - offset, elementidlen);
 
         // If the element is what we're looking for, get the data and return true
-        if (*(datain + offset) == 0x5c) {
-            *dataoutlen = elementlen;
-            memcpy(dataout, datain + offset + elementidlen + 1, elementlen);
-            return true;
-        }
-        offset += elementidlen + elementlen + 1;
-    }
-    // Return false if we can't find the relevant element
-    return false;
-}
-
-static bool emrtd_ef_dg1_get_mrz(uint8_t *datain, int *datainlen, uint8_t *dataout, int *dataoutlen) {
-    // TODO: combine with emrtd_ef_com_get_file_list
-    int offset = 2;
-    int elementidlen = 0;
-    int elementlen = 0;
-    while (offset < *datainlen) {
-        PrintAndLogEx(DEBUG, "emrtd_ef_dg1_get_mrz, offset: %i, data: %X", offset, *(datain + offset));
-        // Determine element ID length to set as offset on asn1datalength
-        if (*(datain + offset) == 0x5f) {
-            elementidlen = 2;
-        } else {
-            elementidlen = 1;
-        }
-
-        // Get the length of the element
-        elementlen = emrtd_get_asn1_data_length(datain + offset, *datainlen - offset, elementidlen);
-
-        // If the element is what we're looking for, get the data and return true
-        if (*(datain + offset) == 0x5f && *(datain + offset + 1) == 0x1f) {
+        if (*(datain + offset) == tag1 && (!twobytetag || *(datain + offset + 1) == tag2)) {
             *dataoutlen = elementlen;
             memcpy(dataout, datain + offset + elementidlen + 1, elementlen);
             return true;
@@ -968,7 +939,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     uint8_t filelist[50];
     int filelistlen = 0;
 
-    if (emrtd_ef_com_get_file_list(response, &resplen, filelist, &filelistlen) == false) {
+    if (!emrtd_lds_get_data_by_tag(response, &resplen, filelist, &filelistlen, 0x5c, 0x00, false)) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
         DropField();
         return PM3_ESOFT;
@@ -1159,7 +1130,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     char mrz[90] = { 0x00 };
     int mrzlen = 0;
 
-    if (emrtd_ef_dg1_get_mrz(response, &resplen, (uint8_t *) mrz, &mrzlen) == false) {
+    if (!emrtd_lds_get_data_by_tag(response, &resplen, (uint8_t *) mrz, &mrzlen, 0x5f, 0x1f, true)) {
         PrintAndLogEx(ERR, "Failed to read MRZ from EF_DG1.");
         DropField();
         return PM3_ESOFT;

From b362101b54b9655dc8db5fddbc6fe23ab4a2cecc Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Thu, 17 Dec 2020 04:19:54 +0300
Subject: [PATCH 087/682] emrtd: Split emrtd_mrz_verify_check_digit into two
 funcs

---
 client/src/cmdhfemrtd.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 2d4d8a8ee..747f9b042 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -966,19 +966,27 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     return PM3_SUCCESS;
 }
 
-static bool emrtd_mrz_verify_check_digit(char *mrz, int offset, int datalen) {
+static bool emrtd_compare_check_digit(char *datain, int datalen, char expected_check_digit) {
     char tempdata[90] = { 0x00 };
     char calculated_check_digit[3];
 
-    memcpy(tempdata, mrz + offset, datalen);
+    memcpy(tempdata, datain, datalen);
     int check_digit = emrtd_calculate_check_digit(tempdata);
 
     sprintf(calculated_check_digit, "%i", check_digit);
 
-    PrintAndLogEx(DEBUG, "emrtd_mrz_verify_check_digit, expected: %c", mrz[offset + datalen]);
-    PrintAndLogEx(DEBUG, "emrtd_mrz_verify_check_digit, calculated: %c", calculated_check_digit[0]);
+    PrintAndLogEx(DEBUG, "emrtd_compare_check_digit, expected: %c", expected_check_digit);
+    PrintAndLogEx(DEBUG, "emrtd_compare_check_digit, calculated: %c", calculated_check_digit[0]);
 
-    return calculated_check_digit[0] == mrz[offset + datalen];
+    return calculated_check_digit[0] == expected_check_digit;
+}
+
+static bool emrtd_mrz_verify_check_digit(char *mrz, int offset, int datalen) {
+    char tempdata[90] = { 0x00 };
+
+    memcpy(tempdata, mrz + offset, datalen);
+
+    return emrtd_compare_check_digit(tempdata, datalen, mrz[offset + datalen]);
 }
 
 static void emrtd_print_legal_sex(char *legal_sex) {
@@ -1096,7 +1104,6 @@ static void emrtd_print_expiry(char *mrz, int offset) {
 }
 
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available) {
-    // TODO: support just loading a dump file
     uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     int resplen = 0;
     uint8_t ssc[8] = { 0x00 };

From 8e6736edd1b7879b33bd6790960f79c68a9788ef Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Thu, 17 Dec 2020 04:28:26 +0300
Subject: [PATCH 088/682] emrtd: Verify composite check digits

---
 client/src/cmdhfemrtd.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 747f9b042..244234836 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1182,7 +1182,15 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         emrtd_print_expiry(mrz, 44 + 21);
         emrtd_print_optional_elements(mrz, 44 + 28, 14, true);
 
-        // TODO: verify composite check digit here
+        // Calculate and verify composite check digit
+        char composite_check_data[50] = { 0x00 };
+        memcpy(composite_check_data, mrz, 9);
+        memcpy(composite_check_data + 9, mrz + 13, 7);
+        memcpy(composite_check_data + 7, mrz + 21, 22);
+
+        if (!emrtd_compare_check_digit(composite_check_data, 36, mrz[87])) {
+            PrintAndLogEx(SUCCESS, _RED_("Composite check digit is invalid."));
+        }
     } else if (td_variant == 1) {
         // ID form factor
         emrtd_print_document_number(mrz, 5);
@@ -1192,7 +1200,12 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         emrtd_print_expiry(mrz, 30 + 8);
         PrintAndLogEx(SUCCESS, "Nationality...........: " _YELLOW_("%.3s"), mrz + 30 + 15);
         emrtd_print_optional_elements(mrz, 30 + 18, 11, false);
-        // TODO: verify composite check digit here
+
+        // Calculate and verify composite check digit
+        if (!emrtd_compare_check_digit(mrz, 59, mrz[59])) {
+            PrintAndLogEx(SUCCESS, _RED_("Composite check digit is invalid."));
+        }
+
         emrtd_print_name(mrz, 60, 30);
     }
 

From b31a610566f62b816cc007f94436dee047459a0b Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Thu, 17 Dec 2020 05:08:56 +0300
Subject: [PATCH 089/682] emrtd: Fix passport composite + change print order

---
 client/src/cmdhfemrtd.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 244234836..5b1fe8981 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1174,9 +1174,9 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
 
     if (td_variant == 3) {
         // Passport form factor
+        PrintAndLogEx(SUCCESS, "Nationality...........: " _YELLOW_("%.3s"), mrz + 44 + 10);
         emrtd_print_name(mrz, 5, 38);
         emrtd_print_document_number(mrz, 44);
-        PrintAndLogEx(SUCCESS, "Nationality...........: " _YELLOW_("%.3s"), mrz + 44 + 10);
         emrtd_print_dob(mrz, 44 + 13);
         emrtd_print_legal_sex(&mrz[44 + 20]);
         emrtd_print_expiry(mrz, 44 + 21);
@@ -1184,29 +1184,28 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
 
         // Calculate and verify composite check digit
         char composite_check_data[50] = { 0x00 };
-        memcpy(composite_check_data, mrz, 9);
-        memcpy(composite_check_data + 9, mrz + 13, 7);
-        memcpy(composite_check_data + 7, mrz + 21, 22);
+        memcpy(composite_check_data, mrz + 44, 10);
+        memcpy(composite_check_data + 10, mrz + 44 + 13, 7);
+        memcpy(composite_check_data + 17, mrz + 44 + 21, 23);
 
-        if (!emrtd_compare_check_digit(composite_check_data, 36, mrz[87])) {
+        if (!emrtd_compare_check_digit(composite_check_data, 39, mrz[87])) {
             PrintAndLogEx(SUCCESS, _RED_("Composite check digit is invalid."));
         }
     } else if (td_variant == 1) {
         // ID form factor
+        PrintAndLogEx(SUCCESS, "Nationality...........: " _YELLOW_("%.3s"), mrz + 30 + 15);
+        emrtd_print_name(mrz, 60, 30);
         emrtd_print_document_number(mrz, 5);
-        emrtd_print_optional_elements(mrz, 15, 15, false);
         emrtd_print_dob(mrz, 30);
         emrtd_print_legal_sex(&mrz[30 + 7]);
         emrtd_print_expiry(mrz, 30 + 8);
-        PrintAndLogEx(SUCCESS, "Nationality...........: " _YELLOW_("%.3s"), mrz + 30 + 15);
+        emrtd_print_optional_elements(mrz, 15, 15, false);
         emrtd_print_optional_elements(mrz, 30 + 18, 11, false);
 
         // Calculate and verify composite check digit
         if (!emrtd_compare_check_digit(mrz, 59, mrz[59])) {
             PrintAndLogEx(SUCCESS, _RED_("Composite check digit is invalid."));
         }
-
-        emrtd_print_name(mrz, 60, 30);
     }
 
     DropField();

From 8cb25b742acb49a14b0d7035a732c51cef2575c2 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Thu, 17 Dec 2020 05:12:54 +0300
Subject: [PATCH 090/682] emrtd: Remove redundant padding code

---
 client/src/cmdhfemrtd.c | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 5b1fe8981..50492e3ee 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -221,12 +221,6 @@ static void des3_decrypt_cbc(uint8_t *iv, uint8_t *key, uint8_t *input, int inpu
     mbedtls_des3_free(&ctx);
 }
 
-static void emrtd_pad_docnum(char *input) {
-    for (int i = strlen(input); i < 9; i++) {
-        input[i] = '<';
-    }
-}
-
 static int pad_block(uint8_t *input, int inputlen, uint8_t *output) {
     uint8_t padding[8] = {0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
 
@@ -834,8 +828,6 @@ static bool emrtd_do_auth(char *documentnumber, char *dob, char *expiry, bool BA
     uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     int resplen = 0;
 
-    emrtd_pad_docnum(documentnumber);
-
     // Try to 14a
     SendCommandMIX(CMD_HF_ISO14443A_READER, ISO14A_CONNECT | ISO14A_NO_DISCONNECT, 0, 0, NULL, 0);
     PacketResponseNG resp;
@@ -1237,7 +1229,8 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
     if (CLIParamStrToBuf(arg_get_str(ctx, 1), docnum, 9, &slen) != 0 || slen == 0) {
         BAC = false;
     } else {
-        if ( slen != 9) {
+        if (slen != 9) {
+            // Pad to 9 with <
             memset(docnum + slen, 0x3c, 9 - slen);
         }
     }

From b3c7dd64c64c6e58e67547672a51b5296d244aec Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 17 Dec 2020 14:46:57 +0100
Subject: [PATCH 091/682] fix auth logic,  and compiler warning

---
 client/src/cmdhfemrtd.c | 20 ++++++++------------
 1 file changed, 8 insertions(+), 12 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index b8de76a8b..c6688ff1e 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -960,24 +960,20 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
 
 static bool emrtd_compare_check_digit(char *datain, int datalen, char expected_check_digit) {
     char tempdata[90] = { 0x00 };
-    char calculated_check_digit[3];
-
     memcpy(tempdata, datain, datalen);
-    int check_digit = emrtd_calculate_check_digit(tempdata);
 
-    sprintf(calculated_check_digit, "%i", check_digit);
-
-    PrintAndLogEx(DEBUG, "emrtd_compare_check_digit, expected: %c", expected_check_digit);
-    PrintAndLogEx(DEBUG, "emrtd_compare_check_digit, calculated: %c", calculated_check_digit[0]);
-
-    return calculated_check_digit[0] == expected_check_digit;
+    uint8_t check_digit = emrtd_calculate_check_digit(tempdata) + 0x30;
+    bool res =check_digit == expected_check_digit;
+    PrintAndLogEx(DEBUG, "emrtd_compare_check_digit, expected %c == %c calculated ( %s )"
+        , expected_check_digit
+        , check_digit
+        , (res) ? _GREEN_("ok") : _RED_("fail"));
+    return res;
 }
 
 static bool emrtd_mrz_verify_check_digit(char *mrz, int offset, int datalen) {
     char tempdata[90] = { 0x00 };
-
     memcpy(tempdata, mrz + offset, datalen);
-
     return emrtd_compare_check_digit(tempdata, datalen, mrz[offset + datalen]);
 }
 
@@ -1112,7 +1108,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     PrintAndLogEx(SUCCESS, "BAC...................: %s", BAC ? _GREEN_("Enforced") : _RED_("Not enforced"));
     PrintAndLogEx(SUCCESS, "Authentication result.: %s", auth_result ? _GREEN_("Successful") : _RED_("Failed"));
 
-    if (!auth_result) {
+    if (BAC && !auth_result) {
         DropField();
         return PM3_ESOFT;
     }

From 205885cb1534966672462cc7417df9651b740f03 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Thu, 17 Dec 2020 18:18:25 +0300
Subject: [PATCH 092/682] emrtd: Improve card presence check logic

---
 client/src/cmdhfemrtd.c | 31 +++++++++++++++++++++++--------
 1 file changed, 23 insertions(+), 8 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index c6688ff1e..daa51be19 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -824,10 +824,7 @@ static bool emrtd_do_bac(char *documentnumber, char *dob, char *expiry, uint8_t
     return true;
 }
 
-static bool emrtd_do_auth(char *documentnumber, char *dob, char *expiry, bool BAC_available, bool *BAC, uint8_t *ssc, uint8_t *ks_enc, uint8_t *ks_mac, bool *use_14b) {
-    uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
-    int resplen = 0;
-
+static bool emrtd_connect(bool *use_14b) {
     // Try to 14a
     SendCommandMIX(CMD_HF_ISO14443A_READER, ISO14A_CONNECT | ISO14A_NO_DISCONNECT, 0, 0, NULL, 0);
     PacketResponseNG resp;
@@ -852,6 +849,12 @@ static bool emrtd_do_auth(char *documentnumber, char *dob, char *expiry, bool BA
         }
         *use_14b = true;
     }
+    return true;
+}
+
+static bool emrtd_do_auth(char *documentnumber, char *dob, char *expiry, bool BAC_available, bool *BAC, uint8_t *ssc, uint8_t *ks_enc, uint8_t *ks_mac, bool *use_14b) {
+    uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    int resplen = 0;
 
     // Select and read EF_CardAccess
     if (emrtd_select_file(EMRTD_P1_SELECT_BY_EF, EMRTD_EF_CARDACCESS, *use_14b)) {
@@ -912,14 +915,20 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     bool BAC = false;
     bool use_14b = false;
 
-    // Select and authenticate with the eMRTD
-    if (emrtd_do_auth(documentnumber, dob, expiry, BAC_available, &BAC, ssc, ks_enc, ks_mac, &use_14b) == false) {
+    // Select the eMRTD
+    if (!emrtd_connect(&use_14b)) {
+        DropField();
+        return PM3_ESOFT;
+    }
+
+    // Authenticate with the eMRTD
+    if (!emrtd_do_auth(documentnumber, dob, expiry, BAC_available, &BAC, ssc, ks_enc, ks_mac, &use_14b)) {
         DropField();
         return PM3_ESOFT;
     }
 
     // Select EF_COM
-    if (emrtd_select_and_read(response, &resplen, EMRTD_EF_COM, ks_enc, ks_mac, ssc, BAC, use_14b) == false) {
+    if (!emrtd_select_and_read(response, &resplen, EMRTD_EF_COM, ks_enc, ks_mac, ssc, BAC, use_14b)) {
         PrintAndLogEx(ERR, "Failed to read EF_COM.");
         DropField();
         return PM3_ESOFT;
@@ -1102,13 +1111,19 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
 
     int td_variant = 0;
 
+    // Select the eMRTD
+    if (!emrtd_connect(&use_14b)) {
+        DropField();
+        return PM3_ESOFT;
+    }
+
     // Select and authenticate with the eMRTD
     bool auth_result = emrtd_do_auth(documentnumber, dob, expiry, BAC_available, &BAC, ssc, ks_enc, ks_mac, &use_14b);
     PrintAndLogEx(SUCCESS, "Communication standard: %s", use_14b ? _YELLOW_("ISO/IEC 14443(B)") : _YELLOW_("ISO/IEC 14443(A)"));
     PrintAndLogEx(SUCCESS, "BAC...................: %s", BAC ? _GREEN_("Enforced") : _RED_("Not enforced"));
     PrintAndLogEx(SUCCESS, "Authentication result.: %s", auth_result ? _GREEN_("Successful") : _RED_("Failed"));
 
-    if (BAC && !auth_result) {
+    if (!auth_result) {
         DropField();
         return PM3_ESOFT;
     }

From 90bb07e63b7a6a5e685cd6135f9cb037bf7fe2bc Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 17 Dec 2020 18:03:46 +0100
Subject: [PATCH 093/682] update discord lnk

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index bc7e88854..b8140e407 100644
--- a/README.md
+++ b/README.md
@@ -111,7 +111,7 @@ Next place to visit is the [Proxmark Forum](http://www.proxmark.org/forum/index.
    - [Proxmark3 IRC channel](http://webchat.freenode.net/?channels=#proxmark3)
    - [Proxmark3 sub reddit](https://www.reddit.com/r/proxmark3/)
    - [Twitter](https://twitter.com/proxmark3/)
-   - [Proxmark3 community discord server](https://discord.gg/zjxc8ZB)
+   - [Proxmark3 community discord server](https://discord.gg/QfPvGFRQxH)
  
  _no slack channel_
 

From 01ec2efc25f9675074ea2d5803804e2f72841692 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Thu, 17 Dec 2020 22:07:16 +0300
Subject: [PATCH 094/682] Show hints by default

---
 client/src/preferences.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/preferences.c b/client/src/preferences.c
index 5b5b9bee9..9f507b969 100644
--- a/client/src/preferences.c
+++ b/client/src/preferences.c
@@ -53,7 +53,7 @@ int preferences_load(void) {
     session.overlay.h = 200;
     session.overlay.w = session.plot.w;
     session.overlay_sliders = true;
-    session.show_hints = false;
+    session.show_hints = true;
 
 //    setDefaultPath (spDefault, "");
 //    setDefaultPath (spDump, "");

From a9f28adabf4ee8a9c572b793b1a735d6741f5f32 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Thu, 17 Dec 2020 22:22:26 +0300
Subject: [PATCH 095/682] emrtd: Improve emrtd_lds_get_data_by_tag to account
 for variable data sizes

---
 client/src/cmdhfemrtd.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index daa51be19..9525e0ac0 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -569,9 +569,11 @@ static int emrtd_read_file(uint8_t *dataout, int *dataoutlen, uint8_t *kenc, uin
 }
 
 static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int *datainlen, uint8_t *dataout, int *dataoutlen, int tag1, int tag2, bool twobytetag) {
-    int offset = 2;
+    int offset = 1;
+    offset += emrtd_get_asn1_field_length(datain, *datainlen, offset);
     int elementidlen = 0;
     int elementlen = 0;
+    int elementlenlen = 0;
     while (offset < *datainlen) {
         PrintAndLogEx(DEBUG, "emrtd_lds_get_data_by_tag, offset: %i, data: %X", offset, *(datain + offset));
         // Determine element ID length to set as offset on asn1datalength
@@ -584,13 +586,16 @@ static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int *datainlen, uint8_t *
         // Get the length of the element
         elementlen = emrtd_get_asn1_data_length(datain + offset, *datainlen - offset, elementidlen);
 
+        // Get the length of the element's length
+        elementlenlen = emrtd_get_asn1_field_length(datain + offset, *datainlen - offset, elementidlen);
+
         // If the element is what we're looking for, get the data and return true
         if (*(datain + offset) == tag1 && (!twobytetag || *(datain + offset + 1) == tag2)) {
             *dataoutlen = elementlen;
-            memcpy(dataout, datain + offset + elementidlen + 1, elementlen);
+            memcpy(dataout, datain + offset + elementidlen + elementlenlen, elementlen);
             return true;
         }
-        offset += elementidlen + elementlen + 1;
+        offset += elementidlen + elementlen + elementlenlen;
     }
     // Return false if we can't find the relevant element
     return false;
@@ -894,7 +899,7 @@ static bool emrtd_do_auth(char *documentnumber, char *dob, char *expiry, bool BA
         // If BAC isn't available, exit out and warn user.
         if (!BAC_available) {
             PrintAndLogEx(ERR, "This eMRTD enforces Basic Access Control, but you didn't supply MRZ data. Cannot proceed.");
-            PrintAndLogEx(HINT, "Check out hf emrtd dump --help, supply data with -n -d and -e.");
+            PrintAndLogEx(HINT, "Check out hf emrtd info/dump --help, supply data with -n -d and -e.");
             return false;
         }
 

From ae7090a47e29177a561ab1fe5e6e37499cc35425 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Thu, 17 Dec 2020 22:22:41 +0300
Subject: [PATCH 096/682] emrtd: Dump image when dumping EF_DG5

---
 client/src/cmdhfemrtd.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 9525e0ac0..cfb4361a4 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -704,6 +704,19 @@ static bool emrtd_select_and_read(uint8_t *dataout, int *dataoutlen, const char
     return true;
 }
 
+static bool emrtd_dump_ef_dg5(uint8_t *file_contents, int file_length) {
+    uint8_t response[EMRTD_MAX_FILE_SIZE];
+    int resplen = 0;
+
+    // If we can't find image in EF_DG5, return false.
+    if (!emrtd_lds_get_data_by_tag(file_contents, &file_length, response, &resplen, 0x5f, 0x40, true)) {
+        return false;
+    }
+
+    saveFile("EF_DG5", ".jpg", response, resplen);
+    return true;
+}
+
 static bool emrtd_dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, const char *file, const char *name, bool use_secure, bool use_14b) {
     uint8_t response[EMRTD_MAX_FILE_SIZE];
     int resplen = 0;
@@ -716,6 +729,10 @@ static bool emrtd_dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, cons
     PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
     saveFile(name, ".BIN", response, resplen);
 
+    if (strcmp(file, EMRTD_EF_DG5) == 0) {
+        emrtd_dump_ef_dg5(response, resplen);
+    }
+
     return true;
 }
 

From f3d5c60c1085d9cbed0e617f709573143280515e Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Thu, 17 Dec 2020 22:45:41 +0300
Subject: [PATCH 097/682] emrtd: Dump cert when dumping EF_SOD

---
 client/src/cmdhfemrtd.c | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index cfb4361a4..299f3e7c7 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -705,15 +705,27 @@ static bool emrtd_select_and_read(uint8_t *dataout, int *dataoutlen, const char
 }
 
 static bool emrtd_dump_ef_dg5(uint8_t *file_contents, int file_length) {
-    uint8_t response[EMRTD_MAX_FILE_SIZE];
-    int resplen = 0;
+    uint8_t data[EMRTD_MAX_FILE_SIZE];
+    int datalen = 0;
 
     // If we can't find image in EF_DG5, return false.
-    if (!emrtd_lds_get_data_by_tag(file_contents, &file_length, response, &resplen, 0x5f, 0x40, true)) {
+    if (!emrtd_lds_get_data_by_tag(file_contents, &file_length, data, &datalen, 0x5f, 0x40, true)) {
         return false;
     }
 
-    saveFile("EF_DG5", ".jpg", response, resplen);
+    saveFile("EF_DG5", ".jpg", data, datalen);
+    return true;
+}
+
+static bool emrtd_dump_ef_sod(uint8_t *file_contents, int file_length) {
+    uint8_t data[EMRTD_MAX_FILE_SIZE];
+
+    int datalenlen = emrtd_get_asn1_field_length(file_contents, file_length, 1);
+    int datalen = emrtd_get_asn1_data_length(file_contents, file_length, 1);
+
+    memcpy(data, file_contents + datalenlen + 1, datalen);
+
+    saveFile("EF_SOD", ".p7b", data, datalen);
     return true;
 }
 
@@ -731,6 +743,8 @@ static bool emrtd_dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, cons
 
     if (strcmp(file, EMRTD_EF_DG5) == 0) {
         emrtd_dump_ef_dg5(response, resplen);
+    } else if (strcmp(file, EMRTD_EF_SOD) == 0) {
+        emrtd_dump_ef_sod(response, resplen);
     }
 
     return true;

From 7d27dabbf1ba249c7e6f9436bc3514c1e342b424 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 17 Dec 2020 20:46:05 +0100
Subject: [PATCH 098/682] textual

---
 .github/ISSUE_TEMPLATE/checklist-for-release.md | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/checklist-for-release.md b/.github/ISSUE_TEMPLATE/checklist-for-release.md
index aae8ab053..01709e9ab 100644
--- a/.github/ISSUE_TEMPLATE/checklist-for-release.md
+++ b/.github/ISSUE_TEMPLATE/checklist-for-release.md
@@ -22,14 +22,14 @@ assignees: doegox, iceman1001
 # OS compilation and tests
 
 ```bash
-make clean && make -j PLATFORM=PM3OTHER && tools/pm3test.sh
-make clean && make -j PLATFORM=PM3RDV4 && tools/pm3test.sh
-make clean && make -j PLATFORM=PM3RDV4 PLATFORM_EXTRAS=BTADDON && tools/pm3test.sh
-make install; pushd /tmp; proxmark3 -c 'data load em4x05.pm3;lf search 1'; popd; make uninstall
+make clean && make -j PLATFORM=PM3OTHER && tools/pm3_tests.sh
+make clean && make -j PLATFORM=PM3RDV4 && tools/pm3_tests.sh
+make clean && make -j PLATFORM=PM3RDV4 PLATFORM_EXTRAS=BTADDON && tools/pm3_tests.sh
+make install; pushd /tmp; proxmark3 -c 'data load -f em4x05.pm3;lf search 1'; popd; make uninstall
 
-( cd client; rm -rf build; mkdir build;cd build;cmake .. && make -j PLATFORM=PM3OTHER && PM3BIN=./proxmark3 ../../tools/pm3test.sh client )
-( cd client; rm -rf build; mkdir build;cd build;cmake .. && make -j PLATFORM=PM3RDV4  && PM3BIN=./proxmark3 ../../tools/pm3test.sh client )
-( cd client; rm -rf build; mkdir build;cd build;cmake .. && make -j PLATFORM=PM3RDV4 PLATFORM_EXTRAS=BTADDON && PM3BIN=./proxmark3 ../../tools/pm3test.sh client )
+( cd client; rm -rf build; mkdir build;cd build;cmake .. && make -j PLATFORM=PM3OTHER && PM3BIN=./proxmark3 ../../tools/pm3_tests.sh client )
+( cd client; rm -rf build; mkdir build;cd build;cmake .. && make -j PLATFORM=PM3RDV4  && PM3BIN=./proxmark3 ../../tools/pm3_tests.sh client )
+( cd client; rm -rf build; mkdir build;cd build;cmake .. && make -j PLATFORM=PM3RDV4 PLATFORM_EXTRAS=BTADDON && PM3BIN=./proxmark3 ../../tools/pm3_tests.sh client )
 ```
 
 - [ ] RPI Zero

From ced056be199f2091ec0714d2f9b3d2fe2be24c22 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Thu, 17 Dec 2020 20:54:06 +0100
Subject: [PATCH 099/682] deleted non existing functions in header

---
 armsrc/em4x50.h | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/armsrc/em4x50.h b/armsrc/em4x50.h
index 12f0a64d8..9f9b38351 100644
--- a/armsrc/em4x50.h
+++ b/armsrc/em4x50.h
@@ -13,11 +13,6 @@
 
 #include "../include/em4x50.h"
 
-int em4x50_standalone_read(uint32_t *words);
-int em4x50_standalone_brute(uint32_t start, uint32_t stop, uint32_t *pwd);
-bool em4x50_sim_send_listen_window(void);
-bool em4x50_sim_send_word(uint32_t word);
-
 void em4x50_info(em4x50_data_t *etd);
 void em4x50_write(em4x50_data_t *etd);
 void em4x50_writepwd(em4x50_data_t *etd);

From 50eb90bdc7f9ad08c88a1970027bffe63b403277 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Thu, 17 Dec 2020 20:55:01 +0100
Subject: [PATCH 100/682] added missing static statements

---
 armsrc/em4x50.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index bf457c7cf..437afd956 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -691,7 +691,7 @@ static bool em4x50_sim_send_byte_with_parity(uint8_t byte) {
     return true;
 }
 
-bool em4x50_sim_send_word(uint32_t word) {
+static bool em4x50_sim_send_word(uint32_t word) {
 
     uint8_t cparity = 0x00;
 
@@ -722,7 +722,7 @@ bool em4x50_sim_send_word(uint32_t word) {
     return true;
 }
 
-bool em4x50_sim_send_listen_window(void) {
+static bool em4x50_sim_send_listen_window(void) {
 
     uint16_t check = 0;
 

From 0be10b617e039b90ee27c36badc9bba1d19338de Mon Sep 17 00:00:00 2001
From: tharexde <61853685+tharexde@users.noreply.github.com>
Date: Thu, 17 Dec 2020 21:09:02 +0100
Subject: [PATCH 101/682] Delete lf_tharexde.c

uploaded by mistake
---
 armsrc/Standalone/lf_tharexde.c | 359 --------------------------------
 1 file changed, 359 deletions(-)
 delete mode 100644 armsrc/Standalone/lf_tharexde.c

diff --git a/armsrc/Standalone/lf_tharexde.c b/armsrc/Standalone/lf_tharexde.c
deleted file mode 100644
index f5195513c..000000000
--- a/armsrc/Standalone/lf_tharexde.c
+++ /dev/null
@@ -1,359 +0,0 @@
-//-----------------------------------------------------------------------------
-// Tharexde, 2020
-//
-// This code is licensed to you under the terms of the GNU GPL, version 2 or,
-// at your option, any later version. See the LICENSE.txt file for the text of
-// the license.
-//-----------------------------------------------------------------------------
-// main code for EM4x50 simulator and collector aka THAREXDE
-//-----------------------------------------------------------------------------
-#include <inttypes.h>
-#include "standalone.h"
-#include "proxmark3_arm.h"
-#include "appmain.h"
-#include "BigBuf.h"
-#include "fpgaloader.h"
-#include "util.h"
-#include "dbprint.h"
-#include "spiffs.h"
-#include "../em4x50.h"
-
-/*
- * `lf_tharexde` simulates hardcoded words/blocks, reads words of standard read
- * mode of EM4x50 tags and stores them in internal flash.
- * It requires RDV4 hardware (for flash and battery).
- *
- * On entering stand-alone mode, this module will start reading/record EM4x50 data.
- * Every found / collected data will be written/appended to the logfile in flash
- * as a text string.
- *
- * LEDs:
- * - LED A: simulating
- * - LED B: reading / record
- * - LED C: writing to flash
- * - LED D: unmounting/sync'ing flash (normally < 100ms)
- *
- * To retrieve log file from flash:
- *
- * 1. mem spiffs dump o lf_em4x50collect.log f lf_em4x50collect.log
- *    Copies log file from flash to your client.
- *
- * 2. exit the Proxmark3 client
- *
- * 3. more lf_tharexdecollect.log
- *
- * This module emits debug strings during normal operation -- so try it out in
- * the lab connected to PM3 client before taking it into the field.
- *
- * To delete the log file from flash:
- *
- * 1. mem spiffs remove lf_tharexdecollect.log
- */
-
-#define STATE_SIM                   0
-#define STATE_READ                  1
-#define STATE_BRUTE                 2
-#define EM4X50_TAG_WORD             45
-#define EM4X50_PWD_SPEED            27
-#define LF_EM4X50SIMULATE_INPUTFILE "lf_em4x50simulate.eml"
-#define LF_EM4X50COLLECT_LOGFILE    "lf_em4x50collect.log"
-#define LF_EM4X50BRUTE_INPUTFILE    "lf_em4x50brute.eml"
-#define LF_EM4X50BRUTE_LOGFILE      "lf_em4x50brute.log"
-
-bool input_exists;
-bool log_exists;
-
-static void LoadDataInstructions(const char *inputfile) {
-    Dbprintf("");
-    Dbprintf("To load datafile into flash and display it:");
-    Dbprintf(_YELLOW_("1.") " edit inputfile %s", inputfile);
-    Dbprintf(_YELLOW_("2.") " start proxmark3 client");
-    Dbprintf(_YELLOW_("3.") " mem spiffs load f %s o %s", inputfile, inputfile);
-    Dbprintf(_YELLOW_("4.") " start standalone mode");
-}
-
-static void DownloadLogInstructions(const char *logfile) {
-    Dbprintf("");
-    Dbprintf("To get the logfile from flash and display it:");
-    Dbprintf(_YELLOW_("1.") " mem spiffs dump o %s f %s", logfile, logfile);
-    Dbprintf(_YELLOW_("2.") " exit proxmark3 client");
-    Dbprintf(_YELLOW_("3.") " cat %s", logfile);
-}
-
-static int get_input_data_from_file(uint32_t *words, char *inputfile) {
-
-    size_t now = 0;
-
-    if (exists_in_spiffs(inputfile)) {
-
-        uint32_t size = size_in_spiffs(inputfile);
-        uint8_t *mem = BigBuf_malloc(size);
-
-        Dbprintf(_YELLOW_("found input file %s"), inputfile);
-
-        rdv40_spiffs_read_as_filetype(inputfile, mem, size, RDV40_SPIFFS_SAFETY_SAFE);
-
-        now = size / 9;
-        for (int i = 0; i < now; i++)
-            for (int j = 0; j < 4; j++)
-                words[i] |= (hex2int(mem[2 * j + 9 * i]) << 4 | hex2int(mem[2 * j + 1 + 9 * i])) << ((3 - j) * 8);
-
-        Dbprintf(_YELLOW_("read data from input file"));
-    }
-
-    BigBuf_free();
-
-    return (now > 0) ? now : 0;
-}
-
-static void append(const char *filename, uint8_t *entry, size_t entry_len) {
-
-    LED_D_ON();
-    if (log_exists == false) {
-        rdv40_spiffs_write(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
-        log_exists = true;
-    } else {
-        rdv40_spiffs_append(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
-    }
-    LED_D_OFF();
-}
-
-void ModInfo(void) {
-    DbpString(_YELLOW_("  LF EM4x50 sim/collector/bruteforce mode") " - a.k.a tharexde");
-}
-
-void RunMod(void) {
-
-    bool state_change = true;//, password_found = false;
-    int pwd_found = false;
-    uint8_t state = STATE_SIM;
-    // declarations for simulating
-    uint32_t words[33] = {0x0};
-    uint32_t pwd = 0x0;
-    uint32_t passwords[2] = {0x0};
-    size_t now = 0;
-    // declarations for reading
-    int no_words = 0;
-    //uint32_t words[EM4X50_TAG_WORD];
-    uint8_t entry[81];
-
-    rdv40_spiffs_lazy_mount();
-
-    StandAloneMode();
-    Dbprintf(_YELLOW_("Standalone mode THAREXDE started"));
-
-    for (;;) {
-
-        WDT_HIT();
-        if (data_available()) break;
-
-        // press button - toggle between SIM, READ and BRUTE
-        // hold button - exit
-        int button_pressed = BUTTON_CLICKED(1000);
-        if (button_pressed == BUTTON_SINGLE_CLICK) {
-
-            SpinUp(100);
-
-            switch (state) {
-
-                case STATE_SIM:
-                    state = STATE_READ;
-                    break;
-                case STATE_READ:
-                    state = STATE_BRUTE;
-                    break;
-                case STATE_BRUTE:
-                    state = STATE_SIM;
-                    break;
-                default:
-                    break;
-            }
-
-            state_change = true;
-
-        } else if (button_pressed == BUTTON_HOLD) {
-
-            SpinDown(100);
-            break;
-        }
-
-        if (state == STATE_SIM) {
-
-            if (state_change) {
-
-                FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
-                FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT);
-                FpgaSendCommand(FPGA_CMD_SET_DIVISOR, LF_DIVISOR_125);
-
-                AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK;
-                AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
-                AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK;
-
-                LEDsoff();
-                LED_A_ON();
-                Dbprintf("");
-                Dbprintf(_YELLOW_("switched to EM4x50 simulating mode"));
-
-                now = get_input_data_from_file(words, LF_EM4X50SIMULATE_INPUTFILE);
-                if (now > 0) {
-                    Dbprintf(_YELLOW_("simulating %i blocks"), now);
-                    for (int i = 0; i < now; i++)
-                        Dbprintf("%2i -> %lx", i + 1, words[i]);
-
-                } else {
-                    Dbprintf(_RED_("error in input data"));
-                }
-
-                state_change = false;
-            }
-
-            em4x50_sim_send_listen_window();
-            for (int i = 0; i < now; i++) {
-                em4x50_sim_send_listen_window();
-                em4x50_sim_send_word(words[i]);
-            }
-
-        } else if (state == STATE_READ) {
-
-            if (state_change) {
-
-                LEDsoff();
-                LED_B_ON();
-                Dbprintf("");
-                Dbprintf(_YELLOW_("switched to EM4x50 reading mode"));
-
-                memset(entry, 0, sizeof(entry));
-                memset(words, 0, sizeof(words));
-
-                log_exists = exists_in_spiffs(LF_EM4X50COLLECT_LOGFILE);
-
-                state_change = false;
-            }
-
-            no_words = em4x50_standalone_read(words);
-
-            if (no_words > 0) {
-
-                memset(entry, 0, sizeof(entry));
-
-                sprintf((char *)entry, "found new EM4x50 tag:");
-                Dbprintf("%s", entry);
-                strcat((char *)entry, "\n");
-                append(LF_EM4X50COLLECT_LOGFILE, entry, strlen((char *)entry));
-
-                for (int i = 0; i < no_words; i++) {
-
-                    sprintf((char *)entry, "  %2i -> 0x%08"PRIx32"", i + 1, words[i]);
-                    Dbprintf("%s", entry);
-                    strcat((char *)entry, "\n");
-                    append(LF_EM4X50COLLECT_LOGFILE, entry, strlen((char *)entry));
-                }
-            }
-
-        } else if (state == STATE_BRUTE) {
-
-            if (state_change) {
-
-                LEDsoff();
-                LED_C_ON();
-                Dbprintf("");
-                Dbprintf(_YELLOW_("switched to EM4x50 brute force mode"));
-
-                log_exists = exists_in_spiffs(LF_EM4X50BRUTE_LOGFILE);
-                now = get_input_data_from_file(passwords, LF_EM4X50BRUTE_INPUTFILE);
-
-                if (now == 2) {
-
-                    // print some information
-                    int no_iter = passwords[1] - passwords[0] + 1;
-                    int dur_s = no_iter / EM4X50_PWD_SPEED;
-                    int dur_h = dur_s / 3600;
-                    int dur_m = (dur_s - dur_h * 3600) / 60;
-                    dur_s -= dur_h * 3600 + dur_m * 60;
-
-                    //iterprint = no_iter/10;
-
-                    Dbprintf(_YELLOW_("trying %i passwords in range [0x%08x, 0x%08x]"),
-                             no_iter, passwords[0], passwords[1]);
-                    Dbprintf(_YELLOW_("estimated duration: %ih%im%is"),
-                             dur_h, dur_m, dur_s);
-
-                } else {
-                    Dbprintf(_RED_("error in input data"));
-                    break;
-                }
-
-                state_change = false;
-            }
-
-            pwd_found = em4x50_standalone_brute(passwords[0], passwords[1], &pwd);
-
-            if (pwd_found == PM3_ETIMEOUT) {
-
-                // timeout -> no EM4x50 tag on reader?
-                Dbprintf(_YELLOW_("timeout - no EM4x50 tag detected"));
-
-            } else if (pwd_found == true) {
-
-                // password found -> write to logfile
-                sprintf((char *)entry, "password found: 0x%08"PRIx32, pwd);
-                Dbprintf(_YELLOW_("%s"), entry);
-                strcat((char *)entry, "\n");
-                append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry));
-
-                break;
-
-            } else {
-
-                if (pwd == passwords[1] + 1) {
-
-                    // finished without success -> write to logfile
-                    sprintf((char *)entry, "no password found");
-                    Dbprintf(_YELLOW_("%s"), entry);
-                    strcat((char *)entry, "\n");
-                    append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry));
-
-
-                } else {
-
-                    // stopped -> write to logfile
-                    sprintf((char *)entry, "stopped search - last password: 0x%08"PRIx32, pwd);
-                    Dbprintf(_YELLOW_("%s"), entry);
-                    strcat((char *)entry, "\n");
-                    append(LF_EM4X50BRUTE_LOGFILE, entry, strlen((char *)entry));
-
-                    // replace start password by last tested password in
-                    // inputfile (spiffs) so that brute forcing process will
-                    // be continued when envoking brute force mode again
-                    sprintf((char *)entry, "%08"PRIx32"\n%08"PRIx32"\n", pwd, passwords[1]);
-                    rdv40_spiffs_write(LF_EM4X50BRUTE_INPUTFILE,
-                                       entry,
-                                       strlen((char *)entry),
-                                       RDV40_SPIFFS_SAFETY_SAFE);
-
-                }
-
-                break;
-            }
-        }
-    }
-
-    if (state == STATE_READ) {
-        DownloadLogInstructions(LF_EM4X50COLLECT_LOGFILE);
-    } else if (state == STATE_BRUTE) {
-        LoadDataInstructions(LF_EM4X50BRUTE_INPUTFILE);
-        DownloadLogInstructions(LF_EM4X50BRUTE_LOGFILE);
-    } else {
-        LoadDataInstructions(LF_EM4X50SIMULATE_INPUTFILE);
-    }
-
-    LED_D_ON();
-    rdv40_spiffs_lazy_unmount();
-    LED_D_OFF();
-
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-    LEDsoff();
-    Dbprintf("");
-    Dbprintf(_YELLOW_("[=] Standalone mode THAREXDE stopped"));
-
-}

From a04d67e82866fe5775467071d6c236312b9fecc0 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Thu, 17 Dec 2020 23:23:31 +0300
Subject: [PATCH 102/682] emrtd: Dump image when dumping EF_DG2

---
 client/src/cmdhfemrtd.c | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 299f3e7c7..390b95866 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -704,6 +704,33 @@ static bool emrtd_select_and_read(uint8_t *dataout, int *dataoutlen, const char
     return true;
 }
 
+static bool emrtd_dump_ef_dg2(uint8_t *file_contents, int file_length) {
+    uint8_t data[EMRTD_MAX_FILE_SIZE];
+    int datalen = 0;
+
+    // This is a hacky impl that just looks for the image header. I'll improve it eventually.
+    // based on mrpkey.py
+    // FF D8 FF E0 -> JPEG
+    // 00 00 00 0C 6A 50 -> JPEG 2000
+    for (int i = 0; i < file_length - 6; i++) {
+        if ((file_contents[i] == 0xFF && file_contents[i + 1] == 0xD8 && file_contents[i + 2] == 0xFF && file_contents[i + 3] == 0xE0) ||
+            (file_contents[i] == 0x00 && file_contents[i + 1] == 0x00 && file_contents[i + 2] == 0x00 && file_contents[i + 3] == 0x0C && file_contents[i + 4] == 0x6A && file_contents[i + 5] == 0x50)) {
+            datalen = file_length - i;
+            memcpy(data, file_contents + i, datalen);
+            break;
+        }
+    }
+
+    // If we didn't get any data, return false.
+    if (datalen == 0) {
+        return false;
+    }
+
+    saveFile("EF_DG2", ".jpg", data, datalen);
+    return true;
+}
+
+
 static bool emrtd_dump_ef_dg5(uint8_t *file_contents, int file_length) {
     uint8_t data[EMRTD_MAX_FILE_SIZE];
     int datalen = 0;
@@ -741,7 +768,9 @@ static bool emrtd_dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, cons
     PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
     saveFile(name, ".BIN", response, resplen);
 
-    if (strcmp(file, EMRTD_EF_DG5) == 0) {
+    if (strcmp(file, EMRTD_EF_DG2) == 0) {
+        emrtd_dump_ef_dg2(response, resplen);
+    } else if (strcmp(file, EMRTD_EF_DG5) == 0) {
         emrtd_dump_ef_dg5(response, resplen);
     } else if (strcmp(file, EMRTD_EF_SOD) == 0) {
         emrtd_dump_ef_sod(response, resplen);

From 2d00fcea98c31c65b9c16c6c1fb6bb08d6acdfa1 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Thu, 17 Dec 2020 21:28:19 +0100
Subject: [PATCH 103/682] added function eview for EM4x50

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a4898db8b..a1b430303 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+ - Added  `lf em 4x50 eview` - show uploaded EM4x50 data in emul memory (@tharexde) 
  - Fix `data rawdemod` parsing for psk2 and user defined clock (@cyberpunk-re)
  - Added `hf iclass encode` - encode a wiegand binary to a encrypted credential (@iceman1001)
  - Changed `recoverpk.py` - now tests more ECDSA curves (@doegox)

From f48f85469eca01c3ef070e0dd0aba622bc20fea2 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 17 Dec 2020 21:56:56 +0100
Subject: [PATCH 104/682] fix 308195 coverity

---
 client/src/cmdhfemrtd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 390b95866..416234c7f 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -813,7 +813,7 @@ static bool emrtd_do_bac(char *documentnumber, char *dob, char *expiry, uint8_t
     sprintf(kmrz, "%s%i%s%i%s%i", documentnumber, documentnumbercd, dob, dobcd, expiry, expirycd);
     PrintAndLogEx(DEBUG, "kmrz.............. " _GREEN_("%s"), kmrz);
 
-    uint8_t kseed[16] = { 0x00 };
+    uint8_t kseed[20] = { 0x00 };
     mbedtls_sha1((unsigned char *)kmrz, strlen(kmrz), kseed);
     PrintAndLogEx(DEBUG, "kseed (sha1)...... %s ", sprint_hex_inrow(kseed, 16));
 

From 254235237edcab79af824727140d5afe1d3d3554 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Thu, 17 Dec 2020 22:06:44 +0100
Subject: [PATCH 105/682] emrtd: fix emrtd_read_binary params

---
 client/src/cmdhfemrtd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 390b95866..e73ed19f3 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -320,7 +320,7 @@ static int emrtd_external_authenticate(uint8_t *data, int length, uint8_t *datao
 
 static int _emrtd_read_binary(int offset, int bytes_to_read, uint8_t *dataout, int *dataoutlen, bool use_14b) {
     char cmd[50];
-    sprintf(cmd, "00%s%04i%02i", EMRTD_READ_BINARY, offset, bytes_to_read);
+    sprintf(cmd, "00%s%04X%02X", EMRTD_READ_BINARY, offset, bytes_to_read);
 
     return emrtd_exchange_commands(cmd, dataout, dataoutlen, false, true, use_14b);
 }

From 814e7c2536392c8680be3161abe15b72af27b402 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 17 Dec 2020 22:15:33 +0100
Subject: [PATCH 106/682] fix 308198 coverity

---
 client/src/cmdhfemrtd.c | 49 +++++++++++++++++++++++++----------------
 1 file changed, 30 insertions(+), 19 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 416234c7f..9e403350d 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -164,10 +164,10 @@ static int emrtd_get_asn1_data_length(uint8_t *datain, int datainlen, int offset
 }
 
 static int emrtd_get_asn1_field_length(uint8_t *datain, int datainlen, int offset) {
-    PrintAndLogEx(DEBUG, "asn1fieldlength, datain: %s", sprint_hex_inrow(datain, datainlen));
+    PrintAndLogEx(DEBUG, "asn1 fieldlength, datain: %s", sprint_hex_inrow(datain, datainlen));
     int lenfield = (int) * (datain + offset);
-    PrintAndLogEx(DEBUG, "asn1fieldlength, thing: %i", lenfield);
-    if (lenfield <= 0x7f) {
+    PrintAndLogEx(DEBUG, "asn1 fieldlength, thing: %i", lenfield);
+    if (lenfield <= 0x7F) {
         return 1;
     } else if (lenfield == 0x81) {
         return 2;
@@ -571,31 +571,32 @@ static int emrtd_read_file(uint8_t *dataout, int *dataoutlen, uint8_t *kenc, uin
 static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int *datainlen, uint8_t *dataout, int *dataoutlen, int tag1, int tag2, bool twobytetag) {
     int offset = 1;
     offset += emrtd_get_asn1_field_length(datain, *datainlen, offset);
-    int elementidlen = 0;
-    int elementlen = 0;
-    int elementlenlen = 0;
+
+    int e_idlen = 0;
+    int e_datalen = 0;
+    int e_fieldlen = 0;
     while (offset < *datainlen) {
         PrintAndLogEx(DEBUG, "emrtd_lds_get_data_by_tag, offset: %i, data: %X", offset, *(datain + offset));
         // Determine element ID length to set as offset on asn1datalength
-        if ((*(datain + offset) == 0x5f) || (*(datain + offset) == 0x7f)) {
-            elementidlen = 2;
+        if ((*(datain + offset) == 0x5F) || (*(datain + offset) == 0x7F)) {
+            e_idlen = 2;
         } else {
-            elementidlen = 1;
+            e_idlen = 1;
         }
 
         // Get the length of the element
-        elementlen = emrtd_get_asn1_data_length(datain + offset, *datainlen - offset, elementidlen);
+        e_datalen = emrtd_get_asn1_data_length(datain + offset, *datainlen - offset, e_idlen);
 
         // Get the length of the element's length
-        elementlenlen = emrtd_get_asn1_field_length(datain + offset, *datainlen - offset, elementidlen);
+        e_fieldlen = emrtd_get_asn1_field_length(datain + offset, *datainlen - offset, e_idlen);
 
         // If the element is what we're looking for, get the data and return true
         if (*(datain + offset) == tag1 && (!twobytetag || *(datain + offset + 1) == tag2)) {
-            *dataoutlen = elementlen;
-            memcpy(dataout, datain + offset + elementidlen + elementlenlen, elementlen);
+            *dataoutlen = e_datalen;
+            memcpy(dataout, datain + offset + e_idlen + e_fieldlen, e_datalen);
             return true;
         }
-        offset += elementidlen + elementlen + elementlenlen;
+        offset += e_idlen + e_datalen + e_fieldlen;
     }
     // Return false if we can't find the relevant element
     return false;
@@ -736,21 +737,31 @@ static bool emrtd_dump_ef_dg5(uint8_t *file_contents, int file_length) {
     int datalen = 0;
 
     // If we can't find image in EF_DG5, return false.
-    if (!emrtd_lds_get_data_by_tag(file_contents, &file_length, data, &datalen, 0x5f, 0x40, true)) {
+    if (emrtd_lds_get_data_by_tag(file_contents, &file_length, data, &datalen, 0x5F, 0x40, true) == false) {
         return false;
     }
 
-    saveFile("EF_DG5", ".jpg", data, datalen);
+    if (datalen < EMRTD_MAX_FILE_SIZE) {
+        saveFile("EF_DG5", ".jpg", data, datalen);
+    } else {
+        PrintAndLogEx(ERR, "error (emrtd_dump_ef_dg5) datalen out-of-bounds");
+        return false;
+    }
     return true;
 }
 
 static bool emrtd_dump_ef_sod(uint8_t *file_contents, int file_length) {
     uint8_t data[EMRTD_MAX_FILE_SIZE];
 
-    int datalenlen = emrtd_get_asn1_field_length(file_contents, file_length, 1);
+    int fieldlen = emrtd_get_asn1_field_length(file_contents, file_length, 1);
     int datalen = emrtd_get_asn1_data_length(file_contents, file_length, 1);
-
-    memcpy(data, file_contents + datalenlen + 1, datalen);
+    
+    if (fieldlen + 1 < EMRTD_MAX_FILE_SIZE) {
+        memcpy(data, file_contents + fieldlen + 1, datalen);
+    } else {
+        PrintAndLogEx(ERR, "error (emrtd_dump_ef_sod) fieldlen out-of-bounds");
+        return false;
+    }
 
     saveFile("EF_SOD", ".p7b", data, datalen);
     return true;

From f0d3cdec6728b8f6c5a372eb995e3f8e601afa99 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 17 Dec 2020 22:20:07 +0100
Subject: [PATCH 107/682] fix 308197 coverity

---
 client/src/cmdhfemrtd.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 9e403350d..7e099775e 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -518,7 +518,6 @@ static bool _emrtd_secure_read_binary_decrypt(uint8_t *kenc, uint8_t *kmac, uint
     return true;
 }
 
-
 static int emrtd_read_file(uint8_t *dataout, int *dataoutlen, uint8_t *kenc, uint8_t *kmac, uint8_t *ssc, bool use_secure, bool use_14b) {
     uint8_t response[EMRTD_MAX_FILE_SIZE];
     int resplen = 0;
@@ -592,9 +591,15 @@ static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int *datainlen, uint8_t *
 
         // If the element is what we're looking for, get the data and return true
         if (*(datain + offset) == tag1 && (!twobytetag || *(datain + offset + 1) == tag2)) {
-            *dataoutlen = e_datalen;
-            memcpy(dataout, datain + offset + e_idlen + e_fieldlen, e_datalen);
-            return true;
+
+            if ( *datainlen > e_datalen) {
+                *dataoutlen = e_datalen;
+                memcpy(dataout, datain + offset + e_idlen + e_fieldlen, e_datalen);
+                return true;
+            } else {
+                PrintAndLogEx(ERR, "error (emrtd_lds_get_data_by_tag) e_datalen out-of-bounds");
+                return false;
+            }
         }
         offset += e_idlen + e_datalen + e_fieldlen;
     }

From ef7a6bb166cdeeecf12244113ffd9636b5732d14 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 17 Dec 2020 22:54:23 +0100
Subject: [PATCH 108/682] text

---
 client/luascripts/hf_mfu_magicwrite.lua | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/luascripts/hf_mfu_magicwrite.lua b/client/luascripts/hf_mfu_magicwrite.lua
index 2961bd54c..4b4d7178a 100644
--- a/client/luascripts/hf_mfu_magicwrite.lua
+++ b/client/luascripts/hf_mfu_magicwrite.lua
@@ -60,7 +60,7 @@ arguments = [[
     -p      password (8 hexsymbols),  set password on tag.
     -a      pack ( 4 hexsymbols), set pack on tag.
     -s      signature data (64 hexsymbols), set signature data on tag.
-    -o      OTP data (8 hexsymbols), set one-time-pad data on tag.
+    -o      OTP data (8 hexsymbols), set `one time programmable` data on tag.
     -v      version data (16 hexsymbols), set version data on tag.
     -w      wipe tag. You can specify password if the tag has been locked down. Fills tag with zeros and put default values for NTAG213 (like -t 5)
     -k      pwd to use with the wipe option

From fbed338dcef7f98fb2d921fa274a621d70000a40 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 18 Dec 2020 02:39:48 +0300
Subject: [PATCH 109/682] emrtd: don't check for EF_CardAccess, and dump it on
 hf emrtd dump

---
 client/src/cmdhfemrtd.c | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index bdf19bfca..8d0aaecaa 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -937,15 +937,6 @@ static bool emrtd_do_auth(char *documentnumber, char *dob, char *expiry, bool BA
     uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     int resplen = 0;
 
-    // Select and read EF_CardAccess
-    if (emrtd_select_file(EMRTD_P1_SELECT_BY_EF, EMRTD_EF_CARDACCESS, *use_14b)) {
-        emrtd_read_file(response, &resplen, NULL, NULL, NULL, false, *use_14b);
-        PrintAndLogEx(INFO, "Read EF_CardAccess, len: %i.", resplen);
-        PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
-    } else {
-        PrintAndLogEx(INFO, "PACE unsupported. Will not read EF_CardAccess.");
-    }
-
     // Select MRTD applet
     if (emrtd_select_file(EMRTD_P1_SELECT_BY_NAME, EMRTD_AID_MRTD, *use_14b) == false) {
         PrintAndLogEx(ERR, "Couldn't select the MRTD application.");
@@ -1041,8 +1032,12 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         emrtd_dump_file(ks_enc, ks_mac, ssc, file_id, file_name, BAC, use_14b);
     }
 
-    // Dump EF_SOD
+    // Dump EF_SOD and EF_CardAccess (if available)
     emrtd_dump_file(ks_enc, ks_mac, ssc, EMRTD_EF_SOD, "EF_SOD", BAC, use_14b);
+    if (!emrtd_dump_file(ks_enc, ks_mac, ssc, EMRTD_EF_CARDACCESS, "EF_CardAccess", BAC, use_14b)) {
+        PrintAndLogEx(INFO, "Couldn't dump EF_CardAccess, card does not support PACE.");
+        PrintAndLogEx(HINT, "This is expected behavior for cards without PACE, and isn't something to be worried about.");
+    }
 
     DropField();
     return PM3_SUCCESS;

From ffb71118359a6d5a99eb3c5157fdd98aada7095c Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 18 Dec 2020 03:06:42 +0300
Subject: [PATCH 110/682] emrtd: Ensure that DOB and doc expiry lengths are
 correct

---
 client/src/cmdhfemrtd.c | 30 +++++++++++++++++++++++++++---
 1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 8d0aaecaa..2f409d5e4 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1324,10 +1324,22 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
     
     if (CLIParamStrToBuf(arg_get_str(ctx, 2), dob, 6, &slen) != 0 || slen == 0) {
         BAC = false;
-    } 
+    } else {
+        if (slen != 6) {
+            PrintAndLogEx(ERR, "Date of Birth length is incorrect, cannot continue.");
+            PrintAndLogEx(HINT, "Use the format YYMMDD.");
+            return PM3_ESOFT;
+        }
+    }
     
     if (CLIParamStrToBuf(arg_get_str(ctx, 3), expiry, 6, &slen) != 0 || slen == 0) {
         BAC = false;
+    } else {
+        if (slen != 6) {
+            PrintAndLogEx(ERR, "Document expiry length is incorrect, cannot continue.");
+            PrintAndLogEx(HINT, "Use the format YYMMDD.");
+            return PM3_ESOFT;
+        }
     }
 
     CLIParserFree(ctx);
@@ -1359,17 +1371,29 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
     if (CLIParamStrToBuf(arg_get_str(ctx, 1), docnum, 9, &slen) != 0 || slen == 0) {
         BAC = false;
     } else {
-        if ( slen != 9) {
+        if (slen != 9) {
             memset(docnum + slen, 0x3c, 9 - slen);
         }
     }
     
     if (CLIParamStrToBuf(arg_get_str(ctx, 2), dob, 6, &slen) != 0 || slen == 0) {
         BAC = false;
-    } 
+    } else {
+        if (slen != 6) {
+            PrintAndLogEx(ERR, "Date of Birth length is incorrect, cannot continue.");
+            PrintAndLogEx(HINT, "Use the format YYMMDD.");
+            return PM3_ESOFT;
+        }
+    }
     
     if (CLIParamStrToBuf(arg_get_str(ctx, 3), expiry, 6, &slen) != 0 || slen == 0) {
         BAC = false;
+    } else {
+        if (slen != 6) {
+            PrintAndLogEx(ERR, "Document expiry length is incorrect, cannot continue.");
+            PrintAndLogEx(HINT, "Use the format YYMMDD.");
+            return PM3_ESOFT;
+        }
     }
 
     CLIParserFree(ctx);

From 45d55106c6c9689ac5e0dc741a7ce50423cb9be7 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 18 Dec 2020 03:13:06 +0300
Subject: [PATCH 111/682] emrtd: Auto-convert document number to uppercase

---
 client/src/cmdhfemrtd.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 2f409d5e4..ae38ebc73 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1291,6 +1291,15 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     return PM3_SUCCESS;
 }
 
+static void text_to_upper(uint8_t *data, int datalen) {
+    // Loop over text to make lowercase text uppercase
+    for (int i = 0; i < datalen; i++) {
+        if ('a' <= data[i] && data[i] <= 'z') {
+            data[i] -= 32;
+        }
+    }
+}
+
 static int cmd_hf_emrtd_dump(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf emrtd dump",
@@ -1316,6 +1325,7 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
     if (CLIParamStrToBuf(arg_get_str(ctx, 1), docnum, 9, &slen) != 0 || slen == 0) {
         BAC = false;
     } else {
+        text_to_upper(docnum, slen);
         if (slen != 9) {
             // Pad to 9 with <
             memset(docnum + slen, 0x3c, 9 - slen);
@@ -1371,6 +1381,8 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
     if (CLIParamStrToBuf(arg_get_str(ctx, 1), docnum, 9, &slen) != 0 || slen == 0) {
         BAC = false;
     } else {
+        text_to_upper(docnum, slen);
+        PrintAndLogEx(HINT, "%.*s.", slen, (char *) docnum);
         if (slen != 9) {
             memset(docnum + slen, 0x3c, 9 - slen);
         }

From 3312230e80d2d9f952ed234ef854909fcf3582d3 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 18 Dec 2020 03:15:14 +0300
Subject: [PATCH 112/682] emrtd: Remove debug line

---
 client/src/cmdhfemrtd.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index ae38ebc73..e77fc277b 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1382,7 +1382,6 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
         BAC = false;
     } else {
         text_to_upper(docnum, slen);
-        PrintAndLogEx(HINT, "%.*s.", slen, (char *) docnum);
         if (slen != 9) {
             memset(docnum + slen, 0x3c, 9 - slen);
         }

From 027f4e5adc78edbed67694c992c88a63b8c76077 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 18 Dec 2020 03:26:26 +0300
Subject: [PATCH 113/682] emrtd: Use toupper

---
 client/src/cmdhfemrtd.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index e77fc277b..dc07744fe 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1294,9 +1294,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
 static void text_to_upper(uint8_t *data, int datalen) {
     // Loop over text to make lowercase text uppercase
     for (int i = 0; i < datalen; i++) {
-        if ('a' <= data[i] && data[i] <= 'z') {
-            data[i] -= 32;
-        }
+        data[i] = toupper(data[i]);
     }
 }
 

From 79e9875b43bf893ba818a918ae850a569bb91ce2 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 18 Dec 2020 03:29:21 +0300
Subject: [PATCH 114/682] emrtd: Validate date further

---
 client/src/cmdhfemrtd.c | 32 ++++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index dc07744fe..5f6c12891 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1298,6 +1298,22 @@ static void text_to_upper(uint8_t *data, int datalen) {
     }
 }
 
+static bool validate_date(uint8_t *data, int datalen) {
+    // Date has to be 6 chars
+    if (datalen != 6) {
+        return false;
+    }
+
+    // Check for valid date and month numbers
+    char temp[4] = { 0x00 };
+    memcpy(temp, data + 2, 2);
+    int month = (int) strtol(temp, NULL, 10);
+    memcpy(temp, data + 4, 2);
+    int day = (int) strtol(temp, NULL, 10);
+
+    return !(day <= 0 || day > 31 || month <= 0 || month > 12);
+}
+
 static int cmd_hf_emrtd_dump(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf emrtd dump",
@@ -1333,8 +1349,8 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
     if (CLIParamStrToBuf(arg_get_str(ctx, 2), dob, 6, &slen) != 0 || slen == 0) {
         BAC = false;
     } else {
-        if (slen != 6) {
-            PrintAndLogEx(ERR, "Date of Birth length is incorrect, cannot continue.");
+        if (!validate_date(dob, slen)) {
+            PrintAndLogEx(ERR, "Date of birth date format is incorrect, cannot continue.");
             PrintAndLogEx(HINT, "Use the format YYMMDD.");
             return PM3_ESOFT;
         }
@@ -1343,8 +1359,8 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
     if (CLIParamStrToBuf(arg_get_str(ctx, 3), expiry, 6, &slen) != 0 || slen == 0) {
         BAC = false;
     } else {
-        if (slen != 6) {
-            PrintAndLogEx(ERR, "Document expiry length is incorrect, cannot continue.");
+        if (!validate_date(expiry, slen)) {
+            PrintAndLogEx(ERR, "Expiry date format is incorrect, cannot continue.");
             PrintAndLogEx(HINT, "Use the format YYMMDD.");
             return PM3_ESOFT;
         }
@@ -1388,8 +1404,8 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
     if (CLIParamStrToBuf(arg_get_str(ctx, 2), dob, 6, &slen) != 0 || slen == 0) {
         BAC = false;
     } else {
-        if (slen != 6) {
-            PrintAndLogEx(ERR, "Date of Birth length is incorrect, cannot continue.");
+        if (!validate_date(dob, slen)) {
+            PrintAndLogEx(ERR, "Date of birth date format is incorrect, cannot continue.");
             PrintAndLogEx(HINT, "Use the format YYMMDD.");
             return PM3_ESOFT;
         }
@@ -1398,8 +1414,8 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
     if (CLIParamStrToBuf(arg_get_str(ctx, 3), expiry, 6, &slen) != 0 || slen == 0) {
         BAC = false;
     } else {
-        if (slen != 6) {
-            PrintAndLogEx(ERR, "Document expiry length is incorrect, cannot continue.");
+        if (!validate_date(expiry, slen)) {
+            PrintAndLogEx(ERR, "Expiry date format is incorrect, cannot continue.");
             PrintAndLogEx(HINT, "Use the format YYMMDD.");
             return PM3_ESOFT;
         }

From ffb1b662ac5452bd3f63c6715c66add19a8fe787 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Fri, 18 Dec 2020 00:54:14 +0100
Subject: [PATCH 115/682] allowing user timeouts in 14b apdus

---
 armsrc/iso14443b.c      |  4 +++-
 client/src/cmdhf14b.c   | 37 +++++++++++++++++++++++++------------
 client/src/cmdhf14b.h   |  2 +-
 client/src/cmdhfemrtd.c |  3 ++-
 4 files changed, 31 insertions(+), 15 deletions(-)

diff --git a/armsrc/iso14443b.c b/armsrc/iso14443b.c
index f170be153..a5b15a0c0 100644
--- a/armsrc/iso14443b.c
+++ b/armsrc/iso14443b.c
@@ -1400,7 +1400,9 @@ int iso14443b_apdu(uint8_t const *msg, size_t msg_len, bool send_chaining, void
     CodeAndTransmit14443bAsReader(real_cmd, msg_len + 3, &start_time, &eof_time);
 
     eof_time += DELAY_ISO14443B_VCD_TO_VICC_READER;
-    int len = Get14443bAnswerFromTag(rxdata, rxmaxlen, ISO14443B_READER_TIMEOUT, &eof_time);
+
+//    int len = Get14443bAnswerFromTag(rxdata, rxmaxlen, ISO14443B_READER_TIMEOUT, &eof_time);
+    int len = Get14443bAnswerFromTag(rxdata, rxmaxlen, iso14b_timeout, &eof_time);
     FpgaDisableTracing();
 
     uint8_t *data_bytes = (uint8_t *) rxdata;
diff --git a/client/src/cmdhf14b.c b/client/src/cmdhf14b.c
index e21509fe8..ffec87950 100644
--- a/client/src/cmdhf14b.c
+++ b/client/src/cmdhf14b.c
@@ -1415,7 +1415,7 @@ static int select_card_14443b_4(bool disconnect, iso14b_card_select_t *card) {
     return PM3_SUCCESS;
 }
 
-static int handle_14b_apdu(bool chainingin, uint8_t *datain, int datainlen, bool activateField, uint8_t *dataout, int maxdataoutlen, int *dataoutlen, bool *chainingout) {
+static int handle_14b_apdu(bool chainingin, uint8_t *datain, int datainlen, bool activateField, uint8_t *dataout, int maxdataoutlen, int *dataoutlen, bool *chainingout, int user_timeout) {
     *chainingout = false;
 
     if (activateField) {
@@ -1430,13 +1430,24 @@ static int handle_14b_apdu(bool chainingin, uint8_t *datain, int datainlen, bool
     if (chainingin)
         flags = ISO14B_SEND_CHAINING;
 
+    uint32_t time_wait = 0;
+    if (user_timeout > 0) {
+#define MAX_14B_TIMEOUT 40542464 // = (2^32-1) * (8*16) / 13560000Hz * 1000ms/s
+        flags |= ISO14B_SET_TIMEOUT;
+        if (user_timeout > MAX_14B_TIMEOUT) {
+            user_timeout = MAX_14B_TIMEOUT;
+            PrintAndLogEx(INFO, "set timeout to 40542 seconds (11.26 hours). The max we can wait for response");
+        }
+        time_wait = 13560000 / 1000 / (8 * 16) * user_timeout; // timeout in ETUs (time to transfer 1 bit, approx. 9.4 us)
+    }
+
     // "Command APDU" length should be 5+255+1, but javacard's APDU buffer might be smaller - 133 bytes
     // https://stackoverflow.com/questions/32994936/safe-max-java-card-apdu-data-command-and-respond-size
     // here length PM3_CMD_DATA_SIZE=512
     if (datain)
-        SendCommandMIX(CMD_HF_ISO14443B_COMMAND, ISO14B_APDU | flags, (datainlen & 0xFFFF), 0, datain, datainlen & 0xFFFF);
+        SendCommandMIX(CMD_HF_ISO14443B_COMMAND, ISO14B_APDU | flags, (datainlen & 0xFFFF), time_wait, datain, datainlen & 0xFFFF);
     else
-        SendCommandMIX(CMD_HF_ISO14443B_COMMAND, ISO14B_APDU | flags, 0, 0, NULL, 0);
+        SendCommandMIX(CMD_HF_ISO14443B_COMMAND, ISO14B_APDU | flags, 0, time_wait, NULL, 0);
 
     PacketResponseNG resp;
     if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, APDU_TIMEOUT)) {
@@ -1489,7 +1500,7 @@ static int handle_14b_apdu(bool chainingin, uint8_t *datain, int datainlen, bool
     return PM3_SUCCESS;
 }
 
-int exchange_14b_apdu(uint8_t *datain, int datainlen, bool activate_field, bool leave_signal_on, uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
+int exchange_14b_apdu(uint8_t *datain, int datainlen, bool activate_field, bool leave_signal_on, uint8_t *dataout, int maxdataoutlen, int *dataoutlen, int user_timeout) {
     *dataoutlen = 0;
     bool chaining = false;
     int res;
@@ -1506,7 +1517,7 @@ int exchange_14b_apdu(uint8_t *datain, int datainlen, bool activate_field, bool
             bool chainBlockNotLast = ((clen + vlen) < datainlen);
 
             *dataoutlen = 0;
-            res = handle_14b_apdu(chainBlockNotLast, &datain[clen], vlen, v_activate_field, dataout, maxdataoutlen, dataoutlen, &chaining);
+            res = handle_14b_apdu(chainBlockNotLast, &datain[clen], vlen, v_activate_field, dataout, maxdataoutlen, dataoutlen, &chaining, user_timeout);
             if (res) {
                 if (leave_signal_on == false)
                     switch_off_field_14b();
@@ -1535,7 +1546,7 @@ int exchange_14b_apdu(uint8_t *datain, int datainlen, bool activate_field, bool
 
     } else {
 
-        res = handle_14b_apdu(false, datain, datainlen, activate_field, dataout, maxdataoutlen, dataoutlen, &chaining);
+        res = handle_14b_apdu(false, datain, datainlen, activate_field, dataout, maxdataoutlen, dataoutlen, &chaining, user_timeout);
         if (res != PM3_SUCCESS) {
             if (leave_signal_on == false) {
                 switch_off_field_14b();
@@ -1546,7 +1557,7 @@ int exchange_14b_apdu(uint8_t *datain, int datainlen, bool activate_field, bool
 
     while (chaining) {
         // I-block with chaining
-        res = handle_14b_apdu(false, NULL, 0, false, &dataout[*dataoutlen], maxdataoutlen, dataoutlen, &chaining);
+        res = handle_14b_apdu(false, NULL, 0, false, &dataout[*dataoutlen], maxdataoutlen, dataoutlen, &chaining, user_timeout);
         if (res != PM3_SUCCESS) {
             if (leave_signal_on == false) {
                 switch_off_field_14b();
@@ -1594,6 +1605,7 @@ static int CmdHF14BAPDU(const char *Cmd) {
         arg_lit0("e",  "extended", "make extended length apdu if `m` parameter included"),
         arg_int0("l",  "le",       "<int>", "Le apdu parameter if `m` parameter included"),
         arg_strx1(NULL, "hex",     "<hex>", "<APDU | data> if `m` parameter included"),
+        arg_int0(NULL, "timeout",   "<dec>", "timeout in ms"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);
@@ -1653,6 +1665,7 @@ static int CmdHF14BAPDU(const char *Cmd) {
         // len = data + PCB(1b) + CRC(2b)
         CLIGetHexBLessWithReturn(ctx, 8, data, &datalen, 1 + 2);
     }
+    int user_timeout = arg_get_int_def(ctx, 9, -1);
     CLIParserFree(ctx);
 
     PrintAndLogEx(NORMAL, ">>>>[%s%s%s] %s",
@@ -1670,7 +1683,7 @@ static int CmdHF14BAPDU(const char *Cmd) {
             PrintAndLogEx(WARNING, "can't decode APDU.");
     }
 
-    int res = exchange_14b_apdu(data, datalen, activate_field, leave_signal_on, data, PM3_CMD_DATA_SIZE, &datalen);
+    int res = exchange_14b_apdu(data, datalen, activate_field, leave_signal_on, data, PM3_CMD_DATA_SIZE, &datalen, user_timeout);
     if (res != PM3_SUCCESS) {
         return res;
     }
@@ -1709,7 +1722,7 @@ static int CmdHF14BNdef(const char *Cmd) {
     uint8_t aSELECT_AID[80];
     int aSELECT_AID_n = 0;
     param_gethex_to_eol("00a4040007d276000085010100", 0, aSELECT_AID, sizeof(aSELECT_AID), &aSELECT_AID_n);
-    int res = exchange_14b_apdu(aSELECT_AID, aSELECT_AID_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
+    int res = exchange_14b_apdu(aSELECT_AID, aSELECT_AID_n, activate_field, keep_field_on, response, sizeof(response), &resplen, -1);
     if (res) {
         goto out;
     }
@@ -1735,7 +1748,7 @@ static int CmdHF14BNdef(const char *Cmd) {
     uint8_t aSELECT_FILE_NDEF[30];
     int aSELECT_FILE_NDEF_n = 0;
     param_gethex_to_eol("00a4000c020001", 0, aSELECT_FILE_NDEF, sizeof(aSELECT_FILE_NDEF), &aSELECT_FILE_NDEF_n);
-    res = exchange_14b_apdu(aSELECT_FILE_NDEF, aSELECT_FILE_NDEF_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
+    res = exchange_14b_apdu(aSELECT_FILE_NDEF, aSELECT_FILE_NDEF_n, activate_field, keep_field_on, response, sizeof(response), &resplen, -1);
     if (res)
         goto out;
 
@@ -1750,7 +1763,7 @@ static int CmdHF14BNdef(const char *Cmd) {
     uint8_t aREAD_NDEF[30];
     int aREAD_NDEF_n = 0;
     param_gethex_to_eol("00b0000002", 0, aREAD_NDEF, sizeof(aREAD_NDEF), &aREAD_NDEF_n);
-    res = exchange_14b_apdu(aREAD_NDEF, aREAD_NDEF_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
+    res = exchange_14b_apdu(aREAD_NDEF, aREAD_NDEF_n, activate_field, keep_field_on, response, sizeof(response), &resplen, -1);
     if (res) {
         goto out;
     }
@@ -1769,7 +1782,7 @@ static int CmdHF14BNdef(const char *Cmd) {
     aREAD_NDEF_n = 0;
     param_gethex_to_eol("00b00002", 0, aREAD_NDEF, sizeof(aREAD_NDEF), &aREAD_NDEF_n);
     aREAD_NDEF[4] = offset;
-    res = exchange_14b_apdu(aREAD_NDEF, aREAD_NDEF_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
+    res = exchange_14b_apdu(aREAD_NDEF, aREAD_NDEF_n, activate_field, keep_field_on, response, sizeof(response), &resplen, -1);
     if (res) {
         goto out;
     }
diff --git a/client/src/cmdhf14b.h b/client/src/cmdhf14b.h
index d236bb6cf..9bbb17625 100644
--- a/client/src/cmdhf14b.h
+++ b/client/src/cmdhf14b.h
@@ -15,7 +15,7 @@
 
 int CmdHF14B(const char *Cmd);
 
-int exchange_14b_apdu(uint8_t *datain, int datainlen, bool activate_field, bool leave_signal_on, uint8_t *dataout, int maxdataoutlen, int *dataoutlen);
+int exchange_14b_apdu(uint8_t *datain, int datainlen, bool activate_field, bool leave_signal_on, uint8_t *dataout, int maxdataoutlen, int *dataoutlen, int user_timeout);
 
 int infoHF14B(bool verbose);
 int readHF14B(bool verbose);
diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index bdf19bfca..619b9cf58 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -92,7 +92,8 @@ static bool emrtd_exchange_commands(const char *cmd, uint8_t *dataout, int *data
     param_gethex_to_eol(cmd, 0, aCMD, sizeof(aCMD), &aCMD_n);
     int res;
     if (use_14b) {
-        res = exchange_14b_apdu(aCMD, aCMD_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
+        // need to add a long timeout for passports with activated anti-bruteforce measure
+        res = exchange_14b_apdu(aCMD, aCMD_n, activate_field, keep_field_on, response, sizeof(response), &resplen, 15000);
     } else {
         res = ExchangeAPDU14a(aCMD, aCMD_n, activate_field, keep_field_on, response, sizeof(response), &resplen);
     }

From 204ae46bf70351ff11de1ff2d3f942007fd1c4fd Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Fri, 18 Dec 2020 00:56:42 +0100
Subject: [PATCH 116/682] minor

---
 armsrc/iso14443b.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/armsrc/iso14443b.c b/armsrc/iso14443b.c
index a5b15a0c0..11542a498 100644
--- a/armsrc/iso14443b.c
+++ b/armsrc/iso14443b.c
@@ -1400,8 +1400,6 @@ int iso14443b_apdu(uint8_t const *msg, size_t msg_len, bool send_chaining, void
     CodeAndTransmit14443bAsReader(real_cmd, msg_len + 3, &start_time, &eof_time);
 
     eof_time += DELAY_ISO14443B_VCD_TO_VICC_READER;
-
-//    int len = Get14443bAnswerFromTag(rxdata, rxmaxlen, ISO14443B_READER_TIMEOUT, &eof_time);
     int len = Get14443bAnswerFromTag(rxdata, rxmaxlen, iso14b_timeout, &eof_time);
     FpgaDisableTracing();
 

From 975034854df159b12ae7ddfc1e6bd32150b24a2d Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Fri, 18 Dec 2020 02:14:50 +0100
Subject: [PATCH 117/682] rework 14b apdu timeout computations

---
 armsrc/iso14443b.c    | 6 +++---
 client/src/cmdhf14b.c | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/armsrc/iso14443b.c b/armsrc/iso14443b.c
index 11542a498..c3c61e980 100644
--- a/armsrc/iso14443b.c
+++ b/armsrc/iso14443b.c
@@ -1201,7 +1201,7 @@ static int Get14443bAnswerFromTag(uint8_t *response, uint16_t max_len, int timeo
 
         if (Handle14443bSamplesFromTag(ci, cq)) {
 
-            *eof_time = dma_start_time + (samples) - DELAY_TAG_TO_ARM;  // end of EOF
+            *eof_time = GetCountSspClkDelta(dma_start_time) - (DELAY_TAG_TO_ARM * 128);  // end of EOF
 
             if (Demod.len > Demod.max_len) {
                 ret = -2; // overflow
@@ -1209,7 +1209,7 @@ static int Get14443bAnswerFromTag(uint8_t *response, uint16_t max_len, int timeo
             break;
         }
 
-        if (samples > timeout && Demod.state < DEMOD_PHASE_REF_TRAINING) {
+        if (((GetCountSspClkDelta(dma_start_time) >> 7) > timeout) && Demod.state < DEMOD_PHASE_REF_TRAINING) {
             ret = -1;
             break;
         }
@@ -1225,7 +1225,7 @@ static int Get14443bAnswerFromTag(uint8_t *response, uint16_t max_len, int timeo
                             - (Demod.len * (8 + 2)) // time for byte transfers
                             - (12)  // time for SOF transfer
                             - (12); // time for EOF transfer
-        LogTrace(Demod.output, Demod.len, (sof_time * 4), (*eof_time * 4), NULL, false);
+        LogTrace(Demod.output, Demod.len, sof_time, *eof_time, NULL, false);
     }
     return Demod.len;
 }
diff --git a/client/src/cmdhf14b.c b/client/src/cmdhf14b.c
index ffec87950..17c31e0a7 100644
--- a/client/src/cmdhf14b.c
+++ b/client/src/cmdhf14b.c
@@ -26,7 +26,7 @@
 #include "mifare/ndef.h"   // NDEFRecordsDecodeAndPrint
 
 #define TIMEOUT 2000
-#define APDU_TIMEOUT 4000
+#define APDU_TIMEOUT 2000
 
 // iso14b apdu input frame length
 static uint16_t apdu_frame_length = 0;
@@ -1450,7 +1450,7 @@ static int handle_14b_apdu(bool chainingin, uint8_t *datain, int datainlen, bool
         SendCommandMIX(CMD_HF_ISO14443B_COMMAND, ISO14B_APDU | flags, 0, time_wait, NULL, 0);
 
     PacketResponseNG resp;
-    if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, APDU_TIMEOUT)) {
+    if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, MAX(APDU_TIMEOUT, user_timeout))) {
         uint8_t *recv = resp.data.asBytes;
         int rlen = resp.oldarg[0];
         uint8_t res = resp.oldarg[1];

From 9b4e0c212f880275494197f4fb976f465b45e224 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 18 Dec 2020 04:26:39 +0300
Subject: [PATCH 118/682] emrtd: Remove unnecessary memcpys from two dump
 functions

---
 client/src/cmdhfemrtd.c | 23 +++++++++--------------
 1 file changed, 9 insertions(+), 14 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 5f6c12891..15983b2f9 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -711,18 +711,17 @@ static bool emrtd_select_and_read(uint8_t *dataout, int *dataoutlen, const char
 }
 
 static bool emrtd_dump_ef_dg2(uint8_t *file_contents, int file_length) {
-    uint8_t data[EMRTD_MAX_FILE_SIZE];
-    int datalen = 0;
+    int offset, datalen = 0;
 
     // This is a hacky impl that just looks for the image header. I'll improve it eventually.
     // based on mrpkey.py
     // FF D8 FF E0 -> JPEG
     // 00 00 00 0C 6A 50 -> JPEG 2000
-    for (int i = 0; i < file_length - 6; i++) {
-        if ((file_contents[i] == 0xFF && file_contents[i + 1] == 0xD8 && file_contents[i + 2] == 0xFF && file_contents[i + 3] == 0xE0) ||
-            (file_contents[i] == 0x00 && file_contents[i + 1] == 0x00 && file_contents[i + 2] == 0x00 && file_contents[i + 3] == 0x0C && file_contents[i + 4] == 0x6A && file_contents[i + 5] == 0x50)) {
-            datalen = file_length - i;
-            memcpy(data, file_contents + i, datalen);
+    // Note: Doing file_length - 6 to account for the longest data we're checking.
+    for (offset = 0; offset < file_length - 6; offset++) {
+        if ((file_contents[offset] == 0xFF && file_contents[offset + 1] == 0xD8 && file_contents[offset + 2] == 0xFF && file_contents[offset + 3] == 0xE0) ||
+            (file_contents[offset] == 0x00 && file_contents[offset + 1] == 0x00 && file_contents[offset + 2] == 0x00 && file_contents[offset + 3] == 0x0C && file_contents[offset + 4] == 0x6A && file_contents[offset + 5] == 0x50)) {
+            datalen = file_length - offset;
             break;
         }
     }
@@ -732,7 +731,7 @@ static bool emrtd_dump_ef_dg2(uint8_t *file_contents, int file_length) {
         return false;
     }
 
-    saveFile("EF_DG2", ".jpg", data, datalen);
+    saveFile("EF_DG2", ".jpg", file_contents + offset, datalen);
     return true;
 }
 
@@ -756,19 +755,15 @@ static bool emrtd_dump_ef_dg5(uint8_t *file_contents, int file_length) {
 }
 
 static bool emrtd_dump_ef_sod(uint8_t *file_contents, int file_length) {
-    uint8_t data[EMRTD_MAX_FILE_SIZE];
-
     int fieldlen = emrtd_get_asn1_field_length(file_contents, file_length, 1);
     int datalen = emrtd_get_asn1_data_length(file_contents, file_length, 1);
     
-    if (fieldlen + 1 < EMRTD_MAX_FILE_SIZE) {
-        memcpy(data, file_contents + fieldlen + 1, datalen);
-    } else {
+    if (fieldlen + 1 > EMRTD_MAX_FILE_SIZE) {
         PrintAndLogEx(ERR, "error (emrtd_dump_ef_sod) fieldlen out-of-bounds");
         return false;
     }
 
-    saveFile("EF_SOD", ".p7b", data, datalen);
+    saveFile("EF_SOD", ".p7b", file_contents + fieldlen + 1, datalen);
     return true;
 }
 

From cd21765acc045175cda637227c201df8dc597726 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 18 Dec 2020 04:28:14 +0300
Subject: [PATCH 119/682] emrtd: Move EF_CardAccess dump to before auth to
 ensure that it is dumped even without auth

---
 client/src/cmdhfemrtd.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 15983b2f9..3dc567d6c 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -988,6 +988,12 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         return PM3_ESOFT;
     }
 
+    // Dump EF_CardAccess (if available)
+    if (!emrtd_dump_file(ks_enc, ks_mac, ssc, EMRTD_EF_CARDACCESS, "EF_CardAccess", BAC, use_14b)) {
+        PrintAndLogEx(INFO, "Couldn't dump EF_CardAccess, card does not support PACE.");
+        PrintAndLogEx(HINT, "This is expected behavior for cards without PACE, and isn't something to be worried about.");
+    }
+
     // Authenticate with the eMRTD
     if (!emrtd_do_auth(documentnumber, dob, expiry, BAC_available, &BAC, ssc, ks_enc, ks_mac, &use_14b)) {
         DropField();
@@ -1027,12 +1033,8 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         emrtd_dump_file(ks_enc, ks_mac, ssc, file_id, file_name, BAC, use_14b);
     }
 
-    // Dump EF_SOD and EF_CardAccess (if available)
+    // Dump EF_SOD
     emrtd_dump_file(ks_enc, ks_mac, ssc, EMRTD_EF_SOD, "EF_SOD", BAC, use_14b);
-    if (!emrtd_dump_file(ks_enc, ks_mac, ssc, EMRTD_EF_CARDACCESS, "EF_CardAccess", BAC, use_14b)) {
-        PrintAndLogEx(INFO, "Couldn't dump EF_CardAccess, card does not support PACE.");
-        PrintAndLogEx(HINT, "This is expected behavior for cards without PACE, and isn't something to be worried about.");
-    }
 
     DropField();
     return PM3_SUCCESS;

From 43dc10e7f0e5b251fd0b5224d9922def8d91f0d1 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Fri, 18 Dec 2020 02:37:31 +0100
Subject: [PATCH 120/682] hf trace list: fix 14b CRC & accept 14a/14b crcs in
 7816

---
 client/src/cmdtrace.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdtrace.c b/client/src/cmdtrace.c
index ad5b38df7..f934caebe 100644
--- a/client/src/cmdtrace.c
+++ b/client/src/cmdtrace.c
@@ -184,6 +184,8 @@ static uint16_t printTraceLine(uint16_t tracepos, uint16_t traceLen, uint8_t *tr
                 break;
             case ISO_14443B:
             case TOPAZ:
+                crcStatus = iso14443B_CRC_check(frame, data_len);
+                break;
             case FELICA:
                 crcStatus = !felica_CRC_check(frame + 2, data_len - 4);
                 break;
@@ -193,9 +195,12 @@ static uint16_t printTraceLine(uint16_t tracepos, uint16_t traceLen, uint8_t *tr
             case ISO_14443A:
             case MFDES:
             case LTO:
-            case ISO_7816_4:
                 crcStatus = iso14443A_CRC_check(hdr->isResponse, frame, data_len);
                 break;
+            case ISO_7816_4:
+                crcStatus = iso14443A_CRC_check(hdr->isResponse, frame, data_len) == 1 ? 3 : 0;
+                crcStatus = iso14443B_CRC_check(frame, data_len) == 1 ? 4 : crcStatus;
+                break;
             case THINFILM:
                 frame[data_len - 1] ^= frame[data_len - 2];
                 frame[data_len - 2] ^= frame[data_len - 1];
@@ -280,7 +285,8 @@ static uint16_t printTraceLine(uint16_t tracepos, uint16_t traceLen, uint8_t *tr
     }
 
     // Draw the CRC column
-    const char *crc = (crcStatus == 0 ? "!crc" : (crcStatus == 1 ? " ok " : "    "));
+    const char *crcstrings[] = { "!crc", " ok ", "    ", "A ok", "B ok" };
+    const char *crc = crcstrings[crcStatus];
 
     // mark short bytes (less than 8 Bit + Parity)
     if (protocol == ISO_14443A ||

From e0e478c90d0b605da06faeabe6d88ccf99137503 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 18 Dec 2020 02:39:32 +0100
Subject: [PATCH 121/682] text

---
 client/luascripts/hf_mfu_magicwrite.lua | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/client/luascripts/hf_mfu_magicwrite.lua b/client/luascripts/hf_mfu_magicwrite.lua
index 4b4d7178a..c01f043fe 100644
--- a/client/luascripts/hf_mfu_magicwrite.lua
+++ b/client/luascripts/hf_mfu_magicwrite.lua
@@ -44,8 +44,8 @@ arguments = [[
     -c      read magic configuration
     -u      UID (14 hexsymbols), set UID on tag
     -t      tag type to impersonate
-                 1 = UL_EV1 48k
-                 2 = UL_EV1 128k
+                 1 = UL EV1 48b
+                 2 = UL EV1 128b
                  3 = NTAG 210
                  4 = NTAG 212
                  5 = NTAG 213 (true)
@@ -60,7 +60,7 @@ arguments = [[
     -p      password (8 hexsymbols),  set password on tag.
     -a      pack ( 4 hexsymbols), set pack on tag.
     -s      signature data (64 hexsymbols), set signature data on tag.
-    -o      OTP data (8 hexsymbols), set `one time programmable` data on tag.
+    -o      OTP data (8 hexsymbols), set `One-Time Programmable` data on tag.
     -v      version data (16 hexsymbols), set version data on tag.
     -w      wipe tag. You can specify password if the tag has been locked down. Fills tag with zeros and put default values for NTAG213 (like -t 5)
     -k      pwd to use with the wipe option

From 69a124762a01a1414183c1dcf691589474978ef8 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 18 Dec 2020 04:42:09 +0300
Subject: [PATCH 122/682] emrtd: Code cleanup on emrtd_bump_ssc

---
 client/src/cmdhfemrtd.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 3dc567d6c..6cf07b1ae 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -331,11 +331,11 @@ static void emrtd_bump_ssc(uint8_t *ssc) {
         if ((*(ssc + i)) == 0xFF) {
             // Set anything already FF to 0, we'll do + 1 on num to left anyways
             (*(ssc + i)) = 0;
-            continue;
+        } else {
+            (*(ssc + i)) += 1;
+            PrintAndLogEx(DEBUG, "ssc-a: %s", sprint_hex_inrow(ssc, 8));
+            return;
         }
-        (*(ssc + i)) += 1;
-        PrintAndLogEx(DEBUG, "ssc-a: %s", sprint_hex_inrow(ssc, 8));
-        return;
     }
 }
 

From 4f3d3f8ac47892f409d8a20a00560f4e3b106346 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 18 Dec 2020 05:03:06 +0300
Subject: [PATCH 123/682] emrtd: Fix insecure read on emrtd_read_file

---
 client/src/cmdhfemrtd.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 6cf07b1ae..bb89b91b9 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -526,7 +526,7 @@ static int emrtd_read_file(uint8_t *dataout, int *dataoutlen, uint8_t *kenc, uin
     int toread = 4;
     int offset = 0;
 
-    if (use_secure == true) {
+    if (use_secure) {
         if (_emrtd_secure_read_binary_decrypt(kenc, kmac, ssc, offset, toread, response, &resplen, use_14b) == false) {
             return false;
         }
@@ -546,12 +546,12 @@ static int emrtd_read_file(uint8_t *dataout, int *dataoutlen, uint8_t *kenc, uin
             toread = 118;
         }
 
-        if (kenc == NULL) {
-            if (_emrtd_read_binary(offset, toread, tempresponse, &tempresplen, use_14b) == false) {
+        if (use_secure) {
+            if (_emrtd_secure_read_binary_decrypt(kenc, kmac, ssc, offset, toread, tempresponse, &tempresplen, use_14b) == false) {
                 return false;
             }
         } else {
-            if (_emrtd_secure_read_binary_decrypt(kenc, kmac, ssc, offset, toread, tempresponse, &tempresplen, use_14b) == false) {
+            if (_emrtd_read_binary(offset, toread, tempresponse, &tempresplen, use_14b) == false) {
                 return false;
             }
         }
@@ -591,8 +591,7 @@ static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int *datainlen, uint8_t *
 
         // If the element is what we're looking for, get the data and return true
         if (*(datain + offset) == tag1 && (!twobytetag || *(datain + offset + 1) == tag2)) {
-
-            if ( *datainlen > e_datalen) {
+            if (*datainlen > e_datalen) {
                 *dataoutlen = e_datalen;
                 memcpy(dataout, datain + offset + e_idlen + e_fieldlen, e_datalen);
                 return true;
@@ -691,7 +690,7 @@ static bool emrtd_file_tag_to_file_id(uint8_t *datain, char *filenameout, char *
 }
 
 static bool emrtd_select_and_read(uint8_t *dataout, int *dataoutlen, const char *file, uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, bool use_secure, bool use_14b) {
-    if (use_secure == true) {
+    if (use_secure) {
         if (emrtd_secure_select_file(ks_enc, ks_mac, ssc, EMRTD_P1_SELECT_BY_EF, file, use_14b) == false) {
             PrintAndLogEx(ERR, "Failed to secure select %s.", file);
             return false;

From ba611ffb538d1fd67d0ac553e8c7a28ca99f7338 Mon Sep 17 00:00:00 2001
From: Drew <drew.parker@iconic.ninja>
Date: Fri, 18 Dec 2020 10:18:58 -0500
Subject: [PATCH 124/682] add dump_sim_mode to Standalone HF_ICECLASS

---
 armsrc/Standalone/hf_iceclass.c | 210 +++++++++++++++++++++++++++++++-
 1 file changed, 207 insertions(+), 3 deletions(-)

diff --git a/armsrc/Standalone/hf_iceclass.c b/armsrc/Standalone/hf_iceclass.c
index 8490ea628..eab45edf4 100644
--- a/armsrc/Standalone/hf_iceclass.c
+++ b/armsrc/Standalone/hf_iceclass.c
@@ -37,15 +37,19 @@
 #define ICE_STATE_ATTACK      2
 #define ICE_STATE_READER      3
 #define ICE_STATE_CONFIGCARD  4
+#define ICE_STATE_DUMP_SIM  5
+
+#define HF_ICLASS_NUM_MODES 6
 
 // ====================================================
 // Select which standalone function to be active.
-// 4 possiblities.  Uncomment the one you wanna use.
+// 5 possiblities.  Uncomment the one you wanna use.
 
-#define ICE_USE               ICE_STATE_FULLSIM
+//#define ICE_USE               ICE_STATE_FULLSIM
 //#define ICE_USE               ICE_STATE_ATTACK
 //#define ICE_USE               ICE_STATE_READER
 //#define ICE_USE               ICE_STATE_CONFIGCARD
+#define ICE_USE               ICE_STATE_DUMP_SIM
 
 // ====================================================
 
@@ -53,6 +57,8 @@
 #define NUM_CSNS                    9
 #define MAC_RESPONSES_SIZE          (16 * NUM_CSNS)
 #define HF_ICLASS_FULLSIM_ORIG_BIN  "iceclass-orig.bin"
+#define HF_ICALSSS_READSIM_TEMP_BIN "iceclass-temp.bin"
+#define HF_ICALSSS_READSIM_TEMP_MOD_BIN  "iceclass-temp-mod.bin"
 #define HF_ICLASS_FULLSIM_MOD       "iceclass-modified"
 #define HF_ICLASS_FULLSIM_MOD_BIN   HF_ICLASS_FULLSIM_MOD".bin"
 #define HF_ICLASS_FULLSIM_MOD_EML   HF_ICLASS_FULLSIM_MOD".eml"
@@ -141,6 +147,12 @@ static void download_instructions(uint8_t t) {
             DbpString("2. " _YELLOW_("mem spiffs dump h"));
             break;
         }
+        case ICE_STATE_DUMP_SIM: {
+            DbpString("The found tag will be dumped to " HF_ICALSSS_READSIM_TEMP_BIN);
+            DbpString("1. " _YELLOW_("mem spiffs tree"));
+            DbpString("2. " _YELLOW_("mem spiffs dump h"));
+            break;
+        }
     }
 }
 
@@ -181,6 +193,22 @@ static void save_to_flash(uint8_t *data, uint16_t datalen) {
     rdv40_spiffs_lazy_unmount();
 }
 
+// Write over file if size of flash file is less than new datalen
+static void save_to_temp_bin(uint8_t *data,  uint16_t datalen) {
+
+    rdv40_spiffs_lazy_mount();
+
+    const char * fn = HF_ICALSSS_READSIM_TEMP_BIN;
+
+    int res;
+    res = rdv40_spiffs_write(fn, data, datalen, RDV40_SPIFFS_SAFETY_SAFE);
+    if (res == SPIFFS_OK) {
+        Dbprintf("saved to " _GREEN_("%s"), fn);
+    }
+
+    rdv40_spiffs_lazy_unmount();
+}
+
 static int fullsim_mode(void) {
 
     rdv40_spiffs_lazy_mount();
@@ -407,6 +435,172 @@ static int reader_dump_mode(void) {
     return PM3_SUCCESS;
 }
 
+static int dump_sim_mode(void) {
+
+    DbpString("this mode has no tracelog");
+    if (have_aa2())
+        DbpString("dumping of " _YELLOW_("AA2 enabled"));
+
+    for (;;) {
+
+        BigBuf_free();
+
+        uint8_t *card_data = BigBuf_malloc(ICLASS_16KS_SIZE);
+        memset(card_data, 0xFF, ICLASS_16KS_SIZE);
+
+        if (BUTTON_PRESS()) {
+            DbpString("button pressed");
+            break;
+        }
+
+        // setup authenticate AA1
+        iclass_auth_req_t auth = {
+            .use_raw = false,
+            .use_elite = false,
+            .use_credit_key = false,
+            .do_auth = true,
+            .send_reply = false,
+        };
+        memcpy(auth.key, legacy_aa1_key, sizeof(auth.key));
+
+        Iso15693InitReader();
+        set_tracing(false);
+
+
+        picopass_hdr *hdr = (picopass_hdr *)card_data;
+
+        // select tag.
+        uint32_t eof_time = 0;
+        bool res = select_iclass_tag(hdr, auth.use_credit_key, &eof_time);
+        if (res == false) {
+            switch_off();
+            continue;
+        }
+
+        // sanity check of CSN.
+        if (hdr->csn[7] != 0xE0 && hdr->csn[6] != 0x12) {
+            switch_off();
+            continue;
+        }
+
+        uint32_t start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
+
+        // get 3 config bits
+        uint8_t type = (hdr->conf.chip_config & 0x10) >> 2;
+        type |= (hdr->conf.mem_config & 0x80) >> 6;
+        type |= (hdr->conf.mem_config & 0x20) >> 5;
+
+        Dbprintf(_GREEN_("%s") ", dumping...", card_types[type]);
+
+        uint8_t pagemap = get_pagemap(hdr);
+        uint8_t app1_limit, app2_limit, start_block;
+
+        // tags configured for NON SECURE PAGE,  acts different
+        if (pagemap == PICOPASS_NON_SECURE_PAGEMODE) {
+            app1_limit = card_app2_limit[type];
+            app2_limit = 0;
+            start_block = 3;
+        } else {
+
+            app1_limit = hdr->conf.app_limit;
+            app2_limit = card_app2_limit[type];
+            start_block = 5;
+
+            res = authenticate_iclass_tag(&auth, hdr, &start_time, &eof_time, NULL);
+            if (res == false) {
+                switch_off();
+                Dbprintf(_RED_("failed AA1 auth") ", skipping ");
+                continue;
+            }
+
+            start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
+        }
+
+        uint16_t dumped = 0;
+
+        // main read loop
+        for (uint16_t i = start_block; i <= app1_limit; i++) {
+            if (iclass_read_block(i, card_data + (8 * i), &start_time, &eof_time)) {
+                dumped++;
+            }
+        }
+
+        if (pagemap != PICOPASS_NON_SECURE_PAGEMODE && have_aa2()) {
+
+            // authenticate AA2
+            auth.use_raw = false;
+            auth.use_credit_key = true;
+            memcpy(auth.key, aa2_key, sizeof(auth.key));
+
+            res = select_iclass_tag(hdr, auth.use_credit_key, &eof_time);
+            if (res) {
+
+                // sanity check of CSN.
+                if (hdr->csn[7] != 0xE0 && hdr->csn[6] != 0x12) {
+                    switch_off();
+                    continue;
+                }
+
+                res = authenticate_iclass_tag(&auth, hdr, &start_time, &eof_time, NULL);
+                if (res) {
+                    start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
+
+                    for (uint16_t i = app1_limit + 1; i <= app2_limit; i++) {
+                        if (iclass_read_block(i, card_data + (8 * i), &start_time, &eof_time)) {
+                            dumped++;
+                        }
+                    }
+                } else {
+                    DbpString(_RED_("failed AA2 auth"));
+                }
+            } else {
+                DbpString(_RED_("failed selecting AA2"));
+
+                // sanity check of CSN.
+                if (hdr->csn[7] != 0xE0 && hdr->csn[6] != 0x12) {
+                    switch_off();
+                    continue;
+                }
+            }
+        }
+        switch_off();
+        save_to_temp_bin(card_data, (start_block + dumped) * 8);
+        Dbprintf("%u bytes saved", (start_block + dumped) * 8);
+
+        if (((start_block + dumped) * 8) > 0) {
+            break; //switch to sim mode 
+        }
+    }
+
+    rdv40_spiffs_lazy_mount();
+
+    SpinOff(0);
+    uint8_t *emul = BigBuf_get_EM_addr();
+    uint32_t fsize = size_in_spiffs(HF_ICALSSS_READSIM_TEMP_BIN);
+    int res = rdv40_spiffs_read_as_filetype(HF_ICALSSS_READSIM_TEMP_BIN, emul, fsize, RDV40_SPIFFS_SAFETY_SAFE);
+    rdv40_spiffs_lazy_unmount();
+    if (res == SPIFFS_OK) {
+        Dbprintf("loaded " _GREEN_(HF_ICALSSS_READSIM_TEMP_BIN) " (%u bytes)", fsize);
+    }
+    
+    Dbprintf("simming " _GREEN_(HF_ICALSSS_READSIM_TEMP_BIN));
+    iclass_simulate(ICLASS_SIM_MODE_FULL, 0, false, NULL, NULL, NULL);
+
+    LED_B_ON();
+    rdv40_spiffs_lazy_mount();
+    res = rdv40_spiffs_write(HF_ICALSSS_READSIM_TEMP_BIN, emul, fsize, RDV40_SPIFFS_SAFETY_SAFE);
+    rdv40_spiffs_lazy_unmount();
+    LED_B_OFF();
+    if (res == SPIFFS_OK) {
+        Dbprintf("wrote emulator memory to " _GREEN_(HF_ICALSSS_READSIM_TEMP_MOD_BIN));
+    } else {
+        Dbprintf(_RED_("error") " writing "HF_ICALSSS_READSIM_TEMP_MOD_BIN" to flash ( %d )", res);
+    }
+
+    DbpString("-=[ exiting " _CYAN_("`dump & sim`") " mode ]=-");
+    return PM3_SUCCESS;
+}
+
 static int config_sim_mode(void) {
 
     uint8_t *emul = BigBuf_get_EM_addr();
@@ -436,7 +630,7 @@ void RunMod(void) {
 
     uint8_t mode = ICE_USE;
     uint8_t *bb = BigBuf_get_EM_addr();
-    if (bb[0] > 0 && bb[0] < 5) {
+    if (bb[0] > 0 && bb[0] < HF_ICLASS_NUM_MODES) { //increase number for new mode
         mode = bb[0];
     }
 
@@ -512,6 +706,16 @@ void RunMod(void) {
                 if (mode == ICE_STATE_CONFIGCARD)
                     config_sim_mode();
 
+                mode = ICE_STATE_NONE;
+                break;
+            }
+            case ICE_STATE_DUMP_SIM: {
+                DbpString("-=[ enter " _CYAN_("`dump & sim`") " mode, read 1 card and sim it ]=-");
+                res = dump_sim_mode();
+                if (res == PM3_SUCCESS) {
+                    download_instructions(mode);
+                }
+
                 mode = ICE_STATE_NONE;
                 break;
             }

From db729497203834b7b692b17f9a51c1efe308e84b Mon Sep 17 00:00:00 2001
From: Drew <drew.parker@iconic.ninja>
Date: Fri, 18 Dec 2020 12:01:03 -0500
Subject: [PATCH 125/682] change default mode; refactor save to take name

---
 armsrc/Standalone/hf_iceclass.c | 47 +++++++++++++++------------------
 1 file changed, 21 insertions(+), 26 deletions(-)

diff --git a/armsrc/Standalone/hf_iceclass.c b/armsrc/Standalone/hf_iceclass.c
index eab45edf4..472544310 100644
--- a/armsrc/Standalone/hf_iceclass.c
+++ b/armsrc/Standalone/hf_iceclass.c
@@ -45,11 +45,11 @@
 // Select which standalone function to be active.
 // 5 possiblities.  Uncomment the one you wanna use.
 
-//#define ICE_USE               ICE_STATE_FULLSIM
+#define ICE_USE               ICE_STATE_FULLSIM
 //#define ICE_USE               ICE_STATE_ATTACK
 //#define ICE_USE               ICE_STATE_READER
 //#define ICE_USE               ICE_STATE_CONFIGCARD
-#define ICE_USE               ICE_STATE_DUMP_SIM
+//#define ICE_USE               ICE_STATE_DUMP_SIM
 
 // ====================================================
 
@@ -158,15 +158,25 @@ static void download_instructions(uint8_t t) {
 
 // Save to flash if file doesn't exist.
 // Write over file if size of flash file is less than new datalen
-static void save_to_flash(uint8_t *data, uint16_t datalen) {
+static void save_to_flash(uint8_t *data, uint16_t datalen, char * filename) {
 
     rdv40_spiffs_lazy_mount();
 
     char fn[SPIFFS_OBJ_NAME_LEN];
-    sprintf(fn, "iclass-%02X%02X%02X%02X%02X%02X%02X%02X.bin",
-            data[0], data[1], data[2], data[3],
-            data[4], data[5], data[6], data[7]
-           );
+
+    if (filename == NULL){
+            sprintf(fn, "iclass-%02X%02X%02X%02X%02X%02X%02X%02X.bin",
+                    data[0], data[1], data[2], data[3],
+                    data[4], data[5], data[6], data[7]
+                );
+    } else {
+        int name_len = SPIFFS_OBJ_NAME_LEN;
+        int filename_len = strlen(filename);
+
+        // if the given name len longer than buffer allows, cut it down to size
+        name_len = (name_len >= SPIFFS_OBJ_NAME_LEN) ? SPIFFS_OBJ_NAME_LEN : filename_len;
+        memcpy(fn, filename, name_len);
+    }    
 
     int res;
     if (exists_in_spiffs(fn) == false) {
@@ -193,22 +203,6 @@ static void save_to_flash(uint8_t *data, uint16_t datalen) {
     rdv40_spiffs_lazy_unmount();
 }
 
-// Write over file if size of flash file is less than new datalen
-static void save_to_temp_bin(uint8_t *data,  uint16_t datalen) {
-
-    rdv40_spiffs_lazy_mount();
-
-    const char * fn = HF_ICALSSS_READSIM_TEMP_BIN;
-
-    int res;
-    res = rdv40_spiffs_write(fn, data, datalen, RDV40_SPIFFS_SAFETY_SAFE);
-    if (res == SPIFFS_OK) {
-        Dbprintf("saved to " _GREEN_("%s"), fn);
-    }
-
-    rdv40_spiffs_lazy_unmount();
-}
-
 static int fullsim_mode(void) {
 
     rdv40_spiffs_lazy_mount();
@@ -428,7 +422,7 @@ static int reader_dump_mode(void) {
             }
         }
         switch_off();
-        save_to_flash(card_data, (start_block + dumped) * 8);
+        save_to_flash(card_data, (start_block + dumped) * 8, NULL);
         Dbprintf("%u bytes saved", (start_block + dumped) * 8);
     }
     DbpString("-=[ exiting " _CYAN_("`read & dump`") " mode ]=-");
@@ -564,7 +558,8 @@ static int dump_sim_mode(void) {
             }
         }
         switch_off();
-        save_to_temp_bin(card_data, (start_block + dumped) * 8);
+        char * temp_file = HF_ICALSSS_READSIM_TEMP_BIN;
+        save_to_flash(card_data, (start_block + dumped) * 8, temp_file);
         Dbprintf("%u bytes saved", (start_block + dumped) * 8);
 
         if (((start_block + dumped) * 8) > 0) {
@@ -630,7 +625,7 @@ void RunMod(void) {
 
     uint8_t mode = ICE_USE;
     uint8_t *bb = BigBuf_get_EM_addr();
-    if (bb[0] > 0 && bb[0] < HF_ICLASS_NUM_MODES) { //increase number for new mode
+    if (bb[0] > 0 && bb[0] < HF_ICLASS_NUM_MODES) {
         mode = bb[0];
     }
 

From 9c37ef08da1f1e7beef5823348afa6a2bedd2088 Mon Sep 17 00:00:00 2001
From: Drew <drew.parker@iconic.ninja>
Date: Fri, 18 Dec 2020 12:27:02 -0500
Subject: [PATCH 126/682] update CHANGELOG

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a1b430303..0f890c8d5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+- Added `ICE_STATE_DUMP_SIM` - standalone mode for dumping/simming one iClass tag (@iconicsec)
  - Added  `lf em 4x50 eview` - show uploaded EM4x50 data in emul memory (@tharexde) 
  - Fix `data rawdemod` parsing for psk2 and user defined clock (@cyberpunk-re)
  - Added `hf iclass encode` - encode a wiegand binary to a encrypted credential (@iceman1001)

From 36cf0be239f43e63fb1aca12e12ef5713172d15b Mon Sep 17 00:00:00 2001
From: Ave Ozkal <ave@ave.zone>
Date: Fri, 18 Dec 2020 21:12:57 +0300
Subject: [PATCH 127/682] emrtd: Basic EF_DG11 support on hf emrtd info

---
 client/src/cmdhfemrtd.c | 107 ++++++++++++++++++++++++++++++++--------
 1 file changed, 87 insertions(+), 20 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index deff0d4df..c1e9bcbce 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1118,7 +1118,7 @@ static void emrtd_print_document_number(char *mrz, int offset) {
     }
 }
 
-static void emrtd_print_name(char *mrz, int offset, int max_length) {
+static void emrtd_print_name(char *mrz, int offset, int max_length, bool localized) {
     char final_name[100] = { 0x00 };
     int i = emrtd_mrz_determine_length(mrz, offset, max_length);
     int sep = emrtd_mrz_determine_separator(mrz, offset, i);
@@ -1128,20 +1128,30 @@ static void emrtd_print_name(char *mrz, int offset, int max_length) {
     final_name[namelen] = ' ';
     memcpy(final_name + namelen + 1, mrz + offset, sep);
 
-    PrintAndLogEx(SUCCESS, "Legal Name............: " _YELLOW_("%s"), final_name);
+    if (localized) {
+        PrintAndLogEx(SUCCESS, "Legal Name (Localized): " _YELLOW_("%s"), final_name);
+    } else {
+        PrintAndLogEx(SUCCESS, "Legal Name............: " _YELLOW_("%s"), final_name);
+    }
 }
 
-static void emrtd_mrz_convert_date(char *mrz, int offset, char *final_date, bool is_expiry) {
-    char temp_year[3] = { 0x00 };
-
-    memcpy(temp_year, mrz + offset, 2);
-    // If it's > 20, assume 19xx.
-    if (strtol(temp_year, NULL, 10) < 20 || is_expiry) {
-        final_date[0] = '2';
-        final_date[1] = '0';
+static void emrtd_mrz_convert_date(char *mrz, int offset, char *final_date, bool is_expiry, bool is_full) {
+    if (is_full) {
+        // If we get the full date, use the first two characters from that for year
+        memcpy(final_date, mrz, 2);
+        // and do + 2 on offset so that rest of code uses the right data
+        offset += 2;
     } else {
-        final_date[0] = '1';
-        final_date[1] = '9';
+        char temp_year[3] = { 0x00 };
+        memcpy(temp_year, mrz + offset, 2);
+        // If it's > 20, assume 19xx.
+        if (strtol(temp_year, NULL, 10) < 20 || is_expiry) {
+            final_date[0] = '2';
+            final_date[1] = '0';
+        } else {
+            final_date[0] = '1';
+            final_date[1] = '9';
+        }
     }
 
     memcpy(final_date + 2, mrz + offset, 2);
@@ -1151,20 +1161,20 @@ static void emrtd_mrz_convert_date(char *mrz, int offset, char *final_date, bool
     memcpy(final_date + 8, mrz + offset + 4, 2);
 }
 
-static void emrtd_print_dob(char *mrz, int offset) {
+static void emrtd_print_dob(char *mrz, int offset, bool full) {
     char final_date[12] = { 0x00 };
-    emrtd_mrz_convert_date(mrz, offset, final_date, false);
+    emrtd_mrz_convert_date(mrz, offset, final_date, false, full);
 
     PrintAndLogEx(SUCCESS, "Date of birth.........: " _YELLOW_("%s"), final_date);
 
-    if (!emrtd_mrz_verify_check_digit(mrz, offset, 6)) {
+    if (!full && !emrtd_mrz_verify_check_digit(mrz, offset, 6)) {
         PrintAndLogEx(SUCCESS, _RED_("Date of Birth check digit is invalid."));
     }
 }
 
 static void emrtd_print_expiry(char *mrz, int offset) {
     char final_date[12] = { 0x00 };
-    emrtd_mrz_convert_date(mrz, offset, final_date, true);
+    emrtd_mrz_convert_date(mrz, offset, final_date, true, false);
 
     PrintAndLogEx(SUCCESS, "Date of expiry........: " _YELLOW_("%s"), final_date);
 
@@ -1173,6 +1183,57 @@ static void emrtd_print_expiry(char *mrz, int offset) {
     }
 }
 
+static bool emrtd_print_ef_dg11_info(bool *BAC, uint8_t *ssc, uint8_t *ks_enc, uint8_t *ks_mac, bool *use_14b) {
+    uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    int resplen = 0;
+
+    uint8_t taglist[100] = { 0x00 };
+    int taglistlen = 0;
+    uint8_t tagdata[1000] = { 0x00 };
+    int tagdatalen = 0;
+
+    PrintAndLogEx(INFO, "=====EF_DG11=====");
+
+    if (!emrtd_select_and_read(response, &resplen, EMRTD_EF_DG11, ks_enc, ks_mac, ssc, *BAC, *use_14b)) {
+        PrintAndLogEx(ERR, "Failed to read EF_DG11.");
+        return false;
+    }
+
+    if (!emrtd_lds_get_data_by_tag(response, &resplen, taglist, &taglistlen, 0x5c, 0x00, false)) {
+        PrintAndLogEx(ERR, "Failed to read file list from EF_DG11.");
+        return false;
+    }
+
+    for (int i = 0; i < taglistlen; i++) {
+        emrtd_lds_get_data_by_tag(response, &resplen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f);
+        // Special behavior for two char tags
+        if (taglist[i] == 0x5f) {
+            switch (taglist[i + 1]) {
+                case 0x0e:
+                    emrtd_print_name((char *) tagdata, 0, tagdatalen, true);
+                    break;
+                case 0x10:
+                    PrintAndLogEx(SUCCESS, "Personal Number.......: " _YELLOW_("%.*s"), tagdatalen, tagdata);
+                    break;
+                case 0x11:
+                    PrintAndLogEx(SUCCESS, "Place of Birth........: " _YELLOW_("%.*s"), tagdatalen, tagdata);
+                    break;
+                case 0x2b:
+                    emrtd_print_dob((char *) tagdata, 0, true);
+                    break;
+                default:
+                    PrintAndLogEx(SUCCESS, "Unknown Field %02X%02X....: %s", taglist[i], taglist[i + 1], sprint_hex_inrow(tagdata, tagdatalen));
+                    break;
+            }
+
+            i += 1;
+        } else {
+            PrintAndLogEx(INFO, "Reading %02X: %s", taglist[i], sprint_hex_inrow(tagdata, tagdatalen));
+        }
+    }
+    return true;
+}
+
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available) {
     uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     int resplen = 0;
@@ -1208,6 +1269,8 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         return PM3_ESOFT;
     }
 
+    PrintAndLogEx(INFO, "=====EF_DG1=====");
+
     // MRZ on TD1 is 90 characters, 30 on each row.
     // MRZ on TD3 is 88 characters, 44 on each row.
     char mrz[90] = { 0x00 };
@@ -1251,9 +1314,9 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     if (td_variant == 3) {
         // Passport form factor
         PrintAndLogEx(SUCCESS, "Nationality...........: " _YELLOW_("%.3s"), mrz + 44 + 10);
-        emrtd_print_name(mrz, 5, 38);
+        emrtd_print_name(mrz, 5, 38, false);
         emrtd_print_document_number(mrz, 44);
-        emrtd_print_dob(mrz, 44 + 13);
+        emrtd_print_dob(mrz, 44 + 13, false);
         emrtd_print_legal_sex(&mrz[44 + 20]);
         emrtd_print_expiry(mrz, 44 + 21);
         emrtd_print_optional_elements(mrz, 44 + 28, 14, true);
@@ -1270,9 +1333,9 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     } else if (td_variant == 1) {
         // ID form factor
         PrintAndLogEx(SUCCESS, "Nationality...........: " _YELLOW_("%.3s"), mrz + 30 + 15);
-        emrtd_print_name(mrz, 60, 30);
+        emrtd_print_name(mrz, 60, 30, false);
         emrtd_print_document_number(mrz, 5);
-        emrtd_print_dob(mrz, 30);
+        emrtd_print_dob(mrz, 30, false);
         emrtd_print_legal_sex(&mrz[30 + 7]);
         emrtd_print_expiry(mrz, 30 + 8);
         emrtd_print_optional_elements(mrz, 15, 15, false);
@@ -1284,6 +1347,10 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         }
     }
 
+    // Print EF_DG11 info
+    // TODO: verify existence from file list, also print file list in info.
+    emrtd_print_ef_dg11_info(&BAC, ssc, ks_enc, ks_mac, &use_14b);
+
     DropField();
     return PM3_SUCCESS;
 }

From 27b7ecf1cdcdfe440850b06d680b99361cdb45e9 Mon Sep 17 00:00:00 2001
From: Ave Ozkal <ave@ave.zone>
Date: Fri, 18 Dec 2020 21:25:46 +0300
Subject: [PATCH 128/682] emrtd: Complete EF_DG11 support on hf emrtd info

---
 client/src/cmdhfemrtd.c | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index c1e9bcbce..62555d11b 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1216,8 +1216,35 @@ static bool emrtd_print_ef_dg11_info(bool *BAC, uint8_t *ssc, uint8_t *ks_enc, u
                     PrintAndLogEx(SUCCESS, "Personal Number.......: " _YELLOW_("%.*s"), tagdatalen, tagdata);
                     break;
                 case 0x11:
+                    // TODO: acc for < separation
                     PrintAndLogEx(SUCCESS, "Place of Birth........: " _YELLOW_("%.*s"), tagdatalen, tagdata);
                     break;
+                case 0x42:
+                    // TODO: acc for < separation
+                    PrintAndLogEx(SUCCESS, "Permanent Address.....: " _YELLOW_("%.*s"), tagdatalen, tagdata);
+                    break;
+                case 0x12:
+                    PrintAndLogEx(SUCCESS, "Telephone.............: " _YELLOW_("%.*s"), tagdatalen, tagdata);
+                    break;
+                case 0x13:
+                    PrintAndLogEx(SUCCESS, "Profession............: " _YELLOW_("%.*s"), tagdatalen, tagdata);
+                    break;
+                case 0x14:
+                    PrintAndLogEx(SUCCESS, "Title.................: " _YELLOW_("%.*s"), tagdatalen, tagdata);
+                    break;
+                case 0x15:
+                    PrintAndLogEx(SUCCESS, "Personal Summary......: " _YELLOW_("%.*s"), tagdatalen, tagdata);
+                    break;
+                case 0x16:
+                    saveFile("ProofOfCitizenship", ".jpg", tagdata, tagdatalen);
+                    break;
+                case 0x17:
+                    // TODO: acc for < separation
+                    PrintAndLogEx(SUCCESS, "Other valid TDs nums..: " _YELLOW_("%.*s"), tagdatalen, tagdata);
+                    break;
+                case 0x18:
+                    PrintAndLogEx(SUCCESS, "Custody Information...: " _YELLOW_("%.*s"), tagdatalen, tagdata);
+                    break;
                 case 0x2b:
                     emrtd_print_dob((char *) tagdata, 0, true);
                     break;
@@ -1228,7 +1255,8 @@ static bool emrtd_print_ef_dg11_info(bool *BAC, uint8_t *ssc, uint8_t *ks_enc, u
 
             i += 1;
         } else {
-            PrintAndLogEx(INFO, "Reading %02X: %s", taglist[i], sprint_hex_inrow(tagdata, tagdatalen));
+            // TODO: Account for A0
+            PrintAndLogEx(SUCCESS, "Unknown Field %02X......: %s", taglist[i], sprint_hex_inrow(tagdata, tagdatalen));
         }
     }
     return true;

From 8e89eb12064f6e0fdfa19f6c81f891e62046c4a3 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 18 Dec 2020 22:33:13 +0300
Subject: [PATCH 129/682] hf emrtd info: fancier output for files

---
 client/src/cmdhfemrtd.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 62555d11b..908b6e689 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1192,7 +1192,8 @@ static bool emrtd_print_ef_dg11_info(bool *BAC, uint8_t *ssc, uint8_t *ks_enc, u
     uint8_t tagdata[1000] = { 0x00 };
     int tagdatalen = 0;
 
-    PrintAndLogEx(INFO, "=====EF_DG11=====");
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_DG11") " -------------------");
 
     if (!emrtd_select_and_read(response, &resplen, EMRTD_EF_DG11, ks_enc, ks_mac, ssc, *BAC, *use_14b)) {
         PrintAndLogEx(ERR, "Failed to read EF_DG11.");
@@ -1281,6 +1282,9 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
 
     // Select and authenticate with the eMRTD
     bool auth_result = emrtd_do_auth(documentnumber, dob, expiry, BAC_available, &BAC, ssc, ks_enc, ks_mac, &use_14b);
+
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "------------------ " _CYAN_("Basic Info") " ------------------");
     PrintAndLogEx(SUCCESS, "Communication standard: %s", use_14b ? _YELLOW_("ISO/IEC 14443(B)") : _YELLOW_("ISO/IEC 14443(A)"));
     PrintAndLogEx(SUCCESS, "BAC...................: %s", BAC ? _GREEN_("Enforced") : _RED_("Not enforced"));
     PrintAndLogEx(SUCCESS, "Authentication result.: %s", auth_result ? _GREEN_("Successful") : _RED_("Failed"));
@@ -1297,7 +1301,8 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         return PM3_ESOFT;
     }
 
-    PrintAndLogEx(INFO, "=====EF_DG1=====");
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_DG1") " --------------------");
 
     // MRZ on TD1 is 90 characters, 30 on each row.
     // MRZ on TD3 is 88 characters, 44 on each row.

From fa217875316a4837b428c1c5aafa0e304a799b92 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 18 Dec 2020 23:52:42 +0300
Subject: [PATCH 130/682] hf emrtd info: Split EF_DG1 into its own func, read
 file list

---
 client/src/cmdhfemrtd.c | 189 ++++++++++++++++++++++------------------
 1 file changed, 102 insertions(+), 87 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 908b6e689..f2c3a60d3 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1045,7 +1045,7 @@ static bool emrtd_compare_check_digit(char *datain, int datalen, char expected_c
     memcpy(tempdata, datain, datalen);
 
     uint8_t check_digit = emrtd_calculate_check_digit(tempdata) + 0x30;
-    bool res =check_digit == expected_check_digit;
+    bool res = check_digit == expected_check_digit;
     PrintAndLogEx(DEBUG, "emrtd_compare_check_digit, expected %c == %c calculated ( %s )"
         , expected_check_digit
         , check_digit
@@ -1183,10 +1183,91 @@ static void emrtd_print_expiry(char *mrz, int offset) {
     }
 }
 
-static bool emrtd_print_ef_dg11_info(bool *BAC, uint8_t *ssc, uint8_t *ks_enc, uint8_t *ks_mac, bool *use_14b) {
-    uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
-    int resplen = 0;
+static bool emrtd_print_ef_dg1_info(uint8_t *response, int resplen) {
+    int td_variant = 0;
 
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_DG1") " --------------------");
+
+    // MRZ on TD1 is 90 characters, 30 on each row.
+    // MRZ on TD3 is 88 characters, 44 on each row.
+    char mrz[90] = { 0x00 };
+    int mrzlen = 0;
+
+    if (!emrtd_lds_get_data_by_tag(response, &resplen, (uint8_t *) mrz, &mrzlen, 0x5f, 0x1f, true)) {
+        PrintAndLogEx(ERR, "Failed to read MRZ from EF_DG1.");
+        return false;
+    }
+
+    // Determine and print the document type
+    if (mrz[0] == 'I' && mrz[1] == 'P') {
+        td_variant = 1;
+        PrintAndLogEx(SUCCESS, "Document Type.........: " _YELLOW_("Passport Card"));
+    } else if (mrz[0] == 'I') {
+        td_variant = 1;
+        PrintAndLogEx(SUCCESS, "Document Type.........: " _YELLOW_("ID Card"));
+    } else if (mrz[0] == 'P') {
+        td_variant = 3;
+        PrintAndLogEx(SUCCESS, "Document Type.........: " _YELLOW_("Passport"));
+    } else {
+        td_variant = 1;
+        PrintAndLogEx(SUCCESS, "Document Type.........: " _YELLOW_("Unknown"));
+        PrintAndLogEx(INFO, "Assuming ID-style MRZ.");
+    }
+    PrintAndLogEx(SUCCESS, "Document Form Factor..: " _YELLOW_("TD%i"), td_variant);
+
+    // Print the MRZ
+    if (td_variant == 1) {
+        PrintAndLogEx(DEBUG, "MRZ Row 1: " _YELLOW_("%.30s"), mrz);
+        PrintAndLogEx(DEBUG, "MRZ Row 2: " _YELLOW_("%.30s"), mrz + 30);
+        PrintAndLogEx(DEBUG, "MRZ Row 3: " _YELLOW_("%.30s"), mrz + 60);
+    } else if (td_variant == 3) {
+        PrintAndLogEx(DEBUG, "MRZ Row 1: " _YELLOW_("%.44s"), mrz);
+        PrintAndLogEx(DEBUG, "MRZ Row 2: " _YELLOW_("%.44s"), mrz + 44);
+    }
+
+    PrintAndLogEx(SUCCESS, "Issuing state.........: " _YELLOW_("%.3s"), mrz + 2);
+
+    if (td_variant == 3) {
+        // Passport form factor
+        PrintAndLogEx(SUCCESS, "Nationality...........: " _YELLOW_("%.3s"), mrz + 44 + 10);
+        emrtd_print_name(mrz, 5, 38, false);
+        emrtd_print_document_number(mrz, 44);
+        emrtd_print_dob(mrz, 44 + 13, false);
+        emrtd_print_legal_sex(&mrz[44 + 20]);
+        emrtd_print_expiry(mrz, 44 + 21);
+        emrtd_print_optional_elements(mrz, 44 + 28, 14, true);
+
+        // Calculate and verify composite check digit
+        char composite_check_data[50] = { 0x00 };
+        memcpy(composite_check_data, mrz + 44, 10);
+        memcpy(composite_check_data + 10, mrz + 44 + 13, 7);
+        memcpy(composite_check_data + 17, mrz + 44 + 21, 23);
+
+        if (!emrtd_compare_check_digit(composite_check_data, 39, mrz[87])) {
+            PrintAndLogEx(SUCCESS, _RED_("Composite check digit is invalid."));
+        }
+    } else if (td_variant == 1) {
+        // ID form factor
+        PrintAndLogEx(SUCCESS, "Nationality...........: " _YELLOW_("%.3s"), mrz + 30 + 15);
+        emrtd_print_name(mrz, 60, 30, false);
+        emrtd_print_document_number(mrz, 5);
+        emrtd_print_dob(mrz, 30, false);
+        emrtd_print_legal_sex(&mrz[30 + 7]);
+        emrtd_print_expiry(mrz, 30 + 8);
+        emrtd_print_optional_elements(mrz, 15, 15, false);
+        emrtd_print_optional_elements(mrz, 30 + 18, 11, false);
+
+        // Calculate and verify composite check digit
+        if (!emrtd_compare_check_digit(mrz, 59, mrz[59])) {
+            PrintAndLogEx(SUCCESS, _RED_("Composite check digit is invalid."));
+        }
+    }
+
+    return true;
+}
+
+static bool emrtd_print_ef_dg11_info(uint8_t *response, int resplen) {
     uint8_t taglist[100] = { 0x00 };
     int taglistlen = 0;
     uint8_t tagdata[1000] = { 0x00 };
@@ -1195,11 +1276,6 @@ static bool emrtd_print_ef_dg11_info(bool *BAC, uint8_t *ssc, uint8_t *ks_enc, u
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_DG11") " -------------------");
 
-    if (!emrtd_select_and_read(response, &resplen, EMRTD_EF_DG11, ks_enc, ks_mac, ssc, *BAC, *use_14b)) {
-        PrintAndLogEx(ERR, "Failed to read EF_DG11.");
-        return false;
-    }
-
     if (!emrtd_lds_get_data_by_tag(response, &resplen, taglist, &taglistlen, 0x5c, 0x00, false)) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_DG11.");
         return false;
@@ -1272,8 +1348,6 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     bool BAC = false;
     bool use_14b = false;
 
-    int td_variant = 0;
-
     // Select the eMRTD
     if (!emrtd_connect(&use_14b)) {
         DropField();
@@ -1294,96 +1368,37 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         return PM3_ESOFT;
     }
 
-    // Select EF_DG1
-    if (emrtd_select_and_read(response, &resplen, EMRTD_EF_DG1, ks_enc, ks_mac, ssc, BAC, use_14b) == false) {
-        PrintAndLogEx(ERR, "Failed to read EF_DG1.");
+    if (!emrtd_select_and_read(response, &resplen, EMRTD_EF_COM, ks_enc, ks_mac, ssc, BAC, use_14b)) {
+        PrintAndLogEx(ERR, "Failed to read EF_COM.");
         DropField();
         return PM3_ESOFT;
     }
 
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_DG1") " --------------------");
+    uint8_t filelist[50];
+    int filelistlen = 0;
 
-    // MRZ on TD1 is 90 characters, 30 on each row.
-    // MRZ on TD3 is 88 characters, 44 on each row.
-    char mrz[90] = { 0x00 };
-    int mrzlen = 0;
-
-    if (!emrtd_lds_get_data_by_tag(response, &resplen, (uint8_t *) mrz, &mrzlen, 0x5f, 0x1f, true)) {
-        PrintAndLogEx(ERR, "Failed to read MRZ from EF_DG1.");
+    if (!emrtd_lds_get_data_by_tag(response, &resplen, filelist, &filelistlen, 0x5c, 0x00, false)) {
+        PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
         DropField();
         return PM3_ESOFT;
     }
 
-    // Determine and print the document type
-    if (mrz[0] == 'I' && mrz[1] == 'P') {
-        td_variant = 1;
-        PrintAndLogEx(SUCCESS, "Document Type.........: " _YELLOW_("Passport Card"));
-    } else if (mrz[0] == 'I') {
-        td_variant = 1;
-        PrintAndLogEx(SUCCESS, "Document Type.........: " _YELLOW_("ID Card"));
-    } else if (mrz[0] == 'P') {
-        td_variant = 3;
-        PrintAndLogEx(SUCCESS, "Document Type.........: " _YELLOW_("Passport"));
-    } else {
-        td_variant = 1;
-        PrintAndLogEx(SUCCESS, "Document Type.........: " _YELLOW_("Unknown"));
-        PrintAndLogEx(INFO, "Assuming ID-style MRZ.");
-    }
-    PrintAndLogEx(SUCCESS, "Document Form Factor..: " _YELLOW_("TD%i"), td_variant);
-
-    // Print the MRZ
-    if (td_variant == 1) {
-        PrintAndLogEx(DEBUG, "MRZ Row 1: " _YELLOW_("%.30s"), mrz);
-        PrintAndLogEx(DEBUG, "MRZ Row 2: " _YELLOW_("%.30s"), mrz + 30);
-        PrintAndLogEx(DEBUG, "MRZ Row 3: " _YELLOW_("%.30s"), mrz + 60);
-    } else if (td_variant == 3) {
-        PrintAndLogEx(DEBUG, "MRZ Row 1: " _YELLOW_("%.44s"), mrz);
-        PrintAndLogEx(DEBUG, "MRZ Row 2: " _YELLOW_("%.44s"), mrz + 44);
-    }
-
-    PrintAndLogEx(SUCCESS, "Issuing state.........: " _YELLOW_("%.3s"), mrz + 2);
-
-    if (td_variant == 3) {
-        // Passport form factor
-        PrintAndLogEx(SUCCESS, "Nationality...........: " _YELLOW_("%.3s"), mrz + 44 + 10);
-        emrtd_print_name(mrz, 5, 38, false);
-        emrtd_print_document_number(mrz, 44);
-        emrtd_print_dob(mrz, 44 + 13, false);
-        emrtd_print_legal_sex(&mrz[44 + 20]);
-        emrtd_print_expiry(mrz, 44 + 21);
-        emrtd_print_optional_elements(mrz, 44 + 28, 14, true);
-
-        // Calculate and verify composite check digit
-        char composite_check_data[50] = { 0x00 };
-        memcpy(composite_check_data, mrz + 44, 10);
-        memcpy(composite_check_data + 10, mrz + 44 + 13, 7);
-        memcpy(composite_check_data + 17, mrz + 44 + 21, 23);
-
-        if (!emrtd_compare_check_digit(composite_check_data, 39, mrz[87])) {
-            PrintAndLogEx(SUCCESS, _RED_("Composite check digit is invalid."));
+    // Dump all files in the file list
+    for (int i = 0; i < filelistlen; i++) {
+        char file_id[5] = { 0x00 };
+        char file_name[8] = { 0x00 };
+        if (emrtd_file_tag_to_file_id(&filelist[i], file_name, file_id) == false) {
+            PrintAndLogEx(DEBUG, "File tag not found, skipping: %02X", filelist[i]);
+            continue;
         }
-    } else if (td_variant == 1) {
-        // ID form factor
-        PrintAndLogEx(SUCCESS, "Nationality...........: " _YELLOW_("%.3s"), mrz + 30 + 15);
-        emrtd_print_name(mrz, 60, 30, false);
-        emrtd_print_document_number(mrz, 5);
-        emrtd_print_dob(mrz, 30, false);
-        emrtd_print_legal_sex(&mrz[30 + 7]);
-        emrtd_print_expiry(mrz, 30 + 8);
-        emrtd_print_optional_elements(mrz, 15, 15, false);
-        emrtd_print_optional_elements(mrz, 30 + 18, 11, false);
 
-        // Calculate and verify composite check digit
-        if (!emrtd_compare_check_digit(mrz, 59, mrz[59])) {
-            PrintAndLogEx(SUCCESS, _RED_("Composite check digit is invalid."));
+        if (strcmp(file_name, "EF_DG1") == 0 && emrtd_select_and_read(response, &resplen, EMRTD_EF_DG1, ks_enc, ks_mac, ssc, BAC, use_14b)) {
+            emrtd_print_ef_dg1_info(response, resplen);
+        } else if (strcmp(file_name, "EF_DG11") == 0 && emrtd_select_and_read(response, &resplen, EMRTD_EF_DG11, ks_enc, ks_mac, ssc, BAC, use_14b)) {
+            emrtd_print_ef_dg11_info(response, resplen);
         }
     }
 
-    // Print EF_DG11 info
-    // TODO: verify existence from file list, also print file list in info.
-    emrtd_print_ef_dg11_info(&BAC, ssc, ks_enc, ks_mac, &use_14b);
-
     DropField();
     return PM3_SUCCESS;
 }

From 15e171b09dca3be141585847e719e8f977803221 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 18 Dec 2020 22:05:16 +0100
Subject: [PATCH 131/682] hf 14b info - now supports aidsearch

---
 client/src/aidsearch.c |  20 +++----
 client/src/cmdhf14b.c  | 130 ++++++++++++++++++++++++++++++++++++++---
 client/src/cmdhf14b.h  |   2 +-
 3 files changed, 133 insertions(+), 19 deletions(-)

diff --git a/client/src/aidsearch.c b/client/src/aidsearch.c
index 47c64e77b..3a9d55ace 100644
--- a/client/src/aidsearch.c
+++ b/client/src/aidsearch.c
@@ -36,7 +36,7 @@ static int openAIDFile(json_t **root, bool verbose) {
         goto out;
     }
 
-    if (verbose) PrintAndLogEx(SUCCESS, "Loaded file (%s) OK. %zu records.", path, json_array_size(*root));
+    PrintAndLogEx(DEBUG, "Loaded file " _YELLOW_("%s") " " _GREEN_("%zu") " records ( " _GREEN_("ok") " )", path, json_array_size(*root));
 out:
     free(path);
     return retval;
@@ -145,22 +145,22 @@ int PrintAIDDescription(json_t *xroot, char *aid, bool verbose) {
     const char *description = jsonStrGet(elm, "Description");
     const char *type = jsonStrGet(elm, "Type");
 
-    if (!verbose) {
-        PrintAndLogEx(SUCCESS, "AID %s | %s | %s", vaid, vendor, name);
+    if (verbose == false) {
+        PrintAndLogEx(SUCCESS, "AID : " _YELLOW_("%s") " | %s | %s", vaid, vendor, name);
     } else {
-        PrintAndLogEx(SUCCESS, "Input AID: %s", aid);
+        PrintAndLogEx(SUCCESS, "Input AID..... " _YELLOW_("%s"), aid);
         if (aid)
-            PrintAndLogEx(SUCCESS, "Found AID: %s", vaid);
+            PrintAndLogEx(SUCCESS, "Found AID..... " _YELLOW_("%s"), vaid);
         if (vendor)
-            PrintAndLogEx(SUCCESS, "Vendor: %s", vendor);
+            PrintAndLogEx(SUCCESS, "Vendor........ " _YELLOW_("%s"), vendor);
         if (type)
-            PrintAndLogEx(SUCCESS, "Type: %s", type);
+            PrintAndLogEx(SUCCESS, "Type.......... " _YELLOW_("%s"), type);
         if (name)
-            PrintAndLogEx(SUCCESS, "Name: %s", name);
+            PrintAndLogEx(SUCCESS, "Name.......... " _YELLOW_("%s"), name);
         if (country)
-            PrintAndLogEx(SUCCESS, "Country: %s", country);
+            PrintAndLogEx(SUCCESS, "Country....... %s", country);
         if (description)
-            PrintAndLogEx(SUCCESS, "Description: %s", description);
+            PrintAndLogEx(SUCCESS, "Description... %s", description);
     }
 
 out:
diff --git a/client/src/cmdhf14b.c b/client/src/cmdhf14b.c
index 17c31e0a7..80695b980 100644
--- a/client/src/cmdhf14b.c
+++ b/client/src/cmdhf14b.c
@@ -24,6 +24,8 @@
 #include "protocols.h"     // definitions of ISO14B/7816 protocol
 #include "emv/apduinfo.h"  // GetAPDUCodeDescription
 #include "mifare/ndef.h"   // NDEFRecordsDecodeAndPrint
+#include "aidsearch.h"
+
 
 #define TIMEOUT 2000
 #define APDU_TIMEOUT 2000
@@ -64,6 +66,103 @@ static uint16_t get_sw(uint8_t *d, uint8_t n) {
     return d[n] * 0x0100 + d[n + 1];
 }
 
+static void hf14b_aid_search(bool verbose) {
+
+    int elmindx = 0;
+    json_t *root = AIDSearchInit(verbose);
+    if (root == NULL)  {
+        switch_off_field_14b();
+        return;
+    }
+
+    PrintAndLogEx(INFO, "-------------------- " _CYAN_("AID Search") " --------------------");
+
+    bool found = false;
+    bool leave_signal_on = true;
+    bool activate_field = true;
+    for (elmindx = 0; elmindx < json_array_size(root); elmindx++) {
+
+       if (kbd_enter_pressed()) {
+           break;
+       }
+
+        json_t *data = AIDSearchGetElm(root, elmindx);
+        uint8_t vaid[200] = {0};
+        int vaidlen = 0;
+        if (!AIDGetFromElm(data, vaid, sizeof(vaid), &vaidlen) || !vaidlen)
+            continue;
+
+
+        // COMPUTE APDU
+        uint8_t apdu_data[PM3_CMD_DATA_SIZE] = {0};
+        int apdu_len = 0;
+        sAPDU apdu = (sAPDU) {0x00, 0xa4, 0x04, 0x00, vaidlen, vaid};
+
+        if (APDUEncodeS(&apdu, false, 0x00, apdu_data, &apdu_len)) {
+            PrintAndLogEx(ERR, "APDU encoding error.");
+            return;
+        }
+
+        PrintAndLogEx(DEBUG, ">>>> %s", sprint_hex(apdu_data, apdu_len));
+
+        int resultlen = 0;
+        uint8_t result[1024] = {0};
+        int res = exchange_14b_apdu(apdu_data, apdu_len, activate_field, leave_signal_on, result, sizeof(result), &resultlen, -1);
+        activate_field = false;
+        if (res)
+            continue;
+
+        uint16_t sw = get_sw(result, resultlen);
+
+        uint8_t dfname[200] = {0};
+        size_t dfnamelen = 0;
+        if (resultlen > 3) {
+            struct tlvdb *tlv = tlvdb_parse_multi(result, resultlen);
+            if (tlv) {
+                // 0x84 Dedicated File (DF) Name
+                const struct tlv *dfnametlv = tlvdb_get_tlv(tlvdb_find_full(tlv, 0x84));
+                if (dfnametlv) {
+                    dfnamelen = dfnametlv->len;
+                    memcpy(dfname, dfnametlv->value, dfnamelen);
+                }
+                tlvdb_free(tlv);
+            }
+        }
+
+        if (sw == 0x9000 || sw == 0x6283 || sw == 0x6285) {
+            if (sw == 0x9000) {
+                if (verbose) PrintAndLogEx(SUCCESS, "Application ( " _GREEN_("ok") " )");
+            } else {
+                if (verbose) PrintAndLogEx(WARNING, "Application ( " _RED_("blocked") " )");
+            }
+
+            PrintAIDDescriptionBuf(root, vaid, vaidlen, verbose);
+
+            if (dfnamelen) {
+                if (dfnamelen == vaidlen) {
+                    if (memcmp(dfname, vaid, vaidlen) == 0) {
+                        if (verbose) PrintAndLogEx(INFO, "(DF) Name found and equal to AID");
+                    } else {
+                        PrintAndLogEx(INFO, "(DF) Name not equal to AID: %s :", sprint_hex(dfname, dfnamelen));
+                        PrintAIDDescriptionBuf(root, dfname, dfnamelen, verbose);
+                    }
+                } else {
+                    PrintAndLogEx(INFO, "(DF) Name not equal to AID: %s :", sprint_hex(dfname, dfnamelen));
+                    PrintAIDDescriptionBuf(root, dfname, dfnamelen, verbose);
+                }
+            } else {
+                if (verbose) PrintAndLogEx(INFO, "(DF) Name not found");
+            }
+
+            if (verbose) PrintAndLogEx(SUCCESS, "----------------------------------------------------");
+            found = true;
+        }
+    }
+    switch_off_field_14b();
+    if (verbose == false && found)
+        PrintAndLogEx(INFO, "----------------------------------------------------");
+}
+
 static bool wait_cmd_14b(bool verbose, bool is_select) {
 
     PacketResponseNG resp;
@@ -650,7 +749,7 @@ static void print_ct_general_info(void *vcard) {
 // 0200a4040010a000000018300301000000000000000000 (resp 02 6a 82 [4b 4c])
 
 // 14b get and print Full Info (as much as we know)
-static bool HF14B_Std_Info(bool verbose) {
+static bool HF14B_Std_Info(bool verbose, bool do_aid_search) {
 
     bool is_success = false;
 
@@ -671,14 +770,21 @@ static bool HF14B_Std_Info(bool verbose) {
     int status = resp.oldarg[0];
 
     switch (status) {
-        case 0:
+        case 0: {
             PrintAndLogEx(NORMAL, "");
+            PrintAndLogEx(INFO, "-------------------- " _CYAN_("Tag information") " --------------------");
             PrintAndLogEx(SUCCESS, " UID    : " _GREEN_("%s"), sprint_hex(card.uid, card.uidlen));
             PrintAndLogEx(SUCCESS, " ATQB   : %s", sprint_hex(card.atqb, sizeof(card.atqb)));
             PrintAndLogEx(SUCCESS, " CHIPID : %02X", card.chipid);
             print_atqb_resp(card.atqb, card.cid);
+
+            if (do_aid_search) {
+                hf14b_aid_search(verbose);
+            }
+
             is_success = true;
             break;
+        }
         case -1:
             if (verbose) PrintAndLogEx(FAILED, "ISO 14443-3 ATTRIB fail");
             break;
@@ -694,7 +800,7 @@ static bool HF14B_Std_Info(bool verbose) {
 }
 
 // SRx get and print full info (needs more info...)
-static bool HF14B_ST_Info(bool verbose) {
+static bool HF14B_ST_Info(bool verbose, bool do_aid_search) {
     clearCommandBuffer();
     PacketResponseNG resp;
     SendCommandMIX(CMD_HF_ISO14443B_COMMAND, ISO14B_CONNECT | ISO14B_SELECT_SR | ISO14B_DISCONNECT, 0, 0, NULL, 0);
@@ -712,6 +818,12 @@ static bool HF14B_ST_Info(bool verbose) {
         return false;
 
     print_st_general_info(card.uid, card.uidlen);
+
+   if (do_aid_search) {
+       hf14b_aid_search(verbose);
+   }
+
+
     return true;
 }
 
@@ -725,13 +837,15 @@ static int CmdHF14Binfo(const char *Cmd) {
 
     void *argtable[] = {
         arg_param_begin,
+        arg_lit0("s",  "aidsearch", "checks if AIDs from aidlist.json is present on the card and prints information about found AIDs"),
         arg_lit0("v", "verbose", "verbose"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
-    bool verbose = arg_get_lit(ctx, 1);
+    bool do_aid_search = arg_get_lit(ctx, 1);
+    bool verbose = arg_get_lit(ctx, 2);
     CLIParserFree(ctx);
-    return infoHF14B(verbose);
+    return infoHF14B(verbose, do_aid_search);
 }
 
 static bool HF14B_st_reader(bool verbose) {
@@ -1830,14 +1944,14 @@ int CmdHF14B(const char *Cmd) {
 }
 
 // get and print all info known about any known 14b tag
-int infoHF14B(bool verbose) {
+int infoHF14B(bool verbose, bool do_aid_search) {
 
     // try std 14b (atqb)
-    if (HF14B_Std_Info(verbose))
+    if (HF14B_Std_Info(verbose, do_aid_search))
         return 1;
 
     // try ST 14b
-    if (HF14B_ST_Info(verbose))
+    if (HF14B_ST_Info(verbose, do_aid_search))
         return 1;
 
     // try unknown 14b read commands (to be identified later)
diff --git a/client/src/cmdhf14b.h b/client/src/cmdhf14b.h
index 9bbb17625..bd97bbf5c 100644
--- a/client/src/cmdhf14b.h
+++ b/client/src/cmdhf14b.h
@@ -17,6 +17,6 @@ int CmdHF14B(const char *Cmd);
 
 int exchange_14b_apdu(uint8_t *datain, int datainlen, bool activate_field, bool leave_signal_on, uint8_t *dataout, int maxdataoutlen, int *dataoutlen, int user_timeout);
 
-int infoHF14B(bool verbose);
+int infoHF14B(bool verbose, bool do_aid_search);
 int readHF14B(bool verbose);
 #endif

From 72f868e2a0a0a15e18f2b2ab8f365d141a77fcf2 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 18 Dec 2020 22:10:30 +0100
Subject: [PATCH 132/682] hf 14a info - now aidsearch is interuptable with
 <enter> press

---
 client/src/cmdhf14a.c | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index d9ff4c3b7..a1cf5b76e 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -26,9 +26,8 @@
 #include "util_posix.h"  // msclock
 #include "aidsearch.h"
 #include "cmdhf.h"       // handle HF plot
-#include "protocols.h"   // MAGIC_GEN_1A
 #include "cliparser.h"
-#include "protocols.h"     // definitions of ISO14A/7816 protocol
+#include "protocols.h"     // definitions of ISO14A/7816 protocol, MAGIC_GEN_1A
 #include "emv/apduinfo.h"  // GetAPDUCodeDescription
 
 bool APDUInFramingEnable = true;
@@ -2001,11 +2000,21 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
         }
 
         if (do_aid_search) {
+
+            
+            PrintAndLogEx(INFO, "-------------------- " _CYAN_("AID Search") " --------------------");
+
+            bool found = false;
             int elmindx = 0;
             json_t *root = AIDSearchInit(verbose);
             if (root != NULL) {
                 bool ActivateField = true;
                 for (elmindx = 0; elmindx < json_array_size(root); elmindx++) {
+
+                    if (kbd_enter_pressed()) {
+                        break;
+                    }
+
                     json_t *data = AIDSearchGetElm(root, elmindx);
                     uint8_t vaid[200] = {0};
                     int vaidlen = 0;
@@ -2037,9 +2046,9 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
 
                     if (sw == 0x9000 || sw == 0x6283 || sw == 0x6285) {
                         if (sw == 0x9000) {
-                            if (verbose) PrintAndLogEx(SUCCESS, "------------- Application OK -----------");
+                            if (verbose) PrintAndLogEx(SUCCESS, "Application ( " _GREEN_("ok") " )");
                         } else {
-                            if (verbose) PrintAndLogEx(WARNING, "----------- Application blocked --------");
+                            if (verbose) PrintAndLogEx(WARNING, "Application ( " _RED_("blocked") " )");
                         }
 
                         PrintAIDDescriptionBuf(root, vaid, vaidlen, verbose);
@@ -2059,10 +2068,15 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
                         } else {
                             if (verbose) PrintAndLogEx(INFO, "(DF) Name not found");
                         }
+
+                        if (verbose) PrintAndLogEx(SUCCESS, "----------------------------------------------------");
+                        found = true;
                     }
 
                 }
                 DropField();
+                if (verbose == false && found)
+                    PrintAndLogEx(INFO, "----------------------------------------------------");
             }
         }
     } else {

From 5a4e77d7afa35352c05c5867f179111288f69cac Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 19 Dec 2020 01:05:09 +0300
Subject: [PATCH 133/682] hf emrtd info: Parse and print info about EF_DG12

---
 client/src/cmdhfemrtd.c | 77 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 77 insertions(+)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index f2c3a60d3..82e9753c2 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1183,6 +1183,22 @@ static void emrtd_print_expiry(char *mrz, int offset) {
     }
 }
 
+static void emrtd_print_issuance(char *data) {
+    char final_date[12] = { 0x00 };
+    emrtd_mrz_convert_date(data, 0, final_date, true, true);
+
+    PrintAndLogEx(SUCCESS, "Date of issue.........: " _YELLOW_("%s"), final_date);
+}
+
+static void emrtd_print_personalization_timestamp(uint8_t *data) {
+    char str_date[0x0F] = { 0x00 };
+    strcpy(str_date, sprint_hex_inrow(data, 0x0E));
+    char final_date[20] = { 0x00 };
+    sprintf(final_date, "%.4s-%.2s-%.2s %.2s:%.2s:%.2s", str_date, str_date + 4, str_date + 6, str_date + 8, str_date + 10, str_date + 12);
+
+    PrintAndLogEx(SUCCESS, "Personalization at....: " _YELLOW_("%s"), final_date);
+}
+
 static bool emrtd_print_ef_dg1_info(uint8_t *response, int resplen) {
     int td_variant = 0;
 
@@ -1339,6 +1355,65 @@ static bool emrtd_print_ef_dg11_info(uint8_t *response, int resplen) {
     return true;
 }
 
+static bool emrtd_print_ef_dg12_info(uint8_t *response, int resplen) {
+    uint8_t taglist[100] = { 0x00 };
+    int taglistlen = 0;
+    uint8_t tagdata[1000] = { 0x00 };
+    int tagdatalen = 0;
+
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_DG12") " -------------------");
+
+    if (!emrtd_lds_get_data_by_tag(response, &resplen, taglist, &taglistlen, 0x5c, 0x00, false)) {
+        PrintAndLogEx(ERR, "Failed to read file list from EF_DG12.");
+        return false;
+    }
+
+    for (int i = 0; i < taglistlen; i++) {
+        emrtd_lds_get_data_by_tag(response, &resplen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f);
+        // Special behavior for two char tags
+        if (taglist[i] == 0x5f) {
+            // Several things here are longer than the rest but I can't think of a way to shorten them
+            // ...and I doubt many states are using them.
+            switch (taglist[i + 1]) {
+                case 0x19:
+                    PrintAndLogEx(SUCCESS, "Issuing Authority.....: " _YELLOW_("%.*s"), tagdatalen, tagdata);
+                    break;
+                case 0x26:
+                    emrtd_print_issuance((char *) tagdata);
+                    break;
+                case 0x1b:
+                    PrintAndLogEx(SUCCESS, "Endorsements & Observations: " _YELLOW_("%.*s"), tagdatalen, tagdata);
+                    break;
+                case 0x1c:
+                    PrintAndLogEx(SUCCESS, "Tax/Exit Requirements.: " _YELLOW_("%.*s"), tagdatalen, tagdata);
+                    break;
+                case 0x1d:
+                    saveFile("FrontOfDocument", ".jpg", tagdata, tagdatalen);
+                    break;
+                case 0x1e:
+                    saveFile("BackOfDocument", ".jpg", tagdata, tagdatalen);
+                    break;
+                case 0x55:
+                    emrtd_print_personalization_timestamp(tagdata);
+                    break;
+                case 0x56:
+                    PrintAndLogEx(SUCCESS, "Serial of Personalization System: " _YELLOW_("%.*s"), tagdatalen, tagdata);
+                    break;
+                default:
+                    PrintAndLogEx(SUCCESS, "Unknown Field %02X%02X....: %s", taglist[i], taglist[i + 1], sprint_hex_inrow(tagdata, tagdatalen));
+                    break;
+            }
+
+            i += 1;
+        } else {
+            // TODO: Account for A0
+            PrintAndLogEx(SUCCESS, "Unknown Field %02X......: %s", taglist[i], sprint_hex_inrow(tagdata, tagdatalen));
+        }
+    }
+    return true;
+}
+
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available) {
     uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     int resplen = 0;
@@ -1396,6 +1471,8 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
             emrtd_print_ef_dg1_info(response, resplen);
         } else if (strcmp(file_name, "EF_DG11") == 0 && emrtd_select_and_read(response, &resplen, EMRTD_EF_DG11, ks_enc, ks_mac, ssc, BAC, use_14b)) {
             emrtd_print_ef_dg11_info(response, resplen);
+        } else if (strcmp(file_name, "EF_DG12") == 0 && emrtd_select_and_read(response, &resplen, EMRTD_EF_DG12, ks_enc, ks_mac, ssc, BAC, use_14b)) {
+            emrtd_print_ef_dg12_info(response, resplen);
         }
     }
 

From 24b0e042cbbfbac02091ddaa7c9d48954ba7f77e Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 19 Dec 2020 01:35:32 +0300
Subject: [PATCH 134/682] Resolve coverity 308206 and 308207

---
 client/src/cmdhfemrtd.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 82e9753c2..796e765b0 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1523,7 +1523,8 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
     uint8_t dob[7] = { 0x00 };
     uint8_t expiry[7] = { 0x00 };
     bool BAC = true;
-    int slen = 0;  // unused
+    bool error = false;
+    int slen = 0;
     // Go through all args, if even one isn't supplied, mark BAC as unavailable
     if (CLIParamStrToBuf(arg_get_str(ctx, 1), docnum, 9, &slen) != 0 || slen == 0) {
         BAC = false;
@@ -1541,7 +1542,7 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
         if (!validate_date(dob, slen)) {
             PrintAndLogEx(ERR, "Date of birth date format is incorrect, cannot continue.");
             PrintAndLogEx(HINT, "Use the format YYMMDD.");
-            return PM3_ESOFT;
+            error = true;
         }
     }
     
@@ -1551,11 +1552,14 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
         if (!validate_date(expiry, slen)) {
             PrintAndLogEx(ERR, "Expiry date format is incorrect, cannot continue.");
             PrintAndLogEx(HINT, "Use the format YYMMDD.");
-            return PM3_ESOFT;
+            error = true;
         }
     }
 
     CLIParserFree(ctx);
+    if (error) {
+        return PM3_ESOFT;
+    }
     return dumpHF_EMRTD((char *)docnum, (char *)dob, (char *)expiry, BAC);
 }
 
@@ -1579,7 +1583,8 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
     uint8_t dob[7] = { 0x00 };
     uint8_t expiry[7] = { 0x00 };
     bool BAC = true;
-    int slen = 0;  // unused
+    bool error = false;
+    int slen = 0;
     // Go through all args, if even one isn't supplied, mark BAC as unavailable
     if (CLIParamStrToBuf(arg_get_str(ctx, 1), docnum, 9, &slen) != 0 || slen == 0) {
         BAC = false;
@@ -1596,7 +1601,7 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
         if (!validate_date(dob, slen)) {
             PrintAndLogEx(ERR, "Date of birth date format is incorrect, cannot continue.");
             PrintAndLogEx(HINT, "Use the format YYMMDD.");
-            return PM3_ESOFT;
+            error = true;
         }
     }
     
@@ -1606,11 +1611,14 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
         if (!validate_date(expiry, slen)) {
             PrintAndLogEx(ERR, "Expiry date format is incorrect, cannot continue.");
             PrintAndLogEx(HINT, "Use the format YYMMDD.");
-            return PM3_ESOFT;
+            error = true;
         }
     }
 
     CLIParserFree(ctx);
+    if (error) {
+        return PM3_ESOFT;
+    }
     return infoHF_EMRTD((char *)docnum, (char *)dob, (char *)expiry, BAC);
 }
 

From 7a9e129ad9513666852550ee417406aff25f7870 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Sat, 19 Dec 2020 00:19:11 +0100
Subject: [PATCH 135/682] hf emrtd info: add option to load from files

---
 client/src/cmdhfemrtd.c | 76 +++++++++++++++++++++++++++++++++++++++--
 client/src/cmdhfemrtd.h |  1 +
 2 files changed, 74 insertions(+), 3 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 796e765b0..97b8264df 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1480,6 +1480,70 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     return PM3_SUCCESS;
 }
 
+int infoHF_EMRTD_offline(const char *path) {
+    uint8_t *data;
+    int datalen = 0;
+    char *filepath = calloc(strlen(path) + 100, sizeof(char));
+    if (filepath == NULL)
+        return PM3_EMALLOC;
+    strcpy(filepath, path);
+    strncat(filepath, PATHSEP, 1);
+    strcat(filepath, "EF_COM");
+
+    if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, true) != PM3_SUCCESS) {
+        PrintAndLogEx(ERR, "Failed to read EF_COM.");
+        free(filepath);
+        return PM3_ESOFT;
+    }
+    uint8_t filelist[50];
+    int filelistlen = 0;
+    int res = emrtd_lds_get_data_by_tag(data, &datalen, filelist, &filelistlen, 0x5c, 0x00, false);
+    free(data);
+    if (!res) {
+        PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
+        free(filepath);
+        return PM3_ESOFT;
+    }
+
+    // Read files in the file list
+    for (int i = 0; i < filelistlen; i++) {
+        char file_id[5] = { 0x00 };
+        char file_name[8] = { 0x00 };
+        if (emrtd_file_tag_to_file_id(&filelist[i], file_name, file_id) == false) {
+            PrintAndLogEx(DEBUG, "File tag not found, skipping: %02X", filelist[i]);
+            continue;
+        }
+
+        if (strcmp(file_name, "EF_DG1") == 0) {
+            strcpy(filepath, path);
+            strncat(filepath, PATHSEP, 1);
+            strcat(filepath, "EF_DG1");
+            if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, true) == PM3_SUCCESS) {
+                emrtd_print_ef_dg1_info(data, datalen);
+                free(data);
+            }
+        } else if (strcmp(file_name, "EF_DG11") == 0) {
+            strcpy(filepath, path);
+            strncat(filepath, PATHSEP, 1);
+            strcat(filepath, "EF_DG11");
+            if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, true) == PM3_SUCCESS) {
+                emrtd_print_ef_dg11_info(data, datalen);
+                free(data);
+            }
+        } else if (strcmp(file_name, "EF_DG12") == 0) {
+            strcpy(filepath, path);
+            strncat(filepath, PATHSEP, 1);
+            strcat(filepath, "EF_DG12");
+            if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, true) == PM3_SUCCESS) {
+                emrtd_print_ef_dg12_info(data, datalen);
+                free(data);
+            }
+        }
+    }
+    free(filepath);
+    return PM3_SUCCESS;
+}
+
 static void text_to_upper(uint8_t *data, int datalen) {
     // Loop over text to make lowercase text uppercase
     for (int i = 0; i < datalen; i++) {
@@ -1575,6 +1639,7 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
         arg_str0("n", "documentnumber", "<alphanum>", "document number, up to 9 chars"),
         arg_str0("d", "dateofbirth", "<YYMMDD>", "date of birth in YYMMDD format"),
         arg_str0("e", "expiry", "<YYMMDD>", "expiry in YYMMDD format"),
+        arg_str0("p", "path", "<dirpath>", "display info from offline dump stored in dirpath"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
@@ -1614,12 +1679,17 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
             error = true;
         }
     }
-
+    uint8_t path[FILENAME_MAX] = { 0x00 };
+    bool offline = CLIParamStrToBuf(arg_get_str(ctx, 4), path, sizeof(path), &slen) == 0 && slen > 0;
     CLIParserFree(ctx);
     if (error) {
         return PM3_ESOFT;
     }
-    return infoHF_EMRTD((char *)docnum, (char *)dob, (char *)expiry, BAC);
+    if (offline) {
+        return infoHF_EMRTD_offline((const char *)path);
+    } else {
+        return infoHF_EMRTD((char *)docnum, (char *)dob, (char *)expiry, BAC);
+    }
 }
 
 static int cmd_hf_emrtd_list(const char *Cmd) {
@@ -1635,7 +1705,7 @@ static int cmd_hf_emrtd_list(const char *Cmd) {
 static command_t CommandTable[] = {
     {"help",    CmdHelp,           AlwaysAvailable, "This help"},
     {"dump",    cmd_hf_emrtd_dump, IfPm3Iso14443,   "Dump eMRTD files to binary files"},
-    {"info",    cmd_hf_emrtd_info, IfPm3Iso14443,   "Display info about an eMRTD"},
+    {"info",    cmd_hf_emrtd_info, AlwaysAvailable, "Display info about an eMRTD"},
     {"list",    cmd_hf_emrtd_list, AlwaysAvailable, "List ISO 14443A/7816 history"},
     {NULL, NULL, NULL, NULL}
 };
diff --git a/client/src/cmdhfemrtd.h b/client/src/cmdhfemrtd.h
index f19a71ac0..3cfcd3cbd 100644
--- a/client/src/cmdhfemrtd.h
+++ b/client/src/cmdhfemrtd.h
@@ -17,4 +17,5 @@ int CmdHFeMRTD(const char *Cmd);
 
 int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available);
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available);
+int infoHF_EMRTD_offline(const char *path);
 #endif

From bdcf84f90de080bc32332cbbe6fcb9205d9f7342 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Sat, 19 Dec 2020 00:59:27 +0100
Subject: [PATCH 136/682] fix emrtd info offline bug

---
 client/src/cmdhfemrtd.c | 35 +++++++++++++++++------------------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 97b8264df..fda90889f 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -568,14 +568,14 @@ static int emrtd_read_file(uint8_t *dataout, int *dataoutlen, uint8_t *kenc, uin
     return true;
 }
 
-static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int *datainlen, uint8_t *dataout, int *dataoutlen, int tag1, int tag2, bool twobytetag) {
+static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int datainlen, uint8_t *dataout, int *dataoutlen, int tag1, int tag2, bool twobytetag) {
     int offset = 1;
-    offset += emrtd_get_asn1_field_length(datain, *datainlen, offset);
+    offset += emrtd_get_asn1_field_length(datain, datainlen, offset);
 
     int e_idlen = 0;
     int e_datalen = 0;
     int e_fieldlen = 0;
-    while (offset < *datainlen) {
+    while (offset < datainlen) {
         PrintAndLogEx(DEBUG, "emrtd_lds_get_data_by_tag, offset: %i, data: %X", offset, *(datain + offset));
         // Determine element ID length to set as offset on asn1datalength
         if ((*(datain + offset) == 0x5F) || (*(datain + offset) == 0x7F)) {
@@ -585,14 +585,14 @@ static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int *datainlen, uint8_t *
         }
 
         // Get the length of the element
-        e_datalen = emrtd_get_asn1_data_length(datain + offset, *datainlen - offset, e_idlen);
+        e_datalen = emrtd_get_asn1_data_length(datain + offset, datainlen - offset, e_idlen);
 
         // Get the length of the element's length
-        e_fieldlen = emrtd_get_asn1_field_length(datain + offset, *datainlen - offset, e_idlen);
+        e_fieldlen = emrtd_get_asn1_field_length(datain + offset, datainlen - offset, e_idlen);
 
         // If the element is what we're looking for, get the data and return true
         if (*(datain + offset) == tag1 && (!twobytetag || *(datain + offset + 1) == tag2)) {
-            if (*datainlen > e_datalen) {
+            if (datainlen > e_datalen) {
                 *dataoutlen = e_datalen;
                 memcpy(dataout, datain + offset + e_idlen + e_fieldlen, e_datalen);
                 return true;
@@ -741,7 +741,7 @@ static bool emrtd_dump_ef_dg5(uint8_t *file_contents, int file_length) {
     int datalen = 0;
 
     // If we can't find image in EF_DG5, return false.
-    if (emrtd_lds_get_data_by_tag(file_contents, &file_length, data, &datalen, 0x5F, 0x40, true) == false) {
+    if (emrtd_lds_get_data_by_tag(file_contents, file_length, data, &datalen, 0x5F, 0x40, true) == false) {
         return false;
     }
 
@@ -1013,7 +1013,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     uint8_t filelist[50];
     int filelistlen = 0;
 
-    if (!emrtd_lds_get_data_by_tag(response, &resplen, filelist, &filelistlen, 0x5c, 0x00, false)) {
+    if (!emrtd_lds_get_data_by_tag(response, resplen, filelist, &filelistlen, 0x5c, 0x00, false)) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
         DropField();
         return PM3_ESOFT;
@@ -1210,7 +1210,7 @@ static bool emrtd_print_ef_dg1_info(uint8_t *response, int resplen) {
     char mrz[90] = { 0x00 };
     int mrzlen = 0;
 
-    if (!emrtd_lds_get_data_by_tag(response, &resplen, (uint8_t *) mrz, &mrzlen, 0x5f, 0x1f, true)) {
+    if (!emrtd_lds_get_data_by_tag(response, resplen, (uint8_t *) mrz, &mrzlen, 0x5f, 0x1f, true)) {
         PrintAndLogEx(ERR, "Failed to read MRZ from EF_DG1.");
         return false;
     }
@@ -1292,13 +1292,13 @@ static bool emrtd_print_ef_dg11_info(uint8_t *response, int resplen) {
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_DG11") " -------------------");
 
-    if (!emrtd_lds_get_data_by_tag(response, &resplen, taglist, &taglistlen, 0x5c, 0x00, false)) {
+    if (!emrtd_lds_get_data_by_tag(response, resplen, taglist, &taglistlen, 0x5c, 0x00, false)) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_DG11.");
         return false;
     }
 
     for (int i = 0; i < taglistlen; i++) {
-        emrtd_lds_get_data_by_tag(response, &resplen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f);
+        emrtd_lds_get_data_by_tag(response, resplen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f);
         // Special behavior for two char tags
         if (taglist[i] == 0x5f) {
             switch (taglist[i + 1]) {
@@ -1364,13 +1364,13 @@ static bool emrtd_print_ef_dg12_info(uint8_t *response, int resplen) {
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_DG12") " -------------------");
 
-    if (!emrtd_lds_get_data_by_tag(response, &resplen, taglist, &taglistlen, 0x5c, 0x00, false)) {
+    if (!emrtd_lds_get_data_by_tag(response, resplen, taglist, &taglistlen, 0x5c, 0x00, false)) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_DG12.");
         return false;
     }
 
     for (int i = 0; i < taglistlen; i++) {
-        emrtd_lds_get_data_by_tag(response, &resplen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f);
+        emrtd_lds_get_data_by_tag(response, resplen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f);
         // Special behavior for two char tags
         if (taglist[i] == 0x5f) {
             // Several things here are longer than the rest but I can't think of a way to shorten them
@@ -1452,7 +1452,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     uint8_t filelist[50];
     int filelistlen = 0;
 
-    if (!emrtd_lds_get_data_by_tag(response, &resplen, filelist, &filelistlen, 0x5c, 0x00, false)) {
+    if (!emrtd_lds_get_data_by_tag(response, resplen, filelist, &filelistlen, 0x5c, 0x00, false)) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
         DropField();
         return PM3_ESOFT;
@@ -1482,7 +1482,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
 
 int infoHF_EMRTD_offline(const char *path) {
     uint8_t *data;
-    int datalen = 0;
+    size_t datalen = 0;
     char *filepath = calloc(strlen(path) + 100, sizeof(char));
     if (filepath == NULL)
         return PM3_EMALLOC;
@@ -1497,7 +1497,7 @@ int infoHF_EMRTD_offline(const char *path) {
     }
     uint8_t filelist[50];
     int filelistlen = 0;
-    int res = emrtd_lds_get_data_by_tag(data, &datalen, filelist, &filelistlen, 0x5c, 0x00, false);
+    int res = emrtd_lds_get_data_by_tag(data, datalen, filelist, &filelistlen, 0x5c, 0x00, false);
     free(data);
     if (!res) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
@@ -1513,7 +1513,6 @@ int infoHF_EMRTD_offline(const char *path) {
             PrintAndLogEx(DEBUG, "File tag not found, skipping: %02X", filelist[i]);
             continue;
         }
-
         if (strcmp(file_name, "EF_DG1") == 0) {
             strcpy(filepath, path);
             strncat(filepath, PATHSEP, 1);
@@ -1639,7 +1638,7 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
         arg_str0("n", "documentnumber", "<alphanum>", "document number, up to 9 chars"),
         arg_str0("d", "dateofbirth", "<YYMMDD>", "date of birth in YYMMDD format"),
         arg_str0("e", "expiry", "<YYMMDD>", "expiry in YYMMDD format"),
-        arg_str0("p", "path", "<dirpath>", "display info from offline dump stored in dirpath"),
+        arg_str0(NULL, "path", "<dirpath>", "display info from offline dump stored in dirpath"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);

From 6ca472fc8ffa74a2c063a73dc6859aecfd863dea Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 19 Dec 2020 03:27:48 +0300
Subject: [PATCH 137/682] emrtd: Dump image from EF_DG7 too

---
 client/src/cmdhfemrtd.c | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index fda90889f..a06beff9a 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -735,7 +735,6 @@ static bool emrtd_dump_ef_dg2(uint8_t *file_contents, int file_length) {
     return true;
 }
 
-
 static bool emrtd_dump_ef_dg5(uint8_t *file_contents, int file_length) {
     uint8_t data[EMRTD_MAX_FILE_SIZE];
     int datalen = 0;
@@ -754,6 +753,24 @@ static bool emrtd_dump_ef_dg5(uint8_t *file_contents, int file_length) {
     return true;
 }
 
+static bool emrtd_dump_ef_dg7(uint8_t *file_contents, int file_length) {
+    uint8_t data[EMRTD_MAX_FILE_SIZE];
+    int datalen = 0;
+
+    // If we can't find image in EF_DG7, return false.
+    if (emrtd_lds_get_data_by_tag(file_contents, file_length, data, &datalen, 0x5F, 0x42, true) == false) {
+        return false;
+    }
+
+    if (datalen < EMRTD_MAX_FILE_SIZE) {
+        saveFile("EF_DG7", ".jpg", data, datalen);
+    } else {
+        PrintAndLogEx(ERR, "error (emrtd_dump_ef_dg7) datalen out-of-bounds");
+        return false;
+    }
+    return true;
+}
+
 static bool emrtd_dump_ef_sod(uint8_t *file_contents, int file_length) {
     int fieldlen = emrtd_get_asn1_field_length(file_contents, file_length, 1);
     int datalen = emrtd_get_asn1_data_length(file_contents, file_length, 1);
@@ -783,6 +800,8 @@ static bool emrtd_dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, cons
         emrtd_dump_ef_dg2(response, resplen);
     } else if (strcmp(file, EMRTD_EF_DG5) == 0) {
         emrtd_dump_ef_dg5(response, resplen);
+    } else if (strcmp(file, EMRTD_EF_DG7) == 0) {
+        emrtd_dump_ef_dg7(response, resplen);
     } else if (strcmp(file, EMRTD_EF_SOD) == 0) {
         emrtd_dump_ef_sod(response, resplen);
     }

From 88f0de3176e21d30b2667839cea4e70b5e0f09ae Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 19 Dec 2020 05:28:21 +0300
Subject: [PATCH 138/682] emrtd: Use .jp2 ext when saving JPG 2000 files

---
 client/src/cmdhfemrtd.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index a06beff9a..e6875fc63 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -731,7 +731,7 @@ static bool emrtd_dump_ef_dg2(uint8_t *file_contents, int file_length) {
         return false;
     }
 
-    saveFile("EF_DG2", ".jpg", file_contents + offset, datalen);
+    saveFile("EF_DG2", file_contents[offset] == 0xFF ? ".jpg" : ".jp2", file_contents + offset, datalen);
     return true;
 }
 
@@ -745,7 +745,7 @@ static bool emrtd_dump_ef_dg5(uint8_t *file_contents, int file_length) {
     }
 
     if (datalen < EMRTD_MAX_FILE_SIZE) {
-        saveFile("EF_DG5", ".jpg", data, datalen);
+        saveFile("EF_DG5", data[0] == 0xFF ? ".jpg" : ".jp2", data, datalen);
     } else {
         PrintAndLogEx(ERR, "error (emrtd_dump_ef_dg5) datalen out-of-bounds");
         return false;
@@ -763,7 +763,7 @@ static bool emrtd_dump_ef_dg7(uint8_t *file_contents, int file_length) {
     }
 
     if (datalen < EMRTD_MAX_FILE_SIZE) {
-        saveFile("EF_DG7", ".jpg", data, datalen);
+        saveFile("EF_DG7", data[0] == 0xFF ? ".jpg" : ".jp2", data, datalen);
     } else {
         PrintAndLogEx(ERR, "error (emrtd_dump_ef_dg7) datalen out-of-bounds");
         return false;
@@ -1348,7 +1348,7 @@ static bool emrtd_print_ef_dg11_info(uint8_t *response, int resplen) {
                     PrintAndLogEx(SUCCESS, "Personal Summary......: " _YELLOW_("%.*s"), tagdatalen, tagdata);
                     break;
                 case 0x16:
-                    saveFile("ProofOfCitizenship", ".jpg", tagdata, tagdatalen);
+                    saveFile("ProofOfCitizenship", tagdata[0] == 0xFF ? ".jpg" : ".jp2", tagdata, tagdatalen);
                     break;
                 case 0x17:
                     // TODO: acc for < separation
@@ -1408,10 +1408,10 @@ static bool emrtd_print_ef_dg12_info(uint8_t *response, int resplen) {
                     PrintAndLogEx(SUCCESS, "Tax/Exit Requirements.: " _YELLOW_("%.*s"), tagdatalen, tagdata);
                     break;
                 case 0x1d:
-                    saveFile("FrontOfDocument", ".jpg", tagdata, tagdatalen);
+                    saveFile("FrontOfDocument", tagdata[0] == 0xFF ? ".jpg" : ".jp2", tagdata, tagdatalen);
                     break;
                 case 0x1e:
-                    saveFile("BackOfDocument", ".jpg", tagdata, tagdatalen);
+                    saveFile("BackOfDocument", tagdata[0] == 0xFF ? ".jpg" : ".jp2", tagdata, tagdatalen);
                     break;
                 case 0x55:
                     emrtd_print_personalization_timestamp(tagdata);

From 333afad302852c22ca03130a98eb65af84821953 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 19 Dec 2020 06:49:21 +0300
Subject: [PATCH 139/682] hf emrtd info: Fixes for hungarian passports

---
 client/src/cmdhfemrtd.c | 46 +++++++++++++++++++++++++++--------------
 1 file changed, 31 insertions(+), 15 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index e6875fc63..389d10f53 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1154,15 +1154,28 @@ static void emrtd_print_name(char *mrz, int offset, int max_length, bool localiz
     }
 }
 
-static void emrtd_mrz_convert_date(char *mrz, int offset, char *final_date, bool is_expiry, bool is_full) {
+static void emrtd_mrz_convert_date(char *mrz, int offset, char *final_date, bool is_expiry, bool is_full, bool is_ascii) {
+    char work_date[9] = { 0x00 };
+    int len = is_full ? 8 : 6;
+
+    // Copy the data to a working array in the right format
+    if (!is_ascii) {
+        memcpy(work_date, sprint_hex_inrow((uint8_t *)mrz + offset, len / 2), len);
+    } else {
+        memcpy(work_date, mrz + offset, len);
+    }
+
+    // Set offset to 0 as we've now copied data.
+    offset = 0;
+
     if (is_full) {
         // If we get the full date, use the first two characters from that for year
-        memcpy(final_date, mrz, 2);
+        memcpy(final_date, work_date, 2);
         // and do + 2 on offset so that rest of code uses the right data
         offset += 2;
     } else {
         char temp_year[3] = { 0x00 };
-        memcpy(temp_year, mrz + offset, 2);
+        memcpy(temp_year, work_date, 2);
         // If it's > 20, assume 19xx.
         if (strtol(temp_year, NULL, 10) < 20 || is_expiry) {
             final_date[0] = '2';
@@ -1173,16 +1186,16 @@ static void emrtd_mrz_convert_date(char *mrz, int offset, char *final_date, bool
         }
     }
 
-    memcpy(final_date + 2, mrz + offset, 2);
+    memcpy(final_date + 2, work_date + offset, 2);
     final_date[4] = '-';
-    memcpy(final_date + 5, mrz + offset + 2, 2);
+    memcpy(final_date + 5, work_date + offset + 2, 2);
     final_date[7] = '-';
-    memcpy(final_date + 8, mrz + offset + 4, 2);
+    memcpy(final_date + 8, work_date + offset + 4, 2);
 }
 
-static void emrtd_print_dob(char *mrz, int offset, bool full) {
+static void emrtd_print_dob(char *mrz, int offset, bool full, bool ascii) {
     char final_date[12] = { 0x00 };
-    emrtd_mrz_convert_date(mrz, offset, final_date, false, full);
+    emrtd_mrz_convert_date(mrz, offset, final_date, false, full, ascii);
 
     PrintAndLogEx(SUCCESS, "Date of birth.........: " _YELLOW_("%s"), final_date);
 
@@ -1193,7 +1206,7 @@ static void emrtd_print_dob(char *mrz, int offset, bool full) {
 
 static void emrtd_print_expiry(char *mrz, int offset) {
     char final_date[12] = { 0x00 };
-    emrtd_mrz_convert_date(mrz, offset, final_date, true, false);
+    emrtd_mrz_convert_date(mrz, offset, final_date, true, false, true);
 
     PrintAndLogEx(SUCCESS, "Date of expiry........: " _YELLOW_("%s"), final_date);
 
@@ -1202,9 +1215,9 @@ static void emrtd_print_expiry(char *mrz, int offset) {
     }
 }
 
-static void emrtd_print_issuance(char *data) {
+static void emrtd_print_issuance(char *data, bool ascii) {
     char final_date[12] = { 0x00 };
-    emrtd_mrz_convert_date(data, 0, final_date, true, true);
+    emrtd_mrz_convert_date(data, 0, final_date, true, true, ascii);
 
     PrintAndLogEx(SUCCESS, "Date of issue.........: " _YELLOW_("%s"), final_date);
 }
@@ -1268,7 +1281,7 @@ static bool emrtd_print_ef_dg1_info(uint8_t *response, int resplen) {
         PrintAndLogEx(SUCCESS, "Nationality...........: " _YELLOW_("%.3s"), mrz + 44 + 10);
         emrtd_print_name(mrz, 5, 38, false);
         emrtd_print_document_number(mrz, 44);
-        emrtd_print_dob(mrz, 44 + 13, false);
+        emrtd_print_dob(mrz, 44 + 13, false, true);
         emrtd_print_legal_sex(&mrz[44 + 20]);
         emrtd_print_expiry(mrz, 44 + 21);
         emrtd_print_optional_elements(mrz, 44 + 28, 14, true);
@@ -1287,7 +1300,7 @@ static bool emrtd_print_ef_dg1_info(uint8_t *response, int resplen) {
         PrintAndLogEx(SUCCESS, "Nationality...........: " _YELLOW_("%.3s"), mrz + 30 + 15);
         emrtd_print_name(mrz, 60, 30, false);
         emrtd_print_document_number(mrz, 5);
-        emrtd_print_dob(mrz, 30, false);
+        emrtd_print_dob(mrz, 30, false, true);
         emrtd_print_legal_sex(&mrz[30 + 7]);
         emrtd_print_expiry(mrz, 30 + 8);
         emrtd_print_optional_elements(mrz, 15, 15, false);
@@ -1324,6 +1337,9 @@ static bool emrtd_print_ef_dg11_info(uint8_t *response, int resplen) {
                 case 0x0e:
                     emrtd_print_name((char *) tagdata, 0, tagdatalen, true);
                     break;
+                case 0x0f:
+                    emrtd_print_name((char *) tagdata, 0, tagdatalen, false);
+                    break;
                 case 0x10:
                     PrintAndLogEx(SUCCESS, "Personal Number.......: " _YELLOW_("%.*s"), tagdatalen, tagdata);
                     break;
@@ -1358,7 +1374,7 @@ static bool emrtd_print_ef_dg11_info(uint8_t *response, int resplen) {
                     PrintAndLogEx(SUCCESS, "Custody Information...: " _YELLOW_("%.*s"), tagdatalen, tagdata);
                     break;
                 case 0x2b:
-                    emrtd_print_dob((char *) tagdata, 0, true);
+                    emrtd_print_dob((char *) tagdata, 0, true, tagdatalen != 4);
                     break;
                 default:
                     PrintAndLogEx(SUCCESS, "Unknown Field %02X%02X....: %s", taglist[i], taglist[i + 1], sprint_hex_inrow(tagdata, tagdatalen));
@@ -1399,7 +1415,7 @@ static bool emrtd_print_ef_dg12_info(uint8_t *response, int resplen) {
                     PrintAndLogEx(SUCCESS, "Issuing Authority.....: " _YELLOW_("%.*s"), tagdatalen, tagdata);
                     break;
                 case 0x26:
-                    emrtd_print_issuance((char *) tagdata);
+                    emrtd_print_issuance((char *) tagdata, tagdatalen != 4);
                     break;
                 case 0x1b:
                     PrintAndLogEx(SUCCESS, "Endorsements & Observations: " _YELLOW_("%.*s"), tagdatalen, tagdata);

From 013a8abcd885ffcb19a8311517618935b287a171 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 19 Dec 2020 07:01:03 +0300
Subject: [PATCH 140/682] hf emrtd info: Fix segfaults on mononyms

---
 client/src/cmdhfemrtd.c | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 389d10f53..f925c2809 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1106,12 +1106,13 @@ static int emrtd_mrz_determine_length(char *mrz, int offset, int max_length) {
 
 static int emrtd_mrz_determine_separator(char *mrz, int offset, int max_length) {
     int i;
-    for (i = max_length; i >= 0; i--) {
+    for (i = max_length; i > 0; i--) {
         if (mrz[offset + i - 1] == '<' && mrz[offset + i] == '<') {
             break;
         }
     }
-    return i - 1;
+    // Return i - 1 unless we couldn't find anything (in that case return 0).
+    return i ? i - 1 : 0;
 }
 
 static void emrtd_print_optional_elements(char *mrz, int offset, int length, bool verify_check_digit) {
@@ -1139,13 +1140,19 @@ static void emrtd_print_document_number(char *mrz, int offset) {
 
 static void emrtd_print_name(char *mrz, int offset, int max_length, bool localized) {
     char final_name[100] = { 0x00 };
-    int i = emrtd_mrz_determine_length(mrz, offset, max_length);
-    int sep = emrtd_mrz_determine_separator(mrz, offset, i);
-    int namelen = (i - (sep + 2));
+    int namelen = emrtd_mrz_determine_length(mrz, offset, max_length);
+    int sep = emrtd_mrz_determine_separator(mrz, offset, namelen);
 
-    memcpy(final_name, mrz + offset + sep + 2, namelen);
-    final_name[namelen] = ' ';
-    memcpy(final_name + namelen + 1, mrz + offset, sep);
+    // Account for mononyms
+    if (sep != 0) {
+        int firstnamelen = (namelen - (sep + 2));
+
+        memcpy(final_name, mrz + offset + sep + 2, firstnamelen);
+        final_name[firstnamelen] = ' ';
+        memcpy(final_name + firstnamelen + 1, mrz + offset, sep);
+    } else {
+        memcpy(final_name, mrz + offset, namelen);
+    }
 
     if (localized) {
         PrintAndLogEx(SUCCESS, "Legal Name (Localized): " _YELLOW_("%s"), final_name);

From 9945107016ce0c05345c43ee4c6ad825f6b908eb Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 19 Dec 2020 07:08:39 +0300
Subject: [PATCH 141/682] hf emrtd info: Replace padding with spaces on names

---
 client/src/cmdhfemrtd.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index f925c2809..32d42f523 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1115,6 +1115,14 @@ static int emrtd_mrz_determine_separator(char *mrz, int offset, int max_length)
     return i ? i - 1 : 0;
 }
 
+static void emrtd_mrz_replace_pad(char *data, int datalen, char newchar) {
+    for (int i = 0; i < datalen; i++) {
+        if (data[i] == '<') {
+            data[i] = newchar;
+        }
+    }
+}
+
 static void emrtd_print_optional_elements(char *mrz, int offset, int length, bool verify_check_digit) {
     int i = emrtd_mrz_determine_length(mrz, offset, length);
 
@@ -1154,6 +1162,9 @@ static void emrtd_print_name(char *mrz, int offset, int max_length, bool localiz
         memcpy(final_name, mrz + offset, namelen);
     }
 
+    // Replace < characters with spaces
+    emrtd_mrz_replace_pad(final_name, namelen, ' ');
+
     if (localized) {
         PrintAndLogEx(SUCCESS, "Legal Name (Localized): " _YELLOW_("%s"), final_name);
     } else {

From d23ebec93c0e81819f649fab15b963157d63d946 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 19 Dec 2020 07:25:28 +0300
Subject: [PATCH 142/682] emrtd: Make emrtd_mrz_determine_separator less hacky

---
 client/src/cmdhfemrtd.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 32d42f523..14abc8c90 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1106,13 +1106,12 @@ static int emrtd_mrz_determine_length(char *mrz, int offset, int max_length) {
 
 static int emrtd_mrz_determine_separator(char *mrz, int offset, int max_length) {
     int i;
-    for (i = max_length; i > 0; i--) {
-        if (mrz[offset + i - 1] == '<' && mrz[offset + i] == '<') {
+    for (i = max_length - 1; i > 0; i--) {
+        if (mrz[offset + i] == '<' && mrz[offset + i + 1] == '<') {
             break;
         }
     }
-    // Return i - 1 unless we couldn't find anything (in that case return 0).
-    return i ? i - 1 : 0;
+    return i;
 }
 
 static void emrtd_mrz_replace_pad(char *data, int datalen, char newchar) {

From 263eb5774900e1c5d12f078c011ef797cac69fee Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 19 Dec 2020 16:14:27 +0300
Subject: [PATCH 143/682] emrtd: fixes for some belgian passports

---
 client/src/cmdhfemrtd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 14abc8c90..827faa4e0 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1105,6 +1105,7 @@ static int emrtd_mrz_determine_length(char *mrz, int offset, int max_length) {
 }
 
 static int emrtd_mrz_determine_separator(char *mrz, int offset, int max_length) {
+    // Note: this function does not account for len=0
     int i;
     for (i = max_length - 1; i > 0; i--) {
         if (mrz[offset + i] == '<' && mrz[offset + i + 1] == '<') {
@@ -1146,6 +1147,9 @@ static void emrtd_print_document_number(char *mrz, int offset) {
 }
 
 static void emrtd_print_name(char *mrz, int offset, int max_length, bool localized) {
+    if (max_length == 0) {
+        return;
+    }
     char final_name[100] = { 0x00 };
     int namelen = emrtd_mrz_determine_length(mrz, offset, max_length);
     int sep = emrtd_mrz_determine_separator(mrz, offset, namelen);

From 3e4a03ec336783df1cca28cc46a6332979608fbd Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 19 Dec 2020 16:17:44 +0300
Subject: [PATCH 144/682] emrtd: Implement a better fix for parsing empty tags

---
 client/src/cmdhfemrtd.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 827faa4e0..0af2d406f 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1147,9 +1147,6 @@ static void emrtd_print_document_number(char *mrz, int offset) {
 }
 
 static void emrtd_print_name(char *mrz, int offset, int max_length, bool localized) {
-    if (max_length == 0) {
-        return;
-    }
     char final_name[100] = { 0x00 };
     int namelen = emrtd_mrz_determine_length(mrz, offset, max_length);
     int sep = emrtd_mrz_determine_separator(mrz, offset, namelen);
@@ -1352,6 +1349,10 @@ static bool emrtd_print_ef_dg11_info(uint8_t *response, int resplen) {
 
     for (int i = 0; i < taglistlen; i++) {
         emrtd_lds_get_data_by_tag(response, resplen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f);
+        // Don't bother with empty tags
+        if (tagdatalen == 0) {
+            continue;
+        }
         // Special behavior for two char tags
         if (taglist[i] == 0x5f) {
             switch (taglist[i + 1]) {
@@ -1427,6 +1428,10 @@ static bool emrtd_print_ef_dg12_info(uint8_t *response, int resplen) {
 
     for (int i = 0; i < taglistlen; i++) {
         emrtd_lds_get_data_by_tag(response, resplen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f);
+        // Don't bother with empty tags
+        if (tagdatalen == 0) {
+            continue;
+        }
         // Special behavior for two char tags
         if (taglist[i] == 0x5f) {
             // Several things here are longer than the rest but I can't think of a way to shorten them

From 9bed791026ac1585fa119e92b758baf59f4de8c1 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 19 Dec 2020 16:25:09 +0300
Subject: [PATCH 145/682] emrtd: Account for undocumented 5F85 tag

---
 client/src/cmdhfemrtd.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 0af2d406f..2fcc849b0 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1249,6 +1249,14 @@ static void emrtd_print_personalization_timestamp(uint8_t *data) {
     PrintAndLogEx(SUCCESS, "Personalization at....: " _YELLOW_("%s"), final_date);
 }
 
+static void emrtd_print_unknown_timestamp_5f85(uint8_t *data) {
+    char final_date[20] = { 0x00 };
+    sprintf(final_date, "%.4s-%.2s-%.2s %.2s:%.2s:%.2s", data, data + 4, data + 6, data + 8, data + 10, data + 12);
+
+    PrintAndLogEx(SUCCESS, "Unknown timestamp 5F85: " _YELLOW_("%s"), final_date);
+    PrintAndLogEx(HINT, "This is very likely the personalization timestamp, but it is using an undocumented tag.");
+}
+
 static bool emrtd_print_ef_dg1_info(uint8_t *response, int resplen) {
     int td_variant = 0;
 
@@ -1461,6 +1469,9 @@ static bool emrtd_print_ef_dg12_info(uint8_t *response, int resplen) {
                 case 0x56:
                     PrintAndLogEx(SUCCESS, "Serial of Personalization System: " _YELLOW_("%.*s"), tagdatalen, tagdata);
                     break;
+                case 0x85:
+                    emrtd_print_unknown_timestamp_5f85(tagdata);
+                    break;
                 default:
                     PrintAndLogEx(SUCCESS, "Unknown Field %02X%02X....: %s", taglist[i], taglist[i + 1], sprint_hex_inrow(tagdata, tagdatalen));
                     break;

From e277eaaab2263b5641e9e6b693ca3a5cdb6b758e Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Sat, 19 Dec 2020 16:48:37 +0100
Subject: [PATCH 146/682] emrtd: add COM description, add big DG table

---
 client/src/cmdhfemrtd.c | 335 ++++++++++++++++++++--------------------
 client/src/cmdhfemrtd.h |  11 ++
 2 files changed, 180 insertions(+), 166 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 2fcc849b0..241a4750b 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -44,25 +44,11 @@
 #define EMRTD_P2_PROPRIETARY "0C"
 
 // File IDs
+// TODO -> dg_table
 #define EMRTD_EF_CARDACCESS "011C"
+#define EMRTD_EF_SOD "011D"
 #define EMRTD_EF_COM "011E"
 #define EMRTD_EF_DG1 "0101"
-#define EMRTD_EF_DG2 "0102"
-#define EMRTD_EF_DG3 "0103"
-#define EMRTD_EF_DG4 "0104"
-#define EMRTD_EF_DG5 "0105"
-#define EMRTD_EF_DG6 "0106"
-#define EMRTD_EF_DG7 "0107"
-#define EMRTD_EF_DG8 "0108"
-#define EMRTD_EF_DG9 "0109"
-#define EMRTD_EF_DG10 "010A"
-#define EMRTD_EF_DG11 "010B"
-#define EMRTD_EF_DG12 "010C"
-#define EMRTD_EF_DG13 "010D"
-#define EMRTD_EF_DG14 "010E"
-#define EMRTD_EF_DG15 "010F"
-#define EMRTD_EF_DG16 "0110"
-#define EMRTD_EF_SOD "011D"
 
 // App IDs
 #define EMRTD_AID_MRTD "A0000002471001"
@@ -71,6 +57,40 @@
 const uint8_t KENC_type[4] = {0x00, 0x00, 0x00, 0x01};
 const uint8_t KMAC_type[4] = {0x00, 0x00, 0x00, 0x02};
 
+static int emrtd_dump_ef_dg2(uint8_t *file_contents, size_t file_length);
+static int emrtd_dump_ef_dg5(uint8_t *file_contents, size_t file_length);
+static int emrtd_dump_ef_dg7(uint8_t *file_contents, size_t file_length);
+static int emrtd_dump_ef_sod(uint8_t *file_contents, size_t file_length);
+static int emrtd_print_ef_com_info(uint8_t *data, size_t datalen);
+static int emrtd_print_ef_dg1_info(uint8_t *data, size_t datalen);
+static int emrtd_print_ef_dg11_info(uint8_t *data, size_t datalen);
+static int emrtd_print_ef_dg12_info(uint8_t *data, size_t datalen);
+static int emrtd_print_ef_sod_info(uint8_t *data, size_t datalen);
+static emrtd_dg_t dg_table[] = {
+    {0x60, "011E", "EF_COM",          "Header and Data Group Presence Information",         true,  emrtd_print_ef_com_info, NULL, true},
+    {0xff, "011C", "EF_CardAccess",   "PACE SecurityInfos",                                 false, NULL, NULL, true},
+    {0xff, "011D", "EF_CardSecurity", "PACE SecurityInfos for Chip Authentication Mapping", false, NULL, NULL, true},
+    {0x61, "0101", "EF_DG1",          "Details recorded in MRZ",                            true,  emrtd_print_ef_dg1_info, NULL, true},
+    {0x75, "0102", "EF_DG2",          "Encoded Face",                                       true,  NULL, emrtd_dump_ef_dg2, false},
+    // These cases are commented out as they require PACE
+    //{0x63, "0103", "EF_DG3",          "Encoded Finger(s)",                                  false, NULL, false},
+    //{0x76, "0104", "EF_DG4",          "Encoded Eye(s)",                                     false, NULL, false},
+    {0x65, "0105", "EF_DG5",          "Displayed Portrait",                                 false, NULL, emrtd_dump_ef_dg5, false},
+    {0x66, "0106", "EF_DG6",          "Reserved for Future Use",                            false, NULL, NULL, false},
+    {0x67, "0107", "EF_DG7",          "Displayed Signature or Usual Mark",                  false, NULL, emrtd_dump_ef_dg7, false},
+    {0x68, "0108", "EF_DG8",          "Data Feature(s)",                                    false, NULL, NULL, true},
+    {0x69, "0109", "EF_DG9",          "Structure Feature(s)",                               false, NULL, NULL, true},
+    {0x6a, "010A", "EF_DG10",         "Substance Feature(s)",                               false, NULL, NULL, true},
+    {0x6b, "010B", "EF_DG11",         "Additional Personal Detail(s)",                      false, emrtd_print_ef_dg11_info, NULL, true},
+    {0x6c, "010C", "EF_DG12",         "Additional Document Detail(s)",                      false, emrtd_print_ef_dg12_info, NULL, true},
+    {0x6d, "010D", "EF_DG13",         "Optional Detail(s)",                                 false, NULL, NULL, true},
+    {0x6e, "010E", "EF_DG14",         "Security Options",                                   false, NULL, NULL, true},
+    {0x6f, "010F", "EF_DG15",         "Active Authentication Public Key Info",              false, NULL, NULL, true},
+    {0x70, "0110", "EF_DG16",         "Person(s) to Notify",                                false, NULL, NULL, true},
+    {0x77, "011D", "EF_SOD",          "Document Security Object",                           false, emrtd_print_ef_sod_info, emrtd_dump_ef_sod, true},
+    {0x00, NULL, NULL, NULL, false, NULL, NULL, false}
+};
+
 static int CmdHelp(const char *Cmd);
 
 static uint16_t get_sw(uint8_t *d, uint8_t n) {
@@ -608,86 +628,14 @@ static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int datainlen, uint8_t *d
 }
 
 static bool emrtd_file_tag_to_file_id(uint8_t *datain, char *filenameout, char *dataout) {
-    // imagine bothering with a hashmap or writing good code
-    // couldn't be me
-    switch (*datain) {
-        case 0x60:
-            memcpy(dataout, EMRTD_EF_COM, 4);
-            memcpy(filenameout, "EF_COM", 6);
-            break;
-        case 0x61:
-            memcpy(dataout, EMRTD_EF_DG1, 4);
-            memcpy(filenameout, "EF_DG1", 6);
-            break;
-        case 0x75:
-            memcpy(dataout, EMRTD_EF_DG2, 4);
-            memcpy(filenameout, "EF_DG2", 6);
-            break;
-        // These cases are commented out as they require PACE
-        // case 0x63:
-        //     memcpy(dataout, EMRTD_EF_DG3, 4);
-        //     memcpy(filenameout, "EF_DG3", 6);
-        //     break;
-        // case 0x76:
-        //     memcpy(dataout, EMRTD_EF_DG4, 4);
-        //     memcpy(filenameout, "EF_DG4", 6);
-        //     break;
-        case 0x65:
-            memcpy(dataout, EMRTD_EF_DG5, 4);
-            memcpy(filenameout, "EF_DG5", 6);
-            break;
-        case 0x66:
-            memcpy(dataout, EMRTD_EF_DG6, 4);
-            memcpy(filenameout, "EF_DG6", 6);
-            break;
-        case 0x67:
-            memcpy(dataout, EMRTD_EF_DG7, 4);
-            memcpy(filenameout, "EF_DG7", 6);
-            break;
-        case 0x68:
-            memcpy(dataout, EMRTD_EF_DG8, 4);
-            memcpy(filenameout, "EF_DG8", 6);
-            break;
-        case 0x69:
-            memcpy(dataout, EMRTD_EF_DG9, 4);
-            memcpy(filenameout, "EF_DG9", 6);
-            break;
-        case 0x6a:
-            memcpy(dataout, EMRTD_EF_DG10, 4);
-            memcpy(filenameout, "EF_DG10", 7);
-            break;
-        case 0x6b:
-            memcpy(dataout, EMRTD_EF_DG11, 4);
-            memcpy(filenameout, "EF_DG11", 7);
-            break;
-        case 0x6c:
-            memcpy(dataout, EMRTD_EF_DG12, 4);
-            memcpy(filenameout, "EF_DG12", 7);
-            break;
-        case 0x6d:
-            memcpy(dataout, EMRTD_EF_DG13, 4);
-            memcpy(filenameout, "EF_DG13", 7);
-            break;
-        case 0x6e:
-            memcpy(dataout, EMRTD_EF_DG14, 4);
-            memcpy(filenameout, "EF_DG14", 7);
-            break;
-        case 0x6f:
-            memcpy(dataout, EMRTD_EF_DG15, 4);
-            memcpy(filenameout, "EF_DG15", 7);
-            break;
-        case 0x70:
-            memcpy(dataout, EMRTD_EF_DG16, 4);
-            memcpy(filenameout, "EF_DG16", 7);
-            break;
-        case 0x77:
-            memcpy(dataout, EMRTD_EF_SOD, 4);
-            memcpy(filenameout, "EF_SOD", 6);
-            break;
-        default:
-            return false;
+    for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
+        if (dg_table[dgi].tag == *datain) {
+            strcpy(dataout, dg_table[dgi].fileid);
+            strcpy(filenameout, dg_table[dgi].filename);
+            return true;
+        }
     }
-    return true;
+    return false;
 }
 
 static bool emrtd_select_and_read(uint8_t *dataout, int *dataoutlen, const char *file, uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, bool use_secure, bool use_14b) {
@@ -710,7 +658,7 @@ static bool emrtd_select_and_read(uint8_t *dataout, int *dataoutlen, const char
     return true;
 }
 
-static bool emrtd_dump_ef_dg2(uint8_t *file_contents, int file_length) {
+static int emrtd_dump_ef_dg2(uint8_t *file_contents, size_t file_length) {
     int offset, datalen = 0;
 
     // This is a hacky impl that just looks for the image header. I'll improve it eventually.
@@ -728,60 +676,60 @@ static bool emrtd_dump_ef_dg2(uint8_t *file_contents, int file_length) {
 
     // If we didn't get any data, return false.
     if (datalen == 0) {
-        return false;
+        return PM3_ESOFT;
     }
 
     saveFile("EF_DG2", file_contents[offset] == 0xFF ? ".jpg" : ".jp2", file_contents + offset, datalen);
-    return true;
+    return PM3_SUCCESS;
 }
 
-static bool emrtd_dump_ef_dg5(uint8_t *file_contents, int file_length) {
+static int emrtd_dump_ef_dg5(uint8_t *file_contents, size_t file_length) {
     uint8_t data[EMRTD_MAX_FILE_SIZE];
     int datalen = 0;
 
     // If we can't find image in EF_DG5, return false.
     if (emrtd_lds_get_data_by_tag(file_contents, file_length, data, &datalen, 0x5F, 0x40, true) == false) {
-        return false;
+        return PM3_ESOFT;
     }
 
     if (datalen < EMRTD_MAX_FILE_SIZE) {
         saveFile("EF_DG5", data[0] == 0xFF ? ".jpg" : ".jp2", data, datalen);
     } else {
         PrintAndLogEx(ERR, "error (emrtd_dump_ef_dg5) datalen out-of-bounds");
-        return false;
+        return PM3_ESOFT;
     }
-    return true;
+    return PM3_SUCCESS;
 }
 
-static bool emrtd_dump_ef_dg7(uint8_t *file_contents, int file_length) {
+static int emrtd_dump_ef_dg7(uint8_t *file_contents, size_t file_length) {
     uint8_t data[EMRTD_MAX_FILE_SIZE];
     int datalen = 0;
 
     // If we can't find image in EF_DG7, return false.
     if (emrtd_lds_get_data_by_tag(file_contents, file_length, data, &datalen, 0x5F, 0x42, true) == false) {
-        return false;
+        return PM3_ESOFT;
     }
 
     if (datalen < EMRTD_MAX_FILE_SIZE) {
         saveFile("EF_DG7", data[0] == 0xFF ? ".jpg" : ".jp2", data, datalen);
     } else {
         PrintAndLogEx(ERR, "error (emrtd_dump_ef_dg7) datalen out-of-bounds");
-        return false;
+        return PM3_ESOFT;
     }
-    return true;
+    return PM3_SUCCESS;
 }
 
-static bool emrtd_dump_ef_sod(uint8_t *file_contents, int file_length) {
+static int emrtd_dump_ef_sod(uint8_t *file_contents, size_t file_length) {
     int fieldlen = emrtd_get_asn1_field_length(file_contents, file_length, 1);
     int datalen = emrtd_get_asn1_data_length(file_contents, file_length, 1);
     
     if (fieldlen + 1 > EMRTD_MAX_FILE_SIZE) {
         PrintAndLogEx(ERR, "error (emrtd_dump_ef_sod) fieldlen out-of-bounds");
-        return false;
+        return PM3_SUCCESS;
     }
 
     saveFile("EF_SOD", ".p7b", file_contents + fieldlen + 1, datalen);
-    return true;
+    return PM3_ESOFT;
 }
 
 static bool emrtd_dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, const char *file, const char *name, bool use_secure, bool use_14b) {
@@ -796,16 +744,13 @@ static bool emrtd_dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, cons
     PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
     saveFile(name, ".BIN", response, resplen);
 
-    if (strcmp(file, EMRTD_EF_DG2) == 0) {
-        emrtd_dump_ef_dg2(response, resplen);
-    } else if (strcmp(file, EMRTD_EF_DG5) == 0) {
-        emrtd_dump_ef_dg5(response, resplen);
-    } else if (strcmp(file, EMRTD_EF_DG7) == 0) {
-        emrtd_dump_ef_dg7(response, resplen);
-    } else if (strcmp(file, EMRTD_EF_SOD) == 0) {
-        emrtd_dump_ef_sod(response, resplen);
+    for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
+        if (strcmp(dg_table[dgi].fileid, file) == 0) {
+            if (dg_table[dgi].dumper != NULL)
+                dg_table[dgi].dumper(response, resplen);
+            break;
+        }
     }
-
     return true;
 }
 
@@ -1257,7 +1202,36 @@ static void emrtd_print_unknown_timestamp_5f85(uint8_t *data) {
     PrintAndLogEx(HINT, "This is very likely the personalization timestamp, but it is using an undocumented tag.");
 }
 
-static bool emrtd_print_ef_dg1_info(uint8_t *response, int resplen) {
+static int emrtd_print_ef_com_info(uint8_t *data, size_t datalen) {
+    uint8_t filelist[50];
+    int filelistlen = 0;
+    int res = emrtd_lds_get_data_by_tag(data, datalen, filelist, &filelistlen, 0x5c, 0x00, false);
+    if (!res) {
+        PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
+        return PM3_ESOFT;
+    }
+
+    // List files in the file list
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_COM") " --------------------");
+    for (int i = 0; i < filelistlen; i++) {
+        char file_id[5] = { 0x00 };
+        char file_name[8] = { 0x00 };
+        if (emrtd_file_tag_to_file_id(&filelist[i], file_name, file_id) == false) {
+            PrintAndLogEx(DEBUG, "File tag not found, skipping: %02X", filelist[i]);
+            continue;
+        }
+        for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
+            if (strcmp(dg_table[dgi].filename, file_name) == 0) {
+                PrintAndLogEx(SUCCESS, "%-7s...............: " _YELLOW_("%s"), file_name, dg_table[dgi].desc);
+                break;
+            }
+        }
+    }
+    return PM3_SUCCESS;
+}
+
+static int emrtd_print_ef_dg1_info(uint8_t *data, size_t datalen) {
     int td_variant = 0;
 
     PrintAndLogEx(NORMAL, "");
@@ -1268,9 +1242,9 @@ static bool emrtd_print_ef_dg1_info(uint8_t *response, int resplen) {
     char mrz[90] = { 0x00 };
     int mrzlen = 0;
 
-    if (!emrtd_lds_get_data_by_tag(response, resplen, (uint8_t *) mrz, &mrzlen, 0x5f, 0x1f, true)) {
+    if (!emrtd_lds_get_data_by_tag(data, datalen, (uint8_t *) mrz, &mrzlen, 0x5f, 0x1f, true)) {
         PrintAndLogEx(ERR, "Failed to read MRZ from EF_DG1.");
-        return false;
+        return PM3_ESOFT;
     }
 
     // Determine and print the document type
@@ -1338,10 +1312,10 @@ static bool emrtd_print_ef_dg1_info(uint8_t *response, int resplen) {
         }
     }
 
-    return true;
+    return PM3_SUCCESS;
 }
 
-static bool emrtd_print_ef_dg11_info(uint8_t *response, int resplen) {
+static int emrtd_print_ef_dg11_info(uint8_t *data, size_t datalen) {
     uint8_t taglist[100] = { 0x00 };
     int taglistlen = 0;
     uint8_t tagdata[1000] = { 0x00 };
@@ -1350,13 +1324,13 @@ static bool emrtd_print_ef_dg11_info(uint8_t *response, int resplen) {
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_DG11") " -------------------");
 
-    if (!emrtd_lds_get_data_by_tag(response, resplen, taglist, &taglistlen, 0x5c, 0x00, false)) {
+    if (!emrtd_lds_get_data_by_tag(data, datalen, taglist, &taglistlen, 0x5c, 0x00, false)) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_DG11.");
-        return false;
+        return PM3_ESOFT;
     }
 
     for (int i = 0; i < taglistlen; i++) {
-        emrtd_lds_get_data_by_tag(response, resplen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f);
+        emrtd_lds_get_data_by_tag(data, datalen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f);
         // Don't bother with empty tags
         if (tagdatalen == 0) {
             continue;
@@ -1417,10 +1391,10 @@ static bool emrtd_print_ef_dg11_info(uint8_t *response, int resplen) {
             PrintAndLogEx(SUCCESS, "Unknown Field %02X......: %s", taglist[i], sprint_hex_inrow(tagdata, tagdatalen));
         }
     }
-    return true;
+    return PM3_SUCCESS;
 }
 
-static bool emrtd_print_ef_dg12_info(uint8_t *response, int resplen) {
+static int emrtd_print_ef_dg12_info(uint8_t *data, size_t datalen) {
     uint8_t taglist[100] = { 0x00 };
     int taglistlen = 0;
     uint8_t tagdata[1000] = { 0x00 };
@@ -1429,13 +1403,13 @@ static bool emrtd_print_ef_dg12_info(uint8_t *response, int resplen) {
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_DG12") " -------------------");
 
-    if (!emrtd_lds_get_data_by_tag(response, resplen, taglist, &taglistlen, 0x5c, 0x00, false)) {
+    if (!emrtd_lds_get_data_by_tag(data, datalen, taglist, &taglistlen, 0x5c, 0x00, false)) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_DG12.");
-        return false;
+        return PM3_ESOFT;
     }
 
     for (int i = 0; i < taglistlen; i++) {
-        emrtd_lds_get_data_by_tag(response, resplen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f);
+        emrtd_lds_get_data_by_tag(data, datalen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f);
         // Don't bother with empty tags
         if (tagdatalen == 0) {
             continue;
@@ -1483,7 +1457,14 @@ static bool emrtd_print_ef_dg12_info(uint8_t *response, int resplen) {
             PrintAndLogEx(SUCCESS, "Unknown Field %02X......: %s", taglist[i], sprint_hex_inrow(tagdata, tagdatalen));
         }
     }
-    return true;
+    return PM3_SUCCESS;
+}
+
+static int emrtd_print_ef_sod_info(uint8_t *data, size_t datalen) {
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_SOD") " --------------------");
+    PrintAndLogEx(WARNING, "TODO");
+    return PM3_SUCCESS;
 }
 
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available) {
@@ -1521,6 +1502,12 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         return PM3_ESOFT;
     }
 
+    int res = emrtd_print_ef_com_info(response, resplen);
+    if ( res != PM3_SUCCESS) {
+        DropField();
+        return res;
+    }
+
     uint8_t filelist[50];
     int filelistlen = 0;
 
@@ -1539,14 +1526,20 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
             continue;
         }
 
-        if (strcmp(file_name, "EF_DG1") == 0 && emrtd_select_and_read(response, &resplen, EMRTD_EF_DG1, ks_enc, ks_mac, ssc, BAC, use_14b)) {
-            emrtd_print_ef_dg1_info(response, resplen);
-        } else if (strcmp(file_name, "EF_DG11") == 0 && emrtd_select_and_read(response, &resplen, EMRTD_EF_DG11, ks_enc, ks_mac, ssc, BAC, use_14b)) {
-            emrtd_print_ef_dg11_info(response, resplen);
-        } else if (strcmp(file_name, "EF_DG12") == 0 && emrtd_select_and_read(response, &resplen, EMRTD_EF_DG12, ks_enc, ks_mac, ssc, BAC, use_14b)) {
-            emrtd_print_ef_dg12_info(response, resplen);
+        for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
+            if ((strcmp(dg_table[dgi].filename, file_name) == 0) && dg_table[dgi].fastdump) {
+                if (emrtd_select_and_read(response, &resplen, dg_table[dgi].fileid, ks_enc, ks_mac, ssc, BAC, use_14b)) {
+                    if (dg_table[dgi].parser != NULL)
+                        dg_table[dgi].parser(response, resplen);
+                }
+                break;
+            }
         }
     }
+// TODO
+    if (emrtd_select_and_read(response, &resplen, EMRTD_EF_SOD, ks_enc, ks_mac, ssc, BAC, use_14b)) {
+        emrtd_print_ef_sod_info(response, resplen);
+    }
 
     DropField();
     return PM3_SUCCESS;
@@ -1562,55 +1555,65 @@ int infoHF_EMRTD_offline(const char *path) {
     strncat(filepath, PATHSEP, 1);
     strcat(filepath, "EF_COM");
 
-    if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, true) != PM3_SUCCESS) {
+    if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, false) != PM3_SUCCESS) {
         PrintAndLogEx(ERR, "Failed to read EF_COM.");
         free(filepath);
         return PM3_ESOFT;
     }
+
+    int res = emrtd_print_ef_com_info(data, datalen);
+    if ( res != PM3_SUCCESS) {
+        free(data);
+        free(filepath);
+        return res;
+    }
+
     uint8_t filelist[50];
     int filelistlen = 0;
-    int res = emrtd_lds_get_data_by_tag(data, datalen, filelist, &filelistlen, 0x5c, 0x00, false);
-    free(data);
+    res = emrtd_lds_get_data_by_tag(data, datalen, filelist, &filelistlen, 0x5c, 0x00, false);
     if (!res) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
+        free(data);
         free(filepath);
         return PM3_ESOFT;
     }
-
+    free(data);
     // Read files in the file list
     for (int i = 0; i < filelistlen; i++) {
         char file_id[5] = { 0x00 };
         char file_name[8] = { 0x00 };
         if (emrtd_file_tag_to_file_id(&filelist[i], file_name, file_id) == false) {
-            PrintAndLogEx(DEBUG, "File tag not found, skipping: %02X", filelist[i]);
+            //PrintAndLogEx(DEBUG, "File tag not found, skipping: %02X", filelist[i]);
             continue;
         }
-        if (strcmp(file_name, "EF_DG1") == 0) {
-            strcpy(filepath, path);
-            strncat(filepath, PATHSEP, 1);
-            strcat(filepath, "EF_DG1");
-            if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, true) == PM3_SUCCESS) {
-                emrtd_print_ef_dg1_info(data, datalen);
-                free(data);
-            }
-        } else if (strcmp(file_name, "EF_DG11") == 0) {
-            strcpy(filepath, path);
-            strncat(filepath, PATHSEP, 1);
-            strcat(filepath, "EF_DG11");
-            if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, true) == PM3_SUCCESS) {
-                emrtd_print_ef_dg11_info(data, datalen);
-                free(data);
-            }
-        } else if (strcmp(file_name, "EF_DG12") == 0) {
-            strcpy(filepath, path);
-            strncat(filepath, PATHSEP, 1);
-            strcat(filepath, "EF_DG12");
-            if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, true) == PM3_SUCCESS) {
-                emrtd_print_ef_dg12_info(data, datalen);
-                free(data);
+
+        for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
+            if (strcmp(dg_table[dgi].filename, file_name) == 0) {
+                strcpy(filepath, path);
+                strncat(filepath, PATHSEP, 1);
+                strcat(filepath, dg_table[dgi].filename);
+                if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, false) == PM3_SUCCESS)
+                {
+                    // we won't halt on parsing errors
+                    if (dg_table[dgi].parser != NULL)
+                        dg_table[dgi].parser(data, datalen);
+                    free(data);
+                }
+                break;
             }
         }
     }
+// TODO
+    strcpy(filepath, path);
+    strncat(filepath, PATHSEP, 1);
+    strcat(filepath, "EF_SOD");
+    if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, false) == PM3_SUCCESS)
+    {
+        // we won't halt on parsing errors
+        emrtd_print_ef_sod_info(data, datalen);
+        free(data);
+    }
+
     free(filepath);
     return PM3_SUCCESS;
 }
diff --git a/client/src/cmdhfemrtd.h b/client/src/cmdhfemrtd.h
index 3cfcd3cbd..aa1c4e1e1 100644
--- a/client/src/cmdhfemrtd.h
+++ b/client/src/cmdhfemrtd.h
@@ -13,6 +13,17 @@
 
 #include "common.h"
 
+typedef struct emrtd_dg_s {
+    uint8_t tag;
+    const char *fileid;
+    const char *filename;
+    const char *desc;
+    bool required;
+    int (*parser)(uint8_t *data, size_t datalen);
+    int (*dumper)(uint8_t *data, size_t datalen);
+    bool fastdump;
+} emrtd_dg_t;
+
 int CmdHFeMRTD(const char *Cmd);
 
 int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available);

From 019f4a7e94698db45860601b75d54be40b7bf07a Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Sat, 19 Dec 2020 17:12:08 +0100
Subject: [PATCH 147/682] emrtd table: pace flag

---
 client/src/cmdhfemrtd.c | 57 ++++++++++++++++++++++-------------------
 client/src/cmdhfemrtd.h |  5 ++--
 2 files changed, 34 insertions(+), 28 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 241a4750b..33a6e0f8f 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -67,28 +67,28 @@ static int emrtd_print_ef_dg11_info(uint8_t *data, size_t datalen);
 static int emrtd_print_ef_dg12_info(uint8_t *data, size_t datalen);
 static int emrtd_print_ef_sod_info(uint8_t *data, size_t datalen);
 static emrtd_dg_t dg_table[] = {
-    {0x60, "011E", "EF_COM",          "Header and Data Group Presence Information",         true,  emrtd_print_ef_com_info, NULL, true},
-    {0xff, "011C", "EF_CardAccess",   "PACE SecurityInfos",                                 false, NULL, NULL, true},
-    {0xff, "011D", "EF_CardSecurity", "PACE SecurityInfos for Chip Authentication Mapping", false, NULL, NULL, true},
-    {0x61, "0101", "EF_DG1",          "Details recorded in MRZ",                            true,  emrtd_print_ef_dg1_info, NULL, true},
-    {0x75, "0102", "EF_DG2",          "Encoded Face",                                       true,  NULL, emrtd_dump_ef_dg2, false},
-    // These cases are commented out as they require PACE
-    //{0x63, "0103", "EF_DG3",          "Encoded Finger(s)",                                  false, NULL, false},
-    //{0x76, "0104", "EF_DG4",          "Encoded Eye(s)",                                     false, NULL, false},
-    {0x65, "0105", "EF_DG5",          "Displayed Portrait",                                 false, NULL, emrtd_dump_ef_dg5, false},
-    {0x66, "0106", "EF_DG6",          "Reserved for Future Use",                            false, NULL, NULL, false},
-    {0x67, "0107", "EF_DG7",          "Displayed Signature or Usual Mark",                  false, NULL, emrtd_dump_ef_dg7, false},
-    {0x68, "0108", "EF_DG8",          "Data Feature(s)",                                    false, NULL, NULL, true},
-    {0x69, "0109", "EF_DG9",          "Structure Feature(s)",                               false, NULL, NULL, true},
-    {0x6a, "010A", "EF_DG10",         "Substance Feature(s)",                               false, NULL, NULL, true},
-    {0x6b, "010B", "EF_DG11",         "Additional Personal Detail(s)",                      false, emrtd_print_ef_dg11_info, NULL, true},
-    {0x6c, "010C", "EF_DG12",         "Additional Document Detail(s)",                      false, emrtd_print_ef_dg12_info, NULL, true},
-    {0x6d, "010D", "EF_DG13",         "Optional Detail(s)",                                 false, NULL, NULL, true},
-    {0x6e, "010E", "EF_DG14",         "Security Options",                                   false, NULL, NULL, true},
-    {0x6f, "010F", "EF_DG15",         "Active Authentication Public Key Info",              false, NULL, NULL, true},
-    {0x70, "0110", "EF_DG16",         "Person(s) to Notify",                                false, NULL, NULL, true},
-    {0x77, "011D", "EF_SOD",          "Document Security Object",                           false, emrtd_print_ef_sod_info, emrtd_dump_ef_sod, true},
-    {0x00, NULL, NULL, NULL, false, NULL, NULL, false}
+//  tag     fileid  filename           desc                                                 pace   req    fast   parser                    dumper
+    {0x60, "011E", "EF_COM",          "Header and Data Group Presence Information",         false, true,  true,  emrtd_print_ef_com_info,  NULL},
+    {0xff, "011C", "EF_CardAccess",   "PACE SecurityInfos",                                 true,  true,  true,  NULL,                     NULL},
+    {0xff, "011D", "EF_CardSecurity", "PACE SecurityInfos for Chip Authentication Mapping", true,  false, true,  NULL,                     NULL},
+    {0x61, "0101", "EF_DG1",          "Details recorded in MRZ",                            false, true,  true,  emrtd_print_ef_dg1_info,  NULL},
+    {0x75, "0102", "EF_DG2",          "Encoded Face",                                       false, true,  false, NULL,                     emrtd_dump_ef_dg2},
+    {0x63, "0103", "EF_DG3",          "Encoded Finger(s)",                                  true,  false, false, NULL,                     NULL},
+    {0x76, "0104", "EF_DG4",          "Encoded Eye(s)",                                     true,  false, false, NULL,                     NULL},
+    {0x65, "0105", "EF_DG5",          "Displayed Portrait",                                 false, false, false, NULL,                     emrtd_dump_ef_dg5},
+    {0x66, "0106", "EF_DG6",          "Reserved for Future Use",                            false, false, false, NULL,                     NULL},
+    {0x67, "0107", "EF_DG7",          "Displayed Signature or Usual Mark",                  false, false, false, NULL,                     emrtd_dump_ef_dg7},
+    {0x68, "0108", "EF_DG8",          "Data Feature(s)",                                    false, false, true,  NULL,                     NULL},
+    {0x69, "0109", "EF_DG9",          "Structure Feature(s)",                               false, false, true,  NULL,                     NULL},
+    {0x6a, "010A", "EF_DG10",         "Substance Feature(s)",                               false, false, true,  NULL,                     NULL},
+    {0x6b, "010B", "EF_DG11",         "Additional Personal Detail(s)",                      false, false, true,  emrtd_print_ef_dg11_info, NULL},
+    {0x6c, "010C", "EF_DG12",         "Additional Document Detail(s)",                      false, false, true,  emrtd_print_ef_dg12_info, NULL},
+    {0x6d, "010D", "EF_DG13",         "Optional Detail(s)",                                 false, false, true,  NULL,                     NULL},
+    {0x6e, "010E", "EF_DG14",         "Security Options",                                   false, false, true,  NULL,                     NULL},
+    {0x6f, "010F", "EF_DG15",         "Active Authentication Public Key Info",              false, false, true,  NULL,                     NULL},
+    {0x70, "0110", "EF_DG16",         "Person(s) to Notify",                                false, false, true,  NULL,                     NULL},
+    {0x77, "011D", "EF_SOD",          "Document Security Object",                           false, false, true,  emrtd_print_ef_sod_info,  emrtd_dump_ef_sod},
+    {0x00, NULL, NULL, NULL, false, false, false, NULL, NULL}
 };
 
 static int CmdHelp(const char *Cmd);
@@ -994,7 +994,13 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
             continue;
         }
         PrintAndLogEx(DEBUG, "Current file: %s", file_name);
-        emrtd_dump_file(ks_enc, ks_mac, ssc, file_id, file_name, BAC, use_14b);
+
+        for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
+            if ((strcmp(dg_table[dgi].filename, file_name) == 0) && !dg_table[dgi].pace) {
+                emrtd_dump_file(ks_enc, ks_mac, ssc, file_id, file_name, BAC, use_14b);
+                break;
+            }
+        }
     }
 
     // Dump EF_SOD
@@ -1525,9 +1531,8 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
             PrintAndLogEx(DEBUG, "File tag not found, skipping: %02X", filelist[i]);
             continue;
         }
-
         for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
-            if ((strcmp(dg_table[dgi].filename, file_name) == 0) && dg_table[dgi].fastdump) {
+            if ((strcmp(dg_table[dgi].filename, file_name) == 0) && dg_table[dgi].fastdump && !dg_table[dgi].pace) {
                 if (emrtd_select_and_read(response, &resplen, dg_table[dgi].fileid, ks_enc, ks_mac, ssc, BAC, use_14b)) {
                     if (dg_table[dgi].parser != NULL)
                         dg_table[dgi].parser(response, resplen);
@@ -1588,7 +1593,7 @@ int infoHF_EMRTD_offline(const char *path) {
         }
 
         for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
-            if (strcmp(dg_table[dgi].filename, file_name) == 0) {
+            if ((strcmp(dg_table[dgi].filename, file_name) == 0) && (!dg_table[dgi].pace)) {
                 strcpy(filepath, path);
                 strncat(filepath, PATHSEP, 1);
                 strcat(filepath, dg_table[dgi].filename);
diff --git a/client/src/cmdhfemrtd.h b/client/src/cmdhfemrtd.h
index aa1c4e1e1..9df7846ad 100644
--- a/client/src/cmdhfemrtd.h
+++ b/client/src/cmdhfemrtd.h
@@ -18,10 +18,11 @@ typedef struct emrtd_dg_s {
     const char *fileid;
     const char *filename;
     const char *desc;
-    bool required;
+    bool pace;
+    bool required; // some are required only if PACE
+    bool fastdump; // fast to dump
     int (*parser)(uint8_t *data, size_t datalen);
     int (*dumper)(uint8_t *data, size_t datalen);
-    bool fastdump;
 } emrtd_dg_t;
 
 int CmdHFeMRTD(const char *Cmd);

From 34cc523546207f08cae7c744083c6fddeb787d1d Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Sat, 19 Dec 2020 17:37:28 +0100
Subject: [PATCH 148/682] emrtd: add helper fcts to search the table

---
 client/src/cmdhfemrtd.c | 116 +++++++++++++++++-----------------------
 1 file changed, 49 insertions(+), 67 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 33a6e0f8f..4475cfa3a 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -91,6 +91,23 @@ static emrtd_dg_t dg_table[] = {
     {0x00, NULL, NULL, NULL, false, false, false, NULL, NULL}
 };
 
+static emrtd_dg_t *emrtd_tag_to_dg(uint8_t tag) {
+    for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
+        if (dg_table[dgi].tag == tag) {
+            return &dg_table[dgi];
+        }
+    }
+    return NULL;
+}
+static emrtd_dg_t *emrtd_fileid_to_dg(const char *file_id) {
+    for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
+        if (strcmp(dg_table[dgi].fileid, file_id) == 0) {
+            return &dg_table[dgi];
+        }
+    }
+    return NULL;
+}
+
 static int CmdHelp(const char *Cmd);
 
 static uint16_t get_sw(uint8_t *d, uint8_t n) {
@@ -627,17 +644,6 @@ static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int datainlen, uint8_t *d
     return false;
 }
 
-static bool emrtd_file_tag_to_file_id(uint8_t *datain, char *filenameout, char *dataout) {
-    for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
-        if (dg_table[dgi].tag == *datain) {
-            strcpy(dataout, dg_table[dgi].fileid);
-            strcpy(filenameout, dg_table[dgi].filename);
-            return true;
-        }
-    }
-    return false;
-}
-
 static bool emrtd_select_and_read(uint8_t *dataout, int *dataoutlen, const char *file, uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, bool use_secure, bool use_14b) {
     if (use_secure) {
         if (emrtd_secure_select_file(ks_enc, ks_mac, ssc, EMRTD_P1_SELECT_BY_EF, file, use_14b) == false) {
@@ -743,13 +749,9 @@ static bool emrtd_dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, cons
     PrintAndLogEx(INFO, "Read %s, len: %i.", name, resplen);
     PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
     saveFile(name, ".BIN", response, resplen);
-
-    for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
-        if (strcmp(dg_table[dgi].fileid, file) == 0) {
-            if (dg_table[dgi].dumper != NULL)
-                dg_table[dgi].dumper(response, resplen);
-            break;
-        }
+    emrtd_dg_t * dg = emrtd_fileid_to_dg(file);
+    if ((dg != NULL) && (dg->dumper != NULL)) {
+        dg->dumper(response, resplen);
     }
     return true;
 }
@@ -987,19 +989,14 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
 
     // Dump all files in the file list
     for (int i = 0; i < filelistlen; i++) {
-        char file_id[5] = { 0x00 };
-        char file_name[8] = { 0x00 };
-        if (emrtd_file_tag_to_file_id(&filelist[i], file_name, file_id) == false) {
+        emrtd_dg_t * dg = emrtd_tag_to_dg(filelist[i]);
+        if (dg == NULL) {
             PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
             continue;
         }
-        PrintAndLogEx(DEBUG, "Current file: %s", file_name);
-
-        for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
-            if ((strcmp(dg_table[dgi].filename, file_name) == 0) && !dg_table[dgi].pace) {
-                emrtd_dump_file(ks_enc, ks_mac, ssc, file_id, file_name, BAC, use_14b);
-                break;
-            }
+        PrintAndLogEx(DEBUG, "Current file: %s", dg->filename);
+        if (!dg->pace) {
+            emrtd_dump_file(ks_enc, ks_mac, ssc, dg->fileid, dg->filename, BAC, use_14b);
         }
     }
 
@@ -1221,18 +1218,12 @@ static int emrtd_print_ef_com_info(uint8_t *data, size_t datalen) {
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_COM") " --------------------");
     for (int i = 0; i < filelistlen; i++) {
-        char file_id[5] = { 0x00 };
-        char file_name[8] = { 0x00 };
-        if (emrtd_file_tag_to_file_id(&filelist[i], file_name, file_id) == false) {
-            PrintAndLogEx(DEBUG, "File tag not found, skipping: %02X", filelist[i]);
+        emrtd_dg_t * dg = emrtd_tag_to_dg(filelist[i]);
+        if (dg == NULL) {
+            PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
             continue;
         }
-        for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
-            if (strcmp(dg_table[dgi].filename, file_name) == 0) {
-                PrintAndLogEx(SUCCESS, "%-7s...............: " _YELLOW_("%s"), file_name, dg_table[dgi].desc);
-                break;
-            }
-        }
+        PrintAndLogEx(SUCCESS, "%-7s...............: " _YELLOW_("%s"), dg->filename, dg->desc);
     }
     return PM3_SUCCESS;
 }
@@ -1525,19 +1516,15 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
 
     // Dump all files in the file list
     for (int i = 0; i < filelistlen; i++) {
-        char file_id[5] = { 0x00 };
-        char file_name[8] = { 0x00 };
-        if (emrtd_file_tag_to_file_id(&filelist[i], file_name, file_id) == false) {
-            PrintAndLogEx(DEBUG, "File tag not found, skipping: %02X", filelist[i]);
+        emrtd_dg_t * dg = emrtd_tag_to_dg(filelist[i]);
+        if (dg == NULL) {
+            PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
             continue;
         }
-        for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
-            if ((strcmp(dg_table[dgi].filename, file_name) == 0) && dg_table[dgi].fastdump && !dg_table[dgi].pace) {
-                if (emrtd_select_and_read(response, &resplen, dg_table[dgi].fileid, ks_enc, ks_mac, ssc, BAC, use_14b)) {
-                    if (dg_table[dgi].parser != NULL)
-                        dg_table[dgi].parser(response, resplen);
-                }
-                break;
+        if (dg->fastdump && !dg->pace) {
+            if (emrtd_select_and_read(response, &resplen, dg->fileid, ks_enc, ks_mac, ssc, BAC, use_14b)) {
+                if (dg->parser != NULL)
+                    dg->parser(response, resplen);
             }
         }
     }
@@ -1585,26 +1572,21 @@ int infoHF_EMRTD_offline(const char *path) {
     free(data);
     // Read files in the file list
     for (int i = 0; i < filelistlen; i++) {
-        char file_id[5] = { 0x00 };
-        char file_name[8] = { 0x00 };
-        if (emrtd_file_tag_to_file_id(&filelist[i], file_name, file_id) == false) {
-            //PrintAndLogEx(DEBUG, "File tag not found, skipping: %02X", filelist[i]);
+        emrtd_dg_t * dg = emrtd_tag_to_dg(filelist[i]);
+        if (dg == NULL) {
+            PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
             continue;
         }
-
-        for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
-            if ((strcmp(dg_table[dgi].filename, file_name) == 0) && (!dg_table[dgi].pace)) {
-                strcpy(filepath, path);
-                strncat(filepath, PATHSEP, 1);
-                strcat(filepath, dg_table[dgi].filename);
-                if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, false) == PM3_SUCCESS)
-                {
-                    // we won't halt on parsing errors
-                    if (dg_table[dgi].parser != NULL)
-                        dg_table[dgi].parser(data, datalen);
-                    free(data);
-                }
-                break;
+        if (!dg->pace) {
+            strcpy(filepath, path);
+            strncat(filepath, PATHSEP, 1);
+            strcat(filepath, dg->filename);
+            if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, false) == PM3_SUCCESS)
+            {
+                // we won't halt on parsing errors
+                if (dg->parser != NULL)
+                    dg->parser(data, datalen);
+                free(data);
             }
         }
     }

From e16249252e5c64e864d9c2bbc307266b2deb434e Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Sat, 19 Dec 2020 17:58:22 +0100
Subject: [PATCH 149/682] emrtd: remove last defs and integrate SOD in com
 lists

---
 client/src/cmdhfemrtd.c | 77 +++++++++++++++++++++--------------------
 1 file changed, 39 insertions(+), 38 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 4475cfa3a..eb399f3cc 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -43,13 +43,6 @@
 #define EMRTD_P1_SELECT_BY_NAME "04"
 #define EMRTD_P2_PROPRIETARY "0C"
 
-// File IDs
-// TODO -> dg_table
-#define EMRTD_EF_CARDACCESS "011C"
-#define EMRTD_EF_SOD "011D"
-#define EMRTD_EF_COM "011E"
-#define EMRTD_EF_DG1 "0101"
-
 // App IDs
 #define EMRTD_AID_MRTD "A0000002471001"
 
@@ -66,11 +59,33 @@ static int emrtd_print_ef_dg1_info(uint8_t *data, size_t datalen);
 static int emrtd_print_ef_dg11_info(uint8_t *data, size_t datalen);
 static int emrtd_print_ef_dg12_info(uint8_t *data, size_t datalen);
 static int emrtd_print_ef_sod_info(uint8_t *data, size_t datalen);
+
+typedef enum  { // list must match dg_table
+    EF_COM=0,
+    EF_DG1,
+    EF_DG2,
+    EF_DG3,
+    EF_DG4,
+    EF_DG5,
+    EF_DG6,
+    EF_DG7,
+    EF_DG8,
+    EF_DG9,
+    EF_DG10,
+    EF_DG11,
+    EF_DG12,
+    EF_DG13,
+    EF_DG14,
+    EF_DG15,
+    EF_DG16,
+    EF_SOD,
+    EF_CardAccess,
+    EF_CardSecurity,
+} emrtd_dg_enum;
+
 static emrtd_dg_t dg_table[] = {
 //  tag     fileid  filename           desc                                                 pace   req    fast   parser                    dumper
     {0x60, "011E", "EF_COM",          "Header and Data Group Presence Information",         false, true,  true,  emrtd_print_ef_com_info,  NULL},
-    {0xff, "011C", "EF_CardAccess",   "PACE SecurityInfos",                                 true,  true,  true,  NULL,                     NULL},
-    {0xff, "011D", "EF_CardSecurity", "PACE SecurityInfos for Chip Authentication Mapping", true,  false, true,  NULL,                     NULL},
     {0x61, "0101", "EF_DG1",          "Details recorded in MRZ",                            false, true,  true,  emrtd_print_ef_dg1_info,  NULL},
     {0x75, "0102", "EF_DG2",          "Encoded Face",                                       false, true,  false, NULL,                     emrtd_dump_ef_dg2},
     {0x63, "0103", "EF_DG3",          "Encoded Finger(s)",                                  true,  false, false, NULL,                     NULL},
@@ -88,6 +103,8 @@ static emrtd_dg_t dg_table[] = {
     {0x6f, "010F", "EF_DG15",         "Active Authentication Public Key Info",              false, false, true,  NULL,                     NULL},
     {0x70, "0110", "EF_DG16",         "Person(s) to Notify",                                false, false, true,  NULL,                     NULL},
     {0x77, "011D", "EF_SOD",          "Document Security Object",                           false, false, true,  emrtd_print_ef_sod_info,  emrtd_dump_ef_sod},
+    {0xff, "011C", "EF_CardAccess",   "PACE SecurityInfos",                                 true,  true,  true,  NULL,                     NULL},
+    {0xff, "011D", "EF_CardSecurity", "PACE SecurityInfos for Chip Authentication Mapping", true,  false, true,  NULL,                     NULL},
     {0x00, NULL, NULL, NULL, false, false, false, NULL, NULL}
 };
 
@@ -905,13 +922,13 @@ static bool emrtd_do_auth(char *documentnumber, char *dob, char *expiry, bool BA
     }
 
     // Select EF_COM
-    if (emrtd_select_file(EMRTD_P1_SELECT_BY_EF, EMRTD_EF_COM, *use_14b) == false) {
+    if (emrtd_select_file(EMRTD_P1_SELECT_BY_EF, dg_table[EF_COM].fileid, *use_14b) == false) {
         *BAC = true;
         PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt external authentication.");
     } else {
         *BAC = false;
         // Select EF_DG1
-        emrtd_select_file(EMRTD_P1_SELECT_BY_EF, EMRTD_EF_DG1, *use_14b);
+        emrtd_select_file(EMRTD_P1_SELECT_BY_EF, dg_table[EF_DG1].fileid, *use_14b);
 
         if (emrtd_read_file(response, &resplen, NULL, NULL, NULL, false, *use_14b) == false) {
             *BAC = true;
@@ -955,7 +972,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     }
 
     // Dump EF_CardAccess (if available)
-    if (!emrtd_dump_file(ks_enc, ks_mac, ssc, EMRTD_EF_CARDACCESS, "EF_CardAccess", BAC, use_14b)) {
+    if (!emrtd_dump_file(ks_enc, ks_mac, ssc, dg_table[EF_CardAccess].fileid, dg_table[EF_CardAccess].filename, BAC, use_14b)) {
         PrintAndLogEx(INFO, "Couldn't dump EF_CardAccess, card does not support PACE.");
         PrintAndLogEx(HINT, "This is expected behavior for cards without PACE, and isn't something to be worried about.");
     }
@@ -967,14 +984,14 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     }
 
     // Select EF_COM
-    if (!emrtd_select_and_read(response, &resplen, EMRTD_EF_COM, ks_enc, ks_mac, ssc, BAC, use_14b)) {
+    if (!emrtd_select_and_read(response, &resplen, dg_table[EF_COM].fileid, ks_enc, ks_mac, ssc, BAC, use_14b)) {
         PrintAndLogEx(ERR, "Failed to read EF_COM.");
         DropField();
         return PM3_ESOFT;
     }
     PrintAndLogEx(INFO, "Read EF_COM, len: %i.", resplen);
     PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
-    saveFile("EF_COM", ".BIN", response, resplen);
+    saveFile(dg_table[EF_COM].filename, ".BIN", response, resplen);
 
     uint8_t filelist[50];
     int filelistlen = 0;
@@ -986,7 +1003,8 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     }
 
     PrintAndLogEx(DEBUG, "File List: %s", sprint_hex_inrow(filelist, filelistlen));
-
+    // Add EF_SOD to the list
+    filelist[filelistlen++] = 0x77;
     // Dump all files in the file list
     for (int i = 0; i < filelistlen; i++) {
         emrtd_dg_t * dg = emrtd_tag_to_dg(filelist[i]);
@@ -999,10 +1017,6 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
             emrtd_dump_file(ks_enc, ks_mac, ssc, dg->fileid, dg->filename, BAC, use_14b);
         }
     }
-
-    // Dump EF_SOD
-    emrtd_dump_file(ks_enc, ks_mac, ssc, EMRTD_EF_SOD, "EF_SOD", BAC, use_14b);
-
     DropField();
     return PM3_SUCCESS;
 }
@@ -1493,7 +1507,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         return PM3_ESOFT;
     }
 
-    if (!emrtd_select_and_read(response, &resplen, EMRTD_EF_COM, ks_enc, ks_mac, ssc, BAC, use_14b)) {
+    if (!emrtd_select_and_read(response, &resplen, dg_table[EF_COM].fileid, ks_enc, ks_mac, ssc, BAC, use_14b)) {
         PrintAndLogEx(ERR, "Failed to read EF_COM.");
         DropField();
         return PM3_ESOFT;
@@ -1513,7 +1527,8 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         DropField();
         return PM3_ESOFT;
     }
-
+    // Add EF_SOD to the list
+    filelist[filelistlen++] = 0x77;
     // Dump all files in the file list
     for (int i = 0; i < filelistlen; i++) {
         emrtd_dg_t * dg = emrtd_tag_to_dg(filelist[i]);
@@ -1528,11 +1543,6 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
             }
         }
     }
-// TODO
-    if (emrtd_select_and_read(response, &resplen, EMRTD_EF_SOD, ks_enc, ks_mac, ssc, BAC, use_14b)) {
-        emrtd_print_ef_sod_info(response, resplen);
-    }
-
     DropField();
     return PM3_SUCCESS;
 }
@@ -1545,7 +1555,7 @@ int infoHF_EMRTD_offline(const char *path) {
         return PM3_EMALLOC;
     strcpy(filepath, path);
     strncat(filepath, PATHSEP, 1);
-    strcat(filepath, "EF_COM");
+    strcat(filepath, dg_table[EF_COM].filename);
 
     if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, false) != PM3_SUCCESS) {
         PrintAndLogEx(ERR, "Failed to read EF_COM.");
@@ -1570,6 +1580,8 @@ int infoHF_EMRTD_offline(const char *path) {
         return PM3_ESOFT;
     }
     free(data);
+    // Add EF_SOD to the list
+    filelist[filelistlen++] = 0x77;
     // Read files in the file list
     for (int i = 0; i < filelistlen; i++) {
         emrtd_dg_t * dg = emrtd_tag_to_dg(filelist[i]);
@@ -1590,17 +1602,6 @@ int infoHF_EMRTD_offline(const char *path) {
             }
         }
     }
-// TODO
-    strcpy(filepath, path);
-    strncat(filepath, PATHSEP, 1);
-    strcat(filepath, "EF_SOD");
-    if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, false) == PM3_SUCCESS)
-    {
-        // we won't halt on parsing errors
-        emrtd_print_ef_sod_info(data, datalen);
-        free(data);
-    }
-
     free(filepath);
     return PM3_SUCCESS;
 }

From 97eaab27a189afe4ee901ca4f78c9e7a886c213d Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Sat, 19 Dec 2020 18:01:19 +0100
Subject: [PATCH 150/682] emrtd: remove few hardcoded filenames

---
 client/src/cmdhfemrtd.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index eb399f3cc..7a46c6850 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -702,7 +702,7 @@ static int emrtd_dump_ef_dg2(uint8_t *file_contents, size_t file_length) {
         return PM3_ESOFT;
     }
 
-    saveFile("EF_DG2", file_contents[offset] == 0xFF ? ".jpg" : ".jp2", file_contents + offset, datalen);
+    saveFile(dg_table[EF_DG2].filename, file_contents[offset] == 0xFF ? ".jpg" : ".jp2", file_contents + offset, datalen);
     return PM3_SUCCESS;
 }
 
@@ -716,7 +716,7 @@ static int emrtd_dump_ef_dg5(uint8_t *file_contents, size_t file_length) {
     }
 
     if (datalen < EMRTD_MAX_FILE_SIZE) {
-        saveFile("EF_DG5", data[0] == 0xFF ? ".jpg" : ".jp2", data, datalen);
+        saveFile(dg_table[EF_DG5].filename, data[0] == 0xFF ? ".jpg" : ".jp2", data, datalen);
     } else {
         PrintAndLogEx(ERR, "error (emrtd_dump_ef_dg5) datalen out-of-bounds");
         return PM3_ESOFT;
@@ -734,7 +734,7 @@ static int emrtd_dump_ef_dg7(uint8_t *file_contents, size_t file_length) {
     }
 
     if (datalen < EMRTD_MAX_FILE_SIZE) {
-        saveFile("EF_DG7", data[0] == 0xFF ? ".jpg" : ".jp2", data, datalen);
+        saveFile(dg_table[EF_DG7].filename, data[0] == 0xFF ? ".jpg" : ".jp2", data, datalen);
     } else {
         PrintAndLogEx(ERR, "error (emrtd_dump_ef_dg7) datalen out-of-bounds");
         return PM3_ESOFT;
@@ -751,7 +751,7 @@ static int emrtd_dump_ef_sod(uint8_t *file_contents, size_t file_length) {
         return PM3_SUCCESS;
     }
 
-    saveFile("EF_SOD", ".p7b", file_contents + fieldlen + 1, datalen);
+    saveFile(dg_table[EF_SOD].filename, ".p7b", file_contents + fieldlen + 1, datalen);
     return PM3_ESOFT;
 }
 

From 415dd84a8d6ddf752224bd12803f48ebf0544ced Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Sat, 19 Dec 2020 19:32:06 +0100
Subject: [PATCH 151/682] fix print_buffer out-of-boundaries bug

---
 client/src/util.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/client/src/util.c b/client/src/util.c
index 4ba4af108..1dad2cd4b 100644
--- a/client/src/util.c
+++ b/client/src/util.c
@@ -208,7 +208,9 @@ void print_buffer(const uint8_t *data, const size_t len, int level) {
     char buf[UTIL_BUFFER_SIZE_SPRINT + 3];
     int i;
     for (i = 0; i < len; i += 16) {
-
+        if (len - i < 16) { // incomplete block, will be treated out of the loop
+            break;
+        }
         // (16 * 3) + (16) +  + 1
         memset(buf, 0, sizeof(buf));
         sprintf(buf, "%*s%02x: ", (level * 4), " ", i);

From 669eea1f7412d2f198695b3d1edba143fe7d9037 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Sat, 19 Dec 2020 19:44:26 +0100
Subject: [PATCH 152/682] emrtd: hide SOD todo for now

---
 client/src/cmdhfemrtd.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 7a46c6850..9d8332ba7 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1472,9 +1472,9 @@ static int emrtd_print_ef_dg12_info(uint8_t *data, size_t datalen) {
 }
 
 static int emrtd_print_ef_sod_info(uint8_t *data, size_t datalen) {
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_SOD") " --------------------");
-    PrintAndLogEx(WARNING, "TODO");
+//    PrintAndLogEx(NORMAL, "");
+//    PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_SOD") " --------------------");
+//    PrintAndLogEx(WARNING, "TODO");
     return PM3_SUCCESS;
 }
 

From 3098f01dd9561d6f6ea95af623222920a5c0a2f9 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Sat, 19 Dec 2020 20:53:16 +0100
Subject: [PATCH 153/682] emrtd: non-BAC: tested! remove debug print

---
 client/src/cmdhfemrtd.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 9d8332ba7..af586e59a 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -935,7 +935,6 @@ static bool emrtd_do_auth(char *documentnumber, char *dob, char *expiry, bool BA
             PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt external authentication.");
         } else {
             *BAC = false;
-            PrintAndLogEx(INFO, "EF_DG1: %s", sprint_hex(response, resplen));
         }
     }
 

From 2d54ec652c4ab1d761f258e91f8ce0482c9ac50f Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Sat, 19 Dec 2020 21:27:03 +0100
Subject: [PATCH 154/682] changed reading of "uid" to "serial" in function
 detect_4x50_block since output is always "serial"

---
 client/src/cmdlfem4x50.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c
index 2f415c32b..0476043a5 100644
--- a/client/src/cmdlfem4x50.c
+++ b/client/src/cmdlfem4x50.c
@@ -508,7 +508,7 @@ bool detect_4x50_block(void) {
     em4x50_data_t etd = {
         .pwd_given = false,
         .addr_given = true,
-        .addresses = (EM4X50_DEVICE_ID << 8) | EM4X50_DEVICE_ID,
+        .addresses = (EM4X50_DEVICE_SERIAL << 8) | EM4X50_DEVICE_SERIAL,
     };
     em4x50_word_t words[EM4X50_NO_WORDS];
     return (em4x50_read(&etd, words) == PM3_SUCCESS);

From ef8f47263ae35c40dab6e67f5be3b4237a0bff6f Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Sat, 19 Dec 2020 22:00:48 +0100
Subject: [PATCH 155/682] lf em 4x50 info: complete data is displayed only via
 additional verbose option (-v)

---
 client/src/cmdlfem4x50.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c
index 0476043a5..9c907caf7 100644
--- a/client/src/cmdlfem4x50.c
+++ b/client/src/cmdlfem4x50.c
@@ -81,7 +81,7 @@ static void print_result(const em4x50_word_t *words, int fwr, int lwr) {
     PrintAndLogEx(INFO, "----+-------------+-------------+--------------------");
 }
 
-static void print_info_result(uint8_t *data) {
+static void print_info_result(uint8_t *data, bool verbose) {
 
     // display all information of info result in structured format
     em4x50_word_t words[EM4X50_NO_WORDS];
@@ -104,7 +104,11 @@ static void print_info_result(uint8_t *data) {
     // data section
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, _YELLOW_("EM4x50 data:"));
-    print_result(words, 0, EM4X50_NO_WORDS - 1);
+    if (verbose) {
+        print_result(words, 0, EM4X50_NO_WORDS - 1);
+    } else {
+        print_result(words, EM4X50_DEVICE_SERIAL, EM4X50_DEVICE_ID);
+    }
 
     // configuration section
     PrintAndLogEx(NORMAL, "");
@@ -618,12 +622,14 @@ int CmdEM4x50Info(const char *Cmd) {
     CLIParserInit(&ctx, "lf em 4x50 info",
                   "Tag information EM4x50.",
                   "lf em 4x50 info\n"
+                  "lf em 4x50 info -v -> show data section\n"
                   "lf em 4x50 info -p 12345678   -> uses pwd 0x12345678\n"
                  );
 
     void *argtable[] = {
         arg_param_begin,
         arg_str0("p", "pwd", "<hex>", "password, 4 hex bytes, lsb"),
+        arg_lit0("v", "verbose", "additional output of data section"),
         arg_param_end
     };
 
@@ -631,6 +637,7 @@ int CmdEM4x50Info(const char *Cmd) {
     int pwd_len = 0;
     uint8_t pwd[4] = {0x0};
     CLIGetHexWithReturn(ctx, 1, pwd, &pwd_len);
+    bool verb = arg_get_lit(ctx, 2);
     CLIParserFree(ctx);
 
     em4x50_data_t etd = {.pwd_given = false};
@@ -653,7 +660,7 @@ int CmdEM4x50Info(const char *Cmd) {
     }
 
     if (resp.status == PM3_SUCCESS)
-        print_info_result(resp.data.asBytes);
+        print_info_result(resp.data.asBytes, verb);
     else
         PrintAndLogEx(FAILED, "Reading tag " _RED_("failed"));
 

From c828caff3357a2210ac1309884b29557db582163 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Sat, 19 Dec 2020 22:05:10 +0100
Subject: [PATCH 156/682] emrtd: add --mrz

---
 client/src/cmdhfemrtd.c | 58 ++++++++++++++++++++++++++++++++++++++---
 1 file changed, 55 insertions(+), 3 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index af586e59a..6420d45e3 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1640,10 +1640,12 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
         arg_str0("n", "documentnumber", "<alphanum>", "document number, up to 9 chars"),
         arg_str0("d", "dateofbirth", "<YYMMDD>", "date of birth in YYMMDD format"),
         arg_str0("e", "expiry", "<YYMMDD>", "expiry in YYMMDD format"),
+        arg_str0("m", "mrz", "<[0-9A-Z<]>", "2nd line of MRZ, 44 chars"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
 
+    uint8_t mrz[45] = { 0x00 };
     uint8_t docnum[10] = { 0x00 };
     uint8_t dob[7] = { 0x00 };
     uint8_t expiry[7] = { 0x00 };
@@ -1657,7 +1659,7 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
         text_to_upper(docnum, slen);
         if (slen != 9) {
             // Pad to 9 with <
-            memset(docnum + slen, 0x3c, 9 - slen);
+            memset(docnum + slen, '<', 9 - slen);
         }
     }
     
@@ -1681,6 +1683,30 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
         }
     }
 
+    if (CLIParamStrToBuf(arg_get_str(ctx, 4), mrz, 44, &slen) == 0 && slen != 0) {
+        if (slen != 44) {
+            PrintAndLogEx(ERR, "MRZ length is incorrect, it should be 44, not %i", slen);
+            error = true;
+        } else {
+            BAC = true;
+            text_to_upper(mrz, slen);
+            memcpy(docnum, &mrz[0], 9);
+            memcpy(dob,    &mrz[13], 6);
+            memcpy(expiry, &mrz[21], 6);
+            // TODO check MRZ checksums?
+            if (!validate_date(dob, 6)) {
+                PrintAndLogEx(ERR, "Date of birth date format is incorrect, cannot continue.");
+                PrintAndLogEx(HINT, "Use the format YYMMDD.");
+                error = true;
+            }
+            if (!validate_date(expiry, 6)) {
+                PrintAndLogEx(ERR, "Expiry date format is incorrect, cannot continue.");
+                PrintAndLogEx(HINT, "Use the format YYMMDD.");
+                error = true;
+            }
+        }
+    }
+
     CLIParserFree(ctx);
     if (error) {
         return PM3_ESOFT;
@@ -1700,11 +1726,13 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
         arg_str0("n", "documentnumber", "<alphanum>", "document number, up to 9 chars"),
         arg_str0("d", "dateofbirth", "<YYMMDD>", "date of birth in YYMMDD format"),
         arg_str0("e", "expiry", "<YYMMDD>", "expiry in YYMMDD format"),
+        arg_str0("m", "mrz", "<[0-9A-Z<]>", "2nd line of MRZ, 44 chars"),
         arg_str0(NULL, "path", "<dirpath>", "display info from offline dump stored in dirpath"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
 
+    uint8_t mrz[45] = { 0x00 };
     uint8_t docnum[10] = { 0x00 };
     uint8_t dob[7] = { 0x00 };
     uint8_t expiry[7] = { 0x00 };
@@ -1717,7 +1745,7 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
     } else {
         text_to_upper(docnum, slen);
         if (slen != 9) {
-            memset(docnum + slen, 0x3c, 9 - slen);
+            memset(docnum + slen, '<', 9 - slen);
         }
     }
     
@@ -1740,8 +1768,32 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
             error = true;
         }
     }
+
+    if (CLIParamStrToBuf(arg_get_str(ctx, 4), mrz, 44, &slen) == 0 && slen != 0) {
+        if (slen != 44) {
+            PrintAndLogEx(ERR, "MRZ length is incorrect, it should be 44, not %i", slen);
+            error = true;
+        } else {
+            BAC = true;
+            text_to_upper(mrz, slen);
+            memcpy(docnum, &mrz[0], 9);
+            memcpy(dob,    &mrz[13], 6);
+            memcpy(expiry, &mrz[21], 6);
+            // TODO check MRZ checksums?
+            if (!validate_date(dob, 6)) {
+                PrintAndLogEx(ERR, "Date of birth date format is incorrect, cannot continue.");
+                PrintAndLogEx(HINT, "Use the format YYMMDD.");
+                error = true;
+            }
+            if (!validate_date(expiry, 6)) {
+                PrintAndLogEx(ERR, "Expiry date format is incorrect, cannot continue.");
+                PrintAndLogEx(HINT, "Use the format YYMMDD.");
+                error = true;
+            }
+        }
+    }
     uint8_t path[FILENAME_MAX] = { 0x00 };
-    bool offline = CLIParamStrToBuf(arg_get_str(ctx, 4), path, sizeof(path), &slen) == 0 && slen > 0;
+    bool offline = CLIParamStrToBuf(arg_get_str(ctx, 5), path, sizeof(path), &slen) == 0 && slen > 0;
     CLIParserFree(ctx);
     if (error) {
         return PM3_ESOFT;

From 2385ea9bb723c27572087859d1ffb903e34e4491 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Sun, 20 Dec 2020 01:13:20 +0100
Subject: [PATCH 157/682] fix issue #1127

---
 client/src/cmdhfemrtd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 6420d45e3..30eb4667f 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1553,7 +1553,7 @@ int infoHF_EMRTD_offline(const char *path) {
     if (filepath == NULL)
         return PM3_EMALLOC;
     strcpy(filepath, path);
-    strncat(filepath, PATHSEP, 1);
+    strncat(filepath, PATHSEP, 2);
     strcat(filepath, dg_table[EF_COM].filename);
 
     if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, false) != PM3_SUCCESS) {
@@ -1590,7 +1590,7 @@ int infoHF_EMRTD_offline(const char *path) {
         }
         if (!dg->pace) {
             strcpy(filepath, path);
-            strncat(filepath, PATHSEP, 1);
+            strncat(filepath, PATHSEP, 2);
             strcat(filepath, dg->filename);
             if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, false) == PM3_SUCCESS)
             {

From 08efedaa8363786c8122d020cd9ff7f5a3d1fd53 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 20 Dec 2020 17:19:26 -0500
Subject: [PATCH 158/682] hf legic crc - now use cliparser

---
 client/luascripts/hf_legic_clone.lua |   2 +-
 client/src/cmdhflegic.c              | 103 +++++++--------------------
 doc/cliparser_todo.txt               |   1 -
 3 files changed, 26 insertions(+), 80 deletions(-)

diff --git a/client/luascripts/hf_legic_clone.lua b/client/luascripts/hf_legic_clone.lua
index 28a95bca7..ec0c78d25 100644
--- a/client/luascripts/hf_legic_clone.lua
+++ b/client/luascripts/hf_legic_clone.lua
@@ -536,7 +536,7 @@ local function main(args)
                 res = res .."\n\na segmentCRC gets calculated over MCD,MSN0..3, Segment-Header0..3"
                 res = res .."\ne.g. (based on Segment00 of the data from "..infile.."):"
                 res = res .."\n"
-                res = res ..ansicolors.yellow.."hf legic crc d "..bytes[1]..bytes[2]..bytes[3]..bytes[4]..bytes[23]..bytes[24]..bytes[25]..bytes[26].." u "..newcrc.." c 8"..ansicolors.reset
+                res = res ..ansicolors.yellow.."hf legic crc -d "..bytes[1]..bytes[2]..bytes[3]..bytes[4]..bytes[23]..bytes[24]..bytes[25]..bytes[26].." --mcc "..newcrc.." -t 8"..ansicolors.reset
                 -- this can not be calculated without knowing the new MCD, MSN0..2
                 print(res)
             end
diff --git a/client/src/cmdhflegic.c b/client/src/cmdhflegic.c
index 39a542cc9..b202ba170 100644
--- a/client/src/cmdhflegic.c
+++ b/client/src/cmdhflegic.c
@@ -16,6 +16,7 @@
 #include <readline/readline.h>
 #endif
 
+#include "cliparser.h"
 #include "cmdparser.h"    // command_t
 #include "comms.h"        // clearCommandBuffer
 #include "cmdtrace.h"
@@ -27,21 +28,6 @@ static int CmdHelp(const char *Cmd);
 
 #define MAX_LENGTH 1024
 
-static int usage_legic_calccrc(void) {
-    PrintAndLogEx(NORMAL, "Calculates the legic crc8/crc16 on the given data.");
-    PrintAndLogEx(NORMAL, "There must be an even number of hexsymbols as input.\n");
-    PrintAndLogEx(NORMAL, "Usage:  hf legic crc [h] d <data> u <uidcrc> c <8|16>\n");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h             : this help");
-    PrintAndLogEx(NORMAL, "      d <data>      : (hex symbols) bytes to calculate crc over");
-    PrintAndLogEx(NORMAL, "      u <uidcrc>    : MCC hexbyte");
-    PrintAndLogEx(NORMAL, "      c <8|16>      : Crc type");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf legic crc d deadbeef1122"));
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf legic crc d deadbeef1122 u 9A c 16"));
-    return PM3_SUCCESS;
-}
 static int usage_legic_rdbl(void) {
     PrintAndLogEx(NORMAL, "Read data from a LEGIC Prime tag\n");
     PrintAndLogEx(NORMAL, "Usage:  hf legic rdbl [h] [o <offset>] [l <length>] [iv <IV>]\n");
@@ -779,84 +765,45 @@ static int CmdLegicWrbl(const char *Cmd) {
 }
 
 static int CmdLegicCalcCrc(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf legic crc",
+                  "Calculates the legic crc8/crc16 on the given data",
+                  "hf legic crc -d deadbeef1122\n"
+                  "hf legic crc -d deadbeef1122 --mcc 9A -t 16  <- CRC Type 16");
 
-    uint8_t *data = NULL;
-    uint8_t cmdp = 0, uidcrc = 0, type = 0;
-    bool errors = false;
-    int len = 0;
-    int bg, en;
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1("d", "data", "<hex>", "bytes to calculate crc over"),
+        arg_str0(NULL, "mcc", "<hex>", "MCC hex byte (UID CRC)"),
+        arg_int0("t", "type", "<dec>", "CRC Type (default: 8)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'd':
-                // peek at length of the input string so we can
-                // figure out how many elements to malloc in "data"
-                bg = en = 0;
-                if (param_getptr(Cmd, &bg, &en, cmdp + 1)) {
-                    errors = true;
-                    break;
-                }
-                len = (en - bg + 1);
+    int data_len = 0;
+    uint8_t data[4096] = {0};
 
-                // check that user entered even number of characters
-                // for hex data string
-                if (len & 1) {
-                    errors = true;
-                    break;
-                }
+    CLIGetHexWithReturn(ctx, 1, data, &data_len);
 
-                // it's possible for user to accidentally enter "b" parameter
-                // more than once - we have to clean previous malloc
-                if (data) free(data);
-                data = calloc(len >> 1,  sizeof(uint8_t));
-                if (data == NULL) {
-                    PrintAndLogEx(WARNING, "Can't allocate memory. exiting");
-                    errors = true;
-                    break;
-                }
+    int mcc_len = 0;
+    uint8_t mcc[1] = {0};  // formerly uidcrc
 
-                if (param_gethex(Cmd, cmdp + 1, data, len)) {
-                    errors = true;
-                    break;
-                }
+    CLIGetHexWithReturn(ctx, 2, mcc, &mcc_len);
 
-                len >>= 1;
-                cmdp += 2;
-                break;
-            case 'u':
-                uidcrc = param_get8ex(Cmd, cmdp + 1, 0, 16);
-                cmdp += 2;
-                break;
-            case 'c':
-                type = param_get8ex(Cmd, cmdp + 1, 0, 10);
-                cmdp += 2;
-                break;
-            case 'h':
-                errors = true;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-    //Validations
-    if (errors || cmdp == 0) {
-        if (data) free(data);
-        return usage_legic_calccrc();
-    }
+    int type = arg_get_int_def(ctx, 3, 0);
+
+    CLIParserFree(ctx);
 
     switch (type) {
         case 16:
             init_table(CRC_LEGIC);
-            PrintAndLogEx(SUCCESS, "Legic crc16: %X", crc16_legic(data, len, uidcrc));
+            PrintAndLogEx(SUCCESS, "Legic crc16: %X", crc16_legic(data, data_len, mcc[0]));
             break;
         default:
-            PrintAndLogEx(SUCCESS, "Legic crc8: %X",  CRC8Legic(data, len));
+            PrintAndLogEx(SUCCESS, "Legic crc8: %X",  CRC8Legic(data, data_len));
             break;
     }
 
-    if (data) free(data);
     return PM3_SUCCESS;
 }
 
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index b2571f493..6e06c5278 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -85,7 +85,6 @@ hf legic restore
 hf legic rdbl
 hf legic sim
 hf legic wrbl
-hf legic crc
 hf legic eload
 hf legic esave
 hf legic wipe

From feeb32b13fdf0cd86520b6d773170d1b23c9e8a5 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 21 Dec 2020 01:45:03 +0100
Subject: [PATCH 159/682] lf tune -  added possiblity to get bar / mix / value
 (defaul)  output of measurements. Also set in preferences

---
 client/src/cmdlf.c       | 121 ++++++++++++++++++++----------------
 client/src/comms.h       |   5 +-
 client/src/preferences.c | 128 ++++++++++++++++++++++++++++++++++++---
 client/src/ui.c          |  65 ++++++++++++++++++++
 client/src/ui.h          |   4 ++
 client/src/util.h        |   1 +
 6 files changed, 261 insertions(+), 63 deletions(-)

diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index 89483bf00..4cc303f19 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -230,59 +230,61 @@ static int usage_lf_find(void) {
     PrintAndLogEx(NORMAL,  _YELLOW_("      lf search 1 u") "  - use data from GraphBuffer & search for known and unknown tags");
     return PM3_SUCCESS;
 }
-static int usage_lf_tune(void) {
-    PrintAndLogEx(NORMAL, "Continuously measure LF antenna tuning.");
-    PrintAndLogEx(NORMAL, "Press button or Enter to interrupt.");
-    PrintAndLogEx(NORMAL, "Usage:  lf tune [h] [n <iter>] [q <divisor> | f <freq>]");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h             - This help");
-    PrintAndLogEx(NORMAL, "       n <iter>      - number of iterations (default: 0=infinite)");
-    PrintAndLogEx(NORMAL, "       q <divisor>   - Frequency divisor. %d -> 134 kHz, %d -> 125 kHz", LF_DIVISOR_134, LF_DIVISOR_125);
-    PrintAndLogEx(NORMAL, "       f <freq>      - Frequency in kHz");
-    return PM3_SUCCESS;
-}
 
 static int CmdLFTune(const char *Cmd) {
-    int iter = 0;
-    uint8_t divisor =  LF_DIVISOR_125;//Frequency divisor
-    bool errors = false;
-    uint8_t cmdp = 0;
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (param_getchar(Cmd, cmdp)) {
-            case 'h':
-                return usage_lf_tune();
-            case 'q':
-                errors |= param_getdec(Cmd, cmdp + 1, &divisor);
-                cmdp += 2;
-                if (divisor < 19) {
-                    PrintAndLogEx(ERR, "divisor must be between 19 and 255");
-                    return PM3_EINVARG;
-                }
-                break;
-            case 'f': {
-                float freq = param_getfloat(Cmd, cmdp + 1, 125);
-                if ((freq < 47) || (freq > 600)) {
-                    PrintAndLogEx(ERR, "freq must be between 47 and 600");
-                    return PM3_EINVARG;
-                }
-                divisor = LF_FREQ2DIV(freq);
-                cmdp += 2;
-                break;
-            }
-            case 'n':
-                iter = param_get32ex(Cmd, cmdp + 1, 0, 10);
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = 1;
-                break;
-        }
+
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf tune",
+                  "Continuously measure LF antenna tuning.\n"
+                  "Press button or <Enter> to interrupt.",
+                  "lf tune"
+                 );
+
+    char q_str[60];
+    snprintf(q_str, sizeof(q_str), "Frequency divisor. %d -> 134 kHz, %d -> 125 kHz", LF_DIVISOR_134, LF_DIVISOR_125);
+    void *argtable[] = {
+        arg_param_begin,
+        arg_u64_0("n", "iteration", "<dec>", "number of iterations (default: 0=infinite)"),
+        arg_u64_0("q", "divisor", "<dec>", q_str),
+        arg_dbl0("f", "freq", "<float>", "Frequency in kHz"),
+        arg_lit0(NULL, "bar", "bar style"),
+        arg_lit0(NULL, "mix", "mixed style"),
+        arg_lit0(NULL, "value", "values style"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    uint32_t iter = arg_get_u32_def(ctx, 1, 0);
+    uint8_t divisor = arg_get_u32_def(ctx, 2, LF_DIVISOR_125);
+    double freq = arg_get_dbl_def(ctx, 3, 125);
+
+    bool is_bar = arg_get_lit(ctx, 4);
+    bool is_mix = arg_get_lit(ctx, 5);
+    bool is_value = arg_get_lit(ctx, 6);
+    CLIParserFree(ctx);
+
+    if (divisor < 19) {
+        PrintAndLogEx(ERR, "divisor must be between 19 and 255");
+        return PM3_EINVARG;
     }
 
-    //Validations
-    if (errors) return usage_lf_tune();
+    if ((freq < 47) || (freq > 600)) {
+        PrintAndLogEx(ERR, "freq must be between 47 and 600");
+        return PM3_EINVARG;
+    }
+    divisor = LF_FREQ2DIV(freq);
+
+    if ((is_bar + is_mix + is_value) > 1) {
+        PrintAndLogEx(ERR, "Select only one output style");
+        return PM3_EINVARG;
+    }
+
+    barMode_t style = session.bar_mode;
+    if (is_bar)
+        style = STYLE_BAR;
+    if (is_mix)
+        style = STYLE_MIXED;
+    if (is_value)
+        style = STYLE_VALUE;
 
     PrintAndLogEx(INFO, "Measuring LF antenna at " _YELLOW_("%.2f") " kHz, click " _GREEN_("pm3 button") " or press " _GREEN_("Enter") " to exit", LF_DIV2FREQ(divisor));
 
@@ -298,6 +300,13 @@ static int CmdLFTune(const char *Cmd) {
     }
 
     params[0] = 2;
+
+    #define MAX_ADC_LF_VOLTAGE 140800
+    uint32_t max = 71000;
+    bool first = true;
+
+	print_progress(0, max, style);
+
     // loop forever (till button pressed) if iter = 0 (default)
     for (uint8_t i = 0; iter == 0 || i < iter; i++) {
         if (kbd_enter_pressed()) {
@@ -308,15 +317,23 @@ static int CmdLFTune(const char *Cmd) {
         if (!WaitForResponseTimeout(CMD_MEASURE_ANTENNA_TUNING_LF, &resp, 1000)) {
             PrintAndLogEx(NORMAL, "");
             PrintAndLogEx(WARNING, "Timeout while waiting for Proxmark LF measure, aborting");
-            return PM3_ETIMEOUT;
+            break;
         }
 
         if ((resp.status == PM3_EOPABORTED) || (resp.length != sizeof(uint32_t))) {
+            PrintAndLogEx(NORMAL, "");
             break;
         }
 
         uint32_t volt = resp.data.asDwords[0];
-        PrintAndLogEx(INPLACE, " %u mV / %3u V", volt, (uint32_t)(volt / 1000));
+        if (first) {
+            max =  (volt * 1.03);
+            first = false;
+        }
+        if ( volt > max) {
+            max =  (volt * 1.03);
+        }
+        print_progress(volt, max, style);
     }
 
     params[0] = 3;
@@ -325,7 +342,7 @@ static int CmdLFTune(const char *Cmd) {
         PrintAndLogEx(WARNING, "Timeout while waiting for Proxmark LF shutdown, aborting");
         return PM3_ETIMEOUT;
     }
-    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(NORMAL, "\x1b%c[2K\r", 30);
     PrintAndLogEx(INFO, "Done.");
     return PM3_SUCCESS;
 }
diff --git a/client/src/comms.h b/client/src/comms.h
index 3ee691a30..80ce543da 100644
--- a/client/src/comms.h
+++ b/client/src/comms.h
@@ -21,9 +21,7 @@ extern "C" {
 #endif
 
 #ifndef DropField
-#define DropField() { \
-        clearCommandBuffer(); SendCommandNG(CMD_HF_DROPFIELD, NULL, 0); \
-    }
+#define DropField() { clearCommandBuffer(); SendCommandNG(CMD_HF_DROPFIELD, NULL, 0); }
 #endif
 
 #ifndef DropFieldEx
@@ -48,7 +46,6 @@ typedef enum {
     FPGA_MEM,
 } DeviceMemType_t;
 
-
 typedef struct {
     bool run; // If TRUE, continue running the uart_communication thread
     bool block_after_ACK; // if true, block after receiving an ACK package
diff --git a/client/src/preferences.c b/client/src/preferences.c
index 9f507b969..b6b1eddd3 100644
--- a/client/src/preferences.c
+++ b/client/src/preferences.c
@@ -55,6 +55,7 @@ int preferences_load(void) {
     session.overlay_sliders = true;
     session.show_hints = true;
 
+    session.bar_mode = STYLE_VALUE;
 //    setDefaultPath (spDefault, "");
 //    setDefaultPath (spDump, "");
 //    setDefaultPath (spTrace, "");
@@ -210,6 +211,20 @@ void preferences_save_callback(json_t *root) {
         default:
             JsonSaveStr(root, "logging.level", "NORMAL");
     }
+
+    switch (session.bar_mode) {
+        case STYLE_BAR:
+            JsonSaveStr(root, "show.bar.mode", "bar");
+            break;
+        case STYLE_MIXED:
+            JsonSaveStr(root, "show.bar.mode", "mixed");
+            break;
+        case STYLE_VALUE:
+            JsonSaveStr(root, "show.bar.mode", "value");
+            break;
+        default:
+            JsonSaveStr(root, "show.bar.mode", "value");
+    }
     /*
         switch (session.device_debug_level) {
             case ddbOFF:
@@ -298,6 +313,16 @@ void preferences_load_callback(json_t *root) {
 
     if (json_unpack_ex(root, &up_error, 0, "{s:b}", "os.supports.colors", &b1) == 0)
         session.supports_colors = (bool)b1;
+
+    // bar mode 
+    if (json_unpack_ex(root, &up_error, 0, "{s:s}", "show.bar.mode", &s1) == 0) {
+        strncpy(tempStr, s1, sizeof(tempStr) - 1);
+        str_lower(tempStr);
+        if (strncmp(tempStr, "bar", 5) == 0) session.bar_mode = STYLE_BAR;
+        if (strncmp(tempStr, "mixed", 5) == 0) session.bar_mode = STYLE_MIXED;
+        if (strncmp(tempStr, "value", 7) == 0) session.bar_mode = STYLE_VALUE;
+    }
+
     /*
         // Logging Level
         if (json_unpack_ex(root, &up_error, 0, "{s:s}", "device.debug.level", &s1) == 0) {
@@ -343,6 +368,17 @@ static int usage_set_debug(void) {
     PrintAndLogEx(NORMAL, "     "_GREEN_("full")"        - full debug messages");
     return PM3_SUCCESS;
 }
+
+static int usage_set_bar_mode(void) {
+    PrintAndLogEx(NORMAL, "Usage: pref set barmode <bar | mixed | value>");
+    PrintAndLogEx(NORMAL, "Options:");
+    PrintAndLogEx(NORMAL, "     "_GREEN_("help")"        - This help");
+    PrintAndLogEx(NORMAL, "     "_GREEN_("bar")"         - measured values as bar only");
+    PrintAndLogEx(NORMAL, "     "_GREEN_("mixed")"       - measured values as numbers and bar");
+    PrintAndLogEx(NORMAL, "     "_GREEN_("value")"       - measured values");
+    return PM3_SUCCESS;
+}
+
 /*
 static int usage_set_devicedebug(void) {
     PrintAndLogEx(NORMAL, "Usage: pref set devicedebug <off | error | info | debug | extended>");
@@ -521,6 +557,23 @@ static void showPlotSliderState(prefShowOpt_t opt) {
         PrintAndLogEx(INFO, "   %s show plot sliders...... "_WHITE_("off"), prefShowMsg(opt));
 }
 
+static void showBarModeState(prefShowOpt_t opt) {
+
+    switch (session.bar_mode) {
+        case STYLE_BAR:
+            PrintAndLogEx(INFO, "   %s mode................... "_GREEN_("bar"), prefShowMsg(opt));
+            break;
+        case STYLE_MIXED:
+            PrintAndLogEx(INFO, "   %s mode................... "_GREEN_("mixed"), prefShowMsg(opt));
+            break;
+        case STYLE_VALUE:
+            PrintAndLogEx(INFO, "   %s mode................... "_GREEN_("value"), prefShowMsg(opt));
+            break;
+        default:
+            PrintAndLogEx(INFO, "   %s mode.................. "_RED_("unknown"), prefShowMsg(opt));
+    }
+}
+
 
 static int setCmdEmoji(const char *Cmd) {
     uint8_t cmdp = 0;
@@ -921,6 +974,57 @@ static int getCmdHelp(const char *Cmd) {
 }
 */
 
+static int setCmdBarMode(const char *Cmd) {
+    uint8_t cmdp = 0;
+    bool errors = false;
+    bool validValue = false;
+    char strOpt[50];
+    barMode_t newValue = session.bar_mode;
+
+    if (param_getchar(Cmd, cmdp) == 0x00)
+        return usage_set_bar_mode();
+
+    while ((param_getchar(Cmd, cmdp) != 0x00) && !errors) {
+
+        if (param_getstr(Cmd, cmdp++, strOpt, sizeof(strOpt)) != 0) {
+            str_lower(strOpt); // convert to lowercase
+
+            if (strncmp(strOpt, "help", 4) == 0)
+                return usage_set_bar_mode();
+
+            if (strncmp(strOpt, "bar", 3) == 0) {
+                validValue = true;
+                newValue = STYLE_BAR;
+            }
+            if (strncmp(strOpt, "mixed", 5) == 0) {
+                validValue = true;
+                newValue = STYLE_MIXED;
+            }
+            if (strncmp(strOpt, "value", 5) == 0) {
+                validValue = true;
+                newValue = STYLE_VALUE;
+            }
+
+            if (validValue) {
+                if (session.bar_mode != newValue) {// changed
+                    showBarModeState(prefShowOLD);
+                    session.bar_mode = newValue;
+                    showBarModeState(prefShowNEW);
+                    preferences_save();
+                } else {
+                    PrintAndLogEx(INFO, "nothing changed");
+                    showBarModeState(prefShowNone);
+                }
+            } else {
+                PrintAndLogEx(ERR, "invalid option");
+                return usage_set_bar_mode();
+            }
+        }
+    }
+
+    return PM3_SUCCESS;
+}
+
 static int getCmdEmoji(const char *Cmd) {
     showEmojiState(prefShowNone);
     return PM3_SUCCESS;
@@ -946,27 +1050,35 @@ static int getCmdPlotSlider(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
+static int getCmdBarMode(const char *Cmd) {
+    showBarModeState(prefShowNone);
+    return PM3_SUCCESS;
+}
+
+
 static command_t getCommandTable[] = {
 //     {"help",             getCmdHelp,          AlwaysAvailable, "This help"},
-    {"emoji",            getCmdEmoji,         AlwaysAvailable, "Get emoji display preference"},
-    {"hints",            getCmdHint,          AlwaysAvailable, "Get hint display preference"},
+    {"barmode",          getCmdBarMode,       AlwaysAvailable, "Get bar mode preference"},
+    {"clientdebug",      getCmdDebug,         AlwaysAvailable, "Get client debug level preference"},
     {"color",            getCmdColor,         AlwaysAvailable, "Get color support preference"},
     //  {"defaultsavepaths", getCmdSavePaths,     AlwaysAvailable, "... to be adjusted next ... "},
-    {"clientdebug",      getCmdDebug,         AlwaysAvailable, "Get client debug level preference"},
-    {"plotsliders",      getCmdPlotSlider,    AlwaysAvailable, "Get plot slider display preference"},
     //  {"devicedebug",      getCmdDeviceDebug,   AlwaysAvailable, "Get device debug level"},
+    {"emoji",            getCmdEmoji,         AlwaysAvailable, "Get emoji display preference"},
+    {"hints",            getCmdHint,          AlwaysAvailable, "Get hint display preference"},
+    {"plotsliders",      getCmdPlotSlider,    AlwaysAvailable, "Get plot slider display preference"},
     {NULL, NULL, NULL, NULL}
 };
 
 static command_t setCommandTable[] = {
     {"help",             setCmdHelp,          AlwaysAvailable, "This help"},
+    {"barmode",          setCmdBarMode,       AlwaysAvailable, "Set bar mode"},
+    {"clientdebug",      setCmdDebug,         AlwaysAvailable, "Set client debug level"},
+    {"color",            setCmdColor,         AlwaysAvailable, "Set color support"},
     {"emoji",            setCmdEmoji,         AlwaysAvailable, "Set emoji display"},
     {"hints",            setCmdHint,          AlwaysAvailable, "Set hint display"},
-    {"color",            setCmdColor,         AlwaysAvailable, "Set color support"},
     //  {"defaultsavepaths", setCmdSavePaths,     AlwaysAvailable, "... to be adjusted next ... "},
-    {"clientdebug",      setCmdDebug,         AlwaysAvailable, "Set client debug level"},
-    {"plotsliders", setCmdPlotSliders,         AlwaysAvailable, "Set plot slider display"},
     //  {"devicedebug",      setCmdDeviceDebug,   AlwaysAvailable, "Set device debug level"},
+    {"plotsliders", setCmdPlotSliders,         AlwaysAvailable, "Set plot slider display"},
     {NULL, NULL, NULL, NULL}
 };
 
@@ -1009,6 +1121,8 @@ static int CmdPrefShow(const char *Cmd) {
     showClientDebugState(prefShowNone);
     showPlotSliderState(prefShowNone);
 //    showDeviceDebugState(prefShowNone);
+
+    showBarModeState(prefShowNone);
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
diff --git a/client/src/ui.c b/client/src/ui.c
index 6e8c73c27..03ff304b2 100644
--- a/client/src/ui.c
+++ b/client/src/ui.c
@@ -624,4 +624,69 @@ void iceSimple_Filter(int *data, const size_t len, uint8_t k) {
     }
 }
 
+void print_progress(size_t count, uint64_t max, barMode_t style) {
 
+    #define PERCENTAGE(V, T)   (100 - (((T - V) * 100) / T))
+
+/*
+    typedef struct smooth_s {
+        const char *bar;
+    } smooth_t;
+
+    static smooth_t smoothtable[] = {
+        {"\xe2\x96\x8F"},
+        {"\xe2\x96\x8E"},
+        {"\xe2\x96\x8D"},
+        {"\xe2\x96\x8C"},
+        {"\xe2\x96\x8B"},
+        {"\xe2\x96\x8A"},
+        {"\xe2\x96\x89"},
+        {"\xe2\x96\x88"},
+    };
+*/
+
+    // +1 for \0
+    char *bar = calloc(100 + 1, sizeof(uint8_t));
+
+    uint8_t value = PERCENTAGE(count, max);
+
+    // prefix is added already.
+    memset(bar + strlen(bar), 0x23, value);
+
+    // add spaces
+    memset(bar + strlen(bar), 0x2E,  100 - value);
+
+    // color buffer
+    uint8_t collen = 100 + 1 + 40;
+    char *cbar = calloc(collen, sizeof(uint8_t));
+
+    // Add colors
+    snprintf(cbar,  collen,  _GREEN_("%.*s"), 60, bar);
+    snprintf(cbar + strlen(cbar), collen - strlen(cbar), _CYAN_("%.*s"), 20,  bar + 60);
+    snprintf(cbar + strlen(cbar), collen - strlen(cbar), _YELLOW_("%.*s"), 20, bar + 80);
+
+    uint8_t len = collen + 1 + 1 + 30;
+    char *buffer = calloc(len, sizeof(uint8_t));
+
+    switch(style) {
+        case STYLE_BAR: {
+	        sprintf(buffer, "%s", cbar);
+            printf("\b%c[2K\r[" _YELLOW_("=")"] %s", 27, buffer);
+            break;
+        }
+        case STYLE_MIXED: {
+            sprintf(buffer, "%s [ %zu mV / %3u V ]", cbar, count, (uint32_t)(count / 1000));
+	        printf("\b%c[2K\r[" _YELLOW_("=")"] %s ", 27, buffer);
+            break;
+        }
+        case STYLE_VALUE: {
+            printf("[" _YELLOW_("=")"] %zu mV / %3u V \r", count, (uint32_t)(count / 1000));
+            break;
+        }
+    }
+
+	fflush(stdout);
+	free(buffer);
+    free(bar);
+    free(cbar);
+}
diff --git a/client/src/ui.h b/client/src/ui.h
index 1a8a14028..30d055b16 100644
--- a/client/src/ui.h
+++ b/client/src/ui.h
@@ -22,6 +22,7 @@ extern "C" {
 
 #define _USE_MATH_DEFINES
 
+typedef enum {STYLE_BAR, STYLE_MIXED, STYLE_VALUE} barMode_t;
 typedef enum logLevel {NORMAL, SUCCESS, INFO, FAILED, WARNING, ERR, DEBUG, INPLACE, HINT} logLevel_t;
 typedef enum emojiMode {ALIAS, EMOJI, ALTTEXT, ERASE} emojiMode_t;
 typedef enum clientdebugLevel {cdbOFF, cdbSIMPLE, cdbFULL} clientdebugLevel_t;
@@ -45,6 +46,7 @@ typedef struct {
     bool incognito;
 //    char *defaultPaths[spItemCount]; // Array should allow loop searching for files
     clientdebugLevel_t client_debug_level;
+    barMode_t bar_mode;
 //    uint8_t device_debug_level;
     char *history_path;
     pm3_device *current_device;
@@ -69,6 +71,8 @@ int searchHomeFilePath(char **foundpath, const char *subdir, const char *filenam
 
 extern pthread_mutex_t print_lock;
 
+void print_progress(size_t count, uint64_t max, barMode_t style);
+
 void iceIIR_Butterworth(int *data, const size_t len);
 void iceSimple_Filter(int *data, const size_t len, uint8_t k);
 #ifdef __cplusplus
diff --git a/client/src/util.h b/client/src/util.h
index 66b72491f..573997d61 100644
--- a/client/src/util.h
+++ b/client/src/util.h
@@ -108,4 +108,5 @@ uint32_t bitcount32(uint32_t a);
 uint64_t bitcount64(uint64_t a);
 uint32_t leadingzeros32(uint32_t a);
 uint64_t leadingzeros64(uint64_t a);
+
 #endif

From 246ee8b2d7d1c0056ba26cd4df1553c3d5cc97e4 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 21 Dec 2020 02:06:43 +0100
Subject: [PATCH 160/682] hf tune - now uses the barmode

---
 client/src/cmdhf.c       | 115 +++++++++++++++++++++++++--------------
 client/src/cmdlf.c       |   7 ++-
 client/src/preferences.c |   8 +--
 3 files changed, 81 insertions(+), 49 deletions(-)

diff --git a/client/src/cmdhf.c b/client/src/cmdhf.c
index 94985579e..41f3d0814 100644
--- a/client/src/cmdhf.c
+++ b/client/src/cmdhf.c
@@ -14,9 +14,8 @@
 #include "cmdhf.h"
 
 #include <ctype.h>          // tolower
-
 #include "cmdparser.h"      // command_t
-#include "cliparser.h"  // parse
+#include "cliparser.h"      // parse
 #include "comms.h"          // clearCommandBuffer
 #include "lfdemod.h"        // computeSignalProperties
 #include "cmdhf14a.h"       // ISO14443-A
@@ -57,36 +56,6 @@ static int usage_hf_search(void) {
     return PM3_SUCCESS;
 }
 
-static int usage_hf_sniff(void) {
-    PrintAndLogEx(NORMAL, "The high frequency sniffer will assign all available memory on device for sniffed data");
-    PrintAndLogEx(NORMAL, "Use " _YELLOW_("'data samples'")" command to download from device,  and " _YELLOW_("'data plot'")" to look at it");
-    PrintAndLogEx(NORMAL, "Press button to quit the sniffing.\n");
-    PrintAndLogEx(NORMAL, "Usage: hf sniff <skip pairs> <skip triggers>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h               - This help");
-    PrintAndLogEx(NORMAL, "       <skip pairs>    - skip sample pairs");
-    PrintAndLogEx(NORMAL, "       <skip triggers> - skip number of triggers");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("           hf sniff"));
-    PrintAndLogEx(NORMAL, _YELLOW_("           hf sniff 1000 0"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
-
-static int usage_hf_tune(void) {
-    PrintAndLogEx(NORMAL, "Continuously measure HF antenna tuning.");
-    PrintAndLogEx(NORMAL, "Press button or `enter` to interrupt.");
-    PrintAndLogEx(NORMAL, "Usage: hf tune [h] [<iter>]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h             - This help");
-    PrintAndLogEx(NORMAL, "       <iter>        - number of iterations (default: 0=infinite)");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("           hf tune 1"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
-
 int CmdHFSearch(const char *Cmd) {
 
     char cmdp = tolower(param_getchar(Cmd, 0));
@@ -199,9 +168,42 @@ int CmdHFSearch(const char *Cmd) {
 }
 
 int CmdHFTune(const char *Cmd) {
-    char cmdp = tolower(param_getchar(Cmd, 0));
-    if (cmdp == 'h') return usage_hf_tune();
-    int iter = param_get32ex(Cmd, 0, 0, 10);
+
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf tune",
+                  "Continuously measure HF antenna tuning.\n"
+                  "Press button or <Enter> to interrupt.",
+                  "hf tune\n"
+                  "hf tune --mixed"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_u64_0("n", "iter", "<dec>", "number of iterations (default: 0=infinite)"),
+        arg_lit0(NULL, "bar", "bar style"),
+        arg_lit0(NULL, "mix", "mixed style"),
+        arg_lit0(NULL, "value", "values style"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    uint32_t iter = arg_get_u32_def(ctx, 1, 0);
+    bool is_bar = arg_get_lit(ctx, 2);
+    bool is_mix = arg_get_lit(ctx, 3);
+    bool is_value = arg_get_lit(ctx, 4);
+    CLIParserFree(ctx);
+
+    if ((is_bar + is_mix + is_value) > 1) {
+        PrintAndLogEx(ERR, "Select only one output style");
+        return PM3_EINVARG;
+    }
+
+    barMode_t style = session.bar_mode;
+    if (is_bar)
+        style = STYLE_BAR;
+    if (is_mix)
+        style = STYLE_MIXED;
+    if (is_value)
+        style = STYLE_VALUE;
 
     PrintAndLogEx(INFO, "Measuring HF antenna, click " _GREEN_("pm3 button") " or press " _GREEN_("Enter") " to exit");
     PacketResponseNG resp;
@@ -215,6 +217,12 @@ int CmdHFTune(const char *Cmd) {
     }
 
     mode[0] = 2;
+
+    uint32_t max = 0xFFFF;
+    bool first = true;
+
+	print_progress(0, max, style);
+
     // loop forever (till button pressed) if iter = 0 (default)
     for (uint8_t i = 0; iter == 0 || i < iter; i++) {
         if (kbd_enter_pressed()) {
@@ -225,15 +233,23 @@ int CmdHFTune(const char *Cmd) {
         if (!WaitForResponseTimeout(CMD_MEASURE_ANTENNA_TUNING_HF, &resp, 1000)) {
             PrintAndLogEx(NORMAL, "");
             PrintAndLogEx(WARNING, "Timeout while waiting for Proxmark HF measure, aborting");
-            return PM3_ETIMEOUT;
+            break;
         }
 
         if ((resp.status == PM3_EOPABORTED) || (resp.length != sizeof(uint16_t))) {
+            PrintAndLogEx(NORMAL, "");
             break;
         }
 
         uint16_t volt = resp.data.asDwords[0] & 0xFFFF;
-        PrintAndLogEx(INPLACE, " %u mV / %2u V", volt, (uint16_t)(volt / 1000));
+        if (first) {
+            max = (volt * 1.03);
+            first = false;
+        }
+        if ( volt > max) {
+            max = (volt * 1.03);
+        }
+        print_progress(volt, max, style);
     }
     mode[0] = 3;
 
@@ -242,7 +258,7 @@ int CmdHFTune(const char *Cmd) {
         PrintAndLogEx(WARNING, "Timeout while waiting for Proxmark HF shutdown, aborting");
         return PM3_ETIMEOUT;
     }
-    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(NORMAL, "\x1b%c[2K\r", 30);
     PrintAndLogEx(INFO, "Done.");
     return PM3_SUCCESS;
 }
@@ -252,16 +268,31 @@ int CmdHFTune(const char *Cmd) {
 // Takes all available bigbuff memory
 // data sample to download?   Not sure what we can do with the data.
 int CmdHFSniff(const char *Cmd) {
-    char cmdp = tolower(param_getchar(Cmd, 0));
-    if (cmdp == 'h') return usage_hf_sniff();
+
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf sniff",
+                  "The high frequency sniffer will assign all available memory on device for sniffed data.s\n"
+                  "Use `data samples` to download from device and `data plot` to visualize it.\n"
+                  "Press button to quit the sniffing.",
+                  "hf sniff\n"
+                  "hf sniff --sp 1000 --st 0   -> skip 1000 pairs, skip 0 triggers"
+                  );
+    void *argtable[] = {
+        arg_param_begin,
+        arg_u64_0(NULL, "sp", "<dec>", "skip sample pairs"),
+        arg_u64_0(NULL, "st", "<dec>", "skip number of triggers"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
 
     struct {
         uint32_t samplesToSkip;
         uint32_t triggersToSkip;
     } PACKED params;
 
-    params.samplesToSkip = param_get32ex(Cmd, 0, 0, 10);
-    params.triggersToSkip = param_get32ex(Cmd, 1, 0, 10);
+    params.samplesToSkip = arg_get_u32_def(ctx, 1, 0);
+    params.triggersToSkip = arg_get_u32_def(ctx, 2, 0);
+    CLIParserFree(ctx);
 
     clearCommandBuffer();
     SendCommandNG(CMD_HF_SNIFF, (uint8_t *)&params, sizeof(params));
diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index 4cc303f19..bd99f648e 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -237,14 +237,15 @@ static int CmdLFTune(const char *Cmd) {
     CLIParserInit(&ctx, "lf tune",
                   "Continuously measure LF antenna tuning.\n"
                   "Press button or <Enter> to interrupt.",
-                  "lf tune"
+                  "lf tune\n"
+                  "lf tune --mixed"
                  );
 
     char q_str[60];
     snprintf(q_str, sizeof(q_str), "Frequency divisor. %d -> 134 kHz, %d -> 125 kHz", LF_DIVISOR_134, LF_DIVISOR_125);
     void *argtable[] = {
         arg_param_begin,
-        arg_u64_0("n", "iteration", "<dec>", "number of iterations (default: 0=infinite)"),
+        arg_u64_0("n", "iter", "<dec>", "number of iterations (default: 0=infinite)"),
         arg_u64_0("q", "divisor", "<dec>", q_str),
         arg_dbl0("f", "freq", "<float>", "Frequency in kHz"),
         arg_lit0(NULL, "bar", "bar style"),
@@ -301,7 +302,7 @@ static int CmdLFTune(const char *Cmd) {
 
     params[0] = 2;
 
-    #define MAX_ADC_LF_VOLTAGE 140800
+//    #define MAX_ADC_LF_VOLTAGE 140800
     uint32_t max = 71000;
     bool first = true;
 
diff --git a/client/src/preferences.c b/client/src/preferences.c
index b6b1eddd3..c80e24e3a 100644
--- a/client/src/preferences.c
+++ b/client/src/preferences.c
@@ -561,16 +561,16 @@ static void showBarModeState(prefShowOpt_t opt) {
 
     switch (session.bar_mode) {
         case STYLE_BAR:
-            PrintAndLogEx(INFO, "   %s mode................... "_GREEN_("bar"), prefShowMsg(opt));
+            PrintAndLogEx(INFO, "   %s barmode................ "_GREEN_("bar"), prefShowMsg(opt));
             break;
         case STYLE_MIXED:
-            PrintAndLogEx(INFO, "   %s mode................... "_GREEN_("mixed"), prefShowMsg(opt));
+            PrintAndLogEx(INFO, "   %s barmode................ "_GREEN_("mixed"), prefShowMsg(opt));
             break;
         case STYLE_VALUE:
-            PrintAndLogEx(INFO, "   %s mode................... "_GREEN_("value"), prefShowMsg(opt));
+            PrintAndLogEx(INFO, "   %s barmode................ "_GREEN_("value"), prefShowMsg(opt));
             break;
         default:
-            PrintAndLogEx(INFO, "   %s mode.................. "_RED_("unknown"), prefShowMsg(opt));
+            PrintAndLogEx(INFO, "   %s barmode............... "_RED_("unknown"), prefShowMsg(opt));
     }
 }
 

From 8bb7e4ed8b23fd36199f88c6037c719eeb1d06f3 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 21 Dec 2020 02:40:04 +0100
Subject: [PATCH 161/682] hf xxx - uses cliparser and textual

---
 client/src/cmdhf.c | 26 ++++++++++++--------------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/client/src/cmdhf.c b/client/src/cmdhf.c
index 41f3d0814..637d6637c 100644
--- a/client/src/cmdhf.c
+++ b/client/src/cmdhf.c
@@ -46,21 +46,19 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_hf_search(void) {
-    PrintAndLogEx(NORMAL, "Usage: hf search");
-    PrintAndLogEx(NORMAL, "Will try to find a HF read out of the unknown tag.");
-    PrintAndLogEx(NORMAL, "Continues to search for all different HF protocols");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h               - This help");
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
-
 int CmdHFSearch(const char *Cmd) {
 
-    char cmdp = tolower(param_getchar(Cmd, 0));
-    if (cmdp == 'h') return usage_hf_search();
-
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf search",
+                  "Will try to find a HF read out of the unknown tag.\n"
+                  "Continues to search for all different HF protocols.",
+                  "hf sniff"
+                  );
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
     int res = PM3_ESOFT;
 
     PROMPT_CLEARLINE;
@@ -271,7 +269,7 @@ int CmdHFSniff(const char *Cmd) {
 
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf sniff",
-                  "The high frequency sniffer will assign all available memory on device for sniffed data.s\n"
+                  "The high frequency sniffer will assign all available memory on device for sniffed data.\n"
                   "Use `data samples` to download from device and `data plot` to visualize it.\n"
                   "Press button to quit the sniffing.",
                   "hf sniff\n"

From 0c41b4b260b2308dacb181b945aa43b9446d64f2 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 21 Dec 2020 02:41:29 +0100
Subject: [PATCH 162/682] text

---
 doc/cliparser_todo.txt | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index b2571f493..6b4b7d01a 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -10,7 +10,6 @@ analyse a
 analyse nuid
 analyse demodbuff
 analyse freq
-analyse foo
 data biphaserawdecode
 data detectclock
 data fsktonrz
@@ -42,9 +41,6 @@ data print
 data samples
 data setdebugmode
 data tune
-hf tune
-hf search
-hf sniff
 hf 14a reader
 hf 14a cuids
 hf 14a sim
@@ -167,14 +163,12 @@ lf simfsk
 lf simpsk
 lf simbidir
 lf sniff
-lf tune
 lf em 410x
 lf em 4x05
 lf em 4x50
-lf hitag info
+lf em 4x70
 lf hitag reader
 lf hitag sim
-lf hitag sniff
 lf hitag writer
 lf hitag dump
 lf hitag cc

From b407d921a91911bce91103a8cdf2f99b1a1f94d5 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 20 Dec 2020 20:52:49 -0500
Subject: [PATCH 163/682] hf legic rdbl - now use cliparser

---
 client/src/cmdhflegic.c | 71 ++++++++++++++++-------------------------
 doc/cliparser_todo.txt  |  1 -
 2 files changed, 27 insertions(+), 45 deletions(-)

diff --git a/client/src/cmdhflegic.c b/client/src/cmdhflegic.c
index b202ba170..bd63057ce 100644
--- a/client/src/cmdhflegic.c
+++ b/client/src/cmdhflegic.c
@@ -28,21 +28,6 @@ static int CmdHelp(const char *Cmd);
 
 #define MAX_LENGTH 1024
 
-static int usage_legic_rdbl(void) {
-    PrintAndLogEx(NORMAL, "Read data from a LEGIC Prime tag\n");
-    PrintAndLogEx(NORMAL, "Usage:  hf legic rdbl [h] [o <offset>] [l <length>] [iv <IV>]\n");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h             : this help");
-    PrintAndLogEx(NORMAL, "      o <offset>    : (hex) offset in data array to start download from");
-    PrintAndLogEx(NORMAL, "      l <length>    : (hex) number of bytes to read");
-    PrintAndLogEx(NORMAL, "      i <IV>        : (hex) (optional) Initialization vector to use. Must be odd and 7bits max");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf legic rdbl o 0 l 16        - reads from byte[0] 0x16 bytes(system header)"));
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf legic rdbl o 0 l 4 iv 55      - reads from byte[0] 0x4 bytes with IV 0x55"));
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf legic rdbl o 0 l 100 iv 55    - reads 0x100 bytes with IV 0x55"));
-    return PM3_SUCCESS;
-}
 static int usage_legic_sim(void) {
     PrintAndLogEx(NORMAL, "Simulates a LEGIC Prime tag. MIM22, MIM256, MIM1024 types can be emulated");
     PrintAndLogEx(NORMAL, "Use " _YELLOW_("`hf legic eload`") " to upload a dump into emulator memory\n");
@@ -512,34 +497,32 @@ out:
 // offset in data memory
 // number of bytes to read
 static int CmdLegicRdbl(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf legic rdbl",
+                  "Read data from a LEGIC Prime tag",
+                  "hf legic rdbl -o 0 -l 16  <- reads from byte[0] 16 bytes(system header)\n"
+                  "hf legic rdbl -o 0 -l 4 --iv 55  <- reads from byte[0] 4 bytes with IV 0x55\n"
+                  "hf legic rdbl -o 0 -l 256 --iv 55  <- reads from byte[0] 256 bytes with IV 0x55");
 
-    uint32_t offset = 0, len = 0, iv = 1;
-    bool errors = false;
-    uint8_t cmdp = 0;
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h' :
-                return usage_legic_rdbl();
-            case 'o' :
-                offset = param_get32ex(Cmd, cmdp + 1, 0, 16);
-                cmdp += 2;
-                break;
-            case 'l' :
-                len = param_get32ex(Cmd, cmdp + 1, 0, 16);
-                cmdp += 2;
-                break;
-            case 'i' :
-                iv = param_get32ex(Cmd, cmdp + 1, 1, 16);
-                cmdp += 2;
-                break;
-            default :
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-    //Validations
-    if (errors || strlen(Cmd) == 0) return usage_legic_rdbl();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_int1("o", "offset", "<dec>", "offset in data array to start download from"),
+        arg_int1("l", "length", "<dec>", "number of bytes to read"),
+        arg_str0(NULL, "iv", "<hex>", "Initialization vector to use. Must be odd and 7bits max"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+
+    int offset = arg_get_int_def(ctx, 1, 0);
+
+    int len = arg_get_int_def(ctx, 2, 0);
+
+    int iv_len = 0;
+    uint8_t iv[1] = {0x01};  // formerly uidcrc
+
+    CLIGetHexWithReturn(ctx, 3, iv, &iv_len);
+
+    CLIParserFree(ctx);
 
     // sanity checks
     if (len + offset >= MAX_LENGTH) {
@@ -557,9 +540,9 @@ static int CmdLegicRdbl(const char *Cmd) {
     }
 
     uint16_t datalen = 0;
-    int status = legic_read_mem(offset, len, iv, data, &datalen);
+    int status = legic_read_mem(offset, len, iv[0], data, &datalen);
     if (status == PM3_SUCCESS) {
-        PrintAndLogEx(NORMAL, "\n ##  |  0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F");
+        PrintAndLogEx(NORMAL, " ##  |  0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F");
         PrintAndLogEx(NORMAL, "-----+------------------------------------------------------------------------------------------------");
         print_hex_break(data, datalen, 32);
     }
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 6e06c5278..c8a21d606 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -82,7 +82,6 @@ hf legic reader
 hf legic info
 hf legic dump
 hf legic restore
-hf legic rdbl
 hf legic sim
 hf legic wrbl
 hf legic eload

From b676efd992e1aa8de5f8551d4b6b756460419523 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 20 Dec 2020 21:00:24 -0500
Subject: [PATCH 164/682] hf legic sim - now use cliparser

---
 client/src/cmdhflegic.c | 36 ++++++++++++++++++------------------
 doc/cliparser_todo.txt  |  1 -
 2 files changed, 18 insertions(+), 19 deletions(-)

diff --git a/client/src/cmdhflegic.c b/client/src/cmdhflegic.c
index bd63057ce..b9f34d362 100644
--- a/client/src/cmdhflegic.c
+++ b/client/src/cmdhflegic.c
@@ -28,20 +28,6 @@ static int CmdHelp(const char *Cmd);
 
 #define MAX_LENGTH 1024
 
-static int usage_legic_sim(void) {
-    PrintAndLogEx(NORMAL, "Simulates a LEGIC Prime tag. MIM22, MIM256, MIM1024 types can be emulated");
-    PrintAndLogEx(NORMAL, "Use " _YELLOW_("`hf legic eload`") " to upload a dump into emulator memory\n");
-    PrintAndLogEx(NORMAL, "Usage:  hf legic sim [h] <tagtype>\n");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h             : this help");
-    PrintAndLogEx(NORMAL, "      <tagtype>     : 0 = MIM22");
-    PrintAndLogEx(NORMAL, "                    : 1 = MIM256 (default)");
-    PrintAndLogEx(NORMAL, "                    : 2 = MIM1024");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf legic sim 2"));
-    return PM3_SUCCESS;
-}
 static int usage_legic_wrbl(void) {
     PrintAndLogEx(NORMAL, "Write data to a LEGIC Prime tag. It autodetects tagsize to make sure size\n");
     PrintAndLogEx(NORMAL, "Usage:  hf legic wrbl [h] [o <offset>] [d <data (hex symbols)>] [y]\n");
@@ -551,9 +537,19 @@ static int CmdLegicRdbl(const char *Cmd) {
 }
 
 static int CmdLegicSim(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf legic sim",
+                  "Simulates a LEGIC Prime tag. MIM22, MIM256, MIM1024 types can be emulated",
+                  "hf legic sim -t 0  <- Simulate Type MIM22\n"
+                  "hf legic sim -t 1  <- Simulate Type MIM256 (default)\n"
+                  "hf legic sim -t 2  <- Simulate Type MIM1024");
 
-    char cmdp = tolower(param_getchar(Cmd, 0));
-    if (strlen(Cmd) == 0 || cmdp == 'h') return usage_legic_sim();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_int0("t", "type", "<dec>", "Tag type to simulate."),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
 
     struct {
         uint8_t tagtype;
@@ -561,9 +557,13 @@ static int CmdLegicSim(const char *Cmd) {
     } PACKED payload;
 
     payload.send_reply = true;
-    payload.tagtype = param_get8ex(Cmd, 0, 1, 10);
+    payload.tagtype = arg_get_int_def(ctx, 1, 1);
+
+    CLIParserFree(ctx);
+
     if (payload.tagtype > 2) {
-        return usage_legic_sim();
+        PrintAndLogEx(ERR, "Invalid tag type selected.");
+        return PM3_EINVARG;
     }
 
     clearCommandBuffer();
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index c8a21d606..274dfe81e 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -82,7 +82,6 @@ hf legic reader
 hf legic info
 hf legic dump
 hf legic restore
-hf legic sim
 hf legic wrbl
 hf legic eload
 hf legic esave

From 03edf439d2025dc4dc1978b37ef4358e265b482e Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 20 Dec 2020 21:16:46 -0500
Subject: [PATCH 165/682] hf legic wrbl - now use cliparser

---
 client/luascripts/hf_legic.lua |   4 +-
 client/src/cmdhflegic.c        | 117 +++++++--------------------------
 doc/cliparser_todo.txt         |   1 -
 3 files changed, 25 insertions(+), 97 deletions(-)

diff --git a/client/luascripts/hf_legic.lua b/client/luascripts/hf_legic.lua
index 1715bf400..744372f83 100644
--- a/client/luascripts/hf_legic.lua
+++ b/client/luascripts/hf_legic.lua
@@ -582,14 +582,14 @@ function writeToTag(tag)
         -- write pm3-buffer to Tag
         for i=1, WriteBytes do
             if (i > 7) then
-                cmd = ("hf legic wrbl o %02x d %s "):format(i-1, padString(bytes[i]))
+                cmd = ("hf legic wrbl -o %d -d %s "):format(i-1, padString(bytes[i]))
                 print(acgreen..cmd..acoff)
                 core.console(cmd)
                 core.clearCommandBuffer()
             elseif (i == 7) then
                 if (writeDCF) then
                     -- write DCF in reverse order (requires 'mosci-patch')
-                    cmd = ('hf legic wrbl o 05 d %s%s'):format(padString(bytes[i-1]), padString(bytes[i]))
+                    cmd = ('hf legic wrbl -o 5 -d %s%s'):format(padString(bytes[i-1]), padString(bytes[i]))
                     print(acgreen..cmd..acoff)
                     core.console(cmd)
                     core.clearCommandBuffer()
diff --git a/client/src/cmdhflegic.c b/client/src/cmdhflegic.c
index b9f34d362..a09946d43 100644
--- a/client/src/cmdhflegic.c
+++ b/client/src/cmdhflegic.c
@@ -28,20 +28,6 @@ static int CmdHelp(const char *Cmd);
 
 #define MAX_LENGTH 1024
 
-static int usage_legic_wrbl(void) {
-    PrintAndLogEx(NORMAL, "Write data to a LEGIC Prime tag. It autodetects tagsize to make sure size\n");
-    PrintAndLogEx(NORMAL, "Usage:  hf legic wrbl [h] [o <offset>] [d <data (hex symbols)>] [y]\n");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h             : this help");
-    PrintAndLogEx(NORMAL, "      o <offset>    : (hex) offset in data array to start writing");
-    //PrintAndLogEx(NORMAL, "  <IV>          : (optional) Initialization vector to use (ODD and 7bits)");
-    PrintAndLogEx(NORMAL, "      d <data>      : (hex symbols) bytes to write ");
-    PrintAndLogEx(NORMAL, "      y             : Auto-confirm dangerous operations ");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf legic wrbl o 10 d 11223344    - Write 0x11223344 starting from offset 0x10"));
-    return PM3_SUCCESS;
-}
 static int usage_legic_reader(void) {
     PrintAndLogEx(NORMAL, "Read UID and type information from a LEGIC Prime tag\n");
     PrintAndLogEx(NORMAL, "Usage:  hf legic reader [h]\n");
@@ -588,94 +574,37 @@ static int CmdLegicSim(const char *Cmd) {
 }
 
 static int CmdLegicWrbl(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf legic wrbl",
+                  "Write data to a LEGIC Prime tag. It autodetects tagsize to ensure proper write",
+                  "hf legic wrbl -o 0 -d 11223344  <- Write 0x11223344 starting from offset 0)\n"
+                  "hf legic wrbl -o 10 -d DEADBEEF  <- Write 0xdeadbeef starting from offset 10");
 
-    uint8_t *data = NULL;
-    uint8_t cmdp = 0;
-    bool errors = false;
-    bool autoconfirm = false;
-    int len = 0, bg, en;
-    uint32_t offset = 0, IV = 0x55;
+    void *argtable[] = {
+        arg_param_begin,
+        arg_int1("o", "offset", "<dec>", "offset in data array to start writing"),
+        arg_str1("d", "data", "<hex>", "data to write"),
+        arg_lit0(NULL, "danger", "Auto-confirm dangerous operations"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h': {
-                errors = true;
-                break;
-            }
-            case 'd': {
-                // peek at length of the input string so we can
-                // figure out how many elements to malloc in "data"
-                bg = en = 0;
-                if (param_getptr(Cmd, &bg, &en, cmdp + 1)) {
-                    errors = true;
-                    break;
-                }
-                len = (en - bg + 1);
+    int offset = arg_get_int_def(ctx, 1, 0);
 
-                // check that user entered even number of characters
-                // for hex data string
-                if (len & 1) {
-                    errors = true;
-                    break;
-                }
+    int data_len = 0;
+    uint8_t data[MAX_LENGTH] = {0};
 
-                // limit number of bytes to write. This is not a 'restore' command.
-                if ((len >> 1) > 100) {
-                    PrintAndLogEx(WARNING, "Max bound on 100bytes to write a one time.");
-                    PrintAndLogEx(WARNING, "Use the 'hf legic restore' command if you want to write the whole tag at once");
-                    errors = true;
-                }
+    CLIGetHexWithReturn(ctx, 2, data, &data_len);
 
-                // it's possible for user to accidentally enter "b" parameter
-                // more than once - we have to clean previous malloc
-                if (data)
-                    free(data);
+    bool autoconfirm = arg_get_lit(ctx, 3);
 
-                data = calloc(len >> 1, sizeof(uint8_t));
-                if (data == NULL) {
-                    PrintAndLogEx(WARNING, "Can't allocate memory. exiting");
-                    errors = true;
-                    break;
-                }
+    CLIParserFree(ctx);
 
-                if (param_gethex(Cmd, cmdp + 1, data, len)) {
-                    errors = true;
-                    break;
-                }
-
-                len >>= 1;
-                cmdp += 2;
-                break;
-            }
-            case 'o': {
-                offset = param_get32ex(Cmd, cmdp + 1, 4, 16);
-                cmdp += 2;
-                break;
-            }
-            case 'y': {
-                autoconfirm = true;
-                break;
-            }
-            default: {
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-            }
-        }
-    }
-
-    //Validations
-    if (errors || cmdp == 0) {
-        if (data)
-            free(data);
-        return usage_legic_wrbl();
-    }
+    uint32_t IV = 0x55;
 
     // OUT-OF-BOUNDS checks
     // UID 4+1 bytes can't be written to.
     if (offset < 5) {
-        if (data)
-            free(data);
         PrintAndLogEx(WARNING, "Out-of-bounds, bytes 0-1-2-3-4 can't be written to. Offset = %d", offset);
         return PM3_EOUTOFBOUND;
     }
@@ -689,8 +618,8 @@ static int CmdLegicWrbl(const char *Cmd) {
 
     legic_print_type(card.cardsize, 0);
 
-    if (len + offset > card.cardsize) {
-        PrintAndLogEx(WARNING, "Out-of-bounds, Cardsize = %d, [offset+len = %d ]", card.cardsize, len + offset);
+    if (data_len + offset > card.cardsize) {
+        PrintAndLogEx(WARNING, "Out-of-bounds, Cardsize = %d, [offset+len = %d ]", card.cardsize, data_len + offset);
         return PM3_EOUTOFBOUND;
     }
 
@@ -725,7 +654,7 @@ static int CmdLegicWrbl(const char *Cmd) {
 
     PacketResponseNG resp;
     clearCommandBuffer();
-    SendCommandOLD(CMD_HF_LEGIC_WRITER, offset, len, IV, data, len);
+    SendCommandOLD(CMD_HF_LEGIC_WRITER, offset, data_len, IV, data, data_len);
 
     uint8_t timeout = 0;
     while (!WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 274dfe81e..d181f93e6 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -82,7 +82,6 @@ hf legic reader
 hf legic info
 hf legic dump
 hf legic restore
-hf legic wrbl
 hf legic eload
 hf legic esave
 hf legic wipe

From a51c45168e8489a44ac558c74c4f6ebdc7f73ae2 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 20 Dec 2020 21:20:47 -0500
Subject: [PATCH 166/682] hf legic info - now use cliparser

---
 client/src/cmdhflegic.c | 21 +++++++++------------
 doc/cliparser_todo.txt  |  1 -
 2 files changed, 9 insertions(+), 13 deletions(-)

diff --git a/client/src/cmdhflegic.c b/client/src/cmdhflegic.c
index a09946d43..d53c68e5e 100644
--- a/client/src/cmdhflegic.c
+++ b/client/src/cmdhflegic.c
@@ -38,16 +38,6 @@ static int usage_legic_reader(void) {
     PrintAndLogEx(NORMAL, _YELLOW_("      hf legic reader"));
     return PM3_SUCCESS;
 }
-static int usage_legic_info(void) {
-    PrintAndLogEx(NORMAL, "Reads information from a LEGIC Prime tag like systemarea, user areas etc\n");
-    PrintAndLogEx(NORMAL, "Usage:  hf legic info [h]\n");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h             : this help");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf legic info"));
-    return PM3_SUCCESS;
-}
 static int usage_legic_dump(void) {
     PrintAndLogEx(NORMAL, "Read all memory from LEGIC Prime MIM22, MIM256, MIM1024");
     PrintAndLogEx(NORMAL, "and saves bin/eml/json dump file");
@@ -146,9 +136,16 @@ static bool legic_xor(uint8_t *data, uint16_t cardsize) {
  *  by Henryk Ploetz and Karsten Nohl at 26c3
  */
 static int CmdLegicInfo(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf legic info",
+                  "Gets information from a LEGIC Prime tag like systemarea, user areas, etc",
+                  "hf legic info");
 
-    char cmdp = tolower(param_getchar(Cmd, 0));
-    if (cmdp == 'h') return usage_legic_info();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
 
     int i = 0, k = 0, segmentNum = 0, segment_len = 0, segment_flag = 0;
     int crc = 0, wrp = 0, wrc = 0;
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index d181f93e6..212029e2c 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -79,7 +79,6 @@ hf felica litesim
 hf felica litedump
 hf fido info
 hf legic reader
-hf legic info
 hf legic dump
 hf legic restore
 hf legic eload

From 7f740c4e3d5b50898aa468081375e84664e2275d Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 20 Dec 2020 21:40:06 -0500
Subject: [PATCH 167/682] hf legic reader - continuous mode and cliparser

---
 client/src/cmdhf.c      |  2 +-
 client/src/cmdhflegic.c | 83 +++++++++++++++++++++++++----------------
 client/src/cmdhflegic.h |  2 +-
 doc/cliparser_todo.txt  |  1 -
 4 files changed, 53 insertions(+), 35 deletions(-)

diff --git a/client/src/cmdhf.c b/client/src/cmdhf.c
index 41f3d0814..4df232637 100644
--- a/client/src/cmdhf.c
+++ b/client/src/cmdhf.c
@@ -111,7 +111,7 @@ int CmdHFSearch(const char *Cmd) {
     PROMPT_CLEARLINE;
     PrintAndLogEx(INPLACE, " Searching for LEGIC tag...");
     if (IfPm3Legicrf()) {
-        if (readLegicUid(false) == PM3_SUCCESS) {
+        if (readLegicUid(false, false) == PM3_SUCCESS) {
             PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("LEGIC Prime tag") " found\n");
             res = PM3_SUCCESS;
         }
diff --git a/client/src/cmdhflegic.c b/client/src/cmdhflegic.c
index d53c68e5e..00eff936d 100644
--- a/client/src/cmdhflegic.c
+++ b/client/src/cmdhflegic.c
@@ -28,16 +28,6 @@ static int CmdHelp(const char *Cmd);
 
 #define MAX_LENGTH 1024
 
-static int usage_legic_reader(void) {
-    PrintAndLogEx(NORMAL, "Read UID and type information from a LEGIC Prime tag\n");
-    PrintAndLogEx(NORMAL, "Usage:  hf legic reader [h]\n");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h             : this help");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf legic reader"));
-    return PM3_SUCCESS;
-}
 static int usage_legic_dump(void) {
     PrintAndLogEx(NORMAL, "Read all memory from LEGIC Prime MIM22, MIM256, MIM1024");
     PrintAndLogEx(NORMAL, "and saves bin/eml/json dump file");
@@ -146,6 +136,7 @@ static int CmdLegicInfo(const char *Cmd) {
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
 
     int i = 0, k = 0, segmentNum = 0, segment_len = 0, segment_flag = 0;
     int crc = 0, wrp = 0, wrc = 0;
@@ -810,12 +801,26 @@ void legic_seteml(uint8_t *src, uint32_t offset, uint32_t numofbytes) {
         SendCommandOLD(CMD_HF_LEGIC_ESET, i, len, 0, src + i, len);
     }
 }
-
 static int CmdLegicReader(const char *Cmd) {
-    char cmdp = tolower(param_getchar(Cmd, 0));
-    if (cmdp == 'h') return usage_legic_reader();
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf legic reader",
+                  "Read UID and type information from a LEGIC Prime tag",
+                  "hf legic reader");
 
-    return readLegicUid(true);
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0("@", NULL, "optional - continuous reader mode"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool cm = arg_get_lit(ctx, 1);
+    CLIParserFree(ctx);
+
+    if (cm) {
+        PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
+    }
+
+    return readLegicUid(cm, true);
 }
 
 static int CmdLegicDump(const char *Cmd) {
@@ -1294,24 +1299,38 @@ int CmdHFLegic(const char *Cmd) {
     return CmdsParse(CommandTable, Cmd);
 }
 
-int readLegicUid(bool verbose) {
+int readLegicUid(bool loop, bool verbose) {
+
+    do {
+        legic_card_select_t card;
+
+        int resp = legic_get_type(&card);
+
+        if (loop) {
+            if (resp != PM3_SUCCESS) {
+                continue;
+            }
+        } else {
+            switch (resp) {
+                case PM3_EINVARG:
+                    return PM3_EINVARG;
+                case PM3_ETIMEOUT:
+                    if (verbose) PrintAndLogEx(WARNING, "command execution time out");
+                    return PM3_ETIMEOUT;
+                case PM3_ESOFT:
+                    if (verbose) PrintAndLogEx(WARNING, "legic card select failed");
+                    return PM3_ESOFT;
+                default:
+                    break;
+            }
+        }
+
+        PrintAndLogEx(NORMAL, "");
+        PrintAndLogEx(SUCCESS, " MCD: " _GREEN_("%02X"), card.uid[0]);
+        PrintAndLogEx(SUCCESS, " MSN: " _GREEN_("%s"), sprint_hex(card.uid + 1, sizeof(card.uid) - 1));
+        legic_print_type(card.cardsize, 0);
+
+    } while (loop && kbd_enter_pressed() == false);
 
-    legic_card_select_t card;
-    switch (legic_get_type(&card)) {
-        case PM3_EINVARG:
-            return PM3_EINVARG;
-        case PM3_ETIMEOUT:
-            if (verbose) PrintAndLogEx(WARNING, "command execution time out");
-            return PM3_ETIMEOUT;
-        case PM3_ESOFT:
-            if (verbose) PrintAndLogEx(WARNING, "legic card select failed");
-            return PM3_ESOFT;
-        default:
-            break;
-    }
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(SUCCESS, " MCD: " _GREEN_("%02X"), card.uid[0]);
-    PrintAndLogEx(SUCCESS, " MSN: " _GREEN_("%s"), sprint_hex(card.uid + 1, sizeof(card.uid) - 1));
-    legic_print_type(card.cardsize, 0);
     return PM3_SUCCESS;
 }
diff --git a/client/src/cmdhflegic.h b/client/src/cmdhflegic.h
index 9e9411a33..379ae13c7 100644
--- a/client/src/cmdhflegic.h
+++ b/client/src/cmdhflegic.h
@@ -17,7 +17,7 @@
 
 int CmdHFLegic(const char *Cmd);
 
-int readLegicUid(bool verbose);
+int readLegicUid(bool loop, bool verbose);
 int legic_print_type(uint32_t tagtype, uint8_t spaces);
 int legic_get_type(legic_card_select_t *card);
 void legic_chk_iv(uint32_t *iv);
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 212029e2c..26ee2f34b 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -78,7 +78,6 @@ hf felica resetmode
 hf felica litesim
 hf felica litedump
 hf fido info
-hf legic reader
 hf legic dump
 hf legic restore
 hf legic eload

From 0ce10e18dfb08bb1295103a37aa62b3edc04636e Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 21 Dec 2020 12:55:36 +0100
Subject: [PATCH 168/682] textual

---
 client/src/cmdhf.c | 2 +-
 client/src/cmdlf.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhf.c b/client/src/cmdhf.c
index 11d01e1a3..a5f3c1d8f 100644
--- a/client/src/cmdhf.c
+++ b/client/src/cmdhf.c
@@ -172,7 +172,7 @@ int CmdHFTune(const char *Cmd) {
                   "Continuously measure HF antenna tuning.\n"
                   "Press button or <Enter> to interrupt.",
                   "hf tune\n"
-                  "hf tune --mixed"
+                  "hf tune --mix"
                  );
 
     void *argtable[] = {
diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index bd99f648e..4120959e8 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -238,7 +238,7 @@ static int CmdLFTune(const char *Cmd) {
                   "Continuously measure LF antenna tuning.\n"
                   "Press button or <Enter> to interrupt.",
                   "lf tune\n"
-                  "lf tune --mixed"
+                  "lf tune --mix"
                  );
 
     char q_str[60];

From 85b1a833fc00ecc8f3d18bfca11440c536ec6147 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Mon, 21 Dec 2020 12:17:05 -0500
Subject: [PATCH 169/682] hf legic wipe - now use cliparser

---
 client/src/cmdhflegic.c | 25 +++++++++++--------------
 doc/cliparser_todo.txt  |  1 -
 2 files changed, 11 insertions(+), 15 deletions(-)

diff --git a/client/src/cmdhflegic.c b/client/src/cmdhflegic.c
index 00eff936d..dd4dde731 100644
--- a/client/src/cmdhflegic.c
+++ b/client/src/cmdhflegic.c
@@ -86,17 +86,6 @@ static int usage_legic_esave(void) {
     PrintAndLogEx(NORMAL, _YELLOW_("      hf legic esave 2 f myfile"));
     return PM3_SUCCESS;
 }
-static int usage_legic_wipe(void) {
-    PrintAndLogEx(NORMAL, "Fills a LEGIC Prime tags memory with zeros. From byte7 and to the end");
-    PrintAndLogEx(NORMAL, "It autodetects card type\n");
-    PrintAndLogEx(NORMAL, "Usage:  hf legic wipe [h]\n");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h             : this help");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf legic wipe"));
-    return PM3_SUCCESS;
-}
 
 static bool legic_xor(uint8_t *data, uint16_t cardsize) {
 
@@ -1198,10 +1187,18 @@ static int CmdLegicESave(const char *Cmd) {
 }
 
 static int CmdLegicWipe(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf legic wipe",
+                  "Fills a LEGIC Prime tags memory with zeros. From byte7 and to the end\n"
+                  "It autodetects card type",
+                  "hf legic wipe");
 
-    char cmdp = tolower(param_getchar(Cmd, 0));
-
-    if (cmdp == 'h') return usage_legic_wipe();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
 
     // tagtype
     legic_card_select_t card;
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 30e4578e2..3b636db91 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -78,7 +78,6 @@ hf legic dump
 hf legic restore
 hf legic eload
 hf legic esave
-hf legic wipe
 hf mf darkside
 hf mf nested
 hf mf hardnested

From 2f1408d65980291761c83402d1252c1af5632037 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Mon, 21 Dec 2020 12:41:14 -0500
Subject: [PATCH 170/682] hf legic dump - now use cliparser

---
 client/luascripts/hf_legic.lua |  2 +-
 client/src/cmdhflegic.c        | 75 ++++++++++++----------------------
 doc/cliparser_todo.txt         |  1 -
 3 files changed, 26 insertions(+), 52 deletions(-)

diff --git a/client/luascripts/hf_legic.lua b/client/luascripts/hf_legic.lua
index 744372f83..b8b9931cd 100644
--- a/client/luascripts/hf_legic.lua
+++ b/client/luascripts/hf_legic.lua
@@ -710,7 +710,7 @@ function readFromPM3()
   local tag, bytes, infile
     --infile="legic.temp"
     infile=os.tmpname()
-    core.console("hf legic dump f "..infile)
+    core.console("hf legic dump -f "..infile)
     tag=readFile(infile..".bin")
     os.remove(infile)
     os.remove(infile..".bin")
diff --git a/client/src/cmdhflegic.c b/client/src/cmdhflegic.c
index dd4dde731..09bbdf90b 100644
--- a/client/src/cmdhflegic.c
+++ b/client/src/cmdhflegic.c
@@ -28,22 +28,6 @@ static int CmdHelp(const char *Cmd);
 
 #define MAX_LENGTH 1024
 
-static int usage_legic_dump(void) {
-    PrintAndLogEx(NORMAL, "Read all memory from LEGIC Prime MIM22, MIM256, MIM1024");
-    PrintAndLogEx(NORMAL, "and saves bin/eml/json dump file");
-    PrintAndLogEx(NORMAL, "It autodetects card type.\n");
-    PrintAndLogEx(NORMAL, "Usage:  hf legic dump [h] [x] [f <filename w/o .bin>]\n");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h             : this help");
-    PrintAndLogEx(NORMAL, "      f <filename>  : filename w/o '.bin' to dump bytes");
-    PrintAndLogEx(NORMAL, "      x             : deobfuscate dump data (xor with MCC)");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf legic dump                 - uses UID as filename"));
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf legic dump f myfile"));
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf legic dump x"));
-    return PM3_SUCCESS;
-}
 static int usage_legic_restore(void) {
     PrintAndLogEx(NORMAL, "Reads binary file and it autodetects card type and verifies that the file has the same size");
     PrintAndLogEx(NORMAL, "Then write the data back to card. All bytes except the first 7bytes [UID(4) MCC(1) DCF(2)]\n");
@@ -813,38 +797,29 @@ static int CmdLegicReader(const char *Cmd) {
 }
 
 static int CmdLegicDump(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf legic dump",
+                  "Read all memory from LEGIC Prime MIM22, MIM256, MIM1024 and saves bin/eml/json dump file\n"
+                  "It autodetects card type.",
+                  "hf legic dump                <-- use UID as filename\n"
+                  "hf legic dump -f myfile      <-- use user specified filename\n"
+                  "hf legic dump --deobfuscate  <-- use UID as filename and deobfuscate data");
 
-    int fileNameLen = 0;
-    char filename[FILE_PATH_SIZE] = {0x00};
-    char *fptr = filename;
-    bool errors = false, shall_deobsfuscate = false;
-    uint16_t dumplen;
-    uint8_t cmdp = 0;
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("f", "file", "<filename>", "specify a filename for dump file"),
+        arg_lit0(NULL, "deobfuscate", "deobfuscate dump data (xor with MCC)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_legic_dump();
-            case 'f':
-                fileNameLen = param_getstr(Cmd, cmdp + 1, filename, FILE_PATH_SIZE);
-                if (!fileNameLen)
-                    errors = true;
-                if (fileNameLen > FILE_PATH_SIZE - 5)
-                    fileNameLen = FILE_PATH_SIZE - 5;
-                cmdp += 2;
-                break;
-            case 'x':
-                shall_deobsfuscate = true;
-                cmdp++;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-    //Validations
-    if (errors) return usage_legic_dump();
+    int fnlen = 0;
+    char filename[FILE_PATH_SIZE] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
+
+    bool shall_deobsfuscate = arg_get_lit(ctx, 2);
+
+    CLIParserFree(ctx);
 
     // tagtype
     legic_card_select_t card;
@@ -852,7 +827,7 @@ static int CmdLegicDump(const char *Cmd) {
         PrintAndLogEx(WARNING, "Failed to identify tagtype");
         return PM3_ESOFT;
     }
-    dumplen = card.cardsize;
+    uint16_t dumplen = card.cardsize;
 
     legic_print_type(dumplen, 0);
     PrintAndLogEx(SUCCESS, "Reading tag memory %d b...", dumplen);
@@ -896,10 +871,10 @@ static int CmdLegicDump(const char *Cmd) {
     }
 
     // user supplied filename?
-    if (fileNameLen < 1) {
+    if (fnlen < 1) {
         PrintAndLogEx(INFO, "Using UID as filename");
-        fptr += snprintf(fptr, sizeof(filename), "hf-legic-");
-        FillFileNameByUID(fptr, data, "-dump", 4);
+        strcat(filename, "hf-legic-");
+        FillFileNameByUID(filename, data, "-dump", 4);
     }
 
     if (shall_deobsfuscate) {
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 3b636db91..d78d347aa 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -74,7 +74,6 @@ hf felica resetmode
 hf felica litesim
 hf felica litedump
 hf fido info
-hf legic dump
 hf legic restore
 hf legic eload
 hf legic esave

From ef2dfc8b3b75c7ba1a58256fd344a15732df76b4 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Mon, 21 Dec 2020 12:50:12 -0500
Subject: [PATCH 171/682] hf legic restore - now use cliparser

---
 client/luascripts/hf_legic_clone.lua |  2 +-
 client/src/cmdhflegic.c              | 68 ++++++++--------------------
 doc/cliparser_todo.txt               |  1 -
 3 files changed, 21 insertions(+), 50 deletions(-)

diff --git a/client/luascripts/hf_legic_clone.lua b/client/luascripts/hf_legic_clone.lua
index ec0c78d25..ec651d35c 100644
--- a/client/luascripts/hf_legic_clone.lua
+++ b/client/luascripts/hf_legic_clone.lua
@@ -456,7 +456,7 @@ local function writeToTag(plainBytes)
     -- write data to file
     if (writeOutputBytes(bytes, "hf-legic-UID-dump.bin")) then
         -- write pm3-buffer to Tag
-        cmd = ('hf legic restore f hf-legic-UID-dump')
+        cmd = ('hf legic restore -f hf-legic-UID-dump')
         core.console(cmd)
     end
 end
diff --git a/client/src/cmdhflegic.c b/client/src/cmdhflegic.c
index 09bbdf90b..95b9567a1 100644
--- a/client/src/cmdhflegic.c
+++ b/client/src/cmdhflegic.c
@@ -28,19 +28,6 @@ static int CmdHelp(const char *Cmd);
 
 #define MAX_LENGTH 1024
 
-static int usage_legic_restore(void) {
-    PrintAndLogEx(NORMAL, "Reads binary file and it autodetects card type and verifies that the file has the same size");
-    PrintAndLogEx(NORMAL, "Then write the data back to card. All bytes except the first 7bytes [UID(4) MCC(1) DCF(2)]\n");
-    PrintAndLogEx(NORMAL, "Usage:   hf legic restore [h] [x] [f <filename w/o .bin>]\n");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h             : this help");
-    PrintAndLogEx(NORMAL, "      f <filename>  : filename w/o '.bin' to restore bytes on to card from");
-    PrintAndLogEx(NORMAL, "      x             : obfuscate dump data (xor with MCC)");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf legic restore f myfile"));
-    return PM3_SUCCESS;
-}
 static int usage_legic_eload(void) {
     PrintAndLogEx(NORMAL, "It loads a binary dump into emulator memory\n");
     PrintAndLogEx(NORMAL, "Usage:  hf legic eload [h] [card memory] [f <file name w/o `.bin`>]\n");
@@ -891,44 +878,28 @@ static int CmdLegicDump(const char *Cmd) {
 }
 
 static int CmdLegicRestore(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf legic restore",
+                  "Reads binary file and it autodetects card type and verifies that the file has the same size\n"
+                  "Then write the data back to card. All bytes except the first 7bytes [UID(4) MCC(1) DCF(2)]",
+                  "hf legic restore -f myfile              <-- use user specified filename\n"
+                  "hf legic restore -f myfile --obfuscate  <-- use UID as filename and deobfuscate data");
 
-    char filename[FILE_PATH_SIZE] = {0x00};
-    bool errors = false, shall_obsfuscate = false, have_filename = false;
-    size_t numofbytes;
-    uint8_t cmdp = 0;
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1("f", "file", "<filename>", "specify a filename to restore"),
+        arg_lit0(NULL, "obfuscate", "obfuscate dump data (xor with MCC)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h': {
-                errors = true;
-                break;
-            }
-            case 'f': {
-                if (param_getstr(Cmd, cmdp + 1, filename, FILE_PATH_SIZE) >= FILE_PATH_SIZE) {
-                    PrintAndLogEx(FAILED, "Filename too long");
-                    break;
-                }
-                have_filename = true;
-                cmdp += 2;
-                break;
-            }
-            case 'x': {
-                shall_obsfuscate = true;
-                cmdp++;
-                break;
-            }
-            default: {
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-            }
-        }
-    }
-    if (have_filename == false)
-        errors = true;
+    int fnlen = 0;
+    char filename[FILE_PATH_SIZE] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
 
-    //Validations
-    if (errors || cmdp == 0) return usage_legic_restore();
+    bool shall_obsfuscate = arg_get_lit(ctx, 2);
+
+    CLIParserFree(ctx);
 
     // tagtype
     legic_card_select_t card;
@@ -946,6 +917,7 @@ static int CmdLegicRestore(const char *Cmd) {
         return PM3_EMALLOC;
     }
 
+    size_t numofbytes;
     if (loadFile_safe(filename, ".bin", (void **)&data, &numofbytes) != PM3_SUCCESS) {
         free(data);
         PrintAndLogEx(WARNING, "Error, reading file");
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index d78d347aa..debef93fb 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -74,7 +74,6 @@ hf felica resetmode
 hf felica litesim
 hf felica litedump
 hf fido info
-hf legic restore
 hf legic eload
 hf legic esave
 hf mf darkside

From d4c87945b8fa8b63570033a01275b0ecf7e09c91 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 21 Dec 2020 20:47:17 +0100
Subject: [PATCH 172/682] style & text

---
 client/src/cmdhf14b.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/client/src/cmdhf14b.c b/client/src/cmdhf14b.c
index 80695b980..b27df1914 100644
--- a/client/src/cmdhf14b.c
+++ b/client/src/cmdhf14b.c
@@ -728,12 +728,12 @@ static void print_ct_general_info(void *vcard) {
     memcpy(&card, (iso14b_cts_card_select_t *)vcard, sizeof(iso14b_cts_card_select_t));
 
     uint32_t uid32 = (card.uid[0] | card.uid[1] << 8 | card.uid[2] << 16 | card.uid[3] << 24);
+    PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(SUCCESS, "ASK C-Ticket");
     PrintAndLogEx(SUCCESS, "           UID: " _GREEN_("%s") " ( " _YELLOW_("%010u") " )", sprint_hex(card.uid, sizeof(card.uid)), uid32);
     PrintAndLogEx(SUCCESS, "  Product Code: %02X", card.pc);
     PrintAndLogEx(SUCCESS, " Facility Code: %02X", card.fc);
     PrintAndLogEx(NORMAL, "");
-
 }
 
 // iceman, calypso?
@@ -819,11 +819,9 @@ static bool HF14B_ST_Info(bool verbose, bool do_aid_search) {
 
     print_st_general_info(card.uid, card.uidlen);
 
-   if (do_aid_search) {
-       hf14b_aid_search(verbose);
-   }
-
-
+    if (do_aid_search) {
+        hf14b_aid_search(verbose);
+    }
     return true;
 }
 

From cd972adce5e4682439c159fbe24cfd43e4b4119b Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Mon, 21 Dec 2020 14:50:42 -0500
Subject: [PATCH 173/682] hf legic eload - now use cliparser

---
 client/luascripts/hf_legic_clone.lua |  2 +-
 client/src/cmdhflegic.c              | 99 +++++++++++-----------------
 doc/cliparser_todo.txt               |  1 -
 3 files changed, 38 insertions(+), 64 deletions(-)

diff --git a/client/luascripts/hf_legic_clone.lua b/client/luascripts/hf_legic_clone.lua
index ec651d35c..757d65fa0 100644
--- a/client/luascripts/hf_legic_clone.lua
+++ b/client/luascripts/hf_legic_clone.lua
@@ -530,7 +530,7 @@ local function main(args)
                 res = res .."\ncreated clone_dump from\n\t"..infile.." crc: "..oldcrc.."\ndump_file:"
                 res = res .."\n\t"..outfile.." crc: "..string.sub(newcrc, -2)
                 res = res .."\nyou may load the new file with:"
-                res = res ..ansicolors.yellow.."hf legic eload f "..outfile..ansicolors.reset
+                res = res ..ansicolors.yellow.."hf legic eload -f "..outfile..ansicolors.reset
                 res = res .."\n\nif you don't write to tag immediately ('-w' switch) you will need to recalculate each segmentCRC"
                 res = res .."\nafter writing this dump to a tag!"
                 res = res .."\n\na segmentCRC gets calculated over MCD,MSN0..3, Segment-Header0..3"
diff --git a/client/src/cmdhflegic.c b/client/src/cmdhflegic.c
index 95b9567a1..3a95621e2 100644
--- a/client/src/cmdhflegic.c
+++ b/client/src/cmdhflegic.c
@@ -28,20 +28,6 @@ static int CmdHelp(const char *Cmd);
 
 #define MAX_LENGTH 1024
 
-static int usage_legic_eload(void) {
-    PrintAndLogEx(NORMAL, "It loads a binary dump into emulator memory\n");
-    PrintAndLogEx(NORMAL, "Usage:  hf legic eload [h] [card memory] [f <file name w/o `.bin`>]\n");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h               : this help");
-    PrintAndLogEx(NORMAL, "      [card memory]   : 0 = MIM22");
-    PrintAndLogEx(NORMAL, "                      : 1 = MIM256 (default)");
-    PrintAndLogEx(NORMAL, "                      : 2 = MIM1024");
-    PrintAndLogEx(NORMAL, "      f <filename>    : filename w/o .bin to load");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf legic eload 2 f myfile"));
-    return PM3_SUCCESS;
-}
 static int usage_legic_esave(void) {
     PrintAndLogEx(NORMAL, "It saves bin/eml/json dump file of emulator memory\n");
     PrintAndLogEx(NORMAL, "Usage:  hf legic esave [h] [card memory] f <file name w/o `.bin`>\n");
@@ -978,58 +964,47 @@ static int CmdLegicRestore(const char *Cmd) {
 }
 
 static int CmdLegicELoad(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf legic eload",
+                  "Loads a LEGIC binary dump into emulator memory",
+                  "hf legic eload -f myfile -t 0  <- Simulate Type MIM22\n"
+                  "hf legic eload -f myfile -t 1  <- Simulate Type MIM256 (default)\n"
+                  "hf legic eload -f myfile -t 2  <- Simulate Type MIM1024");
 
-    size_t numofbytes = 256;
-    char filename[FILE_PATH_SIZE] = {0x00};
-    bool errors = false, shall_obsfuscate = false, have_filename = false;
-    uint8_t cmdp = 0;
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1("f", "file", "<filename>", "Specify a filename to restore"),
+        arg_int0("t", "type", "<dec>", "Tag type to simulate."),
+        arg_lit0(NULL, "obfuscate", "Obfuscate dump data (xor with MCC)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h' : {
-                return usage_legic_eload();
-            }
-            case 'f' : {
-                if (param_getstr(Cmd, cmdp + 1, filename, FILE_PATH_SIZE) >= FILE_PATH_SIZE) {
-                    PrintAndLogEx(FAILED, "Filename too long");
-                    break;
-                }
-                have_filename = true;
-                cmdp += 2;
-                break;
-            }
-            case 'x': {
-                shall_obsfuscate = true;
-                cmdp++;
-                break;
-            }
-            case '0' : {
-                numofbytes = 22;
-                cmdp++;
-                break;
-            }
-            case '1' : {
-                numofbytes = 256;
-                cmdp++;
-                break;
-            }
-            case '2' : {
-                numofbytes = 1024;
-                cmdp++;
-                break;
-            }
-            default : {
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-            }
-        }
+    int fnlen = 0;
+    char filename[FILE_PATH_SIZE] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
+
+    size_t numofbytes = 0;
+    
+    switch (arg_get_int_def(ctx, 2, 1)) {
+        case 0:
+            numofbytes = 22;
+            break;
+        case 1:
+            numofbytes = 256;
+            break;
+        case 2:
+            numofbytes = 1024;
+            break;
+        default:
+            PrintAndLogEx(ERR, "Unknown tag type");
+            CLIParserFree(ctx);
+            return PM3_EINVARG;
     }
-    if (have_filename == false)
-        errors = true;
 
-    //Validations
-    if (errors || strlen(Cmd) == 0) return usage_legic_eload();
+    bool shall_obsfuscate = arg_get_lit(ctx, 3);
+
+    CLIParserFree(ctx);
 
     // set up buffer
     uint8_t *data = calloc(numofbytes, sizeof(uint8_t));
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index debef93fb..00bb3781e 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -74,7 +74,6 @@ hf felica resetmode
 hf felica litesim
 hf felica litedump
 hf fido info
-hf legic eload
 hf legic esave
 hf mf darkside
 hf mf nested

From e25a99077e5819b625627447165b7d8f28ce81ea Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 21 Dec 2020 20:50:47 +0100
Subject: [PATCH 174/682] hf search - always turn off field

---
 client/src/cmdhf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhf.c b/client/src/cmdhf.c
index a5f3c1d8f..0f6a351ec 100644
--- a/client/src/cmdhf.c
+++ b/client/src/cmdhf.c
@@ -157,11 +157,11 @@ int CmdHFSearch(const char *Cmd) {
 
     PROMPT_CLEARLINE;
     if (res != PM3_SUCCESS) {
-
         PrintAndLogEx(WARNING, _RED_("No known/supported 13.56 MHz tags found"));
         res = PM3_ESOFT;
     }
 
+    DropField();
     return res;
 }
 

From f1c4be446cf9230c542850efeb7bbab36a7d71e9 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Mon, 21 Dec 2020 15:00:02 -0500
Subject: [PATCH 175/682] hf legic esave - now use cliparser

---
 client/src/cmdhflegic.c | 101 +++++++++++++++++-----------------------
 doc/cliparser_todo.txt  |   1 -
 2 files changed, 42 insertions(+), 60 deletions(-)

diff --git a/client/src/cmdhflegic.c b/client/src/cmdhflegic.c
index 3a95621e2..512f2dd53 100644
--- a/client/src/cmdhflegic.c
+++ b/client/src/cmdhflegic.c
@@ -28,22 +28,6 @@ static int CmdHelp(const char *Cmd);
 
 #define MAX_LENGTH 1024
 
-static int usage_legic_esave(void) {
-    PrintAndLogEx(NORMAL, "It saves bin/eml/json dump file of emulator memory\n");
-    PrintAndLogEx(NORMAL, "Usage:  hf legic esave [h] [card memory] f <file name w/o `.bin`>\n");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h               : this help");
-    PrintAndLogEx(NORMAL, "      [card memory]   : 0 = MIM22");
-    PrintAndLogEx(NORMAL, "                      : 1 = MIM256 (default)");
-    PrintAndLogEx(NORMAL, "                      : 2 = MIM1024");
-    PrintAndLogEx(NORMAL, "      f <filename>    : filename w/o .bin to load");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf legic esave 2              - uses UID as filename"));
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf legic esave 2 f myfile"));
-    return PM3_SUCCESS;
-}
-
 static bool legic_xor(uint8_t *data, uint16_t cardsize) {
 
     if (cardsize <= 22) {
@@ -1032,49 +1016,48 @@ static int CmdLegicELoad(const char *Cmd) {
 }
 
 static int CmdLegicESave(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf legic esave",
+                  "Saves bin/eml/json dump file of emulator memory",
+                  "hf legic esave                 <- uses UID as filename\n"
+                  "hf legic esave -f myfile -t 0  <- Type MIM22\n"
+                  "hf legic esave -f myfile -t 1  <- Type MIM256 (default)\n"
+                  "hf legic esave -f myfile -t 2  <- Type MIM1024");
 
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("f", "file", "<filename>", "Specify a filename to save"),
+        arg_int0("t", "type", "<dec>", "Tag type"),
+        arg_lit0(NULL, "deobfuscate", "De-obfuscate dump data (xor with MCC)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    int fnlen = 0;
     char filename[FILE_PATH_SIZE] = {0};
-    char *fptr = filename;
-    int fileNameLen = 0;
-    size_t numofbytes = 256;
-    bool errors = false, shall_deobsfuscate = false;
-    uint8_t cmdp = 0;
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h' :
-                return usage_legic_esave();
-            case 'f' :
-                fileNameLen = param_getstr(Cmd, cmdp + 1, filename, FILE_PATH_SIZE);
-                if (!fileNameLen)
-                    errors = true;
-                if (fileNameLen > FILE_PATH_SIZE - 5)
-                    fileNameLen = FILE_PATH_SIZE - 5;
-                cmdp += 2;
-                break;
-            case 'x':
-                shall_deobsfuscate = true;
-                cmdp++;
-                break;
-            case '0' :
-                numofbytes = 22;
-                cmdp++;
-                break;
-            case '1' :
-                numofbytes = 256;
-                cmdp++;
-                break;
-            case '2' :
-                numofbytes = 1024;
-                cmdp++;
-                break;
-            default :
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
+    CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
+
+    size_t numofbytes = 0;
+    
+    switch (arg_get_int_def(ctx, 2, 1)) {
+        case 0:
+            numofbytes = 22;
+            break;
+        case 1:
+            numofbytes = 256;
+            break;
+        case 2:
+            numofbytes = 1024;
+            break;
+        default:
+            PrintAndLogEx(ERR, "Unknown tag type");
+            CLIParserFree(ctx);
+            return PM3_EINVARG;
     }
-    //Validations
-    if (errors || strlen(Cmd) == 0) return usage_legic_esave();
+
+    bool shall_deobsfuscate = arg_get_lit(ctx, 3);
+
+    CLIParserFree(ctx);
 
     // set up buffer
     uint8_t *data = calloc(numofbytes, sizeof(uint8_t));
@@ -1092,10 +1075,10 @@ static int CmdLegicESave(const char *Cmd) {
     }
 
     // user supplied filename?
-    if (fileNameLen < 1) {
+    if (fnlen < 1) {
         PrintAndLogEx(INFO, "Using UID as filename");
-        fptr += snprintf(fptr, sizeof(filename), "hf-legic-");
-        FillFileNameByUID(fptr, data, "-dump", 4);
+        strcat(filename, "hf-legic-");
+        FillFileNameByUID(filename, data, "-dump", 4);
     }
 
     if (shall_deobsfuscate) {
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 00bb3781e..daad348a5 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -74,7 +74,6 @@ hf felica resetmode
 hf felica litesim
 hf felica litedump
 hf fido info
-hf legic esave
 hf mf darkside
 hf mf nested
 hf mf hardnested

From fce36effb434489dba67dc12598939b89633fba4 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Mon, 21 Dec 2020 15:01:30 -0500
Subject: [PATCH 176/682] legic style

---
 client/src/cmdhflegic.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhflegic.c b/client/src/cmdhflegic.c
index 512f2dd53..709cf9390 100644
--- a/client/src/cmdhflegic.c
+++ b/client/src/cmdhflegic.c
@@ -969,7 +969,7 @@ static int CmdLegicELoad(const char *Cmd) {
     CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
 
     size_t numofbytes = 0;
-    
+
     switch (arg_get_int_def(ctx, 2, 1)) {
         case 0:
             numofbytes = 22;
@@ -1038,7 +1038,7 @@ static int CmdLegicESave(const char *Cmd) {
     CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
 
     size_t numofbytes = 0;
-    
+
     switch (arg_get_int_def(ctx, 2, 1)) {
         case 0:
             numofbytes = 22;

From c3cc3b2a80a12aae82c2a82b57a0ebdcb888f0c9 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 22 Dec 2020 02:22:28 +0300
Subject: [PATCH 177/682] emrtd: split lds tag det to a different func and
 improve emrtd_lds_get_data_by_tag

---
 client/src/cmdhfemrtd.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 30eb4667f..1aa6079ad 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -622,8 +622,15 @@ static int emrtd_read_file(uint8_t *dataout, int *dataoutlen, uint8_t *kenc, uin
     return true;
 }
 
+static int emrtd_lds_determine_tag_length(uint8_t tag) {
+    if ((tag == 0x5F) || (tag == 0x7F)) {
+        return 2;
+    }
+    return 1;
+}
+
 static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int datainlen, uint8_t *dataout, int *dataoutlen, int tag1, int tag2, bool twobytetag) {
-    int offset = 1;
+    int offset = emrtd_lds_determine_tag_length(*datain);
     offset += emrtd_get_asn1_field_length(datain, datainlen, offset);
 
     int e_idlen = 0;
@@ -632,11 +639,7 @@ static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int datainlen, uint8_t *d
     while (offset < datainlen) {
         PrintAndLogEx(DEBUG, "emrtd_lds_get_data_by_tag, offset: %i, data: %X", offset, *(datain + offset));
         // Determine element ID length to set as offset on asn1datalength
-        if ((*(datain + offset) == 0x5F) || (*(datain + offset) == 0x7F)) {
-            e_idlen = 2;
-        } else {
-            e_idlen = 1;
-        }
+        e_idlen = emrtd_lds_determine_tag_length(*(datain + offset));
 
         // Get the length of the element
         e_datalen = emrtd_get_asn1_data_length(datain + offset, datainlen - offset, e_idlen);

From a05bdecaaf41ba201e571d3ee667123efe3c72d5 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 22 Dec 2020 02:28:37 +0300
Subject: [PATCH 178/682] emrtd: make top tag skipping on
 emrtd_lds_get_data_by_tag optional

---
 client/src/cmdhfemrtd.c | 32 ++++++++++++++++++--------------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 1aa6079ad..e31c326fa 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -629,9 +629,13 @@ static int emrtd_lds_determine_tag_length(uint8_t tag) {
     return 1;
 }
 
-static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int datainlen, uint8_t *dataout, int *dataoutlen, int tag1, int tag2, bool twobytetag) {
-    int offset = emrtd_lds_determine_tag_length(*datain);
-    offset += emrtd_get_asn1_field_length(datain, datainlen, offset);
+static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int datainlen, uint8_t *dataout, int *dataoutlen, int tag1, int tag2, bool twobytetag, bool skiptoptag) {
+    int offset = 0;
+
+    if (skiptoptag) {
+        offset += emrtd_lds_determine_tag_length(*datain);
+        offset += emrtd_get_asn1_field_length(datain, datainlen, offset);
+    }
 
     int e_idlen = 0;
     int e_datalen = 0;
@@ -714,7 +718,7 @@ static int emrtd_dump_ef_dg5(uint8_t *file_contents, size_t file_length) {
     int datalen = 0;
 
     // If we can't find image in EF_DG5, return false.
-    if (emrtd_lds_get_data_by_tag(file_contents, file_length, data, &datalen, 0x5F, 0x40, true) == false) {
+    if (emrtd_lds_get_data_by_tag(file_contents, file_length, data, &datalen, 0x5F, 0x40, true, true) == false) {
         return PM3_ESOFT;
     }
 
@@ -732,7 +736,7 @@ static int emrtd_dump_ef_dg7(uint8_t *file_contents, size_t file_length) {
     int datalen = 0;
 
     // If we can't find image in EF_DG7, return false.
-    if (emrtd_lds_get_data_by_tag(file_contents, file_length, data, &datalen, 0x5F, 0x42, true) == false) {
+    if (emrtd_lds_get_data_by_tag(file_contents, file_length, data, &datalen, 0x5F, 0x42, true, true) == false) {
         return PM3_ESOFT;
     }
 
@@ -998,7 +1002,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     uint8_t filelist[50];
     int filelistlen = 0;
 
-    if (!emrtd_lds_get_data_by_tag(response, resplen, filelist, &filelistlen, 0x5c, 0x00, false)) {
+    if (!emrtd_lds_get_data_by_tag(response, resplen, filelist, &filelistlen, 0x5c, 0x00, false, true)) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
         DropField();
         return PM3_ESOFT;
@@ -1224,7 +1228,7 @@ static void emrtd_print_unknown_timestamp_5f85(uint8_t *data) {
 static int emrtd_print_ef_com_info(uint8_t *data, size_t datalen) {
     uint8_t filelist[50];
     int filelistlen = 0;
-    int res = emrtd_lds_get_data_by_tag(data, datalen, filelist, &filelistlen, 0x5c, 0x00, false);
+    int res = emrtd_lds_get_data_by_tag(data, datalen, filelist, &filelistlen, 0x5c, 0x00, false, true);
     if (!res) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
         return PM3_ESOFT;
@@ -1255,7 +1259,7 @@ static int emrtd_print_ef_dg1_info(uint8_t *data, size_t datalen) {
     char mrz[90] = { 0x00 };
     int mrzlen = 0;
 
-    if (!emrtd_lds_get_data_by_tag(data, datalen, (uint8_t *) mrz, &mrzlen, 0x5f, 0x1f, true)) {
+    if (!emrtd_lds_get_data_by_tag(data, datalen, (uint8_t *) mrz, &mrzlen, 0x5f, 0x1f, true, true)) {
         PrintAndLogEx(ERR, "Failed to read MRZ from EF_DG1.");
         return PM3_ESOFT;
     }
@@ -1337,13 +1341,13 @@ static int emrtd_print_ef_dg11_info(uint8_t *data, size_t datalen) {
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_DG11") " -------------------");
 
-    if (!emrtd_lds_get_data_by_tag(data, datalen, taglist, &taglistlen, 0x5c, 0x00, false)) {
+    if (!emrtd_lds_get_data_by_tag(data, datalen, taglist, &taglistlen, 0x5c, 0x00, false, true)) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_DG11.");
         return PM3_ESOFT;
     }
 
     for (int i = 0; i < taglistlen; i++) {
-        emrtd_lds_get_data_by_tag(data, datalen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f);
+        emrtd_lds_get_data_by_tag(data, datalen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f, true);
         // Don't bother with empty tags
         if (tagdatalen == 0) {
             continue;
@@ -1416,13 +1420,13 @@ static int emrtd_print_ef_dg12_info(uint8_t *data, size_t datalen) {
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_DG12") " -------------------");
 
-    if (!emrtd_lds_get_data_by_tag(data, datalen, taglist, &taglistlen, 0x5c, 0x00, false)) {
+    if (!emrtd_lds_get_data_by_tag(data, datalen, taglist, &taglistlen, 0x5c, 0x00, false, true)) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_DG12.");
         return PM3_ESOFT;
     }
 
     for (int i = 0; i < taglistlen; i++) {
-        emrtd_lds_get_data_by_tag(data, datalen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f);
+        emrtd_lds_get_data_by_tag(data, datalen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f, true);
         // Don't bother with empty tags
         if (tagdatalen == 0) {
             continue;
@@ -1524,7 +1528,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     uint8_t filelist[50];
     int filelistlen = 0;
 
-    if (!emrtd_lds_get_data_by_tag(response, resplen, filelist, &filelistlen, 0x5c, 0x00, false)) {
+    if (!emrtd_lds_get_data_by_tag(response, resplen, filelist, &filelistlen, 0x5c, 0x00, false, true)) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
         DropField();
         return PM3_ESOFT;
@@ -1574,7 +1578,7 @@ int infoHF_EMRTD_offline(const char *path) {
 
     uint8_t filelist[50];
     int filelistlen = 0;
-    res = emrtd_lds_get_data_by_tag(data, datalen, filelist, &filelistlen, 0x5c, 0x00, false);
+    res = emrtd_lds_get_data_by_tag(data, datalen, filelist, &filelistlen, 0x5c, 0x00, false, true);
     if (!res) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
         free(data);

From 8c1e4168cfe2a81c54aa62f93f634751092d9665 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 22 Dec 2020 02:30:26 +0300
Subject: [PATCH 179/682] emrtd: make style pass

---
 client/src/cmdhfemrtd.c | 43 ++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 22 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index e31c326fa..d0b3527af 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -61,7 +61,7 @@ static int emrtd_print_ef_dg12_info(uint8_t *data, size_t datalen);
 static int emrtd_print_ef_sod_info(uint8_t *data, size_t datalen);
 
 typedef enum  { // list must match dg_table
-    EF_COM=0,
+    EF_COM = 0,
     EF_DG1,
     EF_DG2,
     EF_DG3,
@@ -109,7 +109,7 @@ static emrtd_dg_t dg_table[] = {
 };
 
 static emrtd_dg_t *emrtd_tag_to_dg(uint8_t tag) {
-    for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
+    for (int dgi = 0; dg_table[dgi].filename != NULL; dgi++) {
         if (dg_table[dgi].tag == tag) {
             return &dg_table[dgi];
         }
@@ -117,7 +117,7 @@ static emrtd_dg_t *emrtd_tag_to_dg(uint8_t tag) {
     return NULL;
 }
 static emrtd_dg_t *emrtd_fileid_to_dg(const char *file_id) {
-    for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
+    for (int dgi = 0; dg_table[dgi].filename != NULL; dgi++) {
         if (strcmp(dg_table[dgi].fileid, file_id) == 0) {
             return &dg_table[dgi];
         }
@@ -698,7 +698,7 @@ static int emrtd_dump_ef_dg2(uint8_t *file_contents, size_t file_length) {
     // Note: Doing file_length - 6 to account for the longest data we're checking.
     for (offset = 0; offset < file_length - 6; offset++) {
         if ((file_contents[offset] == 0xFF && file_contents[offset + 1] == 0xD8 && file_contents[offset + 2] == 0xFF && file_contents[offset + 3] == 0xE0) ||
-            (file_contents[offset] == 0x00 && file_contents[offset + 1] == 0x00 && file_contents[offset + 2] == 0x00 && file_contents[offset + 3] == 0x0C && file_contents[offset + 4] == 0x6A && file_contents[offset + 5] == 0x50)) {
+                (file_contents[offset] == 0x00 && file_contents[offset + 1] == 0x00 && file_contents[offset + 2] == 0x00 && file_contents[offset + 3] == 0x0C && file_contents[offset + 4] == 0x6A && file_contents[offset + 5] == 0x50)) {
             datalen = file_length - offset;
             break;
         }
@@ -752,7 +752,7 @@ static int emrtd_dump_ef_dg7(uint8_t *file_contents, size_t file_length) {
 static int emrtd_dump_ef_sod(uint8_t *file_contents, size_t file_length) {
     int fieldlen = emrtd_get_asn1_field_length(file_contents, file_length, 1);
     int datalen = emrtd_get_asn1_data_length(file_contents, file_length, 1);
-    
+
     if (fieldlen + 1 > EMRTD_MAX_FILE_SIZE) {
         PrintAndLogEx(ERR, "error (emrtd_dump_ef_sod) fieldlen out-of-bounds");
         return PM3_SUCCESS;
@@ -773,7 +773,7 @@ static bool emrtd_dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, cons
     PrintAndLogEx(INFO, "Read %s, len: %i.", name, resplen);
     PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
     saveFile(name, ".BIN", response, resplen);
-    emrtd_dg_t * dg = emrtd_fileid_to_dg(file);
+    emrtd_dg_t *dg = emrtd_fileid_to_dg(file);
     if ((dg != NULL) && (dg->dumper != NULL)) {
         dg->dumper(response, resplen);
     }
@@ -785,7 +785,7 @@ static void rng(int length, uint8_t *dataout) {
     //for (int i = 0; i < (length / 4); i++) {
     //    num_to_bytes(prng_successor(msclock() + i, 32), 4, &dataout[i * 4]);
     //}
-    memset(dataout, 0x00, length);   
+    memset(dataout, 0x00, length);
 }
 
 static bool emrtd_do_bac(char *documentnumber, char *dob, char *expiry, uint8_t *ssc, uint8_t *ks_enc, uint8_t *ks_mac, bool use_14b) {
@@ -1013,7 +1013,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     filelist[filelistlen++] = 0x77;
     // Dump all files in the file list
     for (int i = 0; i < filelistlen; i++) {
-        emrtd_dg_t * dg = emrtd_tag_to_dg(filelist[i]);
+        emrtd_dg_t *dg = emrtd_tag_to_dg(filelist[i]);
         if (dg == NULL) {
             PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
             continue;
@@ -1034,9 +1034,9 @@ static bool emrtd_compare_check_digit(char *datain, int datalen, char expected_c
     uint8_t check_digit = emrtd_calculate_check_digit(tempdata) + 0x30;
     bool res = check_digit == expected_check_digit;
     PrintAndLogEx(DEBUG, "emrtd_compare_check_digit, expected %c == %c calculated ( %s )"
-        , expected_check_digit
-        , check_digit
-        , (res) ? _GREEN_("ok") : _RED_("fail"));
+                  , expected_check_digit
+                  , check_digit
+                  , (res) ? _GREEN_("ok") : _RED_("fail"));
     return res;
 }
 
@@ -1238,7 +1238,7 @@ static int emrtd_print_ef_com_info(uint8_t *data, size_t datalen) {
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_COM") " --------------------");
     for (int i = 0; i < filelistlen; i++) {
-        emrtd_dg_t * dg = emrtd_tag_to_dg(filelist[i]);
+        emrtd_dg_t *dg = emrtd_tag_to_dg(filelist[i]);
         if (dg == NULL) {
             PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
             continue;
@@ -1520,7 +1520,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     }
 
     int res = emrtd_print_ef_com_info(response, resplen);
-    if ( res != PM3_SUCCESS) {
+    if (res != PM3_SUCCESS) {
         DropField();
         return res;
     }
@@ -1537,7 +1537,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     filelist[filelistlen++] = 0x77;
     // Dump all files in the file list
     for (int i = 0; i < filelistlen; i++) {
-        emrtd_dg_t * dg = emrtd_tag_to_dg(filelist[i]);
+        emrtd_dg_t *dg = emrtd_tag_to_dg(filelist[i]);
         if (dg == NULL) {
             PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
             continue;
@@ -1570,7 +1570,7 @@ int infoHF_EMRTD_offline(const char *path) {
     }
 
     int res = emrtd_print_ef_com_info(data, datalen);
-    if ( res != PM3_SUCCESS) {
+    if (res != PM3_SUCCESS) {
         free(data);
         free(filepath);
         return res;
@@ -1590,7 +1590,7 @@ int infoHF_EMRTD_offline(const char *path) {
     filelist[filelistlen++] = 0x77;
     // Read files in the file list
     for (int i = 0; i < filelistlen; i++) {
-        emrtd_dg_t * dg = emrtd_tag_to_dg(filelist[i]);
+        emrtd_dg_t *dg = emrtd_tag_to_dg(filelist[i]);
         if (dg == NULL) {
             PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
             continue;
@@ -1599,8 +1599,7 @@ int infoHF_EMRTD_offline(const char *path) {
             strcpy(filepath, path);
             strncat(filepath, PATHSEP, 2);
             strcat(filepath, dg->filename);
-            if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, false) == PM3_SUCCESS)
-            {
+            if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, false) == PM3_SUCCESS) {
                 // we won't halt on parsing errors
                 if (dg->parser != NULL)
                     dg->parser(data, datalen);
@@ -1669,7 +1668,7 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
             memset(docnum + slen, '<', 9 - slen);
         }
     }
-    
+
     if (CLIParamStrToBuf(arg_get_str(ctx, 2), dob, 6, &slen) != 0 || slen == 0) {
         BAC = false;
     } else {
@@ -1679,7 +1678,7 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
             error = true;
         }
     }
-    
+
     if (CLIParamStrToBuf(arg_get_str(ctx, 3), expiry, 6, &slen) != 0 || slen == 0) {
         BAC = false;
     } else {
@@ -1755,7 +1754,7 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
             memset(docnum + slen, '<', 9 - slen);
         }
     }
-    
+
     if (CLIParamStrToBuf(arg_get_str(ctx, 2), dob, 6, &slen) != 0 || slen == 0) {
         BAC = false;
     } else {
@@ -1765,7 +1764,7 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
             error = true;
         }
     }
-    
+
     if (CLIParamStrToBuf(arg_get_str(ctx, 3), expiry, 6, &slen) != 0 || slen == 0) {
         BAC = false;
     } else {

From 62f60dbfbf13375de988dacbb2b09fda597b546e Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Tue, 22 Dec 2020 00:29:45 +0100
Subject: [PATCH 180/682] utf8 barmode when emoji mode is set

---
 client/src/ui.c | 68 +++++++++++++++++++++++++++++--------------------
 1 file changed, 40 insertions(+), 28 deletions(-)

diff --git a/client/src/ui.c b/client/src/ui.c
index 03ff304b2..e4b873596 100644
--- a/client/src/ui.c
+++ b/client/src/ui.c
@@ -626,46 +626,58 @@ void iceSimple_Filter(int *data, const size_t len, uint8_t k) {
 
 void print_progress(size_t count, uint64_t max, barMode_t style) {
 
-    #define PERCENTAGE(V, T)   (100 - (((T - V) * 100) / T))
+    #define PERCENTAGE(V, T)   ((V * 100) / T)
+    // x/8 fractional part of the percentage
+    #define PERCENTAGEFRAC(V, T)   ((int)(((((float)V * 100) / T) - ((V * 100) / T)) * 8))
 
-/*
-    typedef struct smooth_s {
-        const char *bar;
-    } smooth_t;
-
-    static smooth_t smoothtable[] = {
-        {"\xe2\x96\x8F"},
-        {"\xe2\x96\x8E"},
-        {"\xe2\x96\x8D"},
-        {"\xe2\x96\x8C"},
-        {"\xe2\x96\x8B"},
-        {"\xe2\x96\x8A"},
-        {"\xe2\x96\x89"},
-        {"\xe2\x96\x88"},
+    const char *smoothtable[] = {
+        "\xe2\x80\x80",
+        "\xe2\x96\x8F",
+        "\xe2\x96\x8E",
+        "\xe2\x96\x8D",
+        "\xe2\x96\x8C",
+        "\xe2\x96\x8B",
+        "\xe2\x96\x8A",
+        "\xe2\x96\x89",
+        "\xe2\x96\x88",
     };
-*/
 
+    uint8_t mode = session.emoji_mode == EMOJI;
+    const char *block[] = {"#", "\xe2\x96\x88"};
+    // use a 3-byte space in emoji mode to ease computations
+    const char *space[] = {" ", "\xe2\x80\x80"};
+    uint8_t unit = strlen(block[mode]);
     // +1 for \0
-    char *bar = calloc(100 + 1, sizeof(uint8_t));
+    char *bar = calloc(unit*100 + 1, sizeof(uint8_t));
 
     uint8_t value = PERCENTAGE(count, max);
 
+    int i = 0;
     // prefix is added already.
-    memset(bar + strlen(bar), 0x23, value);
-
+    for (; i < unit*value; i+=unit) {
+        memcpy(bar + i, block[mode], unit);
+    }
+    // add last block
+    if (mode == 1) {
+        memcpy(bar + i, smoothtable[PERCENTAGEFRAC(count, max)], unit);
+    } else {
+        memcpy(bar + i, space[mode], unit);
+    }
+    i += unit;
     // add spaces
-    memset(bar + strlen(bar), 0x2E,  100 - value);
-
+    for (; i < unit*100; i+=unit) {
+        memcpy(bar + i, space[mode], unit);
+    }
     // color buffer
-    uint8_t collen = 100 + 1 + 40;
+    size_t collen = strlen(bar) + 40;
     char *cbar = calloc(collen, sizeof(uint8_t));
 
     // Add colors
-    snprintf(cbar,  collen,  _GREEN_("%.*s"), 60, bar);
-    snprintf(cbar + strlen(cbar), collen - strlen(cbar), _CYAN_("%.*s"), 20,  bar + 60);
-    snprintf(cbar + strlen(cbar), collen - strlen(cbar), _YELLOW_("%.*s"), 20, bar + 80);
+    snprintf(cbar,  collen,  _GREEN_("%.*s"), unit*60, bar);
+    snprintf(cbar + strlen(cbar), collen - strlen(cbar), _CYAN_("%.*s"), unit*20,  bar + unit*60);
+    snprintf(cbar + strlen(cbar), collen - strlen(cbar), _YELLOW_("%.*s"), unit*20, bar + unit*80);
 
-    uint8_t len = collen + 1 + 1 + 30;
+    size_t len = strlen(cbar) + 32;
     char *buffer = calloc(len, sizeof(uint8_t));
 
     switch(style) {
@@ -685,8 +697,8 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
         }
     }
 
-	fflush(stdout);
-	free(buffer);
+    fflush(stdout);
+    free(buffer);
     free(bar);
     free(cbar);
 }

From b505c5f4d8e7823c3a2c474e63e375412ec57505 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 22 Dec 2020 05:01:42 +0300
Subject: [PATCH 181/682] emrtd: Read file hash data from EF_SOD

---
 client/src/cmdhfemrtd.c | 76 ++++++++++++++++++++++++++++++++++++-----
 1 file changed, 68 insertions(+), 8 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index d0b3527af..4e3bfc575 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -203,9 +203,9 @@ static char emrtd_calculate_check_digit(char *data) {
 }
 
 static int emrtd_get_asn1_data_length(uint8_t *datain, int datainlen, int offset) {
-    PrintAndLogEx(DEBUG, "asn1datalength, datain: %s", sprint_hex_inrow(datain, datainlen));
+    PrintAndLogEx(DEBUG, "asn1 datalength, datain: %s", sprint_hex_inrow(datain, datainlen));
     int lenfield = (int) * (datain + offset);
-    PrintAndLogEx(DEBUG, "asn1datalength, lenfield: %i", lenfield);
+    PrintAndLogEx(DEBUG, "asn1 datalength, lenfield: %02X", lenfield);
     if (lenfield <= 0x7f) {
         return lenfield;
     } else if (lenfield == 0x81) {
@@ -221,7 +221,7 @@ static int emrtd_get_asn1_data_length(uint8_t *datain, int datainlen, int offset
 static int emrtd_get_asn1_field_length(uint8_t *datain, int datainlen, int offset) {
     PrintAndLogEx(DEBUG, "asn1 fieldlength, datain: %s", sprint_hex_inrow(datain, datainlen));
     int lenfield = (int) * (datain + offset);
-    PrintAndLogEx(DEBUG, "asn1 fieldlength, thing: %i", lenfield);
+    PrintAndLogEx(DEBUG, "asn1 fieldlength, lenfield: %02X", lenfield);
     if (lenfield <= 0x7F) {
         return 1;
     } else if (lenfield == 0x81) {
@@ -629,10 +629,10 @@ static int emrtd_lds_determine_tag_length(uint8_t tag) {
     return 1;
 }
 
-static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int datainlen, uint8_t *dataout, int *dataoutlen, int tag1, int tag2, bool twobytetag, bool skiptoptag) {
+static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int datainlen, uint8_t *dataout, int *dataoutlen, int tag1, int tag2, bool twobytetag, bool entertoptag) {
     int offset = 0;
 
-    if (skiptoptag) {
+    if (entertoptag) {
         offset += emrtd_lds_determine_tag_length(*datain);
         offset += emrtd_get_asn1_field_length(datain, datainlen, offset);
     }
@@ -651,6 +651,8 @@ static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int datainlen, uint8_t *d
         // Get the length of the element's length
         e_fieldlen = emrtd_get_asn1_field_length(datain + offset, datainlen - offset, e_idlen);
 
+        PrintAndLogEx(DEBUG, "emrtd_lds_get_data_by_tag, e_idlen: %02X, e_datalen: %02X, e_fieldlen: %02X", e_idlen, e_datalen, e_fieldlen);
+
         // If the element is what we're looking for, get the data and return true
         if (*(datain + offset) == tag1 && (!twobytetag || *(datain + offset + 1) == tag2)) {
             if (datainlen > e_datalen) {
@@ -1477,10 +1479,68 @@ static int emrtd_print_ef_dg12_info(uint8_t *data, size_t datalen) {
     return PM3_SUCCESS;
 }
 
+static int emrtd_ef_sod_extract_signatures(uint8_t *data, size_t datalen, uint8_t *dataout, size_t *dataoutlen) {
+    // very very very very cursed code.
+    uint8_t top[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    uint8_t signeddata[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    uint8_t emrtdsigcontainer[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    uint8_t emrtdsig[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    uint8_t emrtdsigtext[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    size_t toplen, signeddatalen, emrtdsigcontainerlen, emrtdsiglen, emrtdsigtextlen = 0;
+
+    if (!emrtd_lds_get_data_by_tag(data, (int) datalen, top, (int *) &toplen, 0x30, 0x00, false, true)) {
+        PrintAndLogEx(ERR, "Failed to read top from EF_SOD.");
+        return false;
+    }
+
+    PrintAndLogEx(DEBUG, "top: %s.", sprint_hex_inrow(top, toplen));
+
+    if (!emrtd_lds_get_data_by_tag(top, (int) toplen, signeddata, (int *) &signeddatalen, 0xA0, 0x00, false, false)) {
+        PrintAndLogEx(ERR, "Failed to read signedData from EF_SOD.");
+        return false;
+    }
+
+    PrintAndLogEx(DEBUG, "signeddata: %s.", sprint_hex_inrow(signeddata, signeddatalen));
+
+    // Do true on reading into the tag as it's a "sequence"
+    if (!emrtd_lds_get_data_by_tag(signeddata, (int) signeddatalen, emrtdsigcontainer, (int *) &emrtdsigcontainerlen, 0x30, 0x00, false, true)) {
+        PrintAndLogEx(ERR, "Failed to read eMRTDSignature container from EF_SOD.");
+        return false;
+    }
+
+    PrintAndLogEx(DEBUG, "emrtdsigcontainer: %s.", sprint_hex_inrow(emrtdsigcontainer, emrtdsigcontainerlen));
+
+    if (!emrtd_lds_get_data_by_tag(emrtdsigcontainer, (int) emrtdsigcontainerlen, emrtdsig, (int *) &emrtdsiglen, 0xA0, 0x00, false, false)) {
+        PrintAndLogEx(ERR, "Failed to read eMRTDSignature from EF_SOD.");
+        return false;
+    }
+
+    PrintAndLogEx(DEBUG, "emrtdsig: %s.", sprint_hex_inrow(emrtdsig, emrtdsiglen));
+
+    // TODO: Not doing memcpy here, it didn't work, fix it somehow
+    if (!emrtd_lds_get_data_by_tag(emrtdsig, (int) emrtdsiglen, emrtdsigtext, (int *) &emrtdsigtextlen, 0x04, 0x00, false, false)) {
+        PrintAndLogEx(ERR, "Failed to read eMRTDSignature (text) from EF_SOD.");
+        return false;
+    }
+    memcpy(dataout, emrtdsigtext, emrtdsigtextlen);
+    *dataoutlen = emrtdsigtextlen;
+    return PM3_SUCCESS;
+}
+
 static int emrtd_print_ef_sod_info(uint8_t *data, size_t datalen) {
-//    PrintAndLogEx(NORMAL, "");
-//    PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_SOD") " --------------------");
-//    PrintAndLogEx(WARNING, "TODO");
+    uint8_t emrtdsig[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    // size_t emrtdsiglen, e_datalen, e_fieldlen = 0;
+    size_t emrtdsiglen = 0;
+
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_SOD") " --------------------");
+
+    if (emrtd_ef_sod_extract_signatures(data, datalen, emrtdsig, &emrtdsiglen) != PM3_SUCCESS) {
+        return false;
+    }
+    // TODO: parse this
+    PrintAndLogEx(INFO, "hash data: %s", sprint_hex_inrow(emrtdsig, emrtdsiglen));
+
     return PM3_SUCCESS;
 }
 

From f1a8345faccca4e18795c7c9e9fab1ca39a1aa70 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 22 Dec 2020 05:29:37 +0300
Subject: [PATCH 182/682] emrtd: Add a skip feature to
 emrtd_lds_get_data_by_tag

---
 client/src/cmdhfemrtd.c | 39 +++++++++++++++++++++------------------
 1 file changed, 21 insertions(+), 18 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 4e3bfc575..d92dfb19a 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -629,8 +629,9 @@ static int emrtd_lds_determine_tag_length(uint8_t tag) {
     return 1;
 }
 
-static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int datainlen, uint8_t *dataout, int *dataoutlen, int tag1, int tag2, bool twobytetag, bool entertoptag) {
+static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int datainlen, uint8_t *dataout, int *dataoutlen, int tag1, int tag2, bool twobytetag, bool entertoptag, int skiptagcount) {
     int offset = 0;
+    int skipcounter = 0;
 
     if (entertoptag) {
         offset += emrtd_lds_determine_tag_length(*datain);
@@ -655,7 +656,9 @@ static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int datainlen, uint8_t *d
 
         // If the element is what we're looking for, get the data and return true
         if (*(datain + offset) == tag1 && (!twobytetag || *(datain + offset + 1) == tag2)) {
-            if (datainlen > e_datalen) {
+            if (skipcounter < skiptagcount) {
+                skipcounter += 1;
+            } else if (datainlen > e_datalen) {
                 *dataoutlen = e_datalen;
                 memcpy(dataout, datain + offset + e_idlen + e_fieldlen, e_datalen);
                 return true;
@@ -720,7 +723,7 @@ static int emrtd_dump_ef_dg5(uint8_t *file_contents, size_t file_length) {
     int datalen = 0;
 
     // If we can't find image in EF_DG5, return false.
-    if (emrtd_lds_get_data_by_tag(file_contents, file_length, data, &datalen, 0x5F, 0x40, true, true) == false) {
+    if (emrtd_lds_get_data_by_tag(file_contents, file_length, data, &datalen, 0x5F, 0x40, true, true, 0) == false) {
         return PM3_ESOFT;
     }
 
@@ -738,7 +741,7 @@ static int emrtd_dump_ef_dg7(uint8_t *file_contents, size_t file_length) {
     int datalen = 0;
 
     // If we can't find image in EF_DG7, return false.
-    if (emrtd_lds_get_data_by_tag(file_contents, file_length, data, &datalen, 0x5F, 0x42, true, true) == false) {
+    if (emrtd_lds_get_data_by_tag(file_contents, file_length, data, &datalen, 0x5F, 0x42, true, true, 0) == false) {
         return PM3_ESOFT;
     }
 
@@ -1004,7 +1007,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     uint8_t filelist[50];
     int filelistlen = 0;
 
-    if (!emrtd_lds_get_data_by_tag(response, resplen, filelist, &filelistlen, 0x5c, 0x00, false, true)) {
+    if (!emrtd_lds_get_data_by_tag(response, resplen, filelist, &filelistlen, 0x5c, 0x00, false, true, 0)) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
         DropField();
         return PM3_ESOFT;
@@ -1230,7 +1233,7 @@ static void emrtd_print_unknown_timestamp_5f85(uint8_t *data) {
 static int emrtd_print_ef_com_info(uint8_t *data, size_t datalen) {
     uint8_t filelist[50];
     int filelistlen = 0;
-    int res = emrtd_lds_get_data_by_tag(data, datalen, filelist, &filelistlen, 0x5c, 0x00, false, true);
+    int res = emrtd_lds_get_data_by_tag(data, datalen, filelist, &filelistlen, 0x5c, 0x00, false, true, 0);
     if (!res) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
         return PM3_ESOFT;
@@ -1261,7 +1264,7 @@ static int emrtd_print_ef_dg1_info(uint8_t *data, size_t datalen) {
     char mrz[90] = { 0x00 };
     int mrzlen = 0;
 
-    if (!emrtd_lds_get_data_by_tag(data, datalen, (uint8_t *) mrz, &mrzlen, 0x5f, 0x1f, true, true)) {
+    if (!emrtd_lds_get_data_by_tag(data, datalen, (uint8_t *) mrz, &mrzlen, 0x5f, 0x1f, true, true, 0)) {
         PrintAndLogEx(ERR, "Failed to read MRZ from EF_DG1.");
         return PM3_ESOFT;
     }
@@ -1343,13 +1346,13 @@ static int emrtd_print_ef_dg11_info(uint8_t *data, size_t datalen) {
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_DG11") " -------------------");
 
-    if (!emrtd_lds_get_data_by_tag(data, datalen, taglist, &taglistlen, 0x5c, 0x00, false, true)) {
+    if (!emrtd_lds_get_data_by_tag(data, datalen, taglist, &taglistlen, 0x5c, 0x00, false, true, 0)) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_DG11.");
         return PM3_ESOFT;
     }
 
     for (int i = 0; i < taglistlen; i++) {
-        emrtd_lds_get_data_by_tag(data, datalen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f, true);
+        emrtd_lds_get_data_by_tag(data, datalen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f, true, 0);
         // Don't bother with empty tags
         if (tagdatalen == 0) {
             continue;
@@ -1422,13 +1425,13 @@ static int emrtd_print_ef_dg12_info(uint8_t *data, size_t datalen) {
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_DG12") " -------------------");
 
-    if (!emrtd_lds_get_data_by_tag(data, datalen, taglist, &taglistlen, 0x5c, 0x00, false, true)) {
+    if (!emrtd_lds_get_data_by_tag(data, datalen, taglist, &taglistlen, 0x5c, 0x00, false, true, 0)) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_DG12.");
         return PM3_ESOFT;
     }
 
     for (int i = 0; i < taglistlen; i++) {
-        emrtd_lds_get_data_by_tag(data, datalen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f, true);
+        emrtd_lds_get_data_by_tag(data, datalen, tagdata, &tagdatalen, taglist[i], taglist[i + 1], taglist[i] == 0x5f, true, 0);
         // Don't bother with empty tags
         if (tagdatalen == 0) {
             continue;
@@ -1488,14 +1491,14 @@ static int emrtd_ef_sod_extract_signatures(uint8_t *data, size_t datalen, uint8_
     uint8_t emrtdsigtext[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     size_t toplen, signeddatalen, emrtdsigcontainerlen, emrtdsiglen, emrtdsigtextlen = 0;
 
-    if (!emrtd_lds_get_data_by_tag(data, (int) datalen, top, (int *) &toplen, 0x30, 0x00, false, true)) {
+    if (!emrtd_lds_get_data_by_tag(data, (int) datalen, top, (int *) &toplen, 0x30, 0x00, false, true, 0)) {
         PrintAndLogEx(ERR, "Failed to read top from EF_SOD.");
         return false;
     }
 
     PrintAndLogEx(DEBUG, "top: %s.", sprint_hex_inrow(top, toplen));
 
-    if (!emrtd_lds_get_data_by_tag(top, (int) toplen, signeddata, (int *) &signeddatalen, 0xA0, 0x00, false, false)) {
+    if (!emrtd_lds_get_data_by_tag(top, (int) toplen, signeddata, (int *) &signeddatalen, 0xA0, 0x00, false, false, 0)) {
         PrintAndLogEx(ERR, "Failed to read signedData from EF_SOD.");
         return false;
     }
@@ -1503,14 +1506,14 @@ static int emrtd_ef_sod_extract_signatures(uint8_t *data, size_t datalen, uint8_
     PrintAndLogEx(DEBUG, "signeddata: %s.", sprint_hex_inrow(signeddata, signeddatalen));
 
     // Do true on reading into the tag as it's a "sequence"
-    if (!emrtd_lds_get_data_by_tag(signeddata, (int) signeddatalen, emrtdsigcontainer, (int *) &emrtdsigcontainerlen, 0x30, 0x00, false, true)) {
+    if (!emrtd_lds_get_data_by_tag(signeddata, (int) signeddatalen, emrtdsigcontainer, (int *) &emrtdsigcontainerlen, 0x30, 0x00, false, true, 0)) {
         PrintAndLogEx(ERR, "Failed to read eMRTDSignature container from EF_SOD.");
         return false;
     }
 
     PrintAndLogEx(DEBUG, "emrtdsigcontainer: %s.", sprint_hex_inrow(emrtdsigcontainer, emrtdsigcontainerlen));
 
-    if (!emrtd_lds_get_data_by_tag(emrtdsigcontainer, (int) emrtdsigcontainerlen, emrtdsig, (int *) &emrtdsiglen, 0xA0, 0x00, false, false)) {
+    if (!emrtd_lds_get_data_by_tag(emrtdsigcontainer, (int) emrtdsigcontainerlen, emrtdsig, (int *) &emrtdsiglen, 0xA0, 0x00, false, false, 0)) {
         PrintAndLogEx(ERR, "Failed to read eMRTDSignature from EF_SOD.");
         return false;
     }
@@ -1518,7 +1521,7 @@ static int emrtd_ef_sod_extract_signatures(uint8_t *data, size_t datalen, uint8_
     PrintAndLogEx(DEBUG, "emrtdsig: %s.", sprint_hex_inrow(emrtdsig, emrtdsiglen));
 
     // TODO: Not doing memcpy here, it didn't work, fix it somehow
-    if (!emrtd_lds_get_data_by_tag(emrtdsig, (int) emrtdsiglen, emrtdsigtext, (int *) &emrtdsigtextlen, 0x04, 0x00, false, false)) {
+    if (!emrtd_lds_get_data_by_tag(emrtdsig, (int) emrtdsiglen, emrtdsigtext, (int *) &emrtdsigtextlen, 0x04, 0x00, false, false, 0)) {
         PrintAndLogEx(ERR, "Failed to read eMRTDSignature (text) from EF_SOD.");
         return false;
     }
@@ -1588,7 +1591,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     uint8_t filelist[50];
     int filelistlen = 0;
 
-    if (!emrtd_lds_get_data_by_tag(response, resplen, filelist, &filelistlen, 0x5c, 0x00, false, true)) {
+    if (!emrtd_lds_get_data_by_tag(response, resplen, filelist, &filelistlen, 0x5c, 0x00, false, true, 0)) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
         DropField();
         return PM3_ESOFT;
@@ -1638,7 +1641,7 @@ int infoHF_EMRTD_offline(const char *path) {
 
     uint8_t filelist[50];
     int filelistlen = 0;
-    res = emrtd_lds_get_data_by_tag(data, datalen, filelist, &filelistlen, 0x5c, 0x00, false, true);
+    res = emrtd_lds_get_data_by_tag(data, datalen, filelist, &filelistlen, 0x5c, 0x00, false, true, 0);
     if (!res) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
         free(data);

From c3ed99e3883c04a0e0aef09128605cb5adce9a02 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 22 Dec 2020 05:52:48 +0300
Subject: [PATCH 183/682] emrtd: Parse hashes on EF_SOD

---
 client/src/cmdhfemrtd.c | 40 ++++++++++++++++++++++++++++++++++++++--
 1 file changed, 38 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index d92dfb19a..3203b4932 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1532,8 +1532,19 @@ static int emrtd_ef_sod_extract_signatures(uint8_t *data, size_t datalen, uint8_
 
 static int emrtd_print_ef_sod_info(uint8_t *data, size_t datalen) {
     uint8_t emrtdsig[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    uint8_t hashlist[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    uint8_t hash[65] = { 0x00 };
+    size_t hashlen = 0;
+
+    uint8_t hashidstr[4] = { 0x00 };
+    size_t hashidstrlen = 0;
+
     // size_t emrtdsiglen, e_datalen, e_fieldlen = 0;
     size_t emrtdsiglen = 0;
+    size_t hashlistlen = 0;
+    size_t e_datalen = 0;
+    size_t e_fieldlen = 0;
+    size_t offset = 0;
 
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_SOD") " --------------------");
@@ -1541,8 +1552,33 @@ static int emrtd_print_ef_sod_info(uint8_t *data, size_t datalen) {
     if (emrtd_ef_sod_extract_signatures(data, datalen, emrtdsig, &emrtdsiglen) != PM3_SUCCESS) {
         return false;
     }
-    // TODO: parse this
-    PrintAndLogEx(INFO, "hash data: %s", sprint_hex_inrow(emrtdsig, emrtdsiglen));
+
+    PrintAndLogEx(DEBUG, "hash data: %s", sprint_hex_inrow(emrtdsig, emrtdsiglen));
+
+    if (!emrtd_lds_get_data_by_tag(emrtdsig, (int) emrtdsiglen, hashlist, (int *) &hashlistlen, 0x30, 0x00, false, true, 1)) {
+        PrintAndLogEx(ERR, "Failed to read hash list from EF_SOD.");
+        return false;
+    }
+
+    PrintAndLogEx(DEBUG, "hash list: %s", sprint_hex_inrow(hashlist, hashlistlen));
+
+    while (offset < hashlistlen) {
+        // Get the length of the element
+        e_datalen = emrtd_get_asn1_data_length(hashlist + offset, hashlistlen - offset, 1);
+
+        // Get the length of the element's length
+        e_fieldlen = emrtd_get_asn1_field_length(hashlist + offset, hashlistlen - offset, 1);
+
+        switch (hashlist[offset]) {
+            case 0x30:
+                emrtd_lds_get_data_by_tag(hashlist + offset + e_fieldlen + 1, (int) e_datalen, hashidstr, (int *) &hashidstrlen, 0x02, 0x00, false, false, 0);
+                emrtd_lds_get_data_by_tag(hashlist + offset + e_fieldlen + 1, (int) e_datalen, hash, (int *) &hashlen, 0x04, 0x00, false, false, 0);
+                PrintAndLogEx(SUCCESS, "Hash for EF_DG%i: %s", hashidstr[0], sprint_hex_inrow(hash, hashlen));
+                break;
+        }
+        // + 1 for length of ID
+        offset += 1 + e_datalen + e_fieldlen;
+    }
 
     return PM3_SUCCESS;
 }

From 69e5f8daa5a613f99bddf3296aacc53457e2dc61 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 22 Dec 2020 22:56:57 +0100
Subject: [PATCH 184/682] update the readline to 8.1 and curses to 6.1.  The
 later version 6.2 fails when cross compiling.  Thanks @doegox for verifying
 cross compiling

---
 client/CMakeLists.txt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/CMakeLists.txt b/client/CMakeLists.txt
index c67104158..ec1a28e60 100644
--- a/client/CMakeLists.txt
+++ b/client/CMakeLists.txt
@@ -82,7 +82,7 @@ if (NOT SKIPREADLINE EQUAL 1)
     endif (APPLE)
     if (EMBED_READLINE)
         ExternalProject_Add(ncurses
-            URL                   http://ftp.gnu.org/pub/gnu/ncurses/ncurses-6.0.tar.gz
+            URL                   http://ftp.gnu.org/pub/gnu/ncurses/ncurses-6.1.tar.gz
             PREFIX                deps/ncurses
             DOWNLOAD_DIR          ${CMAKE_CURRENT_SOURCE_DIR}/deps/ncurses
             CONFIGURE_COMMAND     ./configure CC=${CMAKE_C_COMPILER} CXX=${CMAKE_CXX_COMPILER} LD=${CMAKE_C_COMPILER} AR=${CMAKE_AR} RANLIB=${CMAKE_RANLIB} ${CFLAGS_EXTERNAL_LIB} --host=arm --disable-database  --with-fallbacks=ansi-generic,ansi-mini,color_xterm,dtterm,dumb,Eterm,Eterm-256color,Eterm-88color,eterm-color,gnome,gnome-256color,guru,hurd,iTerm.app,konsole,konsole-16color,konsole-256color,konsole-base,konsole-linux,konsole-solaris,konsole-vt100,kterm,kterm-color,linux,linux-16color,linux-basic,mac,mlterm,mlterm-256color,mrxvt,mrxvt-256color,mterm,mterm-ansi,mvterm,nsterm,nsterm-16color,nsterm-256color,pty,putty,putty-256color,putty-vt100,rxvt,rxvt-16color,rxvt-256color,rxvt-88color,rxvt-basic,rxvt-color,screen,screen-16color,screen-256color,simpleterm,st-16color,st-256color,st52,st52-color,stv52,tt,tt52,unknown,vt100,vt102,vte,vte-256color,xterm,xterm-16color,xterm-256color,xterm-88color,xterm-basic,xterm-bold,xterm-color,xterm-utf8,xterm-vt220,xterm-vt52,xterm1,xtermc,xtermm   --enable-termcap --without-ada --without-debug --without-dlsym --without-gpm --without-develop --without-tests --without-cxx-binding --with-termlib
@@ -94,7 +94,7 @@ if (NOT SKIPREADLINE EQUAL 1)
         ExternalProject_Add_StepTargets(ncurses configure build install)
 
         ExternalProject_Add(readline
-            URL                   ftp://ftp.gnu.org/gnu/readline/readline-7.0.tar.gz
+            URL                   ftp://ftp.gnu.org/gnu/readline/readline-8.1.tar.gz
             PREFIX                deps/readline
             DOWNLOAD_DIR          ${CMAKE_CURRENT_SOURCE_DIR}/deps/readline
             CONFIGURE_COMMAND     ./configure CC=${CMAKE_C_COMPILER} CXX=${CMAKE_CXX_COMPILER} LD=${CMAKE_C_COMPILER} AR=${CMAKE_AR} RANLIB=${CMAKE_RANLIB} ${CFLAGS_EXTERNAL_LIB} --host=arm --enable-static

From 59e3c31e0f8fa2750d51e0497d009c08b980ef59 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Tue, 22 Dec 2020 20:09:19 -0500
Subject: [PATCH 185/682] hf fido info - now use cliparser

---
 client/src/cmdhffido.c | 14 +++++++++++---
 doc/cliparser_todo.txt |  1 -
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdhffido.c b/client/src/cmdhffido.c
index 7535a5ef4..d3ea8e1cb 100644
--- a/client/src/cmdhffido.c
+++ b/client/src/cmdhffido.c
@@ -48,10 +48,18 @@ static int cmd_hf_fido_list(const char *Cmd) {
     return CmdTraceList(args);
 }
 
-static int cmd_hf_fido_info(const char *cmd) {
+static int cmd_hf_fido_info(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf fido info",
+                  "Get info from Fido tags",
+                  "hf fido info");
 
-    if (cmd && strlen(cmd) > 0)
-        PrintAndLogEx(WARNING, "WARNING: command doesn't have any parameters.\n");
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
 
     // info about 14a part
     infoHF14A(false, false, false);
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index daad348a5..69a96a479 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -73,7 +73,6 @@ hf felica rqspecver
 hf felica resetmode
 hf felica litesim
 hf felica litedump
-hf fido info
 hf mf darkside
 hf mf nested
 hf mf hardnested

From dbf2ce6074941d5577901fb8c90b79194bb0eb9f Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Tue, 22 Dec 2020 20:15:19 -0500
Subject: [PATCH 186/682] fix double import

---
 client/src/cmdhficlass.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c
index 0d182d9c3..b4b2f4245 100644
--- a/client/src/cmdhficlass.c
+++ b/client/src/cmdhficlass.c
@@ -18,7 +18,6 @@
 #include "cmdparser.h"    // command_t
 #include "commonutil.h"  // ARRAYLEN
 #include "cmdtrace.h"
-#include "cliparser.h"
 #include "util_posix.h"
 #include "comms.h"
 #include "des.h"

From 4c82cc4436ff3932455df0d4a703b6b9b6f5e41e Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Tue, 22 Dec 2020 20:52:18 -0500
Subject: [PATCH 187/682] hf epa - now use cliparser

---
 client/src/cmdhfepa.c  | 128 +++++++++++++++++++----------------------
 doc/cliparser_todo.txt |   2 -
 doc/commands.md        |  50 ++++++++++------
 3 files changed, 90 insertions(+), 90 deletions(-)

diff --git a/client/src/cmdhfepa.c b/client/src/cmdhfepa.c
index 83f347604..21b896032 100644
--- a/client/src/cmdhfepa.c
+++ b/client/src/cmdhfepa.c
@@ -15,7 +15,7 @@
 #include <inttypes.h>
 #include <stdlib.h>
 #include <ctype.h>        // tolower
-
+#include "cliparser.h"
 #include "cmdparser.h"    // command_t
 #include "commonutil.h"   // ARRAYLEN
 #include "comms.h"        // clearCommandBuffer
@@ -24,35 +24,28 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_epa_collect(void) {
-    PrintAndLogEx(NORMAL, "Tries to collect nonces when doing part of PACE protocol.\n"
-                  "\n"
-                  "Usage:  hf epa cnonces <m> <n> <d>\n"
-                  "Options:\n"
-                  "\t<m>      nonce size\n"
-                  "\t<n>      number of nonces to collect\n"
-                  "\t<d>      delay between\n"
-                  "\n"
-                  "Example:\n"
-                  _YELLOW_("\thf epa cnonces 4 4 1")
-                 );
-    return PM3_SUCCESS;
-}
-
 // Perform (part of) the PACE protocol
 static int CmdHFEPACollectPACENonces(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf epa cnonces",
+                  "Tries to collect nonces when doing part of PACE protocol.",
+                  "hf epa cnonces --size 4 --num 4 --delay 1");
 
-    char cmdp = tolower(param_getchar(Cmd, 0));
-    if (cmdp == 'h') return usage_epa_collect();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_int1(NULL, "size", "<dec>", "nonce size"),
+        arg_int1(NULL, "num", "<dec>", "number of nonces to collect"),
+        arg_int1("d", "delay", "<dec>", "delay between attempts"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
 
-    // requested nonce size
-    uint32_t m = 0;
-    // requested number of Nonces
-    uint32_t n = 0;
-    // delay between requests
-    uint32_t d = 0;
 
-    sscanf(Cmd, "%u %u %u", &m, &n, &d);
+    int m = arg_get_int_def(ctx, 1, 0);
+    int n = arg_get_int_def(ctx, 2, 0);
+    int d = arg_get_int_def(ctx, 3, 0);
+
+    CLIParserFree(ctx);
 
     // values are expected to be > 0
     m = m > 0 ? m : 1;
@@ -99,54 +92,51 @@ static int CmdHFEPACollectPACENonces(const char *Cmd) {
 
 // perform the PACE protocol by replaying APDUs
 static int CmdHFEPAPACEReplay(const char *Cmd) {
-    // the 4 APDUs which are replayed + their lengths
-    uint8_t msesa_apdu[41] = {0}, gn_apdu[8] = {0}, map_apdu[75] = {0};
-    uint8_t pka_apdu[75] = {0}, ma_apdu[18] = {0}, apdu_lengths[5] = {0};
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf epa preplay",
+                  "Perform PACE protocol by replaying given APDUs",
+                  "hf epa preplay --mse 0022C1A4 --get 1068000000 --map 1086000002 --pka 1234ABCDEF --ma 1A2B3C4D");
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1(NULL, "mse", "<hex>", "msesa APDU"),
+        arg_str1(NULL, "get", "<hex>", "gn APDU"),
+        arg_str1(NULL, "map", "<hex>", "map APDU"),
+        arg_str1(NULL, "pka", "<hex>", "pka APDU"),
+        arg_str1(NULL, "ma", "<hex>", "ma APDU"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+
+    int msesa_len = 0;
+    uint8_t msesa_apdu[41] = {0};
+    CLIGetHexWithReturn(ctx, 1, msesa_apdu, &msesa_len);
+
+    int gn_len = 0;
+    uint8_t gn_apdu[8] = {0};
+    CLIGetHexWithReturn(ctx, 2, gn_apdu, &gn_len);
+
+    int map_len = 0;
+    uint8_t map_apdu[75] = {0};
+    CLIGetHexWithReturn(ctx, 3, map_apdu, &map_len);
+
+    int pka_len = 0;
+    uint8_t pka_apdu[75] = {0};
+    CLIGetHexWithReturn(ctx, 4, pka_apdu, &pka_len);
+
+    int ma_len = 0;
+    uint8_t ma_apdu[18] = {0};
+    CLIGetHexWithReturn(ctx, 5, ma_apdu, &ma_len);
+
+    CLIParserFree(ctx);
+
+    uint8_t apdu_lengths[5] = {msesa_len, gn_len, map_len, pka_len, ma_len};
     // pointers to the arrays to be able to iterate
     uint8_t *apdus[] = {msesa_apdu, gn_apdu, map_apdu, pka_apdu, ma_apdu};
 
-    // usage message
-    static const char *usage_msg =
-        "Please specify 5 APDUs separated by spaces. "
-        "Example:\n preplay 0022C1A4 1068000000 1086000002 1234ABCDEF 1A2B3C4D";
-
     // Proxmark response
     PacketResponseNG resp;
 
-    int skip = 0, skip_add = 0, scan_return;
-    // for each APDU
-    for (int i = 0; i < ARRAYLEN(apdu_lengths); i++) {
-        // scan to next space or end of string
-        while (Cmd[skip] != ' ' && Cmd[skip] != '\0') {
-            // convert
-            scan_return = sscanf(Cmd + skip,
-                                 "%2" SCNx8 "%n",
-                                 apdus[i] + apdu_lengths[i],
-                                 &skip_add
-                                );
-
-            if (scan_return < 1) {
-                PrintAndLogEx(INFO, (char *)usage_msg);
-                PrintAndLogEx(WARNING, "Not enough APDUs! Try again!");
-                return PM3_SUCCESS;
-            }
-            skip += skip_add;
-            apdu_lengths[i]++;
-        }
-
-        // break on EOF
-        if (Cmd[skip] == '\0') {
-            if (i < ARRAYLEN(apdu_lengths) - 1) {
-
-                PrintAndLogEx(INFO, (char *)usage_msg);
-                return PM3_SUCCESS;
-            }
-            break;
-        }
-        // skip the space
-        skip++;
-    }
-
     // transfer the APDUs to the Proxmark
     uint8_t data[PM3_CMD_DATA_SIZE];
     // fast push mode
@@ -205,8 +195,8 @@ static int CmdHFEPAPACEReplay(const char *Cmd) {
 
 static command_t CommandTable[] = {
     {"help",    CmdHelp,                   AlwaysAvailable, "This help"},
-    {"cnonces", CmdHFEPACollectPACENonces, IfPm3Iso14443,   "<m> <n> <d> Acquire n>0 encrypted PACE nonces of size m>0 with d sec pauses"},
-    {"preplay", CmdHFEPAPACEReplay,        IfPm3Iso14443,   "<mse> <get> <map> <pka> <ma> Perform PACE protocol by replaying given APDUs"},
+    {"cnonces", CmdHFEPACollectPACENonces, IfPm3Iso14443,   "Acquire encrypted PACE nonces of specific size"},
+    {"preplay", CmdHFEPAPACEReplay,        IfPm3Iso14443,   "Perform PACE protocol by replaying given APDUs"},
     {NULL, NULL, NULL, NULL}
 };
 
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 69a96a479..7e333911b 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -56,8 +56,6 @@ hf 15 restore
 hf 15 wrbl
 hf 15 writeafi
 hf 15 writedsfid
-hf epa cnonces
-hf epa preplay
 hf felica reader
 hf felica sniff
 hf felica raw
diff --git a/doc/commands.md b/doc/commands.md
index 7bc9342c5..991f4a590 100644
--- a/doc/commands.md
+++ b/doc/commands.md
@@ -126,7 +126,7 @@ Check column "offline" for their availability.
 
 ### hf 14a
 
- { ISO14443A RFIDs...               }
+ { ISO14443A RFIDs...                  }
 
 |command                  |offline |description
 |-------                  |------- |-----------
@@ -147,7 +147,7 @@ Check column "offline" for their availability.
 
 ### hf 14b
 
- { ISO14443B RFIDs...               }
+ { ISO14443B RFIDs...                  }
 
 |command                  |offline |description
 |-------                  |------- |-----------
@@ -167,7 +167,7 @@ Check column "offline" for their availability.
 
 ### hf 15
 
- { ISO15693 RFIDs...                }
+ { ISO15693 RFIDs...                   }
 
 |command                  |offline |description
 |-------                  |------- |-----------
@@ -193,18 +193,30 @@ Check column "offline" for their availability.
 
 ### hf epa
 
- { German Identification Card...    }
+ { German Identification Card...       }
 
 |command                  |offline |description
 |-------                  |------- |-----------
 |`hf epa help            `|Y       |`This help`
-|`hf epa cnonces         `|N       |`<m> <n> <d> Acquire n>0 encrypted PACE nonces of size m>0 with d sec pauses`
-|`hf epa preplay         `|N       |`<mse> <get> <map> <pka> <ma> Perform PACE protocol by replaying given APDUs`
+|`hf epa cnonces         `|N       |`Acquire encrypted PACE nonces of specific size`
+|`hf epa preplay         `|N       |`Perform PACE protocol by replaying given APDUs`
+
+
+### hf emrtd
+
+ { Machine Readable Travel Document... }
+
+|command                  |offline |description
+|-------                  |------- |-----------
+|`hf emrtd help          `|Y       |`This help`
+|`hf emrtd dump          `|N       |`Dump eMRTD files to binary files`
+|`hf emrtd info          `|Y       |`Display info about an eMRTD`
+|`hf emrtd list          `|Y       |`List ISO 14443A/7816 history`
 
 
 ### hf felica
 
- { ISO18092 / FeliCa RFIDs...       }
+ { ISO18092 / FeliCa RFIDs...          }
 
 |command                  |offline |description
 |-------                  |------- |-----------
@@ -229,7 +241,7 @@ Check column "offline" for their availability.
 
 ### hf fido
 
- { FIDO and FIDO2 authenticators... }
+ { FIDO and FIDO2 authenticators...    }
 
 |command                  |offline |description
 |-------                  |------- |-----------
@@ -244,7 +256,7 @@ Check column "offline" for their availability.
 
 ### hf iclass
 
- { ICLASS RFIDs...                  }
+ { ICLASS RFIDs...                     }
 
 |command                  |offline |description
 |-------                  |------- |-----------
@@ -275,7 +287,7 @@ Check column "offline" for their availability.
 
 ### hf legic
 
- { LEGIC RFIDs...                   }
+ { LEGIC RFIDs...                      }
 
 |command                  |offline |description
 |-------                  |------- |-----------
@@ -296,7 +308,7 @@ Check column "offline" for their availability.
 
 ### hf lto
 
- { LTO Cartridge Memory RFIDs...    }
+ { LTO Cartridge Memory RFIDs...       }
 
 |command                  |offline |description
 |-------                  |------- |-----------
@@ -311,7 +323,7 @@ Check column "offline" for their availability.
 
 ### hf mf
 
- { MIFARE RFIDs...                  }
+ { MIFARE RFIDs...                     }
 
 |command                  |offline |description
 |-------                  |------- |-----------
@@ -363,7 +375,7 @@ Check column "offline" for their availability.
 
 ### hf mfp
 
- { MIFARE Plus RFIDs...             }
+ { MIFARE Plus RFIDs...                }
 
 |command                  |offline |description
 |-------                  |------- |-----------
@@ -383,7 +395,7 @@ Check column "offline" for their availability.
 
 ### hf mfu
 
- { MIFARE Ultralight RFIDs...       }
+ { MIFARE Ultralight RFIDs...          }
 
 |command                  |offline |description
 |-------                  |------- |-----------
@@ -406,7 +418,7 @@ Check column "offline" for their availability.
 
 ### hf mfdes
 
- { MIFARE Desfire RFIDs...          }
+ { MIFARE Desfire RFIDs...             }
 
 |command                  |offline |description
 |-------                  |------- |-----------
@@ -436,7 +448,7 @@ Check column "offline" for their availability.
 
 ### hf st
 
- { ST Rothult RFIDs...              }
+ { ST Rothult RFIDs...                 }
 
 |command                  |offline |description
 |-------                  |------- |-----------
@@ -451,7 +463,7 @@ Check column "offline" for their availability.
 
 ### hf thinfilm
 
- { Thinfilm RFIDs...                }
+ { Thinfilm RFIDs...                   }
 
 |command                  |offline |description
 |-------                  |------- |-----------
@@ -463,7 +475,7 @@ Check column "offline" for their availability.
 
 ### hf topaz
 
- { TOPAZ (NFC Type 1) RFIDs...      }
+ { TOPAZ (NFC Type 1) RFIDs...         }
 
 |command                  |offline |description
 |-------                  |------- |-----------
@@ -478,7 +490,7 @@ Check column "offline" for their availability.
 
 ### hf waveshare
 
- { Waveshare NFC ePaper...          }
+ { Waveshare NFC ePaper...             }
 
 |command                  |offline |description
 |-------                  |------- |-----------

From 7bc3067fa4ea05d176353314ee0d8f11b68fda33 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Wed, 23 Dec 2020 01:12:35 +0100
Subject: [PATCH 188/682] Make print_progess scalable

---
 client/src/cmdhf.c |  2 +-
 client/src/cmdlf.c |  2 +-
 client/src/ui.c    | 34 +++++++++++++++++++++++++---------
 3 files changed, 27 insertions(+), 11 deletions(-)

diff --git a/client/src/cmdhf.c b/client/src/cmdhf.c
index 0f6a351ec..d1bc184ff 100644
--- a/client/src/cmdhf.c
+++ b/client/src/cmdhf.c
@@ -219,7 +219,7 @@ int CmdHFTune(const char *Cmd) {
     uint32_t max = 0xFFFF;
     bool first = true;
 
-	print_progress(0, max, style);
+    print_progress(0, max, style);
 
     // loop forever (till button pressed) if iter = 0 (default)
     for (uint8_t i = 0; iter == 0 || i < iter; i++) {
diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index 4120959e8..cd001bafb 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -306,7 +306,7 @@ static int CmdLFTune(const char *Cmd) {
     uint32_t max = 71000;
     bool first = true;
 
-	print_progress(0, max, style);
+    print_progress(0, max, style);
 
     // loop forever (till button pressed) if iter = 0 (default)
     for (uint8_t i = 0; iter == 0 || i < iter; i++) {
diff --git a/client/src/ui.c b/client/src/ui.c
index e4b873596..e128fb374 100644
--- a/client/src/ui.c
+++ b/client/src/ui.c
@@ -14,7 +14,9 @@
 #if !defined(_WIN32)
 #define _POSIX_C_SOURCE 200112L
 #endif
-
+#ifdef HAVE_READLINE
+#include <readline/readline.h>
+#endif
 #include "ui.h"
 #include "commonutil.h"  // ARRAYLEN
 
@@ -625,10 +627,22 @@ void iceSimple_Filter(int *data, const size_t len, uint8_t k) {
 }
 
 void print_progress(size_t count, uint64_t max, barMode_t style) {
-
-    #define PERCENTAGE(V, T)   ((V * 100) / T)
+    int cols = 100 + 35;
+#ifdef HAVE_READLINE
+    static int prev_cols = 0;
+    int rows;
+    rl_reset_screen_size(); // refresh Readline idea of the actual screen width
+    rl_get_screen_size (&rows, &cols);
+    (void) rows;
+    if (prev_cols > cols) {
+        PrintAndLogEx(NORMAL, _CLEAR_ _TOP_ "");
+    }
+    prev_cols = cols;
+#endif
+    int width = cols - 35;
+    #define PERCENTAGE(V, T)   ((V * width) / T)
     // x/8 fractional part of the percentage
-    #define PERCENTAGEFRAC(V, T)   ((int)(((((float)V * 100) / T) - ((V * 100) / T)) * 8))
+    #define PERCENTAGEFRAC(V, T)   ((int)(((((float)V * width) / T) - ((V * width) / T)) * 8))
 
     const char *smoothtable[] = {
         "\xe2\x80\x80",
@@ -648,7 +662,7 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
     const char *space[] = {" ", "\xe2\x80\x80"};
     uint8_t unit = strlen(block[mode]);
     // +1 for \0
-    char *bar = calloc(unit*100 + 1, sizeof(uint8_t));
+    char *bar = calloc(unit*width + 1, sizeof(uint8_t));
 
     uint8_t value = PERCENTAGE(count, max);
 
@@ -665,7 +679,7 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
     }
     i += unit;
     // add spaces
-    for (; i < unit*100; i+=unit) {
+    for (; i < unit*width; i+=unit) {
         memcpy(bar + i, space[mode], unit);
     }
     // color buffer
@@ -673,9 +687,11 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
     char *cbar = calloc(collen, sizeof(uint8_t));
 
     // Add colors
-    snprintf(cbar,  collen,  _GREEN_("%.*s"), unit*60, bar);
-    snprintf(cbar + strlen(cbar), collen - strlen(cbar), _CYAN_("%.*s"), unit*20,  bar + unit*60);
-    snprintf(cbar + strlen(cbar), collen - strlen(cbar), _YELLOW_("%.*s"), unit*20, bar + unit*80);
+    int p60 = unit*(width*60/100);
+    int p20 = unit*(width*20/100);
+    snprintf(cbar,  collen,  _GREEN_("%.*s"), p60, bar);
+    snprintf(cbar + strlen(cbar), collen - strlen(cbar), _CYAN_("%.*s"), p20,  bar + p60);
+    snprintf(cbar + strlen(cbar), collen - strlen(cbar), _YELLOW_("%.*s"), unit*width - p60 - p20, bar + p60 + p20);
 
     size_t len = strlen(cbar) + 32;
     char *buffer = calloc(len, sizeof(uint8_t));

From 8d4acbe3a622d642c65547243e7809d9d1315955 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Wed, 23 Dec 2020 19:51:10 +0100
Subject: [PATCH 189/682] make style

---
 armsrc/Standalone/hf_iceclass.c | 20 +++++++--------
 armsrc/em4x70.c                 | 38 ++++++++++++++---------------
 armsrc/em4x70.h                 |  2 +-
 client/src/cmdhf.c              |  6 ++---
 client/src/cmdhf14a.c           |  2 +-
 client/src/cmdhf14b.c           |  6 ++---
 client/src/cmdhfemrtd.c         | 43 ++++++++++++++++-----------------
 client/src/cmdlf.c              |  6 ++---
 client/src/cmdlfem4x50.c        |  2 +-
 client/src/cmdmain.c            |  2 +-
 client/src/preferences.c        |  2 +-
 client/src/ui.c                 | 24 +++++++++---------
 doc/commands.md                 |  4 +--
 13 files changed, 78 insertions(+), 79 deletions(-)

diff --git a/armsrc/Standalone/hf_iceclass.c b/armsrc/Standalone/hf_iceclass.c
index 472544310..88ccfaa47 100644
--- a/armsrc/Standalone/hf_iceclass.c
+++ b/armsrc/Standalone/hf_iceclass.c
@@ -158,17 +158,17 @@ static void download_instructions(uint8_t t) {
 
 // Save to flash if file doesn't exist.
 // Write over file if size of flash file is less than new datalen
-static void save_to_flash(uint8_t *data, uint16_t datalen, char * filename) {
+static void save_to_flash(uint8_t *data, uint16_t datalen, char *filename) {
 
     rdv40_spiffs_lazy_mount();
 
     char fn[SPIFFS_OBJ_NAME_LEN];
 
-    if (filename == NULL){
-            sprintf(fn, "iclass-%02X%02X%02X%02X%02X%02X%02X%02X.bin",
-                    data[0], data[1], data[2], data[3],
-                    data[4], data[5], data[6], data[7]
-                );
+    if (filename == NULL) {
+        sprintf(fn, "iclass-%02X%02X%02X%02X%02X%02X%02X%02X.bin",
+                data[0], data[1], data[2], data[3],
+                data[4], data[5], data[6], data[7]
+               );
     } else {
         int name_len = SPIFFS_OBJ_NAME_LEN;
         int filename_len = strlen(filename);
@@ -176,7 +176,7 @@ static void save_to_flash(uint8_t *data, uint16_t datalen, char * filename) {
         // if the given name len longer than buffer allows, cut it down to size
         name_len = (name_len >= SPIFFS_OBJ_NAME_LEN) ? SPIFFS_OBJ_NAME_LEN : filename_len;
         memcpy(fn, filename, name_len);
-    }    
+    }
 
     int res;
     if (exists_in_spiffs(fn) == false) {
@@ -558,12 +558,12 @@ static int dump_sim_mode(void) {
             }
         }
         switch_off();
-        char * temp_file = HF_ICALSSS_READSIM_TEMP_BIN;
+        char *temp_file = HF_ICALSSS_READSIM_TEMP_BIN;
         save_to_flash(card_data, (start_block + dumped) * 8, temp_file);
         Dbprintf("%u bytes saved", (start_block + dumped) * 8);
 
         if (((start_block + dumped) * 8) > 0) {
-            break; //switch to sim mode 
+            break; //switch to sim mode
         }
     }
 
@@ -577,7 +577,7 @@ static int dump_sim_mode(void) {
     if (res == SPIFFS_OK) {
         Dbprintf("loaded " _GREEN_(HF_ICALSSS_READSIM_TEMP_BIN) " (%u bytes)", fsize);
     }
-    
+
     Dbprintf("simming " _GREEN_(HF_ICALSSS_READSIM_TEMP_BIN));
     iclass_simulate(ICLASS_SIM_MODE_FULL, 0, false, NULL, NULL, NULL);
 
diff --git a/armsrc/em4x70.c b/armsrc/em4x70.c
index 1a6f37d56..77cfbb2dd 100644
--- a/armsrc/em4x70.c
+++ b/armsrc/em4x70.c
@@ -190,9 +190,9 @@ static uint32_t get_rising_pulse_length(void) {
 
 static uint32_t get_pulse_length(edge_detection_t edge) {
 
-    if(edge == RISING_EDGE)
+    if (edge == RISING_EDGE)
         return get_rising_pulse_length();
-    else if(edge == FALLING_EDGE)
+    else if (edge == FALLING_EDGE)
         return get_falling_pulse_length();
 
     return 0;
@@ -292,11 +292,11 @@ static bool check_ack(void) {
     // ACK  64 + 64
     // NACK 64 + 48
     if (check_pulse_length(get_pulse_length(FALLING_EDGE), 2 * EM4X70_T_TAG_FULL_PERIOD) &&
-        check_pulse_length(get_pulse_length(FALLING_EDGE), 2 * EM4X70_T_TAG_FULL_PERIOD)) {
+            check_pulse_length(get_pulse_length(FALLING_EDGE), 2 * EM4X70_T_TAG_FULL_PERIOD)) {
         // ACK
         return true;
-    } 
-    
+    }
+
     // Othewise it was a NACK or Listen Window
     return false;
 }
@@ -426,10 +426,10 @@ static bool find_listen_window(bool command) {
         96 ( 64 + 32 )
         64 ( 32 + 16 +16 )*/
 
-        if (check_pulse_length(get_pulse_length(RISING_EDGE),     (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_HALF_PERIOD) &&
-                check_pulse_length(get_pulse_length(RISING_EDGE), (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_HALF_PERIOD) &&
-                check_pulse_length(get_pulse_length(FALLING_EDGE),        (2*EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_FULL_PERIOD) &&
-                check_pulse_length(get_pulse_length(FALLING_EDGE),         EM4X70_T_TAG_FULL_PERIOD + (2*EM4X70_T_TAG_HALF_PERIOD))) {
+        if (check_pulse_length(get_pulse_length(RISING_EDGE), (2 * EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_HALF_PERIOD) &&
+                check_pulse_length(get_pulse_length(RISING_EDGE), (2 * EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_HALF_PERIOD) &&
+                check_pulse_length(get_pulse_length(FALLING_EDGE), (2 * EM4X70_T_TAG_FULL_PERIOD) + EM4X70_T_TAG_FULL_PERIOD) &&
+                check_pulse_length(get_pulse_length(FALLING_EDGE),         EM4X70_T_TAG_FULL_PERIOD + (2 * EM4X70_T_TAG_HALF_PERIOD))) {
 
             if (command) {
                 /* Here we are after the 64 duration edge.
@@ -438,7 +438,7 @@ static bool find_listen_window(bool command) {
                     *
                     *   I've found between 4-5 quarter periods (32-40) works best
                     */
-                WaitTicks( 4 * EM4X70_T_TAG_QUARTER_PERIOD );
+                WaitTicks(4 * EM4X70_T_TAG_QUARTER_PERIOD);
                 // Send RM Command
                 em4x70_send_bit(0);
                 em4x70_send_bit(0);
@@ -559,7 +559,7 @@ static int em4x70_receive(uint8_t *bits, size_t length) {
     WaitTicks(6 * EM4X70_T_TAG_FULL_PERIOD);
 
     // wait until we get the transition from 1's to 0's which is 1.5 full windows
-    for(int i = 0; i < EM4X70_T_READ_HEADER_LEN; i++) {
+    for (int i = 0; i < EM4X70_T_READ_HEADER_LEN; i++) {
         pl = get_pulse_length(edge);
         if (check_pulse_length(pl, 3 * EM4X70_T_TAG_HALF_PERIOD)) {
             foundheader = true;
@@ -575,7 +575,7 @@ static int em4x70_receive(uint8_t *bits, size_t length) {
     // Skip next 3 0's, header check consumes the first 0
     for (int i = 0; i < 3; i++) {
         // If pulse length is not 1 bit, then abort early
-        if(!check_pulse_length(get_pulse_length(edge), EM4X70_T_TAG_FULL_PERIOD)) {
+        if (!check_pulse_length(get_pulse_length(edge), EM4X70_T_TAG_FULL_PERIOD)) {
             return 0;
         }
     }
@@ -745,8 +745,8 @@ void em4x70_write_pin(em4x70_data_t *etd) {
         if (em4x70_read_id()) {
 
             // Write new PIN
-            if( (write( etd->pin & 0xFFFF,        EM4X70_PIN_WORD_UPPER) == PM3_SUCCESS) &&
-                (write((etd->pin >> 16) & 0xFFFF, EM4X70_PIN_WORD_LOWER) == PM3_SUCCESS)) {
+            if ((write(etd->pin & 0xFFFF,        EM4X70_PIN_WORD_UPPER) == PM3_SUCCESS) &&
+                    (write((etd->pin >> 16) & 0xFFFF, EM4X70_PIN_WORD_LOWER) == PM3_SUCCESS)) {
 
                 // Now Try to authenticate using the new PIN
 
@@ -784,13 +784,13 @@ void em4x70_write_key(em4x70_data_t *etd) {
         // Read ID to ensure we can write to card
         if (em4x70_read_id()) {
             status = 1;
-            
-            // Write each crypto block
-            for(int i = 0; i < 6; i++) {
 
-                uint16_t key_word = (etd->crypt_key[(i*2)+1] << 8) + etd->crypt_key[i*2];
+            // Write each crypto block
+            for (int i = 0; i < 6; i++) {
+
+                uint16_t key_word = (etd->crypt_key[(i * 2) + 1] << 8) + etd->crypt_key[i * 2];
                 // Write each word, abort if any failure occurs
-                if (write(key_word, 9-i) != PM3_SUCCESS) {
+                if (write(key_word, 9 - i) != PM3_SUCCESS) {
                     status = 0;
                     break;
                 }
diff --git a/armsrc/em4x70.h b/armsrc/em4x70.h
index abebe0e8b..5bb1a2a37 100644
--- a/armsrc/em4x70.h
+++ b/armsrc/em4x70.h
@@ -20,7 +20,7 @@ typedef struct {
 typedef enum {
     RISING_EDGE,
     FALLING_EDGE
-}edge_detection_t;
+} edge_detection_t;
 
 void em4x70_info(em4x70_data_t *etd);
 void em4x70_write(em4x70_data_t *etd);
diff --git a/client/src/cmdhf.c b/client/src/cmdhf.c
index d1bc184ff..ada69e905 100644
--- a/client/src/cmdhf.c
+++ b/client/src/cmdhf.c
@@ -53,7 +53,7 @@ int CmdHFSearch(const char *Cmd) {
                   "Will try to find a HF read out of the unknown tag.\n"
                   "Continues to search for all different HF protocols.",
                   "hf sniff"
-                  );
+                 );
     void *argtable[] = {
         arg_param_begin,
         arg_param_end
@@ -244,7 +244,7 @@ int CmdHFTune(const char *Cmd) {
             max = (volt * 1.03);
             first = false;
         }
-        if ( volt > max) {
+        if (volt > max) {
             max = (volt * 1.03);
         }
         print_progress(volt, max, style);
@@ -274,7 +274,7 @@ int CmdHFSniff(const char *Cmd) {
                   "Press button to quit the sniffing.",
                   "hf sniff\n"
                   "hf sniff --sp 1000 --st 0   -> skip 1000 pairs, skip 0 triggers"
-                  );
+                 );
     void *argtable[] = {
         arg_param_begin,
         arg_u64_0(NULL, "sp", "<dec>", "skip sample pairs"),
diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index a1cf5b76e..d4418ee62 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -2001,7 +2001,7 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
 
         if (do_aid_search) {
 
-            
+
             PrintAndLogEx(INFO, "-------------------- " _CYAN_("AID Search") " --------------------");
 
             bool found = false;
diff --git a/client/src/cmdhf14b.c b/client/src/cmdhf14b.c
index b27df1914..71c2f03ab 100644
--- a/client/src/cmdhf14b.c
+++ b/client/src/cmdhf14b.c
@@ -82,9 +82,9 @@ static void hf14b_aid_search(bool verbose) {
     bool activate_field = true;
     for (elmindx = 0; elmindx < json_array_size(root); elmindx++) {
 
-       if (kbd_enter_pressed()) {
-           break;
-       }
+        if (kbd_enter_pressed()) {
+            break;
+        }
 
         json_t *data = AIDSearchGetElm(root, elmindx);
         uint8_t vaid[200] = {0};
diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 30eb4667f..3be321fcb 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -61,7 +61,7 @@ static int emrtd_print_ef_dg12_info(uint8_t *data, size_t datalen);
 static int emrtd_print_ef_sod_info(uint8_t *data, size_t datalen);
 
 typedef enum  { // list must match dg_table
-    EF_COM=0,
+    EF_COM = 0,
     EF_DG1,
     EF_DG2,
     EF_DG3,
@@ -109,7 +109,7 @@ static emrtd_dg_t dg_table[] = {
 };
 
 static emrtd_dg_t *emrtd_tag_to_dg(uint8_t tag) {
-    for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
+    for (int dgi = 0; dg_table[dgi].filename != NULL; dgi++) {
         if (dg_table[dgi].tag == tag) {
             return &dg_table[dgi];
         }
@@ -117,7 +117,7 @@ static emrtd_dg_t *emrtd_tag_to_dg(uint8_t tag) {
     return NULL;
 }
 static emrtd_dg_t *emrtd_fileid_to_dg(const char *file_id) {
-    for (int dgi=0; dg_table[dgi].filename != NULL; dgi++) {
+    for (int dgi = 0; dg_table[dgi].filename != NULL; dgi++) {
         if (strcmp(dg_table[dgi].fileid, file_id) == 0) {
             return &dg_table[dgi];
         }
@@ -691,7 +691,7 @@ static int emrtd_dump_ef_dg2(uint8_t *file_contents, size_t file_length) {
     // Note: Doing file_length - 6 to account for the longest data we're checking.
     for (offset = 0; offset < file_length - 6; offset++) {
         if ((file_contents[offset] == 0xFF && file_contents[offset + 1] == 0xD8 && file_contents[offset + 2] == 0xFF && file_contents[offset + 3] == 0xE0) ||
-            (file_contents[offset] == 0x00 && file_contents[offset + 1] == 0x00 && file_contents[offset + 2] == 0x00 && file_contents[offset + 3] == 0x0C && file_contents[offset + 4] == 0x6A && file_contents[offset + 5] == 0x50)) {
+                (file_contents[offset] == 0x00 && file_contents[offset + 1] == 0x00 && file_contents[offset + 2] == 0x00 && file_contents[offset + 3] == 0x0C && file_contents[offset + 4] == 0x6A && file_contents[offset + 5] == 0x50)) {
             datalen = file_length - offset;
             break;
         }
@@ -745,7 +745,7 @@ static int emrtd_dump_ef_dg7(uint8_t *file_contents, size_t file_length) {
 static int emrtd_dump_ef_sod(uint8_t *file_contents, size_t file_length) {
     int fieldlen = emrtd_get_asn1_field_length(file_contents, file_length, 1);
     int datalen = emrtd_get_asn1_data_length(file_contents, file_length, 1);
-    
+
     if (fieldlen + 1 > EMRTD_MAX_FILE_SIZE) {
         PrintAndLogEx(ERR, "error (emrtd_dump_ef_sod) fieldlen out-of-bounds");
         return PM3_SUCCESS;
@@ -766,7 +766,7 @@ static bool emrtd_dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, cons
     PrintAndLogEx(INFO, "Read %s, len: %i.", name, resplen);
     PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
     saveFile(name, ".BIN", response, resplen);
-    emrtd_dg_t * dg = emrtd_fileid_to_dg(file);
+    emrtd_dg_t *dg = emrtd_fileid_to_dg(file);
     if ((dg != NULL) && (dg->dumper != NULL)) {
         dg->dumper(response, resplen);
     }
@@ -778,7 +778,7 @@ static void rng(int length, uint8_t *dataout) {
     //for (int i = 0; i < (length / 4); i++) {
     //    num_to_bytes(prng_successor(msclock() + i, 32), 4, &dataout[i * 4]);
     //}
-    memset(dataout, 0x00, length);   
+    memset(dataout, 0x00, length);
 }
 
 static bool emrtd_do_bac(char *documentnumber, char *dob, char *expiry, uint8_t *ssc, uint8_t *ks_enc, uint8_t *ks_mac, bool use_14b) {
@@ -1006,7 +1006,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     filelist[filelistlen++] = 0x77;
     // Dump all files in the file list
     for (int i = 0; i < filelistlen; i++) {
-        emrtd_dg_t * dg = emrtd_tag_to_dg(filelist[i]);
+        emrtd_dg_t *dg = emrtd_tag_to_dg(filelist[i]);
         if (dg == NULL) {
             PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
             continue;
@@ -1027,9 +1027,9 @@ static bool emrtd_compare_check_digit(char *datain, int datalen, char expected_c
     uint8_t check_digit = emrtd_calculate_check_digit(tempdata) + 0x30;
     bool res = check_digit == expected_check_digit;
     PrintAndLogEx(DEBUG, "emrtd_compare_check_digit, expected %c == %c calculated ( %s )"
-        , expected_check_digit
-        , check_digit
-        , (res) ? _GREEN_("ok") : _RED_("fail"));
+                  , expected_check_digit
+                  , check_digit
+                  , (res) ? _GREEN_("ok") : _RED_("fail"));
     return res;
 }
 
@@ -1231,7 +1231,7 @@ static int emrtd_print_ef_com_info(uint8_t *data, size_t datalen) {
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_COM") " --------------------");
     for (int i = 0; i < filelistlen; i++) {
-        emrtd_dg_t * dg = emrtd_tag_to_dg(filelist[i]);
+        emrtd_dg_t *dg = emrtd_tag_to_dg(filelist[i]);
         if (dg == NULL) {
             PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
             continue;
@@ -1513,7 +1513,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     }
 
     int res = emrtd_print_ef_com_info(response, resplen);
-    if ( res != PM3_SUCCESS) {
+    if (res != PM3_SUCCESS) {
         DropField();
         return res;
     }
@@ -1530,7 +1530,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     filelist[filelistlen++] = 0x77;
     // Dump all files in the file list
     for (int i = 0; i < filelistlen; i++) {
-        emrtd_dg_t * dg = emrtd_tag_to_dg(filelist[i]);
+        emrtd_dg_t *dg = emrtd_tag_to_dg(filelist[i]);
         if (dg == NULL) {
             PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
             continue;
@@ -1563,7 +1563,7 @@ int infoHF_EMRTD_offline(const char *path) {
     }
 
     int res = emrtd_print_ef_com_info(data, datalen);
-    if ( res != PM3_SUCCESS) {
+    if (res != PM3_SUCCESS) {
         free(data);
         free(filepath);
         return res;
@@ -1583,7 +1583,7 @@ int infoHF_EMRTD_offline(const char *path) {
     filelist[filelistlen++] = 0x77;
     // Read files in the file list
     for (int i = 0; i < filelistlen; i++) {
-        emrtd_dg_t * dg = emrtd_tag_to_dg(filelist[i]);
+        emrtd_dg_t *dg = emrtd_tag_to_dg(filelist[i]);
         if (dg == NULL) {
             PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
             continue;
@@ -1592,8 +1592,7 @@ int infoHF_EMRTD_offline(const char *path) {
             strcpy(filepath, path);
             strncat(filepath, PATHSEP, 2);
             strcat(filepath, dg->filename);
-            if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, false) == PM3_SUCCESS)
-            {
+            if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, false) == PM3_SUCCESS) {
                 // we won't halt on parsing errors
                 if (dg->parser != NULL)
                     dg->parser(data, datalen);
@@ -1662,7 +1661,7 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
             memset(docnum + slen, '<', 9 - slen);
         }
     }
-    
+
     if (CLIParamStrToBuf(arg_get_str(ctx, 2), dob, 6, &slen) != 0 || slen == 0) {
         BAC = false;
     } else {
@@ -1672,7 +1671,7 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
             error = true;
         }
     }
-    
+
     if (CLIParamStrToBuf(arg_get_str(ctx, 3), expiry, 6, &slen) != 0 || slen == 0) {
         BAC = false;
     } else {
@@ -1748,7 +1747,7 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
             memset(docnum + slen, '<', 9 - slen);
         }
     }
-    
+
     if (CLIParamStrToBuf(arg_get_str(ctx, 2), dob, 6, &slen) != 0 || slen == 0) {
         BAC = false;
     } else {
@@ -1758,7 +1757,7 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
             error = true;
         }
     }
-    
+
     if (CLIParamStrToBuf(arg_get_str(ctx, 3), expiry, 6, &slen) != 0 || slen == 0) {
         BAC = false;
     } else {
diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index cd001bafb..2ee55eebf 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -328,11 +328,11 @@ static int CmdLFTune(const char *Cmd) {
 
         uint32_t volt = resp.data.asDwords[0];
         if (first) {
-            max =  (volt * 1.03);
+            max = (volt * 1.03);
             first = false;
         }
-        if ( volt > max) {
-            max =  (volt * 1.03);
+        if (volt > max) {
+            max = (volt * 1.03);
         }
         print_progress(volt, max, style);
     }
diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c
index 9c907caf7..79b019a03 100644
--- a/client/src/cmdlfem4x50.c
+++ b/client/src/cmdlfem4x50.c
@@ -286,7 +286,7 @@ int CmdEM4x50EView(const char *Cmd) {
         PrintAndLogEx(WARNING, "Fail, transfer from device time-out");
         return PM3_ETIMEOUT;
     }
-    
+
     // valid em4x50 data?
     uint32_t serial = bytes_to_num(data + 4 * EM4X50_DEVICE_SERIAL, 4);
     uint32_t device_id = bytes_to_num(data + 4 * EM4X50_DEVICE_ID, 4);
diff --git a/client/src/cmdmain.c b/client/src/cmdmain.c
index 4d393756f..fe4fa0b84 100644
--- a/client/src/cmdmain.c
+++ b/client/src/cmdmain.c
@@ -175,7 +175,7 @@ int CmdRem(const char *Cmd) {
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);
 
-    struct arg_str* foo = arg_get_str(ctx, 1);
+    struct arg_str *foo = arg_get_str(ctx, 1);
     size_t count = 0;
     size_t len = 0;
     do {
diff --git a/client/src/preferences.c b/client/src/preferences.c
index c80e24e3a..1e943a84a 100644
--- a/client/src/preferences.c
+++ b/client/src/preferences.c
@@ -314,7 +314,7 @@ void preferences_load_callback(json_t *root) {
     if (json_unpack_ex(root, &up_error, 0, "{s:b}", "os.supports.colors", &b1) == 0)
         session.supports_colors = (bool)b1;
 
-    // bar mode 
+    // bar mode
     if (json_unpack_ex(root, &up_error, 0, "{s:s}", "show.bar.mode", &s1) == 0) {
         strncpy(tempStr, s1, sizeof(tempStr) - 1);
         str_lower(tempStr);
diff --git a/client/src/ui.c b/client/src/ui.c
index e128fb374..f9595e5f3 100644
--- a/client/src/ui.c
+++ b/client/src/ui.c
@@ -632,7 +632,7 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
     static int prev_cols = 0;
     int rows;
     rl_reset_screen_size(); // refresh Readline idea of the actual screen width
-    rl_get_screen_size (&rows, &cols);
+    rl_get_screen_size(&rows, &cols);
     (void) rows;
     if (prev_cols > cols) {
         PrintAndLogEx(NORMAL, _CLEAR_ _TOP_ "");
@@ -640,9 +640,9 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
     prev_cols = cols;
 #endif
     int width = cols - 35;
-    #define PERCENTAGE(V, T)   ((V * width) / T)
+#define PERCENTAGE(V, T)   ((V * width) / T)
     // x/8 fractional part of the percentage
-    #define PERCENTAGEFRAC(V, T)   ((int)(((((float)V * width) / T) - ((V * width) / T)) * 8))
+#define PERCENTAGEFRAC(V, T)   ((int)(((((float)V * width) / T) - ((V * width) / T)) * 8))
 
     const char *smoothtable[] = {
         "\xe2\x80\x80",
@@ -662,13 +662,13 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
     const char *space[] = {" ", "\xe2\x80\x80"};
     uint8_t unit = strlen(block[mode]);
     // +1 for \0
-    char *bar = calloc(unit*width + 1, sizeof(uint8_t));
+    char *bar = calloc(unit * width + 1, sizeof(uint8_t));
 
     uint8_t value = PERCENTAGE(count, max);
 
     int i = 0;
     // prefix is added already.
-    for (; i < unit*value; i+=unit) {
+    for (; i < unit * value; i += unit) {
         memcpy(bar + i, block[mode], unit);
     }
     // add last block
@@ -679,7 +679,7 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
     }
     i += unit;
     // add spaces
-    for (; i < unit*width; i+=unit) {
+    for (; i < unit * width; i += unit) {
         memcpy(bar + i, space[mode], unit);
     }
     // color buffer
@@ -687,24 +687,24 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
     char *cbar = calloc(collen, sizeof(uint8_t));
 
     // Add colors
-    int p60 = unit*(width*60/100);
-    int p20 = unit*(width*20/100);
+    int p60 = unit * (width * 60 / 100);
+    int p20 = unit * (width * 20 / 100);
     snprintf(cbar,  collen,  _GREEN_("%.*s"), p60, bar);
     snprintf(cbar + strlen(cbar), collen - strlen(cbar), _CYAN_("%.*s"), p20,  bar + p60);
-    snprintf(cbar + strlen(cbar), collen - strlen(cbar), _YELLOW_("%.*s"), unit*width - p60 - p20, bar + p60 + p20);
+    snprintf(cbar + strlen(cbar), collen - strlen(cbar), _YELLOW_("%.*s"), unit * width - p60 - p20, bar + p60 + p20);
 
     size_t len = strlen(cbar) + 32;
     char *buffer = calloc(len, sizeof(uint8_t));
 
-    switch(style) {
+    switch (style) {
         case STYLE_BAR: {
-	        sprintf(buffer, "%s", cbar);
+            sprintf(buffer, "%s", cbar);
             printf("\b%c[2K\r[" _YELLOW_("=")"] %s", 27, buffer);
             break;
         }
         case STYLE_MIXED: {
             sprintf(buffer, "%s [ %zu mV / %3u V ]", cbar, count, (uint32_t)(count / 1000));
-	        printf("\b%c[2K\r[" _YELLOW_("=")"] %s ", 27, buffer);
+            printf("\b%c[2K\r[" _YELLOW_("=")"] %s ", 27, buffer);
             break;
         }
         case STYLE_VALUE: {
diff --git a/doc/commands.md b/doc/commands.md
index 991f4a590..e1e445296 100644
--- a/doc/commands.md
+++ b/doc/commands.md
@@ -198,8 +198,8 @@ Check column "offline" for their availability.
 |command                  |offline |description
 |-------                  |------- |-----------
 |`hf epa help            `|Y       |`This help`
-|`hf epa cnonces         `|N       |`Acquire encrypted PACE nonces of specific size`
-|`hf epa preplay         `|N       |`Perform PACE protocol by replaying given APDUs`
+|`hf epa cnonces         `|N       |`<m> <n> <d> Acquire n>0 encrypted PACE nonces of size m>0 with d sec pauses`
+|`hf epa preplay         `|N       |`<mse> <get> <map> <pka> <ma> Perform PACE protocol by replaying given APDUs`
 
 
 ### hf emrtd

From 0272a3b63eaca1bde5f5093ebd2bb5c3572142c5 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Wed, 23 Dec 2020 22:27:05 +0300
Subject: [PATCH 190/682] emrtd: Move a lot of size values from int to size_t

---
 client/src/cmdhfemrtd.c | 42 ++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 3203b4932..0c9de0cac 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -629,7 +629,7 @@ static int emrtd_lds_determine_tag_length(uint8_t tag) {
     return 1;
 }
 
-static bool emrtd_lds_get_data_by_tag(uint8_t *datain, int datainlen, uint8_t *dataout, int *dataoutlen, int tag1, int tag2, bool twobytetag, bool entertoptag, int skiptagcount) {
+static bool emrtd_lds_get_data_by_tag(uint8_t *datain, size_t datainlen, uint8_t *dataout, size_t *dataoutlen, int tag1, int tag2, bool twobytetag, bool entertoptag, size_t skiptagcount) {
     int offset = 0;
     int skipcounter = 0;
 
@@ -720,7 +720,7 @@ static int emrtd_dump_ef_dg2(uint8_t *file_contents, size_t file_length) {
 
 static int emrtd_dump_ef_dg5(uint8_t *file_contents, size_t file_length) {
     uint8_t data[EMRTD_MAX_FILE_SIZE];
-    int datalen = 0;
+    size_t datalen = 0;
 
     // If we can't find image in EF_DG5, return false.
     if (emrtd_lds_get_data_by_tag(file_contents, file_length, data, &datalen, 0x5F, 0x40, true, true, 0) == false) {
@@ -738,7 +738,7 @@ static int emrtd_dump_ef_dg5(uint8_t *file_contents, size_t file_length) {
 
 static int emrtd_dump_ef_dg7(uint8_t *file_contents, size_t file_length) {
     uint8_t data[EMRTD_MAX_FILE_SIZE];
-    int datalen = 0;
+    size_t datalen = 0;
 
     // If we can't find image in EF_DG7, return false.
     if (emrtd_lds_get_data_by_tag(file_contents, file_length, data, &datalen, 0x5F, 0x42, true, true, 0) == false) {
@@ -1005,7 +1005,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     saveFile(dg_table[EF_COM].filename, ".BIN", response, resplen);
 
     uint8_t filelist[50];
-    int filelistlen = 0;
+    size_t filelistlen = 0;
 
     if (!emrtd_lds_get_data_by_tag(response, resplen, filelist, &filelistlen, 0x5c, 0x00, false, true, 0)) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
@@ -1017,7 +1017,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     // Add EF_SOD to the list
     filelist[filelistlen++] = 0x77;
     // Dump all files in the file list
-    for (int i = 0; i < filelistlen; i++) {
+    for (size_t i = 0; i < filelistlen; i++) {
         emrtd_dg_t *dg = emrtd_tag_to_dg(filelist[i]);
         if (dg == NULL) {
             PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
@@ -1232,7 +1232,7 @@ static void emrtd_print_unknown_timestamp_5f85(uint8_t *data) {
 
 static int emrtd_print_ef_com_info(uint8_t *data, size_t datalen) {
     uint8_t filelist[50];
-    int filelistlen = 0;
+    size_t filelistlen = 0;
     int res = emrtd_lds_get_data_by_tag(data, datalen, filelist, &filelistlen, 0x5c, 0x00, false, true, 0);
     if (!res) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
@@ -1262,7 +1262,7 @@ static int emrtd_print_ef_dg1_info(uint8_t *data, size_t datalen) {
     // MRZ on TD1 is 90 characters, 30 on each row.
     // MRZ on TD3 is 88 characters, 44 on each row.
     char mrz[90] = { 0x00 };
-    int mrzlen = 0;
+    size_t mrzlen = 0;
 
     if (!emrtd_lds_get_data_by_tag(data, datalen, (uint8_t *) mrz, &mrzlen, 0x5f, 0x1f, true, true, 0)) {
         PrintAndLogEx(ERR, "Failed to read MRZ from EF_DG1.");
@@ -1339,9 +1339,9 @@ static int emrtd_print_ef_dg1_info(uint8_t *data, size_t datalen) {
 
 static int emrtd_print_ef_dg11_info(uint8_t *data, size_t datalen) {
     uint8_t taglist[100] = { 0x00 };
-    int taglistlen = 0;
+    size_t taglistlen = 0;
     uint8_t tagdata[1000] = { 0x00 };
-    int tagdatalen = 0;
+    size_t tagdatalen = 0;
 
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_DG11") " -------------------");
@@ -1418,9 +1418,9 @@ static int emrtd_print_ef_dg11_info(uint8_t *data, size_t datalen) {
 
 static int emrtd_print_ef_dg12_info(uint8_t *data, size_t datalen) {
     uint8_t taglist[100] = { 0x00 };
-    int taglistlen = 0;
+    size_t taglistlen = 0;
     uint8_t tagdata[1000] = { 0x00 };
-    int tagdatalen = 0;
+    size_t tagdatalen = 0;
 
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_DG12") " -------------------");
@@ -1491,14 +1491,14 @@ static int emrtd_ef_sod_extract_signatures(uint8_t *data, size_t datalen, uint8_
     uint8_t emrtdsigtext[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     size_t toplen, signeddatalen, emrtdsigcontainerlen, emrtdsiglen, emrtdsigtextlen = 0;
 
-    if (!emrtd_lds_get_data_by_tag(data, (int) datalen, top, (int *) &toplen, 0x30, 0x00, false, true, 0)) {
+    if (!emrtd_lds_get_data_by_tag(data, datalen, top, &toplen, 0x30, 0x00, false, true, 0)) {
         PrintAndLogEx(ERR, "Failed to read top from EF_SOD.");
         return false;
     }
 
     PrintAndLogEx(DEBUG, "top: %s.", sprint_hex_inrow(top, toplen));
 
-    if (!emrtd_lds_get_data_by_tag(top, (int) toplen, signeddata, (int *) &signeddatalen, 0xA0, 0x00, false, false, 0)) {
+    if (!emrtd_lds_get_data_by_tag(top, toplen, signeddata, &signeddatalen, 0xA0, 0x00, false, false, 0)) {
         PrintAndLogEx(ERR, "Failed to read signedData from EF_SOD.");
         return false;
     }
@@ -1506,14 +1506,14 @@ static int emrtd_ef_sod_extract_signatures(uint8_t *data, size_t datalen, uint8_
     PrintAndLogEx(DEBUG, "signeddata: %s.", sprint_hex_inrow(signeddata, signeddatalen));
 
     // Do true on reading into the tag as it's a "sequence"
-    if (!emrtd_lds_get_data_by_tag(signeddata, (int) signeddatalen, emrtdsigcontainer, (int *) &emrtdsigcontainerlen, 0x30, 0x00, false, true, 0)) {
+    if (!emrtd_lds_get_data_by_tag(signeddata, signeddatalen, emrtdsigcontainer, &emrtdsigcontainerlen, 0x30, 0x00, false, true, 0)) {
         PrintAndLogEx(ERR, "Failed to read eMRTDSignature container from EF_SOD.");
         return false;
     }
 
     PrintAndLogEx(DEBUG, "emrtdsigcontainer: %s.", sprint_hex_inrow(emrtdsigcontainer, emrtdsigcontainerlen));
 
-    if (!emrtd_lds_get_data_by_tag(emrtdsigcontainer, (int) emrtdsigcontainerlen, emrtdsig, (int *) &emrtdsiglen, 0xA0, 0x00, false, false, 0)) {
+    if (!emrtd_lds_get_data_by_tag(emrtdsigcontainer, emrtdsigcontainerlen, emrtdsig, &emrtdsiglen, 0xA0, 0x00, false, false, 0)) {
         PrintAndLogEx(ERR, "Failed to read eMRTDSignature from EF_SOD.");
         return false;
     }
@@ -1521,7 +1521,7 @@ static int emrtd_ef_sod_extract_signatures(uint8_t *data, size_t datalen, uint8_
     PrintAndLogEx(DEBUG, "emrtdsig: %s.", sprint_hex_inrow(emrtdsig, emrtdsiglen));
 
     // TODO: Not doing memcpy here, it didn't work, fix it somehow
-    if (!emrtd_lds_get_data_by_tag(emrtdsig, (int) emrtdsiglen, emrtdsigtext, (int *) &emrtdsigtextlen, 0x04, 0x00, false, false, 0)) {
+    if (!emrtd_lds_get_data_by_tag(emrtdsig, emrtdsiglen, emrtdsigtext, &emrtdsigtextlen, 0x04, 0x00, false, false, 0)) {
         PrintAndLogEx(ERR, "Failed to read eMRTDSignature (text) from EF_SOD.");
         return false;
     }
@@ -1555,7 +1555,7 @@ static int emrtd_print_ef_sod_info(uint8_t *data, size_t datalen) {
 
     PrintAndLogEx(DEBUG, "hash data: %s", sprint_hex_inrow(emrtdsig, emrtdsiglen));
 
-    if (!emrtd_lds_get_data_by_tag(emrtdsig, (int) emrtdsiglen, hashlist, (int *) &hashlistlen, 0x30, 0x00, false, true, 1)) {
+    if (!emrtd_lds_get_data_by_tag(emrtdsig, emrtdsiglen, hashlist, &hashlistlen, 0x30, 0x00, false, true, 1)) {
         PrintAndLogEx(ERR, "Failed to read hash list from EF_SOD.");
         return false;
     }
@@ -1571,8 +1571,8 @@ static int emrtd_print_ef_sod_info(uint8_t *data, size_t datalen) {
 
         switch (hashlist[offset]) {
             case 0x30:
-                emrtd_lds_get_data_by_tag(hashlist + offset + e_fieldlen + 1, (int) e_datalen, hashidstr, (int *) &hashidstrlen, 0x02, 0x00, false, false, 0);
-                emrtd_lds_get_data_by_tag(hashlist + offset + e_fieldlen + 1, (int) e_datalen, hash, (int *) &hashlen, 0x04, 0x00, false, false, 0);
+                emrtd_lds_get_data_by_tag(hashlist + offset + e_fieldlen + 1, e_datalen, hashidstr, &hashidstrlen, 0x02, 0x00, false, false, 0);
+                emrtd_lds_get_data_by_tag(hashlist + offset + e_fieldlen + 1, e_datalen, hash, &hashlen, 0x04, 0x00, false, false, 0);
                 PrintAndLogEx(SUCCESS, "Hash for EF_DG%i: %s", hashidstr[0], sprint_hex_inrow(hash, hashlen));
                 break;
         }
@@ -1625,7 +1625,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     }
 
     uint8_t filelist[50];
-    int filelistlen = 0;
+    size_t filelistlen = 0;
 
     if (!emrtd_lds_get_data_by_tag(response, resplen, filelist, &filelistlen, 0x5c, 0x00, false, true, 0)) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");
@@ -1676,7 +1676,7 @@ int infoHF_EMRTD_offline(const char *path) {
     }
 
     uint8_t filelist[50];
-    int filelistlen = 0;
+    size_t filelistlen = 0;
     res = emrtd_lds_get_data_by_tag(data, datalen, filelist, &filelistlen, 0x5c, 0x00, false, true, 0);
     if (!res) {
         PrintAndLogEx(ERR, "Failed to read file list from EF_COM.");

From 4962cb84ecc73bbc6e54a92fa0240fa582b7c7d1 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Wed, 23 Dec 2020 22:37:51 +0300
Subject: [PATCH 191/682] emrtd: Note that MRZ option is for passports (TD3)
 only

---
 client/src/cmdhfemrtd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index d90c7e79e..499b06c1a 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1831,7 +1831,7 @@ static int cmd_hf_emrtd_info(const char *Cmd) {
         arg_str0("n", "documentnumber", "<alphanum>", "document number, up to 9 chars"),
         arg_str0("d", "dateofbirth", "<YYMMDD>", "date of birth in YYMMDD format"),
         arg_str0("e", "expiry", "<YYMMDD>", "expiry in YYMMDD format"),
-        arg_str0("m", "mrz", "<[0-9A-Z<]>", "2nd line of MRZ, 44 chars"),
+        arg_str0("m", "mrz", "<[0-9A-Z<]>", "2nd line of MRZ, 44 chars (passports only)"),
         arg_str0(NULL, "path", "<dirpath>", "display info from offline dump stored in dirpath"),
         arg_param_end
     };

From 73dec1e072c13bd4fb039e3bcd6fc95e606975d6 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Wed, 23 Dec 2020 19:57:50 +0000
Subject: [PATCH 192/682] ui: Load readline after stdio.h

---
 client/src/ui.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/client/src/ui.c b/client/src/ui.c
index f9595e5f3..25d5edf7e 100644
--- a/client/src/ui.c
+++ b/client/src/ui.c
@@ -14,9 +14,6 @@
 #if !defined(_WIN32)
 #define _POSIX_C_SOURCE 200112L
 #endif
-#ifdef HAVE_READLINE
-#include <readline/readline.h>
-#endif
 #include "ui.h"
 #include "commonutil.h"  // ARRAYLEN
 
@@ -24,6 +21,10 @@
 #include <stdarg.h>
 #include <stdlib.h>
 
+#ifdef HAVE_READLINE
+#include <readline/readline.h>
+#endif
+
 #include <complex.h>
 #include "util.h"
 #include "proxmark3.h"  // PROXLOG

From 9987ebf53493df280d9ef04e4e3efecc201f97b4 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Wed, 23 Dec 2020 23:08:34 +0300
Subject: [PATCH 193/682] emrtd: Use memcmp for JPEG headers

---
 client/src/cmdhfemrtd.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 499b06c1a..1a51ea427 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -693,17 +693,19 @@ static bool emrtd_select_and_read(uint8_t *dataout, int *dataoutlen, const char
     return true;
 }
 
+const uint8_t jpeg_header[4] = { 0xFF, 0xD8, 0xFF, 0xE0 };
+const uint8_t jpeg2k_header[6] = { 0x00, 0x00, 0x00, 0x0C, 0x6A, 0x50 };
+
 static int emrtd_dump_ef_dg2(uint8_t *file_contents, size_t file_length) {
     int offset, datalen = 0;
 
     // This is a hacky impl that just looks for the image header. I'll improve it eventually.
     // based on mrpkey.py
-    // FF D8 FF E0 -> JPEG
-    // 00 00 00 0C 6A 50 -> JPEG 2000
     // Note: Doing file_length - 6 to account for the longest data we're checking.
+    // Checks first byte before the rest to reduce overhead
     for (offset = 0; offset < file_length - 6; offset++) {
-        if ((file_contents[offset] == 0xFF && file_contents[offset + 1] == 0xD8 && file_contents[offset + 2] == 0xFF && file_contents[offset + 3] == 0xE0) ||
-                (file_contents[offset] == 0x00 && file_contents[offset + 1] == 0x00 && file_contents[offset + 2] == 0x00 && file_contents[offset + 3] == 0x0C && file_contents[offset + 4] == 0x6A && file_contents[offset + 5] == 0x50)) {
+        if ((file_contents[offset] == 0xFF && memcmp(jpeg_header, file_contents + offset, 4) != 0) ||
+                (file_contents[offset] == 0x00 && memcmp(jpeg2k_header, file_contents + offset, 6) != 0)) {
             datalen = file_length - offset;
             break;
         }

From f26e027e23259f247c87efc6ffc998ff80b07624 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Wed, 23 Dec 2020 23:13:13 +0300
Subject: [PATCH 194/682] gitignore: Ignore emrtd dumps

---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index 081c0f8e8..94b4c221b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -98,6 +98,7 @@ tools/andrew/*
 tools/jtag_openocd/openocd_configuration
 ppls patches/*
 *- Copy.*
+/EF_*
 
 client/lualibs/mfc_default_keys.lua
 client/lualibs/pm3_cmd.lua

From a1762fa4a30dde35e92d2f0c5164aa3c5d59c948 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Wed, 23 Dec 2020 23:21:54 +0300
Subject: [PATCH 195/682] emrtd: Mark biometrics as EAC-only and introduce the
 concept

---
 client/src/cmdhfemrtd.c | 48 ++++++++++++++++++++---------------------
 client/src/cmdhfemrtd.h |  1 +
 2 files changed, 25 insertions(+), 24 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 1a51ea427..fa669f103 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -84,28 +84,28 @@ typedef enum  { // list must match dg_table
 } emrtd_dg_enum;
 
 static emrtd_dg_t dg_table[] = {
-//  tag     fileid  filename           desc                                                 pace   req    fast   parser                    dumper
-    {0x60, "011E", "EF_COM",          "Header and Data Group Presence Information",         false, true,  true,  emrtd_print_ef_com_info,  NULL},
-    {0x61, "0101", "EF_DG1",          "Details recorded in MRZ",                            false, true,  true,  emrtd_print_ef_dg1_info,  NULL},
-    {0x75, "0102", "EF_DG2",          "Encoded Face",                                       false, true,  false, NULL,                     emrtd_dump_ef_dg2},
-    {0x63, "0103", "EF_DG3",          "Encoded Finger(s)",                                  true,  false, false, NULL,                     NULL},
-    {0x76, "0104", "EF_DG4",          "Encoded Eye(s)",                                     true,  false, false, NULL,                     NULL},
-    {0x65, "0105", "EF_DG5",          "Displayed Portrait",                                 false, false, false, NULL,                     emrtd_dump_ef_dg5},
-    {0x66, "0106", "EF_DG6",          "Reserved for Future Use",                            false, false, false, NULL,                     NULL},
-    {0x67, "0107", "EF_DG7",          "Displayed Signature or Usual Mark",                  false, false, false, NULL,                     emrtd_dump_ef_dg7},
-    {0x68, "0108", "EF_DG8",          "Data Feature(s)",                                    false, false, true,  NULL,                     NULL},
-    {0x69, "0109", "EF_DG9",          "Structure Feature(s)",                               false, false, true,  NULL,                     NULL},
-    {0x6a, "010A", "EF_DG10",         "Substance Feature(s)",                               false, false, true,  NULL,                     NULL},
-    {0x6b, "010B", "EF_DG11",         "Additional Personal Detail(s)",                      false, false, true,  emrtd_print_ef_dg11_info, NULL},
-    {0x6c, "010C", "EF_DG12",         "Additional Document Detail(s)",                      false, false, true,  emrtd_print_ef_dg12_info, NULL},
-    {0x6d, "010D", "EF_DG13",         "Optional Detail(s)",                                 false, false, true,  NULL,                     NULL},
-    {0x6e, "010E", "EF_DG14",         "Security Options",                                   false, false, true,  NULL,                     NULL},
-    {0x6f, "010F", "EF_DG15",         "Active Authentication Public Key Info",              false, false, true,  NULL,                     NULL},
-    {0x70, "0110", "EF_DG16",         "Person(s) to Notify",                                false, false, true,  NULL,                     NULL},
-    {0x77, "011D", "EF_SOD",          "Document Security Object",                           false, false, true,  emrtd_print_ef_sod_info,  emrtd_dump_ef_sod},
-    {0xff, "011C", "EF_CardAccess",   "PACE SecurityInfos",                                 true,  true,  true,  NULL,                     NULL},
-    {0xff, "011D", "EF_CardSecurity", "PACE SecurityInfos for Chip Authentication Mapping", true,  false, true,  NULL,                     NULL},
-    {0x00, NULL, NULL, NULL, false, false, false, NULL, NULL}
+//  tag     fileid  filename           desc                                                 pace   eac    req    fast   parser                    dumper
+    {0x60, "011E", "EF_COM",          "Header and Data Group Presence Information",         false, false, true,  true,  emrtd_print_ef_com_info,  NULL},
+    {0x61, "0101", "EF_DG1",          "Details recorded in MRZ",                            false, false, true,  true,  emrtd_print_ef_dg1_info,  NULL},
+    {0x75, "0102", "EF_DG2",          "Encoded Face",                                       false, false, true,  false, NULL,                     emrtd_dump_ef_dg2},
+    {0x63, "0103", "EF_DG3",          "Encoded Finger(s)",                                  false, true,  false, false, NULL,                     NULL},
+    {0x76, "0104", "EF_DG4",          "Encoded Eye(s)",                                     false, true,  false, false, NULL,                     NULL},
+    {0x65, "0105", "EF_DG5",          "Displayed Portrait",                                 false, false, false, false, NULL,                     emrtd_dump_ef_dg5},
+    {0x66, "0106", "EF_DG6",          "Reserved for Future Use",                            false, false, false, false, NULL,                     NULL},
+    {0x67, "0107", "EF_DG7",          "Displayed Signature or Usual Mark",                  false, false, false, false, NULL,                     emrtd_dump_ef_dg7},
+    {0x68, "0108", "EF_DG8",          "Data Feature(s)",                                    false, false, false, true,  NULL,                     NULL},
+    {0x69, "0109", "EF_DG9",          "Structure Feature(s)",                               false, false, false, true,  NULL,                     NULL},
+    {0x6a, "010A", "EF_DG10",         "Substance Feature(s)",                               false, false, false, true,  NULL,                     NULL},
+    {0x6b, "010B", "EF_DG11",         "Additional Personal Detail(s)",                      false, false, false, true,  emrtd_print_ef_dg11_info, NULL},
+    {0x6c, "010C", "EF_DG12",         "Additional Document Detail(s)",                      false, false, false, true,  emrtd_print_ef_dg12_info, NULL},
+    {0x6d, "010D", "EF_DG13",         "Optional Detail(s)",                                 false, false, false, true,  NULL,                     NULL},
+    {0x6e, "010E", "EF_DG14",         "Security Options",                                   false, false, false, true,  NULL,                     NULL},
+    {0x6f, "010F", "EF_DG15",         "Active Authentication Public Key Info",              false, false, false, true,  NULL,                     NULL},
+    {0x70, "0110", "EF_DG16",         "Person(s) to Notify",                                false, false, false, true,  NULL,                     NULL},
+    {0x77, "011D", "EF_SOD",          "Document Security Object",                           false, false, false, true,  emrtd_print_ef_sod_info,  emrtd_dump_ef_sod},
+    {0xff, "011C", "EF_CardAccess",   "PACE SecurityInfos",                                 true,  false, true,  true,  NULL,                     NULL},
+    {0xff, "011D", "EF_CardSecurity", "PACE SecurityInfos for Chip Authentication Mapping", true,  false, false, true,  NULL,                     NULL},
+    {0x00, NULL, NULL, NULL, false, false, false, false, NULL, NULL}
 };
 
 static emrtd_dg_t *emrtd_tag_to_dg(uint8_t tag) {
@@ -1026,7 +1026,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
             continue;
         }
         PrintAndLogEx(DEBUG, "Current file: %s", dg->filename);
-        if (!dg->pace) {
+        if (!dg->pace && !dg->eac) {
             emrtd_dump_file(ks_enc, ks_mac, ssc, dg->fileid, dg->filename, BAC, use_14b);
         }
     }
@@ -1643,7 +1643,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
             PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
             continue;
         }
-        if (dg->fastdump && !dg->pace) {
+        if (dg->fastdump && !dg->pace && !dg->eac) {
             if (emrtd_select_and_read(response, &resplen, dg->fileid, ks_enc, ks_mac, ssc, BAC, use_14b)) {
                 if (dg->parser != NULL)
                     dg->parser(response, resplen);
diff --git a/client/src/cmdhfemrtd.h b/client/src/cmdhfemrtd.h
index 9df7846ad..bcae56538 100644
--- a/client/src/cmdhfemrtd.h
+++ b/client/src/cmdhfemrtd.h
@@ -19,6 +19,7 @@ typedef struct emrtd_dg_s {
     const char *filename;
     const char *desc;
     bool pace;
+    bool eac; // EAC only (we can't dump these)
     bool required; // some are required only if PACE
     bool fastdump; // fast to dump
     int (*parser)(uint8_t *data, size_t datalen);

From 9e7d515c37d1303de07b635b0e0682ddb4a8303c Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Wed, 23 Dec 2020 23:52:31 +0300
Subject: [PATCH 196/682] emrtd info: Don't print EF_SOD info

---
 client/src/cmdhfemrtd.c | 163 ++++++++++++++++++++--------------------
 1 file changed, 81 insertions(+), 82 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index fa669f103..88a79707a 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -58,7 +58,6 @@ static int emrtd_print_ef_com_info(uint8_t *data, size_t datalen);
 static int emrtd_print_ef_dg1_info(uint8_t *data, size_t datalen);
 static int emrtd_print_ef_dg11_info(uint8_t *data, size_t datalen);
 static int emrtd_print_ef_dg12_info(uint8_t *data, size_t datalen);
-static int emrtd_print_ef_sod_info(uint8_t *data, size_t datalen);
 
 typedef enum  { // list must match dg_table
     EF_COM = 0,
@@ -102,7 +101,7 @@ static emrtd_dg_t dg_table[] = {
     {0x6e, "010E", "EF_DG14",         "Security Options",                                   false, false, false, true,  NULL,                     NULL},
     {0x6f, "010F", "EF_DG15",         "Active Authentication Public Key Info",              false, false, false, true,  NULL,                     NULL},
     {0x70, "0110", "EF_DG16",         "Person(s) to Notify",                                false, false, false, true,  NULL,                     NULL},
-    {0x77, "011D", "EF_SOD",          "Document Security Object",                           false, false, false, true,  emrtd_print_ef_sod_info,  emrtd_dump_ef_sod},
+    {0x77, "011D", "EF_SOD",          "Document Security Object",                           false, false, false, false, NULL,                     emrtd_dump_ef_sod},
     {0xff, "011C", "EF_CardAccess",   "PACE SecurityInfos",                                 true,  false, true,  true,  NULL,                     NULL},
     {0xff, "011D", "EF_CardSecurity", "PACE SecurityInfos for Chip Authentication Mapping", true,  false, false, true,  NULL,                     NULL},
     {0x00, NULL, NULL, NULL, false, false, false, false, NULL, NULL}
@@ -1484,106 +1483,106 @@ static int emrtd_print_ef_dg12_info(uint8_t *data, size_t datalen) {
     return PM3_SUCCESS;
 }
 
-static int emrtd_ef_sod_extract_signatures(uint8_t *data, size_t datalen, uint8_t *dataout, size_t *dataoutlen) {
-    // very very very very cursed code.
-    uint8_t top[EMRTD_MAX_FILE_SIZE] = { 0x00 };
-    uint8_t signeddata[EMRTD_MAX_FILE_SIZE] = { 0x00 };
-    uint8_t emrtdsigcontainer[EMRTD_MAX_FILE_SIZE] = { 0x00 };
-    uint8_t emrtdsig[EMRTD_MAX_FILE_SIZE] = { 0x00 };
-    uint8_t emrtdsigtext[EMRTD_MAX_FILE_SIZE] = { 0x00 };
-    size_t toplen, signeddatalen, emrtdsigcontainerlen, emrtdsiglen, emrtdsigtextlen = 0;
+// static int emrtd_ef_sod_extract_signatures(uint8_t *data, size_t datalen, uint8_t *dataout, size_t *dataoutlen) {
+//     // very very very very cursed code.
+//     uint8_t top[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+//     uint8_t signeddata[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+//     uint8_t emrtdsigcontainer[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+//     uint8_t emrtdsig[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+//     uint8_t emrtdsigtext[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+//     size_t toplen, signeddatalen, emrtdsigcontainerlen, emrtdsiglen, emrtdsigtextlen = 0;
 
-    if (!emrtd_lds_get_data_by_tag(data, datalen, top, &toplen, 0x30, 0x00, false, true, 0)) {
-        PrintAndLogEx(ERR, "Failed to read top from EF_SOD.");
-        return false;
-    }
+//     if (!emrtd_lds_get_data_by_tag(data, datalen, top, &toplen, 0x30, 0x00, false, true, 0)) {
+//         PrintAndLogEx(ERR, "Failed to read top from EF_SOD.");
+//         return false;
+//     }
 
-    PrintAndLogEx(DEBUG, "top: %s.", sprint_hex_inrow(top, toplen));
+//     PrintAndLogEx(DEBUG, "top: %s.", sprint_hex_inrow(top, toplen));
 
-    if (!emrtd_lds_get_data_by_tag(top, toplen, signeddata, &signeddatalen, 0xA0, 0x00, false, false, 0)) {
-        PrintAndLogEx(ERR, "Failed to read signedData from EF_SOD.");
-        return false;
-    }
+//     if (!emrtd_lds_get_data_by_tag(top, toplen, signeddata, &signeddatalen, 0xA0, 0x00, false, false, 0)) {
+//         PrintAndLogEx(ERR, "Failed to read signedData from EF_SOD.");
+//         return false;
+//     }
 
-    PrintAndLogEx(DEBUG, "signeddata: %s.", sprint_hex_inrow(signeddata, signeddatalen));
+//     PrintAndLogEx(DEBUG, "signeddata: %s.", sprint_hex_inrow(signeddata, signeddatalen));
 
-    // Do true on reading into the tag as it's a "sequence"
-    if (!emrtd_lds_get_data_by_tag(signeddata, signeddatalen, emrtdsigcontainer, &emrtdsigcontainerlen, 0x30, 0x00, false, true, 0)) {
-        PrintAndLogEx(ERR, "Failed to read eMRTDSignature container from EF_SOD.");
-        return false;
-    }
+//     // Do true on reading into the tag as it's a "sequence"
+//     if (!emrtd_lds_get_data_by_tag(signeddata, signeddatalen, emrtdsigcontainer, &emrtdsigcontainerlen, 0x30, 0x00, false, true, 0)) {
+//         PrintAndLogEx(ERR, "Failed to read eMRTDSignature container from EF_SOD.");
+//         return false;
+//     }
 
-    PrintAndLogEx(DEBUG, "emrtdsigcontainer: %s.", sprint_hex_inrow(emrtdsigcontainer, emrtdsigcontainerlen));
+//     PrintAndLogEx(DEBUG, "emrtdsigcontainer: %s.", sprint_hex_inrow(emrtdsigcontainer, emrtdsigcontainerlen));
 
-    if (!emrtd_lds_get_data_by_tag(emrtdsigcontainer, emrtdsigcontainerlen, emrtdsig, &emrtdsiglen, 0xA0, 0x00, false, false, 0)) {
-        PrintAndLogEx(ERR, "Failed to read eMRTDSignature from EF_SOD.");
-        return false;
-    }
+//     if (!emrtd_lds_get_data_by_tag(emrtdsigcontainer, emrtdsigcontainerlen, emrtdsig, &emrtdsiglen, 0xA0, 0x00, false, false, 0)) {
+//         PrintAndLogEx(ERR, "Failed to read eMRTDSignature from EF_SOD.");
+//         return false;
+//     }
 
-    PrintAndLogEx(DEBUG, "emrtdsig: %s.", sprint_hex_inrow(emrtdsig, emrtdsiglen));
+//     PrintAndLogEx(DEBUG, "emrtdsig: %s.", sprint_hex_inrow(emrtdsig, emrtdsiglen));
 
-    // TODO: Not doing memcpy here, it didn't work, fix it somehow
-    if (!emrtd_lds_get_data_by_tag(emrtdsig, emrtdsiglen, emrtdsigtext, &emrtdsigtextlen, 0x04, 0x00, false, false, 0)) {
-        PrintAndLogEx(ERR, "Failed to read eMRTDSignature (text) from EF_SOD.");
-        return false;
-    }
-    memcpy(dataout, emrtdsigtext, emrtdsigtextlen);
-    *dataoutlen = emrtdsigtextlen;
-    return PM3_SUCCESS;
-}
+//     // TODO: Not doing memcpy here, it didn't work, fix it somehow
+//     if (!emrtd_lds_get_data_by_tag(emrtdsig, emrtdsiglen, emrtdsigtext, &emrtdsigtextlen, 0x04, 0x00, false, false, 0)) {
+//         PrintAndLogEx(ERR, "Failed to read eMRTDSignature (text) from EF_SOD.");
+//         return false;
+//     }
+//     memcpy(dataout, emrtdsigtext, emrtdsigtextlen);
+//     *dataoutlen = emrtdsigtextlen;
+//     return PM3_SUCCESS;
+// }
 
-static int emrtd_print_ef_sod_info(uint8_t *data, size_t datalen) {
-    uint8_t emrtdsig[EMRTD_MAX_FILE_SIZE] = { 0x00 };
-    uint8_t hashlist[EMRTD_MAX_FILE_SIZE] = { 0x00 };
-    uint8_t hash[65] = { 0x00 };
-    size_t hashlen = 0;
+// static int emrtd_print_ef_sod_info(uint8_t *data, size_t datalen) {
+//     uint8_t emrtdsig[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+//     uint8_t hashlist[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+//     uint8_t hash[65] = { 0x00 };
+//     size_t hashlen = 0;
 
-    uint8_t hashidstr[4] = { 0x00 };
-    size_t hashidstrlen = 0;
+//     uint8_t hashidstr[4] = { 0x00 };
+//     size_t hashidstrlen = 0;
 
-    // size_t emrtdsiglen, e_datalen, e_fieldlen = 0;
-    size_t emrtdsiglen = 0;
-    size_t hashlistlen = 0;
-    size_t e_datalen = 0;
-    size_t e_fieldlen = 0;
-    size_t offset = 0;
+//     // size_t emrtdsiglen, e_datalen, e_fieldlen = 0;
+//     size_t emrtdsiglen = 0;
+//     size_t hashlistlen = 0;
+//     size_t e_datalen = 0;
+//     size_t e_fieldlen = 0;
+//     size_t offset = 0;
 
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_SOD") " --------------------");
+//     PrintAndLogEx(NORMAL, "");
+//     PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_SOD") " --------------------");
 
-    if (emrtd_ef_sod_extract_signatures(data, datalen, emrtdsig, &emrtdsiglen) != PM3_SUCCESS) {
-        return false;
-    }
+//     if (emrtd_ef_sod_extract_signatures(data, datalen, emrtdsig, &emrtdsiglen) != PM3_SUCCESS) {
+//         return false;
+//     }
 
-    PrintAndLogEx(DEBUG, "hash data: %s", sprint_hex_inrow(emrtdsig, emrtdsiglen));
+//     PrintAndLogEx(DEBUG, "hash data: %s", sprint_hex_inrow(emrtdsig, emrtdsiglen));
 
-    if (!emrtd_lds_get_data_by_tag(emrtdsig, emrtdsiglen, hashlist, &hashlistlen, 0x30, 0x00, false, true, 1)) {
-        PrintAndLogEx(ERR, "Failed to read hash list from EF_SOD.");
-        return false;
-    }
+//     if (!emrtd_lds_get_data_by_tag(emrtdsig, emrtdsiglen, hashlist, &hashlistlen, 0x30, 0x00, false, true, 1)) {
+//         PrintAndLogEx(ERR, "Failed to read hash list from EF_SOD.");
+//         return false;
+//     }
 
-    PrintAndLogEx(DEBUG, "hash list: %s", sprint_hex_inrow(hashlist, hashlistlen));
+//     PrintAndLogEx(DEBUG, "hash list: %s", sprint_hex_inrow(hashlist, hashlistlen));
 
-    while (offset < hashlistlen) {
-        // Get the length of the element
-        e_datalen = emrtd_get_asn1_data_length(hashlist + offset, hashlistlen - offset, 1);
+//     while (offset < hashlistlen) {
+//         // Get the length of the element
+//         e_datalen = emrtd_get_asn1_data_length(hashlist + offset, hashlistlen - offset, 1);
 
-        // Get the length of the element's length
-        e_fieldlen = emrtd_get_asn1_field_length(hashlist + offset, hashlistlen - offset, 1);
+//         // Get the length of the element's length
+//         e_fieldlen = emrtd_get_asn1_field_length(hashlist + offset, hashlistlen - offset, 1);
 
-        switch (hashlist[offset]) {
-            case 0x30:
-                emrtd_lds_get_data_by_tag(hashlist + offset + e_fieldlen + 1, e_datalen, hashidstr, &hashidstrlen, 0x02, 0x00, false, false, 0);
-                emrtd_lds_get_data_by_tag(hashlist + offset + e_fieldlen + 1, e_datalen, hash, &hashlen, 0x04, 0x00, false, false, 0);
-                PrintAndLogEx(SUCCESS, "Hash for EF_DG%i: %s", hashidstr[0], sprint_hex_inrow(hash, hashlen));
-                break;
-        }
-        // + 1 for length of ID
-        offset += 1 + e_datalen + e_fieldlen;
-    }
+//         switch (hashlist[offset]) {
+//             case 0x30:
+//                 emrtd_lds_get_data_by_tag(hashlist + offset + e_fieldlen + 1, e_datalen, hashidstr, &hashidstrlen, 0x02, 0x00, false, false, 0);
+//                 emrtd_lds_get_data_by_tag(hashlist + offset + e_fieldlen + 1, e_datalen, hash, &hashlen, 0x04, 0x00, false, false, 0);
+//                 PrintAndLogEx(SUCCESS, "Hash for EF_DG%i: %s", hashidstr[0], sprint_hex_inrow(hash, hashlen));
+//                 break;
+//         }
+//         // + 1 for length of ID
+//         offset += 1 + e_datalen + e_fieldlen;
+//     }
 
-    return PM3_SUCCESS;
-}
+//     return PM3_SUCCESS;
+// }
 
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available) {
     uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
@@ -1696,7 +1695,7 @@ int infoHF_EMRTD_offline(const char *path) {
             PrintAndLogEx(INFO, "File tag not found, skipping: %02X", filelist[i]);
             continue;
         }
-        if (!dg->pace) {
+        if (!dg->pace && !dg->eac) {
             strcpy(filepath, path);
             strncat(filepath, PATHSEP, 2);
             strcat(filepath, dg->filename);

From b91bc9bb856e9895dd2c3c10bd5fa92bf6a83030 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Wed, 23 Dec 2020 16:01:50 -0500
Subject: [PATCH 197/682] hf_legic Lua - change method for temp file naming

---
 client/luascripts/hf_legic.lua | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/client/luascripts/hf_legic.lua b/client/luascripts/hf_legic.lua
index b8b9931cd..ca06ae8c5 100644
--- a/client/luascripts/hf_legic.lua
+++ b/client/luascripts/hf_legic.lua
@@ -704,12 +704,31 @@ function writeFile(bytes, filename)
     return true
 end
 
+function getRandomTempName()
+  local upperCase = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+  local lowerCase = "abcdefghijklmnopqrstuvwxyz"
+
+  local characterSet = upperCase .. lowerCase
+
+  local keyLength = 8
+  local output = ""
+
+  for	i = 1, keyLength do
+    local rand = math.random(#characterSet)
+    output = output .. string.sub(characterSet, rand, rand)
+  end
+
+  output = "hf-legic-temp-" .. output
+
+  return output
+end
+
 ---
 -- read from pm3 into virtual-tag
 function readFromPM3()
   local tag, bytes, infile
     --infile="legic.temp"
-    infile=os.tmpname()
+    infile=getRandomTempName()
     core.console("hf legic dump -f "..infile)
     tag=readFile(infile..".bin")
     os.remove(infile)

From 902b6c98668e894901995f5e9de76969943f48c5 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 23 Dec 2020 22:54:56 +0100
Subject: [PATCH 198/682] hf/lf tune - show Volt max.  And use corect session
 support identification

---
 client/src/ui.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/client/src/ui.c b/client/src/ui.c
index 25d5edf7e..885910919 100644
--- a/client/src/ui.c
+++ b/client/src/ui.c
@@ -657,7 +657,8 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
         "\xe2\x96\x88",
     };
 
-    uint8_t mode = session.emoji_mode == EMOJI;
+    uint8_t mode = session.supports_colors;
+
     const char *block[] = {"#", "\xe2\x96\x88"};
     // use a 3-byte space in emoji mode to ease computations
     const char *space[] = {" ", "\xe2\x80\x80"};
@@ -704,12 +705,12 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
             break;
         }
         case STYLE_MIXED: {
-            sprintf(buffer, "%s [ %zu mV / %3u V ]", cbar, count, (uint32_t)(count / 1000));
+            sprintf(buffer, "%s [ %zu mV / %2u V / %2u Vmax ]", cbar, count, (uint32_t)(count / 1000), (uint32_t)(max / 1000));
             printf("\b%c[2K\r[" _YELLOW_("=")"] %s ", 27, buffer);
             break;
         }
         case STYLE_VALUE: {
-            printf("[" _YELLOW_("=")"] %zu mV / %3u V \r", count, (uint32_t)(count / 1000));
+            printf("[" _YELLOW_("=")"] %zu mV / %2u V / %2u Vmax\r", count, (uint32_t)(count / 1000), (uint32_t)(max / 1000));
             break;
         }
     }

From 3d76be2dbdcfa7bc293ba06614b7acd6a451cccb Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 24 Dec 2020 10:55:36 +0100
Subject: [PATCH 199/682] coverity fix

---
 client/src/cmdhf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdhf.c b/client/src/cmdhf.c
index ada69e905..85044f27b 100644
--- a/client/src/cmdhf.c
+++ b/client/src/cmdhf.c
@@ -52,13 +52,15 @@ int CmdHFSearch(const char *Cmd) {
     CLIParserInit(&ctx, "hf search",
                   "Will try to find a HF read out of the unknown tag.\n"
                   "Continues to search for all different HF protocols.",
-                  "hf sniff"
+                  "hf search"
                  );
     void *argtable[] = {
         arg_param_begin,
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
+
     int res = PM3_ESOFT;
 
     PROMPT_CLEARLINE;

From d801d2be0f793787c60b98224eb1dc255c961916 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 26 Dec 2020 22:11:56 +0100
Subject: [PATCH 200/682] lf/hf tune - color vs emoji...

---
 client/src/ui.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/client/src/ui.c b/client/src/ui.c
index 885910919..391279e52 100644
--- a/client/src/ui.c
+++ b/client/src/ui.c
@@ -657,7 +657,7 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
         "\xe2\x96\x88",
     };
 
-    uint8_t mode = session.supports_colors;
+    uint8_t mode = (session.emoji_mode == EMOJI);
 
     const char *block[] = {"#", "\xe2\x96\x88"};
     // use a 3-byte space in emoji mode to ease computations
@@ -689,11 +689,15 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
     char *cbar = calloc(collen, sizeof(uint8_t));
 
     // Add colors
-    int p60 = unit * (width * 60 / 100);
-    int p20 = unit * (width * 20 / 100);
-    snprintf(cbar,  collen,  _GREEN_("%.*s"), p60, bar);
-    snprintf(cbar + strlen(cbar), collen - strlen(cbar), _CYAN_("%.*s"), p20,  bar + p60);
-    snprintf(cbar + strlen(cbar), collen - strlen(cbar), _YELLOW_("%.*s"), unit * width - p60 - p20, bar + p60 + p20);
+    if ( session.supports_colors ) {
+        int p60 = unit * (width * 60 / 100);
+        int p20 = unit * (width * 20 / 100);
+        snprintf(cbar,  collen,  _GREEN_("%.*s"), p60, bar);
+        snprintf(cbar + strlen(cbar), collen - strlen(cbar), _CYAN_("%.*s"), p20,  bar + p60);
+        snprintf(cbar + strlen(cbar), collen - strlen(cbar), _YELLOW_("%.*s"), unit * width - p60 - p20, bar + p60 + p20);
+    } else {
+        snprintf(cbar,  collen,  "%s", bar);
+    }
 
     size_t len = strlen(cbar) + 32;
     char *buffer = calloc(len, sizeof(uint8_t));

From 20bc2b060b4867f441ee7b2bf44ca3f5fc420095 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 26 Dec 2020 22:12:22 +0100
Subject: [PATCH 201/682] textual

---
 README.md | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/README.md b/README.md
index b8140e407..56af79cda 100644
--- a/README.md
+++ b/README.md
@@ -135,12 +135,6 @@ The separation from official Proxmark3 repo gives us a lot of freedom to create
 The official PM3-GUI from Gaucho will not work.
 The new [Proxmark3 Universal GUI](https://github.com/burma69/PM3UniversalGUI) will work more or less. Change is needed in order to show helptext when client isn't connected to a device.  We don't know how active the maintainers.
 
-## The end
-
-- July 2018 [@herrmann1001](https://mobile.twitter.com/herrmann1001)
-- updated Feb 2019 [@5w0rdfish](https://mobile.twitter.com/5w0rdFish)
-- updated 2019 [@doegox](https://mobile.twitter.com/doegox)
-
 # Donations
 
 Nothing says thank you as much as a donation. So if you feel the love, do feel free to become a iceman patron. For some tiers it comes with rewards.

From 9007629213890eb523eaa648b6c2a3a4cc7c6ebf Mon Sep 17 00:00:00 2001
From: ikarus <ikarus4ever@web.de>
Date: Sun, 27 Dec 2020 15:44:59 +0100
Subject: [PATCH 202/682] apdufind: filter reoccurring SWs & reset filed on
 tractive errors.

---
 client/src/cmdhf14a.c | 60 ++++++++++++++++++++++++++++---------------
 client/src/ui.c       |  2 +-
 2 files changed, 41 insertions(+), 21 deletions(-)

diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index d4418ee62..fd03d60a4 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -2135,15 +2135,26 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
 }
 
 static uint16_t get_sw(uint8_t *d, uint8_t n) {
-    if (n < 2)
+    if (n < 2) {
         return 0;
-
+    }
     n -= 2;
     return d[n] * 0x0100 + d[n + 1];
 }
 
+static uint64_t inc_sw_error_occurence(uint16_t sw, uint64_t all_sw[256][256]) {
+    uint8_t sw1 = (uint8_t)(sw >> 8);
+    uint8_t sw2 = (uint8_t)(0xff & sw);
+    if (sw1 == 0x90 && sw2 == 0x00) {
+        return 0; // Don't count successes.
+    }
+    if (sw1 == 0x6d && sw2 == 0x00) {
+        return 0xffffffffffffffffULL; // Always max "Instruction not supported".
+    }
+    return ++all_sw[sw1][sw2];
+}
+
 static int CmdHf14AFindapdu(const char *Cmd) {
-    // TODO: What response values should be considerd "valid" or "instersting" (worth dispalying)?
     // TODO: Option to select AID/File (and skip INS 0xA4).
     // TODO: Validate the decoding of the APDU (not specific to this command, check
     //       https://cardwerk.com/smartcards/smartcard_standard_ISO7816-4_5_basic_organizations.aspx#chap5_3_2).
@@ -2161,12 +2172,13 @@ static int CmdHf14AFindapdu(const char *Cmd) {
 
     void *argtable[] = {
         arg_param_begin,
-        arg_str0("c",  "cla",    "<hex>",    "Start value of CLASS (1 hex byte)"),
-        arg_str0("i",  "ins",    "<hex>",    "Start value of INSTRUCTION (1 hex byte)"),
-        arg_str0(NULL, "p1",     "<hex>",    "Start value of P1 (1 hex byte)"),
-        arg_str0(NULL, "p2",     "<hex>",    "Start value of P2 (1 hex byte)"),
-        arg_u64_0("r", "reset",  "<number>", "Minimum secondes before resetting the tag (to prevent timeout issues). Default is 5 minutes"),
-        arg_lit0("v",  "verbose",            "Verbose output"),
+        arg_str0("c",  "cla",           "<hex>",    "Start value of CLASS (1 hex byte)"),
+        arg_str0("i",  "ins",           "<hex>",    "Start value of INSTRUCTION (1 hex byte)"),
+        arg_str0(NULL, "p1",            "<hex>",    "Start value of P1 (1 hex byte)"),
+        arg_str0(NULL, "p2",            "<hex>",    "Start value of P2 (1 hex byte)"),
+        arg_u64_0("r", "reset",         "<number>", "Minimum secondes before resetting the tag (to prevent timeout issues). Default is 5 minutes"),
+        arg_u64_0("e", "error-limit",   "<number>", "Maximum times an status word other than 0x9000 or 0x6D00 is shown. Default is 500."),
+        arg_lit0("v",  "verbose",                   "Verbose output"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
@@ -2184,7 +2196,8 @@ static int CmdHf14AFindapdu(const char *Cmd) {
     uint8_t p2_arg[1] = {0};
     CLIGetHexWithReturn(ctx, 4, p2_arg, &p2_len);
     uint64_t reset_time = arg_get_u64_def(ctx, 5, 5 * 60); // Reset every 5 minutes.
-    bool verbose = arg_get_lit(ctx, 6);
+    uint64_t error_limit = arg_get_u64_def(ctx, 6, 500);
+    bool verbose = arg_get_lit(ctx, 7);
 
     CLIParserFree(ctx);
 
@@ -2211,6 +2224,8 @@ static int CmdHf14AFindapdu(const char *Cmd) {
     PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
 
     bool inc_p1 = true;
+    uint64_t all_sw[256][256] = {0};
+    uint64_t sw_occurences = 0;
     uint64_t t_start = msclock();
     uint64_t t_last_reset = msclock();
 
@@ -2233,33 +2248,38 @@ static int CmdHf14AFindapdu(const char *Cmd) {
                 int command_n = sizeof(command);
                 res = ExchangeAPDU14a(command, command_n, activate_field, keep_field_on, response, sizeof(response), &response_n);
                 if (res) {
+                    DropField();
+                    activate_field = true;
                     continue;
                 }
+                uint16_t sw = get_sw(response, response_n);
+                sw_occurences = inc_sw_error_occurence(sw, all_sw);
 
                 // Was there and length error? If so, try with Le length (case 2 instad of case 1,
                 // https://stackoverflow.com/a/30679558). Le = 0x00 will get interpreted as extended length APDU
                 // with Le being 0x0100.
-                uint16_t sw = get_sw(response, response_n);
                 bool command_with_le = false;
                 if (sw == 0x6700) {
-                    PrintAndLogEx(INFO, "Got response for APDU \"%02X%02X%02X%02X\": %04X (%s)", cla, ins, p1, p2,
-                                  sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
-                    PrintAndLogEx(INFO, "Resending current command with Le = 0x0100 (extended length APDU)");
+                    if (sw_occurences < error_limit) {
+                        PrintAndLogEx(INFO, "Got response for APDU \"%02X%02X%02X%02X\": %04X (%s)", cla, ins, p1, p2,
+                                      sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
+                        PrintAndLogEx(INFO, "Resending current command with Le = 0x0100 (extended length APDU)");
+                    }
                     uint8_t command2[7] = {cla, ins, p1, p2, 0x00};
                     int command2_n = sizeof(command2);
                     res = ExchangeAPDU14a(command2, command2_n, activate_field, keep_field_on, response, sizeof(response), &response_n);
                     if (res) {
+                        DropField();
+                        activate_field = true;
                         continue;
                     }
+                    sw = get_sw(response, response_n);
+                    sw_occurences = inc_sw_error_occurence(sw, all_sw);
                     command_with_le = true;
                 }
 
-                // Check response.
-                sw = get_sw(response, response_n);
-                if (sw != 0x6a86 &&
-                        sw != 0x6986 &&
-                        sw != 0x6d00
-                   ) {
+                // Show response.
+                if (sw_occurences < error_limit) {
                     if (command_with_le) {
                         PrintAndLogEx(INFO, "Got response for APDU \"%02X%02X%02X%02X00\": %04X (%s)", cla, ins, p1, p2,
                                       sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
diff --git a/client/src/ui.c b/client/src/ui.c
index 391279e52..b7e63e7dd 100644
--- a/client/src/ui.c
+++ b/client/src/ui.c
@@ -689,7 +689,7 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
     char *cbar = calloc(collen, sizeof(uint8_t));
 
     // Add colors
-    if ( session.supports_colors ) {
+    if (session.supports_colors) {
         int p60 = unit * (width * 60 / 100);
         int p20 = unit * (width * 20 / 100);
         snprintf(cbar,  collen,  _GREEN_("%.*s"), p60, bar);

From 28df590fc845f24bbc9c32542a5ca9fcd31eaf4f Mon Sep 17 00:00:00 2001
From: ikarus <ikarus4ever@web.de>
Date: Sun, 27 Dec 2020 20:20:19 +0100
Subject: [PATCH 203/682] apdufind: added option to skip instrcutions.

(This helps if a tag might be locked permanently with a certain instruction. You can just skip it.)
---
 client/src/cmdhf14a.c | 26 +++++++++++++++++++-------
 doc/commands.md       |  4 ++--
 2 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index fd03d60a4..f66b29e1c 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -2159,7 +2159,6 @@ static int CmdHf14AFindapdu(const char *Cmd) {
     // TODO: Validate the decoding of the APDU (not specific to this command, check
     //       https://cardwerk.com/smartcards/smartcard_standard_ISO7816-4_5_basic_organizations.aspx#chap5_3_2).
     // TODO: Check all cases (APDUs) with no data bytes (no/short/extended length).
-    // TODO: Option to blacklist instructions (or whole APDUs).
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf 14a apdufind",
                   "Enumerate APDU's of ISO7816 protocol to find valid CLS/INS/P1P2 commands.\n"
@@ -2168,6 +2167,7 @@ static int CmdHf14AFindapdu(const char *Cmd) {
                   "Tag must be on antenna before running.",
                   "hf 14a apdufind\n"
                   "hf 14a apdufind --cla 80\n"
+                  "hf 14a apdufind --cla 80 --error-limit 20 --skip-ins a4 --skip-ins b0\n"
                  );
 
     void *argtable[] = {
@@ -2177,7 +2177,8 @@ static int CmdHf14AFindapdu(const char *Cmd) {
         arg_str0(NULL, "p1",            "<hex>",    "Start value of P1 (1 hex byte)"),
         arg_str0(NULL, "p2",            "<hex>",    "Start value of P2 (1 hex byte)"),
         arg_u64_0("r", "reset",         "<number>", "Minimum secondes before resetting the tag (to prevent timeout issues). Default is 5 minutes"),
-        arg_u64_0("e", "error-limit",   "<number>", "Maximum times an status word other than 0x9000 or 0x6D00 is shown. Default is 500."),
+        arg_u64_0("e", "error-limit",   "<number>", "Maximum times an status word other than 0x9000 or 0x6D00 is shown. Default is 256."),
+        arg_strx0("s", "skip-ins",      "<hex>",    "Do not test an instructions (can be specifed multiple times)"),
         arg_lit0("v",  "verbose",                   "Verbose output"),
         arg_param_end
     };
@@ -2195,9 +2196,12 @@ static int CmdHf14AFindapdu(const char *Cmd) {
     int p2_len = 0;
     uint8_t p2_arg[1] = {0};
     CLIGetHexWithReturn(ctx, 4, p2_arg, &p2_len);
-    uint64_t reset_time = arg_get_u64_def(ctx, 5, 5 * 60); // Reset every 5 minutes.
-    uint64_t error_limit = arg_get_u64_def(ctx, 6, 500);
-    bool verbose = arg_get_lit(ctx, 7);
+    uint64_t reset_time = arg_get_u64_def(ctx, 5, 5 * 60);
+    uint64_t error_limit = arg_get_u64_def(ctx, 6, 256);
+    int ignore_ins_len = 0;
+    uint8_t ignore_ins_arg[250] = {0};
+    CLIGetHexWithReturn(ctx, 7, ignore_ins_arg, &ignore_ins_len);
+    bool verbose = arg_get_lit(ctx, 8);
 
     CLIParserFree(ctx);
 
@@ -2239,6 +2243,13 @@ static int CmdHf14AFindapdu(const char *Cmd) {
                     goto out;
                 }
 
+                // Skip/Ignore this instrctuion?
+                for (int i = 0; i < ignore_ins_len; i++) {
+                    if (ins == ignore_ins_arg[i]) {
+                        goto next_ins;
+                    }
+                }
+
                 if (verbose) {
                     PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
                 }
@@ -2250,7 +2261,7 @@ static int CmdHf14AFindapdu(const char *Cmd) {
                 if (res) {
                     DropField();
                     activate_field = true;
-                    continue;
+                    goto next_ins;
                 }
                 uint16_t sw = get_sw(response, response_n);
                 sw_occurences = inc_sw_error_occurence(sw, all_sw);
@@ -2271,7 +2282,7 @@ static int CmdHf14AFindapdu(const char *Cmd) {
                     if (res) {
                         DropField();
                         activate_field = true;
-                        continue;
+                        goto next_ins;
                     }
                     sw = get_sw(response, response_n);
                     sw_occurences = inc_sw_error_occurence(sw, all_sw);
@@ -2293,6 +2304,7 @@ static int CmdHf14AFindapdu(const char *Cmd) {
                                       sprint_ascii(response, response_n - 2));
                     }
                 }
+next_ins:
                 activate_field = false; // Do not reativate the filed until the next reset.
             } while (++ins != ins_arg[0]);
             // Increment P1/P2 in an alternating fashion.
diff --git a/doc/commands.md b/doc/commands.md
index e1e445296..991f4a590 100644
--- a/doc/commands.md
+++ b/doc/commands.md
@@ -198,8 +198,8 @@ Check column "offline" for their availability.
 |command                  |offline |description
 |-------                  |------- |-----------
 |`hf epa help            `|Y       |`This help`
-|`hf epa cnonces         `|N       |`<m> <n> <d> Acquire n>0 encrypted PACE nonces of size m>0 with d sec pauses`
-|`hf epa preplay         `|N       |`<mse> <get> <map> <pka> <ma> Perform PACE protocol by replaying given APDUs`
+|`hf epa cnonces         `|N       |`Acquire encrypted PACE nonces of specific size`
+|`hf epa preplay         `|N       |`Perform PACE protocol by replaying given APDUs`
 
 
 ### hf emrtd

From 4494c47e5fe53c6f249e6d0e00a8d3a48c93f354 Mon Sep 17 00:00:00 2001
From: ikarus <ikarus4ever@web.de>
Date: Sun, 27 Dec 2020 20:31:30 +0100
Subject: [PATCH 204/682] reverted the faulty edits by make style to
 doc/commands.md.

---
 doc/commands.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/commands.md b/doc/commands.md
index 991f4a590..e1e445296 100644
--- a/doc/commands.md
+++ b/doc/commands.md
@@ -198,8 +198,8 @@ Check column "offline" for their availability.
 |command                  |offline |description
 |-------                  |------- |-----------
 |`hf epa help            `|Y       |`This help`
-|`hf epa cnonces         `|N       |`Acquire encrypted PACE nonces of specific size`
-|`hf epa preplay         `|N       |`Perform PACE protocol by replaying given APDUs`
+|`hf epa cnonces         `|N       |`<m> <n> <d> Acquire n>0 encrypted PACE nonces of size m>0 with d sec pauses`
+|`hf epa preplay         `|N       |`<mse> <get> <map> <pka> <ma> Perform PACE protocol by replaying given APDUs`
 
 
 ### hf emrtd

From 438cada2cf7729d5bed42f59a6a70d9b8d1d3efa Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Sun, 27 Dec 2020 22:22:44 +0100
Subject: [PATCH 205/682] commits after xcode crash

---
 armsrc/appmain.c         |  4 +++
 armsrc/em4x50.c          | 67 +++++++++++++++++++++++++++++++++++++++-
 armsrc/em4x50.h          |  1 +
 client/src/cmdlfem4x50.c | 39 +++++++++++++++++++++++
 client/src/cmdlfem4x50.h |  1 +
 include/em4x50.h         |  4 +++
 include/pm3_cmd.h        |  1 +
 7 files changed, 116 insertions(+), 1 deletion(-)

diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index fe8566363..87b17afd9 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -1163,6 +1163,10 @@ static void PacketReceived(PacketCommandNG *packet) {
             em4x50_chk((uint8_t *)packet->data.asBytes);
             break;
         }
+        case CMD_LF_EM4X50_TEST: {
+            em4x50_test((em4x50_test_t *)packet->data.asBytes);
+            break;
+        }
 #endif
 
 #ifdef WITH_EM4x70
diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index 437afd956..a84a911c5 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -431,7 +431,6 @@ static int find_double_listen_window(bool bcommand) {
                         // send RM for request mode
                         em4x50_reader_send_bit(0);
                         em4x50_reader_send_bit(0);
-
                         LED_B_OFF();
 
                         return PM3_SUCCESS;
@@ -724,13 +723,27 @@ static bool em4x50_sim_send_word(uint32_t word) {
 
 static bool em4x50_sim_send_listen_window(void) {
 
+    bool cond = false;
     uint16_t check = 0;
+    uint32_t tval1[5 * EM4X50_T_TAG_FULL_PERIOD] = {0};
+    uint32_t tval2[5 * EM4X50_T_TAG_FULL_PERIOD] = {0};
+
+    StartTicks();
 
     for (int t = 0; t < 5 * EM4X50_T_TAG_FULL_PERIOD; t++) {
 
+        cond = ((t >= 3 * EM4X50_T_TAG_FULL_PERIOD) && (t < 4 * EM4X50_T_TAG_FULL_PERIOD));
+        
         // wait until SSC_CLK goes HIGH
+        if (cond) {
+            AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG;
+            AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
+            while (AT91C_BASE_TC0->TC_CV > 0);
+        }
+        
         while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
             WDT_HIT();
+            
             if (check == 1000) {
                 if (BUTTON_PRESS())
                     return false;
@@ -738,6 +751,8 @@ static bool em4x50_sim_send_listen_window(void) {
             }
             ++check;
         }
+        if (cond)
+            tval1[t] = GetTicks();
 
         if (t >= 4 * EM4X50_T_TAG_FULL_PERIOD)
             SHORT_COIL();
@@ -753,6 +768,12 @@ static bool em4x50_sim_send_listen_window(void) {
         check = 0;
 
         // wait until SSC_CLK goes LOW
+        if (cond) {
+            AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG;
+            AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
+            while (AT91C_BASE_TC0->TC_CV > 0);
+        }
+        
         while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
             WDT_HIT();
             if (check == 1000) {
@@ -762,8 +783,16 @@ static bool em4x50_sim_send_listen_window(void) {
             }
             ++check;
         }
+        if (cond)
+            tval2[t] = GetTicks();
     }
 
+    for (int t = 0; t < 5 * EM4X50_T_TAG_FULL_PERIOD; t++) {
+        //if (tval[t] > 4)
+            Dbprintf("%3i probably RM intialization found: delta = %i %i", t, tval1[t], tval2[t]);
+    }
+    Dbprintf("");
+    
     return true;
 }
 
@@ -1281,3 +1310,39 @@ void em4x50_sim(uint8_t *filename) {
     lf_finalize();
     reply_ng(CMD_LF_EM4X50_SIM, status, NULL, 0);
 }
+
+void em4x50_test(em4x50_test_t *ett) {
+
+    int status = PM3_EFAILED;
+
+    em4x50_setup_read();
+
+    if (ett->field) {
+        LOW(GPIO_SSC_DOUT);
+        LED_A_ON();
+
+        if (DBGLEVEL >= DBG_DEBUG)
+            Dbprintf("switched field on");
+        
+        status = 1;
+    } else {
+        HIGH(GPIO_SSC_DOUT);
+        LED_A_OFF();
+
+        if (DBGLEVEL >= DBG_DEBUG)
+            Dbprintf("switched field off");
+        
+        status = 0;
+    }
+    
+    while (BUTTON_PRESS() == false) {
+
+        if (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
+            Dbprintf("field on");
+        } else if (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)){
+            Dbprintf("field on");
+        }
+    }
+    
+    reply_ng(CMD_LF_EM4X50_TEST, status, NULL, 0);
+}
diff --git a/armsrc/em4x50.h b/armsrc/em4x50.h
index 9f9b38351..87451e198 100644
--- a/armsrc/em4x50.h
+++ b/armsrc/em4x50.h
@@ -22,5 +22,6 @@ void em4x50_login(uint32_t *password);
 void em4x50_sim(uint8_t *filename);
 void em4x50_reader(void);
 void em4x50_chk(uint8_t *filename);
+void em4x50_test(em4x50_test_t *ett);
 
 #endif /* EM4X50_H */
diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c
index 79b019a03..8182a822f 100644
--- a/client/src/cmdlfem4x50.c
+++ b/client/src/cmdlfem4x50.c
@@ -1158,6 +1158,43 @@ int CmdEM4x50Sim(const char *Cmd) {
     return resp.status;
 }
 
+int CmdEM4x50Test(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf em 4x50 test",
+                  "perform EM4x50 tests.",
+                  "lf em 4x50 test --field 1    -> reader field on \n"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0("", "field", "field off/on"),
+        arg_param_end
+    };
+
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    em4x50_test_t ett;
+    ett.field = arg_get_lit(ctx, 1);
+    CLIParserFree(ctx);
+
+    // start
+    clearCommandBuffer();
+    PacketResponseNG resp;
+    SendCommandNG(CMD_LF_EM4X50_TEST, (uint8_t *)&ett, sizeof(ett));
+    WaitForResponse(CMD_LF_EM4X50_TEST, &resp);
+
+    // print response
+    if (resp.status == 1) {
+        PrintAndLogEx(SUCCESS, "Field switched " _GREEN_("on"));
+    } else if (resp.status == 0) {
+        PrintAndLogEx(SUCCESS, "Field switched " _GREEN_("off"));
+    } else {
+        PrintAndLogEx(FAILED, "Test call " _RED_("failed"));
+    }
+
+    return resp.status;
+}
+
 static command_t CommandTable[] = {
     {"help",   CmdHelp,              AlwaysAvailable, "This help"},
     {"brute",  CmdEM4x50Brute,       IfPm3EM4x50,     "guess password of EM4x50"},
@@ -1175,6 +1212,7 @@ static command_t CommandTable[] = {
     {"eload",  CmdEM4x50ELoad,       IfPm3EM4x50,     "upload dump of EM4x50 to emulator memory"},
     {"esave",  CmdEM4x50ESave,       IfPm3EM4x50,     "save emulator memory to file"},
     {"eview",  CmdEM4x50EView,       IfPm3EM4x50,     "view EM4x50 content in emulator memory"},
+    {"test",   CmdEM4x50Test,        IfPm3EM4x50,     "perform EM4x50 tests"},
     {NULL, NULL, NULL, NULL}
 };
 
@@ -1188,3 +1226,4 @@ int CmdLFEM4X50(const char *Cmd) {
     clearCommandBuffer();
     return CmdsParse(CommandTable, Cmd);
 }
+
diff --git a/client/src/cmdlfem4x50.h b/client/src/cmdlfem4x50.h
index 0d5c04bc6..df9c587de 100644
--- a/client/src/cmdlfem4x50.h
+++ b/client/src/cmdlfem4x50.h
@@ -34,5 +34,6 @@ int CmdEM4x50ELoad(const char *Cmd);
 int CmdEM4x50ESave(const char *Cmd);
 int CmdEM4x50Chk(const char *Cmd);
 int CmdEM4x50EView(const char *Cmd);
+int CmdEM4x50Test(const char *Cmd);
 
 #endif
diff --git a/include/em4x50.h b/include/em4x50.h
index 573c58375..27d71e661 100644
--- a/include/em4x50.h
+++ b/include/em4x50.h
@@ -46,6 +46,10 @@ typedef struct {
     uint32_t addresses;
 } PACKED em4x50_data_t;
 
+typedef struct {
+    bool field;
+} PACKED em4x50_test_t;
+
 typedef struct {
     uint8_t byte[4];
 } PACKED em4x50_word_t;
diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h
index e3dc29aee..022b602e3 100644
--- a/include/pm3_cmd.h
+++ b/include/pm3_cmd.h
@@ -516,6 +516,7 @@ typedef struct {
 #define CMD_LF_EM4X50_READER                                              0x0251
 #define CMD_LF_EM4X50_ESET                                                0x0252
 #define CMD_LF_EM4X50_CHK                                                 0x0253
+#define CMD_LF_EM4X50_TEST                                                0x0254
 #define CMD_LF_EM4X70_INFO                                                0x0260
 #define CMD_LF_EM4X70_WRITE                                               0x0261
 #define CMD_LF_EM4X70_UNLOCK                                              0x0262

From 8233b2c914b775e5976b841cd2699d18383b5d55 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 28 Dec 2020 13:36:37 +0100
Subject: [PATCH 206/682] script now supports Gen1a, Gen1b, Gen2 type of MIFARE
 Ultralight family uid changeable cards

---
 client/luascripts/hf_mfu_setuid.lua | 44 ++++++++++++++++++++---------
 1 file changed, 31 insertions(+), 13 deletions(-)

diff --git a/client/luascripts/hf_mfu_setuid.lua b/client/luascripts/hf_mfu_setuid.lua
index 86bef09c3..f64d5cfab 100644
--- a/client/luascripts/hf_mfu_setuid.lua
+++ b/client/luascripts/hf_mfu_setuid.lua
@@ -4,26 +4,32 @@ local ansicolors = require('ansicolors')
 
 copyright = ''
 author = "Iceman"
-version = 'v1.0.2'
+version = 'v1.0.3'
 desc = [[
 This script tries to set UID on a mifare Ultralight magic card which either
  - answers to chinese backdoor commands
  - brickable magic tag  (must write in one session)
+
+ It defaults to GEN1A type of uid changeable card.
 ]]
 example = [[
-     -- backdoor magic tag
+     -- backdoor magic tag (gen1a)
      script run hf_mfu_setuid -u 11223344556677
 
-     -- brickable magic tag
+     -- backdoor magic tag (gen1b)
      script run hf_mfu_setuid -b -u 11223344556677
+
+     -- brickable magic tag (gen2)
+     script run hf_mfu_setuid -2 -u 11223344556677
 ]]
 usage = [[
-script run hf_mfu_setuid [-h] [-b] [-u <uid>]
+script run hf_mfu_setuid [-h] [-b] [-2] [-u <uid>]
 ]]
 arguments = [[
     -h             : this help
     -u <UID>       : UID (14 hexsymbols)
-    -b             : write to brickable magic tag
+    -b             : write to magic tag GEN1B
+    -2             : write to brickable magic tag GEN2
 ]]
 
 local DEBUG = true
@@ -65,23 +71,33 @@ local function help()
 end
 --
 --- Set UID on magic command enabled
-function magicUID(b0, b1, b2)
+function magicUID(b0, b1, b2,  isgen1a)
 
-    print('Using backdoor Magic tag function')
+    if isgen1a then 
+        print('Using backdoor Magic tag (gen1a) function')
+    else
+        print('Using backdoor Magic tag (gen1b) function')
+    end
 
     -- write block 0
     core.console('hf 14a raw -k -a -b 7 40')
-    core.console('hf 14a raw -k -a 43')
+    if isgen1a then 
+        core.console('hf 14a raw -k -a 43')
+    end
     core.console('hf 14a raw -c -a A200'..b0)
 
     -- write block 1
     core.console('hf 14a raw -k -a -b 7 40')
-    core.console('hf 14a raw -k -a 43')
+    if isgen1a then 
+        core.console('hf 14a raw -k -a 43')
+    end
     core.console('hf 14a raw -c -a A201'..b1)
 
     -- write block 2
     core.console('hf 14a raw -k -a -b 7 40')
-    core.console('hf 14a raw -k -a 43')
+    if isgen1a then 
+        core.console('hf 14a raw -k -a 43')
+    end
     core.console('hf 14a raw -c -a A202'..b2)
 end
 --
@@ -113,10 +129,11 @@ function main(args)
     local tagtype = 1
 
     -- Read the parameters
-    for o, a in getopt.getopt(args, 'hu:b') do
+    for o, a in getopt.getopt(args, 'hu:b2') do
         if o == 'h' then return help() end
         if o == 'u' then uid = a end
         if o == 'b' then tagtype = 2 end
+        if o == '2' then tagtype = 3 end
     end
 
     -- uid string checks
@@ -137,10 +154,11 @@ function main(args)
 
     core.clearCommandBuffer()
 
-    if tagtype == 2 then
+    if tagtype == 3 then        
         brickableUID(block0, block1, block2)
     else
-        magicUID(block0, block1, block2)
+        local is_gen1a = (tagtype == 1)
+        magicUID(block0, block1, block2, is_gen1a)
     end
 
         --halt

From 201e2506b2e8c3d9a5c23893305effb6155f815f Mon Sep 17 00:00:00 2001
From: ikarus <ikarus4ever@web.de>
Date: Mon, 28 Dec 2020 15:38:35 +0100
Subject: [PATCH 207/682] apdufind: fixed bug which prevented a retry, if there
 was an error.

---
 client/src/cmdhf14a.c | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index f66b29e1c..150b49fee 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -2228,6 +2228,7 @@ static int CmdHf14AFindapdu(const char *Cmd) {
     PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
 
     bool inc_p1 = true;
+    bool skip_ins = false;
     uint64_t all_sw[256][256] = {0};
     uint64_t sw_occurences = 0;
     uint64_t t_start = msclock();
@@ -2237,6 +2238,7 @@ static int CmdHf14AFindapdu(const char *Cmd) {
     do {
         do {
             do {
+retry_ins:
                 // Exit (was the Enter key pressed)?
                 if (kbd_enter_pressed()) {
                     PrintAndLogEx(INFO, "User interrupted detected. Aborting");
@@ -2246,9 +2248,14 @@ static int CmdHf14AFindapdu(const char *Cmd) {
                 // Skip/Ignore this instrctuion?
                 for (int i = 0; i < ignore_ins_len; i++) {
                     if (ins == ignore_ins_arg[i]) {
-                        goto next_ins;
+                        skip_ins = true;
+                        break;
                     }
                 }
+                if (skip_ins) {
+                    skip_ins = false;
+                    continue;
+                }
 
                 if (verbose) {
                     PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
@@ -2261,7 +2268,7 @@ static int CmdHf14AFindapdu(const char *Cmd) {
                 if (res) {
                     DropField();
                     activate_field = true;
-                    goto next_ins;
+                    goto retry_ins;
                 }
                 uint16_t sw = get_sw(response, response_n);
                 sw_occurences = inc_sw_error_occurence(sw, all_sw);
@@ -2282,7 +2289,7 @@ static int CmdHf14AFindapdu(const char *Cmd) {
                     if (res) {
                         DropField();
                         activate_field = true;
-                        goto next_ins;
+                        goto retry_ins;
                     }
                     sw = get_sw(response, response_n);
                     sw_occurences = inc_sw_error_occurence(sw, all_sw);
@@ -2291,11 +2298,15 @@ static int CmdHf14AFindapdu(const char *Cmd) {
 
                 // Show response.
                 if (sw_occurences < error_limit) {
+                    logLevel_t log_level = INFO;
+                    if (sw == 0x9000) {
+                        log_level = SUCCESS;
+                    }
                     if (command_with_le) {
-                        PrintAndLogEx(INFO, "Got response for APDU \"%02X%02X%02X%02X00\": %04X (%s)", cla, ins, p1, p2,
+                        PrintAndLogEx(log_level, "Got response for APDU \"%02X%02X%02X%02X00\": %04X (%s)", cla, ins, p1, p2,
                                       sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
                     } else {
-                        PrintAndLogEx(INFO, "Got response for APDU \"%02X%02X%02X%02X\": %04X (%s)", cla, ins, p1, p2,
+                        PrintAndLogEx(log_level, "Got response for APDU \"%02X%02X%02X%02X\": %04X (%s)", cla, ins, p1, p2,
                                       sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
                     }
                     // Show response data.
@@ -2304,7 +2315,6 @@ static int CmdHf14AFindapdu(const char *Cmd) {
                                       sprint_ascii(response, response_n - 2));
                     }
                 }
-next_ins:
                 activate_field = false; // Do not reativate the filed until the next reset.
             } while (++ins != ins_arg[0]);
             // Increment P1/P2 in an alternating fashion.

From 59e6658753d40c40ea7d4b0a6d0f23e7f9ee9762 Mon Sep 17 00:00:00 2001
From: ikarus <ikarus4ever@web.de>
Date: Mon, 28 Dec 2020 19:14:29 +0100
Subject: [PATCH 208/682] apdufind: added option to find Le=0 commands (case
 2S)

---
 client/src/cmdhf14a.c | 81 +++++++++++++++----------------------------
 1 file changed, 28 insertions(+), 53 deletions(-)

diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index 150b49fee..29d3afa65 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -2156,18 +2156,17 @@ static uint64_t inc_sw_error_occurence(uint16_t sw, uint64_t all_sw[256][256]) {
 
 static int CmdHf14AFindapdu(const char *Cmd) {
     // TODO: Option to select AID/File (and skip INS 0xA4).
-    // TODO: Validate the decoding of the APDU (not specific to this command, check
-    //       https://cardwerk.com/smartcards/smartcard_standard_ISO7816-4_5_basic_organizations.aspx#chap5_3_2).
-    // TODO: Check all cases (APDUs) with no data bytes (no/short/extended length).
+    // TODO: Check all instructions with extended APDUs if the card support it.
+    // TODO: Option to reset tag before every command.
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf 14a apdufind",
-                  "Enumerate APDU's of ISO7816 protocol to find valid CLS/INS/P1P2 commands.\n"
+                  "Enumerate APDU's of ISO7816 protocol to find valid CLS/INS/P1/P2 commands.\n"
                   "It loops all 256 possible values for each byte.\n"
-                  "The loop oder is INS -> P1/P2 (alternating) -> CLA\n"
+                  "The loop oder is INS -> P1/P2 (alternating) -> CLA.\n"
                   "Tag must be on antenna before running.",
                   "hf 14a apdufind\n"
                   "hf 14a apdufind --cla 80\n"
-                  "hf 14a apdufind --cla 80 --error-limit 20 --skip-ins a4 --skip-ins b0\n"
+                  "hf 14a apdufind --cla 80 --error-limit 20 --skip-ins a4 --skip-ins b0 --with-le\n"
                  );
 
     void *argtable[] = {
@@ -2177,8 +2176,9 @@ static int CmdHf14AFindapdu(const char *Cmd) {
         arg_str0(NULL, "p1",            "<hex>",    "Start value of P1 (1 hex byte)"),
         arg_str0(NULL, "p2",            "<hex>",    "Start value of P2 (1 hex byte)"),
         arg_u64_0("r", "reset",         "<number>", "Minimum secondes before resetting the tag (to prevent timeout issues). Default is 5 minutes"),
-        arg_u64_0("e", "error-limit",   "<number>", "Maximum times an status word other than 0x9000 or 0x6D00 is shown. Default is 256."),
+        arg_u64_0("e", "error-limit",   "<number>", "Maximum times an status word other than 0x9000 or 0x6D00 is shown. Default is 512."),
         arg_strx0("s", "skip-ins",      "<hex>",    "Do not test an instructions (can be specifed multiple times)"),
+        arg_lit0("l",  "with-le",                   "Serach  for APDUs with Le=0 (case 2S) as well"),
         arg_lit0("v",  "verbose",                   "Verbose output"),
         arg_param_end
     };
@@ -2197,11 +2197,12 @@ static int CmdHf14AFindapdu(const char *Cmd) {
     uint8_t p2_arg[1] = {0};
     CLIGetHexWithReturn(ctx, 4, p2_arg, &p2_len);
     uint64_t reset_time = arg_get_u64_def(ctx, 5, 5 * 60);
-    uint64_t error_limit = arg_get_u64_def(ctx, 6, 256);
+    uint64_t error_limit = arg_get_u64_def(ctx, 6, 512);
     int ignore_ins_len = 0;
     uint8_t ignore_ins_arg[250] = {0};
     CLIGetHexWithReturn(ctx, 7, ignore_ins_arg, &ignore_ins_len);
-    bool verbose = arg_get_lit(ctx, 8);
+    bool with_le = arg_get_lit(ctx, 8);
+    bool verbose = arg_get_lit(ctx, 9);
 
     CLIParserFree(ctx);
 
@@ -2261,58 +2262,32 @@ retry_ins:
                     PrintAndLogEx(INFO, "Status: [ CLA " _GREEN_("%02X") " INS " _GREEN_("%02X") " P1 " _GREEN_("%02X") " P2 " _GREEN_("%02X") " ]", cla, ins, p1, p2);
                 }
 
-                // Send APDU.
-                uint8_t command[4] = {cla, ins, p1, p2};
-                int command_n = sizeof(command);
-                res = ExchangeAPDU14a(command, command_n, activate_field, keep_field_on, response, sizeof(response), &response_n);
-                if (res) {
-                    DropField();
-                    activate_field = true;
-                    goto retry_ins;
-                }
-                uint16_t sw = get_sw(response, response_n);
-                sw_occurences = inc_sw_error_occurence(sw, all_sw);
-
-                // Was there and length error? If so, try with Le length (case 2 instad of case 1,
-                // https://stackoverflow.com/a/30679558). Le = 0x00 will get interpreted as extended length APDU
-                // with Le being 0x0100.
-                bool command_with_le = false;
-                if (sw == 0x6700) {
-                    if (sw_occurences < error_limit) {
-                        PrintAndLogEx(INFO, "Got response for APDU \"%02X%02X%02X%02X\": %04X (%s)", cla, ins, p1, p2,
-                                      sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
-                        PrintAndLogEx(INFO, "Resending current command with Le = 0x0100 (extended length APDU)");
-                    }
-                    uint8_t command2[7] = {cla, ins, p1, p2, 0x00};
-                    int command2_n = sizeof(command2);
-                    res = ExchangeAPDU14a(command2, command2_n, activate_field, keep_field_on, response, sizeof(response), &response_n);
+                // Send APDU without Le (case 1) and with Le = 0 (case 2S), if "with-le" was set.
+                uint8_t command[5] = {cla, ins, p1, p2, 0x00};
+                int command_n = 4;
+                for (int i = 0; i < 1 + with_le; i++) {
+                    // Send APDU.
+                    res = ExchangeAPDU14a(command, command_n + i, activate_field, keep_field_on, response, sizeof(response), &response_n);
                     if (res) {
                         DropField();
                         activate_field = true;
                         goto retry_ins;
                     }
-                    sw = get_sw(response, response_n);
+                    uint16_t sw = get_sw(response, response_n);
                     sw_occurences = inc_sw_error_occurence(sw, all_sw);
-                    command_with_le = true;
-                }
 
-                // Show response.
-                if (sw_occurences < error_limit) {
-                    logLevel_t log_level = INFO;
-                    if (sw == 0x9000) {
-                        log_level = SUCCESS;
-                    }
-                    if (command_with_le) {
-                        PrintAndLogEx(log_level, "Got response for APDU \"%02X%02X%02X%02X00\": %04X (%s)", cla, ins, p1, p2,
+                    // Show response.
+                    if (sw_occurences < error_limit) {
+                        logLevel_t log_level = INFO;
+                        if (sw == 0x9000) {
+                            log_level = SUCCESS;
+                        }
+                        PrintAndLogEx(log_level, "Got response for APDU \"%s\": %04X (%s)", sprint_hex_inrow(command, command_n + i),
                                       sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
-                    } else {
-                        PrintAndLogEx(log_level, "Got response for APDU \"%02X%02X%02X%02X\": %04X (%s)", cla, ins, p1, p2,
-                                      sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
-                    }
-                    // Show response data.
-                    if (response_n > 2) {
-                        PrintAndLogEx(SUCCESS, "Response data is: %s | %s", sprint_hex_inrow(response, response_n - 2),
-                                      sprint_ascii(response, response_n - 2));
+                        if (response_n > 2) {
+                            PrintAndLogEx(SUCCESS, "Response data is: %s | %s", sprint_hex_inrow(response, response_n - 2),
+                                          sprint_ascii(response, response_n - 2));
+                        }
                     }
                 }
                 activate_field = false; // Do not reativate the filed until the next reset.

From 11567dc2e35cb556a32f40496124952b7a3fa824 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Mon, 28 Dec 2020 22:48:41 +0100
Subject: [PATCH 209/682] Added option for running with uncompressed .data
 section. Thanks @doegox

---
 armsrc/Makefile         |  4 ++++
 armsrc/appmain.c        | 11 ++++++++++-
 armsrc/start.c          | 20 +++++++++++++++++---
 common_arm/Makefile.hal |  3 +++
 4 files changed, 34 insertions(+), 4 deletions(-)

diff --git a/armsrc/Makefile b/armsrc/Makefile
index 46ba4f027..074380058 100644
--- a/armsrc/Makefile
+++ b/armsrc/Makefile
@@ -217,8 +217,12 @@ $(OBJDIR)/fullimage.data.o: $(OBJDIR)/fullimage.data.bin.z
 	$(Q)$(OBJCOPY) -O elf32-littlearm -I binary -B arm --rename-section .data=compressed_data $^ $@
 
 $(OBJDIR)/fullimage.elf: $(OBJDIR)/fullimage.nodata.o $(OBJDIR)/fullimage.data.o
+ifneq ($(SKIP_COMPRESSION),1)
 	$(info [=] LD $@)
 	$(Q)$(CC) $(CROSS_LDFLAGS) -Wl,-T,ldscript,-e,_osimage_entry,-Map,$(patsubst %.elf,%.map,$@) -o $@ $^
+else
+	$(Q)$(CP) $(OBJDIR)/fullimage.stage1.elf $@
+endif
 
 tarbin: $(OBJS)
 	$(info TAR $@)
diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index fe8566363..b4c3d6a30 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -257,6 +257,9 @@ void ReadMem(int addr) {
 /* osimage version information is linked in, cf commonutil.h */
 /* bootrom version information is pointed to from _bootphase1_version_pointer */
 extern char *_bootphase1_version_pointer, _flash_start, _flash_end, __data_src_start__;
+#ifdef WITH_NO_COMPRESSION
+extern char *_bootrom_end, _bootrom_start, __os_size__;
+#endif
 static void SendVersion(void) {
     char temp[PM3_CMD_DATA_SIZE - 12]; /* Limited data payload in USB packets */
     char VersionString[PM3_CMD_DATA_SIZE - 12] = { '\0' };
@@ -295,9 +298,11 @@ static void SendVersion(void) {
             strncat(VersionString, "\n ", sizeof(VersionString) - strlen(VersionString) - 1);
         }
     }
+#ifndef WITH_NO_COMPRESSION
     // Send Chip ID and used flash memory
     uint32_t text_and_rodata_section_size = (uint32_t)&__data_src_start__ - (uint32_t)&_flash_start;
     uint32_t compressed_data_section_size = common_area.arg1;
+#endif
 
     struct p {
         uint32_t id;
@@ -308,7 +313,11 @@ static void SendVersion(void) {
 
     struct p payload;
     payload.id = *(AT91C_DBGU_CIDR);
-    payload.section_size = text_and_rodata_section_size + compressed_data_section_size;
+#ifdef WITH_NO_COMPRESSION
+	payload.section_size = (uint32_t)&_bootrom_end - (uint32_t)&_bootrom_start + (uint32_t)&__os_size__;
+#else
+	payload.section_size = text_and_rodata_section_size + compressed_data_section_size;
+#endif
     payload.versionstr_len = strlen(VersionString) + 1;
     memcpy(payload.versionstr, VersionString, payload.versionstr_len);
 
diff --git a/armsrc/start.c b/armsrc/start.c
index 70eee5063..542b9f3f4 100644
--- a/armsrc/start.c
+++ b/armsrc/start.c
@@ -14,14 +14,16 @@
 
 #include "proxmark3_arm.h"
 #include "appmain.h"
+#ifndef WITH_NO_COMPRESSION
 #include "lz4.h"
+#endif
 #include "BigBuf.h"
 #include "string.h"
 
 extern struct common_area common_area;
 extern char __data_src_start__, __data_start__, __data_end__, __bss_start__, __bss_end__;
 
-
+#ifndef WITH_NO_COMPRESSION
 static void uncompress_data_section(void) {
     int avail_in;
     memcpy(&avail_in, &__data_src_start__, sizeof(int));
@@ -35,6 +37,7 @@ static void uncompress_data_section(void) {
     // save the size of the compressed data section
     common_area.arg1 = avail_in;
 }
+#endif
 
 void __attribute__((section(".startos"))) Vector(void);
 void Vector(void) {
@@ -47,12 +50,23 @@ void Vector(void) {
         common_area.version = 1;
     }
     common_area.flags.osimage_present = 1;
-
-    uncompress_data_section();
+	
+#ifdef WITH_NO_COMPRESSION
+	/* Set up data segment: Copy from flash to ram */
+    char *src = &__data_src_start__;
+    char *dst = &__data_start__;
+    char *end = &__data_end__;
+    while(dst < end) *dst++ = *src++;
+	dst = &__bss_start__;
+    end = &__bss_end__;
+#else
+	uncompress_data_section();
 
     /* Set up (that is: clear) BSS. */
     char *dst = &__bss_start__;
     char *end = &__bss_end__;
+#endif
+    
     while (dst < end) *dst++ = 0;
 
     AppMain();
diff --git a/common_arm/Makefile.hal b/common_arm/Makefile.hal
index 24d31261e..bfbe56d34 100644
--- a/common_arm/Makefile.hal
+++ b/common_arm/Makefile.hal
@@ -137,6 +137,9 @@ endif
 ifneq ($(SKIP_HFPLOT),1)
     PLATFORM_DEFS += -DWITH_HFPLOT
 endif
+ifeq ($(SKIP_COMPRESSION),1)
+    PLATFORM_DEFS += -DWITH_NO_COMPRESSION
+endif
 
 # Standalone mode
 ifneq ($(strip $(filter $(PLATFORM_DEFS),$(STANDALONE_REQ_DEFS))),$(strip $(STANDALONE_REQ_DEFS)))

From bdb384f7b7417a08368ab6cc2a3cfed918641481 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Mon, 28 Dec 2020 22:57:58 +0100
Subject: [PATCH 210/682] Fix for the Makefile.platform file

---
 armsrc/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/armsrc/Makefile b/armsrc/Makefile
index 074380058..019d10820 100644
--- a/armsrc/Makefile
+++ b/armsrc/Makefile
@@ -217,7 +217,7 @@ $(OBJDIR)/fullimage.data.o: $(OBJDIR)/fullimage.data.bin.z
 	$(Q)$(OBJCOPY) -O elf32-littlearm -I binary -B arm --rename-section .data=compressed_data $^ $@
 
 $(OBJDIR)/fullimage.elf: $(OBJDIR)/fullimage.nodata.o $(OBJDIR)/fullimage.data.o
-ifneq ($(SKIP_COMPRESSION),1)
+ifeq (,$(findstring WITH_NO_COMPRESSION,$(APP_CFLAGS)))
 	$(info [=] LD $@)
 	$(Q)$(CC) $(CROSS_LDFLAGS) -Wl,-T,ldscript,-e,_osimage_entry,-Map,$(patsubst %.elf,%.map,$@) -o $@ $^
 else

From 7e2b10d413fb38965359e1bd1a91352bbf251bdf Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 29 Dec 2020 01:55:18 +0300
Subject: [PATCH 211/682] emrtd info (offline): Add basic hash verification
 support

---
 client/src/cmdhfemrtd.c | 235 ++++++++++++++++++++++------------------
 client/src/cmdhfemrtd.h |   1 +
 2 files changed, 131 insertions(+), 105 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 88a79707a..a088bfc7f 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -20,6 +20,7 @@
 #include "protocols.h"              // definitions of ISO14A/7816 protocol
 #include "emv/apduinfo.h"           // GetAPDUCodeDescription
 #include "sha1.h"                   // KSeed calculation etc
+#include "crypto/libpcrypto.h"      // Hash calculation (sha256), TODO: AES too
 #include "mifare/desfire_crypto.h"  // des_encrypt/des_decrypt
 #include "des.h"                    // mbedtls_des_key_set_parity
 #include "cmdhf14b.h"               // exchange_14b_apdu
@@ -83,28 +84,28 @@ typedef enum  { // list must match dg_table
 } emrtd_dg_enum;
 
 static emrtd_dg_t dg_table[] = {
-//  tag     fileid  filename           desc                                                 pace   eac    req    fast   parser                    dumper
-    {0x60, "011E", "EF_COM",          "Header and Data Group Presence Information",         false, false, true,  true,  emrtd_print_ef_com_info,  NULL},
-    {0x61, "0101", "EF_DG1",          "Details recorded in MRZ",                            false, false, true,  true,  emrtd_print_ef_dg1_info,  NULL},
-    {0x75, "0102", "EF_DG2",          "Encoded Face",                                       false, false, true,  false, NULL,                     emrtd_dump_ef_dg2},
-    {0x63, "0103", "EF_DG3",          "Encoded Finger(s)",                                  false, true,  false, false, NULL,                     NULL},
-    {0x76, "0104", "EF_DG4",          "Encoded Eye(s)",                                     false, true,  false, false, NULL,                     NULL},
-    {0x65, "0105", "EF_DG5",          "Displayed Portrait",                                 false, false, false, false, NULL,                     emrtd_dump_ef_dg5},
-    {0x66, "0106", "EF_DG6",          "Reserved for Future Use",                            false, false, false, false, NULL,                     NULL},
-    {0x67, "0107", "EF_DG7",          "Displayed Signature or Usual Mark",                  false, false, false, false, NULL,                     emrtd_dump_ef_dg7},
-    {0x68, "0108", "EF_DG8",          "Data Feature(s)",                                    false, false, false, true,  NULL,                     NULL},
-    {0x69, "0109", "EF_DG9",          "Structure Feature(s)",                               false, false, false, true,  NULL,                     NULL},
-    {0x6a, "010A", "EF_DG10",         "Substance Feature(s)",                               false, false, false, true,  NULL,                     NULL},
-    {0x6b, "010B", "EF_DG11",         "Additional Personal Detail(s)",                      false, false, false, true,  emrtd_print_ef_dg11_info, NULL},
-    {0x6c, "010C", "EF_DG12",         "Additional Document Detail(s)",                      false, false, false, true,  emrtd_print_ef_dg12_info, NULL},
-    {0x6d, "010D", "EF_DG13",         "Optional Detail(s)",                                 false, false, false, true,  NULL,                     NULL},
-    {0x6e, "010E", "EF_DG14",         "Security Options",                                   false, false, false, true,  NULL,                     NULL},
-    {0x6f, "010F", "EF_DG15",         "Active Authentication Public Key Info",              false, false, false, true,  NULL,                     NULL},
-    {0x70, "0110", "EF_DG16",         "Person(s) to Notify",                                false, false, false, true,  NULL,                     NULL},
-    {0x77, "011D", "EF_SOD",          "Document Security Object",                           false, false, false, false, NULL,                     emrtd_dump_ef_sod},
-    {0xff, "011C", "EF_CardAccess",   "PACE SecurityInfos",                                 true,  false, true,  true,  NULL,                     NULL},
-    {0xff, "011D", "EF_CardSecurity", "PACE SecurityInfos for Chip Authentication Mapping", true,  false, false, true,  NULL,                     NULL},
-    {0x00, NULL, NULL, NULL, false, false, false, false, NULL, NULL}
+//  tag    dg# fileid  filename           desc                                                  pace   eac    req    fast   parser                    dumper
+    {0x60, 0,  "011E", "EF_COM",          "Header and Data Group Presence Information",         false, false, true,  true,  emrtd_print_ef_com_info,  NULL},
+    {0x61, 1,  "0101", "EF_DG1",          "Details recorded in MRZ",                            false, false, true,  true,  emrtd_print_ef_dg1_info,  NULL},
+    {0x75, 2,  "0102", "EF_DG2",          "Encoded Face",                                       false, false, true,  false, NULL,                     emrtd_dump_ef_dg2},
+    {0x63, 3,  "0103", "EF_DG3",          "Encoded Finger(s)",                                  false, true,  false, false, NULL,                     NULL},
+    {0x76, 4,  "0104", "EF_DG4",          "Encoded Eye(s)",                                     false, true,  false, false, NULL,                     NULL},
+    {0x65, 5,  "0105", "EF_DG5",          "Displayed Portrait",                                 false, false, false, false, NULL,                     emrtd_dump_ef_dg5},
+    {0x66, 6,  "0106", "EF_DG6",          "Reserved for Future Use",                            false, false, false, false, NULL,                     NULL},
+    {0x67, 7,  "0107", "EF_DG7",          "Displayed Signature or Usual Mark",                  false, false, false, false, NULL,                     emrtd_dump_ef_dg7},
+    {0x68, 8,  "0108", "EF_DG8",          "Data Feature(s)",                                    false, false, false, true,  NULL,                     NULL},
+    {0x69, 9,  "0109", "EF_DG9",          "Structure Feature(s)",                               false, false, false, true,  NULL,                     NULL},
+    {0x6a, 10, "010A", "EF_DG10",         "Substance Feature(s)",                               false, false, false, true,  NULL,                     NULL},
+    {0x6b, 11, "010B", "EF_DG11",         "Additional Personal Detail(s)",                      false, false, false, true,  emrtd_print_ef_dg11_info, NULL},
+    {0x6c, 12, "010C", "EF_DG12",         "Additional Document Detail(s)",                      false, false, false, true,  emrtd_print_ef_dg12_info, NULL},
+    {0x6d, 13, "010D", "EF_DG13",         "Optional Detail(s)",                                 false, false, false, true,  NULL,                     NULL},
+    {0x6e, 14, "010E", "EF_DG14",         "Security Options",                                   false, false, false, true,  NULL,                     NULL},
+    {0x6f, 15, "010F", "EF_DG15",         "Active Authentication Public Key Info",              false, false, false, true,  NULL,                     NULL},
+    {0x70, 16, "0110", "EF_DG16",         "Person(s) to Notify",                                false, false, false, true,  NULL,                     NULL},
+    {0x77, 0,  "011D", "EF_SOD",          "Document Security Object",                           false, false, false, false, NULL,                     emrtd_dump_ef_sod},
+    {0xff, 0,  "011C", "EF_CardAccess",   "PACE SecurityInfos",                                 true,  false, true,  true,  NULL,                     NULL},
+    {0xff, 0,  "011D", "EF_CardSecurity", "PACE SecurityInfos for Chip Authentication Mapping", true,  false, false, true,  NULL,                     NULL},
+    {0x00, 0,  NULL, NULL, NULL, false, false, false, false, NULL, NULL}
 };
 
 static emrtd_dg_t *emrtd_tag_to_dg(uint8_t tag) {
@@ -1483,106 +1484,105 @@ static int emrtd_print_ef_dg12_info(uint8_t *data, size_t datalen) {
     return PM3_SUCCESS;
 }
 
-// static int emrtd_ef_sod_extract_signatures(uint8_t *data, size_t datalen, uint8_t *dataout, size_t *dataoutlen) {
-//     // very very very very cursed code.
-//     uint8_t top[EMRTD_MAX_FILE_SIZE] = { 0x00 };
-//     uint8_t signeddata[EMRTD_MAX_FILE_SIZE] = { 0x00 };
-//     uint8_t emrtdsigcontainer[EMRTD_MAX_FILE_SIZE] = { 0x00 };
-//     uint8_t emrtdsig[EMRTD_MAX_FILE_SIZE] = { 0x00 };
-//     uint8_t emrtdsigtext[EMRTD_MAX_FILE_SIZE] = { 0x00 };
-//     size_t toplen, signeddatalen, emrtdsigcontainerlen, emrtdsiglen, emrtdsigtextlen = 0;
+static int emrtd_ef_sod_extract_signatures(uint8_t *data, size_t datalen, uint8_t *dataout, size_t *dataoutlen) {
+    // very very very very cursed code.
+    uint8_t top[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    uint8_t signeddata[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    uint8_t emrtdsigcontainer[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    uint8_t emrtdsig[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    uint8_t emrtdsigtext[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    size_t toplen, signeddatalen, emrtdsigcontainerlen, emrtdsiglen, emrtdsigtextlen = 0;
 
-//     if (!emrtd_lds_get_data_by_tag(data, datalen, top, &toplen, 0x30, 0x00, false, true, 0)) {
-//         PrintAndLogEx(ERR, "Failed to read top from EF_SOD.");
-//         return false;
-//     }
+    if (!emrtd_lds_get_data_by_tag(data, datalen, top, &toplen, 0x30, 0x00, false, true, 0)) {
+        PrintAndLogEx(ERR, "Failed to read top from EF_SOD.");
+        return false;
+    }
 
-//     PrintAndLogEx(DEBUG, "top: %s.", sprint_hex_inrow(top, toplen));
+    PrintAndLogEx(DEBUG, "top: %s.", sprint_hex_inrow(top, toplen));
 
-//     if (!emrtd_lds_get_data_by_tag(top, toplen, signeddata, &signeddatalen, 0xA0, 0x00, false, false, 0)) {
-//         PrintAndLogEx(ERR, "Failed to read signedData from EF_SOD.");
-//         return false;
-//     }
+    if (!emrtd_lds_get_data_by_tag(top, toplen, signeddata, &signeddatalen, 0xA0, 0x00, false, false, 0)) {
+        PrintAndLogEx(ERR, "Failed to read signedData from EF_SOD.");
+        return false;
+    }
 
-//     PrintAndLogEx(DEBUG, "signeddata: %s.", sprint_hex_inrow(signeddata, signeddatalen));
+    PrintAndLogEx(DEBUG, "signeddata: %s.", sprint_hex_inrow(signeddata, signeddatalen));
 
-//     // Do true on reading into the tag as it's a "sequence"
-//     if (!emrtd_lds_get_data_by_tag(signeddata, signeddatalen, emrtdsigcontainer, &emrtdsigcontainerlen, 0x30, 0x00, false, true, 0)) {
-//         PrintAndLogEx(ERR, "Failed to read eMRTDSignature container from EF_SOD.");
-//         return false;
-//     }
+    // Do true on reading into the tag as it's a "sequence"
+    if (!emrtd_lds_get_data_by_tag(signeddata, signeddatalen, emrtdsigcontainer, &emrtdsigcontainerlen, 0x30, 0x00, false, true, 0)) {
+        PrintAndLogEx(ERR, "Failed to read eMRTDSignature container from EF_SOD.");
+        return false;
+    }
 
-//     PrintAndLogEx(DEBUG, "emrtdsigcontainer: %s.", sprint_hex_inrow(emrtdsigcontainer, emrtdsigcontainerlen));
+    PrintAndLogEx(DEBUG, "emrtdsigcontainer: %s.", sprint_hex_inrow(emrtdsigcontainer, emrtdsigcontainerlen));
 
-//     if (!emrtd_lds_get_data_by_tag(emrtdsigcontainer, emrtdsigcontainerlen, emrtdsig, &emrtdsiglen, 0xA0, 0x00, false, false, 0)) {
-//         PrintAndLogEx(ERR, "Failed to read eMRTDSignature from EF_SOD.");
-//         return false;
-//     }
+    if (!emrtd_lds_get_data_by_tag(emrtdsigcontainer, emrtdsigcontainerlen, emrtdsig, &emrtdsiglen, 0xA0, 0x00, false, false, 0)) {
+        PrintAndLogEx(ERR, "Failed to read eMRTDSignature from EF_SOD.");
+        return false;
+    }
 
-//     PrintAndLogEx(DEBUG, "emrtdsig: %s.", sprint_hex_inrow(emrtdsig, emrtdsiglen));
+    PrintAndLogEx(DEBUG, "emrtdsig: %s.", sprint_hex_inrow(emrtdsig, emrtdsiglen));
 
-//     // TODO: Not doing memcpy here, it didn't work, fix it somehow
-//     if (!emrtd_lds_get_data_by_tag(emrtdsig, emrtdsiglen, emrtdsigtext, &emrtdsigtextlen, 0x04, 0x00, false, false, 0)) {
-//         PrintAndLogEx(ERR, "Failed to read eMRTDSignature (text) from EF_SOD.");
-//         return false;
-//     }
-//     memcpy(dataout, emrtdsigtext, emrtdsigtextlen);
-//     *dataoutlen = emrtdsigtextlen;
-//     return PM3_SUCCESS;
-// }
+    // TODO: Not doing memcpy here, it didn't work, fix it somehow
+    if (!emrtd_lds_get_data_by_tag(emrtdsig, emrtdsiglen, emrtdsigtext, &emrtdsigtextlen, 0x04, 0x00, false, false, 0)) {
+        PrintAndLogEx(ERR, "Failed to read eMRTDSignature (text) from EF_SOD.");
+        return false;
+    }
+    memcpy(dataout, emrtdsigtext, emrtdsigtextlen);
+    *dataoutlen = emrtdsigtextlen;
+    return PM3_SUCCESS;
+}
 
-// static int emrtd_print_ef_sod_info(uint8_t *data, size_t datalen) {
-//     uint8_t emrtdsig[EMRTD_MAX_FILE_SIZE] = { 0x00 };
-//     uint8_t hashlist[EMRTD_MAX_FILE_SIZE] = { 0x00 };
-//     uint8_t hash[65] = { 0x00 };
-//     size_t hashlen = 0;
+static int emrtd_parse_ef_sod_hashes(uint8_t *data, size_t datalen, uint8_t *hashes) {
+    uint8_t emrtdsig[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    uint8_t hashlist[EMRTD_MAX_FILE_SIZE] = { 0x00 };
+    uint8_t hash[65] = { 0x00 };
+    size_t hashlen = 0;
 
-//     uint8_t hashidstr[4] = { 0x00 };
-//     size_t hashidstrlen = 0;
+    uint8_t hashidstr[4] = { 0x00 };
+    size_t hashidstrlen = 0;
 
-//     // size_t emrtdsiglen, e_datalen, e_fieldlen = 0;
-//     size_t emrtdsiglen = 0;
-//     size_t hashlistlen = 0;
-//     size_t e_datalen = 0;
-//     size_t e_fieldlen = 0;
-//     size_t offset = 0;
+    // size_t emrtdsiglen, e_datalen, e_fieldlen = 0;
+    size_t emrtdsiglen = 0;
+    size_t hashlistlen = 0;
+    size_t e_datalen = 0;
+    size_t e_fieldlen = 0;
+    size_t offset = 0;
 
-//     PrintAndLogEx(NORMAL, "");
-//     PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_SOD") " --------------------");
+    if (emrtd_ef_sod_extract_signatures(data, datalen, emrtdsig, &emrtdsiglen) != PM3_SUCCESS) {
+        return false;
+    }
 
-//     if (emrtd_ef_sod_extract_signatures(data, datalen, emrtdsig, &emrtdsiglen) != PM3_SUCCESS) {
-//         return false;
-//     }
+    PrintAndLogEx(DEBUG, "hash data: %s", sprint_hex_inrow(emrtdsig, emrtdsiglen));
 
-//     PrintAndLogEx(DEBUG, "hash data: %s", sprint_hex_inrow(emrtdsig, emrtdsiglen));
+    if (!emrtd_lds_get_data_by_tag(emrtdsig, emrtdsiglen, hashlist, &hashlistlen, 0x30, 0x00, false, true, 1)) {
+        PrintAndLogEx(ERR, "Failed to read hash list from EF_SOD.");
+        return false;
+    }
 
-//     if (!emrtd_lds_get_data_by_tag(emrtdsig, emrtdsiglen, hashlist, &hashlistlen, 0x30, 0x00, false, true, 1)) {
-//         PrintAndLogEx(ERR, "Failed to read hash list from EF_SOD.");
-//         return false;
-//     }
+    PrintAndLogEx(DEBUG, "hash list: %s", sprint_hex_inrow(hashlist, hashlistlen));
 
-//     PrintAndLogEx(DEBUG, "hash list: %s", sprint_hex_inrow(hashlist, hashlistlen));
+    while (offset < hashlistlen) {
+        // Get the length of the element
+        e_datalen = emrtd_get_asn1_data_length(hashlist + offset, hashlistlen - offset, 1);
 
-//     while (offset < hashlistlen) {
-//         // Get the length of the element
-//         e_datalen = emrtd_get_asn1_data_length(hashlist + offset, hashlistlen - offset, 1);
+        // Get the length of the element's length
+        e_fieldlen = emrtd_get_asn1_field_length(hashlist + offset, hashlistlen - offset, 1);
 
-//         // Get the length of the element's length
-//         e_fieldlen = emrtd_get_asn1_field_length(hashlist + offset, hashlistlen - offset, 1);
+        switch (hashlist[offset]) {
+            case 0x30:
+                emrtd_lds_get_data_by_tag(hashlist + offset + e_fieldlen + 1, e_datalen, hashidstr, &hashidstrlen, 0x02, 0x00, false, false, 0);
+                emrtd_lds_get_data_by_tag(hashlist + offset + e_fieldlen + 1, e_datalen, hash, &hashlen, 0x04, 0x00, false, false, 0);
+                if (hashlen <= 64) {  // TODO: This is for coverity, account for it.
+                    memcpy(hashes + (hashidstr[0] * 64), hash, hashlen);
+                }
+                break;
+        }
+        // + 1 for length of ID
+        offset += 1 + e_datalen + e_fieldlen;
+    }
 
-//         switch (hashlist[offset]) {
-//             case 0x30:
-//                 emrtd_lds_get_data_by_tag(hashlist + offset + e_fieldlen + 1, e_datalen, hashidstr, &hashidstrlen, 0x02, 0x00, false, false, 0);
-//                 emrtd_lds_get_data_by_tag(hashlist + offset + e_fieldlen + 1, e_datalen, hash, &hashlen, 0x04, 0x00, false, false, 0);
-//                 PrintAndLogEx(SUCCESS, "Hash for EF_DG%i: %s", hashidstr[0], sprint_hex_inrow(hash, hashlen));
-//                 break;
-//         }
-//         // + 1 for length of ID
-//         offset += 1 + e_datalen + e_fieldlen;
-//     }
-
-//     return PM3_SUCCESS;
-// }
+    return PM3_SUCCESS;
+}
 
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available) {
     uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
@@ -1633,8 +1633,9 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         DropField();
         return PM3_ESOFT;
     }
+    // TODO: DROP THIS TOO A LA OFFLINE
     // Add EF_SOD to the list
-    filelist[filelistlen++] = 0x77;
+    // filelist[filelistlen++] = 0x77;
     // Dump all files in the file list
     for (int i = 0; i < filelistlen; i++) {
         emrtd_dg_t *dg = emrtd_tag_to_dg(filelist[i]);
@@ -1686,8 +1687,26 @@ int infoHF_EMRTD_offline(const char *path) {
         return PM3_ESOFT;
     }
     free(data);
-    // Add EF_SOD to the list
-    filelist[filelistlen++] = 0x77;
+
+    uint8_t dg_hashes[20][64];
+    uint8_t hash_out[64];
+
+    strcpy(filepath, path);
+    strncat(filepath, PATHSEP, 2);
+    strcat(filepath, dg_table[EF_SOD].filename);
+
+    if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, false) != PM3_SUCCESS) {
+        PrintAndLogEx(ERR, "Failed to read EF_SOD.");
+        free(filepath);
+        return PM3_ESOFT;
+    }
+
+    res = emrtd_parse_ef_sod_hashes(data, datalen, *dg_hashes);
+    if (res != PM3_SUCCESS) {
+        PrintAndLogEx(ERR, "Failed to read hash list from EF_SOD. Hash checks will fail.");
+    }
+    free(data);
+
     // Read files in the file list
     for (int i = 0; i < filelistlen; i++) {
         emrtd_dg_t *dg = emrtd_tag_to_dg(filelist[i]);
@@ -1703,6 +1722,12 @@ int infoHF_EMRTD_offline(const char *path) {
                 // we won't halt on parsing errors
                 if (dg->parser != NULL)
                     dg->parser(data, datalen);
+                sha512hash(data, datalen, hash_out);
+                if (memcmp(dg_hashes[dg->dgnum], hash_out, 64) == 0) {
+                    PrintAndLogEx(SUCCESS, _GREEN_("Hash verification passed for EF_DG%i."), dg->dgnum);
+                } else {
+                    PrintAndLogEx(ERR, _RED_("Hash verification failed for EF_DG%i."), dg->dgnum);
+                }
                 free(data);
             }
         }
diff --git a/client/src/cmdhfemrtd.h b/client/src/cmdhfemrtd.h
index bcae56538..72f5f44b9 100644
--- a/client/src/cmdhfemrtd.h
+++ b/client/src/cmdhfemrtd.h
@@ -15,6 +15,7 @@
 
 typedef struct emrtd_dg_s {
     uint8_t tag;
+    uint8_t dgnum;
     const char *fileid;
     const char *filename;
     const char *desc;

From dbe5d9ac9a219265738645ec694ee93666441123 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 29 Dec 2020 02:08:30 +0300
Subject: [PATCH 212/682] emrtd info (online): Add basic hash verification
 support

---
 client/src/cmdhfemrtd.c | 32 ++++++++++++++++++++++++++++----
 1 file changed, 28 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index a088bfc7f..2235dc60b 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1633,9 +1633,22 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         DropField();
         return PM3_ESOFT;
     }
-    // TODO: DROP THIS TOO A LA OFFLINE
-    // Add EF_SOD to the list
-    // filelist[filelistlen++] = 0x77;
+
+    // Grab the hash list
+    uint8_t dg_hashes[16][64];
+    uint8_t hash_out[64];
+
+    if (!emrtd_select_and_read(response, &resplen, dg_table[EF_SOD].fileid, ks_enc, ks_mac, ssc, BAC, use_14b)) {
+        PrintAndLogEx(ERR, "Failed to read EF_SOD.");
+        DropField();
+        return PM3_ESOFT;
+    }
+
+    res = emrtd_parse_ef_sod_hashes(response, resplen, *dg_hashes);
+    if (res != PM3_SUCCESS) {
+        PrintAndLogEx(ERR, "Failed to read hash list from EF_SOD. Hash checks will fail.");
+    }
+
     // Dump all files in the file list
     for (int i = 0; i < filelistlen; i++) {
         emrtd_dg_t *dg = emrtd_tag_to_dg(filelist[i]);
@@ -1647,6 +1660,14 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
             if (emrtd_select_and_read(response, &resplen, dg->fileid, ks_enc, ks_mac, ssc, BAC, use_14b)) {
                 if (dg->parser != NULL)
                     dg->parser(response, resplen);
+
+                // Check file hash
+                sha512hash(response, resplen, hash_out);
+                if (memcmp(dg_hashes[dg->dgnum], hash_out, 64) == 0) {
+                    PrintAndLogEx(SUCCESS, _GREEN_("Hash verification passed for EF_DG%i."), dg->dgnum);
+                } else {
+                    PrintAndLogEx(ERR, _RED_("Hash verification failed for EF_DG%i."), dg->dgnum);
+                }
             }
         }
     }
@@ -1688,7 +1709,8 @@ int infoHF_EMRTD_offline(const char *path) {
     }
     free(data);
 
-    uint8_t dg_hashes[20][64];
+    // Grab the hash list
+    uint8_t dg_hashes[16][64];
     uint8_t hash_out[64];
 
     strcpy(filepath, path);
@@ -1722,6 +1744,8 @@ int infoHF_EMRTD_offline(const char *path) {
                 // we won't halt on parsing errors
                 if (dg->parser != NULL)
                     dg->parser(data, datalen);
+
+                // Check file hash
                 sha512hash(data, datalen, hash_out);
                 if (memcmp(dg_hashes[dg->dgnum], hash_out, 64) == 0) {
                     PrintAndLogEx(SUCCESS, _GREEN_("Hash verification passed for EF_DG%i."), dg->dgnum);

From 5a9d47476591458e69f9dcfb9c2f6a6c8a0db76d Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 29 Dec 2020 02:15:15 +0300
Subject: [PATCH 213/682] emrtd: Better coverity bits for hash verif

---
 client/src/cmdhfemrtd.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 2235dc60b..770fde28f 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1532,16 +1532,15 @@ static int emrtd_ef_sod_extract_signatures(uint8_t *data, size_t datalen, uint8_
     return PM3_SUCCESS;
 }
 
-static int emrtd_parse_ef_sod_hashes(uint8_t *data, size_t datalen, uint8_t *hashes) {
+static int emrtd_parse_ef_sod_hashes(uint8_t *data, size_t datalen, uint8_t *hashes, int *hashalgo) {
     uint8_t emrtdsig[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     uint8_t hashlist[EMRTD_MAX_FILE_SIZE] = { 0x00 };
-    uint8_t hash[65] = { 0x00 };
+    uint8_t hash[64] = { 0x00 };
     size_t hashlen = 0;
 
     uint8_t hashidstr[4] = { 0x00 };
     size_t hashidstrlen = 0;
 
-    // size_t emrtdsiglen, e_datalen, e_fieldlen = 0;
     size_t emrtdsiglen = 0;
     size_t hashlistlen = 0;
     size_t e_datalen = 0;
@@ -1572,8 +1571,10 @@ static int emrtd_parse_ef_sod_hashes(uint8_t *data, size_t datalen, uint8_t *has
             case 0x30:
                 emrtd_lds_get_data_by_tag(hashlist + offset + e_fieldlen + 1, e_datalen, hashidstr, &hashidstrlen, 0x02, 0x00, false, false, 0);
                 emrtd_lds_get_data_by_tag(hashlist + offset + e_fieldlen + 1, e_datalen, hash, &hashlen, 0x04, 0x00, false, false, 0);
-                if (hashlen <= 64) {  // TODO: This is for coverity, account for it.
+                if (hashlen <= 64) {
                     memcpy(hashes + (hashidstr[0] * 64), hash, hashlen);
+                } else {
+                    PrintAndLogEx(ERR, "error (emrtd_parse_ef_sod_hashes) hashlen out-of-bounds");
                 }
                 break;
         }

From 8b9c6a15f174651e407a77ff843daa19bb68ee87 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Tue, 29 Dec 2020 00:44:06 +0100
Subject: [PATCH 214/682] VSCode debugging test

---
 .vscode/launch.json | 16 +++++++++++++++-
 .vscode/tasks.json  |  8 ++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/.vscode/launch.json b/.vscode/launch.json
index f6a030c7c..65619a2a3 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -55,7 +55,21 @@
                     "name": "PATH","value": "${workspaceFolder}/../../msys2/mingw64/bin;${workspaceFolder}/../../msys2/usr/local/bin;${workspaceFolder}/../../msys2/usr/bin;${workspaceFolder}/../../msys2/bin"
                 }]
             }
-        }
+        },{
+            "type": "cortex-debug",
+            "request": "launch",
+            "name": "Debug J-Link",
+            "cwd": "${workspaceRoot}",
+            "preLaunchTask": "fullimage: clean & make",
+            "executable": "${workspaceRoot}/armsrc/obj/fullimage.stage1.elf",
+            "serverpath": "/opt/SEGGER/JLink/JLinkGDBServerCLExe", 
+            "servertype": "jlink",
+            "device": "AT91SAM7S512",
+            "interface": "jtag",
+            "serialNumber": "", //If you have more than one J-Link probe, add the serial number here.
+            "runToMain": true,
+            "armToolchainPath": "/usr/bin/"
+            }
     ],
     "inputs": [
         {
diff --git a/.vscode/tasks.json b/.vscode/tasks.json
index 7354a8a2d..4cc21841d 100644
--- a/.vscode/tasks.json
+++ b/.vscode/tasks.json
@@ -143,6 +143,14 @@
                 }
               },
             "problemMatcher": []
+        },{
+            "label": "fullimage: clean & make",
+            "type": "shell",
+            "command": "make armsrc/clean && make armsrc/all SKIP_COMPRESSION=1 DEBUG=1",
+            "problemMatcher": [
+                "$gcc"
+            ],
+            "group": "build",
         }
     ],
     "inputs": [

From 637e0179756243477a143c7767ddd175af3bcf77 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 29 Dec 2020 03:39:01 +0300
Subject: [PATCH 215/682] emrtd: Support SHA256

---
 client/src/cmdhfemrtd.c | 47 +++++++++++++++++++++++++++++++++++++----
 1 file changed, 43 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 770fde28f..e782e43ab 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1532,6 +1532,29 @@ static int emrtd_ef_sod_extract_signatures(uint8_t *data, size_t datalen, uint8_
     return PM3_SUCCESS;
 }
 
+static const uint8_t emrtd_hashalgo_sha256[] = {0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01};
+static const uint8_t emrtd_hashalgo_sha512[] = {0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03};
+
+static int emrtd_parse_ef_sod_hash_algo(uint8_t *data, size_t datalen, int *hashalgo) {
+    uint8_t hashalgoset[64] = { 0x00 };
+    size_t hashalgosetlen = 0;
+
+    if (!emrtd_lds_get_data_by_tag(data, datalen, hashalgoset, &hashalgosetlen, 0x30, 0x00, false, true, 0)) {
+        PrintAndLogEx(ERR, "Failed to read hash algo set from EF_SOD.");
+        return false;
+    }
+
+    PrintAndLogEx(DEBUG, "hash algo set: %s", sprint_hex_inrow(hashalgoset, hashalgosetlen));
+
+    if (memcmp(emrtd_hashalgo_sha256, hashalgoset, 11) == 0) {
+        *hashalgo = 1;
+    } else if (memcmp(emrtd_hashalgo_sha512, hashalgoset, 11) == 0) {
+        *hashalgo = 3;
+    }
+
+    return PM3_SUCCESS;
+}
+
 static int emrtd_parse_ef_sod_hashes(uint8_t *data, size_t datalen, uint8_t *hashes, int *hashalgo) {
     uint8_t emrtdsig[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     uint8_t hashlist[EMRTD_MAX_FILE_SIZE] = { 0x00 };
@@ -1553,6 +1576,8 @@ static int emrtd_parse_ef_sod_hashes(uint8_t *data, size_t datalen, uint8_t *has
 
     PrintAndLogEx(DEBUG, "hash data: %s", sprint_hex_inrow(emrtdsig, emrtdsiglen));
 
+    emrtd_parse_ef_sod_hash_algo(emrtdsig, emrtdsiglen, hashalgo);
+
     if (!emrtd_lds_get_data_by_tag(emrtdsig, emrtdsiglen, hashlist, &hashlistlen, 0x30, 0x00, false, true, 1)) {
         PrintAndLogEx(ERR, "Failed to read hash list from EF_SOD.");
         return false;
@@ -1638,6 +1663,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     // Grab the hash list
     uint8_t dg_hashes[16][64];
     uint8_t hash_out[64];
+    int hash_algo = 0;
 
     if (!emrtd_select_and_read(response, &resplen, dg_table[EF_SOD].fileid, ks_enc, ks_mac, ssc, BAC, use_14b)) {
         PrintAndLogEx(ERR, "Failed to read EF_SOD.");
@@ -1645,7 +1671,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         return PM3_ESOFT;
     }
 
-    res = emrtd_parse_ef_sod_hashes(response, resplen, *dg_hashes);
+    res = emrtd_parse_ef_sod_hashes(response, resplen, *dg_hashes, &hash_algo);
     if (res != PM3_SUCCESS) {
         PrintAndLogEx(ERR, "Failed to read hash list from EF_SOD. Hash checks will fail.");
     }
@@ -1663,7 +1689,13 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
                     dg->parser(response, resplen);
 
                 // Check file hash
-                sha512hash(response, resplen, hash_out);
+                memset(hash_out, 0, 64);
+                if (hash_algo == 1) {
+                    sha256hash(response, resplen, hash_out);
+                } else if (hash_algo == 3) {
+                    sha512hash(response, resplen, hash_out);
+                }
+
                 if (memcmp(dg_hashes[dg->dgnum], hash_out, 64) == 0) {
                     PrintAndLogEx(SUCCESS, _GREEN_("Hash verification passed for EF_DG%i."), dg->dgnum);
                 } else {
@@ -1713,6 +1745,7 @@ int infoHF_EMRTD_offline(const char *path) {
     // Grab the hash list
     uint8_t dg_hashes[16][64];
     uint8_t hash_out[64];
+    int hash_algo = 0;
 
     strcpy(filepath, path);
     strncat(filepath, PATHSEP, 2);
@@ -1724,7 +1757,7 @@ int infoHF_EMRTD_offline(const char *path) {
         return PM3_ESOFT;
     }
 
-    res = emrtd_parse_ef_sod_hashes(data, datalen, *dg_hashes);
+    res = emrtd_parse_ef_sod_hashes(data, datalen, *dg_hashes, &hash_algo);
     if (res != PM3_SUCCESS) {
         PrintAndLogEx(ERR, "Failed to read hash list from EF_SOD. Hash checks will fail.");
     }
@@ -1747,7 +1780,13 @@ int infoHF_EMRTD_offline(const char *path) {
                     dg->parser(data, datalen);
 
                 // Check file hash
-                sha512hash(data, datalen, hash_out);
+                memset(hash_out, 0, 64);
+                if (hash_algo == 1) {
+                    sha256hash(data, datalen, hash_out);
+                } else if (hash_algo == 3) {
+                    sha512hash(data, datalen, hash_out);
+                }
+
                 if (memcmp(dg_hashes[dg->dgnum], hash_out, 64) == 0) {
                     PrintAndLogEx(SUCCESS, _GREEN_("Hash verification passed for EF_DG%i."), dg->dgnum);
                 } else {

From f47b617a58c6851da9a456c56adb8f5170bae6e6 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 29 Dec 2020 03:51:30 +0300
Subject: [PATCH 216/682] emrtd: Check emrtd_parse_ef_sod_hash_algo output

---
 client/src/cmdhfemrtd.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index e782e43ab..089bb6633 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1550,6 +1550,9 @@ static int emrtd_parse_ef_sod_hash_algo(uint8_t *data, size_t datalen, int *hash
         *hashalgo = 1;
     } else if (memcmp(emrtd_hashalgo_sha512, hashalgoset, 11) == 0) {
         *hashalgo = 3;
+    } else {
+        *hashalgo = 0;
+        return PM3_ESOFT;
     }
 
     return PM3_SUCCESS;
@@ -1576,7 +1579,9 @@ static int emrtd_parse_ef_sod_hashes(uint8_t *data, size_t datalen, uint8_t *has
 
     PrintAndLogEx(DEBUG, "hash data: %s", sprint_hex_inrow(emrtdsig, emrtdsiglen));
 
-    emrtd_parse_ef_sod_hash_algo(emrtdsig, emrtdsiglen, hashalgo);
+    if (emrtd_parse_ef_sod_hash_algo(emrtdsig, emrtdsiglen, hashalgo) != PM3_SUCCESS) {
+        PrintAndLogEx(ERR, "Failed to parse hash list. Unknown algo?");
+    }
 
     if (!emrtd_lds_get_data_by_tag(emrtdsig, emrtdsiglen, hashlist, &hashlistlen, 0x30, 0x00, false, true, 1)) {
         PrintAndLogEx(ERR, "Failed to read hash list from EF_SOD.");

From bc8c52931bd65816e30109b283f0c70700881777 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 29 Dec 2020 04:01:15 +0300
Subject: [PATCH 217/682] emrtd: Split DG hash calc into emrtd_calc_dg_hash

---
 client/src/cmdhfemrtd.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 089bb6633..43a2adeb8 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1532,6 +1532,7 @@ static int emrtd_ef_sod_extract_signatures(uint8_t *data, size_t datalen, uint8_
     return PM3_SUCCESS;
 }
 
+// https://security.stackexchange.com/questions/131241/where-do-magic-constants-for-signature-algorithms-come-from
 static const uint8_t emrtd_hashalgo_sha256[] = {0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01};
 static const uint8_t emrtd_hashalgo_sha512[] = {0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03};
 
@@ -1615,6 +1616,16 @@ static int emrtd_parse_ef_sod_hashes(uint8_t *data, size_t datalen, uint8_t *has
     return PM3_SUCCESS;
 }
 
+static void emrtd_calc_dg_hash(uint8_t *data, size_t datalen, uint8_t *hash_out, int hash_algo) {
+    memset(hash_out, 0, 64);
+
+    if (hash_algo == 1) {
+        sha256hash(data, datalen, hash_out);
+    } else if (hash_algo == 3) {
+        sha512hash(data, datalen, hash_out);
+    }
+}
+
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available) {
     uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     int resplen = 0;
@@ -1694,12 +1705,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
                     dg->parser(response, resplen);
 
                 // Check file hash
-                memset(hash_out, 0, 64);
-                if (hash_algo == 1) {
-                    sha256hash(response, resplen, hash_out);
-                } else if (hash_algo == 3) {
-                    sha512hash(response, resplen, hash_out);
-                }
+                emrtd_calc_dg_hash(response, resplen, hash_out, hash_algo);
 
                 if (memcmp(dg_hashes[dg->dgnum], hash_out, 64) == 0) {
                     PrintAndLogEx(SUCCESS, _GREEN_("Hash verification passed for EF_DG%i."), dg->dgnum);
@@ -1785,12 +1791,7 @@ int infoHF_EMRTD_offline(const char *path) {
                     dg->parser(data, datalen);
 
                 // Check file hash
-                memset(hash_out, 0, 64);
-                if (hash_algo == 1) {
-                    sha256hash(data, datalen, hash_out);
-                } else if (hash_algo == 3) {
-                    sha512hash(data, datalen, hash_out);
-                }
+                emrtd_calc_dg_hash(data, datalen, hash_out, hash_algo);
 
                 if (memcmp(dg_hashes[dg->dgnum], hash_out, 64) == 0) {
                     PrintAndLogEx(SUCCESS, _GREEN_("Hash verification passed for EF_DG%i."), dg->dgnum);

From aae3426f8e6f08079ae5648c336c1d5d33c47318 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 29 Dec 2020 04:09:53 +0300
Subject: [PATCH 218/682] emrtd: Adjust an include comment

---
 client/src/cmdhfemrtd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 43a2adeb8..32c2c9e23 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -20,7 +20,7 @@
 #include "protocols.h"              // definitions of ISO14A/7816 protocol
 #include "emv/apduinfo.h"           // GetAPDUCodeDescription
 #include "sha1.h"                   // KSeed calculation etc
-#include "crypto/libpcrypto.h"      // Hash calculation (sha256), TODO: AES too
+#include "crypto/libpcrypto.h"      // Hash calculation (sha256, sha512)
 #include "mifare/desfire_crypto.h"  // des_encrypt/des_decrypt
 #include "des.h"                    // mbedtls_des_key_set_parity
 #include "cmdhf14b.h"               // exchange_14b_apdu

From 2c5c58d128e9d7ddc2cdb2a4f7c1a76ffefa807a Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 29 Dec 2020 04:20:48 +0300
Subject: [PATCH 219/682] emrtd: Remove 'very very very very cursed' comment

---
 client/src/cmdhfemrtd.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 32c2c9e23..08c53467b 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1485,7 +1485,6 @@ static int emrtd_print_ef_dg12_info(uint8_t *data, size_t datalen) {
 }
 
 static int emrtd_ef_sod_extract_signatures(uint8_t *data, size_t datalen, uint8_t *dataout, size_t *dataoutlen) {
-    // very very very very cursed code.
     uint8_t top[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     uint8_t signeddata[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     uint8_t emrtdsigcontainer[EMRTD_MAX_FILE_SIZE] = { 0x00 };

From 8c29c4231be80b41bc4ee2a31921f4d0c847d9e4 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Tue, 29 Dec 2020 03:30:57 +0100
Subject: [PATCH 220/682] Allow generation of debug information when using no
 compression

---
 common_arm/Makefile.hal | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/common_arm/Makefile.hal b/common_arm/Makefile.hal
index bfbe56d34..b6519e4ab 100644
--- a/common_arm/Makefile.hal
+++ b/common_arm/Makefile.hal
@@ -138,7 +138,7 @@ ifneq ($(SKIP_HFPLOT),1)
     PLATFORM_DEFS += -DWITH_HFPLOT
 endif
 ifeq ($(SKIP_COMPRESSION),1)
-    PLATFORM_DEFS += -DWITH_NO_COMPRESSION
+    PLATFORM_DEFS += -DWITH_NO_COMPRESSION -g
 endif
 
 # Standalone mode

From 654996eeee4f3cd8f1895aa90c57ffc48b04ae63 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Tue, 29 Dec 2020 03:39:59 +0100
Subject: [PATCH 221/682] Fixed debugger waiting for main

---
 .vscode/launch.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.vscode/launch.json b/.vscode/launch.json
index 65619a2a3..d1c5d6ff8 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -58,7 +58,7 @@
         },{
             "type": "cortex-debug",
             "request": "launch",
-            "name": "Debug J-Link",
+            "name": "Firmware debug",
             "cwd": "${workspaceRoot}",
             "preLaunchTask": "fullimage: clean & make",
             "executable": "${workspaceRoot}/armsrc/obj/fullimage.stage1.elf",
@@ -67,7 +67,7 @@
             "device": "AT91SAM7S512",
             "interface": "jtag",
             "serialNumber": "", //If you have more than one J-Link probe, add the serial number here.
-            "runToMain": true,
+            "runToMain": false,
             "armToolchainPath": "/usr/bin/"
             }
     ],

From 6d6f3d9f1a1bf7296dad3e654407b832464285cf Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Mon, 28 Dec 2020 23:00:10 -0500
Subject: [PATCH 222/682] hf 14a sniff, reader - now use cliparser

---
 client/src/cmdhf14a.c  | 110 ++++++++++++++++++++++-------------------
 doc/cliparser_todo.txt |   2 -
 2 files changed, 58 insertions(+), 54 deletions(-)

diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index 150b49fee..5419239b1 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -236,26 +236,6 @@ static int usage_hf_14a_sim(void) {
     PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a sim t 1 u 112233445566778899AA"));
     return PM3_SUCCESS;
 }
-static int usage_hf_14a_sniff(void) {
-    PrintAndLogEx(NORMAL, "Collect data from the field and save into command buffer.");
-    PrintAndLogEx(NORMAL, "Buffer accessible from command 'hf 14a list'");
-    PrintAndLogEx(NORMAL, "Usage:  hf 14a sniff [c][r]");
-    PrintAndLogEx(NORMAL, "c - triggered by first data from card");
-    PrintAndLogEx(NORMAL, "r - triggered by first 7-bit request from reader (REQ,WUP,...)");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("        hf 14a sniff c r"));
-    return PM3_SUCCESS;
-}
-
-static int usage_hf_14a_reader(void) {
-    PrintAndLogEx(NORMAL, "Usage: hf 14a reader [k|s|x] [3]");
-    PrintAndLogEx(NORMAL, "       k    keep the field active after command executed");
-    PrintAndLogEx(NORMAL, "       s    silent (no messages)");
-    PrintAndLogEx(NORMAL, "       x    just drop the signal field");
-    PrintAndLogEx(NORMAL, "       3    ISO14443-3 select only (skip RATS)");
-    PrintAndLogEx(NORMAL, "       @    continuous mode. Updates hf plot as well");
-    return PM3_SUCCESS;
-}
 
 static int CmdHF14AList(const char *Cmd) {
     char args[128] = {0};
@@ -462,37 +442,44 @@ int Hf14443_4aGetCardData(iso14a_card_select_t *card) {
 }
 
 static int CmdHF14AReader(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf 14a reader",
+                  "Reader for ISO 14443A based tags",
+                  "hf 14a reader -@ <- Continuous mode");
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0("k", "keep", "keep the field active after command executed"),
+        arg_lit0("s", "silent", "silent (no messages)"),
+        arg_lit0(NULL, "drop", "just drop the signal field"),
+        arg_lit0(NULL, "skip", "ISO14443-3 select only (skip RATS)"),
+        arg_lit0("@", NULL, "optional - continuous reader mode"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    bool disconnectAfter = true;
+    if (arg_get_lit(ctx, 1)) {
+        disconnectAfter = false;
+    }
+
+    bool silent = arg_get_lit(ctx, 2);
 
     uint32_t cm = ISO14A_CONNECT;
-    bool disconnectAfter = true, silent = false, continuous = false;
-    int cmdp = 0;
-    int res = PM3_SUCCESS;
-    while (param_getchar(Cmd, cmdp) != 0x00) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_hf_14a_reader();
-            case '3':
-                cm |= ISO14A_NO_RATS;
-                break;
-            case 'k':
-                disconnectAfter = false;
-                break;
-            case 's':
-                silent = true;
-                break;
-            case 'x':
-                cm &= ~ISO14A_CONNECT;
-                break;
-            case '@':
-                continuous = true;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown command.");
-                return PM3_EINVARG;
-        }
-        cmdp++;
+    if (arg_get_lit(ctx, 3)) {
+        cm &= ~ISO14A_CONNECT;
     }
 
+    if (arg_get_lit(ctx, 4)) {
+        cm |= ISO14A_NO_RATS;
+    }
+
+    bool continuous = arg_get_lit(ctx, 5);
+
+    CLIParserFree(ctx);
+
+    int res = PM3_SUCCESS;
+
     if (!disconnectAfter)
         cm |= ISO14A_NO_DISCONNECT;
     if (continuous) {
@@ -768,13 +755,32 @@ int CmdHF14ASim(const char *Cmd) {
 }
 
 int CmdHF14ASniff(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf 14a sniff",
+                  "Collect data from the field and save into command buffer.\n"
+                  "Buffer accessible from command 'hf 14a list'",
+                  " hf 14a sniff -c -r");
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0("c", "card", "triggered by first data from card"),
+        arg_lit0("r", "reader", "triggered by first 7-bit request from reader (REQ,WUP,...)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
     uint8_t param = 0;
-    for (uint8_t i = 0; i < 2; i++) {
-        uint8_t ctmp = tolower(param_getchar(Cmd, i));
-        if (ctmp == 'h') return usage_hf_14a_sniff();
-        if (ctmp == 'c') param |= 0x01;
-        if (ctmp == 'r') param |= 0x02;
+
+    if (arg_get_lit(ctx, 1)) {
+        param |= 0x01;
     }
+
+    if (arg_get_lit(ctx, 2)) {
+        param |= 0x02;
+    }
+
+    CLIParserFree(ctx);
+
     clearCommandBuffer();
     SendCommandNG(CMD_HF_ISO14443A_SNIFF, (uint8_t *)&param, sizeof(uint8_t));
     return PM3_SUCCESS;
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 7e333911b..c9dcf077c 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -41,10 +41,8 @@ data print
 data samples
 data setdebugmode
 data tune
-hf 14a reader
 hf 14a cuids
 hf 14a sim
-hf 14a sniff
 hf 14a config
 hf 14b sriwrite
 hf 15 dump

From 2124ef52893d95a251337f385af3ca1d4542e566 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Tue, 29 Dec 2020 05:01:29 +0100
Subject: [PATCH 223/682] Added firmware configuration for wsl

---
 .vscode/launch.json | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/.vscode/launch.json b/.vscode/launch.json
index d1c5d6ff8..abd2cd775 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -58,10 +58,10 @@
         },{
             "type": "cortex-debug",
             "request": "launch",
-            "name": "Firmware debug",
+            "name": "(Linux) Firmware debug",
             "cwd": "${workspaceRoot}",
             "preLaunchTask": "fullimage: clean & make",
-            "executable": "${workspaceRoot}/armsrc/obj/fullimage.stage1.elf",
+            "executable": "${workspaceRoot}/armsrc/obj/fullimage.elf",
             "serverpath": "/opt/SEGGER/JLink/JLinkGDBServerCLExe", 
             "servertype": "jlink",
             "device": "AT91SAM7S512",
@@ -69,7 +69,21 @@
             "serialNumber": "", //If you have more than one J-Link probe, add the serial number here.
             "runToMain": false,
             "armToolchainPath": "/usr/bin/"
-            }
+        },{
+            "type": "cortex-debug",
+            "request": "launch",
+            "name": "(WSL) Firmware debug",
+            "cwd": "${workspaceRoot}",
+            "preLaunchTask": "fullimage: clean & make",
+            "executable": "${workspaceRoot}/armsrc/obj/fullimage.elf",
+            "serverpath": "/mnt/c/Program Files (x86)/SEGGER/JLink/JLinkGDBServerCL.exe", 
+            "servertype": "jlink",
+            "device": "AT91SAM7S512",
+            "interface": "jtag",
+            "serialNumber": "", //If you have more than one J-Link probe, add the serial number here.
+            "runToMain": false,
+            "armToolchainPath": "/usr/bin/"
+        }
     ],
     "inputs": [
         {

From 9e224b011b6655e5de59c102731461ffa9adb152 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Tue, 29 Dec 2020 14:55:31 +0100
Subject: [PATCH 224/682] Template files for vscode

---
 .gitignore                               |   5 +
 .vscode/extensions.json                  |  10 ++
 .vscode/launch.json                      | 108 --------------
 .vscode/launch_linux.json                |  70 +++++++++
 .vscode/launch_ps.json                   |  45 ++++++
 .vscode/launch_wsl.json                  |  70 +++++++++
 .vscode/setup.sh                         |   4 +
 .vscode/{tasks.json => tasks_linux.json} |   0
 .vscode/tasks_ps.json                    | 177 +++++++++++++++++++++++
 .vscode/tasks_wsl.json                   | 177 +++++++++++++++++++++++
 10 files changed, 558 insertions(+), 108 deletions(-)
 create mode 100644 .vscode/extensions.json
 delete mode 100644 .vscode/launch.json
 create mode 100644 .vscode/launch_linux.json
 create mode 100644 .vscode/launch_ps.json
 create mode 100644 .vscode/launch_wsl.json
 create mode 100644 .vscode/setup.sh
 rename .vscode/{tasks.json => tasks_linux.json} (100%)
 create mode 100644 .vscode/tasks_ps.json
 create mode 100644 .vscode/tasks_wsl.json

diff --git a/.gitignore b/.gitignore
index 081c0f8e8..1b27c52a3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -108,3 +108,8 @@ fpga_version_info.c
 
 # .tmp files are created during compilation
 *.tmp
+
+#VSCode files
+!.vscode/*.json
+.vscode/launch.json
+.vscode/tasks.json
\ No newline at end of file
diff --git a/.vscode/extensions.json b/.vscode/extensions.json
new file mode 100644
index 000000000..85b3997e2
--- /dev/null
+++ b/.vscode/extensions.json
@@ -0,0 +1,10 @@
+{
+	// See https://go.microsoft.com/fwlink/?LinkId=827846
+	// for the documentation about the extensions.json format
+	"recommendations": [
+		"ms-vscode.cpptools",
+		"austin.code-gnu-global",
+		"marus25.cortex-debug",
+		"augustocdias.tasks-shell-input"
+	]
+}
diff --git a/.vscode/launch.json b/.vscode/launch.json
deleted file mode 100644
index abd2cd775..000000000
--- a/.vscode/launch.json
+++ /dev/null
@@ -1,108 +0,0 @@
-{
-    // Use IntelliSense to learn about possible attributes.
-    // Hover to view descriptions of existing attributes.
-    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
-    "version": "0.2.0",
-    "configurations": [
-        {
-            "name": "(gdb) Attach",
-            "type": "cppdbg",
-            "request": "attach",
-            "program": "${cwd}/client/proxmark3",
-            //"processId": "${command:pickProcess}",
-            "processId": "${input:ProcessID}",
-            "MIMode": "gdb",
-            "setupCommands": [
-                {
-                    "description": "Enable pretty-printing for gdb",
-                    "text": "-enable-pretty-printing",
-                    "ignoreFailures": true
-                }
-            ],
-            "windows": {
-                "processId": "${input:ProcessIDWindows}",
-                "miDebuggerPath": "${workspaceFolder}/../../msys2/mingw64/bin/gdb.exe",
-                "externalConsole": true,//for ProxSpace externalConsole=true is required, because the internal cosole stops updating after a while
-                "environment": [{
-                    "name": "PATH","value": "${workspaceFolder}/../../msys2/mingw64/bin;${workspaceFolder}/../../msys2/usr/local/bin;${workspaceFolder}/../../msys2/usr/bin;${workspaceFolder}/../../msys2/bin"
-                }]
-            }
-        },{
-            "name": "(gdb) Build & Launch",
-            "type": "cppdbg",
-            "request": "launch",
-            "program": "${cwd}/client/proxmark3",
-            "args": ["/dev/ttyACM0"], 
-            "stopAtEntry": false,
-            "cwd": "${workspaceFolder}",
-            "environment": [],
-            "externalConsole": false,
-            "MIMode": "gdb",
-            "setupCommands": [
-                {
-                    "description": "Enable pretty-printing for gdb",
-                    "text": "-enable-pretty-printing",
-                    "ignoreFailures": true
-                }
-            ],
-            "preLaunchTask": "client: Debug: clean & make",
-            "miDebuggerPath": "/usr/bin/gdb",
-            "windows": {
-                "args": ["COM5"],
-                "miDebuggerPath": "${workspaceFolder}/../../msys2/mingw64/bin/gdb.exe",
-                "externalConsole": true,//for ProxSpace externalConsole=true is required, because the internal cosole stops updating after a while
-                "environment": [{
-                    "name": "PATH","value": "${workspaceFolder}/../../msys2/mingw64/bin;${workspaceFolder}/../../msys2/usr/local/bin;${workspaceFolder}/../../msys2/usr/bin;${workspaceFolder}/../../msys2/bin"
-                }]
-            }
-        },{
-            "type": "cortex-debug",
-            "request": "launch",
-            "name": "(Linux) Firmware debug",
-            "cwd": "${workspaceRoot}",
-            "preLaunchTask": "fullimage: clean & make",
-            "executable": "${workspaceRoot}/armsrc/obj/fullimage.elf",
-            "serverpath": "/opt/SEGGER/JLink/JLinkGDBServerCLExe", 
-            "servertype": "jlink",
-            "device": "AT91SAM7S512",
-            "interface": "jtag",
-            "serialNumber": "", //If you have more than one J-Link probe, add the serial number here.
-            "runToMain": false,
-            "armToolchainPath": "/usr/bin/"
-        },{
-            "type": "cortex-debug",
-            "request": "launch",
-            "name": "(WSL) Firmware debug",
-            "cwd": "${workspaceRoot}",
-            "preLaunchTask": "fullimage: clean & make",
-            "executable": "${workspaceRoot}/armsrc/obj/fullimage.elf",
-            "serverpath": "/mnt/c/Program Files (x86)/SEGGER/JLink/JLinkGDBServerCL.exe", 
-            "servertype": "jlink",
-            "device": "AT91SAM7S512",
-            "interface": "jtag",
-            "serialNumber": "", //If you have more than one J-Link probe, add the serial number here.
-            "runToMain": false,
-            "armToolchainPath": "/usr/bin/"
-        }
-    ],
-    "inputs": [
-        {
-            // Using Extension "Tasks Shell Input" https://marketplace.visualstudio.com/items?itemName=augustocdias.tasks-shell-input
-            "id": "ProcessID",
-            "type": "command",
-            "command": "shellCommand.execute",
-            "args": {
-                "command": "pgrep -n proxmark3",
-            }
-            
-        },{
-            "id": "ProcessIDWindows",
-            "type": "command",
-            "command": "shellCommand.execute",
-            "args": {
-                "command": "${workspaceFolder}/../../runme64.bat -c \"cat /proc/$(pgrep -n proxmark3)/winpid\"",
-            }
-            
-        }
-    ]
-}
\ No newline at end of file
diff --git a/.vscode/launch_linux.json b/.vscode/launch_linux.json
new file mode 100644
index 000000000..0f60495a6
--- /dev/null
+++ b/.vscode/launch_linux.json
@@ -0,0 +1,70 @@
+{
+    // Use IntelliSense to learn about possible attributes.
+    // Hover to view descriptions of existing attributes.
+    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "name": "Client: (gdb) Build & Launch",
+            "type": "cppdbg",
+            "request": "launch",
+            "program": "${cwd}/client/proxmark3",
+            "args": ["${SerialPort}"], 
+            "stopAtEntry": false,
+            "cwd": "${workspaceFolder}",
+            "environment": [],
+            "externalConsole": false,
+            "MIMode": "gdb",
+            "setupCommands": [
+                {
+                    "description": "Enable pretty-printing for gdb",
+                    "text": "-enable-pretty-printing",
+                    "ignoreFailures": true
+                }
+            ],
+            "preLaunchTask": "client: Debug: clean & make",
+            "miDebuggerPath": "${DebuggerPath}"
+        },{
+            "name": "Client: (gdb) Attach",
+            "type": "cppdbg",
+            "request": "attach",
+            "program": "${cwd}/client/proxmark3",
+            //"processId": "${command:pickProcess}",
+            "processId": "${input:ProcessID}",
+            "MIMode": "gdb",
+            "setupCommands": [
+                {
+                    "description": "Enable pretty-printing for gdb",
+                    "text": "-enable-pretty-printing",
+                    "ignoreFailures": true
+                }
+            ]
+        },{
+            "name": "Firmware: (J-Link) Build & Launch",
+            "type": "cortex-debug",
+            "request": "launch",
+            "cwd": "${workspaceRoot}",
+            "preLaunchTask": "fullimage: clean & make",
+            "executable": "${workspaceRoot}/armsrc/obj/fullimage.elf",
+            "serverpath": "${JLinkServerPath}", 
+            "servertype": "jlink",
+            "device": "AT91SAM7S${DeviceMem}",
+            "interface": "jtag",
+            "serialNumber": "", //If you have more than one J-Link probe, add the serial number here.
+            "runToMain": false,
+            "armToolchainPath": "/usr/bin/"
+        }
+    ],
+    "inputs": [
+        {
+            // Using Extension "Tasks Shell Input" https://marketplace.visualstudio.com/items?itemName=augustocdias.tasks-shell-input
+            "id": "ProcessID",
+            "type": "command",
+            "command": "shellCommand.execute",
+            "args": {
+                "command": "pgrep -n proxmark3",
+            }
+            
+        }
+    ]
+}
\ No newline at end of file
diff --git a/.vscode/launch_ps.json b/.vscode/launch_ps.json
new file mode 100644
index 000000000..8794ef76e
--- /dev/null
+++ b/.vscode/launch_ps.json
@@ -0,0 +1,45 @@
+{
+    // Use IntelliSense to learn about possible attributes.
+    // Hover to view descriptions of existing attributes.
+    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+    "version": "0.2.0",
+    "configurations": [
+		{
+            "name": "Client: (gdb) Build & Launch",
+            "type": "cppdbg",
+            "request": "launch",
+            "program": "${cwd}/client/proxmark3",
+            "args": ["${SerialPort}"],
+            "stopAtEntry": false,
+            "cwd": "${workspaceFolder}",
+            "environment": [
+				"name": "PATH","value": "${workspaceFolder}/../../msys2/mingw64/bin;${workspaceFolder}/../../msys2/usr/local/bin;${workspaceFolder}/../../msys2/usr/bin;${workspaceFolder}/../../msys2/bin"
+			],
+            "externalConsole": true,//for ProxSpace externalConsole=true is required, because the internal cosole stops updating after a while
+            "MIMode": "gdb",
+            "setupCommands": [
+                {
+                    "description": "Enable pretty-printing for gdb",
+                    "text": "-enable-pretty-printing",
+                    "ignoreFailures": true
+                }
+            ],
+            "preLaunchTask": "client: Debug: clean & make",
+            "miDebuggerPath": "${DebuggerPath}"
+        },{
+            "name": "Firmware: (J-Link) Build & Launch",
+            "type": "cortex-debug",
+            "request": "launch",
+            "cwd": "${workspaceRoot}",
+            "preLaunchTask": "fullimage: clean & make",
+            "executable": "${workspaceRoot}/armsrc/obj/fullimage.elf",
+            "serverpath": "${JLinkServerPath}",
+            "servertype": "jlink",
+            "device": "AT91SAM7S${DeviceMem}",
+            "interface": "jtag",
+            "serialNumber": "", //If you have more than one J-Link probe, add the serial number here.
+            "runToMain": false,
+            "armToolchainPath": "/usr/bin/"
+        }
+    ]
+}
\ No newline at end of file
diff --git a/.vscode/launch_wsl.json b/.vscode/launch_wsl.json
new file mode 100644
index 000000000..0f60495a6
--- /dev/null
+++ b/.vscode/launch_wsl.json
@@ -0,0 +1,70 @@
+{
+    // Use IntelliSense to learn about possible attributes.
+    // Hover to view descriptions of existing attributes.
+    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "name": "Client: (gdb) Build & Launch",
+            "type": "cppdbg",
+            "request": "launch",
+            "program": "${cwd}/client/proxmark3",
+            "args": ["${SerialPort}"], 
+            "stopAtEntry": false,
+            "cwd": "${workspaceFolder}",
+            "environment": [],
+            "externalConsole": false,
+            "MIMode": "gdb",
+            "setupCommands": [
+                {
+                    "description": "Enable pretty-printing for gdb",
+                    "text": "-enable-pretty-printing",
+                    "ignoreFailures": true
+                }
+            ],
+            "preLaunchTask": "client: Debug: clean & make",
+            "miDebuggerPath": "${DebuggerPath}"
+        },{
+            "name": "Client: (gdb) Attach",
+            "type": "cppdbg",
+            "request": "attach",
+            "program": "${cwd}/client/proxmark3",
+            //"processId": "${command:pickProcess}",
+            "processId": "${input:ProcessID}",
+            "MIMode": "gdb",
+            "setupCommands": [
+                {
+                    "description": "Enable pretty-printing for gdb",
+                    "text": "-enable-pretty-printing",
+                    "ignoreFailures": true
+                }
+            ]
+        },{
+            "name": "Firmware: (J-Link) Build & Launch",
+            "type": "cortex-debug",
+            "request": "launch",
+            "cwd": "${workspaceRoot}",
+            "preLaunchTask": "fullimage: clean & make",
+            "executable": "${workspaceRoot}/armsrc/obj/fullimage.elf",
+            "serverpath": "${JLinkServerPath}", 
+            "servertype": "jlink",
+            "device": "AT91SAM7S${DeviceMem}",
+            "interface": "jtag",
+            "serialNumber": "", //If you have more than one J-Link probe, add the serial number here.
+            "runToMain": false,
+            "armToolchainPath": "/usr/bin/"
+        }
+    ],
+    "inputs": [
+        {
+            // Using Extension "Tasks Shell Input" https://marketplace.visualstudio.com/items?itemName=augustocdias.tasks-shell-input
+            "id": "ProcessID",
+            "type": "command",
+            "command": "shellCommand.execute",
+            "args": {
+                "command": "pgrep -n proxmark3",
+            }
+            
+        }
+    ]
+}
\ No newline at end of file
diff --git a/.vscode/setup.sh b/.vscode/setup.sh
new file mode 100644
index 000000000..b439f2cbd
--- /dev/null
+++ b/.vscode/setup.sh
@@ -0,0 +1,4 @@
+export SerialPort="/dev/ttyACM0"
+export DebuggerPath="/usr/bin/gdb"
+export JLinkServerPath="/opt/SEGGER/JLink/JLinkGDBServerCLExe"
+export DeviceMem="512"
\ No newline at end of file
diff --git a/.vscode/tasks.json b/.vscode/tasks_linux.json
similarity index 100%
rename from .vscode/tasks.json
rename to .vscode/tasks_linux.json
diff --git a/.vscode/tasks_ps.json b/.vscode/tasks_ps.json
new file mode 100644
index 000000000..4cc21841d
--- /dev/null
+++ b/.vscode/tasks_ps.json
@@ -0,0 +1,177 @@
+{
+    // See https://go.microsoft.com/fwlink/?LinkId=733558
+    // for the documentation about the tasks.json format
+    "version": "2.0.0",
+    "tasks": [
+        {
+            "label": "all: Make & run",
+            "type": "shell",
+            "command": "make -j && ./pm3",
+            "windows": {
+                "options": {
+                    "cwd": "${workspaceFolder}/../..",
+                    "shell": {
+                        "executable": "${workspaceFolder}/../../runme64.bat",
+                        "args": [
+                            "-c \"cd ${workspaceFolderBasename} &&"
+                        ],
+                        
+                    }
+                }
+              },
+            "problemMatcher": [
+                "$gcc"
+            ],
+            "group": {
+                "kind": "build",
+                "isDefault": true
+            }
+        },
+        {
+            "label": "choose: Make",
+            "type": "shell",
+            "command": "make ${input:componentType} -j",
+            "windows": {
+                "options": {
+                    "cwd": "${workspaceFolder}/../..",
+                    "shell": {
+                        "executable": "${workspaceFolder}/../../runme64.bat",
+                        "args": [
+                            "-c \"cd ${workspaceFolderBasename} &&"
+                        ],
+                        
+                    }
+                }
+              },
+            "problemMatcher": [
+                "$gcc"
+            ],
+            "group": "build",
+        },
+        {
+            "label": "client: Debug: make",
+            "type": "shell",
+            "command": "make client -j DEBUG=1",
+            "windows": {
+                "options": {
+                    "cwd": "${workspaceFolder}/../..",
+                    "shell": {
+                        "executable": "${workspaceFolder}/../../runme64.bat",
+                        "args": [
+                            "-c \"cd ${workspaceFolderBasename} &&"
+                        ],
+                        
+                    }
+                }
+              },
+            "problemMatcher": [
+                "$gcc"
+            ],
+            "group": "build",
+        },
+        {
+            "label": "client: Debug: clean & make",
+            "type": "shell",
+            "command": "make client/clean && make client -j DEBUG=1",
+            "windows": {
+                "options": {
+                    "cwd": "${workspaceFolder}/../..",
+                    "shell": {
+                        "executable": "${workspaceFolder}/../../runme64.bat",
+                        "args": [
+                            "-c \"cd ${workspaceFolderBasename} &&"
+                        ],
+                        
+                    }   
+                }
+              },
+            "problemMatcher": [
+                "$gcc"
+            ],
+            "group": "build",
+        },
+        {
+            "label": "fullimage: Make & Flash",
+            "type": "shell",
+            "command": "make fullimage && ./pm3-flash-fullimage",
+            "windows": {
+                "options": {
+                    "cwd": "${workspaceFolder}/../..",
+                    "shell": {
+                        "executable": "${workspaceFolder}/../../runme64.bat",
+                        "args": [
+                            "-c \"cd ${workspaceFolderBasename} &&"
+                        ],
+                        
+                    }
+                }
+              },
+            "problemMatcher": []
+        },
+        {
+            "label": "BOOTROM: Make & Flash",
+            "type": "shell",
+            "command": "make bootrom && ./pm3-flash-bootrom",
+            "windows": {
+                "options": {
+                    "cwd": "${workspaceFolder}/../..",
+                    "shell": {
+                        "executable": "${workspaceFolder}/../../runme64.bat",
+                        "args": [
+                            "-c \"cd ${workspaceFolderBasename} &&"
+                        ],
+                        
+                    }
+                }
+              },
+            "problemMatcher": []
+        },
+        {
+            "label": "Run client",
+            "type": "shell",
+            "command": "./pm3",
+            "windows": {
+                "options": {
+                    "cwd": "${workspaceFolder}/../..",
+                    "shell": {
+                        "executable": "${workspaceFolder}/../../runme64.bat",
+                        "args": [
+                            "-c \"cd ${workspaceFolderBasename} &&"
+                        ],
+                        
+                    }
+                }
+              },
+            "problemMatcher": []
+        },{
+            "label": "fullimage: clean & make",
+            "type": "shell",
+            "command": "make armsrc/clean && make armsrc/all SKIP_COMPRESSION=1 DEBUG=1",
+            "problemMatcher": [
+                "$gcc"
+            ],
+            "group": "build",
+        }
+    ],
+    "inputs": [
+        {
+            "type": "pickString",
+            "id": "componentType",
+            "description": "What Makefile target do you want to execute?",
+            "options": [
+                "all",
+                "client",
+                "bootrom",
+                "fullimage",
+                "recovery",
+                "clean",
+                "install",
+                "uninstall",
+                "style",
+                "miscchecks",
+                "check",
+            ],
+            "default": "all"
+        }
+    ]
+}
\ No newline at end of file
diff --git a/.vscode/tasks_wsl.json b/.vscode/tasks_wsl.json
new file mode 100644
index 000000000..4cc21841d
--- /dev/null
+++ b/.vscode/tasks_wsl.json
@@ -0,0 +1,177 @@
+{
+    // See https://go.microsoft.com/fwlink/?LinkId=733558
+    // for the documentation about the tasks.json format
+    "version": "2.0.0",
+    "tasks": [
+        {
+            "label": "all: Make & run",
+            "type": "shell",
+            "command": "make -j && ./pm3",
+            "windows": {
+                "options": {
+                    "cwd": "${workspaceFolder}/../..",
+                    "shell": {
+                        "executable": "${workspaceFolder}/../../runme64.bat",
+                        "args": [
+                            "-c \"cd ${workspaceFolderBasename} &&"
+                        ],
+                        
+                    }
+                }
+              },
+            "problemMatcher": [
+                "$gcc"
+            ],
+            "group": {
+                "kind": "build",
+                "isDefault": true
+            }
+        },
+        {
+            "label": "choose: Make",
+            "type": "shell",
+            "command": "make ${input:componentType} -j",
+            "windows": {
+                "options": {
+                    "cwd": "${workspaceFolder}/../..",
+                    "shell": {
+                        "executable": "${workspaceFolder}/../../runme64.bat",
+                        "args": [
+                            "-c \"cd ${workspaceFolderBasename} &&"
+                        ],
+                        
+                    }
+                }
+              },
+            "problemMatcher": [
+                "$gcc"
+            ],
+            "group": "build",
+        },
+        {
+            "label": "client: Debug: make",
+            "type": "shell",
+            "command": "make client -j DEBUG=1",
+            "windows": {
+                "options": {
+                    "cwd": "${workspaceFolder}/../..",
+                    "shell": {
+                        "executable": "${workspaceFolder}/../../runme64.bat",
+                        "args": [
+                            "-c \"cd ${workspaceFolderBasename} &&"
+                        ],
+                        
+                    }
+                }
+              },
+            "problemMatcher": [
+                "$gcc"
+            ],
+            "group": "build",
+        },
+        {
+            "label": "client: Debug: clean & make",
+            "type": "shell",
+            "command": "make client/clean && make client -j DEBUG=1",
+            "windows": {
+                "options": {
+                    "cwd": "${workspaceFolder}/../..",
+                    "shell": {
+                        "executable": "${workspaceFolder}/../../runme64.bat",
+                        "args": [
+                            "-c \"cd ${workspaceFolderBasename} &&"
+                        ],
+                        
+                    }   
+                }
+              },
+            "problemMatcher": [
+                "$gcc"
+            ],
+            "group": "build",
+        },
+        {
+            "label": "fullimage: Make & Flash",
+            "type": "shell",
+            "command": "make fullimage && ./pm3-flash-fullimage",
+            "windows": {
+                "options": {
+                    "cwd": "${workspaceFolder}/../..",
+                    "shell": {
+                        "executable": "${workspaceFolder}/../../runme64.bat",
+                        "args": [
+                            "-c \"cd ${workspaceFolderBasename} &&"
+                        ],
+                        
+                    }
+                }
+              },
+            "problemMatcher": []
+        },
+        {
+            "label": "BOOTROM: Make & Flash",
+            "type": "shell",
+            "command": "make bootrom && ./pm3-flash-bootrom",
+            "windows": {
+                "options": {
+                    "cwd": "${workspaceFolder}/../..",
+                    "shell": {
+                        "executable": "${workspaceFolder}/../../runme64.bat",
+                        "args": [
+                            "-c \"cd ${workspaceFolderBasename} &&"
+                        ],
+                        
+                    }
+                }
+              },
+            "problemMatcher": []
+        },
+        {
+            "label": "Run client",
+            "type": "shell",
+            "command": "./pm3",
+            "windows": {
+                "options": {
+                    "cwd": "${workspaceFolder}/../..",
+                    "shell": {
+                        "executable": "${workspaceFolder}/../../runme64.bat",
+                        "args": [
+                            "-c \"cd ${workspaceFolderBasename} &&"
+                        ],
+                        
+                    }
+                }
+              },
+            "problemMatcher": []
+        },{
+            "label": "fullimage: clean & make",
+            "type": "shell",
+            "command": "make armsrc/clean && make armsrc/all SKIP_COMPRESSION=1 DEBUG=1",
+            "problemMatcher": [
+                "$gcc"
+            ],
+            "group": "build",
+        }
+    ],
+    "inputs": [
+        {
+            "type": "pickString",
+            "id": "componentType",
+            "description": "What Makefile target do you want to execute?",
+            "options": [
+                "all",
+                "client",
+                "bootrom",
+                "fullimage",
+                "recovery",
+                "clean",
+                "install",
+                "uninstall",
+                "style",
+                "miscchecks",
+                "check",
+            ],
+            "default": "all"
+        }
+    ]
+}
\ No newline at end of file

From 040520d865486184e0165779a16f7774414277ee Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 29 Dec 2020 17:56:29 +0300
Subject: [PATCH 225/682] emrtd: Improve hashing logic, support SHA1

---
 client/src/cmdhfemrtd.c        | 86 +++++++++++++++++++---------------
 client/src/cmdhfemrtd.h        |  8 ++++
 client/src/crypto/libpcrypto.c | 10 ++++
 client/src/crypto/libpcrypto.h |  1 +
 4 files changed, 68 insertions(+), 37 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 08c53467b..e563ac7fa 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -19,8 +19,7 @@
 #include "cmdhf14a.h"               // ExchangeAPDU14a
 #include "protocols.h"              // definitions of ISO14A/7816 protocol
 #include "emv/apduinfo.h"           // GetAPDUCodeDescription
-#include "sha1.h"                   // KSeed calculation etc
-#include "crypto/libpcrypto.h"      // Hash calculation (sha256, sha512)
+#include "crypto/libpcrypto.h"      // Hash calculation (sha1, sha256, sha512)
 #include "mifare/desfire_crypto.h"  // des_encrypt/des_decrypt
 #include "des.h"                    // mbedtls_des_key_set_parity
 #include "cmdhf14b.h"               // exchange_14b_apdu
@@ -108,6 +107,16 @@ static emrtd_dg_t dg_table[] = {
     {0x00, 0,  NULL, NULL, NULL, false, false, false, false, NULL, NULL}
 };
 
+// https://security.stackexchange.com/questions/131241/where-do-magic-constants-for-signature-algorithms-come-from
+// https://tools.ietf.org/html/rfc3447#page-43
+static emrtd_hashalg_t hashalg_table[] = {
+//  name        hash func   len len descriptor
+    {"SHA-1",   sha1hash,   20,  9, {0x06, 0x05, 0x2B, 0x0E, 0x03, 0x02, 0x1A, 0x05, 0x00}},
+    {"SHA-256", sha256hash, 32, 11, {0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01}},
+    {"SHA-512", sha512hash, 64, 11, {0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03}},
+    {NULL,      NULL,       0,  0,  {}}
+};
+
 static emrtd_dg_t *emrtd_tag_to_dg(uint8_t tag) {
     for (int dgi = 0; dg_table[dgi].filename != NULL; dgi++) {
         if (dg_table[dgi].tag == tag) {
@@ -339,7 +348,7 @@ static void emrtd_deskey(uint8_t *seed, const uint8_t *type, int length, uint8_t
 
     // SHA1 the key
     unsigned char key[64];
-    mbedtls_sha1(data, length + 4, key);
+    sha1hash(data, length + 4, key);
     PrintAndLogEx(DEBUG, "key............... %s", sprint_hex_inrow(key, length + 4));
 
     // Set parity bits
@@ -822,7 +831,7 @@ static bool emrtd_do_bac(char *documentnumber, char *dob, char *expiry, uint8_t
     PrintAndLogEx(DEBUG, "kmrz.............. " _GREEN_("%s"), kmrz);
 
     uint8_t kseed[20] = { 0x00 };
-    mbedtls_sha1((unsigned char *)kmrz, strlen(kmrz), kseed);
+    sha1hash((unsigned char *)kmrz, strlen(kmrz), kseed);
     PrintAndLogEx(DEBUG, "kseed (sha1)...... %s ", sprint_hex_inrow(kseed, 16));
 
     emrtd_deskey(kseed, KENC_type, 16, kenc);
@@ -1531,10 +1540,6 @@ static int emrtd_ef_sod_extract_signatures(uint8_t *data, size_t datalen, uint8_
     return PM3_SUCCESS;
 }
 
-// https://security.stackexchange.com/questions/131241/where-do-magic-constants-for-signature-algorithms-come-from
-static const uint8_t emrtd_hashalgo_sha256[] = {0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01};
-static const uint8_t emrtd_hashalgo_sha512[] = {0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03};
-
 static int emrtd_parse_ef_sod_hash_algo(uint8_t *data, size_t datalen, int *hashalgo) {
     uint8_t hashalgoset[64] = { 0x00 };
     size_t hashalgosetlen = 0;
@@ -1546,16 +1551,23 @@ static int emrtd_parse_ef_sod_hash_algo(uint8_t *data, size_t datalen, int *hash
 
     PrintAndLogEx(DEBUG, "hash algo set: %s", sprint_hex_inrow(hashalgoset, hashalgosetlen));
 
-    if (memcmp(emrtd_hashalgo_sha256, hashalgoset, 11) == 0) {
-        *hashalgo = 1;
-    } else if (memcmp(emrtd_hashalgo_sha512, hashalgoset, 11) == 0) {
-        *hashalgo = 3;
-    } else {
-        *hashalgo = 0;
-        return PM3_ESOFT;
+    for (int hashi = 0; hashalg_table[hashi].name != NULL; hashi++) {
+        PrintAndLogEx(DEBUG, "trying: %s", hashalg_table[hashi].name);
+        // We're only interested in checking if the length matches to avoid memory shenanigans
+        if (hashalg_table[hashi].descriptorlen != hashalgosetlen) {
+            PrintAndLogEx(DEBUG, "len mismatch: %i", hashalgosetlen);
+            continue;
+        }
+
+        if (memcmp(hashalg_table[hashi].descriptor, hashalgoset, hashalgosetlen) == 0) {
+            *hashalgo = hashi;
+            return PM3_SUCCESS;
+        }
     }
 
-    return PM3_SUCCESS;
+    // Return hash algo 0 if we can't find anything
+    *hashalgo = -1;
+    return PM3_ESOFT;
 }
 
 static int emrtd_parse_ef_sod_hashes(uint8_t *data, size_t datalen, uint8_t *hashes, int *hashalgo) {
@@ -1580,7 +1592,7 @@ static int emrtd_parse_ef_sod_hashes(uint8_t *data, size_t datalen, uint8_t *has
     PrintAndLogEx(DEBUG, "hash data: %s", sprint_hex_inrow(emrtdsig, emrtdsiglen));
 
     if (emrtd_parse_ef_sod_hash_algo(emrtdsig, emrtdsiglen, hashalgo) != PM3_SUCCESS) {
-        PrintAndLogEx(ERR, "Failed to parse hash list. Unknown algo?");
+        PrintAndLogEx(ERR, "Failed to parse hash list (Unknown algo?). Hash verification won't be available.");
     }
 
     if (!emrtd_lds_get_data_by_tag(emrtdsig, emrtdsiglen, hashlist, &hashlistlen, 0x30, 0x00, false, true, 1)) {
@@ -1615,16 +1627,6 @@ static int emrtd_parse_ef_sod_hashes(uint8_t *data, size_t datalen, uint8_t *has
     return PM3_SUCCESS;
 }
 
-static void emrtd_calc_dg_hash(uint8_t *data, size_t datalen, uint8_t *hash_out, int hash_algo) {
-    memset(hash_out, 0, 64);
-
-    if (hash_algo == 1) {
-        sha256hash(data, datalen, hash_out);
-    } else if (hash_algo == 3) {
-        sha512hash(data, datalen, hash_out);
-    }
-}
-
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available) {
     uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     int resplen = 0;
@@ -1703,13 +1705,18 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
                 if (dg->parser != NULL)
                     dg->parser(response, resplen);
 
+                PrintAndLogEx(DEBUG, "EF_DG%i hash algo: %i", dg->dgnum, hash_algo);
                 // Check file hash
-                emrtd_calc_dg_hash(response, resplen, hash_out, hash_algo);
+                if (hash_algo != -1) {
+                    PrintAndLogEx(DEBUG, "EF_DG%i hash on EF_SOD: %s", dg->dgnum, sprint_hex_inrow(dg_hashes[dg->dgnum], hashalg_table[hash_algo].hashlen));
+                    hashalg_table[hash_algo].hasher(response, resplen, hash_out);
+                    PrintAndLogEx(DEBUG, "EF_DG%i hash calc: %s", dg->dgnum, sprint_hex_inrow(hash_out, hashalg_table[hash_algo].hashlen));
 
-                if (memcmp(dg_hashes[dg->dgnum], hash_out, 64) == 0) {
-                    PrintAndLogEx(SUCCESS, _GREEN_("Hash verification passed for EF_DG%i."), dg->dgnum);
-                } else {
-                    PrintAndLogEx(ERR, _RED_("Hash verification failed for EF_DG%i."), dg->dgnum);
+                    if (memcmp(dg_hashes[dg->dgnum], hash_out, hashalg_table[hash_algo].hashlen) == 0) {
+                        PrintAndLogEx(SUCCESS, _GREEN_("Hash verification passed for EF_DG%i."), dg->dgnum);
+                    } else {
+                        PrintAndLogEx(ERR, _RED_("Hash verification failed for EF_DG%i."), dg->dgnum);
+                    }
                 }
             }
         }
@@ -1789,13 +1796,18 @@ int infoHF_EMRTD_offline(const char *path) {
                 if (dg->parser != NULL)
                     dg->parser(data, datalen);
 
+                PrintAndLogEx(DEBUG, "EF_DG%i hash algo: %i", dg->dgnum, hash_algo);
                 // Check file hash
-                emrtd_calc_dg_hash(data, datalen, hash_out, hash_algo);
+                if (hash_algo != -1) {
+                    PrintAndLogEx(DEBUG, "EF_DG%i hash on EF_SOD: %s", dg->dgnum, sprint_hex_inrow(dg_hashes[dg->dgnum], hashalg_table[hash_algo].hashlen));
+                    hashalg_table[hash_algo].hasher(data, datalen, hash_out);
+                    PrintAndLogEx(DEBUG, "EF_DG%i hash calc: %s", dg->dgnum, sprint_hex_inrow(hash_out, hashalg_table[hash_algo].hashlen));
 
-                if (memcmp(dg_hashes[dg->dgnum], hash_out, 64) == 0) {
-                    PrintAndLogEx(SUCCESS, _GREEN_("Hash verification passed for EF_DG%i."), dg->dgnum);
-                } else {
-                    PrintAndLogEx(ERR, _RED_("Hash verification failed for EF_DG%i."), dg->dgnum);
+                    if (memcmp(dg_hashes[dg->dgnum], hash_out, hashalg_table[hash_algo].hashlen) == 0) {
+                        PrintAndLogEx(SUCCESS, _GREEN_("Hash verification passed for EF_DG%i."), dg->dgnum);
+                    } else {
+                        PrintAndLogEx(ERR, _RED_("Hash verification failed for EF_DG%i."), dg->dgnum);
+                    }
                 }
                 free(data);
             }
diff --git a/client/src/cmdhfemrtd.h b/client/src/cmdhfemrtd.h
index 72f5f44b9..f7bd64945 100644
--- a/client/src/cmdhfemrtd.h
+++ b/client/src/cmdhfemrtd.h
@@ -27,6 +27,14 @@ typedef struct emrtd_dg_s {
     int (*dumper)(uint8_t *data, size_t datalen);
 } emrtd_dg_t;
 
+typedef struct emrtd_hashalg_s {
+    const char *name;
+    int (*hasher)(uint8_t *datain, int datainlen, uint8_t *dataout);
+    size_t hashlen;
+    size_t descriptorlen;
+    const uint8_t descriptor[15];
+} emrtd_hashalg_t;
+
 int CmdHFeMRTD(const char *Cmd);
 
 int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available);
diff --git a/client/src/crypto/libpcrypto.c b/client/src/crypto/libpcrypto.c
index cb73b3f5c..5c5455bf6 100644
--- a/client/src/crypto/libpcrypto.c
+++ b/client/src/crypto/libpcrypto.c
@@ -19,6 +19,7 @@
 #include <mbedtls/cmac.h>
 #include <mbedtls/pk.h>
 #include <mbedtls/ecdsa.h>
+#include <mbedtls/sha1.h>
 #include <mbedtls/sha256.h>
 #include <mbedtls/sha512.h>
 #include <mbedtls/ctr_drbg.h>
@@ -93,6 +94,15 @@ static int fixed_rand(void *rng_state, unsigned char *output, size_t len) {
     return 0;
 }
 
+int sha1hash(uint8_t *input, int length, uint8_t *hash) {
+    if (!hash || !input)
+        return 1;
+
+    mbedtls_sha1(input, length, hash);
+
+    return 0;
+}
+
 int sha256hash(uint8_t *input, int length, uint8_t *hash) {
     if (!hash || !input)
         return 1;
diff --git a/client/src/crypto/libpcrypto.h b/client/src/crypto/libpcrypto.h
index b4307f454..099fd4423 100644
--- a/client/src/crypto/libpcrypto.h
+++ b/client/src/crypto/libpcrypto.h
@@ -21,6 +21,7 @@ int aes_decode(uint8_t *iv, uint8_t *key, uint8_t *input, uint8_t *output, int l
 int aes_cmac(uint8_t *iv, uint8_t *key, uint8_t *input, uint8_t *mac, int length);
 int aes_cmac8(uint8_t *iv, uint8_t *key, uint8_t *input, uint8_t *mac, int length);
 
+int sha1hash(uint8_t *input, int length, uint8_t *hash);
 int sha256hash(uint8_t *input, int length, uint8_t *hash);
 int sha512hash(uint8_t *input, int length, uint8_t *hash);
 

From 6f316b8e29559d260f1f3be2ca8b3ce0dd5708f0 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Tue, 29 Dec 2020 16:38:02 +0100
Subject: [PATCH 226/682] detect serial port

---
 .vscode/setup.sh | 69 +++++++++++++++++++++++++++++++++++++++++++++---
 pm3              | 45 +++++++++++++++++--------------
 2 files changed, 90 insertions(+), 24 deletions(-)

diff --git a/.vscode/setup.sh b/.vscode/setup.sh
index b439f2cbd..ee8476d11 100644
--- a/.vscode/setup.sh
+++ b/.vscode/setup.sh
@@ -1,4 +1,65 @@
-export SerialPort="/dev/ttyACM0"
-export DebuggerPath="/usr/bin/gdb"
-export JLinkServerPath="/opt/SEGGER/JLink/JLinkGDBServerCLExe"
-export DeviceMem="512"
\ No newline at end of file
+#!/bin/bash
+###############################
+#            Linux            #
+#    Uncomment to override    #
+###############################
+#export SerialPort="/dev/ttyACM0"
+#export DebuggerPath="/usr/bin/gdb"
+#export JLinkServerPath="/opt/SEGGER/JLink/JLinkGDBServerCLExe"
+
+###############################
+#             WSL             #
+#    Uncomment to override    #
+###############################
+#export SerialPort="/dev/ttyS4"
+#export DebuggerPath="/usr/bin/gdb"
+#export JLinkServerPath="/mnt/c/Program Files (x86)/SEGGER/JLink/JLinkGDBServerCL.exe"
+
+###############################
+#          ProxSpace          #
+#    Uncomment to override    #
+###############################
+#export SerialPort="COM5"
+#export DebuggerPath="${workspaceFolder}/../../msys2/mingw64/bin/gdb.exe"
+#export JLinkServerPath="c/Program Files (x86)/SEGGER/JLink/JLinkGDBServerCL.exe"
+
+#Debugging on 256KB systems is not recommended
+#This option does not override PLATFORM_SIZE
+export DeviceMem="512"
+
+
+VSCODEPATH=$(dirname "$0")
+
+function get_serial_port {
+	if [ -z "$SerialPort" ]; then
+		pm3list=$($VSCODEPATH/../pm3 --list 2>/dev/null)
+		#Use first port listed 
+		SerialPort=$(echo $pm3list | head -n 1 | cut -c 4-)
+		if [ -z "$SerialPort" ]; then
+			echo >&2 "[!!] No serial port found, please set SerialPort manually"
+			exit 1
+		fi
+	fi
+	
+	echo "Using $SerialPort as port"
+}
+
+
+HOSTOS=$(uname | awk '{print toupper($0)}')
+if [ "$HOSTOS" = "LINUX" ]; then
+    if uname -a|grep -q Microsoft; then
+        echo "WSL"
+    else
+        echo "LINUX"
+    fi
+elif [ "$HOSTOS" = "DARWIN" ]; then
+	echo >&2 "[!!] MacOS not supported, sorry!"
+	exit 1
+elif [[ "$HOSTOS" =~ MINGW(32|64)_NT* ]]; then
+    echo "ProxSpace"
+else
+    echo >&2 "[!!] Host OS not recognized, abort: $HOSTOS"
+    exit 1
+fi
+
+get_serial_port
\ No newline at end of file
diff --git a/pm3 b/pm3
index 0d3b9863a..1ee2ebeb8 100755
--- a/pm3
+++ b/pm3
@@ -14,27 +14,32 @@ PM3PATH=$(dirname "$0")
 EVALENV=""
 FULLIMAGE="fullimage.elf"
 BOOTIMAGE="bootrom.elf"
-# try pm3 dirs in current repo workdir
-if [ -d "$PM3PATH/client/" ]; then
-    if [ -x "$PM3PATH/client/proxmark3" ]; then
-        CLIENT="$PM3PATH/client/proxmark3"
-    elif [ -x "$PM3PATH/client/build/proxmark3" ]; then
-        CLIENT="$PM3PATH/client/build/proxmark3"
-    else
-        echo >&2 "[!!] In devel workdir but no executable found, did you compile it?"
-        exit 1
-    fi
-    # Devel mode: point to workdir pm3.py module
-    EVALENV+=" PYTHONPATH=$PM3PATH/client/src"
-# try install dir
-elif [ -x "$PM3PATH/proxmark3" ]; then
-    CLIENT="$PM3PATH/proxmark3"
-    EVALENV+=" PYTHONPATH=$PM3PATH/../share/proxmark3/pyscripts/"
-    #  or /usr/[local/]lib/python3/dist-packages/pm3.py ?
-else
-# hope it's installed somehow, still not sure where fw images and pm3.py are...
-    CLIENT="proxmark3"
+
+#Skip check if --list is used
+if [ ! "$1" == "--list" ]; then
+	# try pm3 dirs in current repo workdir
+	if [ -d "$PM3PATH/client/" ]; then
+		if [ -x "$PM3PATH/client/proxmark3" ]; then
+			CLIENT="$PM3PATH/client/proxmark3"
+		elif [ -x "$PM3PATH/client/build/proxmark3" ]; then
+			CLIENT="$PM3PATH/client/build/proxmark3"
+		else
+			echo >&2 "[!!] In devel workdir but no executable found, did you compile it?"
+			exit 1
+		fi
+		# Devel mode: point to workdir pm3.py module
+		EVALENV+=" PYTHONPATH=$PM3PATH/client/src"
+	# try install dir
+	elif [ -x "$PM3PATH/proxmark3" ]; then
+		CLIENT="$PM3PATH/proxmark3"
+		EVALENV+=" PYTHONPATH=$PM3PATH/../share/proxmark3/pyscripts/"
+		#  or /usr/[local/]lib/python3/dist-packages/pm3.py ?
+	else
+	# hope it's installed somehow, still not sure where fw images and pm3.py are...
+		CLIENT="proxmark3"
+	fi   
 fi
+
 # LeakSanitizer suppressions
 if [ -e .lsan_suppressions ]; then
   EVALENV+=" LSAN_OPTIONS=suppressions=.lsan_suppressions"

From 71ac6369d8661bb8c9903638b94545ea11eba3b9 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 29 Dec 2020 18:42:29 +0300
Subject: [PATCH 227/682] emrtd: Account for hash algo quirks

---
 client/src/cmdhfemrtd.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index e563ac7fa..4ed1732b4 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -111,7 +111,7 @@ static emrtd_dg_t dg_table[] = {
 // https://tools.ietf.org/html/rfc3447#page-43
 static emrtd_hashalg_t hashalg_table[] = {
 //  name        hash func   len len descriptor
-    {"SHA-1",   sha1hash,   20,  9, {0x06, 0x05, 0x2B, 0x0E, 0x03, 0x02, 0x1A, 0x05, 0x00}},
+    {"SHA-1",   sha1hash,   20,  7, {0x06, 0x05, 0x2B, 0x0E, 0x03, 0x02, 0x1A}},
     {"SHA-256", sha256hash, 32, 11, {0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01}},
     {"SHA-512", sha512hash, 64, 11, {0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03}},
     {NULL,      NULL,       0,  0,  {}}
@@ -1551,6 +1551,12 @@ static int emrtd_parse_ef_sod_hash_algo(uint8_t *data, size_t datalen, int *hash
 
     PrintAndLogEx(DEBUG, "hash algo set: %s", sprint_hex_inrow(hashalgoset, hashalgosetlen));
 
+    // If last two bytes are 05 00, ignore them.
+    // https://wf.lavatech.top/ave-but-random/emrtd-data-quirks#EF_SOD
+    if (hashalgoset[hashalgosetlen - 2] == 0x05 && hashalgoset[hashalgosetlen - 1] == 0x00) {
+        hashalgosetlen -= 2;
+    }
+
     for (int hashi = 0; hashalg_table[hashi].name != NULL; hashi++) {
         PrintAndLogEx(DEBUG, "trying: %s", hashalg_table[hashi].name);
         // We're only interested in checking if the length matches to avoid memory shenanigans
@@ -1565,8 +1571,9 @@ static int emrtd_parse_ef_sod_hash_algo(uint8_t *data, size_t datalen, int *hash
         }
     }
 
-    // Return hash algo 0 if we can't find anything
+    // Return hash algo -1 if we can't find anything
     *hashalgo = -1;
+    PrintAndLogEx(ERR, "Failed to parse hash list (Unknown algo: %s). Hash verification won't be available.", sprint_hex_inrow(hashalgoset, hashalgosetlen));
     return PM3_ESOFT;
 }
 
@@ -1591,9 +1598,7 @@ static int emrtd_parse_ef_sod_hashes(uint8_t *data, size_t datalen, uint8_t *has
 
     PrintAndLogEx(DEBUG, "hash data: %s", sprint_hex_inrow(emrtdsig, emrtdsiglen));
 
-    if (emrtd_parse_ef_sod_hash_algo(emrtdsig, emrtdsiglen, hashalgo) != PM3_SUCCESS) {
-        PrintAndLogEx(ERR, "Failed to parse hash list (Unknown algo?). Hash verification won't be available.");
-    }
+    emrtd_parse_ef_sod_hash_algo(emrtdsig, emrtdsiglen, hashalgo);
 
     if (!emrtd_lds_get_data_by_tag(emrtdsig, emrtdsiglen, hashlist, &hashlistlen, 0x30, 0x00, false, true, 1)) {
         PrintAndLogEx(ERR, "Failed to read hash list from EF_SOD.");

From d1ec96ed41a55e80fac58a75cbbb54cca66ac4f6 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 29 Dec 2020 19:13:10 +0300
Subject: [PATCH 228/682] emrtd: Ensure that emrtd_parse_ef_sod_hash_algo
 returns -1 on errors too

---
 client/src/cmdhfemrtd.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 4ed1732b4..6b966cfad 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1544,6 +1544,9 @@ static int emrtd_parse_ef_sod_hash_algo(uint8_t *data, size_t datalen, int *hash
     uint8_t hashalgoset[64] = { 0x00 };
     size_t hashalgosetlen = 0;
 
+    // We'll return hash algo -1 if we can't find anything
+    *hashalgo = -1;
+
     if (!emrtd_lds_get_data_by_tag(data, datalen, hashalgoset, &hashalgosetlen, 0x30, 0x00, false, true, 0)) {
         PrintAndLogEx(ERR, "Failed to read hash algo set from EF_SOD.");
         return false;
@@ -1571,8 +1574,6 @@ static int emrtd_parse_ef_sod_hash_algo(uint8_t *data, size_t datalen, int *hash
         }
     }
 
-    // Return hash algo -1 if we can't find anything
-    *hashalgo = -1;
     PrintAndLogEx(ERR, "Failed to parse hash list (Unknown algo: %s). Hash verification won't be available.", sprint_hex_inrow(hashalgoset, hashalgosetlen));
     return PM3_ESOFT;
 }

From 5f5e8758ab44d9a20bf2d42bcb6233ba24f501f0 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Tue, 29 Dec 2020 17:22:09 +0100
Subject: [PATCH 229/682] Setup for WSL/Linux done

---
 .gitignore                                |  5 +-
 .vscode/setup.sh                          | 81 ++++++++++++++++++++---
 .vscode/{ => templates}/launch_linux.json |  0
 .vscode/{ => templates}/launch_ps.json    |  0
 .vscode/{ => templates}/launch_wsl.json   |  0
 .vscode/{ => templates}/tasks_linux.json  |  0
 .vscode/{ => templates}/tasks_ps.json     |  0
 .vscode/{ => templates}/tasks_wsl.json    |  0
 8 files changed, 75 insertions(+), 11 deletions(-)
 rename .vscode/{ => templates}/launch_linux.json (100%)
 rename .vscode/{ => templates}/launch_ps.json (100%)
 rename .vscode/{ => templates}/launch_wsl.json (100%)
 rename .vscode/{ => templates}/tasks_linux.json (100%)
 rename .vscode/{ => templates}/tasks_ps.json (100%)
 rename .vscode/{ => templates}/tasks_wsl.json (100%)

diff --git a/.gitignore b/.gitignore
index 1b27c52a3..125dc536e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -110,6 +110,5 @@ fpga_version_info.c
 *.tmp
 
 #VSCode files
-!.vscode/*.json
-.vscode/launch.json
-.vscode/tasks.json
\ No newline at end of file
+!.vscode/templates/*.json
+!.vscode/extensions.json
\ No newline at end of file
diff --git a/.vscode/setup.sh b/.vscode/setup.sh
index ee8476d11..93f7144f2 100644
--- a/.vscode/setup.sh
+++ b/.vscode/setup.sh
@@ -30,7 +30,7 @@ export DeviceMem="512"
 
 VSCODEPATH=$(dirname "$0")
 
-function get_serial_port {
+function setup_serial_port {
 	if [ -z "$SerialPort" ]; then
 		pm3list=$($VSCODEPATH/../pm3 --list 2>/dev/null)
 		#Use first port listed 
@@ -40,26 +40,91 @@ function get_serial_port {
 			exit 1
 		fi
 	fi
-	
 	echo "Using $SerialPort as port"
 }
 
+function setup_gdb_linux {
+	if [ -z "$DebuggerPath" ]; then
+		export DebuggerPath="/usr/bin/gdb"
+	fi
+	if [ ! -x "$DebuggerPath" ]; then
+		echo >&2 "[!!] gdb not found, please set DebuggerPath manually"
+		exit 1
+	fi
+}
+
+function setup_jlink_linux {
+	if [ -z "$JLinkServerPath" ]; then
+		export JLinkServerPath="/opt/SEGGER/JLink/JLinkGDBServerCLExe"
+	fi
+	if [ ! -x "$JLinkServerPath" ]; then
+		echo >&2 "[!!] JLinkGDBServerCLExe not found, please set JLinkServerPath manually"
+		exit 1
+	fi
+	
+}
+
+function setup_jlink_wsl {
+	if [ -z "$JLinkServerPath" ]; then
+		export JLinkServerPath="/mnt/c/Program Files (x86)/SEGGER/JLink/JLinkGDBServerCL.exe"
+	fi
+	if [ ! -x "$JLinkServerPath" ]; then
+		echo >&2 "[!!] JLinkGDBServerCLExe not found, please set JLinkServerPath manually"
+		exit 1
+	fi
+}
+
+function setup_wsl {
+	setup_serial_port
+	setup_gdb_linux
+	setup_jlink_wsl
+	cp "$VSCODEPATH/templates/tasks_wsl.json" "$VSCODEPATH/tasks.json"
+	envsubst <"$VSCODEPATH/templates/launch_wsl.json" > "$VSCODEPATH/launch.json"
+}
+
+function setup_linux {
+	setup_serial_port
+	setup_gdb_linux
+	setup_jlink_linux
+	cp "$VSCODEPATH/templates/tasks_linux.json" "$VSCODEPATH/tasks.json"
+	envsubst <"$VSCODEPATH/templates/launch_linux.json" > "$VSCODEPATH/launch.json"
+}
+
+function setup_ps {
+	setup_serial_port
+	if [ -z "$JLinkServerPath" ]; then
+		export JLinkServerPath="c/Program Files (x86)/SEGGER/JLink/JLinkGDBServerCL.exe"
+	fi
+}
+
+if [ -f "$VSCODEPATH/launch.json" ] || [ -f "$VSCODEPATH/tasks.json"  ]; then
+	read -p "Existing configuration found, do you want to override it? " -n 1 -r
+	if [[ $REPLY =~ ^[Yy]$ ]]
+	then
+		rm "$VSCODEPATH/launch.json.bak" 2> /dev/null
+		rm "$VSCODEPATH/tasks.json.bak" 2> /dev/null
+		mv "$VSCODEPATH/launch.json" "$VSCODEPATH/launch.json.bak" 2> /dev/null
+		mv "$VSCODEPATH/tasks.json" "$VSCODEPATH/tasks.json.bak" 2> /dev/null
+	else
+		echo >&2 "[!!] user abort"
+		exit 1
+	fi
+
+fi
 
 HOSTOS=$(uname | awk '{print toupper($0)}')
 if [ "$HOSTOS" = "LINUX" ]; then
     if uname -a|grep -q Microsoft; then
-        echo "WSL"
+		setup_wsl
     else
-        echo "LINUX"
+		setup_linux
     fi
 elif [ "$HOSTOS" = "DARWIN" ]; then
 	echo >&2 "[!!] MacOS not supported, sorry!"
 	exit 1
 elif [[ "$HOSTOS" =~ MINGW(32|64)_NT* ]]; then
-    echo "ProxSpace"
+	setup_ps
 else
     echo >&2 "[!!] Host OS not recognized, abort: $HOSTOS"
     exit 1
-fi
-
-get_serial_port
\ No newline at end of file
+fi
\ No newline at end of file
diff --git a/.vscode/launch_linux.json b/.vscode/templates/launch_linux.json
similarity index 100%
rename from .vscode/launch_linux.json
rename to .vscode/templates/launch_linux.json
diff --git a/.vscode/launch_ps.json b/.vscode/templates/launch_ps.json
similarity index 100%
rename from .vscode/launch_ps.json
rename to .vscode/templates/launch_ps.json
diff --git a/.vscode/launch_wsl.json b/.vscode/templates/launch_wsl.json
similarity index 100%
rename from .vscode/launch_wsl.json
rename to .vscode/templates/launch_wsl.json
diff --git a/.vscode/tasks_linux.json b/.vscode/templates/tasks_linux.json
similarity index 100%
rename from .vscode/tasks_linux.json
rename to .vscode/templates/tasks_linux.json
diff --git a/.vscode/tasks_ps.json b/.vscode/templates/tasks_ps.json
similarity index 100%
rename from .vscode/tasks_ps.json
rename to .vscode/templates/tasks_ps.json
diff --git a/.vscode/tasks_wsl.json b/.vscode/templates/tasks_wsl.json
similarity index 100%
rename from .vscode/tasks_wsl.json
rename to .vscode/templates/tasks_wsl.json

From a14b5f7b5fbde1aec5c5359ded808fd056d5c38a Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 29 Dec 2020 19:24:44 +0300
Subject: [PATCH 230/682] emrtd: Employ a workaround for data length of 0x80

This is to make US passport hashes read properly.
https://wf.lavatech.top/ave-but-random/emrtd-data-quirks#EF_SOD
---
 client/src/cmdhfemrtd.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 6b966cfad..fa9c936e9 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -217,6 +217,11 @@ static int emrtd_get_asn1_data_length(uint8_t *datain, int datainlen, int offset
     PrintAndLogEx(DEBUG, "asn1 datalength, lenfield: %02X", lenfield);
     if (lenfield <= 0x7f) {
         return lenfield;
+    } else if (lenfield == 0x80) {
+        // TODO: 0x80 means indeterminate.
+        // Giving rest of the file is a workaround, nothing more, nothing less.
+        // More at https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/
+        return datainlen;
     } else if (lenfield == 0x81) {
         return ((int) * (datain + offset + 1));
     } else if (lenfield == 0x82) {
@@ -231,7 +236,7 @@ static int emrtd_get_asn1_field_length(uint8_t *datain, int datainlen, int offse
     PrintAndLogEx(DEBUG, "asn1 fieldlength, datain: %s", sprint_hex_inrow(datain, datainlen));
     int lenfield = (int) * (datain + offset);
     PrintAndLogEx(DEBUG, "asn1 fieldlength, lenfield: %02X", lenfield);
-    if (lenfield <= 0x7F) {
+    if (lenfield <= 0x80) {
         return 1;
     } else if (lenfield == 0x81) {
         return 2;

From f3f47a66e965276f3df44ae4d18c41d7ef27225e Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 29 Dec 2020 17:25:48 +0100
Subject: [PATCH 231/682] hf mfu info - now supports cliparser,  fixed magic
 detection output, fixed ntag counter output

---
 client/src/cmdhfmfu.c | 303 ++++++++++++++++++++++++++----------------
 client/src/cmdhfmfu.h |   3 +
 2 files changed, 188 insertions(+), 118 deletions(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index c69de053b..639429fba 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -13,6 +13,7 @@
 #include "commonutil.h"
 #include "crypto/libpcrypto.h"
 #include "des.h"
+#include "aes.h"
 #include "cmdhfmf.h"
 #include "cmdhf14a.h"
 #include "comms.h"
@@ -23,7 +24,6 @@
 #include "cliparser.h"
 #include "cmdmain.h"
 
-
 #define MAX_UL_BLOCKS       0x0F
 #define MAX_ULC_BLOCKS      0x2F
 #define MAX_ULEV1a_BLOCKS   0x13
@@ -42,26 +42,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_hf_mfu_info(void) {
-    PrintAndLogEx(NORMAL, "It gathers information about the tag and tries to detect what kind it is.");
-    PrintAndLogEx(NORMAL, "Sometimes the tags are locked down, and you may need a key to be able to read the information");
-    PrintAndLogEx(NORMAL, "The following tags can be identified:\n");
-    PrintAndLogEx(NORMAL, "Ultralight, Ultralight-C, Ultralight EV1, NTAG 203, NTAG 210,");
-    PrintAndLogEx(NORMAL, "NTAG 212, NTAG 213, NTAG 215, NTAG 216, NTAG I2C 1K & 2K");
-    PrintAndLogEx(NORMAL, "my-d, my-d NFC, my-d move, my-d move NFC\n");
-    PrintAndLogEx(NORMAL, "Usage:  hf mfu info k <key> l");
-    PrintAndLogEx(NORMAL, "  Options : ");
-    PrintAndLogEx(NORMAL, "  k <key> : (optional) key for authentication [UL-C 16bytes, EV1/NTAG 4bytes]");
-    PrintAndLogEx(NORMAL, "  l       : (optional) swap entered key's endianness");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu info"));
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu info k 00112233445566778899AABBCCDDEEFF"));
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu info k AABBCCDD"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
-
 static int usage_hf_mfu_dump(void) {
     PrintAndLogEx(NORMAL, "Reads all pages from Ultralight, Ultralight-C, Ultralight EV1");
     PrintAndLogEx(NORMAL, "NTAG 203, NTAG 210, NTAG 212, NTAG 213, NTAG 215, NTAG 216");
@@ -684,62 +664,80 @@ int ul_print_type(uint32_t tagtype, uint8_t spaces) {
 
     if (spaces > 10)
         spaces = 10;
+
+    char typestr[100];
+    memset(typestr, 0x00, sizeof(typestr));
+
     if (tagtype & UL)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("MIFARE Ultralight (MF0ICU1) %s"), spaces, "", (tagtype & MAGIC) ? "<magic>" : "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("MIFARE Ultralight (MF0ICU1)s"), spaces, "");
     else if (tagtype & UL_C)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("MIFARE Ultralight C (MF0ULC) %s"), spaces, "", (tagtype & MAGIC) ? "<magic>" : "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("MIFARE Ultralight C (MF0ULC)"), spaces, "");
     else if (tagtype & UL_NANO_40)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("MIFARE Ultralight Nano 40bytes (MF0UNH00)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("MIFARE Ultralight Nano 40bytes (MF0UNH00)"), spaces, "");
     else if (tagtype & UL_EV1_48)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("MIFARE Ultralight EV1 48bytes (MF0UL1101)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("MIFARE Ultralight EV1 48bytes (MF0UL1101)"), spaces, "");
     else if (tagtype & UL_EV1_128)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("MIFARE Ultralight EV1 128bytes (MF0UL2101)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("MIFARE Ultralight EV1 128bytes (MF0UL2101)"), spaces, "");
     else if (tagtype & UL_EV1)
-        PrintAndLogEx(NORMAL, "%*sTYPE: " _YELLOW_("MIFARE Ultralight EV1 UNKNOWN"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("MIFARE Ultralight EV1 UNKNOWN"), spaces, "");
     else if (tagtype & NTAG)
-        PrintAndLogEx(NORMAL, "%*sTYPE: " _YELLOW_("NTAG UNKNOWN"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("NTAG UNKNOWN"), spaces, "");
     else if (tagtype & NTAG_203)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("NTAG 203 144bytes (NT2H0301F0DT)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("NTAG 203 144bytes (NT2H0301F0DT)"), spaces, "");
     else if (tagtype & NTAG_210)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("NTAG 210 48bytes (NT2L1011G0DU)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("NTAG 210 48bytes (NT2L1011G0DU)"), spaces, "");
     else if (tagtype & NTAG_212)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("NTAG 212 128bytes (NT2L1211G0DU)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("NTAG 212 128bytes (NT2L1211G0DU)"), spaces, "");
     else if (tagtype & NTAG_213)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("NTAG 213 144bytes (NT2H1311G0DU)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("NTAG 213 144bytes (NT2H1311G0DU)"), spaces, "");
     else if (tagtype & NTAG_213_F)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("NTAG 213F 144bytes (NT2H1311F0DTL)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("NTAG 213F 144bytes (NT2H1311F0DTL)"), spaces, "");
     else if (tagtype & NTAG_213_C)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("NTAG 213C 144bytes (NT2H1311C1DTL)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("NTAG 213C 144bytes (NT2H1311C1DTL)"), spaces, "");
     else if (tagtype & NTAG_213_TT)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("NTAG 213TT 144bytes (NT2H1311TTDU)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("NTAG 213TT 144bytes (NT2H1311TTDU)"), spaces, "");
     else if (tagtype & NTAG_215)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("NTAG 215 504bytes (NT2H1511G0DU)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("NTAG 215 504bytes (NT2H1511G0DU)"), spaces, "");
     else if (tagtype & NTAG_216)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("NTAG 216 888bytes (NT2H1611G0DU)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("NTAG 216 888bytes (NT2H1611G0DU)"), spaces, "");
     else if (tagtype & NTAG_216_F)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("NTAG 216F 888bytes (NT2H1611F0DTL)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("NTAG 216F 888bytes (NT2H1611F0DTL)"), spaces, "");
     else if (tagtype & NTAG_I2C_1K)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("NTAG I2C 888bytes (NT3H1101FHK)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("NTAG I2C 888bytes (NT3H1101FHK)"), spaces, "");
     else if (tagtype & NTAG_I2C_2K)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("NTAG I2C 1904bytes (NT3H1201FHK)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("NTAG I2C 1904bytes (NT3H1201FHK)"), spaces, "");
     else if (tagtype & NTAG_I2C_1K_PLUS)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("NTAG I2C plus 888bytes (NT3H2111FHK)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("NTAG I2C plus 888bytes (NT3H2111FHK)"), spaces, "");
     else if (tagtype & NTAG_I2C_2K_PLUS)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("NTAG I2C plus 1912bytes (NT3H2211FHK)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("NTAG I2C plus 1912bytes (NT3H2211FHK)"), spaces, "");
     else if (tagtype & MY_D)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("INFINEON my-d\x99 (SLE 66RxxS)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("INFINEON my-d\x99 (SLE 66RxxS)"), spaces, "");
     else if (tagtype & MY_D_NFC)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("INFINEON my-d\x99 NFC (SLE 66RxxP)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("INFINEON my-d\x99 NFC (SLE 66RxxP)"), spaces, "");
     else if (tagtype & MY_D_MOVE)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("INFINEON my-d\x99 move (SLE 66R01P)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("INFINEON my-d\x99 move (SLE 66R01P)"), spaces, "");
     else if (tagtype & MY_D_MOVE_NFC)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("INFINEON my-d\x99 move NFC (SLE 66R01P)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("INFINEON my-d\x99 move NFC (SLE 66R01P)"), spaces, "");
     else if (tagtype & MY_D_MOVE_LEAN)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("INFINEON my-d\x99 move lean (SLE 66R01L)"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("INFINEON my-d\x99 move lean (SLE 66R01L)"), spaces, "");
     else if (tagtype & FUDAN_UL)
-        PrintAndLogEx(SUCCESS, "%*sTYPE: " _YELLOW_("FUDAN Ultralight Compatible (or other compatible) %s"), spaces, "", (tagtype & MAGIC) ? "<magic>" : "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("FUDAN Ultralight Compatible (or other compatible)"), spaces, "");
     else
-        PrintAndLogEx(NORMAL, "%*sTYPE: " _YELLOW_("Unknown %06x"), spaces, "", tagtype);
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("Unknown %06x"), spaces, "", tagtype);
+
+    bool ismagic = ((tagtype & MAGIC) == MAGIC);
+    if (ismagic)
+        snprintf(typestr + strlen(typestr), 4, " (");
+
+    snprintf(typestr + strlen(typestr) , sizeof(typestr) - strlen(typestr), " %s ", (tagtype & MAGIC) ?  _GREEN_("magic") : "");
+    tagtype ^= MAGIC;
+    snprintf(typestr + strlen(typestr) , sizeof(typestr) - strlen(typestr), "%s", (tagtype & MAGIC_1A) ? _GREEN_("Gen 1a") : "");
+    snprintf(typestr + strlen(typestr) , sizeof(typestr) - strlen(typestr), "%s", (tagtype & MAGIC_1B) ? _GREEN_("Gen 1b") : "");
+
+    if (ismagic)
+        snprintf(typestr + strlen(typestr), 4, " )");
+
+    PrintAndLogEx(SUCCESS, "%s", typestr);
     return PM3_SUCCESS;
 }
 
@@ -895,7 +893,10 @@ static int ulev1_print_counters(void) {
         len = ulev1_readCounter(i, counter, sizeof(counter));
         if (len == 3) {
             PrintAndLogEx(INFO, "       [%0d]: %s", i, sprint_hex(counter, 3));
-            PrintAndLogEx(SUCCESS, "            - %02X tearing (%s)", tear[0], (tear[0] == 0xBD) ? _GREEN_("ok") : _RED_("failure"));
+            PrintAndLogEx(SUCCESS, "            - %02X tearing (%s)"
+                    , tear[0]
+                    , (tear[0] == 0xBD) ? _GREEN_("ok") : _RED_("fail")
+                    );
         }
     }
     return len;
@@ -983,7 +984,7 @@ static int ulev1_print_signature(TagTypeUL_t tagtype, uint8_t *uid, uint8_t *sig
     if (is_valid == false || i == ARRAYLEN(nxp_mfu_public_keys)) {
         PrintAndLogEx(INFO, "    Elliptic curve parameters: NID_secp128r1");
         PrintAndLogEx(INFO, "             TAG IC Signature: %s", sprint_hex_inrow(signature, signature_len));
-        PrintAndLogEx(SUCCESS, "       Signature verification: " _RED_("failed"));
+        PrintAndLogEx(SUCCESS, "       Signature verification (" _RED_("fail") ")");
         return PM3_ESOFT;
     }
 
@@ -991,7 +992,7 @@ static int ulev1_print_signature(TagTypeUL_t tagtype, uint8_t *uid, uint8_t *sig
     PrintAndLogEx(INFO, "IC signature public key value: %s", nxp_mfu_public_keys[i].value);
     PrintAndLogEx(INFO, "    Elliptic curve parameters: NID_secp128r1");
     PrintAndLogEx(INFO, "             TAG IC Signature: %s", sprint_hex_inrow(signature, signature_len));
-    PrintAndLogEx(SUCCESS, "       Signature verification: " _GREEN_("successful"));
+    PrintAndLogEx(SUCCESS, "       Signature verification (" _GREEN_("successful") ")" );
     return PM3_SUCCESS;
 }
 
@@ -1021,7 +1022,10 @@ static int ntag_print_counter(void) {
     len = ulev1_readCounter(0x02, counter, sizeof(counter));
     (void)len;
     PrintAndLogEx(INFO, "       [02]: %s", sprint_hex(counter, 3));
-    PrintAndLogEx(SUCCESS, "            - %02X tearing (" _GREEN_("%s")")", tear[0], (tear[0] == 0xBD) ? "ok" : "failure");
+    PrintAndLogEx(SUCCESS, "            - %02X tearing (%s)"
+                    , tear[0]
+                    , (tear[0] == 0xBD) ? _GREEN_("ok") : _RED_("fail")
+                    );
     return len;
 }
 
@@ -1057,12 +1061,34 @@ static int ul_magic_test(void) {
     // 2) make a wrong length write to page0, and see if tag answers with ACK/NACK:
 
     iso14a_card_select_t card;
-    if (!ul_select(&card))
+    if (ul_select(&card) == false)
         return UL_ERROR;
+
     int status = ul_comp_write(0, NULL, 0);
     DropField();
     if (status == 0)
         return MAGIC;
+
+    // check for GEN1A, GEN1B and NTAG21x
+    uint8_t is_generation = 0;
+    PacketResponseNG resp;
+    clearCommandBuffer();
+    uint8_t payload[] = { 0 };
+    SendCommandNG(CMD_HF_MIFARE_CIDENT, payload, sizeof(payload));
+    if (WaitForResponseTimeout(CMD_HF_MIFARE_CIDENT, &resp, 1500)) {
+        if (resp.status == PM3_SUCCESS)
+            is_generation = resp.data.asBytes[0];
+    }
+    switch (is_generation) {
+        case MAGIC_GEN_1A:
+            return MAGIC_1A;
+        case MAGIC_GEN_1B:
+            return MAGIC_1B;
+        case MAGIC_NTAG21X:
+            return MAGIC_NTAG;
+        default:
+            break;
+    }
     return 0;
 }
 
@@ -1071,7 +1097,8 @@ uint32_t GetHF14AMfU_Type(void) {
     TagTypeUL_t tagtype = UNKNOWN;
     iso14a_card_select_t card;
 
-    if (!ul_select(&card)) return UL_ERROR;
+    if (ul_select(&card) == false)
+        return UL_ERROR;
 
     // Ultralight - ATQA / SAK
     if (card.atqa[1] != 0x00 || card.atqa[0] != 0x44 || card.sak != 0x00) {
@@ -1177,7 +1204,8 @@ uint32_t GetHF14AMfU_Type(void) {
                 tagtype = UL_C;
             } else {
                 // need to re-select after authentication error
-                if (!ul_select(&card)) return UL_ERROR;
+                if (ul_select(&card) == false)
+                    return UL_ERROR;
 
                 uint8_t data[16] = {0x00};
                 // read page 0x26-0x29 (last valid ntag203 page)
@@ -1222,7 +1250,9 @@ uint32_t GetHF14AMfU_Type(void) {
     }
 
     tagtype |= ul_magic_test();
-    if (tagtype == (UNKNOWN | MAGIC)) tagtype = (UL_MAGIC);
+    if (tagtype == (UNKNOWN | MAGIC)) {
+        tagtype = (UL_MAGIC);
+    }
     return tagtype;
 }
 //
@@ -1230,56 +1260,53 @@ uint32_t GetHF14AMfU_Type(void) {
 //
 static int CmdHF14AMfUInfo(const char *Cmd) {
 
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mfu info",
+                  "Get info about MIFARE Ultralight Family styled tag.\n"
+                  "Sometimes the tags are locked down, and you may need a key to be able to read the information",
+                  "hf mfu info\n"
+                  "hf mfu info k AABBCCDD\n"
+                  "hf mfu info k 00112233445566778899AABBCCDDEEFF"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("k", "key", "<hex>", "key for authentication (UL-C 16 bytes, EV1/NTAG 4 bytes)"),
+        arg_lit0("l", NULL,           "swap entered key's endianness"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    int ak_len = 0;
+    uint8_t authenticationkey[16] = {0x00};
+    CLIGetHexWithReturn(ctx, 1, authenticationkey, &ak_len);
+    bool swap_endian = arg_get_lit(ctx, 2);
+    CLIParserFree(ctx);
+
+    if (ak_len) {
+        if (ak_len != 16 || ak_len != 8) {
+            PrintAndLogEx(WARNING, "ERROR: Key is incorrect length\n");
+            return PM3_EINVARG;
+        }
+    }
+
+    bool has_auth_key = false;
+    if (ak_len > 0)
+        has_auth_key = true;
+
     uint8_t authlim = 0xff;
     uint8_t data[16] = {0x00};
     iso14a_card_select_t card;
     int status;
-    bool errors = false;
-    bool hasAuthKey = false;
-    bool locked = false;
-    bool swapEndian = false;
-    uint8_t cmdp = 0;
-    uint8_t dataLen = 0;
-    uint8_t authenticationkey[16] = {0x00};
     uint8_t *authkeyptr = authenticationkey;
     uint8_t pwd[4] = {0, 0, 0, 0};
     uint8_t *key = pwd;
     uint8_t pack[4] = {0, 0, 0, 0};
     int len;
 
-    char tempStr[50];
-
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_hf_mfu_info();
-            case 'k':
-                dataLen = param_getstr(Cmd, cmdp + 1, tempStr, sizeof(tempStr));
-                if (dataLen == 32 || dataLen == 8) { //ul-c or ev1/ntag key length
-                    errors = param_gethex(tempStr, 0, authenticationkey, dataLen);
-                    dataLen /= 2; // handled as bytes from now on
-                } else {
-                    PrintAndLogEx(WARNING, "ERROR: Key is incorrect length\n");
-                    errors = true;
-                }
-                cmdp += 2;
-                hasAuthKey = true;
-                break;
-            case 'l':
-                swapEndian = true;
-                cmdp++;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter: " _RED_("'%c'"), param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-    //Validations
-    if (errors) return usage_hf_mfu_info();
-
     TagTypeUL_t tagtype = GetHF14AMfU_Type();
-    if (tagtype == UL_ERROR) return PM3_ESOFT;
+    if (tagtype == UL_ERROR)
+        return PM3_ESOFT;
 
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "--- " _CYAN_("Tag Information") " --------------------------");
@@ -1287,10 +1314,15 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
     ul_print_type(tagtype, 6);
 
     // Swap endianness
-    if (swapEndian && hasAuthKey) authkeyptr = SwapEndian64(authenticationkey, dataLen, (dataLen == 16) ? 8 : 4);
+    if (swap_endian && has_auth_key) {
+        authkeyptr = SwapEndian64(authenticationkey, ak_len, (ak_len == 16) ? 8 : 4);
+    }
 
-    if (ul_auth_select(&card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) return PM3_ESOFT;
+    if (ul_auth_select(&card, tagtype, has_auth_key, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) {
+        return PM3_ESOFT;
+    }
 
+    bool locked = false;
     // read pages 0,1,2,3 (should read 4pages)
     status = ul_read(0, data, sizeof(data));
     if (status == -1) {
@@ -1329,12 +1361,16 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
                 PrintAndLogEx(ERR, "Error: tag didn't answer to READ magic");
                 return PM3_ESOFT;
             }
-            if (status == 16) ulc_print_3deskey(ulc_deskey);
+            if (status == 16) {
+                ulc_print_3deskey(ulc_deskey);
+            }
 
         } else {
             DropField();
             // if we called info with key, just return
-            if (hasAuthKey) return PM3_SUCCESS;
+            if (has_auth_key) {
+                return PM3_SUCCESS;
+            }
 
             // also try to diversify default keys..  look into CmdHF14AMfGenDiverseKeys
             if (try_default_3des_keys(&key)) {
@@ -1353,7 +1389,9 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
     if ((tagtype & (UL_EV1_48 | UL_EV1_128 | UL_EV1))) {
         if (ulev1_print_counters() != 3) {
             // failed - re-select
-            if (ul_auth_select(&card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) return PM3_ESOFT;
+            if (ul_auth_select(&card, tagtype, has_auth_key, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) {
+                return PM3_ESOFT;
+            }
         }
     }
 
@@ -1361,7 +1399,9 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
     if ((tagtype & (NTAG_213 | NTAG_213_F | NTAG_213_C | NTAG_213_TT | NTAG_215 | NTAG_216))) {
         if (ntag_print_counter()) {
             // failed - re-select
-            if (ul_auth_select(&card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) return PM3_ESOFT;
+            if (ul_auth_select(&card, tagtype, has_auth_key, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) {
+                return PM3_ESOFT;
+            }
         }
     }
 
@@ -1378,7 +1418,9 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
             ulev1_print_signature(tagtype, card.uid, ulev1_signature, sizeof(ulev1_signature));
         } else {
             // re-select
-            if (ul_auth_select(&card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) return PM3_ESOFT;
+            if (ul_auth_select(&card, tagtype, has_auth_key, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) {
+                return PM3_ESOFT;
+            }
         }
 
         // Get Version
@@ -1392,7 +1434,9 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
             ulev1_print_version(version);
         } else {
             locked = true;
-            if (ul_auth_select(&card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) return PM3_ESOFT;
+            if (ul_auth_select(&card, tagtype, has_auth_key, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) {
+                return PM3_ESOFT;
+            }
         }
 
         uint8_t startconfigblock = 0;
@@ -1416,7 +1460,7 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
                 // save AUTHENTICATION LIMITS for later:
                 authlim = (ulev1_conf[4] & 0x07);
                 // add pwd / pack if used from cli
-                if (hasAuthKey) {
+                if (has_auth_key) {
                     memcpy(ulev1_conf + 8, authkeyptr, 4);
                     memcpy(ulev1_conf + 12, pack, 2);
                 }
@@ -1428,57 +1472,67 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
         // 0 = limitless.
         // 1-7 = limit. No automatic tries then.
         // hasAuthKey,  if we was called with key, skip test.
-        if (!authlim && !hasAuthKey) {
+        if (!authlim && !has_auth_key) {
             PrintAndLogEx(NORMAL, "");
             PrintAndLogEx(SUCCESS, "--- " _CYAN_("Known EV1/NTAG passwords"));
             // test pwd gen A
             num_to_bytes(ul_ev1_pwdgenA(card.uid), 4, key);
             len = ulev1_requestAuthentication(key, pack, sizeof(pack));
             if (len > -1) {
-                PrintAndLogEx(SUCCESS, "Found a default password: " _GREEN_("%s") "|| Pack: %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
+                PrintAndLogEx(SUCCESS, "Found a default password: " _GREEN_("%s") " Pack: %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
                 goto out;
             }
 
-            if (ul_auth_select(&card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) return PM3_ESOFT;
+            if (ul_auth_select(&card, tagtype, has_auth_key, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) {
+                return PM3_ESOFT;
+            }
 
             // test pwd gen B
             num_to_bytes(ul_ev1_pwdgenB(card.uid), 4, key);
             len = ulev1_requestAuthentication(key, pack, sizeof(pack));
             if (len > -1) {
-                PrintAndLogEx(SUCCESS, "Found a default password: " _GREEN_("%s") " || Pack: %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
+                PrintAndLogEx(SUCCESS, "Found a default password: " _GREEN_("%s") " Pack: %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
                 goto out;
             }
 
-            if (ul_auth_select(&card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) return PM3_ESOFT;
+            if (ul_auth_select(&card, tagtype, has_auth_key, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) {
+                return PM3_ESOFT;
+            }
 
             // test pwd gen C
             num_to_bytes(ul_ev1_pwdgenC(card.uid), 4, key);
             len = ulev1_requestAuthentication(key, pack, sizeof(pack));
             if (len > -1) {
-                PrintAndLogEx(SUCCESS, "Found a default password: " _GREEN_("%s") " || Pack: %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
+                PrintAndLogEx(SUCCESS, "Found a default password: " _GREEN_("%s") " Pack: %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
                 goto out;
             }
 
-            if (ul_auth_select(&card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) return PM3_ESOFT;
+            if (ul_auth_select(&card, tagtype, has_auth_key, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) {
+                return PM3_ESOFT;
+            }
 
             // test pwd gen D
             num_to_bytes(ul_ev1_pwdgenD(card.uid), 4, key);
             len = ulev1_requestAuthentication(key, pack, sizeof(pack));
             if (len > -1) {
-                PrintAndLogEx(SUCCESS, "Found a default password:" _GREEN_("%s") " || Pack: %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
+                PrintAndLogEx(SUCCESS, "Found a default password:" _GREEN_("%s") " Pack: %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
                 goto out;
             }
 
-            if (ul_auth_select(&card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) return PM3_ESOFT;
+            if (ul_auth_select(&card, tagtype, has_auth_key, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) {
+                return PM3_ESOFT;
+            }
 
             for (uint8_t i = 0; i < ARRAYLEN(default_pwd_pack); ++i) {
                 key = default_pwd_pack[i];
                 len = ulev1_requestAuthentication(key, pack, sizeof(pack));
                 if (len > -1) {
-                    PrintAndLogEx(SUCCESS, "Found a default password: " _GREEN_("%s") " || Pack: %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
+                    PrintAndLogEx(SUCCESS, "Found a default password: " _GREEN_("%s") " Pack: %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
                     break;
                 } else {
-                    if (ul_auth_select(&card, tagtype, hasAuthKey, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) return PM3_ESOFT;
+                    if (ul_auth_select(&card, tagtype, has_auth_key, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) {
+                        return PM3_ESOFT;
+                    }
                 }
             }
             if (len < 1) {
@@ -1492,7 +1546,7 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
 out:
     DropField();
     if (locked) {
-        PrintAndLogEx(INFO, "\nTag appears to be locked, try using the key to get more info");
+        PrintAndLogEx(INFO, "\nTag appears to be locked, try using a key to get more info");
         PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mfu pwdgen r`") " to get see known pwd gen algo suggestions");
     }
     PrintAndLogEx(NORMAL, "");
@@ -2709,7 +2763,6 @@ static int CmdHF14AMfUGenDiverseKeys(const char *Cmd) {
     uint8_t dkeyB[8] = { 0x00 };
 
     uint8_t masterkey[] = { 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff };
-
     uint8_t mix[8] = { 0x00 };
     uint8_t divkey[8] = { 0x00 };
 
@@ -2774,6 +2827,20 @@ static int CmdHF14AMfUGenDiverseKeys(const char *Cmd) {
     PrintAndLogEx(SUCCESS, "Mifare Pwd   :\t %s", sprint_hex(newpwd, sizeof(newpwd)));
 
     mbedtls_des3_free(&ctx);
+
+    mbedtls_aes_context ctx_aes;
+    uint8_t aes_iv[16] = { 0x00 };
+    uint8_t aes_masterkey[] = { 0x00, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F };
+    uint8_t aes_input[16] = {0x01, 0x04, 0x2A, 0x2E, 0x19, 0x70, 0x1C, 0x80, 0x01, 0x04, 0x2A, 0x2E, 0x19, 0x70, 0x1C, 0x80};
+    uint8_t aes_output[16] = {0x00};
+    mbedtls_aes_setkey_enc(&ctx_aes, aes_masterkey, 128);
+    mbedtls_aes_crypt_cbc(&ctx_aes, MBEDTLS_AES_ENCRYPT, 16, aes_iv, aes_input, aes_output);
+    mbedtls_aes_free(&ctx_aes);
+
+    PrintAndLogEx(SUCCESS, "\n-- AES version");
+    PrintAndLogEx(SUCCESS, "Mifare AES m :\t %s", sprint_hex(aes_masterkey, sizeof(aes_masterkey)));
+    PrintAndLogEx(SUCCESS, "Mifare Div   :\t %s", sprint_hex(aes_output, sizeof(aes_output)));
+
     // next. from the diversify_key method.
     return PM3_SUCCESS;
 }
diff --git a/client/src/cmdhfmfu.h b/client/src/cmdhfmfu.h
index d59389434..e3eae9e79 100644
--- a/client/src/cmdhfmfu.h
+++ b/client/src/cmdhfmfu.h
@@ -59,6 +59,9 @@ typedef enum TAGTYPE_UL {
     UL_NANO_40       = 0x2000000,
     NTAG_213_TT      = 0x4000000,
     NTAG_213_C       = 0x8000000,
+    MAGIC_1A         = 0x10000000 | MAGIC,
+    MAGIC_1B         = 0x20000000 | MAGIC,
+    MAGIC_NTAG       = 0x40000000 | MAGIC,
     UL_MAGIC         = UL | MAGIC,
     UL_C_MAGIC       = UL_C | MAGIC,
     UL_ERROR         = 0xFFFFFF,

From 9b3bc551368bf126e03f504d695518afbf188bca Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Tue, 29 Dec 2020 17:40:18 +0100
Subject: [PATCH 232/682] aa

---
 armsrc/em4x50.c          | 132 ++++++++++++++++++++++++---------------
 client/src/cmdlfem4x50.c |  96 ++++++++++++++++++++++++++--
 include/em4x50.h         |   5 +-
 3 files changed, 178 insertions(+), 55 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index a84a911c5..b03872bea 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -62,6 +62,26 @@ static void wait_timer(uint32_t period) {
     while (AT91C_BASE_TC0->TC_CV < period);
 }
 
+static void catch_samples(void) {
+
+    uint8_t sample = 0;
+
+    if (EM4X50_MAX_NO_SAMPLES > CARD_MEMORY_SIZE) {
+        Dbprintf("exeeded emulator memory size");
+        return;
+    }
+
+    uint8_t *em4x50_sample_buffer = BigBuf_get_addr();
+
+    memcpy(em4x50_sample_buffer, &gHigh, 1);
+    memcpy(em4x50_sample_buffer + 1, &gLow, 1);
+
+    for (int i = 2; i < EM4X50_MAX_NO_SAMPLES + 2; i++) {
+        sample = AT91C_BASE_SSC->SSC_RHR;
+        memcpy(em4x50_sample_buffer + i, &sample, 1);
+        wait_timer(T0); // 8µs delay
+    }
+}
 
 // extract and check parities
 // return result of parity check and extracted plain data
@@ -242,11 +262,13 @@ static bool invalid_bit(void) {
 
     // get sample at 3/4 of bit period
     wait_timer(T0 * EM4X50_T_TAG_THREE_QUARTER_PERIOD);
+    //wait_timer(T0 * EM4X50_T_TAG_HALF_PERIOD);
 
     uint8_t sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 
     // wait until end of bit period
     wait_timer(T0 * EM4X50_T_TAG_QUARTER_PERIOD);
+    //wait_timer(T0 * EM4X50_T_TAG_HALF_PERIOD);
 
     // bit in "undefined" state?
     if (sample <= gHigh && sample >= gLow)
@@ -422,6 +444,8 @@ static int find_double_listen_window(bool bcommand) {
 
                     // skip the next bit...
                     wait_timer(T0 * EM4X50_T_TAG_FULL_PERIOD);
+                    catch_samples();
+                    break;
 
                     // ...and check if the following bit does make sense
                     // (if not it is the correct position within the second
@@ -723,24 +747,11 @@ static bool em4x50_sim_send_word(uint32_t word) {
 
 static bool em4x50_sim_send_listen_window(void) {
 
-    bool cond = false;
     uint16_t check = 0;
-    uint32_t tval1[5 * EM4X50_T_TAG_FULL_PERIOD] = {0};
-    uint32_t tval2[5 * EM4X50_T_TAG_FULL_PERIOD] = {0};
-
-    StartTicks();
 
     for (int t = 0; t < 5 * EM4X50_T_TAG_FULL_PERIOD; t++) {
 
-        cond = ((t >= 3 * EM4X50_T_TAG_FULL_PERIOD) && (t < 4 * EM4X50_T_TAG_FULL_PERIOD));
-        
         // wait until SSC_CLK goes HIGH
-        if (cond) {
-            AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG;
-            AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
-            while (AT91C_BASE_TC0->TC_CV > 0);
-        }
-        
         while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
             WDT_HIT();
             
@@ -751,8 +762,6 @@ static bool em4x50_sim_send_listen_window(void) {
             }
             ++check;
         }
-        if (cond)
-            tval1[t] = GetTicks();
 
         if (t >= 4 * EM4X50_T_TAG_FULL_PERIOD)
             SHORT_COIL();
@@ -768,12 +777,6 @@ static bool em4x50_sim_send_listen_window(void) {
         check = 0;
 
         // wait until SSC_CLK goes LOW
-        if (cond) {
-            AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG;
-            AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
-            while (AT91C_BASE_TC0->TC_CV > 0);
-        }
-        
         while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
             WDT_HIT();
             if (check == 1000) {
@@ -783,15 +786,7 @@ static bool em4x50_sim_send_listen_window(void) {
             }
             ++check;
         }
-        if (cond)
-            tval2[t] = GetTicks();
     }
-
-    for (int t = 0; t < 5 * EM4X50_T_TAG_FULL_PERIOD; t++) {
-        //if (tval[t] > 4)
-            Dbprintf("%3i probably RM intialization found: delta = %i %i", t, tval1[t], tval2[t]);
-    }
-    Dbprintf("");
     
     return true;
 }
@@ -1315,33 +1310,72 @@ void em4x50_test(em4x50_test_t *ett) {
 
     int status = PM3_EFAILED;
 
-    em4x50_setup_read();
+    // set field on or off
+    if (ett->field != -1) {
+        em4x50_setup_read();
+        if (ett->field == 1) {
+            LED_A_ON();
+        } else {
+            HIGH(GPIO_SSC_DOUT);
+            LED_A_OFF();
+        }
+        status = ett->field;
+    }
 
-    if (ett->field) {
-        LOW(GPIO_SSC_DOUT);
-        LED_A_ON();
+    // check field status
+    if (ett->check_field) {
+        em4x50_setup_sim();
+        bool field_on = false;
+        while (BUTTON_PRESS() == false) {
 
-        if (DBGLEVEL >= DBG_DEBUG)
-            Dbprintf("switched field on");
-        
+            if (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
+                if (field_on == false) {
+                    Dbprintf("field on");
+                    field_on = true;
+                }
+            } else if (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK){
+                if (field_on == true) {
+                    Dbprintf("field off");
+                    field_on = false;
+                }
+            }
+        }
         status = 1;
-    } else {
-        HIGH(GPIO_SSC_DOUT);
-        LED_A_OFF();
-
-        if (DBGLEVEL >= DBG_DEBUG)
-            Dbprintf("switched field off");
-        
-        status = 0;
     }
     
-    while (BUTTON_PRESS() == false) {
+    // timing values
+    if (ett->cycles != 0) {
+        uint32_t tval = 0;
+        uint32_t tvalhigh[ett->cycles];
+        uint32_t tvallow[ett->cycles];
 
-        if (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
-            Dbprintf("field on");
-        } else if (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)){
-            Dbprintf("field on");
+        em4x50_setup_sim();
+        AT91C_BASE_PMC->PMC_PCER |= (1 << AT91C_ID_TC0);
+        AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME;
+        AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;
+        AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK;
+        AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
+        while (AT91C_BASE_TC0->TC_CV > 0);
+        
+        for (int t = 0; t < ett->cycles; t++) {
+        
+            // field on -> high value
+            AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
+            tval = AT91C_BASE_TC0->TC_CV;
+            while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
+            tvalhigh[t] = AT91C_BASE_TC0->TC_CV - tval;
+
+            // filed off -> zero value
+            AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
+            tval = AT91C_BASE_TC0->TC_CV;
+            while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK);
+            tvallow[t] = AT91C_BASE_TC0->TC_CV - tval;
         }
+        
+        for (int t = 0; t < ett->cycles; t++) {
+            Dbprintf("%03i %li %li", t, tvallow[t], tvalhigh[t]);
+        }
+
     }
     
     reply_ng(CMD_LF_EM4X50_TEST, status, NULL, 0);
diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c
index 8182a822f..a3da00bcc 100644
--- a/client/src/cmdlfem4x50.c
+++ b/client/src/cmdlfem4x50.c
@@ -23,6 +23,61 @@
 
 static int CmdHelp(const char *Cmd);
 
+static void write_gnuplot_config_file(int gHigh, int gLow) {
+
+    const char *fn = "../data/data.gnu";
+    FILE *fp = NULL;
+
+    if ((fp = fopen(fn, "w+")) == false) {
+        PrintAndLogEx(WARNING, "Fail, open file %s", fn);
+    }
+
+    fprintf(fp, "set term qt size 1400, 350 enhanced\n");
+    fprintf(fp, "set border 31 front linecolor rgb 'dark-grey' linewidth 1.000 dashtype solid\n");
+    fprintf(fp, "set xtics  0, 1 textcolor rgb 'dark-grey'\n");
+    fprintf(fp, "set ytics  0, 64 textcolor rgb 'dark-grey'\n");
+    fprintf(fp, "set title 'EM4x50 signal (amplitude vs time)'\n");
+    fprintf(fp, "set title  font ',14' textcolor rgb 'white'\n");
+    fprintf(fp, "set xlabel 'time / ms'\n");
+    fprintf(fp, "set xlabel  font ',12' textcolor rgb 'dark-grey'\n");
+    fprintf(fp, "set ylabel 'amplitude'\n");
+    fprintf(fp, "set ylabel  font ',12' textcolor rgb 'dark-grey'\n");
+    fprintf(fp, "set key textcolor 'green'\n");
+    fprintf(fp, "set grid\n");
+    fprintf(fp, "#set time textcolor 'dark-grey'\n");
+    fprintf(fp, "plot [0:][-50:300] '../data/data.dat' u ($1/1000):2 w l linecolor 'green' title '500/4', '../data/data.dat' u ($1/1000):3 w l linecolor 'yellow' title 'gHigh = %i', '../data/data.dat' u ($1/1000):4 w l linecolor 'yellow' title 'gLow = %i'\n", gHigh, gLow);
+    fprintf(fp, "pause -1\n");
+
+    fclose(fp);
+}
+
+static void get_samples(void) {
+
+    int gHigh = 0, gLow = 0;
+    const char *fn = "../data/data.dat";
+    FILE *fp = NULL;
+
+    // download from BigBuf memory
+    uint8_t data[EM4X50_MAX_NO_SAMPLES + 2] = {0x0};
+    if (GetFromDevice(BIG_BUF, data, EM4X50_MAX_NO_SAMPLES + 2, 0, NULL, 0, NULL, 2500, false) == false) {
+        PrintAndLogEx(WARNING, "Fail, transfer from device time-out");
+    }
+
+    if ((fp = fopen(fn, "w+")) == false) {
+        PrintAndLogEx(WARNING, "Fail, open file %s", fn);
+    }
+
+    gHigh = data[0];
+    gLow = data[1];
+    for (int i = 2; i < EM4X50_MAX_NO_SAMPLES + 2; i++) {
+        fprintf(fp, "%i %i %i %i\n", (i - 2) * 8, data[i], gHigh, gLow);
+    }
+
+    fclose(fp);
+
+    write_gnuplot_config_file(gHigh, gLow);
+}
+
 static void prepare_result(const uint8_t *data, int fwr, int lwr, em4x50_word_t *words) {
 
     // restructure received result in "em4x50_word_t" structure
@@ -612,6 +667,8 @@ int CmdEM4x50Read(const char *Cmd) {
         }
     }
 
+    get_samples();
+    
     return em4x50_read(&etd, NULL);
 }
 
@@ -1162,19 +1219,43 @@ int CmdEM4x50Test(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "lf em 4x50 test",
                   "perform EM4x50 tests.",
-                  "lf em 4x50 test --field 1    -> reader field on \n"
+                  "lf em 4x50 test --field on   -> reader field on\n"
+                  "lf em 4x50 test --field off  -> reader field off\n"
+                  "lf em 4x50 test --check      -> check on/off status of reader field\n"
+                  "lf em 4x50 test --cycles 100  -> measure time of 100 field cycles\n"
                  );
 
     void *argtable[] = {
         arg_param_begin,
-        arg_lit0("", "field", "field off/on"),
+        arg_str0(NULL, "field", "on/off", "field on/off"),
+        arg_lit0(NULL, "check", "check if field is on or off"),
+        arg_int0(NULL, "cycles", "<dec>", "number of field cycles"),
         arg_param_end
     };
 
     CLIExecWithReturn(ctx, Cmd, argtable, true);
 
-    em4x50_test_t ett;
-    ett.field = arg_get_lit(ctx, 1);
+    // option: field
+    int slen = 0;
+    char format[3] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)format, sizeof(format), &slen);
+    em4x50_test_t ett = {.field = -1};
+    if (slen != 0) {
+        if (strcmp(format, "on") == 0) {
+            ett.field = 1;
+        } else if (strcmp(format, "off") == 0) {
+            ett.field = 0;
+        } else {
+            PrintAndLogEx(INFO, "Unknown option for --field: %s", format);
+            return PM3_ESOFT;
+        }
+    }
+
+    // option: check_field
+    ett.check_field = arg_get_lit(ctx, 2);
+    // option: cycles
+    ett.cycles = arg_get_int_def(ctx, 3, 0);
+    
     CLIParserFree(ctx);
 
     // start
@@ -1185,9 +1266,14 @@ int CmdEM4x50Test(const char *Cmd) {
 
     // print response
     if (resp.status == 1) {
-        PrintAndLogEx(SUCCESS, "Field switched " _GREEN_("on"));
+        if (ett.field == 1)
+            PrintAndLogEx(SUCCESS, "Field switched " _GREEN_("on"));
+        if (ett.check_field == 1)
+            PrintAndLogEx(SUCCESS, "Field status evaluated");
     } else if (resp.status == 0) {
         PrintAndLogEx(SUCCESS, "Field switched " _GREEN_("off"));
+    } else if (resp.status == -1) {
+        PrintAndLogEx(INFO, "Nothing done");
     } else {
         PrintAndLogEx(FAILED, "Test call " _RED_("failed"));
     }
diff --git a/include/em4x50.h b/include/em4x50.h
index 27d71e661..3308a371f 100644
--- a/include/em4x50.h
+++ b/include/em4x50.h
@@ -36,6 +36,7 @@
 // misc
 #define TIMEOUT                     2000
 #define DUMP_FILESIZE               136
+#define EM4X50_MAX_NO_SAMPLES       1000
 
 typedef struct {
     bool addr_given;
@@ -47,7 +48,9 @@ typedef struct {
 } PACKED em4x50_data_t;
 
 typedef struct {
-    bool field;
+    bool check_field;
+    int field;
+    int cycles;
 } PACKED em4x50_test_t;
 
 typedef struct {

From 9c43f8e44f379dd5f244f0bbaa3a2730d8d61276 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Tue, 29 Dec 2020 17:50:43 +0100
Subject: [PATCH 233/682] Updated wsl instructions

---
 .../Windows-Installation-Instructions.md      | 39 ++++++++++++-------
 1 file changed, 26 insertions(+), 13 deletions(-)

diff --git a/doc/md/Installation_Instructions/Windows-Installation-Instructions.md b/doc/md/Installation_Instructions/Windows-Installation-Instructions.md
index ea0505268..6d4477de2 100644
--- a/doc/md/Installation_Instructions/Windows-Installation-Instructions.md
+++ b/doc/md/Installation_Instructions/Windows-Installation-Instructions.md
@@ -149,18 +149,31 @@ Note that it may take a quite long time for a freshly plugged Proxmark3 to be vi
 
 Now you're ready to follow the [compilation instructions](/doc/md/Use_of_Proxmark/0_Compilation-Instructions.md).
 
-## Color text on windows 10
-In later versions of windows 10 you may be able to get color to work by setting this registry key
-```
-[HKEY_CURRENT_USER\Console]
-    "VirtualTerminalLevel"=dword:00000001
-```
-You also need to disable "use legacy console" in the cmd.exe properties, or set the following registry key
-```
-[HKEY_CURRENT_USER\Console]
-    "ForceV2"=dword:00000001
-```
-After making these changes, you will need to start a new command prompt (cmd.exe) to ensure its using the new settings.
 
-If after making these changes (and restarting proxmark3.exe) you get extra characters and no color text, set either key to 0 or enable legacy mode again (and restart the command prompt).
+## (Optional) Visual Studio Code debugging
 
+Download and install [J-Link Software and Documentation pack for Windows](https://www.segger.com/downloads/jlink/JLink_Windows.exe) 
+
+Enter WSL prompt (`wsl` or `start windows terminal`)  and from there, follow the [Linux Installation Instructions](/doc/md/Installation_Instructions/Linux-Installation-Instructions.md) for Ubuntu, summarized here below:
+
+Install dependencies
+```sh
+sudo apt-get install --no-install-recommends binutils-arm-none-eabi gdb openocd gdb-multiarch
+```
+
+The J-Link debugger requires `arm-none-eabi-gdb` which was replaced with `gdb-multiarch`. In order to use the J-Link debugger link `arm-none-eabi-gdb` to `gdb-multiarch`:
+```sh
+sudo ln -s /usr/bin/gdb-multiarch /usr/bin/arm-none-eabi-gdb
+```
+
+Setup the Visual Studio Code configuration, by going into your project folder and run:
+```sh
+./.vscode/setup.sh
+```
+
+and launch Visual Studio Code
+```sh
+code .
+```
+_note_
+Please install the recommended Visual Studio Code extensions in order for debugging to work.

From 800e68d9933bc084e321eed8590ef1862740bc39 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Tue, 29 Dec 2020 17:54:49 +0100
Subject: [PATCH 234/682] Missing step

---
 .../Windows-Installation-Instructions.md                        | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/md/Installation_Instructions/Windows-Installation-Instructions.md b/doc/md/Installation_Instructions/Windows-Installation-Instructions.md
index 6d4477de2..1cf1f43c9 100644
--- a/doc/md/Installation_Instructions/Windows-Installation-Instructions.md
+++ b/doc/md/Installation_Instructions/Windows-Installation-Instructions.md
@@ -152,6 +152,8 @@ Now you're ready to follow the [compilation instructions](/doc/md/Use_of_Proxmar
 
 ## (Optional) Visual Studio Code debugging
 
+Download and install [Visual Studio Code](https://code.visualstudio.com/) 
+
 Download and install [J-Link Software and Documentation pack for Windows](https://www.segger.com/downloads/jlink/JLink_Windows.exe) 
 
 Enter WSL prompt (`wsl` or `start windows terminal`)  and from there, follow the [Linux Installation Instructions](/doc/md/Installation_Instructions/Linux-Installation-Instructions.md) for Ubuntu, summarized here below:

From ff4acf70059d86e0bc63a6094a719e3b8b3c06e1 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Tue, 29 Dec 2020 20:05:50 +0300
Subject: [PATCH 235/682] emrtd: Improve comment on USA quirk workaround

---
 client/src/cmdhfemrtd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index fa9c936e9..670ea804d 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -218,9 +218,9 @@ static int emrtd_get_asn1_data_length(uint8_t *datain, int datainlen, int offset
     if (lenfield <= 0x7f) {
         return lenfield;
     } else if (lenfield == 0x80) {
-        // TODO: 0x80 means indeterminate.
+        // TODO: 0x80 means indeterminate, and this impl is a workaround.
         // Giving rest of the file is a workaround, nothing more, nothing less.
-        // More at https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/
+        // https://wf.lavatech.top/ave-but-random/emrtd-data-quirks#EF_SOD
         return datainlen;
     } else if (lenfield == 0x81) {
         return ((int) * (datain + offset + 1));

From d1a6164a10221fd92794adf872e2d34262ab3360 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Tue, 29 Dec 2020 18:08:35 +0100
Subject: [PATCH 236/682] Updated linux instructions

---
 .../Linux-Installation-Instructions.md        | 27 ++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/doc/md/Installation_Instructions/Linux-Installation-Instructions.md b/doc/md/Installation_Instructions/Linux-Installation-Instructions.md
index 18164398a..aa5cf9042 100644
--- a/doc/md/Installation_Instructions/Linux-Installation-Instructions.md
+++ b/doc/md/Installation_Instructions/Linux-Installation-Instructions.md
@@ -25,13 +25,16 @@ Install the requirements
 
 ```sh
 sudo apt-get install --no-install-recommends git ca-certificates build-essential pkg-config \
-libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev
+libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev \
+binutils-arm-none-eabi gdb openocd gdb-multiarch
 ```
 
 If you don't need the native Bluetooth support in the client, you can skip the installation of `libbluetooth-dev`.
 
 If you don't need the graphical components of the Proxmark3 client (such as in `hw tune`), you can skip the installation of `qtbase5-dev`.
 
+If you don't need the debugging packages, you can skip the installation of `binutils-arm-none-eabi`,`gdb`,`openocd` and `gdb-multiarch`.
+
 If you get some (non blocking) error at runtime such as _Gtk-Message: Failed to load module "canberra-gtk-module"_ you may have to install `libcanberra-gtk-module`.
 
 ## On ArchLinux
@@ -112,3 +115,25 @@ It must return `ok`. Otherwise this means you've got a permission problem to fix
 # Compile and use the project
 
 Now you're ready to follow the [compilation instructions](/doc/md/Use_of_Proxmark/0_Compilation-Instructions.md).
+
+
+## (Optional) Visual Studio Code debugging
+
+Download and install [Visual Studio Code](https://code.visualstudio.com/) 
+
+Download and install [J-Link Software and Documentation pack](https://www.segger.com/downloads/jlink) 
+
+On some systems `arm-none-eabi-gdb` was replaced with `gdb-multiarch`. In order to use the J-Link debugger you need to link `arm-none-eabi-gdb` to `gdb-multiarch`:
+```sh
+ln -s /usr/bin/gdb-multiarch /usr/bin/arm-none-eabi-gdb
+```
+
+Setup the Visual Studio Code configuration, by going into your project folder and run:
+```sh
+./.vscode/setup.sh
+```
+
+now launch Visual Studio Code and open your project folder
+
+_note_
+Please install the recommended Visual Studio Code extensions in order for debugging to work.

From c58b1043b8ca8b9dfb0a0c80ed5ac917502a4cea Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Tue, 29 Dec 2020 18:15:09 +0100
Subject: [PATCH 237/682] Make setup executable

---
 .vscode/setup.sh | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 mode change 100644 => 100755 .vscode/setup.sh

diff --git a/.vscode/setup.sh b/.vscode/setup.sh
old mode 100644
new mode 100755

From cc2b36430dece96f66d0f877ccb55f55fc328d77 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Tue, 29 Dec 2020 18:26:51 +0100
Subject: [PATCH 238/682] Fixed removing all variables

---
 .vscode/setup.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.vscode/setup.sh b/.vscode/setup.sh
index 93f7144f2..3e76e03ae 100755
--- a/.vscode/setup.sh
+++ b/.vscode/setup.sh
@@ -79,7 +79,7 @@ function setup_wsl {
 	setup_gdb_linux
 	setup_jlink_wsl
 	cp "$VSCODEPATH/templates/tasks_wsl.json" "$VSCODEPATH/tasks.json"
-	envsubst <"$VSCODEPATH/templates/launch_wsl.json" > "$VSCODEPATH/launch.json"
+	envsubst '${SerialPort} ${DebuggerPath} ${JLinkServerPath} ${DeviceMem}' <"$VSCODEPATH/templates/launch_wsl.json" > "$VSCODEPATH/launch.json"
 }
 
 function setup_linux {
@@ -87,7 +87,7 @@ function setup_linux {
 	setup_gdb_linux
 	setup_jlink_linux
 	cp "$VSCODEPATH/templates/tasks_linux.json" "$VSCODEPATH/tasks.json"
-	envsubst <"$VSCODEPATH/templates/launch_linux.json" > "$VSCODEPATH/launch.json"
+	envsubst '${SerialPort} ${DebuggerPath} ${JLinkServerPath} ${DeviceMem}' <"$VSCODEPATH/templates/launch_linux.json" > "$VSCODEPATH/launch.json"
 }
 
 function setup_ps {

From 7c982c7785bbfe45b6d5b783fd5b3e7e04c127fb Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Tue, 29 Dec 2020 18:32:22 +0100
Subject: [PATCH 239/682] Print config

---
 .vscode/setup.sh | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.vscode/setup.sh b/.vscode/setup.sh
index 3e76e03ae..1cfd3b9b6 100755
--- a/.vscode/setup.sh
+++ b/.vscode/setup.sh
@@ -30,6 +30,13 @@ export DeviceMem="512"
 
 VSCODEPATH=$(dirname "$0")
 
+function print_config {
+	echo "Updating with following configuration:"
+	echo "SerialPort: $SerialPort"
+	echo "DebuggerPath: $DebuggerPath"
+	echo "JLinkServerPath: $JLinkServerPath"
+}
+
 function setup_serial_port {
 	if [ -z "$SerialPort" ]; then
 		pm3list=$($VSCODEPATH/../pm3 --list 2>/dev/null)
@@ -40,7 +47,6 @@ function setup_serial_port {
 			exit 1
 		fi
 	fi
-	echo "Using $SerialPort as port"
 }
 
 function setup_gdb_linux {
@@ -78,6 +84,7 @@ function setup_wsl {
 	setup_serial_port
 	setup_gdb_linux
 	setup_jlink_wsl
+	print_config
 	cp "$VSCODEPATH/templates/tasks_wsl.json" "$VSCODEPATH/tasks.json"
 	envsubst '${SerialPort} ${DebuggerPath} ${JLinkServerPath} ${DeviceMem}' <"$VSCODEPATH/templates/launch_wsl.json" > "$VSCODEPATH/launch.json"
 }
@@ -86,6 +93,7 @@ function setup_linux {
 	setup_serial_port
 	setup_gdb_linux
 	setup_jlink_linux
+	print_config
 	cp "$VSCODEPATH/templates/tasks_linux.json" "$VSCODEPATH/tasks.json"
 	envsubst '${SerialPort} ${DebuggerPath} ${JLinkServerPath} ${DeviceMem}' <"$VSCODEPATH/templates/launch_linux.json" > "$VSCODEPATH/launch.json"
 }
@@ -95,6 +103,7 @@ function setup_ps {
 	if [ -z "$JLinkServerPath" ]; then
 		export JLinkServerPath="c/Program Files (x86)/SEGGER/JLink/JLinkGDBServerCL.exe"
 	fi
+	print_config
 }
 
 if [ -f "$VSCODEPATH/launch.json" ] || [ -f "$VSCODEPATH/tasks.json"  ]; then

From a103628a351f84521e82521185f8edd18e84612d Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Tue, 29 Dec 2020 20:43:24 +0100
Subject: [PATCH 240/682] ProxSpace debugging

---
 .gitignore                          |   3 +-
 .vscode/setup.sh                    |  32 +++--
 .vscode/tasks.json                  | 102 ++++++++++++++++
 .vscode/templates/launch_linux.json |   2 +-
 .vscode/templates/launch_ps.json    |  11 +-
 .vscode/templates/launch_wsl.json   |   2 +-
 .vscode/templates/tasks_linux.json  | 177 ----------------------------
 .vscode/templates/tasks_ps.json     | 177 ----------------------------
 .vscode/templates/tasks_wsl.json    | 177 ----------------------------
 9 files changed, 135 insertions(+), 548 deletions(-)
 create mode 100644 .vscode/tasks.json
 delete mode 100644 .vscode/templates/tasks_linux.json
 delete mode 100644 .vscode/templates/tasks_ps.json
 delete mode 100644 .vscode/templates/tasks_wsl.json

diff --git a/.gitignore b/.gitignore
index 125dc536e..e1f694327 100644
--- a/.gitignore
+++ b/.gitignore
@@ -111,4 +111,5 @@ fpga_version_info.c
 
 #VSCode files
 !.vscode/templates/*.json
-!.vscode/extensions.json
\ No newline at end of file
+!.vscode/extensions.json
+!.vscode/tasks.json
\ No newline at end of file
diff --git a/.vscode/setup.sh b/.vscode/setup.sh
index 1cfd3b9b6..1dc3b5237 100755
--- a/.vscode/setup.sh
+++ b/.vscode/setup.sh
@@ -21,7 +21,7 @@
 ###############################
 #export SerialPort="COM5"
 #export DebuggerPath="${workspaceFolder}/../../msys2/mingw64/bin/gdb.exe"
-#export JLinkServerPath="c/Program Files (x86)/SEGGER/JLink/JLinkGDBServerCL.exe"
+#export JLinkServerPath="/c/Program Files (x86)/SEGGER/JLink/JLinkGDBServerCL.exe"
 
 #Debugging on 256KB systems is not recommended
 #This option does not override PLATFORM_SIZE
@@ -59,6 +59,12 @@ function setup_gdb_linux {
 	fi
 }
 
+function setup_gdb_ps {
+	if [ -z "$DebuggerPath" ]; then
+		export DebuggerPath="${workspaceFolder}/../../msys2/mingw64/bin/gdb.exe"
+	fi
+}
+
 function setup_jlink_linux {
 	if [ -z "$JLinkServerPath" ]; then
 		export JLinkServerPath="/opt/SEGGER/JLink/JLinkGDBServerCLExe"
@@ -75,7 +81,17 @@ function setup_jlink_wsl {
 		export JLinkServerPath="/mnt/c/Program Files (x86)/SEGGER/JLink/JLinkGDBServerCL.exe"
 	fi
 	if [ ! -x "$JLinkServerPath" ]; then
-		echo >&2 "[!!] JLinkGDBServerCLExe not found, please set JLinkServerPath manually"
+		echo >&2 "[!!] JLinkGDBServerCL.exe not found, please set JLinkServerPath manually"
+		exit 1
+	fi
+}
+
+function setup_jlink_ps {
+	if [ -z "$JLinkServerPath" ]; then
+		export JLinkServerPath="/c/Program Files (x86)/SEGGER/JLink/JLinkGDBServerCL.exe"
+	fi
+	if [ ! -x "$JLinkServerPath" ]; then
+		echo >&2 "[!!] JLinkGDBServerCL.exe not found, please set JLinkServerPath manually"
 		exit 1
 	fi
 }
@@ -85,7 +101,6 @@ function setup_wsl {
 	setup_gdb_linux
 	setup_jlink_wsl
 	print_config
-	cp "$VSCODEPATH/templates/tasks_wsl.json" "$VSCODEPATH/tasks.json"
 	envsubst '${SerialPort} ${DebuggerPath} ${JLinkServerPath} ${DeviceMem}' <"$VSCODEPATH/templates/launch_wsl.json" > "$VSCODEPATH/launch.json"
 }
 
@@ -94,26 +109,23 @@ function setup_linux {
 	setup_gdb_linux
 	setup_jlink_linux
 	print_config
-	cp "$VSCODEPATH/templates/tasks_linux.json" "$VSCODEPATH/tasks.json"
 	envsubst '${SerialPort} ${DebuggerPath} ${JLinkServerPath} ${DeviceMem}' <"$VSCODEPATH/templates/launch_linux.json" > "$VSCODEPATH/launch.json"
 }
 
 function setup_ps {
 	setup_serial_port
-	if [ -z "$JLinkServerPath" ]; then
-		export JLinkServerPath="c/Program Files (x86)/SEGGER/JLink/JLinkGDBServerCL.exe"
-	fi
+	setup_gdb_ps
+	setup_jlink_ps
 	print_config
+	envsubst '${SerialPort} ${DebuggerPath} ${JLinkServerPath} ${DeviceMem}' <"$VSCODEPATH/templates/launch_ps.json" > "$VSCODEPATH/launch.json"
 }
 
-if [ -f "$VSCODEPATH/launch.json" ] || [ -f "$VSCODEPATH/tasks.json"  ]; then
+if [ -f "$VSCODEPATH/launch.json" ]; then
 	read -p "Existing configuration found, do you want to override it? " -n 1 -r
 	if [[ $REPLY =~ ^[Yy]$ ]]
 	then
 		rm "$VSCODEPATH/launch.json.bak" 2> /dev/null
-		rm "$VSCODEPATH/tasks.json.bak" 2> /dev/null
 		mv "$VSCODEPATH/launch.json" "$VSCODEPATH/launch.json.bak" 2> /dev/null
-		mv "$VSCODEPATH/tasks.json" "$VSCODEPATH/tasks.json.bak" 2> /dev/null
 	else
 		echo >&2 "[!!] user abort"
 		exit 1
diff --git a/.vscode/tasks.json b/.vscode/tasks.json
new file mode 100644
index 000000000..463377982
--- /dev/null
+++ b/.vscode/tasks.json
@@ -0,0 +1,102 @@
+{
+    // See https://go.microsoft.com/fwlink/?LinkId=733558
+    // for the documentation about the tasks.json format
+    "version": "2.0.0",
+    "windows": {
+        "options": {
+            "cwd": "${workspaceFolder}",
+            "env": {
+                "PATH": "${workspaceFolder}/../../msys2/mingw64/bin;${workspaceFolder}/../../msys2/usr/local/bin;${workspaceFolder}/../../msys2/usr/bin;${workspaceFolder}/../../msys2/bin",
+                "MSYSTEM": "MINGW64"
+            }
+        }
+    },
+    "tasks": [
+        {
+            "label": "all: Make & run",
+            "type": "shell",
+            "command": "make -j && ./pm3",
+            "problemMatcher": [
+                "$gcc"
+            ],
+            "group": {
+                "kind": "build",
+                "isDefault": true
+            }
+        },
+        {
+            "label": "choose: Make",
+            "type": "shell",
+            "command": "make ${input:componentType} -j",
+            "problemMatcher": [
+                "$gcc"
+            ],
+            "group": "build",
+        },
+        {
+            "label": "client: Debug: make",
+            "type": "shell",
+            "command": "make client -j DEBUG=1",
+            "problemMatcher": [
+                "$gcc"
+            ],
+            "group": "build",
+        },
+        {
+            "label": "client: Debug: clean & make",
+            "type": "shell",
+            "command": "make client/clean && make client -j DEBUG=1",
+            "problemMatcher": [
+                "$gcc"
+            ],
+            "group": "build",
+        },
+        {
+            "label": "fullimage: Make & Flash",
+            "type": "shell",
+            "command": "make fullimage && ./pm3-flash-fullimage",
+            "problemMatcher": []
+        },
+        {
+            "label": "BOOTROM: Make & Flash",
+            "type": "shell",
+            "command": "make bootrom && ./pm3-flash-bootrom",
+            "problemMatcher": []
+        },
+        {
+            "label": "Run client",
+            "type": "shell",
+            "command": "./pm3",
+            "problemMatcher": []
+        },{
+            "label": "fullimage: clean & make debug",
+            "type": "shell",
+            "command": "make armsrc/clean && make armsrc/all SKIP_COMPRESSION=1 DEBUG=1",
+            "problemMatcher": [
+                "$gcc"
+            ],
+            "group": "build",
+        }
+    ],
+    "inputs": [
+        {
+            "type": "pickString",
+            "id": "componentType",
+            "description": "What Makefile target do you want to execute?",
+            "options": [
+                "all",
+                "client",
+                "bootrom",
+                "fullimage",
+                "recovery",
+                "clean",
+                "install",
+                "uninstall",
+                "style",
+                "miscchecks",
+                "check",
+            ],
+            "default": "all"
+        }
+    ]
+}
\ No newline at end of file
diff --git a/.vscode/templates/launch_linux.json b/.vscode/templates/launch_linux.json
index 0f60495a6..5239c6bda 100644
--- a/.vscode/templates/launch_linux.json
+++ b/.vscode/templates/launch_linux.json
@@ -44,7 +44,7 @@
             "type": "cortex-debug",
             "request": "launch",
             "cwd": "${workspaceRoot}",
-            "preLaunchTask": "fullimage: clean & make",
+            "preLaunchTask": "fullimage: clean & make debug",
             "executable": "${workspaceRoot}/armsrc/obj/fullimage.elf",
             "serverpath": "${JLinkServerPath}", 
             "servertype": "jlink",
diff --git a/.vscode/templates/launch_ps.json b/.vscode/templates/launch_ps.json
index 8794ef76e..28b724f7b 100644
--- a/.vscode/templates/launch_ps.json
+++ b/.vscode/templates/launch_ps.json
@@ -3,6 +3,13 @@
     // Hover to view descriptions of existing attributes.
     // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
     "version": "0.2.0",
+	"options": {
+        "cwd": "${workspaceFolder}",
+        "env": {
+            "PATH": "${workspaceFolder}/../../msys2/mingw64/bin;${workspaceFolder}/../../msys2/usr/local/bin;${workspaceFolder}/../../msys2/usr/bin;${workspaceFolder}/../../msys2/bin",
+            "MSYSTEM": "MINGW64"
+        }
+    },
     "configurations": [
 		{
             "name": "Client: (gdb) Build & Launch",
@@ -11,10 +18,6 @@
             "program": "${cwd}/client/proxmark3",
             "args": ["${SerialPort}"],
             "stopAtEntry": false,
-            "cwd": "${workspaceFolder}",
-            "environment": [
-				"name": "PATH","value": "${workspaceFolder}/../../msys2/mingw64/bin;${workspaceFolder}/../../msys2/usr/local/bin;${workspaceFolder}/../../msys2/usr/bin;${workspaceFolder}/../../msys2/bin"
-			],
             "externalConsole": true,//for ProxSpace externalConsole=true is required, because the internal cosole stops updating after a while
             "MIMode": "gdb",
             "setupCommands": [
diff --git a/.vscode/templates/launch_wsl.json b/.vscode/templates/launch_wsl.json
index 0f60495a6..5239c6bda 100644
--- a/.vscode/templates/launch_wsl.json
+++ b/.vscode/templates/launch_wsl.json
@@ -44,7 +44,7 @@
             "type": "cortex-debug",
             "request": "launch",
             "cwd": "${workspaceRoot}",
-            "preLaunchTask": "fullimage: clean & make",
+            "preLaunchTask": "fullimage: clean & make debug",
             "executable": "${workspaceRoot}/armsrc/obj/fullimage.elf",
             "serverpath": "${JLinkServerPath}", 
             "servertype": "jlink",
diff --git a/.vscode/templates/tasks_linux.json b/.vscode/templates/tasks_linux.json
deleted file mode 100644
index 4cc21841d..000000000
--- a/.vscode/templates/tasks_linux.json
+++ /dev/null
@@ -1,177 +0,0 @@
-{
-    // See https://go.microsoft.com/fwlink/?LinkId=733558
-    // for the documentation about the tasks.json format
-    "version": "2.0.0",
-    "tasks": [
-        {
-            "label": "all: Make & run",
-            "type": "shell",
-            "command": "make -j && ./pm3",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }
-                }
-              },
-            "problemMatcher": [
-                "$gcc"
-            ],
-            "group": {
-                "kind": "build",
-                "isDefault": true
-            }
-        },
-        {
-            "label": "choose: Make",
-            "type": "shell",
-            "command": "make ${input:componentType} -j",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }
-                }
-              },
-            "problemMatcher": [
-                "$gcc"
-            ],
-            "group": "build",
-        },
-        {
-            "label": "client: Debug: make",
-            "type": "shell",
-            "command": "make client -j DEBUG=1",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }
-                }
-              },
-            "problemMatcher": [
-                "$gcc"
-            ],
-            "group": "build",
-        },
-        {
-            "label": "client: Debug: clean & make",
-            "type": "shell",
-            "command": "make client/clean && make client -j DEBUG=1",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }   
-                }
-              },
-            "problemMatcher": [
-                "$gcc"
-            ],
-            "group": "build",
-        },
-        {
-            "label": "fullimage: Make & Flash",
-            "type": "shell",
-            "command": "make fullimage && ./pm3-flash-fullimage",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }
-                }
-              },
-            "problemMatcher": []
-        },
-        {
-            "label": "BOOTROM: Make & Flash",
-            "type": "shell",
-            "command": "make bootrom && ./pm3-flash-bootrom",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }
-                }
-              },
-            "problemMatcher": []
-        },
-        {
-            "label": "Run client",
-            "type": "shell",
-            "command": "./pm3",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }
-                }
-              },
-            "problemMatcher": []
-        },{
-            "label": "fullimage: clean & make",
-            "type": "shell",
-            "command": "make armsrc/clean && make armsrc/all SKIP_COMPRESSION=1 DEBUG=1",
-            "problemMatcher": [
-                "$gcc"
-            ],
-            "group": "build",
-        }
-    ],
-    "inputs": [
-        {
-            "type": "pickString",
-            "id": "componentType",
-            "description": "What Makefile target do you want to execute?",
-            "options": [
-                "all",
-                "client",
-                "bootrom",
-                "fullimage",
-                "recovery",
-                "clean",
-                "install",
-                "uninstall",
-                "style",
-                "miscchecks",
-                "check",
-            ],
-            "default": "all"
-        }
-    ]
-}
\ No newline at end of file
diff --git a/.vscode/templates/tasks_ps.json b/.vscode/templates/tasks_ps.json
deleted file mode 100644
index 4cc21841d..000000000
--- a/.vscode/templates/tasks_ps.json
+++ /dev/null
@@ -1,177 +0,0 @@
-{
-    // See https://go.microsoft.com/fwlink/?LinkId=733558
-    // for the documentation about the tasks.json format
-    "version": "2.0.0",
-    "tasks": [
-        {
-            "label": "all: Make & run",
-            "type": "shell",
-            "command": "make -j && ./pm3",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }
-                }
-              },
-            "problemMatcher": [
-                "$gcc"
-            ],
-            "group": {
-                "kind": "build",
-                "isDefault": true
-            }
-        },
-        {
-            "label": "choose: Make",
-            "type": "shell",
-            "command": "make ${input:componentType} -j",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }
-                }
-              },
-            "problemMatcher": [
-                "$gcc"
-            ],
-            "group": "build",
-        },
-        {
-            "label": "client: Debug: make",
-            "type": "shell",
-            "command": "make client -j DEBUG=1",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }
-                }
-              },
-            "problemMatcher": [
-                "$gcc"
-            ],
-            "group": "build",
-        },
-        {
-            "label": "client: Debug: clean & make",
-            "type": "shell",
-            "command": "make client/clean && make client -j DEBUG=1",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }   
-                }
-              },
-            "problemMatcher": [
-                "$gcc"
-            ],
-            "group": "build",
-        },
-        {
-            "label": "fullimage: Make & Flash",
-            "type": "shell",
-            "command": "make fullimage && ./pm3-flash-fullimage",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }
-                }
-              },
-            "problemMatcher": []
-        },
-        {
-            "label": "BOOTROM: Make & Flash",
-            "type": "shell",
-            "command": "make bootrom && ./pm3-flash-bootrom",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }
-                }
-              },
-            "problemMatcher": []
-        },
-        {
-            "label": "Run client",
-            "type": "shell",
-            "command": "./pm3",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }
-                }
-              },
-            "problemMatcher": []
-        },{
-            "label": "fullimage: clean & make",
-            "type": "shell",
-            "command": "make armsrc/clean && make armsrc/all SKIP_COMPRESSION=1 DEBUG=1",
-            "problemMatcher": [
-                "$gcc"
-            ],
-            "group": "build",
-        }
-    ],
-    "inputs": [
-        {
-            "type": "pickString",
-            "id": "componentType",
-            "description": "What Makefile target do you want to execute?",
-            "options": [
-                "all",
-                "client",
-                "bootrom",
-                "fullimage",
-                "recovery",
-                "clean",
-                "install",
-                "uninstall",
-                "style",
-                "miscchecks",
-                "check",
-            ],
-            "default": "all"
-        }
-    ]
-}
\ No newline at end of file
diff --git a/.vscode/templates/tasks_wsl.json b/.vscode/templates/tasks_wsl.json
deleted file mode 100644
index 4cc21841d..000000000
--- a/.vscode/templates/tasks_wsl.json
+++ /dev/null
@@ -1,177 +0,0 @@
-{
-    // See https://go.microsoft.com/fwlink/?LinkId=733558
-    // for the documentation about the tasks.json format
-    "version": "2.0.0",
-    "tasks": [
-        {
-            "label": "all: Make & run",
-            "type": "shell",
-            "command": "make -j && ./pm3",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }
-                }
-              },
-            "problemMatcher": [
-                "$gcc"
-            ],
-            "group": {
-                "kind": "build",
-                "isDefault": true
-            }
-        },
-        {
-            "label": "choose: Make",
-            "type": "shell",
-            "command": "make ${input:componentType} -j",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }
-                }
-              },
-            "problemMatcher": [
-                "$gcc"
-            ],
-            "group": "build",
-        },
-        {
-            "label": "client: Debug: make",
-            "type": "shell",
-            "command": "make client -j DEBUG=1",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }
-                }
-              },
-            "problemMatcher": [
-                "$gcc"
-            ],
-            "group": "build",
-        },
-        {
-            "label": "client: Debug: clean & make",
-            "type": "shell",
-            "command": "make client/clean && make client -j DEBUG=1",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }   
-                }
-              },
-            "problemMatcher": [
-                "$gcc"
-            ],
-            "group": "build",
-        },
-        {
-            "label": "fullimage: Make & Flash",
-            "type": "shell",
-            "command": "make fullimage && ./pm3-flash-fullimage",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }
-                }
-              },
-            "problemMatcher": []
-        },
-        {
-            "label": "BOOTROM: Make & Flash",
-            "type": "shell",
-            "command": "make bootrom && ./pm3-flash-bootrom",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }
-                }
-              },
-            "problemMatcher": []
-        },
-        {
-            "label": "Run client",
-            "type": "shell",
-            "command": "./pm3",
-            "windows": {
-                "options": {
-                    "cwd": "${workspaceFolder}/../..",
-                    "shell": {
-                        "executable": "${workspaceFolder}/../../runme64.bat",
-                        "args": [
-                            "-c \"cd ${workspaceFolderBasename} &&"
-                        ],
-                        
-                    }
-                }
-              },
-            "problemMatcher": []
-        },{
-            "label": "fullimage: clean & make",
-            "type": "shell",
-            "command": "make armsrc/clean && make armsrc/all SKIP_COMPRESSION=1 DEBUG=1",
-            "problemMatcher": [
-                "$gcc"
-            ],
-            "group": "build",
-        }
-    ],
-    "inputs": [
-        {
-            "type": "pickString",
-            "id": "componentType",
-            "description": "What Makefile target do you want to execute?",
-            "options": [
-                "all",
-                "client",
-                "bootrom",
-                "fullimage",
-                "recovery",
-                "clean",
-                "install",
-                "uninstall",
-                "style",
-                "miscchecks",
-                "check",
-            ],
-            "default": "all"
-        }
-    ]
-}
\ No newline at end of file

From 7357d17c8c298042f7ac05341fa71b5d300ef4e6 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Tue, 29 Dec 2020 21:02:23 +0100
Subject: [PATCH 241/682] ProxSpace path fixes

---
 .vscode/setup.sh                 | 13 +++----------
 .vscode/templates/launch_ps.json |  7 ++++---
 2 files changed, 7 insertions(+), 13 deletions(-)

diff --git a/.vscode/setup.sh b/.vscode/setup.sh
index 1dc3b5237..3b652a6b8 100755
--- a/.vscode/setup.sh
+++ b/.vscode/setup.sh
@@ -20,8 +20,7 @@
 #    Uncomment to override    #
 ###############################
 #export SerialPort="COM5"
-#export DebuggerPath="${workspaceFolder}/../../msys2/mingw64/bin/gdb.exe"
-#export JLinkServerPath="/c/Program Files (x86)/SEGGER/JLink/JLinkGDBServerCL.exe"
+#export JLinkServerPath="C:/Program Files (x86)/SEGGER/JLink/JLinkGDBServerCL.exe"
 
 #Debugging on 256KB systems is not recommended
 #This option does not override PLATFORM_SIZE
@@ -59,12 +58,6 @@ function setup_gdb_linux {
 	fi
 }
 
-function setup_gdb_ps {
-	if [ -z "$DebuggerPath" ]; then
-		export DebuggerPath="${workspaceFolder}/../../msys2/mingw64/bin/gdb.exe"
-	fi
-}
-
 function setup_jlink_linux {
 	if [ -z "$JLinkServerPath" ]; then
 		export JLinkServerPath="/opt/SEGGER/JLink/JLinkGDBServerCLExe"
@@ -88,9 +81,9 @@ function setup_jlink_wsl {
 
 function setup_jlink_ps {
 	if [ -z "$JLinkServerPath" ]; then
-		export JLinkServerPath="/c/Program Files (x86)/SEGGER/JLink/JLinkGDBServerCL.exe"
+		export JLinkServerPath="c:/Program Files (x86)/SEGGER/JLink/JLinkGDBServerCL.exe"
 	fi
-	if [ ! -x "$JLinkServerPath" ]; then
+	if [ ! -x $(cygpath \"$JLinkServerPath\") ]; then
 		echo >&2 "[!!] JLinkGDBServerCL.exe not found, please set JLinkServerPath manually"
 		exit 1
 	fi
diff --git a/.vscode/templates/launch_ps.json b/.vscode/templates/launch_ps.json
index 28b724f7b..045b3d6c5 100644
--- a/.vscode/templates/launch_ps.json
+++ b/.vscode/templates/launch_ps.json
@@ -15,6 +15,7 @@
             "name": "Client: (gdb) Build & Launch",
             "type": "cppdbg",
             "request": "launch",
+			"cwd": "${workspaceFolder}",
             "program": "${cwd}/client/proxmark3",
             "args": ["${SerialPort}"],
             "stopAtEntry": false,
@@ -28,13 +29,13 @@
                 }
             ],
             "preLaunchTask": "client: Debug: clean & make",
-            "miDebuggerPath": "${DebuggerPath}"
+            "miDebuggerPath": "${workspaceFolder}/../../msys2/mingw64/bin/gdb.exe"
         },{
             "name": "Firmware: (J-Link) Build & Launch",
             "type": "cortex-debug",
             "request": "launch",
             "cwd": "${workspaceRoot}",
-            "preLaunchTask": "fullimage: clean & make",
+            "preLaunchTask": "fullimage: clean & make debug",
             "executable": "${workspaceRoot}/armsrc/obj/fullimage.elf",
             "serverpath": "${JLinkServerPath}",
             "servertype": "jlink",
@@ -42,7 +43,7 @@
             "interface": "jtag",
             "serialNumber": "", //If you have more than one J-Link probe, add the serial number here.
             "runToMain": false,
-            "armToolchainPath": "/usr/bin/"
+            "armToolchainPath": "${workspaceFolder}/../../msys2/mingw64/bin"
         }
     ]
 }
\ No newline at end of file

From 3f7e9c8f8279c93a666ff8779cf5317086ce6bc8 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Tue, 29 Dec 2020 21:10:16 +0100
Subject: [PATCH 242/682] Windows path check

---
 .vscode/setup.sh | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.vscode/setup.sh b/.vscode/setup.sh
index 3b652a6b8..cdfb77e8f 100755
--- a/.vscode/setup.sh
+++ b/.vscode/setup.sh
@@ -83,7 +83,8 @@ function setup_jlink_ps {
 	if [ -z "$JLinkServerPath" ]; then
 		export JLinkServerPath="c:/Program Files (x86)/SEGGER/JLink/JLinkGDBServerCL.exe"
 	fi
-	if [ ! -x $(cygpath \"$JLinkServerPath\") ]; then
+	jlinkpath=$(cygpath "$JLinkServerPath")
+	if [ ! -x "$jlinkpath" ]; then
 		echo >&2 "[!!] JLinkGDBServerCL.exe not found, please set JLinkServerPath manually"
 		exit 1
 	fi
@@ -107,10 +108,10 @@ function setup_linux {
 
 function setup_ps {
 	setup_serial_port
-	setup_gdb_ps
 	setup_jlink_ps
+	export DebuggerPath="Using ProxSpace gbd"
 	print_config
-	envsubst '${SerialPort} ${DebuggerPath} ${JLinkServerPath} ${DeviceMem}' <"$VSCODEPATH/templates/launch_ps.json" > "$VSCODEPATH/launch.json"
+	envsubst '${SerialPort} ${JLinkServerPath} ${DeviceMem}' <"$VSCODEPATH/templates/launch_ps.json" > "$VSCODEPATH/launch.json"
 }
 
 if [ -f "$VSCODEPATH/launch.json" ]; then

From c4729670b6c6c79fc968710b18a2b7a2f0860c8d Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Tue, 29 Dec 2020 21:37:01 +0100
Subject: [PATCH 243/682] Fixed serial port not parsing

---
 .vscode/setup.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.vscode/setup.sh b/.vscode/setup.sh
index cdfb77e8f..70672b924 100755
--- a/.vscode/setup.sh
+++ b/.vscode/setup.sh
@@ -40,7 +40,7 @@ function setup_serial_port {
 	if [ -z "$SerialPort" ]; then
 		pm3list=$($VSCODEPATH/../pm3 --list 2>/dev/null)
 		#Use first port listed 
-		SerialPort=$(echo $pm3list | head -n 1 | cut -c 4-)
+		export SerialPort=$(echo $pm3list | head -n 1 | cut -c 4-)
 		if [ -z "$SerialPort" ]; then
 			echo >&2 "[!!] No serial port found, please set SerialPort manually"
 			exit 1

From db43f55b98ecef1092b066dae09f468e962a5cb6 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 29 Dec 2020 21:38:02 +0100
Subject: [PATCH 244/682] hf mfu wrbl - now supports cliparser

---
 client/src/cmdhfmfu.c | 185 +++++++++++++++++++-----------------------
 1 file changed, 84 insertions(+), 101 deletions(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index 639429fba..0dbc93998 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -99,21 +99,6 @@ static int usage_hf_mfu_rdbl(void) {
     return PM3_SUCCESS;
 }
 
-static int usage_hf_mfu_wrbl(void) {
-    PrintAndLogEx(NORMAL, "Write a block. It autodetects card type.\n");
-    PrintAndLogEx(NORMAL, "Usage:  hf mfu wrbl b <block number> d <data> k <key> l\n");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "  b <no>   : block to write");
-    PrintAndLogEx(NORMAL, "  d <data> : block data - (8 or 32 hex symbols, 32 hex symbols will do a compatibility write)");
-    PrintAndLogEx(NORMAL, "  k <key>  : (optional) key for authentication [UL-C 16bytes, EV1/NTAG 4bytes]");
-    PrintAndLogEx(NORMAL, "  l        : (optional) swap entered key's endianness");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu wrbl b 0 d 01234567"));
-    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu wrbl b 0 d 01234567 k AABBCCDD"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
 
 static int usage_hf_mfu_eload(void) {
     PrintAndLogEx(NORMAL, "It loads emul dump from the file " _YELLOW_("`filename.eml`"));
@@ -1265,8 +1250,8 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
                   "Get info about MIFARE Ultralight Family styled tag.\n"
                   "Sometimes the tags are locked down, and you may need a key to be able to read the information",
                   "hf mfu info\n"
-                  "hf mfu info k AABBCCDD\n"
-                  "hf mfu info k 00112233445566778899AABBCCDDEEFF"
+                  "hf mfu info -k AABBCCDD\n"
+                  "hf mfu info --key 00112233445566778899AABBCCDDEEFF"
                  );
 
     void *argtable[] = {
@@ -1284,7 +1269,7 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
     CLIParserFree(ctx);
 
     if (ak_len) {
-        if (ak_len != 16 || ak_len != 8) {
+        if (ak_len != 16 && ak_len != 8) {
             PrintAndLogEx(WARNING, "ERROR: Key is incorrect length\n");
             return PM3_EINVARG;
         }
@@ -1558,81 +1543,63 @@ out:
 //
 static int CmdHF14AMfUWrBl(const char *Cmd) {
 
-    int blockNo = -1;
-    bool errors = false;
-    bool hasAuthKey = false;
-    bool hasPwdKey = false;
-    bool swapEndian = false;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mfu wrbl",
+                  "Write a block. It autodetects card type.",
+                  "hf mfu wrbl -b 0 -d 01234567\n"
+                  "hf mfu wrbl -b 0 -d 01234567 -k AABBCCDD\n"
+                  "hf mfu wrbl -b 0 -d 01234567 -k 00112233445566778899AABBCCDDEEFF"
+                 );
 
-    uint8_t cmdp = 0;
-    uint8_t keylen = 0;
-    uint8_t blockdata[16] = {0x00};
-    uint8_t data[16] = {0x00};
-    uint8_t datalen = 4;
+    void *argtable[] = {
+        arg_param_begin,        
+        arg_str0("k", "key", "<hex>", "key for authentication (UL-C 16 bytes, EV1/NTAG 4 bytes)"),
+        arg_lit0("l", NULL,           "swap entered key's endianness"),
+        arg_int1("b", "block", "<dec>", "block number to write"),
+        arg_str1("d", "data", "<hex>", "block data (4 or 16 hex bytes, 16 hex bytes will do a compatibility write)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+
+    int ak_len = 0;
     uint8_t authenticationkey[16] = {0x00};
+    CLIGetHexWithReturn(ctx, 1, authenticationkey, &ak_len);
+    bool swap_endian = arg_get_lit(ctx, 2);
+
+    int blockno = arg_get_int_def(ctx, 3, -1);
+
+    int datalen = 0;
+    uint8_t data[16] = {0x00};
+    CLIGetHexWithReturn(ctx, 4, data, &datalen);
+    CLIParserFree(ctx);
+
+    bool has_auth_key = false;
+    bool has_pwd = false;
+    if (ak_len == 16) {
+        has_auth_key = true;
+    } else if (ak_len == 4) {
+        has_pwd = true;
+    } else if (ak_len != 0){
+        PrintAndLogEx(WARNING, "ERROR: Key is incorrect length\n");
+        return PM3_EINVARG;
+    }
+
+    if (blockno < 0) {
+        PrintAndLogEx(WARNING, "Wrong block number");
+        return PM3_EINVARG;
+    }
+
+    if (datalen != 16 && datalen != 4) {
+        PrintAndLogEx(WARNING, "Wrong data length. Expect 16 or 4, got %d", datalen);
+        return PM3_EINVARG;
+    }
+
     uint8_t *authKeyPtr = authenticationkey;
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_hf_mfu_wrbl();
-            case 'k':
-                // EV1/NTAG size key
-                keylen = param_gethex(Cmd, cmdp + 1, data, 8);
-                if (!keylen) {
-                    memcpy(authenticationkey, data, 4);
-                    cmdp += 2;
-                    hasPwdKey = true;
-                    break;
-                }
-                // UL-C size key
-                keylen = param_gethex(Cmd, cmdp + 1, data, 32);
-                if (!keylen) {
-                    memcpy(authenticationkey, data, 16);
-                    cmdp += 2;
-                    hasAuthKey = true;
-                    break;
-                }
-                PrintAndLogEx(WARNING, "ERROR: Key is incorrect length\n");
-                errors = true;
-                break;
-            case 'b':
-                blockNo = param_get8(Cmd, cmdp + 1);
-                if (blockNo < 0) {
-                    PrintAndLogEx(WARNING, "Wrong block number");
-                    errors = true;
-                }
-                cmdp += 2;
-                break;
-            case 'l':
-                swapEndian = true;
-                cmdp++;
-                break;
-            case 'd':
-                if (param_gethex(Cmd, cmdp + 1, blockdata, 8)) {
-                    if (param_gethex(Cmd, cmdp + 1, blockdata, 32)) {
-                        PrintAndLogEx(WARNING, "Block data must include 8 or 32 HEX symbols");
-                        errors = true;
-                        break;
-                    } else {
-                        datalen = 16;
-                    }
-                }
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter: " _RED_("'%c'"), param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-    //Validations
-    if (errors || cmdp == 0) return usage_hf_mfu_wrbl();
-
-    if (blockNo == -1) return usage_hf_mfu_wrbl();
     // starting with getting tagtype
     TagTypeUL_t tagtype = GetHF14AMfU_Type();
-    if (tagtype == UL_ERROR) return -1;
+    if (tagtype == UL_ERROR) 
+        return PM3_ESOFT;
 
     uint8_t maxblockno = 0;
     for (uint8_t idx = 0; idx < ARRAYLEN(UL_TYPES_ARRAY); idx++) {
@@ -1641,39 +1608,55 @@ static int CmdHF14AMfUWrBl(const char *Cmd) {
             break;
         }
     }
-    if (blockNo > maxblockno) {
+    if (blockno > maxblockno) {
         PrintAndLogEx(WARNING, "block number too large. Max block is %u/0x%02X \n", maxblockno, maxblockno);
-        return usage_hf_mfu_wrbl();
+        return PM3_EINVARG;
     }
 
     // Swap endianness
-    if (swapEndian && hasAuthKey) authKeyPtr = SwapEndian64(authenticationkey, 16, 8);
-    if (swapEndian && hasPwdKey)  authKeyPtr = SwapEndian64(authenticationkey, 4, 4);
+    if (swap_endian) {
+        if (has_auth_key) 
+            authKeyPtr = SwapEndian64(authenticationkey, 16, 8);
 
-    if (blockNo <= 3)
-        PrintAndLogEx(NORMAL, "Special Block: %0d (0x%02X) [ %s]", blockNo, blockNo, sprint_hex(blockdata, 4));
+        if (has_pwd)
+            authKeyPtr = SwapEndian64(authenticationkey, 4, 4);
+    }
+
+    if (blockno <= 3)
+        PrintAndLogEx(INFO, "Special block: %0d (0x%02X) [ %s]", blockno, blockno, sprint_hex(data, datalen));
     else
-        PrintAndLogEx(NORMAL, "Block: %0d (0x%02X) [ %s]", blockNo, blockNo, sprint_hex(blockdata, 4));
+        PrintAndLogEx(INFO, "Block: %0d (0x%02X) [ %s]", blockno, blockno, sprint_hex(data, datalen));
 
+    if (ak_len) {
+        PrintAndLogEx(INFO, "Using %s  %s", (ak_len == 16) ? "3des" : "pwd", sprint_hex(authenticationkey, ak_len));
+    }
+    
     //Send write Block
+
+    // 4 or 16.
     uint8_t cmddata[32];
-    memcpy(cmddata, blockdata, datalen);
+    memcpy(cmddata, data, datalen);
+
+    // 0 - no pwd/key, no authentication
+    // 1 - 3des key (16 bytes)
+    // 2 - pwd  (4 bytes)
     uint8_t keytype = 0;
-    if (hasAuthKey) {
+    size_t cmdlen = datalen;
+    if (has_auth_key) {
         keytype = 1;
         memcpy(cmddata + datalen, authKeyPtr, 16);
-        datalen += 16;
-    } else if (hasPwdKey) {
+        cmdlen += 16;
+    } else if (has_pwd) {
         keytype = 2;
         memcpy(cmddata + datalen, authKeyPtr, 4);
-        datalen += 4;
+        cmdlen += 4;
     }
 
     clearCommandBuffer();
     if (datalen == 16) {
-        SendCommandMIX(CMD_HF_MIFAREU_WRITEBL_COMPAT, blockNo, keytype, 0, cmddata, datalen);
+        SendCommandMIX(CMD_HF_MIFAREU_WRITEBL_COMPAT, blockno, keytype, 0, cmddata, cmdlen);
     } else {
-        SendCommandMIX(CMD_HF_MIFAREU_WRITEBL, blockNo, keytype, 0, cmddata, datalen);
+        SendCommandMIX(CMD_HF_MIFAREU_WRITEBL, blockno, keytype, 0, cmddata, cmdlen);
     }
     PacketResponseNG resp;
     if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {

From 3396eeefdd371dacb6444d3228ff8aa9b3bfcec6 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 29 Dec 2020 21:41:15 +0100
Subject: [PATCH 245/682] missing quote,  Thanks @aveao for pointing it out!

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index b7e942f58..3fd900b42 100644
--- a/Makefile
+++ b/Makefile
@@ -169,7 +169,7 @@ help:
 	@echo "+ fpga_compress   - Make tools/fpga_compress"
 	@echo
 	@echo "+ style           - Apply some automated source code formatting rules"
-	@echo "+ cliparser       - Generate cliparser TODO
+	@echo "+ cliparser       - Generate cliparser TODO"
 	@echo "+ check           - Run offline tests. Set CHECKARGS to pass arguments to the test script"
 	@echo "+ .../check       - Run offline tests against specific target. See above."
 	@echo "+ miscchecks      - Detect various encoding issues in source code"

From 9bd73c4c0ad826f144ab5096d71cd275d0e5ccc5 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Tue, 29 Dec 2020 21:43:29 +0100
Subject: [PATCH 246/682] Updated installation instructions for ProxSpace

---
 .../Windows-Installation-Instructions.md       | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/doc/md/Installation_Instructions/Windows-Installation-Instructions.md b/doc/md/Installation_Instructions/Windows-Installation-Instructions.md
index 1cf1f43c9..80f5b4d5c 100644
--- a/doc/md/Installation_Instructions/Windows-Installation-Instructions.md
+++ b/doc/md/Installation_Instructions/Windows-Installation-Instructions.md
@@ -64,6 +64,24 @@ To use the compiled client, the only differences are that executables end with `
 
 Now you're ready to follow the [compilation instructions](/doc/md/Use_of_Proxmark/0_Compilation-Instructions.md).
 
+## (Optional) Visual Studio Code debugging
+
+Download and install [Visual Studio Code](https://code.visualstudio.com/) 
+
+Download and install [J-Link Software and Documentation pack for Windows](https://www.segger.com/downloads/jlink/JLink_Windows.exe) 
+
+Enter PorxSpace (`runme64.bat`)  and enter your project folder.
+
+Setup the Visual Studio Code configuration, by running:
+```sh
+./.vscode/setup.sh
+```
+
+now launch Visual Studio Code and open your project folder
+
+_note_
+Please install the recommended Visual Studio Code extensions in order for debugging to work.
+
 # Installing on Windows with WSL 1
 
 WSL 1 requires to run on Windows 10 version 1709 or above. Previous windows versions didn't have support for COM ports.

From d8c8de3204a442bc7c0099f158dee1b963d49cb7 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 29 Dec 2020 22:47:50 +0100
Subject: [PATCH 247/682] hf mfu rdbl - now uses cliparser

---
 client/src/cmdhfmfu.c | 147 ++++++++++++++++++------------------------
 1 file changed, 63 insertions(+), 84 deletions(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index 0dbc93998..a85e9aaf3 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -83,23 +83,6 @@ static int usage_hf_mfu_restore(void) {
     return PM3_SUCCESS;
 }
 
-static int usage_hf_mfu_rdbl(void) {
-    PrintAndLogEx(NORMAL, "Read a block and print. It autodetects card type.\n");
-    PrintAndLogEx(NORMAL, "Usage:  hf mfu rdbl b <block number> k <key> l\n");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "  b <no>  : block to read");
-    PrintAndLogEx(NORMAL, "  k <key> : (optional) key for authentication [UL-C 16bytes, EV1/NTAG 4bytes]");
-    PrintAndLogEx(NORMAL, "  l       : (optional) swap entered key's endianness");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu rdbl b 0"));
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu rdbl b 0 k 00112233445566778899AABBCCDDEEFF"));
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu rdbl b 0 k AABBCCDD"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
-
-
 static int usage_hf_mfu_eload(void) {
     PrintAndLogEx(NORMAL, "It loads emul dump from the file " _YELLOW_("`filename.eml`"));
     PrintAndLogEx(NORMAL, "Hint: See " _YELLOW_("`script run hf_mfu_dumptoemulator`") " to convert the .bin to the eml");
@@ -1628,7 +1611,7 @@ static int CmdHF14AMfUWrBl(const char *Cmd) {
         PrintAndLogEx(INFO, "Block: %0d (0x%02X) [ %s]", blockno, blockno, sprint_hex(data, datalen));
 
     if (ak_len) {
-        PrintAndLogEx(INFO, "Using %s  %s", (ak_len == 16) ? "3des" : "pwd", sprint_hex(authenticationkey, ak_len));
+        PrintAndLogEx(INFO, "Using %s " _GREEN_("%s"), (ak_len == 16) ? "3des" : "pwd", sprint_hex(authenticationkey, ak_len));
     }
     
     //Send write Block
@@ -1673,66 +1656,52 @@ static int CmdHF14AMfUWrBl(const char *Cmd) {
 //
 static int CmdHF14AMfURdBl(const char *Cmd) {
 
-    int blockNo = -1;
-    bool errors = false;
-    bool hasAuthKey = false;
-    bool hasPwdKey = false;
-    bool swapEndian = false;
-    uint8_t cmdp = 0;
-    uint8_t keylen = 0;
-    uint8_t data[16] = {0x00};
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mfu rdbl",
+                  "Read a block and print. It autodetects card type.",
+                  "hf mfu rdbl -b 0\n"
+                  "hf mfu rdbl -b 0 -k AABBCCDD\n"
+                  "hf mfu rdbl -b 0 --key 00112233445566778899AABBCCDDEEFF"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,        
+        arg_str0("k", "key", "<hex>", "key for authentication (UL-C 16 bytes, EV1/NTAG 4 bytes)"),
+        arg_lit0("l", NULL,           "swap entered key's endianness"),
+        arg_int1("b", "block", "<dec>", "block number to write"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+
+    int ak_len = 0;
     uint8_t authenticationkey[16] = {0x00};
+    CLIGetHexWithReturn(ctx, 1, authenticationkey, &ak_len);
+    bool swap_endian = arg_get_lit(ctx, 2);
+    int blockno = arg_get_int_def(ctx, 3, -1);
+    CLIParserFree(ctx);
+
+    bool has_auth_key = false;
+    bool has_pwd = false;
+    if (ak_len == 16) {
+        has_auth_key = true;
+    } else if (ak_len == 4) {
+        has_pwd = true;
+    } else if (ak_len != 0){
+        PrintAndLogEx(WARNING, "ERROR: Key is incorrect length\n");
+        return PM3_EINVARG;
+    }
+
+    if (blockno < 0) {
+        PrintAndLogEx(WARNING, "Wrong block number");
+        return PM3_EINVARG;
+    }
+
     uint8_t *authKeyPtr = authenticationkey;
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_hf_mfu_rdbl();
-            case 'k':
-                // EV1/NTAG size key
-                keylen = param_gethex(Cmd, cmdp + 1, data, 8);
-                if (!keylen) {
-                    memcpy(authenticationkey, data, 4);
-                    cmdp += 2;
-                    hasPwdKey = true;
-                    break;
-                }
-                // UL-C size key
-                keylen = param_gethex(Cmd, cmdp + 1, data, 32);
-                if (!keylen) {
-                    memcpy(authenticationkey, data, 16);
-                    cmdp += 2;
-                    hasAuthKey = true;
-                    break;
-                }
-                PrintAndLogEx(WARNING, "ERROR: Key is incorrect length\n");
-                errors = true;
-                break;
-            case 'b':
-                blockNo = param_get8(Cmd, cmdp + 1);
-                if (blockNo < 0) {
-                    PrintAndLogEx(WARNING, "Wrong block number");
-                    errors = true;
-                }
-                cmdp += 2;
-                break;
-            case 'l':
-                swapEndian = true;
-                cmdp++;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter: " _RED_("'%c'"), param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-    //Validations
-    if (errors || cmdp == 0) return usage_hf_mfu_rdbl();
-
-    if (blockNo == -1) return usage_hf_mfu_rdbl();
     // start with getting tagtype
     TagTypeUL_t tagtype = GetHF14AMfU_Type();
-    if (tagtype == UL_ERROR) return -1;
+    if (tagtype == UL_ERROR)
+        return PM3_ESOFT;
 
     uint8_t maxblockno = 0;
     for (uint8_t idx = 0; idx < ARRAYLEN(UL_TYPES_ARRAY); idx++) {
@@ -1741,43 +1710,53 @@ static int CmdHF14AMfURdBl(const char *Cmd) {
             break;
         }
     }
-    if (blockNo > maxblockno) {
+    if (blockno > maxblockno) {
         PrintAndLogEx(WARNING, "block number to large. Max block is %u/0x%02X \n", maxblockno, maxblockno);
-        return usage_hf_mfu_rdbl();
+        return PM3_EINVARG;
     }
 
     // Swap endianness
-    if (swapEndian && hasAuthKey) authKeyPtr = SwapEndian64(authenticationkey, 16, 8);
-    if (swapEndian && hasPwdKey)  authKeyPtr = SwapEndian64(authenticationkey, 4, 4);
+    if (swap_endian) {
+        if (has_auth_key)
+            authKeyPtr = SwapEndian64(authenticationkey, ak_len, 8);
+
+        if (has_pwd)
+            authKeyPtr = SwapEndian64(authenticationkey, ak_len, 4);
+    }
+
+    if (ak_len) {
+        PrintAndLogEx(INFO, "Using %s " _GREEN_("%s"), (ak_len == 16) ? "3des" : "pwd", sprint_hex(authenticationkey, ak_len));
+    }    
 
     //Read Block
     uint8_t keytype = 0;
     uint8_t datalen = 0;
-    if (hasAuthKey) {
+    if (has_auth_key) {
         keytype = 1;
         datalen = 16;
-    } else if (hasPwdKey) {
+    } else if (has_pwd) {
         keytype = 2;
         datalen = 4;
     }
 
     clearCommandBuffer();
-    SendCommandMIX(CMD_HF_MIFAREU_READBL, blockNo, keytype, 0, authKeyPtr, datalen);
+    SendCommandMIX(CMD_HF_MIFAREU_READBL, blockno, keytype, 0, authKeyPtr, datalen);
     PacketResponseNG resp;
     if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
         uint8_t isOK = resp.oldarg[0] & 0xff;
         if (isOK) {
             uint8_t *d = resp.data.asBytes;
-            PrintAndLogEx(NORMAL, "\nBlock#  | Data        | Ascii");
-            PrintAndLogEx(NORMAL, "-----------------------------");
-            PrintAndLogEx(NORMAL, "%02d/0x%02X | %s| %s\n", blockNo, blockNo, sprint_hex(d, 4), sprint_ascii(d, 4));
+            PrintAndLogEx(NORMAL, "");
+            PrintAndLogEx(INFO, "Block#  | Data        | Ascii");
+            PrintAndLogEx(INFO, "-----------------------------");
+            PrintAndLogEx(INFO, "%02d/0x%02X | %s| %s\n", blockno, blockno, sprint_hex(d, 4), sprint_ascii(d, 4));
         } else {
             PrintAndLogEx(WARNING, "Failed reading block: (%02x)", isOK);
         }
     } else {
         PrintAndLogEx(WARNING, "Command execute time-out");
     }
-    return 0;
+    return PM3_SUCCESS;
 }
 
 void printMFUdumpEx(mfu_dump_t *card, uint16_t pages, uint8_t startpage) {

From 8c803edfd2b42cd173d3a22615d5ae74e6e703b5 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 29 Dec 2020 23:36:38 +0100
Subject: [PATCH 248/682] hf mfu dump - now uses cliparser

---
 client/src/cmdhfmfu.c | 211 +++++++++++++++++++-----------------------
 1 file changed, 94 insertions(+), 117 deletions(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index a85e9aaf3..2c89cdf73 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -42,28 +42,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_hf_mfu_dump(void) {
-    PrintAndLogEx(NORMAL, "Reads all pages from Ultralight, Ultralight-C, Ultralight EV1");
-    PrintAndLogEx(NORMAL, "NTAG 203, NTAG 210, NTAG 212, NTAG 213, NTAG 215, NTAG 216");
-    PrintAndLogEx(NORMAL, "and saves binary dump into the file " _YELLOW_("`filename.bin`") " or " _YELLOW_("`cardUID.bin`"));
-    PrintAndLogEx(NORMAL, "It autodetects card type.\n");
-    PrintAndLogEx(NORMAL, "Usage:  hf mfu dump k <key> l f <filename w/o .bin> p <page#> q <#pages>");
-    PrintAndLogEx(NORMAL, "  Options :");
-    PrintAndLogEx(NORMAL, "  k <key> : (optional) key for authentication [UL-C 16bytes, EV1/NTAG 4bytes]");
-    PrintAndLogEx(NORMAL, "  l       : (optional) swap entered key's endianness");
-    PrintAndLogEx(NORMAL, "  f <fn>  : " _YELLOW_("filename w/o .bin") " to save the dump as");
-    PrintAndLogEx(NORMAL, "  p <pg>  : starting Page number to manually set a page to start the dump at");
-    PrintAndLogEx(NORMAL, "  q <qty> : number of Pages to manually set how many pages to dump");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu dump"));
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu dump f myfile"));
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu dump k 00112233445566778899AABBCCDDEEFF"));
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu dump k AABBCCDD"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
-
 static int usage_hf_mfu_restore(void) {
     PrintAndLogEx(NORMAL, "Restore dumpfile onto card.");
     PrintAndLogEx(NORMAL, "Usage:  hf mfu restore [h] [l] [s] k <key> n <filename w .bin> ");
@@ -1911,83 +1889,78 @@ void printMFUdumpEx(mfu_dump_t *card, uint16_t pages, uint8_t startpage) {
 //  Read and Dump Card Contents,  using auto detection of tag size.
 static int CmdHF14AMfUDump(const char *Cmd) {
 
-    int fileNameLen = 0;
-    char filename[FILE_PATH_SIZE] = {0x00};
-    char *fptr = filename;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mfu dump",
+                  "Reads all pages from Ultralight, Ultralight-C, Ultralight EV1\n"
+                  "NTAG 203, NTAG 210, NTAG 212, NTAG 213, NTAG 215, NTAG 216\n"
+                  "and saves data into binary/json files.\n"
+                  "It autodetects card type.",
+                  "hf mfu dump -f myfile        -> dump whole tag, save to `myfile.bin`\n"
+                  "hf mfu dump -k AABBCCDD      -> dump whole tag using pwd AABBCCDD\n"
+                  "hf mfu dump -p 10            -> start at page 10 and dump rest of blocks\n"
+                  "hf mfu dump -p 10 -q 2       -> start at page 10 and dump two blocks\n"
+                  "hf mfu dump --key 00112233445566778899AABBCCDDEEFF"
+                 );
 
-    uint8_t data[1024] = {0x00};
-    memset(data, 0x00, sizeof(data));
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("f", "file", "<fn>", "specify a filename for dump file"),
+        arg_str0("k", "key", "<hex>", "key for authentication (UL-C 16 bytes, EV1/NTAG 4 bytes)"),
+        arg_lit0("l", NULL,           "swap entered key's endianness"),
+        arg_int0("p", "page", "<dec>", "manually set start page number to start from"),
+        arg_int0("q", "qty", "<dec>", "manually set number of pages to dump"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
 
-    bool hasAuthKey = false;
-    int pages = 16;
-    uint8_t dataLen = 0;
-    uint8_t cmdp = 0;
+    int fnlen = 0;
+    char filename[FILE_PATH_SIZE] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
+
+    int ak_len = 0;
     uint8_t authenticationkey[16] = {0x00};
-    memset(authenticationkey, 0x00, sizeof(authenticationkey));
     uint8_t *authKeyPtr = authenticationkey;
+    CLIGetHexWithReturn(ctx, 2, authenticationkey, &ak_len);
+    bool swap_endian = arg_get_lit(ctx, 3);
+    int start_page = arg_get_int_def(ctx, 4, 0);
+    int pages = arg_get_int_def(ctx, 5, 16);
+    CLIParserFree(ctx);
 
-    bool errors = false;
-    bool swapEndian = false;
-    bool manualPages = false;
-    uint8_t startPage = 0;
-    uint8_t card_mem_size = 0;
-    char tempStr[50];
-
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_hf_mfu_dump();
-            case 'k':
-                dataLen = param_getstr(Cmd, cmdp + 1, tempStr, sizeof(tempStr));
-                if (dataLen == 32 || dataLen == 8) { //ul-c or ev1/ntag key length
-                    errors = param_gethex(tempStr, 0, authenticationkey, dataLen);
-                    dataLen /= 2;
-                } else {
-                    PrintAndLogEx(WARNING, "ERROR: Key is incorrect length\n");
-                    errors = true;
-                }
-                cmdp += 2;
-                hasAuthKey = true;
-                break;
-            case 'l':
-                swapEndian = true;
-                cmdp++;
-                break;
-            case 'f':
-                fileNameLen = param_getstr(Cmd, cmdp + 1, filename, sizeof(filename));
-                if (fileNameLen > FILE_PATH_SIZE - 5)
-                    fileNameLen = FILE_PATH_SIZE - 5;
-                cmdp += 2;
-                break;
-            case 'p': //set start page
-                startPage = param_get8(Cmd, cmdp + 1);
-                manualPages = true;
-                cmdp += 2;
-                break;
-            case 'q':
-                pages = param_get8(Cmd, cmdp + 1);
-                cmdp += 2;
-                manualPages = true;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter: " _RED_("'%c'"), param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
+    bool has_auth_key = false;
+    bool has_pwd = false;
+    if (ak_len == 16) {
+        has_auth_key = true;
+    } else if (ak_len == 4) {
+        has_pwd = true;
+    } else if (ak_len != 0){
+        PrintAndLogEx(WARNING, "ERROR: Key is incorrect length\n");
+        return PM3_EINVARG;
     }
 
-    //Validations
-    if (errors) return usage_hf_mfu_dump();
+    bool manual_pages = false;
+    if ( start_page > 0)
+        manual_pages = true;
 
-    //if we entered a key in little endian and set the swapEndian switch - switch it...
-    if (swapEndian && hasAuthKey)
-        authKeyPtr = SwapEndian64(authenticationkey, dataLen, (dataLen == 16) ? 8 : 4);
+    if (pages != 16)
+        manual_pages = true;
+
+    uint8_t card_mem_size = 0;
+
+    // Swap endianness
+    if (swap_endian) {
+        if (has_auth_key)
+            authKeyPtr = SwapEndian64(authenticationkey, ak_len, 8);
+
+        if (has_pwd)
+            authKeyPtr = SwapEndian64(authenticationkey, ak_len, 4);
+    }
 
     TagTypeUL_t tagtype = GetHF14AMfU_Type();
-    if (tagtype == UL_ERROR) return -1;
+    if (tagtype == UL_ERROR)
+        return PM3_ESOFT;
 
     //get number of pages to read
-    if (!manualPages) {
+    if (manual_pages == false) {
         for (uint8_t idx = 0; idx < ARRAYLEN(UL_TYPES_ARRAY); idx++) {
             if (tagtype & UL_TYPES_ARRAY[idx]) {
                 //add one as maxblks starts at 0
@@ -1999,7 +1972,7 @@ static int CmdHF14AMfUDump(const char *Cmd) {
     ul_print_type(tagtype, 0);
     PrintAndLogEx(SUCCESS, "Reading tag memory...");
     uint8_t keytype = 0;
-    if (hasAuthKey) {
+    if (has_auth_key) {
         if (tagtype & UL_C)
             keytype = 1; //UL_C auth
         else
@@ -2007,34 +1980,38 @@ static int CmdHF14AMfUDump(const char *Cmd) {
     }
 
     clearCommandBuffer();
-    SendCommandMIX(CMD_HF_MIFAREU_READCARD, startPage, pages, keytype, authKeyPtr, dataLen);
+    SendCommandMIX(CMD_HF_MIFAREU_READCARD, start_page, pages, keytype, authKeyPtr, ak_len);
 
     PacketResponseNG resp;
     if (!WaitForResponseTimeout(CMD_ACK, &resp, 2500)) {
         PrintAndLogEx(WARNING, "Command execute time-out");
-        return 1;
+        return PM3_ETIMEOUT;
     }
 
     if (resp.oldarg[0] != 1) {
         PrintAndLogEx(WARNING, "Failed dumping card");
-        return 1;
+        return PM3_ESOFT;
     }
 
+    // read all memory
+    uint8_t data[1024] = {0x00};
+    memset(data, 0x00, sizeof(data));
+
     uint32_t startindex = resp.oldarg[2];
-    uint32_t bufferSize = resp.oldarg[1];
-    if (bufferSize > sizeof(data)) {
+    uint32_t buffer_size = resp.oldarg[1];
+    if (buffer_size > sizeof(data)) {
         PrintAndLogEx(FAILED, "Data exceeded Buffer size!");
-        bufferSize = sizeof(data);
+        buffer_size = sizeof(data);
     }
 
-    if (!GetFromDevice(BIG_BUF, data, bufferSize, startindex, NULL, 0, NULL, 2500, false)) {
+    if (!GetFromDevice(BIG_BUF, data, buffer_size, startindex, NULL, 0, NULL, 2500, false)) {
         PrintAndLogEx(WARNING, "command execution time out");
-        return 1;
+        return PM3_ETIMEOUT;
     }
 
-    bool is_partial = (pages != bufferSize / 4);
+    bool is_partial = (pages != buffer_size / 4);
 
-    pages = bufferSize / 4;
+    pages = buffer_size / 4;
 
     iso14a_card_select_t card;
     mfu_dump_t dump_file_data;
@@ -2063,9 +2040,9 @@ static int CmdHF14AMfUDump(const char *Cmd) {
             memcpy(data + (pages * 4) - 4, get_pack, sizeof(get_pack));
         }
 
-        if (hasAuthKey) {
+        if (has_auth_key) {
             uint8_t dummy_pack[] = {0, 0};
-            ul_auth_select(&card, tagtype, hasAuthKey, authKeyPtr, dummy_pack, sizeof(dummy_pack));
+            ul_auth_select(&card, tagtype, has_auth_key, authKeyPtr, dummy_pack, sizeof(dummy_pack));
         } else {
             ul_select(&card);
         }
@@ -2083,17 +2060,17 @@ static int CmdHF14AMfUDump(const char *Cmd) {
         // NTAG can have nfc counter pwd protection enabled
         for (; n < 3; n++) {
 
-            if (hasAuthKey) {
+            if (has_auth_key) {
                 uint8_t dummy_pack[] = {0, 0};
-                ul_auth_select(&card, tagtype, hasAuthKey, authKeyPtr, dummy_pack, sizeof(dummy_pack));
+                ul_auth_select(&card, tagtype, has_auth_key, authKeyPtr, dummy_pack, sizeof(dummy_pack));
             } else {
                 ul_select(&card);
             }
             ulev1_readCounter(n, &get_counter_tearing[n][0], 3);
 
-            if (hasAuthKey) {
+            if (has_auth_key) {
                 uint8_t dummy_pack[] = {0, 0};
-                ul_auth_select(&card, tagtype, hasAuthKey, authKeyPtr, dummy_pack, sizeof(dummy_pack));
+                ul_auth_select(&card, tagtype, has_auth_key, authKeyPtr, dummy_pack, sizeof(dummy_pack));
             } else {
                 ul_select(&card);
             }
@@ -2102,9 +2079,9 @@ static int CmdHF14AMfUDump(const char *Cmd) {
 
         DropField();
 
-        if (hasAuthKey) {
+        if (has_auth_key) {
             uint8_t dummy_pack[] = {0, 0};
-            ul_auth_select(&card, tagtype, hasAuthKey, authKeyPtr, dummy_pack, sizeof(dummy_pack));
+            ul_auth_select(&card, tagtype, has_auth_key, authKeyPtr, dummy_pack, sizeof(dummy_pack));
         } else
             ul_select(&card);
 
@@ -2114,21 +2091,21 @@ static int CmdHF14AMfUDump(const char *Cmd) {
 
     // format and add keys to block dump output
     // only add keys if not partial read, and complete pages read
-    if (!is_partial && pages == card_mem_size && hasAuthKey) {
+    if (!is_partial && pages == card_mem_size && has_auth_key) {
         // if we didn't swapendian before - do it now for the sprint_hex call
         // NOTE: default entry is bigendian (unless swapped), sprint_hex outputs little endian
         //       need to swap to keep it the same
-        if (!swapEndian) {
-            authKeyPtr = SwapEndian64(authenticationkey, dataLen, (dataLen == 16) ? 8 : 4);
+        if (swap_endian == false) {
+            authKeyPtr = SwapEndian64(authenticationkey, ak_len, (ak_len == 16) ? 8 : 4);
         } else {
             authKeyPtr = authenticationkey;
         }
 
         if (tagtype & UL_C) { //add 4 pages
-            memcpy(data + pages * 4, authKeyPtr, dataLen);
-            pages += dataLen / 4;
+            memcpy(data + pages * 4, authKeyPtr, ak_len);
+            pages += ak_len / 4;
         } else { // 2nd page from end
-            memcpy(data + (pages * 4) - 8, authenticationkey, dataLen);
+            memcpy(data + (pages * 4) - 8, authenticationkey, ak_len);
         }
     }
 
@@ -2140,17 +2117,17 @@ static int CmdHF14AMfUDump(const char *Cmd) {
     memcpy(dump_file_data.counter_tearing, get_counter_tearing, sizeof(dump_file_data.counter_tearing));
     memcpy(dump_file_data.data, data, pages * 4);
 
-    printMFUdumpEx(&dump_file_data, pages, startPage);
+    printMFUdumpEx(&dump_file_data, pages, start_page);
 
     // user supplied filename?
-    if (fileNameLen < 1) {
+    if (fnlen < 1) {
 
         PrintAndLogEx(INFO, "Using UID as filename");
         uint8_t uid[7] = {0};
         memcpy(uid, (uint8_t *)&dump_file_data.data, 3);
         memcpy(uid + 3, (uint8_t *)&dump_file_data.data + 4, 4);
-        fptr += sprintf(fptr, "hf-mfu-");
-        FillFileNameByUID(fptr, uid, "-dump", sizeof(uid));
+        strcat(filename, "hf-mfu-");
+        FillFileNameByUID(filename, uid, "-dump", sizeof(uid));
     }
     uint16_t datalen = pages * 4 + MFU_DUMP_PREFIX_LENGTH;
     saveFile(filename, ".bin", (uint8_t *)&dump_file_data, datalen);
@@ -2159,7 +2136,7 @@ static int CmdHF14AMfUDump(const char *Cmd) {
     if (is_partial)
         PrintAndLogEx(WARNING, "Partial dump created. (%d of %d blocks)", pages, card_mem_size);
 
-    return 0;
+    return PM3_SUCCESS;
 }
 
 static void wait4response(uint8_t b) {

From 483707a45ac05ad162705f3022ec6a3e4b09dbd3 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Wed, 30 Dec 2020 00:00:39 +0100
Subject: [PATCH 249/682] Moved vscode instructions

---
 .../Linux-Installation-Instructions.md        | 27 +------
 .../VSCode-Installation-Instructions.md       | 72 +++++++++++++++++++
 .../Windows-Installation-Instructions.md      | 48 -------------
 3 files changed, 73 insertions(+), 74 deletions(-)
 create mode 100644 doc/md/Installation_Instructions/VSCode-Installation-Instructions.md

diff --git a/doc/md/Installation_Instructions/Linux-Installation-Instructions.md b/doc/md/Installation_Instructions/Linux-Installation-Instructions.md
index aa5cf9042..18164398a 100644
--- a/doc/md/Installation_Instructions/Linux-Installation-Instructions.md
+++ b/doc/md/Installation_Instructions/Linux-Installation-Instructions.md
@@ -25,16 +25,13 @@ Install the requirements
 
 ```sh
 sudo apt-get install --no-install-recommends git ca-certificates build-essential pkg-config \
-libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev \
-binutils-arm-none-eabi gdb openocd gdb-multiarch
+libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev
 ```
 
 If you don't need the native Bluetooth support in the client, you can skip the installation of `libbluetooth-dev`.
 
 If you don't need the graphical components of the Proxmark3 client (such as in `hw tune`), you can skip the installation of `qtbase5-dev`.
 
-If you don't need the debugging packages, you can skip the installation of `binutils-arm-none-eabi`,`gdb`,`openocd` and `gdb-multiarch`.
-
 If you get some (non blocking) error at runtime such as _Gtk-Message: Failed to load module "canberra-gtk-module"_ you may have to install `libcanberra-gtk-module`.
 
 ## On ArchLinux
@@ -115,25 +112,3 @@ It must return `ok`. Otherwise this means you've got a permission problem to fix
 # Compile and use the project
 
 Now you're ready to follow the [compilation instructions](/doc/md/Use_of_Proxmark/0_Compilation-Instructions.md).
-
-
-## (Optional) Visual Studio Code debugging
-
-Download and install [Visual Studio Code](https://code.visualstudio.com/) 
-
-Download and install [J-Link Software and Documentation pack](https://www.segger.com/downloads/jlink) 
-
-On some systems `arm-none-eabi-gdb` was replaced with `gdb-multiarch`. In order to use the J-Link debugger you need to link `arm-none-eabi-gdb` to `gdb-multiarch`:
-```sh
-ln -s /usr/bin/gdb-multiarch /usr/bin/arm-none-eabi-gdb
-```
-
-Setup the Visual Studio Code configuration, by going into your project folder and run:
-```sh
-./.vscode/setup.sh
-```
-
-now launch Visual Studio Code and open your project folder
-
-_note_
-Please install the recommended Visual Studio Code extensions in order for debugging to work.
diff --git a/doc/md/Installation_Instructions/VSCode-Installation-Instructions.md b/doc/md/Installation_Instructions/VSCode-Installation-Instructions.md
new file mode 100644
index 000000000..079f301f6
--- /dev/null
+++ b/doc/md/Installation_Instructions/VSCode-Installation-Instructions.md
@@ -0,0 +1,72 @@
+# Visual Studio Code for debugging
+
+Download and install [Visual Studio Code](https://code.visualstudio.com/) 
+
+Download and install [J-Link Software and Documentation pack](https://www.segger.com/downloads/jlink) 
+
+
+## Debian / Ubuntu / Kali / ParrotOS / Raspbian
+
+Install dependencies
+
+```sh
+sudo apt-get install --no-install-recommends binutils-arm-none-eabi gdb openocd gdb-multiarch
+```
+
+On some systems `arm-none-eabi-gdb` was replaced with `gdb-multiarch`. In order to use the J-Link debugger you need to link `arm-none-eabi-gdb` to `gdb-multiarch`:
+```sh
+ln -s /usr/bin/gdb-multiarch /usr/bin/arm-none-eabi-gdb
+```
+
+Setup the Visual Studio Code configuration, by going into your project folder and run:
+```sh
+./.vscode/setup.sh
+```
+
+now launch Visual Studio Code and open your project folder
+
+
+## Windows: WSL
+
+Enter WSL prompt (`wsl` or `start windows terminal`)
+
+Install dependencies
+```sh
+sudo apt-get install --no-install-recommends binutils-arm-none-eabi gdb openocd gdb-multiarch
+```
+
+The J-Link debugger requires `arm-none-eabi-gdb` which was replaced with `gdb-multiarch`. In order to use the J-Link debugger link `arm-none-eabi-gdb` to `gdb-multiarch`:
+```sh
+sudo ln -s /usr/bin/gdb-multiarch /usr/bin/arm-none-eabi-gdb
+```
+
+Setup the Visual Studio Code configuration, by going into your project folder and run:
+```sh
+./.vscode/setup.sh
+```
+
+and launch Visual Studio Code
+```sh
+code .
+```
+
+
+## Windows: ProxSpace
+
+Download and install [Visual Studio Code](https://code.visualstudio.com/) 
+
+Download and install [J-Link Software and Documentation pack for Windows](https://www.segger.com/downloads/jlink/JLink_Windows.exe) 
+
+Enter PorxSpace (`runme64.bat`)  and enter your project folder.
+
+Setup the Visual Studio Code configuration, by running:
+```sh
+./.vscode/setup.sh
+```
+
+now launch Visual Studio Code and open your project folder
+
+
+
+_note_
+Please install the recommended Visual Studio Code extensions in order for debugging to work.
\ No newline at end of file
diff --git a/doc/md/Installation_Instructions/Windows-Installation-Instructions.md b/doc/md/Installation_Instructions/Windows-Installation-Instructions.md
index 80f5b4d5c..6000f42f2 100644
--- a/doc/md/Installation_Instructions/Windows-Installation-Instructions.md
+++ b/doc/md/Installation_Instructions/Windows-Installation-Instructions.md
@@ -64,24 +64,6 @@ To use the compiled client, the only differences are that executables end with `
 
 Now you're ready to follow the [compilation instructions](/doc/md/Use_of_Proxmark/0_Compilation-Instructions.md).
 
-## (Optional) Visual Studio Code debugging
-
-Download and install [Visual Studio Code](https://code.visualstudio.com/) 
-
-Download and install [J-Link Software and Documentation pack for Windows](https://www.segger.com/downloads/jlink/JLink_Windows.exe) 
-
-Enter PorxSpace (`runme64.bat`)  and enter your project folder.
-
-Setup the Visual Studio Code configuration, by running:
-```sh
-./.vscode/setup.sh
-```
-
-now launch Visual Studio Code and open your project folder
-
-_note_
-Please install the recommended Visual Studio Code extensions in order for debugging to work.
-
 # Installing on Windows with WSL 1
 
 WSL 1 requires to run on Windows 10 version 1709 or above. Previous windows versions didn't have support for COM ports.
@@ -167,33 +149,3 @@ Note that it may take a quite long time for a freshly plugged Proxmark3 to be vi
 
 Now you're ready to follow the [compilation instructions](/doc/md/Use_of_Proxmark/0_Compilation-Instructions.md).
 
-
-## (Optional) Visual Studio Code debugging
-
-Download and install [Visual Studio Code](https://code.visualstudio.com/) 
-
-Download and install [J-Link Software and Documentation pack for Windows](https://www.segger.com/downloads/jlink/JLink_Windows.exe) 
-
-Enter WSL prompt (`wsl` or `start windows terminal`)  and from there, follow the [Linux Installation Instructions](/doc/md/Installation_Instructions/Linux-Installation-Instructions.md) for Ubuntu, summarized here below:
-
-Install dependencies
-```sh
-sudo apt-get install --no-install-recommends binutils-arm-none-eabi gdb openocd gdb-multiarch
-```
-
-The J-Link debugger requires `arm-none-eabi-gdb` which was replaced with `gdb-multiarch`. In order to use the J-Link debugger link `arm-none-eabi-gdb` to `gdb-multiarch`:
-```sh
-sudo ln -s /usr/bin/gdb-multiarch /usr/bin/arm-none-eabi-gdb
-```
-
-Setup the Visual Studio Code configuration, by going into your project folder and run:
-```sh
-./.vscode/setup.sh
-```
-
-and launch Visual Studio Code
-```sh
-code .
-```
-_note_
-Please install the recommended Visual Studio Code extensions in order for debugging to work.

From f4c632bd313172ea7620f565f8ae048d3dbb262e Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Wed, 30 Dec 2020 00:19:21 +0100
Subject: [PATCH 250/682] Added DEBUG_ARM flag

---
 .vscode/tasks.json      | 2 +-
 Makefile.defs           | 5 +++++
 common_arm/Makefile.hal | 2 +-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/.vscode/tasks.json b/.vscode/tasks.json
index 463377982..67f0f235e 100644
--- a/.vscode/tasks.json
+++ b/.vscode/tasks.json
@@ -71,7 +71,7 @@
         },{
             "label": "fullimage: clean & make debug",
             "type": "shell",
-            "command": "make armsrc/clean && make armsrc/all SKIP_COMPRESSION=1 DEBUG=1",
+            "command": "make armsrc/clean && make armsrc/all DEBUG_ARM=1",
             "problemMatcher": [
                 "$gcc"
             ],
diff --git a/Makefile.defs b/Makefile.defs
index 48567214b..b86b477aa 100644
--- a/Makefile.defs
+++ b/Makefile.defs
@@ -66,6 +66,11 @@ else
   DEFCFLAGS = -Wall -Werror -O3 -fstrict-aliasing -pipe
   DEFLDFLAGS =
 endif
+
+ifeq ($(DEBUG_ARM),1)
+  APP_CFLAGS += -g
+  SKIP_COMPRESSION=1
+endif
 # Next ones are activated only if SANITIZE=1
 ifeq ($(SANITIZE),1)
   DEFCFLAGS += -g -fsanitize=address -fno-omit-frame-pointer
diff --git a/common_arm/Makefile.hal b/common_arm/Makefile.hal
index b6519e4ab..bfbe56d34 100644
--- a/common_arm/Makefile.hal
+++ b/common_arm/Makefile.hal
@@ -138,7 +138,7 @@ ifneq ($(SKIP_HFPLOT),1)
     PLATFORM_DEFS += -DWITH_HFPLOT
 endif
 ifeq ($(SKIP_COMPRESSION),1)
-    PLATFORM_DEFS += -DWITH_NO_COMPRESSION -g
+    PLATFORM_DEFS += -DWITH_NO_COMPRESSION
 endif
 
 # Standalone mode

From e3710bbdddb4121497d7df30c1816caeb6ee3b90 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Wed, 30 Dec 2020 01:13:17 +0100
Subject: [PATCH 251/682] update doc

---
 doc/md/Development/Makefile-vs-CMake.md | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/doc/md/Development/Makefile-vs-CMake.md b/doc/md/Development/Makefile-vs-CMake.md
index 6fa95066c..1a7a0ddb5 100644
--- a/doc/md/Development/Makefile-vs-CMake.md
+++ b/doc/md/Development/Makefile-vs-CMake.md
@@ -15,6 +15,7 @@ At the moment both are maintained because they don't perfectly overlap yet.
 |-----|---|---|---|
 | verbose | `V=1` | `VERBOSE=1` |   |
 | debug build | `DEBUG=1` | `-DCMAKE_BUILD_TYPE=Debug` | client only |
+| ARM debug build | `DEBUG_ARM=1` | **no** | for use with JLink and VSCode |
 | warnings management | yes (1) | **no** | (1) cf Makefile.defs |
 | extra GCC warnings | GCCEXTRA=1 | **no** |   |
 | extra Clang warnings | CLANGEXTRA=1 | **no** | only on host |
@@ -83,7 +84,13 @@ At the moment both are maintained because they don't perfectly overlap yet.
 
 `makefile` only at the moment
 
-`PLATFORM`, `PLATFORM_EXTRAS`, `DESTDIR`, `PREFIX`, `FWTAG`
+Supposedly via `Makefile.platform`:
+
+`PLATFORM`, `PLATFORM_SIZE`, `PLATFORM_EXTRAS`, `SKIP_*`, `STANDALONE`
+
+Other:
+
+`DESTDIR`, `PREFIX`, `FWTAG`
 
 ## Global
 

From 0f833018254edf1bfba08ba68df0f9e030f713ae Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Wed, 30 Dec 2020 01:30:30 +0100
Subject: [PATCH 252/682] update doc

---
 doc/md/Development/Makefile-vs-CMake.md | 32 ++++++++++++++++++-------
 1 file changed, 23 insertions(+), 9 deletions(-)

diff --git a/doc/md/Development/Makefile-vs-CMake.md b/doc/md/Development/Makefile-vs-CMake.md
index 1a7a0ddb5..675ba0e96 100644
--- a/doc/md/Development/Makefile-vs-CMake.md
+++ b/doc/md/Development/Makefile-vs-CMake.md
@@ -15,11 +15,10 @@ At the moment both are maintained because they don't perfectly overlap yet.
 |-----|---|---|---|
 | verbose | `V=1` | `VERBOSE=1` |   |
 | debug build | `DEBUG=1` | `-DCMAKE_BUILD_TYPE=Debug` | client only |
-| ARM debug build | `DEBUG_ARM=1` | **no** | for use with JLink and VSCode |
 | warnings management | yes (1) | **no** | (1) cf Makefile.defs |
-| extra GCC warnings | GCCEXTRA=1 | **no** |   |
-| extra Clang warnings | CLANGEXTRA=1 | **no** | only on host |
-| AddressSanitize | SANITIZE=1 | **no** | only on host |
+| extra GCC warnings | `GCCEXTRA=1` | **no** |   |
+| extra Clang warnings | `CLANGEXTRA=1` | **no** | only on host |
+| AddressSanitize | `SANITIZE=1` | **no** | only on host |
 | compilation | in place | in build dir | |
 | user `CFLAGS`/`LDFLAGS` | envvars honored (1) | envvars honored (2) | (1) also `LDLIBS` and `INCLUDES_CLIENT` for more tuning (2) only at first cmake call |
 | Mingw gnu printf | `_ISOC99_SOURCE` | `_ISOC99_SOURCE` | and in cbor.h: `__attribute__((format (__MINGW_PRINTF_FORMAT, 2, 3)))`|
@@ -78,19 +77,34 @@ At the moment both are maintained because they don't perfectly overlap yet.
 
 `makefile` only at the moment
 
-`SKIPGPU`
+| Feature | Makefile | Remarks |
+|-----|---|---|
+| Skip GPU-dependent code | `SKIPGPU=1` | to skip ht2crack5gpu tool when compiling the hitag2crack toolsuite |
 
 ## ARM
 
 `makefile` only at the moment
 
-Supposedly via `Makefile.platform`:
+### Features to be used via `Makefile.platform`:
 
-`PLATFORM`, `PLATFORM_SIZE`, `PLATFORM_EXTRAS`, `SKIP_*`, `STANDALONE`
+`SKIP_*`, `STANDALONE`
 
-Other:
+| Feature | Makefile | Remarks |
+|-----|---|---|
+| Platform choice | `PLATFORM=` | values: `PM3RDV4`, `PM3OTHER` |
+| Platform size | `PLATFORM_SIZE=` | values: `256`, `512` |
+| Platform extras | `PLATFORM_EXTRAS=` | values: `BTADDON`, `FPC_USART_DEV` |
+| Skip LF/HF techs in the firmware | `SKIP_`*`=1` | see `common_arm/Makefile.hal` for a list |
+| Standalone mode choice | `STANDALONE=` | see `doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md` for a list |
 
-`DESTDIR`, `PREFIX`, `FWTAG`
+### Other features:
+
+| Feature | Makefile | Remarks |
+|-----|---|---|
+| ARM debug build | `DEBUG_ARM=1` | to be used with JLink and VSCode |
+| Install dest dir | `DESTDIR=` | for maintainers |
+| Install prefix dir | `PREFIX=` | for maintainers |
+| Tag firmware image | `FWTAG=` | for maintainers |
 
 ## Global
 

From a0e110941a502bc2135f53b1883c655ba117c331 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Wed, 30 Dec 2020 01:31:40 +0100
Subject: [PATCH 253/682] make style

---
 armsrc/appmain.c                    |  4 +--
 armsrc/start.c                      | 12 ++++-----
 client/luascripts/hf_mfu_setuid.lua | 10 ++++----
 client/src/cmdhfmfu.c               | 40 ++++++++++++++---------------
 doc/commands.md                     |  4 +--
 5 files changed, 35 insertions(+), 35 deletions(-)

diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index b4c3d6a30..480a8632b 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -314,9 +314,9 @@ static void SendVersion(void) {
     struct p payload;
     payload.id = *(AT91C_DBGU_CIDR);
 #ifdef WITH_NO_COMPRESSION
-	payload.section_size = (uint32_t)&_bootrom_end - (uint32_t)&_bootrom_start + (uint32_t)&__os_size__;
+    payload.section_size = (uint32_t)&_bootrom_end - (uint32_t)&_bootrom_start + (uint32_t)&__os_size__;
 #else
-	payload.section_size = text_and_rodata_section_size + compressed_data_section_size;
+    payload.section_size = text_and_rodata_section_size + compressed_data_section_size;
 #endif
     payload.versionstr_len = strlen(VersionString) + 1;
     memcpy(payload.versionstr, VersionString, payload.versionstr_len);
diff --git a/armsrc/start.c b/armsrc/start.c
index 542b9f3f4..011742447 100644
--- a/armsrc/start.c
+++ b/armsrc/start.c
@@ -50,23 +50,23 @@ void Vector(void) {
         common_area.version = 1;
     }
     common_area.flags.osimage_present = 1;
-	
+
 #ifdef WITH_NO_COMPRESSION
-	/* Set up data segment: Copy from flash to ram */
+    /* Set up data segment: Copy from flash to ram */
     char *src = &__data_src_start__;
     char *dst = &__data_start__;
     char *end = &__data_end__;
-    while(dst < end) *dst++ = *src++;
-	dst = &__bss_start__;
+    while (dst < end) *dst++ = *src++;
+    dst = &__bss_start__;
     end = &__bss_end__;
 #else
-	uncompress_data_section();
+    uncompress_data_section();
 
     /* Set up (that is: clear) BSS. */
     char *dst = &__bss_start__;
     char *end = &__bss_end__;
 #endif
-    
+
     while (dst < end) *dst++ = 0;
 
     AppMain();
diff --git a/client/luascripts/hf_mfu_setuid.lua b/client/luascripts/hf_mfu_setuid.lua
index f64d5cfab..921563ed6 100644
--- a/client/luascripts/hf_mfu_setuid.lua
+++ b/client/luascripts/hf_mfu_setuid.lua
@@ -73,7 +73,7 @@ end
 --- Set UID on magic command enabled
 function magicUID(b0, b1, b2,  isgen1a)
 
-    if isgen1a then 
+    if isgen1a then
         print('Using backdoor Magic tag (gen1a) function')
     else
         print('Using backdoor Magic tag (gen1b) function')
@@ -81,21 +81,21 @@ function magicUID(b0, b1, b2,  isgen1a)
 
     -- write block 0
     core.console('hf 14a raw -k -a -b 7 40')
-    if isgen1a then 
+    if isgen1a then
         core.console('hf 14a raw -k -a 43')
     end
     core.console('hf 14a raw -c -a A200'..b0)
 
     -- write block 1
     core.console('hf 14a raw -k -a -b 7 40')
-    if isgen1a then 
+    if isgen1a then
         core.console('hf 14a raw -k -a 43')
     end
     core.console('hf 14a raw -c -a A201'..b1)
 
     -- write block 2
     core.console('hf 14a raw -k -a -b 7 40')
-    if isgen1a then 
+    if isgen1a then
         core.console('hf 14a raw -k -a 43')
     end
     core.console('hf 14a raw -c -a A202'..b2)
@@ -154,7 +154,7 @@ function main(args)
 
     core.clearCommandBuffer()
 
-    if tagtype == 3 then        
+    if tagtype == 3 then
         brickableUID(block0, block1, block2)
     else
         local is_gen1a = (tagtype == 1)
diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index 2c89cdf73..2a32e0a8d 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -675,10 +675,10 @@ int ul_print_type(uint32_t tagtype, uint8_t spaces) {
     if (ismagic)
         snprintf(typestr + strlen(typestr), 4, " (");
 
-    snprintf(typestr + strlen(typestr) , sizeof(typestr) - strlen(typestr), " %s ", (tagtype & MAGIC) ?  _GREEN_("magic") : "");
+    snprintf(typestr + strlen(typestr), sizeof(typestr) - strlen(typestr), " %s ", (tagtype & MAGIC) ?  _GREEN_("magic") : "");
     tagtype ^= MAGIC;
-    snprintf(typestr + strlen(typestr) , sizeof(typestr) - strlen(typestr), "%s", (tagtype & MAGIC_1A) ? _GREEN_("Gen 1a") : "");
-    snprintf(typestr + strlen(typestr) , sizeof(typestr) - strlen(typestr), "%s", (tagtype & MAGIC_1B) ? _GREEN_("Gen 1b") : "");
+    snprintf(typestr + strlen(typestr), sizeof(typestr) - strlen(typestr), "%s", (tagtype & MAGIC_1A) ? _GREEN_("Gen 1a") : "");
+    snprintf(typestr + strlen(typestr), sizeof(typestr) - strlen(typestr), "%s", (tagtype & MAGIC_1B) ? _GREEN_("Gen 1b") : "");
 
     if (ismagic)
         snprintf(typestr + strlen(typestr), 4, " )");
@@ -840,9 +840,9 @@ static int ulev1_print_counters(void) {
         if (len == 3) {
             PrintAndLogEx(INFO, "       [%0d]: %s", i, sprint_hex(counter, 3));
             PrintAndLogEx(SUCCESS, "            - %02X tearing (%s)"
-                    , tear[0]
-                    , (tear[0] == 0xBD) ? _GREEN_("ok") : _RED_("fail")
-                    );
+                          , tear[0]
+                          , (tear[0] == 0xBD) ? _GREEN_("ok") : _RED_("fail")
+                         );
         }
     }
     return len;
@@ -938,7 +938,7 @@ static int ulev1_print_signature(TagTypeUL_t tagtype, uint8_t *uid, uint8_t *sig
     PrintAndLogEx(INFO, "IC signature public key value: %s", nxp_mfu_public_keys[i].value);
     PrintAndLogEx(INFO, "    Elliptic curve parameters: NID_secp128r1");
     PrintAndLogEx(INFO, "             TAG IC Signature: %s", sprint_hex_inrow(signature, signature_len));
-    PrintAndLogEx(SUCCESS, "       Signature verification (" _GREEN_("successful") ")" );
+    PrintAndLogEx(SUCCESS, "       Signature verification (" _GREEN_("successful") ")");
     return PM3_SUCCESS;
 }
 
@@ -969,9 +969,9 @@ static int ntag_print_counter(void) {
     (void)len;
     PrintAndLogEx(INFO, "       [02]: %s", sprint_hex(counter, 3));
     PrintAndLogEx(SUCCESS, "            - %02X tearing (%s)"
-                    , tear[0]
-                    , (tear[0] == 0xBD) ? _GREEN_("ok") : _RED_("fail")
-                    );
+                  , tear[0]
+                  , (tear[0] == 0xBD) ? _GREEN_("ok") : _RED_("fail")
+                 );
     return len;
 }
 
@@ -1513,7 +1513,7 @@ static int CmdHF14AMfUWrBl(const char *Cmd) {
                  );
 
     void *argtable[] = {
-        arg_param_begin,        
+        arg_param_begin,
         arg_str0("k", "key", "<hex>", "key for authentication (UL-C 16 bytes, EV1/NTAG 4 bytes)"),
         arg_lit0("l", NULL,           "swap entered key's endianness"),
         arg_int1("b", "block", "<dec>", "block number to write"),
@@ -1540,7 +1540,7 @@ static int CmdHF14AMfUWrBl(const char *Cmd) {
         has_auth_key = true;
     } else if (ak_len == 4) {
         has_pwd = true;
-    } else if (ak_len != 0){
+    } else if (ak_len != 0) {
         PrintAndLogEx(WARNING, "ERROR: Key is incorrect length\n");
         return PM3_EINVARG;
     }
@@ -1559,7 +1559,7 @@ static int CmdHF14AMfUWrBl(const char *Cmd) {
 
     // starting with getting tagtype
     TagTypeUL_t tagtype = GetHF14AMfU_Type();
-    if (tagtype == UL_ERROR) 
+    if (tagtype == UL_ERROR)
         return PM3_ESOFT;
 
     uint8_t maxblockno = 0;
@@ -1576,7 +1576,7 @@ static int CmdHF14AMfUWrBl(const char *Cmd) {
 
     // Swap endianness
     if (swap_endian) {
-        if (has_auth_key) 
+        if (has_auth_key)
             authKeyPtr = SwapEndian64(authenticationkey, 16, 8);
 
         if (has_pwd)
@@ -1591,7 +1591,7 @@ static int CmdHF14AMfUWrBl(const char *Cmd) {
     if (ak_len) {
         PrintAndLogEx(INFO, "Using %s " _GREEN_("%s"), (ak_len == 16) ? "3des" : "pwd", sprint_hex(authenticationkey, ak_len));
     }
-    
+
     //Send write Block
 
     // 4 or 16.
@@ -1643,7 +1643,7 @@ static int CmdHF14AMfURdBl(const char *Cmd) {
                  );
 
     void *argtable[] = {
-        arg_param_begin,        
+        arg_param_begin,
         arg_str0("k", "key", "<hex>", "key for authentication (UL-C 16 bytes, EV1/NTAG 4 bytes)"),
         arg_lit0("l", NULL,           "swap entered key's endianness"),
         arg_int1("b", "block", "<dec>", "block number to write"),
@@ -1664,7 +1664,7 @@ static int CmdHF14AMfURdBl(const char *Cmd) {
         has_auth_key = true;
     } else if (ak_len == 4) {
         has_pwd = true;
-    } else if (ak_len != 0){
+    } else if (ak_len != 0) {
         PrintAndLogEx(WARNING, "ERROR: Key is incorrect length\n");
         return PM3_EINVARG;
     }
@@ -1704,7 +1704,7 @@ static int CmdHF14AMfURdBl(const char *Cmd) {
 
     if (ak_len) {
         PrintAndLogEx(INFO, "Using %s " _GREEN_("%s"), (ak_len == 16) ? "3des" : "pwd", sprint_hex(authenticationkey, ak_len));
-    }    
+    }
 
     //Read Block
     uint8_t keytype = 0;
@@ -1932,13 +1932,13 @@ static int CmdHF14AMfUDump(const char *Cmd) {
         has_auth_key = true;
     } else if (ak_len == 4) {
         has_pwd = true;
-    } else if (ak_len != 0){
+    } else if (ak_len != 0) {
         PrintAndLogEx(WARNING, "ERROR: Key is incorrect length\n");
         return PM3_EINVARG;
     }
 
     bool manual_pages = false;
-    if ( start_page > 0)
+    if (start_page > 0)
         manual_pages = true;
 
     if (pages != 16)
diff --git a/doc/commands.md b/doc/commands.md
index e1e445296..991f4a590 100644
--- a/doc/commands.md
+++ b/doc/commands.md
@@ -198,8 +198,8 @@ Check column "offline" for their availability.
 |command                  |offline |description
 |-------                  |------- |-----------
 |`hf epa help            `|Y       |`This help`
-|`hf epa cnonces         `|N       |`<m> <n> <d> Acquire n>0 encrypted PACE nonces of size m>0 with d sec pauses`
-|`hf epa preplay         `|N       |`<mse> <get> <map> <pka> <ma> Perform PACE protocol by replaying given APDUs`
+|`hf epa cnonces         `|N       |`Acquire encrypted PACE nonces of specific size`
+|`hf epa preplay         `|N       |`Perform PACE protocol by replaying given APDUs`
 
 
 ### hf emrtd

From b0f122528df093c2df5dd9dccb2ce3a1988dc069 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Wed, 30 Dec 2020 01:36:44 +0100
Subject: [PATCH 254/682] minor

---
 armsrc/start.c | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/armsrc/start.c b/armsrc/start.c
index 011742447..062a83eb9 100644
--- a/armsrc/start.c
+++ b/armsrc/start.c
@@ -51,23 +51,20 @@ void Vector(void) {
     }
     common_area.flags.osimage_present = 1;
 
-#ifdef WITH_NO_COMPRESSION
     /* Set up data segment: Copy from flash to ram */
-    char *src = &__data_src_start__;
-    char *dst = &__data_start__;
-    char *end = &__data_end__;
-    while (dst < end) *dst++ = *src++;
-    dst = &__bss_start__;
-    end = &__bss_end__;
+#ifdef WITH_NO_COMPRESSION
+    char *data_src = &__data_src_start__;
+    char *data_dst = &__data_start__;
+    char *data_end = &__data_end__;
+    while (data_dst < data_end) *data_dst++ = *data_src++;
 #else
     uncompress_data_section();
-
-    /* Set up (that is: clear) BSS. */
-    char *dst = &__bss_start__;
-    char *end = &__bss_end__;
 #endif
 
-    while (dst < end) *dst++ = 0;
+    /* Set up (that is: clear) BSS. */
+    char *bss_dst = &__bss_start__;
+    char *bss_end = &__bss_end__;
+    while (bss_dst < bss_end) *bss_dst++ = 0;
 
     AppMain();
 }

From 49990ab11d01f1758e3723a6b0f74ee5a9ebc0ad Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Tue, 29 Dec 2020 20:58:13 -0500
Subject: [PATCH 255/682] hf 14a cuids, sim - now use cliparser

---
 client/luascripts/hf_mf_uidbruteforce.lua |   4 +-
 client/src/cmdhf14a.c                     | 177 ++++++++++------------
 client/src/cmdhfst.c                      |   2 +-
 doc/cliparser_todo.txt                    |   2 -
 doc/commands.md                           |   4 +-
 tools/pm3_amii_bin2eml.pl                 |   4 +-
 6 files changed, 87 insertions(+), 106 deletions(-)

diff --git a/client/luascripts/hf_mf_uidbruteforce.lua b/client/luascripts/hf_mf_uidbruteforce.lua
index fc85b63bb..548898606 100644
--- a/client/luascripts/hf_mf_uidbruteforce.lua
+++ b/client/luascripts/hf_mf_uidbruteforce.lua
@@ -99,10 +99,10 @@ local function main(args)
     local command = ''
 
     if mftype == 'mfc' then
-        command = 'hf 14a sim t 1 u %014x'
+        command = 'hf 14a sim -t 1 -u %014x'
         msg('Bruteforcing Mifare Classic card numbers')
     elseif mftype == 'mfu' then
-        command = 'hf 14a sim t 2 u %014x'
+        command = 'hf 14a sim -t 2 -u %014x'
         msg('Bruteforcing Mifare Ultralight card numbers')
     else
         return print(usage)
diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index 3cee04ecf..8a6ce45ef 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -209,34 +209,6 @@ static int usage_hf_14a_config(void) {
     return PM3_SUCCESS;
 }
 
-static int usage_hf_14a_sim(void) {
-    PrintAndLogEx(NORMAL, "\n Emulating ISO/IEC 14443 type A tag with 4,7 or 10 byte UID\n");
-    PrintAndLogEx(NORMAL, "Usage: hf 14a sim [h] t <type> u <uid> [n <numreads>] [x] [e] [v]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "    h     : This help");
-    PrintAndLogEx(NORMAL, "    t     : 1 = MIFARE Classic 1k");
-    PrintAndLogEx(NORMAL, "            2 = MIFARE Ultralight");
-    PrintAndLogEx(NORMAL, "            3 = MIFARE Desfire");
-    PrintAndLogEx(NORMAL, "            4 = ISO/IEC 14443-4");
-    PrintAndLogEx(NORMAL, "            5 = MIFARE Tnp3xxx");
-    PrintAndLogEx(NORMAL, "            6 = MIFARE Mini");
-    PrintAndLogEx(NORMAL, "            7 = AMIIBO (NTAG 215),  pack 0x8080");
-    PrintAndLogEx(NORMAL, "            8 = MIFARE Classic 4k");
-    PrintAndLogEx(NORMAL, "            9 = FM11RF005SH Shanghai Metro");
-    PrintAndLogEx(NORMAL, "           10 = JCOP 31/41 Rothult");
-    PrintAndLogEx(NORMAL, "    u     : 4, 7 or 10 byte UID");
-    PrintAndLogEx(NORMAL, "    n     : (Optional) Exit simulation after <numreads> blocks have been read by reader. 0 = infinite");
-    PrintAndLogEx(NORMAL, "    x     : (Optional) Performs the 'reader attack', nr/ar attack against a reader");
-    PrintAndLogEx(NORMAL, "    e     : (Optional) Fill simulator keys from found keys");
-    PrintAndLogEx(NORMAL, "    v     : (Optional) Verbose");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a sim t 1 u 11223344 x"));
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a sim t 1 u 11223344"));
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a sim t 1 u 11223344556677"));
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a sim t 1 u 112233445566778899AA"));
-    return PM3_SUCCESS;
-}
-
 static int CmdHF14AList(const char *Cmd) {
     char args[128] = {0};
     if (strlen(Cmd) == 0) {
@@ -595,10 +567,23 @@ static int CmdHF14AInfo(const char *Cmd) {
 
 // Collect ISO14443 Type A UIDs
 static int CmdHF14ACUIDs(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf 14a cuids",
+                  "Collect n>0 ISO14443-a UIDs in one go",
+                  "hf 14a cuids -n 5 <-- Collect 5 UIDs");
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_int0("n", "num", "<dec>", "Number of UIDs to collect"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
     // requested number of UIDs
-    int n = atoi(Cmd);
     // collect at least 1 (e.g. if no parameter was given)
-    n = n > 0 ? n : 1;
+    int n = arg_get_int_def(ctx, 1, 1);
+
+    CLIParserFree(ctx);
 
     uint64_t t1 =  msclock();
     PrintAndLogEx(SUCCESS, "collecting %d UIDs", n);
@@ -633,83 +618,81 @@ static int CmdHF14ACUIDs(const char *Cmd) {
     PrintAndLogEx(SUCCESS, "end: %" PRIu64 " seconds", (msclock() - t1) / 1000);
     return 1;
 }
+
 // ## simulate iso14443a tag
 int CmdHF14ASim(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf 14a sim",
+                  "Simulate ISO/IEC 14443 type A tag with 4,7 or 10 byte UID",
+                  "hf 14a sim -t 1 --uid 11223344      -> MIFARE Classic 1k\n"
+                  "hf 14a sim -t 2                     -> MIFARE Ultralight\n"
+                  "hf 14a sim -t 3                     -> MIFARE Desfire\n"
+                  "hf 14a sim -t 4                     -> ISO/IEC 14443-4\n"
+                  "hf 14a sim -t 5                     -> MIFARE Tnp3xxx\n"
+                  "hf 14a sim -t 6                     -> MIFARE Mini\n"
+                  "hf 14a sim -t 7                     -> AMIIBO (NTAG 215),  pack 0x8080\n"
+                  "hf 14a sim -t 8                     -> MIFARE Classic 4k\n"
+                  "hf 14a sim -t 9                     -> FM11RF005SH Shanghai Metro\n"
+                  "hf 14a sim -t 10                    -> ST25TA IKEA Rothult\n");
 
-    int uidlen = 0;
-    uint8_t flags = 0, tagtype = 1, cmdp = 0;
-    uint8_t uid[10] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+    void *argtable[] = {
+        arg_param_begin,
+        arg_int1("t", "type", "<1-10> ", "Simulation type to use"),
+        arg_str0("u", "uid", "<hex>", "4, 7 or 10 byte UID"),
+        arg_int0("n", "num", "<dec>", "Exit simulation after <numreads> blocks have been read by reader. 0 = infinite"),
+        arg_lit0(NULL, "nr", "Performs the 'reader attack', nr/ar attack against a reader"),
+        arg_lit0(NULL, "sk", "Fill simulator keys from found keys"),
+        arg_lit0("v", "verbose", "verbose output"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+
+    int tagtype = arg_get_int(ctx, 1);
+
+    int uid_len = 0;
+    uint8_t uid[10] = {0};
+    CLIGetHexWithReturn(ctx, 2, uid, &uid_len);
+
+    uint8_t flags = 0;
     bool useUIDfromEML = true;
-    bool setEmulatorMem = false;
-    bool verbose = false;
-    bool errors = false;
-    sector_t *k_sector = NULL;
-    uint8_t k_sectorsCount = 40;
-    uint8_t exitAfterNReads = 0;
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_hf_14a_sim();
-            case 't':
-                // Retrieve the tag type
-                tagtype = param_get8ex(Cmd, cmdp + 1, 0, 10);
-                if (tagtype == 0)
-                    errors = true;
-                cmdp += 2;
+    if (uid_len > 0) {
+        switch (uid_len) {
+            case 10:
+                flags |= FLAG_10B_UID_IN_DATA;
                 break;
-            case 'u':
-                // Retrieve the full 4,7,10 byte long uid
-                param_gethex_ex(Cmd, cmdp + 1, uid, &uidlen);
-                uidlen >>= 1;
-                switch (uidlen) {
-                    case 10:
-                        flags |= FLAG_10B_UID_IN_DATA;
-                        break;
-                    case 7:
-                        flags |= FLAG_7B_UID_IN_DATA;
-                        break;
-                    case 4:
-                        flags |= FLAG_4B_UID_IN_DATA;
-                        break;
-                    default:
-                        errors = true;
-                        break;
-                }
-                if (!errors) {
-                    PrintAndLogEx(SUCCESS, "Emulating " _YELLOW_("ISO/IEC 14443 type A tag")" with " _GREEN_("%d byte UID (%s)"), uidlen, sprint_hex(uid, uidlen));
-                    useUIDfromEML = false;
-                }
-                cmdp += 2;
+            case 7:
+                flags |= FLAG_7B_UID_IN_DATA;
                 break;
-            case 'n':
-                exitAfterNReads = param_get8(Cmd, cmdp + 1);
-                cmdp += 2;
-                break;
-            case 'v':
-                verbose = true;
-                cmdp++;
-                break;
-            case 'x':
-                flags |= FLAG_NR_AR_ATTACK;
-                cmdp++;
-                break;
-            case 'e':
-                setEmulatorMem = true;
-                cmdp++;
+            case 4:
+                flags |= FLAG_4B_UID_IN_DATA;
                 break;
             default:
-                PrintAndLogEx(WARNING, "Unknown parameter " _RED_("'%c'"), param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
+                PrintAndLogEx(ERR, "Please specify a 4, 7, or 10 byte UID");
+                CLIParserFree(ctx);
+                return PM3_EINVARG;
         }
+        PrintAndLogEx(SUCCESS, "Emulating " _YELLOW_("ISO/IEC 14443 type A tag")" with " _GREEN_("%d byte UID (%s)"), uid_len, sprint_hex(uid, uid_len));
+        useUIDfromEML = false;
     }
 
-    //Validations
-    if (errors || cmdp == 0) return usage_hf_14a_sim();
+    uint8_t exitAfterNReads = arg_get_int(ctx, 3);
 
-    if (useUIDfromEML)
+    if (arg_get_lit(ctx, 4)) {
+        flags |= FLAG_NR_AR_ATTACK;
+    }
+
+    bool setEmulatorMem = arg_get_lit(ctx, 5);
+    bool verbose = arg_get_lit(ctx, 6);
+
+    CLIParserFree(ctx);
+
+    sector_t *k_sector = NULL;
+    uint8_t k_sectorsCount = 40;
+
+    if (useUIDfromEML) {
         flags |= FLAG_UID_IN_EMUL;
+    }
 
     struct {
         uint8_t tagtype;
@@ -721,7 +704,7 @@ int CmdHF14ASim(const char *Cmd) {
     payload.tagtype = tagtype;
     payload.flags = flags;
     payload.exitAfter = exitAfterNReads;
-    memcpy(payload.uid, uid, uidlen);
+    memcpy(payload.uid, uid, uid_len);
 
     clearCommandBuffer();
     SendCommandNG(CMD_HF_ISO14443A_SIMULATE, (uint8_t *)&payload, sizeof(payload));
@@ -2327,11 +2310,11 @@ out:
 
 static command_t CommandTable[] = {
     {"help",        CmdHelp,              AlwaysAvailable, "This help"},
-    {"list",        CmdHF14AList,         AlwaysAvailable,  "List ISO 14443-a history"},
+    {"list",        CmdHF14AList,         AlwaysAvailable, "List ISO 14443-a history"},
     {"info",        CmdHF14AInfo,         IfPm3Iso14443a,  "Tag information"},
     {"reader",      CmdHF14AReader,       IfPm3Iso14443a,  "Act like an ISO14443-a reader"},
-    {"cuids",       CmdHF14ACUIDs,        IfPm3Iso14443a,  "<n> Collect n>0 ISO14443-a UIDs in one go"},
-    {"sim",         CmdHF14ASim,          IfPm3Iso14443a,  "<UID> -- Simulate ISO 14443-a tag"},
+    {"cuids",       CmdHF14ACUIDs,        IfPm3Iso14443a,  "Collect n>0 ISO14443-a UIDs in one go"},
+    {"sim",         CmdHF14ASim,          IfPm3Iso14443a,  "Simulate ISO 14443-a tag"},
     {"sniff",       CmdHF14ASniff,        IfPm3Iso14443a,  "sniff ISO 14443-a traffic"},
     {"apdu",        CmdHF14AAPDU,         IfPm3Iso14443a,  "Send ISO 14443-4 APDU to tag"},
     {"chaining",    CmdHF14AChaining,     IfPm3Iso14443a,  "Control ISO 14443-4 input chaining"},
diff --git a/client/src/cmdhfst.c b/client/src/cmdhfst.c
index 89633de8a..5fc151cc0 100644
--- a/client/src/cmdhfst.c
+++ b/client/src/cmdhfst.c
@@ -351,7 +351,7 @@ static int cmd_hf_st_sim(const char *Cmd) {
     }
 
     char param[40];
-    snprintf(param, sizeof(param), "t 10 u %s", sprint_hex_inrow(uid, uidlen));
+    snprintf(param, sizeof(param), "-t 10 -u %s", sprint_hex_inrow(uid, uidlen));
     return CmdHF14ASim(param);
 }
 
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index c9dcf077c..0a5e5c77e 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -41,8 +41,6 @@ data print
 data samples
 data setdebugmode
 data tune
-hf 14a cuids
-hf 14a sim
 hf 14a config
 hf 14b sriwrite
 hf 15 dump
diff --git a/doc/commands.md b/doc/commands.md
index 991f4a590..f10e7a2bf 100644
--- a/doc/commands.md
+++ b/doc/commands.md
@@ -134,8 +134,8 @@ Check column "offline" for their availability.
 |`hf 14a list            `|Y       |`List ISO 14443-a history`
 |`hf 14a info            `|N       |`Tag information`
 |`hf 14a reader          `|N       |`Act like an ISO14443-a reader`
-|`hf 14a cuids           `|N       |`<n> Collect n>0 ISO14443-a UIDs in one go`
-|`hf 14a sim             `|N       |`<UID> -- Simulate ISO 14443-a tag`
+|`hf 14a cuids           `|N       |`Collect n>0 ISO14443-a UIDs in one go`
+|`hf 14a sim             `|N       |`Simulate ISO 14443-a tag`
 |`hf 14a sniff           `|N       |`sniff ISO 14443-a traffic`
 |`hf 14a apdu            `|N       |`Send ISO 14443-4 APDU to tag`
 |`hf 14a chaining        `|N       |`Control ISO 14443-4 input chaining`
diff --git a/tools/pm3_amii_bin2eml.pl b/tools/pm3_amii_bin2eml.pl
index 35c95e8e4..c8e8d4f46 100755
--- a/tools/pm3_amii_bin2eml.pl
+++ b/tools/pm3_amii_bin2eml.pl
@@ -7,7 +7,7 @@
 # -samy kamkar 05/28/2017
 #
 # hf mf eload u FILENAME_MINUS_EML
-# hf 14a sim t 7 u UID
+# hf 14a sim -t 7 -u UID
 
 # perl -lne 'chomp; s/\s+(\S+)$//;$f=$1;if($f=~s/-(\S+)//){$g=hex($1);}else{$g=hex($f)}$f=hex($f); for$m($f..$g){print "0x" . substr(unpack("H4",pack("n",$m)),1) ." => \"$_\","}' /tmp/game  >> game2
 # perl -lne 'if(/^(\S.*?)\s+\w?\w\w\w\w(\s*-\s*\w?\w\w\w\w)?\s*$/){$l=$1} s/(\w{4,5}\s*-\s*)?(\w{4,5})$//; $a=$1;$b=$2; $b=hex($b); $a=$a?hex($a):$b; for$m($a..$b){print "0x" . substr(unpack("H4",pack("n",$m)),0) ." => \"$l\","}' /tmp/g2
@@ -685,7 +685,7 @@ $uid = uc $uid;
 #print STDERR "amiitool -d -k ../client/amiitool/key_retail.bin -i $input -o $input.decrypted\n";
 $input =~ s/\....$//;
 print STDERR "hf mf eload u $input\n";
-print STDERR "hf 14a sim t 7 u $uid\n";
+print STDERR "hf 14a sim -t 7 -u $uid\n";
 
 
 __DATA__

From 714470877af87f8be0870d8b141ef762692e1310 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Tue, 29 Dec 2020 21:12:11 -0500
Subject: [PATCH 256/682] lf em 410x - textual

---
 client/src/cmdlfem410x.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdlfem410x.c b/client/src/cmdlfem410x.c
index c8b11a9db..c2ee95a9d 100644
--- a/client/src/cmdlfem410x.c
+++ b/client/src/cmdlfem410x.c
@@ -585,8 +585,8 @@ static int CmdEM410xClone(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "lf em 410x clone",
                   "Writes EM410x ID to a T55x7 or Q5/T5555 tag",
-                  "lf em 410x clone --id 0F0368568B        -> write id to T55x7 tag\n"
-                  "lf em 410x clone --id 0F0368568B --q5   -> write id to Q5/T5555 tag"
+                  "lf em 410x clone --uid 0F0368568B        -> write id to T55x7 tag\n"
+                  "lf em 410x clone --uid 0F0368568B --q5   -> write id to Q5/T5555 tag"
                  );
 
     void *argtable[] = {

From 2679ea098091957713fce12a510a6b43d0b4db7d Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Wed, 30 Dec 2020 05:50:25 +0300
Subject: [PATCH 257/682] emrtd info: Split EF_SOD into a separate section
 (only on offline)

---
 client/src/cmdhfemrtd.c | 66 ++++++++++++++++++++++++++---------------
 1 file changed, 42 insertions(+), 24 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 670ea804d..0a98c58b9 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1689,8 +1689,8 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     }
 
     // Grab the hash list
-    uint8_t dg_hashes[16][64];
-    uint8_t hash_out[64];
+    uint8_t dg_hashes_sod[17][64] = { 0x00 };
+    uint8_t dg_hashes_calc[17][64] = { 0x00 };
     int hash_algo = 0;
 
     if (!emrtd_select_and_read(response, &resplen, dg_table[EF_SOD].fileid, ks_enc, ks_mac, ssc, BAC, use_14b)) {
@@ -1699,7 +1699,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         return PM3_ESOFT;
     }
 
-    res = emrtd_parse_ef_sod_hashes(response, resplen, *dg_hashes, &hash_algo);
+    res = emrtd_parse_ef_sod_hashes(response, resplen, *dg_hashes_sod, &hash_algo);
     if (res != PM3_SUCCESS) {
         PrintAndLogEx(ERR, "Failed to read hash list from EF_SOD. Hash checks will fail.");
     }
@@ -1719,15 +1719,9 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
                 PrintAndLogEx(DEBUG, "EF_DG%i hash algo: %i", dg->dgnum, hash_algo);
                 // Check file hash
                 if (hash_algo != -1) {
-                    PrintAndLogEx(DEBUG, "EF_DG%i hash on EF_SOD: %s", dg->dgnum, sprint_hex_inrow(dg_hashes[dg->dgnum], hashalg_table[hash_algo].hashlen));
-                    hashalg_table[hash_algo].hasher(response, resplen, hash_out);
-                    PrintAndLogEx(DEBUG, "EF_DG%i hash calc: %s", dg->dgnum, sprint_hex_inrow(hash_out, hashalg_table[hash_algo].hashlen));
-
-                    if (memcmp(dg_hashes[dg->dgnum], hash_out, hashalg_table[hash_algo].hashlen) == 0) {
-                        PrintAndLogEx(SUCCESS, _GREEN_("Hash verification passed for EF_DG%i."), dg->dgnum);
-                    } else {
-                        PrintAndLogEx(ERR, _RED_("Hash verification failed for EF_DG%i."), dg->dgnum);
-                    }
+                    PrintAndLogEx(DEBUG, "EF_DG%i hash on EF_SOD: %s", dg->dgnum, sprint_hex_inrow(dg_hashes_sod[dg->dgnum], hashalg_table[hash_algo].hashlen));
+                    hashalg_table[hash_algo].hasher(response, resplen, dg_hashes_calc[dg->dgnum]);
+                    PrintAndLogEx(DEBUG, "EF_DG%i hash calc: %s", dg->dgnum, sprint_hex_inrow(dg_hashes_calc[dg->dgnum], hashalg_table[hash_algo].hashlen));
                 }
             }
         }
@@ -1771,8 +1765,8 @@ int infoHF_EMRTD_offline(const char *path) {
     free(data);
 
     // Grab the hash list
-    uint8_t dg_hashes[16][64];
-    uint8_t hash_out[64];
+    uint8_t dg_hashes_sod[17][64] = { 0x00 };
+    uint8_t dg_hashes_calc[17][64] = { 0x00 };
     int hash_algo = 0;
 
     strcpy(filepath, path);
@@ -1785,7 +1779,7 @@ int infoHF_EMRTD_offline(const char *path) {
         return PM3_ESOFT;
     }
 
-    res = emrtd_parse_ef_sod_hashes(data, datalen, *dg_hashes, &hash_algo);
+    res = emrtd_parse_ef_sod_hashes(data, datalen, *dg_hashes_sod, &hash_algo);
     if (res != PM3_SUCCESS) {
         PrintAndLogEx(ERR, "Failed to read hash list from EF_SOD. Hash checks will fail.");
     }
@@ -1810,21 +1804,45 @@ int infoHF_EMRTD_offline(const char *path) {
                 PrintAndLogEx(DEBUG, "EF_DG%i hash algo: %i", dg->dgnum, hash_algo);
                 // Check file hash
                 if (hash_algo != -1) {
-                    PrintAndLogEx(DEBUG, "EF_DG%i hash on EF_SOD: %s", dg->dgnum, sprint_hex_inrow(dg_hashes[dg->dgnum], hashalg_table[hash_algo].hashlen));
-                    hashalg_table[hash_algo].hasher(data, datalen, hash_out);
-                    PrintAndLogEx(DEBUG, "EF_DG%i hash calc: %s", dg->dgnum, sprint_hex_inrow(hash_out, hashalg_table[hash_algo].hashlen));
-
-                    if (memcmp(dg_hashes[dg->dgnum], hash_out, hashalg_table[hash_algo].hashlen) == 0) {
-                        PrintAndLogEx(SUCCESS, _GREEN_("Hash verification passed for EF_DG%i."), dg->dgnum);
-                    } else {
-                        PrintAndLogEx(ERR, _RED_("Hash verification failed for EF_DG%i."), dg->dgnum);
-                    }
+                    PrintAndLogEx(DEBUG, "EF_DG%i hash on EF_SOD: %s", dg->dgnum, sprint_hex_inrow(dg_hashes_sod[dg->dgnum], hashalg_table[hash_algo].hashlen));
+                    hashalg_table[hash_algo].hasher(data, datalen, dg_hashes_calc[dg->dgnum]);
+                    PrintAndLogEx(DEBUG, "EF_DG%i hash calc: %s", dg->dgnum, sprint_hex_inrow(dg_hashes_calc[dg->dgnum], hashalg_table[hash_algo].hashlen));
                 }
                 free(data);
             }
         }
     }
     free(filepath);
+
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_SOD") " --------------------");
+
+    if (hash_algo == -1) {
+        PrintAndLogEx(SUCCESS, "Hash algorithm: " _YELLOW_("Unknown"));
+    } else {
+        PrintAndLogEx(SUCCESS, "Hash algorithm: " _YELLOW_("%s"), hashalg_table[hash_algo].name);
+
+        uint8_t all_zeroes[64] = { 0x00 };
+        bool calc_all_zero, sod_all_zero, hash_matches;
+        for (int i = 1; i <= 16; i++) {
+            calc_all_zero = (memcmp(dg_hashes_calc[i], all_zeroes, hashalg_table[hash_algo].hashlen) == 0);
+            sod_all_zero = (memcmp(dg_hashes_sod[i], all_zeroes, hashalg_table[hash_algo].hashlen) == 0);
+            hash_matches = (memcmp(dg_hashes_sod[i], dg_hashes_calc[i], hashalg_table[hash_algo].hashlen) == 0);
+            // Ignore files we don't haven't read and lack hashes to
+            if (calc_all_zero == true && sod_all_zero == true) {
+                continue;
+            } else if (calc_all_zero == true) {
+                PrintAndLogEx(SUCCESS, "EF_DG%i: " _YELLOW_("File read access denied, but is in EF_SOD"), i);
+            } else if (sod_all_zero == true) {
+                PrintAndLogEx(SUCCESS, "EF_DG%i: " _YELLOW_("File not in EF_SOD"), i);
+            } else if (hash_matches == false) {
+                PrintAndLogEx(SUCCESS, "EF_DG%i: " _RED_("Invalid"), i);
+            } else {
+                PrintAndLogEx(SUCCESS, "EF_DG%i: " _GREEN_("Valid"), i);
+            }
+        }
+    }
+
     return PM3_SUCCESS;
 }
 

From 80f035f7ab0087acdcc330074c6cbfdb189b75c2 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Wed, 30 Dec 2020 05:57:11 +0300
Subject: [PATCH 258/682] emrtd info: Improve EF_SOD wording

---
 client/src/cmdhfemrtd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 0a98c58b9..72832b112 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1832,9 +1832,9 @@ int infoHF_EMRTD_offline(const char *path) {
             if (calc_all_zero == true && sod_all_zero == true) {
                 continue;
             } else if (calc_all_zero == true) {
-                PrintAndLogEx(SUCCESS, "EF_DG%i: " _YELLOW_("File read access denied, but is in EF_SOD"), i);
+                PrintAndLogEx(SUCCESS, "EF_DG%i: " _YELLOW_("File couldn't be read, but is in EF_SOD."), i);
             } else if (sod_all_zero == true) {
-                PrintAndLogEx(SUCCESS, "EF_DG%i: " _YELLOW_("File not in EF_SOD"), i);
+                PrintAndLogEx(SUCCESS, "EF_DG%i: " _YELLOW_("File is not in EF_SOD."), i);
             } else if (hash_matches == false) {
                 PrintAndLogEx(SUCCESS, "EF_DG%i: " _RED_("Invalid"), i);
             } else {

From 9f29a839a789842343a3ad0135f3f8c6f4c24708 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Wed, 30 Dec 2020 06:03:12 +0300
Subject: [PATCH 259/682] emrtd info: Move EF_SOD print to a func, also add to
 online

---
 client/src/cmdhfemrtd.c | 65 +++++++++++++++++++++++------------------
 1 file changed, 37 insertions(+), 28 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 72832b112..8789656a5 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1638,6 +1638,39 @@ static int emrtd_parse_ef_sod_hashes(uint8_t *data, size_t datalen, uint8_t *has
     return PM3_SUCCESS;
 }
 
+static int emrtd_print_ef_sod_info(uint8_t *dg_hashes_calc, uint8_t *dg_hashes_sod, int hash_algo) {
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_SOD") " --------------------");
+
+    if (hash_algo == -1) {
+        PrintAndLogEx(SUCCESS, "Hash algorithm: " _YELLOW_("Unknown"));
+    } else {
+        PrintAndLogEx(SUCCESS, "Hash algorithm: " _YELLOW_("%s"), hashalg_table[hash_algo].name);
+
+        uint8_t all_zeroes[64] = { 0x00 };
+        bool calc_all_zero, sod_all_zero, hash_matches;
+        for (int i = 1; i <= 16; i++) {
+            calc_all_zero = (memcmp(dg_hashes_calc + (i * 64), all_zeroes, hashalg_table[hash_algo].hashlen) == 0);
+            sod_all_zero = (memcmp(dg_hashes_sod + (i * 64), all_zeroes, hashalg_table[hash_algo].hashlen) == 0);
+            hash_matches = (memcmp(dg_hashes_sod + (i * 64), dg_hashes_calc + (i * 64), hashalg_table[hash_algo].hashlen) == 0);
+            // Ignore files we don't haven't read and lack hashes to
+            if (calc_all_zero == true && sod_all_zero == true) {
+                continue;
+            } else if (calc_all_zero == true) {
+                PrintAndLogEx(SUCCESS, "EF_DG%i: " _YELLOW_("File couldn't be read, but is in EF_SOD."), i);
+            } else if (sod_all_zero == true) {
+                PrintAndLogEx(SUCCESS, "EF_DG%i: " _YELLOW_("File is not in EF_SOD."), i);
+            } else if (hash_matches == false) {
+                PrintAndLogEx(SUCCESS, "EF_DG%i: " _RED_("Invalid"), i);
+            } else {
+                PrintAndLogEx(SUCCESS, "EF_DG%i: " _GREEN_("Valid"), i);
+            }
+        }
+    }
+
+    return PM3_SUCCESS;
+}
+
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available) {
     uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     int resplen = 0;
@@ -1727,6 +1760,9 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         }
     }
     DropField();
+
+    emrtd_print_ef_sod_info(*dg_hashes_calc, *dg_hashes_sod, hash_algo);
+
     return PM3_SUCCESS;
 }
 
@@ -1814,34 +1850,7 @@ int infoHF_EMRTD_offline(const char *path) {
     }
     free(filepath);
 
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(INFO, "-------------------- " _CYAN_("EF_SOD") " --------------------");
-
-    if (hash_algo == -1) {
-        PrintAndLogEx(SUCCESS, "Hash algorithm: " _YELLOW_("Unknown"));
-    } else {
-        PrintAndLogEx(SUCCESS, "Hash algorithm: " _YELLOW_("%s"), hashalg_table[hash_algo].name);
-
-        uint8_t all_zeroes[64] = { 0x00 };
-        bool calc_all_zero, sod_all_zero, hash_matches;
-        for (int i = 1; i <= 16; i++) {
-            calc_all_zero = (memcmp(dg_hashes_calc[i], all_zeroes, hashalg_table[hash_algo].hashlen) == 0);
-            sod_all_zero = (memcmp(dg_hashes_sod[i], all_zeroes, hashalg_table[hash_algo].hashlen) == 0);
-            hash_matches = (memcmp(dg_hashes_sod[i], dg_hashes_calc[i], hashalg_table[hash_algo].hashlen) == 0);
-            // Ignore files we don't haven't read and lack hashes to
-            if (calc_all_zero == true && sod_all_zero == true) {
-                continue;
-            } else if (calc_all_zero == true) {
-                PrintAndLogEx(SUCCESS, "EF_DG%i: " _YELLOW_("File couldn't be read, but is in EF_SOD."), i);
-            } else if (sod_all_zero == true) {
-                PrintAndLogEx(SUCCESS, "EF_DG%i: " _YELLOW_("File is not in EF_SOD."), i);
-            } else if (hash_matches == false) {
-                PrintAndLogEx(SUCCESS, "EF_DG%i: " _RED_("Invalid"), i);
-            } else {
-                PrintAndLogEx(SUCCESS, "EF_DG%i: " _GREEN_("Valid"), i);
-            }
-        }
-    }
+    emrtd_print_ef_sod_info(*dg_hashes_calc, *dg_hashes_sod, hash_algo);
 
     return PM3_SUCCESS;
 }

From 5d250339dd7a2d5c5c51b0ba7136ea66539cf300 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Wed, 30 Dec 2020 06:37:01 +0300
Subject: [PATCH 260/682] emrtd dump: Allow specifying a dump folder

---
 client/src/cmdhfemrtd.c | 101 ++++++++++++++++++++++++++++++++--------
 client/src/cmdhfemrtd.h |   4 +-
 2 files changed, 83 insertions(+), 22 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 670ea804d..1f9916041 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -50,10 +50,10 @@
 const uint8_t KENC_type[4] = {0x00, 0x00, 0x00, 0x01};
 const uint8_t KMAC_type[4] = {0x00, 0x00, 0x00, 0x02};
 
-static int emrtd_dump_ef_dg2(uint8_t *file_contents, size_t file_length);
-static int emrtd_dump_ef_dg5(uint8_t *file_contents, size_t file_length);
-static int emrtd_dump_ef_dg7(uint8_t *file_contents, size_t file_length);
-static int emrtd_dump_ef_sod(uint8_t *file_contents, size_t file_length);
+static int emrtd_dump_ef_dg2(uint8_t *file_contents, size_t file_length, const char *path);
+static int emrtd_dump_ef_dg5(uint8_t *file_contents, size_t file_length, const char *path);
+static int emrtd_dump_ef_dg7(uint8_t *file_contents, size_t file_length, const char *path);
+static int emrtd_dump_ef_sod(uint8_t *file_contents, size_t file_length, const char *path);
 static int emrtd_print_ef_com_info(uint8_t *data, size_t datalen);
 static int emrtd_print_ef_dg1_info(uint8_t *data, size_t datalen);
 static int emrtd_print_ef_dg11_info(uint8_t *data, size_t datalen);
@@ -710,7 +710,7 @@ static bool emrtd_select_and_read(uint8_t *dataout, int *dataoutlen, const char
 const uint8_t jpeg_header[4] = { 0xFF, 0xD8, 0xFF, 0xE0 };
 const uint8_t jpeg2k_header[6] = { 0x00, 0x00, 0x00, 0x0C, 0x6A, 0x50 };
 
-static int emrtd_dump_ef_dg2(uint8_t *file_contents, size_t file_length) {
+static int emrtd_dump_ef_dg2(uint8_t *file_contents, size_t file_length, const char *path) {
     int offset, datalen = 0;
 
     // This is a hacky impl that just looks for the image header. I'll improve it eventually.
@@ -730,11 +730,20 @@ static int emrtd_dump_ef_dg2(uint8_t *file_contents, size_t file_length) {
         return PM3_ESOFT;
     }
 
-    saveFile(dg_table[EF_DG2].filename, file_contents[offset] == 0xFF ? ".jpg" : ".jp2", file_contents + offset, datalen);
+    char *filepath = calloc(strlen(path) + 100, sizeof(char));
+    if (filepath == NULL)
+        return PM3_EMALLOC;
+    strcpy(filepath, path);
+    strncat(filepath, PATHSEP, 2);
+    strcat(filepath, dg_table[EF_DG2].filename);
+
+    saveFile(filepath, file_contents[offset] == 0xFF ? ".jpg" : ".jp2", file_contents + offset, datalen);
+
+    free(filepath);
     return PM3_SUCCESS;
 }
 
-static int emrtd_dump_ef_dg5(uint8_t *file_contents, size_t file_length) {
+static int emrtd_dump_ef_dg5(uint8_t *file_contents, size_t file_length, const char *path) {
     uint8_t data[EMRTD_MAX_FILE_SIZE];
     size_t datalen = 0;
 
@@ -744,7 +753,16 @@ static int emrtd_dump_ef_dg5(uint8_t *file_contents, size_t file_length) {
     }
 
     if (datalen < EMRTD_MAX_FILE_SIZE) {
-        saveFile(dg_table[EF_DG5].filename, data[0] == 0xFF ? ".jpg" : ".jp2", data, datalen);
+        char *filepath = calloc(strlen(path) + 100, sizeof(char));
+        if (filepath == NULL)
+            return PM3_EMALLOC;
+        strcpy(filepath, path);
+        strncat(filepath, PATHSEP, 2);
+        strcat(filepath, dg_table[EF_DG5].filename);
+
+        saveFile(filepath, data[0] == 0xFF ? ".jpg" : ".jp2", data, datalen);
+
+        free(filepath);
     } else {
         PrintAndLogEx(ERR, "error (emrtd_dump_ef_dg5) datalen out-of-bounds");
         return PM3_ESOFT;
@@ -752,7 +770,7 @@ static int emrtd_dump_ef_dg5(uint8_t *file_contents, size_t file_length) {
     return PM3_SUCCESS;
 }
 
-static int emrtd_dump_ef_dg7(uint8_t *file_contents, size_t file_length) {
+static int emrtd_dump_ef_dg7(uint8_t *file_contents, size_t file_length, const char *path) {
     uint8_t data[EMRTD_MAX_FILE_SIZE];
     size_t datalen = 0;
 
@@ -762,7 +780,16 @@ static int emrtd_dump_ef_dg7(uint8_t *file_contents, size_t file_length) {
     }
 
     if (datalen < EMRTD_MAX_FILE_SIZE) {
-        saveFile(dg_table[EF_DG7].filename, data[0] == 0xFF ? ".jpg" : ".jp2", data, datalen);
+        char *filepath = calloc(strlen(path) + 100, sizeof(char));
+        if (filepath == NULL)
+            return PM3_EMALLOC;
+        strcpy(filepath, path);
+        strncat(filepath, PATHSEP, 2);
+        strcat(filepath, dg_table[EF_DG7].filename);
+
+        saveFile(filepath, data[0] == 0xFF ? ".jpg" : ".jp2", data, datalen);
+
+        free(filepath);
     } else {
         PrintAndLogEx(ERR, "error (emrtd_dump_ef_dg7) datalen out-of-bounds");
         return PM3_ESOFT;
@@ -770,7 +797,7 @@ static int emrtd_dump_ef_dg7(uint8_t *file_contents, size_t file_length) {
     return PM3_SUCCESS;
 }
 
-static int emrtd_dump_ef_sod(uint8_t *file_contents, size_t file_length) {
+static int emrtd_dump_ef_sod(uint8_t *file_contents, size_t file_length, const char *path) {
     int fieldlen = emrtd_get_asn1_field_length(file_contents, file_length, 1);
     int datalen = emrtd_get_asn1_data_length(file_contents, file_length, 1);
 
@@ -779,11 +806,19 @@ static int emrtd_dump_ef_sod(uint8_t *file_contents, size_t file_length) {
         return PM3_SUCCESS;
     }
 
-    saveFile(dg_table[EF_SOD].filename, ".p7b", file_contents + fieldlen + 1, datalen);
+    char *filepath = calloc(strlen(path) + 100, sizeof(char));
+    if (filepath == NULL)
+        return PM3_EMALLOC;
+    strcpy(filepath, path);
+    strncat(filepath, PATHSEP, 2);
+    strcat(filepath, dg_table[EF_SOD].filename);
+
+    saveFile(filepath, ".p7b", file_contents + fieldlen + 1, datalen);
+    free(filepath);
     return PM3_ESOFT;
 }
 
-static bool emrtd_dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, const char *file, const char *name, bool use_secure, bool use_14b) {
+static bool emrtd_dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, const char *file, const char *name, bool use_secure, bool use_14b, const char *path) {
     uint8_t response[EMRTD_MAX_FILE_SIZE];
     int resplen = 0;
 
@@ -791,13 +826,22 @@ static bool emrtd_dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, cons
         return false;
     }
 
+    char *filepath = calloc(strlen(path) + 100, sizeof(char));
+    if (filepath == NULL)
+        return PM3_EMALLOC;
+    strcpy(filepath, path);
+    strncat(filepath, PATHSEP, 2);
+    strcat(filepath, name);
+
     PrintAndLogEx(INFO, "Read %s, len: %i.", name, resplen);
     PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
-    saveFile(name, ".BIN", response, resplen);
+    saveFile(filepath, ".BIN", response, resplen);
     emrtd_dg_t *dg = emrtd_fileid_to_dg(file);
     if ((dg != NULL) && (dg->dumper != NULL)) {
-        dg->dumper(response, resplen);
+        dg->dumper(response, resplen, path);
     }
+
+    free(filepath);
     return true;
 }
 
@@ -983,7 +1027,7 @@ static bool emrtd_do_auth(char *documentnumber, char *dob, char *expiry, bool BA
     return true;
 }
 
-int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available) {
+int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available, const char *path) {
     uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     int resplen = 0;
     uint8_t ssc[8] = { 0x00 };
@@ -999,7 +1043,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     }
 
     // Dump EF_CardAccess (if available)
-    if (!emrtd_dump_file(ks_enc, ks_mac, ssc, dg_table[EF_CardAccess].fileid, dg_table[EF_CardAccess].filename, BAC, use_14b)) {
+    if (!emrtd_dump_file(ks_enc, ks_mac, ssc, dg_table[EF_CardAccess].fileid, dg_table[EF_CardAccess].filename, BAC, use_14b, path)) {
         PrintAndLogEx(INFO, "Couldn't dump EF_CardAccess, card does not support PACE.");
         PrintAndLogEx(HINT, "This is expected behavior for cards without PACE, and isn't something to be worried about.");
     }
@@ -1016,9 +1060,20 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         DropField();
         return PM3_ESOFT;
     }
+
+
+    char *filepath = calloc(strlen(path) + 100, sizeof(char));
+    if (filepath == NULL)
+        return PM3_EMALLOC;
+    strcpy(filepath, path);
+    strncat(filepath, PATHSEP, 2);
+    strcat(filepath, dg_table[EF_COM].filename);
+
     PrintAndLogEx(INFO, "Read EF_COM, len: %i.", resplen);
     PrintAndLogEx(DEBUG, "Contents (may be incomplete over 2k chars): %s", sprint_hex_inrow(response, resplen));
-    saveFile(dg_table[EF_COM].filename, ".BIN", response, resplen);
+    saveFile(filepath, ".BIN", response, resplen);
+
+    free(filepath);
 
     uint8_t filelist[50];
     size_t filelistlen = 0;
@@ -1041,7 +1096,7 @@ int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         }
         PrintAndLogEx(DEBUG, "Current file: %s", dg->filename);
         if (!dg->pace && !dg->eac) {
-            emrtd_dump_file(ks_enc, ks_mac, ssc, dg->fileid, dg->filename, BAC, use_14b);
+            emrtd_dump_file(ks_enc, ks_mac, ssc, dg->fileid, dg->filename, BAC, use_14b, path);
         }
     }
     DropField();
@@ -1864,6 +1919,7 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
         arg_str0("d", "dateofbirth", "<YYMMDD>", "date of birth in YYMMDD format"),
         arg_str0("e", "expiry", "<YYMMDD>", "expiry in YYMMDD format"),
         arg_str0("m", "mrz", "<[0-9A-Z<]>", "2nd line of MRZ, 44 chars"),
+        arg_str0(NULL, "path", "<dirpath>", "save dump to the given dirpath"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
@@ -1930,11 +1986,16 @@ static int cmd_hf_emrtd_dump(const char *Cmd) {
         }
     }
 
+    uint8_t path[FILENAME_MAX] = { 0x00 };
+    if (CLIParamStrToBuf(arg_get_str(ctx, 5), path, sizeof(path), &slen) != 0 || slen == 0) {
+        path[0] = '.';
+    }
+
     CLIParserFree(ctx);
     if (error) {
         return PM3_ESOFT;
     }
-    return dumpHF_EMRTD((char *)docnum, (char *)dob, (char *)expiry, BAC);
+    return dumpHF_EMRTD((char *)docnum, (char *)dob, (char *)expiry, BAC, (const char *)path);
 }
 
 static int cmd_hf_emrtd_info(const char *Cmd) {
diff --git a/client/src/cmdhfemrtd.h b/client/src/cmdhfemrtd.h
index f7bd64945..bb32fb53d 100644
--- a/client/src/cmdhfemrtd.h
+++ b/client/src/cmdhfemrtd.h
@@ -24,7 +24,7 @@ typedef struct emrtd_dg_s {
     bool required; // some are required only if PACE
     bool fastdump; // fast to dump
     int (*parser)(uint8_t *data, size_t datalen);
-    int (*dumper)(uint8_t *data, size_t datalen);
+    int (*dumper)(uint8_t *data, size_t datalen, const char *path);
 } emrtd_dg_t;
 
 typedef struct emrtd_hashalg_s {
@@ -37,7 +37,7 @@ typedef struct emrtd_hashalg_s {
 
 int CmdHFeMRTD(const char *Cmd);
 
-int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available);
+int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available, const char *path);
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available);
 int infoHF_EMRTD_offline(const char *path);
 #endif

From 037fd47673156a2ef780e1b347bdb612eb04b4e8 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 30 Dec 2020 18:57:30 +0100
Subject: [PATCH 261/682] fix #1151 - improved feedback text

---
 client/src/fileutils.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/fileutils.c b/client/src/fileutils.c
index f7ccf1516..4d607b9df 100644
--- a/client/src/fileutils.c
+++ b/client/src/fileutils.c
@@ -735,7 +735,7 @@ int createMfcKeyDump(const char *preferredName, uint8_t sectorsCnt, sector_t *e_
     fflush(f);
     fclose(f);
     PrintAndLogEx(SUCCESS, "Found keys have been dumped to " _YELLOW_("%s"), fileName);
-    PrintAndLogEx(INFO, " OBS! --> 0xFFFFFFFFFFFF <-- has been inserted for unknown keys.");
+    PrintAndLogEx(INFO, "FYI! --> " _YELLOW_("0xFFFFFFFFFFFF") " <-- has been inserted for unknown keys where " _YELLOW_("res") " is " _YELLOW_("0"));
     free(fileName);
     return PM3_SUCCESS;
 }

From 49f684c31adb42228da2c45f1edcb717d6e75562 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 30 Dec 2020 18:58:04 +0100
Subject: [PATCH 262/682] add noralsy/vigik entry

---
 client/resources/mad.json | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/client/resources/mad.json b/client/resources/mad.json
index d5c413d73..c63190cda 100644
--- a/client/resources/mad.json
+++ b/client/resources/mad.json
@@ -6096,6 +6096,13 @@
         "service_provider": "CDVI",
         "system_integrator": "CDVI"
     },
+    {
+        "application": "(access control and security) VIGIK",
+        "company": "NORALSY",
+        "mad": "0x4980",
+        "service_provider": "NORALSY",
+        "system_integrator": "NORALSY"
+    },
     {
         "application": "Card Administratin, cardholder adminstration, access control & security, company services, miscellaneous applications",
         "company": "Ministry of Defense",

From cdbd4d7d1e2e8d259119278b4f3501709af32147 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 30 Dec 2020 19:16:37 +0100
Subject: [PATCH 263/682] hf mf mad - deals with user supplied keys in a
 different order now

---
 client/src/cmdhfmf.c | 35 ++++++++++++++++++++++++++---------
 1 file changed, 26 insertions(+), 9 deletions(-)

diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index 481a5ce14..8cf0f4e1a 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -4869,28 +4869,45 @@ static int CmdHF14AMfMAD(const char *Cmd) {
     CLIExecWithReturn(ctx, Cmd, argtable, true);
     bool verbose = arg_get_lit(ctx, 1);
     uint8_t aid[2] = {0};
-    int aidlen;
+    int aidlen = 0;
     CLIGetHexWithReturn(ctx, 2, aid, &aidlen);
-    uint8_t key[6] = {0};
-    int keylen;
-    CLIGetHexWithReturn(ctx, 3, key, &keylen);
+    uint8_t userkey[6] = {0};
+    int keylen = 0;
+    CLIGetHexWithReturn(ctx, 3, userkey, &keylen);
     bool keyB = arg_get_lit(ctx, 4);
     bool swapmad = arg_get_lit(ctx, 5);
     bool decodeholder = arg_get_lit(ctx, 6);
 
     CLIParserFree(ctx);
 
-    if (aidlen != 2 && !decodeholder && keylen > 0) {
-        PrintAndLogEx(WARNING, "Using default MAD keys instead");
-    }
-
     uint8_t sector0[16 * 4] = {0};
     uint8_t sector10[16 * 4] = {0};
+
+    bool got_first = true;
     if (mfReadSector(MF_MAD1_SECTOR, MF_KEY_A, (uint8_t *)g_mifare_mad_key, sector0)) {
         PrintAndLogEx(ERR, "error, read sector 0. card don't have MAD or don't have MAD on default keys");
+        got_first = false;
+    }
+
+    // User supplied key
+    if (got_first == false && keylen == 6) {
+        if (mfReadSector(MF_MAD1_SECTOR, MF_KEY_A, userkey, sector0)) {
+        PrintAndLogEx(ERR, "error, read sector 0. card don't have MAD or don't the custom key is wrong");
+        } else {
+            got_first = true;
+        }
+    }
+
+    // Both default and user supplied key failed
+    if (got_first == false) {
         return PM3_ESOFT;
     }
 
+//    if (aidlen != 2 && !decodeholder) {
+//        PrintAndLogEx(WARNING, "Using default MAD keys instead");
+
+
+
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "--- " _CYAN_("MIFARE App Directory Information") " ----------------");
     PrintAndLogEx(INFO, "-----------------------------------------------------");
@@ -4921,7 +4938,7 @@ static int CmdHF14AMfMAD(const char *Cmd) {
 
         // user specified key
         if (keylen == 6) {
-            memcpy(akey, key, 6);
+            memcpy(akey, userkey, 6);
         }
 
         uint16_t aaid = 0x0004;

From c3ea0c83ada42c0533b4060d81031f4980ff4ec3 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 30 Dec 2020 22:05:28 +0100
Subject: [PATCH 264/682] hf mf mad - text

---
 client/src/cmdhfmf.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index 8cf0f4e1a..e9b87add6 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -4884,16 +4884,20 @@ static int CmdHF14AMfMAD(const char *Cmd) {
     uint8_t sector10[16 * 4] = {0};
 
     bool got_first = true;
-    if (mfReadSector(MF_MAD1_SECTOR, MF_KEY_A, (uint8_t *)g_mifare_mad_key, sector0)) {
-        PrintAndLogEx(ERR, "error, read sector 0. card don't have MAD or don't have MAD on default keys");
+    if (mfReadSector(MF_MAD1_SECTOR, MF_KEY_A, (uint8_t *)g_mifare_mad_key, sector0) != PM3_SUCCESS) {
+        PrintAndLogEx(WARNING, "error, read sector 0. card don't have MAD or don't have MAD on default keys");
         got_first = false;
+    } else {
+        PrintAndLogEx(INFO, "Authentication ( " _GREEN_("OK") " )");
     }
 
     // User supplied key
     if (got_first == false && keylen == 6) {
-        if (mfReadSector(MF_MAD1_SECTOR, MF_KEY_A, userkey, sector0)) {
-        PrintAndLogEx(ERR, "error, read sector 0. card don't have MAD or don't the custom key is wrong");
+        PrintAndLogEx(INFO, "Trying user specified key...");
+        if (mfReadSector(MF_MAD1_SECTOR, MF_KEY_A, userkey, sector0) != PM3_SUCCESS) {
+            PrintAndLogEx(ERR, "error, read sector 0. card don't have MAD or don't the custom key is wrong");
         } else {
+            PrintAndLogEx(INFO, "Authentication ( " _GREEN_("OK") " )");
             got_first = true;
         }
     }
@@ -4903,11 +4907,6 @@ static int CmdHF14AMfMAD(const char *Cmd) {
         return PM3_ESOFT;
     }
 
-//    if (aidlen != 2 && !decodeholder) {
-//        PrintAndLogEx(WARNING, "Using default MAD keys instead");
-
-
-
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "--- " _CYAN_("MIFARE App Directory Information") " ----------------");
     PrintAndLogEx(INFO, "-----------------------------------------------------");

From 6d62f3f53c47e9f79463e8ef8355874fd6ce7d4a Mon Sep 17 00:00:00 2001
From: ikarus <ikarus4ever@web.de>
Date: Wed, 30 Dec 2020 23:10:53 +0100
Subject: [PATCH 265/682] hf_mf_format.lua: fixed off by one and typo.

---
 client/luascripts/hf_mf_format.lua | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/luascripts/hf_mf_format.lua b/client/luascripts/hf_mf_format.lua
index 0bde3c2d1..7aed6b757 100644
--- a/client/luascripts/hf_mf_format.lua
+++ b/client/luascripts/hf_mf_format.lua
@@ -14,7 +14,7 @@ This script will generate 'hf mf wrbl' commands for each block to format a Mifar
 Alla datablocks gets 0x00
 As default the script sets the keys A/B to 0xFFFFFFFFFFFF
 and the access bytes will become 0x78,0x77,0x88
-The GDB will become 0x00
+The GPB will become 0x00
 
 The script will skip the manufactoring block 0.
 ]]
@@ -169,7 +169,7 @@ local function main(args)
     GetCardInfo()
 
     -- Show info
-    print( string.format('Estimating number of blocks: %d', numBlocks))
+    print( string.format('Estimating number of blocks: %d', numBlocks + 1))
     print( string.format('Old key:    %s', OldKey))
     print( string.format('New key:    %s', NewKey))
     print( string.format('New Access: %s', Accessbytes))

From 027ed5e5589b1c9f577bb28f57953a8369e75ee4 Mon Sep 17 00:00:00 2001
From: Gabriele Gristina <matrix@users.noreply.github.com>
Date: Thu, 31 Dec 2020 00:33:42 +0100
Subject: [PATCH 266/682] Fixed build errors on osx

---
 client/src/cmdhf14a.c   | 2 +-
 client/src/cmdhfemrtd.c | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index 8a6ce45ef..1048be3f5 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -2219,7 +2219,7 @@ static int CmdHf14AFindapdu(const char *Cmd) {
 
     bool inc_p1 = true;
     bool skip_ins = false;
-    uint64_t all_sw[256][256] = {0};
+    uint64_t all_sw[256][256] = { { 0 } };
     uint64_t sw_occurences = 0;
     uint64_t t_start = msclock();
     uint64_t t_last_reset = msclock();
diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 2ba45f5b7..afe5b6b6f 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1777,8 +1777,8 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     }
 
     // Grab the hash list
-    uint8_t dg_hashes_sod[17][64] = { 0x00 };
-    uint8_t dg_hashes_calc[17][64] = { 0x00 };
+    uint8_t dg_hashes_sod[17][64] = { { 0 } };
+    uint8_t dg_hashes_calc[17][64] = { { 0 } };
     int hash_algo = 0;
 
     if (!emrtd_select_and_read(response, &resplen, dg_table[EF_SOD].fileid, ks_enc, ks_mac, ssc, BAC, use_14b)) {
@@ -1856,8 +1856,8 @@ int infoHF_EMRTD_offline(const char *path) {
     free(data);
 
     // Grab the hash list
-    uint8_t dg_hashes_sod[17][64] = { 0x00 };
-    uint8_t dg_hashes_calc[17][64] = { 0x00 };
+    uint8_t dg_hashes_sod[17][64] = { { 0 } };
+    uint8_t dg_hashes_calc[17][64] = { { 0 } };
     int hash_algo = 0;
 
     strcpy(filepath, path);

From a9f4f4f80477913d41bf4b44600270e48031d1b6 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Wed, 30 Dec 2020 22:42:46 -0500
Subject: [PATCH 267/682] hf 14a config - now use cliparser

---
 armsrc/iso14443a.c       |   2 +-
 client/src/cmdhf14a.c    | 249 +++++++++++++++------------------------
 client/src/cmdhf14a.h    |   2 +-
 doc/cliparser_todo.txt   |   1 -
 doc/magic_cards_notes.md |  24 ++--
 5 files changed, 108 insertions(+), 170 deletions(-)

diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index db00f5494..4776e555a 100644
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -142,7 +142,7 @@ void printHf14aConfig(void) {
     Dbprintf("  [b] BCC override........%i %s%s%s",
              hf14aconfig.forcebcc,
              (hf14aconfig.forcebcc == 0) ? "( " _GREEN_("No") " ) follow standard" : "",
-             (hf14aconfig.forcebcc == 1) ? "( " _RED_("Yes") " ) always do CL2" : "",
+             (hf14aconfig.forcebcc == 1) ? "( " _RED_("Yes") " ) force fix of bad BCC" : "",
              (hf14aconfig.forcebcc == 2) ? "( " _RED_("Yes") " ) always use card BCC" : ""
             );
     Dbprintf("  [2] CL2 override........%i %s%s%s",
diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index 1048be3f5..02b3a817e 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -170,45 +170,6 @@ const char *getTagInfo(uint8_t uid) {
 static uint16_t frameLength = 0;
 uint16_t atsFSC[] = {16, 24, 32, 40, 48, 64, 96, 128, 256};
 
-static int usage_hf_14a_config(void) {
-    PrintAndLogEx(NORMAL, "Usage: hf 14a config [a 0|1|2] [b 0|1|2] [2 0|1|2] [3 0|1|2]");
-    PrintAndLogEx(NORMAL, "\nOptions:");
-    PrintAndLogEx(NORMAL, "       h                 This help");
-    PrintAndLogEx(NORMAL, "       a 0|1|2           ATQA<>anticollision: 0=follow standard 1=execute anticol 2=skip anticol");
-    PrintAndLogEx(NORMAL, "       b 0|1|2           BCC:                 0=follow standard 1=use fixed BCC   2=use card BCC");
-    PrintAndLogEx(NORMAL, "       2 0|1|2           SAK<>CL2:            0=follow standard 1=execute CL2     2=skip CL2");
-    PrintAndLogEx(NORMAL, "       3 0|1|2           SAK<>CL3:            0=follow standard 1=execute CL3     2=skip CL3");
-    PrintAndLogEx(NORMAL, "       r 0|1|2           SAK<>ATS:            0=follow standard 1=execute RATS    2=skip RATS");
-    PrintAndLogEx(NORMAL, "\nExamples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config       ")"     Print current configuration");
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config a 1   ")"     Force execution of anticollision");
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config a 0   ")"     Restore ATQA interpretation");
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config b 1   ")"     Force fix of bad BCC in anticollision");
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config b 0   ")"     Restore BCC check");
-    PrintAndLogEx(NORMAL, "\nExamples to revive Gen2/DirectWrite magic cards failing at anticollision:");
-    PrintAndLogEx(NORMAL, _CYAN_("    MFC 1k 4b UID")":");
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config a 1 b 2 2 2 r 2"));
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf mf wrbl 0 A FFFFFFFFFFFF 11223344440804006263646566676869"));
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config a 0 b 0 2 0 r 0"));
-    PrintAndLogEx(NORMAL, _CYAN_("    MFC 4k 4b UID")":");
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config a 1 b 2 2 2 r 2"));
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf mf wrbl 0 A FFFFFFFFFFFF 11223344441802006263646566676869"));
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config a 0 b 0 2 0 r 0"));
-    PrintAndLogEx(NORMAL, _CYAN_("    MFC 1k 7b UID")":");
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config a 1 b 2 2 1 3 2 r 2"));
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf mf wrbl 0 A FFFFFFFFFFFF 04112233445566084400626364656667"));
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config a 0 b 0 2 0 3 0 r 0"));
-    PrintAndLogEx(NORMAL, _CYAN_("    MFC 4k 7b UID")":");
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config a 1 b 2 2 1 3 2 r 2"));
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf mf wrbl 0 A FFFFFFFFFFFF 04112233445566184200626364656667"));
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config a 0 b 0 2 0 3 0 r 0"));
-    PrintAndLogEx(NORMAL, _CYAN_("    MFUL ")"/" _CYAN_(" MFUL EV1 ")"/" _CYAN_(" MFULC")":");
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config a 1 b 2 2 1 3 2 r 2"));
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf mfu setuid 04112233445566"));
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config a 0 b 0 2 0 3 0 r 0"));
-    return PM3_SUCCESS;
-}
-
 static int CmdHF14AList(const char *Cmd) {
     char args[128] = {0};
     if (strlen(Cmd) == 0) {
@@ -237,142 +198,120 @@ int hf14a_getconfig(hf14a_config *config) {
     return PM3_SUCCESS;
 }
 
-int hf14a_setconfig(hf14a_config *config) {
+int hf14a_setconfig(hf14a_config *config, bool verbose) {
     if (!session.pm3_present) return PM3_ENOTTY;
 
     clearCommandBuffer();
-    if (config != NULL)
+    if (config != NULL) {
         SendCommandNG(CMD_HF_ISO14443A_SET_CONFIG, (uint8_t *)config, sizeof(hf14a_config));
-    else
+        if (verbose) {
+            SendCommandNG(CMD_HF_ISO14443A_PRINT_CONFIG, NULL, 0);
+        }
+    } else {
         SendCommandNG(CMD_HF_ISO14443A_PRINT_CONFIG, NULL, 0);
+    }
 
     return PM3_SUCCESS;
 }
 
+static int hf_14a_config_example(void) {
+    PrintAndLogEx(NORMAL, "\nExamples to revive Gen2/DirectWrite magic cards failing at anticollision:");
+    PrintAndLogEx(NORMAL, _CYAN_("    MFC 1k 4b UID")":");
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 1 --bcc 2 --cl2 2 --rats 2"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf mf wrbl 0 A FFFFFFFFFFFF 11223344440804006263646566676869"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 0 --bcc 0 --cl2 0 --rats 0"));
+    PrintAndLogEx(NORMAL, _CYAN_("    MFC 4k 4b UID")":");
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 1 --bcc 2 --cl2 2 --rats 2"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf mf wrbl 0 A FFFFFFFFFFFF 11223344441802006263646566676869"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 0 --bcc 0 --cl2 0 --rats 0"));
+    PrintAndLogEx(NORMAL, _CYAN_("    MFC 1k 7b UID")":");
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 1 --bcc 2 --cl2 1 --cl3 2 --rats 2"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf mf wrbl 0 A FFFFFFFFFFFF 04112233445566084400626364656667"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 0 --bcc 0 --cl2 0 --rats 0"));
+    PrintAndLogEx(NORMAL, _CYAN_("    MFC 4k 7b UID")":");
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 1 --bcc 2 --cl2 1 --cl3 2 --rats 2"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf mf wrbl 0 A FFFFFFFFFFFF 04112233445566184200626364656667"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 0 --bcc 0 --cl2 0 --rats 0"));
+    PrintAndLogEx(NORMAL, _CYAN_("    MFUL ")"/" _CYAN_(" MFUL EV1 ")"/" _CYAN_(" MFULC")":");
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 1 --bcc 2 --cl2 1 --cl3 2 r 2"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf mfu setuid 04112233445566"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 0 --bcc 0 --cl2 0 --rats 0"));
+    return PM3_SUCCESS;
+}
 static int CmdHf14AConfig(const char *Cmd) {
-
     if (!session.pm3_present) return PM3_ENOTTY;
 
-    // if called with no params, just print the device config
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf 14a config",
+                  "Configure 14a settings (use with caution)",
+                  "hf 14a config  -> Print current configuration\n"
+                  "hf 14a config --atqa 0 -> Follow standard\n"
+                  "hf 14a config --atqa 1 -> Force execution of anticollision\n"
+                  "hf 14a config --atqa 2 -> Skip anticollision\n"
+                  "hf 14a config --bcc 0  -> Follow standard\n"
+                  "hf 14a config --bcc 1  -> Force fix of bad BCC in anticollision\n"
+                  "hf 14a config --bcc 2  -> Use card BCC\n"
+                  "hf 14a config --cl2 0  -> Follow standard\n"
+                  "hf 14a config --cl2 1  -> Execute CL2\n"
+                  "hf 14a config --cl2 2  -> Skip CL2\n"
+                  "hf 14a config --cl3 0  -> Follow standard\n"
+                  "hf 14a config --cl3 1  -> Execute CL3\n"
+                  "hf 14a config --cl3 2  -> Skip CL3\n"
+                  "hf 14a config --rats 0  -> Follow standard\n"
+                  "hf 14a config --rats 1  -> Execute RATS\n"
+                  "hf 14a config --rats 2  -> Skip RATS");
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_int0(NULL, "atqa", "<dec>", "Configure ATQA<>anticollision behavior"),
+        arg_int0(NULL, "bcc", "<dec>", "Configure BCC behavior"),
+        arg_int0(NULL, "cl2", "<dec>", "Configure SAK<>CL2 behavior"),
+        arg_int0(NULL, "cl3", "<dec>", "Configure SAK<>CL3 behavior"),
+        arg_int0(NULL, "rats", "<dec>", "Configure RATS behavior"),
+        arg_lit0("v", "verbose", "verbose output, also prints examples for reviving Gen2 cards"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    int atqa = arg_get_int_def(ctx, 1, -1);
+    int bcc = arg_get_int_def(ctx, 2, -1);
+    int cl2 = arg_get_int_def(ctx, 3, -1);
+    int cl3 = arg_get_int_def(ctx, 4, -1);
+    int rats = arg_get_int_def(ctx, 5, -1);
+
+    int *config_options[5] = {&atqa, &bcc, &cl2, &cl3, &rats};
+
+    bool verbose = arg_get_lit(ctx, 6);
+
+    CLIParserFree(ctx);
+
+    // validations
     if (strlen(Cmd) == 0) {
-        return hf14a_setconfig(NULL);
+        return hf14a_setconfig(NULL, verbose);
     }
 
-    hf14a_config config = {
-        .forceanticol = -1,
-        .forcebcc = -1,
-        .forcecl2 = -1,
-        .forcecl3 = -1,
-        .forcerats = -1
-    };
+    if (verbose) {
+        hf_14a_config_example();
+    }
 
-    bool errors = false;
-    uint8_t cmdp = 0;
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (param_getchar(Cmd, cmdp)) {
-            case 'h':
-                return usage_hf_14a_config();
-            case 'a':
-                switch (param_getchar(Cmd, cmdp + 1)) {
-                    case '0':
-                        config.forceanticol = 0;
-                        break;
-                    case '1':
-                        config.forceanticol = 1;
-                        break;
-                    case '2':
-                        config.forceanticol = 2;
-                        break;
-                    default:
-                        PrintAndLogEx(WARNING, "Unknown value '%c'", param_getchar(Cmd, cmdp + 1));
-                        errors = 1;
-                        break;
-                }
-                cmdp += 2;
-                break;
-            case 'b':
-                switch (param_getchar(Cmd, cmdp + 1)) {
-                    case '0':
-                        config.forcebcc = 0;
-                        break;
-                    case '1':
-                        config.forcebcc = 1;
-                        break;
-                    case '2':
-                        config.forcebcc = 2;
-                        break;
-                    default:
-                        PrintAndLogEx(WARNING, "Unknown value '%c'", param_getchar(Cmd, cmdp + 1));
-                        errors = 1;
-                        break;
-                }
-                cmdp += 2;
-                break;
-            case '2':
-                switch (param_getchar(Cmd, cmdp + 1)) {
-                    case '0':
-                        config.forcecl2 = 0;
-                        break;
-                    case '1':
-                        config.forcecl2 = 1;
-                        break;
-                    case '2':
-                        config.forcecl2 = 2;
-                        break;
-                    default:
-                        PrintAndLogEx(WARNING, "Unknown value '%c'", param_getchar(Cmd, cmdp + 1));
-                        errors = 1;
-                        break;
-                }
-                cmdp += 2;
-                break;
-            case '3':
-                switch (param_getchar(Cmd, cmdp + 1)) {
-                    case '0':
-                        config.forcecl3 = 0;
-                        break;
-                    case '1':
-                        config.forcecl3 = 1;
-                        break;
-                    case '2':
-                        config.forcecl3 = 2;
-                        break;
-                    default:
-                        PrintAndLogEx(WARNING, "Unknown value '%c'", param_getchar(Cmd, cmdp + 1));
-                        errors = 1;
-                        break;
-                }
-                cmdp += 2;
-                break;
-            case 'r':
-                switch (param_getchar(Cmd, cmdp + 1)) {
-                    case '0':
-                        config.forcerats = 0;
-                        break;
-                    case '1':
-                        config.forcerats = 1;
-                        break;
-                    case '2':
-                        config.forcerats = 2;
-                        break;
-                    default:
-                        PrintAndLogEx(WARNING, "Unknown value '%c'", param_getchar(Cmd, cmdp + 1));
-                        errors = 1;
-                        break;
-                }
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = 1;
-                break;
+    for (int i = 0; i < 5; ++i) {
+        if (*config_options[i] > -1) {
+            if (*config_options[i] > 2) {
+                PrintAndLogEx(ERR, "Argument must be 0, 1, or 2");
+                return PM3_EINVARG;
+            }
         }
     }
 
-    // validations
-    if (errors) return usage_hf_14a_config();
+    hf14a_config config = {
+        .forceanticol = atqa,
+        .forcebcc = bcc,
+        .forcecl2 = cl2,
+        .forcecl3 = cl3,
+        .forcerats = rats
+    };
 
-    return hf14a_setconfig(&config);
+    return hf14a_setconfig(&config, verbose);
 }
 
 int Hf14443_4aGetCardData(iso14a_card_select_t *card) {
diff --git a/client/src/cmdhf14a.h b/client/src/cmdhf14a.h
index 925bf8bef..a1a2279a0 100644
--- a/client/src/cmdhf14a.h
+++ b/client/src/cmdhf14a.h
@@ -27,7 +27,7 @@ int CmdHF14ASniff(const char *Cmd); // used by hf topaz sniff
 int CmdHF14ASim(const char *Cmd);   // used by hf mfu sim
 
 int hf14a_getconfig(hf14a_config *config);
-int hf14a_setconfig(hf14a_config *config);
+int hf14a_setconfig(hf14a_config *config, bool verbose);
 int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search);
 const char *getTagInfo(uint8_t uid);
 int Hf14443_4aGetCardData(iso14a_card_select_t *card);
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 0a5e5c77e..7f5643b2f 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -41,7 +41,6 @@ data print
 data samples
 data setdebugmode
 data tune
-hf 14a config
 hf 14b sriwrite
 hf 15 dump
 hf 15 info
diff --git a/doc/magic_cards_notes.md b/doc/magic_cards_notes.md
index 9e4cdce12..08aaa0386 100644
--- a/doc/magic_cards_notes.md
+++ b/doc/magic_cards_notes.md
@@ -45,12 +45,12 @@ Here are some tips if the card doesn't react or gives error on a simple `hf 14a
 
 Let's force a 4b UID anticollision and see what happens:
 ```
-hf 14a config a 1 b 2 2 2 r 2
+hf 14a config --atqa 1 --bcc 2 --cl2 2 --rats 2
 hf 14a reader
 ```
 It it responds, we know it's a TypeA card. But maybe it's a 7b UID, so let's force a 7b UID anticollision:
 ```
-hf 14a config a 1 b 2 2 1 3 2 r 2
+hf 14a config --atqa 1 --bcc 2 --cl2 1 --cl3 2 --rats 2
 hf 14a reader
 ```
 At this stage, you know if it's a TypeA 4b or 7b card and you can check further on this page how to reconfigure different types of cards.
@@ -58,7 +58,7 @@ At this stage, you know if it's a TypeA 4b or 7b card and you can check further
 To restore anticollision config of the Proxmark3:
 
 ```
-hf 14a config a 0 b 0 2 0 3 0 r 0
+hf 14a config --atqa 0 --bcc 0 --cl2 0 --cl3 0 --rats 0
 ```
 # MIFARE Classic
 
@@ -335,26 +335,26 @@ hf mf wrbl 0 A FFFFFFFFFFFF 11223344440804006263646566676869
 When "soft-bricked" (by writing invalid data in block0), these ones may help:
 
 ```
-hf 14a config h
+hf 14a config -h
 ```
 
 e.g. for 4b UID:
 
 ```
-hf 14a config a 1 b 2 2 2 r 2
+hf 14a config --atqa 1 --bcc 2 --cl2 2 --rats 2
 hf mf wrbl 0 A FFFFFFFFFFFF 11223344440804006263646566676869 # for 1k
 hf mf wrbl 0 A FFFFFFFFFFFF 11223344441802006263646566676869 # for 4k
-hf 14a config a 0 b 0 2 0 r 0
+hf 14a config --atqa 0 --bcc 0 --cl2 0 --rats 0
 hf 14a reader
 ```
 
 e.g. for 7b UID:
 
 ```
-hf 14a config a 1 b 2 2 1 3 2 r 2
+hf 14a config --atqa 1 --bcc 2 --cl2 1 --cl3 2 --rats 2
 hf mf wrbl 0 A FFFFFFFFFFFF 04112233445566084400626364656667 # for 1k
 hf mf wrbl 0 A FFFFFFFFFFFF 04112233445566184200626364656667 # for 4k
-hf 14a config a 0 b 0 2 0 3 0 r 0
+hf 14a config --atqa 0 --bcc 0 --cl2 0 --cl3 0 --rats 0
 hf 14a reader
 ```
 ## MIFARE Classic DirectWrite, FUID version aka 1-write
@@ -537,7 +537,7 @@ script run hf_mfu_setuid -h
 When "soft-bricked" (by writing invalid data in block0), these ones may help:
 
 ```
-hf 14a config h
+hf 14a config -h
 script run run hf_mf_magicrevive -u
 ```
 
@@ -599,14 +599,14 @@ hf 14a raw    -c    a2 02 44480000
 When "soft-bricked" (by writing invalid data in block0), these ones may help:
 
 ```
-hf 14a config h
+hf 14a config -h
 ```
 
 E.g.:
 ```
-hf 14a config a 1 b 2 2 1 3 2 r 2
+hf 14a config --atqa 1 --bcc 2 --cl2 1 --cl3 2 --rats 2
 hf mfu setuid 04112233445566
-hf 14a config a 0 b 0 2 0 3 0 r 0
+hf 14a config --atqa 0 --bcc 0 --cl2 0 --cl3 0 --rats 0
 hf 14a reader
 ```
 

From b956d4c148e3c07014375ab36429b1c48d205fa2 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Thu, 31 Dec 2020 11:39:57 +0100
Subject: [PATCH 268/682] hf 14a config cliparser: use string values

---
 armsrc/iso14443a.c    |  45 ++++++-------
 client/src/cmdhf14a.c | 146 ++++++++++++++++++++++++++++--------------
 2 files changed, 117 insertions(+), 74 deletions(-)

diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index 4776e555a..759e5e646 100644
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -133,35 +133,30 @@ static hf14a_config hf14aconfig = { 0, 0, 0, 0, 0 } ;
 
 void printHf14aConfig(void) {
     DbpString(_CYAN_("HF 14a config"));
-    Dbprintf("  [a] Anticol override....%i %s%s%s",
-             hf14aconfig.forceanticol,
-             (hf14aconfig.forceanticol == 0) ? "( " _GREEN_("No") " ) follow standard " : "",
-             (hf14aconfig.forceanticol == 1) ? "( " _RED_("Yes") " ) always do anticol" : "",
-             (hf14aconfig.forceanticol == 2) ? "( " _RED_("Yes") " ) always skip anticol" : ""
+    Dbprintf("  [a] Anticol override....%s%s%s",
+             (hf14aconfig.forceanticol == 0) ? _GREEN_("std") "    : follow standard " : "",
+             (hf14aconfig.forceanticol == 1) ? _RED_("force") "  : always do anticol" : "",
+             (hf14aconfig.forceanticol == 2) ? _RED_("skip") "   : always skip anticol" : ""
             );
-    Dbprintf("  [b] BCC override........%i %s%s%s",
-             hf14aconfig.forcebcc,
-             (hf14aconfig.forcebcc == 0) ? "( " _GREEN_("No") " ) follow standard" : "",
-             (hf14aconfig.forcebcc == 1) ? "( " _RED_("Yes") " ) force fix of bad BCC" : "",
-             (hf14aconfig.forcebcc == 2) ? "( " _RED_("Yes") " ) always use card BCC" : ""
+    Dbprintf("  [b] BCC override........%s%s%s",
+             (hf14aconfig.forcebcc == 0) ? _GREEN_("std") "    : follow standard" : "",
+             (hf14aconfig.forcebcc == 1) ? _RED_("fix") "    : fix bad BCC" : "",
+             (hf14aconfig.forcebcc == 2) ? _RED_("ignore") " : ignore bad BCC, always use card BCC" : ""
             );
-    Dbprintf("  [2] CL2 override........%i %s%s%s",
-             hf14aconfig.forcecl2,
-             (hf14aconfig.forcecl2 == 0) ? "( " _GREEN_("No") " ) follow standard" : "",
-             (hf14aconfig.forcecl2 == 1) ? "( " _RED_("Yes") " ) always do CL2" : "",
-             (hf14aconfig.forcecl2 == 2) ? "( " _RED_("Yes") " ) always skip CL2" : ""
+    Dbprintf("  [2] CL2 override........%s%s%s",
+             (hf14aconfig.forcecl2 == 0) ? _GREEN_("std") "    : follow standard" : "",
+             (hf14aconfig.forcecl2 == 1) ? _RED_("force") "  : always do CL2" : "",
+             (hf14aconfig.forcecl2 == 2) ? _RED_("skip") "   : always skip CL2" : ""
             );
-    Dbprintf("  [3] CL3 override........%i %s%s%s",
-             hf14aconfig.forcecl3,
-             (hf14aconfig.forcecl3 == 0) ? "( " _GREEN_("No") " ) follow standard" : "",
-             (hf14aconfig.forcecl3 == 1) ? "( " _RED_("Yes") " ) always do CL3" : "",
-             (hf14aconfig.forcecl3 == 2) ? "( " _RED_("Yes") " ) always skip CL3" : ""
+    Dbprintf("  [3] CL3 override........%s%s%s",
+             (hf14aconfig.forcecl3 == 0) ? _GREEN_("std") "    : follow standard" : "",
+             (hf14aconfig.forcecl3 == 1) ? _RED_("force") "  : always do CL3" : "",
+             (hf14aconfig.forcecl3 == 2) ? _RED_("skip") "   : always skip CL3" : ""
             );
-    Dbprintf("  [r] RATS override.......%i %s%s%s",
-             hf14aconfig.forcerats,
-             (hf14aconfig.forcerats == 0) ? "( " _GREEN_("No") " ) follow standard " : "",
-             (hf14aconfig.forcerats == 1) ? "( " _RED_("Yes") " ) always do RATS" : "",
-             (hf14aconfig.forcerats == 2) ? "( " _RED_("Yes") " ) always skip RATS" : ""
+    Dbprintf("  [r] RATS override.......%s%s%s",
+             (hf14aconfig.forcerats == 0) ? _GREEN_("std") "    : follow standard " : "",
+             (hf14aconfig.forcerats == 1) ? _RED_("force") "  : always do RATS" : "",
+             (hf14aconfig.forcerats == 2) ? _RED_("skip") "   : always skip RATS" : ""
             );
 }
 
diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index 02b3a817e..373e81d49 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -217,25 +217,25 @@ int hf14a_setconfig(hf14a_config *config, bool verbose) {
 static int hf_14a_config_example(void) {
     PrintAndLogEx(NORMAL, "\nExamples to revive Gen2/DirectWrite magic cards failing at anticollision:");
     PrintAndLogEx(NORMAL, _CYAN_("    MFC 1k 4b UID")":");
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 1 --bcc 2 --cl2 2 --rats 2"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa force --bcc ignore --cl2 skip --rats skip"));
     PrintAndLogEx(NORMAL, _YELLOW_("          hf mf wrbl 0 A FFFFFFFFFFFF 11223344440804006263646566676869"));
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 0 --bcc 0 --cl2 0 --rats 0"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --std"));
     PrintAndLogEx(NORMAL, _CYAN_("    MFC 4k 4b UID")":");
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 1 --bcc 2 --cl2 2 --rats 2"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa force --bcc ignore --cl2 skip --rats skip"));
     PrintAndLogEx(NORMAL, _YELLOW_("          hf mf wrbl 0 A FFFFFFFFFFFF 11223344441802006263646566676869"));
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 0 --bcc 0 --cl2 0 --rats 0"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --std"));
     PrintAndLogEx(NORMAL, _CYAN_("    MFC 1k 7b UID")":");
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 1 --bcc 2 --cl2 1 --cl3 2 --rats 2"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa force --bcc ignore --cl2 force --cl3 skip --rats skip"));
     PrintAndLogEx(NORMAL, _YELLOW_("          hf mf wrbl 0 A FFFFFFFFFFFF 04112233445566084400626364656667"));
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 0 --bcc 0 --cl2 0 --rats 0"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --std"));
     PrintAndLogEx(NORMAL, _CYAN_("    MFC 4k 7b UID")":");
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 1 --bcc 2 --cl2 1 --cl3 2 --rats 2"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa forcce --bcc ignore --cl2 force --cl3 skip --rats skip"));
     PrintAndLogEx(NORMAL, _YELLOW_("          hf mf wrbl 0 A FFFFFFFFFFFF 04112233445566184200626364656667"));
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 0 --bcc 0 --cl2 0 --rats 0"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --std"));
     PrintAndLogEx(NORMAL, _CYAN_("    MFUL ")"/" _CYAN_(" MFUL EV1 ")"/" _CYAN_(" MFULC")":");
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 1 --bcc 2 --cl2 1 --cl3 2 r 2"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa force --bcc ignore --cl2 force --cl3 skip -rats skip"));
     PrintAndLogEx(NORMAL, _YELLOW_("          hf mfu setuid 04112233445566"));
-    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --atqa 0 --bcc 0 --cl2 0 --rats 0"));
+    PrintAndLogEx(NORMAL, _YELLOW_("          hf 14a config --std"));
     return PM3_SUCCESS;
 }
 static int CmdHf14AConfig(const char *Cmd) {
@@ -244,44 +244,101 @@ static int CmdHf14AConfig(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf 14a config",
                   "Configure 14a settings (use with caution)",
-                  "hf 14a config  -> Print current configuration\n"
-                  "hf 14a config --atqa 0 -> Follow standard\n"
-                  "hf 14a config --atqa 1 -> Force execution of anticollision\n"
-                  "hf 14a config --atqa 2 -> Skip anticollision\n"
-                  "hf 14a config --bcc 0  -> Follow standard\n"
-                  "hf 14a config --bcc 1  -> Force fix of bad BCC in anticollision\n"
-                  "hf 14a config --bcc 2  -> Use card BCC\n"
-                  "hf 14a config --cl2 0  -> Follow standard\n"
-                  "hf 14a config --cl2 1  -> Execute CL2\n"
-                  "hf 14a config --cl2 2  -> Skip CL2\n"
-                  "hf 14a config --cl3 0  -> Follow standard\n"
-                  "hf 14a config --cl3 1  -> Execute CL3\n"
-                  "hf 14a config --cl3 2  -> Skip CL3\n"
-                  "hf 14a config --rats 0  -> Follow standard\n"
-                  "hf 14a config --rats 1  -> Execute RATS\n"
-                  "hf 14a config --rats 2  -> Skip RATS");
+                  "hf 14a config              -> Print current configuration\n"
+                  "hf 14a config --std        -> Reset default configuration (follow standard)\n"
+                  "hf 14a config --atqa std   -> Follow standard\n"
+                  "hf 14a config --atqa force -> Force execution of anticollision\n"
+                  "hf 14a config --atqa skip  -> Skip anticollision\n"
+                  "hf 14a config --bcc std    -> Follow standard\n"
+                  "hf 14a config --bcc fix    -> Fix bad BCC in anticollision\n"
+                  "hf 14a config --bcc ignore -> Ignore bad BCC and use it as such\n"
+                  "hf 14a config --cl2 std    -> Follow standard\n"
+                  "hf 14a config --cl2 force  -> Execute CL2\n"
+                  "hf 14a config --cl2 skip   -> Skip CL2\n"
+                  "hf 14a config --cl3 std    -> Follow standard\n"
+                  "hf 14a config --cl3 force  -> Execute CL3\n"
+                  "hf 14a config --cl3 skip   -> Skip CL3\n"
+                  "hf 14a config --rats std   -> Follow standard\n"
+                  "hf 14a config --rats force -> Execute RATS\n"
+                  "hf 14a config --rats skip  -> Skip RATS");
 
     void *argtable[] = {
         arg_param_begin,
-        arg_int0(NULL, "atqa", "<dec>", "Configure ATQA<>anticollision behavior"),
-        arg_int0(NULL, "bcc", "<dec>", "Configure BCC behavior"),
-        arg_int0(NULL, "cl2", "<dec>", "Configure SAK<>CL2 behavior"),
-        arg_int0(NULL, "cl3", "<dec>", "Configure SAK<>CL3 behavior"),
-        arg_int0(NULL, "rats", "<dec>", "Configure RATS behavior"),
+        arg_str0(NULL, "atqa", "<std|force|skip>", "Configure ATQA<>anticollision behavior"),
+        arg_str0(NULL, "bcc", "<std|fix|ignore>", "Configure BCC behavior"),
+        arg_str0(NULL, "cl2", "<std|force|skip>", "Configure SAK<>CL2 behavior"),
+        arg_str0(NULL, "cl3", "<std|force|skip>", "Configure SAK<>CL3 behavior"),
+        arg_str0(NULL, "rats", "<std|force|skip>", "Configure RATS behavior"),
+        arg_lit0(NULL, "std", "Reset default configuration: follow all standard"),
         arg_lit0("v", "verbose", "verbose output, also prints examples for reviving Gen2 cards"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool defaults = arg_get_lit(ctx, 6);
+    int vlen = 0;
+    char value[10];
+    int atqa = defaults ? 0 : -1;
+    CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)value, sizeof(value), &vlen);
+    if (vlen > 0) {
+        if (strcmp(value, "std") == 0) atqa = 0;
+        else if (strcmp(value, "force") == 0) atqa = 1;
+        else if (strcmp(value, "skip") == 0) atqa = 2;
+        else {
+            PrintAndLogEx(ERR, "atqa argument must be 'std', 'force', or 'skip'");
+            CLIParserFree(ctx);
+            return PM3_EINVARG;
+        }
+    }
+    int bcc = defaults ? 0 : -1;
+    CLIParamStrToBuf(arg_get_str(ctx, 2), (uint8_t *)value, sizeof(value), &vlen);
+    if (vlen > 0) {
+        if (strcmp(value, "std") == 0) bcc = 0;
+        else if (strcmp(value, "fix") == 0) bcc = 1;
+        else if (strcmp(value, "ignore") == 0) bcc = 2;
+        else {
+            PrintAndLogEx(ERR, "bcc argument must be 'std', 'fix', or 'ignore'");
+            CLIParserFree(ctx);
+            return PM3_EINVARG;
+        }
+    }
+    int cl2 = defaults ? 0 : -1;
+    CLIParamStrToBuf(arg_get_str(ctx, 3), (uint8_t *)value, sizeof(value), &vlen);
+    if (vlen > 0) {
+        if (strcmp(value, "std") == 0) cl2 = 0;
+        else if (strcmp(value, "force") == 0) cl2 = 1;
+        else if (strcmp(value, "skip") == 0) cl2 = 2;
+        else {
+            PrintAndLogEx(ERR, "cl2 argument must be 'std', 'force', or 'skip'");
+            CLIParserFree(ctx);
+            return PM3_EINVARG;
+        }
+    }
+    int cl3 = defaults ? 0 : -1;
+    CLIParamStrToBuf(arg_get_str(ctx, 4), (uint8_t *)value, sizeof(value), &vlen);
+    if (vlen > 0) {
+        if (strcmp(value, "std") == 0) cl3 = 0;
+        else if (strcmp(value, "force") == 0) cl3 = 1;
+        else if (strcmp(value, "skip") == 0) cl3 = 2;
+        else {
+            PrintAndLogEx(ERR, "cl3 argument must be 'std', 'force', or 'skip'");
+            CLIParserFree(ctx);
+            return PM3_EINVARG;
+        }
+    }
+    int rats = defaults ? 0 : -1;
+    CLIParamStrToBuf(arg_get_str(ctx, 5), (uint8_t *)value, sizeof(value), &vlen);
+    if (vlen > 0) {
+        if (strcmp(value, "std") == 0) rats = 0;
+        else if (strcmp(value, "force") == 0) rats = 1;
+        else if (strcmp(value, "skip") == 0) rats = 2;
+        else {
+            PrintAndLogEx(ERR, "rats argument must be 'std', 'force', or 'skip'");
+            CLIParserFree(ctx);
+            return PM3_EINVARG;
+        }
+    }
 
-    int atqa = arg_get_int_def(ctx, 1, -1);
-    int bcc = arg_get_int_def(ctx, 2, -1);
-    int cl2 = arg_get_int_def(ctx, 3, -1);
-    int cl3 = arg_get_int_def(ctx, 4, -1);
-    int rats = arg_get_int_def(ctx, 5, -1);
-
-    int *config_options[5] = {&atqa, &bcc, &cl2, &cl3, &rats};
-
-    bool verbose = arg_get_lit(ctx, 6);
+    bool verbose = arg_get_lit(ctx, 7);
 
     CLIParserFree(ctx);
 
@@ -294,15 +351,6 @@ static int CmdHf14AConfig(const char *Cmd) {
         hf_14a_config_example();
     }
 
-    for (int i = 0; i < 5; ++i) {
-        if (*config_options[i] > -1) {
-            if (*config_options[i] > 2) {
-                PrintAndLogEx(ERR, "Argument must be 0, 1, or 2");
-                return PM3_EINVARG;
-            }
-        }
-    }
-
     hf14a_config config = {
         .forceanticol = atqa,
         .forcebcc = bcc,

From 0b3931f1b057f9c641711883d0d099c078b574f3 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Thu, 31 Dec 2020 11:44:19 +0100
Subject: [PATCH 269/682] adapt doc

---
 doc/magic_cards_notes.md | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/doc/magic_cards_notes.md b/doc/magic_cards_notes.md
index 08aaa0386..d24a0b7c5 100644
--- a/doc/magic_cards_notes.md
+++ b/doc/magic_cards_notes.md
@@ -45,12 +45,12 @@ Here are some tips if the card doesn't react or gives error on a simple `hf 14a
 
 Let's force a 4b UID anticollision and see what happens:
 ```
-hf 14a config --atqa 1 --bcc 2 --cl2 2 --rats 2
+hf 14a config --atqa force --bcc ignore --cl2 skip --rats skip
 hf 14a reader
 ```
 It it responds, we know it's a TypeA card. But maybe it's a 7b UID, so let's force a 7b UID anticollision:
 ```
-hf 14a config --atqa 1 --bcc 2 --cl2 1 --cl3 2 --rats 2
+hf 14a config --atqa force --bcc ignore --cl2 force --cl3 skip --rats skip
 hf 14a reader
 ```
 At this stage, you know if it's a TypeA 4b or 7b card and you can check further on this page how to reconfigure different types of cards.
@@ -58,7 +58,7 @@ At this stage, you know if it's a TypeA 4b or 7b card and you can check further
 To restore anticollision config of the Proxmark3:
 
 ```
-hf 14a config --atqa 0 --bcc 0 --cl2 0 --cl3 0 --rats 0
+hf 14a config --std
 ```
 # MIFARE Classic
 
@@ -341,20 +341,20 @@ hf 14a config -h
 e.g. for 4b UID:
 
 ```
-hf 14a config --atqa 1 --bcc 2 --cl2 2 --rats 2
+hf 14a config --atqa force --bcc ignore --cl2 skip --rats skip
 hf mf wrbl 0 A FFFFFFFFFFFF 11223344440804006263646566676869 # for 1k
 hf mf wrbl 0 A FFFFFFFFFFFF 11223344441802006263646566676869 # for 4k
-hf 14a config --atqa 0 --bcc 0 --cl2 0 --rats 0
+hf 14a config --std
 hf 14a reader
 ```
 
 e.g. for 7b UID:
 
 ```
-hf 14a config --atqa 1 --bcc 2 --cl2 1 --cl3 2 --rats 2
+hf 14a config --atqa force --bcc ignore --cl2 force --cl3 skip --rats skip
 hf mf wrbl 0 A FFFFFFFFFFFF 04112233445566084400626364656667 # for 1k
 hf mf wrbl 0 A FFFFFFFFFFFF 04112233445566184200626364656667 # for 4k
-hf 14a config --atqa 0 --bcc 0 --cl2 0 --cl3 0 --rats 0
+hf 14a config --std
 hf 14a reader
 ```
 ## MIFARE Classic DirectWrite, FUID version aka 1-write
@@ -604,9 +604,9 @@ hf 14a config -h
 
 E.g.:
 ```
-hf 14a config --atqa 1 --bcc 2 --cl2 1 --cl3 2 --rats 2
+hf 14a config --atqa force --bcc ignore --cl2 force --cl3 skip --rats skip
 hf mfu setuid 04112233445566
-hf 14a config --atqa 0 --bcc 0 --cl2 0 --cl3 0 --rats 0
+hf 14a config --std
 hf 14a reader
 ```
 

From afc4d78d68f0ca3e51bd997cd18f0ceeb53949b9 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 31 Dec 2020 13:51:38 +0100
Subject: [PATCH 270/682] hf mfu eload/restore/sim/cauth - now uses cliparser

---
 client/src/cmdhfmfu.c | 371 ++++++++++++++++++++----------------------
 1 file changed, 173 insertions(+), 198 deletions(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index 2a32e0a8d..8d3e85c36 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -42,73 +42,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_hf_mfu_restore(void) {
-    PrintAndLogEx(NORMAL, "Restore dumpfile onto card.");
-    PrintAndLogEx(NORMAL, "Usage:  hf mfu restore [h] [l] [s] k <key> n <filename w .bin> ");
-    PrintAndLogEx(NORMAL, "  Options :");
-    PrintAndLogEx(NORMAL, "  k <key> : (optional) key for authentication [UL-C 16bytes, EV1/NTAG 4bytes]");
-    PrintAndLogEx(NORMAL, "  l       : (optional) swap entered key's endianness");
-    PrintAndLogEx(NORMAL, "  s       : (optional) enable special write UID " _BLUE_("-MAGIC TAG ONLY-"));
-    PrintAndLogEx(NORMAL, "  e       : (optional) enable special write version/signature " _BLUE_("-MAGIC NTAG 21* ONLY-"));
-    PrintAndLogEx(NORMAL, "  r       : (optional) use the password found in dumpfile to configure tag. requires " _YELLOW_("'e'") " parameter to work");
-    PrintAndLogEx(NORMAL, "  f <fn>  : " _YELLOW_("filename w .bin") " to restore");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu restore s f myfile"));
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu restore k AABBCCDD s f myfile"));
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu restore k AABBCCDD s e r f myfile"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
-
-static int usage_hf_mfu_eload(void) {
-    PrintAndLogEx(NORMAL, "It loads emul dump from the file " _YELLOW_("`filename.eml`"));
-    PrintAndLogEx(NORMAL, "Hint: See " _YELLOW_("`script run hf_mfu_dumptoemulator`") " to convert the .bin to the eml");
-    PrintAndLogEx(NORMAL, "Usage:  hf mfu eload u <file name w/o `.eml`> [numblocks]");
-    PrintAndLogEx(NORMAL, "  Options:");
-    PrintAndLogEx(NORMAL, "    h          : this help");
-    PrintAndLogEx(NORMAL, "    u          : UL (required)");
-    PrintAndLogEx(NORMAL, "    [filename] : without `.eml` (required)");
-    PrintAndLogEx(NORMAL, "    numblocks  : number of blocks to load from eml file (optional)");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu eload u filename"));
-    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu eload u filename 57"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
-
-static int usage_hf_mfu_sim(void) {
-    PrintAndLogEx(NORMAL, "\nEmulating Ultralight tag from emulator memory\n");
-    PrintAndLogEx(NORMAL, "\nBe sure to load the emulator memory first!\n");
-    PrintAndLogEx(NORMAL, "Usage: hf mfu sim t 7 u <uid> [n <num>]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "    h       : this help");
-    PrintAndLogEx(NORMAL, "    t 7     : 7 = NTAG or Ultralight sim (required)");
-    PrintAndLogEx(NORMAL, "    n <num> : exit simulation after <num> blocks have been read by reader. 0 = infinite (optional)");
-    PrintAndLogEx(NORMAL, "    u <uid> : 4 or 7 byte UID (optional)");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu sim t 7"));
-    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu sim t 7 u 1122344556677"));
-    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu sim t 7 u 1122344556677 n 5"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
-
-static int usage_hf_mfu_ucauth(void) {
-    PrintAndLogEx(NORMAL, "Tests 3DES password on Mifare Ultralight-C tag.");
-    PrintAndLogEx(NORMAL, "If password is not specified, a set of known defaults will be tested.");
-    PrintAndLogEx(NORMAL, "Usage:  hf mfu cauth [k] <password (32 hex symbols)>");
-    PrintAndLogEx(NORMAL, "       k          - keep field on (only if a password is provided too)");
-    PrintAndLogEx(NORMAL, "       [password] - (32 hex symbols)");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu cauth"));
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf mfu cauth 000102030405060708090a0b0c0d0e0f"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
-
 static int usage_hf_mfu_ucsetpwd(void) {
     PrintAndLogEx(NORMAL, "Set 3DES password on Mifare Ultralight-C tag.");
     PrintAndLogEx(NORMAL, "Usage:  hf mfu setpwd <password (32 hex symbols)>");
@@ -349,10 +282,10 @@ static int try_default_3des_keys(uint8_t **correct_key) {
         uint8_t *key = default_3des_keys[i];
         if (ulc_authentication(key, true)) {
             *correct_key = key;
-            return 1;
+            return PM3_SUCCESS;
         }
     }
-    return 0;
+    return PM3_ESOFT;
 }
 
 static int ulev1_requestAuthentication(uint8_t *pwd, uint8_t *pack, uint16_t packLength) {
@@ -615,7 +548,7 @@ int ul_print_type(uint32_t tagtype, uint8_t spaces) {
     memset(typestr, 0x00, sizeof(typestr));
 
     if (tagtype & UL)
-        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("MIFARE Ultralight (MF0ICU1)s"), spaces, "");
+        snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("MIFARE Ultralight (MF0ICU1)"), spaces, "");
     else if (tagtype & UL_C)
         snprintf(typestr, sizeof(typestr), "%*sTYPE: " _YELLOW_("MIFARE Ultralight C (MF0ULC)"), spaces, "");
     else if (tagtype & UL_NANO_40)
@@ -676,7 +609,7 @@ int ul_print_type(uint32_t tagtype, uint8_t spaces) {
         snprintf(typestr + strlen(typestr), 4, " (");
 
     snprintf(typestr + strlen(typestr), sizeof(typestr) - strlen(typestr), " %s ", (tagtype & MAGIC) ?  _GREEN_("magic") : "");
-    tagtype ^= MAGIC;
+    tagtype &= ~(MAGIC);
     snprintf(typestr + strlen(typestr), sizeof(typestr) - strlen(typestr), "%s", (tagtype & MAGIC_1A) ? _GREEN_("Gen 1a") : "");
     snprintf(typestr + strlen(typestr), sizeof(typestr) - strlen(typestr), "%s", (tagtype & MAGIC_1B) ? _GREEN_("Gen 1b") : "");
 
@@ -688,11 +621,11 @@ int ul_print_type(uint32_t tagtype, uint8_t spaces) {
 }
 
 static int ulc_print_3deskey(uint8_t *data) {
-    PrintAndLogEx(NORMAL, "         deskey1 [44/0x2C]: %s [%s]", sprint_hex(data, 4), sprint_ascii(data, 4));
-    PrintAndLogEx(NORMAL, "         deskey1 [45/0x2D]: %s [%s]", sprint_hex(data + 4, 4), sprint_ascii(data + 4, 4));
-    PrintAndLogEx(NORMAL, "         deskey2 [46/0x2E]: %s [%s]", sprint_hex(data + 8, 4), sprint_ascii(data + 8, 4));
-    PrintAndLogEx(NORMAL, "         deskey2 [47/0x2F]: %s [%s]", sprint_hex(data + 12, 4), sprint_ascii(data + 12, 4));
-    PrintAndLogEx(NORMAL, "\n 3des key: %s", sprint_hex(SwapEndian64(data, 16, 8), 16));
+    PrintAndLogEx(INFO, "    deskey1 [44/0x2C]: %s [%s]", sprint_hex(data, 4), sprint_ascii(data, 4));
+    PrintAndLogEx(INFO, "    deskey1 [45/0x2D]: %s [%s]", sprint_hex(data + 4, 4), sprint_ascii(data + 4, 4));
+    PrintAndLogEx(INFO, "    deskey2 [46/0x2E]: %s [%s]", sprint_hex(data + 8, 4), sprint_ascii(data + 8, 4));
+    PrintAndLogEx(INFO, "    deskey2 [47/0x2F]: %s [%s]", sprint_hex(data + 12, 4), sprint_ascii(data + 12, 4));
+    PrintAndLogEx(INFO, "3des key: " _GREEN_("%s"), sprint_hex_inrow(SwapEndian64(data, 16, 8), 16));
     return PM3_SUCCESS;
 }
 
@@ -839,7 +772,7 @@ static int ulev1_print_counters(void) {
         len = ulev1_readCounter(i, counter, sizeof(counter));
         if (len == 3) {
             PrintAndLogEx(INFO, "       [%0d]: %s", i, sprint_hex(counter, 3));
-            PrintAndLogEx(SUCCESS, "            - %02X tearing (%s)"
+            PrintAndLogEx(SUCCESS, "            - %02X tearing ( %s )"
                           , tear[0]
                           , (tear[0] == 0xBD) ? _GREEN_("ok") : _RED_("fail")
                          );
@@ -930,7 +863,7 @@ static int ulev1_print_signature(TagTypeUL_t tagtype, uint8_t *uid, uint8_t *sig
     if (is_valid == false || i == ARRAYLEN(nxp_mfu_public_keys)) {
         PrintAndLogEx(INFO, "    Elliptic curve parameters: NID_secp128r1");
         PrintAndLogEx(INFO, "             TAG IC Signature: %s", sprint_hex_inrow(signature, signature_len));
-        PrintAndLogEx(SUCCESS, "       Signature verification (" _RED_("fail") ")");
+        PrintAndLogEx(SUCCESS, "       Signature verification ( " _RED_("fail") " )");
         return PM3_ESOFT;
     }
 
@@ -938,7 +871,7 @@ static int ulev1_print_signature(TagTypeUL_t tagtype, uint8_t *uid, uint8_t *sig
     PrintAndLogEx(INFO, "IC signature public key value: %s", nxp_mfu_public_keys[i].value);
     PrintAndLogEx(INFO, "    Elliptic curve parameters: NID_secp128r1");
     PrintAndLogEx(INFO, "             TAG IC Signature: %s", sprint_hex_inrow(signature, signature_len));
-    PrintAndLogEx(SUCCESS, "       Signature verification (" _GREEN_("successful") ")");
+    PrintAndLogEx(SUCCESS, "       Signature verification ( " _GREEN_("successful") " )");
     return PM3_SUCCESS;
 }
 
@@ -968,7 +901,7 @@ static int ntag_print_counter(void) {
     len = ulev1_readCounter(0x02, counter, sizeof(counter));
     (void)len;
     PrintAndLogEx(INFO, "       [02]: %s", sprint_hex(counter, 3));
-    PrintAndLogEx(SUCCESS, "            - %02X tearing (%s)"
+    PrintAndLogEx(SUCCESS, "            - %02X tearing ( %s )"
                   , tear[0]
                   , (tear[0] == 0xBD) ? _GREEN_("ok") : _RED_("fail")
                  );
@@ -1038,6 +971,19 @@ static int ul_magic_test(void) {
     return 0;
 }
 
+static char *GenerateFilename(const char *prefix, const char *suffix) {
+    iso14a_card_select_t card;
+    if (ul_select(&card) == false) {
+        PrintAndLogEx(WARNING, "No tag found.");
+        return NULL;
+    }
+
+    char *fptr = calloc(sizeof(char) * (strlen(prefix) + strlen(suffix)) + sizeof(card.uid) * 2 + 1,  sizeof(uint8_t));
+    strcpy(fptr, prefix);
+    FillFileNameByUID(fptr, card.uid, suffix, card.uidlen);
+    return fptr;
+}
+
 uint32_t GetHF14AMfU_Type(void) {
 
     TagTypeUL_t tagtype = UNKNOWN;
@@ -1218,7 +1164,7 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
     void *argtable[] = {
         arg_param_begin,
         arg_str0("k", "key", "<hex>", "key for authentication (UL-C 16 bytes, EV1/NTAG 4 bytes)"),
-        arg_lit0("l", NULL,           "swap entered key's endianness"),
+        arg_lit0("l", NULL, "swap entered key's endianness"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
@@ -1319,7 +1265,7 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
             }
 
             // also try to diversify default keys..  look into CmdHF14AMfGenDiverseKeys
-            if (try_default_3des_keys(&key)) {
+            if (try_default_3des_keys(&key) == PM3_SUCCESS) {
                 PrintAndLogEx(SUCCESS, "Found default 3des key: ");
                 uint8_t keySwap[16];
                 memcpy(keySwap, SwapEndian64(key, 16, 8), 16);
@@ -1425,7 +1371,7 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
             num_to_bytes(ul_ev1_pwdgenA(card.uid), 4, key);
             len = ulev1_requestAuthentication(key, pack, sizeof(pack));
             if (len > -1) {
-                PrintAndLogEx(SUCCESS, "Found a default password: " _GREEN_("%s") " Pack: %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
+                PrintAndLogEx(SUCCESS, "Found default password " _GREEN_("%s") " pack %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
                 goto out;
             }
 
@@ -1437,7 +1383,7 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
             num_to_bytes(ul_ev1_pwdgenB(card.uid), 4, key);
             len = ulev1_requestAuthentication(key, pack, sizeof(pack));
             if (len > -1) {
-                PrintAndLogEx(SUCCESS, "Found a default password: " _GREEN_("%s") " Pack: %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
+                PrintAndLogEx(SUCCESS, "Found default password " _GREEN_("%s") " pack %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
                 goto out;
             }
 
@@ -1449,7 +1395,7 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
             num_to_bytes(ul_ev1_pwdgenC(card.uid), 4, key);
             len = ulev1_requestAuthentication(key, pack, sizeof(pack));
             if (len > -1) {
-                PrintAndLogEx(SUCCESS, "Found a default password: " _GREEN_("%s") " Pack: %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
+                PrintAndLogEx(SUCCESS, "Found default password " _GREEN_("%s") " pack %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
                 goto out;
             }
 
@@ -1461,7 +1407,7 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
             num_to_bytes(ul_ev1_pwdgenD(card.uid), 4, key);
             len = ulev1_requestAuthentication(key, pack, sizeof(pack));
             if (len > -1) {
-                PrintAndLogEx(SUCCESS, "Found a default password:" _GREEN_("%s") " Pack: %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
+                PrintAndLogEx(SUCCESS, "Found default password" _GREEN_("%s") " pack %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
                 goto out;
             }
 
@@ -1473,7 +1419,7 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
                 key = default_pwd_pack[i];
                 len = ulev1_requestAuthentication(key, pack, sizeof(pack));
                 if (len > -1) {
-                    PrintAndLogEx(SUCCESS, "Found a default password: " _GREEN_("%s") " Pack: %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
+                    PrintAndLogEx(SUCCESS, "Found default password " _GREEN_("%s") " pack %02X %02X", sprint_hex(key, 4), pack[0], pack[1]);
                     break;
                 } else {
                     if (ul_auth_select(&card, tagtype, has_auth_key, authkeyptr, pack, sizeof(pack)) == PM3_ESOFT) {
@@ -1515,7 +1461,7 @@ static int CmdHF14AMfUWrBl(const char *Cmd) {
     void *argtable[] = {
         arg_param_begin,
         arg_str0("k", "key", "<hex>", "key for authentication (UL-C 16 bytes, EV1/NTAG 4 bytes)"),
-        arg_lit0("l", NULL,           "swap entered key's endianness"),
+        arg_lit0("l", NULL, "swap entered key's endianness"),
         arg_int1("b", "block", "<dec>", "block number to write"),
         arg_str1("d", "data", "<hex>", "block data (4 or 16 hex bytes, 16 hex bytes will do a compatibility write)"),
         arg_param_end
@@ -1645,7 +1591,7 @@ static int CmdHF14AMfURdBl(const char *Cmd) {
     void *argtable[] = {
         arg_param_begin,
         arg_str0("k", "key", "<hex>", "key for authentication (UL-C 16 bytes, EV1/NTAG 4 bytes)"),
-        arg_lit0("l", NULL,           "swap entered key's endianness"),
+        arg_lit0("l", NULL, "swap entered key's endianness"),
         arg_int1("b", "block", "<dec>", "block number to write"),
         arg_param_end
     };
@@ -1729,7 +1675,7 @@ static int CmdHF14AMfURdBl(const char *Cmd) {
             PrintAndLogEx(INFO, "-----------------------------");
             PrintAndLogEx(INFO, "%02d/0x%02X | %s| %s\n", blockno, blockno, sprint_hex(d, 4), sprint_ascii(d, 4));
         } else {
-            PrintAndLogEx(WARNING, "Failed reading block: (%02x)", isOK);
+            PrintAndLogEx(WARNING, "Failed reading block: ( %02x )", isOK);
         }
     } else {
         PrintAndLogEx(WARNING, "Command execute time-out");
@@ -1906,7 +1852,7 @@ static int CmdHF14AMfUDump(const char *Cmd) {
         arg_param_begin,
         arg_str0("f", "file", "<fn>", "specify a filename for dump file"),
         arg_str0("k", "key", "<hex>", "key for authentication (UL-C 16 bytes, EV1/NTAG 4 bytes)"),
-        arg_lit0("l", NULL,           "swap entered key's endianness"),
+        arg_lit0("l", NULL, "swap entered key's endianness"),
         arg_int0("p", "page", "<dec>", "manually set start page number to start from"),
         arg_int0("q", "qty", "<dec>", "manually set number of pages to dump"),
         arg_param_end
@@ -2154,82 +2100,58 @@ static void wait4response(uint8_t b) {
 //  Restore dump file onto tag
 //
 static int CmdHF14AMfURestore(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mfu restore",
+                  "Restore dumpfile onto card.",
+                  "hf mfu restore -f myfile -s                 -> user specified filename and special write\n"
+                  "hf mfu restore -f myfile -k AABBCCDD -s     -> user specified filename, special write and use key\n"
+                  "hf mfu restore -f myfile -k AABBCCDD -ser   -> user specified filename, special write, use key, ..."
+                  );
 
-    char tempStr[50] = {0};
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1("f", "file", "<fn>", "specify a filename to restore"),
+        arg_str0("k", "key", "<hex>", "key for authentication (UL-C 16 bytes, EV1/NTAG 4 bytes)"),
+        arg_lit0("l", NULL, "swap entered key's endianness"),
+        arg_lit0("s", NULL, "enable special write UID -MAGIC TAG ONLY-"),
+        arg_lit0("e", NULL, "enable special write version/signature -MAGIC NTAG 21* ONLY-"),
+        arg_lit0("r", NULL, "use the password found in dumpfile to configure tag. requires " _YELLOW_("'-e'") " parameter to work"),
+        arg_lit0("v", "verbose", "verbose"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+
+    int fnlen = 0;
     char filename[FILE_PATH_SIZE] = {0};
-    uint8_t authkey[16] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
+
+    int ak_len = 0;
+    uint8_t authkey[16] = {0x00};
     uint8_t *p_authkey = authkey;
-    uint8_t cmdp = 0, keylen = 0;
+    CLIGetHexWithReturn(ctx, 2, authkey, &ak_len);
+
+    bool swap_endian = arg_get_lit(ctx, 3);
+    bool write_special = arg_get_lit(ctx, 4);
+    bool write_extra = arg_get_lit(ctx, 5);
+    bool read_key = arg_get_lit(ctx, 6);
+    bool verbose = arg_get_lit(ctx, 7);
+    CLIParserFree(ctx);
+
     bool hasKey = false;
-    bool swapEndian = false;
-    bool errors = false;
-    bool write_special = false;
-    bool write_extra = false;
-    bool read_key = false;
-    bool verbose = false;
-    size_t filelen = 0;
-
-    memset(authkey, 0x00, sizeof(authkey));
-
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_hf_mfu_restore();
-            case 'k':
-                keylen = param_getstr(Cmd, cmdp + 1, tempStr, sizeof(tempStr));
-                if (keylen == 32 || keylen == 8) { //ul-c or ev1/ntag key length
-                    errors = param_gethex(tempStr, 0, authkey, keylen);
-                    keylen /= 2;
-                } else {
-                    PrintAndLogEx(WARNING, "ERROR: Key is incorrect length\n");
-                    errors = true;
-                }
-                cmdp += 2;
-                hasKey = true;
-                break;
-            case 'l':
-                swapEndian = true;
-                cmdp++;
-                break;
-            case 'f':
-                filelen = param_getstr(Cmd, cmdp + 1, filename, FILE_PATH_SIZE);
-
-                if (filelen > FILE_PATH_SIZE - 5)
-                    filelen = FILE_PATH_SIZE - 5;
-
-                if (filelen < 1)
-                    sprintf(filename, "dumpdata.bin");
-
-                cmdp += 2;
-                break;
-            case 's':
-                cmdp++;
-                write_special = true;
-                break;
-            case 'e':
-                cmdp++;
-                write_extra = true;
-                break;
-            case 'r':
-                cmdp++;
-                read_key = true;
-                break;
-            case 'v':
-                cmdp++;
-                verbose = true;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter: " _RED_("'%c'"), param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-
-    //Validations
-    if (errors || cmdp == 0) return usage_hf_mfu_restore();
 
     uint8_t *dump = NULL;
     size_t bytes_read = 0;
+
+    if (fnlen == 0) {
+        char *fptr = GenerateFilename("hf-mfu-", "-dump.bin");
+        if (fptr != NULL) {
+            strcpy(filename, fptr);
+        } else {
+            snprintf(filename, sizeof(filename), "dumpdata.bin");
+        }            
+        free(fptr);
+    }
+
     if (loadFile_safe(filename, "", (void **)&dump, &bytes_read) != PM3_SUCCESS) {
         PrintAndLogEx(WARNING, "Could not find file " _YELLOW_("%s"), filename);
         return PM3_EIO;
@@ -2263,19 +2185,19 @@ static int CmdHF14AMfURestore(const char *Cmd) {
     printMFUdumpEx(mem, pages, 0);
 
     // Swap endianness
-    if (swapEndian && hasKey) {
-        if (keylen == 16)
-            p_authkey = SwapEndian64(authkey, keylen, 8);
+    if (swap_endian && hasKey) {
+        if (ak_len == 16)
+            p_authkey = SwapEndian64(authkey, ak_len, 8);
         else
-            p_authkey = SwapEndian64(authkey, keylen, 4);
+            p_authkey = SwapEndian64(authkey, ak_len, 4);
     }
 
     uint8_t data[20] = {0};
     uint8_t keytype = 0;
     // set key - only once
     if (hasKey) {
-        keytype = (keylen == 16) ? 1 : 2;
-        memcpy(data + 4, p_authkey, keylen);
+        keytype = (ak_len == 16) ? 1 : 2;
+        memcpy(data + 4, p_authkey, ak_len);
     }
 
     // write version, signature, pack
@@ -2379,16 +2301,54 @@ static int CmdHF14AMfURestore(const char *Cmd) {
 //  Load emulator with dump file
 //
 static int CmdHF14AMfUeLoad(const char *Cmd) {
-    char c = tolower(param_getchar(Cmd, 0));
-    if (c == 'h' || c == 0x00) return usage_hf_mfu_eload();
+
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mfu eload",
+                  "It loads emul dump from the file `filename.eml`",
+                  "hf mfu eload -u -f myfile\n"
+                  "hf mfu eload -u -f myfile -q 57   -> load 57 blocks from myfile"
+                  );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1("f", "file", "<fn>", "specify a filename w/o `.eml` to load"),
+        arg_lit1("u", NULL, "Ultralight Family type"),
+        arg_int0("q", "qty", "<dec>", "number of blocks to load from eml file"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+
+    int fnlen = 0;
+    char filename[FILE_PATH_SIZE] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
+    CLIParserFree(ctx);
+
+    PrintAndLogEx(HINT, "Hint: See " _YELLOW_("`script run hf_mfu_dumptoemulator`") " to convert the .bin to .eml");
     return CmdHF14AMfELoad(Cmd);
 }
 //
 //  Simulate tag
 //
 static int CmdHF14AMfUSim(const char *Cmd) {
-    char c = tolower(param_getchar(Cmd, 0));
-    if (c == 'h' || c == 0x00) return usage_hf_mfu_sim();
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mfu sim",
+                  "Simulate MIFARE Ultralight family type based upon\n"
+                  "ISO/IEC 14443 type A tag with 4,7 or 10 byte UID\n"
+                  "from emulator memory.  See `hf mfu eload` first",
+                  "hf mfu sim -t 2 --uid 1122344556677        -> MIFARE Ultralight\n"
+                  "hf mfu sim -t 7 --uid 1122344556677 -n 5   -> AMIIBO (NTAG 215),  pack 0x8080"
+                  );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_int1("t", "type", "<1-10> ", "Simulation type to use"),
+        arg_str0("u", "uid", "<hex>", "4, 7 or 10 byte UID"),
+        arg_int0("n", "num", "<dec>", "Exit simulation after <numreads> blocks have been read by reader. 0 = infinite"),
+        arg_lit0("v", "verbose", "verbose output"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+    CLIParserFree(ctx);
     return CmdHF14ASim(Cmd);
 }
 
@@ -2396,43 +2356,58 @@ static int CmdHF14AMfUSim(const char *Cmd) {
 // Ultralight C Methods
 //-------------------------------------------------------------------------------
 
-//
 // Ultralight C Authentication
 //
-
 static int CmdHF14AMfUCAuth(const char *Cmd) {
-    uint8_t cmdp = 0;
-    char c = tolower(param_getchar(Cmd, 0));
-    if (c == 'h') {
-        return usage_hf_mfu_ucauth();
-    }
-    bool keep_field_on = false;
-    if (c == 'k') {
-        keep_field_on = true;
-        cmdp++;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mfu cauth",
+                  "Tests 3DES password on Mifare Ultralight-C tag.\n"
+                  "If password is not specified, a set of known defaults will be tested.",
+                  "hf mfu cauth\n"
+                  "hf mfu cauth --key 000102030405060708090a0b0c0d0e0f"
+                  );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("k", "key", "<hex>", "key for authentication (UL-C 16 bytes, EV1/NTAG 4 bytes)"),
+        arg_lit0("l", NULL, "swap entered key's endianness"),
+        arg_lit0("k", NULL, "keep field on (only if a password is provided too)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    
+    int ak_len = 0;
+    uint8_t authenticationkey[16] = {0x00};
+    uint8_t *authKeyPtr = authenticationkey;
+    CLIGetHexWithReturn(ctx, 1, authenticationkey, &ak_len);
+    bool swap_endian = arg_get_lit(ctx, 2);
+    bool keep_field_on = arg_get_lit(ctx, 3);
+    CLIParserFree(ctx);
+
+    if (ak_len != 16 && ak_len != 0) {
+        PrintAndLogEx(WARNING, "ERROR: Key is incorrect length\n");
+        return PM3_EINVARG;
     }
 
-    uint8_t key_buf[16];
-    uint8_t *key;
-    int succeeded;
+    // Swap endianness
+    if (swap_endian && ak_len) {
+        authKeyPtr = SwapEndian64(authenticationkey, 16, 8);
+    }
 
-    // If no hex key is specified, try all known ones
-    if (strlen(Cmd + cmdp) == 0) {
-        succeeded = try_default_3des_keys(&key);
-        // Else try user-supplied
+    bool isok = false;
+
+    // If no hex key is specified, try default keys
+    if (ak_len == 0) {
+        isok = (try_default_3des_keys(&authKeyPtr) == PM3_SUCCESS); 
     } else {
-        if (param_gethex(Cmd, cmdp, key_buf, 32)) {
-            PrintAndLogEx(WARNING, "Password must include 32 HEX symbols");
-            return PM3_EINVARG;
-        }
-        succeeded = ulc_authentication(key_buf, ! keep_field_on);
-        key = key_buf;
+        // try user-supplied
+        isok = ulc_authentication(authKeyPtr, !keep_field_on);
     }
 
-    if (succeeded)
-        PrintAndLogEx(SUCCESS, "Authentication successful. 3des key: %s", sprint_hex(key, 16));
+    if (isok)
+        PrintAndLogEx(SUCCESS, "Authentication success. 3des key: " _GREEN_("%s"), sprint_hex_inrow(authKeyPtr, 16));
     else
-        PrintAndLogEx(WARNING, "Authentication failed");
+        PrintAndLogEx(WARNING, "Authentication ( " _RED_("fail") " )");
 
     return PM3_SUCCESS;
 }
@@ -3484,7 +3459,7 @@ static int CmdHF14MfuNDEF(const char *Cmd) {
     void *argtable[] = {
         arg_param_begin,
         arg_str0("k", "key", "replace default key for NDEF", NULL),
-        arg_lit0("l", "key", "(optional) swap entered key's endianness"),
+        arg_lit0("l", NULL, "swap entered key's endianness"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);

From d08f0d7fe8aed5899cdec4e2f3baead6e749e11a Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 1 Jan 2021 21:01:10 +0100
Subject: [PATCH 271/682] hf mfu setpwd/setuid/keygen - now uses cliparser

---
 client/src/cmdhfmfu.c | 199 +++++++++++++++++++++---------------------
 1 file changed, 100 insertions(+), 99 deletions(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index 8d3e85c36..5f0548968 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -42,41 +42,7 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_hf_mfu_ucsetpwd(void) {
-    PrintAndLogEx(NORMAL, "Set 3DES password on Mifare Ultralight-C tag.");
-    PrintAndLogEx(NORMAL, "Usage:  hf mfu setpwd <password (32 hex symbols)>");
-    PrintAndLogEx(NORMAL, "       [password] - (32 hex symbols)");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("         hf mfu setpwd 000102030405060708090a0b0c0d0e0f"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
 
-static int usage_hf_mfu_ucsetuid(void) {
-    PrintAndLogEx(NORMAL, "Usage:  hf mfu setuid <uid (14 hex symbols)>");
-    PrintAndLogEx(NORMAL, "       [uid] - (14 hex symbols)");
-    PrintAndLogEx(NORMAL, "\n");
-    PrintAndLogEx(NORMAL, "This only works for " _BLUE_("Magic Ultralight") " tags.");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("         hf mfu setuid 11223344556677"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
-
-static int usage_hf_mfu_gendiverse(void) {
-    PrintAndLogEx(NORMAL, "Usage:  hf mfu gen [h] [r] <uid (8 hex symbols)>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "    h       : this help");
-    PrintAndLogEx(NORMAL, "    r       : read uid from tag");
-    PrintAndLogEx(NORMAL, "    <uid>   : 4 byte UID (optional)");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu gen r"));
-    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu gen 11223344"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
 
 static int usage_hf_mfu_pwdgen(void) {
     PrintAndLogEx(NORMAL, "Usage:  hf mfu pwdgen [h|t] [r] <uid (14 hex symbols)>");
@@ -2137,7 +2103,7 @@ static int CmdHF14AMfURestore(const char *Cmd) {
     bool verbose = arg_get_lit(ctx, 7);
     CLIParserFree(ctx);
 
-    bool hasKey = false;
+    bool has_key = false;
 
     uint8_t *dump = NULL;
     size_t bytes_read = 0;
@@ -2185,7 +2151,7 @@ static int CmdHF14AMfURestore(const char *Cmd) {
     printMFUdumpEx(mem, pages, 0);
 
     // Swap endianness
-    if (swap_endian && hasKey) {
+    if (swap_endian && has_key) {
         if (ak_len == 16)
             p_authkey = SwapEndian64(authkey, ak_len, 8);
         else
@@ -2195,7 +2161,7 @@ static int CmdHF14AMfURestore(const char *Cmd) {
     uint8_t data[20] = {0};
     uint8_t keytype = 0;
     // set key - only once
-    if (hasKey) {
+    if (has_key) {
         keytype = (ak_len == 16) ? 1 : 2;
         memcpy(data + 4, p_authkey, ak_len);
     }
@@ -2209,16 +2175,15 @@ static int CmdHF14AMfURestore(const char *Cmd) {
 #define MFU_NTAG_SPECIAL_VERSION    0xFA
 #define MFU_NTAG_SPECIAL_SIGNATURE  0xF2
         // pwd
-        if (hasKey || read_key) {
+        if (has_key || read_key) {
 
+            memcpy(data,  p_authkey, 4);
             if (read_key) {
                 // try reading key from dump and use.
                 memcpy(data, mem->data + (bytes_read - MFU_DUMP_PREFIX_LENGTH - 8), 4);
-            } else {
-                memcpy(data,  p_authkey, 4);
             }
 
-            PrintAndLogEx(NORMAL, "special PWD     block written 0x%X - %s\n", MFU_NTAG_SPECIAL_PWD, sprint_hex(data, 4));
+            PrintAndLogEx(INFO, "special PWD     block written 0x%X - %s\n", MFU_NTAG_SPECIAL_PWD, sprint_hex(data, 4));
             clearCommandBuffer();
             SendCommandMIX(CMD_HF_MIFAREU_WRITEBL, MFU_NTAG_SPECIAL_PWD, keytype, 0, data, sizeof(data));
 
@@ -2234,7 +2199,7 @@ static int CmdHF14AMfURestore(const char *Cmd) {
         memcpy(data, mem->data + (bytes_read - MFU_DUMP_PREFIX_LENGTH - 4), 2);
         data[2] = 0;
         data[3] = 0;
-        PrintAndLogEx(NORMAL, "special PACK    block written 0x%X - %s\n", MFU_NTAG_SPECIAL_PACK, sprint_hex(data, 4));
+        PrintAndLogEx(INFO, "special PACK    block written 0x%X - %s\n", MFU_NTAG_SPECIAL_PACK, sprint_hex(data, 4));
         clearCommandBuffer();
         SendCommandMIX(CMD_HF_MIFAREU_WRITEBL, MFU_NTAG_SPECIAL_PACK, keytype, 0, data, sizeof(data));
         wait4response(MFU_NTAG_SPECIAL_PACK);
@@ -2242,7 +2207,7 @@ static int CmdHF14AMfURestore(const char *Cmd) {
         // Signature
         for (uint8_t s = MFU_NTAG_SPECIAL_SIGNATURE, i = 0; s < MFU_NTAG_SPECIAL_SIGNATURE + 8; s++, i += 4) {
             memcpy(data, mem->signature + i, 4);
-            PrintAndLogEx(NORMAL, "special SIG     block written 0x%X - %s\n", s, sprint_hex(data, 4));
+            PrintAndLogEx(INFO, "special SIG     block written 0x%X - %s\n", s, sprint_hex(data, 4));
             clearCommandBuffer();
             SendCommandMIX(CMD_HF_MIFAREU_WRITEBL, s, keytype, 0, data, sizeof(data));
             wait4response(s);
@@ -2251,7 +2216,7 @@ static int CmdHF14AMfURestore(const char *Cmd) {
         // Version
         for (uint8_t s = MFU_NTAG_SPECIAL_VERSION, i = 0; s < MFU_NTAG_SPECIAL_VERSION + 2; s++, i += 4) {
             memcpy(data, mem->version + i, 4);
-            PrintAndLogEx(NORMAL, "special VERSION block written 0x%X - %s\n", s, sprint_hex(data, 4));
+            PrintAndLogEx(INFO, "special VERSION block written 0x%X - %s\n", s, sprint_hex(data, 4));
             clearCommandBuffer();
             SendCommandMIX(CMD_HF_MIFAREU_WRITEBL, s, keytype, 0, data, sizeof(data));
             wait4response(s);
@@ -2271,14 +2236,14 @@ static int CmdHF14AMfURestore(const char *Cmd) {
         wait4response(b);
         PrintAndLogEx(NORMAL, "." NOLF);
     }
-    PrintAndLogEx(NORMAL, "\n");
+    PrintAndLogEx(NORMAL, "");
 
     // write special data last
     if (write_special) {
 
         PrintAndLogEx(INFO, "Restoring configuration blocks.\n");
 
-        PrintAndLogEx(NORMAL, "authentication with keytype[%x]  %s\n", (uint8_t)(keytype & 0xff), sprint_hex(p_authkey, 4));
+        PrintAndLogEx(INFO, "authentication with keytype[%x]  %s\n", (uint8_t)(keytype & 0xff), sprint_hex(p_authkey, 4));
 
         // otp, uid, lock, cfg1, cfg0, dynlockbits
         uint8_t blocks[] = {3, 0, 1, 2, pages - 5, pages - 4, pages - 3};
@@ -2288,13 +2253,13 @@ static int CmdHF14AMfURestore(const char *Cmd) {
             clearCommandBuffer();
             SendCommandMIX(CMD_HF_MIFAREU_WRITEBL, b, keytype, 0, data, sizeof(data));
             wait4response(b);
-            PrintAndLogEx(NORMAL, "special block written %u - %s\n", b, sprint_hex(data, 4));
+            PrintAndLogEx(INFO, "special block written %u - %s\n", b, sprint_hex(data, 4));
         }
     }
 
     DropField();
     free(dump);
-    PrintAndLogEx(INFO, "Finish restore");
+    PrintAndLogEx(INFO, "Restore finished");
     return PM3_SUCCESS;
 }
 //
@@ -2317,10 +2282,6 @@ static int CmdHF14AMfUeLoad(const char *Cmd) {
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);
-
-    int fnlen = 0;
-    char filename[FILE_PATH_SIZE] = {0};
-    CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
     CLIParserFree(ctx);
 
     PrintAndLogEx(HINT, "Hint: See " _YELLOW_("`script run hf_mfu_dumptoemulator`") " to convert the .bin to .eml");
@@ -2513,26 +2474,38 @@ static int CmdTestDES(const char * cmd)
 // Mifare Ultralight C - Set password
 //
 static int CmdHF14AMfUCSetPwd(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mfu setpwd",
+                  "Set the 3DES key on MIFARE Ultralight-C tag. ",
+                  "hf mfu setpwd --key 000102030405060708090a0b0c0d0e0f"
+                  );
 
-    uint8_t pwd[16] = {0x00};
-    char cmdp = tolower(param_getchar(Cmd, 0));
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("k", "key", "<hex>", "New key (16 bytes)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    
+    int k_len = 0;
+    uint8_t key[16] = {0x00};
+    CLIGetHexWithReturn(ctx, 1, key, &k_len);
+    CLIParserFree(ctx);
 
-    if (strlen(Cmd) == 0  || cmdp == 'h') return usage_hf_mfu_ucsetpwd();
-
-    if (param_gethex(Cmd, 0, pwd, 32)) {
-        PrintAndLogEx(WARNING, "Password must include 32 HEX symbols");
+    if (k_len != 16) {
+        PrintAndLogEx(WARNING, "Key must be 16 hex bytes");
         return PM3_EINVARG;
     }
 
     clearCommandBuffer();
-    SendCommandMIX(CMD_HF_MIFAREUC_SETPWD, 0, 0, 0, pwd, 16);
+    SendCommandMIX(CMD_HF_MIFAREUC_SETPWD, 0, 0, 0, key, sizeof(key));
 
     PacketResponseNG resp;
     if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
         if ((resp.oldarg[0] & 0xff) == 1) {
-            PrintAndLogEx(INFO, "Ultralight-C new password: %s", sprint_hex(pwd, 16));
+            PrintAndLogEx(INFO, "Ultralight-C new key: %s", sprint_hex(key, sizeof(key)));
         } else {
-            PrintAndLogEx(WARNING, "Failed writing at block %u", (uint8_t)(resp.oldarg[1] & 0xff));
+            PrintAndLogEx(WARNING, "Failed writing at block %u", (uint8_t)(resp.oldarg[1] & 0xFF));
             return PM3_ESOFT;
         }
     } else {
@@ -2546,20 +2519,35 @@ static int CmdHF14AMfUCSetPwd(const char *Cmd) {
 // Magic UL / UL-C tags  - Set UID
 //
 static int CmdHF14AMfUCSetUid(const char *Cmd) {
+   
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mfu setuid",
+                  "Set uid on MIFARE Ultralight tag.\n"
+                  "This only works for `magic Ultralight` tags.",
+                  "hf mfu setuid --uid 11223344556677"
+                  );
 
-    PacketResponseNG resp;
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("uk", "uid", "<hex>", "new uid (7 bytes)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    
+    int u_len = 0;
     uint8_t uid[7] = {0x00};
-    char cmdp = tolower(param_getchar(Cmd, 0));
+    CLIGetHexWithReturn(ctx, 1, uid, &u_len);
+    CLIParserFree(ctx);
 
-    if (strlen(Cmd) == 0  || cmdp == 'h') return usage_hf_mfu_ucsetuid();
-
-    if (param_gethex(Cmd, 0, uid, 14)) {
-        PrintAndLogEx(WARNING, "UID must include 14 HEX symbols");
+    if (u_len != 7) {
+        PrintAndLogEx(WARNING, "UID must be 7 hex bytes");
         return PM3_EINVARG;
     }
 
     PrintAndLogEx(INFO, "Please ignore possible transient BCC warnings");
+
     // read block2.
+    PacketResponseNG resp;
     clearCommandBuffer();
     SendCommandMIX(CMD_HF_MIFAREU_READBL, 2, 0, 0, NULL, 0);
     if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
@@ -2632,12 +2620,28 @@ static int CmdHF14AMfUCSetUid(const char *Cmd) {
 }
 
 static int CmdHF14AMfUGenDiverseKeys(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mfu keygen",
+                  "Set the 3DES key on MIFARE Ultralight-C tag. ",
+                  "hf mfu keygen -r\n"
+                  "hf mfu keygen --uid 11223344556677"
+                  );
 
-    uint8_t uid[4];
-    char cmdp = tolower(param_getchar(Cmd, 0));
-    if (strlen(Cmd) == 0  || cmdp == 'h') return usage_hf_mfu_gendiverse();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("u", "uid", "<hex>", "4|7 hex byte UID"),
+        arg_lit0("r", NULL, "read UID from tag"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    
+    int ulen = 0;
+    uint8_t uid[7];
+    CLIGetHexWithReturn(ctx, 1, uid, &ulen);
+    bool read_tag = arg_get_lit(ctx, 2);
+    CLIParserFree(ctx);
 
-    if (cmdp == 'r') {
+    if (read_tag) {
         // read uid from tag
         clearCommandBuffer();
         SendCommandMIX(CMD_HF_ISO14443A_READER, ISO14A_CONNECT | ISO14A_NO_RATS, 0, 0, NULL, 0);
@@ -2656,17 +2660,14 @@ static int CmdHF14AMfUGenDiverseKeys(const char *Cmd) {
             PrintAndLogEx(WARNING, "iso14443a card select failed");
             return PM3_ESOFT;
         }
-        /*
-                if (card.uidlen != 4) {
-                    PrintAndLogEx(WARNING, "Wrong sized UID, expected 4bytes got %d", card.uidlen);
-                    return PM3_ESOFT;
-                }
-        */
-        memcpy(uid, card.uid, card.uidlen);
-    } else {
-        if (param_gethex(Cmd, 0, uid, 8)) return usage_hf_mfu_gendiverse();
-    }
 
+        if (card.uidlen != 4 && card.uidlen != 7) {
+            PrintAndLogEx(WARNING, "Wrong sized UID, expected 4|7 bytes got %d", card.uidlen);
+            return PM3_ESOFT;
+        }
+        ulen = card.uidlen;
+        memcpy(uid, card.uid, card.uidlen);
+    }
 
     uint8_t iv[8] = { 0x00 };
     uint8_t block = 0x01;
@@ -2687,10 +2688,10 @@ static int CmdHF14AMfUGenDiverseKeys(const char *Cmd) {
     mix[6] = block ^ uid[2];
     mix[7] = uid[3];
 
-    mbedtls_des3_context ctx;
-    mbedtls_des3_set2key_enc(&ctx, masterkey);
+    mbedtls_des3_context ctx_des3;
+    mbedtls_des3_set2key_enc(&ctx_des3, masterkey);
 
-    mbedtls_des3_crypt_cbc(&ctx  // des3_context
+    mbedtls_des3_crypt_cbc(&ctx_des3  // des3_context
                            , MBEDTLS_DES_ENCRYPT    // int mode
                            , sizeof(mix)    // length
                            , iv             // iv[8]
@@ -2699,12 +2700,12 @@ static int CmdHF14AMfUGenDiverseKeys(const char *Cmd) {
                           );
 
     PrintAndLogEx(SUCCESS, "-- 3DES version");
-    PrintAndLogEx(SUCCESS, "Masterkey    :\t %s", sprint_hex(masterkey, sizeof(masterkey)));
-    PrintAndLogEx(SUCCESS, "UID          :\t %s", sprint_hex(uid, sizeof(uid)));
-    PrintAndLogEx(SUCCESS, "block        :\t %0d", block);
-    PrintAndLogEx(SUCCESS, "Mifare key   :\t %s", sprint_hex(mifarekeyA, sizeof(mifarekeyA)));
-    PrintAndLogEx(SUCCESS, "Message      :\t %s", sprint_hex(mix, sizeof(mix)));
-    PrintAndLogEx(SUCCESS, "Diversified key: %s", sprint_hex(divkey + 1, 6));
+    PrintAndLogEx(SUCCESS, "Masterkey......... %s", sprint_hex(masterkey, sizeof(masterkey)));
+    PrintAndLogEx(SUCCESS, "UID............... %s", sprint_hex(uid, ulen));
+    PrintAndLogEx(SUCCESS, "block............. %0d", block);
+    PrintAndLogEx(SUCCESS, "Mifare key........ %s", sprint_hex(mifarekeyA, sizeof(mifarekeyA)));
+    PrintAndLogEx(SUCCESS, "Message........... %s", sprint_hex(mix, sizeof(mix)));
+    PrintAndLogEx(SUCCESS, "Diversified key... %s", sprint_hex(divkey + 1, 6));
 
     for (int i = 0; i < ARRAYLEN(mifarekeyA); ++i) {
         dkeyA[i]  = (mifarekeyA[i] << 1) & 0xff;
@@ -2724,9 +2725,9 @@ static int CmdHF14AMfUGenDiverseKeys(const char *Cmd) {
     memcpy(dmkey + 16, dkeyA, 8);
     memset(iv, 0x00, 8);
 
-    mbedtls_des3_set3key_enc(&ctx, dmkey);
+    mbedtls_des3_set3key_enc(&ctx_des3, dmkey);
 
-    mbedtls_des3_crypt_cbc(&ctx  // des3_context
+    mbedtls_des3_crypt_cbc(&ctx_des3  // des3_context
                            , MBEDTLS_DES_ENCRYPT    // int mode
                            , sizeof(newpwd) // length
                            , iv             // iv[8]
@@ -2735,12 +2736,12 @@ static int CmdHF14AMfUGenDiverseKeys(const char *Cmd) {
                           );
 
     PrintAndLogEx(SUCCESS, "\n-- DES version");
-    PrintAndLogEx(SUCCESS, "Mifare dkeyA :\t %s", sprint_hex(dkeyA, sizeof(dkeyA)));
-    PrintAndLogEx(SUCCESS, "Mifare dkeyB :\t %s", sprint_hex(dkeyB, sizeof(dkeyB)));
-    PrintAndLogEx(SUCCESS, "Mifare ABA   :\t %s", sprint_hex(dmkey, sizeof(dmkey)));
-    PrintAndLogEx(SUCCESS, "Mifare Pwd   :\t %s", sprint_hex(newpwd, sizeof(newpwd)));
+    PrintAndLogEx(SUCCESS, "MIFARE dkeyA...... %s", sprint_hex(dkeyA, sizeof(dkeyA)));
+    PrintAndLogEx(SUCCESS, "MIFARE dkeyB...... %s", sprint_hex(dkeyB, sizeof(dkeyB)));
+    PrintAndLogEx(SUCCESS, "MIFARE ABA........ %s", sprint_hex(dmkey, sizeof(dmkey)));
+    PrintAndLogEx(SUCCESS, "MIFARE PWD........ %s", sprint_hex(newpwd, sizeof(newpwd)));
 
-    mbedtls_des3_free(&ctx);
+    mbedtls_des3_free(&ctx_des3);
 
     mbedtls_aes_context ctx_aes;
     uint8_t aes_iv[16] = { 0x00 };
@@ -2752,8 +2753,8 @@ static int CmdHF14AMfUGenDiverseKeys(const char *Cmd) {
     mbedtls_aes_free(&ctx_aes);
 
     PrintAndLogEx(SUCCESS, "\n-- AES version");
-    PrintAndLogEx(SUCCESS, "Mifare AES m :\t %s", sprint_hex(aes_masterkey, sizeof(aes_masterkey)));
-    PrintAndLogEx(SUCCESS, "Mifare Div   :\t %s", sprint_hex(aes_output, sizeof(aes_output)));
+    PrintAndLogEx(SUCCESS, "MIFARE AES mk..... %s", sprint_hex(aes_masterkey, sizeof(aes_masterkey)));
+    PrintAndLogEx(SUCCESS, "MIFARE Div........ %s", sprint_hex(aes_output, sizeof(aes_output)));
 
     // next. from the diversify_key method.
     return PM3_SUCCESS;

From baa7ca086b7b302b402ef6a82a19ee9c749d3e2b Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 1 Jan 2021 21:02:22 +0100
Subject: [PATCH 272/682] hf mfu eview - view emulator memory.  Defaults to
 download and show 0xFF blocks * 4 bytes since we dont know the MFU tag type

---
 client/src/cmdhfmfu.c | 70 ++++++++++++++++++++++++++++++++++++-------
 1 file changed, 59 insertions(+), 11 deletions(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index 5f0548968..d37321b1f 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -3550,26 +3550,74 @@ static int CmdHF14MfuNDEF(const char *Cmd) {
     free(records);
     return status;
 }
+
+static int CmdHF14AMfuEView(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mfu eview",
+                  "It displays emulator memory",
+                  "hf mfu eview"
+                  );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
+
+    uint16_t blocks = 0xFF;
+    uint16_t bytes = blocks * 4;
+
+    uint8_t *dump = calloc(bytes, sizeof(uint8_t));
+    if (dump == NULL) {
+        PrintAndLogEx(WARNING, "Fail, cannot allocate memory");
+        return PM3_EMALLOC;
+    }
+
+    PrintAndLogEx(INFO, "downloading from emulator memory");
+    if (!GetFromDevice(BIG_BUF_EML, dump, bytes, 0, NULL, 0, NULL, 2500, false)) {
+        PrintAndLogEx(WARNING, "Fail, transfer from device time-out");
+        free(dump);
+        return PM3_ETIMEOUT;
+    }
+
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "----+-------------+-------");
+    PrintAndLogEx(INFO, "blk | data        | ascii");
+    PrintAndLogEx(INFO, "----+-------------+-------");
+    for (uint16_t i = 0; i < blocks; i++) {
+        PrintAndLogEx(INFO, "%03d | %s ", i, sprint_hex_ascii(dump + (i * 4), 4));
+    }
+    PrintAndLogEx(INFO, "----+-------------+-------");
+    PrintAndLogEx(NORMAL, "");
+    free(dump);
+    return PM3_SUCCESS;
+}
+
 //------------------------------------
 // Menu Stuff
 //------------------------------------
 static command_t CommandTable[] = {
     {"help",    CmdHelp,                   AlwaysAvailable, "This help"},
-    {"info",    CmdHF14AMfUInfo,           IfPm3Iso14443a,  "Tag information"},
-    {"dump",    CmdHF14AMfUDump,           IfPm3Iso14443a,  "Dump Ultralight / Ultralight-C / NTAG tag to binary file"},
-    {"restore", CmdHF14AMfURestore,        IfPm3Iso14443a,  "Restore a dump onto a MFU MAGIC tag"},
-    {"eload",   CmdHF14AMfUeLoad,          IfPm3Iso14443a,  "load Ultralight .eml dump file into emulator memory"},
-    {"rdbl",    CmdHF14AMfURdBl,           IfPm3Iso14443a,  "Read block"},
-    {"wrbl",    CmdHF14AMfUWrBl,           IfPm3Iso14443a,  "Write block"},
-    {"cauth",   CmdHF14AMfUCAuth,          IfPm3Iso14443a,  "Authentication    - Ultralight C"},
-    {"setpwd",  CmdHF14AMfUCSetPwd,        IfPm3Iso14443a,  "Set 3des password - Ultralight-C"},
-    {"setuid",  CmdHF14AMfUCSetUid,        IfPm3Iso14443a,  "Set UID - MAGIC tags only"},
-    {"sim",     CmdHF14AMfUSim,            IfPm3Iso14443a,  "Simulate Ultralight from emulator memory"},
-    {"gen",     CmdHF14AMfUGenDiverseKeys, AlwaysAvailable, "Generate 3des mifare diversified keys"},
+    {"-----------", CmdHelp,                IfPm3Iso14443a,  "----------------------- " _CYAN_("recovery") " -----------------------"},
+    {"keygen",  CmdHF14AMfUGenDiverseKeys, AlwaysAvailable, "Generate 3DES MIFARE diversified keys"},
     {"pwdgen",  CmdHF14AMfUPwdGen,         AlwaysAvailable, "Generate pwd from known algos"},
     {"otptear", CmdHF14AMfuOtpTearoff,     IfPm3Iso14443a,  "Tear-off test on OTP bits"},
 //    {"countertear", CmdHF14AMfuEv1CounterTearoff,     IfPm3Iso14443a,  "Tear-off test on Ev1 Counter bits"},
+    {"-----------", CmdHelp,                IfPm3Iso14443a,  "----------------------- " _CYAN_("operations") " -----------------------"},
+    {"cauth",   CmdHF14AMfUCAuth,          IfPm3Iso14443a,  "Authentication - Ultralight-C"},
+    {"dump",    CmdHF14AMfUDump,           IfPm3Iso14443a,  "Dump MIFARE Ultralight family tag to binary file"},
+    {"info",    CmdHF14AMfUInfo,           IfPm3Iso14443a,  "Tag information"},
     {"ndef",    CmdHF14MfuNDEF,            IfPm3Iso14443a,  "Prints NDEF records from card"},
+    {"rdbl",    CmdHF14AMfURdBl,           IfPm3Iso14443a,  "Read block"},
+    {"restore", CmdHF14AMfURestore,        IfPm3Iso14443a,  "Restore a dump onto a MFU MAGIC tag"},    
+    {"wrbl",    CmdHF14AMfUWrBl,           IfPm3Iso14443a,  "Write block"},
+    {"-----------", CmdHelp,                IfPm3Iso14443a,  "----------------------- " _CYAN_("simulation") " -----------------------"},    
+    {"eload",   CmdHF14AMfUeLoad,          IfPm3Iso14443a,  "load Ultralight .eml dump file into emulator memory"},    
+    {"eview",   CmdHF14AMfuEView,          IfPm3Iso14443a,  "View emulator memory"},
+    {"sim",     CmdHF14AMfUSim,            IfPm3Iso14443a,  "Simulate MIFARE Ultralight from emulator memory"},
+    {"setpwd",  CmdHF14AMfUCSetPwd,        IfPm3Iso14443a,  "Set 3DES key - Ultralight-C"},
+    {"setuid",  CmdHF14AMfUCSetUid,        IfPm3Iso14443a,  "Set UID - MAGIC tags only"},
     {NULL, NULL, NULL, NULL}
 };
 

From db213522d68b41e575ab0f347badaa52e3a7adf8 Mon Sep 17 00:00:00 2001
From: Samy Kamkar <git@samy.pl>
Date: Fri, 1 Jan 2021 15:47:47 -0800
Subject: [PATCH 273/682] Reorder Lua libs/includes to compile on macOS

Jansson libs/include dirs were taking preference over the included Lua
files, causing system Lua files to interfere with expected includes
---
 client/Makefile | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/client/Makefile b/client/Makefile
index 9cfc4fc4b..29cc37180 100644
--- a/client/Makefile
+++ b/client/Makefile
@@ -115,21 +115,6 @@ STATICLIBS += $(HARDNESTEDLIB)
 LDLIBS +=$(HARDNESTEDLIBLD)
 INCLUDES += $(HARDNESTEDLIBINC)
 
-## Jansson
-ifneq ($(SKIPJANSSONSYSTEM),1)
-    JANSSONINCLUDES = $(shell $(PKG_CONFIG_ENV) pkg-config --cflags jansson 2>/dev/null)
-    JANSSONLDLIBS = $(shell $(PKG_CONFIG_ENV) pkg-config --libs jansson 2>/dev/null)
-    ifneq ($(JANSSONLDLIBS),)
-        JANSSONLIB =
-        JANSSONLIBLD = $(JANSSONLDLIBS)
-        JANSSONLIBINC = $(JANSSONINCLUDES)
-        JANSSON_FOUND = 1
-    endif
-endif
-STATICLIBS += $(JANSSONLIB)
-LDLIBS += $(JANSSONLIBLD)
-INCLUDES += $(JANSSONLIBINC)
-
 ## Lua
 ifneq ($(SKIPLUASYSTEM),1)
     LUAINCLUDES = $(shell $(PKG_CONFIG_ENV) pkg-config --cflags lua5.2 2>/dev/null)
@@ -145,6 +130,21 @@ STATICLIBS += $(LUALIB)
 LDLIBS += $(LUALIBLD)
 INCLUDES += $(LUALIBINC)
 
+## Jansson
+ifneq ($(SKIPJANSSONSYSTEM),1)
+    JANSSONINCLUDES = $(shell $(PKG_CONFIG_ENV) pkg-config --cflags jansson 2>/dev/null)
+    JANSSONLDLIBS = $(shell $(PKG_CONFIG_ENV) pkg-config --libs jansson 2>/dev/null)
+    ifneq ($(JANSSONLDLIBS),)
+        JANSSONLIB =
+        JANSSONLIBLD = $(JANSSONLDLIBS)
+        JANSSONLIBINC = $(JANSSONINCLUDES)
+        JANSSON_FOUND = 1
+    endif
+endif
+STATICLIBS += $(JANSSONLIB)
+LDLIBS += $(JANSSONLIBLD)
+INCLUDES += $(JANSSONLIBINC)
+
 ## mbed TLS
 # system library cannot be used because it is compiled by default without CMAC support
 STATICLIBS += $(MBEDTLSLIB)

From 72896b902e37b484139d57a149efcb2befd5a1c5 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Sat, 2 Jan 2021 13:10:42 +0100
Subject: [PATCH 274/682] comment

---
 client/Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/client/Makefile b/client/Makefile
index 29cc37180..05a0979ae 100644
--- a/client/Makefile
+++ b/client/Makefile
@@ -131,6 +131,7 @@ LDLIBS += $(LUALIBLD)
 INCLUDES += $(LUALIBINC)
 
 ## Jansson
+# Jansson section needs to be after Lua to avoid interferences on macOS if a locally incompatible Lua was available, see PR 1155
 ifneq ($(SKIPJANSSONSYSTEM),1)
     JANSSONINCLUDES = $(shell $(PKG_CONFIG_ENV) pkg-config --cflags jansson 2>/dev/null)
     JANSSONLDLIBS = $(shell $(PKG_CONFIG_ENV) pkg-config --libs jansson 2>/dev/null)

From 4e1a9694a21810cd2b218be96784a94d589e5e3d Mon Sep 17 00:00:00 2001
From: Gator96100 <jupuerzi@gmx.at>
Date: Sun, 3 Jan 2021 02:49:40 +0100
Subject: [PATCH 275/682] Updated precompiled links

Also x86 is no longer supported
---
 README.md | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index 56af79cda..578dccf7f 100644
--- a/README.md
+++ b/README.md
@@ -82,16 +82,13 @@ If you are having troubles with these files, contact the package maintainer @gat
 
 Ref:
 For Proxmark3 RDV4
-- [Precompiled builds for RDV40 dedicated x86](https://drive.google.com/open?id=13zUs-aiQkYaSl5KWrBtuW5IWCoHJPsue)
-- [Precompiled builds for RDV40 dedicated x64](https://drive.google.com/open?id=1SyPB8t5Vo8O0Lh7PjNm3Kv-mO4BNbxjX)
+- [Precompiled builds for RDV40 dedicated x64](https://www.proxmarkbuilds.org/#rdv40-64/)
 
 For Proxmark3 RDV4 with blueshark addon
-- [Precompiled builds for RDV40 dedicated with Bluetooth addon x86](https://drive.google.com/open?id=1TqWYctkRvkLshQ1ZRBHPLDzYHR-asuMO)
-- [Precompiled builds for RDV40 dedicated with Bluetooth addon x64](https://drive.google.com/open?id=17ful7u2QyYmMQzQzc5fAf8nJvyoDJfSL)
+- [Precompiled builds for RDV40 dedicated with Bluetooth addon x64](https://www.proxmarkbuilds.org/#rdv40_bt-64/)
 
 Generice Proxmark3 devices (non RDV4),  for Proxmark3 Easy,  RDV1, RDV2, RDV3, etc etc
-- [Precompiled builds for RRG / Iceman repository x86](https://drive.google.com/open?id=1PI3Xr1mussPBPnYGu4ZjWzGPARK4N7JR)
-- [Precompiled builds for RRG / Iceman repository x64](https://drive.google.com/open?id=1uX9RtYGinuFrpHybu4xq_BE3HrobI20e)
+- [Precompiled builds for RRG / Iceman repository x64](https://www.proxmarkbuilds.org/#rrg_other-64/)
 
 
 ## Roadmap

From eea63a6cb772be7a783f50c11e34d59f57c5481f Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Sun, 3 Jan 2021 22:50:27 +0100
Subject: [PATCH 276/682] first draft half duplex simulation

---
 armsrc/appmain.c         |   2 +-
 armsrc/em4x50.c          | 523 +++++++++++++++++++++++++++++++++++----
 armsrc/em4x50.h          |   2 +-
 client/src/cmdlfem4x50.c |  29 ++-
 client/src/cmdlfem4x70.h |   2 +-
 include/em4x50.h         |   3 +
 6 files changed, 511 insertions(+), 50 deletions(-)

diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index 87b17afd9..6fba90e0e 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -1136,7 +1136,7 @@ static void PacketReceived(PacketCommandNG *packet) {
             // destroy the Emulator Memory.
             //-----------------------------------------------------------------------------
             FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
-            em4x50_sim((uint8_t *)packet->data.asBytes);
+            em4x50_sim();
             break;
         }
         case CMD_LF_EM4X50_READER: {
diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index b03872bea..6c6091a8b 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -11,6 +11,7 @@
 #include "fpgaloader.h"
 #include "ticks.h"
 #include "dbprint.h"
+#include "lfsampling.h"
 #include "lfadc.h"
 #include "lfdemod.h"
 #include "commonutil.h"
@@ -34,14 +35,15 @@
 #define EM4X50_T_TAG_FULL_PERIOD            64
 #define EM4X50_T_TAG_TPP                    64
 #define EM4X50_T_TAG_TWA                    64
+#define EM4X50_T_TAG_TINIT                  2112
+#define EM4X50_T_TAG_TWEE                   3200
 #define EM4X50_T_TAG_WAITING_FOR_SIGNAL     75
 #define EM4X50_T_WAITING_FOR_DBLLIW         1550
-#define EM4X50_T_WAITING_FOR_SNGLLIW        140     // this value seems to be
-// critical;
-// if it's too low
-// (e.g. < 120) some cards
-// are no longer readable
-// although they're ok
+#define EM4X50_T_WAITING_FOR_ACK            4
+
+// the following value seems to be critical; if it's too low (e.g. < 120)
+// some cards are no longer readable although they're ok
+#define EM4X50_T_WAITING_FOR_SNGLLIW        140
 
 #define EM4X50_TAG_TOLERANCE                8
 #define EM4X50_TAG_WORD                     45
@@ -55,6 +57,14 @@
 
 int gHigh = 190;
 int gLow = 60;
+int gcount = 0;
+int gcycles = 0;
+int rm = 0;
+
+static bool em4x50_sim_send_listen_window(void);
+static void em4x50_sim_handle_command(uint8_t command);
+
+void catch_samples(void);
 
 // do nothing for <period> using timer0
 static void wait_timer(uint32_t period) {
@@ -62,7 +72,7 @@ static void wait_timer(uint32_t period) {
     while (AT91C_BASE_TC0->TC_CV < period);
 }
 
-static void catch_samples(void) {
+void catch_samples(void) {
 
     uint8_t sample = 0;
 
@@ -160,19 +170,22 @@ static void em4x50_setup_read(void) {
 
     // Enable Peripheral Clock for
     //   TIMER_CLOCK0, used to measure exact timing before answering
-    AT91C_BASE_PMC->PMC_PCER |= (1 << AT91C_ID_TC0);// | (1 << AT91C_ID_TC1);
+    AT91C_BASE_PMC->PMC_PCER |= (1 << AT91C_ID_TC0) | (1 << AT91C_ID_TC1);
     AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME;
 
     // Disable timer during configuration
     AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;
+    AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
 
     // TC0: Capture mode, default timer source = MCK/2 (TIMER_CLOCK1), no triggers
     AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK;
+    AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK;
 
     // TC1: Capture mode, default timer source = MCK/2 (TIMER_CLOCK1), no triggers
 
     // Enable and reset counters
     AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
+    AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
 
     // synchronized startup procedure
     while (AT91C_BASE_TC0->TC_CV > 0) {}; // wait until TC1 returned to zero
@@ -182,13 +195,27 @@ static void em4x50_setup_read(void) {
 }
 
 static void em4x50_setup_sim(void) {
+    StopTicks();
+
     FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
+
+    sample_config *sc = getSamplingConfig();
+    sc->decimation = 1;
+    sc->averaging = 0;
+    sc->divisor = LF_DIVISOR_125;
+
+    FpgaSendCommand(FPGA_CMD_SET_DIVISOR, sc->divisor);
     FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT);
-    FpgaSendCommand(FPGA_CMD_SET_DIVISOR, LF_DIVISOR_125);
 
     AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK;
     AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
     AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK;
+    
+    AT91C_BASE_PMC->PMC_PCER |= (1 << AT91C_ID_TC0);
+    AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME;
+    AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;
+    AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK;
+    AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
 }
 
 // calculate signal properties (mean amplitudes) from measured data:
@@ -323,12 +350,12 @@ static void em4x50_reader_send_bit(int bit) {
 
     if (bit == 0) {
 
-        // disable modulation (drops the field) for 7 cycles of carrier
+        // disable modulation (activate the field) for 7 cycles of carrier
         // period (Opt64)
         LOW(GPIO_SSC_DOUT);
         while (AT91C_BASE_TC0->TC_CV < T0 * 7);
 
-        // enable modulation (activates the field) for remaining first
+        // enable modulation (drop the field) for remaining first
         // half of bit period
         HIGH(GPIO_SSC_DOUT);
         while (AT91C_BASE_TC0->TC_CV < T0 * EM4X50_T_TAG_HALF_PERIOD);
@@ -432,9 +459,7 @@ static int find_double_listen_window(bool bcommand) {
                 // first listen window found
 
                 if (bcommand) {
-
-//                    SpinDelay(10);
-
+                    
                     // data transmission from card has to be stopped, because
                     // a commamd shall be issued
 
@@ -444,8 +469,6 @@ static int find_double_listen_window(bool bcommand) {
 
                     // skip the next bit...
                     wait_timer(T0 * EM4X50_T_TAG_FULL_PERIOD);
-                    catch_samples();
-                    break;
 
                     // ...and check if the following bit does make sense
                     // (if not it is the correct position within the second
@@ -499,14 +522,19 @@ static int request_receive_mode(void) {
 // If <bliw> is true then within the single listen window right after the
 // ack signal a RM request has to be sent.
 static bool check_ack(bool bliw) {
+    int cnt_pulses = 0;
+    
     AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
+    //while (cnt_pulses < EM4X50_T_WAITING_FOR_ACK) {
     while (AT91C_BASE_TC0->TC_CV < T0 * 4 * EM4X50_T_TAG_FULL_PERIOD) {
 
         if (BUTTON_PRESS())
             return false;
-
+        
         if (check_pulse_length(get_pulse_length(), 2 * EM4X50_T_TAG_FULL_PERIOD)) {
 
+            catch_samples();
+            
             // The received signal is either ACK or NAK.
 
             if (check_pulse_length(get_pulse_length(), 2 * EM4X50_T_TAG_FULL_PERIOD)) {
@@ -542,6 +570,7 @@ static bool check_ack(bool bliw) {
                 break;
             }
         }
+        cnt_pulses++;
     }
 
     return false;
@@ -745,6 +774,154 @@ static bool em4x50_sim_send_word(uint32_t word) {
     return true;
 }
 
+static int wait_cycles(int maxperiods) {
+
+    int period = 0;
+
+    while (period < maxperiods) {
+        
+        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
+        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK);
+        
+        period++;
+    }
+    
+    return PM3_SUCCESS;
+}
+
+static int get_cycles(void) {
+
+    int cycles = 0;
+
+    AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
+    while (AT91C_BASE_TC0->TC_CV < T0 * EM4X50_T_TAG_FULL_PERIOD) {
+
+        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
+        
+        // check again to minimize desynchronization
+        if (AT91C_BASE_TC0->TC_CV >= T0 * EM4X50_T_TAG_FULL_PERIOD)
+            break;
+        
+        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK);
+
+        cycles++;
+    }
+
+    return cycles;
+}
+
+static uint8_t em4x50_sim_read_bit(void) {
+
+    int cond = EM4X50_T_TAG_FULL_PERIOD - EM4X50_TAG_TOLERANCE;
+
+    return (get_cycles() < cond) ? 0 : 1;
+}
+
+static uint8_t em4x50_sim_read_byte(void) {
+    
+    uint8_t byte = 0;
+    
+    for (int i = 0; i < 8; i++) {
+        byte <<= 1;
+        byte |= em4x50_sim_read_bit();
+    }
+        
+    return byte;
+}
+
+static uint8_t em4x50_sim_read_byte_with_parity_check(void) {
+    
+    uint8_t byte = 0, parity = 0, pval = 0;
+    
+    for (int i = 0; i < 8; i++) {
+        byte <<= 1;
+        byte |= em4x50_sim_read_bit();
+        parity ^= (byte & 1);
+    }
+        
+    pval = em4x50_sim_read_bit();
+
+    return (parity == pval) ? byte : 0;
+}
+
+static uint32_t em4x50_sim_read_word(void) {
+    
+    uint8_t parities = 0, parities_calculated = 0, stop_bit = 0;
+    uint8_t bytes[4] = {0};
+
+    // read plain data
+    for (int i = 0; i < 4; i++) {
+        bytes[i] = em4x50_sim_read_byte_with_parity_check();
+    }
+        
+    // read column parities and stop bit
+    parities = em4x50_sim_read_byte();
+    stop_bit = em4x50_sim_read_bit();
+
+    // calculate column parities from data
+    for (int i = 0; i < 8; i++) {
+        parities_calculated <<= 1;
+        for (int j = 0; j < 4; j++) {
+            parities_calculated ^= (bytes[j] >> (7 - i)) & 1;
+        }
+    }
+    
+    // check parities
+    if ((parities == parities_calculated) && (stop_bit == 0)) {
+        return BYTES2UINT32(bytes);
+    }
+    
+    return 0;
+}
+
+static void em4x50_sim_send_ack(void) {
+
+    SHORT_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    OPEN_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    SHORT_COIL();
+    wait_cycles(3 * EM4X50_T_TAG_HALF_PERIOD);
+
+    OPEN_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    SHORT_COIL();
+    wait_cycles(3 * EM4X50_T_TAG_HALF_PERIOD);
+
+    OPEN_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+    
+    SHORT_COIL();
+}
+
+static void em4x50_sim_send_nak(void) {
+
+    SHORT_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    OPEN_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    SHORT_COIL();
+    wait_cycles(3 * EM4X50_T_TAG_HALF_PERIOD);
+
+    OPEN_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    SHORT_COIL();
+    wait_cycles(EM4X50_T_TAG_FULL_PERIOD);
+
+    OPEN_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    SHORT_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+}
+
+/*
 static bool em4x50_sim_send_listen_window(void) {
 
     uint16_t check = 0;
@@ -790,6 +967,257 @@ static bool em4x50_sim_send_listen_window(void) {
     
     return true;
 }
+*/
+
+static void em4x50_sim_handle_login_command(void) {
+
+    //uint8_t *em4x50_mem = BigBuf_get_EM_addr();
+    uint32_t password = 0;
+    //uint32_t tag[EM4X50_NO_WORDS] = {0x0};
+
+    // read password
+    password = em4x50_sim_read_word();
+
+    //for (int i = 0; i < EM4X50_NO_WORDS; i++)
+    //    tag[i] = reflect32(bytes_to_num(em4x50_mem + (i * 4), 4));
+
+    // processing pause time (corresponds to a "1" bit)
+    em4x50_sim_send_bit(1);
+
+    em4x50_sim_send_ack();
+
+    /*
+    if (password == tag[0]) {
+        em4x50_sim_send_ack();
+    } else {
+        em4x50_sim_send_ack();
+    }
+    */
+    
+    // continue with standard read mode
+    em4x50_sim_handle_command(0);
+    Dbprintf("password = %08x", password);
+    BigBuf_free();
+}
+
+static void em4x50_sim_handle_reset_command(void) {
+
+    // processing pause time (corresponds to a "1" bit)
+    em4x50_sim_send_bit(1);
+
+    // send ACK
+    em4x50_sim_send_ack();
+    
+    // wait for tinit
+    wait_timer(T0 * EM4X50_T_TAG_TINIT);
+
+    // continue with standard read mode
+    em4x50_sim_handle_command(0);
+}
+
+static void em4x50_sim_handle_write_command(void) {
+
+    uint8_t *em4x50_mem = BigBuf_get_EM_addr();
+    uint8_t address = 0;
+    uint32_t data = 0;
+    uint32_t tag[EM4X50_NO_WORDS] = {0x0};
+
+    // read address
+    address = em4x50_sim_read_byte_with_parity_check();
+    // read data
+    data = em4x50_sim_read_word();
+    
+    for (int i = 0; i < EM4X50_NO_WORDS; i++) {
+        tag[i] = reflect32(bytes_to_num(em4x50_mem + (i * 4), 4));
+    }
+
+    // extract necessary control data
+    bool raw = (tag[EM4X50_CONTROL] >> CONFIG_BLOCK) & READ_AFTER_WRITE;
+    // extract protection data
+    int fwrp = tag[EM4X50_PROTECTION] & 0xFF;         // first word read protected
+    int lwrp = (tag[EM4X50_PROTECTION] >> 8) & 0xFF;  // last word read protected
+    
+    // save data to tag
+    tag[address] = data;
+    
+    // write access time
+    wait_timer(T0 * EM4X50_T_TAG_TWA);
+
+    if ((address >= fwrp) && (address <= lwrp)) {
+        em4x50_sim_send_nak();
+    } else if ((address == EM4X50_DEVICE_SERIAL)
+               && (address == EM4X50_DEVICE_ID)
+               && (address == 0)
+               ) {
+        em4x50_sim_send_nak();
+    } else {
+        em4x50_sim_send_ack();
+    }
+    
+    // EEPROM write time
+    //wait_timer(T0 * EM4X50_T_TAG_TWEE);
+    
+    em4x50_sim_send_ack();
+
+    // if "read after write" (raw) bit is set, repeat written data once
+    if (raw) {
+        em4x50_sim_send_listen_window();
+        em4x50_sim_send_listen_window();
+        em4x50_sim_send_word(tag[address]);
+    }
+
+    BigBuf_free();
+
+    // continue with standard read mode
+    em4x50_sim_handle_command(0);
+}
+
+static void em4x50_sim_handle_selective_read_command(void) {
+
+    uint8_t *em4x50_mem = BigBuf_get_EM_addr();
+    uint32_t address = 0;
+    uint32_t tag[EM4X50_NO_WORDS] = {0x0};
+
+    // read password
+    address = em4x50_sim_read_word();
+
+    // extract control data
+    int fwr = address & 0xFF;           // first word read
+    int lwr = (address >> 8) & 0xFF;    // last word read
+
+    for (int i = 0; i < EM4X50_NO_WORDS; i++) {
+        tag[i] = reflect32(bytes_to_num(em4x50_mem + (i * 4), 4));
+    }
+
+    // extract protection data
+    int fwrp = tag[EM4X50_PROTECTION] & 0xFF;         // first word read protected
+    int lwrp = (tag[EM4X50_PROTECTION] >> 8) & 0xFF;  // last word read protected
+    
+    // processing pause time (corresponds to a "1" bit)
+    em4x50_sim_send_bit(1);
+
+    em4x50_sim_send_ack();
+    
+    while (BUTTON_PRESS() == false) {
+
+        WDT_HIT();
+        em4x50_sim_send_listen_window();
+        for (int i = fwr; i <= lwr; i++) {
+
+            em4x50_sim_send_listen_window();
+
+            if ((i >= fwrp) && (i <= lwrp)) {
+                em4x50_sim_send_word(0x00);
+            } else {
+                em4x50_sim_send_word(tag[i]);
+            }
+        }
+    }
+    
+    BigBuf_free();
+}
+
+static void em4x50_sim_handle_standard_read_command(void) {
+    
+    uint8_t *em4x50_mem = BigBuf_get_EM_addr();
+    uint32_t tag[EM4X50_NO_WORDS] = {0x0};
+
+    for (int i = 0; i < EM4X50_NO_WORDS; i++) {
+        tag[i] = reflect32(bytes_to_num(em4x50_mem + (i * 4), 4));
+    }
+
+    // extract control data
+    int fwr = tag[CONFIG_BLOCK] & 0xFF;           // first word read
+    int lwr = (tag[CONFIG_BLOCK] >> 8) & 0xFF;    // last word read
+    // extract protection data
+    int fwrp = tag[EM4X50_PROTECTION] & 0xFF;         // first word read protected
+    int lwrp = (tag[EM4X50_PROTECTION] >> 8) & 0xFF;  // last word read protected
+
+    while (BUTTON_PRESS() == false) {
+
+        WDT_HIT();
+        em4x50_sim_send_listen_window();
+        for (int i = fwr; i <= lwr; i++) {
+
+            em4x50_sim_send_listen_window();
+
+            if ((i >= fwrp) && (i <= lwrp)) {
+                em4x50_sim_send_word(0x00);
+            } else {
+                em4x50_sim_send_word(tag[i]);
+            }
+        }
+    }
+    BigBuf_free();
+}
+
+static void em4x50_sim_handle_command(uint8_t command) {
+    
+    switch (command) {
+
+        case EM4X50_COMMAND_LOGIN:
+            em4x50_sim_handle_login_command();
+            break;
+
+        case EM4X50_COMMAND_RESET:
+            em4x50_sim_handle_reset_command();
+            break;
+
+        case EM4X50_COMMAND_WRITE:
+            em4x50_sim_handle_write_command();
+            break;
+
+        case EM4X50_COMMAND_WRITE_PASSWORD:
+            Dbprintf("Command = write_password");
+            break;
+
+        case EM4X50_COMMAND_SELECTIVE_READ:
+            em4x50_sim_handle_selective_read_command();
+            break;
+
+        default:
+            em4x50_sim_handle_standard_read_command();
+            break;
+    }
+}
+
+// reader requests receive mode (rm) by sending two zeros
+static void check_rm_request(void) {
+    
+    int cond = EM4X50_T_TAG_FULL_PERIOD - EM4X50_TAG_TOLERANCE;
+    
+    // look for first zero
+    if (get_cycles() < cond) {
+    
+        // look for second zero
+        if (get_cycles() < cond) {
+
+            // read mode request detected, get command from reader
+            uint8_t command = em4x50_sim_read_byte_with_parity_check();
+            em4x50_sim_handle_command(command);
+        }
+    }
+}
+
+static bool em4x50_sim_send_listen_window(void) {
+
+    SHORT_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    OPEN_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    SHORT_COIL();
+    wait_cycles(2 * EM4X50_T_TAG_FULL_PERIOD);
+
+    OPEN_COIL();
+    check_rm_request();
+
+    SHORT_COIL();
+    wait_cycles(EM4X50_T_TAG_FULL_PERIOD);
+
+    return true;
+}
 
 // simple login to EM4x50,
 // used in operations that require authentication
@@ -805,8 +1233,9 @@ static bool login(uint32_t password) {
         wait_timer(T0 * EM4X50_T_TAG_TPP);
 
         // check if ACK is returned
-        if (check_ack(false))
+        if (check_ack(false)) {
             return PM3_SUCCESS;
+        }
 
     } else {
         if (DBGLEVEL >= DBG_DEBUG)
@@ -1051,6 +1480,7 @@ void em4x50_info(em4x50_data_t *etd) {
     uint32_t addresses = 0x00002100; // read from fwr = 0 to lwr = 33 (0x21)
     uint32_t words[EM4X50_NO_WORDS] = {0x0};
 
+    gcount = 0;
     em4x50_setup_read();
 
     if (get_signalproperties() && find_em4x50_tag()) {
@@ -1064,7 +1494,7 @@ void em4x50_info(em4x50_data_t *etd) {
     }
 
     lf_finalize();
-
+    
     reply_ng(CMD_LF_EM4X50_INFO, status, (uint8_t *)words, EM4X50_TAG_MAX_NO_BYTES);
 }
 
@@ -1081,6 +1511,7 @@ void em4x50_reader(void) {
 
     LOW(GPIO_SSC_DOUT);
     lf_finalize();
+    
     reply_ng(CMD_LF_EM4X50_READER, now, (uint8_t *)words, 4 * now);
 }
 
@@ -1244,35 +1675,22 @@ void em4x50_writepwd(em4x50_data_t *etd) {
 
 // simulate uploaded data in emulator memory
 // (currently simulation allows only a one-way communication)
-void em4x50_sim(uint8_t *filename) {
+void em4x50_sim() {
     int status = PM3_SUCCESS;
     uint8_t *em4x50_mem = BigBuf_get_EM_addr();
     uint32_t words[EM4X50_NO_WORDS] = {0x0};
 
-#ifdef WITH_FLASH
-
-    if (strlen((char *)filename) != 0) {
-
-        BigBuf_free();
-
-        int changed = rdv40_spiffs_lazy_mount();
-        uint32_t size = size_in_spiffs((char *)filename);
-        em4x50_mem = BigBuf_malloc(size);
-
-        rdv40_spiffs_read_as_filetype((char *)filename, em4x50_mem, size, RDV40_SPIFFS_SAFETY_SAFE);
-
-        if (changed)
-            rdv40_spiffs_lazy_unmount();
-    }
-
-#endif
-
     for (int i = 0; i < EM4X50_NO_WORDS; i++)
         words[i] = reflect32(bytes_to_num(em4x50_mem + (i * 4), 4));
 
     // only if valid em4x50 data (e.g. uid == serial)
     if (words[EM4X50_DEVICE_SERIAL] != words[EM4X50_DEVICE_ID]) {
 
+        em4x50_setup_sim();
+
+        em4x50_sim_handle_command(0);
+        
+        /*
         // extract control data
         int fwr = words[CONFIG_BLOCK] & 0xFF;           // first word read
         int lwr = (words[CONFIG_BLOCK] >> 8) & 0xFF;    // last word read
@@ -1280,11 +1698,10 @@ void em4x50_sim(uint8_t *filename) {
         int fwrp = words[EM4X50_PROTECTION] & 0xFF;         // first word read protected
         int lwrp = (words[EM4X50_PROTECTION] >> 8) & 0xFF;  // last word read protected
 
-        em4x50_setup_sim();
-
         // iceman,  will need a usb cmd check to break as well
         while (BUTTON_PRESS() == false) {
 
+            rm = 0;
             WDT_HIT();
             em4x50_sim_send_listen_window();
             for (int i = fwr; i <= lwr; i++) {
@@ -1297,12 +1714,14 @@ void em4x50_sim(uint8_t *filename) {
                     em4x50_sim_send_word(words[i]);
             }
         }
+         */
     } else {
         status = PM3_ENODATA;
     }
 
     BigBuf_free();
     lf_finalize();
+    
     reply_ng(CMD_LF_EM4X50_SIM, status, NULL, 0);
 }
 
@@ -1350,11 +1769,6 @@ void em4x50_test(em4x50_test_t *ett) {
         uint32_t tvallow[ett->cycles];
 
         em4x50_setup_sim();
-        AT91C_BASE_PMC->PMC_PCER |= (1 << AT91C_ID_TC0);
-        AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME;
-        AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;
-        AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK;
-        AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
         while (AT91C_BASE_TC0->TC_CV > 0);
         
         for (int t = 0; t < ett->cycles; t++) {
@@ -1378,5 +1792,24 @@ void em4x50_test(em4x50_test_t *ett) {
 
     }
     
+    em4x50_setup_sim();
+    for (;;) {
+        em4x50_sim_send_listen_window();
+        em4x50_sim_send_listen_window();
+        em4x50_sim_send_bit(0);
+        em4x50_sim_send_bit(0);
+        em4x50_sim_send_bit(0);
+        em4x50_sim_send_ack();
+        em4x50_sim_send_ack();
+        em4x50_sim_send_bit(0);
+        em4x50_sim_send_bit(0);
+        em4x50_sim_send_bit(0);
+        em4x50_sim_send_nak();
+        em4x50_sim_send_nak();
+        em4x50_sim_send_bit(0);
+        em4x50_sim_send_bit(0);
+        em4x50_sim_send_bit(0);
+    }
+    
     reply_ng(CMD_LF_EM4X50_TEST, status, NULL, 0);
 }
diff --git a/armsrc/em4x50.h b/armsrc/em4x50.h
index 87451e198..a753b0808 100644
--- a/armsrc/em4x50.h
+++ b/armsrc/em4x50.h
@@ -19,7 +19,7 @@ void em4x50_writepwd(em4x50_data_t *etd);
 void em4x50_read(em4x50_data_t *etd);
 void em4x50_brute(em4x50_data_t *etd);
 void em4x50_login(uint32_t *password);
-void em4x50_sim(uint8_t *filename);
+void em4x50_sim(void);
 void em4x50_reader(void);
 void em4x50_chk(uint8_t *filename);
 void em4x50_test(em4x50_test_t *ett);
diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c
index a3da00bcc..402c826e4 100644
--- a/client/src/cmdlfem4x50.c
+++ b/client/src/cmdlfem4x50.c
@@ -78,6 +78,31 @@ static void get_samples(void) {
     write_gnuplot_config_file(gHigh, gLow);
 }
 
+/*
+static void get_time_samples(void) {
+
+    const char *fn = "../data/data.dat";
+    FILE *fp = NULL;
+
+    // download from BigBuf memory
+    uint32_t data[EM4X50_MAX_TIME_SAMPLES] = {0x0};
+    if (GetFromDevice(BIG_BUF, (uint8_t *)data, EM4X50_MAX_TIME_SAMPLES, 0, NULL, 0, NULL, 2500, false) == false) {
+        PrintAndLogEx(WARNING, "Fail, transfer from device time-out");
+    }
+
+    if ((fp = fopen(fn, "w+")) == false) {
+        PrintAndLogEx(WARNING, "Fail, open file %s", fn);
+    }
+
+    for (int i = 0; i < EM4X50_MAX_TIME_SAMPLES; i++) {
+        PrintAndLogEx(INFO, "%i %"PRIu32"", i, data[i]);
+        fprintf(fp, "%i %"PRIu32"\n", i, data[i]);
+    }
+
+    fclose(fp);
+}
+*/
+
 static void prepare_result(const uint8_t *data, int fwr, int lwr, em4x50_word_t *words) {
 
     // restructure received result in "em4x50_word_t" structure
@@ -398,6 +423,8 @@ int CmdEM4x50Login(const char *Cmd) {
     else
         PrintAndLogEx(FAILED, "Login " _RED_("failed"));
 
+    get_samples();
+    
     return resp.status;
 }
 
@@ -667,8 +694,6 @@ int CmdEM4x50Read(const char *Cmd) {
         }
     }
 
-    get_samples();
-    
     return em4x50_read(&etd, NULL);
 }
 
diff --git a/client/src/cmdlfem4x70.h b/client/src/cmdlfem4x70.h
index f0f221b06..c72450e88 100644
--- a/client/src/cmdlfem4x70.h
+++ b/client/src/cmdlfem4x70.h
@@ -12,7 +12,7 @@
 #define CMDLFEM4X70_H__
 
 #include "common.h"
-#include "em4x50.h"
+#include "em4x70.h"
 
 #define TIMEOUT                     2000
 
diff --git a/include/em4x50.h b/include/em4x50.h
index 3308a371f..06ca3f10a 100644
--- a/include/em4x50.h
+++ b/include/em4x50.h
@@ -37,6 +37,9 @@
 #define TIMEOUT                     2000
 #define DUMP_FILESIZE               136
 #define EM4X50_MAX_NO_SAMPLES       1000
+#define EM4X50_MAX_TIME_SAMPLES     1000
+
+#define BYTES2UINT32(x) ((x[0] << 24) | (x[1] << 16) | (x[2] << 8) | (x[3]))
 
 typedef struct {
     bool addr_given;

From 9ce99862e89d38af219583a044ed65bad7652a60 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Mon, 4 Jan 2021 00:36:34 +0100
Subject: [PATCH 277/682] make style

---
 client/src/cmdhfmfu.c | 36 ++++++++++++++++++------------------
 doc/commands.md       | 23 ++++++++++++-----------
 2 files changed, 30 insertions(+), 29 deletions(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index d37321b1f..b29c7ab26 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -2072,7 +2072,7 @@ static int CmdHF14AMfURestore(const char *Cmd) {
                   "hf mfu restore -f myfile -s                 -> user specified filename and special write\n"
                   "hf mfu restore -f myfile -k AABBCCDD -s     -> user specified filename, special write and use key\n"
                   "hf mfu restore -f myfile -k AABBCCDD -ser   -> user specified filename, special write, use key, ..."
-                  );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -2114,7 +2114,7 @@ static int CmdHF14AMfURestore(const char *Cmd) {
             strcpy(filename, fptr);
         } else {
             snprintf(filename, sizeof(filename), "dumpdata.bin");
-        }            
+        }
         free(fptr);
     }
 
@@ -2272,7 +2272,7 @@ static int CmdHF14AMfUeLoad(const char *Cmd) {
                   "It loads emul dump from the file `filename.eml`",
                   "hf mfu eload -u -f myfile\n"
                   "hf mfu eload -u -f myfile -q 57   -> load 57 blocks from myfile"
-                  );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -2298,7 +2298,7 @@ static int CmdHF14AMfUSim(const char *Cmd) {
                   "from emulator memory.  See `hf mfu eload` first",
                   "hf mfu sim -t 2 --uid 1122344556677        -> MIFARE Ultralight\n"
                   "hf mfu sim -t 7 --uid 1122344556677 -n 5   -> AMIIBO (NTAG 215),  pack 0x8080"
-                  );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -2326,7 +2326,7 @@ static int CmdHF14AMfUCAuth(const char *Cmd) {
                   "If password is not specified, a set of known defaults will be tested.",
                   "hf mfu cauth\n"
                   "hf mfu cauth --key 000102030405060708090a0b0c0d0e0f"
-                  );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -2336,7 +2336,7 @@ static int CmdHF14AMfUCAuth(const char *Cmd) {
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
-    
+
     int ak_len = 0;
     uint8_t authenticationkey[16] = {0x00};
     uint8_t *authKeyPtr = authenticationkey;
@@ -2359,7 +2359,7 @@ static int CmdHF14AMfUCAuth(const char *Cmd) {
 
     // If no hex key is specified, try default keys
     if (ak_len == 0) {
-        isok = (try_default_3des_keys(&authKeyPtr) == PM3_SUCCESS); 
+        isok = (try_default_3des_keys(&authKeyPtr) == PM3_SUCCESS);
     } else {
         // try user-supplied
         isok = ulc_authentication(authKeyPtr, !keep_field_on);
@@ -2478,7 +2478,7 @@ static int CmdHF14AMfUCSetPwd(const char *Cmd) {
     CLIParserInit(&ctx, "hf mfu setpwd",
                   "Set the 3DES key on MIFARE Ultralight-C tag. ",
                   "hf mfu setpwd --key 000102030405060708090a0b0c0d0e0f"
-                  );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -2486,7 +2486,7 @@ static int CmdHF14AMfUCSetPwd(const char *Cmd) {
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
-    
+
     int k_len = 0;
     uint8_t key[16] = {0x00};
     CLIGetHexWithReturn(ctx, 1, key, &k_len);
@@ -2519,13 +2519,13 @@ static int CmdHF14AMfUCSetPwd(const char *Cmd) {
 // Magic UL / UL-C tags  - Set UID
 //
 static int CmdHF14AMfUCSetUid(const char *Cmd) {
-   
+
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf mfu setuid",
                   "Set uid on MIFARE Ultralight tag.\n"
                   "This only works for `magic Ultralight` tags.",
                   "hf mfu setuid --uid 11223344556677"
-                  );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -2533,7 +2533,7 @@ static int CmdHF14AMfUCSetUid(const char *Cmd) {
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
-    
+
     int u_len = 0;
     uint8_t uid[7] = {0x00};
     CLIGetHexWithReturn(ctx, 1, uid, &u_len);
@@ -2625,7 +2625,7 @@ static int CmdHF14AMfUGenDiverseKeys(const char *Cmd) {
                   "Set the 3DES key on MIFARE Ultralight-C tag. ",
                   "hf mfu keygen -r\n"
                   "hf mfu keygen --uid 11223344556677"
-                  );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -2634,7 +2634,7 @@ static int CmdHF14AMfUGenDiverseKeys(const char *Cmd) {
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
-    
+
     int ulen = 0;
     uint8_t uid[7];
     CLIGetHexWithReturn(ctx, 1, uid, &ulen);
@@ -3556,7 +3556,7 @@ static int CmdHF14AMfuEView(const char *Cmd) {
     CLIParserInit(&ctx, "hf mfu eview",
                   "It displays emulator memory",
                   "hf mfu eview"
-                  );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -3610,10 +3610,10 @@ static command_t CommandTable[] = {
     {"info",    CmdHF14AMfUInfo,           IfPm3Iso14443a,  "Tag information"},
     {"ndef",    CmdHF14MfuNDEF,            IfPm3Iso14443a,  "Prints NDEF records from card"},
     {"rdbl",    CmdHF14AMfURdBl,           IfPm3Iso14443a,  "Read block"},
-    {"restore", CmdHF14AMfURestore,        IfPm3Iso14443a,  "Restore a dump onto a MFU MAGIC tag"},    
+    {"restore", CmdHF14AMfURestore,        IfPm3Iso14443a,  "Restore a dump onto a MFU MAGIC tag"},
     {"wrbl",    CmdHF14AMfUWrBl,           IfPm3Iso14443a,  "Write block"},
-    {"-----------", CmdHelp,                IfPm3Iso14443a,  "----------------------- " _CYAN_("simulation") " -----------------------"},    
-    {"eload",   CmdHF14AMfUeLoad,          IfPm3Iso14443a,  "load Ultralight .eml dump file into emulator memory"},    
+    {"-----------", CmdHelp,                IfPm3Iso14443a,  "----------------------- " _CYAN_("simulation") " -----------------------"},
+    {"eload",   CmdHF14AMfUeLoad,          IfPm3Iso14443a,  "load Ultralight .eml dump file into emulator memory"},
     {"eview",   CmdHF14AMfuEView,          IfPm3Iso14443a,  "View emulator memory"},
     {"sim",     CmdHF14AMfUSim,            IfPm3Iso14443a,  "Simulate MIFARE Ultralight from emulator memory"},
     {"setpwd",  CmdHF14AMfUCSetPwd,        IfPm3Iso14443a,  "Set 3DES key - Ultralight-C"},
diff --git a/doc/commands.md b/doc/commands.md
index f10e7a2bf..fa960f973 100644
--- a/doc/commands.md
+++ b/doc/commands.md
@@ -400,20 +400,21 @@ Check column "offline" for their availability.
 |command                  |offline |description
 |-------                  |------- |-----------
 |`hf mfu help            `|Y       |`This help`
-|`hf mfu info            `|N       |`Tag information`
-|`hf mfu dump            `|N       |`Dump Ultralight / Ultralight-C / NTAG tag to binary file`
-|`hf mfu restore         `|N       |`Restore a dump onto a MFU MAGIC tag`
-|`hf mfu eload           `|N       |`load Ultralight .eml dump file into emulator memory`
-|`hf mfu rdbl            `|N       |`Read block`
-|`hf mfu wrbl            `|N       |`Write block`
-|`hf mfu cauth           `|N       |`Authentication    - Ultralight C`
-|`hf mfu setpwd          `|N       |`Set 3des password - Ultralight-C`
-|`hf mfu setuid          `|N       |`Set UID - MAGIC tags only`
-|`hf mfu sim             `|N       |`Simulate Ultralight from emulator memory`
-|`hf mfu gen             `|Y       |`Generate 3des mifare diversified keys`
+|`hf mfu keygen          `|Y       |`Generate 3DES MIFARE diversified keys`
 |`hf mfu pwdgen          `|Y       |`Generate pwd from known algos`
 |`hf mfu otptear         `|N       |`Tear-off test on OTP bits`
+|`hf mfu cauth           `|N       |`Authentication - Ultralight-C`
+|`hf mfu dump            `|N       |`Dump MIFARE Ultralight family tag to binary file`
+|`hf mfu info            `|N       |`Tag information`
 |`hf mfu ndef            `|N       |`Prints NDEF records from card`
+|`hf mfu rdbl            `|N       |`Read block`
+|`hf mfu restore         `|N       |`Restore a dump onto a MFU MAGIC tag`
+|`hf mfu wrbl            `|N       |`Write block`
+|`hf mfu eload           `|N       |`load Ultralight .eml dump file into emulator memory`
+|`hf mfu eview           `|N       |`View emulator memory`
+|`hf mfu sim             `|N       |`Simulate MIFARE Ultralight from emulator memory`
+|`hf mfu setpwd          `|N       |`Set 3DES key - Ultralight-C`
+|`hf mfu setuid          `|N       |`Set UID - MAGIC tags only`
 
 
 ### hf mfdes

From eaee80f3d7a2fafabe54c125e7f690f9185697e0 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Mon, 4 Jan 2021 00:54:34 +0100
Subject: [PATCH 278/682] update changelog

---
 CHANGELOG.md    | 7 ++++++-
 client/src/ui.c | 1 +
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0f890c8d5..b00aef560 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,7 +3,12 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
-- Added `ICE_STATE_DUMP_SIM` - standalone mode for dumping/simming one iClass tag (@iconicsec)
+ - Added support for debugging ARM with JTAG & VSCode (@Gator96100)
+ - Added MFUL "Gen1b" suport to `hf_mfu_setuid.lua` (@iceman1001)
+ - Added possibility to get bargraph in `lf tune` and `hf tune` (@iceman1001, @doegox)
+ - Added `hf emrtd` ePassport dumping and parsing (@aveao)
+ - Added `aidsearch` to `hf 14b info` (@iceman1001)
+ - Added `ICE_STATE_DUMP_SIM` - standalone mode for dumping/simming one iClass tag (@iconicsec)
  - Added  `lf em 4x50 eview` - show uploaded EM4x50 data in emul memory (@tharexde) 
  - Fix `data rawdemod` parsing for psk2 and user defined clock (@cyberpunk-re)
  - Added `hf iclass encode` - encode a wiegand binary to a encrypted credential (@iceman1001)
diff --git a/client/src/ui.c b/client/src/ui.c
index b7e63e7dd..327d266bf 100644
--- a/client/src/ui.c
+++ b/client/src/ui.c
@@ -22,6 +22,7 @@
 #include <stdlib.h>
 
 #ifdef HAVE_READLINE
+//Load readline after stdio.h
 #include <readline/readline.h>
 #endif
 

From ecd52347fa021f8167147c3c46b3951e6b4e8a41 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 3 Jan 2021 19:27:20 -0500
Subject: [PATCH 279/682] Add support for Apple Silicon (M1)

---
 CHANGELOG.md                                     |  1 +
 Makefile.defs                                    |  5 +++++
 client/CMakeLists.txt                            | 16 +++++++++++++---
 client/Makefile                                  |  7 +++----
 ...ac-OS-X-Homebrew-Installation-Instructions.md | 16 ++++++++++++++++
 5 files changed, 38 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b00aef560..e5050bb6e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+ - Fixed Makefile to account for changes when running on Apple Silicon (@tcprst)
  - Added support for debugging ARM with JTAG & VSCode (@Gator96100)
  - Added MFUL "Gen1b" suport to `hf_mfu_setuid.lua` (@iceman1001)
  - Added possibility to get bargraph in `lf tune` and `hf tune` (@iceman1001, @doegox)
diff --git a/Makefile.defs b/Makefile.defs
index b86b477aa..23dab5b32 100644
--- a/Makefile.defs
+++ b/Makefile.defs
@@ -57,6 +57,11 @@ else
   RANLIB= ranlib
 endif
 
+# For detection of Apple Silicon
+ifeq ($(platform),Darwin)
+  BREW_PREFIX = $(shell brew --prefix)
+endif
+
 ifeq ($(DEBUG),1)
   DEFCXXFLAGS = -g -O0 -pipe
   DEFCFLAGS = -g -O0 -fstrict-aliasing -pipe
diff --git a/client/CMakeLists.txt b/client/CMakeLists.txt
index ec1a28e60..ddfd288b2 100644
--- a/client/CMakeLists.txt
+++ b/client/CMakeLists.txt
@@ -32,7 +32,7 @@ find_package(PkgConfig)
 if (NOT SKIPQT EQUAL 1)
     if(APPLE AND EXISTS /usr/local/opt/qt5)
         # Homebrew installs Qt5 (up to at least 5.11.0) in
-        # /usr/local/qt5. Ensure that it can be found by CMake
+        # /usr/local/opt/qt5. Ensure that it can be found by CMake
         # since it is not in the default /usr/local prefix.
         # Add it to PATHS so that it doesn't override the
         # CMAKE_PREFIX_PATH environment variable.
@@ -40,6 +40,16 @@ if (NOT SKIPQT EQUAL 1)
         # e.g. find_package(Qt5Core ${QT_FIND_PACKAGE_OPTIONS})
         list(APPEND QT_FIND_PACKAGE_OPTIONS PATHS /usr/local/opt/qt5)
     endif(APPLE AND EXISTS /usr/local/opt/qt5)
+    if(APPLE AND EXISTS /opt/homebrew/opt/qt5)
+        # Homebrew on Apple Silicon installs Qt5 in
+        # /opt/homebrew/opt/qt5. Ensure that it can be found by CMake
+        # since it is not in the default /usr/local prefix.
+        # Add it to PATHS so that it doesn't override the
+        # CMAKE_PREFIX_PATH environment variable.
+        # QT_FIND_PACKAGE_OPTIONS should be passed to find_package,
+        # e.g. find_package(Qt5Core ${QT_FIND_PACKAGE_OPTIONS})
+        list(APPEND QT_FIND_PACKAGE_OPTIONS PATHS /opt/homebrew/opt/qt5)
+    endif(APPLE AND EXISTS /opt/homebrew/opt/qt5)
     set(QT_PACKAGELIST
         Qt5Core
         Qt5Widgets
@@ -77,8 +87,8 @@ endif (EMBED_READLINE OR EMBED_BZIP2)
 
 if (NOT SKIPREADLINE EQUAL 1)
     if (APPLE)
-      find_path(READLINE_INCLUDE_DIRS readline/readline.h /usr/local/opt/readline/include /opt/local/include /opt/include /usr/local/include /usr/include NO_DEFAULT_PATH)
-      find_library(READLINE_LIBRARIES readline /usr/local/opt/readline/lib /opt/local/lib /opt/lib /usr/local/lib /usr/lib NO_DEFAULT_PATH)
+      find_path(READLINE_INCLUDE_DIRS readline/readline.h /usr/local/opt/readline/include /opt/local/include /opt/include /usr/local/include /usr/include /opt/homebrew/opt/readline/include NO_DEFAULT_PATH)
+      find_library(READLINE_LIBRARIES readline /usr/local/opt/readline/lib /opt/local/lib /opt/lib /usr/local/lib /usr/lib /opt/homebrew/opt/readline/lib NO_DEFAULT_PATH)
     endif (APPLE)
     if (EMBED_READLINE)
         ExternalProject_Add(ncurses
diff --git a/client/Makefile b/client/Makefile
index 05a0979ae..a756a2ede 100644
--- a/client/Makefile
+++ b/client/Makefile
@@ -17,8 +17,7 @@ vpath %.dic dictionaries
 OBJDIR = obj
 
 ifeq ($(platform),Darwin)
-    # cf brew info qt: qt not symlinked anymore
-    PKG_CONFIG_ENV := PKG_CONFIG_PATH=/usr/local/opt/qt/lib/pkgconfig
+	PKG_CONFIG_ENV := PKG_CONFIG_PATH=$(BREW_PREFIX)/opt/qt/lib/pkgconfig
 endif
 
 ###################
@@ -279,8 +278,8 @@ CXXINCLUDES += $(QTINCLUDES)
 ## Readline
 ifneq ($(SKIPREADLINE),1)
     ifeq ($(platform),Darwin)
-        LDLIBS += -L/usr/local/opt/readline/lib
-        INCLUDES += -I/usr/local/opt/readline/include
+		LDLIBS += -L$(BREW_PREFIX)/opt/readline/lib
+		INCLUDES += -I$(BREW_PREFIX)/opt/readline/include
     endif
     LDLIBS += -lreadline
     READLINE_FOUND = 1
diff --git a/doc/md/Installation_Instructions/Mac-OS-X-Homebrew-Installation-Instructions.md b/doc/md/Installation_Instructions/Mac-OS-X-Homebrew-Installation-Instructions.md
index 6e21f852b..dbd2b2636 100644
--- a/doc/md/Installation_Instructions/Mac-OS-X-Homebrew-Installation-Instructions.md
+++ b/doc/md/Installation_Instructions/Mac-OS-X-Homebrew-Installation-Instructions.md
@@ -1,5 +1,21 @@
 # Homebrew (Mac OS X), automatic installation
 
+## Apple Silicon (M1) Notes
+
+Ensure Rosetta 2 is installed as it's currently needed to run `arm-none-eabi-gcc` as it's delivered as a precombiled x86_64 binary.
+
+If you see an error like:
+
+```sh
+bad CPU type in executable
+```
+
+Then you are missing Rosetta 2 and need to install it: `/usr/sbin/softwareupdate --install-rosetta`
+
+Homebrew has changed their prefix to differentiate between native Apple Silicon and Intel compiled binaries.  The Makefile attempts to account for this but please note that whichever terminal or application you're using must be running under Architecture "Apple" as seen by Activity Monitor as all child processes inherit the Rosetta 2 environment of their parent.  You can check which architecture you're currently running under with a `uname -m` in your terminal.
+
+Visual Studio Code still runs under Rosetta 2 and if you're developing for proxmark3 on an Apple Silicon Mac you might want to consider running the Insiders build which has support for running natively on Apple Silicon.
+
 ## Install Proxmark3 tools
 
 These instructions comes from @Chrisfu, where we got the proxmark3.rb scriptfile from.

From 4daf4a8d538b9ee3dfe2fc8002d8472eb67433f3 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 4 Jan 2021 00:32:59 +0000
Subject: [PATCH 280/682] Create ubuntu-build-and-test.yml

---
 .github/workflows/ubuntu-build-and-test.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 .github/workflows/ubuntu-build-and-test.yml

diff --git a/.github/workflows/ubuntu-build-and-test.yml b/.github/workflows/ubuntu-build-and-test.yml
new file mode 100644
index 000000000..8967451c9
--- /dev/null
+++ b/.github/workflows/ubuntu-build-and-test.yml
@@ -0,0 +1,12 @@
+name: Ubuntu Build and Test
+
+on: [push, pull_request]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: make all
+      run: make all

From e3119abd98373dee8b0900f4e280a0b00a371e84 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 4 Jan 2021 00:38:58 +0000
Subject: [PATCH 281/682] Install deps on ubuntu builder

Stolen from https://gitlab.com/mirrorbuilds/ci-configs/-/blob/master/iceman-pm3/.gitlab-ci.yml by @linuxgemini
---
 .github/workflows/ubuntu-build-and-test.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ubuntu-build-and-test.yml b/.github/workflows/ubuntu-build-and-test.yml
index 8967451c9..adecebcb8 100644
--- a/.github/workflows/ubuntu-build-and-test.yml
+++ b/.github/workflows/ubuntu-build-and-test.yml
@@ -8,5 +8,7 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
+    - name: Install dependencies
+      run: apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
     - name: make all
       run: make all

From cc9b80915117827f4f84a44f55424d8e1689aa4f Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 4 Jan 2021 00:44:41 +0000
Subject: [PATCH 282/682] sudo

---
 .github/workflows/ubuntu-build-and-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ubuntu-build-and-test.yml b/.github/workflows/ubuntu-build-and-test.yml
index adecebcb8..86e8dd0a8 100644
--- a/.github/workflows/ubuntu-build-and-test.yml
+++ b/.github/workflows/ubuntu-build-and-test.yml
@@ -9,6 +9,6 @@ jobs:
     steps:
     - uses: actions/checkout@v2
     - name: Install dependencies
-      run: apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
+      run: sudo apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
     - name: make all
       run: make all

From 37791bbbf84232cab6dbfc9782f509a47546afb5 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 4 Jan 2021 00:46:28 +0000
Subject: [PATCH 283/682] Update and upgrade before installing deps

---
 .github/workflows/ubuntu-build-and-test.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ubuntu-build-and-test.yml b/.github/workflows/ubuntu-build-and-test.yml
index 86e8dd0a8..3ec11b05a 100644
--- a/.github/workflows/ubuntu-build-and-test.yml
+++ b/.github/workflows/ubuntu-build-and-test.yml
@@ -8,6 +8,10 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
+    - name: Update apt repos
+      run: sudo apt-get update
+    - name: Update packages
+      run: sudo apt-get upgrade -yqq
     - name: Install dependencies
       run: sudo apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
     - name: make all

From 2d6119b5cd4c19ee6b239f38ac5ed5480435032a Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 4 Jan 2021 00:57:05 +0000
Subject: [PATCH 284/682] Add tests to ubuntu CI

---
 .github/workflows/ubuntu-build-and-test.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ubuntu-build-and-test.yml b/.github/workflows/ubuntu-build-and-test.yml
index 3ec11b05a..8bc11dbbf 100644
--- a/.github/workflows/ubuntu-build-and-test.yml
+++ b/.github/workflows/ubuntu-build-and-test.yml
@@ -14,5 +14,7 @@ jobs:
       run: sudo apt-get upgrade -yqq
     - name: Install dependencies
       run: sudo apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
-    - name: make all
-      run: make all
+    - name: Build
+      run: make clean && make V=1
+    - name: Test
+      run: make check

From fdb28dd95e287ab00b2381114ecc609f50b2b81d Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 4 Jan 2021 04:05:19 +0300
Subject: [PATCH 285/682] github actions: add macos action

---
 .github/workflows/macos-build-and-test.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 .github/workflows/macos-build-and-test.yml

diff --git a/.github/workflows/macos-build-and-test.yml b/.github/workflows/macos-build-and-test.yml
new file mode 100644
index 000000000..dff98dd2d
--- /dev/null
+++ b/.github/workflows/macos-build-and-test.yml
@@ -0,0 +1,22 @@
+name: MacOS Build and Test
+
+on: [push, pull_request]
+
+jobs:
+  build:
+    runs-on: macos-latest
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Update brew repos
+      run: brew update
+    - name: Update packages
+      run: brew upgrade
+    - name: Tap RfidResearchGroup/proxmark3
+      run: brew tap RfidResearchGroup/proxmark3
+    - name: Install dependencies
+      run: readline qt5 RfidResearchGroup/proxmark3/arm-none-eabi-gcc
+    - name: Build
+      run: make clean && make V=1
+    - name: Test
+      run: make check

From 7db332a6de4bf2f4abe62b9dca7aebf187fe96c8 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 4 Jan 2021 04:13:27 +0300
Subject: [PATCH 286/682] gh actions: Add ubuntu with make w/ btaddon and cmake

---
 .../{macos-build-and-test.yml => macos.yml}   |  0
 .github/workflows/ubuntu-cmake.yml            | 20 +++++++++++++++++++
 .github/workflows/ubuntu-make-btaddon.yml     | 20 +++++++++++++++++++
 ...ntu-build-and-test.yml => ubuntu-make.yml} |  4 ++--
 4 files changed, 42 insertions(+), 2 deletions(-)
 rename .github/workflows/{macos-build-and-test.yml => macos.yml} (100%)
 create mode 100644 .github/workflows/ubuntu-cmake.yml
 create mode 100644 .github/workflows/ubuntu-make-btaddon.yml
 rename .github/workflows/{ubuntu-build-and-test.yml => ubuntu-make.yml} (92%)

diff --git a/.github/workflows/macos-build-and-test.yml b/.github/workflows/macos.yml
similarity index 100%
rename from .github/workflows/macos-build-and-test.yml
rename to .github/workflows/macos.yml
diff --git a/.github/workflows/ubuntu-cmake.yml b/.github/workflows/ubuntu-cmake.yml
new file mode 100644
index 000000000..539ac252d
--- /dev/null
+++ b/.github/workflows/ubuntu-cmake.yml
@@ -0,0 +1,20 @@
+name: Ubuntu (cmake) Build and Test
+
+on: [push, pull_request]
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Update apt repos
+      run: sudo apt-get update
+    - name: Update packages
+      run: sudo apt-get upgrade -yqq
+    - name: Install dependencies
+      run: sudo apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
+    - name: Build
+      run: mkdir -p client/build && ( cd client/build && cmake .. && make VERBOSE=1 )
+    - name: Test
+      run: make client/check CHECKARGS="--clientbin ./client/build/proxmark3"
diff --git a/.github/workflows/ubuntu-make-btaddon.yml b/.github/workflows/ubuntu-make-btaddon.yml
new file mode 100644
index 000000000..e8de696a7
--- /dev/null
+++ b/.github/workflows/ubuntu-make-btaddon.yml
@@ -0,0 +1,20 @@
+name: Ubuntu (make with BTADDON) Build and Test
+
+on: [push, pull_request]
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Update apt repos
+      run: sudo apt-get update
+    - name: Update packages
+      run: sudo apt-get upgrade -yqq
+    - name: Install dependencies
+      run: sudo apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
+    - name: Build
+      run: make clean && make V=1 PLATFORM_EXTRAS=BTADDON
+    - name: Test
+      run: make check
diff --git a/.github/workflows/ubuntu-build-and-test.yml b/.github/workflows/ubuntu-make.yml
similarity index 92%
rename from .github/workflows/ubuntu-build-and-test.yml
rename to .github/workflows/ubuntu-make.yml
index 8bc11dbbf..958c9c35d 100644
--- a/.github/workflows/ubuntu-build-and-test.yml
+++ b/.github/workflows/ubuntu-make.yml
@@ -1,9 +1,9 @@
-name: Ubuntu Build and Test
+name: Ubuntu (make) Build and Test
 
 on: [push, pull_request]
 
 jobs:
-  build:
+  build-and-test:
     runs-on: ubuntu-latest
 
     steps:

From 3dfc068a284e4f49a7aa528983e0f6ba3f097f89 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 4 Jan 2021 04:15:54 +0300
Subject: [PATCH 287/682] github actions: macos bugfix

---
 .github/workflows/macos.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index dff98dd2d..ff72a0e3d 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -8,9 +8,11 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
+    - name: Brew python bug workaround
+      run: brew link --overwrite python
     - name: Update brew repos
       run: brew update
-    - name: Update packages
+    - name: Upgrade packages
       run: brew upgrade
     - name: Tap RfidResearchGroup/proxmark3
       run: brew tap RfidResearchGroup/proxmark3

From 96127e0da3447bd93a50288990857834aacf9327 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 4 Jan 2021 04:17:58 +0300
Subject: [PATCH 288/682] github actions: don't upgrade packages

---
 .github/workflows/macos.yml               | 4 +---
 .github/workflows/ubuntu-cmake.yml        | 2 --
 .github/workflows/ubuntu-make-btaddon.yml | 2 --
 .github/workflows/ubuntu-make.yml         | 2 --
 4 files changed, 1 insertion(+), 9 deletions(-)

diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index ff72a0e3d..3eb0b8584 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -12,12 +12,10 @@ jobs:
       run: brew link --overwrite python
     - name: Update brew repos
       run: brew update
-    - name: Upgrade packages
-      run: brew upgrade
     - name: Tap RfidResearchGroup/proxmark3
       run: brew tap RfidResearchGroup/proxmark3
     - name: Install dependencies
-      run: readline qt5 RfidResearchGroup/proxmark3/arm-none-eabi-gcc
+      run: brew install readline qt5 RfidResearchGroup/proxmark3/arm-none-eabi-gcc
     - name: Build
       run: make clean && make V=1
     - name: Test
diff --git a/.github/workflows/ubuntu-cmake.yml b/.github/workflows/ubuntu-cmake.yml
index 539ac252d..dd99487f1 100644
--- a/.github/workflows/ubuntu-cmake.yml
+++ b/.github/workflows/ubuntu-cmake.yml
@@ -10,8 +10,6 @@ jobs:
     - uses: actions/checkout@v2
     - name: Update apt repos
       run: sudo apt-get update
-    - name: Update packages
-      run: sudo apt-get upgrade -yqq
     - name: Install dependencies
       run: sudo apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
     - name: Build
diff --git a/.github/workflows/ubuntu-make-btaddon.yml b/.github/workflows/ubuntu-make-btaddon.yml
index e8de696a7..0e11f01c3 100644
--- a/.github/workflows/ubuntu-make-btaddon.yml
+++ b/.github/workflows/ubuntu-make-btaddon.yml
@@ -10,8 +10,6 @@ jobs:
     - uses: actions/checkout@v2
     - name: Update apt repos
       run: sudo apt-get update
-    - name: Update packages
-      run: sudo apt-get upgrade -yqq
     - name: Install dependencies
       run: sudo apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
     - name: Build
diff --git a/.github/workflows/ubuntu-make.yml b/.github/workflows/ubuntu-make.yml
index 958c9c35d..f4f7d0113 100644
--- a/.github/workflows/ubuntu-make.yml
+++ b/.github/workflows/ubuntu-make.yml
@@ -10,8 +10,6 @@ jobs:
     - uses: actions/checkout@v2
     - name: Update apt repos
       run: sudo apt-get update
-    - name: Update packages
-      run: sudo apt-get upgrade -yqq
     - name: Install dependencies
       run: sudo apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
     - name: Build

From 4a6b2d4390a4666e5208c4a8da3ae37ea68315fa Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Mon, 4 Jan 2021 04:26:56 +0300
Subject: [PATCH 289/682] github actions: Introduce build variants for macos
 too

---
 .github/workflows/macos-cmake.yaml            | 20 +++++++++++++++++++
 .github/workflows/macos-make-btaddon.yml      | 20 +++++++++++++++++++
 .../workflows/{macos.yml => macos-make.yml}   |  4 +---
 3 files changed, 41 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/macos-cmake.yaml
 create mode 100644 .github/workflows/macos-make-btaddon.yml
 rename .github/workflows/{macos.yml => macos-make.yml} (81%)

diff --git a/.github/workflows/macos-cmake.yaml b/.github/workflows/macos-cmake.yaml
new file mode 100644
index 000000000..8c6a41f37
--- /dev/null
+++ b/.github/workflows/macos-cmake.yaml
@@ -0,0 +1,20 @@
+name: MacOS (cmake) Build and Test
+
+on: [push, pull_request]
+
+jobs:
+  build:
+    runs-on: macos-latest
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Update brew repos
+      run: brew update
+    - name: Tap RfidResearchGroup/proxmark3
+      run: brew tap RfidResearchGroup/proxmark3
+    - name: Install dependencies
+      run: brew install readline qt5 RfidResearchGroup/proxmark3/arm-none-eabi-gcc
+    - name: Build
+      run: mkdir -p client/build && ( cd client/build && cmake .. && make VERBOSE=1 )
+    - name: Test
+      run: make client/check CHECKARGS="--clientbin ./client/build/proxmark3"
diff --git a/.github/workflows/macos-make-btaddon.yml b/.github/workflows/macos-make-btaddon.yml
new file mode 100644
index 000000000..9d5b75ff7
--- /dev/null
+++ b/.github/workflows/macos-make-btaddon.yml
@@ -0,0 +1,20 @@
+name: MacOS (make with BTADDON) Build and Test
+
+on: [push, pull_request]
+
+jobs:
+  build:
+    runs-on: macos-latest
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Update brew repos
+      run: brew update
+    - name: Tap RfidResearchGroup/proxmark3
+      run: brew tap RfidResearchGroup/proxmark3
+    - name: Install dependencies
+      run: brew install readline qt5 RfidResearchGroup/proxmark3/arm-none-eabi-gcc
+    - name: Build
+      run: make clean && make V=1 PLATFORM_EXTRAS=BTADDON
+    - name: Test
+      run: make check
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos-make.yml
similarity index 81%
rename from .github/workflows/macos.yml
rename to .github/workflows/macos-make.yml
index 3eb0b8584..a612bcda2 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos-make.yml
@@ -1,4 +1,4 @@
-name: MacOS Build and Test
+name: MacOS (make) Build and Test
 
 on: [push, pull_request]
 
@@ -8,8 +8,6 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
-    - name: Brew python bug workaround
-      run: brew link --overwrite python
     - name: Update brew repos
       run: brew update
     - name: Tap RfidResearchGroup/proxmark3

From 38332d2fcf04f019a4001ae483f8c5db52d67d08 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 4 Jan 2021 11:11:05 +0100
Subject: [PATCH 290/682] hf mfu otptear/pwdgen - now supports cliparser

---
 client/src/cmdhfmfu.c  | 289 +++++++++++++++++++----------------------
 doc/cliparser_todo.txt |  15 ---
 2 files changed, 137 insertions(+), 167 deletions(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index b29c7ab26..9c0534c75 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -42,45 +42,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-
-
-static int usage_hf_mfu_pwdgen(void) {
-    PrintAndLogEx(NORMAL, "Usage:  hf mfu pwdgen [h|t] [r] <uid (14 hex symbols)>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "    h       : this help");
-    PrintAndLogEx(NORMAL, "    t       : selftest");
-    PrintAndLogEx(NORMAL, "    r       : read uid from tag");
-    PrintAndLogEx(NORMAL, "    <uid>   : 7 byte UID (optional)");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu pwdgen r"));
-    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu pwdgen 11223344556677"));
-    PrintAndLogEx(NORMAL, _YELLOW_("        hf mfu pwdgen t"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
-
-static int usage_hf_mfu_otp_tearoff(void) {
-    PrintAndLogEx(NORMAL, "Tear-off test against OTP block (no 3) on MFU tags - More help sooner or later\n");
-    PrintAndLogEx(NORMAL, "Usage:  hf mfu otptear b <block number> i <intervalTime> l <limitTime> s <startTime> d <data before> t <data after>\n");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "  b <no>    : (optional) block to run the test -  default block: 8 (not OTP for safety)");
-    PrintAndLogEx(NORMAL, "  i <time>  : (optional) time interval to increase in each test - default 500 us");
-    PrintAndLogEx(NORMAL, "  l <time>  : (optional) limit time to run the test - default 3000 us");
-    PrintAndLogEx(NORMAL, "  s <time>  : (optional) start time to run the test - default 0 us");
-    PrintAndLogEx(NORMAL, "  d <data>  : (optional) data to full-write before trying the OTP test - default 0x00");
-    PrintAndLogEx(NORMAL, "  t <data>  : (optional) data to write while running the OTP test - default 0x00");
-    PrintAndLogEx(NORMAL, "  m <data>  : (optional) exit criteria, if block matches this value");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "        hf mfu otptear b 3");
-    PrintAndLogEx(NORMAL, "        hf mfu otptear b 8 i 100 l 3000 s 1000");
-    PrintAndLogEx(NORMAL, "        hf mfu otptear b 3 i 1 l 200");
-    PrintAndLogEx(NORMAL, "        hf mfu otptear b 3 i 100 l 2500 s 200 d FFFFFFFF t EEEEEEEE");
-    PrintAndLogEx(NORMAL, "        hf mfu otptear b 3 i 100 l 2500 s 200 d FFFFFFFF t EEEEEEEE m 00000000    -> such quite when OTP is reset");
-    return PM3_SUCCESS;
-}
-
-
 uint8_t default_3des_keys[][16] = {
     { 0x42, 0x52, 0x45, 0x41, 0x4b, 0x4d, 0x45, 0x49, 0x46, 0x59, 0x4f, 0x55, 0x43, 0x41, 0x4e, 0x21 }, // 3des std key
     { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, // all zeroes
@@ -2761,14 +2722,39 @@ static int CmdHF14AMfUGenDiverseKeys(const char *Cmd) {
 }
 
 static int CmdHF14AMfUPwdGen(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mfu pwdgen",
+                  "Generate different passwords from known pwdgen algos",
+                  "hf mfu pwdgen -r\n"
+                  "hf mfu pwdgen -t\n"
+                  "hf mfu pwdgen --uid 11223344556677"
+                 );
 
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("u", "uid", "<hex>", "uid (7 bytes)"),
+        arg_lit0("r", NULL, "read uid from tag"),
+        arg_lit0("t", NULL, "selftest"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    int u_len = 0;
     uint8_t uid[7] = {0x00};
-    char cmdp = tolower(param_getchar(Cmd, 0));
-    if (strlen(Cmd) == 0  || cmdp == 'h') return usage_hf_mfu_pwdgen();
+    CLIGetHexWithReturn(ctx, 1, uid, &u_len);
+    bool use_tag = arg_get_lit(ctx, 2);
+    bool selftest = arg_get_lit(ctx, 3);
+    CLIParserFree(ctx);
 
-    if (cmdp == 't') return generator_selftest();
+    if (selftest) 
+        return generator_selftest();
 
-    if (cmdp == 'r') {
+    if (u_len != 7) {
+        PrintAndLogEx(WARNING, "Key must be 7 hex bytes");
+        return PM3_EINVARG;
+    }
+
+    if (use_tag) {
         // read uid from tag
         clearCommandBuffer();
         SendCommandMIX(CMD_HF_ISO14443A_READER, ISO14A_CONNECT | ISO14A_NO_RATS, 0, 0, NULL, 0);
@@ -2791,22 +2777,20 @@ static int CmdHF14AMfUPwdGen(const char *Cmd) {
             return PM3_ESOFT;
         }
         memcpy(uid, card.uid, sizeof(uid));
-    } else {
-        if (param_gethex(Cmd, 0, uid, 14)) return usage_hf_mfu_pwdgen();
     }
 
-    PrintAndLogEx(NORMAL, "---------------------------------");
-    PrintAndLogEx(NORMAL, " Using UID : %s", sprint_hex(uid, 7));
-    PrintAndLogEx(NORMAL, "---------------------------------");
-    PrintAndLogEx(NORMAL, " algo | pwd      | pack");
-    PrintAndLogEx(NORMAL, "------+----------+-----");
-    PrintAndLogEx(NORMAL, " EV1  | %08X | %04X", ul_ev1_pwdgenA(uid), ul_ev1_packgenA(uid));
-    PrintAndLogEx(NORMAL, " Ami  | %08X | %04X", ul_ev1_pwdgenB(uid), ul_ev1_packgenB(uid));
-    PrintAndLogEx(NORMAL, " LD   | %08X | %04X", ul_ev1_pwdgenC(uid), ul_ev1_packgenC(uid));
-    PrintAndLogEx(NORMAL, " XYZ  | %08X | %04X", ul_ev1_pwdgenD(uid), ul_ev1_packgenD(uid));
-    PrintAndLogEx(NORMAL, "------+----------+-----");
-    PrintAndLogEx(NORMAL, " Vingcard algo");
-    PrintAndLogEx(NORMAL, "--------------------");
+    PrintAndLogEx(INFO, "---------------------------------");
+    PrintAndLogEx(INFO, " Using UID : %s", sprint_hex(uid, 7));
+    PrintAndLogEx(INFO, "---------------------------------");
+    PrintAndLogEx(INFO, " algo | pwd      | pack");
+    PrintAndLogEx(INFO, "------+----------+-----");
+    PrintAndLogEx(INFO, " EV1  | %08X | %04X", ul_ev1_pwdgenA(uid), ul_ev1_packgenA(uid));
+    PrintAndLogEx(INFO, " Ami  | %08X | %04X", ul_ev1_pwdgenB(uid), ul_ev1_packgenB(uid));
+    PrintAndLogEx(INFO, " LD   | %08X | %04X", ul_ev1_pwdgenC(uid), ul_ev1_packgenC(uid));
+    PrintAndLogEx(INFO, " XYZ  | %08X | %04X", ul_ev1_pwdgenD(uid), ul_ev1_packgenD(uid));
+    PrintAndLogEx(INFO, "------+----------+-----");
+    PrintAndLogEx(INFO, " Vingcard algo");
+    PrintAndLogEx(INFO, "--------------------");
     return PM3_SUCCESS;
 }
 
@@ -2815,85 +2799,87 @@ static int CmdHF14AMfUPwdGen(const char *Cmd) {
 // Moebius et al
 //
 static int CmdHF14AMfuOtpTearoff(const char *Cmd) {
-    uint8_t blockNoUint = 8;
-    uint8_t cmdp = 0;
-    bool errors = 0, use_match = false;
-    uint8_t match[4] = {0x00};
-    uint8_t teardata[8] = {0x00};
-    uint32_t interval = 500; // time in us
-    uint32_t timeLimit = 3000; // time in us
-    uint32_t startTime = 0; // time in us
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mfu otptear",
+                  "Tear-off test against OTP block",
+                  "hf mfu otptear -b 3\n"
+                  "hf mfu otptear -b 3 -i 100 -s 1000\n"
+                  "hf mfu otptear -b 3 -i 1 -e 200\n"
+                  "hf mfu otptear -b 3 -i 100 -s 200 -e 2500 -d FFFFFFFF -t EEEEEEEE\n"
+                  "hf mfu otptear -b 3 -i 100 -s 200 -e 2500 -d FFFFFFFF -t EEEEEEEE -m 00000000    -> quite when OTP is reset"
+                 );
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_hf_mfu_otp_tearoff();
-            case 'b':
-                blockNoUint = param_get8(Cmd, cmdp + 1);
-                if (blockNoUint < 2) {
-                    PrintAndLogEx(WARNING, "Wrong block number");
-                    errors = true;
-                }
-                cmdp += 2;
-                break;
-            case 'i':
-                interval = param_get32ex(Cmd, cmdp + 1, interval, 10);
-                cmdp += 2;
-                break;
-            case 'l':
-                timeLimit = param_get32ex(Cmd, cmdp + 1, timeLimit, 10);
-                if (timeLimit < interval) {
-                    PrintAndLogEx(WARNING, "Wrong time limit number");
-                    errors = true;
-                }
-                if (timeLimit > 43000) {
-                    PrintAndLogEx(WARNING, "You can't set delay out of 1..43000 range!");
-                    errors = true;
-                }
-                cmdp += 2;
-                break;
-            case 's':
-                startTime = param_get32ex(Cmd, cmdp + 1, 0, 10);
-                if (startTime > (timeLimit - interval)) {
-                    PrintAndLogEx(WARNING, "Wrong start time number");
-                    errors = true;
-                }
-                cmdp += 2;
-                break;
-            case 'd':
-                if (param_gethex(Cmd, cmdp + 1, teardata, 8)) {
-                    PrintAndLogEx(WARNING, "Block data must include 8 HEX symbols");
-                    errors = true;
-                }
-                cmdp += 2;
-                break;
-            case 't':
-                if (param_gethex(Cmd, cmdp + 1, teardata + 4, 8)) {
-                    PrintAndLogEx(WARNING, "Block data must include 8 HEX symbols");
-                    errors = true;
-                }
-                cmdp += 2;
-                break;
-            case 'm':
-                if (param_gethex(Cmd, cmdp + 1, match, 8)) {
-                    PrintAndLogEx(WARNING, "Block data must include 8 HEX symbols");
-                    errors = true;
-                }
-                use_match = true;
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
+    void *argtable[] = {
+        arg_param_begin,
+        arg_u64_0("b", "blk", "<dec>", "target block (def 8)"),
+        arg_u64_0("i", "inc", "<dec>", "increase time steps (def 500 us)"),
+        arg_u64_0("e", "end", "<dec>", "end time (def 3000 us)"),
+        arg_u64_0("s", "start", "<dec>", "start time (def 0 us)"),
+        arg_str0("d", "data", "<hex>", "initialise data before run (4 bytes)"),
+        arg_str0("t", "test", "<hex>", "test write data (4 bytes)"),
+        arg_str0("m", "match", "<hex>", "exit criteria, if block matches this value (4 bytes)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    uint8_t blockno = arg_get_u32_def(ctx, 1, 8);
+    uint32_t steps = arg_get_u32_def(ctx, 2, 500);
+    uint32_t end = arg_get_u32_def(ctx, 3, 3000);
+    uint32_t start = arg_get_u32_def(ctx, 4, 0);
+
+    int d_len = 0;
+    uint8_t data[4] = {0x00};
+    CLIGetHexWithReturn(ctx, 5, data, &d_len);
+
+    int t_len = 0;
+    uint8_t test[4] = {0x00};
+    CLIGetHexWithReturn(ctx, 6, test, &t_len);
+
+    int m_len = 0;
+    uint8_t match[4] = {0x00};
+    CLIGetHexWithReturn(ctx, 7, match, &m_len);
+    bool use_match = (m_len > 0);
+    CLIParserFree(ctx);
+
+    if (blockno < 2) {
+        PrintAndLogEx(WARNING, "Block number must be larger than 2.");
+        return PM3_EINVARG;
+    }
+    if (end < steps) {
+        PrintAndLogEx(WARNING, "end time smaller than increase value");
+        return PM3_EINVARG;
+    }
+    if (end > 43000) {
+        PrintAndLogEx(WARNING, "end time - out of 1 .. 43000 range");
+        return PM3_EINVARG;
+    }
+    if (start > (end - steps)) {
+        PrintAndLogEx(WARNING, "Start time larger then (end time + steps)");
+        return PM3_EINVARG;
     }
 
-    if (errors) return usage_hf_mfu_otp_tearoff();
+    if (d_len && d_len != 4) {
+        PrintAndLogEx(WARNING, "data must be 4 hex bytes");
+        return PM3_EINVARG;
+    }
+
+    if (t_len && t_len != 4) {
+        PrintAndLogEx(WARNING, "test data must be 4 hex bytes");
+        return PM3_EINVARG;
+    }
+
+    if (m_len && m_len != 4) {
+        PrintAndLogEx(WARNING, "match data must be 4 hex bytes");
+        return PM3_EINVARG;
+    }
+
+   uint8_t teardata[8] = {0x00};
+   memcpy(teardata, data, sizeof(data));
+   memcpy(teardata + sizeof(data), test, sizeof(test));
 
     PrintAndLogEx(INFO, "----------------- " _CYAN_("MFU Tear off") " ---------------------");
     PrintAndLogEx(INFO, "Starting Tear-off test");
-    PrintAndLogEx(INFO, "Target block no: %u", blockNoUint);
+    PrintAndLogEx(INFO, "Target block no: %u", blockno);
     PrintAndLogEx(INFO, "Target inital block data : %s", sprint_hex_inrow(teardata, 4));
     PrintAndLogEx(INFO, "Target write block data  : %s", sprint_hex_inrow(teardata + 4, 4));
     PrintAndLogEx(INFO, "----------------------------------------------------");
@@ -2901,23 +2887,22 @@ static int CmdHF14AMfuOtpTearoff(const char *Cmd) {
     bool got_pre = false, got_post = false, lock_on = false;
     uint8_t pre[4] = {0};
     uint8_t post[4] = {0};
-    uint32_t actualTime = startTime;
-
+    uint32_t current = start;
     int phase_clear = -1;
     int phase_newwr = -1;
-
     uint8_t retries = 0;
-    while (actualTime <= (timeLimit - interval)) {
+
+    while (current <= (end - steps)) {
 
         if (kbd_enter_pressed()) {
             PrintAndLogEx(INFO, "\naborted via keyboard!\n");
             break;
         }
 
-        PrintAndLogEx(INFO, "Using tear-off delay " _GREEN_("%" PRIu32) " us", actualTime);
+        PrintAndLogEx(INFO, "Using tear-off delay " _GREEN_("%" PRIu32) " us", current);
 
         clearCommandBuffer();
-        SendCommandMIX(CMD_HF_MIFAREU_READBL, blockNoUint, 0, 0, NULL, 0);
+        SendCommandMIX(CMD_HF_MIFAREU_READBL, blockno, 0, 0, NULL, 0);
         PacketResponseNG resp;
 
         got_pre = false;
@@ -2930,7 +2915,7 @@ static int CmdHF14AMfuOtpTearoff(const char *Cmd) {
         }
 
         clearCommandBuffer();
-        SendCommandMIX(CMD_HF_MFU_OTP_TEAROFF, blockNoUint, actualTime, 0, teardata, 8);
+        SendCommandMIX(CMD_HF_MFU_OTP_TEAROFF, blockno, current, 0, teardata, 8);
 
         // we be getting ACK that we are silently ignoring here..
 
@@ -2946,7 +2931,7 @@ static int CmdHF14AMfuOtpTearoff(const char *Cmd) {
 
         got_post = false;
         clearCommandBuffer();
-        SendCommandMIX(CMD_HF_MIFAREU_READBL, blockNoUint, 0, 0, NULL, 0);
+        SendCommandMIX(CMD_HF_MIFAREU_READBL, blockno, 0, 0, NULL, 0);
         if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
             isOK = resp.oldarg[0] & 0xFF;
             if (isOK) {
@@ -2965,19 +2950,19 @@ static int CmdHF14AMfuOtpTearoff(const char *Cmd) {
             if (memcmp(pre, post, sizeof(pre)) == 0) {
 
                 PrintAndLogEx(INFO, "Current %02d (0x%02X) %s"
-                              , blockNoUint
-                              , blockNoUint
+                              , blockno
+                              , blockno
                               , poststr
                              );
             } else {
 
                 // skip first message, since its the reset write.
-                if (actualTime == startTime) {
+                if (current == start) {
                     PrintAndLogEx(INFO, "Inital write");
                 } else {
                     PrintAndLogEx(INFO, _CYAN_("Tear off occured") " : %02d (0x%02X) %s vs " _RED_("%s")
-                                  , blockNoUint
-                                  , blockNoUint
+                                  , blockno
+                                  , blockno
                                   , prestr
                                   , poststr
                                  );
@@ -2985,11 +2970,11 @@ static int CmdHF14AMfuOtpTearoff(const char *Cmd) {
                     lock_on = true;
 
                     if (phase_clear == -1)
-                        phase_clear = actualTime;
+                        phase_clear = current;
 
                     // new write phase must be atleast 100us later..
-                    if (phase_clear > -1 && phase_newwr == -1 && actualTime > (phase_clear + 100))
-                        phase_newwr = actualTime;
+                    if (phase_clear > -1 && phase_newwr == -1 && current > (phase_clear + 100))
+                        phase_newwr = current;
                 }
             }
 
@@ -3017,14 +3002,14 @@ static int CmdHF14AMfuOtpTearoff(const char *Cmd) {
                     PrintAndLogEx(NORMAL, "---------------------------------\n");
                 }
         */
-        if (startTime != timeLimit) {
-            actualTime += interval;
+        if (start != end) {
+            current += steps;
         } else {
             if (lock_on == false) {
                 if (++retries == 20) {
-                    actualTime++;
-                    timeLimit++;
-                    startTime++;
+                    current++;
+                    end++;
+                    start++;
                     retries = 0;
                     PrintAndLogEx(INFO, _CYAN_("Retried %u times, increased delay with 1us"), retries);
                 }
@@ -3603,7 +3588,7 @@ static command_t CommandTable[] = {
     {"keygen",  CmdHF14AMfUGenDiverseKeys, AlwaysAvailable, "Generate 3DES MIFARE diversified keys"},
     {"pwdgen",  CmdHF14AMfUPwdGen,         AlwaysAvailable, "Generate pwd from known algos"},
     {"otptear", CmdHF14AMfuOtpTearoff,     IfPm3Iso14443a,  "Tear-off test on OTP bits"},
-//    {"countertear", CmdHF14AMfuEv1CounterTearoff,     IfPm3Iso14443a,  "Tear-off test on Ev1 Counter bits"},
+//    {"tear_cnt", CmdHF14AMfuEv1CounterTearoff,     IfPm3Iso14443a,  "Tear-off test on Ev1/NTAG Counter bits"},
     {"-----------", CmdHelp,                IfPm3Iso14443a,  "----------------------- " _CYAN_("operations") " -----------------------"},
     {"cauth",   CmdHF14AMfUCAuth,          IfPm3Iso14443a,  "Authentication - Ultralight-C"},
     {"dump",    CmdHF14AMfUDump,           IfPm3Iso14443a,  "Dump MIFARE Ultralight family tag to binary file"},
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 7f5643b2f..1b2241b72 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -102,22 +102,7 @@ hf mf gen3uid
 hf mf gen3blk
 hf mf gen3freeze
 hf mf ice
-hf mfu info
-hf mfu dump
-hf mfu restore
-hf mfu eload
-hf mfu rdbl
-hf mfu wrbl
-hf mfu cauth
-hf mfu setpwd
-hf mfu setuid
-hf mfu sim
-hf mfu gen
-hf mfu pwdgen
-hf mfu otptear
-hf mfdes enum
 hf mfdes getuid
-hf mfdes info
 hw connect
 hw dbg
 hw detectreader

From d82edb3b7a0a8af1f5f5798a8cdc5927bfff2f27 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 4 Jan 2021 12:01:55 +0100
Subject: [PATCH 291/682] hw detectreader, readmem, lcd, lcdreset, fpgaoff,
 reset,  now uses cliparser

---
 client/src/cmdhw.c | 206 ++++++++++++++++++++++++++++++++-------------
 1 file changed, 147 insertions(+), 59 deletions(-)

diff --git a/client/src/cmdhw.c b/client/src/cmdhw.c
index 3f2b3407a..e34a5e226 100644
--- a/client/src/cmdhw.c
+++ b/client/src/cmdhw.c
@@ -26,36 +26,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_dbg(void) {
-    PrintAndLogEx(NORMAL, "Usage:  hw dbg [h] <debug level>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "           h    this help");
-    PrintAndLogEx(NORMAL, "       <debug level>  (Optional) see list for valid levels");
-    PrintAndLogEx(NORMAL, "           0 - no debug messages");
-    PrintAndLogEx(NORMAL, "           1 - error messages");
-    PrintAndLogEx(NORMAL, "           2 - plus information messages");
-    PrintAndLogEx(NORMAL, "           3 - plus debug messages");
-    PrintAndLogEx(NORMAL, "           4 - print even debug messages in timing critical functions");
-    PrintAndLogEx(NORMAL, "               Note: this option therefore may cause malfunction itself");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("           hw dbg 3"));
-    return 0;
-}
-
-static int usage_hw_detectreader(void) {
-    PrintAndLogEx(NORMAL, "Start to detect presences of reader field");
-    PrintAndLogEx(NORMAL, "press pm3 button to change modes and finally exit");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Usage:  hw detectreader [h] <L|H>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h          This help");
-    PrintAndLogEx(NORMAL, "       <type>     L = 125/134 kHz, H = 13.56 MHz");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hw detectreader L"));
-    return PM3_SUCCESS;
-}
-
 static int usage_hw_setmux(void) {
     PrintAndLogEx(NORMAL, "Set the ADC mux to a specific value");
     PrintAndLogEx(NORMAL, "");
@@ -371,32 +341,81 @@ static void lookupChipID(uint32_t iChipID, uint32_t mem_used) {
 
 static int CmdDbg(const char *Cmd) {
 
-    char ctmp = tolower(param_getchar(Cmd, 0));
-    if (strlen(Cmd) < 1 || ctmp == 'h') return usage_dbg();
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hw dbg",
+                  "Set device side debug level output.\n"
+                  "Note: option -4, this option may cause malfunction itself",
+                  "hw dbg -1\n"
+                 );
 
-    uint8_t dbgMode = param_get8ex(Cmd, 0, 0, 10);
-    if (dbgMode > 4) return usage_dbg();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0("0", NULL, "no debug messages"),
+        arg_lit0("1", NULL, "error messages"),
+        arg_lit0("2", NULL, "plus information messages"),
+        arg_lit0("3", NULL, "plus debug messages"),
+        arg_lit0("4", NULL, "print even debug messages in timing critical functions"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool lv0 = arg_get_lit(ctx, 1);
+    bool lv1 = arg_get_lit(ctx, 2);
+    bool lv2 = arg_get_lit(ctx, 3);
+    bool lv3 = arg_get_lit(ctx, 3);
+    bool lv4 = arg_get_lit(ctx, 4);
+    CLIParserFree(ctx);
 
-    SendCommandNG(CMD_SET_DBGMODE, &dbgMode, 1);
+    if ((lv0 + lv1 + lv2 + lv3 + lv4) > 1) {
+        PrintAndLogEx(INFO, "Can only set one debug level");
+        return PM3_EINVARG;
+    }
+
+    uint8_t dbg = 0;
+    if (lv0)
+        dbg = 0;
+    else if (lv1)
+        dbg = 1;
+    else if (lv2)
+        dbg = 2;    
+    else if (lv3)
+        dbg = 3;    
+    else if (lv4)
+        dbg = 4;
+
+    SendCommandNG(CMD_SET_DBGMODE, &dbg, sizeof(dbg));
     return PM3_SUCCESS;
 }
 
 static int CmdDetectReader(const char *Cmd) {
-    uint8_t arg = 0;
-    char c = toupper(Cmd[0]);
-    switch (c) {
-        case 'L':
-            arg = 1;
-            break;
-        case 'H':
-            arg = 2;
-            break;
-        default: {
-            usage_hw_detectreader();
-            return PM3_EINVARG;
-        }
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hw detectreader",
+                  "Start to detect presences of reader field",
+                  "hw detectreader -L\n"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0("L", "LF", "detect low frequence 125/134 kHz"),
+        arg_lit0("H", "HF", "detect high frequence 13.56 MHZ"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool lf = arg_get_lit(ctx, 1);
+    bool hf = arg_get_lit(ctx, 2);
+    CLIParserFree(ctx);
+
+    if ((lf + hf) > 1) {
+        PrintAndLogEx(INFO, "Can only set one frequence");
+        return PM3_EINVARG;
     }
 
+    uint8_t arg = 0;
+    if (lf)
+        arg = 1;
+    else if (hf)
+        arg = 2;
+
+    PrintAndLogEx(INFO, "press pm3 button to change modes and finally exit");
     clearCommandBuffer();
     SendCommandNG(CMD_LISTEN_READER_FIELD, (uint8_t *)&arg, sizeof(arg));
     return PM3_SUCCESS;
@@ -404,38 +423,107 @@ static int CmdDetectReader(const char *Cmd) {
 
 // ## FPGA Control
 static int CmdFPGAOff(const char *Cmd) {
-    (void)Cmd; // Cmd is not used so far
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hw fpgaoff",
+                  "Turn of fpga and antenna field",
+                  "hw fpgaoff\n"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
+
     clearCommandBuffer();
     SendCommandNG(CMD_FPGA_MAJOR_MODE_OFF, NULL, 0);
     return PM3_SUCCESS;
 }
 
 static int CmdLCD(const char *Cmd) {
-    int i, j;
-    sscanf(Cmd, "%x %d", &i, &j);
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hw lcd",
+                  "Send command/data to LCD",
+                  "hw lcd -r AA -c 03    -> sends 0xAA three times"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_int1("r", "raw", "<hex>",  "data "),
+        arg_int1("c", "cnt", "<dec>",  "number of times to send"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
+
+    int r_len = 0;
+    uint8_t raw[1] = {0};
+    CLIGetHexWithReturn(ctx, 1, raw, &r_len);
+    int j = arg_get_int(ctx, 2);
+    if (j < 1) {
+        PrintAndLogEx(WARNING, "Count must be larger than zero");
+        return PM3_EINVARG;
+    }
+
     while (j--) {
         clearCommandBuffer();
-        SendCommandMIX(CMD_LCD, i & 0x1ff, 0, 0, NULL, 0);
+        SendCommandMIX(CMD_LCD, raw[0], 0, 0, NULL, 0);
     }
     return PM3_SUCCESS;
 }
 
 static int CmdLCDReset(const char *Cmd) {
-    (void)Cmd; // Cmd is not used so far
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hw lcdreset",
+                  "Hardware reset LCD",
+                  "hw lcdreset\n"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
     clearCommandBuffer();
     SendCommandNG(CMD_LCD_RESET, NULL, 0);
     return PM3_SUCCESS;
 }
 
 static int CmdReadmem(const char *Cmd) {
-    uint32_t address = strtol(Cmd, NULL, 0);
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hw readmem",
+                  "Read memory at decimal address from ARM chip flash.",
+                  "hw readmem -a 10000"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_u64_1("a", "adr", "<dec>", "address to read"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    uint32_t address = arg_get_u32(ctx, 1);
+    CLIParserFree(ctx);
     clearCommandBuffer();
     SendCommandNG(CMD_READ_MEM, (uint8_t *)&address, sizeof(address));
     return PM3_SUCCESS;
 }
 
 static int CmdReset(const char *Cmd) {
-    (void)Cmd; // Cmd is not used so far
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hw reset",
+                  "Reset the Proxmark3 device.",
+                  "hw reset"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
     clearCommandBuffer();
     SendCommandNG(CMD_HARDWARE_RESET, NULL, 0);
     PrintAndLogEx(INFO, "Proxmark3 has been reset.");
@@ -683,14 +771,14 @@ static int CmdConnect(const char *Cmd) {
 static command_t CommandTable[] = {
     {"-------------", CmdHelp,         AlwaysAvailable, "----------------------- " _CYAN_("Hardware") " -----------------------"},
     {"help",          CmdHelp,         AlwaysAvailable, "This help"},
-    {"connect",       CmdConnect,      AlwaysAvailable, "connect Proxmark3 to serial port"},
+    {"connect",       CmdConnect,      AlwaysAvailable, "Connect Proxmark3 to serial port"},
     {"dbg",           CmdDbg,          IfPm3Present,    "Set Proxmark3 debug level"},
-    {"detectreader",  CmdDetectReader, IfPm3Present,    "['l'|'h'] -- Detect external reader field (option 'l' or 'h' to limit to LF or HF)"},
+    {"detectreader",  CmdDetectReader, IfPm3Present,    "Detect external reader field"},
     {"fpgaoff",       CmdFPGAOff,      IfPm3Present,    "Set FPGA off"},
-    {"lcd",           CmdLCD,          IfPm3Lcd,        "<HEX command> <count> -- Send command/data to LCD"},
+    {"lcd",           CmdLCD,          IfPm3Lcd,        "Send command/data to LCD"},
     {"lcdreset",      CmdLCDReset,     IfPm3Lcd,        "Hardware reset LCD"},
     {"ping",          CmdPing,         IfPm3Present,    "Test if the Proxmark3 is responsive"},
-    {"readmem",       CmdReadmem,      IfPm3Present,    "[address] -- Read memory at decimal address from flash"},
+    {"readmem",       CmdReadmem,      IfPm3Present,    "Read memory at decimal address from flash"},
     {"reset",         CmdReset,        IfPm3Present,    "Reset the Proxmark3"},
     {"setlfdivisor",  CmdSetDivisor,   IfPm3Present,    "<19 - 255> -- Drive LF antenna at 12MHz/(divisor+1)"},
     {"setmux",        CmdSetMux,       IfPm3Present,    "Set the ADC mux to a specific value"},

From 5b18c4353c640b1440fa7a89792fd5e50c978bf6 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 4 Jan 2021 12:23:50 +0100
Subject: [PATCH 292/682] update to match cliparser

---
 tools/pm3_tests.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/pm3_tests.sh b/tools/pm3_tests.sh
index cdbc5adb4..86a3b852a 100755
--- a/tools/pm3_tests.sh
+++ b/tools/pm3_tests.sh
@@ -333,7 +333,7 @@ while true; do
       if ! CheckExecute "reveng readline test"    "$CLIENTBIN -c 'reveng -h;reveng -D'" "CRC-64/GO-ISO"; then break; fi
       if ! CheckExecute "reveng -g test"          "$CLIENTBIN -c 'reveng -g abda202c'" "CRC-16/ISO-IEC-14443-3-A"; then break; fi
       if ! CheckExecute "reveng -w test"          "$CLIENTBIN -c 'reveng -w 8 -s 01020304e3 010204039d'" "CRC-8/SMBUS"; then break; fi
-      if ! CheckExecute "mfu pwdgen test"         "$CLIENTBIN -c 'hf mfu pwdgen t'" "Selftest OK"; then break; fi
+      if ! CheckExecute "mfu pwdgen test"         "$CLIENTBIN -c 'hf mfu pwdgen -t'" "Selftest OK"; then break; fi
       if ! CheckExecute "trace load/list 14a"     "$CLIENTBIN -c 'trace load -f traces/hf_14a_mfu.trace; trace list -1 -t 14a;'" "READBLOCK(8)"; then break; fi
       if ! CheckExecute "trace load/list x"       "$CLIENTBIN -c 'trace load -f traces/hf_14a_mfu.trace; trace list -x1 -t 14a;'" "0.0101840425"; then break; fi
 

From be92990c45f2a17bee3892f87a5f0d9d7d15850e Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 4 Jan 2021 12:25:03 +0100
Subject: [PATCH 293/682] hw setdivisor - now uses cliparser

---
 client/src/cmdhw.c     | 16 +++++++++++++++-
 doc/cliparser_todo.txt |  7 -------
 2 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/client/src/cmdhw.c b/client/src/cmdhw.c
index e34a5e226..f19dc26bb 100644
--- a/client/src/cmdhw.c
+++ b/client/src/cmdhw.c
@@ -535,7 +535,21 @@ static int CmdReset(const char *Cmd) {
  * 600kHz.
  */
 static int CmdSetDivisor(const char *Cmd) {
-    uint8_t arg = param_get8ex(Cmd, 0, 95, 10);
+
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hw setdivisor",
+                  "Drive LF antenna at 12 MHz / (divisor + 1).",
+                  "hw setdivisor -d 88"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_u64_1("d", "div", "<dec>", "19 - 255 divisor value (def 95)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    uint8_t arg = arg_get_u32_def(ctx, 1, 95);
+    CLIParserFree(ctx);
 
     if (arg < 19) {
         PrintAndLogEx(ERR, "divisor must be between" _YELLOW_("19") " and " _YELLOW_("255"));
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 1b2241b72..9f1068af6 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -104,14 +104,7 @@ hf mf gen3freeze
 hf mf ice
 hf mfdes getuid
 hw connect
-hw dbg
-hw detectreader
-hw fpgaoff
-hw lcd
-hw lcdreset
 hw ping
-hw readmem
-hw reset
 hw setlfdivisor
 hw setmux
 hw standalone

From 1c5a206f7906454972b5e9fbe134f4e679316d6f Mon Sep 17 00:00:00 2001
From: NPC-C83H <i@scp500.com>
Date: Tue, 5 Jan 2021 01:27:21 +0800
Subject: [PATCH 294/682] Update CMakeLists.txt

android client compability
---
 client/android/CMakeLists.txt | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/client/android/CMakeLists.txt b/client/android/CMakeLists.txt
index f459748b2..69a383bb9 100644
--- a/client/android/CMakeLists.txt
+++ b/client/android/CMakeLists.txt
@@ -126,9 +126,11 @@ add_library(pm3rrg_rdv4 SHARED
         ${PM3_ROOT}/client/src/cmdlfawid.c
         ${PM3_ROOT}/client/src/cmdlfcotag.c
         ${PM3_ROOT}/client/src/cmdlfdestron.c
-        ${PM3_ROOT}/client/src/cmdlfem4x.c
+        ${PM3_ROOT}/client/src/cmdlfem.c
+        ${PM3_ROOT}/client/src/cmdlfem410x.c
         ${PM3_ROOT}/client/src/cmdlfem4x05.c
         ${PM3_ROOT}/client/src/cmdlfem4x50.c
+        ${PM3_ROOT}/client/src/cmdlfem4x70.c
         ${PM3_ROOT}/client/src/cmdlffdxb.c
         ${PM3_ROOT}/client/src/cmdlfgallagher.c
         ${PM3_ROOT}/client/src/cmdlfguard.c

From 86821a253466930de568bf8ebb661b19590ffb46 Mon Sep 17 00:00:00 2001
From: NPC-C83H <i@scp500.com>
Date: Tue, 5 Jan 2021 01:32:05 +0800
Subject: [PATCH 295/682] Update pm3_main.c

---
 client/android/pm3_main.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/client/android/pm3_main.c b/client/android/pm3_main.c
index 3d2ef917d..1fb1cc95f 100644
--- a/client/android/pm3_main.c
+++ b/client/android/pm3_main.c
@@ -74,13 +74,13 @@ static bool OpenPm3(void) {
 jint Console(JNIEnv *env, jobject instance, jstring cmd_) {
 
     if (!conn.run) {
-        if (OpenPm3() && TestProxmark() == PM3_SUCCESS) {
+        if (OpenPm3() && TestProxmark(session.current_device) == PM3_SUCCESS) {
             LOGD("Connected to device");
             PrintAndLogEx(SUCCESS, "Connected to device");
         } else {
             LOGD("Failed to connect to device");
             PrintAndLogEx(ERR, "Failed to connect to device");
-            CloseProxmark();
+            CloseProxmark(session.current_device);
         }
     }
 
@@ -110,10 +110,10 @@ jboolean IsClientRunning(JNIEnv *env, jobject instance) {
  * */
 jboolean TestPm3(JNIEnv *env, jobject instance) {
     if (open() == false) {
-        CloseProxmark();
+        CloseProxmark(session.current_device);
         return false;
     }
-    bool ret = (TestProxmark() == PM3_SUCCESS);
+    bool ret = (TestProxmark(session.current_device) == PM3_SUCCESS);
     return (jboolean)(ret);
 }
 
@@ -121,7 +121,7 @@ jboolean TestPm3(JNIEnv *env, jobject instance) {
  * stop pm3 client
  * */
 void ClosePm3(JNIEnv *env, jobject instance) {
-    CloseProxmark();
+    CloseProxmark(session.current_device);
 }
 
 /*

From 4a9b5cee962a4b1059ce593b35c6209bd35f1d82 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C4=B0lteri=C5=9F=20Ero=C4=9Flu?= <ilteris@asenkron.com.tr>
Date: Mon, 4 Jan 2021 18:23:05 +0000
Subject: [PATCH 296/682] Raise Git's http.postBuffer to something high for
 macOS actions

---
 .github/workflows/macos-cmake.yaml       | 2 ++
 .github/workflows/macos-make-btaddon.yml | 2 ++
 .github/workflows/macos-make.yml         | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/.github/workflows/macos-cmake.yaml b/.github/workflows/macos-cmake.yaml
index 8c6a41f37..8dc2d358e 100644
--- a/.github/workflows/macos-cmake.yaml
+++ b/.github/workflows/macos-cmake.yaml
@@ -8,6 +8,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
+    - name: Set Git http.postBuffer to something high
+      run: git config --global http.postBuffer 524288000
     - name: Update brew repos
       run: brew update
     - name: Tap RfidResearchGroup/proxmark3
diff --git a/.github/workflows/macos-make-btaddon.yml b/.github/workflows/macos-make-btaddon.yml
index 9d5b75ff7..79d2c4afa 100644
--- a/.github/workflows/macos-make-btaddon.yml
+++ b/.github/workflows/macos-make-btaddon.yml
@@ -8,6 +8,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
+    - name: Set Git http.postBuffer to something high
+      run: git config --global http.postBuffer 524288000
     - name: Update brew repos
       run: brew update
     - name: Tap RfidResearchGroup/proxmark3
diff --git a/.github/workflows/macos-make.yml b/.github/workflows/macos-make.yml
index a612bcda2..01300ab28 100644
--- a/.github/workflows/macos-make.yml
+++ b/.github/workflows/macos-make.yml
@@ -9,6 +9,8 @@ jobs:
     steps:
     - uses: actions/checkout@v2
     - name: Update brew repos
+    - name: Set Git http.postBuffer to something high
+      run: git config --global http.postBuffer 524288000
       run: brew update
     - name: Tap RfidResearchGroup/proxmark3
       run: brew tap RfidResearchGroup/proxmark3

From 1fb17aad3f8c6e48757b7594a0c32f0376ad7f80 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C4=B0lteri=C5=9F=20Ero=C4=9Flu?= <ilteris@asenkron.com.tr>
Date: Mon, 4 Jan 2021 18:24:48 +0000
Subject: [PATCH 297/682] Oops, fast paste failed

---
 .github/workflows/macos-make.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/macos-make.yml b/.github/workflows/macos-make.yml
index 01300ab28..aecc22b8c 100644
--- a/.github/workflows/macos-make.yml
+++ b/.github/workflows/macos-make.yml
@@ -8,9 +8,9 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
-    - name: Update brew repos
     - name: Set Git http.postBuffer to something high
       run: git config --global http.postBuffer 524288000
+    - name: Update brew repos
       run: brew update
     - name: Tap RfidResearchGroup/proxmark3
       run: brew tap RfidResearchGroup/proxmark3

From 887f12796327c05441e71fc33b3b1f5050f52841 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Mon, 4 Jan 2021 19:29:01 +0100
Subject: [PATCH 298/682] android target client compability: add cmdemrtd.c

---
 client/android/CMakeLists.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/client/android/CMakeLists.txt b/client/android/CMakeLists.txt
index 69a383bb9..3f45f1073 100644
--- a/client/android/CMakeLists.txt
+++ b/client/android/CMakeLists.txt
@@ -106,6 +106,7 @@ add_library(pm3rrg_rdv4 SHARED
         ${PM3_ROOT}/client/src/cmdhf15.c
         ${PM3_ROOT}/client/src/cmdhfcryptorf.c
         ${PM3_ROOT}/client/src/cmdhfepa.c
+        ${PM3_ROOT}/client/src/cmdhfemrtd.c
         ${PM3_ROOT}/client/src/cmdhffelica.c
         ${PM3_ROOT}/client/src/cmdhffido.c
         ${PM3_ROOT}/client/src/cmdhficlass.c

From 0bc2bbef52327249eaeedd3bda8e144c67a4144e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C4=B0lteri=C5=9F=20Ero=C4=9Flu?= <ilteris@asenkron.com.tr>
Date: Mon, 4 Jan 2021 18:40:21 +0000
Subject: [PATCH 299/682] merge macos jobs to 1 workflow, run 'em sequentially

---
 .github/workflows/macos-cmake.yaml       | 22 ---------
 .github/workflows/macos-make-btaddon.yml | 22 ---------
 .github/workflows/macos-make.yml         | 22 ---------
 .github/workflows/macos.yml              | 62 ++++++++++++++++++++++++
 4 files changed, 62 insertions(+), 66 deletions(-)
 delete mode 100644 .github/workflows/macos-cmake.yaml
 delete mode 100644 .github/workflows/macos-make-btaddon.yml
 delete mode 100644 .github/workflows/macos-make.yml
 create mode 100644 .github/workflows/macos.yml

diff --git a/.github/workflows/macos-cmake.yaml b/.github/workflows/macos-cmake.yaml
deleted file mode 100644
index 8dc2d358e..000000000
--- a/.github/workflows/macos-cmake.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-name: MacOS (cmake) Build and Test
-
-on: [push, pull_request]
-
-jobs:
-  build:
-    runs-on: macos-latest
-
-    steps:
-    - uses: actions/checkout@v2
-    - name: Set Git http.postBuffer to something high
-      run: git config --global http.postBuffer 524288000
-    - name: Update brew repos
-      run: brew update
-    - name: Tap RfidResearchGroup/proxmark3
-      run: brew tap RfidResearchGroup/proxmark3
-    - name: Install dependencies
-      run: brew install readline qt5 RfidResearchGroup/proxmark3/arm-none-eabi-gcc
-    - name: Build
-      run: mkdir -p client/build && ( cd client/build && cmake .. && make VERBOSE=1 )
-    - name: Test
-      run: make client/check CHECKARGS="--clientbin ./client/build/proxmark3"
diff --git a/.github/workflows/macos-make-btaddon.yml b/.github/workflows/macos-make-btaddon.yml
deleted file mode 100644
index 79d2c4afa..000000000
--- a/.github/workflows/macos-make-btaddon.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-name: MacOS (make with BTADDON) Build and Test
-
-on: [push, pull_request]
-
-jobs:
-  build:
-    runs-on: macos-latest
-
-    steps:
-    - uses: actions/checkout@v2
-    - name: Set Git http.postBuffer to something high
-      run: git config --global http.postBuffer 524288000
-    - name: Update brew repos
-      run: brew update
-    - name: Tap RfidResearchGroup/proxmark3
-      run: brew tap RfidResearchGroup/proxmark3
-    - name: Install dependencies
-      run: brew install readline qt5 RfidResearchGroup/proxmark3/arm-none-eabi-gcc
-    - name: Build
-      run: make clean && make V=1 PLATFORM_EXTRAS=BTADDON
-    - name: Test
-      run: make check
diff --git a/.github/workflows/macos-make.yml b/.github/workflows/macos-make.yml
deleted file mode 100644
index aecc22b8c..000000000
--- a/.github/workflows/macos-make.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-name: MacOS (make) Build and Test
-
-on: [push, pull_request]
-
-jobs:
-  build:
-    runs-on: macos-latest
-
-    steps:
-    - uses: actions/checkout@v2
-    - name: Set Git http.postBuffer to something high
-      run: git config --global http.postBuffer 524288000
-    - name: Update brew repos
-      run: brew update
-    - name: Tap RfidResearchGroup/proxmark3
-      run: brew tap RfidResearchGroup/proxmark3
-    - name: Install dependencies
-      run: brew install readline qt5 RfidResearchGroup/proxmark3/arm-none-eabi-gcc
-    - name: Build
-      run: make clean && make V=1
-    - name: Test
-      run: make check
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
new file mode 100644
index 000000000..97495eb28
--- /dev/null
+++ b/.github/workflows/macos.yml
@@ -0,0 +1,62 @@
+name: MacOS Build and Test
+
+on: [push, pull_request]
+
+jobs:
+  build-make:
+    runs-on: macos-latest
+
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set Git http.postBuffer to something high
+        run: git config --global http.postBuffer 524288000
+      - name: Update brew repos
+        run: brew update
+      - name: Tap RfidResearchGroup/proxmark3
+        run: brew tap RfidResearchGroup/proxmark3
+      - name: Install dependencies
+        run: brew install readline qt5 RfidResearchGroup/proxmark3/arm-none-eabi-gcc
+      - name: Build
+        run: make clean && make V=1
+      - name: Test
+        run: make check
+
+  build-make-btaddon:
+    if: always()
+    needs: [build-make]
+    runs-on: macos-latest
+
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set Git http.postBuffer to something high
+        run: git config --global http.postBuffer 524288000
+      - name: Update brew repos
+        run: brew update
+      - name: Tap RfidResearchGroup/proxmark3
+        run: brew tap RfidResearchGroup/proxmark3
+      - name: Install dependencies
+        run: brew install readline qt5 RfidResearchGroup/proxmark3/arm-none-eabi-gcc
+      - name: Build
+        run: make clean && make V=1 PLATFORM_EXTRAS=BTADDON
+      - name: Test
+        run: make check
+
+  build-cmake:
+    if: always()
+    needs: [build-make, build-make-btaddon]
+    runs-on: macos-latest
+
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set Git http.postBuffer to something high
+        run: git config --global http.postBuffer 524288000
+      - name: Update brew repos
+        run: brew update
+      - name: Tap RfidResearchGroup/proxmark3
+        run: brew tap RfidResearchGroup/proxmark3
+      - name: Install dependencies
+        run: brew install readline qt5 RfidResearchGroup/proxmark3/arm-none-eabi-gcc
+      - name: Build
+        run: mkdir -p client/build && ( cd client/build && cmake .. && make VERBOSE=1 )
+      - name: Test
+        run: make client/check CHECKARGS="--clientbin ./client/build/proxmark3"

From b05b94f619f0f724053b9a30d539871e26f5e33c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C4=B0lteri=C5=9F=20Ero=C4=9Flu?= <ilteris@asenkron.com.tr>
Date: Mon, 4 Jan 2021 19:00:10 +0000
Subject: [PATCH 300/682] tweak jobs

---
 .github/workflows/macos.yml | 48 ++++++++++++++++++++++++++++++++++---
 1 file changed, 45 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 97495eb28..9ccb51e39 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -8,16 +8,28 @@ jobs:
 
     steps:
       - uses: actions/checkout@v2
+
       - name: Set Git http.postBuffer to something high
         run: git config --global http.postBuffer 524288000
+
       - name: Update brew repos
         run: brew update
+        continue-on-error: true
+
       - name: Tap RfidResearchGroup/proxmark3
         run: brew tap RfidResearchGroup/proxmark3
+
       - name: Install dependencies
         run: brew install readline qt5 RfidResearchGroup/proxmark3/arm-none-eabi-gcc
+
+      - name: make clean
+        run: make clean
+
       - name: Build
-        run: make clean && make V=1
+        env:
+          V: 1
+        run: make
+
       - name: Test
         run: make check
 
@@ -28,16 +40,29 @@ jobs:
 
     steps:
       - uses: actions/checkout@v2
+
       - name: Set Git http.postBuffer to something high
         run: git config --global http.postBuffer 524288000
+
       - name: Update brew repos
         run: brew update
+        continue-on-error: true
+
       - name: Tap RfidResearchGroup/proxmark3
         run: brew tap RfidResearchGroup/proxmark3
+
       - name: Install dependencies
         run: brew install readline qt5 RfidResearchGroup/proxmark3/arm-none-eabi-gcc
+
+      - name: make clean
+        run: make clean
+
       - name: Build
-        run: make clean && make V=1 PLATFORM_EXTRAS=BTADDON
+        env:
+          V: 1
+          PLATFORM_EXTRAS: BTADDON
+        run: make
+
       - name: Test
         run: make check
 
@@ -48,15 +73,32 @@ jobs:
 
     steps:
       - uses: actions/checkout@v2
+
       - name: Set Git http.postBuffer to something high
         run: git config --global http.postBuffer 524288000
+
       - name: Update brew repos
         run: brew update
+        continue-on-error: true
+
       - name: Tap RfidResearchGroup/proxmark3
         run: brew tap RfidResearchGroup/proxmark3
+
       - name: Install dependencies
         run: brew install readline qt5 RfidResearchGroup/proxmark3/arm-none-eabi-gcc
+
+      - name: Prepare Build Folders
+        run: mkdir -p client/build
+
+      - name: Initiate cmake environment
+        run: cmake ..
+        working-directory: client/build/
+
       - name: Build
-        run: mkdir -p client/build && ( cd client/build && cmake .. && make VERBOSE=1 )
+        env:
+          VERBOSE: 1
+        run: make
+        working-directory: client/build/
+
       - name: Test
         run: make client/check CHECKARGS="--clientbin ./client/build/proxmark3"

From 12d700136fc2014ed34afcea602b51a3bce72d93 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C4=B0lteri=C5=9F=20Ero=C4=9Flu?= <ilteris@asenkron.com.tr>
Date: Mon, 4 Jan 2021 19:18:08 +0000
Subject: [PATCH 301/682] workflow cleaning

---
 .github/workflows/macos.yml               | 25 ++++++-
 .github/workflows/ubuntu-cmake.yml        | 18 -----
 .github/workflows/ubuntu-make-btaddon.yml | 18 -----
 .github/workflows/ubuntu-make.yml         | 18 -----
 .github/workflows/ubuntu.yml              | 85 +++++++++++++++++++++++
 5 files changed, 109 insertions(+), 55 deletions(-)
 delete mode 100644 .github/workflows/ubuntu-cmake.yml
 delete mode 100644 .github/workflows/ubuntu-make-btaddon.yml
 delete mode 100644 .github/workflows/ubuntu-make.yml
 create mode 100644 .github/workflows/ubuntu.yml

diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 9ccb51e39..d10bb7cc6 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -12,6 +12,13 @@ jobs:
       - name: Set Git http.postBuffer to something high
         run: git config --global http.postBuffer 524288000
 
+      - name: handle homebrew quirks
+        run: |
+          brew uninstall openssl@1.0.2t
+          rm -rf /usr/local/etc/openssl
+          rm -rf /usr/local/etc/openssl@1.1
+          rm -rf /usr/local/bin/2to3
+
       - name: Update brew repos
         run: brew update
         continue-on-error: true
@@ -44,6 +51,13 @@ jobs:
       - name: Set Git http.postBuffer to something high
         run: git config --global http.postBuffer 524288000
 
+      - name: handle homebrew quirks
+        run: |
+          brew uninstall openssl@1.0.2t
+          rm -rf /usr/local/etc/openssl
+          rm -rf /usr/local/etc/openssl@1.1
+          rm -rf /usr/local/bin/2to3
+
       - name: Update brew repos
         run: brew update
         continue-on-error: true
@@ -77,6 +91,13 @@ jobs:
       - name: Set Git http.postBuffer to something high
         run: git config --global http.postBuffer 524288000
 
+      - name: handle homebrew quirks
+        run: |
+          brew uninstall openssl@1.0.2t
+          rm -rf /usr/local/etc/openssl
+          rm -rf /usr/local/etc/openssl@1.1
+          rm -rf /usr/local/bin/2to3
+
       - name: Update brew repos
         run: brew update
         continue-on-error: true
@@ -101,4 +122,6 @@ jobs:
         working-directory: client/build/
 
       - name: Test
-        run: make client/check CHECKARGS="--clientbin ./client/build/proxmark3"
+        env:
+          CHECKARGS: "--clientbin ./client/build/proxmark3"
+        run: make client/check
diff --git a/.github/workflows/ubuntu-cmake.yml b/.github/workflows/ubuntu-cmake.yml
deleted file mode 100644
index dd99487f1..000000000
--- a/.github/workflows/ubuntu-cmake.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-name: Ubuntu (cmake) Build and Test
-
-on: [push, pull_request]
-
-jobs:
-  build-and-test:
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v2
-    - name: Update apt repos
-      run: sudo apt-get update
-    - name: Install dependencies
-      run: sudo apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
-    - name: Build
-      run: mkdir -p client/build && ( cd client/build && cmake .. && make VERBOSE=1 )
-    - name: Test
-      run: make client/check CHECKARGS="--clientbin ./client/build/proxmark3"
diff --git a/.github/workflows/ubuntu-make-btaddon.yml b/.github/workflows/ubuntu-make-btaddon.yml
deleted file mode 100644
index 0e11f01c3..000000000
--- a/.github/workflows/ubuntu-make-btaddon.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-name: Ubuntu (make with BTADDON) Build and Test
-
-on: [push, pull_request]
-
-jobs:
-  build-and-test:
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v2
-    - name: Update apt repos
-      run: sudo apt-get update
-    - name: Install dependencies
-      run: sudo apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
-    - name: Build
-      run: make clean && make V=1 PLATFORM_EXTRAS=BTADDON
-    - name: Test
-      run: make check
diff --git a/.github/workflows/ubuntu-make.yml b/.github/workflows/ubuntu-make.yml
deleted file mode 100644
index f4f7d0113..000000000
--- a/.github/workflows/ubuntu-make.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-name: Ubuntu (make) Build and Test
-
-on: [push, pull_request]
-
-jobs:
-  build-and-test:
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v2
-    - name: Update apt repos
-      run: sudo apt-get update
-    - name: Install dependencies
-      run: sudo apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
-    - name: Build
-      run: make clean && make V=1
-    - name: Test
-      run: make check
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
new file mode 100644
index 000000000..394088e87
--- /dev/null
+++ b/.github/workflows/ubuntu.yml
@@ -0,0 +1,85 @@
+name: Ubuntu Build and Test
+
+on: [push, pull_request]
+
+jobs:
+  build-make:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Update apt repos
+        run: sudo apt-get update
+
+      - name: Install dependencies
+        run: sudo apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
+
+      - name: make clean
+        run: make clean
+
+      - name: Build
+        env:
+          V: 1
+        run: make
+
+      - name: Test
+        run: make check
+
+  build-make-btaddon:
+    if: always()
+    needs: [build-make]
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Update apt repos
+        run: sudo apt-get update
+
+      - name: Install dependencies
+        run: sudo apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
+
+      - name: make clean
+        run: make clean
+
+      - name: Build
+        env:
+          V: 1
+          PLATFORM_EXTRAS: BTADDON
+        run: make
+
+      - name: Test
+        run: make check
+
+  build-cmake:
+    if: always()
+    needs: [build-make, build-make-btaddon]
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Update apt repos
+        run: sudo apt-get update
+
+      - name: Install dependencies
+        run: sudo apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
+
+      - name: Prepare Build Folders
+        run: mkdir -p client/build
+
+      - name: Initiate cmake environment
+        run: cmake ..
+        working-directory: client/build/
+
+      - name: Build
+        env:
+          VERBOSE: 1
+        run: make
+        working-directory: client/build/
+
+      - name: Test
+        env:
+          CHECKARGS: "--clientbin ./client/build/proxmark3"
+        run: make client/check

From 6b11b18314edcaa0297faed6bf86de6cf6541e80 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C4=B0lteri=C5=9F=20Ero=C4=9Flu?= <ilteris@asenkron.com.tr>
Date: Mon, 4 Jan 2021 19:20:38 +0000
Subject: [PATCH 302/682] workflow changes

---
 .github/workflows/macos.yml | 24 ++++++------------------
 1 file changed, 6 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index d10bb7cc6..cef27e89e 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -12,12 +12,8 @@ jobs:
       - name: Set Git http.postBuffer to something high
         run: git config --global http.postBuffer 524288000
 
-      - name: handle homebrew quirks
-        run: |
-          brew uninstall openssl@1.0.2t
-          rm -rf /usr/local/etc/openssl
-          rm -rf /usr/local/etc/openssl@1.1
-          rm -rf /usr/local/bin/2to3
+      - name: Handle homebrew quirks
+        run: rm -rf /usr/local/bin/2to3
 
       - name: Update brew repos
         run: brew update
@@ -51,12 +47,8 @@ jobs:
       - name: Set Git http.postBuffer to something high
         run: git config --global http.postBuffer 524288000
 
-      - name: handle homebrew quirks
-        run: |
-          brew uninstall openssl@1.0.2t
-          rm -rf /usr/local/etc/openssl
-          rm -rf /usr/local/etc/openssl@1.1
-          rm -rf /usr/local/bin/2to3
+      - name: Handle homebrew quirks
+        run: rm -rf /usr/local/bin/2to3
 
       - name: Update brew repos
         run: brew update
@@ -91,12 +83,8 @@ jobs:
       - name: Set Git http.postBuffer to something high
         run: git config --global http.postBuffer 524288000
 
-      - name: handle homebrew quirks
-        run: |
-          brew uninstall openssl@1.0.2t
-          rm -rf /usr/local/etc/openssl
-          rm -rf /usr/local/etc/openssl@1.1
-          rm -rf /usr/local/bin/2to3
+      - name: Handle homebrew quirks
+        run: rm -rf /usr/local/bin/2to3
 
       - name: Update brew repos
         run: brew update

From 9a0165f4cafd7cf3c527fe2fd02378f380a1166d Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 4 Jan 2021 21:58:50 +0100
Subject: [PATCH 303/682] hw connect, ping, version, standalone, tune etc - now
 uses cliparser

---
 client/src/cmdhw.c     | 212 +++++++++++++++++++++++++++--------------
 doc/cliparser_todo.txt |   8 --
 2 files changed, 140 insertions(+), 80 deletions(-)

diff --git a/client/src/cmdhw.c b/client/src/cmdhw.c
index f19dc26bb..71c33a755 100644
--- a/client/src/cmdhw.c
+++ b/client/src/cmdhw.c
@@ -26,35 +26,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_hw_setmux(void) {
-    PrintAndLogEx(NORMAL, "Set the ADC mux to a specific value");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Usage:  hw setmux [h] <lopkd | loraw | hipkd | hiraw>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h          This help");
-    PrintAndLogEx(NORMAL, "       <type>     Low peak, Low raw, Hi peak, Hi raw");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hw setmux lopkd"));
-    return PM3_SUCCESS;
-}
-
-static int usage_hw_connect(void) {
-    PrintAndLogEx(NORMAL, "Connects to a Proxmark3 device via specified serial port");
-    PrintAndLogEx(NORMAL, "Baudrate here is only for physical UART or UART-BT, " _YELLOW_("not")" for USB-CDC or blue shark add-on");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Usage:  hw connect [h] [p <port>] [b <baudrate>]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h              This help");
-    PrintAndLogEx(NORMAL, "       p <port>       Serial port to connect to, else retry the last used one");
-    PrintAndLogEx(NORMAL, "       b <baudrate>   Baudrate");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hw connect p "SERIAL_PORT_EXAMPLE_H));
-    PrintAndLogEx(NORMAL, _YELLOW_("      hw connect p "SERIAL_PORT_EXAMPLE_H" b 115200"));
-    return PM3_SUCCESS;
-}
-
 static void lookupChipID(uint32_t iChipID, uint32_t mem_used) {
     char asBuff[120];
     memset(asBuff, 0, sizeof(asBuff));
@@ -564,51 +535,114 @@ static int CmdSetDivisor(const char *Cmd) {
 
 static int CmdSetMux(const char *Cmd) {
 
-    if (strlen(Cmd) < 5) {
-        usage_hw_setmux();
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hw setmux",
+                  "Set the ADC mux to a specific value",
+                  "hw setmux --hiraw    -> set HIGH RAW"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0(NULL, "lopkd", "low peak"),
+        arg_lit0(NULL, "loraw", "low raw"),
+        arg_lit0(NULL, "hipkd", "high peak"),
+        arg_lit0(NULL, "hiraw", "high raw"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool lopkd = arg_get_lit(ctx, 1);
+    bool loraw = arg_get_lit(ctx, 2);
+    bool hipkd = arg_get_lit(ctx, 3);
+    bool hiraw = arg_get_lit(ctx, 4);
+    CLIParserFree(ctx);
+
+    if ((lopkd + loraw + hipkd + hiraw) > 1) {
+        PrintAndLogEx(INFO, "Can only set one mux");
         return PM3_EINVARG;
     }
 
-    str_lower((char *)Cmd);
-
     uint8_t arg = 0;
-    if (strcmp(Cmd, "lopkd") == 0)
+    if (lopkd)
         arg = 0;
-    else if (strcmp(Cmd, "loraw") == 0)
+    else if (loraw)
         arg = 1;
-    else if (strcmp(Cmd, "hipkd") == 0)
+    else if (hipkd)
         arg = 2;
-    else if (strcmp(Cmd, "hiraw") == 0)
+    else if (hiraw)
         arg = 3;
-    else {
-        usage_hw_setmux();
-        return PM3_EINVARG;
-    }
+
     clearCommandBuffer();
     SendCommandNG(CMD_SET_ADC_MUX, (uint8_t *)&arg, sizeof(arg));
     return PM3_SUCCESS;
 }
 
 static int CmdStandalone(const char *Cmd) {
-//    (void)Cmd; // Cmd is not used so far
-    uint8_t arg = param_get8ex(Cmd, 0, 0, 10);
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hw standalone",
+                  "Start standalone mode",
+                  "hw standalone       -> start \n"
+                  "hw standalone -a 1  -> start and send arg 1"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_u64_0("a", "arg", "<dec>", "argument byte"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    uint8_t arg = arg_get_u32(ctx, 1);
+    CLIParserFree(ctx);
     clearCommandBuffer();
     SendCommandNG(CMD_STANDALONE, (uint8_t *)&arg, sizeof(arg));
     return PM3_SUCCESS;
 }
 
 static int CmdTune(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hw tune",
+                  "Measure antenna tuning",
+                  "hw tune"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
     return CmdTuneSamples(Cmd);
 }
 
 static int CmdVersion(const char *Cmd) {
-    (void)Cmd; // Cmd is not used so far
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hw version",
+                  "Show version information about the connected Proxmark3",
+                  "hw version"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
     pm3_version(true, false);
     return PM3_SUCCESS;
 }
 
 static int CmdStatus(const char *Cmd) {
-    (void)Cmd; // Cmd is not used so far
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hw status",
+                  "Show runtime status information about the connected Proxmark3",
+                  "hw status"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
     clearCommandBuffer();
     PacketResponseNG resp;
     SendCommandNG(CMD_STATUS, NULL, 0);
@@ -692,7 +726,19 @@ static int CmdTearoff(const char *Cmd) {
 }
 
 static int CmdTia(const char *Cmd) {
-    (void)Cmd; // Cmd is not used so far
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hw tia",
+                  "Trigger a Timing Interval Acquisition to re-adjust the RealTimeCounter divider",
+                  "hw tia"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
+
     PrintAndLogEx(INFO, "Triggering new Timing Interval Acquisition (TIA)...");
     clearCommandBuffer();
     SendCommandNG(CMD_TIA, NULL, 0);
@@ -706,19 +752,38 @@ static int CmdTia(const char *Cmd) {
 }
 
 static int CmdPing(const char *Cmd) {
-    uint32_t len = strtol(Cmd, NULL, 0);
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hw ping",
+                  "Test if the Proxmark3 is responsive",
+                  "hw ping\n"
+                  "hw ping --len 32"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_u64_0("l", "len", "<dec>", "length of payload to send"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    uint32_t len = arg_get_u32(ctx, 1);
+    CLIParserFree(ctx);
+
     if (len > PM3_CMD_DATA_SIZE)
         len = PM3_CMD_DATA_SIZE;
+
     if (len) {
-        PrintAndLogEx(INFO, "Ping sent with payload len = %d", len);
+        PrintAndLogEx(INFO, "Ping sent with payload len " _YELLOW_("%d"), len);
     } else {
         PrintAndLogEx(INFO, "Ping sent");
     }
+
     clearCommandBuffer();
     PacketResponseNG resp;
     uint8_t data[PM3_CMD_DATA_SIZE] = {0};
+
     for (uint16_t i = 0; i < len; i++)
         data[i] = i & 0xFF;
+
     SendCommandNG(CMD_PING, data, len);
     if (WaitForResponseTimeout(CMD_PING, &resp, 1000)) {
         if (len) {
@@ -734,35 +799,38 @@ static int CmdPing(const char *Cmd) {
 
 static int CmdConnect(const char *Cmd) {
 
-    uint32_t baudrate = USART_BAUD_RATE;
-    uint8_t cmdp = 0;
-    char port[FILE_PATH_SIZE] = {0};
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hw connect",
+                  "Connects to a Proxmark3 device via specified serial port.\n"
+                  "Baudrate here is only for physical UART or UART-BT, NOT for USB-CDC or blue shark add-on",
+                  "hw connect -p "SERIAL_PORT_EXAMPLE_H"\n"
+                  "hw connect -p "SERIAL_PORT_EXAMPLE_H" -b 115200"
+                 );
 
-    while (param_getchar(Cmd, cmdp) != 0x00) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_hw_connect();
-            case 'p': {
-                param_getstr(Cmd, cmdp + 1, port, sizeof(port));
-                cmdp += 2;
-                break;
-            }
-            case 'b':
-                baudrate = param_get32ex(Cmd, cmdp + 1, USART_BAUD_RATE, 10);
-                if (baudrate == 0)
-                    return usage_hw_connect();
-                cmdp += 2;
-                break;
-            default:
-                usage_hw_connect();
-                return PM3_EINVARG;
-        }
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("p", "port", NULL, "Serial port to connect to, else retry the last used one"),
+        arg_u64_0("b", "baud", "<dec>", "Baudrate"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    int p_len = FILE_PATH_SIZE;
+    char port[FILE_PATH_SIZE] = {0};
+    CLIGetStrWithReturn(ctx, 1, (uint8_t*)port, &p_len);
+    uint32_t baudrate = arg_get_u32_def(ctx, 2, USART_BAUD_RATE);
+    CLIParserFree(ctx);
+
+    if (baudrate == 0) {
+        PrintAndLogEx(WARNING, "Baudrate can't be zero");
+        return PM3_EINVARG;
     }
 
     // default back to previous used serial port
     if (strlen(port) == 0) {
         if (strlen(conn.serial_port_name) == 0) {
-            return usage_hw_connect();
+            PrintAndLogEx(WARNING, "Must specify a serial port");
+            return PM3_EINVARG;
         }
         memcpy(port, conn.serial_port_name, sizeof(port));
     }
@@ -794,7 +862,7 @@ static command_t CommandTable[] = {
     {"ping",          CmdPing,         IfPm3Present,    "Test if the Proxmark3 is responsive"},
     {"readmem",       CmdReadmem,      IfPm3Present,    "Read memory at decimal address from flash"},
     {"reset",         CmdReset,        IfPm3Present,    "Reset the Proxmark3"},
-    {"setlfdivisor",  CmdSetDivisor,   IfPm3Present,    "<19 - 255> -- Drive LF antenna at 12MHz/(divisor+1)"},
+    {"setlfdivisor",  CmdSetDivisor,   IfPm3Present,    "Drive LF antenna at 12MHz / (divisor + 1)"},
     {"setmux",        CmdSetMux,       IfPm3Present,    "Set the ADC mux to a specific value"},
     {"standalone",    CmdStandalone,   IfPm3Present,    "Jump to the standalone mode"},
     {"status",        CmdStatus,       IfPm3Present,    "Show runtime status information about the connected Proxmark3"},
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 9f1068af6..4c3dcd8d0 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -103,15 +103,7 @@ hf mf gen3blk
 hf mf gen3freeze
 hf mf ice
 hf mfdes getuid
-hw connect
-hw ping
 hw setlfdivisor
-hw setmux
-hw standalone
-hw status
-hw tia
-hw tune
-hw version
 lf config
 lf cmdread
 lf read

From f3bd1b3d743dd775469d7468e32d16d19a07f2c9 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 4 Jan 2021 22:14:58 +0100
Subject: [PATCH 304/682] text

---
 doc/cheatsheet.md | 68 ++++++++++++++++++++++++++---------------------
 1 file changed, 37 insertions(+), 31 deletions(-)

diff --git a/doc/cheatsheet.md b/doc/cheatsheet.md
index 3a19dd553..9c77f4bee 100644
--- a/doc/cheatsheet.md
+++ b/doc/cheatsheet.md
@@ -191,9 +191,9 @@ Extract custom iCLASS key (loclass attack)
 ```
 Options
 ---
-f <filename>   : specify a filename to clone from
-k <key>        : Access Key as 16 hex symbols or 1 hex to select key from memory
---elite        : Elite computations applied to key
+-f <filename>                  specify a filename to clone from
+-k <key>                       Access Key as 16 hex symbols or 1 hex to select key from memory
+    --elite                    Elite computations applied to key
 
 pm3 --> hf iclass sim -t 2
 pm3 --> hf iclass loclass -f iclass_mac_attack.bin
@@ -329,10 +329,10 @@ pm3 --> hf mfu info
 
 Clone MIFARE Ultralight EV1 Sequence
 ```
-pm3 --> hf mfu dump k FFFFFFFF
+pm3 --> hf mfu dump -k FFFFFFFF
 pm3 --> script run hf_mfu_dumptoemulator -i hf-mfu-XXXX-dump.bin -o hf-mfu-XXXX-dump.eml
-pm3 --> hf mfu eload u hf-mfu-XXXX-dump.eml
-pm3 --> hf mfu sim t 7 u hf-mfu-XXXX-dump.eml
+pm3 --> hf mfu eload -u -f hf-mfu-XXXX-dump.eml
+pm3 --> hf mfu sim -t 7 -f hf-mfu-XXXX-dump.eml
 ```
 
 Bruteforce MIFARE Classic card numbers from 11223344 to 11223346
@@ -359,11 +359,11 @@ Options
 ---
 -w <format> --oem <OEM> --fc <FC> --cn <CN> --issue <issuelevel>
 
--w            : wiegand format to use
---oem        : OEM number / site code
---fc         : facility code
---cn         : card number
---issue      : issue level
+-w                             wiegand format to use
+    --oem                      OEM number / site code
+    --fc                       facility code
+    --cn                       card number
+    --issue                    issue level
 
 pm3 --> wiegand encode -w H10301 --oem 0 --fc 56  --cn 150
 ```
@@ -372,8 +372,8 @@ Convert Site & Facility code from Wiegand raw hex to numbers
 ```
 Options
 ---
--p           : ignore parity errors
---raw        : raw hex to be decoded
+-p                             ignore parity errors
+    --raw                      raw hex to be decoded
 
 pm3 --> wiegand decode --raw 2006f623ae
 ```
@@ -408,15 +408,15 @@ Brute force HID reader
 ```
 Options
 ---
--v, --verbose        : verbose logging, show all tries
--w, --wiegand format : see `wiegand list` for available formats
--f, --fn dec         : facility code
--c, --cn dec         : card number to start with
--i dec               : issue level
--o, --oem dec        : OEM code
--d, --delay dec      : delay betweens attempts in ms. Default 1000ms
---up                 : direction to increment card number. (default is both directions)
---down               : direction to decrement card number. (default is both directions)
+-v, --verbose                  verbose logging, show all tries
+-w, --wiegand format           see `wiegand list` for available formats
+-f, --fn dec                   facility code
+-c, --cn dec                   card number to start with
+-i dec                         issue level
+-o, --oem dec                  OEM code
+-d, --delay dec                delay betweens attempts in ms. Default 1000ms
+    --up                       direction to increment card number. (default is both directions)
+    --down                     direction to decrement card number. (default is both directions)
 
 pm3 --> lf hid brute -w H10301 -f 224
 pm3 --> lf hid brute -v -w H10301 -f 21 -c 200 -d 2000
@@ -439,18 +439,24 @@ Simulate Indala card
 ```
 Options
 ---
-<uid> :  64/224 UID
+-r, --raw <hex>                raw bytes
+    --heden <decimal>          Cardnumber for Heden 2L format
 
-pm3 --> lf indala sim a0000000c2c436c1
+pm3 --> lf indala sim -r a0000000c2c436c1
 ```
 
 Clone to T55x7 card
 ```
 Options
 ---
-<uid> :  64/224 UID
+-r, --raw <hex>                raw bytes
+    --heden <decimal>          Cardnumber for Heden 2L format
+    --fc <decimal>             Facility Code (26 bit H10301 format)
+    --cn <decimal>             Cardnumber (26 bit H10301 format)
+    --q5                       specify writing to Q5/T5555 tag
+    --em                       specify writing to EM4305/4469 tag
 
-pm3 --> lf indala clone a0000000c2c436c1
+pm3 --> lf indala clone -r a0000000c2c436c1
 ```
 
 ## Hitag
@@ -628,11 +634,11 @@ Load default keys into flash memory (RDV4 only)
 ```
 Options
 ---
--o <offset>         : offset in memory
--f <filename>       : file name
---mfc               : upload 6 bytes keys (mifare key dictionary)
---iclass            : upload 8 bytes keys (iClass key dictionary)
---t55xx             : upload 4 bytes keys (pwd dictionary)
+-o <offset>                    offset in memory
+-f <filename>                  file name
+    --mfc                      upload 6 bytes keys (mifare key dictionary)
+    --iclass                   upload 8 bytes keys (iClass key dictionary)
+    --t55xx                    upload 4 bytes keys (pwd dictionary)
 
 pm3 --> mem load -f mfc_default_keys --mfc
 pm3 --> mem load -f t55xx_default_pwds --t5xx

From fc1c7f4fd02f46d46e60e155faf1eea0fe932f13 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 4 Jan 2021 22:22:32 +0100
Subject: [PATCH 305/682] text

---
 doc/cheatsheet.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/doc/cheatsheet.md b/doc/cheatsheet.md
index 9c77f4bee..1aa990358 100644
--- a/doc/cheatsheet.md
+++ b/doc/cheatsheet.md
@@ -153,7 +153,9 @@ Load iCLASS dump into memory for simulation
 ```
 Options
 ---
-f <filename>     : load iCLASS tag-dump filename
+-f, --file <filename>          filename of dump
+    --json                     load JSON type dump
+    --eml                      load EML type dump
 
 pm3 --> hf iclass eload -f hf-iclass-db883702f8ff12e0.bin
 ```

From c13ad9dcc66acf01d2ae7a1f0b8bfb5f9715f1b3 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 4 Jan 2021 23:06:06 +0100
Subject: [PATCH 306/682] text

---
 client/src/cmdhf.c                            |  4 +-
 client/src/cmdhficlass.c                      | 50 ++++++++---------
 doc/commands.md                               | 56 +++++++++----------
 .../3_Commands-and-Features.md                |  2 +-
 4 files changed, 56 insertions(+), 56 deletions(-)

diff --git a/client/src/cmdhf.c b/client/src/cmdhf.c
index 85044f27b..90a3b3ebf 100644
--- a/client/src/cmdhf.c
+++ b/client/src/cmdhf.c
@@ -410,11 +410,11 @@ static command_t CommandTable[] = {
     {"waveshare",   CmdHFWaveshare,   AlwaysAvailable, "{ Waveshare NFC ePaper...             }"},
     {"-----------", CmdHelp,          AlwaysAvailable, "--------------------- " _CYAN_("General") " ---------------------"},
     {"help",        CmdHelp,          AlwaysAvailable, "This help"},
-    {"list",        CmdTraceList,     AlwaysAvailable,    "List protocol data in trace buffer"},
+    {"list",        CmdTraceList,     AlwaysAvailable, "List protocol data in trace buffer"},
     {"plot",        CmdHFPlot,        IfPm3Hfplot,     "Plot signal"},
     {"tune",        CmdHFTune,        IfPm3Present,    "Continuously measure HF antenna tuning"},
     {"search",      CmdHFSearch,      AlwaysAvailable, "Search for known HF tags"},
-    {"sniff",       CmdHFSniff,       IfPm3Hfsniff,    "<samples to skip (10000)> <triggers to skip (1)> Generic HF Sniff"},
+    {"sniff",       CmdHFSniff,       IfPm3Hfsniff,    "Generic HF Sniff"},
     {NULL, NULL, NULL, NULL}
 };
 
diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c
index b4b2f4245..7b90a5bbf 100644
--- a/client/src/cmdhficlass.c
+++ b/client/src/cmdhficlass.c
@@ -3488,36 +3488,36 @@ static int CmdHFiClassAutopwn(const char *Cmd) {
 
 static command_t CommandTable[] = {
     {"-----------", CmdHelp,                    AlwaysAvailable, "--------------------- " _CYAN_("operations") " ---------------------"},
-    {"help",        CmdHelp,                    AlwaysAvailable, "    This help"},
-//    {"clone",       CmdHFiClassClone,           IfPm3Iclass,     "[*] Create a HID credential to Picopass / iCLASS tag"},
-    {"dump",        CmdHFiClassDump,            IfPm3Iclass,     "[*] Dump Picopass / iCLASS tag to file"},
-    {"info",        CmdHFiClassInfo,            AlwaysAvailable, "    Tag information"},
-    {"list",        CmdHFiClassList,            AlwaysAvailable, "    List iclass history"},
-    {"rdbl",        CmdHFiClass_ReadBlock,      IfPm3Iclass,     "[*] Read Picopass / iCLASS block"},
-    {"reader",      CmdHFiClassReader,          IfPm3Iclass,     "    Act like an Picopass / iCLASS reader"},
-    {"restore",     CmdHFiClassRestore,        IfPm3Iclass,      "[*] Restore a dump file onto a Picopass / iCLASS tag"},
-    {"sniff",       CmdHFiClassSniff,           IfPm3Iclass,     "    Eavesdrop Picopass / iCLASS communication"},
-    {"wrbl",        CmdHFiClass_WriteBlock,     IfPm3Iclass,     "[*] Write Picopass / iCLASS block"},
+    {"help",        CmdHelp,                    AlwaysAvailable, "This help"},
+//    {"clone",       CmdHFiClassClone,           IfPm3Iclass,     "Create a HID credential to Picopass / iCLASS tag"},
+    {"dump",        CmdHFiClassDump,            IfPm3Iclass,     "Dump Picopass / iCLASS tag to file"},
+    {"info",        CmdHFiClassInfo,            AlwaysAvailable, "Tag information"},
+    {"list",        CmdHFiClassList,            AlwaysAvailable, "List iclass history"},
+    {"rdbl",        CmdHFiClass_ReadBlock,      IfPm3Iclass,     "Read Picopass / iCLASS block"},
+    {"reader",      CmdHFiClassReader,          IfPm3Iclass,     "Act like an Picopass / iCLASS reader"},
+    {"restore",     CmdHFiClassRestore,        IfPm3Iclass,      "Restore a dump file onto a Picopass / iCLASS tag"},
+    {"sniff",       CmdHFiClassSniff,           IfPm3Iclass,     "Eavesdrop Picopass / iCLASS communication"},
+    {"wrbl",        CmdHFiClass_WriteBlock,     IfPm3Iclass,     "Write Picopass / iCLASS block"},
 
     {"-----------", CmdHelp,                    AlwaysAvailable, "--------------------- " _CYAN_("recovery") " ---------------------"},
-//    {"autopwn",     CmdHFiClassAutopwn,         IfPm3Iclass,     "[*] Automatic key recovery tool for iCLASS"},
-    {"chk",         CmdHFiClassCheckKeys,       IfPm3Iclass,     "[*] Check keys"},
-    {"loclass",     CmdHFiClass_loclass,        AlwaysAvailable, "[*] Use loclass to perform bruteforce reader attack"},
-    {"lookup",      CmdHFiClassLookUp,          AlwaysAvailable, "[*] Uses authentication trace to check for key in dictionary file"},
+//    {"autopwn",     CmdHFiClassAutopwn,         IfPm3Iclass,     "Automatic key recovery tool for iCLASS"},
+    {"chk",         CmdHFiClassCheckKeys,       IfPm3Iclass,     "Check keys"},
+    {"loclass",     CmdHFiClass_loclass,        AlwaysAvailable, "Use loclass to perform bruteforce reader attack"},
+    {"lookup",      CmdHFiClassLookUp,          AlwaysAvailable, "Uses authentication trace to check for key in dictionary file"},
     {"-----------", CmdHelp,                    AlwaysAvailable, "--------------------- " _CYAN_("simulation") " ---------------------"},
-    {"sim",         CmdHFiClassSim,             IfPm3Iclass,     "[*] Simulate iCLASS tag"},
-    {"eload",       CmdHFiClassELoad,           IfPm3Iclass,     "[*] Load Picopass / iCLASS dump file into emulator memory"},
-    {"esave",       CmdHFiClassESave,           IfPm3Iclass,     "[*] Save emulator memory to file"},
-    {"eview",       CmdHFiClassEView,           IfPm3Iclass,     "[.] View emulator memory"},
+    {"sim",         CmdHFiClassSim,             IfPm3Iclass,     "Simulate iCLASS tag"},
+    {"eload",       CmdHFiClassELoad,           IfPm3Iclass,     "Load Picopass / iCLASS dump file into emulator memory"},
+    {"esave",       CmdHFiClassESave,           IfPm3Iclass,     "Save emulator memory to file"},
+    {"eview",       CmdHFiClassEView,           IfPm3Iclass,     "View emulator memory"},
 
     {"-----------", CmdHelp,                    AlwaysAvailable, "--------------------- " _CYAN_("utils") " ---------------------"},
-    {"calcnewkey",  CmdHFiClassCalcNewKey,      AlwaysAvailable, "[*] Calc diversified keys (blocks 3 & 4) to write new keys"},
-    {"encode",      CmdHFiClassEncode,          AlwaysAvailable, "[*] Encode binary wiegand to block 7"},
-    {"encrypt",     CmdHFiClassEncryptBlk,      AlwaysAvailable, "[*] Encrypt given block data"},
-    {"decrypt",     CmdHFiClassDecrypt,         AlwaysAvailable, "[*] Decrypt given block data or tag dump file" },
-    {"managekeys",  CmdHFiClassManageKeys,      AlwaysAvailable, "[*] Manage keys to use with iclass commands"},
-    {"permutekey",  CmdHFiClassPermuteKey,      IfPm3Iclass,     "    Permute function from 'heart of darkness' paper"},
-    {"view",        CmdHFiClassView,            AlwaysAvailable, "[*] Display content from tag dump file"},
+    {"calcnewkey",  CmdHFiClassCalcNewKey,      AlwaysAvailable, "Calc diversified keys (blocks 3 & 4) to write new keys"},
+    {"encode",      CmdHFiClassEncode,          AlwaysAvailable, "Encode binary wiegand to block 7"},
+    {"encrypt",     CmdHFiClassEncryptBlk,      AlwaysAvailable, "Encrypt given block data"},
+    {"decrypt",     CmdHFiClassDecrypt,         AlwaysAvailable, "Decrypt given block data or tag dump file" },
+    {"managekeys",  CmdHFiClassManageKeys,      AlwaysAvailable, "Manage keys to use with iclass commands"},
+    {"permutekey",  CmdHFiClassPermuteKey,      IfPm3Iclass,     "Permute function from 'heart of darkness' paper"},
+    {"view",        CmdHFiClassView,            AlwaysAvailable, "Display content from tag dump file"},
     {NULL, NULL, NULL, NULL}
 };
 
diff --git a/doc/commands.md b/doc/commands.md
index fa960f973..347fdaaa8 100644
--- a/doc/commands.md
+++ b/doc/commands.md
@@ -121,7 +121,7 @@ Check column "offline" for their availability.
 |`hf plot                `|N       |`Plot signal`
 |`hf tune                `|N       |`Continuously measure HF antenna tuning`
 |`hf search              `|Y       |`Search for known HF tags`
-|`hf sniff               `|N       |`<samples to skip (10000)> <triggers to skip (1)> Generic HF Sniff`
+|`hf sniff               `|N       |`Generic HF Sniff`
 
 
 ### hf 14a
@@ -260,29 +260,29 @@ Check column "offline" for their availability.
 
 |command                  |offline |description
 |-------                  |------- |-----------
-|`hf iclass help         `|Y       |`    This help`
-|`hf iclass dump         `|N       |`[*] Dump Picopass / iCLASS tag to file`
-|`hf iclass info         `|Y       |`    Tag information`
-|`hf iclass list         `|Y       |`    List iclass history`
-|`hf iclass rdbl         `|N       |`[*] Read Picopass / iCLASS block`
-|`hf iclass reader       `|N       |`    Act like an Picopass / iCLASS reader`
-|`hf iclass restore      `|N       |`[*] Restore a dump file onto a Picopass / iCLASS tag`
-|`hf iclass sniff        `|N       |`    Eavesdrop Picopass / iCLASS communication`
-|`hf iclass wrbl         `|N       |`[*] Write Picopass / iCLASS block`
-|`hf iclass chk          `|N       |`[*] Check keys`
-|`hf iclass loclass      `|Y       |`[*] Use loclass to perform bruteforce reader attack`
-|`hf iclass lookup       `|Y       |`[*] Uses authentication trace to check for key in dictionary file`
-|`hf iclass sim          `|N       |`[*] Simulate iCLASS tag`
-|`hf iclass eload        `|N       |`[*] Load Picopass / iCLASS dump file into emulator memory`
-|`hf iclass esave        `|N       |`[*] Save emulator memory to file`
-|`hf iclass eview        `|N       |`[.] View emulator memory`
-|`hf iclass calcnewkey   `|Y       |`[*] Calc diversified keys (blocks 3 & 4) to write new keys`
-|`hf iclass encode       `|Y       |`[*] Encode binary wiegand to block 7`
-|`hf iclass encrypt      `|Y       |`[*] Encrypt given block data`
-|`hf iclass decrypt      `|Y       |`[*] Decrypt given block data or tag dump file`
-|`hf iclass managekeys   `|Y       |`[*] Manage keys to use with iclass commands`
-|`hf iclass permutekey   `|N       |`    Permute function from 'heart of darkness' paper`
-|`hf iclass view         `|Y       |`[*] Display content from tag dump file`
+|`hf iclass help         `|Y       |`This help`
+|`hf iclass dump         `|N       |`Dump Picopass / iCLASS tag to file`
+|`hf iclass info         `|Y       |`Tag information`
+|`hf iclass list         `|Y       |`List iclass history`
+|`hf iclass rdbl         `|N       |`Read Picopass / iCLASS block`
+|`hf iclass reader       `|N       |`Act like an Picopass / iCLASS reader`
+|`hf iclass restore      `|N       |`Restore a dump file onto a Picopass / iCLASS tag`
+|`hf iclass sniff        `|N       |`Eavesdrop Picopass / iCLASS communication`
+|`hf iclass wrbl         `|N       |`Write Picopass / iCLASS block`
+|`hf iclass chk          `|N       |`Check keys`
+|`hf iclass loclass      `|Y       |`Use loclass to perform bruteforce reader attack`
+|`hf iclass lookup       `|Y       |`Uses authentication trace to check for key in dictionary file`
+|`hf iclass sim          `|N       |`Simulate iCLASS tag`
+|`hf iclass eload        `|N       |`Load Picopass / iCLASS dump file into emulator memory`
+|`hf iclass esave        `|N       |`Save emulator memory to file`
+|`hf iclass eview        `|N       |`View emulator memory`
+|`hf iclass calcnewkey   `|Y       |`Calc diversified keys (blocks 3 & 4) to write new keys`
+|`hf iclass encode       `|Y       |`Encode binary wiegand to block 7`
+|`hf iclass encrypt      `|Y       |`Encrypt given block data`
+|`hf iclass decrypt      `|Y       |`Decrypt given block data or tag dump file`
+|`hf iclass managekeys   `|Y       |`Manage keys to use with iclass commands`
+|`hf iclass permutekey   `|N       |`Permute function from 'heart of darkness' paper`
+|`hf iclass view         `|Y       |`Display content from tag dump file`
 
 
 ### hf legic
@@ -508,14 +508,14 @@ Check column "offline" for their availability.
 |`hw help                `|Y       |`This help`
 |`hw connect             `|Y       |`connect Proxmark3 to serial port`
 |`hw dbg                 `|N       |`Set Proxmark3 debug level`
-|`hw detectreader        `|N       |`['l'|'h'] -- Detect external reader field (option 'l' or 'h' to limit to LF or HF)`
+|`hw detectreader        `|N       |`Detect external reader field`
 |`hw fpgaoff             `|N       |`Set FPGA off`
-|`hw lcd                 `|N       |`<HEX command> <count> -- Send command/data to LCD`
+|`hw lcd                 `|N       |`Send command/data to LCD`
 |`hw lcdreset            `|N       |`Hardware reset LCD`
 |`hw ping                `|N       |`Test if the Proxmark3 is responsive`
-|`hw readmem             `|N       |`[address] -- Read memory at decimal address from flash`
+|`hw readmem             `|N       |`Read memory at decimal address from flash`
 |`hw reset               `|N       |`Reset the Proxmark3`
-|`hw setlfdivisor        `|N       |`<19 - 255> -- Drive LF antenna at 12MHz/(divisor+1)`
+|`hw setlfdivisor        `|N       |`Drive LF antenna at 12 MHz / (divisor + 1)`
 |`hw setmux              `|N       |`Set the ADC mux to a specific value`
 |`hw standalone          `|N       |`Jump to the standalone mode`
 |`hw status              `|N       |`Show runtime status information about the connected Proxmark3`
diff --git a/doc/md/Use_of_Proxmark/3_Commands-and-Features.md b/doc/md/Use_of_Proxmark/3_Commands-and-Features.md
index 195468002..d2786956a 100644
--- a/doc/md/Use_of_Proxmark/3_Commands-and-Features.md
+++ b/doc/md/Use_of_Proxmark/3_Commands-and-Features.md
@@ -9,7 +9,7 @@ Please make sure you've gone through the following pages firstly:
 
 ## To get interactive help
 
-As seen before, for basic help type `help`. Or for help on a set of sub commands type the command followed by `help`. For example `hf mf help`.  Many commands uses the `h` parameter to show a help text.
+As seen before, for basic help type `help`. Or for help on a set of sub commands type the command followed by `help`. For example `hf mf help`.  Many commands uses the `h` / `-h` parameter to show a help text.
 
 ## New Features in RDV4
 

From f6868aadf97b0dd42c2ba465677f769927f87e75 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Tue, 5 Jan 2021 01:11:46 +0100
Subject: [PATCH 307/682] next version of half duplex simulation

---
 client/src/cmdlfem4x50.c | 15 ++++++++++++---
 include/em4x50.h         |  1 +
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c
index 402c826e4..d4a458438 100644
--- a/client/src/cmdlfem4x50.c
+++ b/client/src/cmdlfem4x50.c
@@ -1247,7 +1247,8 @@ int CmdEM4x50Test(const char *Cmd) {
                   "lf em 4x50 test --field on   -> reader field on\n"
                   "lf em 4x50 test --field off  -> reader field off\n"
                   "lf em 4x50 test --check      -> check on/off status of reader field\n"
-                  "lf em 4x50 test --cycles 100  -> measure time of 100 field cycles\n"
+                  "lf em 4x50 test --cycles 100 -> measure time of 100 field cycles\n"
+                  "lf em 4x50 test --reset      -> intitiate reset command\n"
                  );
 
     void *argtable[] = {
@@ -1255,6 +1256,7 @@ int CmdEM4x50Test(const char *Cmd) {
         arg_str0(NULL, "field", "on/off", "field on/off"),
         arg_lit0(NULL, "check", "check if field is on or off"),
         arg_int0(NULL, "cycles", "<dec>", "number of field cycles"),
+        arg_lit0(NULL, "reset", "initiates a manual reset command"),
         arg_param_end
     };
 
@@ -1280,7 +1282,9 @@ int CmdEM4x50Test(const char *Cmd) {
     ett.check_field = arg_get_lit(ctx, 2);
     // option: cycles
     ett.cycles = arg_get_int_def(ctx, 3, 0);
-    
+    // option: reset
+    ett.reset = arg_get_lit(ctx, 4);
+
     CLIParserFree(ctx);
 
     // start
@@ -1295,8 +1299,13 @@ int CmdEM4x50Test(const char *Cmd) {
             PrintAndLogEx(SUCCESS, "Field switched " _GREEN_("on"));
         if (ett.check_field == 1)
             PrintAndLogEx(SUCCESS, "Field status evaluated");
+        if (ett.reset == 1)
+            PrintAndLogEx(SUCCESS, "reset command " _GREEN_("ok"));
     } else if (resp.status == 0) {
-        PrintAndLogEx(SUCCESS, "Field switched " _GREEN_("off"));
+        if (ett.field == 1)
+            PrintAndLogEx(SUCCESS, "Field switched " _GREEN_("off"));
+        if (ett.reset == 1)
+            PrintAndLogEx(SUCCESS, "reset command " _GREEN_("failed"));
     } else if (resp.status == -1) {
         PrintAndLogEx(INFO, "Nothing done");
     } else {
diff --git a/include/em4x50.h b/include/em4x50.h
index 06ca3f10a..a2d1dfe23 100644
--- a/include/em4x50.h
+++ b/include/em4x50.h
@@ -52,6 +52,7 @@ typedef struct {
 
 typedef struct {
     bool check_field;
+    bool reset;
     int field;
     int cycles;
 } PACKED em4x50_test_t;

From 560be3005301b94e5918d7766ea7a6c2a283335b Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Tue, 5 Jan 2021 01:12:21 +0100
Subject: [PATCH 308/682] next version of half duplex simulation

---
 armsrc/em4x50.c | 212 ++++++++++++++++++------------------------------
 1 file changed, 78 insertions(+), 134 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index 6c6091a8b..e0b93ce0f 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -57,12 +57,17 @@
 
 int gHigh = 190;
 int gLow = 60;
+
+// a global parameter is needed to indicate whether a previous login was
+// successful, so operations that require authentication may be performed
+bool gLogin = 0;
+
 int gcount = 0;
 int gcycles = 0;
 int rm = 0;
 
-static bool em4x50_sim_send_listen_window(void);
-static void em4x50_sim_handle_command(uint8_t command);
+static bool em4x50_sim_send_listen_window(uint32_t *tag);
+static void em4x50_sim_handle_command(uint8_t command, uint32_t *tag);
 
 void catch_samples(void);
 
@@ -170,22 +175,19 @@ static void em4x50_setup_read(void) {
 
     // Enable Peripheral Clock for
     //   TIMER_CLOCK0, used to measure exact timing before answering
-    AT91C_BASE_PMC->PMC_PCER |= (1 << AT91C_ID_TC0) | (1 << AT91C_ID_TC1);
+    AT91C_BASE_PMC->PMC_PCER |= (1 << AT91C_ID_TC0);// | (1 << AT91C_ID_TC1);
     AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME;
 
     // Disable timer during configuration
     AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;
-    AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
 
     // TC0: Capture mode, default timer source = MCK/2 (TIMER_CLOCK1), no triggers
     AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK;
-    AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK;
 
     // TC1: Capture mode, default timer source = MCK/2 (TIMER_CLOCK1), no triggers
 
     // Enable and reset counters
     AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
-    AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
 
     // synchronized startup procedure
     while (AT91C_BASE_TC0->TC_CV > 0) {}; // wait until TC1 returned to zero
@@ -289,13 +291,11 @@ static bool invalid_bit(void) {
 
     // get sample at 3/4 of bit period
     wait_timer(T0 * EM4X50_T_TAG_THREE_QUARTER_PERIOD);
-    //wait_timer(T0 * EM4X50_T_TAG_HALF_PERIOD);
 
     uint8_t sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 
     // wait until end of bit period
     wait_timer(T0 * EM4X50_T_TAG_QUARTER_PERIOD);
-    //wait_timer(T0 * EM4X50_T_TAG_HALF_PERIOD);
 
     // bit in "undefined" state?
     if (sample <= gHigh && sample >= gLow)
@@ -522,18 +522,14 @@ static int request_receive_mode(void) {
 // If <bliw> is true then within the single listen window right after the
 // ack signal a RM request has to be sent.
 static bool check_ack(bool bliw) {
-    int cnt_pulses = 0;
-    
-    AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
-    //while (cnt_pulses < EM4X50_T_WAITING_FOR_ACK) {
-    while (AT91C_BASE_TC0->TC_CV < T0 * 4 * EM4X50_T_TAG_FULL_PERIOD) {
-
+    int count_cycles = 0;
+    while (count_cycles < EM4X50_T_WAITING_FOR_ACK) {
         if (BUTTON_PRESS())
             return false;
         
         if (check_pulse_length(get_pulse_length(), 2 * EM4X50_T_TAG_FULL_PERIOD)) {
 
-            catch_samples();
+            //catch_samples();
             
             // The received signal is either ACK or NAK.
 
@@ -570,7 +566,7 @@ static bool check_ack(bool bliw) {
                 break;
             }
         }
-        cnt_pulses++;
+        count_cycles++;
     }
 
     return false;
@@ -919,6 +915,8 @@ static void em4x50_sim_send_nak(void) {
 
     SHORT_COIL();
     wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    OPEN_COIL();
 }
 
 /*
@@ -969,68 +967,57 @@ static bool em4x50_sim_send_listen_window(void) {
 }
 */
 
-static void em4x50_sim_handle_login_command(void) {
+static void em4x50_sim_handle_login_command(uint32_t *tag) {
 
-    //uint8_t *em4x50_mem = BigBuf_get_EM_addr();
     uint32_t password = 0;
-    //uint32_t tag[EM4X50_NO_WORDS] = {0x0};
 
     // read password
     password = em4x50_sim_read_word();
 
-    //for (int i = 0; i < EM4X50_NO_WORDS; i++)
-    //    tag[i] = reflect32(bytes_to_num(em4x50_mem + (i * 4), 4));
-
     // processing pause time (corresponds to a "1" bit)
     em4x50_sim_send_bit(1);
 
-    em4x50_sim_send_ack();
-
-    /*
+    // empirically determined delay (to be examined seperately)
+    wait_cycles(1);
+    
     if (password == tag[0]) {
         em4x50_sim_send_ack();
+        gLogin = true;
     } else {
-        em4x50_sim_send_ack();
+        em4x50_sim_send_nak();
+        gLogin = false;
     }
-    */
     
     // continue with standard read mode
-    em4x50_sim_handle_command(0);
-    Dbprintf("password = %08x", password);
-    BigBuf_free();
+    em4x50_sim_handle_command(0, tag);
 }
 
-static void em4x50_sim_handle_reset_command(void) {
+static void em4x50_sim_handle_reset_command(uint32_t *tag) {
 
     // processing pause time (corresponds to a "1" bit)
     em4x50_sim_send_bit(1);
 
     // send ACK
     em4x50_sim_send_ack();
+    gLogin = false;
     
     // wait for tinit
-    wait_timer(T0 * EM4X50_T_TAG_TINIT);
-
+    wait_cycles(EM4X50_T_TAG_TINIT);
+    
     // continue with standard read mode
-    em4x50_sim_handle_command(0);
+    em4x50_sim_handle_command(0, tag);
 }
 
-static void em4x50_sim_handle_write_command(void) {
+static void em4x50_sim_handle_write_command(uint32_t *tag) {
 
-    uint8_t *em4x50_mem = BigBuf_get_EM_addr();
     uint8_t address = 0;
     uint32_t data = 0;
-    uint32_t tag[EM4X50_NO_WORDS] = {0x0};
 
     // read address
     address = em4x50_sim_read_byte_with_parity_check();
     // read data
     data = em4x50_sim_read_word();
     
-    for (int i = 0; i < EM4X50_NO_WORDS; i++) {
-        tag[i] = reflect32(bytes_to_num(em4x50_mem + (i * 4), 4));
-    }
-
     // extract necessary control data
     bool raw = (tag[EM4X50_CONTROL] >> CONFIG_BLOCK) & READ_AFTER_WRITE;
     // extract protection data
@@ -1041,7 +1028,7 @@ static void em4x50_sim_handle_write_command(void) {
     tag[address] = data;
     
     // write access time
-    wait_timer(T0 * EM4X50_T_TAG_TWA);
+    wait_cycles(EM4X50_T_TAG_TWA);
 
     if ((address >= fwrp) && (address <= lwrp)) {
         em4x50_sim_send_nak();
@@ -1055,28 +1042,24 @@ static void em4x50_sim_handle_write_command(void) {
     }
     
     // EEPROM write time
-    //wait_timer(T0 * EM4X50_T_TAG_TWEE);
+    wait_cycles(EM4X50_T_TAG_TWEE);
     
     em4x50_sim_send_ack();
 
     // if "read after write" (raw) bit is set, repeat written data once
     if (raw) {
-        em4x50_sim_send_listen_window();
-        em4x50_sim_send_listen_window();
+        em4x50_sim_send_listen_window(tag);
+        em4x50_sim_send_listen_window(tag);
         em4x50_sim_send_word(tag[address]);
     }
 
-    BigBuf_free();
-
     // continue with standard read mode
-    em4x50_sim_handle_command(0);
+    em4x50_sim_handle_command(0, tag);
 }
 
-static void em4x50_sim_handle_selective_read_command(void) {
+static void em4x50_sim_handle_selective_read_command(uint32_t *tag) {
 
-    uint8_t *em4x50_mem = BigBuf_get_EM_addr();
     uint32_t address = 0;
-    uint32_t tag[EM4X50_NO_WORDS] = {0x0};
 
     // read password
     address = em4x50_sim_read_word();
@@ -1085,10 +1068,6 @@ static void em4x50_sim_handle_selective_read_command(void) {
     int fwr = address & 0xFF;           // first word read
     int lwr = (address >> 8) & 0xFF;    // last word read
 
-    for (int i = 0; i < EM4X50_NO_WORDS; i++) {
-        tag[i] = reflect32(bytes_to_num(em4x50_mem + (i * 4), 4));
-    }
-
     // extract protection data
     int fwrp = tag[EM4X50_PROTECTION] & 0xFF;         // first word read protected
     int lwrp = (tag[EM4X50_PROTECTION] >> 8) & 0xFF;  // last word read protected
@@ -1098,34 +1077,27 @@ static void em4x50_sim_handle_selective_read_command(void) {
 
     em4x50_sim_send_ack();
     
+    // iceman,  will need a usb cmd check to break as well
     while (BUTTON_PRESS() == false) {
 
         WDT_HIT();
-        em4x50_sim_send_listen_window();
+        em4x50_sim_send_listen_window(tag);
         for (int i = fwr; i <= lwr; i++) {
 
-            em4x50_sim_send_listen_window();
+            em4x50_sim_send_listen_window(tag);
 
-            if ((i >= fwrp) && (i <= lwrp)) {
+            // if not authenticated do not send read protected words
+            if ((gLogin == false) && (i >= fwrp) && (i <= lwrp)) {
                 em4x50_sim_send_word(0x00);
             } else {
                 em4x50_sim_send_word(tag[i]);
             }
         }
     }
-    
-    BigBuf_free();
 }
 
-static void em4x50_sim_handle_standard_read_command(void) {
+static void em4x50_sim_handle_standard_read_command(uint32_t *tag) {
     
-    uint8_t *em4x50_mem = BigBuf_get_EM_addr();
-    uint32_t tag[EM4X50_NO_WORDS] = {0x0};
-
-    for (int i = 0; i < EM4X50_NO_WORDS; i++) {
-        tag[i] = reflect32(bytes_to_num(em4x50_mem + (i * 4), 4));
-    }
-
     // extract control data
     int fwr = tag[CONFIG_BLOCK] & 0xFF;           // first word read
     int lwr = (tag[CONFIG_BLOCK] >> 8) & 0xFF;    // last word read
@@ -1133,13 +1105,14 @@ static void em4x50_sim_handle_standard_read_command(void) {
     int fwrp = tag[EM4X50_PROTECTION] & 0xFF;         // first word read protected
     int lwrp = (tag[EM4X50_PROTECTION] >> 8) & 0xFF;  // last word read protected
 
+    // iceman,  will need a usb cmd check to break as well
     while (BUTTON_PRESS() == false) {
 
         WDT_HIT();
-        em4x50_sim_send_listen_window();
+        em4x50_sim_send_listen_window(tag);
         for (int i = fwr; i <= lwr; i++) {
 
-            em4x50_sim_send_listen_window();
+            em4x50_sim_send_listen_window(tag);
 
             if ((i >= fwrp) && (i <= lwrp)) {
                 em4x50_sim_send_word(0x00);
@@ -1148,23 +1121,22 @@ static void em4x50_sim_handle_standard_read_command(void) {
             }
         }
     }
-    BigBuf_free();
 }
 
-static void em4x50_sim_handle_command(uint8_t command) {
+static void em4x50_sim_handle_command(uint8_t command, uint32_t *tag) {
     
     switch (command) {
 
         case EM4X50_COMMAND_LOGIN:
-            em4x50_sim_handle_login_command();
+            em4x50_sim_handle_login_command(tag);
             break;
 
         case EM4X50_COMMAND_RESET:
-            em4x50_sim_handle_reset_command();
+            em4x50_sim_handle_reset_command(tag);
             break;
 
         case EM4X50_COMMAND_WRITE:
-            em4x50_sim_handle_write_command();
+            em4x50_sim_handle_write_command(tag);
             break;
 
         case EM4X50_COMMAND_WRITE_PASSWORD:
@@ -1172,17 +1144,17 @@ static void em4x50_sim_handle_command(uint8_t command) {
             break;
 
         case EM4X50_COMMAND_SELECTIVE_READ:
-            em4x50_sim_handle_selective_read_command();
+            em4x50_sim_handle_selective_read_command(tag);
             break;
 
         default:
-            em4x50_sim_handle_standard_read_command();
+            em4x50_sim_handle_standard_read_command(tag);
             break;
     }
 }
 
 // reader requests receive mode (rm) by sending two zeros
-static void check_rm_request(void) {
+static void check_rm_request(uint32_t *tag) {
     
     int cond = EM4X50_T_TAG_FULL_PERIOD - EM4X50_TAG_TOLERANCE;
     
@@ -1194,12 +1166,12 @@ static void check_rm_request(void) {
 
             // read mode request detected, get command from reader
             uint8_t command = em4x50_sim_read_byte_with_parity_check();
-            em4x50_sim_handle_command(command);
+            em4x50_sim_handle_command(command, tag);
         }
     }
 }
 
-static bool em4x50_sim_send_listen_window(void) {
+static bool em4x50_sim_send_listen_window(uint32_t *tag) {
 
     SHORT_COIL();
     wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
@@ -1211,7 +1183,7 @@ static bool em4x50_sim_send_listen_window(void) {
     wait_cycles(2 * EM4X50_T_TAG_FULL_PERIOD);
 
     OPEN_COIL();
-    check_rm_request();
+    check_rm_request(tag);
 
     SHORT_COIL();
     wait_cycles(EM4X50_T_TAG_FULL_PERIOD);
@@ -1230,7 +1202,7 @@ static bool login(uint32_t password) {
         // send password
         em4x50_reader_send_word(password);
 
-        wait_timer(T0 * EM4X50_T_TAG_TPP);
+        wait_timer(T0 * (EM4X50_T_TAG_TPP));
 
         // check if ACK is returned
         if (check_ack(false)) {
@@ -1377,7 +1349,7 @@ static int reset(void) {
 
         // send reset command
         em4x50_reader_send_byte_with_parity(EM4X50_COMMAND_RESET);
-
+        
         if (check_ack(false))
             return PM3_SUCCESS;
 
@@ -1674,60 +1646,36 @@ void em4x50_writepwd(em4x50_data_t *etd) {
 }
 
 // simulate uploaded data in emulator memory
-// (currently simulation allows only a one-way communication)
 void em4x50_sim() {
     int status = PM3_SUCCESS;
     uint8_t *em4x50_mem = BigBuf_get_EM_addr();
-    uint32_t words[EM4X50_NO_WORDS] = {0x0};
+    uint32_t tag[EM4X50_NO_WORDS] = {0x0};
 
     for (int i = 0; i < EM4X50_NO_WORDS; i++)
-        words[i] = reflect32(bytes_to_num(em4x50_mem + (i * 4), 4));
+        tag[i] = reflect32(bytes_to_num(em4x50_mem + (i * 4), 4));
 
     // only if valid em4x50 data (e.g. uid == serial)
-    if (words[EM4X50_DEVICE_SERIAL] != words[EM4X50_DEVICE_ID]) {
+    if (tag[EM4X50_DEVICE_SERIAL] != tag[EM4X50_DEVICE_ID]) {
 
+        // init
         em4x50_setup_sim();
+        gLogin = false;
 
-        em4x50_sim_handle_command(0);
+        // start with inital command = standard read mode (= 0)
+        em4x50_sim_handle_command(0, tag);
         
-        /*
-        // extract control data
-        int fwr = words[CONFIG_BLOCK] & 0xFF;           // first word read
-        int lwr = (words[CONFIG_BLOCK] >> 8) & 0xFF;    // last word read
-        // extract protection data
-        int fwrp = words[EM4X50_PROTECTION] & 0xFF;         // first word read protected
-        int lwrp = (words[EM4X50_PROTECTION] >> 8) & 0xFF;  // last word read protected
-
-        // iceman,  will need a usb cmd check to break as well
-        while (BUTTON_PRESS() == false) {
-
-            rm = 0;
-            WDT_HIT();
-            em4x50_sim_send_listen_window();
-            for (int i = fwr; i <= lwr; i++) {
-
-                em4x50_sim_send_listen_window();
-
-                if ((i >= fwrp) && (i <= lwrp))
-                    em4x50_sim_send_word(0x00);
-                else
-                    em4x50_sim_send_word(words[i]);
-            }
-        }
-         */
     } else {
         status = PM3_ENODATA;
     }
 
     BigBuf_free();
     lf_finalize();
-    
     reply_ng(CMD_LF_EM4X50_SIM, status, NULL, 0);
 }
 
 void em4x50_test(em4x50_test_t *ett) {
 
-    int status = PM3_EFAILED;
+    int status = 0;
 
     // set field on or off
     if (ett->field != -1) {
@@ -1791,25 +1739,21 @@ void em4x50_test(em4x50_test_t *ett) {
         }
 
     }
-    
-    em4x50_setup_sim();
-    for (;;) {
-        em4x50_sim_send_listen_window();
-        em4x50_sim_send_listen_window();
-        em4x50_sim_send_bit(0);
-        em4x50_sim_send_bit(0);
-        em4x50_sim_send_bit(0);
-        em4x50_sim_send_ack();
-        em4x50_sim_send_ack();
-        em4x50_sim_send_bit(0);
-        em4x50_sim_send_bit(0);
-        em4x50_sim_send_bit(0);
-        em4x50_sim_send_nak();
-        em4x50_sim_send_nak();
-        em4x50_sim_send_bit(0);
-        em4x50_sim_send_bit(0);
-        em4x50_sim_send_bit(0);
+        
+    // perform reset
+    if (ett->reset) {
+        em4x50_setup_read();
+
+        status = PM3_EFAILED;
+        if (get_signalproperties() && find_em4x50_tag()) {
+
+            if (reset() == PM3_SUCCESS) {
+                status = 1;
+            }
+        }
+
+        lf_finalize();
     }
-    
+
     reply_ng(CMD_LF_EM4X50_TEST, status, NULL, 0);
 }

From 1083945a00af7fc8ada0f4d4386d4f1b1d42d8fe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C4=B0lteri=C5=9F=20Ero=C4=9Flu?= <ilteris@asenkron.com.tr>
Date: Tue, 5 Jan 2021 14:44:05 +0300
Subject: [PATCH 309/682] Make jobnames more understandable

---
 .github/workflows/macos.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index cef27e89e..c476fbefe 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -3,7 +3,7 @@ name: MacOS Build and Test
 on: [push, pull_request]
 
 jobs:
-  build-make:
+  macos-make:
     runs-on: macos-latest
 
     steps:
@@ -36,9 +36,9 @@ jobs:
       - name: Test
         run: make check
 
-  build-make-btaddon:
+  macos-make-btaddon:
     if: always()
-    needs: [build-make]
+    needs: [macos-make]
     runs-on: macos-latest
 
     steps:
@@ -72,9 +72,9 @@ jobs:
       - name: Test
         run: make check
 
-  build-cmake:
+  macos-cmake:
     if: always()
-    needs: [build-make, build-make-btaddon]
+    needs: [macos-make, macos-make-btaddon]
     runs-on: macos-latest
 
     steps:

From e41e5de8b262c7e6c8c5a2cbbf653dcc6c45535a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C4=B0lteri=C5=9F=20Ero=C4=9Flu?= <ilteris@asenkron.com.tr>
Date: Tue, 5 Jan 2021 14:44:49 +0300
Subject: [PATCH 310/682] Make jobnames more understandable 2/2

---
 .github/workflows/ubuntu.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index 394088e87..57a6caa1d 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -3,7 +3,7 @@ name: Ubuntu Build and Test
 on: [push, pull_request]
 
 jobs:
-  build-make:
+  ubuntu-make:
     runs-on: ubuntu-latest
 
     steps:
@@ -26,9 +26,9 @@ jobs:
       - name: Test
         run: make check
 
-  build-make-btaddon:
+  ubuntu-make-btaddon:
     if: always()
-    needs: [build-make]
+    needs: [ubuntu-make]
     runs-on: ubuntu-latest
 
     steps:
@@ -52,9 +52,9 @@ jobs:
       - name: Test
         run: make check
 
-  build-cmake:
+  ubuntu-cmake:
     if: always()
-    needs: [build-make, build-make-btaddon]
+    needs: [ubuntu-make, ubuntu-make-btaddon]
     runs-on: ubuntu-latest
 
     steps:

From 9e0b18ad9a20bdf022bc78e0419ca7dc1f5a7595 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 5 Jan 2021 15:20:57 +0100
Subject: [PATCH 311/682] added actions badges

---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index 578dccf7f..18b964704 100644
--- a/README.md
+++ b/README.md
@@ -8,6 +8,10 @@
 | [![Latest release](https://img.shields.io/github/v/release/rfidresearchgroup/proxmark3)](https://github.com/RfidResearchGroup/proxmark3/releases/latest) | [![Build status](https://api.travis-ci.com/RfidResearchGroup/proxmark3.svg?branch=master)](https://travis-ci.com/RfidResearchGroup/proxmark3) | [![Build status](https://ci.appveyor.com/api/projects/status/b4gwrhq3nc876cuu/branch/master?svg=true)](https://ci.appveyor.com/project/RfidResearchGroup/proxmark3/branch/master) | [![Coverity Status](https://scan.coverity.com/projects/19334/badge.svg)](https://scan.coverity.com/projects/proxmark3-rrg-iceman-repo)| ![GitHub contributors](https://img.shields.io/github/contributors/rfidresearchgroup/proxmark3) |
 
 
+| Actions OSX CI    |  Actions Ubuntu CI    | 
+| ------------------- |:-------------------:|
+| ![MacOS Build and Test](https://github.com/RfidResearchGroup/proxmark3/workflows/MacOS%20Build%20and%20Test/badge.svg?branch=master) | ![Ubuntu Build and Test](https://github.com/RfidResearchGroup/proxmark3/workflows/Ubuntu%20Build%20and%20Test/badge.svg?branch=master) |
+
 
 # PROXMARK INSTALLATION AND OVERVIEW
 

From 82ffd54f09ad02550ff89d876055801534ffb498 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 5 Jan 2021 22:53:00 +0100
Subject: [PATCH 312/682] added 3 spaces to compensate when voltage goes to one
 digit

---
 client/src/ui.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/ui.c b/client/src/ui.c
index 327d266bf..f01b71009 100644
--- a/client/src/ui.c
+++ b/client/src/ui.c
@@ -710,12 +710,12 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
             break;
         }
         case STYLE_MIXED: {
-            sprintf(buffer, "%s [ %zu mV / %2u V / %2u Vmax ]", cbar, count, (uint32_t)(count / 1000), (uint32_t)(max / 1000));
+            sprintf(buffer, "%s [ %zu mV / %2u V / %2u Vmax ]   ", cbar, count, (uint32_t)(count / 1000), (uint32_t)(max / 1000));
             printf("\b%c[2K\r[" _YELLOW_("=")"] %s ", 27, buffer);
             break;
         }
         case STYLE_VALUE: {
-            printf("[" _YELLOW_("=")"] %zu mV / %2u V / %2u Vmax\r", count, (uint32_t)(count / 1000), (uint32_t)(max / 1000));
+            printf("[" _YELLOW_("=")"] %zu mV / %2u V / %2u Vmax   \r", count, (uint32_t)(count / 1000), (uint32_t)(max / 1000));
             break;
         }
     }

From 55ede9e415bca324f703124152143f96924fde48 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 6 Jan 2021 02:04:57 +0100
Subject: [PATCH 313/682] hw setlfdivsor - text

---
 client/src/cmdhw.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/client/src/cmdhw.c b/client/src/cmdhw.c
index 71c33a755..45281637c 100644
--- a/client/src/cmdhw.c
+++ b/client/src/cmdhw.c
@@ -508,9 +508,9 @@ static int CmdReset(const char *Cmd) {
 static int CmdSetDivisor(const char *Cmd) {
 
     CLIParserContext *ctx;
-    CLIParserInit(&ctx, "hw setdivisor",
+    CLIParserInit(&ctx, "hw setlfdivisor",
                   "Drive LF antenna at 12 MHz / (divisor + 1).",
-                  "hw setdivisor -d 88"
+                  "hw setlfdivisor -d 88"
                  );
 
     void *argtable[] = {
@@ -523,7 +523,7 @@ static int CmdSetDivisor(const char *Cmd) {
     CLIParserFree(ctx);
 
     if (arg < 19) {
-        PrintAndLogEx(ERR, "divisor must be between" _YELLOW_("19") " and " _YELLOW_("255"));
+        PrintAndLogEx(ERR, "Divisor must be between" _YELLOW_("19") " and " _YELLOW_("255"));
         return PM3_EINVARG;
     }
     // 12 000 000 (12MHz)

From 12071080a6abf6d84c65f6469ea7744fbcbb390e Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Thu, 7 Jan 2021 01:22:46 +0100
Subject: [PATCH 314/682] next step (half duplex simulation): all commands seem
 to work

---
 armsrc/appmain.c         |   2 +-
 armsrc/em4x50.c          | 247 ++++++++++++++++++++++++++++++---------
 armsrc/em4x50.h          |   2 +-
 client/src/cmdlfem4x50.c |  20 +++-
 4 files changed, 212 insertions(+), 59 deletions(-)

diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index 6fba90e0e..b3f752fb8 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -1136,7 +1136,7 @@ static void PacketReceived(PacketCommandNG *packet) {
             // destroy the Emulator Memory.
             //-----------------------------------------------------------------------------
             FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
-            em4x50_sim();
+            em4x50_sim((uint32_t *)packet->data.asBytes);
             break;
         }
         case CMD_LF_EM4X50_READER: {
diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index e0b93ce0f..9ff516797 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -61,6 +61,8 @@ int gLow = 60;
 // a global parameter is needed to indicate whether a previous login was
 // successful, so operations that require authentication may be performed
 bool gLogin = 0;
+// additionally a global variable to identify the WritePassword process
+bool gWritePasswordProcess = 0;
 
 int gcount = 0;
 int gcycles = 0;
@@ -218,6 +220,9 @@ static void em4x50_setup_sim(void) {
     AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;
     AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK;
     AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
+
+    // Watchdog hit
+    WDT_HIT();
 }
 
 // calculate signal properties (mean amplitudes) from measured data:
@@ -840,7 +845,7 @@ static uint8_t em4x50_sim_read_byte_with_parity_check(void) {
     return (parity == pval) ? byte : 0;
 }
 
-static uint32_t em4x50_sim_read_word(void) {
+static bool em4x50_sim_read_word(uint32_t *word) {
     
     uint8_t parities = 0, parities_calculated = 0, stop_bit = 0;
     uint8_t bytes[4] = {0};
@@ -864,10 +869,11 @@ static uint32_t em4x50_sim_read_word(void) {
     
     // check parities
     if ((parities == parities_calculated) && (stop_bit == 0)) {
-        return BYTES2UINT32(bytes);
+        *word = BYTES2UINT32(bytes);
+        return true;
     }
     
-    return 0;
+    return false;
 }
 
 static void em4x50_sim_send_ack(void) {
@@ -969,10 +975,9 @@ static bool em4x50_sim_send_listen_window(void) {
 
 static void em4x50_sim_handle_login_command(uint32_t *tag) {
 
-    uint32_t password = 0;
-
     // read password
-    password = em4x50_sim_read_word();
+    uint32_t password = 0;
+    bool pwd_ok = em4x50_sim_read_word(&password);
 
     // processing pause time (corresponds to a "1" bit)
     em4x50_sim_send_bit(1);
@@ -980,7 +985,7 @@ static void em4x50_sim_handle_login_command(uint32_t *tag) {
     // empirically determined delay (to be examined seperately)
     wait_cycles(1);
     
-    if (password == tag[0]) {
+    if (pwd_ok && (password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
         em4x50_sim_send_ack();
         gLogin = true;
     } else {
@@ -1010,43 +1015,87 @@ static void em4x50_sim_handle_reset_command(uint32_t *tag) {
 
 static void em4x50_sim_handle_write_command(uint32_t *tag) {
 
-    uint8_t address = 0;
-    uint32_t data = 0;
-
     // read address
+    uint8_t address = 0;
     address = em4x50_sim_read_byte_with_parity_check();
     // read data
-    data = em4x50_sim_read_word();
-    
-    // extract necessary control data
-    bool raw = (tag[EM4X50_CONTROL] >> CONFIG_BLOCK) & READ_AFTER_WRITE;
-    // extract protection data
-    int fwrp = tag[EM4X50_PROTECTION] & 0xFF;         // first word read protected
-    int lwrp = (tag[EM4X50_PROTECTION] >> 8) & 0xFF;  // last word read protected
-    
-    // save data to tag
-    tag[address] = data;
+    uint32_t data = 0;
+    bool word_ok = em4x50_sim_read_word(&data);
     
     // write access time
     wait_cycles(EM4X50_T_TAG_TWA);
 
-    if ((address >= fwrp) && (address <= lwrp)) {
+    if (word_ok == false) {
         em4x50_sim_send_nak();
-    } else if ((address == EM4X50_DEVICE_SERIAL)
-               && (address == EM4X50_DEVICE_ID)
-               && (address == 0)
-               ) {
-        em4x50_sim_send_nak();
-    } else {
-        em4x50_sim_send_ack();
+        em4x50_sim_handle_command(0, tag);
+    }
+    
+    // extract necessary control data
+    bool raw = (tag[EM4X50_CONTROL] >> CONFIG_BLOCK) & READ_AFTER_WRITE;
+    // extract protection data:
+    // first word write protected
+    int fwwp = reflect8((tag[EM4X50_PROTECTION] >> 24) & 0xFF);
+    // last word write protected
+    int lwwp = reflect8((tag[EM4X50_PROTECTION] >> 16) & 0xFF);
+    
+    switch (address) {
+
+        case EM4X50_DEVICE_PASSWORD:
+            em4x50_sim_send_nak();
+            em4x50_sim_handle_command(0, tag);
+            break;
+
+        case EM4X50_PROTECTION:
+            if (gLogin) {
+                tag[address] = reflect32(data);
+                em4x50_sim_send_ack();
+            } else {
+                em4x50_sim_send_nak();
+                em4x50_sim_handle_command(0, tag);
+            }
+            break;
+
+        case EM4X50_CONTROL:
+            if (gLogin) {
+                tag[address] = reflect32(data);
+                em4x50_sim_send_ack();
+            } else {
+                em4x50_sim_send_nak();
+                em4x50_sim_handle_command(0, tag);
+            }
+            break;
+
+        case EM4X50_DEVICE_SERIAL:
+            em4x50_sim_send_nak();
+            em4x50_sim_handle_command(0, tag);
+            break;
+
+        case EM4X50_DEVICE_ID:
+            em4x50_sim_send_nak();
+            em4x50_sim_handle_command(0, tag);
+            break;
+
+        default:
+            if ((address >= fwwp) && (address <= lwwp) && (gLogin == false)) {
+                em4x50_sim_send_nak();
+                em4x50_sim_handle_command(0, tag);
+            } else {
+                tag[address] = reflect32(data);
+                em4x50_sim_send_ack();
+            }
+            break;
     }
     
     // EEPROM write time
     wait_cycles(EM4X50_T_TAG_TWEE);
     
+    // strange: need some sort of 'waveform correction', otherwise ack signal
+    // will not be detected; sending a single "1" seems to solve the problem
+    em4x50_sim_send_bit(1);
+    
     em4x50_sim_send_ack();
 
-    // if "read after write" (raw) bit is set, repeat written data once
+    // if "read after write" (raw) bit is set, send written data once
     if (raw) {
         em4x50_sim_send_listen_window(tag);
         em4x50_sim_send_listen_window(tag);
@@ -1057,25 +1106,90 @@ static void em4x50_sim_handle_write_command(uint32_t *tag) {
     em4x50_sim_handle_command(0, tag);
 }
 
+static void em4x50_sim_handle_writepwd_command(uint32_t *tag) {
+
+    bool pwd_ok = false;
+    
+    if (gWritePasswordProcess == false) {
+        
+        gWritePasswordProcess = true;
+
+        // read password
+        uint32_t act_password = 0;
+        pwd_ok = em4x50_sim_read_word(&act_password);
+
+        // processing pause time (corresponds to a "1" bit)
+        em4x50_sim_send_bit(1);
+        
+        if (pwd_ok && (act_password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
+            em4x50_sim_send_ack();
+            gLogin = true;
+        } else {
+            em4x50_sim_send_nak();
+            gLogin = false;
+            em4x50_sim_handle_command(0, tag);
+        }
+        
+        em4x50_sim_send_listen_window(tag);
+
+    } else {
+
+        gWritePasswordProcess = false;
+
+        // read new password
+        uint32_t new_password = 0;
+        pwd_ok = em4x50_sim_read_word(&new_password);
+
+        // write access time
+        wait_cycles(EM4X50_T_TAG_TWA);
+
+        if (pwd_ok) {
+            em4x50_sim_send_ack();
+            tag[EM4X50_DEVICE_PASSWORD] = reflect32(new_password);
+        } else {
+            em4x50_sim_send_ack();
+            em4x50_sim_handle_command(0, tag);
+        }
+
+        // EEPROM write time
+        wait_cycles(EM4X50_T_TAG_TWEE);
+        
+        // strange: need some sort of 'waveform correction', otherwise ack signal
+        // will not be detected; sending a single "1" seems to solve the problem
+        em4x50_sim_send_bit(1);
+        
+        em4x50_sim_send_ack();
+
+        // continue with standard read mode
+        em4x50_sim_handle_command(0, tag);
+    }
+}
+
 static void em4x50_sim_handle_selective_read_command(uint32_t *tag) {
 
-    uint32_t address = 0;
-
     // read password
-    address = em4x50_sim_read_word();
+    uint32_t address = 0;
+    bool addr_ok = em4x50_sim_read_word(&address);
+
+    // processing pause time (corresponds to a "1" bit)
+    em4x50_sim_send_bit(1);
+
+    if (addr_ok) {
+        em4x50_sim_send_ack();
+    } else {
+        em4x50_sim_send_nak();
+        em4x50_sim_handle_command(0, tag);
+    }
 
     // extract control data
     int fwr = address & 0xFF;           // first word read
     int lwr = (address >> 8) & 0xFF;    // last word read
 
-    // extract protection data
-    int fwrp = tag[EM4X50_PROTECTION] & 0xFF;         // first word read protected
-    int lwrp = (tag[EM4X50_PROTECTION] >> 8) & 0xFF;  // last word read protected
-    
-    // processing pause time (corresponds to a "1" bit)
-    em4x50_sim_send_bit(1);
-
-    em4x50_sim_send_ack();
+    // extract protection data:
+    // first word read protected
+    int fwrp = reflect32(tag[EM4X50_PROTECTION]) & 0xFF;
+    // last word read protected
+    int lwrp = (reflect32(tag[EM4X50_PROTECTION]) >> 8) & 0xFF;
     
     // iceman,  will need a usb cmd check to break as well
     while (BUTTON_PRESS() == false) {
@@ -1090,7 +1204,7 @@ static void em4x50_sim_handle_selective_read_command(uint32_t *tag) {
             if ((gLogin == false) && (i >= fwrp) && (i <= lwrp)) {
                 em4x50_sim_send_word(0x00);
             } else {
-                em4x50_sim_send_word(tag[i]);
+                em4x50_sim_send_word(reflect32(tag[i]));
             }
         }
     }
@@ -1099,11 +1213,13 @@ static void em4x50_sim_handle_selective_read_command(uint32_t *tag) {
 static void em4x50_sim_handle_standard_read_command(uint32_t *tag) {
     
     // extract control data
-    int fwr = tag[CONFIG_BLOCK] & 0xFF;           // first word read
-    int lwr = (tag[CONFIG_BLOCK] >> 8) & 0xFF;    // last word read
-    // extract protection data
-    int fwrp = tag[EM4X50_PROTECTION] & 0xFF;         // first word read protected
-    int lwrp = (tag[EM4X50_PROTECTION] >> 8) & 0xFF;  // last word read protected
+    int fwr = reflect32(tag[EM4X50_CONTROL]) & 0xFF;      // first word read
+    int lwr = (reflect32(tag[EM4X50_CONTROL]) >> 8) & 0xFF; // last word read
+    // extract protection data:
+    // first word read protected
+    int fwrp = reflect32(tag[EM4X50_PROTECTION]) & 0xFF;
+    // last word read protected
+    int lwrp = (reflect32(tag[EM4X50_PROTECTION]) >> 8) & 0xFF;
 
     // iceman,  will need a usb cmd check to break as well
     while (BUTTON_PRESS() == false) {
@@ -1117,7 +1233,7 @@ static void em4x50_sim_handle_standard_read_command(uint32_t *tag) {
             if ((i >= fwrp) && (i <= lwrp)) {
                 em4x50_sim_send_word(0x00);
             } else {
-                em4x50_sim_send_word(tag[i]);
+                em4x50_sim_send_word(reflect32(tag[i]));
             }
         }
     }
@@ -1140,7 +1256,7 @@ static void em4x50_sim_handle_command(uint8_t command, uint32_t *tag) {
             break;
 
         case EM4X50_COMMAND_WRITE_PASSWORD:
-            Dbprintf("Command = write_password");
+            em4x50_sim_handle_writepwd_command(tag);
             break;
 
         case EM4X50_COMMAND_SELECTIVE_READ:
@@ -1164,9 +1280,15 @@ static void check_rm_request(uint32_t *tag) {
         // look for second zero
         if (get_cycles() < cond) {
 
-            // read mode request detected, get command from reader
-            uint8_t command = em4x50_sim_read_byte_with_parity_check();
-            em4x50_sim_handle_command(command, tag);
+            // if command before was EM4X50_COMMAND_WRITE_PASSWORD
+            // switch to separate process
+            if (gWritePasswordProcess) {
+                em4x50_sim_handle_command(EM4X50_COMMAND_WRITE_PASSWORD, tag);
+            } else {
+                // read mode request detected, get command from reader
+                uint8_t command = em4x50_sim_read_byte_with_parity_check();
+                em4x50_sim_handle_command(command, tag);
+            }
         }
     }
 }
@@ -1514,8 +1636,13 @@ static int write(uint32_t word, uint32_t addresses) {
 
                 // now EM4x50 needs T0 * EM4X50_T_TAG_TWEE (EEPROM write time)
                 // for saving data and should return with ACK
-                if (check_ack(false))
+                for (int i = 0; i < 50; i++) {
+                    wait_timer(T0 * EM4X50_T_TAG_FULL_PERIOD);
+                }
+                
+                if (check_ack(false)) {
                     return PM3_SUCCESS;
+                }
             }
         }
     } else {
@@ -1554,9 +1681,12 @@ static int write_password(uint32_t password, uint32_t new_password) {
                 // wait for T0 * EM4X50_T_TAG_TWA (write access time)
                 wait_timer(T0 * EM4X50_T_TAG_TWA);
 
-                if (check_ack(false))
-                    if (check_ack(false))
+                if (check_ack(false)) {
+                    //Dbprintf("zweites ack");
+                    if (check_ack(false)) {
                         return PM3_SUCCESS;
+                    }
+                }
             }
         }
     } else {
@@ -1646,13 +1776,18 @@ void em4x50_writepwd(em4x50_data_t *etd) {
 }
 
 // simulate uploaded data in emulator memory
-void em4x50_sim() {
+void em4x50_sim(uint32_t *password) {
     int status = PM3_SUCCESS;
     uint8_t *em4x50_mem = BigBuf_get_EM_addr();
     uint32_t tag[EM4X50_NO_WORDS] = {0x0};
 
     for (int i = 0; i < EM4X50_NO_WORDS; i++)
-        tag[i] = reflect32(bytes_to_num(em4x50_mem + (i * 4), 4));
+        tag[i] = bytes_to_num(em4x50_mem + (i * 4), 4);
+    
+    // via eload uploaded dump usually does not contain a password
+    if (tag[EM4X50_DEVICE_PASSWORD] == 0) {
+        tag[EM4X50_DEVICE_PASSWORD] = reflect32(*password);
+    }
 
     // only if valid em4x50 data (e.g. uid == serial)
     if (tag[EM4X50_DEVICE_SERIAL] != tag[EM4X50_DEVICE_ID]) {
diff --git a/armsrc/em4x50.h b/armsrc/em4x50.h
index a753b0808..5d4812f42 100644
--- a/armsrc/em4x50.h
+++ b/armsrc/em4x50.h
@@ -19,7 +19,7 @@ void em4x50_writepwd(em4x50_data_t *etd);
 void em4x50_read(em4x50_data_t *etd);
 void em4x50_brute(em4x50_data_t *etd);
 void em4x50_login(uint32_t *password);
-void em4x50_sim(void);
+void em4x50_sim(uint32_t *password);
 void em4x50_reader(void);
 void em4x50_chk(uint8_t *filename);
 void em4x50_test(em4x50_test_t *ett);
diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c
index d4a458438..3aea9e981 100644
--- a/client/src/cmdlfem4x50.c
+++ b/client/src/cmdlfem4x50.c
@@ -1211,25 +1211,43 @@ int CmdEM4x50Restore(const char *Cmd) {
 }
 
 int CmdEM4x50Sim(const char *Cmd) {
+    
+    uint32_t password = 0;
+    
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "lf em 4x50 sim",
                   "Simulates a EM4x50 tag.\n"
                   "Upload using `lf em 4x50 eload`",
                   "lf em 4x50 sim"
+                  "lf em 4x50 sim -p 27182818   -> uses password for eload data"
                  );
 
     void *argtable[] = {
         arg_param_begin,
+        arg_str0("p", "passsword", "<hex>", "password, 4 bytes, lsb"),
         arg_param_end
     };
 
     CLIExecWithReturn(ctx, Cmd, argtable, true);
+    int pwd_len = 0;
+    uint8_t pwd[4] = {0};
+    CLIGetHexWithReturn(ctx, 1, pwd, &pwd_len);
+    CLIParserFree(ctx);
+
+    if (pwd_len) {
+        if (pwd_len != 4) {
+            PrintAndLogEx(FAILED, "password length must be 4 bytes instead of %d", pwd_len);
+            return PM3_EINVARG;
+        } else {
+            password = BYTES2UINT32(pwd);
+        }
+    }
     CLIParserFree(ctx);
 
     PrintAndLogEx(INFO, "Simulating data from emulator memory");
 
     clearCommandBuffer();
-    SendCommandNG(CMD_LF_EM4X50_SIM, NULL, 0);
+    SendCommandNG(CMD_LF_EM4X50_SIM, (uint8_t *)&password, sizeof(password));
     PacketResponseNG resp;
     WaitForResponse(CMD_LF_EM4X50_SIM, &resp);
     if (resp.status == PM3_SUCCESS)

From f05fa8a77eac090bb943308d570a161a1198f6f1 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 7 Jan 2021 10:45:31 +0100
Subject: [PATCH 315/682] usart btpin/factory/tx - now uses cliparser

---
 client/src/cmdusart.c  | 226 ++++++++++++++++-------------------------
 doc/cliparser_todo.txt |   4 -
 2 files changed, 86 insertions(+), 144 deletions(-)

diff --git a/client/src/cmdusart.c b/client/src/cmdusart.c
index 290e543eb..a6bcda67d 100644
--- a/client/src/cmdusart.c
+++ b/client/src/cmdusart.c
@@ -13,64 +13,17 @@
 #include <string.h>
 #include <stdio.h>
 #include <ctype.h>
-
 #include "cmdparser.h"    // command_t
-#include "commonutil.h"  // ARRAYLEN
+#include "cliparser.h"    // 
+#include "commonutil.h"   // ARRAYLEN
 #include "comms.h"
 #include "util_posix.h"
 #include "usart_defs.h"
 #include "ui.h"           // PrintAndLog
 
+
 static int CmdHelp(const char *Cmd);
 
-static int usage_usart_bt_pin(void) {
-    PrintAndLogEx(NORMAL, "Change BT add-on PIN");
-    PrintAndLogEx(NORMAL, "WARNING: this requires");
-    PrintAndLogEx(NORMAL, "      1) BTpower to be turned ON");
-    PrintAndLogEx(NORMAL, "      2) BT add-on to NOT be connected");
-    PrintAndLogEx(NORMAL, "      => the add-on blue LED must blink");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Usage:  usart btpin [h] d NNNN");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "           h          This help");
-    PrintAndLogEx(NORMAL, "           d NNNN     Desired PIN");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Example:");
-    PrintAndLogEx(NORMAL, "      usart btpin d 1234");
-    PrintAndLogEx(NORMAL, "expected output: nothing");
-    return PM3_SUCCESS;
-}
-
-static int usage_usart_bt_factory(void) {
-    PrintAndLogEx(NORMAL, "Reset BT add-on to factory settings");
-    PrintAndLogEx(NORMAL, _RED_("WARNING: process only if strictly needed!"));
-    PrintAndLogEx(NORMAL, "This requires");
-    PrintAndLogEx(NORMAL, "      1) BTpower to be turned ON");
-    PrintAndLogEx(NORMAL, "      2) BT add-on to NOT be connected");
-    PrintAndLogEx(NORMAL, "      => the add-on blue LED must blink");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Usage:  usart btfactory [h]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "           h          This help");
-    return PM3_SUCCESS;
-}
-
-static int usage_usart_tx(void) {
-    PrintAndLogEx(NORMAL, "Send string over USART");
-    PrintAndLogEx(NORMAL, _RED_("WARNING: it will have side-effects if used in USART HOST mode!"));
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Usage:  usart tx [h] d \"string\"");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "           h          This help");
-    PrintAndLogEx(NORMAL, "           d string   string to send");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "      usart tx d \"AT+VERSION\"");
-    PrintAndLogEx(NORMAL, "      usart tx d \"AT+VERSION\\r\\n\"");
-    PrintAndLogEx(NORMAL, "expected output: nothing");
-    return PM3_SUCCESS;
-}
-
 static int usage_usart_txhex(void) {
     PrintAndLogEx(NORMAL, "Send bytes over USART");
     PrintAndLogEx(NORMAL, _RED_("WARNING: it will have side-effects if used in USART HOST mode!"));
@@ -292,28 +245,30 @@ static int usart_bt_testcomm(uint32_t baudrate, uint8_t parity) {
 }
 
 static int CmdUsartBtFactory(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "usart btfactory",
+                  "Reset BT add-on to factory settings\n"
+                  "WARNING: process only if strictly needed!\n"
+                  "This requires\n"
+                  "    1) BTpower to be turned ON\n"
+                  "    2) BT add-on to NOT be connected\n"
+                  "      => the add-on blue LED must blink",
+                  "usart btfactory"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
+
 // take care to define compatible settings:
 # define BTADDON_BAUD_AT  "AT+BAUD8"
 # define BTADDON_BAUD_NUM "115200"
-    uint8_t cmdp = 0;
-    bool errors = false;
+
     uint32_t baudrate = 0;
     uint8_t parity = 0;
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_usart_bt_factory();
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-    //Validations
-    if (errors) {
-        usage_usart_bt_factory();
-        return PM3_EINVARG;
-    }
 
     if (USART_BAUD_RATE != atoi(BTADDON_BAUD_NUM)) {
         PrintAndLogEx(WARNING, _RED_("WARNING:") " current Proxmark3 firmware has default USART baudrate = %i", USART_BAUD_RATE);
@@ -476,42 +431,39 @@ static int CmdUsartBtFactory(const char *Cmd) {
 }
 
 static int CmdUsartBtPin(const char *Cmd) {
-    uint8_t cmdp = 0;
-    bool errors = false;
-    char pin[5] = {0};
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "usart btpin",
+                  "Change BT add-on PIN.\n"
+                  "WARNING: this requires\n"
+                  "    1) BTpower to be turned ON\n"
+                  "    2) BT add-on to NOT be connected\n"
+                  "      => the add-on blue LED must blink",
+                  "usart btpin -p 1234"
+                 );
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_usart_bt_pin();
-            case 'd':
-                if (param_getstr(Cmd, cmdp + 1, pin, sizeof(pin)) != sizeof(pin) - 1) {
-                    PrintAndLogEx(FAILED, "PIN has wrong length, must be 4 digits");
-                    errors = true;
-                    break;
-                }
-                for (size_t i = 0; i < sizeof(pin) - 1; i++) {
-                    if ((pin[i] < '0') || (pin[i] > '9')) {
-                        PrintAndLogEx(FAILED, "PIN has wrong char \"%c\", must be 4 digits", pin[i]);
-                        errors = true;
-                        break;
-                    }
-                }
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1("p", "pin", "<dec>", "Desired PIN number (4 digits)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    int plen = 4;
+    char pin[5] = { 0, 0 ,0, 0, 0 };
+    CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)pin, sizeof(pin), &plen);
+    CLIParserFree(ctx);
+
+    if (plen != 4) {
+        PrintAndLogEx(FAILED, "PIN must be 4 digits");
+        return PM3_EINVARG;        
+    }
+
+    for (uint8_t i = 0; i < plen; i++) {
+        if (isdigit(pin[i]) == false) {
+            PrintAndLogEx(FAILED, "PIN must be 4 digits");
+            return PM3_EINVARG;        
         }
     }
-
-    //Validations
-    if (errors || cmdp == 0) {
-        usage_usart_bt_pin();
-        return PM3_EINVARG;
-    }
-
+   
     char string[6 + sizeof(pin)] = {0};
     sprintf(string, "AT+PIN%s", pin);
     uint8_t data[PM3_CMD_DATA_SIZE] = {0x00};
@@ -537,63 +489,57 @@ static int CmdUsartBtPin(const char *Cmd) {
 }
 
 static int CmdUsartTX(const char *Cmd) {
-    uint8_t cmdp = 0;
-    bool errors = false;
-    char string[PM3_CMD_DATA_SIZE] = {0};
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "usart tx",
+                  "Send string over USART.\n"
+                  "WARNING:  it will have side-effects if used in USART HOST mode!",
+                  "usart tx -d \"AT+VERSION\"\n"
+                  "usart tx -d \"AT+VERSION\\r\\n\""
+                 );
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_usart_tx();
-            case 'd':
-                if (param_getstr(Cmd, cmdp + 1, string, sizeof(string)) >= sizeof(string)) {
-                    PrintAndLogEx(FAILED, "String too long");
-                    errors = true;
-                    break;
-                }
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-    //Validations
-    if (errors || cmdp == 0) {
-        usage_usart_tx();
-        return PM3_EINVARG;
-    }
-    char string2[PM3_CMD_DATA_SIZE] = {0};
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1("d", "data", NULL, "string to send"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    int slen = 0;
+    char s[PM3_CMD_DATA_SIZE] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)s, sizeof(s), &slen);
+    CLIParserFree(ctx);
+
+    char clean[PM3_CMD_DATA_SIZE] = {0};
     size_t i2 = 0;
-    size_t n = strlen(string);
+    size_t n = strlen(s);
+
+    // strip / replace 
     for (size_t i = 0; i < n; i++) {
-        if ((i < n - 1) && (string[i] == '\\') && (string[i + 1] == '\\')) {
+        if ((i < n - 1) && (s[i] == '\\') && (s[i + 1] == '\\')) {
             i++;
-            string2[i2++] = '\\';
+            clean[i2++] = '\\';
             continue;
         }
-        if ((i < n - 1) && (string[i] == '\\') && (string[i + 1] == '"')) {
+        if ((i < n - 1) && (s[i] == '\\') && (s[i + 1] == '"')) {
             i++;
-            string2[i2++] = '"';
+            clean[i2++] = '"';
             continue;
         }
-        if (string[i] == '"') {
+        if (s[i] == '"') {
             continue;
         }
-        if ((i < n - 1) && (string[i] == '\\') && (string[i + 1] == 'r')) {
+        if ((i < n - 1) && (s[i] == '\\') && (s[i + 1] == 'r')) {
             i++;
-            string2[i2++] = '\r';
+            clean[i2++] = '\r';
             continue;
         }
-        if ((i < n - 1) && (string[i] == '\\') && (string[i + 1] == 'n')) {
+        if ((i < n - 1) && (s[i] == '\\') && (s[i + 1] == 'n')) {
             i++;
-            string2[i2++] = '\n';
+            clean[i2++] = '\n';
             continue;
         }
-        string2[i2++] = string[i];
+        clean[i2++] = s[i];
     }
-    return usart_tx((uint8_t *)string2, strlen(string2));
+    return usart_tx((uint8_t *)clean, strlen(clean));
 }
 
 static int CmdUsartRX(const char *Cmd) {
@@ -781,7 +727,7 @@ static command_t CommandTable[] = {
 static int CmdHelp(const char *Cmd) {
     (void)Cmd; // Cmd is not used so far
     CmdsHelp(CommandTable);
-    return 0;
+    return PM3_SUCCESS;
 }
 
 int CmdUsart(const char *Cmd) {
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 4c3dcd8d0..8e37f3c6a 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -103,7 +103,6 @@ hf mf gen3blk
 hf mf gen3freeze
 hf mf ice
 hf mfdes getuid
-hw setlfdivisor
 lf config
 lf cmdread
 lf read
@@ -150,9 +149,6 @@ smart upgrade
 smart setclock
 smart brute
 script run
-usart btpin
-usart btfactory
-usart tx
 usart rx
 usart txrx
 usart txhex

From eba87bdd4b01952cafb0c6dc5a96fd020469c723 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 7 Jan 2021 11:33:36 +0100
Subject: [PATCH 316/682] usart the rest - now uses cliparser

---
 client/src/cmdusart.c  | 376 +++++++++++++++--------------------------
 doc/cliparser_todo.txt |   5 -
 2 files changed, 135 insertions(+), 246 deletions(-)

diff --git a/client/src/cmdusart.c b/client/src/cmdusart.c
index a6bcda67d..2faa2ae8b 100644
--- a/client/src/cmdusart.c
+++ b/client/src/cmdusart.c
@@ -21,89 +21,8 @@
 #include "usart_defs.h"
 #include "ui.h"           // PrintAndLog
 
-
 static int CmdHelp(const char *Cmd);
 
-static int usage_usart_txhex(void) {
-    PrintAndLogEx(NORMAL, "Send bytes over USART");
-    PrintAndLogEx(NORMAL, _RED_("WARNING: it will have side-effects if used in USART HOST mode!"));
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Usage:  usart txhex [h] d <bytes>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "           h          This help");
-    PrintAndLogEx(NORMAL, "           d <bytes>  bytes to send");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "      usart txhex d 504d33620a80000000010100f09f988ef09fa5b36233");
-    PrintAndLogEx(NORMAL, "expected output: nothing");
-    return PM3_SUCCESS;
-}
-
-static int usage_usart_rx(void) {
-    PrintAndLogEx(NORMAL, "Receive string over USART [t <timeout>]");
-    PrintAndLogEx(NORMAL, _RED_("WARNING: it will have side-effects if used in USART HOST mode!"));
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Usage:  usart rx [h]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "           h          This help");
-    PrintAndLogEx(NORMAL, "           t <timeout> timeout in ms, default is 0ms");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "expected output: Received string");
-    return PM3_SUCCESS;
-}
-
-static int usage_usart_rxhex(void) {
-    PrintAndLogEx(NORMAL, "Receive bytes over USART");
-    PrintAndLogEx(NORMAL, _RED_("WARNING: it will have side-effects if used in USART HOST mode!"));
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Usage:  usart rxhex [h] [t <timeout>]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "           h          This help");
-    PrintAndLogEx(NORMAL, "           t <timeout> timeout in ms, default is 0ms");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "expected output: Received bytes");
-    return PM3_SUCCESS;
-}
-
-static int usage_usart_txrx(void) {
-    PrintAndLogEx(NORMAL, "Send string over USART and wait for response");
-    PrintAndLogEx(NORMAL, _YELLOW_("WARNING: if used in USART HOST mode, you can only send AT commands"));
-    PrintAndLogEx(NORMAL, _YELLOW_("to add-on when BT connection is not established (LED needs to be blinking)"));
-    PrintAndLogEx(NORMAL, _RED_("Any other usage in USART HOST mode will have side-effects!"));
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Usage:  usart txrx [h] [t <timeout>] d \"string\"");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "           h           This help");
-    PrintAndLogEx(NORMAL, "           t <timeout> timeout in ms, default is 1000ms");
-    PrintAndLogEx(NORMAL, "           d string    string to send");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "    Talking to the BT add-on (when no connection):");
-    PrintAndLogEx(NORMAL, "      usart txrx d \"AT+VERSION\"");
-    PrintAndLogEx(NORMAL, "    Talking to a target requiring longer time and end-of-line chars:");
-    PrintAndLogEx(NORMAL, "      usart txrx t 2000 d \"AT+SOMESTUFF\\r\\n\"");
-    PrintAndLogEx(NORMAL, "expected output: Received string");
-    return PM3_SUCCESS;
-}
-
-static int usage_usart_config(void) {
-    PrintAndLogEx(NORMAL, "Configure USART");
-    PrintAndLogEx(NORMAL, _RED_("WARNING: it will have side-effects if used in USART HOST mode!"));
-    PrintAndLogEx(NORMAL, "The changes are not permanent, restart Proxmark3 to get default settings back.");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Usage:  usart config [h] [b <baudrate>] [p <N|O|E>]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "           h             This help");
-    PrintAndLogEx(NORMAL, "           b <baudrate>  Baudrate");
-    PrintAndLogEx(NORMAL, "           p <N|O|E>     Parity (None/Odd/Even)");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "      usart config b 9600");
-    PrintAndLogEx(NORMAL, "      usart config b 9600 p N");
-    PrintAndLogEx(NORMAL, "      usart config p E");
-    return PM3_SUCCESS;
-}
-
 static int usart_tx(uint8_t *data, size_t len) {
     clearCommandBuffer();
     SendCommandNG(CMD_USART_TX, data, len);
@@ -174,51 +93,45 @@ static int set_usart_config(uint32_t baudrate, uint8_t parity) {
 }
 
 static int CmdUsartConfig(const char *Cmd) {
-    uint8_t cmdp = 0;
-    bool errors = false;
-    uint32_t baudrate = 0;
-    uint8_t parity = 0;
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_usart_config();
-            case 'p':
-                switch (tolower(param_getchar(Cmd, cmdp + 1))) {
-                    case 'n':
-                        parity = 'N';
-                        break;
-                    case 'o':
-                        parity = 'O';
-                        break;
-                    case 'e':
-                        parity = 'E';
-                        break;
-                    default:
-                        PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp + 1));
-                        errors = true;
-                        break;
-                }
-                cmdp += 2;
-                break;
-            case 'b':
-                baudrate = param_get32ex(Cmd, cmdp + 1, 0, 10);
-                if (baudrate == 0) {
-                    PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp + 1));
-                    errors = true;
-                }
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-    //Validations
-    if (errors || ((baudrate == 0) && (parity == 0))) {
-        usage_usart_config();
+
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "usart config",
+                  "Configure USART.\n"
+                  "WARNING: it will have side-effects if used in USART HOST mode!\n"
+                  "The changes are not permanent, restart Proxmark3 to get default settings back.",
+                  "usart config -b 9600\n"
+                  "usart config -b 9600 --none\n"
+                  "usart config -E"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_u64_0("b", "baud", "<dec>", "baudrate"),
+        arg_lit0("N", "none", "mone parity"),
+        arg_lit0("E", "even", "even parity"),
+        arg_lit0("O", "odd", "odd parity"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+    uint32_t baudrate = arg_get_u32_def(ctx, 1, 0);
+    bool pn = arg_get_lit(ctx, 2);
+    bool pe = arg_get_lit(ctx, 3);
+    bool po = arg_get_lit(ctx, 4);
+    CLIParserFree(ctx);
+
+    if ((pn + pe + po) > 1 ) {
+        PrintAndLogEx(WARNING, "Only one parity can be used at a time");
         return PM3_EINVARG;
     }
+
+    uint8_t parity = 0;
+    if (pn)
+        parity = 'N';
+    else if (po)
+        parity = 'O';
+    else if (pe)
+        parity = 'E';
+
     return set_usart_config(baudrate, parity);
 }
 
@@ -543,162 +456,143 @@ static int CmdUsartTX(const char *Cmd) {
 }
 
 static int CmdUsartRX(const char *Cmd) {
-    uint8_t cmdp = 0;
-    bool errors = false;
-    uint32_t waittime = 0;
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_usart_rx();
-            case 't':
-                waittime = param_get32ex(Cmd, cmdp + 1, 0, 10);
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-    //Validations
-    if (errors) {
-        usage_usart_rx();
-        return PM3_EINVARG;
-    }
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "usart rx",
+                  "Receive string over USART.\n"
+                  "WARNING: it will have side-effects if used in USART HOST mode!\n",
+                  "usart rx -t 2000     ->  2 second timeout"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_u64_0("t", "timeout", "<dec>", "timeout in ms, default is 0ms"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    uint32_t waittime = arg_get_u32_def(ctx, 1, 0);    
+    CLIParserFree(ctx);
+
     uint8_t data[PM3_CMD_DATA_SIZE] = {0x00};
     size_t len = 0;
     int ret = usart_rx(data, &len, waittime);
     if (ret != PM3_SUCCESS)
         return ret;
-    PrintAndLogEx(NORMAL, "RX:%.*s", (int)len, data);
+
+    PrintAndLogEx(SUCCESS, "RX:%.*s", (int)len, data);
     return PM3_SUCCESS;
 }
 
 static int CmdUsartTXRX(const char *Cmd) {
-    uint8_t cmdp = 0;
-    bool errors = false;
-    char string[PM3_CMD_DATA_SIZE] = {0};
-    uint32_t waittime = 1000;
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_usart_txrx();
-            case 'd':
-                if (param_getstr(Cmd, cmdp + 1, string, sizeof(string)) >= sizeof(string)) {
-                    PrintAndLogEx(FAILED, "String too long");
-                    errors = true;
-                    break;
-                }
-                cmdp += 2;
-                break;
-            case 't':
-                waittime = param_get32ex(Cmd, cmdp + 1, 1000, 10);
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-    //Validations
-    if (errors || cmdp == 0) {
-        usage_usart_txrx();
-        return PM3_EINVARG;
-    }
-    char string2[PM3_CMD_DATA_SIZE] = {0};
-    size_t i2 = 0;
-    size_t n = strlen(string);
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "usart txrx",
+                  "Send string over USART and wait for response.\n"
+                  "WARNING: if used in USART HOST mode, you can only send AT commands\n"
+                  "to add-on when BT connection is not established (LED needs to be blinking)\n"
+                  _RED_("Any other usage in USART HOST mode will have side-effects!"),
+
+                  "usart txrx -d \"AT+VERSION\"               -> Talking to BT add-on (when no connection)\n"
+                  "usart txrx -t 2000 -d \"AT+SOMESTUFF\\r\\n\" -> Talking to a target requiring longer time and end-of-line chars"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_u64_0("t", "timeout", "<dec>", "timeout in ms, default is 1000 ms"),
+        arg_str1("d", "data", NULL, "string to send"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    uint32_t waittime = arg_get_u32_def(ctx, 1, 1000);    
+    int slen = 0;
+    char s[PM3_CMD_DATA_SIZE] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 2), (uint8_t *)s, sizeof(s), &slen);
+    CLIParserFree(ctx);
+
+    char clean[PM3_CMD_DATA_SIZE] = {0};
+    size_t j = 0;
+    size_t n = strlen(s);
     for (size_t i = 0; i < n; i++) {
-        if ((i < n - 1) && (string[i] == '\\') && (string[i + 1] == '\\')) {
+        if ((i < n - 1) && (s[i] == '\\') && (s[i + 1] == '\\')) {
             i++;
-            string2[i2++] = '\\';
+            clean[j++] = '\\';
             continue;
         }
-        if ((i < n - 1) && (string[i] == '\\') && (string[i + 1] == '"')) {
+        if ((i < n - 1) && (s[i] == '\\') && (s[i + 1] == '"')) {
             i++;
-            string2[i2++] = '"';
+            clean[j++] = '"';
             continue;
         }
-        if (string[i] == '"') {
+        if (s[i] == '"') {
             continue;
         }
-        if ((i < n - 1) && (string[i] == '\\') && (string[i + 1] == 'r')) {
+        if ((i < n - 1) && (s[i] == '\\') && (s[i + 1] == 'r')) {
             i++;
-            string2[i2++] = '\r';
+            clean[j++] = '\r';
             continue;
         }
-        if ((i < n - 1) && (string[i] == '\\') && (string[i + 1] == 'n')) {
+        if ((i < n - 1) && (s[i] == '\\') && (s[i + 1] == 'n')) {
             i++;
-            string2[i2++] = '\n';
+            clean[j++] = '\n';
             continue;
         }
-        string2[i2++] = string[i];
+        clean[j++] = s[i];
     }
+
     uint8_t data[PM3_CMD_DATA_SIZE] = {0x00};
     size_t len = 0;
-    PrintAndLogEx(NORMAL, "TX (%3zu):%.*s", strlen(string2), (int)strlen(string2), string2);
-    int ret = usart_txrx((uint8_t *)string2, strlen(string2), data, &len, waittime);
+    PrintAndLogEx(SUCCESS, "TX (%3zu):%.*s", strlen(clean), (int)strlen(clean), clean);
+    int ret = usart_txrx((uint8_t *)clean, strlen(clean), data, &len, waittime);
     if (ret != PM3_SUCCESS)
         return ret;
-    PrintAndLogEx(NORMAL, "RX (%3zu):%.*s", len, (int)len, data);
+
+    PrintAndLogEx(SUCCESS, "RX (%3zu):%.*s", len, (int)len, data);
     return PM3_SUCCESS;
 }
 
 static int CmdUsartTXhex(const char *Cmd) {
-    int hexlen, len = 0;
-    uint8_t cmdp = 0;
-    bool errors = false;
+
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "usart txhex",
+                  "Send bytes over USART.\n"
+                  "WARNING:  it will have side-effects if used in USART HOST mode!",
+                  "usart txhex -d 504d33620a80000000010100f09f988ef09fa5b36233"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1("d", "data", "<hex>", "bytes to send"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    int dlen = 0;
     uint8_t data[PM3_CMD_DATA_SIZE] = {0x00};
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_usart_txhex();
-            case 'd':
-                if (param_gethex_ex(Cmd, cmdp + 1, data, &hexlen)) {
-                    PrintAndLogEx(ERR, "Error parsing bytes");
-                    return PM3_EINVARG;
-                }
-                len = hexlen >> 1;
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-    //Validations
-    if (errors || cmdp == 0) {
-        usage_usart_txhex();
+    int res = CLIParamHexToBuf(arg_get_str(ctx, 1), data, sizeof(data), &dlen);
+    CLIParserFree(ctx);
+   
+    if (res) {
+        PrintAndLogEx(FAILED, "Error parsing bytes");
         return PM3_EINVARG;
     }
-    return usart_tx(data, len);
+    return usart_tx(data, dlen);
 }
 
 static int CmdUsartRXhex(const char *Cmd) {
-    uint8_t cmdp = 0;
-    bool errors = false;
-    uint32_t waittime = 0;
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_usart_rxhex();
-            case 't':
-                waittime = param_get32ex(Cmd, cmdp + 1, 0, 10);
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-    //Validations
-    if (errors) {
-        usage_usart_rxhex();
-        return PM3_EINVARG;
-    }
+
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "usart rxhex",
+                  "Receive bytes over USART.\n"
+                  "WARNING: it will have side-effects if used in USART HOST mode!\n",
+                  "usart rxhex -t 2000  -> 2 second timeout"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_u64_0("t", "timeout", "<dec>", "timeout in ms, default is 0ms"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    uint32_t waittime = arg_get_u32_def(ctx, 1, 0);    
+    CLIParserFree(ctx);
 
     uint8_t data[PM3_CMD_DATA_SIZE] = {0x00};
     size_t len = 0;
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 8e37f3c6a..c3c81c2e7 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -149,8 +149,3 @@ smart upgrade
 smart setclock
 smart brute
 script run
-usart rx
-usart txrx
-usart txhex
-usart rxhex
-usart config

From e96cfa94b6853cbda055d36ae0c0ecb6bdc91b68 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 7 Jan 2021 11:40:10 +0100
Subject: [PATCH 317/682] hf mfdes getuid/info/eum - with a default cliparser

---
 client/src/cmdhfmfdes.c | 37 ++++++++++++++++++++++++++++++++++---
 doc/cliparser_todo.txt  |  1 -
 2 files changed, 34 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdhfmfdes.c b/client/src/cmdhfmfdes.c
index f2282dbfd..f5222fb9a 100644
--- a/client/src/cmdhfmfdes.c
+++ b/client/src/cmdhfmfdes.c
@@ -2256,7 +2256,17 @@ static int desfire_authenticate(int cmdAuthMode, int cmdAuthAlgo, uint8_t *aid,
 }
 
 static int CmdHF14ADesGetUID(const char *Cmd) {
-    (void)Cmd;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mfdes getuid",
+                  "Get UID from a MIFARE DESfire tag",
+                  "hf mfdes getuid");
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
 
     uint8_t uid[16] = {0};
     int res = handler_desfire_getuid(uid);
@@ -3438,7 +3448,18 @@ static int CmdHF14ADesFormatPICC(const char *Cmd) {
 }
 
 static int CmdHF14ADesInfo(const char *Cmd) {
-    (void)Cmd; // Cmd is not used so far
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mfdes info",
+                  "Get info from MIFARE DESfire tags",
+                  "hf mfdes info");
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
+
     DropFieldDesfire();
 
     mfdes_info_res_t info;
@@ -3862,8 +3883,18 @@ static int CmdHF14ADesDump(const char *Cmd) {
 }
 
 static int CmdHF14ADesEnumApplications(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mfdes enum",
+                  "Enumerate all AID's on MIFARE DESfire tag",
+                  "hf mfdes enum");
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
 
-    (void)Cmd; // Cmd is not used so far
     DropFieldDesfire();
 
     uint8_t aid[3] = {0};
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index c3c81c2e7..785553240 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -102,7 +102,6 @@ hf mf gen3uid
 hf mf gen3blk
 hf mf gen3freeze
 hf mf ice
-hf mfdes getuid
 lf config
 lf cmdread
 lf read

From 0983ad806fbc740e7cd6676bcbbcee863b1f0239 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 7 Jan 2021 12:31:29 +0100
Subject: [PATCH 318/682] smart commands - most use cliparser,  moved sim fw
 file to RESOURCES

---
 .../simmodule => client/resources}/sim011.bin | Bin
 .../resources}/sim011.sha512.txt              |   0
 client/src/cmdsmartcard.c                     | 230 ++++++++----------
 3 files changed, 97 insertions(+), 133 deletions(-)
 rename {tools/simmodule => client/resources}/sim011.bin (100%)
 rename {tools/simmodule => client/resources}/sim011.sha512.txt (100%)

diff --git a/tools/simmodule/sim011.bin b/client/resources/sim011.bin
similarity index 100%
rename from tools/simmodule/sim011.bin
rename to client/resources/sim011.bin
diff --git a/tools/simmodule/sim011.sha512.txt b/client/resources/sim011.sha512.txt
similarity index 100%
rename from tools/simmodule/sim011.sha512.txt
rename to client/resources/sim011.sha512.txt
diff --git a/client/src/cmdsmartcard.c b/client/src/cmdsmartcard.c
index ddeece950..02d34c47c 100644
--- a/client/src/cmdsmartcard.c
+++ b/client/src/cmdsmartcard.c
@@ -22,6 +22,7 @@
 #include "util.h"
 #include "fileutils.h"
 #include "crc16.h"              // crc
+#include "cliparser.h"          // cliparsing
 
 static int CmdHelp(const char *Cmd);
 
@@ -42,43 +43,7 @@ static int usage_sm_raw(void) {
     PrintAndLogEx(NORMAL, "        smart raw 0 t d 00a4040007a0000000031010                - Visa");
     return PM3_SUCCESS;
 }
-static int usage_sm_reader(void) {
-    PrintAndLogEx(NORMAL, "Usage: smart reader [h|s]");
-    PrintAndLogEx(NORMAL, "       h          :  this help");
-    PrintAndLogEx(NORMAL, "       s          :  silent (no messages)");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "        smart reader");
-    return PM3_SUCCESS;
-}
-static int usage_sm_info(void) {
-    PrintAndLogEx(NORMAL, "Usage: smart info [h|s]");
-    PrintAndLogEx(NORMAL, "       h          :  this help");
-    PrintAndLogEx(NORMAL, "       s          :  silent (no messages)");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "        smart info");
-    return PM3_SUCCESS;
-}
-static int usage_sm_upgrade(void) {
-    PrintAndLogEx(NORMAL, "Upgrade RDV4.0 Sim module firmware");
-    PrintAndLogEx(NORMAL, "Usage:  smart upgrade f <file name>");
-    PrintAndLogEx(NORMAL, "       h               :  this help");
-    PrintAndLogEx(NORMAL, "       f <filename>    :  firmware file name");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "        smart upgrade f ../tools/simmodule/sim011.bin");
-    return PM3_SUCCESS;
-}
-static int usage_sm_setclock(void) {
-    PrintAndLogEx(NORMAL, "Usage: smart setclock [h] c <clockspeed>");
-    PrintAndLogEx(NORMAL, "       h          :  this help");
-    PrintAndLogEx(NORMAL, "       c <>       :  clockspeed (0 = 16MHz, 1=8MHz, 2=4MHz) ");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "        smart setclock c 2");
-    return PM3_SUCCESS;
-}
+
 static int usage_sm_brute(void) {
     PrintAndLogEx(NORMAL, "Tries to bruteforce SFI, using a known list of AID's ");
     PrintAndLogEx(NORMAL, "Usage: smart brute [h]");
@@ -524,36 +489,29 @@ static int CmdSmartRaw(const char *Cmd) {
 
 static int CmdSmartUpgrade(const char *Cmd) {
 
-    PrintAndLogEx(WARNING, "WARNING - Sim module firmware upgrade.");
-    PrintAndLogEx(WARNING, "A dangerous command, do wrong and you could brick the sim module");
+
+    PrintAndLogEx(INFO, "-------------------------------------------------------------------");
+    PrintAndLogEx(WARNING, _RED_("WARNING") " - sim module firmware upgrade");
+    PrintAndLogEx(WARNING, _RED_("A dangerous command, do wrong and you could brick the sim module"));
+    PrintAndLogEx(INFO, "-------------------------------------------------------------------");
     PrintAndLogEx(NORMAL, "");
 
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "smart upgrade",
+                  "Upgrade RDV4.0 sim module firmware",
+                  "smart upgrade -f sim011.bin"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1("f", "file", "<filename>", "firmware file name"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    int fnlen = 0;
     char filename[FILE_PATH_SIZE] = {0};
-    uint8_t cmdp = 0;
-    bool errors = false;
-
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'f':
-                if (param_getstr(Cmd, cmdp + 1, filename, FILE_PATH_SIZE) >= FILE_PATH_SIZE) {
-                    PrintAndLogEx(FAILED, "Filename too long");
-                    errors = true;
-                    break;
-                }
-                cmdp += 2;
-                break;
-            case 'h':
-                return usage_sm_upgrade();
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-
-    //Validations
-    if (errors || cmdp == 0) return usage_sm_upgrade();
-
+    CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, sizeof(filename), &fnlen);
+    CLIParserFree(ctx);
 
     char *bin_extension = filename;
     char *dot_position = NULL;
@@ -623,7 +581,8 @@ static int CmdSmartUpgrade(const char *Cmd) {
     }
     free(hashstring);
 
-    PrintAndLogEx(SUCCESS, "Sim module firmware uploading to PM3");
+    PrintAndLogEx(INFO, _GREEN_("Don\'t turn off your PM3!"));
+    PrintAndLogEx(SUCCESS, "Sim module firmware uploading to PM3...");
 
     PacketResponseNG resp;
 
@@ -669,7 +628,7 @@ static int CmdSmartUpgrade(const char *Cmd) {
         PrintAndLogEx(INPLACE, "%d bytes sent", bytes_sent);
     }
     PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(SUCCESS, "Sim module firmware updating,  don\'t turn off your PM3!");
+    PrintAndLogEx(SUCCESS, "Sim module firmware updating...");
 
     // trigger the firmware upgrade
     clearCommandBuffer();
@@ -700,37 +659,35 @@ static int CmdSmartUpgrade(const char *Cmd) {
 }
 
 static int CmdSmartInfo(const char *Cmd) {
-    uint8_t cmdp = 0;
-    bool errors = false, silent = false;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "smart info",
+                  "Extract more detailed information from smart card.",
+                  "smart info -v"
+                 );
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_sm_info();
-            case 's':
-                silent = true;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-        cmdp++;
-    }
-
-    //Validations
-    if (errors) return usage_sm_info();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0("v", "verbose", "verbose"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool verbose = arg_get_lit(ctx, 1);    
+    CLIParserFree(ctx);
 
     clearCommandBuffer();
     SendCommandNG(CMD_SMART_ATR, NULL, 0);
     PacketResponseNG resp;
     if (!WaitForResponseTimeout(CMD_SMART_ATR, &resp, 2500)) {
-        if (!silent) PrintAndLogEx(WARNING, "smart card select failed");
+        if (verbose) {
+            PrintAndLogEx(WARNING, "smart card select failed");
+        }
         return PM3_ETIMEOUT;
     }
 
     if (resp.status != PM3_SUCCESS) {
-        if (!silent) PrintAndLogEx(WARNING, "smart card select failed");
+        if (verbose) { 
+            PrintAndLogEx(WARNING, "smart card select failed");
+        }
         return PM3_ESOFT;
     }
 
@@ -772,37 +729,36 @@ static int CmdSmartInfo(const char *Cmd) {
 }
 
 static int CmdSmartReader(const char *Cmd) {
-    uint8_t cmdp = 0;
-    bool errors = false, silent = false;
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_sm_reader();
-            case 's':
-                silent = true;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-        cmdp++;
-    }
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "smart reader",
+                  "Act as a smart card reader.",
+                  "smart reader"
+                 );
 
-    //Validations
-    if (errors) return usage_sm_reader();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0("v", "verbose", "verbose"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool verbose = arg_get_lit(ctx, 1);    
+    CLIParserFree(ctx);
 
     clearCommandBuffer();
     SendCommandNG(CMD_SMART_ATR, NULL, 0);
     PacketResponseNG resp;
     if (!WaitForResponseTimeout(CMD_SMART_ATR, &resp, 2500)) {
-        if (!silent) PrintAndLogEx(WARNING, "smart card select failed");
+        if (verbose) {
+            PrintAndLogEx(WARNING, "smart card select failed");
+        }
         return PM3_ETIMEOUT;
     }
 
     if (resp.status != PM3_SUCCESS) {
-        if (!silent) PrintAndLogEx(WARNING, "smart card select failed");
+        if (verbose) {
+             PrintAndLogEx(WARNING, "smart card select failed");
+        }
         return PM3_ESOFT;
     }
     smart_card_atr_t card;
@@ -813,34 +769,42 @@ static int CmdSmartReader(const char *Cmd) {
 }
 
 static int CmdSmartSetClock(const char *Cmd) {
-    uint8_t cmdp = 0;
-    bool errors = false;
-    uint8_t new_clk = 0;
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_sm_setclock();
-            case 'c':
-                new_clk = param_get8ex(Cmd, cmdp + 1, 2, 10);
-                if (new_clk > 2)
-                    errors = true;
 
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "smart setclock",
+                  "Set clock speed for smart card interface.",
+                  "smart setclock --4mhz\n"
+                  "smart setclock --16mhz"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0(NULL, "16mhz", "16 MHz clock speed"),
+        arg_lit0(NULL, "8mhz", "8 MHz clock speed"),
+        arg_lit0(NULL, "4mhz", "4 MHz clock speed"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+    bool c16 = arg_get_lit(ctx, 1);
+    bool c8 = arg_get_lit(ctx, 2);
+    bool c4 = arg_get_lit(ctx, 3);
+    CLIParserFree(ctx);
+
+    if ((c16 + c8 + c4) > 1 ) {
+        PrintAndLogEx(WARNING, "Only one clock speed can be used at a time");
+        return PM3_EINVARG;
     }
 
-    //Validations
-    if (errors || cmdp == 0) return usage_sm_setclock();
-
     struct {
         uint32_t new_clk;
     } PACKED payload;
-    payload.new_clk = new_clk;
+
+    if (c16)
+        payload.new_clk = 0;
+    else if (c8)
+        payload.new_clk = 1;
+    else if (c4)
+        payload.new_clk = 2;
 
     clearCommandBuffer();
     SendCommandNG(CMD_SMART_SETCLOCK, (uint8_t *)&payload, sizeof(payload));
@@ -855,15 +819,15 @@ static int CmdSmartSetClock(const char *Cmd) {
         return PM3_ESOFT;
     }
 
-    switch (new_clk) {
+    switch (payload.new_clk) {
         case 0:
-            PrintAndLogEx(SUCCESS, "Clock changed to 16MHz giving 10800 baudrate");
+            PrintAndLogEx(SUCCESS, "Clock changed to " _GREEN_("16") " MHz giving " _GREEN_("10800") " baudrate");
             break;
         case 1:
-            PrintAndLogEx(SUCCESS, "Clock changed to 8MHz giving 21600 baudrate");
+            PrintAndLogEx(SUCCESS, "Clock changed to " _GREEN_("8") " MHz giving " _GREEN_("21600") " baudrate");
             break;
         case 2:
-            PrintAndLogEx(SUCCESS, "Clock changed to 4MHz giving 86400 baudrate");
+            PrintAndLogEx(SUCCESS, "Clock changed to " _GREEN_("4") " MHz giving " _GREEN_("86400") " baudrate");
             break;
         default:
             break;

From 90cbfbf0fccc07da5c953df3fca6968c4136192d Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 7 Jan 2021 12:50:28 +0100
Subject: [PATCH 319/682] smard cmds - now use cliparser

---
 client/src/cmdsmartcard.c | 178 ++++++++++++--------------------------
 doc/cliparser_todo.txt    |   5 --
 2 files changed, 55 insertions(+), 128 deletions(-)

diff --git a/client/src/cmdsmartcard.c b/client/src/cmdsmartcard.c
index 02d34c47c..7e8e6c910 100644
--- a/client/src/cmdsmartcard.c
+++ b/client/src/cmdsmartcard.c
@@ -26,36 +26,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_sm_raw(void) {
-    PrintAndLogEx(NORMAL, "Usage: smart raw [h|r|c] d <0A 0B 0C ... hex>");
-    PrintAndLogEx(NORMAL, "       h          :  this help");
-    PrintAndLogEx(NORMAL, "       r          :  do not read response");
-    PrintAndLogEx(NORMAL, "       a          :  active smartcard without select (reset sc module)");
-    PrintAndLogEx(NORMAL, "       s          :  active smartcard with select (get ATR)");
-    PrintAndLogEx(NORMAL, "       t          :  executes TLV decoder if it possible");
-    PrintAndLogEx(NORMAL, "       0          :  use protocol T=0");
-    PrintAndLogEx(NORMAL, "       d <bytes>  :  bytes to send");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "        smart raw s 0 d 00a404000e315041592e5359532e4444463031  - `1PAY.SYS.DDF01` PPSE directory with get ATR");
-    PrintAndLogEx(NORMAL, "        smart raw 0 d 00a404000e325041592e5359532e4444463031    - `2PAY.SYS.DDF01` PPSE directory");
-    PrintAndLogEx(NORMAL, "        smart raw 0 t d 00a4040007a0000000041010              - Mastercard");
-    PrintAndLogEx(NORMAL, "        smart raw 0 t d 00a4040007a0000000031010                - Visa");
-    return PM3_SUCCESS;
-}
-
-static int usage_sm_brute(void) {
-    PrintAndLogEx(NORMAL, "Tries to bruteforce SFI, using a known list of AID's ");
-    PrintAndLogEx(NORMAL, "Usage: smart brute [h]");
-    PrintAndLogEx(NORMAL, "       h          :  this help");
-    PrintAndLogEx(NORMAL, "       t          :  executes TLV decoder if it possible");
-//  PrintAndLogEx(NORMAL, "       0          :  use protocol T=0");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "        smart brute t");
-    return PM3_SUCCESS;
-}
-
 static int smart_loadjson(const char *preferredName, json_t **root) {
 
     json_error_t error;
@@ -367,68 +337,43 @@ static int smart_response(uint8_t *data) {
 }
 
 static int CmdSmartRaw(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "smart brute",
+                  "Tries to bruteforce SFI, using a known list of AID's",
+                  "smart raw -s -0 -d 00a404000e315041592e5359532e4444463031  -> `1PAY.SYS.DDF01` PPSE directory with get ATR\n"
+                  "smart raw -0 -d 00a404000e325041592e5359532e4444463031     -> `2PAY.SYS.DDF01` PPSE directory\n"
+                  "smart raw -0 -t -d 00a4040007a0000000041010                -> Mastercard\n"
+                  "smart raw -0 -t -d 00a4040007a0000000031010                -> Visa"
+                 );
 
-    int hexlen = 0;
-    bool active = false;
-    bool active_select = false;
-    bool useT0 = false;
-    uint8_t cmdp = 0;
-    bool errors = false, reply = true, decodeTLV = false, breakloop = false;
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0("r", NULL, "do not read response"),
+        arg_lit0("a", NULL, "active smartcard without select (reset sc module)"),
+        arg_lit0("s", NULL, "active smartcard with select (get ATR)"),
+        arg_lit0("t", "tlv", "executes TLV decoder if it possible"),
+        arg_lit0("0", NULL, "use protocol T=0"),
+        arg_str1("d", "data", "<hex>", "bytes to send"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    bool reply = arg_get_lit(ctx, 1);
+    bool active = arg_get_lit(ctx, 2);
+    bool active_select = arg_get_lit(ctx, 3);
+    bool decode_tlv = arg_get_lit(ctx, 4);
+    bool use_t0 = arg_get_lit(ctx, 5);
+
+    int dlen = 0;
     uint8_t data[PM3_CMD_DATA_SIZE] = {0x00};
+    int res = CLIParamHexToBuf(arg_get_str(ctx, 6), data, sizeof(data), &dlen);
+    CLIParserFree(ctx);
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_sm_raw();
-            case 'r':
-                reply = false;
-                cmdp++;
-                break;
-            case 'a':
-                active = true;
-                cmdp++;
-                break;
-            case 's':
-                active_select = true;
-                cmdp++;
-                break;
-            case 't':
-                decodeTLV = true;
-                cmdp++;
-                break;
-            case '0':
-                useT0 = true;
-                cmdp++;
-                break;
-            case 'd': {
-                switch (param_gethex_to_eol(Cmd, cmdp + 1, data, sizeof(data), &hexlen)) {
-                    case 1:
-                        PrintAndLogEx(WARNING, "Invalid HEX value.");
-                        return PM3_EINVARG;
-                    case 2:
-                        PrintAndLogEx(WARNING, "Too many bytes.  Max %zu bytes", sizeof(data));
-                        return PM3_EINVARG;
-                    case 3:
-                        PrintAndLogEx(WARNING, "Hex must have even number of digits.");
-                        return PM3_EINVARG;
-                }
-                cmdp++;
-                breakloop = true;
-                break;
-            }
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-
-        if (breakloop)
-            break;
+    if (res) {
+        PrintAndLogEx(FAILED, "Error parsing bytes");
+        return PM3_EINVARG;
     }
 
-    //Validations
-    if (errors || cmdp == 0) return usage_sm_raw();
-
     uint8_t flags = SC_LOG;
     if (active || active_select) {
 
@@ -437,15 +382,15 @@ static int CmdSmartRaw(const char *Cmd) {
             flags |= SC_SELECT;
     }
 
-    if (hexlen > 0) {
-        if (useT0)
+    if (dlen > 0) {
+        if (use_t0)
             flags |= SC_RAW_T0;
         else
             flags |= SC_RAW;
     }
 
     clearCommandBuffer();
-    SendCommandOLD(CMD_SMART_RAW, flags, hexlen, 0, data, hexlen);
+    SendCommandOLD(CMD_SMART_RAW, flags, dlen, 0, data, dlen);
 
     // reading response from smart card
     if (reply) {
@@ -464,13 +409,13 @@ static int CmdSmartRaw(const char *Cmd) {
             data[4] = buf[1];
 
             clearCommandBuffer();
-            SendCommandMIX(CMD_SMART_RAW, 0, hexlen, 0, data, hexlen);
+            SendCommandMIX(CMD_SMART_RAW, 0, dlen, 0, data, dlen);
             len = smart_response(buf);
 
             data[4] = 0;
         }
 
-        if (decodeTLV && len > 4)
+        if (decode_tlv && len > 4)
             TLVPrintFromBuffer(buf, len - 2);
         else {
             if (len > 16) {
@@ -488,8 +433,6 @@ static int CmdSmartRaw(const char *Cmd) {
 }
 
 static int CmdSmartUpgrade(const char *Cmd) {
-
-
     PrintAndLogEx(INFO, "-------------------------------------------------------------------");
     PrintAndLogEx(WARNING, _RED_("WARNING") " - sim module firmware upgrade");
     PrintAndLogEx(WARNING, _RED_("A dangerous command, do wrong and you could brick the sim module"));
@@ -964,33 +907,22 @@ static void smart_brute_options(bool decodeTLV) {
 }
 
 static int CmdSmartBruteforceSFI(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "smart brute",
+                  "Tries to bruteforce SFI, using a known list of AID's",
+                  "smart brute -t"
+                 );
 
-    uint8_t cmdp = 0;
-    bool errors = false, decodeTLV = false; //, useT0 = false;
-
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_sm_brute();
-            case 't':
-                decodeTLV = true;
-                cmdp++;
-                break;
-            /*
-                    case '0':
-                        useT0 = true;
-                        cmdp++;
-                        break;
-            */
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-
-    //Validations
-    if (errors) return usage_sm_brute();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0("t", "tlv", "executes TLV decoder if it possible"),
+//        arg_lit0("0", NULL, "use protocol T=0"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool decode_tlv = arg_get_lit(ctx, 1);
+//    bool use_t0 = arg_get_lit(ctx, 2);
+    CLIParserFree(ctx);
 
     const char *SELECT = "00a40400%02zu%s";
 
@@ -1083,11 +1015,11 @@ static int CmdSmartBruteforceSFI(const char *Cmd) {
 
         PrintAndLogEx(SUCCESS, "\nAID %s | %s | %s", aid, vendor, name);
 
-        smart_brute_options(decodeTLV);
+        smart_brute_options(decode_tlv);
 
         smart_brute_prim();
 
-        smart_brute_sfi(decodeTLV);
+        smart_brute_sfi(decode_tlv);
 
         PrintAndLogEx(SUCCESS, "\nSFI brute force done\n");
     }
@@ -1108,7 +1040,7 @@ static command_t CommandTable[] = {
     {"info",     CmdSmartInfo,          IfPm3Smartcard,  "Tag information"},
     {"reader",   CmdSmartReader,        IfPm3Smartcard,  "Act like an IS07816 reader"},
     {"raw",      CmdSmartRaw,           IfPm3Smartcard,  "Send raw hex data to tag"},
-    {"upgrade",  CmdSmartUpgrade,       AlwaysAvailable,  "Upgrade sim module firmware"},
+    {"upgrade",  CmdSmartUpgrade,       AlwaysAvailable, "Upgrade sim module firmware"},
     {"setclock", CmdSmartSetClock,      IfPm3Smartcard,  "Set clock speed"},
     {"brute",    CmdSmartBruteforceSFI, IfPm3Smartcard,  "Bruteforce SFI"},
     {NULL, NULL, NULL, NULL}
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 785553240..a4d21f65e 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -141,10 +141,5 @@ lf t55xx recoverpw
 lf t55xx sniff
 lf t55xx special
 lf t55xx wipe
-smart info
-smart reader
 smart raw
-smart upgrade
-smart setclock
-smart brute
 script run

From 11991976de84b18f735d6596dede09d7956291f2 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 7 Jan 2021 12:51:57 +0100
Subject: [PATCH 320/682] text

---
 client/src/cmdsmartcard.c | 4 ++--
 doc/cliparser_todo.txt    | 1 -
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/client/src/cmdsmartcard.c b/client/src/cmdsmartcard.c
index 7e8e6c910..0b5bc4507 100644
--- a/client/src/cmdsmartcard.c
+++ b/client/src/cmdsmartcard.c
@@ -338,8 +338,8 @@ static int smart_response(uint8_t *data) {
 
 static int CmdSmartRaw(const char *Cmd) {
     CLIParserContext *ctx;
-    CLIParserInit(&ctx, "smart brute",
-                  "Tries to bruteforce SFI, using a known list of AID's",
+    CLIParserInit(&ctx, "smart raw",
+                  "Sends raw bytes to card",
                   "smart raw -s -0 -d 00a404000e315041592e5359532e4444463031  -> `1PAY.SYS.DDF01` PPSE directory with get ATR\n"
                   "smart raw -0 -d 00a404000e325041592e5359532e4444463031     -> `2PAY.SYS.DDF01` PPSE directory\n"
                   "smart raw -0 -t -d 00a4040007a0000000041010                -> Mastercard\n"
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index a4d21f65e..06400e0ca 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -141,5 +141,4 @@ lf t55xx recoverpw
 lf t55xx sniff
 lf t55xx special
 lf t55xx wipe
-smart raw
 script run

From 8847668b981737143edbb04936c92fbed1cbac34 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 7 Jan 2021 12:56:07 +0100
Subject: [PATCH 321/682] update test to match new location

---
 tools/pm3_tests.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/pm3_tests.sh b/tools/pm3_tests.sh
index 86a3b852a..36b2a3494 100755
--- a/tools/pm3_tests.sh
+++ b/tools/pm3_tests.sh
@@ -221,7 +221,7 @@ while true; do
     if $TESTALL || $TESTCOMMON; then
       echo -e "\n${C_BLUE}Testing common:${C_NC}"
       if ! CheckFileExist "hardnested tables exists"       "./client/resources/hardnested_tables/bitflip_0_001_states.bin.bz2"; then break; fi
-      if ! CheckFileExist "simmodule fw file exists"       "./tools/simmodule/sim011.bin"; then break; fi
+      if ! CheckFileExist "simmodule fw file exists"       "./client/resources/sim011.bin"; then break; fi
       echo -e "\n${C_BLUE}Testing tools:${C_NC}"
       if ! CheckExecute "xorcheck test"                    "tools/xorcheck.py 04 00 80 64 ba" "final LRC XOR byte value: 5A"; then break; fi
       if ! CheckExecute "findbits test"                    "tools/findbits.py 73 0110010101110011" "Match at bit 9: 011001010"; then break; fi

From 517fa271cd0e26d944ff8ceff6baf007afa9fc23 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 7 Jan 2021 12:59:04 +0100
Subject: [PATCH 322/682] text

---
 .../Troubleshooting.md                        |  8 ++---
 .../2_Configuration-and-Verification.md       | 36 +++++++++++--------
 2 files changed, 25 insertions(+), 19 deletions(-)

diff --git a/doc/md/Installation_Instructions/Troubleshooting.md b/doc/md/Installation_Instructions/Troubleshooting.md
index f70db78a8..85a45f852 100644
--- a/doc/md/Installation_Instructions/Troubleshooting.md
+++ b/doc/md/Installation_Instructions/Troubleshooting.md
@@ -128,9 +128,9 @@ proxmark3 <YOUR_PORT_HERE> --flash --image /usr/local/share/proxmark3/firmware/f
 <>
 proxmark3 <YOUR_PORT_HERE> --flash --image /usr/share/proxmark3/firmware/fullimage.elf
 
-pm3 --> smart upgrade f /usr/local/share/proxmark3/firmware/sim011.bin
+pm3 --> smart upgrade -f /usr/local/share/proxmark3/firmware/sim011.bin
 <>
-pm3 --> smart upgrade f /usr/share/proxmark3/firmware/sim011.bin
+pm3 --> smart upgrade -f /usr/share/proxmark3/firmware/sim011.bin
 ```
 
 If you didn't install the PRoxmark but you're working from the sources directory and depending how you launch the client, your working directory might be the root of the repository:
@@ -153,9 +153,7 @@ client/proxmark3 <YOUR_PORT_HERE> --flash --image armsrc/obj/fullimage.elf
 <>
 ./proxmark3 <YOUR_PORT_HERE> --flash --image ../armsrc/obj/fullimage.elf
 
-pm3 --> smart upgrade f tools/simmodule/sim011.bin
-<>
-pm3 --> smart upgrade f ../tools/simmodule/sim011.bin
+pm3 --> smart upgrade -f sim011.bin
 ```
 
 etc.
diff --git a/doc/md/Use_of_Proxmark/2_Configuration-and-Verification.md b/doc/md/Use_of_Proxmark/2_Configuration-and-Verification.md
index a5d9b2975..17b22f6c6 100644
--- a/doc/md/Use_of_Proxmark/2_Configuration-and-Verification.md
+++ b/doc/md/Use_of_Proxmark/2_Configuration-and-Verification.md
@@ -54,26 +54,34 @@ Don't not turn off your device during the execution of this command!!
 Even its a quite fast command you should be warned.  You may brick it if you interrupt it.
 
 ```
-[usb] pm3 --> smart upgrade f /usr/local/share/proxmark3/firmware/sim011.bin
+[usb] pm3 --> smart upgrade -f /usr/local/share/proxmark3/firmware/sim011.bin
 # or if from local repo
-[usb] pm3 --> smart upgrade f tools/simmodule/sim011.bin
+[usb] pm3 --> smart upgrade -f sim011.bin
 ```
 
 You get the following output if the execution was successful:
 
 ```
-[!] WARNING - Smartcard socket firmware upgrade.
-[!] A dangerous command, do wrong and you will brick the smart card socket
-[+] Smartcard socket firmware uploading to PM3
-..
-[+] Smartcard socket firmware updating,  don't turn off your PM3!
-#db# FW 0000
-#db# FW 0080
-#db# FW 0100
-#db# FW 0180
-#db# FW 0200
-#db# FW 0280
-[+] Smartcard socket firmware upgraded successful        
+[=] -------------------------------------------------------------------
+[!] ⚠️  WARNING - sim module firmware upgrade
+[!] ⚠️  A dangerous command, do wrong and you could brick the sim module
+[=] -------------------------------------------------------------------
+
+[=] firmware file       sim011.bin
+[=] Checking integrity  sim011.sha512.txt
+[+] loaded 733 bytes from binary file sim011.bin
+[+] loaded 141 bytes from binary file sim011.sha512.txt
+[=] Don't turn off your PM3!
+[+] Sim module firmware uploading to PM3...
+ 🕑 733 bytes sent
+[+] Sim module firmware updating...
+[#] FW 0000
+[#] FW 0080
+[#] FW 0100
+[#] FW 0180
+[#] FW 0200
+[#] FW 0280
+[+] Sim module firmware upgrade successful    
 ```
 
 Run hw status command to verify that the upgrade went well.

From a23812ef594c22aafc546b5de1e0f3e5cbc35e00 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 7 Jan 2021 13:04:52 +0100
Subject: [PATCH 323/682] text

---
 doc/cheatsheet.md | 35 +++++++++++++++++++----------------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/doc/cheatsheet.md b/doc/cheatsheet.md
index 1aa990358..b4b536053 100644
--- a/doc/cheatsheet.md
+++ b/doc/cheatsheet.md
@@ -652,7 +652,7 @@ pm3 --> mem load -f iclass_default_keys --iclass
 
 Upgrade Sim Module firmware
 ```
-pm3 --> smart upgrade f ../tools/simmodule/sim011.bin
+pm3 --> smart upgrade -f sim011.bin
 ```
 
 ## Smart Card
@@ -668,38 +668,41 @@ Act like an IS07816 reader
 pm3 --> smart reader
 ```
 
-Set clock speed
+Set clock speed for smart card interface
 ```
 Options
 ---
-c <speed>       : clockspeed (0 = 16MHz, 1=8MHz, 2=4MHz)
+    --16mhz                    16 MHz clock speed
+    --8mhz                     8 MHz clock speed
+    --4mhz                     4 MHz clock speed
 
-pm3 --> smart setclock c 2
+
+pm3 --> smart setclock --8mhz
 ```
 
 Send raw hex data
 ```
 Options
 ---
-r           : do not read response
-a           : active smartcard without select (reset smart module)
-s           : active smartcard with select (get ATR)
-t           : executes TLV decoder if it possible
-0           : use protocol T=0
-d <bytes>   : bytes to send
+-r                             do not read response
+-a                             active smartcard without select (reset sc module)
+-s                             active smartcard with select (get ATR)
+-t, --tlv                      executes TLV decoder if it possible
+-0                             use protocol T=0
+-d, --data <hex>               bytes to send
 
-pm3 --> smart raw s 0 d 00a404000e315041592e5359532e4444463031 : 1PAY.SYS.DDF01 PPSE directory with get ATR
-pm3 --> smart raw 0 d 00a404000e325041592e5359532e4444463031   : 2PAY.SYS.DDF01 PPSE directory
-pm3 --> smart raw 0 t d 00a4040007a0000000041010               : Mastercard
-pm3 --> smart raw 0 t d 00a4040007a0000000031010               : Visa
+pm3 --> smart raw -s -0 -d 00a404000e315041592e5359532e4444463031
+pm3 --> smart raw -0 -d 00a404000e325041592e5359532e4444463031
+pm3 --> smart raw -0 -t -d 00a4040007a0000000041010
+pm3 --> smart raw -0 -t -d 00a4040007a0000000031010
 ````
 
 Bruteforce SPI
 ```
 Options
 ---
-t          : executes TLV decoder if it possible
+-t, --tlv                      executes TLV decoder if it possible
 
 pm3 --> smart brute
-pm3 --> smart brute t
+pm3 --> smart brute --tlv
 ```

From 5edf623cb4055b32db2027c56c35b6c60da61c58 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 7 Jan 2021 13:49:17 +0100
Subject: [PATCH 324/682] change sim011 folder paths for install

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 3fd900b42..e42c0caa9 100644
--- a/Makefile
+++ b/Makefile
@@ -46,7 +46,7 @@ ifneq (,$(INSTALLTOOLS))
 endif
 ifneq (,$(INSTALLSIMFW))
 	$(Q)$(MKDIR) $(DESTDIR)$(PREFIX)$(PATHSEP)$(INSTALLFWRELPATH)
-	$(Q)$(CP) $(foreach fw,$(INSTALLSIMFW),tools/simmodule/$(fw)) $(DESTDIR)$(PREFIX)$(PATHSEP)$(INSTALLFWRELPATH)
+	$(Q)$(CP) $(foreach fw,$(INSTALLSIMFW),client/resources/$(fw)) $(DESTDIR)$(PREFIX)$(PATHSEP)$(INSTALLFWRELPATH)
 endif
 ifeq ($(platform),Linux)
 	$(Q)$(MKDIR) $(DESTDIR)$(UDEV_PREFIX)

From b6b04bda193a28886cd60e1fe41b3a48f47b3ff4 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 7 Jan 2021 14:05:03 +0100
Subject: [PATCH 325/682] analyse lcr/crc - now uses cliparser

---
 client/src/cmdanalyse.c | 166 +++++++++++++++++++---------------------
 1 file changed, 79 insertions(+), 87 deletions(-)

diff --git a/client/src/cmdanalyse.c b/client/src/cmdanalyse.c
index ecf8e50de..db2563358 100644
--- a/client/src/cmdanalyse.c
+++ b/client/src/cmdanalyse.c
@@ -22,23 +22,12 @@
 #include "tea.h"
 #include "legic_prng.h"
 #include "cmddata.h"      // demodbuffer
+#include "graph.h"
+#include "proxgui.h"
+#include "cliparser.h"
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_analyse_lcr(void) {
-    PrintAndLogEx(NORMAL, "Specifying the bytes of a UID with a known LRC will find the last byte value");
-    PrintAndLogEx(NORMAL, "needed to generate that LRC with a rolling XOR. All bytes should be specified in HEX.");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Usage:  analyse lcr [h] <bytes>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "           h          This help");
-    PrintAndLogEx(NORMAL, "           <bytes>    bytes to calc missing XOR in a LCR");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "      analyse lcr 04008064BA");
-    PrintAndLogEx(NORMAL, "expected output: Target (BA) requires final LRC XOR byte value: 5A");
-    return PM3_SUCCESS;
-}
 static int usage_analyse_checksum(void) {
     PrintAndLogEx(NORMAL, "The bytes will be added with eachother and than limited with the applied mask");
     PrintAndLogEx(NORMAL, "Finally compute ones' complement of the least significant bytes");
@@ -55,18 +44,7 @@ static int usage_analyse_checksum(void) {
     PrintAndLogEx(NORMAL, "expected output: 0x61");
     return PM3_SUCCESS;
 }
-static int usage_analyse_crc(void) {
-    PrintAndLogEx(NORMAL, "A stub method to test different crc implementations inside the PM3 sourcecode. Just because you figured out the poly, doesn't mean you get the desired output");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Usage:  analyse crc [h] <bytes>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "           h          This help");
-    PrintAndLogEx(NORMAL, "           <bytes>    bytes to calc crc");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "      analyse crc 137AF00A0A0D");
-    return PM3_SUCCESS;
-}
+
 static int usage_analyse_nuid(void) {
     PrintAndLogEx(NORMAL, "Generate 4byte NUID from 7byte UID");
     PrintAndLogEx(NORMAL, "");
@@ -263,121 +241,135 @@ static int CmdAnalyseLfsr(const char *Cmd) {
     return 0;
 }
 static int CmdAnalyseLCR(const char *Cmd) {
-    uint8_t data[50];
-    char cmdp = tolower(param_getchar(Cmd, 0));
-    if (strlen(Cmd) == 0 || cmdp == 'h') return usage_analyse_lcr();
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "analyse lcr",
+                  "Specifying the bytes of a UID with a known LRC will find the last byte value\n"
+                  "needed to generate that LRC with a rolling XOR. All bytes should be specified in HEX.",
+                  "analyse lcr -d 04008064BA     ->  Target (BA) requires final LRC XOR byte value: 5A"
+                 );
 
-    int len = 0;
-    switch (param_gethex_to_eol(Cmd, 0, data, sizeof(data), &len)) {
-        case 1:
-            PrintAndLogEx(WARNING, "Invalid HEX value.");
-            return 1;
-        case 2:
-            PrintAndLogEx(WARNING, "Too many bytes.  Max %zu bytes", sizeof(data));
-            return 1;
-        case 3:
-            PrintAndLogEx(WARNING, "Hex must have even number of digits.");
-            return 1;
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1("d", "data", "<hex>", "bytes to calc missing XOR in a LCR"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    int dlen = 0;
+    uint8_t data[100] = {0x00};
+    int res = CLIParamHexToBuf(arg_get_str(ctx, 1), data, sizeof(data), &dlen);
+    CLIParserFree(ctx);
+   
+    if (res) {
+        PrintAndLogEx(FAILED, "Error parsing bytes");
+        return PM3_EINVARG;
     }
-    uint8_t finalXor = calculateLRC(data, len);
-    PrintAndLogEx(NORMAL, "Target [%02X] requires final LRC XOR byte value: 0x%02X", data[len - 1], finalXor);
-    return 0;
+
+    uint8_t finalXor = calculateLRC(data, dlen);
+    PrintAndLogEx(SUCCESS, "Target [%02X] requires final LRC XOR byte value: " _YELLOW_("0x%02X"), data[dlen - 1], finalXor);
+    PrintAndLogEx(NORMAL, "");
+    return PM3_SUCCESS;
 }
+
 static int CmdAnalyseCRC(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "analyse crc",
+                  "A stub method to test different crc implementations inside the PM3 sourcecode.\n"
+                  "Just because you figured out the poly, doesn't mean you get the desired output",
+                  "analyse crc -d 137AF00A0A0D"
+                 );
 
-    char cmdp = tolower(param_getchar(Cmd, 0));
-    if (strlen(Cmd) == 0 || cmdp == 'h') return usage_analyse_crc();
-
-    int len = strlen(Cmd);
-    if (len & 1) return usage_analyse_crc();
-
-    // add 1 for null terminator.
-    uint8_t *data = calloc(len + 1,  sizeof(uint8_t));
-    if (!data) return 1;
-
-    if (param_gethex(Cmd, 0, data, len)) {
-        free(data);
-        return usage_analyse_crc();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1("d", "data", "<hex>", "bytes to calc crc"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    int dlen = 0;
+    uint8_t data[1024] = {0x00};
+    int res = CLIParamHexToBuf(arg_get_str(ctx, 1), data, sizeof(data), &dlen);
+    CLIParserFree(ctx);
+   
+    if (res) {
+        PrintAndLogEx(FAILED, "Error parsing bytes");
+        return PM3_EINVARG;
     }
-    len >>= 1;
 
-    PrintAndLogEx(NORMAL, "\nTests with (%d) | %s", len, sprint_hex(data, len));
+    PrintAndLogEx(INFO, "\nTests with (%d) | %s", dlen, sprint_hex(data, dlen));
 
     // 51  f5  7a  d6
     uint8_t uid[] = {0x51, 0xf5, 0x7a, 0xd6}; //12 34 56
     init_table(CRC_LEGIC);
     uint8_t legic8 = CRC8Legic(uid, sizeof(uid));
-    PrintAndLogEx(NORMAL, "Legic 16 | %X (EF6F expected) [legic8 = %02x]", crc16_legic(data, len, legic8), legic8);
+    PrintAndLogEx(INFO, "Legic 16 | %X (EF6F expected) [legic8 = %02x]", crc16_legic(data, dlen, legic8), legic8);
     init_table(CRC_FELICA);
-    PrintAndLogEx(NORMAL, "FeliCa | %X ", crc16_xmodem(data, len));
+    PrintAndLogEx(INFO, "FeliCa | %X ", crc16_xmodem(data, dlen));
 
-    PrintAndLogEx(NORMAL, "\nTests of reflection. Current methods in source code");
-    PrintAndLogEx(NORMAL, "   reflect(0x3e23L,3) is %04X == 0x3e26", reflect(0x3e23L, 3));
-    PrintAndLogEx(NORMAL, "       reflect8(0x80) is %02X == 0x01", reflect8(0x80));
-    PrintAndLogEx(NORMAL, "    reflect16(0x8000) is %04X == 0x0001", reflect16(0xc6c6));
+    PrintAndLogEx(INFO, "\nTests of reflection. Current methods in source code");
+    PrintAndLogEx(INFO, "   reflect(0x3e23L,3) is %04X == 0x3e26", reflect(0x3e23L, 3));
+    PrintAndLogEx(INFO, "       reflect8(0x80) is %02X == 0x01", reflect8(0x80));
+    PrintAndLogEx(INFO, "    reflect16(0x8000) is %04X == 0x0001", reflect16(0xc6c6));
 
     uint8_t b1, b2;
     // ISO14443 crc B
-    compute_crc(CRC_14443_B, data, len, &b1, &b2);
+    compute_crc(CRC_14443_B, data, dlen, &b1, &b2);
     uint16_t crcBB_1 = b1 << 8 | b2;
-    uint16_t bbb = Crc16ex(CRC_14443_B, data, len);
-    PrintAndLogEx(NORMAL, "ISO14443 crc B  | %04x == %04x \n", crcBB_1, bbb);
+    uint16_t bbb = Crc16ex(CRC_14443_B, data, dlen);
+    PrintAndLogEx(INFO, "ISO14443 crc B  | %04x == %04x \n", crcBB_1, bbb);
 
 
     // Test of CRC16,  '123456789' string.
     //
 
-    PrintAndLogEx(NORMAL, "\n\nStandard test with 31 32 33 34 35 36 37 38 39  '123456789'\n\n");
+    PrintAndLogEx(INFO, "\n\nStandard test with 31 32 33 34 35 36 37 38 39  '123456789'\n\n");
     uint8_t dataStr[] = { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39 };
     legic8 = CRC8Legic(dataStr, sizeof(dataStr));
 
     //these below has been tested OK.
-    PrintAndLogEx(NORMAL, "Confirmed CRC Implementations");
-    PrintAndLogEx(NORMAL, "-------------------------------------\n");
-    PrintAndLogEx(NORMAL, "CRC 8 based\n\n");
-    PrintAndLogEx(NORMAL, "LEGIC: CRC8 : %X (C6 expected)", legic8);
-    PrintAndLogEx(NORMAL, "MAXIM: CRC8 : %X (A1 expected)", CRC8Maxim(dataStr, sizeof(dataStr)));
-    PrintAndLogEx(NORMAL, "-------------------------------------\n");
-    PrintAndLogEx(NORMAL, "CRC16 based\n\n");
+    PrintAndLogEx(INFO, "Confirmed CRC Implementations");
+    PrintAndLogEx(INFO, "-------------------------------------\n");
+    PrintAndLogEx(INFO, "CRC 8 based\n\n");
+    PrintAndLogEx(INFO, "LEGIC: CRC8 : %X (C6 expected)", legic8);
+    PrintAndLogEx(INFO, "MAXIM: CRC8 : %X (A1 expected)", CRC8Maxim(dataStr, sizeof(dataStr)));
+    PrintAndLogEx(INFO, "-------------------------------------\n");
+    PrintAndLogEx(INFO, "CRC16 based\n\n");
 
     // input from commandline
-    PrintAndLogEx(NORMAL, "CCITT  | %X (29B1 expected)", Crc16ex(CRC_CCITT, dataStr, sizeof(dataStr)));
+    PrintAndLogEx(INFO, "CCITT  | %X (29B1 expected)", Crc16ex(CRC_CCITT, dataStr, sizeof(dataStr)));
 
     uint8_t poll[] = {0xb2, 0x4d, 0x12, 0x01, 0x01, 0x2e, 0x3d, 0x17, 0x26, 0x47, 0x80, 0x95, 0x00, 0xf1, 0x00, 0x00, 0x00, 0x01, 0x43, 0x00, 0xb3, 0x7f};
-    PrintAndLogEx(NORMAL, "FeliCa | %04X (B37F expected)", Crc16ex(CRC_FELICA, poll + 2, sizeof(poll) - 4));
-    PrintAndLogEx(NORMAL, "FeliCa | %04X (0000 expected)", Crc16ex(CRC_FELICA, poll + 2, sizeof(poll) - 2));
+    PrintAndLogEx(INFO, "FeliCa | %04X (B37F expected)", Crc16ex(CRC_FELICA, poll + 2, sizeof(poll) - 4));
+    PrintAndLogEx(INFO, "FeliCa | %04X (0000 expected)", Crc16ex(CRC_FELICA, poll + 2, sizeof(poll) - 2));
 
     uint8_t sel_corr[] = { 0x40, 0xe1, 0xe1, 0xff, 0xfe, 0x5f, 0x02, 0x3c, 0x43, 0x01};
-    PrintAndLogEx(NORMAL, "iCLASS | %04x (0143 expected)", Crc16ex(CRC_ICLASS, sel_corr, sizeof(sel_corr) - 2));
-    PrintAndLogEx(NORMAL, "---------------------------------------------------------------\n\n\n");
+    PrintAndLogEx(INFO, "iCLASS | %04x (0143 expected)", Crc16ex(CRC_ICLASS, sel_corr, sizeof(sel_corr) - 2));
+    PrintAndLogEx(INFO, "---------------------------------------------------------------\n\n\n");
 
     // ISO14443 crc A
     compute_crc(CRC_14443_A, dataStr, sizeof(dataStr), &b1, &b2);
     uint16_t crcAA = b1 << 8 | b2;
-    PrintAndLogEx(NORMAL, "ISO14443 crc A  | %04x or %04x (BF05 expected)\n", crcAA, Crc16ex(CRC_14443_A, dataStr, sizeof(dataStr)));
+    PrintAndLogEx(INFO, "ISO14443 crc A  | %04x or %04x (BF05 expected)\n", crcAA, Crc16ex(CRC_14443_A, dataStr, sizeof(dataStr)));
 
     // ISO14443 crc B
     compute_crc(CRC_14443_B, dataStr, sizeof(dataStr), &b1, &b2);
     uint16_t crcBB = b1 << 8 | b2;
-    PrintAndLogEx(NORMAL, "ISO14443 crc B  | %04x or %04x (906E expected)\n", crcBB, Crc16ex(CRC_14443_B, dataStr, sizeof(dataStr)));
+    PrintAndLogEx(INFO, "ISO14443 crc B  | %04x or %04x (906E expected)\n", crcBB, Crc16ex(CRC_14443_B, dataStr, sizeof(dataStr)));
 
     // ISO15693 crc  (x.25)
     compute_crc(CRC_15693, dataStr, sizeof(dataStr), &b1, &b2);
     uint16_t crcCC = b1 << 8 | b2;
-    PrintAndLogEx(NORMAL, "ISO15693 crc X25| %04x or %04x (906E expected)\n", crcCC, Crc16ex(CRC_15693, dataStr, sizeof(dataStr)));
+    PrintAndLogEx(INFO, "ISO15693 crc X25| %04x or %04x (906E expected)\n", crcCC, Crc16ex(CRC_15693, dataStr, sizeof(dataStr)));
 
     // ICLASS
     compute_crc(CRC_ICLASS, dataStr, sizeof(dataStr), &b1, &b2);
     uint16_t crcDD = b1 << 8 | b2;
-    PrintAndLogEx(NORMAL, "ICLASS crc      | %04x or %04x\n", crcDD, Crc16ex(CRC_ICLASS, dataStr, sizeof(dataStr)));
+    PrintAndLogEx(INFO, "ICLASS crc      | %04x or %04x\n", crcDD, Crc16ex(CRC_ICLASS, dataStr, sizeof(dataStr)));
 
     // FeliCa
     compute_crc(CRC_FELICA, dataStr, sizeof(dataStr), &b1, &b2);
     uint16_t crcEE = b1 << 8 | b2;
-    PrintAndLogEx(NORMAL, "FeliCa          | %04x or %04x (31C3 expected)\n", crcEE, Crc16ex(CRC_FELICA, dataStr, sizeof(dataStr)));
+    PrintAndLogEx(INFO, "FeliCa          | %04x or %04x (31C3 expected)\n", crcEE, Crc16ex(CRC_FELICA, dataStr, sizeof(dataStr)));
 
-    free(data);
-    return 0;
+    return PM3_SUCCESS;
 }
 static int CmdAnalyseCHKSUM(const char *Cmd) {
 

From 72070168995f3118af1bc81473b86b8ac12cffc6 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 7 Jan 2021 14:05:20 +0100
Subject: [PATCH 326/682] text

---
 doc/cliparser_todo.txt | 2 --
 1 file changed, 2 deletions(-)

diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 06400e0ca..ccaa7ada3 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -1,7 +1,5 @@
 clear
 pref
-analyse lcr
-analyse crc
 analyse chksum
 analyse dates
 analyse tea

From 56efcc9d7f948d06f3ac21184b13556f75e1f6af Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Thu, 7 Jan 2021 23:49:59 +0100
Subject: [PATCH 327/682] half duplex sim status: stop mechanism still missing

---
 armsrc/em4x50.c | 64 ++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 48 insertions(+), 16 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index 9ff516797..262b4c6a6 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -60,9 +60,9 @@ int gLow = 60;
 
 // a global parameter is needed to indicate whether a previous login was
 // successful, so operations that require authentication may be performed
-bool gLogin = 0;
+bool gLogin = false;
 // additionally a global variable to identify the WritePassword process
-bool gWritePasswordProcess = 0;
+bool gWritePasswordProcess = false;
 
 int gcount = 0;
 int gcycles = 0;
@@ -777,12 +777,35 @@ static bool em4x50_sim_send_word(uint32_t word) {
 
 static int wait_cycles(int maxperiods) {
 
-    int period = 0;
+    int period = 0, check = 0;
 
     while (period < maxperiods) {
         
-        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
-        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK);
+        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
+            WDT_HIT();
+            
+            if (check == 1000) {
+                if (BUTTON_PRESS()) {
+                    malsehn(PM3_SUCCESS);
+                }
+                check = 0;
+            }
+            ++check;
+        }
+
+        check = 0;
+        
+        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
+            WDT_HIT();
+            
+            if (check == 1000) {
+                if (BUTTON_PRESS()) {
+                    malsehn(PM3_SUCCESS);
+                }
+                check = 0;
+            }
+            ++check;
+        }
         
         period++;
     }
@@ -830,19 +853,19 @@ static uint8_t em4x50_sim_read_byte(void) {
     return byte;
 }
 
-static uint8_t em4x50_sim_read_byte_with_parity_check(void) {
+static bool em4x50_sim_read_byte_with_parity_check(uint8_t *byte) {
     
-    uint8_t byte = 0, parity = 0, pval = 0;
+    uint8_t parity = 0, pval = 0;
     
     for (int i = 0; i < 8; i++) {
-        byte <<= 1;
-        byte |= em4x50_sim_read_bit();
-        parity ^= (byte & 1);
+        *byte <<= 1;
+        *byte |= em4x50_sim_read_bit();
+        parity ^= ((*byte) & 1);
     }
         
     pval = em4x50_sim_read_bit();
 
-    return (parity == pval) ? byte : 0;
+    return (parity == pval);
 }
 
 static bool em4x50_sim_read_word(uint32_t *word) {
@@ -852,7 +875,7 @@ static bool em4x50_sim_read_word(uint32_t *word) {
 
     // read plain data
     for (int i = 0; i < 4; i++) {
-        bytes[i] = em4x50_sim_read_byte_with_parity_check();
+         em4x50_sim_read_byte_with_parity_check(&bytes[i]);
     }
         
     // read column parities and stop bit
@@ -1017,7 +1040,7 @@ static void em4x50_sim_handle_write_command(uint32_t *tag) {
 
     // read address
     uint8_t address = 0;
-    address = em4x50_sim_read_byte_with_parity_check();
+    bool addr_ok = em4x50_sim_read_byte_with_parity_check(&address);
     // read data
     uint32_t data = 0;
     bool word_ok = em4x50_sim_read_word(&data);
@@ -1025,7 +1048,7 @@ static void em4x50_sim_handle_write_command(uint32_t *tag) {
     // write access time
     wait_cycles(EM4X50_T_TAG_TWA);
 
-    if (word_ok == false) {
+    if ((addr_ok == false) || (word_ok == false)) {
         em4x50_sim_send_nak();
         em4x50_sim_handle_command(0, tag);
     }
@@ -1286,7 +1309,8 @@ static void check_rm_request(uint32_t *tag) {
                 em4x50_sim_handle_command(EM4X50_COMMAND_WRITE_PASSWORD, tag);
             } else {
                 // read mode request detected, get command from reader
-                uint8_t command = em4x50_sim_read_byte_with_parity_check();
+                uint8_t command = 0;
+                em4x50_sim_read_byte_with_parity_check(&command);
                 em4x50_sim_handle_command(command, tag);
             }
         }
@@ -1682,7 +1706,13 @@ static int write_password(uint32_t password, uint32_t new_password) {
                 wait_timer(T0 * EM4X50_T_TAG_TWA);
 
                 if (check_ack(false)) {
-                    //Dbprintf("zweites ack");
+
+                    // now EM4x50 needs T0 * EM4X50_T_TAG_TWEE (EEPROM write time)
+                    // for saving data and should return with ACK
+                    for (int i = 0; i < 50; i++) {
+                        wait_timer(T0 * EM4X50_T_TAG_FULL_PERIOD);
+                    }
+
                     if (check_ack(false)) {
                         return PM3_SUCCESS;
                     }
@@ -1777,7 +1807,9 @@ void em4x50_writepwd(em4x50_data_t *etd) {
 
 // simulate uploaded data in emulator memory
 void em4x50_sim(uint32_t *password) {
+    
     int status = PM3_SUCCESS;
+    
     uint8_t *em4x50_mem = BigBuf_get_EM_addr();
     uint32_t tag[EM4X50_NO_WORDS] = {0x0};
 

From fab65d1dcd821c17c817658d81d8f373193c6403 Mon Sep 17 00:00:00 2001
From: Samy Kamkar <git@samy.pl>
Date: Fri, 8 Jan 2021 16:23:39 -0800
Subject: [PATCH 328/682] Add EV3 to `hf 14a info`

---
 client/src/cmdhf14a.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index 373e81d49..e772d406e 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -1515,6 +1515,7 @@ static int detect_nxp_card(uint8_t sak, uint16_t atqa, uint64_t select_status) {
                         printTag("MIFARE DESFire CL2");
                         printTag("MIFARE DESFire EV1 256B/2K/4K/8K CL2");
                         printTag("MIFARE DESFire EV2 2K/4K/8K/16K/32K");
+                        printTag("MIFARE DESFire EV3 2K/4K/8K");
                         printTag("MIFARE DESFire Light 640B");
                     } else {
                         printTag("MIFARE Plus EV1 2K/4K CL2 in SL3");

From ae45dbd877c02056bde01dc52bf7077cc04d449c Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 9 Jan 2021 11:27:05 +0100
Subject: [PATCH 329/682] analyze chksum - now uses cliparser

---
 client/src/cmdanalyse.c | 153 +++++++++++++++++++++-------------------
 1 file changed, 80 insertions(+), 73 deletions(-)

diff --git a/client/src/cmdanalyse.c b/client/src/cmdanalyse.c
index db2563358..bfd02cb4f 100644
--- a/client/src/cmdanalyse.c
+++ b/client/src/cmdanalyse.c
@@ -28,23 +28,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_analyse_checksum(void) {
-    PrintAndLogEx(NORMAL, "The bytes will be added with eachother and than limited with the applied mask");
-    PrintAndLogEx(NORMAL, "Finally compute ones' complement of the least significant bytes");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Usage:  analyse chksum [h] [v] b <bytes> m <mask>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "           h          This help");
-    PrintAndLogEx(NORMAL, "           v          suppress header");
-    PrintAndLogEx(NORMAL, "           b <bytes>  bytes to calc missing XOR in a LCR");
-    PrintAndLogEx(NORMAL, "           m <mask>   bit mask to limit the outpuyt");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "      analyse chksum b 137AF00A0A0D m FF");
-    PrintAndLogEx(NORMAL, "expected output: 0x61");
-    return PM3_SUCCESS;
-}
-
 static int usage_analyse_nuid(void) {
     PrintAndLogEx(NORMAL, "Generate 4byte NUID from 7byte UID");
     PrintAndLogEx(NORMAL, "");
@@ -371,70 +354,94 @@ static int CmdAnalyseCRC(const char *Cmd) {
 
     return PM3_SUCCESS;
 }
+
 static int CmdAnalyseCHKSUM(const char *Cmd) {
 
-    uint8_t data[50];
-    uint8_t cmdp = 0;
-    uint32_t mask = 0xFFFF;
-    bool errors = false;
-    bool useHeader = false;
-    int len = 0;
-    memset(data, 0x0, sizeof(data));
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "analyse chksum",
+                  "The bytes will be added with eachother and than limited with the applied mask\n"
+                  "Finally compute ones' complement of the least significant bytes.",
+                  "analyse chksum -d 137AF00A0A0D     ->  expected output: 0x61\n"
+                  "analyse chksum -d 137AF00A0A0D -m FF"
+                 );
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (param_getchar(Cmd, cmdp)) {
-            case 'b':
-            case 'B':
-                param_gethex_ex(Cmd, cmdp + 1, data, &len);
-                if (len % 2) errors = true;
-                len >>= 1;
-                cmdp += 2;
-                break;
-            case 'm':
-            case 'M':
-                mask = param_get32ex(Cmd, cmdp + 1, 0, 16);
-                cmdp += 2;
-                break;
-            case 'v':
-            case 'V':
-                useHeader = true;
-                cmdp++;
-                break;
-            case 'h':
-            case 'H':
-                return usage_analyse_checksum();
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1("d", "data", "<hex>", "bytes to calc checksum"),
+        arg_str0("m", "mask", "<hex>", "bit mask to limit the output (4 hex bytes max)"),
+        arg_lit0("v", "verbose", "verbose"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    int dlen = 0;
+    uint8_t data[100] = {0x00};
+    memset(data, 0x0, sizeof(data));
+    int res = CLIParamHexToBuf(arg_get_str(ctx, 1), data, sizeof(data), &dlen);
+    if (res) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(FAILED, "Error parsing bytes");
+        return PM3_EINVARG;
+    }
+    const char *s = arg_get_str(ctx, 2)->sval[0];
+    bool verbose = arg_get_lit(ctx, 3);
+    CLIParserFree(ctx);
+   
+    uint32_t mlen = 0;
+    if (s) 
+        mlen = strlen(s);
+
+    if (mlen > 8) {
+        PrintAndLogEx(FAILED, "Mask value is max 4 hex bytes");
+        return PM3_EINVARG;        
+    }
+
+    uint32_t mask = 0;
+    if (mlen == 0) {
+        mask = 0xFFFF;
+    } else {
+        for (int i = 0; i < mlen; i++) {
+            char c = s[i];
+            // capitalize
+            if (c >= 'a' && c <= 'f')
+                c -= 32;
+            // convert to numeric value
+            if (c >= '0' && c <= '9')
+                c -= '0';
+            else if (c >= 'A' && c <= 'F')
+                c -= 'A' - 10;
+            else
+                continue;
+
+            mask <<= 4;
+            mask |= c;
         }
     }
-    //Validations
-    if (errors || cmdp == 0) return usage_analyse_checksum();
 
-    if (useHeader) {
-        PrintAndLogEx(NORMAL, "     add          | sub         | add 1's compl    | sub 1's compl   | xor");
-        PrintAndLogEx(NORMAL, "byte nibble crumb | byte nibble | byte nibble cumb | byte nibble     | byte nibble cumb |  BSD       |");
-        PrintAndLogEx(NORMAL, "------------------+-------------+------------------+-----------------+--------------------");
+    PrintAndLogEx(INFO, "Mask value 0x%x", mask);
+
+    if (verbose) {
+        PrintAndLogEx(INFO, "     add          | sub         | add 1's compl    | sub 1's compl   | xor");
+        PrintAndLogEx(INFO, "byte nibble crumb | byte nibble | byte nibble cumb | byte nibble     | byte nibble cumb |  BSD       |");
+        PrintAndLogEx(INFO, "------------------+-------------+------------------+-----------------+--------------------");
     }
-    PrintAndLogEx(NORMAL, "0x%X 0x%X   0x%X  | 0x%X 0x%X   | 0x%X 0x%X   0x%X | 0x%X 0x%X       | 0x%X 0x%X   0x%X  | 0x%X  0x%X |\n",
-                  calcSumByteAdd(data, len, mask)
-                  , calcSumNibbleAdd(data, len, mask)
-                  , calcSumCrumbAdd(data, len, mask)
-                  , calcSumByteSub(data, len, mask)
-                  , calcSumNibbleSub(data, len, mask)
-                  , calcSumByteAddOnes(data, len, mask)
-                  , calcSumNibbleAddOnes(data, len, mask)
-                  , calcSumCrumbAddOnes(data, len, mask)
-                  , calcSumByteSubOnes(data, len, mask)
-                  , calcSumNibbleSubOnes(data, len, mask)
-                  , calcSumByteXor(data, len, mask)
-                  , calcSumNibbleXor(data, len, mask)
-                  , calcSumCrumbXor(data, len, mask)
-                  , calcBSDchecksum8(data, len, mask)
-                  , calcBSDchecksum4(data, len, mask)
+    PrintAndLogEx(INFO, "0x%X 0x%X   0x%X  | 0x%X 0x%X   | 0x%X 0x%X   0x%X | 0x%X 0x%X       | 0x%X 0x%X   0x%X  | 0x%X  0x%X |\n",
+                  calcSumByteAdd(data, dlen, mask)
+                  , calcSumNibbleAdd(data, dlen, mask)
+                  , calcSumCrumbAdd(data, dlen, mask)
+                  , calcSumByteSub(data, dlen, mask)
+                  , calcSumNibbleSub(data, dlen, mask)
+                  , calcSumByteAddOnes(data, dlen, mask)
+                  , calcSumNibbleAddOnes(data, dlen, mask)
+                  , calcSumCrumbAddOnes(data, dlen, mask)
+                  , calcSumByteSubOnes(data, dlen, mask)
+                  , calcSumNibbleSubOnes(data, dlen, mask)
+                  , calcSumByteXor(data, dlen, mask)
+                  , calcSumNibbleXor(data, dlen, mask)
+                  , calcSumCrumbXor(data, dlen, mask)
+                  , calcBSDchecksum8(data, dlen, mask)
+                  , calcBSDchecksum4(data, dlen, mask)
                  );
-    return 0;
+    return PM3_SUCCESS;
 }
 
 static int CmdAnalyseDates(const char *Cmd) {

From 3f4a98901d578e5e9621419b72304ffc197fdefd Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 9 Jan 2021 11:43:49 +0100
Subject: [PATCH 330/682] analyze nuid  - now uses cliparser, and refactored to
 generators

---
 client/src/cmdanalyse.c | 92 ++++++++++++++++++++++-------------------
 common/generator.c      | 17 ++++++++
 common/generator.h      |  2 +
 3 files changed, 69 insertions(+), 42 deletions(-)

diff --git a/client/src/cmdanalyse.c b/client/src/cmdanalyse.c
index bfd02cb4f..d26e7adfa 100644
--- a/client/src/cmdanalyse.c
+++ b/client/src/cmdanalyse.c
@@ -25,21 +25,10 @@
 #include "graph.h"
 #include "proxgui.h"
 #include "cliparser.h"
+#include "generator.h"    // generate nuid
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_analyse_nuid(void) {
-    PrintAndLogEx(NORMAL, "Generate 4byte NUID from 7byte UID");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Usage:  analyse hid [h] <bytes>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "           h          This help");
-    PrintAndLogEx(NORMAL, "           <bytes>  input bytes (14 hexsymbols)");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "      analyse nuid 11223344556677");
-    return PM3_SUCCESS;
-}
 static int usage_analyse_a(void) {
     PrintAndLogEx(NORMAL, "Iceman's personal garbage test command");
     PrintAndLogEx(NORMAL, "");
@@ -839,56 +828,75 @@ static int CmdAnalyseA(const char *Cmd) {
 //    return 0;
 }
 
-static void generate4bNUID(uint8_t *uid, uint8_t *nuid) {
-    uint16_t crc;
-    uint8_t b1, b2;
-
-    compute_crc(CRC_14443_A, uid, 3, &b1, &b2);
-    nuid[0] = (b2 & 0xE0) | 0xF;
-    nuid[1] = b1;
-    crc = b1;
-    crc |= b2 << 8;
-    crc = crc16_fast(&uid[3], 4, reflect16(crc), true, true);
-    nuid[2] = (crc >> 8) & 0xFF ;
-    nuid[3] = crc & 0xFF;
-}
-
 static int CmdAnalyseNuid(const char *Cmd) {
-    uint8_t nuid[4] = {0};
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "analyse nuid",
+                  "Generate 4byte NUID from 7byte UID",
+                  "analyse nuid -d 11223344556677"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("d", "data", "<hex>", "bytes to send"),
+        arg_lit0("t", "test", "self test"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    int uidlen = 0;
     uint8_t uid[7] = {0};
-    int len = 0;
-    char cmdp = tolower(param_getchar(Cmd, 0));
-    if (strlen(Cmd) == 0 || cmdp == 'h') return usage_analyse_nuid();
+    int res = CLIParamHexToBuf(arg_get_str(ctx, 1), uid, sizeof(uid), &uidlen);
+    bool selftest = arg_get_lit(ctx, 2);
+    CLIParserFree(ctx);
+   
+    if (res) {
+        PrintAndLogEx(FAILED, "Error parsing bytes");
+        return PM3_EINVARG;
+    }
+
+    uint8_t nuid[4] = {0};
 
     /* src: https://www.nxp.com/docs/en/application-note/AN10927.pdf */
     /* selftest1  UID 040D681AB52281  -> NUID 8F430FEF */
     /* selftest2  UID 04183F09321B85  -> NUID 4F505D7D */
-    if (cmdp == 't') {
+    if (selftest) {
         uint8_t uid_test1[] = {0x04, 0x0d, 0x68, 0x1a, 0xb5, 0x22, 0x81};
         uint8_t nuid_test1[] = {0x8f, 0x43, 0x0f, 0xef};
         uint8_t uid_test2[] = {0x04, 0x18, 0x3f, 0x09, 0x32, 0x1b, 0x85};
         uint8_t nuid_test2[] = {0x4f, 0x50, 0x5d, 0x7d};
         memcpy(uid, uid_test1, sizeof(uid));
-        generate4bNUID(uid, nuid);
+        mfc_generate4b_nuid(uid, nuid);
 
+        PrintAndLogEx(INFO, "Self tests");
         bool test1 = (0 == memcmp(nuid, nuid_test1, sizeof(nuid)));
-        PrintAndLogEx(SUCCESS, "Selftest1 %s\n",  test1 ? _GREEN_("OK") : _RED_("Fail"));
+        PrintAndLogEx((test1) ? SUCCESS : FAILED, "1. %s -> %s ( %s )"
+            , sprint_hex_inrow(uid_test1, sizeof(uid_test1))
+            , sprint_hex(nuid, sizeof(nuid))
+            ,  test1 ? _GREEN_("ok") : _RED_("fail")
+            );
 
         memcpy(uid, uid_test2, sizeof(uid));
-        generate4bNUID(uid, nuid);
+        mfc_generate4b_nuid(uid, nuid);
         bool test2 = (0 == memcmp(nuid, nuid_test2, sizeof(nuid)));
-        PrintAndLogEx(SUCCESS, "Selftest2 %s\n", test2 ? _GREEN_("OK") : _RED_("Fail"));
-        return 0;
+        PrintAndLogEx((test2) ? SUCCESS : FAILED, "2. %s -> %s ( %s )\n"
+            , sprint_hex_inrow(uid_test2, sizeof(uid_test2))
+            , sprint_hex(nuid, sizeof(nuid))
+            , test2 ? _GREEN_("ok") : _RED_("fail")
+            );
+
+        return PM3_SUCCESS;
     }
 
-    param_gethex_ex(Cmd, 0, uid, &len);
-    if (len % 2  || len != 14) return usage_analyse_nuid();
+    if (uidlen != 7) {
+        PrintAndLogEx(FAILED, "Error parsing bytes");
+        return PM3_EINVARG;
+    }
 
-    generate4bNUID(uid, nuid);
+    mfc_generate4b_nuid(uid, nuid);
 
-    PrintAndLogEx(NORMAL, "UID  | %s \n", sprint_hex(uid, 7));
-    PrintAndLogEx(NORMAL, "NUID | %s \n", sprint_hex(nuid, 4));
-    return 0;
+    PrintAndLogEx(INFO, "UID  | %s \n", sprint_hex(uid, 7));
+    PrintAndLogEx(INFO, "NUID | %s \n", sprint_hex(nuid, 4));
+    return PM3_SUCCESS;
 }
 
 static int CmdAnalyseDemodBuffer(const char *Cmd) {
diff --git a/common/generator.c b/common/generator.c
index f40070346..90a3d92f6 100644
--- a/common/generator.c
+++ b/common/generator.c
@@ -21,6 +21,7 @@
 #include "pm3_cmd.h"
 #include "ui.h"
 #include "mbedtls/sha1.h"
+#include "crc16.h"        // crc16 ccitt
 
 // Implemetation tips:
 // For each implementation of the algos, I recommend adding a self test for easy "simple unit" tests when Travic CI / Appveyour runs.
@@ -464,6 +465,22 @@ int mfdes_kdf_input_gallagher(uint8_t *uid, uint8_t uidLen, uint8_t keyNo, uint3
     return PM3_SUCCESS;
 }
 
+
+int mfc_generate4b_nuid(uint8_t *uid, uint8_t *nuid) {
+    uint16_t crc;
+    uint8_t b1, b2;
+
+    compute_crc(CRC_14443_A, uid, 3, &b1, &b2);
+    nuid[0] = (b2 & 0xE0) | 0xF;
+    nuid[1] = b1;
+    crc = b1;
+    crc |= b2 << 8;
+    crc = crc16_fast(&uid[3], 4, reflect16(crc), true, true);
+    nuid[2] = (crc >> 8) & 0xFF ;
+    nuid[3] = crc & 0xFF;
+    return PM3_SUCCESS;
+}
+
 //------------------------------------
 // Self tests
 //------------------------------------
diff --git a/common/generator.h b/common/generator.h
index 40dd51e78..601d36fda 100644
--- a/common/generator.h
+++ b/common/generator.h
@@ -41,6 +41,8 @@ int mfc_algo_di_all(uint8_t *uid, uint8_t *keys);
 int mfc_algo_sky_one(uint8_t *uid, uint8_t sector, uint8_t keytype, uint64_t *key);
 int mfc_algo_sky_all(uint8_t *uid, uint8_t *keys);
 
+int mfc_generate4b_nuid(uint8_t *uid, uint8_t *nuid);
+
 uint32_t lf_t55xx_white_pwdgen(uint32_t id);
 
 int mfdes_kdf_input_gallagher(uint8_t *uid, uint8_t uidLen, uint8_t keyNo, uint32_t aid, uint8_t *kdfInputOut, uint8_t *kdfInputLen);

From 5f92562856e6c32163c31c5535882e73a2169923 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 9 Jan 2021 11:50:26 +0100
Subject: [PATCH 331/682] analyze a  - now uses cliparser

---
 client/src/cmdanalyse.c | 111 +++++++++++++++++-----------------------
 1 file changed, 46 insertions(+), 65 deletions(-)

diff --git a/client/src/cmdanalyse.c b/client/src/cmdanalyse.c
index d26e7adfa..55cbc4127 100644
--- a/client/src/cmdanalyse.c
+++ b/client/src/cmdanalyse.c
@@ -29,18 +29,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_analyse_a(void) {
-    PrintAndLogEx(NORMAL, "Iceman's personal garbage test command");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Usage:  analyse a [h] d <bytes>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "           h          This help");
-    PrintAndLogEx(NORMAL, "           d <bytes>  bytes to send to device");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "      analyse a d 137AF00A0A0D");
-    return PM3_SUCCESS;
-}
 static int usage_analyse_demodbuffer(void) {
     PrintAndLogEx(NORMAL, "loads a binary string into demod buffer");
     PrintAndLogEx(NORMAL, "");
@@ -497,14 +485,31 @@ static char *pb(uint32_t b) {
 */
 
 static int CmdAnalyseA(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "analyse a",
+                  "Iceman's personal garbage test command",
+                  "analyse a -d 137AF00A0A0D"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1("d", "data", "<hex>", "bytes to manipulate"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    int dlen = 0;
+    uint8_t data[100] = {0x00};
+    memset(data, 0x0, sizeof(data));
+    int res = CLIParamHexToBuf(arg_get_str(ctx, 1), data, sizeof(data), &dlen);
+    if (res) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(FAILED, "Error parsing bytes");
+        return PM3_EINVARG;
+    }
+    CLIParserFree(ctx);
+    return PM3_SUCCESS;
 
-    return usage_analyse_a();
     /*
-        PrintAndLogEx(NORMAL, "-- " _BLUE_("its my message") "\n");
-        PrintAndLogEx(NORMAL, "-- " _RED_("its my message") "\n");
-        PrintAndLogEx(NORMAL, "-- " _YELLOW_("its my message") "\n");
-        PrintAndLogEx(NORMAL, "-- " _GREEN_("its my message") "\n");
-
         //uint8_t syncBit = 99;
         // The start bit is one ore more Sequence Y followed by a Sequence Z (... 11111111 00x11111). We need to distinguish from
         // Sequence X followed by Sequence Y followed by Sequence Z     (111100x1 11111111 00x11111)
@@ -516,28 +521,22 @@ static int CmdAnalyseA(const char *Cmd) {
         uint8_t byte_offset = 99;
         // reverse byte
         uint8_t rev =  reflect8(bt);
-        PrintAndLogEx(NORMAL, "input  %02x | %02x \n", bt, rev);
+        PrintAndLogEx(INFO, "input  %02x | %02x \n", bt, rev);
         // add byte to shift register
         shiftReg = shiftReg << 8 | rev;
 
-        PrintAndLogEx(NORMAL, "shiftreg after %08x | pattern %08x \n", shiftReg, SYNC_16BIT);
+        PrintAndLogEx(INFO, "shiftreg after %08x | pattern %08x \n", shiftReg, SYNC_16BIT);
 
         uint8_t n0 = 0, n1 = 0;
 
         n0 = (rev & (uint8_t)(~(0xFF >> (8 - 4)))) >> 4;
         n1 = (n1 << 4) | (rev & (uint8_t)(~(0xFF << 4)));
 
-        PrintAndLogEx(NORMAL, "rev %02X | %02X %s | %02X %s |\n", rev, n0, pb(n0), n1, pb(n1));
+        PrintAndLogEx(INFO, "rev %02X | %02X %s | %02X %s |\n", rev, n0, pb(n0), n1, pb(n1));
     */
-    /*
-    hex(0xb24d shr 0) 0xB24D 0b1011001001001101
-    hex(0xb24d shr 1) 0x5926
-    hex(0xb24d shr 2) 0x2C93
-    */
-
     /*
         for (int i = 0; i < 16; i++) {
-            PrintAndLogEx(NORMAL, " (shiftReg >> %d) & 0xFFFF ==  %08x ---", i, ((shiftReg >> i) & 0xFFFF));
+            PrintAndLogEx(INFO, " (shiftReg >> %d) & 0xFFFF ==  %08x ---", i, ((shiftReg >> i) & 0xFFFF));
 
             // kolla om SYNC_PATTERN finns.
             if (((shiftReg >> 7) & 0xFFFF) == SYNC_16BIT) byte_offset = 7;
@@ -549,7 +548,7 @@ static int CmdAnalyseA(const char *Cmd) {
             else if (((shiftReg >> 1) & 0xFFFF) == SYNC_16BIT) byte_offset = 1;
             else if (((shiftReg >> 0) & 0xFFFF) == SYNC_16BIT) byte_offset = 0;
 
-            PrintAndLogEx(NORMAL, "Offset  %u \n", byte_offset);
+            PrintAndLogEx(INFO, "Offset  %u \n", byte_offset);
             if (byte_offset != 99)
                 break;
 
@@ -557,14 +556,14 @@ static int CmdAnalyseA(const char *Cmd) {
         }
 
         uint8_t p1 = (rev & (uint8_t)(~(0xFF << byte_offset)));
-        PrintAndLogEx(NORMAL, "Offset  %u  | leftovers  %02x  %s \n", byte_offset, p1, pb(p1));
+        PrintAndLogEx(INFO, "Offset  %u  | leftovers  %02x  %s \n", byte_offset, p1, pb(p1));
 
     */
 
     /*
-    pm3 --> da hex2bin 4db2     0100110110110010
+    pm3 --> da hex2bin 4db2   0100110110110010
     */
-    //return 0;
+    //return PM3_SUCCESS;
     /*
         // split byte into two parts.
         uint8_t offset = 3, n0 = 0, n1 = 0;
@@ -574,23 +573,23 @@ static int CmdAnalyseA(const char *Cmd) {
             n0 = (rev & (uint8_t)(~(0xFF >> (8-offset)))) >> offset;
             n1 = (n1 << offset) | (rev & (uint8_t)(~(0xFF << offset)));
 
-            PrintAndLogEx(NORMAL, "rev %02X | %02X %s | %02X %s |\n", rev, n0, pb(n0), n1, pb(n1) );
+            PrintAndLogEx(INFO, "rev %02X | %02X %s | %02X %s |\n", rev, n0, pb(n0), n1, pb(n1) );
             n0 = 0, n1 = 0;
-            // PrintAndLogEx(NORMAL, " (0xFF >> offset) == %s |\n", pb( (0xFF >> offset)) );
-            //PrintAndLogEx(NORMAL, "~(0xFF >> (8-offset)) == %s |\n", pb(  (uint8_t)(~(0xFF >> (8-offset))) ) );
-            //PrintAndLogEx(NORMAL, " rev & xxx == %s\n\n", pb( (rev & (uint8_t)(~(0xFF << offset))) ));
+            // PrintAndLogEx(INFO, " (0xFF >> offset) == %s |\n", pb( (0xFF >> offset)) );
+            //PrintAndLogEx(INFO, "~(0xFF >> (8-offset)) == %s |\n", pb(  (uint8_t)(~(0xFF >> (8-offset))) ) );
+            //PrintAndLogEx(INFO, " rev & xxx == %s\n\n", pb( (rev & (uint8_t)(~(0xFF << offset))) ));
         }
-    return 0;
+    return PM3_SUCCESS;
         // from A  -- x bits into B and the rest into C.
 
         for ( uint8_t i=0; i<8; i++){
-            PrintAndLogEx(NORMAL, "%u | %02X %s | %02X %s |\n", i, a, pb(a), b, pb(b) );
+            PrintAndLogEx(INFO, "%u | %02X %s | %02X %s |\n", i, a, pb(a), b, pb(b) );
             b = a & (a & (0xFF >> (8-i)));
             a >>=1;
         }
 
         */
-//    return 0;
+//    return PM3_SUCCESS;
 
     /*
         // 14443-A
@@ -601,7 +600,7 @@ static int CmdAnalyseA(const char *Cmd) {
 
         // 14443-B
         uint8_t u14b[] = {0x05, 0x00, 0x08, 0x39, 0x73};
-        PrintAndLogEx(NORMAL, "14b check crc            | %s\n", (check_crc(CRC_14443_B, u14b, sizeof(u14b))) ? "YES" : "NO");
+        PrintAndLogEx(INFO, "14b check crc            | %s\n", (check_crc(CRC_14443_B, u14b, sizeof(u14b))) ? "YES" : "NO");
 
         // 15693 test
         uint8_t u15_c[] = {0x05, 0x00, 0x08, 0x39, 0x73}; // correct
@@ -621,28 +620,10 @@ static int CmdAnalyseA(const char *Cmd) {
         PrintAndLogEx(FAILED, "FeliCa check wrong crc   | %s\n", (check_crc(CRC_FELICA, felica_w, sizeof(felica_w))) ? "YES" : "NO");
         PrintAndLogEx(SUCCESS, "FeliCa check correct crc | %s\n", (check_crc(CRC_FELICA, felica_c, sizeof(felica_c))) ? "YES" : "NO");
 
-        PrintAndLogEx(NORMAL, "\n\n");
+        PrintAndLogEx(NORMAL, "\n");
 
-        return 0;
+        return PM3_SUCCESS;
         */
-    /*
-    bool term = !isatty(STDIN_FILENO);
-    if (!term) {
-        char star[4];
-        star[0] = '-';
-        star[1] = '\\';
-        star[2] = '|';
-        star[3] = '/';
-
-        for (uint8_t k=0; k<4; k = (k+1) % 4 ) {
-            PrintAndLogEx(NORMAL, "\e[s%c\e[u", star[k]);
-            fflush(stdout);
-            if (kbd_enter_pressed()) {
-                break;
-            }
-        }
-    }
-    */
 
 //piwi
 // uid(2e086b1a) nt(230736f6) ks(0b0008000804000e) nr(000000000)
@@ -777,7 +758,7 @@ static int CmdAnalyseA(const char *Cmd) {
     /*
     for (uint8_t i=0; i<31; i++){
         uint64_t a = keys[i] ^ keys[i+1];
-        PrintAndLogEx(NORMAL, "%u | %012" PRIX64 " | \n", i, a);
+        PrintAndLogEx(INFO, "%u | %012" PRIX64 " | \n", i, a);
     }
     */
 
@@ -795,8 +776,8 @@ static int CmdAnalyseA(const char *Cmd) {
         0x2F
     };
 
-    PrintAndLogEx(NORMAL, "UID   | %s\n", sprint_hex(uid,4 ));
-    PrintAndLogEx(NORMAL, "KEY A | %s\n", sprint_hex(key_s0a, 6));
+    PrintAndLogEx(INFO, "UID   | %s\n", sprint_hex(uid,4 ));
+    PrintAndLogEx(INFO, "KEY A | %s\n", sprint_hex(key_s0a, 6));
 
     // arrays w all keys
     uint64_t foo[32] = {0};
@@ -816,7 +797,7 @@ static int CmdAnalyseA(const char *Cmd) {
         uint64_t a = foo[i];
         uint64_t b = foo[i+16];
 
-        PrintAndLogEx(NORMAL, "%02u | %012" PRIX64 " %s | %012" PRIX64 " %s\n",
+        PrintAndLogEx(INFO, "%02u | %012" PRIX64 " %s | %012" PRIX64 " %s\n",
             i,
             a,
             ( a == keya[i])?"ok":"err",
@@ -825,7 +806,7 @@ static int CmdAnalyseA(const char *Cmd) {
         );
     }
     */
-//    return 0;
+//    return PM3_SUCCESS;
 }
 
 static int CmdAnalyseNuid(const char *Cmd) {

From 2239b2dff084785c44fd1a0df47872a1d048ca37 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 9 Jan 2021 12:32:50 +0100
Subject: [PATCH 332/682] all analyse cmds  now use cliparser

---
 client/src/cmdanalyse.c | 182 ++++++++++++++++++++++++----------------
 doc/cliparser_todo.txt  |   8 --
 2 files changed, 111 insertions(+), 79 deletions(-)

diff --git a/client/src/cmdanalyse.c b/client/src/cmdanalyse.c
index 55cbc4127..54a2e5adc 100644
--- a/client/src/cmdanalyse.c
+++ b/client/src/cmdanalyse.c
@@ -29,19 +29,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_analyse_demodbuffer(void) {
-    PrintAndLogEx(NORMAL, "loads a binary string into demod buffer");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Usage:  analyse demodbuff [h] <binarystring>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "           h                This help");
-    PrintAndLogEx(NORMAL, "           <binarystring>   Binary string to load");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "      analyse demodbuff 0011101001001011");
-    return PM3_SUCCESS;
-}
-
 static uint8_t calculateLRC(uint8_t *bytes, uint8_t len) {
     uint8_t LRC = 0;
     for (uint8_t i = 0; i < len; i++)
@@ -185,21 +172,58 @@ static uint16_t calcBSDchecksum4(uint8_t *bytes, uint8_t len, uint32_t mask) {
 
 // measuring LFSR maximum length
 static int CmdAnalyseLfsr(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "analyse lfsr",
+                  "looks at LEGIC Prime's lfsr,  iterates the first 48 values",
+                  "analyse lfsr --iv 55"
+                 );
 
-    uint8_t iv = param_get8ex(Cmd, 0, 0, 16);
-    uint8_t find = param_get8ex(Cmd, 1, 0, 16);
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1(NULL, "iv", "<hex>", "init vector data (1 hex byte)"),
+        arg_str0(NULL, "find", "<hex>", "lfsr data to find (1 hex byte)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    int iv_len = 0;
+    uint8_t idata[1] = {0};
+    int res = CLIParamHexToBuf(arg_get_str(ctx, 1), idata, sizeof(idata), &iv_len);
 
-    PrintAndLogEx(NORMAL, "LEGIC LFSR IV 0x%02X: \n", iv);
-    PrintAndLogEx(NORMAL, " bit# | lfsr | ^0x40 |  0x%02X ^ lfsr \n", find);
+    if (res) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(FAILED, "Error parsing IV byte");
+        return PM3_EINVARG;
+    }
+
+    int f_len = 0;
+    uint8_t fdata[1] = {0};
+    res = CLIParamHexToBuf(arg_get_str(ctx, 2), fdata, sizeof(fdata), &f_len);
+    CLIParserFree(ctx);
+
+    if (res) {
+        PrintAndLogEx(FAILED, "Error parsing FIND byte");
+        return PM3_EINVARG;
+    }
+
+    uint8_t iv = idata[0];
+    uint8_t find = fdata[0];
+
+    PrintAndLogEx(INFO, "LEGIC Prime lfsr");
+    PrintAndLogEx(INFO, "iv..... 0x%02X", iv);
+    PrintAndLogEx(INFO, "----+------+-------+--------------");
+    PrintAndLogEx(INFO, " i# | lfsr | ^0x40 |  0x%02X ^ lfsr", find);
+    PrintAndLogEx(INFO, "----+------+-------+--------------");
 
     for (uint8_t i = 0x01; i < 0x30; i += 1) {
         legic_prng_init(iv);
         legic_prng_forward(i);
         uint16_t lfsr = legic_prng_get_bits(12);  /* Any nonzero start state will work. */
-        PrintAndLogEx(NORMAL, " %02X | %03X | %03X | %03X \n", i, lfsr, 0x40 ^ lfsr, find ^ lfsr);
+        PrintAndLogEx(INFO, " %02X |  %03X |  %03X  | %03X", i, lfsr, 0x40 ^ lfsr, find ^ lfsr);
     }
-    return 0;
+    PrintAndLogEx(INFO, "----+------+-------+--------------");
+    return PM3_SUCCESS;
 }
+
 static int CmdAnalyseLCR(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "analyse lcr",
@@ -422,27 +446,49 @@ static int CmdAnalyseCHKSUM(const char *Cmd) {
 }
 
 static int CmdAnalyseDates(const char *Cmd) {
-    (void)Cmd; // Cmd is not used so far
-    // look for datestamps in a given array of bytes
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "analyse dates",
+                  "Tool to look for date/time stamps in a given array of bytes",
+                  "analyse dates"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
     PrintAndLogEx(NORMAL, "To be implemented. Feel free to contribute!");
-    return 0;
+    return PM3_SUCCESS;
 }
+
 static int CmdAnalyseTEASelfTest(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "analyse tea",
+                  "Crypto TEA self tests",
+                  "analyse tea -d 1122334455667788"
+                 );
 
-    uint8_t v[8], v_le[8];
-    memset(v, 0x00, sizeof(v));
-    memset(v_le, 0x00, sizeof(v_le));
-    uint8_t *v_ptr = v_le;
-
-    uint8_t cmdlen = strlen(Cmd);
-    cmdlen = (sizeof(v) << 2 < cmdlen) ? sizeof(v) << 2 : cmdlen;
-
-    if (param_gethex(Cmd, 0, v, cmdlen) > 0) {
-        PrintAndLogEx(WARNING, "Can't read hex chars, uneven? :: %u", cmdlen);
-        return 1;
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1("d", "data", "<hex>", "bytes to encrypt ( 8 hex bytes )"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    int dlen = 0;
+    uint8_t data[8] = {0x00};
+    int res = CLIParamHexToBuf(arg_get_str(ctx, 1), data, sizeof(data), &dlen);
+    CLIParserFree(ctx);
+    if (res) {
+        PrintAndLogEx(FAILED, "Error parsing bytes");
+        return PM3_EINVARG;
     }
 
-    SwapEndian64ex(v, 8, 4, v_ptr);
+    uint8_t v_le[8];
+    memset(v_le, 0x00, sizeof(v_le));
+    uint8_t *v_ptr = v_le;
+   
+    SwapEndian64ex(data, 8, 4, v_ptr);
 
     // ENCRYPTION KEY:
     uint8_t key[16] = {0x55, 0xFE, 0xF6, 0x30, 0x62, 0xBF, 0x0B, 0xC1, 0xC9, 0xB3, 0x7C, 0x34, 0x97, 0x3E, 0x29, 0xFB };
@@ -450,40 +496,21 @@ static int CmdAnalyseTEASelfTest(const char *Cmd) {
     uint8_t *key_ptr = keyle;
     SwapEndian64ex(key, sizeof(key), 4, key_ptr);
 
-    PrintAndLogEx(NORMAL, "TEST LE enc| %s", sprint_hex(v_ptr, 8));
+    PrintAndLogEx(INFO, "TEA crypto testing");
+    PrintAndLogEx(INFO, "-----------------------------------+---------");
+    PrintAndLogEx(INFO, "LE enc.... %s", sprint_hex_ascii(v_ptr, 8));
 
     tea_decrypt(v_ptr, key_ptr);
-    PrintAndLogEx(NORMAL, "TEST LE dec | %s", sprint_hex_ascii(v_ptr, 8));
+    PrintAndLogEx(INFO, "LE dec.... %s", sprint_hex_ascii(v_ptr, 8));
 
     tea_encrypt(v_ptr, key_ptr);
+    PrintAndLogEx(INFO, "enc1...... %s", sprint_hex_ascii(v_ptr, 8));
     tea_encrypt(v_ptr, key_ptr);
-    PrintAndLogEx(NORMAL, "TEST enc2 | %s", sprint_hex_ascii(v_ptr, 8));
-
-    return 0;
+    PrintAndLogEx(INFO, "enc2...... %s", sprint_hex_ascii(v_ptr, 8));
+    PrintAndLogEx(NORMAL, "");
+    return PM3_SUCCESS;
 }
 
-/*
-static char *pb(uint32_t b) {
-    static char buf1[33] = {0};
-    static char buf2[33] = {0};
-    static char *s;
-
-    if (s != buf1)
-        s = buf1;
-    else
-        s = buf2;
-
-    memset(s, 0, sizeof(buf1));
-
-    uint32_t mask = 0x80000000;
-    for (uint8_t i = 0; i < 32; i++) {
-        s[i] = (mask & b) ? '1' : '0';
-        mask >>= 1;
-    }
-    return s;
-}
-*/
-
 static int CmdAnalyseA(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "analyse a",
@@ -881,22 +908,35 @@ static int CmdAnalyseNuid(const char *Cmd) {
 }
 
 static int CmdAnalyseDemodBuffer(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "analyse demodbuff",
+                  "loads a binary string into demod buffer",
+                  "analyse demodbuff -d 0011101001001011"
+                 );
 
-    char cmdp = tolower(param_getchar(Cmd, 0));
-    if (strlen(Cmd) == 0 || cmdp == 'h') return usage_analyse_demodbuffer();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1("d", "data", "<bin>", "binary string to load"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    const char *s = arg_get_str(ctx, 1)->sval[0];
+    CLIParserFree(ctx);
+   
+    if (s == NULL) {
+        PrintAndLogEx(FAILED, "Must provide a binary string");
+        return PM3_EINVARG;
+    }
 
-    int bg = 0, en = 0;
-    if (param_getptr(Cmd, &bg, &en, 0))
-        return usage_analyse_demodbuffer();
-
-    int len = MIN((en - bg + 1), MAX_DEMOD_BUF_LEN);
+    int len = MIN(strlen(s), MAX_DEMOD_BUF_LEN);
 
     // add 1 for null terminator.
     uint8_t *data = calloc(len + 1,  sizeof(uint8_t));
-    if (!data) return PM3_EMALLOC;
+    if (data == NULL)
+        return PM3_EMALLOC;
 
-    for (int i = 0; bg <= en; bg++, i++) {
-        char c = Cmd[bg];
+    for (int i = 0; i <= strlen(s); i++) {
+        char c = s[i];
         if (c == '1')
             DemodBuffer[i] = 1;
         if (c == '0')
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index ccaa7ada3..2859c6752 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -1,13 +1,5 @@
 clear
 pref
-analyse chksum
-analyse dates
-analyse tea
-analyse lfsr
-analyse a
-analyse nuid
-analyse demodbuff
-analyse freq
 data biphaserawdecode
 data detectclock
 data fsktonrz

From ee8309e09bda2937218f531fd46dca641734e56c Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 9 Jan 2021 14:00:58 +0100
Subject: [PATCH 333/682] pref cmds - now use cliparser. renamed a enum to fit
 the global scope better

---
 client/src/preferences.c | 563 +++++++++++++++++----------------------
 client/src/proxmark3.c   |  10 +-
 client/src/ui.c          |  22 +-
 client/src/ui.h          |   2 +-
 4 files changed, 263 insertions(+), 334 deletions(-)

diff --git a/client/src/preferences.c b/client/src/preferences.c
index 1e943a84a..9ae4f08a0 100644
--- a/client/src/preferences.c
+++ b/client/src/preferences.c
@@ -4,8 +4,6 @@
 // the license.
 //-----------------------------------------------------------------------------
 // Preferences Functions
-//-----------------------------------------------------------------------------
-
 //-----------------------------------------------------------------------------
 // Notes
 //      To add a new setting
@@ -25,6 +23,7 @@
 #include <ctype.h>
 #include <dirent.h>
 #include <proxmark3.h>
+#include "cliparser.h"
 
 static int CmdHelp(const char *Cmd);
 static int setCmdHelp(const char *Cmd);
@@ -160,17 +159,17 @@ void preferences_save_callback(json_t *root) {
 
     // Emoji
     switch (session.emoji_mode) {
-        case ALIAS:
+        case EMO_ALIAS:
             JsonSaveStr(root, "show.emoji", "alias");
             break;
-        case EMOJI:
+        case EMO_EMOJI:
             JsonSaveStr(root, "show.emoji", "emoji");
             break;
-        case ALTTEXT:
+        case EMO_ALTTEXT:
             JsonSaveStr(root, "show.emoji", "alttext");
             break;
-        case ERASE:
-            JsonSaveStr(root, "show.emoji", "erase");
+        case EMO_NONE:
+            JsonSaveStr(root, "show.emoji", "none");
             break;
         default:
             JsonSaveStr(root, "show.emoji", "ALIAS");
@@ -302,10 +301,10 @@ void preferences_load_callback(json_t *root) {
     if (json_unpack_ex(root, &up_error, 0, "{s:s}", "show.emoji", &s1) == 0) {
         strncpy(tempStr, s1, sizeof(tempStr) - 1);
         str_lower(tempStr);
-        if (strncmp(tempStr, "alias", 5) == 0) session.emoji_mode = ALIAS;
-        if (strncmp(tempStr, "emoji", 5) == 0) session.emoji_mode = EMOJI;
-        if (strncmp(tempStr, "alttext", 7) == 0) session.emoji_mode = ALTTEXT;
-        if (strncmp(tempStr, "erase", 5) == 0) session.emoji_mode = ERASE;
+        if (strncmp(tempStr, "alias", 5) == 0) session.emoji_mode = EMO_ALIAS;
+        if (strncmp(tempStr, "emoji", 5) == 0) session.emoji_mode = EMO_EMOJI;
+        if (strncmp(tempStr, "alttext", 7) == 0) session.emoji_mode = EMO_ALTTEXT;
+        if (strncmp(tempStr, "none", 4) == 0) session.emoji_mode = EMO_NONE;
     }
 
     if (json_unpack_ex(root, &up_error, 0, "{s:b}", "show.hints", &b1) == 0)
@@ -339,45 +338,6 @@ void preferences_load_callback(json_t *root) {
 
 // Help Functions
 
-static int usage_set_emoji(void) {
-    PrintAndLogEx(NORMAL, "Usage: pref set emoji <alias | emoji | alttext | erase>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("help")"        - This help");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("alias")"       - Show alias for emoji");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("emoji")"       - Show amoji");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("alttext")"     - Show alt text for emoji");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("erase")"       - Dont show emoji or text");
-    return PM3_SUCCESS;
-}
-
-static int usage_set_color(void) {
-    PrintAndLogEx(NORMAL, "Usage: pref set color <off | ansi>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("help")"        - This help");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("off")"         - Dont use colors");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("ansi")"        - Use ANSI colors");
-    return PM3_SUCCESS;
-}
-
-static int usage_set_debug(void) {
-    PrintAndLogEx(NORMAL, "Usage: pref set clientdebug <off | simple | full>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("help")"        - This help");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("off")"         - no debug messages");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("simple")"      - simple debug messages");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("full")"        - full debug messages");
-    return PM3_SUCCESS;
-}
-
-static int usage_set_bar_mode(void) {
-    PrintAndLogEx(NORMAL, "Usage: pref set barmode <bar | mixed | value>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("help")"        - This help");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("bar")"         - measured values as bar only");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("mixed")"       - measured values as numbers and bar");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("value")"       - measured values");
-    return PM3_SUCCESS;
-}
 
 /*
 static int usage_set_devicedebug(void) {
@@ -393,23 +353,8 @@ static int usage_set_devicedebug(void) {
     return PM3_SUCCESS;
 }
 */
-static int usage_set_hints(void) {
-    PrintAndLogEx(NORMAL, "Usage: pref set hints <off | on>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("help")"        - This help");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("off")"         - Dont display hints");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("on")"          - Display hints");
-    return PM3_SUCCESS;
-}
 
-static int usage_set_plotsliders(void) {
-    PrintAndLogEx(NORMAL, "Usage: pref set plotsliders <on | off>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("help")"        - This help");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("on")"          - show plot slider controls");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("off")"         - hide plot slider controls");
-    return PM3_SUCCESS;
-}
+
 
 /*
 static int usage_set_savePaths(void) {
@@ -431,30 +376,29 @@ typedef enum prefShowOpt {prefShowNone, prefShowOLD, prefShowNEW} prefShowOpt_t;
 static const char *prefShowMsg(prefShowOpt_t Opt) {
     switch (Opt) {
         case prefShowOLD:
-            return _YELLOW_("[old]");
+            return "( " _YELLOW_("old") " )";
         case prefShowNEW:
-            return _GREEN_("[new]");
+            return "( " _GREEN_("new") " )";
         case prefShowNone:
             return "";
     }
-
     return "";
 }
 
 static void showEmojiState(prefShowOpt_t opt) {
 
     switch (session.emoji_mode) {
-        case ALIAS:
+        case EMO_ALIAS:
             PrintAndLogEx(INFO, "   %s emoji.................. "_GREEN_("alias"), prefShowMsg(opt));
             break;
-        case EMOJI:
+        case EMO_EMOJI:
             PrintAndLogEx(INFO, "   %s emoji.................. "_GREEN_("emoji"), prefShowMsg(opt));
             break;
-        case ALTTEXT:
+        case EMO_ALTTEXT:
             PrintAndLogEx(INFO, "   %s emoji.................. "_GREEN_("alttext"), prefShowMsg(opt));
             break;
-        case ERASE:
-            PrintAndLogEx(INFO, "   %s emoji.................. "_GREEN_("erase"), prefShowMsg(opt));
+        case EMO_NONE:
+            PrintAndLogEx(INFO, "   %s emoji.................. "_GREEN_("none"), prefShowMsg(opt));
             break;
         default:
             PrintAndLogEx(INFO, "   %s emoji.................. "_RED_("unknown"), prefShowMsg(opt));
@@ -574,153 +518,149 @@ static void showBarModeState(prefShowOpt_t opt) {
     }
 }
 
-
 static int setCmdEmoji(const char *Cmd) {
-    uint8_t cmdp = 0;
-    bool errors = false;
-    bool validValue = false;
-    char strOpt[50];
-    emojiMode_t newValue = session.emoji_mode;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "pref set emoji ",
+                  "Set presistent preference of using emojis in the client",
+                  "pref set emoji --alias"
+                 );
 
-    if (param_getchar(Cmd, cmdp) == 0x00)
-        return usage_set_emoji();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0(NULL, "alias", "show alias for emoji"),
+        arg_lit0(NULL, "emoji", "show emoji"),
+        arg_lit0(NULL, "alttext", "show alt text for emoji"),
+        arg_lit0(NULL, "none", "don't show emoji or text"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool show_a = arg_get_lit(ctx, 1);
+    bool show_e = arg_get_lit(ctx, 2);
+    bool show_alt = arg_get_lit(ctx, 3);
+    bool show_none = arg_get_lit(ctx, 4);
+    CLIParserFree(ctx);
+   
+    if ( (show_a + show_e + show_alt + show_none) > 1) {
+        PrintAndLogEx(FAILED, "Can only set one option");
+        return PM3_EINVARG;
+    }
 
-    while ((param_getchar(Cmd, cmdp) != 0x00) && !errors) {
+    emojiMode_t new_value = session.emoji_mode;
 
-        if (param_getstr(Cmd, cmdp++, strOpt, sizeof(strOpt)) != 0) {
-            str_lower(strOpt); // convert to lowercase
+    if (show_a) {
+        new_value = EMO_ALIAS;
+    }
+    if (show_e) {
+        new_value = EMO_EMOJI;
+    }
+    if (show_alt) {
+        new_value = EMO_ALTTEXT;
+    }
+    if (show_none) {
+        new_value = EMO_NONE;
+    }
 
-            if (strncmp(strOpt, "help", 4) == 0)
-                return usage_set_emoji();
-            if (strncmp(strOpt, "alias", 5) == 0) {
-                validValue = true;
-                newValue = ALIAS;
-            }
-            if (strncmp(strOpt, "emoji", 5) == 0) {
-                validValue = true;
-                newValue = EMOJI;
-            }
-            if (strncmp(strOpt, "alttext", 7) == 0) {
-                validValue = true;
-                newValue = ALTTEXT;
-            }
-            if (strncmp(strOpt, "erase", 5) == 0) {
-                validValue = true;
-                newValue = ERASE;
-            }
-
-            if (validValue) {
-                if (session.emoji_mode != newValue) {// changed
-                    showEmojiState(prefShowOLD);
-                    session.emoji_mode = newValue;
-                    showEmojiState(prefShowNEW);
-                    preferences_save();
-                } else {
-                    PrintAndLogEx(INFO, "nothing changed");
-                    showEmojiState(prefShowNone);
-                }
-            } else {
-                PrintAndLogEx(ERR, "invalid option");
-                return usage_set_emoji();
-            }
-        }
+    if (session.emoji_mode != new_value) {// changed
+        showEmojiState(prefShowOLD);
+        session.emoji_mode = new_value;
+        showEmojiState(prefShowNEW);
+        preferences_save();
+    } else {
+        showEmojiState(prefShowNone);
     }
 
     return PM3_SUCCESS;
 }
 
 static int setCmdColor(const char *Cmd) {
-    uint8_t cmdp = 0;
-    bool errors = false;
-    bool validValue = false;
-    char strOpt[50];
-    bool newValue = session.supports_colors;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "pref set color ",
+                  "Set presistent preference of using colors in the client",
+                  "pref set color --ansi"
+                 );
 
-    if (param_getchar(Cmd, cmdp) == 0x00)
-        return usage_set_color();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0(NULL, "ansi", "use ANSI colors"),
+        arg_lit0(NULL, "off", "don't use colors"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool use_c = arg_get_lit(ctx, 1);
+    bool use_n = arg_get_lit(ctx, 2);
+    CLIParserFree(ctx);
 
-    while ((param_getchar(Cmd, cmdp) != 0x00) && !errors) {
+    if ( (use_c + use_n) > 1) {
+        PrintAndLogEx(FAILED, "Can only set one option");
+        return PM3_EINVARG;
+    }
 
-        if (param_getstr(Cmd, cmdp++, strOpt, sizeof(strOpt)) != 0) {
-            str_lower(strOpt); // convert to lowercase
+    bool new_value = session.supports_colors;
+    if (use_c) {
+        new_value = true;
+    }
 
-            if (strncmp(strOpt, "help", 4) == 0)
-                return usage_set_color();
-            if (strncmp(strOpt, "off", 3) == 0) {
-                validValue = true;
-                newValue = false;
-            }
-            if (strncmp(strOpt, "ansi", 4) == 0) {
-                validValue = true;
-                newValue = true;
-            }
+    if (use_n) {
+        new_value = false;
+    }
 
-            if (validValue) {
-                if (session.supports_colors != newValue) {// changed
-                    showColorState(prefShowOLD);
-                    session.supports_colors = newValue;
-                    showColorState(prefShowNEW);
-                    preferences_save();
-                } else {
-                    PrintAndLogEx(INFO, "nothing changed");
-                    showColorState(prefShowNone);
-                }
-            } else {
-                PrintAndLogEx(ERR, "invalid option");
-                return usage_set_color();
-            }
-        }
+    if (session.supports_colors != new_value) {
+        showColorState(prefShowOLD);
+        session.supports_colors = new_value;
+        showColorState(prefShowNEW);
+        preferences_save();
+    } else {
+        showColorState(prefShowNone);
     }
 
     return PM3_SUCCESS;
 }
 
 static int setCmdDebug(const char *Cmd) {
-    uint8_t cmdp = 0;
-    bool errors = false;
-    bool validValue = false;
-    char strOpt[50];
-    clientdebugLevel_t newValue = session.client_debug_level;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "pref set clientdebug ",
+                  "Set presistent preference of using clientside debug level",
+                  "pref set clientdebug --simple"
+                 );
 
-    if (param_getchar(Cmd, cmdp) == 0x00)
-        return usage_set_debug();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0(NULL, "off", "no debug messages"),
+        arg_lit0(NULL, "simple", "simple debug messages"),
+        arg_lit0(NULL, "full", "full debug messages"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool use_off = arg_get_lit(ctx, 1);
+    bool use_simple = arg_get_lit(ctx, 2);
+    bool use_full = arg_get_lit(ctx, 3);
+    CLIParserFree(ctx);
 
-    while ((param_getchar(Cmd, cmdp) != 0x00) && !errors) {
+    if ( (use_off + use_simple + use_full) > 1) {
+        PrintAndLogEx(FAILED, "Can only set one option");
+        return PM3_EINVARG;
+    }
 
-        if (param_getstr(Cmd, cmdp++, strOpt, sizeof(strOpt)) != 0) {
-            str_lower(strOpt); // convert to lowercase
+    clientdebugLevel_t new_value = session.client_debug_level;
 
-            if (strncmp(strOpt, "help", 4) == 0)
-                return usage_set_debug();
-            if (strncmp(strOpt, "off", 3) == 0) {
-                validValue = true;
-                newValue = cdbOFF;
-            }
-            if (strncmp(strOpt, "simple", 6) == 0) {
-                validValue = true;
-                newValue = cdbSIMPLE;
-            }
-            if (strncmp(strOpt, "full", 4) == 0) {
-                validValue = true;
-                newValue = cdbFULL;
-            }
+    if (use_off) {
+        new_value = cdbOFF;
+    }
+    if (use_simple) {
+        new_value = cdbSIMPLE;
+    }
+    if (use_full) {
+        new_value = cdbFULL;
+    }
 
-            if (validValue) {
-                if (session.client_debug_level != newValue) {// changed
-                    showClientDebugState(prefShowOLD);
-                    session.client_debug_level = newValue;
-                    g_debugMode = newValue;
-                    showClientDebugState(prefShowNEW);
-                    preferences_save();
-                } else {
-                    PrintAndLogEx(INFO, "nothing changed");
-                    showClientDebugState(prefShowNone);
-                }
-            } else {
-                PrintAndLogEx(ERR, "invalid option");
-                return usage_set_debug();
-            }
-        }
+    if (session.client_debug_level != new_value) {
+        showClientDebugState(prefShowOLD);
+        session.client_debug_level = new_value;
+        g_debugMode = new_value;
+        showClientDebugState(prefShowNEW);
+        preferences_save();
+    } else {
+        showClientDebugState(prefShowNone);
     }
 
     return PM3_SUCCESS;
@@ -793,93 +733,86 @@ static int setCmdDeviceDebug (const char *Cmd)
 }
 */
 static int setCmdHint(const char *Cmd) {
-    uint8_t cmdp = 0;
-    bool errors = false;
-    bool validValue = false;
-    char strOpt[50];
-    bool newValue = session.show_hints;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "pref set hints ",
+                  "Set presistent preference of showing hint messages in the client",
+                  "pref set hints --on"
+                 );
 
-    if (param_getchar(Cmd, cmdp) == 0x00)
-        return usage_set_hints();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0(NULL, "off", "hide hints"),
+        arg_lit0(NULL, "on", "show hints"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool use_off = arg_get_lit(ctx, 1);
+    bool use_on = arg_get_lit(ctx, 2);
+    CLIParserFree(ctx);
 
-    while ((param_getchar(Cmd, cmdp) != 0x00) && !errors) {
+    if ( (use_off + use_on) > 1) {
+        PrintAndLogEx(FAILED, "Can only set one option");
+        return PM3_EINVARG;
+    }
+ 
+     bool new_value = session.show_hints;
+    if (use_off) {
+        new_value = false;
+    }
+    if (use_on) {
+        new_value = true;
+    }
 
-        if (param_getstr(Cmd, cmdp++, strOpt, sizeof(strOpt)) != 0) {
-            str_lower(strOpt); // convert to lowercase
-
-            if (strncmp(strOpt, "help", 4) == 0)
-                return usage_set_hints();
-            if (strncmp(strOpt, "off", 3) == 0) {
-                validValue = true;
-                newValue = false;
-            }
-            if (strncmp(strOpt, "on", 2) == 0) {
-                validValue = true;
-                newValue = true;
-            }
-
-            if (validValue) {
-                if (session.show_hints != newValue) {// changed
-                    showHintsState(prefShowOLD);
-                    session.show_hints = newValue;
-                    showHintsState(prefShowNEW);
-                    preferences_save();
-                } else {
-                    PrintAndLogEx(INFO, "nothing changed");
-                    showHintsState(prefShowNone);
-                }
-            } else {
-                PrintAndLogEx(ERR, "invalid option");
-                return usage_set_hints();
-            }
-        }
+    if (session.show_hints != new_value) {
+        showHintsState(prefShowOLD);
+        session.show_hints = new_value;
+        showHintsState(prefShowNEW);
+        preferences_save();
+    } else {
+        showHintsState(prefShowNone);
     }
 
     return PM3_SUCCESS;
 }
 static int setCmdPlotSliders(const char *Cmd) {
-    uint8_t cmdp = 0;
-    bool errors = false;
-    bool validValue = false;
-    char strOpt[50];
-    bool newValue = session.overlay_sliders;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "pref set plotsliders ",
+                  "Set presistent preference of showing the plotslider control in the client",
+                  "pref set plotsliders --on"
+                 );
 
-    if (param_getchar(Cmd, cmdp) == 0x00)
-        return usage_set_plotsliders();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0(NULL, "off", "hide plot slider controls"),
+        arg_lit0(NULL, "on", "show plot slider controls"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool use_off = arg_get_lit(ctx, 1);
+    bool use_on = arg_get_lit(ctx, 2);
+    CLIParserFree(ctx);
 
-    while ((param_getchar(Cmd, cmdp) != 0x00) && !errors) {
-
-        if (param_getstr(Cmd, cmdp++, strOpt, sizeof(strOpt)) != 0) {
-            str_lower(strOpt); // convert to lowercase
-
-            if (strncmp(strOpt, "help", 4) == 0)
-                return usage_set_plotsliders();
-            if (strncmp(strOpt, "off", 3) == 0) {
-                validValue = true;
-                newValue = false;
-            }
-            if (strncmp(strOpt, "on", 2) == 0) {
-                validValue = true;
-                newValue = true;
-            }
-
-            if (validValue) {
-                if (session.overlay_sliders != newValue) {// changed
-                    showPlotSliderState(prefShowOLD);
-                    session.overlay_sliders = newValue;
-                    showPlotSliderState(prefShowNEW);
-                    preferences_save();
-                } else {
-                    PrintAndLogEx(INFO, "nothing changed");
-                    showPlotSliderState(prefShowNone);
-                }
-            } else {
-                PrintAndLogEx(ERR, "invalid option");
-                return usage_set_plotsliders();
-            }
-        }
+    if ( (use_off + use_on) > 1) {
+        PrintAndLogEx(FAILED, "Can only set one option");
+        return PM3_EINVARG;
+    }
+ 
+    bool new_value = session.overlay_sliders;
+    if (use_off) {
+        new_value = false;
+    }
+    if (use_on) {
+        new_value = true;
     }
 
+    if (session.overlay_sliders != new_value) {
+        showPlotSliderState(prefShowOLD);
+        session.overlay_sliders = new_value;
+        showPlotSliderState(prefShowNEW);
+        preferences_save();
+    } else {
+        showPlotSliderState(prefShowNone);
+    }
     return PM3_SUCCESS;
 }
 
@@ -975,53 +908,49 @@ static int getCmdHelp(const char *Cmd) {
 */
 
 static int setCmdBarMode(const char *Cmd) {
-    uint8_t cmdp = 0;
-    bool errors = false;
-    bool validValue = false;
-    char strOpt[50];
-    barMode_t newValue = session.bar_mode;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "pref set barmode",
+                  "Set presistent preference of HF/LF tune command styled output in the client",
+                  "pref set barmode --mix"
+                 );
 
-    if (param_getchar(Cmd, cmdp) == 0x00)
-        return usage_set_bar_mode();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0(NULL, "bar", "measured values as bar only"),
+        arg_lit0(NULL, "mix", "measured values as numbers and bar"),
+        arg_lit0(NULL, "val", "measured values only"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool show_bar = arg_get_lit(ctx, 1);
+    bool show_mix = arg_get_lit(ctx, 2);
+    bool show_val = arg_get_lit(ctx, 3);
+    CLIParserFree(ctx);
 
-    while ((param_getchar(Cmd, cmdp) != 0x00) && !errors) {
-
-        if (param_getstr(Cmd, cmdp++, strOpt, sizeof(strOpt)) != 0) {
-            str_lower(strOpt); // convert to lowercase
-
-            if (strncmp(strOpt, "help", 4) == 0)
-                return usage_set_bar_mode();
-
-            if (strncmp(strOpt, "bar", 3) == 0) {
-                validValue = true;
-                newValue = STYLE_BAR;
-            }
-            if (strncmp(strOpt, "mixed", 5) == 0) {
-                validValue = true;
-                newValue = STYLE_MIXED;
-            }
-            if (strncmp(strOpt, "value", 5) == 0) {
-                validValue = true;
-                newValue = STYLE_VALUE;
-            }
-
-            if (validValue) {
-                if (session.bar_mode != newValue) {// changed
-                    showBarModeState(prefShowOLD);
-                    session.bar_mode = newValue;
-                    showBarModeState(prefShowNEW);
-                    preferences_save();
-                } else {
-                    PrintAndLogEx(INFO, "nothing changed");
-                    showBarModeState(prefShowNone);
-                }
-            } else {
-                PrintAndLogEx(ERR, "invalid option");
-                return usage_set_bar_mode();
-            }
-        }
+    if ( (show_bar + show_mix + show_val) > 1) {
+        PrintAndLogEx(FAILED, "Can only set one option");
+        return PM3_EINVARG;
     }
 
+    barMode_t new_value = session.bar_mode;
+    if (show_bar) {
+        new_value = STYLE_BAR;
+    }
+    if (show_mix) {
+        new_value = STYLE_MIXED;
+    }
+    if (show_val) {
+        new_value = STYLE_VALUE;
+    }
+
+    if (session.bar_mode != new_value) {
+        showBarModeState(prefShowOLD);
+        session.bar_mode = new_value;
+        showBarModeState(prefShowNEW);
+        preferences_save();
+    } else {
+        showBarModeState(prefShowNone);
+    }
     return PM3_SUCCESS;
 }
 
@@ -1056,7 +985,7 @@ static int getCmdBarMode(const char *Cmd) {
 }
 
 
-static command_t getCommandTable[] = {
+static command_t CommandTableGet[] = {
 //     {"help",             getCmdHelp,          AlwaysAvailable, "This help"},
     {"barmode",          getCmdBarMode,       AlwaysAvailable, "Get bar mode preference"},
     {"clientdebug",      getCmdDebug,         AlwaysAvailable, "Get client debug level preference"},
@@ -1069,7 +998,7 @@ static command_t getCommandTable[] = {
     {NULL, NULL, NULL, NULL}
 };
 
-static command_t setCommandTable[] = {
+static command_t CommandTableSet[] = {
     {"help",             setCmdHelp,          AlwaysAvailable, "This help"},
     {"barmode",          setCmdBarMode,       AlwaysAvailable, "Set bar mode"},
     {"clientdebug",      setCmdDebug,         AlwaysAvailable, "Set client debug level"},
@@ -1084,18 +1013,18 @@ static command_t setCommandTable[] = {
 
 static int setCmdHelp(const char *Cmd) {
     (void)Cmd; // Cmd is not used so far
-    CmdsHelp(setCommandTable);
+    CmdsHelp(CommandTableSet);
     return PM3_SUCCESS;
 }
 
 static int CmdPrefGet(const char *Cmd) {
     clearCommandBuffer();
-    return CmdsParse(getCommandTable, Cmd);
+    return CmdsParse(CommandTableGet, Cmd);
 }
 
 static int CmdPrefSet(const char *Cmd) {
     clearCommandBuffer();
-    return CmdsParse(setCommandTable, Cmd);
+    return CmdsParse(CommandTableSet, Cmd);
 }
 
 static int CmdPrefShow(const char *Cmd) {
diff --git a/client/src/proxmark3.c b/client/src/proxmark3.c
index 539b7a20b..0019b6f2b 100644
--- a/client/src/proxmark3.c
+++ b/client/src/proxmark3.c
@@ -711,7 +711,7 @@ void pm3_init(void) {
     session.help_dump_mode = false;
     session.incognito = false;
     session.supports_colors = false;
-    session.emoji_mode = ALTTEXT;
+    session.emoji_mode = EMO_ALTTEXT;
     session.stdinOnTTY = false;
     session.stdoutOnTTY = false;
 
@@ -769,14 +769,14 @@ int main(int argc, char *argv[]) {
     session.stdinOnTTY = isatty(STDIN_FILENO);
     session.stdoutOnTTY = isatty(STDOUT_FILENO);
     session.supports_colors = false;
-    session.emoji_mode = ALTTEXT;
+    session.emoji_mode = EMO_ALTTEXT;
     if (session.stdinOnTTY && session.stdoutOnTTY) {
 #if defined(__linux__) || defined(__APPLE__)
         session.supports_colors = true;
-        session.emoji_mode = EMOJI;
+        session.emoji_mode = EMO_EMOJI;
 #elif defined(_WIN32)
         session.supports_colors = DetectWindowsAnsiSupport();
-        session.emoji_mode = ALTTEXT;
+        session.emoji_mode = EMO_ALTTEXT;
 #endif
     }
     for (int i = 1; i < argc; i++) {
@@ -976,7 +976,7 @@ int main(int argc, char *argv[]) {
     // even if prefs, we disable colors if stdin or stdout is not a TTY
     if ((! session.stdinOnTTY) || (! session.stdoutOnTTY)) {
         session.supports_colors = false;
-        session.emoji_mode = ALTTEXT;
+        session.emoji_mode = EMO_ALTTEXT;
     }
 
     // Let's take a baudrate ok for real UART, USB-CDC & BT don't use that info anyway
diff --git a/client/src/ui.c b/client/src/ui.c
index f01b71009..3b85f4e94 100644
--- a/client/src/ui.c
+++ b/client/src/ui.c
@@ -202,14 +202,14 @@ void PrintAndLogEx(logLevel_t level, const char *fmt, ...) {
                                   };
     switch (level) {
         case ERR:
-            if (session.emoji_mode == EMOJI)
+            if (session.emoji_mode == EMO_EMOJI)
                 strncpy(prefix,  "[" _RED_("!!") "] :rotating_light: ", sizeof(prefix) - 1);
             else
                 strncpy(prefix, "[" _RED_("!!") "] ", sizeof(prefix) - 1);
             stream = stderr;
             break;
         case FAILED:
-            if (session.emoji_mode == EMOJI)
+            if (session.emoji_mode == EMO_EMOJI)
                 strncpy(prefix, "[" _RED_("-") "] :no_entry: ", sizeof(prefix) - 1);
             else
                 strncpy(prefix, "[" _RED_("-") "] ", sizeof(prefix) - 1);
@@ -224,7 +224,7 @@ void PrintAndLogEx(logLevel_t level, const char *fmt, ...) {
             strncpy(prefix, "[" _GREEN_("+") "] ", sizeof(prefix) - 1);
             break;
         case WARNING:
-            if (session.emoji_mode == EMOJI)
+            if (session.emoji_mode == EMO_EMOJI)
                 strncpy(prefix, "[" _CYAN_("!") "] :warning:  ", sizeof(prefix) - 1);
             else
                 strncpy(prefix, "[" _CYAN_("!") "] ", sizeof(prefix) - 1);
@@ -233,7 +233,7 @@ void PrintAndLogEx(logLevel_t level, const char *fmt, ...) {
             strncpy(prefix, "[" _YELLOW_("=") "] ", sizeof(prefix) - 1);
             break;
         case INPLACE:
-            if (session.emoji_mode == EMOJI) {
+            if (session.emoji_mode == EMO_EMOJI) {
                 strncpy(prefix, spinner_emoji[PrintAndLogEx_spinidx], sizeof(prefix) - 1);
                 PrintAndLogEx_spinidx++;
                 if (PrintAndLogEx_spinidx >= ARRAYLEN(spinner_emoji))
@@ -388,7 +388,7 @@ static void fPrintAndLog(FILE *stream, const char *fmt, ...) {
 #endif
 
     if ((g_printAndLog & PRINTANDLOG_LOG) && logging && logfile) {
-        memcpy_filter_emoji(buffer3, buffer2, sizeof(buffer2), ALTTEXT);
+        memcpy_filter_emoji(buffer3, buffer2, sizeof(buffer2), EMO_ALTTEXT);
         if (filter_ansi) { // already done
             fprintf(logfile, "%s", buffer3);
         } else {
@@ -466,12 +466,12 @@ static bool emojify_token(const char *token, uint8_t token_length, const char **
     while (EmojiTable[i].alias && EmojiTable[i].emoji) {
         if ((strlen(EmojiTable[i].alias) == token_length) && (0 == memcmp(EmojiTable[i].alias, token, token_length))) {
             switch (mode) {
-                case EMOJI: {
+                case EMO_EMOJI: {
                     *emojified_token = EmojiTable[i].emoji;
                     *emojified_token_length = strlen(EmojiTable[i].emoji);
                     break;
                 }
-                case ALTTEXT: {
+                case EMO_ALTTEXT: {
                     int j = 0;
                     *emojified_token_length = 0;
                     while (EmojiAltTable[j].alias && EmojiAltTable[i].alttext) {
@@ -484,11 +484,11 @@ static bool emojify_token(const char *token, uint8_t token_length, const char **
                     }
                     break;
                 }
-                case ERASE: {
+                case EMO_NONE: {
                     *emojified_token_length = 0;
                     break;
                 }
-                case ALIAS: { // should never happen
+                case EMO_ALIAS: { // should never happen
                     return false;
                 }
             }
@@ -508,7 +508,7 @@ static bool token_charset(uint8_t c) {
 }
 
 void memcpy_filter_emoji(void *dest, const void *src, size_t n, emojiMode_t mode) {
-    if (mode == ALIAS) {
+    if (mode == EMO_ALIAS) {
         memcpy(dest, src, n);
     } else {
         // tokenize emoji
@@ -658,7 +658,7 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
         "\xe2\x96\x88",
     };
 
-    uint8_t mode = (session.emoji_mode == EMOJI);
+    uint8_t mode = (session.emoji_mode == EMO_EMOJI);
 
     const char *block[] = {"#", "\xe2\x96\x88"};
     // use a 3-byte space in emoji mode to ease computations
diff --git a/client/src/ui.h b/client/src/ui.h
index 30d055b16..db8ac99ce 100644
--- a/client/src/ui.h
+++ b/client/src/ui.h
@@ -24,7 +24,7 @@ extern "C" {
 
 typedef enum {STYLE_BAR, STYLE_MIXED, STYLE_VALUE} barMode_t;
 typedef enum logLevel {NORMAL, SUCCESS, INFO, FAILED, WARNING, ERR, DEBUG, INPLACE, HINT} logLevel_t;
-typedef enum emojiMode {ALIAS, EMOJI, ALTTEXT, ERASE} emojiMode_t;
+typedef enum emojiMode {EMO_ALIAS, EMO_EMOJI, EMO_ALTTEXT, EMO_NONE} emojiMode_t;
 typedef enum clientdebugLevel {cdbOFF, cdbSIMPLE, cdbFULL} clientdebugLevel_t;
 // typedef enum devicedebugLevel {ddbOFF, ddbERROR, ddbINFO, ddbDEBUG, ddbEXTENDED} devicedebugLevel_t;
 //typedef enum savePaths {spDefault, spDump, spTrace, spItemCount} savePaths_t; // last item spItemCount used to auto map to number of files

From 8b7ef202c36fa1b0b2758087bbd58b31a9798c21 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 9 Jan 2021 22:44:09 +0100
Subject: [PATCH 334/682] pref savedefaultpaths uses cliparser, enabled  but is
 not used in the fileutils yet.

---
 client/src/cmdhf14b.c    |   2 +-
 client/src/fileutils.c   |  12 +-
 client/src/fileutils.h   |   2 +-
 client/src/preferences.c | 420 +++++++++++++++++++--------------------
 client/src/ui.h          |   4 +-
 5 files changed, 209 insertions(+), 231 deletions(-)

diff --git a/client/src/cmdhf14b.c b/client/src/cmdhf14b.c
index 71c2f03ab..5676aa41f 100644
--- a/client/src/cmdhf14b.c
+++ b/client/src/cmdhf14b.c
@@ -287,7 +287,7 @@ static int CmdHF14BCmdRaw(const char *Cmd) {
 
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf 14b raw",
-                  "Sends raw bytes to card ",
+                  "Sends raw bytes to card",
                   "hf 14b raw -cks      --data 0200a40400    -> standard select\n"
                   "hf 14b raw -ck --sr  --data 0200a40400    -> SRx select\n"
                   "hf 14b raw -ck --cts --data 0200a40400    -> C-ticket select\n"
diff --git a/client/src/fileutils.c b/client/src/fileutils.c
index 4d607b9df..23444d62b 100644
--- a/client/src/fileutils.c
+++ b/client/src/fileutils.c
@@ -195,8 +195,8 @@ bool create_path(const char *dirname) {
     return true;
 }
 */
-/*
-bool setDefaultPath (savePaths_t pathIndex,const char *Path) {
+
+bool setDefaultPath (savePaths_t pathIndex, const char *Path) {
 
     if (pathIndex < spItemCount) {
         if ((Path == NULL) && (session.defaultPaths[pathIndex] != NULL)) {
@@ -208,13 +208,11 @@ bool setDefaultPath (savePaths_t pathIndex,const char *Path) {
             session.defaultPaths[pathIndex] = (char *)realloc(session.defaultPaths[pathIndex], strlen(Path) + 1);
             strcpy(session.defaultPaths[pathIndex], Path);
         }
-    } else {
-        return false;
+        return true;
     }
-
-    return true;
+    return false;
 }
-*/
+
 static char *filenamemcopy(const char *preferredName, const char *suffix) {
     if (preferredName == NULL) return NULL;
     if (suffix == NULL) return NULL;
diff --git a/client/src/fileutils.h b/client/src/fileutils.h
index e307a2492..587e48ec6 100644
--- a/client/src/fileutils.h
+++ b/client/src/fileutils.h
@@ -78,7 +78,7 @@ typedef enum {
 
 int fileExists(const char *filename);
 //bool create_path(const char *dirname);
-//bool setDefaultPath (savePaths_t pathIndex,const char *Path);  // set a path in the path list session.defaultPaths
+bool setDefaultPath (savePaths_t pathIndex,const char *Path);  // set a path in the path list session.defaultPaths
 
 char *newfilenamemcopy(const char *preferredName, const char *suffix);
 
diff --git a/client/src/preferences.c b/client/src/preferences.c
index 9ae4f08a0..6a3207cd4 100644
--- a/client/src/preferences.c
+++ b/client/src/preferences.c
@@ -55,29 +55,27 @@ int preferences_load(void) {
     session.show_hints = true;
 
     session.bar_mode = STYLE_VALUE;
-//    setDefaultPath (spDefault, "");
-//    setDefaultPath (spDump, "");
-//    setDefaultPath (spTrace, "");
+    setDefaultPath (spDefault, "");
+    setDefaultPath (spDump, "");
+    setDefaultPath (spTrace, "");
 
-    /*
-        // default save path
-        if (get_my_user_directory() != NULL) // should return path to .proxmark3 folder
-            setDefaultPath (spDefault, get_my_user_directory());
-        else
-            setDefaultPath (spDefault, ".");
+    // default save path
+    if (get_my_user_directory() != NULL) // should return path to .proxmark3 folder
+        setDefaultPath (spDefault, get_my_user_directory());
+    else
+        setDefaultPath (spDefault, ".");
 
-        // default dump path
-        if (get_my_user_directory() != NULL) // should return path to .proxmark3 folder
-            setDefaultPath (spDump, get_my_user_directory());
-        else
-            setDefaultPath (spDump, ".");
+    // default dump path
+    if (get_my_user_directory() != NULL) // should return path to .proxmark3 folder
+        setDefaultPath (spDump, get_my_user_directory());
+    else
+        setDefaultPath (spDump, ".");
 
-        // default dump path
-        if (get_my_user_directory() != NULL) // should return path to .proxmark3 folder
-            setDefaultPath (spTrace, get_my_user_directory());
-        else
-            setDefaultPath (spTrace, ".");
-    */
+    // default dump path
+    if (get_my_user_directory() != NULL) // should return path to .proxmark3 folder
+        setDefaultPath (spTrace, get_my_user_directory());
+    else
+        setDefaultPath (spTrace, ".");
 
     if (session.incognito) {
         PrintAndLogEx(INFO, "No preferences file will be loaded");
@@ -179,9 +177,9 @@ void preferences_save_callback(json_t *root) {
 
     JsonSaveBoolean(root, "os.supports.colors", session.supports_colors);
 
-//   JsonSaveStr(root, "file.default.savepath", session.defaultPaths[spDefault]);
-//   JsonSaveStr(root, "file.default.dumppath", session.defaultPaths[spDump]);
-//   JsonSaveStr(root, "file.default.tracepath", session.defaultPaths[spTrace]);
+   JsonSaveStr(root, "file.default.savepath", session.defaultPaths[spDefault]);
+   JsonSaveStr(root, "file.default.dumppath", session.defaultPaths[spDump]);
+   JsonSaveStr(root, "file.default.tracepath", session.defaultPaths[spTrace]);
 
     // Plot window
     JsonSaveInt(root, "window.plot.xpos", session.plot.x);
@@ -246,7 +244,6 @@ void preferences_save_callback(json_t *root) {
         }
     */
 }
-
 void preferences_load_callback(json_t *root) {
     json_error_t up_error = {0};
     int b1;
@@ -262,19 +259,19 @@ void preferences_load_callback(json_t *root) {
         if (strncmp(tempStr, "simple", 6) == 0) session.client_debug_level = cdbSIMPLE;
         if (strncmp(tempStr, "full", 4) == 0) session.client_debug_level = cdbFULL;
     }
-    /*
-        // default save path
-        if (json_unpack_ex(root, &up_error, 0, "{s:s}", "file.default.savepath", &s1) == 0)
-            setDefaultPath (spDefault,s1);
 
-        // default dump path
-        if (json_unpack_ex(root, &up_error, 0, "{s:s}", "file.default.dumppath", &s1) == 0)
-            setDefaultPath (spDump,s1);
+    // default save path
+    if (json_unpack_ex(root, &up_error, 0, "{s:s}", "file.default.savepath", &s1) == 0)
+        setDefaultPath (spDefault, s1);
+
+    // default dump path
+    if (json_unpack_ex(root, &up_error, 0, "{s:s}", "file.default.dumppath", &s1) == 0)
+        setDefaultPath (spDump, s1);
+
+    // default trace path
+    if (json_unpack_ex(root, &up_error, 0, "{s:s}", "file.default.tracepath", &s1) == 0)
+        setDefaultPath (spTrace, s1);
 
-        // default trace path
-        if (json_unpack_ex(root, &up_error, 0, "{s:s}", "file.default.tracepath", &s1) == 0)
-            setDefaultPath (spTrace,s1);
-    */
     // window plot
     if (json_unpack_ex(root, &up_error, 0, "{s:i}", "window.plot.xpos", &i1) == 0)
         session.plot.x = i1;
@@ -338,37 +335,6 @@ void preferences_load_callback(json_t *root) {
 
 // Help Functions
 
-
-/*
-static int usage_set_devicedebug(void) {
-    PrintAndLogEx(NORMAL, "Usage: pref set devicedebug <off | error | info | debug | extended>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("help")"        - This help");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("off")"         - no debug messages");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("error")"       - error messages");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("info")"        - info messages");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("debug")"       - debug messages");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("extended")"    - extended debug messages");
-
-    return PM3_SUCCESS;
-}
-*/
-
-
-
-/*
-static int usage_set_savePaths(void) {
-    PrintAndLogEx(NORMAL, "Usage: pref set savepaths [help] [create] [default <path>] [dump <path>] [trace <path>]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("help")"        - This help");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("create")"      - Create directory if it does not exist");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("default")"     - Deafult path");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("dump")"        - Dump path");
-    PrintAndLogEx(NORMAL, "     "_GREEN_("trace")"       - Trace help");
-
-    return PM3_SUCCESS;
-}
-*/
 // Preference Processing Functions
 // typedef enum preferenceId {prefNONE,prefHELP,prefEMOJI,prefCOLOR,prefPLOT,prefOVERLAY,prefHINTS,prefCLIENTDEBUG} preferenceId_t;
 typedef enum prefShowOpt {prefShowNone, prefShowOLD, prefShowNEW} prefShowOpt_t;
@@ -452,40 +418,56 @@ static void showDeviceDebugState(prefShowOpt_t opt) {
     }
 }
 */
-/*
-static void showSavePathState(savePaths_t pathIndex, prefShowOpt_t opt) {
 
-    char tempStr[50];
+static void showSavePathState(savePaths_t path_index, prefShowOpt_t opt) {
 
-    switch (pathIndex) {
+    char s[50];
+    switch (path_index) {
         case spDefault:
-            strcpy (tempStr,"default save path......");
+            strcpy (s, "default save path......");
             break;
         case spDump:
-            strcpy (tempStr,"dump save path.........");
+            strcpy (s, "dump save path.........");
             break;
         case spTrace:
-            strcpy (tempStr,"trace save path........");
+            strcpy (s, "trace save path........");
             break;
+        case spItemCount:
         default:
-            strcpy (tempStr,_RED_("unknown")" save path......");
+            strcpy (s, _RED_("unknown")" save path......");
+    }
+
+    if ((session.defaultPaths[path_index] == NULL) || (strcmp(session.defaultPaths[path_index], "") == 0)) {
+        PrintAndLogEx(INFO, "   %s %s "_WHITE_("not set"),
+            prefShowMsg(opt),
+            s
+        );
+    } else {
+        PrintAndLogEx(INFO, "   %s %s "_GREEN_("%s"),
+            prefShowMsg(opt),
+            s,
+            session.defaultPaths[path_index]
+        );
     }
-    if ((session.defaultPaths[pathIndex] == NULL) || (strcmp(session.defaultPaths[pathIndex],"") == 0))
-        PrintAndLogEx(INFO, "   %s %s "_WHITE_("not set"), prefShowMsg(opt),tempStr);
-    else
-        PrintAndLogEx(INFO, "   %s %s "_GREEN_("%s"), prefShowMsg(opt), tempStr, session.defaultPaths[pathIndex]);
 }
 
 static void showPlotPosState(void) {
     PrintAndLogEx(INFO, "    Plot window............ X "_GREEN_("%4d")" Y "_GREEN_("%4d")" H "_GREEN_("%4d")" W "_GREEN_("%4d"),
-                  session.plot.x, session.plot.y, session.plot.h, session.plot.w);
+        session.plot.x,
+        session.plot.y,
+        session.plot.h,
+        session.plot.w
+    );
 }
 
 static void showOverlayPosState(void) {
     PrintAndLogEx(INFO, "    Slider/Overlay window.. X "_GREEN_("%4d")" Y "_GREEN_("%4d")" H "_GREEN_("%4d")" W "_GREEN_("%4d"),
-                  session.overlay.x, session.overlay.y, session.overlay.h, session.overlay.w);
+        session.overlay.x,
+        session.overlay.y,
+        session.overlay.h,
+        session.overlay.w
+    );
 }
-*/
 
 static void showHintsState(prefShowOpt_t opt) {
     if (session.show_hints)
@@ -668,70 +650,72 @@ static int setCmdDebug(const char *Cmd) {
 /*
 static int setCmdDeviceDebug (const char *Cmd)
 {
-    uint8_t cmdp = 0;
-    bool errors = false;
-    bool validValue = false;
-    char strOpt[50];
-    devicedebugLevel_t newValue = session.device_debug_level;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "pref set devicedebug ",
+                  "Set presistent preference of device side debug level",
+                  "pref set devicedebug --on"
+                 );
 
-    if (param_getchar(Cmd, cmdp) == 0x00)
-        return usage_set_devicedebug ();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0(NULL, "off", "no debug messages"),
+        arg_lit0(NULL, "error", "error messages"),
+        arg_lit0(NULL, "info", "info messages"),
+        arg_lit0(NULL, "dbg", "debug messages"),
+        arg_lit0(NULL, "ext", "extended debug messages"),        
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool use_off = arg_get_lit(ctx, 1);
+    bool use_err = arg_get_lit(ctx, 2);
+    bool use_info = arg_get_lit(ctx, 3);
+    bool use_dbg = arg_get_lit(ctx, 4);
+    bool use_ext = arg_get_lit(ctx, 5);
+    CLIParserFree(ctx);
 
-    while ((param_getchar(Cmd, cmdp) != 0x00) && !errors) {
-
-        if (param_getstr(Cmd, cmdp++, strOpt, sizeof(strOpt)) != 0) {
-            str_lower(strOpt); // convert to lowercase
-
-            if (strncmp (strOpt,"help",4) == 0)
-                return usage_set_devicedebug();
-            if (strncmp (strOpt,"off",3) == 0) {
-                validValue = true;
-                newValue = ddbOFF;
-            }
-            if (strncmp (strOpt,"error",5) == 0) {
-                validValue = true;
-                newValue = ddbERROR;
-            }
-            if (strncmp (strOpt,"info",4) == 0) {
-                validValue = true;
-                newValue = ddbINFO;
-            }
-            if (strncmp (strOpt,"debug",5) == 0) {
-                validValue = true;
-                newValue = ddbDEBUG;
-            }
-            if (strncmp (strOpt,"extended",8) == 0) {
-                validValue = true;
-                newValue = ddbEXTENDED;
-            }
-
-            if (validValue) {
-                if (session.device_debug_level != newValue) {// changed
-                    showDeviceDebugState (prefShowOLD);
-                    session.device_debug_level = newValue;
-                    showDeviceDebugState (prefShowNEW);
-                    preferences_save();
-                } else {
-                    PrintAndLogEx(INFO,"nothing changed");
-                    showDeviceDebugState (prefShowNone);
-                }
-                if (session.pm3_present) {
-                    PrintAndLogEx (INFO,"setting device debug loglevel");
-                    SendCommandNG(CMD_SET_DBGMODE, &session.device_debug_level, 1);
-                    PacketResponseNG resp;
-                    if (WaitForResponseTimeout(CMD_SET_DBGMODE, &resp, 2000) == false)
-                        PrintAndLogEx (INFO,"failed to set device debug loglevel");
-                }
-            } else {
-                PrintAndLogEx(ERR,"invalid option");
-                return usage_set_devicedebug();
-            }
-        }
+    if ( (use_off + use_err + use_info + use_dbg + use_ext) > 1) {
+        PrintAndLogEx(FAILED, "Can only set one option");
+        return PM3_EINVARG;
     }
 
+    devicedebugLevel_t new_value = session.device_debug_level;
+
+    if (use_off) {
+        new_value = ddbOFF;
+    }
+    if (use_err) {
+        new_value = ddbERROR;
+    }
+    if (use_info) {
+        new_value = ddbINFO;
+    }
+    if (use_dbg) {
+        new_value = ddbDEBUG;
+    }
+    if (use_ext) {
+        new_value = ddbEXTENDED;
+    }
+
+    if (session.device_debug_level != new_value) {// changed
+        showDeviceDebugState (prefShowOLD);
+        session.device_debug_level = new_value;
+        showDeviceDebugState (prefShowNEW);
+        preferences_save();
+    } else {
+        showDeviceDebugState (prefShowNone);
+    }
+
+    if (session.pm3_present) {
+        PrintAndLogEx (INFO,"setting device debug loglevel");
+        SendCommandNG(CMD_SET_DBGMODE, &session.device_debug_level, 1);
+        PacketResponseNG resp;
+        if (WaitForResponseTimeout(CMD_SET_DBGMODE, &resp, 2000) == false)
+            PrintAndLogEx (WARNING,"failed to set device debug loglevel");
+    }
     return PM3_SUCCESS;
 }
 */
+
 static int setCmdHint(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "pref set hints ",
@@ -774,6 +758,7 @@ static int setCmdHint(const char *Cmd) {
 
     return PM3_SUCCESS;
 }
+
 static int setCmdPlotSliders(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "pref set plotsliders ",
@@ -816,97 +801,87 @@ static int setCmdPlotSliders(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
-/*
 static int setCmdSavePaths (const char *Cmd) {
-    uint8_t cmdp = 0;
-    bool errors = false;
-    // bool validValue = false;
-    char *strOpt = NULL;
-    int  optLen = 0;
-    char *newValue = NULL;
-    bool createDir = false;
-    savePaths_t pathItem = spItemCount;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "pref set savepath",
+                  "Set presistent preference of file paths in the client",
+                  "pref set savepaths --dump /home/mydumpfolder      -> all dump files will be saved into this folder\n"
+                  "pref set savepaths --def /home/myfolder -c    -> create if needed, all files will be saved into this folder"
+                 );
 
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0("c", "create", "create directory if it does not exist"),
+        arg_str0(NULL, "def", "<path>", "default path"),
+        arg_str0(NULL, "dump", "<path>", "dump file path"),
+        arg_str0(NULL, "trace", "<path>", "trace path"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool create_dir = arg_get_lit(ctx, 1);
 
-    if (param_getchar(Cmd, cmdp) == 0x00)
-        return usage_set_savePaths();
+    int deflen = 0;
+    char def_path[FILE_PATH_SIZE] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 2), (uint8_t *)def_path, FILE_PATH_SIZE, &deflen);
 
-    while ((param_getchar(Cmd, cmdp) != 0x00) && !errors) {
+    int dulen = 0;
+    char dump_path[FILE_PATH_SIZE] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 3), (uint8_t *)dump_path, FILE_PATH_SIZE, &dulen);
 
-        optLen = param_getlength(Cmd, cmdp)+1;
-        strOpt = (char *)realloc(strOpt,optLen+1);//, sizeof(uint8_t));
+    int tlen = 0;
+    char trace_path[FILE_PATH_SIZE] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 4), (uint8_t *)trace_path, FILE_PATH_SIZE, &tlen);
+    CLIParserFree(ctx);
 
-        if (param_getstr(Cmd, cmdp++, strOpt, optLen) != 0) {
-            str_lower(strOpt); // convert to lowercase
+    if (deflen == 0 && dulen == 0 && tlen == 0) {
+        PrintAndLogEx(FAILED, "Must give atleast one path");
+        return PM3_EINVARG;
+    }
 
-            if (strncmp(strOpt, "help", 4) == 0)
-                return usage_set_savePaths();
+    savePaths_t path_item = spItemCount;
+    char *path = NULL;
+    if (deflen) {
+        path_item = spDefault;
+        path = def_path;
+    }
+    if (dulen) {
+        path_item = spDump;
+        path = dump_path;
+    }
+    if (tlen) {
+        path_item = spTrace;
+        path = trace_path;
+    }
 
-            if (strncmp(strOpt, "create", 6) == 0) {
-                // check if 2 more options.
-                if (param_getlength(Cmd, cmdp+1) == 0) // should have min 2 more options
-                    return usage_set_savePaths();
-                createDir = true;
-            } else {
-                if ((strncmp(strOpt, "default", 7) == 0) ||
-                    (strncmp(strOpt, "dump", 4) == 0) ||
-                    (strncmp(strOpt, "trace", 5) == 0)) {
+    // remove trailing slash.
+    size_t nplen = strlen(path);
+    if ((path[nplen - 1] == '/') || (path[nplen - 1] == '\\')) {
+        path[nplen - 1] = 0x00;
+    }
 
-                    // Get Path
-                    optLen = param_getlength(Cmd, cmdp) + 1;
-                    newValue = (char *)realloc(newValue, optLen+1);
-                    if (param_getstr(Cmd, cmdp++, newValue, optLen) == 0) {
-                        PrintAndLogEx(INFO, "missing %s path",strOpt);
-                        return usage_set_savePaths();
-                    }
-                    // remove trailing slash.
-                    if ((newValue[strlen(newValue)-1] == '/') || (newValue[strlen(newValue)-1] == '\\'))
-                        newValue[strlen(newValue)-1] = 0x00;
+    // Check path
+    if (fileExists(path) == false && create_dir == false) {
+        PrintAndLogEx(ERR,"path does not exist... "_RED_("%s"), path);
+    } 
 
-                    // Check path
-                    if (!fileExists(newValue) && !createDir) {
-                        PrintAndLogEx(ERR,"path does not exist... "_RED_("%s"),newValue);
-                    } else {
-                        // do we need to create it
-                    //    if (!fileExists(newValue))
-                    //        create_path (newValue); //mkdir (newValue,0x777);
+    // do we need to create it
+    //    if (!fileExists(newValue))
+    //        create_path (newValue); //mkdir (newValue,0x777);
 
-                        pathItem = spItemCount;
-                        if (strncmp(strOpt, "default", 7) == 0) pathItem = spDefault;
-                        if (strncmp(strOpt, "dump", 4) == 0) pathItem = spDump;
-                        if (strncmp(strOpt, "trace", 5) == 0) pathItem = spTrace;
-
-                        if (pathItem < spItemCount) {
-                            if (strcmp(newValue, session.defaultPaths[pathItem]) != 0) {
-                                showSavePathState(pathItem, prefShowOLD);
-                                setDefaultPath (pathItem, newValue);
-                                showSavePathState(pathItem, prefShowNEW);
-                                preferences_save();
-                            } else {
-                                PrintAndLogEx(INFO, "nothing changed");
-                                showSavePathState(pathItem, prefShowNone);
-                            }
-                        }
-                    }
-                } else {
-                    return usage_set_savePaths();
-                }
-            }
+    if (path_item < spItemCount) {
+        if (strcmp(path, session.defaultPaths[path_item]) != 0) {
+            showSavePathState(path_item, prefShowOLD);
+            setDefaultPath (path_item, path);
+            showSavePathState(path_item, prefShowNEW);
+            preferences_save();
+        } else {
+            showSavePathState(path_item, prefShowNone);
         }
     }
 
-    // clean up
-    if (strOpt != NULL) free (strOpt);
-    if (newValue != NULL) free (newValue);
-
     return PM3_SUCCESS;
 }
 
-static int getCmdHelp(const char *Cmd) {
-    return PM3_SUCCESS;
-}
-*/
-
 static int setCmdBarMode(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "pref set barmode",
@@ -984,13 +959,18 @@ static int getCmdBarMode(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
+static int getCmdSavePaths(const char *Cmd) {
+    showSavePathState(spDefault, prefShowNone);
+    showSavePathState(spDump, prefShowNone);
+    showSavePathState(spTrace, prefShowNone);
+    return PM3_SUCCESS;
+}
 
 static command_t CommandTableGet[] = {
-//     {"help",             getCmdHelp,          AlwaysAvailable, "This help"},
     {"barmode",          getCmdBarMode,       AlwaysAvailable, "Get bar mode preference"},
     {"clientdebug",      getCmdDebug,         AlwaysAvailable, "Get client debug level preference"},
     {"color",            getCmdColor,         AlwaysAvailable, "Get color support preference"},
-    //  {"defaultsavepaths", getCmdSavePaths,     AlwaysAvailable, "... to be adjusted next ... "},
+    {"savepaths",        getCmdSavePaths,     AlwaysAvailable, "Get file folder  "},
     //  {"devicedebug",      getCmdDeviceDebug,   AlwaysAvailable, "Get device debug level"},
     {"emoji",            getCmdEmoji,         AlwaysAvailable, "Get emoji display preference"},
     {"hints",            getCmdHint,          AlwaysAvailable, "Get hint display preference"},
@@ -1005,7 +985,7 @@ static command_t CommandTableSet[] = {
     {"color",            setCmdColor,         AlwaysAvailable, "Set color support"},
     {"emoji",            setCmdEmoji,         AlwaysAvailable, "Set emoji display"},
     {"hints",            setCmdHint,          AlwaysAvailable, "Set hint display"},
-    //  {"defaultsavepaths", setCmdSavePaths,     AlwaysAvailable, "... to be adjusted next ... "},
+    {"savepaths",        setCmdSavePaths,     AlwaysAvailable, "... to be adjusted next ... "},
     //  {"devicedebug",      setCmdDeviceDebug,   AlwaysAvailable, "Set device debug level"},
     {"plotsliders", setCmdPlotSliders,         AlwaysAvailable, "Set plot slider display"},
     {NULL, NULL, NULL, NULL}
@@ -1042,11 +1022,11 @@ static int CmdPrefShow(const char *Cmd) {
     showEmojiState(prefShowNone);
     showHintsState(prefShowNone);
     showColorState(prefShowNone);
-    // showPlotPosState ();
-    // showOverlayPosState ();
-    //  showSavePathState(spDefault, prefShowNone);
-    //  showSavePathState(spDump, prefShowNone);
-    //  showSavePathState(spTrace, prefShowNone);
+    showPlotPosState();
+    showOverlayPosState();
+    showSavePathState(spDefault, prefShowNone);
+    showSavePathState(spDump, prefShowNone);
+    showSavePathState(spTrace, prefShowNone);
     showClientDebugState(prefShowNone);
     showPlotSliderState(prefShowNone);
 //    showDeviceDebugState(prefShowNone);
diff --git a/client/src/ui.h b/client/src/ui.h
index db8ac99ce..632a818d3 100644
--- a/client/src/ui.h
+++ b/client/src/ui.h
@@ -27,7 +27,7 @@ typedef enum logLevel {NORMAL, SUCCESS, INFO, FAILED, WARNING, ERR, DEBUG, INPLA
 typedef enum emojiMode {EMO_ALIAS, EMO_EMOJI, EMO_ALTTEXT, EMO_NONE} emojiMode_t;
 typedef enum clientdebugLevel {cdbOFF, cdbSIMPLE, cdbFULL} clientdebugLevel_t;
 // typedef enum devicedebugLevel {ddbOFF, ddbERROR, ddbINFO, ddbDEBUG, ddbEXTENDED} devicedebugLevel_t;
-//typedef enum savePaths {spDefault, spDump, spTrace, spItemCount} savePaths_t; // last item spItemCount used to auto map to number of files
+typedef enum savePaths {spDefault, spDump, spTrace, spItemCount} savePaths_t; // last item spItemCount used to auto map to number of files
 typedef struct {int x; int y; int h; int w;} qtWindow_t;
 
 typedef struct {
@@ -44,7 +44,7 @@ typedef struct {
     qtWindow_t overlay;
     bool overlay_sliders;
     bool incognito;
-//    char *defaultPaths[spItemCount]; // Array should allow loop searching for files
+    char *defaultPaths[spItemCount]; // Array should allow loop searching for files
     clientdebugLevel_t client_debug_level;
     barMode_t bar_mode;
 //    uint8_t device_debug_level;

From 005079b91ffd02a7846eb2f86d22eb52c020eeb9 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 9 Jan 2021 22:45:17 +0100
Subject: [PATCH 335/682] lf hitag info, sniff - now uses cliparser

---
 client/src/cmdlfhitag.c | 60 ++++++++++++++++++++---------------------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/client/src/cmdlfhitag.c b/client/src/cmdlfhitag.c
index 8457b7bce..b98d83705 100644
--- a/client/src/cmdlfhitag.c
+++ b/client/src/cmdlfhitag.c
@@ -7,18 +7,16 @@
 //-----------------------------------------------------------------------------
 // Low frequency Hitag support
 //-----------------------------------------------------------------------------
-
 #include "cmdlfhitag.h"
-
 #include <ctype.h>
-
-#include "cmdparser.h"    // command_t
+#include "cmdparser.h"   // command_t
 #include "comms.h"
 #include "cmdtrace.h"
 #include "commonutil.h"
 #include "hitag.h"
-#include "fileutils.h"  // savefile
-#include "protocols.h"  // defines
+#include "fileutils.h"   // savefile
+#include "protocols.h"   // defines
+#include "cliparser.h"
 
 static int CmdHelp(const char *Cmd);
 
@@ -52,17 +50,7 @@ static size_t nbytes(size_t nbits) {
     return (nbits / 8) + ((nbits % 8) > 0);
 }
 */
-static int usage_hitag_sniff(void) {
-    PrintAndLogEx(NORMAL, "Sniff traffic between Hitag reader and tag. Use " _YELLOW_("`lf hitag list`")" to view collected data.");
-    PrintAndLogEx(NORMAL, "Usage:   lf hitag sniff [h] ");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h             This help");
-//    PrintAndLogEx(NORMAL, "       p <pwd>       Password");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "         lf hitag sniff");
-    return PM3_SUCCESS;
-}
+
 static int usage_hitag_sim(void) {
     PrintAndLogEx(NORMAL, "Simulate " _YELLOW_("Hitag2 / HitagS")" transponder");
     PrintAndLogEx(NORMAL, "Usage:   lf hitag sim [h] [2|s] e|j|b <filename w/o extension>");
@@ -77,15 +65,6 @@ static int usage_hitag_sim(void) {
     PrintAndLogEx(NORMAL, "         lf hitag sim 2 b lf-hitag-dump");
     return PM3_SUCCESS;
 }
-static int usage_hitag_info(void) {
-    PrintAndLogEx(NORMAL, "Usage:   lf hitag info [h] p <pwd>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h          This help");
-    PrintAndLogEx(NORMAL, "       p <pwd>    password");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "         lf hitag info");
-    return PM3_SUCCESS;
-}
 /*
 static int usage_hitag_dump(void) {
     PrintAndLogEx(NORMAL, "Usage:   lf hitag dump [h] p <pwd> f <name>");
@@ -287,12 +266,23 @@ static int CmdLFHitagList(const char *Cmd) {
 }
 
 static int CmdLFHitagSniff(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf hitag sniff",
+                  "Sniff traffic between Hitag reader and tag.\n"
+                  "Use " _YELLOW_("`lf hitag list`")" to view collected data.",
+                  "lf hitag sniff"
+                 );
 
-    char ctmp = tolower(param_getchar(Cmd, 0));
-    if (ctmp == 'h') return usage_hitag_sniff();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
 
     clearCommandBuffer();
     SendCommandNG(CMD_LF_HITAG_SNIFF, NULL, 0);
+    PrintAndLogEx(HINT, "HINT: Try " _YELLOW_("`lf hitag list`")" to view collected data");
     return PM3_SUCCESS;
 }
 
@@ -508,8 +498,18 @@ static bool getHitagUid(uint32_t *uid) {
 }
 
 static int CmdLFHitagInfo(const char *Cmd) {
-    char ctmp = tolower(param_getchar(Cmd, 0));
-    if (ctmp == 'h') return usage_hitag_info();
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf hitag info",
+                  "Sniff traffic between Hitag reader and tag.",
+                  "lf hitag info"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
 
     // read UID
     uint32_t uid = 0;

From 93c99e9f7a2e63538cd07568a650649bc8eff765 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 9 Jan 2021 22:47:04 +0100
Subject: [PATCH 336/682] lf hid clone - wip take binary string as input

---
 client/src/cmdlfhid.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/client/src/cmdlfhid.c b/client/src/cmdlfhid.c
index 108550539..46a8febbe 100644
--- a/client/src/cmdlfhid.c
+++ b/client/src/cmdlfhid.c
@@ -344,6 +344,7 @@ static int CmdHIDClone(const char *Cmd) {
         arg_strx0("r",  "raw",     "<hex>", "raw bytes"),
         arg_lit0(NULL, "q5", "optional - specify writing to Q5/T5555 tag"),
         arg_lit0(NULL, "em", "optional - specify writing to EM4305/4469 tag"),
+        arg_str0(NULL, "bin", "<bin>", "Binary string i.e 0001001001"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);
@@ -365,6 +366,12 @@ static int CmdHIDClone(const char *Cmd) {
 
     bool q5 = arg_get_lit(ctx, 7);
     bool em = arg_get_lit(ctx, 8);
+
+
+    int bin_len = 63;
+    uint8_t bin[70] = {0};
+    CLIGetStrWithReturn(ctx, 9, bin, &bin_len);
+
     CLIParserFree(ctx);
 
     if (q5 && em) {
@@ -372,6 +379,11 @@ static int CmdHIDClone(const char *Cmd) {
         return PM3_EINVARG;
     }
 
+    if (bin_len > 127) {
+        PrintAndLogEx(ERR, "Binary wiegand string must be less than 128 bits");
+        return PM3_EINVARG;
+    }
+
     wiegand_message_t packed;
     memset(&packed, 0, sizeof(wiegand_message_t));
 

From 12e80bb8a6a001fb404340c4fb2141b2ac8b4d09 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 9 Jan 2021 22:50:53 +0100
Subject: [PATCH 337/682] analyze freq - use cliparser,   foo - to play with
 fpga muxer data simulator (anticat)

---
 client/src/cmdanalyse.c | 103 ++++++++++++++++++++++++++++++++++++----
 1 file changed, 95 insertions(+), 8 deletions(-)

diff --git a/client/src/cmdanalyse.c b/client/src/cmdanalyse.c
index 54a2e5adc..3f860c4e6 100644
--- a/client/src/cmdanalyse.c
+++ b/client/src/cmdanalyse.c
@@ -12,7 +12,7 @@
 #include <stdlib.h>       // size_t
 #include <string.h>
 #include <ctype.h>        // tolower
-//#include <stdio.h>        // printf
+#include <math.h>
 #include "commonutil.h"   // reflect...
 #include "comms.h"        // clearCommandBuffer
 #include "cmdparser.h"    // command_t
@@ -944,28 +944,114 @@ static int CmdAnalyseDemodBuffer(const char *Cmd) {
 
         PrintAndLogEx(NORMAL, "%c" NOLF, c);
     }
-
     PrintAndLogEx(NORMAL, "");
-
     DemodBufferLen = len;
     free(data);
+    PrintAndLogEx(HINT, "Use `" _YELLOW_("data print") "` to view demod buffer");
     return PM3_SUCCESS;
 }
 
 static int CmdAnalyseFreq(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "analyse freq",
+                  "calc wave lengths",
+                  "analyse freq"
+                 );
 
-//    char cmdp = tolower(param_getchar(Cmd, 0));
-//    if (strlen(Cmd) == 0 || cmdp == 'h') return usage_analyse_freq();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
 
     const double c = 299792458;
     double len_125 = c / 125000;
     double len_134 = c / 134000;
     double len_1356 = c / 13560000;
 
+    double rf_range_125 = len_125 / (M_PI * 2);
+    double rf_range_134 = len_134 / (M_PI * 2);
+    double rf_range_1356 = len_1356 / (M_PI * 2);
+
     PrintAndLogEx(INFO, "Wavelengths");
-    PrintAndLogEx(INFO, "   125 kHz has %f meters", len_125);
-    PrintAndLogEx(INFO, "   134 kHz has %f meters", len_134);
-    PrintAndLogEx(INFO, " 13.56 mHz has %f meters", len_1356);
+    PrintAndLogEx(INFO, "   125 kHz has %f m, rf range %f m", len_125, rf_range_125);
+    PrintAndLogEx(INFO, "   134 kHz has %f m, rf range %f m", len_134, rf_range_134);
+    PrintAndLogEx(INFO, " 13.56 mHz has %f m, rf range %f m", len_1356, rf_range_1356);
+    return PM3_SUCCESS;
+}
+
+static int CmdAnalyseFoo(const char *Cmd) {
+
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "analyze foo",
+                  "experiments of cliparse",
+                  "analyse foo -r a0000000a0002021"
+                  );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_strx0("r", "raw",  "<hex>", "raw bytes (strx)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+
+    // raw param
+    int datalen = 256;
+    uint8_t data[256];
+    CLIGetHexWithReturn(ctx, 1, data, &datalen);
+
+    int data3len = 512;    
+    uint8_t data3[512];    
+    CLIGetStrWithReturn(ctx, 1, data3, &data3len);
+
+    CLIParserFree(ctx);
+
+    PrintAndLogEx(INFO, "-r");
+    PrintAndLogEx(INFO, "Got:  %s", sprint_hex_inrow(data, datalen));
+    PrintAndLogEx(INFO, "Got:  %s", data3);
+    
+    ClearGraph(false);
+    GraphTraceLen = 15000;
+
+    for (int i = 0; i < 4095; i++) {
+        int o = 0;
+
+        // 0010 0000
+        if (i & 0x2000) o |= 0x80;    // corr_i_accum[13]
+        // 0001 1100
+        if (i & 0x1C00) o |= 0x40;    // corr_i_accum[12] | corr_i_accum[11] | corr_i_accum[10]
+        // 0000 1110
+        if (i & 0x0E00) o |= 0x20;    // corr_i_accum[12] | corr_i_accum[11] | corr_i_accum[9],
+        o |= (i & 0x1F0) >> 4;        // corr_i_accum[8:4]
+
+        GraphBuffer[i] = o;
+    }
+
+    for (int i = 0; i < 4095; i++) {
+        int o = 0;
+
+        // Send 8 bits of in phase tag signal
+        //if (corr_i_accum[13:11] == 3'b000 || corr_i_accum[13:11] == 3'b111)
+        if ((i & 0x3800) == 0 || (i & 0x3800) == 0x3800) {
+            o |= (i & 0xFF0) >> 4;   // corr_i_out <= corr_i_accum[11:4];
+        } else {
+            // truncate to maximum value
+            //if (corr_i_accum[13] == 1'b0)
+            if ((i & 0x2000) == 0) {
+                o |= 0x7f;     //  corr_i_out <= 8'b01111111;
+            }
+        }
+        GraphBuffer[i + 5000] = o;
+    }
+
+    for (int i = 0; i < 4095; i++) {
+        int o = i >> 5;
+        GraphBuffer[i + 10000] = o;
+    }
+
+    RepaintGraphWindow();
+    ShowGraphWindow();
     return PM3_SUCCESS;
 }
 
@@ -981,6 +1067,7 @@ static command_t CommandTable[] = {
     {"nuid",    CmdAnalyseNuid,     AlwaysAvailable, "create NUID from 7byte UID"},
     {"demodbuff", CmdAnalyseDemodBuffer, AlwaysAvailable, "Load binary string to demodbuffer"},
     {"freq",    CmdAnalyseFreq,     AlwaysAvailable, "Calc wave lengths"},
+    {"foo",    CmdAnalyseFoo,     AlwaysAvailable, "muxer"},
     {NULL, NULL, NULL, NULL}
 };
 

From 714bee0cf519ef8960a677d3f8fafe1ae5eb1180 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sun, 10 Jan 2021 00:35:40 +0100
Subject: [PATCH 338/682] text

---
 doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md b/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
index 7b4ae12d4..61ad2d9d8 100644
--- a/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
+++ b/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
@@ -136,7 +136,7 @@ So for example, at the time of writing, this is a valid `Makefile.platform` comp
 PLATFORM=PM3OTHER
 PLATFORM_SIZE=256
 STANDALONE=
-SKIP_LEGICRF=1
+SKIP_HITAG=1
 SKIP_FELICA=1
 ```
 Situation might change when the firmware is growing of course, requiring to skip more elements.

From b60daea57057805f2b0abd47ae84d65f7e818cf2 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sun, 10 Jan 2021 12:52:57 +0100
Subject: [PATCH 339/682] lf t55xx sniff - now uses cliparser

---
 client/src/cmdlft55xx.c | 179 +++++++++++++++++++---------------------
 1 file changed, 83 insertions(+), 96 deletions(-)

diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index d67770ba3..5ef0bed28 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -13,10 +13,8 @@
 #endif
 
 #include "cmdlft55xx.h"
-
 #include <ctype.h>
-#include <time.h> // MingW
-
+#include <time.h>         // MingW
 #include "cmdparser.h"    // command_t
 #include "comms.h"
 #include "commonutil.h"
@@ -25,11 +23,12 @@
 #include "graph.h"
 #include "cmddata.h"
 #include "lfdemod.h"
-#include "cmdhf14a.h"   // for getTagInfo
-#include "fileutils.h"  // loadDictionary
+#include "cmdhf14a.h"     // for getTagInfo
+#include "fileutils.h"    // loadDictionary
 #include "util_posix.h"
-#include "cmdlf.h"      // for lf sniff
+#include "cmdlf.h"        // for lf sniff
 #include "generator.h"
+#include "cliparser.h"    // cliparsing
 
 // Some defines for readability
 #define T55XX_DLMODE_FIXED         0 // Default Mode
@@ -406,22 +405,7 @@ static int usage_t55xx_clonehelp(void) {
     PrintAndLogEx(NORMAL, _GREEN_("lf visa2000 clone"));
     return PM3_SUCCESS;
 }
-static int usage_t55xx_sniff(void) {
-    PrintAndLogEx(NORMAL, "Usage:  lf t55xx sniff [w <width 0> <width 1>] [l <min level>] [s <level>] [t <level>] [1] [h]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     w <0> <1>       - Set samples width for 0 and 1 matching (default auto detect)");
-    //  PrintAndLogEx(NORMAL, "     s <level>       - Set minimum signal level (default 20)");
-    PrintAndLogEx(NORMAL, "     t <level>       - Set tolerance level (default 5).  lower means tighter");
-    PrintAndLogEx(NORMAL, "     1               - Extract from current sample buffer (default will get new samples)");
-    PrintAndLogEx(NORMAL, "     h               - This help");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf t55xx sniff"));
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf t55xx sniff 1 t 2"));
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf t55xx sniff w 7 14 1"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
+
 static int CmdHelp(const char *Cmd);
 
 static int CmdT55xxCloneHelp(const char *Cmd) {
@@ -3832,36 +3816,35 @@ static int CmdT55xxProtect(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
-// if the difference bettwen a and b is less then or eq to d  i.e. does a = b +/- d
-#define approxEq(a,b,d) ((abs(a-b) <= d) ? true : false)
+// if the difference between a and b is less then or eq to d  i.e. does a = b +/- d
+#define APPROX_EQ(a, b, d) ((abs(a - b) <= d) ? true : false)
 
-static uint8_t t55sniffGetPacket(int *pulseBuffer, char *data, uint8_t width0, uint8_t width1, uint8_t tolerance) {
+static uint8_t t55sniff_get_packet(int *pulseBuffer, char *data, uint8_t width0, uint8_t width1, uint8_t tolerance) {
     int i = 0;
     bool ok = true;
-    uint8_t dataLen = 0;
+    uint8_t len = 0;
 
     while (ok && (i < 73)) { // 70 bits max Fixed bit packet
-        if (approxEq(width0, pulseBuffer[i], tolerance))  {
-            data[dataLen++] = '0';
+        if (APPROX_EQ(width0, pulseBuffer[i], tolerance))  {
+            data[len++] = '0';
             i++;
             continue;
         }
-        if (approxEq(width1, pulseBuffer[i], tolerance)) {
-            data[dataLen++] = '1';
+        if (APPROX_EQ(width1, pulseBuffer[i], tolerance)) {
+            data[len++] = '1';
             i++;
             continue;
         }
 
         ok = false;
     }
-    data[dataLen] = 0x00;
-
-    return dataLen;
+    data[len] = 0x00;
+    return len;
 }
 
-static uint8_t t55sniffTrimSamples(int *pulseBuffer, int *pulseIdx, uint8_t len) {
-    for (uint8_t ii = 0; ii < (80 - len); ii++) {
-        pulseBuffer[ii] = pulseBuffer[ii + len];
+static uint8_t t55sniff_trim_samples(int *pulseBuffer, int *pulseIdx, uint8_t len) {
+    for (uint8_t i = 0; i < (80 - len); i++) {
+        pulseBuffer[i] = pulseBuffer[i + len];
     }
 
     *pulseIdx -= len;
@@ -3869,25 +3852,45 @@ static uint8_t t55sniffTrimSamples(int *pulseBuffer, int *pulseIdx, uint8_t len)
 }
 
 static int CmdT55xxSniff(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf t55xx sniff",
+                  "Sniff LF t55xx based trafic and decode possible cmd / blocks.\n"
+                  "Lower tolerance means tighter pulses. ",
+                  "lf t55xx sniff\n"
+                  "lf t55xx sniff -1 -t 2               -> use buffer with tolernace of 2\n"
+                  "lf t55xx sniff -1 --zero 7 --one 14  -> use buffer, zero pulse width 7,  one pulse width 15"
+                 );
 
-    bool sampleData = true;
-    bool haveData = false;
-    uint8_t cmdp = 0;
-    uint8_t width0 = 0, width1 = 0;
-    uint8_t tolerance = 5, page, blockAddr;
-    uint16_t dataLen = 0;
-    size_t idx = 0;
-    uint32_t usedPassword, blockData;
-    int pulseSamples = 0;
-    int pulseIdx = 0;
-    int minWidth = 1000;
-    int maxWidth = 0;
-    char modeText [100];
-    char pwdText  [100];
-    char dataText [100];
-    int pulseBuffer[80] = { 0 }; // max should be 73 +/- - Holds Pulse widths
-    char data[80]; //  linked to pulseBuffer. - Holds 0/1 from pulse widths
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0("1", NULL, "extract using data from graphbuffer"),
+        arg_int0("t", "tol", "<dec>", "set tolerance level (default 5)"),
+//        arg_int0(NULL, "signal", "<dec>", "set minimum signal level (default 20)"),
+        arg_int0("o", "one", "<dec>", "set samples width for ONE pulse (default auto)"),
+        arg_int0("z", "zero", "<dec>", "set samples width for ZERO pulse (default auto)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool use_graphbuf = arg_get_lit(ctx, 1);
+    uint8_t tolerance = arg_get_int_def(ctx, 2, 5);
+    uint8_t width1 = arg_get_int(ctx, 3);
+    uint8_t width0 = arg_get_int(ctx, 4);
+    CLIParserFree(ctx);
 
+    if (width0 && width1 == 0) {
+        PrintAndLogEx(ERR, _RED_("Missing sample width for ONE"));
+        return PM3_EINVARG;
+    }
+
+    if (width1 && width0 == 0) {
+        PrintAndLogEx(ERR, _RED_("Missing sample width for ZERO"));
+        return PM3_EINVARG;
+    }
+
+    if ((width0 == 0) || (width1 == 0)) {
+        PrintAndLogEx(ERR, "Must call with --one and --zero params");
+        return PM3_EINVARG;
+    }
 
     /*
         Notes:
@@ -3914,40 +3917,25 @@ static int CmdT55xxSniff(const char *Cmd) {
                     ----------------------------------------------------
                                                              00 01 10 11
     */
-    while (param_getchar(Cmd, cmdp) != 0x00) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_t55xx_sniff();
-            case '1':
-                sampleData = false;
-                cmdp ++;
-                break;
-            case 'w':
-                width0 = param_get8ex(Cmd, cmdp + 1, 0, 10);
-                width1 = param_get8ex(Cmd, cmdp + 2, 0, 10);
-                cmdp += 3;
-
-                if (width0 == 0) PrintAndLogEx(ERR, "need both sample widths!  "_RED_("Missing sample width for 0"));
-                if (width1 == 0) PrintAndLogEx(ERR, "need both sample widths!  "_RED_("Missing sample width for 1"));
-                if ((width0 == 0) || (width1 == 0)) {
-                    PrintAndLogEx(NORMAL, "");
-                    return usage_t55xx_sniff();
-                }
-                break;
-            case 't':
-                tolerance = param_get8ex(Cmd, cmdp + 1, 0, 10);
-                cmdp += 2;
-                break;
-            default:
-                cmdp++;
-                PrintAndLogEx(ERR, "Invalid options supplied!");
-                return usage_t55xx_sniff();
-        }
-    }
 
+    bool haveData = false;
+    uint8_t page, blockAddr;
+    uint16_t dataLen = 0;
+    size_t idx = 0;
+    uint32_t usedPassword, blockData;
+    int pulseSamples = 0;
+    int pulseIdx = 0;
+    int minWidth = 1000;
+    int maxWidth = 0;
+    char modeText [100];
+    char pwdText  [100];
+    char dataText [100];
+    int pulseBuffer[80] = { 0 }; // max should be 73 +/- - Holds Pulse widths
+    char data[80]; //  linked to pulseBuffer. - Holds 0/1 from pulse widths
+ 
     // setup and sample data from Proxmark
     // if not directed to existing sample/graphbuffer
-    if (sampleData) {
+    if (use_graphbuf == false) {
         CmdLFSniff("");
     }
 
@@ -3989,7 +3977,7 @@ static int CmdT55xxSniff(const char *Cmd) {
         if (pulseSamples > 0) {
             pulseBuffer[pulseIdx++] = pulseSamples;
             if (pulseIdx > 79) { // make room for next sample - if not used by now, it wont be.
-                t55sniffTrimSamples(pulseBuffer, &pulseIdx, 1);
+                t55sniff_trim_samples(pulseBuffer, &pulseIdx, 1);
             }
 
             // Check Samples for valid packets;
@@ -4004,7 +3992,7 @@ static int CmdT55xxSniff(const char *Cmd) {
                     maxWidth = pulseBuffer[1];
                     bool done = false;
 
-                    while ((!done) && (ii < pulseIdx) && ((maxWidth <= minWidth) || (approxEq(minWidth, maxWidth, tolerance)))) { // min should be 8, 16-32 more normal
+                    while ((!done) && (ii < pulseIdx) && ((maxWidth <= minWidth) || (APPROX_EQ(minWidth, maxWidth, tolerance)))) { // min should be 8, 16-32 more normal
                         if (pulseBuffer[ii] + 3 < minWidth) {
                             minWidth = pulseBuffer[ii];
                             done = true;
@@ -4034,14 +4022,14 @@ static int CmdT55xxSniff(const char *Cmd) {
             // Check first bit.
 
             // Long leading 0
-            if (haveData == false && (approxEq(pulseBuffer[0], 136 + minWidth, tolerance) && approxEq(pulseBuffer[1], maxWidth, tolerance))) {
+            if (haveData == false && (APPROX_EQ(pulseBuffer[0], 136 + minWidth, tolerance) && APPROX_EQ(pulseBuffer[1], maxWidth, tolerance))) {
                 // printf ("Long Leading 0 - not yet hanled | have 1 Fisrt bit | Min : %-3d - Max : %-3d : diff : %d\n",minWidth,maxWidth, maxWidth-minWidth);
                 continue;
             }
 
             // Fixed bit - Default
-            if (haveData == false && (approxEq(pulseBuffer[0], maxWidth, tolerance))) {
-                dataLen = t55sniffGetPacket(pulseBuffer, data, minWidth, maxWidth, tolerance);
+            if (haveData == false && (APPROX_EQ(pulseBuffer[0], maxWidth, tolerance))) {
+                dataLen = t55sniff_get_packet(pulseBuffer, data, minWidth, maxWidth, tolerance);
 
                 //   if ((dataLen == 39) )
                 //           printf ("Fixed | Data end of 80 samples | offset : %llu - datalen %-2d - data : %s  --- - Bit 0 width : %d\n",idx,dataLen,data,pulseBuffer[0]);
@@ -4053,7 +4041,7 @@ static int CmdT55xxSniff(const char *Cmd) {
 
                     // Default Read
                     if (dataLen == 6) {
-                        t55sniffTrimSamples(pulseBuffer, &pulseIdx, 4); // left 1 or 2 samples seemed to help
+                        t55sniff_trim_samples(pulseBuffer, &pulseIdx, 4); // left 1 or 2 samples seemed to help
 
                         page = data[1] - '0';
                         blockAddr = 0;
@@ -4069,7 +4057,7 @@ static int CmdT55xxSniff(const char *Cmd) {
 
                     // Password Write
                     if (dataLen == 70) {
-                        t55sniffTrimSamples(pulseBuffer, &pulseIdx, 70);
+                        t55sniff_trim_samples(pulseBuffer, &pulseIdx, 70);
 
                         page = data[1] - '0';
                         usedPassword = 0;
@@ -4099,7 +4087,7 @@ static int CmdT55xxSniff(const char *Cmd) {
 
                     // Default Write (or password read ??)
                     if (dataLen == 38) {
-                        t55sniffTrimSamples(pulseBuffer, &pulseIdx, 38);
+                        t55sniff_trim_samples(pulseBuffer, &pulseIdx, 38);
 
                         page = data[1] - '0';
                         usedPassword = 0;
@@ -4123,14 +4111,14 @@ static int CmdT55xxSniff(const char *Cmd) {
             }
 
             // Leading 0
-            if (haveData == false && (approxEq(pulseBuffer[0], minWidth, tolerance))) {
+            if (haveData == false && (APPROX_EQ(pulseBuffer[0], minWidth, tolerance))) {
                 // leading 0 (should = 0 width)
                 // 1 of 4 (leads with 00)
-                dataLen = t55sniffGetPacket(pulseBuffer, data, minWidth, maxWidth, tolerance);
+                dataLen = t55sniff_get_packet(pulseBuffer, data, minWidth, maxWidth, tolerance);
                 // **** Should check to 0 to be actual 0 as well i.e. 01 .... data ....
                 if ((data[0] == '0') && (data[1] == '1')) {
                     if (dataLen == 73) {
-                        t55sniffTrimSamples(pulseBuffer, &pulseIdx, 73);
+                        t55sniff_trim_samples(pulseBuffer, &pulseIdx, 73);
 
                         page = data[2] - '0';
                         usedPassword = 0;
@@ -4172,7 +4160,6 @@ static int CmdT55xxSniff(const char *Cmd) {
     // footer
     PrintAndLogEx(SUCCESS, "-----------------------------------------------------------------------------------------------------------------------------------------------------");
     PrintAndLogEx(NORMAL, "");
-
     return PM3_SUCCESS;
 }
 

From ae45e1d776f481926e8266b61078aaaaf4d988bd Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 11 Jan 2021 19:24:24 +0100
Subject: [PATCH 340/682] remove some of my personal setup

---
 .gitignore | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/.gitignore b/.gitignore
index 08b82452f..e451810ce 100644
--- a/.gitignore
+++ b/.gitignore
@@ -93,10 +93,6 @@ client/traces/*
 client/dumps/*
 *.ice
 *.new
-tools/mf_nonce_brute/mf_nonce_brute
-tools/andrew/*
-tools/jtag_openocd/openocd_configuration
-ppls patches/*
 *- Copy.*
 /EF_*
 
@@ -105,12 +101,13 @@ client/lualibs/pm3_cmd.lua
 # recompiled
 fpga_version_info.c
 
+# log / history
 .proxmark3/*
 
 # .tmp files are created during compilation
 *.tmp
 
-#VSCode files
+# VSCode files
 !.vscode/templates/*.json
 !.vscode/extensions.json
-!.vscode/tasks.json
\ No newline at end of file
+!.vscode/tasks.json

From af5237e6fdf5311f9e8c6732d5bae7cc452aa497 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Mon, 11 Jan 2021 21:23:38 +0100
Subject: [PATCH 341/682] changes due to desynchronization effects

---
 armsrc/em4x50.c | 259 ++++++++++++++++++++++++------------------------
 1 file changed, 132 insertions(+), 127 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index 262b4c6a6..cb9b26485 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -54,6 +54,7 @@
 #define EM4X50_COMMAND_WRITE                0x12
 #define EM4X50_COMMAND_WRITE_PASSWORD       0x11
 #define EM4X50_COMMAND_SELECTIVE_READ       0x0A
+#define EM4X50_COMMAND_STANDARD_READ        0x02 // virtual command
 
 int gHigh = 190;
 int gLow = 60;
@@ -68,8 +69,7 @@ int gcount = 0;
 int gcycles = 0;
 int rm = 0;
 
-static bool em4x50_sim_send_listen_window(uint32_t *tag);
-static void em4x50_sim_handle_command(uint8_t command, uint32_t *tag);
+static int em4x50_sim_send_listen_window(uint32_t *tag);
 
 void catch_samples(void);
 
@@ -786,7 +786,7 @@ static int wait_cycles(int maxperiods) {
             
             if (check == 1000) {
                 if (BUTTON_PRESS()) {
-                    malsehn(PM3_SUCCESS);
+                    return PM3_EOPABORTED;
                 }
                 check = 0;
             }
@@ -800,7 +800,7 @@ static int wait_cycles(int maxperiods) {
             
             if (check == 1000) {
                 if (BUTTON_PRESS()) {
-                    malsehn(PM3_SUCCESS);
+                    return PM3_EOPABORTED;
                 }
                 check = 0;
             }
@@ -818,16 +818,16 @@ static int get_cycles(void) {
     int cycles = 0;
 
     AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
-    while (AT91C_BASE_TC0->TC_CV < T0 * EM4X50_T_TAG_FULL_PERIOD) {
+    while (AT91C_BASE_TC0->TC_CV < T0 * (EM4X50_T_TAG_FULL_PERIOD - 2)) {
 
         while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
-        
+
         // check again to minimize desynchronization
         if (AT91C_BASE_TC0->TC_CV >= T0 * EM4X50_T_TAG_FULL_PERIOD)
             break;
-        
-        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK);
 
+        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK);
+        
         cycles++;
     }
 
@@ -890,9 +890,10 @@ static bool em4x50_sim_read_word(uint32_t *word) {
         }
     }
     
+    *word = BYTES2UINT32(bytes);
+    
     // check parities
     if ((parities == parities_calculated) && (stop_bit == 0)) {
-        *word = BYTES2UINT32(bytes);
         return true;
     }
     
@@ -948,59 +949,13 @@ static void em4x50_sim_send_nak(void) {
     OPEN_COIL();
 }
 
-/*
-static bool em4x50_sim_send_listen_window(void) {
-
-    uint16_t check = 0;
-
-    for (int t = 0; t < 5 * EM4X50_T_TAG_FULL_PERIOD; t++) {
-
-        // wait until SSC_CLK goes HIGH
-        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
-            WDT_HIT();
-            
-            if (check == 1000) {
-                if (BUTTON_PRESS())
-                    return false;
-                check = 0;
-            }
-            ++check;
-        }
-
-        if (t >= 4 * EM4X50_T_TAG_FULL_PERIOD)
-            SHORT_COIL();
-        else if (t >= 3 * EM4X50_T_TAG_FULL_PERIOD)
-            OPEN_COIL();
-        else if (t >= EM4X50_T_TAG_FULL_PERIOD)
-            SHORT_COIL();
-        else if (t >= EM4X50_T_TAG_HALF_PERIOD)
-            OPEN_COIL();
-        else
-            SHORT_COIL();
-
-        check = 0;
-
-        // wait until SSC_CLK goes LOW
-        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
-            WDT_HIT();
-            if (check == 1000) {
-                if (BUTTON_PRESS())
-                    return false;
-                check = 0;
-            }
-            ++check;
-        }
-    }
-    
-    return true;
-}
-*/
-
-static void em4x50_sim_handle_login_command(uint32_t *tag) {
+static int em4x50_sim_handle_login_command(uint32_t *tag) {
 
     // read password
     uint32_t password = 0;
     bool pwd_ok = em4x50_sim_read_word(&password);
+    //Dbprintf("address = %08x", address);
+    wait_cycles(15);
 
     // processing pause time (corresponds to a "1" bit)
     em4x50_sim_send_bit(1);
@@ -1017,10 +972,10 @@ static void em4x50_sim_handle_login_command(uint32_t *tag) {
     }
     
     // continue with standard read mode
-    em4x50_sim_handle_command(0, tag);
+    return EM4X50_COMMAND_STANDARD_READ;
 }
 
-static void em4x50_sim_handle_reset_command(uint32_t *tag) {
+static int em4x50_sim_handle_reset_command(uint32_t *tag) {
 
     // processing pause time (corresponds to a "1" bit)
     em4x50_sim_send_bit(1);
@@ -1033,10 +988,10 @@ static void em4x50_sim_handle_reset_command(uint32_t *tag) {
     wait_cycles(EM4X50_T_TAG_TINIT);
     
     // continue with standard read mode
-    em4x50_sim_handle_command(0, tag);
+    return EM4X50_COMMAND_STANDARD_READ;
 }
 
-static void em4x50_sim_handle_write_command(uint32_t *tag) {
+static int em4x50_sim_handle_write_command(uint32_t *tag) {
 
     // read address
     uint8_t address = 0;
@@ -1044,15 +999,15 @@ static void em4x50_sim_handle_write_command(uint32_t *tag) {
     // read data
     uint32_t data = 0;
     bool word_ok = em4x50_sim_read_word(&data);
-    
+        
     // write access time
     wait_cycles(EM4X50_T_TAG_TWA);
 
     if ((addr_ok == false) || (word_ok == false)) {
         em4x50_sim_send_nak();
-        em4x50_sim_handle_command(0, tag);
+        return EM4X50_COMMAND_STANDARD_READ;
     }
-    
+
     // extract necessary control data
     bool raw = (tag[EM4X50_CONTROL] >> CONFIG_BLOCK) & READ_AFTER_WRITE;
     // extract protection data:
@@ -1065,7 +1020,7 @@ static void em4x50_sim_handle_write_command(uint32_t *tag) {
 
         case EM4X50_DEVICE_PASSWORD:
             em4x50_sim_send_nak();
-            em4x50_sim_handle_command(0, tag);
+            return EM4X50_COMMAND_STANDARD_READ;
             break;
 
         case EM4X50_PROTECTION:
@@ -1074,7 +1029,7 @@ static void em4x50_sim_handle_write_command(uint32_t *tag) {
                 em4x50_sim_send_ack();
             } else {
                 em4x50_sim_send_nak();
-                em4x50_sim_handle_command(0, tag);
+                return EM4X50_COMMAND_STANDARD_READ;
             }
             break;
 
@@ -1084,24 +1039,24 @@ static void em4x50_sim_handle_write_command(uint32_t *tag) {
                 em4x50_sim_send_ack();
             } else {
                 em4x50_sim_send_nak();
-                em4x50_sim_handle_command(0, tag);
+                return EM4X50_COMMAND_STANDARD_READ;
             }
             break;
 
         case EM4X50_DEVICE_SERIAL:
             em4x50_sim_send_nak();
-            em4x50_sim_handle_command(0, tag);
+            return EM4X50_COMMAND_STANDARD_READ;
             break;
 
         case EM4X50_DEVICE_ID:
             em4x50_sim_send_nak();
-            em4x50_sim_handle_command(0, tag);
+            return EM4X50_COMMAND_STANDARD_READ;
             break;
 
         default:
             if ((address >= fwwp) && (address <= lwwp) && (gLogin == false)) {
                 em4x50_sim_send_nak();
-                em4x50_sim_handle_command(0, tag);
+                return EM4X50_COMMAND_STANDARD_READ;
             } else {
                 tag[address] = reflect32(data);
                 em4x50_sim_send_ack();
@@ -1120,16 +1075,24 @@ static void em4x50_sim_handle_write_command(uint32_t *tag) {
 
     // if "read after write" (raw) bit is set, send written data once
     if (raw) {
-        em4x50_sim_send_listen_window(tag);
-        em4x50_sim_send_listen_window(tag);
+        int command = em4x50_sim_send_listen_window(tag);
+        if (command != PM3_SUCCESS) {
+            return command;
+        }
+
+        command = em4x50_sim_send_listen_window(tag);
+        if (command != PM3_SUCCESS) {
+            return command;
+        }
+
         em4x50_sim_send_word(tag[address]);
     }
 
     // continue with standard read mode
-    em4x50_sim_handle_command(0, tag);
+    return EM4X50_COMMAND_STANDARD_READ;
 }
 
-static void em4x50_sim_handle_writepwd_command(uint32_t *tag) {
+static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
 
     bool pwd_ok = false;
     
@@ -1140,6 +1103,8 @@ static void em4x50_sim_handle_writepwd_command(uint32_t *tag) {
         // read password
         uint32_t act_password = 0;
         pwd_ok = em4x50_sim_read_word(&act_password);
+        
+        wait_cycles(15);
 
         // processing pause time (corresponds to a "1" bit)
         em4x50_sim_send_bit(1);
@@ -1150,10 +1115,13 @@ static void em4x50_sim_handle_writepwd_command(uint32_t *tag) {
         } else {
             em4x50_sim_send_nak();
             gLogin = false;
-            em4x50_sim_handle_command(0, tag);
+            return EM4X50_COMMAND_STANDARD_READ;
+        }
+
+        int command = em4x50_sim_send_listen_window(tag);
+        if (command != PM3_SUCCESS) {
+            return command;
         }
-        
-        em4x50_sim_send_listen_window(tag);
 
     } else {
 
@@ -1162,7 +1130,7 @@ static void em4x50_sim_handle_writepwd_command(uint32_t *tag) {
         // read new password
         uint32_t new_password = 0;
         pwd_ok = em4x50_sim_read_word(&new_password);
-
+        
         // write access time
         wait_cycles(EM4X50_T_TAG_TWA);
 
@@ -1171,8 +1139,9 @@ static void em4x50_sim_handle_writepwd_command(uint32_t *tag) {
             tag[EM4X50_DEVICE_PASSWORD] = reflect32(new_password);
         } else {
             em4x50_sim_send_ack();
-            em4x50_sim_handle_command(0, tag);
+            return EM4X50_COMMAND_STANDARD_READ;
         }
+        //OPEN_COIL();
 
         // EEPROM write time
         wait_cycles(EM4X50_T_TAG_TWEE);
@@ -1184,15 +1153,21 @@ static void em4x50_sim_handle_writepwd_command(uint32_t *tag) {
         em4x50_sim_send_ack();
 
         // continue with standard read mode
-        em4x50_sim_handle_command(0, tag);
+        return EM4X50_COMMAND_STANDARD_READ;
     }
+    
+    // call writepwd function again for else branch
+    return EM4X50_COMMAND_WRITE_PASSWORD;
 }
 
-static void em4x50_sim_handle_selective_read_command(uint32_t *tag) {
+static int em4x50_sim_handle_selective_read_command(uint32_t *tag) {
 
+    int command = PM3_EOPABORTED;
+    
     // read password
     uint32_t address = 0;
     bool addr_ok = em4x50_sim_read_word(&address);
+    wait_cycles(15);
 
     // processing pause time (corresponds to a "1" bit)
     em4x50_sim_send_bit(1);
@@ -1201,7 +1176,7 @@ static void em4x50_sim_handle_selective_read_command(uint32_t *tag) {
         em4x50_sim_send_ack();
     } else {
         em4x50_sim_send_nak();
-        em4x50_sim_handle_command(0, tag);
+        return EM4X50_COMMAND_STANDARD_READ;
     }
 
     // extract control data
@@ -1218,10 +1193,18 @@ static void em4x50_sim_handle_selective_read_command(uint32_t *tag) {
     while (BUTTON_PRESS() == false) {
 
         WDT_HIT();
-        em4x50_sim_send_listen_window(tag);
+
+        command = em4x50_sim_send_listen_window(tag);
+        if (command != PM3_SUCCESS) {
+            return command;
+        }
+
         for (int i = fwr; i <= lwr; i++) {
 
-            em4x50_sim_send_listen_window(tag);
+            command = em4x50_sim_send_listen_window(tag);
+            if (command != PM3_SUCCESS) {
+                return command;
+            }
 
             // if not authenticated do not send read protected words
             if ((gLogin == false) && (i >= fwrp) && (i <= lwrp)) {
@@ -1231,9 +1214,13 @@ static void em4x50_sim_handle_selective_read_command(uint32_t *tag) {
             }
         }
     }
+
+    return command;
 }
 
-static void em4x50_sim_handle_standard_read_command(uint32_t *tag) {
+static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
+    
+    int command = PM3_EOPABORTED;
     
     // extract control data
     int fwr = reflect32(tag[EM4X50_CONTROL]) & 0xFF;      // first word read
@@ -1248,10 +1235,18 @@ static void em4x50_sim_handle_standard_read_command(uint32_t *tag) {
     while (BUTTON_PRESS() == false) {
 
         WDT_HIT();
-        em4x50_sim_send_listen_window(tag);
+
+        command = em4x50_sim_send_listen_window(tag);
+        if (command != PM3_SUCCESS) {
+            return command;
+        }
+
         for (int i = fwr; i <= lwr; i++) {
 
-            em4x50_sim_send_listen_window(tag);
+            command = em4x50_sim_send_listen_window(tag);
+            if (command != PM3_SUCCESS) {
+                return command;
+            }
 
             if ((i >= fwrp) && (i <= lwrp)) {
                 em4x50_sim_send_word(0x00);
@@ -1260,40 +1255,11 @@ static void em4x50_sim_handle_standard_read_command(uint32_t *tag) {
             }
         }
     }
-}
-
-static void em4x50_sim_handle_command(uint8_t command, uint32_t *tag) {
-    
-    switch (command) {
-
-        case EM4X50_COMMAND_LOGIN:
-            em4x50_sim_handle_login_command(tag);
-            break;
-
-        case EM4X50_COMMAND_RESET:
-            em4x50_sim_handle_reset_command(tag);
-            break;
-
-        case EM4X50_COMMAND_WRITE:
-            em4x50_sim_handle_write_command(tag);
-            break;
-
-        case EM4X50_COMMAND_WRITE_PASSWORD:
-            em4x50_sim_handle_writepwd_command(tag);
-            break;
-
-        case EM4X50_COMMAND_SELECTIVE_READ:
-            em4x50_sim_handle_selective_read_command(tag);
-            break;
-
-        default:
-            em4x50_sim_handle_standard_read_command(tag);
-            break;
-    }
+    return command;
 }
 
 // reader requests receive mode (rm) by sending two zeros
-static void check_rm_request(uint32_t *tag) {
+static int check_rm_request(uint32_t *tag) {
     
     int cond = EM4X50_T_TAG_FULL_PERIOD - EM4X50_TAG_TOLERANCE;
     
@@ -1306,19 +1272,21 @@ static void check_rm_request(uint32_t *tag) {
             // if command before was EM4X50_COMMAND_WRITE_PASSWORD
             // switch to separate process
             if (gWritePasswordProcess) {
-                em4x50_sim_handle_command(EM4X50_COMMAND_WRITE_PASSWORD, tag);
+                return EM4X50_COMMAND_WRITE_PASSWORD;
             } else {
                 // read mode request detected, get command from reader
                 uint8_t command = 0;
                 em4x50_sim_read_byte_with_parity_check(&command);
-                em4x50_sim_handle_command(command, tag);
+                return command;
             }
         }
     }
+    
+    return PM3_SUCCESS;
 }
 
-static bool em4x50_sim_send_listen_window(uint32_t *tag) {
-
+static int em4x50_sim_send_listen_window(uint32_t *tag) {
+    
     SHORT_COIL();
     wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
 
@@ -1329,12 +1297,15 @@ static bool em4x50_sim_send_listen_window(uint32_t *tag) {
     wait_cycles(2 * EM4X50_T_TAG_FULL_PERIOD);
 
     OPEN_COIL();
-    check_rm_request(tag);
+    int command = check_rm_request(tag);
+    if (command != PM3_SUCCESS) {
+        return command;
+    }
 
     SHORT_COIL();
     wait_cycles(EM4X50_T_TAG_FULL_PERIOD);
 
-    return true;
+    return PM3_SUCCESS;
 }
 
 // simple login to EM4x50,
@@ -1828,8 +1799,42 @@ void em4x50_sim(uint32_t *password) {
         em4x50_setup_sim();
         gLogin = false;
 
-        // start with inital command = standard read mode (= 0)
-        em4x50_sim_handle_command(0, tag);
+        // start with inital command = standard read mode
+        int command = EM4X50_COMMAND_STANDARD_READ;
+
+        for (;;) {
+
+            switch (command) {
+
+                case EM4X50_COMMAND_LOGIN:
+                    command = em4x50_sim_handle_login_command(tag);
+                    break;
+
+                case EM4X50_COMMAND_RESET:
+                    command =  em4x50_sim_handle_reset_command(tag);
+                    break;
+
+                case EM4X50_COMMAND_WRITE:
+                    command =  em4x50_sim_handle_write_command(tag);
+                    break;
+
+                case EM4X50_COMMAND_WRITE_PASSWORD:
+                    command =  em4x50_sim_handle_writepwd_command(tag);
+                    break;
+
+                case EM4X50_COMMAND_SELECTIVE_READ:
+                    command =  em4x50_sim_handle_selective_read_command(tag);
+                    break;
+
+                default:
+                    command = em4x50_sim_handle_standard_read_command(tag);
+                    break;
+            }
+
+            if (command == PM3_EOPABORTED) {
+                break;
+            }
+        }
         
     } else {
         status = PM3_ENODATA;

From ad1f3eae57560dcf4f33d296a65d3d25d0f766cc Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 11 Jan 2021 23:29:49 +0100
Subject: [PATCH 342/682] added some supprt fct for cliparser,  to take a hex
 byte param and fall back to a default value, or specify how many bytes the
 param must be

---
 client/deps/cliparser/cliparser.c | 22 ++++++++++++++++++++++
 client/deps/cliparser/cliparser.h |  2 ++
 2 files changed, 24 insertions(+)

diff --git a/client/deps/cliparser/cliparser.c b/client/deps/cliparser/cliparser.c
index f55b7a8f7..6c249e9cb 100644
--- a/client/deps/cliparser/cliparser.c
+++ b/client/deps/cliparser/cliparser.c
@@ -285,4 +285,26 @@ uint64_t arg_get_u64_hexstr_def(CLIParserContext *ctx, uint8_t paramnum, uint64_
     return rv;
 }
 
+int arg_get_u32_hexstr_def(CLIParserContext *ctx, uint8_t paramnum, uint32_t def, uint32_t *out) {
+    return arg_get_u32_hexstr_def_nlen(ctx, paramnum, def, out, 4);
+}
+
+int arg_get_u32_hexstr_def_nlen(CLIParserContext *ctx, uint8_t paramnum, uint32_t def, uint32_t *out, uint8_t nlen) {
+    int n = 0;
+    uint8_t d[nlen];
+    int res = CLIParamHexToBuf(arg_get_str(ctx, paramnum), d, sizeof(d), &n);
+    if (res == 0 && n == nlen) {
+        uint32_t rv = 0;
+        for (uint8_t i = 0; i < n; i++) {
+            rv <<= 8;
+            rv |= d[i];
+        }
+        *out = rv;
+        return 1;
+    } else if (res == 0 && n) {
+        *out = def;
+        return 2;
+    }
+    return 0;
+}
 
diff --git a/client/deps/cliparser/cliparser.h b/client/deps/cliparser/cliparser.h
index 996ad81ef..40fd5c2f7 100644
--- a/client/deps/cliparser/cliparser.h
+++ b/client/deps/cliparser/cliparser.h
@@ -68,4 +68,6 @@ int CLIParamHexToBuf(struct arg_str *argstr, uint8_t *data, int maxdatalen, int
 int CLIParamStrToBuf(struct arg_str *argstr, uint8_t *data, int maxdatalen, int *datalen);
 
 uint64_t arg_get_u64_hexstr_def(CLIParserContext *ctx, uint8_t paramnum, uint64_t def);
+int arg_get_u32_hexstr_def(CLIParserContext *ctx, uint8_t paramnum, uint32_t def, uint32_t *out);
+int arg_get_u32_hexstr_def_nlen(CLIParserContext *ctx, uint8_t paramnum, uint32_t def, uint32_t *out, uint8_t nlen);
 #endif

From 59c4a38674d580965b304d71987c86f7795fcaee Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 12 Jan 2021 00:11:40 +0100
Subject: [PATCH 343/682] lf t55xx protect/sniff - now use cliparser

---
 client/src/cmdlft55xx.c | 261 +++++++++++++++++++++++-----------------
 1 file changed, 148 insertions(+), 113 deletions(-)

diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index 5ef0bed28..29297b255 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -79,6 +79,34 @@ static void print_usage_t55xx_downloadlink(uint8_t ShowAll, uint8_t dl_mode_defa
         PrintAndLogEx(NORMAL, "                       4 - Try all downlink modes%s", (dl_mode_default == 4) ? " (default)" : "");
 }
 
+static void arg_add_t55xx_downloadlink(void *at[], uint8_t *idx, uint8_t show, uint8_t dl_mode_def) {
+    
+    char *r0 = (char*)calloc(56, sizeof(uint8_t));    
+    char *r1 = (char*)calloc(56, sizeof(uint8_t));
+    char *r2 = (char*)calloc(56, sizeof(uint8_t));
+    char *r3 = (char*)calloc(56, sizeof(uint8_t));
+
+    sprintf(r0, "downlink - fixed bit length %s", (dl_mode_def == 0) ? "(detected def)" : "");
+    sprintf(r1, "downlink - long leading reference %s", (dl_mode_def == 1) ? "(detected def)" : "");
+    sprintf(r2, "downlink - leading zero %s", (dl_mode_def == 2) ? "(detected def)" : "");
+    sprintf(r3, "downlink - 1 of 4 coding reference %s", (dl_mode_def == 3) ? "(detected def)" : "");
+
+    uint8_t n = *idx;
+    at[n++] = arg_lit0(NULL, "r0", r0);
+    at[n++] = arg_lit0(NULL, "r1", r1);
+    at[n++] = arg_lit0(NULL, "r2", r2);
+    at[n++] = arg_lit0(NULL, "r3", r3);
+
+    if (show == T55XX_DLMODE_ALL) {
+        char *r4 = (char*)calloc(50, sizeof(uint8_t));
+        sprintf(r4, "try all downlink modes %s", (dl_mode_def == 4) ? "(def)" : "");
+        at[n++] = arg_lit0(NULL, "all", r4);
+    }
+    at[n++] = arg_param_end;
+    *idx = n;  
+}
+
+
 static int usage_t55xx_config(void) {
     PrintAndLogEx(NORMAL, "Usage: lf t55xx config [c <blk0>] [d <demodulation>] [i [0/1]] [o <offset>] [Q5 [0/1]] [ST [0/1]]");
     PrintAndLogEx(NORMAL, "Options:");
@@ -309,21 +337,7 @@ static int usage_t55xx_recoverpw(void) {
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
-static int usage_t55xx_wipe(void) {
-    PrintAndLogEx(NORMAL, "Usage:  lf t55xx wipe [h] [Q5] [p <password>] [c <blk0>]");
-    PrintAndLogEx(NORMAL, "This commands wipes a tag, fills blocks 1-7 with zeros and a default configuration block");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     h               - this help");
-    PrintAndLogEx(NORMAL, "     c <block0>      - set configuration from a block0");
-    PrintAndLogEx(NORMAL, "     p <password  - OPTIONAL password (8 hex characters)");
-    PrintAndLogEx(NORMAL, "     q               - indicates to use Q5/T5555 default configuration block");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf t55xx wipe") "              -  wipes a T55x7 tag,    config block 0x000880E0");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf t55xx wipe q") "            -  wipes a Q5/T5555 tag, config block 0x6001F004");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf t55xx wipe p 11223344") "   -  wipes a T55x7 tag,    config block 0x000880E0, using password");
-    return PM3_SUCCESS;
-}
+
 static int usage_t55xx_deviceconfig(void) {
     PrintAndLogEx(NORMAL, "Sets t55x7 timings for direct commands. The timings are set here in Field Clocks (FC), \nwhich is converted to (US) on device");
     PrintAndLogEx(NORMAL, "Usage: lf t55xx deviceconfig [r <mode>] a <gap> b <gap> c <gap> d <gap> e <gap> f <gap> g <gap> [p]");
@@ -345,22 +359,7 @@ static int usage_t55xx_deviceconfig(void) {
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
-static int usage_t55xx_protect(void) {
-    PrintAndLogEx(NORMAL, "This command sets the pwd bit on T5577.");
-    PrintAndLogEx(NORMAL, _RED_("WARNING:") " this locks the tag!");
-    PrintAndLogEx(NORMAL, "Usage:  lf t55xx protect [r <mode>] [p <password>] [o] [n <new_password>]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     p <password>        - OPTIONAL password (8 hex characters)");
-    PrintAndLogEx(NORMAL, "     o                   - OPTIONAL override safety check");
-    PrintAndLogEx(NORMAL, "     n <new password>    - new password");
-    print_usage_t55xx_downloadlink(T55XX_DLMODE_SINGLE, config.downlink_mode);
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf t55xx protect n 01020304") "              - sets new password to 01020304");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf t55xx protect p 11223344 n 00000000") "   - use pwd 11223344 to set newpwd to 00000000");
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
+
 static int usage_t55xx_dangerraw(void) {
     PrintAndLogEx(NORMAL, "This command allows to emit arbitrary raw commands on T5577 and cut the field after arbitrary duration.");
     PrintAndLogEx(NORMAL, _RED_("WARNING:") " this may lock definitively the tag in an unusable state!");
@@ -2946,42 +2945,42 @@ static int CmdResetRead(const char *Cmd) {
 }
 
 static int CmdT55xxWipe(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf t55xx wipe",
+                  "This commands wipes a tag, fills blocks 1-7 with zeros and a default configuration block",
+                  "lf t55xx wipe               -> wipes a T55x7 tag, config block 0x000880E0\n"
+                  "lf t55xx wipe --q5          -> wipes a Q5/T5555 tag, config block 0x6001F004\n"
+                  "lf t55xx wipe -p 11223344   -> wipes a T55x7 tag, config block 0x000880E0, using pwd"
+                 );
 
-    char writeData[36] = {0};
-    char *ptrData = writeData;
-    uint32_t password = 0, block0 = 0;
-    bool usepwd = false, Q5 = false, gotconf = false;
-    uint8_t cmdp = 0;
-    bool errors = false;
+    // 4 + (5 or 6)
+   void *argtable[9] = {
+        arg_param_begin,
+        arg_str0("c", "cfg", "<hex>", "configuration block0 (4 hex bytes)"),
+        arg_str0("p", "pwd", "<hex>", "password (4 hex bytes)"),
+        arg_lit0(NULL, "q5", "specify writing to Q5/T5555 tag using dedicated config block"),
+    };
+    uint8_t idx = 4;
+    arg_add_t55xx_downloadlink(argtable, &idx, T55XX_DLMODE_SINGLE, config.downlink_mode);
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_t55xx_wipe();
-            case 'p':
-                // password used by handheld cloners
-                password = param_get32ex(Cmd, cmdp + 1, 0x51243648, 16);
-                usepwd = true;
-                cmdp += 2;
-                break;
-            case 'c':
-                block0 = param_get32ex(Cmd, cmdp + 1, 0, 16);
-                gotconf = true;
-                cmdp += 2;
-                break;
-            case 'q':
-                Q5 = true;
-                cmdp++;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
+    bool usepwd = false, gotconf = false;
+    uint32_t block0 = 0; 
+    int res = arg_get_u32_hexstr_def(ctx, 1, 0, &block0);
+    if (res) {
+        gotconf = true;
+    }
+    uint32_t password = 0;
+    res = arg_get_u32_hexstr_def(ctx, 2, 0x51243648, &password);
+    if (res) {
+        usepwd = true;
+
+        if (usepwd && res == 2)
+            PrintAndLogEx(INFO, "Password should be 4 bytes, using default pwd instead");
     }
 
-    if (errors) return usage_t55xx_wipe();
-
+    bool Q5 = arg_get_lit(ctx, 3); 
+    CLIParserFree(ctx);
 
     PrintAndLogEx(INFO, "\nBegin wiping " _YELLOW_("%s")" tag", (Q5) ? "Q5/T5555" : "T55x7");
 
@@ -2990,6 +2989,8 @@ static int CmdT55xxWipe(const char *Cmd) {
         block0 = (Q5) ? 0x6001F004 : 0x000880E0;
     }
 
+    char writeData[36] = {0};
+    char *ptrData = writeData;
     char msg[80] = {0};
 
     if (gotconf)
@@ -3023,8 +3024,9 @@ static int CmdT55xxWipe(const char *Cmd) {
     // Check and rest t55xx downlink mode.
     if (config.downlink_mode != T55XX_DLMODE_FIXED) { // Detect found a different mode so card must support
         snprintf(ptrData, sizeof(writeData), "b 3 1 d 00000000");
-        if (CmdT55xxWriteBlock(ptrData) != PM3_SUCCESS)
+        if (CmdT55xxWriteBlock(ptrData) != PM3_SUCCESS) {
             PrintAndLogEx(WARNING, "Warning: failed writing block 3 page 1 (config)");
+        }
         memset(writeData, 0x00, sizeof(writeData));
     }
     return PM3_SUCCESS;
@@ -3759,50 +3761,83 @@ static int CmdT55xxSetDeviceConfig(const char *Cmd) {
 }
 
 static int CmdT55xxProtect(const char *Cmd) {
-    bool errors = false, usepwd = false, gotnewpwd = false;
-    uint32_t password = 0, new_password = 0;
+
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf t55xx protect",
+                  "This command sets the pwd bit on T5577.\n"
+                  "WARNING: this locks the tag!",
+                  "lf t55xx protect -n 01020304              -> sets new password to 01020304\n"
+                  "lf t55xx protect -p 11223344 -n 00000000  -> use pwd 11223344 to set newpwd to 00000000"
+                 );
+
+    // 4 + (5 or 6)
+   void *argtable[9] = {
+        arg_param_begin,
+        arg_lit0("o", "override", "override safety check"),
+        arg_str1("p", "pwd", "<hex>", "password (4 hex bytes)"),
+        arg_str1("n", "new", "<hex>", "new password (4 hex bytes)"),
+    };
+    uint8_t idx = 4;
+    arg_add_t55xx_downloadlink(argtable, &idx, T55XX_DLMODE_SINGLE, config.downlink_mode);
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
     uint8_t override = 0;
-    uint8_t cmdp = 0;
-    uint8_t downlink_mode = config.downlink_mode;
+    if (arg_get_lit(ctx, 1)) 
+        override = 2;
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_t55xx_protect();
-            case 'o':
-                override = 2;
-                cmdp++;
-                break;
-            case 'n':
-                new_password = param_get32ex(Cmd, cmdp + 1, 0, 16);
-                gotnewpwd = true;
-                cmdp += 2;
-                break;
-            case 'p':
-                password = param_get32ex(Cmd, cmdp + 1, 0, 16);
-                usepwd = true;
-                override = 1;
-                cmdp += 2;
-                break;
-            case 'r':
-                //ICEMAN STRANGE
-                downlink_mode = param_get8ex(Cmd, cmdp + 1, 0, 10);
-                if (downlink_mode > 3)
-                    downlink_mode = 0;
-
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
+    int plen = 0;
+    uint8_t pdata[4] = {0x00};
+    int res = CLIParamHexToBuf(arg_get_str(ctx, 2), pdata, sizeof(pdata), &plen);
+    if (res) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(FAILED, "Error parsing password bytes");
+        return PM3_EINVARG;
     }
 
-    if (gotnewpwd == false)
-        return usage_t55xx_protect();
+    int nlen = 0;
+    uint8_t ndata[4] = {0x00};
+    res = CLIParamHexToBuf(arg_get_str(ctx, 3), ndata, sizeof(ndata), &nlen);
+    if (res) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(FAILED, "Error parsing new passpord bytes");
+        return PM3_EINVARG;
+    }
 
-    if (errors || cmdp == 0) return usage_t55xx_protect();
+    bool r0 = arg_get_lit(ctx, 4);
+    bool r1 = arg_get_lit(ctx, 5);
+    bool r2 = arg_get_lit(ctx, 6);
+    bool r3 = arg_get_lit(ctx, 7);
+    CLIParserFree(ctx);
+
+    if ((r0 + r1 + r2 + r3) > 1) {
+        PrintAndLogEx(FAILED, "Error multiple downlink encoding");
+        return PM3_EINVARG;
+    }
+
+    uint8_t downlink_mode = config.downlink_mode;
+    if (r0)
+        downlink_mode = refFixedBit;
+    else if (r1)
+        downlink_mode = refLongLeading;
+    else if (r2)
+        downlink_mode = refLeading0;
+    else if (r3)
+        downlink_mode = ref1of4;
+
+    uint32_t password = 0, new_password = 0;
+    bool usepwd = false; 
+    if (plen == 4) {
+        usepwd = true;
+        override = 1;
+        password = bytes_to_num(pdata, plen);
+    }
+
+    if (nlen == 4) {
+        new_password = bytes_to_num(ndata, nlen);
+    } else {
+        PrintAndLogEx(WARNING, "Must specify new password param");
+        return PM3_EINVARG;
+    }
 
     // sanity check.
     if (SanityOfflineCheck(false) != PM3_SUCCESS)
@@ -3918,7 +3953,7 @@ static int CmdT55xxSniff(const char *Cmd) {
                                                              00 01 10 11
     */
 
-    bool haveData = false;
+    bool have_data = false;
     uint8_t page, blockAddr;
     uint16_t dataLen = 0;
     size_t idx = 0;
@@ -3953,7 +3988,7 @@ static int CmdT55xxSniff(const char *Cmd) {
         maxWidth = 0;
         dataLen = 0;
         data[0] = 0;
-        haveData = false;
+        have_data = false;
         sprintf(modeText, "Default");
         sprintf(pwdText, " ");
         sprintf(dataText, " ");
@@ -4022,13 +4057,13 @@ static int CmdT55xxSniff(const char *Cmd) {
             // Check first bit.
 
             // Long leading 0
-            if (haveData == false && (APPROX_EQ(pulseBuffer[0], 136 + minWidth, tolerance) && APPROX_EQ(pulseBuffer[1], maxWidth, tolerance))) {
+            if (have_data == false && (APPROX_EQ(pulseBuffer[0], 136 + minWidth, tolerance) && APPROX_EQ(pulseBuffer[1], maxWidth, tolerance))) {
                 // printf ("Long Leading 0 - not yet hanled | have 1 Fisrt bit | Min : %-3d - Max : %-3d : diff : %d\n",minWidth,maxWidth, maxWidth-minWidth);
                 continue;
             }
 
             // Fixed bit - Default
-            if (haveData == false && (APPROX_EQ(pulseBuffer[0], maxWidth, tolerance))) {
+            if (have_data == false && (APPROX_EQ(pulseBuffer[0], maxWidth, tolerance))) {
                 dataLen = t55sniff_get_packet(pulseBuffer, data, minWidth, maxWidth, tolerance);
 
                 //   if ((dataLen == 39) )
@@ -4051,7 +4086,7 @@ static int CmdT55xxSniff(const char *Cmd) {
                                 blockAddr |= 1;
                         }
                         blockData = 0;
-                        haveData = true;
+                        have_data = true;
                         sprintf(modeText, "Default Read");
                     }
 
@@ -4079,7 +4114,7 @@ static int CmdT55xxSniff(const char *Cmd) {
                             if (data[i] == '1')
                                 blockAddr |= 1;
                         }
-                        haveData = true;
+                        have_data = true;
                         sprintf(modeText, "Default pwd write");
                         sprintf(pwdText, "%08X", usedPassword);
                         sprintf(dataText, "%08X", blockData);
@@ -4103,7 +4138,7 @@ static int CmdT55xxSniff(const char *Cmd) {
                             if (data[i] == '1')
                                 blockAddr |= 1;
                         }
-                        haveData = true;
+                        have_data = true;
                         sprintf(modeText, "Default write");
                         sprintf(dataText, "%08X", blockData);
                     }
@@ -4111,7 +4146,7 @@ static int CmdT55xxSniff(const char *Cmd) {
             }
 
             // Leading 0
-            if (haveData == false && (APPROX_EQ(pulseBuffer[0], minWidth, tolerance))) {
+            if (have_data == false && (APPROX_EQ(pulseBuffer[0], minWidth, tolerance))) {
                 // leading 0 (should = 0 width)
                 // 1 of 4 (leads with 00)
                 dataLen = t55sniff_get_packet(pulseBuffer, data, minWidth, maxWidth, tolerance);
@@ -4139,7 +4174,7 @@ static int CmdT55xxSniff(const char *Cmd) {
                             if (data[i] == '1')
                                 blockAddr |= 1;
                         }
-                        haveData = true;
+                        have_data = true;
                         sprintf(modeText, "Leading 0 pwd write");
                         sprintf(pwdText, "%08X", usedPassword);
                         sprintf(dataText, "%08X", blockData);
@@ -4149,7 +4184,7 @@ static int CmdT55xxSniff(const char *Cmd) {
         }
 
         // Print results
-        if (haveData) { //&& (minWidth > 1) && (maxWidth > minWidth)){
+        if (have_data) { 
             if (blockAddr == 7)
                 PrintAndLogEx(SUCCESS, "%-20s  | "_GREEN_("%8s")" | "_YELLOW_("%8s")" |  "_YELLOW_("%d")"  |   "_GREEN_("%d")"  | %3d | %3d | %s", modeText, pwdText, dataText, blockAddr, page, minWidth, maxWidth, data);
             else

From 999d1774cba029a5e791bd2ddf42f3e20d7113d1 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 12 Jan 2021 00:12:12 +0100
Subject: [PATCH 344/682] text

---
 doc/cliparser_todo.txt | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 2859c6752..a824eb3c1 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -126,9 +126,6 @@ lf t55xx wakeup
 lf t55xx write
 lf t55xx bruteforce
 lf t55xx chk
-lf t55xx protect
 lf t55xx recoverpw
-lf t55xx sniff
 lf t55xx special
-lf t55xx wipe
 script run

From 1f085126702b634a1455030180e552eb8a460d96 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Tue, 12 Jan 2021 00:22:53 +0100
Subject: [PATCH 345/682] reduced use of timers and synchronized read actions

---
 armsrc/em4x50.c | 68 +++++++++++++++++++++++++++----------------------
 1 file changed, 37 insertions(+), 31 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index cb9b26485..a90d977ea 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -46,6 +46,7 @@
 #define EM4X50_T_WAITING_FOR_SNGLLIW        140
 
 #define EM4X50_TAG_TOLERANCE                8
+#define EM4X50_ZERO_DETECTION               3
 #define EM4X50_TAG_WORD                     45
 #define EM4X50_TAG_MAX_NO_BYTES             136
 
@@ -60,15 +61,11 @@ int gHigh = 190;
 int gLow = 60;
 
 // a global parameter is needed to indicate whether a previous login was
-// successful, so operations that require authentication may be performed
+// successful, so operations that require authentication can be handled
 bool gLogin = false;
 // additionally a global variable to identify the WritePassword process
 bool gWritePasswordProcess = false;
 
-int gcount = 0;
-int gcycles = 0;
-int rm = 0;
-
 static int em4x50_sim_send_listen_window(uint32_t *tag);
 
 void catch_samples(void);
@@ -812,35 +809,48 @@ static int wait_cycles(int maxperiods) {
     
     return PM3_SUCCESS;
 }
-
-static int get_cycles(void) {
+ 
+static uint8_t em4x50_sim_read_bit(void) {
 
     int cycles = 0;
 
-    AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
-    while (AT91C_BASE_TC0->TC_CV < T0 * (EM4X50_T_TAG_FULL_PERIOD - 2)) {
+    while (cycles < EM4X50_T_TAG_FULL_PERIOD) {
 
+        // wait until reader field disappears
         while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
 
-        // check again to minimize desynchronization
-        if (AT91C_BASE_TC0->TC_CV >= T0 * EM4X50_T_TAG_FULL_PERIOD)
-            break;
+        // reader field is off, reset timer TC0
+        AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
 
-        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK);
-        
+        // now check until reader switches on carrier field
+        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
+
+            // check if cycle (i.e. off -> on -> off) takes longer than T0
+            if (AT91C_BASE_TC0->TC_CV > T0 * EM4X50_ZERO_DETECTION) {
+
+                // gap detected; wait until reader field is switched on again
+                while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK);
+                
+                // now we have a reference "position", from here it will take
+                // slightly less 32 cycles until the end of the bit period
+                wait_cycles(EM4X50_T_TAG_FULL_PERIOD - EM4X50_ZERO_DETECTION);
+                
+                // end of bit period is reached; return with bit value "0"
+                // (cf. datasheet)
+                return 0;
+            }
+
+        }
+
+        // no gap detected, i.e. reader field is still up;
+        // continue with counting cycles
         cycles++;
     }
 
-    return cycles;
+    // reached 64 cycles (= EM4X50_T_TAG_FULL_PERIOD) -> return bit value "1"
+    return 1;
 }
-
-static uint8_t em4x50_sim_read_bit(void) {
-
-    int cond = EM4X50_T_TAG_FULL_PERIOD - EM4X50_TAG_TOLERANCE;
-
-    return (get_cycles() < cond) ? 0 : 1;
-}
-
+ 
 static uint8_t em4x50_sim_read_byte(void) {
     
     uint8_t byte = 0;
@@ -954,8 +964,7 @@ static int em4x50_sim_handle_login_command(uint32_t *tag) {
     // read password
     uint32_t password = 0;
     bool pwd_ok = em4x50_sim_read_word(&password);
-    //Dbprintf("address = %08x", address);
-    wait_cycles(15);
+    //wait_cycles(15);
 
     // processing pause time (corresponds to a "1" bit)
     em4x50_sim_send_bit(1);
@@ -1261,13 +1270,11 @@ static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
 // reader requests receive mode (rm) by sending two zeros
 static int check_rm_request(uint32_t *tag) {
     
-    int cond = EM4X50_T_TAG_FULL_PERIOD - EM4X50_TAG_TOLERANCE;
-    
     // look for first zero
-    if (get_cycles() < cond) {
-    
+    if (em4x50_sim_read_bit() == 0) {
+
         // look for second zero
-        if (get_cycles() < cond) {
+        if (em4x50_sim_read_bit() == 0) {
 
             // if command before was EM4X50_COMMAND_WRITE_PASSWORD
             // switch to separate process
@@ -1569,7 +1576,6 @@ void em4x50_info(em4x50_data_t *etd) {
     uint32_t addresses = 0x00002100; // read from fwr = 0 to lwr = 33 (0x21)
     uint32_t words[EM4X50_NO_WORDS] = {0x0};
 
-    gcount = 0;
     em4x50_setup_read();
 
     if (get_signalproperties() && find_em4x50_tag()) {

From 9351d29a4897b4f8017af23c7d75e25047fefa04 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 12 Jan 2021 00:30:16 +0100
Subject: [PATCH 346/682] usart btfactory - improve warning message given the
 cliparser template limit

---
 client/src/cmdusart.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/client/src/cmdusart.c b/client/src/cmdusart.c
index 2faa2ae8b..6be9ed743 100644
--- a/client/src/cmdusart.c
+++ b/client/src/cmdusart.c
@@ -160,12 +160,12 @@ static int usart_bt_testcomm(uint32_t baudrate, uint8_t parity) {
 static int CmdUsartBtFactory(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "usart btfactory",
-                  "Reset BT add-on to factory settings\n"
-                  "WARNING: process only if strictly needed!\n"
+                  "Reset BT add-on to factory settings\n"                  
                   "This requires\n"
                   "    1) BTpower to be turned ON\n"
                   "    2) BT add-on to NOT be connected\n"
-                  "      => the add-on blue LED must blink",
+                  "      => the add-on blue LED must blink\n\n"
+                  _RED_("WARNING:") _CYAN_(" process only if strictly needed!"),
                   "usart btfactory"
                  );
 

From 00b1613afa81a717a2113266a387664b7c07b976 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 12 Jan 2021 20:19:00 +0100
Subject: [PATCH 347/682] added link

---
 doc/jtag_notes.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/doc/jtag_notes.md b/doc/jtag_notes.md
index 42001d91d..6344bb706 100644
--- a/doc/jtag_notes.md
+++ b/doc/jtag_notes.md
@@ -74,7 +74,10 @@ GND | 6
 ## Third party notes on using a RaspBerry Pi
 
 * http://www.lucasoldi.com/2017/01/17/unbrick-proxmark3-with-a-raspberry-pi-and-openocd/
+* https://wiki.elvis.science/index.php?title=Proxmark3:_Debricking
+* https://github.com/synthetos/PiOCD/wiki/Using-a-Raspberry-Pi-as-a-JTAG-Dongle
 
 ## Third party notes on using a J-Link on Windows
 
 * https://github.com/Proxmark/proxmark3/wiki/De-Bricking-Segger
+

From 55b76f0d4cda8baefd5ffc147464890f806aef44 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 12 Jan 2021 20:38:55 +0100
Subject: [PATCH 348/682] lf t55xx recoverpw .. - now uses cliparser

---
 client/src/cmdlft55xx.c | 472 +++++++++++++++++++---------------------
 client/src/cmdlft55xx.h |   2 +-
 doc/cliparser_todo.txt  |   3 -
 3 files changed, 223 insertions(+), 254 deletions(-)

diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index 29297b255..3965ab71e 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -236,7 +236,6 @@ static int usage_t55xx_restore(void) {
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
-
 static int usage_t55xx_detect(void) {
     PrintAndLogEx(NORMAL, "Usage:  lf t55xx detect [1] [r <mode>] [p <password>]");
     PrintAndLogEx(NORMAL, "Options:");
@@ -251,21 +250,6 @@ static int usage_t55xx_detect(void) {
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
-static int usage_t55xx_detectP1(void) {
-    PrintAndLogEx(NORMAL, "Command: Detect Page 1 of a t55xx chip");
-    PrintAndLogEx(NORMAL, "Usage:  lf t55xx p1detect [1] [r <mode>] [p <password>]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     1            - if set, use Graphbuffer otherwise read data from tag.");
-    PrintAndLogEx(NORMAL, "     p <password> - OPTIONAL password (8 hex characters)");
-    print_usage_t55xx_downloadlink(T55XX_DLMODE_SINGLE, config.downlink_mode); // Need to setup to try all modes
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf t55xx p1detect"));
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf t55xx p1detect 1"));
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf t55xx p1detect p 11223344"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
 static int usage_t55xx_wakup(void) {
     PrintAndLogEx(NORMAL, "Usage:  lf t55xx wakeup [h] [r <mode>] p <password>");
     PrintAndLogEx(NORMAL, "This commands sends the Answer-On-Request command and leaves the readerfield ON afterwards.");
@@ -316,49 +300,6 @@ static int usage_t55xx_bruteforce(void) {
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
-static int usage_t55xx_recoverpw(void) {
-    PrintAndLogEx(NORMAL, "This command uses a few tricks to try to recover mangled password");
-    PrintAndLogEx(NORMAL, "press " _YELLOW_("'enter'") " to cancel the command");
-    PrintAndLogEx(NORMAL, _RED_("WARNING:") " this may brick non-password protected chips!");
-    PrintAndLogEx(NORMAL, "Try reading block 7 before\n");
-    PrintAndLogEx(NORMAL, "Usage: lf t55xx recoverpw [r <mode>] [p <password>]");
-    PrintAndLogEx(NORMAL, "       password must be 4 bytes (8 hex symbols)");
-    PrintAndLogEx(NORMAL, "       default password is 51243648, used by many cloners");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     h            - this help");
-    print_usage_t55xx_downloadlink(T55XX_DLMODE_ALL, T55XX_DLMODE_ALL);
-    PrintAndLogEx(NORMAL, "     p <password>   - 4 byte hex value of password written by cloner");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("       lf t55xx recoverpw"));
-    PrintAndLogEx(NORMAL, _YELLOW_("       lf t55xx recoverpw p 51243648"));
-    PrintAndLogEx(NORMAL, _YELLOW_("       lf t55xx recoverpw r 3 p 51243648"));
-
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
-
-static int usage_t55xx_deviceconfig(void) {
-    PrintAndLogEx(NORMAL, "Sets t55x7 timings for direct commands. The timings are set here in Field Clocks (FC), \nwhich is converted to (US) on device");
-    PrintAndLogEx(NORMAL, "Usage: lf t55xx deviceconfig [r <mode>] a <gap> b <gap> c <gap> d <gap> e <gap> f <gap> g <gap> [p]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     h            - This help");
-    PrintAndLogEx(NORMAL, "     a <8..255>   - Set start gap");
-    PrintAndLogEx(NORMAL, "     b <8..255>   - Set write gap");
-    PrintAndLogEx(NORMAL, "     c <8..255>   - Set write ZERO gap");
-    PrintAndLogEx(NORMAL, "     d <8..255>   - Set write ONE gap");
-    PrintAndLogEx(NORMAL, "     e <8..255>   - Set read gap");
-    PrintAndLogEx(NORMAL, "     f <8..255>   - Set write TWO gap (1 of 4 only)");
-    PrintAndLogEx(NORMAL, "     g <8..255>   - Set write THREE gap (1 of 4 only)");
-    PrintAndLogEx(NORMAL, "     p            - persist to flashmemory");
-    PrintAndLogEx(NORMAL, "     z            - Set default t55x7 timings (use p to save if required)");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf t55xx deviceconfig a 29 b 17 c 15 d 47 e 15") "   - default T55XX");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf t55xx deviceconfig a 55 b 14 c 21 d 30") "        - default EM4305");
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
 
 static int usage_t55xx_dangerraw(void) {
     PrintAndLogEx(NORMAL, "This command allows to emit arbitrary raw commands on T5577 and cut the field after arbitrary duration.");
@@ -2967,40 +2908,50 @@ static int CmdT55xxWipe(const char *Cmd) {
     bool usepwd = false, gotconf = false;
     uint32_t block0 = 0; 
     int res = arg_get_u32_hexstr_def(ctx, 1, 0, &block0);
-    if (res) {
+    if (res == 1) {
         gotconf = true;
     }
+    if (res == 2) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(WARNING, "config block needs to be 4 hex bytes");
+        return PM3_EINVARG;
+    }
+
     uint32_t password = 0;
     res = arg_get_u32_hexstr_def(ctx, 2, 0x51243648, &password);
     if (res) {
         usepwd = true;
 
         if (usepwd && res == 2)
-            PrintAndLogEx(INFO, "Password should be 4 bytes, using default pwd instead");
+            PrintAndLogEx(WARNING, "Password should be 4 bytes, using default pwd");
     }
 
     bool Q5 = arg_get_lit(ctx, 3); 
     CLIParserFree(ctx);
 
-    PrintAndLogEx(INFO, "\nBegin wiping " _YELLOW_("%s")" tag", (Q5) ? "Q5/T5555" : "T55x7");
+    PrintAndLogEx(INFO, "Target " _YELLOW_("%s")" tag", (Q5) ? "Q5/T5555" : "T55x7");
 
     // default config blocks.
     if (gotconf == false) {
         block0 = (Q5) ? 0x6001F004 : 0x000880E0;
     }
 
-    char writeData[36] = {0};
-    char *ptrData = writeData;
+    if (usepwd)
+        PrintAndLogEx(INFO, "Using password " _GREEN_("%08X"), password);
+
     char msg[80] = {0};
-
     if (gotconf)
-        snprintf(msg, sizeof(msg), "User provided configuration block %08X", block0);
+        snprintf(msg, sizeof(msg), "User provided configuration block " _GREEN_("%08X"), block0);
     else
-        snprintf(msg, sizeof(msg), "Default configation block %08X", block0);
+        snprintf(msg, sizeof(msg), "Default configuration block " _GREEN_("%08X"), block0);
 
-    PrintAndLogEx(INFO, "%s", msg);
+    PrintAndLogEx(INFO, "%s\n", msg);
+
+    PrintAndLogEx(INFO, "Begin wiping...");
 
     // Creating cmd string for write block :)
+    char writeData[36] = {0};
+    char *ptrData = writeData;
     snprintf(ptrData, sizeof(writeData), "b 0 ");
 
     if (usepwd) {
@@ -3295,7 +3246,8 @@ static int CmdT55xxBruteForce(const char *Cmd) {
             return PM3_EOPABORTED;
         }
 
-        found = tryOnePassword(curr, downlink_mode);
+        // iceman: don't forget to change to true -> ra
+        found = t55xx_try_one_password(curr, downlink_mode, true);
 
         if (curr == end_password)
             break;
@@ -3316,19 +3268,15 @@ static int CmdT55xxBruteForce(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
-uint8_t tryOnePassword(uint32_t password, uint8_t downlink_mode) {
-
-    bool  try_all_dl_modes = false;
-    uint8_t dl_mode          = 0;
+uint8_t t55xx_try_one_password(uint32_t password, uint8_t downlink_mode,  bool try_all_dl_modes) {
 
     PrintAndLogEx(INFO, "Trying password %08X", password);
 
-    if (downlink_mode == 4) try_all_dl_modes = true;
-
-    downlink_mode = (downlink_mode & 3); // ensure 0-3
+    // ensure 0-3
+    downlink_mode = (downlink_mode & 3);
 
     // check if dl mode 4 and loop if needed
-    for (dl_mode = downlink_mode; dl_mode < 4; dl_mode++) {
+    for (uint8_t dl_mode = downlink_mode; dl_mode < 4; dl_mode++) {
 
         if (AcquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, password, dl_mode)) {
             //  if (getSignalProperties()->isnoise == false) {
@@ -3338,51 +3286,73 @@ uint8_t tryOnePassword(uint32_t password, uint8_t downlink_mode) {
             }
             //  }
         }
-        if (!try_all_dl_modes) dl_mode = 4;
+        if (try_all_dl_modes == false) {
+            break;
+        }
     }
     return 0;
 }
 
 static int CmdT55xxRecoverPW(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf t55xx recoverpw",
+                  "This command uses a few tricks to try to recover mangled password.\n"
+                  "Try reading Page 0, block 7 before.\n\n"
+                  _RED_("WARNING") _CYAN_(" this may brick non-password protected chips!"),
+                  "lf t55xx recoverpw\n"
+                  "lf t55xx recoverpw -p 11223344\n"
+                  "lf t55xx recoverpw -p 11223344 --r3\n"
+                 );
+
+    // 2 + (5 or 6)
+   void *argtable[8] = {
+        arg_param_begin,
+        arg_str1("p", "pwd", "<hex>", "password (4 hex bytes)"),
+    };
+    uint8_t idx = 2;
+    arg_add_t55xx_downloadlink(argtable, &idx, T55XX_DLMODE_ALL, T55XX_DLMODE_ALL);
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    uint32_t orig_password = 0;
+    int res = arg_get_u32_hexstr_def(ctx, 1, 0x51243648, &orig_password);
+    if (res == 2) {
+        PrintAndLogEx(INFO, "Password should be 4 bytes, using default pwd instead");
+    }
+
+    bool r0 = arg_get_lit(ctx, 2);
+    bool r1 = arg_get_lit(ctx, 3);
+    bool r2 = arg_get_lit(ctx, 4);
+    bool r3 = arg_get_lit(ctx, 5);
+    bool ra = arg_get_lit(ctx, 6);
+    CLIParserFree(ctx);
+
+    if ((r0 + r1 + r2 + r3 + ra) > 1) {
+        PrintAndLogEx(FAILED, "Error multiple downlink encoding");
+        return PM3_EINVARG;
+    }
+
+    uint8_t downlink_mode = config.downlink_mode;
+    if (r0)
+        downlink_mode = refFixedBit;
+    else if (r1)
+        downlink_mode = refLongLeading;
+    else if (r2)
+        downlink_mode = refLeading0;
+    else if (r3)
+        downlink_mode = ref1of4;
+
+    PrintAndLogEx(NORMAL, "press " _YELLOW_("'enter'") " to cancel the command");
+
     int bit = 0;
-    uint32_t orig_password = 0x0;
     uint32_t curr_password = 0x0;
     uint32_t prev_password = 0xffffffff;
     uint32_t mask = 0x0;
-    uint8_t downlink_mode = 0;
     uint8_t found = 0;
-    uint8_t cmdp = 0;
-    bool errors = false;
-
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_t55xx_recoverpw();
-            case 'p':
-                // password used by handheld cloners
-                orig_password = param_get32ex(Cmd, cmdp + 1, 0x51243648, 16);
-                cmdp += 2;
-                break;
-            case 'r':
-                downlink_mode = param_get8ex(Cmd, cmdp + 1, 0, 10);
-                if (downlink_mode > 4)
-                    downlink_mode = 0;
-
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-
-    if (errors || cmdp == 0) return usage_t55xx_recoverpw();
 
     // first try fliping each bit in the expected password
     while (bit < 32) {
         curr_password = orig_password ^ (1u << bit);
-        found = tryOnePassword(curr_password, downlink_mode);
+        found = t55xx_try_one_password(curr_password, downlink_mode, ra);
         if (found > 0) // xx1 for found xx = dl mode used
             goto out;
 
@@ -3407,7 +3377,7 @@ static int CmdT55xxRecoverPW(const char *Cmd) {
             continue;
         }
 
-        found = tryOnePassword(curr_password, downlink_mode);
+        found = t55xx_try_one_password(curr_password, downlink_mode, ra);
         if (found > 0)
             goto out;
 
@@ -3429,7 +3399,7 @@ static int CmdT55xxRecoverPW(const char *Cmd) {
             bit++;
             continue;
         }
-        found = tryOnePassword(curr_password, downlink_mode);
+        found = t55xx_try_one_password(curr_password, downlink_mode, ra);
         if (found > 0)
             goto out;
 
@@ -3441,15 +3411,14 @@ static int CmdT55xxRecoverPW(const char *Cmd) {
     }
 
 out:
-
     PrintAndLogEx(NORMAL, "");
 
     if (found > 0) {
         PrintAndLogEx(SUCCESS, "Found valid password: [ " _GREEN_("%08X") " ]", curr_password);
         T55xx_Print_DownlinkMode((found >> 1) & 3);
-    } else
-        PrintAndLogEx(WARNING, "Recover pwd failed");
-
+    } else {
+        PrintAndLogEx(FAILED, "Recover password failed");
+    }
     return PM3_SUCCESS;
 }
 
@@ -3567,70 +3536,89 @@ bool tryDetectP1(bool getData) {
 }
 //  does this need to be a callable command?
 static int CmdT55xxDetectPage1(const char *Cmd) {
-    bool errors = false;
-    bool useGB = false;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf t55xx p1detect",
+                  "Detect Page 1 of a T55xx chip",
+                  "lf t55xx p1detect\n"
+                  "lf t55xx p1detect -1\n"
+                  "lf t55xx p1detect -p 11223344 --r3\n"
+                 );
+
+    // 2 + (5 or 6)
+   void *argtable[7] = {
+        arg_param_begin,
+        arg_lit0("1", NULL, "extract using data from graphbuffer"),
+        arg_str0("p", "pwd", "<hex>", "password (4 hex bytes)"),
+    };
+    uint8_t idx = 3;
+    arg_add_t55xx_downloadlink(argtable, &idx, T55XX_DLMODE_SINGLE, config.downlink_mode);
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    bool use_graphbuf = arg_get_lit(ctx, 1);
+
     bool usepwd = false;
+    uint32_t password = 0;
+    int res = arg_get_u32_hexstr_def(ctx, 2, 0, &password);
+    if (res == 2) {
+        PrintAndLogEx(INFO, "Password should be 4 hex bytes");
+        return PM3_EINVARG;
+    } else if ( res == 1) {
+        usepwd = true;
+    }
+
+    bool r0 = arg_get_lit(ctx, 3);
+    bool r1 = arg_get_lit(ctx, 4);
+    bool r2 = arg_get_lit(ctx, 5);
+    bool r3 = arg_get_lit(ctx, 6);
+    CLIParserFree(ctx);
+
+    if ((r0 + r1 + r2 + r3) > 1) {
+        PrintAndLogEx(FAILED, "Error multiple downlink encoding");
+        return PM3_EINVARG;
+    }
+
+    uint8_t downlink_mode = config.downlink_mode;
+    if (r0)
+        downlink_mode = refFixedBit;
+    else if (r1)
+        downlink_mode = refLongLeading;
+    else if (r2)
+        downlink_mode = refLeading0;
+    else if (r3)
+        downlink_mode = ref1of4;
+
     bool try_all_dl_modes = true;
+
+    //ICEMAN STRANGE
+    if (downlink_mode == 4)
+        try_all_dl_modes = true;
+    if (downlink_mode < 4)
+        try_all_dl_modes = false;
+
+    if (downlink_mode > 3)
+        downlink_mode = 0;
+
     bool found = false;
     uint8_t found_mode = 0;
-    uint32_t password = 0;
-    uint8_t cmdp = 0;
-    uint8_t downlink_mode = config.downlink_mode;
-    uint8_t dl_mode = 0;
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_t55xx_detectP1();
-            case 'p':
-                password = param_get32ex(Cmd, cmdp + 1, 0, 16);
-                usepwd = true;
-                cmdp += 2;
-                break;
-            case '1':
-                // use Graphbuffer data
-                useGB = true;
-                cmdp++;
-                break;
-            case 'r':
-                //ICEMAN STRANGE
-                downlink_mode = param_get8ex(Cmd, cmdp + 1, 0, 10);
-                if (downlink_mode == 4)
-                    try_all_dl_modes = true;
-                if (downlink_mode < 4)
-                    try_all_dl_modes = false;
-                if (downlink_mode > 3)
-                    downlink_mode = 0;
-
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-    if (errors) return usage_t55xx_detectP1();
-
-    if (!useGB) {
-        for (dl_mode = downlink_mode; dl_mode < 4; dl_mode++) {
-            found = AcquireData(T55x7_PAGE1, T55x7_TRACE_BLOCK1, usepwd, password, dl_mode);
-            if (found == false)
+    if (use_graphbuf == false) {
+        for (uint8_t dl_mode = downlink_mode; dl_mode < 4; dl_mode++) {
+            
+            if (AcquireData(T55x7_PAGE1, T55x7_TRACE_BLOCK1, usepwd, password, dl_mode) == false)
                 continue;
 
             if (tryDetectP1(false)) {
                 found = true;
                 found_mode = dl_mode;
-                dl_mode = 4;
+                break;
             } else {
                 found = false;
             }
 
-            if (!try_all_dl_modes) {
-                dl_mode = 4;
+            if (try_all_dl_modes == false) {
+                break;
             }
         }
-
     } else {
         found = tryDetectP1(false);
     }
@@ -3645,66 +3633,59 @@ static int CmdT55xxDetectPage1(const char *Cmd) {
 }
 
 static int CmdT55xxSetDeviceConfig(const char *Cmd) {
-    uint8_t startgap = 0, writegap = 0, readgap = 0;
-    uint8_t write0 = 0, write1 = 0, write2 = 0, write3 = 0;
-    uint8_t cmdp = 0, downlink_mode = 0;
-    bool errors = false, shall_persist = false, set_defaults  = false;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf t55xx deviceconfig",
+                  "Sets t55x7 timings for direct commands.\n"
+                  "The timings are set here in Field Clocks (FC) which is converted to (US) on device.",
+                  "lf t55xx deviceconfig -a 29 -b 17 -c 15 -d 47 -e 15    -> default T55XX\n"
+                  "lf t55xx deviceconfig -a 55 -b 14 -c 21 -d 30          -> default EM4305"
+                 );
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_t55xx_deviceconfig();
-            case 'a':
-                errors |= param_getdec(Cmd, cmdp + 1, &startgap);
-                cmdp += 2;
-                break;
-            case 'b':
-                errors |= param_getdec(Cmd, cmdp + 1, &writegap);
-                cmdp += 2;
-                break;
-            case 'c':
-                errors |= param_getdec(Cmd, cmdp + 1, &write0);
-                cmdp += 2;
-                break;
-            case 'd':
-                errors |= param_getdec(Cmd, cmdp + 1, &write1);
-                cmdp += 2;
-                break;
-            case 'e':
-                errors |= param_getdec(Cmd, cmdp + 1, &readgap);
-                cmdp += 2;
-                break;
-            case 'f':
-                errors |= param_getdec(Cmd, cmdp + 1, &write2);
-                cmdp += 2;
-                break;
-            case 'g':
-                errors |= param_getdec(Cmd, cmdp + 1, &write3);
-                cmdp += 2;
-                break;
-            case 'r':
-                downlink_mode = param_get8ex(Cmd, cmdp + 1, 0, 10);
-                if (downlink_mode > 3)
-                    downlink_mode = 0;
-                cmdp += 2;
-                break;
-            case 'p':
-                shall_persist = true;
-                cmdp++;
-                break;
-            case 'z':
-                set_defaults = true;
-                cmdp++;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = 1;
-                break;
-        }
+   void *argtable[10 + 5] = {
+        arg_param_begin,
+        arg_int0("a", NULL, "<8..255>", "Set start gap"),
+        arg_int0("b", NULL, "<8..255>", "Set write gap"),
+        arg_int0("c", NULL, "<8..255>", "Set write ZERO gap"),
+        arg_int0("d", NULL, "<8..255>", "Set write ONE gap"),
+        arg_int0("e", NULL, "<8..255>", "Set read gap"),
+        arg_int0("f", NULL, "<8..255>", "Set write TWO gap (1 of 4 only)"),
+        arg_int0("g", NULL, "<8..255>", "Set write THREE gap (1 of 4 only)"),
+        arg_lit0("p", "persist", "persist to flash memory (RDV4)"),
+        arg_lit0("z", NULL, "Set default t55x7 timings (use `-p` to save if required)"),
+    };
+    uint8_t idx = 10;
+    arg_add_t55xx_downloadlink(argtable, &idx, T55XX_DLMODE_SINGLE, config.downlink_mode);
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+
+    uint8_t startgap = arg_get_int(ctx, 1);
+    uint8_t writegap = arg_get_int(ctx, 2);
+    uint8_t write0 = arg_get_int(ctx, 3);
+    uint8_t write1 = arg_get_int(ctx, 4);
+    uint8_t readgap = arg_get_int(ctx, 5);
+    uint8_t write2 = arg_get_int(ctx, 6);
+    uint8_t write3 = arg_get_int(ctx, 7);
+    bool shall_persist = arg_get_lit(ctx, 8);
+    bool set_defaults = arg_get_lit(ctx, 9);
+    bool r0 = arg_get_lit(ctx, 10);
+    bool r1 = arg_get_lit(ctx, 11);
+    bool r2 = arg_get_lit(ctx, 12);
+    bool r3 = arg_get_lit(ctx, 13);
+    CLIParserFree(ctx);
+
+    if ((r0 + r1 + r2 + r3) > 1) {
+        PrintAndLogEx(FAILED, "Error multiple downlink encoding");
+        return PM3_EINVARG;        
     }
 
-    //Validations
-    if (errors || cmdp == 0) return usage_t55xx_deviceconfig();
+    uint8_t downlink_mode = 0;
+    if (r0)
+        downlink_mode = refFixedBit;
+    else if (r1)
+        downlink_mode = refLongLeading;
+    else if (r2)
+        downlink_mode = refLeading0;
+    else if (r3)
+        downlink_mode = ref1of4;
 
     t55xx_configurations_t configurations = {{{0}, {0}, {0}, {0}}};
 
@@ -3765,13 +3746,13 @@ static int CmdT55xxProtect(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "lf t55xx protect",
                   "This command sets the pwd bit on T5577.\n"
-                  "WARNING: this locks the tag!",
-                  "lf t55xx protect -n 01020304              -> sets new password to 01020304\n"
-                  "lf t55xx protect -p 11223344 -n 00000000  -> use pwd 11223344 to set newpwd to 00000000"
+                  _RED_("WARNING") _CYAN_(" this locks the tag!"),
+                  "lf t55xx protect -n 01020304              -> sets new pwd 01020304\n"
+                  "lf t55xx protect -p 11223344 -n 00000000  -> use pwd 11223344, sets new pwd 00000000"
                  );
 
     // 4 + (5 or 6)
-   void *argtable[9] = {
+   void *argtable[4 + 5] = {
         arg_param_begin,
         arg_lit0("o", "override", "override safety check"),
         arg_str1("p", "pwd", "<hex>", "password (4 hex bytes)"),
@@ -3785,21 +3766,27 @@ static int CmdT55xxProtect(const char *Cmd) {
     if (arg_get_lit(ctx, 1)) 
         override = 2;
 
-    int plen = 0;
-    uint8_t pdata[4] = {0x00};
-    int res = CLIParamHexToBuf(arg_get_str(ctx, 2), pdata, sizeof(pdata), &plen);
-    if (res) {
+    uint32_t password = 0;
+    bool usepwd = false; 
+    int res = arg_get_u32_hexstr_def(ctx, 2, 0, &password);
+    if (res == 2) {
         CLIParserFree(ctx);
         PrintAndLogEx(FAILED, "Error parsing password bytes");
         return PM3_EINVARG;
+    } else if ( res == 1) {
+        usepwd = true;
+        override = 1;
     }
 
-    int nlen = 0;
-    uint8_t ndata[4] = {0x00};
-    res = CLIParamHexToBuf(arg_get_str(ctx, 3), ndata, sizeof(ndata), &nlen);
-    if (res) {
+    uint32_t new_password = 0;
+    res = arg_get_u32_hexstr_def(ctx, 3, 0, &new_password);
+    if (res == 2) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(FAILED, "Error parsing new password bytes");
+        return PM3_EINVARG;
+    } else if (res == 0) {
+        PrintAndLogEx(FAILED, "Must specify new password param");
         CLIParserFree(ctx);
-        PrintAndLogEx(FAILED, "Error parsing new passpord bytes");
         return PM3_EINVARG;
     }
 
@@ -3824,21 +3811,6 @@ static int CmdT55xxProtect(const char *Cmd) {
     else if (r3)
         downlink_mode = ref1of4;
 
-    uint32_t password = 0, new_password = 0;
-    bool usepwd = false; 
-    if (plen == 4) {
-        usepwd = true;
-        override = 1;
-        password = bytes_to_num(pdata, plen);
-    }
-
-    if (nlen == 4) {
-        new_password = bytes_to_num(ndata, nlen);
-    } else {
-        PrintAndLogEx(WARNING, "Must specify new password param");
-        return PM3_EINVARG;
-    }
-
     // sanity check.
     if (SanityOfflineCheck(false) != PM3_SUCCESS)
         return PM3_ESOFT;
@@ -4205,7 +4177,7 @@ static command_t CommandTable[] = {
     {"config",       CmdT55xxSetConfig,       AlwaysAvailable, "Set/Get T55XX configuration (modulation, inverted, offset, rate)"},
     {"dangerraw",    CmdT55xxDangerousRaw,    IfPm3Lf,         "Sends raw bitstream. Dangerous, do not use!! b <bitstream> t <timing>"},
     {"detect",       CmdT55xxDetect,          AlwaysAvailable, "[1] Try detecting the tag modulation from reading the configuration block."},
-    {"deviceconfig", CmdT55xxSetDeviceConfig, IfPm3Lf,         "Set/Get T55XX device configuration (startgap, writegap, write0, write1, readgap"},
+    {"deviceconfig", CmdT55xxSetDeviceConfig, IfPm3Lf,         "Set/Get T55XX device configuration"},
     {"dump",         CmdT55xxDump,            IfPm3Lf,         "[password] [o] Dump T55xx card Page 0 block 0-7. Optional [password], [override]"},
     {"info",         CmdT55xxInfo,            AlwaysAvailable, "[1] Show T55x7 configuration data (page 0/ blk 0)"},
     {"p1detect",     CmdT55xxDetectPage1,     IfPm3Lf,         "[1] Try detecting if this is a t55xx tag by reading page 1"},
@@ -4220,10 +4192,10 @@ static command_t CommandTable[] = {
     {"bruteforce",   CmdT55xxBruteForce,      IfPm3Lf,         "<start password> <end password> Simple bruteforce attack to find password"},
     {"chk",          CmdT55xxChkPwds,         IfPm3Lf,         "Check passwords from dictionary/flash"},
     {"protect",      CmdT55xxProtect,         IfPm3Lf,         "Password protect tag"},
-    {"recoverpw",    CmdT55xxRecoverPW,       IfPm3Lf,         "[password] Try to recover from bad password write from a cloner. Only use on PW protected chips!"},
+    {"recoverpw",    CmdT55xxRecoverPW,       IfPm3Lf,         "Try to recover from bad password write from a cloner"},
     {"sniff",        CmdT55xxSniff,           AlwaysAvailable, "Attempt to recover T55xx commands from sample buffer"},
     {"special",      special,                 IfPm3Lf,         "Show block changes with 64 different offsets"},
-    {"wipe",         CmdT55xxWipe,            IfPm3Lf,         "[q] Wipe a T55xx tag and set defaults (will destroy any data on tag)"},
+    {"wipe",         CmdT55xxWipe,            IfPm3Lf,         "Wipe a T55xx tag and set defaults (will destroy any data on tag)"},
     {NULL, NULL, NULL, NULL}
 };
 
diff --git a/client/src/cmdlft55xx.h b/client/src/cmdlft55xx.h
index d87194b25..336dbfc76 100644
--- a/client/src/cmdlft55xx.h
+++ b/client/src/cmdlft55xx.h
@@ -198,7 +198,7 @@ bool tryDetectP1(bool getData);
 bool test(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk, bool *Q5);
 int  special(const char *Cmd);
 bool AcquireData(uint8_t page, uint8_t block, bool pwdmode, uint32_t password, uint8_t downlink_mode);
-uint8_t  tryOnePassword(uint32_t password, uint8_t downlink_mode);
+uint8_t t55xx_try_one_password(uint32_t password, uint8_t downlink_mode, bool try_all_dl_modes);
 
 void printT55x7Trace(t55x7_tracedata_t data, uint8_t repeat);
 void printT5555Trace(t5555_tracedata_t data, uint8_t repeat);
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index a824eb3c1..dbe4e53a7 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -114,10 +114,8 @@ lf hitag cc
 lf t55xx config
 lf t55xx dangerraw
 lf t55xx detect
-lf t55xx deviceconfig
 lf t55xx dump
 lf t55xx info
-lf t55xx p1detect
 lf t55xx read
 lf t55xx resetread
 lf t55xx restore
@@ -126,6 +124,5 @@ lf t55xx wakeup
 lf t55xx write
 lf t55xx bruteforce
 lf t55xx chk
-lf t55xx recoverpw
 lf t55xx special
 script run

From e723ebea1235da5afc62cff0760a1a6204d39f3c Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 12 Jan 2021 20:59:44 +0100
Subject: [PATCH 349/682] lf t55 bruteforce - now use cliparser

---
 client/src/cmdlft55xx.c | 146 ++++++++++++++++++++--------------------
 1 file changed, 74 insertions(+), 72 deletions(-)

diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index 3965ab71e..fe2ba09ca 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -282,25 +282,6 @@ static int usage_t55xx_chk(void) {
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
-static int usage_t55xx_bruteforce(void) {
-    PrintAndLogEx(NORMAL, "This command uses bruteforce to scan a number range");
-    PrintAndLogEx(NORMAL, "press " _YELLOW_("'enter'") " to cancel the command");
-    PrintAndLogEx(NORMAL, _RED_("WARNING:") " this may brick non-password protected chips!");
-    PrintAndLogEx(NORMAL, "Try reading block 7 before\n");
-    PrintAndLogEx(NORMAL, "Usage: lf t55xx bruteforce [h] [r <mode>] [s <start password>] [e <end password>]");
-    PrintAndLogEx(NORMAL, "       password must be 4 bytes (8 hex symbols)");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     h            - this help");
-    print_usage_t55xx_downloadlink(T55XX_DLMODE_ALL, T55XX_DLMODE_ALL);
-    PrintAndLogEx(NORMAL, "     s <start_pwd>  - 4 byte hex value to start pwd search at");
-    PrintAndLogEx(NORMAL, "     e <end_pwd>    - 4 byte hex value to end pwd search at");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("       lf t55xx bruteforce r 2 s aaaaaa77 e aaaaaa99"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
-
 static int usage_t55xx_dangerraw(void) {
     PrintAndLogEx(NORMAL, "This command allows to emit arbitrary raw commands on T5577 and cut the field after arbitrary duration.");
     PrintAndLogEx(NORMAL, _RED_("WARNING:") " this may lock definitively the tag in an unusable state!");
@@ -3192,62 +3173,84 @@ out:
 
 // Bruteforce - incremental password range search
 static int CmdT55xxBruteForce(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf t55xx bruteforce",
+                  "This command uses bruteforce to scan a number range.\n"
+                  "Try reading Page 0, block 7 before.\n\n"
+                  _RED_("WARNING") _CYAN_(" this may brick non-password protected chips!"),
+                  "lf t55xx bruteforce --r2 -s aaaaaa77 -e aaaaaa99\n"
+                 );
 
-    uint32_t start_password = 0x00000000; //start password
-    uint32_t end_password = 0xFFFFFFFF; //end   password
-    uint32_t curr = 0;
-    uint8_t downlink_mode = 0;
-    uint8_t found = 0; // > 0 if found xx1 xx downlink needed, 1 found
-    uint8_t cmdp = 0;
-    bool errors = false;
+   void *argtable[3 + 6] = {
+        arg_param_begin,
+        arg_str1("s", "start", "<hex>", "search start password (4 hex bytes)"),
+        arg_str1("e", "end", "<hex>", "search end password (4 hex bytes)"),
+    };
+    uint8_t idx = 3;
+    arg_add_t55xx_downloadlink(argtable, &idx, T55XX_DLMODE_ALL, T55XX_DLMODE_ALL);
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_t55xx_bruteforce();
-            case 'r':
-                downlink_mode = param_get8ex(Cmd, cmdp + 1, 0, 10);
-                if (downlink_mode > 4)
-                    downlink_mode = 0;
-
-                cmdp += 2;
-                break;
-            case 's':
-                start_password = param_get32ex(Cmd, cmdp + 1, 0, 16);
-                cmdp += 2;
-                break;
-            case 'e':
-                end_password   = param_get32ex(Cmd, cmdp + 1, 0, 16);
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
+    uint32_t start_password = 0;
+    int res = arg_get_u32_hexstr_def(ctx, 1, 0, &start_password);
+    if (res == 2) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(FAILED, "start password should be 4 bytes");
+        return PM3_EINVARG;
     }
 
-    if (start_password >= end_password)
-        errors = true;
+    uint32_t end_password = 0xFFFFFFFF;
+    res = arg_get_u32_hexstr_def(ctx, 2, 0xFFFFFFFF, &end_password);
+    if (res == 2) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(FAILED, "end password should be 4 bytes");
+        return PM3_EINVARG;
+    }
 
-    if (errors || cmdp == 0) return usage_t55xx_bruteforce();
+    bool r0 = arg_get_lit(ctx, 3);
+    bool r1 = arg_get_lit(ctx, 4);
+    bool r2 = arg_get_lit(ctx, 5);
+    bool r3 = arg_get_lit(ctx, 6);
+    bool ra = arg_get_lit(ctx, 7);
+    CLIParserFree(ctx);
 
-    uint64_t t1 = msclock();
+    if ((r0 + r1 + r2 + r3 + ra) > 1) {
+        PrintAndLogEx(FAILED, "Error multiple downlink encoding");
+        return PM3_EINVARG;
+    }
 
-    curr = start_password;
+    uint8_t downlink_mode = config.downlink_mode;
+    if (r0)
+        downlink_mode = refFixedBit;
+    else if (r1)
+        downlink_mode = refLongLeading;
+    else if (r2)
+        downlink_mode = refLeading0;
+    else if (r3)
+        downlink_mode = ref1of4;
 
+    uint32_t curr = 0;
+    uint8_t found = 0; // > 0 if found xx1 xx downlink needed, 1 found
+
+    if (start_password >= end_password) {
+        PrintAndLogEx(FAILED, "Error, start larger then end password");
+        return PM3_EINVARG;
+    }
+
+    PrintAndLogEx(INFO, "press " _GREEN_("'enter'") " to cancel the command");
     PrintAndLogEx(INFO, "Search password range [%08X -> %08X]", start_password, end_password);
 
-    while (found == 0) {
+    uint64_t t1 = msclock();
+    curr = start_password;
 
+    while (found == 0) {
+        
         PrintAndLogEx(NORMAL, "." NOLF);
 
         if (IsCancelled()) {
             return PM3_EOPABORTED;
         }
 
-        // iceman: don't forget to change to true -> ra
-        found = t55xx_try_one_password(curr, downlink_mode, true);
+        found = t55xx_try_one_password(curr, downlink_mode, ra);
 
         if (curr == end_password)
             break;
@@ -3341,7 +3344,7 @@ static int CmdT55xxRecoverPW(const char *Cmd) {
     else if (r3)
         downlink_mode = ref1of4;
 
-    PrintAndLogEx(NORMAL, "press " _YELLOW_("'enter'") " to cancel the command");
+    PrintAndLogEx(NORMAL, "press " _GREEN_("'enter'") " to cancel the command");
 
     int bit = 0;
     uint32_t curr_password = 0x0;
@@ -4171,25 +4174,24 @@ static int CmdT55xxSniff(const char *Cmd) {
 }
 
 static command_t CommandTable[] = {
-    {"-----------", CmdHelp,                    AlwaysAvailable, "--------------------- " _CYAN_("operations") " ---------------------"},
+    {"-----------",  CmdHelp,                 AlwaysAvailable, "--------------------- " _CYAN_("operations") " ---------------------"},
     {"help",         CmdHelp,                 AlwaysAvailable, "This help"},
     {"clonehelp",    CmdT55xxCloneHelp,       IfPm3Lf,         "Shows the available clone commands"},
     {"config",       CmdT55xxSetConfig,       AlwaysAvailable, "Set/Get T55XX configuration (modulation, inverted, offset, rate)"},
-    {"dangerraw",    CmdT55xxDangerousRaw,    IfPm3Lf,         "Sends raw bitstream. Dangerous, do not use!! b <bitstream> t <timing>"},
-    {"detect",       CmdT55xxDetect,          AlwaysAvailable, "[1] Try detecting the tag modulation from reading the configuration block."},
+    {"dangerraw",    CmdT55xxDangerousRaw,    IfPm3Lf,         "Sends raw bitstream. Dangerous, do not use!!"},
+    {"detect",       CmdT55xxDetect,          AlwaysAvailable, "Try detecting the tag modulation from reading the configuration block"},
     {"deviceconfig", CmdT55xxSetDeviceConfig, IfPm3Lf,         "Set/Get T55XX device configuration"},
-    {"dump",         CmdT55xxDump,            IfPm3Lf,         "[password] [o] Dump T55xx card Page 0 block 0-7. Optional [password], [override]"},
-    {"info",         CmdT55xxInfo,            AlwaysAvailable, "[1] Show T55x7 configuration data (page 0/ blk 0)"},
-    {"p1detect",     CmdT55xxDetectPage1,     IfPm3Lf,         "[1] Try detecting if this is a t55xx tag by reading page 1"},
-    {"read",         CmdT55xxReadBlock,       IfPm3Lf,         "b <block> p [password] [o] [1] -- Read T55xx block data. Optional [p password], [override], [page1]"},
+    {"dump",         CmdT55xxDump,            IfPm3Lf,         "Dump T55xx card Page 0 block 0-7"},
+    {"info",         CmdT55xxInfo,            AlwaysAvailable, "Show T55x7 configuration data (page 0/ blk 0)"},
+    {"p1detect",     CmdT55xxDetectPage1,     IfPm3Lf,         "Try detecting if this is a t55xx tag by reading page 1"},
+    {"read",         CmdT55xxReadBlock,       IfPm3Lf,         "Read T55xx block data"},
     {"resetread",    CmdResetRead,            IfPm3Lf,         "Send Reset Cmd then lf read the stream to attempt to identify the start of it (needs a demod and/or plot after)"},
-    {"restore",      CmdT55xxRestore,         IfPm3Lf,         "f <filename> [p <password>] Restore T55xx card Page 0 / Page 1 blocks"},
-    {"trace",        CmdT55xxReadTrace,       AlwaysAvailable, "[1] Show T55x7 traceability data (page 1/ blk 0-1)"},
+    {"restore",      CmdT55xxRestore,         IfPm3Lf,         "Restore T55xx card Page 0 / Page 1 blocks"},
+    {"trace",        CmdT55xxReadTrace,       AlwaysAvailable, "Show T55x7 traceability data (page 1/ blk 0-1)"},
     {"wakeup",       CmdT55xxWakeUp,          IfPm3Lf,         "Send AOR wakeup command"},
-    {"write",        CmdT55xxWriteBlock,      IfPm3Lf,         "b <block> d <data> p [password] [1] -- Write T55xx block data. Optional [p password], [page1]"},
-
-    {"-----------", CmdHelp,                    AlwaysAvailable, "--------------------- " _CYAN_("recovery") " ---------------------"},
-    {"bruteforce",   CmdT55xxBruteForce,      IfPm3Lf,         "<start password> <end password> Simple bruteforce attack to find password"},
+    {"write",        CmdT55xxWriteBlock,      IfPm3Lf,         "Write T55xx block data"},
+    {"-----------",  CmdHelp,                 AlwaysAvailable, "--------------------- " _CYAN_("recovery") " ---------------------"},
+    {"bruteforce",   CmdT55xxBruteForce,      IfPm3Lf,         "Simple bruteforce attack to find password"},
     {"chk",          CmdT55xxChkPwds,         IfPm3Lf,         "Check passwords from dictionary/flash"},
     {"protect",      CmdT55xxProtect,         IfPm3Lf,         "Password protect tag"},
     {"recoverpw",    CmdT55xxRecoverPW,       IfPm3Lf,         "Try to recover from bad password write from a cloner"},

From 5a004f5505cfeb023e967aa0066a23a61c12dd44 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Tue, 12 Jan 2021 18:07:15 -0500
Subject: [PATCH 350/682] fix gitignore mf_nonce_brute

---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index e451810ce..430ae2cad 100644
--- a/.gitignore
+++ b/.gitignore
@@ -71,6 +71,7 @@ tools/cryptorf/cm
 tools/cryptorf/sm
 tools/cryptorf/sma
 tools/cryptorf/sma_multi
+tools/mf_nonce_brute/mf_nonce_brute
 
 fpga/*
 !fpga/tests

From 6403ef679a9548b1f4a922c0aea61f4de72a7b5c Mon Sep 17 00:00:00 2001
From: Gabriele Gristina <matrix@users.noreply.github.com>
Date: Wed, 13 Jan 2021 23:37:10 +0100
Subject: [PATCH 351/682] add crack5opencl

---
 tools/hitag2crack/Makefile                    |    8 +-
 tools/hitag2crack/README.md                   |   13 +-
 .../hitag2crack/common/OpenCL-Headers/CL/cl.h | 1929 ++++++++++++++++
 .../common/OpenCL-Headers/CL/cl_d3d10.h       |  128 ++
 .../common/OpenCL-Headers/CL/cl_d3d11.h       |  128 ++
 .../OpenCL-Headers/CL/cl_dx9_media_sharing.h  |  118 +
 .../CL/cl_dx9_media_sharing_intel.h           |  170 ++
 .../common/OpenCL-Headers/CL/cl_egl.h         |  120 +
 .../common/OpenCL-Headers/CL/cl_ext.h         |  907 ++++++++
 .../common/OpenCL-Headers/CL/cl_ext_intel.h   |  731 ++++++
 .../common/OpenCL-Headers/CL/cl_gl.h          |  159 ++
 .../common/OpenCL-Headers/CL/cl_gl_ext.h      |   40 +
 .../common/OpenCL-Headers/CL/cl_half.h        |  440 ++++
 .../common/OpenCL-Headers/CL/cl_icd.h         | 1294 +++++++++++
 .../common/OpenCL-Headers/CL/cl_platform.h    | 1384 +++++++++++
 .../CL/cl_va_api_media_sharing_intel.h        |  160 ++
 .../common/OpenCL-Headers/CL/cl_version.h     |   81 +
 .../common/OpenCL-Headers/CL/opencl.h         |   33 +
 .../common/OpenCL-Headers/CODE_OF_CONDUCT.md  |    1 +
 .../hitag2crack/common/OpenCL-Headers/LICENSE |  202 ++
 .../common/OpenCL-Headers/README.md           |   74 +
 tools/hitag2crack/common/hitagcrypto.c        |    4 +
 .../hitag2crack/crack2/ht2crack2buildtable.c  |    3 +-
 tools/hitag2crack/crack5gpu/Makefile          |    4 +
 tools/hitag2crack/crack5opencl/.gitignore     |    2 +
 tools/hitag2crack/crack5opencl/LICENSE.txt    |  674 ++++++
 tools/hitag2crack/crack5opencl/Makefile       |   77 +
 tools/hitag2crack/crack5opencl/README.md      |   57 +
 .../hitag2crack/crack5opencl/dolphin_macro.h  |   38 +
 tools/hitag2crack/crack5opencl/hitag2.c       |  258 +++
 tools/hitag2crack/crack5opencl/hitag2.h       |   84 +
 .../crack5opencl/ht2crack5opencl.c            | 2036 +++++++++++++++++
 .../crack5opencl/ht2crack5opencl.h            |   47 +
 .../crack5opencl/ht2crack5opencl_kernel.cl    |  866 +++++++
 tools/hitag2crack/crack5opencl/opencl.c       |  163 ++
 tools/hitag2crack/crack5opencl/opencl.h       |  129 ++
 tools/hitag2crack/crack5opencl/queue.c        |  551 +++++
 tools/hitag2crack/crack5opencl/queue.h        |  122 +
 tools/hitag2crack/crack5opencl/threads.c      |  730 ++++++
 tools/hitag2crack/crack5opencl/threads.h      |  143 ++
 40 files changed, 14103 insertions(+), 5 deletions(-)
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/CL/cl.h
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/CL/cl_d3d10.h
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/CL/cl_d3d11.h
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/CL/cl_dx9_media_sharing.h
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/CL/cl_dx9_media_sharing_intel.h
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/CL/cl_egl.h
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/CL/cl_ext.h
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/CL/cl_ext_intel.h
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/CL/cl_gl.h
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/CL/cl_gl_ext.h
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/CL/cl_half.h
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/CL/cl_icd.h
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/CL/cl_platform.h
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/CL/cl_va_api_media_sharing_intel.h
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/CL/cl_version.h
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/CL/opencl.h
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/CODE_OF_CONDUCT.md
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/LICENSE
 create mode 100644 tools/hitag2crack/common/OpenCL-Headers/README.md
 create mode 100644 tools/hitag2crack/crack5opencl/.gitignore
 create mode 100644 tools/hitag2crack/crack5opencl/LICENSE.txt
 create mode 100644 tools/hitag2crack/crack5opencl/Makefile
 create mode 100644 tools/hitag2crack/crack5opencl/README.md
 create mode 100644 tools/hitag2crack/crack5opencl/dolphin_macro.h
 create mode 100644 tools/hitag2crack/crack5opencl/hitag2.c
 create mode 100644 tools/hitag2crack/crack5opencl/hitag2.h
 create mode 100644 tools/hitag2crack/crack5opencl/ht2crack5opencl.c
 create mode 100644 tools/hitag2crack/crack5opencl/ht2crack5opencl.h
 create mode 100644 tools/hitag2crack/crack5opencl/ht2crack5opencl_kernel.cl
 create mode 100644 tools/hitag2crack/crack5opencl/opencl.c
 create mode 100644 tools/hitag2crack/crack5opencl/opencl.h
 create mode 100644 tools/hitag2crack/crack5opencl/queue.c
 create mode 100644 tools/hitag2crack/crack5opencl/queue.h
 create mode 100644 tools/hitag2crack/crack5opencl/threads.c
 create mode 100644 tools/hitag2crack/crack5opencl/threads.h

diff --git a/tools/hitag2crack/Makefile b/tools/hitag2crack/Makefile
index c36d18b30..c3e5cebc1 100644
--- a/tools/hitag2crack/Makefile
+++ b/tools/hitag2crack/Makefile
@@ -5,7 +5,7 @@ include ../../Makefile.defs
 
 all clean install uninstall check: %: crack2/% crack3/% crack4/% crack5/%
 ifneq ($(SKIPGPU),1)
-all clean install uninstall check: %: crack5gpu/%
+all clean install uninstall check: %: crack5gpu/% crack5opencl/%
 endif
 
 crack2/%: FORCE
@@ -28,6 +28,10 @@ crack5gpu/%: FORCE
 	$(info [*] MAKE $@)
 	$(Q)$(MAKE) --no-print-directory -C crack5gpu $(patsubst crack5gpu/%,%,$@) DESTDIR=$(MYDESTDIR)
 
+crack5opencl/%: FORCE
+	$(info [*] MAKE $@)
+	$(Q)$(MAKE) --no-print-directory -C crack5opencl $(patsubst crack5opencl/%,%,$@) DESTDIR=$(MYDESTDIR)
+
 FORCE: # Dummy target to force remake in the subdirectories, even if files exist (this Makefile doesn't know about the prerequisites)
 
-.phony: crack2 crack3 crack4 crack5 crack5gpu FORCE
+.phony: crack2 crack3 crack4 crack5 crack5gpu crack5opencl FORCE
diff --git a/tools/hitag2crack/README.md b/tools/hitag2crack/README.md
index 9f31f6d62..9e9e722ef 100644
--- a/tools/hitag2crack/README.md
+++ b/tools/hitag2crack/README.md
@@ -5,6 +5,7 @@ Authors:
 
 * Attacks 1, 2, 3, 4 : Kevin Sheldrake <kev@headhacking.com>
 * Attacks 5, 5gpu : anonymous, based on https://github.com/factoritbv/hitag2hell by FactorIT B.V.
+* Attacks 5, 5opencl : Gabriele Gristina <gabriele.gristina@gmail.com>, based on 5gpu
 
 Introduction
 ------------
@@ -205,8 +206,8 @@ Stop once you got two pairs.
 $ ./ht2crack5 <UID> <nR1> <aR1> <nR2> <aR2>
 ```
 
-Usage details: Attack 5gpu
---------------------------
+Usage details: Attack 5gpu/5opencl
+----------------------------------
 
 Attack 5gpu requires two encrypted nonce and challenge
 response value pairs (nR, aR) for the tag's UID.
@@ -220,6 +221,14 @@ Stop once you got two pairs.
 $ ./ht2crack5gpu <UID> <nR1> <aR1> <nR2> <aR2>
 ```
 
+Attack 5opencl requires the same of 5gpu version.
+
+```
+$ ./ht2crack5opencl <UID> <nR1> <aR1> <nR2> <aR2>
+```
+
+More details in crack5opencl/README.md
+
 Usage details: Next steps
 -------------------------
 
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl.h
new file mode 100644
index 000000000..3a5aae486
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl.h
@@ -0,0 +1,1929 @@
+/*******************************************************************************
+ * Copyright (c) 2008-2020 The Khronos Group Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ ******************************************************************************/
+
+#ifndef __OPENCL_CL_H
+#define __OPENCL_CL_H
+
+#include <CL/cl_version.h>
+#include <CL/cl_platform.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/******************************************************************************/
+
+typedef struct _cl_platform_id *    cl_platform_id;
+typedef struct _cl_device_id *      cl_device_id;
+typedef struct _cl_context *        cl_context;
+typedef struct _cl_command_queue *  cl_command_queue;
+typedef struct _cl_mem *            cl_mem;
+typedef struct _cl_program *        cl_program;
+typedef struct _cl_kernel *         cl_kernel;
+typedef struct _cl_event *          cl_event;
+typedef struct _cl_sampler *        cl_sampler;
+
+typedef cl_uint             cl_bool;                     /* WARNING!  Unlike cl_ types in cl_platform.h, cl_bool is not guaranteed to be the same size as the bool in kernels. */
+typedef cl_ulong            cl_bitfield;
+typedef cl_ulong            cl_properties;
+typedef cl_bitfield         cl_device_type;
+typedef cl_uint             cl_platform_info;
+typedef cl_uint             cl_device_info;
+typedef cl_bitfield         cl_device_fp_config;
+typedef cl_uint             cl_device_mem_cache_type;
+typedef cl_uint             cl_device_local_mem_type;
+typedef cl_bitfield         cl_device_exec_capabilities;
+#ifdef CL_VERSION_2_0
+typedef cl_bitfield         cl_device_svm_capabilities;
+#endif
+typedef cl_bitfield         cl_command_queue_properties;
+#ifdef CL_VERSION_1_2
+typedef intptr_t            cl_device_partition_property;
+typedef cl_bitfield         cl_device_affinity_domain;
+#endif
+
+typedef intptr_t            cl_context_properties;
+typedef cl_uint             cl_context_info;
+#ifdef CL_VERSION_2_0
+typedef cl_properties       cl_queue_properties;
+#endif
+typedef cl_uint             cl_command_queue_info;
+typedef cl_uint             cl_channel_order;
+typedef cl_uint             cl_channel_type;
+typedef cl_bitfield         cl_mem_flags;
+#ifdef CL_VERSION_2_0
+typedef cl_bitfield         cl_svm_mem_flags;
+#endif
+typedef cl_uint             cl_mem_object_type;
+typedef cl_uint             cl_mem_info;
+#ifdef CL_VERSION_1_2
+typedef cl_bitfield         cl_mem_migration_flags;
+#endif
+typedef cl_uint             cl_image_info;
+#ifdef CL_VERSION_1_1
+typedef cl_uint             cl_buffer_create_type;
+#endif
+typedef cl_uint             cl_addressing_mode;
+typedef cl_uint             cl_filter_mode;
+typedef cl_uint             cl_sampler_info;
+typedef cl_bitfield         cl_map_flags;
+#ifdef CL_VERSION_2_0
+typedef intptr_t            cl_pipe_properties;
+typedef cl_uint             cl_pipe_info;
+#endif
+typedef cl_uint             cl_program_info;
+typedef cl_uint             cl_program_build_info;
+#ifdef CL_VERSION_1_2
+typedef cl_uint             cl_program_binary_type;
+#endif
+typedef cl_int              cl_build_status;
+typedef cl_uint             cl_kernel_info;
+#ifdef CL_VERSION_1_2
+typedef cl_uint             cl_kernel_arg_info;
+typedef cl_uint             cl_kernel_arg_address_qualifier;
+typedef cl_uint             cl_kernel_arg_access_qualifier;
+typedef cl_bitfield         cl_kernel_arg_type_qualifier;
+#endif
+typedef cl_uint             cl_kernel_work_group_info;
+#ifdef CL_VERSION_2_1
+typedef cl_uint             cl_kernel_sub_group_info;
+#endif
+typedef cl_uint             cl_event_info;
+typedef cl_uint             cl_command_type;
+typedef cl_uint             cl_profiling_info;
+#ifdef CL_VERSION_2_0
+typedef cl_properties       cl_sampler_properties;
+typedef cl_uint             cl_kernel_exec_info;
+#endif
+#ifdef CL_VERSION_3_0
+typedef cl_bitfield         cl_device_atomic_capabilities;
+typedef cl_bitfield         cl_device_device_enqueue_capabilities;
+typedef cl_uint             cl_khronos_vendor_id;
+typedef cl_properties       cl_mem_properties;
+typedef cl_uint             cl_version;
+#endif
+
+typedef struct _cl_image_format {
+    cl_channel_order        image_channel_order;
+    cl_channel_type         image_channel_data_type;
+} cl_image_format;
+
+#ifdef CL_VERSION_1_2
+
+typedef struct _cl_image_desc {
+    cl_mem_object_type      image_type;
+    size_t                  image_width;
+    size_t                  image_height;
+    size_t                  image_depth;
+    size_t                  image_array_size;
+    size_t                  image_row_pitch;
+    size_t                  image_slice_pitch;
+    cl_uint                 num_mip_levels;
+    cl_uint                 num_samples;
+#ifdef CL_VERSION_2_0
+#if defined(__GNUC__)
+    __extension__                   /* Prevents warnings about anonymous union in -pedantic builds */
+#endif
+#if defined(_MSC_VER) && !defined(__STDC__)
+#pragma warning( push )
+#pragma warning( disable : 4201 )   /* Prevents warning about nameless struct/union in /W4 builds */
+#endif
+#if defined(_MSC_VER) && defined(__STDC__)
+    /* Anonymous unions are not supported in /Za builds */
+#else
+    union {
+#endif
+#endif
+      cl_mem                  buffer;
+#ifdef CL_VERSION_2_0
+#if defined(_MSC_VER) && defined(__STDC__)
+    /* Anonymous unions are not supported in /Za builds */
+#else
+      cl_mem                  mem_object;
+    };
+#endif
+#if defined(_MSC_VER) && !defined(__STDC__)
+#pragma warning( pop )
+#endif
+#endif
+} cl_image_desc;
+
+#endif
+
+#ifdef CL_VERSION_1_1
+
+typedef struct _cl_buffer_region {
+    size_t                  origin;
+    size_t                  size;
+} cl_buffer_region;
+
+#endif
+
+#ifdef CL_VERSION_3_0
+
+#define CL_NAME_VERSION_MAX_NAME_SIZE 64
+
+typedef struct _cl_name_version {
+    cl_version              version;
+    char                    name[CL_NAME_VERSION_MAX_NAME_SIZE];
+} cl_name_version;
+
+#endif
+
+/******************************************************************************/
+
+/* Error Codes */
+#define CL_SUCCESS                                  0
+#define CL_DEVICE_NOT_FOUND                         -1
+#define CL_DEVICE_NOT_AVAILABLE                     -2
+#define CL_COMPILER_NOT_AVAILABLE                   -3
+#define CL_MEM_OBJECT_ALLOCATION_FAILURE            -4
+#define CL_OUT_OF_RESOURCES                         -5
+#define CL_OUT_OF_HOST_MEMORY                       -6
+#define CL_PROFILING_INFO_NOT_AVAILABLE             -7
+#define CL_MEM_COPY_OVERLAP                         -8
+#define CL_IMAGE_FORMAT_MISMATCH                    -9
+#define CL_IMAGE_FORMAT_NOT_SUPPORTED               -10
+#define CL_BUILD_PROGRAM_FAILURE                    -11
+#define CL_MAP_FAILURE                              -12
+#ifdef CL_VERSION_1_1
+#define CL_MISALIGNED_SUB_BUFFER_OFFSET             -13
+#define CL_EXEC_STATUS_ERROR_FOR_EVENTS_IN_WAIT_LIST -14
+#endif
+#ifdef CL_VERSION_1_2
+#define CL_COMPILE_PROGRAM_FAILURE                  -15
+#define CL_LINKER_NOT_AVAILABLE                     -16
+#define CL_LINK_PROGRAM_FAILURE                     -17
+#define CL_DEVICE_PARTITION_FAILED                  -18
+#define CL_KERNEL_ARG_INFO_NOT_AVAILABLE            -19
+#endif
+
+#define CL_INVALID_VALUE                            -30
+#define CL_INVALID_DEVICE_TYPE                      -31
+#define CL_INVALID_PLATFORM                         -32
+#define CL_INVALID_DEVICE                           -33
+#define CL_INVALID_CONTEXT                          -34
+#define CL_INVALID_QUEUE_PROPERTIES                 -35
+#define CL_INVALID_COMMAND_QUEUE                    -36
+#define CL_INVALID_HOST_PTR                         -37
+#define CL_INVALID_MEM_OBJECT                       -38
+#define CL_INVALID_IMAGE_FORMAT_DESCRIPTOR          -39
+#define CL_INVALID_IMAGE_SIZE                       -40
+#define CL_INVALID_SAMPLER                          -41
+#define CL_INVALID_BINARY                           -42
+#define CL_INVALID_BUILD_OPTIONS                    -43
+#define CL_INVALID_PROGRAM                          -44
+#define CL_INVALID_PROGRAM_EXECUTABLE               -45
+#define CL_INVALID_KERNEL_NAME                      -46
+#define CL_INVALID_KERNEL_DEFINITION                -47
+#define CL_INVALID_KERNEL                           -48
+#define CL_INVALID_ARG_INDEX                        -49
+#define CL_INVALID_ARG_VALUE                        -50
+#define CL_INVALID_ARG_SIZE                         -51
+#define CL_INVALID_KERNEL_ARGS                      -52
+#define CL_INVALID_WORK_DIMENSION                   -53
+#define CL_INVALID_WORK_GROUP_SIZE                  -54
+#define CL_INVALID_WORK_ITEM_SIZE                   -55
+#define CL_INVALID_GLOBAL_OFFSET                    -56
+#define CL_INVALID_EVENT_WAIT_LIST                  -57
+#define CL_INVALID_EVENT                            -58
+#define CL_INVALID_OPERATION                        -59
+#define CL_INVALID_GL_OBJECT                        -60
+#define CL_INVALID_BUFFER_SIZE                      -61
+#define CL_INVALID_MIP_LEVEL                        -62
+#define CL_INVALID_GLOBAL_WORK_SIZE                 -63
+#ifdef CL_VERSION_1_1
+#define CL_INVALID_PROPERTY                         -64
+#endif
+#ifdef CL_VERSION_1_2
+#define CL_INVALID_IMAGE_DESCRIPTOR                 -65
+#define CL_INVALID_COMPILER_OPTIONS                 -66
+#define CL_INVALID_LINKER_OPTIONS                   -67
+#define CL_INVALID_DEVICE_PARTITION_COUNT           -68
+#endif
+#ifdef CL_VERSION_2_0
+#define CL_INVALID_PIPE_SIZE                        -69
+#define CL_INVALID_DEVICE_QUEUE                     -70
+#endif
+#ifdef CL_VERSION_2_2
+#define CL_INVALID_SPEC_ID                          -71
+#define CL_MAX_SIZE_RESTRICTION_EXCEEDED            -72
+#endif
+
+
+/* cl_bool */
+#define CL_FALSE                                    0
+#define CL_TRUE                                     1
+#ifdef CL_VERSION_1_2
+#define CL_BLOCKING                                 CL_TRUE
+#define CL_NON_BLOCKING                             CL_FALSE
+#endif
+
+/* cl_platform_info */
+#define CL_PLATFORM_PROFILE                         0x0900
+#define CL_PLATFORM_VERSION                         0x0901
+#define CL_PLATFORM_NAME                            0x0902
+#define CL_PLATFORM_VENDOR                          0x0903
+#define CL_PLATFORM_EXTENSIONS                      0x0904
+#ifdef CL_VERSION_2_1
+#define CL_PLATFORM_HOST_TIMER_RESOLUTION           0x0905
+#endif
+#ifdef CL_VERSION_3_0
+#define CL_PLATFORM_NUMERIC_VERSION                 0x0906
+#define CL_PLATFORM_EXTENSIONS_WITH_VERSION         0x0907
+#endif
+
+/* cl_device_type - bitfield */
+#define CL_DEVICE_TYPE_DEFAULT                      (1 << 0)
+#define CL_DEVICE_TYPE_CPU                          (1 << 1)
+#define CL_DEVICE_TYPE_GPU                          (1 << 2)
+#define CL_DEVICE_TYPE_ACCELERATOR                  (1 << 3)
+#ifdef CL_VERSION_1_2
+#define CL_DEVICE_TYPE_CUSTOM                       (1 << 4)
+#endif
+#define CL_DEVICE_TYPE_ALL                          0xFFFFFFFF
+
+/* cl_device_info */
+#define CL_DEVICE_TYPE                                   0x1000
+#define CL_DEVICE_VENDOR_ID                              0x1001
+#define CL_DEVICE_MAX_COMPUTE_UNITS                      0x1002
+#define CL_DEVICE_MAX_WORK_ITEM_DIMENSIONS               0x1003
+#define CL_DEVICE_MAX_WORK_GROUP_SIZE                    0x1004
+#define CL_DEVICE_MAX_WORK_ITEM_SIZES                    0x1005
+#define CL_DEVICE_PREFERRED_VECTOR_WIDTH_CHAR            0x1006
+#define CL_DEVICE_PREFERRED_VECTOR_WIDTH_SHORT           0x1007
+#define CL_DEVICE_PREFERRED_VECTOR_WIDTH_INT             0x1008
+#define CL_DEVICE_PREFERRED_VECTOR_WIDTH_LONG            0x1009
+#define CL_DEVICE_PREFERRED_VECTOR_WIDTH_FLOAT           0x100A
+#define CL_DEVICE_PREFERRED_VECTOR_WIDTH_DOUBLE          0x100B
+#define CL_DEVICE_MAX_CLOCK_FREQUENCY                    0x100C
+#define CL_DEVICE_ADDRESS_BITS                           0x100D
+#define CL_DEVICE_MAX_READ_IMAGE_ARGS                    0x100E
+#define CL_DEVICE_MAX_WRITE_IMAGE_ARGS                   0x100F
+#define CL_DEVICE_MAX_MEM_ALLOC_SIZE                     0x1010
+#define CL_DEVICE_IMAGE2D_MAX_WIDTH                      0x1011
+#define CL_DEVICE_IMAGE2D_MAX_HEIGHT                     0x1012
+#define CL_DEVICE_IMAGE3D_MAX_WIDTH                      0x1013
+#define CL_DEVICE_IMAGE3D_MAX_HEIGHT                     0x1014
+#define CL_DEVICE_IMAGE3D_MAX_DEPTH                      0x1015
+#define CL_DEVICE_IMAGE_SUPPORT                          0x1016
+#define CL_DEVICE_MAX_PARAMETER_SIZE                     0x1017
+#define CL_DEVICE_MAX_SAMPLERS                           0x1018
+#define CL_DEVICE_MEM_BASE_ADDR_ALIGN                    0x1019
+#define CL_DEVICE_MIN_DATA_TYPE_ALIGN_SIZE               0x101A
+#define CL_DEVICE_SINGLE_FP_CONFIG                       0x101B
+#define CL_DEVICE_GLOBAL_MEM_CACHE_TYPE                  0x101C
+#define CL_DEVICE_GLOBAL_MEM_CACHELINE_SIZE              0x101D
+#define CL_DEVICE_GLOBAL_MEM_CACHE_SIZE                  0x101E
+#define CL_DEVICE_GLOBAL_MEM_SIZE                        0x101F
+#define CL_DEVICE_MAX_CONSTANT_BUFFER_SIZE               0x1020
+#define CL_DEVICE_MAX_CONSTANT_ARGS                      0x1021
+#define CL_DEVICE_LOCAL_MEM_TYPE                         0x1022
+#define CL_DEVICE_LOCAL_MEM_SIZE                         0x1023
+#define CL_DEVICE_ERROR_CORRECTION_SUPPORT               0x1024
+#define CL_DEVICE_PROFILING_TIMER_RESOLUTION             0x1025
+#define CL_DEVICE_ENDIAN_LITTLE                          0x1026
+#define CL_DEVICE_AVAILABLE                              0x1027
+#define CL_DEVICE_COMPILER_AVAILABLE                     0x1028
+#define CL_DEVICE_EXECUTION_CAPABILITIES                 0x1029
+#define CL_DEVICE_QUEUE_PROPERTIES                       0x102A    /* deprecated */
+#ifdef CL_VERSION_2_0
+#define CL_DEVICE_QUEUE_ON_HOST_PROPERTIES               0x102A
+#endif
+#define CL_DEVICE_NAME                                   0x102B
+#define CL_DEVICE_VENDOR                                 0x102C
+#define CL_DRIVER_VERSION                                0x102D
+#define CL_DEVICE_PROFILE                                0x102E
+#define CL_DEVICE_VERSION                                0x102F
+#define CL_DEVICE_EXTENSIONS                             0x1030
+#define CL_DEVICE_PLATFORM                               0x1031
+#ifdef CL_VERSION_1_2
+#define CL_DEVICE_DOUBLE_FP_CONFIG                       0x1032
+#endif
+/* 0x1033 reserved for CL_DEVICE_HALF_FP_CONFIG which is already defined in "cl_ext.h" */
+#ifdef CL_VERSION_1_1
+#define CL_DEVICE_PREFERRED_VECTOR_WIDTH_HALF            0x1034
+#define CL_DEVICE_HOST_UNIFIED_MEMORY                    0x1035   /* deprecated */
+#define CL_DEVICE_NATIVE_VECTOR_WIDTH_CHAR               0x1036
+#define CL_DEVICE_NATIVE_VECTOR_WIDTH_SHORT              0x1037
+#define CL_DEVICE_NATIVE_VECTOR_WIDTH_INT                0x1038
+#define CL_DEVICE_NATIVE_VECTOR_WIDTH_LONG               0x1039
+#define CL_DEVICE_NATIVE_VECTOR_WIDTH_FLOAT              0x103A
+#define CL_DEVICE_NATIVE_VECTOR_WIDTH_DOUBLE             0x103B
+#define CL_DEVICE_NATIVE_VECTOR_WIDTH_HALF               0x103C
+#define CL_DEVICE_OPENCL_C_VERSION                       0x103D
+#endif
+#ifdef CL_VERSION_1_2
+#define CL_DEVICE_LINKER_AVAILABLE                       0x103E
+#define CL_DEVICE_BUILT_IN_KERNELS                       0x103F
+#define CL_DEVICE_IMAGE_MAX_BUFFER_SIZE                  0x1040
+#define CL_DEVICE_IMAGE_MAX_ARRAY_SIZE                   0x1041
+#define CL_DEVICE_PARENT_DEVICE                          0x1042
+#define CL_DEVICE_PARTITION_MAX_SUB_DEVICES              0x1043
+#define CL_DEVICE_PARTITION_PROPERTIES                   0x1044
+#define CL_DEVICE_PARTITION_AFFINITY_DOMAIN              0x1045
+#define CL_DEVICE_PARTITION_TYPE                         0x1046
+#define CL_DEVICE_REFERENCE_COUNT                        0x1047
+#define CL_DEVICE_PREFERRED_INTEROP_USER_SYNC            0x1048
+#define CL_DEVICE_PRINTF_BUFFER_SIZE                     0x1049
+#endif
+#ifdef CL_VERSION_2_0
+#define CL_DEVICE_IMAGE_PITCH_ALIGNMENT                  0x104A
+#define CL_DEVICE_IMAGE_BASE_ADDRESS_ALIGNMENT           0x104B
+#define CL_DEVICE_MAX_READ_WRITE_IMAGE_ARGS              0x104C
+#define CL_DEVICE_MAX_GLOBAL_VARIABLE_SIZE               0x104D
+#define CL_DEVICE_QUEUE_ON_DEVICE_PROPERTIES             0x104E
+#define CL_DEVICE_QUEUE_ON_DEVICE_PREFERRED_SIZE         0x104F
+#define CL_DEVICE_QUEUE_ON_DEVICE_MAX_SIZE               0x1050
+#define CL_DEVICE_MAX_ON_DEVICE_QUEUES                   0x1051
+#define CL_DEVICE_MAX_ON_DEVICE_EVENTS                   0x1052
+#define CL_DEVICE_SVM_CAPABILITIES                       0x1053
+#define CL_DEVICE_GLOBAL_VARIABLE_PREFERRED_TOTAL_SIZE   0x1054
+#define CL_DEVICE_MAX_PIPE_ARGS                          0x1055
+#define CL_DEVICE_PIPE_MAX_ACTIVE_RESERVATIONS           0x1056
+#define CL_DEVICE_PIPE_MAX_PACKET_SIZE                   0x1057
+#define CL_DEVICE_PREFERRED_PLATFORM_ATOMIC_ALIGNMENT    0x1058
+#define CL_DEVICE_PREFERRED_GLOBAL_ATOMIC_ALIGNMENT      0x1059
+#define CL_DEVICE_PREFERRED_LOCAL_ATOMIC_ALIGNMENT       0x105A
+#endif
+#ifdef CL_VERSION_2_1
+#define CL_DEVICE_IL_VERSION                             0x105B
+#define CL_DEVICE_MAX_NUM_SUB_GROUPS                     0x105C
+#define CL_DEVICE_SUB_GROUP_INDEPENDENT_FORWARD_PROGRESS 0x105D
+#endif
+#ifdef CL_VERSION_3_0
+#define CL_DEVICE_NUMERIC_VERSION                        0x105E
+#define CL_DEVICE_EXTENSIONS_WITH_VERSION                0x1060
+#define CL_DEVICE_ILS_WITH_VERSION                       0x1061
+#define CL_DEVICE_BUILT_IN_KERNELS_WITH_VERSION          0x1062
+#define CL_DEVICE_ATOMIC_MEMORY_CAPABILITIES             0x1063
+#define CL_DEVICE_ATOMIC_FENCE_CAPABILITIES              0x1064
+#define CL_DEVICE_NON_UNIFORM_WORK_GROUP_SUPPORT         0x1065
+#define CL_DEVICE_OPENCL_C_ALL_VERSIONS                  0x1066
+#define CL_DEVICE_PREFERRED_WORK_GROUP_SIZE_MULTIPLE     0x1067
+#define CL_DEVICE_WORK_GROUP_COLLECTIVE_FUNCTIONS_SUPPORT 0x1068
+#define CL_DEVICE_GENERIC_ADDRESS_SPACE_SUPPORT          0x1069
+/* 0x106A to 0x106E - Reserved for upcoming KHR extension */
+#define CL_DEVICE_OPENCL_C_FEATURES                      0x106F
+#define CL_DEVICE_DEVICE_ENQUEUE_CAPABILITIES            0x1070
+#define CL_DEVICE_PIPE_SUPPORT                           0x1071
+#define CL_DEVICE_LATEST_CONFORMANCE_VERSION_PASSED      0x1072
+#endif
+
+/* cl_device_fp_config - bitfield */
+#define CL_FP_DENORM                                (1 << 0)
+#define CL_FP_INF_NAN                               (1 << 1)
+#define CL_FP_ROUND_TO_NEAREST                      (1 << 2)
+#define CL_FP_ROUND_TO_ZERO                         (1 << 3)
+#define CL_FP_ROUND_TO_INF                          (1 << 4)
+#define CL_FP_FMA                                   (1 << 5)
+#ifdef CL_VERSION_1_1
+#define CL_FP_SOFT_FLOAT                            (1 << 6)
+#endif
+#ifdef CL_VERSION_1_2
+#define CL_FP_CORRECTLY_ROUNDED_DIVIDE_SQRT         (1 << 7)
+#endif
+
+/* cl_device_mem_cache_type */
+#define CL_NONE                                     0x0
+#define CL_READ_ONLY_CACHE                          0x1
+#define CL_READ_WRITE_CACHE                         0x2
+
+/* cl_device_local_mem_type */
+#define CL_LOCAL                                    0x1
+#define CL_GLOBAL                                   0x2
+
+/* cl_device_exec_capabilities - bitfield */
+#define CL_EXEC_KERNEL                              (1 << 0)
+#define CL_EXEC_NATIVE_KERNEL                       (1 << 1)
+
+/* cl_command_queue_properties - bitfield */
+#define CL_QUEUE_OUT_OF_ORDER_EXEC_MODE_ENABLE      (1 << 0)
+#define CL_QUEUE_PROFILING_ENABLE                   (1 << 1)
+#ifdef CL_VERSION_2_0
+#define CL_QUEUE_ON_DEVICE                          (1 << 2)
+#define CL_QUEUE_ON_DEVICE_DEFAULT                  (1 << 3)
+#endif
+
+/* cl_context_info */
+#define CL_CONTEXT_REFERENCE_COUNT                  0x1080
+#define CL_CONTEXT_DEVICES                          0x1081
+#define CL_CONTEXT_PROPERTIES                       0x1082
+#ifdef CL_VERSION_1_1
+#define CL_CONTEXT_NUM_DEVICES                      0x1083
+#endif
+
+/* cl_context_properties */
+#define CL_CONTEXT_PLATFORM                         0x1084
+#ifdef CL_VERSION_1_2
+#define CL_CONTEXT_INTEROP_USER_SYNC                0x1085
+#endif
+
+#ifdef CL_VERSION_1_2
+
+/* cl_device_partition_property */
+#define CL_DEVICE_PARTITION_EQUALLY                 0x1086
+#define CL_DEVICE_PARTITION_BY_COUNTS               0x1087
+#define CL_DEVICE_PARTITION_BY_COUNTS_LIST_END      0x0
+#define CL_DEVICE_PARTITION_BY_AFFINITY_DOMAIN      0x1088
+
+#endif
+
+#ifdef CL_VERSION_1_2
+
+/* cl_device_affinity_domain */
+#define CL_DEVICE_AFFINITY_DOMAIN_NUMA               (1 << 0)
+#define CL_DEVICE_AFFINITY_DOMAIN_L4_CACHE           (1 << 1)
+#define CL_DEVICE_AFFINITY_DOMAIN_L3_CACHE           (1 << 2)
+#define CL_DEVICE_AFFINITY_DOMAIN_L2_CACHE           (1 << 3)
+#define CL_DEVICE_AFFINITY_DOMAIN_L1_CACHE           (1 << 4)
+#define CL_DEVICE_AFFINITY_DOMAIN_NEXT_PARTITIONABLE (1 << 5)
+
+#endif
+
+#ifdef CL_VERSION_2_0
+
+/* cl_device_svm_capabilities */
+#define CL_DEVICE_SVM_COARSE_GRAIN_BUFFER           (1 << 0)
+#define CL_DEVICE_SVM_FINE_GRAIN_BUFFER             (1 << 1)
+#define CL_DEVICE_SVM_FINE_GRAIN_SYSTEM             (1 << 2)
+#define CL_DEVICE_SVM_ATOMICS                       (1 << 3)
+
+#endif
+
+/* cl_command_queue_info */
+#define CL_QUEUE_CONTEXT                            0x1090
+#define CL_QUEUE_DEVICE                             0x1091
+#define CL_QUEUE_REFERENCE_COUNT                    0x1092
+#define CL_QUEUE_PROPERTIES                         0x1093
+#ifdef CL_VERSION_2_0
+#define CL_QUEUE_SIZE                               0x1094
+#endif
+#ifdef CL_VERSION_2_1
+#define CL_QUEUE_DEVICE_DEFAULT                     0x1095
+#endif
+#ifdef CL_VERSION_3_0
+#define CL_QUEUE_PROPERTIES_ARRAY                   0x1098
+#endif
+
+/* cl_mem_flags and cl_svm_mem_flags - bitfield */
+#define CL_MEM_READ_WRITE                           (1 << 0)
+#define CL_MEM_WRITE_ONLY                           (1 << 1)
+#define CL_MEM_READ_ONLY                            (1 << 2)
+#define CL_MEM_USE_HOST_PTR                         (1 << 3)
+#define CL_MEM_ALLOC_HOST_PTR                       (1 << 4)
+#define CL_MEM_COPY_HOST_PTR                        (1 << 5)
+/* reserved                                         (1 << 6)    */
+#ifdef CL_VERSION_1_2
+#define CL_MEM_HOST_WRITE_ONLY                      (1 << 7)
+#define CL_MEM_HOST_READ_ONLY                       (1 << 8)
+#define CL_MEM_HOST_NO_ACCESS                       (1 << 9)
+#endif
+#ifdef CL_VERSION_2_0
+#define CL_MEM_SVM_FINE_GRAIN_BUFFER                (1 << 10)   /* used by cl_svm_mem_flags only */
+#define CL_MEM_SVM_ATOMICS                          (1 << 11)   /* used by cl_svm_mem_flags only */
+#define CL_MEM_KERNEL_READ_AND_WRITE                (1 << 12)
+#endif
+
+#ifdef CL_VERSION_1_2
+
+/* cl_mem_migration_flags - bitfield */
+#define CL_MIGRATE_MEM_OBJECT_HOST                  (1 << 0)
+#define CL_MIGRATE_MEM_OBJECT_CONTENT_UNDEFINED     (1 << 1)
+
+#endif
+
+/* cl_channel_order */
+#define CL_R                                        0x10B0
+#define CL_A                                        0x10B1
+#define CL_RG                                       0x10B2
+#define CL_RA                                       0x10B3
+#define CL_RGB                                      0x10B4
+#define CL_RGBA                                     0x10B5
+#define CL_BGRA                                     0x10B6
+#define CL_ARGB                                     0x10B7
+#define CL_INTENSITY                                0x10B8
+#define CL_LUMINANCE                                0x10B9
+#ifdef CL_VERSION_1_1
+#define CL_Rx                                       0x10BA
+#define CL_RGx                                      0x10BB
+#define CL_RGBx                                     0x10BC
+#endif
+#ifdef CL_VERSION_1_2
+#define CL_DEPTH                                    0x10BD
+#define CL_DEPTH_STENCIL                            0x10BE
+#endif
+#ifdef CL_VERSION_2_0
+#define CL_sRGB                                     0x10BF
+#define CL_sRGBx                                    0x10C0
+#define CL_sRGBA                                    0x10C1
+#define CL_sBGRA                                    0x10C2
+#define CL_ABGR                                     0x10C3
+#endif
+
+/* cl_channel_type */
+#define CL_SNORM_INT8                               0x10D0
+#define CL_SNORM_INT16                              0x10D1
+#define CL_UNORM_INT8                               0x10D2
+#define CL_UNORM_INT16                              0x10D3
+#define CL_UNORM_SHORT_565                          0x10D4
+#define CL_UNORM_SHORT_555                          0x10D5
+#define CL_UNORM_INT_101010                         0x10D6
+#define CL_SIGNED_INT8                              0x10D7
+#define CL_SIGNED_INT16                             0x10D8
+#define CL_SIGNED_INT32                             0x10D9
+#define CL_UNSIGNED_INT8                            0x10DA
+#define CL_UNSIGNED_INT16                           0x10DB
+#define CL_UNSIGNED_INT32                           0x10DC
+#define CL_HALF_FLOAT                               0x10DD
+#define CL_FLOAT                                    0x10DE
+#ifdef CL_VERSION_1_2
+#define CL_UNORM_INT24                              0x10DF
+#endif
+#ifdef CL_VERSION_2_1
+#define CL_UNORM_INT_101010_2                       0x10E0
+#endif
+
+/* cl_mem_object_type */
+#define CL_MEM_OBJECT_BUFFER                        0x10F0
+#define CL_MEM_OBJECT_IMAGE2D                       0x10F1
+#define CL_MEM_OBJECT_IMAGE3D                       0x10F2
+#ifdef CL_VERSION_1_2
+#define CL_MEM_OBJECT_IMAGE2D_ARRAY                 0x10F3
+#define CL_MEM_OBJECT_IMAGE1D                       0x10F4
+#define CL_MEM_OBJECT_IMAGE1D_ARRAY                 0x10F5
+#define CL_MEM_OBJECT_IMAGE1D_BUFFER                0x10F6
+#endif
+#ifdef CL_VERSION_2_0
+#define CL_MEM_OBJECT_PIPE                          0x10F7
+#endif
+
+/* cl_mem_info */
+#define CL_MEM_TYPE                                 0x1100
+#define CL_MEM_FLAGS                                0x1101
+#define CL_MEM_SIZE                                 0x1102
+#define CL_MEM_HOST_PTR                             0x1103
+#define CL_MEM_MAP_COUNT                            0x1104
+#define CL_MEM_REFERENCE_COUNT                      0x1105
+#define CL_MEM_CONTEXT                              0x1106
+#ifdef CL_VERSION_1_1
+#define CL_MEM_ASSOCIATED_MEMOBJECT                 0x1107
+#define CL_MEM_OFFSET                               0x1108
+#endif
+#ifdef CL_VERSION_2_0
+#define CL_MEM_USES_SVM_POINTER                     0x1109
+#endif
+#ifdef CL_VERSION_3_0
+#define CL_MEM_PROPERTIES                           0x110A
+#endif
+
+/* cl_image_info */
+#define CL_IMAGE_FORMAT                             0x1110
+#define CL_IMAGE_ELEMENT_SIZE                       0x1111
+#define CL_IMAGE_ROW_PITCH                          0x1112
+#define CL_IMAGE_SLICE_PITCH                        0x1113
+#define CL_IMAGE_WIDTH                              0x1114
+#define CL_IMAGE_HEIGHT                             0x1115
+#define CL_IMAGE_DEPTH                              0x1116
+#ifdef CL_VERSION_1_2
+#define CL_IMAGE_ARRAY_SIZE                         0x1117
+#define CL_IMAGE_BUFFER                             0x1118
+#define CL_IMAGE_NUM_MIP_LEVELS                     0x1119
+#define CL_IMAGE_NUM_SAMPLES                        0x111A
+#endif
+
+
+/* cl_pipe_info */
+#ifdef CL_VERSION_2_0
+#define CL_PIPE_PACKET_SIZE                         0x1120
+#define CL_PIPE_MAX_PACKETS                         0x1121
+#endif
+#ifdef CL_VERSION_3_0
+#define CL_PIPE_PROPERTIES                          0x1122
+#endif
+
+/* cl_addressing_mode */
+#define CL_ADDRESS_NONE                             0x1130
+#define CL_ADDRESS_CLAMP_TO_EDGE                    0x1131
+#define CL_ADDRESS_CLAMP                            0x1132
+#define CL_ADDRESS_REPEAT                           0x1133
+#ifdef CL_VERSION_1_1
+#define CL_ADDRESS_MIRRORED_REPEAT                  0x1134
+#endif
+
+/* cl_filter_mode */
+#define CL_FILTER_NEAREST                           0x1140
+#define CL_FILTER_LINEAR                            0x1141
+
+/* cl_sampler_info */
+#define CL_SAMPLER_REFERENCE_COUNT                  0x1150
+#define CL_SAMPLER_CONTEXT                          0x1151
+#define CL_SAMPLER_NORMALIZED_COORDS                0x1152
+#define CL_SAMPLER_ADDRESSING_MODE                  0x1153
+#define CL_SAMPLER_FILTER_MODE                      0x1154
+#ifdef CL_VERSION_2_0
+/* These enumerants are for the cl_khr_mipmap_image extension.
+   They have since been added to cl_ext.h with an appropriate
+   KHR suffix, but are left here for backwards compatibility. */
+#define CL_SAMPLER_MIP_FILTER_MODE                  0x1155
+#define CL_SAMPLER_LOD_MIN                          0x1156
+#define CL_SAMPLER_LOD_MAX                          0x1157
+#endif
+#ifdef CL_VERSION_3_0
+#define CL_SAMPLER_PROPERTIES                       0x1158
+#endif
+
+/* cl_map_flags - bitfield */
+#define CL_MAP_READ                                 (1 << 0)
+#define CL_MAP_WRITE                                (1 << 1)
+#ifdef CL_VERSION_1_2
+#define CL_MAP_WRITE_INVALIDATE_REGION              (1 << 2)
+#endif
+
+/* cl_program_info */
+#define CL_PROGRAM_REFERENCE_COUNT                  0x1160
+#define CL_PROGRAM_CONTEXT                          0x1161
+#define CL_PROGRAM_NUM_DEVICES                      0x1162
+#define CL_PROGRAM_DEVICES                          0x1163
+#define CL_PROGRAM_SOURCE                           0x1164
+#define CL_PROGRAM_BINARY_SIZES                     0x1165
+#define CL_PROGRAM_BINARIES                         0x1166
+#ifdef CL_VERSION_1_2
+#define CL_PROGRAM_NUM_KERNELS                      0x1167
+#define CL_PROGRAM_KERNEL_NAMES                     0x1168
+#endif
+#ifdef CL_VERSION_2_1
+#define CL_PROGRAM_IL                               0x1169
+#endif
+#ifdef CL_VERSION_2_2
+#define CL_PROGRAM_SCOPE_GLOBAL_CTORS_PRESENT       0x116A
+#define CL_PROGRAM_SCOPE_GLOBAL_DTORS_PRESENT       0x116B
+#endif
+
+/* cl_program_build_info */
+#define CL_PROGRAM_BUILD_STATUS                     0x1181
+#define CL_PROGRAM_BUILD_OPTIONS                    0x1182
+#define CL_PROGRAM_BUILD_LOG                        0x1183
+#ifdef CL_VERSION_1_2
+#define CL_PROGRAM_BINARY_TYPE                      0x1184
+#endif
+#ifdef CL_VERSION_2_0
+#define CL_PROGRAM_BUILD_GLOBAL_VARIABLE_TOTAL_SIZE 0x1185
+#endif
+
+#ifdef CL_VERSION_1_2
+
+/* cl_program_binary_type */
+#define CL_PROGRAM_BINARY_TYPE_NONE                 0x0
+#define CL_PROGRAM_BINARY_TYPE_COMPILED_OBJECT      0x1
+#define CL_PROGRAM_BINARY_TYPE_LIBRARY              0x2
+#define CL_PROGRAM_BINARY_TYPE_EXECUTABLE           0x4
+
+#endif
+
+/* cl_build_status */
+#define CL_BUILD_SUCCESS                            0
+#define CL_BUILD_NONE                               -1
+#define CL_BUILD_ERROR                              -2
+#define CL_BUILD_IN_PROGRESS                        -3
+
+/* cl_kernel_info */
+#define CL_KERNEL_FUNCTION_NAME                     0x1190
+#define CL_KERNEL_NUM_ARGS                          0x1191
+#define CL_KERNEL_REFERENCE_COUNT                   0x1192
+#define CL_KERNEL_CONTEXT                           0x1193
+#define CL_KERNEL_PROGRAM                           0x1194
+#ifdef CL_VERSION_1_2
+#define CL_KERNEL_ATTRIBUTES                        0x1195
+#endif
+
+#ifdef CL_VERSION_1_2
+
+/* cl_kernel_arg_info */
+#define CL_KERNEL_ARG_ADDRESS_QUALIFIER             0x1196
+#define CL_KERNEL_ARG_ACCESS_QUALIFIER              0x1197
+#define CL_KERNEL_ARG_TYPE_NAME                     0x1198
+#define CL_KERNEL_ARG_TYPE_QUALIFIER                0x1199
+#define CL_KERNEL_ARG_NAME                          0x119A
+
+#endif
+
+#ifdef CL_VERSION_1_2
+
+/* cl_kernel_arg_address_qualifier */
+#define CL_KERNEL_ARG_ADDRESS_GLOBAL                0x119B
+#define CL_KERNEL_ARG_ADDRESS_LOCAL                 0x119C
+#define CL_KERNEL_ARG_ADDRESS_CONSTANT              0x119D
+#define CL_KERNEL_ARG_ADDRESS_PRIVATE               0x119E
+
+#endif
+
+#ifdef CL_VERSION_1_2
+
+/* cl_kernel_arg_access_qualifier */
+#define CL_KERNEL_ARG_ACCESS_READ_ONLY              0x11A0
+#define CL_KERNEL_ARG_ACCESS_WRITE_ONLY             0x11A1
+#define CL_KERNEL_ARG_ACCESS_READ_WRITE             0x11A2
+#define CL_KERNEL_ARG_ACCESS_NONE                   0x11A3
+
+#endif
+
+#ifdef CL_VERSION_1_2
+
+/* cl_kernel_arg_type_qualifier */
+#define CL_KERNEL_ARG_TYPE_NONE                     0
+#define CL_KERNEL_ARG_TYPE_CONST                    (1 << 0)
+#define CL_KERNEL_ARG_TYPE_RESTRICT                 (1 << 1)
+#define CL_KERNEL_ARG_TYPE_VOLATILE                 (1 << 2)
+#ifdef CL_VERSION_2_0
+#define CL_KERNEL_ARG_TYPE_PIPE                     (1 << 3)
+#endif
+
+#endif
+
+/* cl_kernel_work_group_info */
+#define CL_KERNEL_WORK_GROUP_SIZE                   0x11B0
+#define CL_KERNEL_COMPILE_WORK_GROUP_SIZE           0x11B1
+#define CL_KERNEL_LOCAL_MEM_SIZE                    0x11B2
+#define CL_KERNEL_PREFERRED_WORK_GROUP_SIZE_MULTIPLE 0x11B3
+#define CL_KERNEL_PRIVATE_MEM_SIZE                  0x11B4
+#ifdef CL_VERSION_1_2
+#define CL_KERNEL_GLOBAL_WORK_SIZE                  0x11B5
+#endif
+
+#ifdef CL_VERSION_2_1
+
+/* cl_kernel_sub_group_info */
+#define CL_KERNEL_MAX_SUB_GROUP_SIZE_FOR_NDRANGE    0x2033
+#define CL_KERNEL_SUB_GROUP_COUNT_FOR_NDRANGE       0x2034
+#define CL_KERNEL_LOCAL_SIZE_FOR_SUB_GROUP_COUNT    0x11B8
+#define CL_KERNEL_MAX_NUM_SUB_GROUPS                0x11B9
+#define CL_KERNEL_COMPILE_NUM_SUB_GROUPS            0x11BA
+
+#endif
+
+#ifdef CL_VERSION_2_0
+
+/* cl_kernel_exec_info */
+#define CL_KERNEL_EXEC_INFO_SVM_PTRS                0x11B6
+#define CL_KERNEL_EXEC_INFO_SVM_FINE_GRAIN_SYSTEM   0x11B7
+
+#endif
+
+/* cl_event_info */
+#define CL_EVENT_COMMAND_QUEUE                      0x11D0
+#define CL_EVENT_COMMAND_TYPE                       0x11D1
+#define CL_EVENT_REFERENCE_COUNT                    0x11D2
+#define CL_EVENT_COMMAND_EXECUTION_STATUS           0x11D3
+#ifdef CL_VERSION_1_1
+#define CL_EVENT_CONTEXT                            0x11D4
+#endif
+
+/* cl_command_type */
+#define CL_COMMAND_NDRANGE_KERNEL                   0x11F0
+#define CL_COMMAND_TASK                             0x11F1
+#define CL_COMMAND_NATIVE_KERNEL                    0x11F2
+#define CL_COMMAND_READ_BUFFER                      0x11F3
+#define CL_COMMAND_WRITE_BUFFER                     0x11F4
+#define CL_COMMAND_COPY_BUFFER                      0x11F5
+#define CL_COMMAND_READ_IMAGE                       0x11F6
+#define CL_COMMAND_WRITE_IMAGE                      0x11F7
+#define CL_COMMAND_COPY_IMAGE                       0x11F8
+#define CL_COMMAND_COPY_IMAGE_TO_BUFFER             0x11F9
+#define CL_COMMAND_COPY_BUFFER_TO_IMAGE             0x11FA
+#define CL_COMMAND_MAP_BUFFER                       0x11FB
+#define CL_COMMAND_MAP_IMAGE                        0x11FC
+#define CL_COMMAND_UNMAP_MEM_OBJECT                 0x11FD
+#define CL_COMMAND_MARKER                           0x11FE
+#define CL_COMMAND_ACQUIRE_GL_OBJECTS               0x11FF
+#define CL_COMMAND_RELEASE_GL_OBJECTS               0x1200
+#ifdef CL_VERSION_1_1
+#define CL_COMMAND_READ_BUFFER_RECT                 0x1201
+#define CL_COMMAND_WRITE_BUFFER_RECT                0x1202
+#define CL_COMMAND_COPY_BUFFER_RECT                 0x1203
+#define CL_COMMAND_USER                             0x1204
+#endif
+#ifdef CL_VERSION_1_2
+#define CL_COMMAND_BARRIER                          0x1205
+#define CL_COMMAND_MIGRATE_MEM_OBJECTS              0x1206
+#define CL_COMMAND_FILL_BUFFER                      0x1207
+#define CL_COMMAND_FILL_IMAGE                       0x1208
+#endif
+#ifdef CL_VERSION_2_0
+#define CL_COMMAND_SVM_FREE                         0x1209
+#define CL_COMMAND_SVM_MEMCPY                       0x120A
+#define CL_COMMAND_SVM_MEMFILL                      0x120B
+#define CL_COMMAND_SVM_MAP                          0x120C
+#define CL_COMMAND_SVM_UNMAP                        0x120D
+#endif
+#ifdef CL_VERSION_3_0
+#define CL_COMMAND_SVM_MIGRATE_MEM                  0x120E
+#endif
+
+/* command execution status */
+#define CL_COMPLETE                                 0x0
+#define CL_RUNNING                                  0x1
+#define CL_SUBMITTED                                0x2
+#define CL_QUEUED                                   0x3
+
+/* cl_buffer_create_type */
+#ifdef CL_VERSION_1_1
+#define CL_BUFFER_CREATE_TYPE_REGION                0x1220
+#endif
+
+/* cl_profiling_info */
+#define CL_PROFILING_COMMAND_QUEUED                 0x1280
+#define CL_PROFILING_COMMAND_SUBMIT                 0x1281
+#define CL_PROFILING_COMMAND_START                  0x1282
+#define CL_PROFILING_COMMAND_END                    0x1283
+#ifdef CL_VERSION_2_0
+#define CL_PROFILING_COMMAND_COMPLETE               0x1284
+#endif
+
+/* cl_device_atomic_capabilities - bitfield */
+#ifdef CL_VERSION_3_0
+#define CL_DEVICE_ATOMIC_ORDER_RELAXED          (1 << 0)
+#define CL_DEVICE_ATOMIC_ORDER_ACQ_REL          (1 << 1)
+#define CL_DEVICE_ATOMIC_ORDER_SEQ_CST          (1 << 2)
+#define CL_DEVICE_ATOMIC_SCOPE_WORK_ITEM        (1 << 3)
+#define CL_DEVICE_ATOMIC_SCOPE_WORK_GROUP       (1 << 4)
+#define CL_DEVICE_ATOMIC_SCOPE_DEVICE           (1 << 5)
+#define CL_DEVICE_ATOMIC_SCOPE_ALL_DEVICES      (1 << 6)
+#endif
+
+/* cl_device_device_enqueue_capabilities - bitfield */
+#ifdef CL_VERSION_3_0
+#define CL_DEVICE_QUEUE_SUPPORTED               (1 << 0)
+#define CL_DEVICE_QUEUE_REPLACEABLE_DEFAULT     (1 << 1)
+#endif
+
+/* cl_khronos_vendor_id */
+#define CL_KHRONOS_VENDOR_ID_CODEPLAY               0x10004
+
+#ifdef CL_VERSION_3_0
+
+/* cl_version */
+#define CL_VERSION_MAJOR_BITS (10)
+#define CL_VERSION_MINOR_BITS (10)
+#define CL_VERSION_PATCH_BITS (12)
+
+#define CL_VERSION_MAJOR_MASK ((1 << CL_VERSION_MAJOR_BITS) - 1)
+#define CL_VERSION_MINOR_MASK ((1 << CL_VERSION_MINOR_BITS) - 1)
+#define CL_VERSION_PATCH_MASK ((1 << CL_VERSION_PATCH_BITS) - 1)
+
+#define CL_VERSION_MAJOR(version) \
+  ((version) >> (CL_VERSION_MINOR_BITS + CL_VERSION_PATCH_BITS))
+
+#define CL_VERSION_MINOR(version) \
+  (((version) >> CL_VERSION_PATCH_BITS) & CL_VERSION_MINOR_MASK)
+
+#define CL_VERSION_PATCH(version) ((version) & CL_VERSION_PATCH_MASK)
+
+#define CL_MAKE_VERSION(major, minor, patch)                      \
+  ((((major) & CL_VERSION_MAJOR_MASK)                             \
+       << (CL_VERSION_MINOR_BITS + CL_VERSION_PATCH_BITS)) |      \
+   (((minor) & CL_VERSION_MINOR_MASK) << CL_VERSION_PATCH_BITS) | \
+   ((patch) & CL_VERSION_PATCH_MASK))
+
+#endif
+
+/********************************************************************************************************/
+
+/* Platform API */
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetPlatformIDs(cl_uint          num_entries,
+                 cl_platform_id * platforms,
+                 cl_uint *        num_platforms) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetPlatformInfo(cl_platform_id   platform,
+                  cl_platform_info param_name,
+                  size_t           param_value_size,
+                  void *           param_value,
+                  size_t *         param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+/* Device APIs */
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetDeviceIDs(cl_platform_id   platform,
+               cl_device_type   device_type,
+               cl_uint          num_entries,
+               cl_device_id *   devices,
+               cl_uint *        num_devices) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetDeviceInfo(cl_device_id    device,
+                cl_device_info  param_name,
+                size_t          param_value_size,
+                void *          param_value,
+                size_t *        param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_2
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clCreateSubDevices(cl_device_id                         in_device,
+                   const cl_device_partition_property * properties,
+                   cl_uint                              num_devices,
+                   cl_device_id *                       out_devices,
+                   cl_uint *                            num_devices_ret) CL_API_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clRetainDevice(cl_device_id device) CL_API_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clReleaseDevice(cl_device_id device) CL_API_SUFFIX__VERSION_1_2;
+
+#endif
+
+#ifdef CL_VERSION_2_1
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clSetDefaultDeviceCommandQueue(cl_context           context,
+                               cl_device_id         device,
+                               cl_command_queue     command_queue) CL_API_SUFFIX__VERSION_2_1;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetDeviceAndHostTimer(cl_device_id    device,
+                        cl_ulong*       device_timestamp,
+                        cl_ulong*       host_timestamp) CL_API_SUFFIX__VERSION_2_1;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetHostTimer(cl_device_id device,
+               cl_ulong *   host_timestamp) CL_API_SUFFIX__VERSION_2_1;
+
+#endif
+
+/* Context APIs */
+extern CL_API_ENTRY cl_context CL_API_CALL
+clCreateContext(const cl_context_properties * properties,
+                cl_uint              num_devices,
+                const cl_device_id * devices,
+                void (CL_CALLBACK * pfn_notify)(const char * errinfo,
+                                                const void * private_info,
+                                                size_t       cb,
+                                                void *       user_data),
+                void *               user_data,
+                cl_int *             errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_context CL_API_CALL
+clCreateContextFromType(const cl_context_properties * properties,
+                        cl_device_type      device_type,
+                        void (CL_CALLBACK * pfn_notify)(const char * errinfo,
+                                                        const void * private_info,
+                                                        size_t       cb,
+                                                        void *       user_data),
+                        void *              user_data,
+                        cl_int *            errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clRetainContext(cl_context context) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clReleaseContext(cl_context context) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetContextInfo(cl_context         context,
+                 cl_context_info    param_name,
+                 size_t             param_value_size,
+                 void *             param_value,
+                 size_t *           param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_3_0
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clSetContextDestructorCallback(cl_context         context,
+                               void (CL_CALLBACK* pfn_notify)(cl_context context,
+                                                              void* user_data),
+                               void*              user_data) CL_API_SUFFIX__VERSION_3_0;
+
+#endif
+
+/* Command Queue APIs */
+
+#ifdef CL_VERSION_2_0
+
+extern CL_API_ENTRY cl_command_queue CL_API_CALL
+clCreateCommandQueueWithProperties(cl_context               context,
+                                   cl_device_id             device,
+                                   const cl_queue_properties *    properties,
+                                   cl_int *                 errcode_ret) CL_API_SUFFIX__VERSION_2_0;
+
+#endif
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clRetainCommandQueue(cl_command_queue command_queue) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clReleaseCommandQueue(cl_command_queue command_queue) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetCommandQueueInfo(cl_command_queue      command_queue,
+                      cl_command_queue_info param_name,
+                      size_t                param_value_size,
+                      void *                param_value,
+                      size_t *              param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+/* Memory Object APIs */
+extern CL_API_ENTRY cl_mem CL_API_CALL
+clCreateBuffer(cl_context   context,
+               cl_mem_flags flags,
+               size_t       size,
+               void *       host_ptr,
+               cl_int *     errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_1
+
+extern CL_API_ENTRY cl_mem CL_API_CALL
+clCreateSubBuffer(cl_mem                   buffer,
+                  cl_mem_flags             flags,
+                  cl_buffer_create_type    buffer_create_type,
+                  const void *             buffer_create_info,
+                  cl_int *                 errcode_ret) CL_API_SUFFIX__VERSION_1_1;
+
+#endif
+
+#ifdef CL_VERSION_1_2
+
+extern CL_API_ENTRY cl_mem CL_API_CALL
+clCreateImage(cl_context              context,
+              cl_mem_flags            flags,
+              const cl_image_format * image_format,
+              const cl_image_desc *   image_desc,
+              void *                  host_ptr,
+              cl_int *                errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+
+#endif
+
+#ifdef CL_VERSION_2_0
+
+extern CL_API_ENTRY cl_mem CL_API_CALL
+clCreatePipe(cl_context                 context,
+             cl_mem_flags               flags,
+             cl_uint                    pipe_packet_size,
+             cl_uint                    pipe_max_packets,
+             const cl_pipe_properties * properties,
+             cl_int *                   errcode_ret) CL_API_SUFFIX__VERSION_2_0;
+
+#endif
+
+#ifdef CL_VERSION_3_0
+
+extern CL_API_ENTRY cl_mem CL_API_CALL
+clCreateBufferWithProperties(cl_context                context,
+                             const cl_mem_properties * properties,
+                             cl_mem_flags              flags,
+                             size_t                    size,
+                             void *                    host_ptr,
+                             cl_int *                  errcode_ret) CL_API_SUFFIX__VERSION_3_0;
+
+extern CL_API_ENTRY cl_mem CL_API_CALL
+clCreateImageWithProperties(cl_context                context,
+                            const cl_mem_properties * properties,
+                            cl_mem_flags              flags,
+                            const cl_image_format *   image_format,
+                            const cl_image_desc *     image_desc,
+                            void *                    host_ptr,
+                            cl_int *                  errcode_ret) CL_API_SUFFIX__VERSION_3_0;
+
+#endif
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clRetainMemObject(cl_mem memobj) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clReleaseMemObject(cl_mem memobj) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetSupportedImageFormats(cl_context           context,
+                           cl_mem_flags         flags,
+                           cl_mem_object_type   image_type,
+                           cl_uint              num_entries,
+                           cl_image_format *    image_formats,
+                           cl_uint *            num_image_formats) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetMemObjectInfo(cl_mem           memobj,
+                   cl_mem_info      param_name,
+                   size_t           param_value_size,
+                   void *           param_value,
+                   size_t *         param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetImageInfo(cl_mem           image,
+               cl_image_info    param_name,
+               size_t           param_value_size,
+               void *           param_value,
+               size_t *         param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_2_0
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetPipeInfo(cl_mem           pipe,
+              cl_pipe_info     param_name,
+              size_t           param_value_size,
+              void *           param_value,
+              size_t *         param_value_size_ret) CL_API_SUFFIX__VERSION_2_0;
+
+#endif
+
+#ifdef CL_VERSION_1_1
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clSetMemObjectDestructorCallback(cl_mem memobj,
+                                 void (CL_CALLBACK * pfn_notify)(cl_mem memobj,
+                                                                 void * user_data),
+                                 void * user_data) CL_API_SUFFIX__VERSION_1_1;
+
+#endif
+
+/* SVM Allocation APIs */
+
+#ifdef CL_VERSION_2_0
+
+extern CL_API_ENTRY void * CL_API_CALL
+clSVMAlloc(cl_context       context,
+           cl_svm_mem_flags flags,
+           size_t           size,
+           cl_uint          alignment) CL_API_SUFFIX__VERSION_2_0;
+
+extern CL_API_ENTRY void CL_API_CALL
+clSVMFree(cl_context        context,
+          void *            svm_pointer) CL_API_SUFFIX__VERSION_2_0;
+
+#endif
+
+/* Sampler APIs */
+
+#ifdef CL_VERSION_2_0
+
+extern CL_API_ENTRY cl_sampler CL_API_CALL
+clCreateSamplerWithProperties(cl_context                     context,
+                              const cl_sampler_properties *  sampler_properties,
+                              cl_int *                       errcode_ret) CL_API_SUFFIX__VERSION_2_0;
+
+#endif
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clRetainSampler(cl_sampler sampler) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clReleaseSampler(cl_sampler sampler) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetSamplerInfo(cl_sampler         sampler,
+                 cl_sampler_info    param_name,
+                 size_t             param_value_size,
+                 void *             param_value,
+                 size_t *           param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+/* Program Object APIs */
+extern CL_API_ENTRY cl_program CL_API_CALL
+clCreateProgramWithSource(cl_context        context,
+                          cl_uint           count,
+                          const char **     strings,
+                          const size_t *    lengths,
+                          cl_int *          errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_program CL_API_CALL
+clCreateProgramWithBinary(cl_context                     context,
+                          cl_uint                        num_devices,
+                          const cl_device_id *           device_list,
+                          const size_t *                 lengths,
+                          const unsigned char **         binaries,
+                          cl_int *                       binary_status,
+                          cl_int *                       errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_2
+
+extern CL_API_ENTRY cl_program CL_API_CALL
+clCreateProgramWithBuiltInKernels(cl_context            context,
+                                  cl_uint               num_devices,
+                                  const cl_device_id *  device_list,
+                                  const char *          kernel_names,
+                                  cl_int *              errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+
+#endif
+
+#ifdef CL_VERSION_2_1
+
+extern CL_API_ENTRY cl_program CL_API_CALL
+clCreateProgramWithIL(cl_context    context,
+                     const void*    il,
+                     size_t         length,
+                     cl_int*        errcode_ret) CL_API_SUFFIX__VERSION_2_1;
+
+#endif
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clRetainProgram(cl_program program) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clReleaseProgram(cl_program program) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clBuildProgram(cl_program           program,
+               cl_uint              num_devices,
+               const cl_device_id * device_list,
+               const char *         options,
+               void (CL_CALLBACK *  pfn_notify)(cl_program program,
+                                                void * user_data),
+               void *               user_data) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_2
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clCompileProgram(cl_program           program,
+                 cl_uint              num_devices,
+                 const cl_device_id * device_list,
+                 const char *         options,
+                 cl_uint              num_input_headers,
+                 const cl_program *   input_headers,
+                 const char **        header_include_names,
+                 void (CL_CALLBACK *  pfn_notify)(cl_program program,
+                                                  void * user_data),
+                 void *               user_data) CL_API_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY cl_program CL_API_CALL
+clLinkProgram(cl_context           context,
+              cl_uint              num_devices,
+              const cl_device_id * device_list,
+              const char *         options,
+              cl_uint              num_input_programs,
+              const cl_program *   input_programs,
+              void (CL_CALLBACK *  pfn_notify)(cl_program program,
+                                               void * user_data),
+              void *               user_data,
+              cl_int *             errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+
+#endif
+
+#ifdef CL_VERSION_2_2
+
+extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_2_2_DEPRECATED cl_int CL_API_CALL
+clSetProgramReleaseCallback(cl_program          program,
+                            void (CL_CALLBACK * pfn_notify)(cl_program program,
+                                                            void * user_data),
+                            void *              user_data) CL_EXT_SUFFIX__VERSION_2_2_DEPRECATED;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clSetProgramSpecializationConstant(cl_program  program,
+                                   cl_uint     spec_id,
+                                   size_t      spec_size,
+                                   const void* spec_value) CL_API_SUFFIX__VERSION_2_2;
+
+#endif
+
+#ifdef CL_VERSION_1_2
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clUnloadPlatformCompiler(cl_platform_id platform) CL_API_SUFFIX__VERSION_1_2;
+
+#endif
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetProgramInfo(cl_program         program,
+                 cl_program_info    param_name,
+                 size_t             param_value_size,
+                 void *             param_value,
+                 size_t *           param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetProgramBuildInfo(cl_program            program,
+                      cl_device_id          device,
+                      cl_program_build_info param_name,
+                      size_t                param_value_size,
+                      void *                param_value,
+                      size_t *              param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+/* Kernel Object APIs */
+extern CL_API_ENTRY cl_kernel CL_API_CALL
+clCreateKernel(cl_program      program,
+               const char *    kernel_name,
+               cl_int *        errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clCreateKernelsInProgram(cl_program     program,
+                         cl_uint        num_kernels,
+                         cl_kernel *    kernels,
+                         cl_uint *      num_kernels_ret) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_2_1
+
+extern CL_API_ENTRY cl_kernel CL_API_CALL
+clCloneKernel(cl_kernel     source_kernel,
+              cl_int*       errcode_ret) CL_API_SUFFIX__VERSION_2_1;
+
+#endif
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clRetainKernel(cl_kernel    kernel) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clReleaseKernel(cl_kernel   kernel) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clSetKernelArg(cl_kernel    kernel,
+               cl_uint      arg_index,
+               size_t       arg_size,
+               const void * arg_value) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_2_0
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clSetKernelArgSVMPointer(cl_kernel    kernel,
+                         cl_uint      arg_index,
+                         const void * arg_value) CL_API_SUFFIX__VERSION_2_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clSetKernelExecInfo(cl_kernel            kernel,
+                    cl_kernel_exec_info  param_name,
+                    size_t               param_value_size,
+                    const void *         param_value) CL_API_SUFFIX__VERSION_2_0;
+
+#endif
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetKernelInfo(cl_kernel       kernel,
+                cl_kernel_info  param_name,
+                size_t          param_value_size,
+                void *          param_value,
+                size_t *        param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_2
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetKernelArgInfo(cl_kernel       kernel,
+                   cl_uint         arg_indx,
+                   cl_kernel_arg_info  param_name,
+                   size_t          param_value_size,
+                   void *          param_value,
+                   size_t *        param_value_size_ret) CL_API_SUFFIX__VERSION_1_2;
+
+#endif
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetKernelWorkGroupInfo(cl_kernel                  kernel,
+                         cl_device_id               device,
+                         cl_kernel_work_group_info  param_name,
+                         size_t                     param_value_size,
+                         void *                     param_value,
+                         size_t *                   param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_2_1
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetKernelSubGroupInfo(cl_kernel                   kernel,
+                        cl_device_id                device,
+                        cl_kernel_sub_group_info    param_name,
+                        size_t                      input_value_size,
+                        const void*                 input_value,
+                        size_t                      param_value_size,
+                        void*                       param_value,
+                        size_t*                     param_value_size_ret) CL_API_SUFFIX__VERSION_2_1;
+
+#endif
+
+/* Event Object APIs */
+extern CL_API_ENTRY cl_int CL_API_CALL
+clWaitForEvents(cl_uint             num_events,
+                const cl_event *    event_list) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetEventInfo(cl_event         event,
+               cl_event_info    param_name,
+               size_t           param_value_size,
+               void *           param_value,
+               size_t *         param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_1
+
+extern CL_API_ENTRY cl_event CL_API_CALL
+clCreateUserEvent(cl_context    context,
+                  cl_int *      errcode_ret) CL_API_SUFFIX__VERSION_1_1;
+
+#endif
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clRetainEvent(cl_event event) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clReleaseEvent(cl_event event) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_1
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clSetUserEventStatus(cl_event   event,
+                     cl_int     execution_status) CL_API_SUFFIX__VERSION_1_1;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clSetEventCallback(cl_event    event,
+                   cl_int      command_exec_callback_type,
+                   void (CL_CALLBACK * pfn_notify)(cl_event event,
+                                                   cl_int   event_command_status,
+                                                   void *   user_data),
+                   void *      user_data) CL_API_SUFFIX__VERSION_1_1;
+
+#endif
+
+/* Profiling APIs */
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetEventProfilingInfo(cl_event            event,
+                        cl_profiling_info   param_name,
+                        size_t              param_value_size,
+                        void *              param_value,
+                        size_t *            param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+/* Flush and Finish APIs */
+extern CL_API_ENTRY cl_int CL_API_CALL
+clFlush(cl_command_queue command_queue) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clFinish(cl_command_queue command_queue) CL_API_SUFFIX__VERSION_1_0;
+
+/* Enqueued Commands APIs */
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueReadBuffer(cl_command_queue    command_queue,
+                    cl_mem              buffer,
+                    cl_bool             blocking_read,
+                    size_t              offset,
+                    size_t              size,
+                    void *              ptr,
+                    cl_uint             num_events_in_wait_list,
+                    const cl_event *    event_wait_list,
+                    cl_event *          event) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_1
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueReadBufferRect(cl_command_queue    command_queue,
+                        cl_mem              buffer,
+                        cl_bool             blocking_read,
+                        const size_t *      buffer_origin,
+                        const size_t *      host_origin,
+                        const size_t *      region,
+                        size_t              buffer_row_pitch,
+                        size_t              buffer_slice_pitch,
+                        size_t              host_row_pitch,
+                        size_t              host_slice_pitch,
+                        void *              ptr,
+                        cl_uint             num_events_in_wait_list,
+                        const cl_event *    event_wait_list,
+                        cl_event *          event) CL_API_SUFFIX__VERSION_1_1;
+
+#endif
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueWriteBuffer(cl_command_queue   command_queue,
+                     cl_mem             buffer,
+                     cl_bool            blocking_write,
+                     size_t             offset,
+                     size_t             size,
+                     const void *       ptr,
+                     cl_uint            num_events_in_wait_list,
+                     const cl_event *   event_wait_list,
+                     cl_event *         event) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_1
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueWriteBufferRect(cl_command_queue    command_queue,
+                         cl_mem              buffer,
+                         cl_bool             blocking_write,
+                         const size_t *      buffer_origin,
+                         const size_t *      host_origin,
+                         const size_t *      region,
+                         size_t              buffer_row_pitch,
+                         size_t              buffer_slice_pitch,
+                         size_t              host_row_pitch,
+                         size_t              host_slice_pitch,
+                         const void *        ptr,
+                         cl_uint             num_events_in_wait_list,
+                         const cl_event *    event_wait_list,
+                         cl_event *          event) CL_API_SUFFIX__VERSION_1_1;
+
+#endif
+
+#ifdef CL_VERSION_1_2
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueFillBuffer(cl_command_queue   command_queue,
+                    cl_mem             buffer,
+                    const void *       pattern,
+                    size_t             pattern_size,
+                    size_t             offset,
+                    size_t             size,
+                    cl_uint            num_events_in_wait_list,
+                    const cl_event *   event_wait_list,
+                    cl_event *         event) CL_API_SUFFIX__VERSION_1_2;
+
+#endif
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueCopyBuffer(cl_command_queue    command_queue,
+                    cl_mem              src_buffer,
+                    cl_mem              dst_buffer,
+                    size_t              src_offset,
+                    size_t              dst_offset,
+                    size_t              size,
+                    cl_uint             num_events_in_wait_list,
+                    const cl_event *    event_wait_list,
+                    cl_event *          event) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_1
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueCopyBufferRect(cl_command_queue    command_queue,
+                        cl_mem              src_buffer,
+                        cl_mem              dst_buffer,
+                        const size_t *      src_origin,
+                        const size_t *      dst_origin,
+                        const size_t *      region,
+                        size_t              src_row_pitch,
+                        size_t              src_slice_pitch,
+                        size_t              dst_row_pitch,
+                        size_t              dst_slice_pitch,
+                        cl_uint             num_events_in_wait_list,
+                        const cl_event *    event_wait_list,
+                        cl_event *          event) CL_API_SUFFIX__VERSION_1_1;
+
+#endif
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueReadImage(cl_command_queue     command_queue,
+                   cl_mem               image,
+                   cl_bool              blocking_read,
+                   const size_t *       origin,
+                   const size_t *       region,
+                   size_t               row_pitch,
+                   size_t               slice_pitch,
+                   void *               ptr,
+                   cl_uint              num_events_in_wait_list,
+                   const cl_event *     event_wait_list,
+                   cl_event *           event) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueWriteImage(cl_command_queue    command_queue,
+                    cl_mem              image,
+                    cl_bool             blocking_write,
+                    const size_t *      origin,
+                    const size_t *      region,
+                    size_t              input_row_pitch,
+                    size_t              input_slice_pitch,
+                    const void *        ptr,
+                    cl_uint             num_events_in_wait_list,
+                    const cl_event *    event_wait_list,
+                    cl_event *          event) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_2
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueFillImage(cl_command_queue   command_queue,
+                   cl_mem             image,
+                   const void *       fill_color,
+                   const size_t *     origin,
+                   const size_t *     region,
+                   cl_uint            num_events_in_wait_list,
+                   const cl_event *   event_wait_list,
+                   cl_event *         event) CL_API_SUFFIX__VERSION_1_2;
+
+#endif
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueCopyImage(cl_command_queue     command_queue,
+                   cl_mem               src_image,
+                   cl_mem               dst_image,
+                   const size_t *       src_origin,
+                   const size_t *       dst_origin,
+                   const size_t *       region,
+                   cl_uint              num_events_in_wait_list,
+                   const cl_event *     event_wait_list,
+                   cl_event *           event) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueCopyImageToBuffer(cl_command_queue command_queue,
+                           cl_mem           src_image,
+                           cl_mem           dst_buffer,
+                           const size_t *   src_origin,
+                           const size_t *   region,
+                           size_t           dst_offset,
+                           cl_uint          num_events_in_wait_list,
+                           const cl_event * event_wait_list,
+                           cl_event *       event) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueCopyBufferToImage(cl_command_queue command_queue,
+                           cl_mem           src_buffer,
+                           cl_mem           dst_image,
+                           size_t           src_offset,
+                           const size_t *   dst_origin,
+                           const size_t *   region,
+                           cl_uint          num_events_in_wait_list,
+                           const cl_event * event_wait_list,
+                           cl_event *       event) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY void * CL_API_CALL
+clEnqueueMapBuffer(cl_command_queue command_queue,
+                   cl_mem           buffer,
+                   cl_bool          blocking_map,
+                   cl_map_flags     map_flags,
+                   size_t           offset,
+                   size_t           size,
+                   cl_uint          num_events_in_wait_list,
+                   const cl_event * event_wait_list,
+                   cl_event *       event,
+                   cl_int *         errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY void * CL_API_CALL
+clEnqueueMapImage(cl_command_queue  command_queue,
+                  cl_mem            image,
+                  cl_bool           blocking_map,
+                  cl_map_flags      map_flags,
+                  const size_t *    origin,
+                  const size_t *    region,
+                  size_t *          image_row_pitch,
+                  size_t *          image_slice_pitch,
+                  cl_uint           num_events_in_wait_list,
+                  const cl_event *  event_wait_list,
+                  cl_event *        event,
+                  cl_int *          errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueUnmapMemObject(cl_command_queue command_queue,
+                        cl_mem           memobj,
+                        void *           mapped_ptr,
+                        cl_uint          num_events_in_wait_list,
+                        const cl_event * event_wait_list,
+                        cl_event *       event) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_2
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueMigrateMemObjects(cl_command_queue       command_queue,
+                           cl_uint                num_mem_objects,
+                           const cl_mem *         mem_objects,
+                           cl_mem_migration_flags flags,
+                           cl_uint                num_events_in_wait_list,
+                           const cl_event *       event_wait_list,
+                           cl_event *             event) CL_API_SUFFIX__VERSION_1_2;
+
+#endif
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueNDRangeKernel(cl_command_queue command_queue,
+                       cl_kernel        kernel,
+                       cl_uint          work_dim,
+                       const size_t *   global_work_offset,
+                       const size_t *   global_work_size,
+                       const size_t *   local_work_size,
+                       cl_uint          num_events_in_wait_list,
+                       const cl_event * event_wait_list,
+                       cl_event *       event) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueNativeKernel(cl_command_queue  command_queue,
+                      void (CL_CALLBACK * user_func)(void *),
+                      void *            args,
+                      size_t            cb_args,
+                      cl_uint           num_mem_objects,
+                      const cl_mem *    mem_list,
+                      const void **     args_mem_loc,
+                      cl_uint           num_events_in_wait_list,
+                      const cl_event *  event_wait_list,
+                      cl_event *        event) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_2
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueMarkerWithWaitList(cl_command_queue  command_queue,
+                            cl_uint           num_events_in_wait_list,
+                            const cl_event *  event_wait_list,
+                            cl_event *        event) CL_API_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueBarrierWithWaitList(cl_command_queue  command_queue,
+                             cl_uint           num_events_in_wait_list,
+                             const cl_event *  event_wait_list,
+                             cl_event *        event) CL_API_SUFFIX__VERSION_1_2;
+
+#endif
+
+#ifdef CL_VERSION_2_0
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueSVMFree(cl_command_queue  command_queue,
+                 cl_uint           num_svm_pointers,
+                 void *            svm_pointers[],
+                 void (CL_CALLBACK * pfn_free_func)(cl_command_queue queue,
+                                                    cl_uint          num_svm_pointers,
+                                                    void *           svm_pointers[],
+                                                    void *           user_data),
+                 void *            user_data,
+                 cl_uint           num_events_in_wait_list,
+                 const cl_event *  event_wait_list,
+                 cl_event *        event) CL_API_SUFFIX__VERSION_2_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueSVMMemcpy(cl_command_queue  command_queue,
+                   cl_bool           blocking_copy,
+                   void *            dst_ptr,
+                   const void *      src_ptr,
+                   size_t            size,
+                   cl_uint           num_events_in_wait_list,
+                   const cl_event *  event_wait_list,
+                   cl_event *        event) CL_API_SUFFIX__VERSION_2_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueSVMMemFill(cl_command_queue  command_queue,
+                    void *            svm_ptr,
+                    const void *      pattern,
+                    size_t            pattern_size,
+                    size_t            size,
+                    cl_uint           num_events_in_wait_list,
+                    const cl_event *  event_wait_list,
+                    cl_event *        event) CL_API_SUFFIX__VERSION_2_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueSVMMap(cl_command_queue  command_queue,
+                cl_bool           blocking_map,
+                cl_map_flags      flags,
+                void *            svm_ptr,
+                size_t            size,
+                cl_uint           num_events_in_wait_list,
+                const cl_event *  event_wait_list,
+                cl_event *        event) CL_API_SUFFIX__VERSION_2_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueSVMUnmap(cl_command_queue  command_queue,
+                  void *            svm_ptr,
+                  cl_uint           num_events_in_wait_list,
+                  const cl_event *  event_wait_list,
+                  cl_event *        event) CL_API_SUFFIX__VERSION_2_0;
+
+#endif
+
+#ifdef CL_VERSION_2_1
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueSVMMigrateMem(cl_command_queue         command_queue,
+                       cl_uint                  num_svm_pointers,
+                       const void **            svm_pointers,
+                       const size_t *           sizes,
+                       cl_mem_migration_flags   flags,
+                       cl_uint                  num_events_in_wait_list,
+                       const cl_event *         event_wait_list,
+                       cl_event *               event) CL_API_SUFFIX__VERSION_2_1;
+
+#endif
+
+#ifdef CL_VERSION_1_2
+
+/* Extension function access
+ *
+ * Returns the extension function address for the given function name,
+ * or NULL if a valid function can not be found.  The client must
+ * check to make sure the address is not NULL, before using or
+ * calling the returned function address.
+ */
+extern CL_API_ENTRY void * CL_API_CALL
+clGetExtensionFunctionAddressForPlatform(cl_platform_id platform,
+                                         const char *   func_name) CL_API_SUFFIX__VERSION_1_2;
+
+#endif
+
+#ifdef CL_USE_DEPRECATED_OPENCL_1_0_APIS
+    /*
+     *  WARNING:
+     *     This API introduces mutable state into the OpenCL implementation. It has been REMOVED
+     *  to better facilitate thread safety.  The 1.0 API is not thread safe. It is not tested by the
+     *  OpenCL 1.1 conformance test, and consequently may not work or may not work dependably.
+     *  It is likely to be non-performant. Use of this API is not advised. Use at your own risk.
+     *
+     *  Software developers previously relying on this API are instructed to set the command queue
+     *  properties when creating the queue, instead.
+     */
+    extern CL_API_ENTRY cl_int CL_API_CALL
+    clSetCommandQueueProperty(cl_command_queue              command_queue,
+                              cl_command_queue_properties   properties,
+                              cl_bool                       enable,
+                              cl_command_queue_properties * old_properties) CL_EXT_SUFFIX__VERSION_1_0_DEPRECATED;
+#endif /* CL_USE_DEPRECATED_OPENCL_1_0_APIS */
+
+/* Deprecated OpenCL 1.1 APIs */
+extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_1_DEPRECATED cl_mem CL_API_CALL
+clCreateImage2D(cl_context              context,
+                cl_mem_flags            flags,
+                const cl_image_format * image_format,
+                size_t                  image_width,
+                size_t                  image_height,
+                size_t                  image_row_pitch,
+                void *                  host_ptr,
+                cl_int *                errcode_ret) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+
+extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_1_DEPRECATED cl_mem CL_API_CALL
+clCreateImage3D(cl_context              context,
+                cl_mem_flags            flags,
+                const cl_image_format * image_format,
+                size_t                  image_width,
+                size_t                  image_height,
+                size_t                  image_depth,
+                size_t                  image_row_pitch,
+                size_t                  image_slice_pitch,
+                void *                  host_ptr,
+                cl_int *                errcode_ret) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+
+extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_1_DEPRECATED cl_int CL_API_CALL
+clEnqueueMarker(cl_command_queue    command_queue,
+                cl_event *          event) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+
+extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_1_DEPRECATED cl_int CL_API_CALL
+clEnqueueWaitForEvents(cl_command_queue  command_queue,
+                        cl_uint          num_events,
+                        const cl_event * event_list) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+
+extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_1_DEPRECATED cl_int CL_API_CALL
+clEnqueueBarrier(cl_command_queue command_queue) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+
+extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_1_DEPRECATED cl_int CL_API_CALL
+clUnloadCompiler(void) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+
+extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_1_DEPRECATED void * CL_API_CALL
+clGetExtensionFunctionAddress(const char * func_name) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+
+/* Deprecated OpenCL 2.0 APIs */
+extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_2_DEPRECATED cl_command_queue CL_API_CALL
+clCreateCommandQueue(cl_context                     context,
+                     cl_device_id                   device,
+                     cl_command_queue_properties    properties,
+                     cl_int *                       errcode_ret) CL_EXT_SUFFIX__VERSION_1_2_DEPRECATED;
+
+extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_2_DEPRECATED cl_sampler CL_API_CALL
+clCreateSampler(cl_context          context,
+                cl_bool             normalized_coords,
+                cl_addressing_mode  addressing_mode,
+                cl_filter_mode      filter_mode,
+                cl_int *            errcode_ret) CL_EXT_SUFFIX__VERSION_1_2_DEPRECATED;
+
+extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_2_DEPRECATED cl_int CL_API_CALL
+clEnqueueTask(cl_command_queue  command_queue,
+              cl_kernel         kernel,
+              cl_uint           num_events_in_wait_list,
+              const cl_event *  event_wait_list,
+              cl_event *        event) CL_EXT_SUFFIX__VERSION_1_2_DEPRECATED;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif  /* __OPENCL_CL_H */
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_d3d10.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_d3d10.h
new file mode 100644
index 000000000..2b80d90cb
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_d3d10.h
@@ -0,0 +1,128 @@
+/*******************************************************************************
+ * Copyright (c) 2008-2020 The Khronos Group Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ ******************************************************************************/
+
+#ifndef __OPENCL_CL_D3D10_H
+#define __OPENCL_CL_D3D10_H
+
+#if defined(_MSC_VER)
+#if _MSC_VER >=1500
+#pragma warning( push )
+#pragma warning( disable : 4201 )
+#endif
+#endif
+#include <d3d10.h>
+#if defined(_MSC_VER)
+#if _MSC_VER >=1500
+#pragma warning( pop )
+#endif
+#endif
+#include <CL/cl.h>
+#include <CL/cl_platform.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/******************************************************************************
+ * cl_khr_d3d10_sharing                                                       */
+#define cl_khr_d3d10_sharing 1
+
+typedef cl_uint cl_d3d10_device_source_khr;
+typedef cl_uint cl_d3d10_device_set_khr;
+
+/******************************************************************************/
+
+/* Error Codes */
+#define CL_INVALID_D3D10_DEVICE_KHR                  -1002
+#define CL_INVALID_D3D10_RESOURCE_KHR                -1003
+#define CL_D3D10_RESOURCE_ALREADY_ACQUIRED_KHR       -1004
+#define CL_D3D10_RESOURCE_NOT_ACQUIRED_KHR           -1005
+
+/* cl_d3d10_device_source_nv */
+#define CL_D3D10_DEVICE_KHR                          0x4010
+#define CL_D3D10_DXGI_ADAPTER_KHR                    0x4011
+
+/* cl_d3d10_device_set_nv */
+#define CL_PREFERRED_DEVICES_FOR_D3D10_KHR           0x4012
+#define CL_ALL_DEVICES_FOR_D3D10_KHR                 0x4013
+
+/* cl_context_info */
+#define CL_CONTEXT_D3D10_DEVICE_KHR                  0x4014
+#define CL_CONTEXT_D3D10_PREFER_SHARED_RESOURCES_KHR 0x402C
+
+/* cl_mem_info */
+#define CL_MEM_D3D10_RESOURCE_KHR                    0x4015
+
+/* cl_image_info */
+#define CL_IMAGE_D3D10_SUBRESOURCE_KHR               0x4016
+
+/* cl_command_type */
+#define CL_COMMAND_ACQUIRE_D3D10_OBJECTS_KHR         0x4017
+#define CL_COMMAND_RELEASE_D3D10_OBJECTS_KHR         0x4018
+
+/******************************************************************************/
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clGetDeviceIDsFromD3D10KHR_fn)(
+    cl_platform_id             platform,
+    cl_d3d10_device_source_khr d3d_device_source,
+    void *                     d3d_object,
+    cl_d3d10_device_set_khr    d3d_device_set,
+    cl_uint                    num_entries,
+    cl_device_id *             devices,
+    cl_uint *                  num_devices) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_mem (CL_API_CALL *clCreateFromD3D10BufferKHR_fn)(
+    cl_context     context,
+    cl_mem_flags   flags,
+    ID3D10Buffer * resource,
+    cl_int *       errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_mem (CL_API_CALL *clCreateFromD3D10Texture2DKHR_fn)(
+    cl_context        context,
+    cl_mem_flags      flags,
+    ID3D10Texture2D * resource,
+    UINT              subresource,
+    cl_int *          errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_mem (CL_API_CALL *clCreateFromD3D10Texture3DKHR_fn)(
+    cl_context        context,
+    cl_mem_flags      flags,
+    ID3D10Texture3D * resource,
+    UINT              subresource,
+    cl_int *          errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueAcquireD3D10ObjectsKHR_fn)(
+    cl_command_queue command_queue,
+    cl_uint          num_objects,
+    const cl_mem *   mem_objects,
+    cl_uint          num_events_in_wait_list,
+    const cl_event * event_wait_list,
+    cl_event *       event) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueReleaseD3D10ObjectsKHR_fn)(
+    cl_command_queue command_queue,
+    cl_uint          num_objects,
+    const cl_mem *   mem_objects,
+    cl_uint          num_events_in_wait_list,
+    const cl_event * event_wait_list,
+    cl_event *       event) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif  /* __OPENCL_CL_D3D10_H */
+
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_d3d11.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_d3d11.h
new file mode 100644
index 000000000..10023dde0
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_d3d11.h
@@ -0,0 +1,128 @@
+/*******************************************************************************
+ * Copyright (c) 2008-2020 The Khronos Group Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ ******************************************************************************/
+
+#ifndef __OPENCL_CL_D3D11_H
+#define __OPENCL_CL_D3D11_H
+
+#if defined(_MSC_VER)
+#if _MSC_VER >=1500
+#pragma warning( push )
+#pragma warning( disable : 4201 )
+#endif
+#endif
+#include <d3d11.h>
+#if defined(_MSC_VER)
+#if _MSC_VER >=1500
+#pragma warning( pop )
+#endif
+#endif
+#include <CL/cl.h>
+#include <CL/cl_platform.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/******************************************************************************
+ * cl_khr_d3d11_sharing                                                       */
+#define cl_khr_d3d11_sharing 1
+
+typedef cl_uint cl_d3d11_device_source_khr;
+typedef cl_uint cl_d3d11_device_set_khr;
+
+/******************************************************************************/
+
+/* Error Codes */
+#define CL_INVALID_D3D11_DEVICE_KHR                  -1006
+#define CL_INVALID_D3D11_RESOURCE_KHR                -1007
+#define CL_D3D11_RESOURCE_ALREADY_ACQUIRED_KHR       -1008
+#define CL_D3D11_RESOURCE_NOT_ACQUIRED_KHR           -1009
+
+/* cl_d3d11_device_source */
+#define CL_D3D11_DEVICE_KHR                          0x4019
+#define CL_D3D11_DXGI_ADAPTER_KHR                    0x401A
+
+/* cl_d3d11_device_set */
+#define CL_PREFERRED_DEVICES_FOR_D3D11_KHR           0x401B
+#define CL_ALL_DEVICES_FOR_D3D11_KHR                 0x401C
+
+/* cl_context_info */
+#define CL_CONTEXT_D3D11_DEVICE_KHR                  0x401D
+#define CL_CONTEXT_D3D11_PREFER_SHARED_RESOURCES_KHR 0x402D
+
+/* cl_mem_info */
+#define CL_MEM_D3D11_RESOURCE_KHR                    0x401E
+
+/* cl_image_info */
+#define CL_IMAGE_D3D11_SUBRESOURCE_KHR               0x401F
+
+/* cl_command_type */
+#define CL_COMMAND_ACQUIRE_D3D11_OBJECTS_KHR         0x4020
+#define CL_COMMAND_RELEASE_D3D11_OBJECTS_KHR         0x4021
+
+/******************************************************************************/
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clGetDeviceIDsFromD3D11KHR_fn)(
+    cl_platform_id             platform,
+    cl_d3d11_device_source_khr d3d_device_source,
+    void *                     d3d_object,
+    cl_d3d11_device_set_khr    d3d_device_set,
+    cl_uint                    num_entries,
+    cl_device_id *             devices,
+    cl_uint *                  num_devices) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_mem (CL_API_CALL *clCreateFromD3D11BufferKHR_fn)(
+    cl_context     context,
+    cl_mem_flags   flags,
+    ID3D11Buffer * resource,
+    cl_int *       errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_mem (CL_API_CALL *clCreateFromD3D11Texture2DKHR_fn)(
+    cl_context        context,
+    cl_mem_flags      flags,
+    ID3D11Texture2D * resource,
+    UINT              subresource,
+    cl_int *          errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_mem (CL_API_CALL *clCreateFromD3D11Texture3DKHR_fn)(
+    cl_context        context,
+    cl_mem_flags      flags,
+    ID3D11Texture3D * resource,
+    UINT              subresource,
+    cl_int *          errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueAcquireD3D11ObjectsKHR_fn)(
+    cl_command_queue command_queue,
+    cl_uint          num_objects,
+    const cl_mem *   mem_objects,
+    cl_uint          num_events_in_wait_list,
+    const cl_event * event_wait_list,
+    cl_event *       event) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueReleaseD3D11ObjectsKHR_fn)(
+    cl_command_queue command_queue,
+    cl_uint          num_objects,
+    const cl_mem *   mem_objects,
+    cl_uint          num_events_in_wait_list,
+    const cl_event * event_wait_list,
+    cl_event *       event) CL_API_SUFFIX__VERSION_1_2;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif  /* __OPENCL_CL_D3D11_H */
+
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_dx9_media_sharing.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_dx9_media_sharing.h
new file mode 100644
index 000000000..048937005
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_dx9_media_sharing.h
@@ -0,0 +1,118 @@
+/*******************************************************************************
+ * Copyright (c) 2008-2020 The Khronos Group Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ ******************************************************************************/
+
+#ifndef __OPENCL_CL_DX9_MEDIA_SHARING_H
+#define __OPENCL_CL_DX9_MEDIA_SHARING_H
+
+#include <CL/cl.h>
+#include <CL/cl_platform.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/******************************************************************************/
+/* cl_khr_dx9_media_sharing                                                   */
+#define cl_khr_dx9_media_sharing 1
+
+typedef cl_uint             cl_dx9_media_adapter_type_khr;
+typedef cl_uint             cl_dx9_media_adapter_set_khr;
+    
+#if defined(_WIN32)
+#include <d3d9.h>
+typedef struct _cl_dx9_surface_info_khr
+{
+    IDirect3DSurface9 *resource;
+    HANDLE shared_handle;
+} cl_dx9_surface_info_khr;
+#endif
+
+
+/******************************************************************************/
+
+/* Error Codes */
+#define CL_INVALID_DX9_MEDIA_ADAPTER_KHR                -1010
+#define CL_INVALID_DX9_MEDIA_SURFACE_KHR                -1011
+#define CL_DX9_MEDIA_SURFACE_ALREADY_ACQUIRED_KHR       -1012
+#define CL_DX9_MEDIA_SURFACE_NOT_ACQUIRED_KHR           -1013
+
+/* cl_media_adapter_type_khr */
+#define CL_ADAPTER_D3D9_KHR                              0x2020
+#define CL_ADAPTER_D3D9EX_KHR                            0x2021
+#define CL_ADAPTER_DXVA_KHR                              0x2022
+
+/* cl_media_adapter_set_khr */
+#define CL_PREFERRED_DEVICES_FOR_DX9_MEDIA_ADAPTER_KHR   0x2023
+#define CL_ALL_DEVICES_FOR_DX9_MEDIA_ADAPTER_KHR         0x2024
+
+/* cl_context_info */
+#define CL_CONTEXT_ADAPTER_D3D9_KHR                      0x2025
+#define CL_CONTEXT_ADAPTER_D3D9EX_KHR                    0x2026
+#define CL_CONTEXT_ADAPTER_DXVA_KHR                      0x2027
+
+/* cl_mem_info */
+#define CL_MEM_DX9_MEDIA_ADAPTER_TYPE_KHR                0x2028
+#define CL_MEM_DX9_MEDIA_SURFACE_INFO_KHR                0x2029
+
+/* cl_image_info */
+#define CL_IMAGE_DX9_MEDIA_PLANE_KHR                     0x202A
+
+/* cl_command_type */
+#define CL_COMMAND_ACQUIRE_DX9_MEDIA_SURFACES_KHR        0x202B
+#define CL_COMMAND_RELEASE_DX9_MEDIA_SURFACES_KHR        0x202C
+
+/******************************************************************************/
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clGetDeviceIDsFromDX9MediaAdapterKHR_fn)(
+    cl_platform_id                   platform,
+    cl_uint                          num_media_adapters,
+    cl_dx9_media_adapter_type_khr *  media_adapter_type,
+    void *                           media_adapters,
+    cl_dx9_media_adapter_set_khr     media_adapter_set,
+    cl_uint                          num_entries,
+    cl_device_id *                   devices,
+    cl_uint *                        num_devices) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_mem (CL_API_CALL *clCreateFromDX9MediaSurfaceKHR_fn)(
+    cl_context                    context,
+    cl_mem_flags                  flags,
+    cl_dx9_media_adapter_type_khr adapter_type,
+    void *                        surface_info,
+    cl_uint                       plane,                                                                          
+    cl_int *                      errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueAcquireDX9MediaSurfacesKHR_fn)(
+    cl_command_queue command_queue,
+    cl_uint          num_objects,
+    const cl_mem *   mem_objects,
+    cl_uint          num_events_in_wait_list,
+    const cl_event * event_wait_list,
+    cl_event *       event) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueReleaseDX9MediaSurfacesKHR_fn)(
+    cl_command_queue command_queue,
+    cl_uint          num_objects,
+    const cl_mem *   mem_objects,
+    cl_uint          num_events_in_wait_list,
+    const cl_event * event_wait_list,
+    cl_event *       event) CL_API_SUFFIX__VERSION_1_2;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif  /* __OPENCL_CL_DX9_MEDIA_SHARING_H */
+
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_dx9_media_sharing_intel.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_dx9_media_sharing_intel.h
new file mode 100644
index 000000000..4525a175e
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_dx9_media_sharing_intel.h
@@ -0,0 +1,170 @@
+/*******************************************************************************
+ * Copyright (c) 2008-2020 The Khronos Group Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ ******************************************************************************/
+/*****************************************************************************\
+
+Copyright (c) 2013-2019 Intel Corporation All Rights Reserved.
+
+THESE MATERIALS ARE PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL OR ITS
+CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THESE
+MATERIALS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+File Name: cl_dx9_media_sharing_intel.h
+
+Abstract:
+
+Notes:
+
+\*****************************************************************************/
+
+#ifndef __OPENCL_CL_DX9_MEDIA_SHARING_INTEL_H
+#define __OPENCL_CL_DX9_MEDIA_SHARING_INTEL_H
+
+#include <CL/cl.h>
+#include <CL/cl_platform.h>
+#include <d3d9.h>
+#include <dxvahd.h>
+#include <wtypes.h>
+#include <d3d9types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/***************************************
+* cl_intel_dx9_media_sharing extension *
+****************************************/
+
+#define cl_intel_dx9_media_sharing 1
+
+typedef cl_uint cl_dx9_device_source_intel;
+typedef cl_uint cl_dx9_device_set_intel;
+
+/* error codes */
+#define CL_INVALID_DX9_DEVICE_INTEL                   -1010
+#define CL_INVALID_DX9_RESOURCE_INTEL                 -1011
+#define CL_DX9_RESOURCE_ALREADY_ACQUIRED_INTEL        -1012
+#define CL_DX9_RESOURCE_NOT_ACQUIRED_INTEL            -1013
+
+/* cl_dx9_device_source_intel */
+#define CL_D3D9_DEVICE_INTEL                          0x4022
+#define CL_D3D9EX_DEVICE_INTEL                        0x4070
+#define CL_DXVA_DEVICE_INTEL                          0x4071
+
+/* cl_dx9_device_set_intel */
+#define CL_PREFERRED_DEVICES_FOR_DX9_INTEL            0x4024
+#define CL_ALL_DEVICES_FOR_DX9_INTEL                  0x4025
+
+/* cl_context_info */
+#define CL_CONTEXT_D3D9_DEVICE_INTEL                  0x4026
+#define CL_CONTEXT_D3D9EX_DEVICE_INTEL                0x4072
+#define CL_CONTEXT_DXVA_DEVICE_INTEL                  0x4073
+
+/* cl_mem_info */
+#define CL_MEM_DX9_RESOURCE_INTEL                     0x4027
+#define CL_MEM_DX9_SHARED_HANDLE_INTEL                0x4074
+
+/* cl_image_info */
+#define CL_IMAGE_DX9_PLANE_INTEL                      0x4075
+
+/* cl_command_type */
+#define CL_COMMAND_ACQUIRE_DX9_OBJECTS_INTEL          0x402A
+#define CL_COMMAND_RELEASE_DX9_OBJECTS_INTEL          0x402B
+/******************************************************************************/
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetDeviceIDsFromDX9INTEL(
+    cl_platform_id              platform,
+    cl_dx9_device_source_intel  dx9_device_source,
+    void*                       dx9_object,
+    cl_dx9_device_set_intel     dx9_device_set,
+    cl_uint                     num_entries,
+    cl_device_id*               devices,
+    cl_uint*                    num_devices) CL_EXT_SUFFIX__VERSION_1_1;
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL* clGetDeviceIDsFromDX9INTEL_fn)(
+    cl_platform_id              platform,
+    cl_dx9_device_source_intel  dx9_device_source,
+    void*                       dx9_object,
+    cl_dx9_device_set_intel     dx9_device_set,
+    cl_uint                     num_entries,
+    cl_device_id*               devices,
+    cl_uint*                    num_devices) CL_EXT_SUFFIX__VERSION_1_1;
+
+extern CL_API_ENTRY cl_mem CL_API_CALL
+clCreateFromDX9MediaSurfaceINTEL(
+    cl_context                  context,
+    cl_mem_flags                flags,
+    IDirect3DSurface9*          resource,
+    HANDLE                      sharedHandle,
+    UINT                        plane,
+    cl_int*                     errcode_ret) CL_EXT_SUFFIX__VERSION_1_1;
+
+typedef CL_API_ENTRY cl_mem (CL_API_CALL *clCreateFromDX9MediaSurfaceINTEL_fn)(
+    cl_context                  context,
+    cl_mem_flags                flags,
+    IDirect3DSurface9*          resource,
+    HANDLE                      sharedHandle,
+    UINT                        plane,
+    cl_int*                     errcode_ret) CL_EXT_SUFFIX__VERSION_1_1;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueAcquireDX9ObjectsINTEL(
+    cl_command_queue            command_queue,
+    cl_uint                     num_objects,
+    const cl_mem*               mem_objects,
+    cl_uint                     num_events_in_wait_list,
+    const cl_event*             event_wait_list,
+    cl_event*                   event) CL_EXT_SUFFIX__VERSION_1_1;
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueAcquireDX9ObjectsINTEL_fn)(
+    cl_command_queue            command_queue,
+    cl_uint                     num_objects,
+    const cl_mem*               mem_objects,
+    cl_uint                     num_events_in_wait_list,
+    const cl_event*             event_wait_list,
+    cl_event*                   event) CL_EXT_SUFFIX__VERSION_1_1;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueReleaseDX9ObjectsINTEL(
+    cl_command_queue            command_queue,
+    cl_uint                     num_objects,
+    cl_mem*                     mem_objects,
+    cl_uint                     num_events_in_wait_list,
+    const cl_event*             event_wait_list,
+    cl_event*                   event) CL_EXT_SUFFIX__VERSION_1_1;
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueReleaseDX9ObjectsINTEL_fn)(
+    cl_command_queue            command_queue,
+    cl_uint                     num_objects,
+    cl_mem*                     mem_objects,
+    cl_uint                     num_events_in_wait_list,
+    const cl_event*             event_wait_list,
+    cl_event*                   event) CL_EXT_SUFFIX__VERSION_1_1;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif  /* __OPENCL_CL_DX9_MEDIA_SHARING_INTEL_H */
+
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_egl.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_egl.h
new file mode 100644
index 000000000..c8bde80e1
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_egl.h
@@ -0,0 +1,120 @@
+/*******************************************************************************
+ * Copyright (c) 2008-2020 The Khronos Group Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ ******************************************************************************/
+
+#ifndef __OPENCL_CL_EGL_H
+#define __OPENCL_CL_EGL_H
+
+#include <CL/cl.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+/* Command type for events created with clEnqueueAcquireEGLObjectsKHR */
+#define CL_COMMAND_EGL_FENCE_SYNC_OBJECT_KHR  0x202F
+#define CL_COMMAND_ACQUIRE_EGL_OBJECTS_KHR    0x202D
+#define CL_COMMAND_RELEASE_EGL_OBJECTS_KHR    0x202E
+
+/* Error type for clCreateFromEGLImageKHR */
+#define CL_INVALID_EGL_OBJECT_KHR             -1093
+#define CL_EGL_RESOURCE_NOT_ACQUIRED_KHR      -1092
+
+/* CLeglImageKHR is an opaque handle to an EGLImage */
+typedef void* CLeglImageKHR;
+
+/* CLeglDisplayKHR is an opaque handle to an EGLDisplay */
+typedef void* CLeglDisplayKHR;
+
+/* CLeglSyncKHR is an opaque handle to an EGLSync object */
+typedef void* CLeglSyncKHR;
+
+/* properties passed to clCreateFromEGLImageKHR */
+typedef intptr_t cl_egl_image_properties_khr;
+
+
+#define cl_khr_egl_image 1
+
+extern CL_API_ENTRY cl_mem CL_API_CALL
+clCreateFromEGLImageKHR(cl_context                  context,
+                        CLeglDisplayKHR             egldisplay,
+                        CLeglImageKHR               eglimage,
+                        cl_mem_flags                flags,
+                        const cl_egl_image_properties_khr * properties,
+                        cl_int *                    errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_mem (CL_API_CALL *clCreateFromEGLImageKHR_fn)(
+    cl_context                  context,
+    CLeglDisplayKHR             egldisplay,
+    CLeglImageKHR               eglimage,
+    cl_mem_flags                flags,
+    const cl_egl_image_properties_khr * properties,
+    cl_int *                    errcode_ret);
+
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueAcquireEGLObjectsKHR(cl_command_queue command_queue,
+                              cl_uint          num_objects,
+                              const cl_mem *   mem_objects,
+                              cl_uint          num_events_in_wait_list,
+                              const cl_event * event_wait_list,
+                              cl_event *       event) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueAcquireEGLObjectsKHR_fn)(
+    cl_command_queue command_queue,
+    cl_uint          num_objects,
+    const cl_mem *   mem_objects,
+    cl_uint          num_events_in_wait_list,
+    const cl_event * event_wait_list,
+    cl_event *       event);
+
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueReleaseEGLObjectsKHR(cl_command_queue command_queue,
+                              cl_uint          num_objects,
+                              const cl_mem *   mem_objects,
+                              cl_uint          num_events_in_wait_list,
+                              const cl_event * event_wait_list,
+                              cl_event *       event) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueReleaseEGLObjectsKHR_fn)(
+    cl_command_queue command_queue,
+    cl_uint          num_objects,
+    const cl_mem *   mem_objects,
+    cl_uint          num_events_in_wait_list,
+    const cl_event * event_wait_list,
+    cl_event *       event);
+
+
+#define cl_khr_egl_event 1
+
+extern CL_API_ENTRY cl_event CL_API_CALL
+clCreateEventFromEGLSyncKHR(cl_context      context,
+                            CLeglSyncKHR    sync,
+                            CLeglDisplayKHR display,
+                            cl_int *        errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_event (CL_API_CALL *clCreateEventFromEGLSyncKHR_fn)(
+    cl_context      context,
+    CLeglSyncKHR    sync,
+    CLeglDisplayKHR display,
+    cl_int *        errcode_ret);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __OPENCL_CL_EGL_H */
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_ext.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_ext.h
new file mode 100644
index 000000000..0239b6413
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_ext.h
@@ -0,0 +1,907 @@
+/*******************************************************************************
+ * Copyright (c) 2008-2020 The Khronos Group Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ ******************************************************************************/
+
+/* cl_ext.h contains OpenCL extensions which don't have external */
+/* (OpenGL, D3D) dependencies.                                   */
+
+#ifndef __CL_EXT_H
+#define __CL_EXT_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <CL/cl.h>
+
+/* cl_khr_fp64 extension - no extension #define since it has no functions  */
+/* CL_DEVICE_DOUBLE_FP_CONFIG is defined in CL.h for OpenCL >= 120 */
+
+#if CL_TARGET_OPENCL_VERSION <= 110
+#define CL_DEVICE_DOUBLE_FP_CONFIG                       0x1032
+#endif
+
+/* cl_khr_fp16 extension - no extension #define since it has no functions  */
+#define CL_DEVICE_HALF_FP_CONFIG                    0x1033
+
+/* Memory object destruction
+ *
+ * Apple extension for use to manage externally allocated buffers used with cl_mem objects with CL_MEM_USE_HOST_PTR
+ *
+ * Registers a user callback function that will be called when the memory object is deleted and its resources
+ * freed. Each call to clSetMemObjectCallbackFn registers the specified user callback function on a callback
+ * stack associated with memobj. The registered user callback functions are called in the reverse order in
+ * which they were registered. The user callback functions are called and then the memory object is deleted
+ * and its resources freed. This provides a mechanism for the application (and libraries) using memobj to be
+ * notified when the memory referenced by host_ptr, specified when the memory object is created and used as
+ * the storage bits for the memory object, can be reused or freed.
+ *
+ * The application may not call CL api's with the cl_mem object passed to the pfn_notify.
+ *
+ * Please check for the "cl_APPLE_SetMemObjectDestructor" extension using clGetDeviceInfo(CL_DEVICE_EXTENSIONS)
+ * before using.
+ */
+#define cl_APPLE_SetMemObjectDestructor 1
+cl_int  CL_API_ENTRY clSetMemObjectDestructorAPPLE(  cl_mem memobj,
+                                        void (* pfn_notify)(cl_mem memobj, void * user_data),
+                                        void * user_data)             CL_EXT_SUFFIX__VERSION_1_0;
+
+
+/* Context Logging Functions
+ *
+ * The next three convenience functions are intended to be used as the pfn_notify parameter to clCreateContext().
+ * Please check for the "cl_APPLE_ContextLoggingFunctions" extension using clGetDeviceInfo(CL_DEVICE_EXTENSIONS)
+ * before using.
+ *
+ * clLogMessagesToSystemLog forwards on all log messages to the Apple System Logger
+ */
+#define cl_APPLE_ContextLoggingFunctions 1
+extern void CL_API_ENTRY clLogMessagesToSystemLogAPPLE(  const char * errstr,
+                                            const void * private_info,
+                                            size_t       cb,
+                                            void *       user_data)  CL_EXT_SUFFIX__VERSION_1_0;
+
+/* clLogMessagesToStdout sends all log messages to the file descriptor stdout */
+extern void CL_API_ENTRY clLogMessagesToStdoutAPPLE(   const char * errstr,
+                                          const void * private_info,
+                                          size_t       cb,
+                                          void *       user_data)    CL_EXT_SUFFIX__VERSION_1_0;
+
+/* clLogMessagesToStderr sends all log messages to the file descriptor stderr */
+extern void CL_API_ENTRY clLogMessagesToStderrAPPLE(   const char * errstr,
+                                          const void * private_info,
+                                          size_t       cb,
+                                          void *       user_data)    CL_EXT_SUFFIX__VERSION_1_0;
+
+
+/************************
+* cl_khr_icd extension *
+************************/
+#define cl_khr_icd 1
+
+/* cl_platform_info                                                        */
+#define CL_PLATFORM_ICD_SUFFIX_KHR                  0x0920
+
+/* Additional Error Codes                                                  */
+#define CL_PLATFORM_NOT_FOUND_KHR                   -1001
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clIcdGetPlatformIDsKHR(cl_uint          num_entries,
+                       cl_platform_id * platforms,
+                       cl_uint *        num_platforms);
+
+typedef CL_API_ENTRY cl_int
+(CL_API_CALL *clIcdGetPlatformIDsKHR_fn)(cl_uint          num_entries,
+                                         cl_platform_id * platforms,
+                                         cl_uint *        num_platforms);
+
+
+/*******************************
+ * cl_khr_il_program extension *
+ *******************************/
+#define cl_khr_il_program 1
+
+/* New property to clGetDeviceInfo for retrieving supported intermediate
+ * languages
+ */
+#define CL_DEVICE_IL_VERSION_KHR                    0x105B
+
+/* New property to clGetProgramInfo for retrieving for retrieving the IL of a
+ * program
+ */
+#define CL_PROGRAM_IL_KHR                           0x1169
+
+extern CL_API_ENTRY cl_program CL_API_CALL
+clCreateProgramWithILKHR(cl_context   context,
+                         const void * il,
+                         size_t       length,
+                         cl_int *     errcode_ret);
+
+typedef CL_API_ENTRY cl_program
+(CL_API_CALL *clCreateProgramWithILKHR_fn)(cl_context   context,
+                                           const void * il,
+                                           size_t       length,
+                                           cl_int *     errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
+
+/* Extension: cl_khr_image2d_from_buffer
+ *
+ * This extension allows a 2D image to be created from a cl_mem buffer without
+ * a copy. The type associated with a 2D image created from a buffer in an
+ * OpenCL program is image2d_t. Both the sampler and sampler-less read_image
+ * built-in functions are supported for 2D images and 2D images created from
+ * a buffer.  Similarly, the write_image built-ins are also supported for 2D
+ * images created from a buffer.
+ *
+ * When the 2D image from buffer is created, the client must specify the
+ * width, height, image format (i.e. channel order and channel data type)
+ * and optionally the row pitch.
+ *
+ * The pitch specified must be a multiple of
+ * CL_DEVICE_IMAGE_PITCH_ALIGNMENT_KHR pixels.
+ * The base address of the buffer must be aligned to
+ * CL_DEVICE_IMAGE_BASE_ADDRESS_ALIGNMENT_KHR pixels.
+ */
+
+#define CL_DEVICE_IMAGE_PITCH_ALIGNMENT_KHR              0x104A
+#define CL_DEVICE_IMAGE_BASE_ADDRESS_ALIGNMENT_KHR       0x104B
+
+
+/**************************************
+ * cl_khr_initialize_memory extension *
+ **************************************/
+
+#define CL_CONTEXT_MEMORY_INITIALIZE_KHR            0x2030
+
+
+/**************************************
+ * cl_khr_terminate_context extension *
+ **************************************/
+
+#define CL_CONTEXT_TERMINATED_KHR                   -1121
+
+#define CL_DEVICE_TERMINATE_CAPABILITY_KHR          0x2031
+#define CL_CONTEXT_TERMINATE_KHR                    0x2032
+
+#define cl_khr_terminate_context 1
+extern CL_API_ENTRY cl_int CL_API_CALL
+clTerminateContextKHR(cl_context context) CL_EXT_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_int
+(CL_API_CALL *clTerminateContextKHR_fn)(cl_context context) CL_EXT_SUFFIX__VERSION_1_2;
+
+
+/*
+ * Extension: cl_khr_spir
+ *
+ * This extension adds support to create an OpenCL program object from a
+ * Standard Portable Intermediate Representation (SPIR) instance
+ */
+
+#define CL_DEVICE_SPIR_VERSIONS                     0x40E0
+#define CL_PROGRAM_BINARY_TYPE_INTERMEDIATE         0x40E1
+
+
+/*****************************************
+ * cl_khr_create_command_queue extension *
+ *****************************************/
+#define cl_khr_create_command_queue 1
+
+typedef cl_properties cl_queue_properties_khr;
+
+extern CL_API_ENTRY cl_command_queue CL_API_CALL
+clCreateCommandQueueWithPropertiesKHR(cl_context context,
+                                      cl_device_id device,
+                                      const cl_queue_properties_khr* properties,
+                                      cl_int* errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_command_queue
+(CL_API_CALL *clCreateCommandQueueWithPropertiesKHR_fn)(cl_context context,
+                                                        cl_device_id device,
+                                                        const cl_queue_properties_khr* properties,
+                                                        cl_int* errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
+
+
+/******************************************
+* cl_nv_device_attribute_query extension *
+******************************************/
+
+/* cl_nv_device_attribute_query extension - no extension #define since it has no functions */
+#define CL_DEVICE_COMPUTE_CAPABILITY_MAJOR_NV       0x4000
+#define CL_DEVICE_COMPUTE_CAPABILITY_MINOR_NV       0x4001
+#define CL_DEVICE_REGISTERS_PER_BLOCK_NV            0x4002
+#define CL_DEVICE_WARP_SIZE_NV                      0x4003
+#define CL_DEVICE_GPU_OVERLAP_NV                    0x4004
+#define CL_DEVICE_KERNEL_EXEC_TIMEOUT_NV            0x4005
+#define CL_DEVICE_INTEGRATED_MEMORY_NV              0x4006
+
+
+/*********************************
+* cl_amd_device_attribute_query *
+*********************************/
+
+#define CL_DEVICE_PROFILING_TIMER_OFFSET_AMD            0x4036
+#define CL_DEVICE_TOPOLOGY_AMD                          0x4037
+#define CL_DEVICE_BOARD_NAME_AMD                        0x4038
+#define CL_DEVICE_GLOBAL_FREE_MEMORY_AMD                0x4039
+#define CL_DEVICE_SIMD_PER_COMPUTE_UNIT_AMD             0x4040
+#define CL_DEVICE_SIMD_WIDTH_AMD                        0x4041
+#define CL_DEVICE_SIMD_INSTRUCTION_WIDTH_AMD            0x4042
+#define CL_DEVICE_WAVEFRONT_WIDTH_AMD                   0x4043
+#define CL_DEVICE_GLOBAL_MEM_CHANNELS_AMD               0x4044
+#define CL_DEVICE_GLOBAL_MEM_CHANNEL_BANKS_AMD          0x4045
+#define CL_DEVICE_GLOBAL_MEM_CHANNEL_BANK_WIDTH_AMD     0x4046
+#define CL_DEVICE_LOCAL_MEM_SIZE_PER_COMPUTE_UNIT_AMD   0x4047
+#define CL_DEVICE_LOCAL_MEM_BANKS_AMD                   0x4048
+#define CL_DEVICE_THREAD_TRACE_SUPPORTED_AMD            0x4049
+#define CL_DEVICE_GFXIP_MAJOR_AMD                       0x404A
+#define CL_DEVICE_GFXIP_MINOR_AMD                       0x404B
+#define CL_DEVICE_AVAILABLE_ASYNC_QUEUES_AMD            0x404C
+#define CL_DEVICE_PREFERRED_WORK_GROUP_SIZE_AMD         0x4030
+#define CL_DEVICE_MAX_WORK_GROUP_SIZE_AMD               0x4031
+#define CL_DEVICE_PREFERRED_CONSTANT_BUFFER_SIZE_AMD    0x4033
+#define CL_DEVICE_PCIE_ID_AMD                           0x4034
+
+
+/*********************************
+* cl_arm_printf extension
+*********************************/
+
+#define CL_PRINTF_CALLBACK_ARM                      0x40B0
+#define CL_PRINTF_BUFFERSIZE_ARM                    0x40B1
+
+
+/***********************************
+* cl_ext_device_fission extension
+***********************************/
+#define cl_ext_device_fission   1
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clReleaseDeviceEXT(cl_device_id device) CL_EXT_SUFFIX__VERSION_1_1;
+
+typedef CL_API_ENTRY cl_int
+(CL_API_CALL *clReleaseDeviceEXT_fn)(cl_device_id device) CL_EXT_SUFFIX__VERSION_1_1;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clRetainDeviceEXT(cl_device_id device) CL_EXT_SUFFIX__VERSION_1_1;
+
+typedef CL_API_ENTRY cl_int
+(CL_API_CALL *clRetainDeviceEXT_fn)(cl_device_id device) CL_EXT_SUFFIX__VERSION_1_1;
+
+typedef cl_ulong  cl_device_partition_property_ext;
+extern CL_API_ENTRY cl_int CL_API_CALL
+clCreateSubDevicesEXT(cl_device_id   in_device,
+                      const cl_device_partition_property_ext * properties,
+                      cl_uint        num_entries,
+                      cl_device_id * out_devices,
+                      cl_uint *      num_devices) CL_EXT_SUFFIX__VERSION_1_1;
+
+typedef CL_API_ENTRY cl_int
+(CL_API_CALL * clCreateSubDevicesEXT_fn)(cl_device_id   in_device,
+                                         const cl_device_partition_property_ext * properties,
+                                         cl_uint        num_entries,
+                                         cl_device_id * out_devices,
+                                         cl_uint *      num_devices) CL_EXT_SUFFIX__VERSION_1_1;
+
+/* cl_device_partition_property_ext */
+#define CL_DEVICE_PARTITION_EQUALLY_EXT             0x4050
+#define CL_DEVICE_PARTITION_BY_COUNTS_EXT           0x4051
+#define CL_DEVICE_PARTITION_BY_NAMES_EXT            0x4052
+#define CL_DEVICE_PARTITION_BY_AFFINITY_DOMAIN_EXT  0x4053
+
+/* clDeviceGetInfo selectors */
+#define CL_DEVICE_PARENT_DEVICE_EXT                 0x4054
+#define CL_DEVICE_PARTITION_TYPES_EXT               0x4055
+#define CL_DEVICE_AFFINITY_DOMAINS_EXT              0x4056
+#define CL_DEVICE_REFERENCE_COUNT_EXT               0x4057
+#define CL_DEVICE_PARTITION_STYLE_EXT               0x4058
+
+/* error codes */
+#define CL_DEVICE_PARTITION_FAILED_EXT              -1057
+#define CL_INVALID_PARTITION_COUNT_EXT              -1058
+#define CL_INVALID_PARTITION_NAME_EXT               -1059
+
+/* CL_AFFINITY_DOMAINs */
+#define CL_AFFINITY_DOMAIN_L1_CACHE_EXT             0x1
+#define CL_AFFINITY_DOMAIN_L2_CACHE_EXT             0x2
+#define CL_AFFINITY_DOMAIN_L3_CACHE_EXT             0x3
+#define CL_AFFINITY_DOMAIN_L4_CACHE_EXT             0x4
+#define CL_AFFINITY_DOMAIN_NUMA_EXT                 0x10
+#define CL_AFFINITY_DOMAIN_NEXT_FISSIONABLE_EXT     0x100
+
+/* cl_device_partition_property_ext list terminators */
+#define CL_PROPERTIES_LIST_END_EXT                  ((cl_device_partition_property_ext) 0)
+#define CL_PARTITION_BY_COUNTS_LIST_END_EXT         ((cl_device_partition_property_ext) 0)
+#define CL_PARTITION_BY_NAMES_LIST_END_EXT          ((cl_device_partition_property_ext) 0 - 1)
+
+
+/***********************************
+ * cl_ext_migrate_memobject extension definitions
+ ***********************************/
+#define cl_ext_migrate_memobject 1
+
+typedef cl_bitfield cl_mem_migration_flags_ext;
+
+#define CL_MIGRATE_MEM_OBJECT_HOST_EXT              0x1
+
+#define CL_COMMAND_MIGRATE_MEM_OBJECT_EXT           0x4040
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueMigrateMemObjectEXT(cl_command_queue command_queue,
+                             cl_uint          num_mem_objects,
+                             const cl_mem *   mem_objects,
+                             cl_mem_migration_flags_ext flags,
+                             cl_uint          num_events_in_wait_list,
+                             const cl_event * event_wait_list,
+                             cl_event *       event);
+
+typedef CL_API_ENTRY cl_int
+(CL_API_CALL *clEnqueueMigrateMemObjectEXT_fn)(cl_command_queue command_queue,
+                                               cl_uint          num_mem_objects,
+                                               const cl_mem *   mem_objects,
+                                               cl_mem_migration_flags_ext flags,
+                                               cl_uint          num_events_in_wait_list,
+                                               const cl_event * event_wait_list,
+                                               cl_event *       event);
+
+
+/*********************************
+* cl_ext_cxx_for_opencl extension
+*********************************/
+#define cl_ext_cxx_for_opencl 1
+
+#define CL_DEVICE_CXX_FOR_OPENCL_NUMERIC_VERSION_EXT 0x4230
+
+/*********************************
+* cl_qcom_ext_host_ptr extension
+*********************************/
+#define cl_qcom_ext_host_ptr 1
+
+#define CL_MEM_EXT_HOST_PTR_QCOM                  (1 << 29)
+
+#define CL_DEVICE_EXT_MEM_PADDING_IN_BYTES_QCOM   0x40A0
+#define CL_DEVICE_PAGE_SIZE_QCOM                  0x40A1
+#define CL_IMAGE_ROW_ALIGNMENT_QCOM               0x40A2
+#define CL_IMAGE_SLICE_ALIGNMENT_QCOM             0x40A3
+#define CL_MEM_HOST_UNCACHED_QCOM                 0x40A4
+#define CL_MEM_HOST_WRITEBACK_QCOM                0x40A5
+#define CL_MEM_HOST_WRITETHROUGH_QCOM             0x40A6
+#define CL_MEM_HOST_WRITE_COMBINING_QCOM          0x40A7
+
+typedef cl_uint                                   cl_image_pitch_info_qcom;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetDeviceImageInfoQCOM(cl_device_id             device,
+                         size_t                   image_width,
+                         size_t                   image_height,
+                         const cl_image_format   *image_format,
+                         cl_image_pitch_info_qcom param_name,
+                         size_t                   param_value_size,
+                         void                    *param_value,
+                         size_t                  *param_value_size_ret);
+
+typedef struct _cl_mem_ext_host_ptr
+{
+    /* Type of external memory allocation. */
+    /* Legal values will be defined in layered extensions. */
+    cl_uint  allocation_type;
+
+    /* Host cache policy for this external memory allocation. */
+    cl_uint  host_cache_policy;
+
+} cl_mem_ext_host_ptr;
+
+
+/*******************************************
+* cl_qcom_ext_host_ptr_iocoherent extension
+********************************************/
+
+/* Cache policy specifying io-coherence */
+#define CL_MEM_HOST_IOCOHERENT_QCOM               0x40A9
+
+
+/*********************************
+* cl_qcom_ion_host_ptr extension
+*********************************/
+
+#define CL_MEM_ION_HOST_PTR_QCOM                  0x40A8
+
+typedef struct _cl_mem_ion_host_ptr
+{
+    /* Type of external memory allocation. */
+    /* Must be CL_MEM_ION_HOST_PTR_QCOM for ION allocations. */
+    cl_mem_ext_host_ptr  ext_host_ptr;
+
+    /* ION file descriptor */
+    int                  ion_filedesc;
+
+    /* Host pointer to the ION allocated memory */
+    void*                ion_hostptr;
+
+} cl_mem_ion_host_ptr;
+
+
+/*********************************
+* cl_qcom_android_native_buffer_host_ptr extension
+*********************************/
+
+#define CL_MEM_ANDROID_NATIVE_BUFFER_HOST_PTR_QCOM                  0x40C6
+
+typedef struct _cl_mem_android_native_buffer_host_ptr
+{
+    /* Type of external memory allocation. */
+    /* Must be CL_MEM_ANDROID_NATIVE_BUFFER_HOST_PTR_QCOM for Android native buffers. */
+    cl_mem_ext_host_ptr  ext_host_ptr;
+
+    /* Virtual pointer to the android native buffer */
+    void*                anb_ptr;
+
+} cl_mem_android_native_buffer_host_ptr;
+
+
+/******************************************
+ * cl_img_yuv_image extension *
+ ******************************************/
+
+/* Image formats used in clCreateImage */
+#define CL_NV21_IMG                                 0x40D0
+#define CL_YV12_IMG                                 0x40D1
+
+
+/******************************************
+ * cl_img_cached_allocations extension *
+ ******************************************/
+
+/* Flag values used by clCreateBuffer */
+#define CL_MEM_USE_UNCACHED_CPU_MEMORY_IMG          (1 << 26)
+#define CL_MEM_USE_CACHED_CPU_MEMORY_IMG            (1 << 27)
+
+
+/******************************************
+ * cl_img_use_gralloc_ptr extension *
+ ******************************************/
+#define cl_img_use_gralloc_ptr 1
+
+/* Flag values used by clCreateBuffer */
+#define CL_MEM_USE_GRALLOC_PTR_IMG                  (1 << 28)
+
+/* To be used by clGetEventInfo: */
+#define CL_COMMAND_ACQUIRE_GRALLOC_OBJECTS_IMG      0x40D2
+#define CL_COMMAND_RELEASE_GRALLOC_OBJECTS_IMG      0x40D3
+
+/* Error codes from clEnqueueAcquireGrallocObjectsIMG and clEnqueueReleaseGrallocObjectsIMG */
+#define CL_GRALLOC_RESOURCE_NOT_ACQUIRED_IMG        0x40D4
+#define CL_INVALID_GRALLOC_OBJECT_IMG               0x40D5
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueAcquireGrallocObjectsIMG(cl_command_queue      command_queue,
+                                  cl_uint               num_objects,
+                                  const cl_mem *        mem_objects,
+                                  cl_uint               num_events_in_wait_list,
+                                  const cl_event *      event_wait_list,
+                                  cl_event *            event) CL_EXT_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueReleaseGrallocObjectsIMG(cl_command_queue      command_queue,
+                                  cl_uint               num_objects,
+                                  const cl_mem *        mem_objects,
+                                  cl_uint               num_events_in_wait_list,
+                                  const cl_event *      event_wait_list,
+                                  cl_event *            event) CL_EXT_SUFFIX__VERSION_1_2;
+
+/******************************************
+ * cl_img_generate_mipmap extension *
+ ******************************************/
+#define cl_img_generate_mipmap 1
+
+typedef cl_uint cl_mipmap_filter_mode_img;
+
+/* To be used by clEnqueueGenerateMipmapIMG */
+#define CL_MIPMAP_FILTER_ANY_IMG 0x0
+#define CL_MIPMAP_FILTER_BOX_IMG 0x1
+
+/* To be used by clGetEventInfo */
+#define CL_COMMAND_GENERATE_MIPMAP_IMG 0x40D6
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueGenerateMipmapIMG(cl_command_queue          command_queue,
+                           cl_mem                    src_image,
+                           cl_mem                    dst_image,
+                           cl_mipmap_filter_mode_img mipmap_filter_mode,
+                           const size_t              *array_region,
+                           const size_t              *mip_region,
+                           cl_uint                   num_events_in_wait_list,
+                           const cl_event            *event_wait_list,
+                           cl_event *event) CL_EXT_SUFFIX__VERSION_1_2;
+  
+/******************************************
+ * cl_img_mem_properties extension *
+ ******************************************/
+#define cl_img_mem_properties 1
+
+/* To be used by clCreateBufferWithProperties */
+#define CL_MEM_ALLOC_FLAGS_IMG 0x40D7
+
+/* To be used wiith the CL_MEM_ALLOC_FLAGS_IMG property */
+typedef cl_bitfield cl_mem_alloc_flags_img;
+
+/* To be used with cl_mem_alloc_flags_img */
+#define CL_MEM_ALLOC_RELAX_REQUIREMENTS_IMG (1 << 0)
+
+/*********************************
+* cl_khr_subgroups extension
+*********************************/
+#define cl_khr_subgroups 1
+
+#if !defined(CL_VERSION_2_1)
+/* For OpenCL 2.1 and newer, cl_kernel_sub_group_info is declared in CL.h.
+   In hindsight, there should have been a khr suffix on this type for
+   the extension, but keeping it un-suffixed to maintain backwards
+   compatibility. */
+typedef cl_uint             cl_kernel_sub_group_info;
+#endif
+
+/* cl_kernel_sub_group_info */
+#define CL_KERNEL_MAX_SUB_GROUP_SIZE_FOR_NDRANGE_KHR    0x2033
+#define CL_KERNEL_SUB_GROUP_COUNT_FOR_NDRANGE_KHR       0x2034
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetKernelSubGroupInfoKHR(cl_kernel    in_kernel,
+                           cl_device_id in_device,
+                           cl_kernel_sub_group_info param_name,
+                           size_t       input_value_size,
+                           const void * input_value,
+                           size_t       param_value_size,
+                           void *       param_value,
+                           size_t *     param_value_size_ret) CL_EXT_SUFFIX__VERSION_2_0_DEPRECATED;
+
+typedef CL_API_ENTRY cl_int
+(CL_API_CALL * clGetKernelSubGroupInfoKHR_fn)(cl_kernel    in_kernel,
+                                              cl_device_id in_device,
+                                              cl_kernel_sub_group_info param_name,
+                                              size_t       input_value_size,
+                                              const void * input_value,
+                                              size_t       param_value_size,
+                                              void *       param_value,
+                                              size_t *     param_value_size_ret) CL_EXT_SUFFIX__VERSION_2_0_DEPRECATED;
+
+
+/*********************************
+* cl_khr_mipmap_image extension
+*********************************/
+
+/* cl_sampler_properties */
+#define CL_SAMPLER_MIP_FILTER_MODE_KHR              0x1155
+#define CL_SAMPLER_LOD_MIN_KHR                      0x1156
+#define CL_SAMPLER_LOD_MAX_KHR                      0x1157
+
+
+/*********************************
+* cl_khr_priority_hints extension
+*********************************/
+/* This extension define is for backwards compatibility.
+   It shouldn't be required since this extension has no new functions. */
+#define cl_khr_priority_hints 1
+
+typedef cl_uint  cl_queue_priority_khr;
+
+/* cl_command_queue_properties */
+#define CL_QUEUE_PRIORITY_KHR 0x1096
+
+/* cl_queue_priority_khr */
+#define CL_QUEUE_PRIORITY_HIGH_KHR (1<<0)
+#define CL_QUEUE_PRIORITY_MED_KHR (1<<1)
+#define CL_QUEUE_PRIORITY_LOW_KHR (1<<2)
+
+
+/*********************************
+* cl_khr_throttle_hints extension
+*********************************/
+/* This extension define is for backwards compatibility.
+   It shouldn't be required since this extension has no new functions. */
+#define cl_khr_throttle_hints 1
+
+typedef cl_uint  cl_queue_throttle_khr;
+
+/* cl_command_queue_properties */
+#define CL_QUEUE_THROTTLE_KHR 0x1097
+
+/* cl_queue_throttle_khr */
+#define CL_QUEUE_THROTTLE_HIGH_KHR (1<<0)
+#define CL_QUEUE_THROTTLE_MED_KHR (1<<1)
+#define CL_QUEUE_THROTTLE_LOW_KHR (1<<2)
+
+
+/*********************************
+* cl_khr_subgroup_named_barrier
+*********************************/
+/* This extension define is for backwards compatibility.
+   It shouldn't be required since this extension has no new functions. */
+#define cl_khr_subgroup_named_barrier 1
+
+/* cl_device_info */
+#define CL_DEVICE_MAX_NAMED_BARRIER_COUNT_KHR       0x2035
+
+
+/*********************************
+* cl_khr_extended_versioning
+*********************************/
+
+#define cl_khr_extended_versioning 1
+
+#define CL_VERSION_MAJOR_BITS_KHR (10)
+#define CL_VERSION_MINOR_BITS_KHR (10)
+#define CL_VERSION_PATCH_BITS_KHR (12)
+
+#define CL_VERSION_MAJOR_MASK_KHR ((1 << CL_VERSION_MAJOR_BITS_KHR) - 1)
+#define CL_VERSION_MINOR_MASK_KHR ((1 << CL_VERSION_MINOR_BITS_KHR) - 1)
+#define CL_VERSION_PATCH_MASK_KHR ((1 << CL_VERSION_PATCH_BITS_KHR) - 1)
+
+#define CL_VERSION_MAJOR_KHR(version) ((version) >> (CL_VERSION_MINOR_BITS_KHR + CL_VERSION_PATCH_BITS_KHR))
+#define CL_VERSION_MINOR_KHR(version) (((version) >> CL_VERSION_PATCH_BITS_KHR) & CL_VERSION_MINOR_MASK_KHR)
+#define CL_VERSION_PATCH_KHR(version) ((version) & CL_VERSION_PATCH_MASK_KHR)
+
+#define CL_MAKE_VERSION_KHR(major, minor, patch) \
+    ((((major) & CL_VERSION_MAJOR_MASK_KHR) << (CL_VERSION_MINOR_BITS_KHR + CL_VERSION_PATCH_BITS_KHR)) | \
+    (((minor) &  CL_VERSION_MINOR_MASK_KHR) << CL_VERSION_PATCH_BITS_KHR) | \
+    ((patch) & CL_VERSION_PATCH_MASK_KHR))
+
+typedef cl_uint cl_version_khr;
+
+#define CL_NAME_VERSION_MAX_NAME_SIZE_KHR 64
+
+typedef struct _cl_name_version_khr
+{
+    cl_version_khr version;
+    char name[CL_NAME_VERSION_MAX_NAME_SIZE_KHR];
+} cl_name_version_khr;
+
+/* cl_platform_info */
+#define CL_PLATFORM_NUMERIC_VERSION_KHR                  0x0906
+#define CL_PLATFORM_EXTENSIONS_WITH_VERSION_KHR          0x0907
+
+/* cl_device_info */
+#define CL_DEVICE_NUMERIC_VERSION_KHR                    0x105E
+#define CL_DEVICE_OPENCL_C_NUMERIC_VERSION_KHR           0x105F
+#define CL_DEVICE_EXTENSIONS_WITH_VERSION_KHR            0x1060
+#define CL_DEVICE_ILS_WITH_VERSION_KHR                   0x1061
+#define CL_DEVICE_BUILT_IN_KERNELS_WITH_VERSION_KHR      0x1062
+
+
+/*********************************
+* cl_khr_device_uuid extension
+*********************************/
+#define cl_khr_device_uuid 1
+
+#define CL_UUID_SIZE_KHR 16
+#define CL_LUID_SIZE_KHR 8
+
+#define CL_DEVICE_UUID_KHR          0x106A
+#define CL_DRIVER_UUID_KHR          0x106B
+#define CL_DEVICE_LUID_VALID_KHR    0x106C
+#define CL_DEVICE_LUID_KHR          0x106D
+#define CL_DEVICE_NODE_MASK_KHR     0x106E
+
+
+/**********************************
+ * cl_arm_import_memory extension *
+ **********************************/
+#define cl_arm_import_memory 1
+
+typedef intptr_t cl_import_properties_arm;
+
+/* Default and valid proporties name for cl_arm_import_memory */
+#define CL_IMPORT_TYPE_ARM                        0x40B2
+
+/* Host process memory type default value for CL_IMPORT_TYPE_ARM property */
+#define CL_IMPORT_TYPE_HOST_ARM                   0x40B3
+
+/* DMA BUF memory type value for CL_IMPORT_TYPE_ARM property */
+#define CL_IMPORT_TYPE_DMA_BUF_ARM                0x40B4
+
+/* Protected memory property */
+#define CL_IMPORT_TYPE_PROTECTED_ARM              0x40B5
+
+/* Android hardware buffer type value for CL_IMPORT_TYPE_ARM property */
+#define CL_IMPORT_TYPE_ANDROID_HARDWARE_BUFFER_ARM 0x41E2
+
+/* Data consistency with host property */
+#define CL_IMPORT_DMA_BUF_DATA_CONSISTENCY_WITH_HOST_ARM 0x41E3
+
+/* Import memory size value to indicate a size for the whole buffer */
+#define CL_IMPORT_MEMORY_WHOLE_ALLOCATION_ARM SIZE_MAX
+
+/* This extension adds a new function that allows for direct memory import into
+ * OpenCL via the clImportMemoryARM function.
+ *
+ * Memory imported through this interface will be mapped into the device's page
+ * tables directly, providing zero copy access. It will never fall back to copy
+ * operations and aliased buffers.
+ *
+ * Types of memory supported for import are specified as additional extension
+ * strings.
+ *
+ * This extension produces cl_mem allocations which are compatible with all other
+ * users of cl_mem in the standard API.
+ *
+ * This extension maps pages with the same properties as the normal buffer creation
+ * function clCreateBuffer.
+ */
+extern CL_API_ENTRY cl_mem CL_API_CALL
+clImportMemoryARM( cl_context context,
+                   cl_mem_flags flags,
+                   const cl_import_properties_arm *properties,
+                   void *memory,
+                   size_t size,
+                   cl_int *errcode_ret) CL_EXT_SUFFIX__VERSION_1_0;
+
+
+/******************************************
+ * cl_arm_shared_virtual_memory extension *
+ ******************************************/
+#define cl_arm_shared_virtual_memory 1
+
+/* Used by clGetDeviceInfo */
+#define CL_DEVICE_SVM_CAPABILITIES_ARM                  0x40B6
+
+/* Used by clGetMemObjectInfo */
+#define CL_MEM_USES_SVM_POINTER_ARM                     0x40B7
+
+/* Used by clSetKernelExecInfoARM: */
+#define CL_KERNEL_EXEC_INFO_SVM_PTRS_ARM                0x40B8
+#define CL_KERNEL_EXEC_INFO_SVM_FINE_GRAIN_SYSTEM_ARM   0x40B9
+
+/* To be used by clGetEventInfo: */
+#define CL_COMMAND_SVM_FREE_ARM                         0x40BA
+#define CL_COMMAND_SVM_MEMCPY_ARM                       0x40BB
+#define CL_COMMAND_SVM_MEMFILL_ARM                      0x40BC
+#define CL_COMMAND_SVM_MAP_ARM                          0x40BD
+#define CL_COMMAND_SVM_UNMAP_ARM                        0x40BE
+
+/* Flag values returned by clGetDeviceInfo with CL_DEVICE_SVM_CAPABILITIES_ARM as the param_name. */
+#define CL_DEVICE_SVM_COARSE_GRAIN_BUFFER_ARM           (1 << 0)
+#define CL_DEVICE_SVM_FINE_GRAIN_BUFFER_ARM             (1 << 1)
+#define CL_DEVICE_SVM_FINE_GRAIN_SYSTEM_ARM             (1 << 2)
+#define CL_DEVICE_SVM_ATOMICS_ARM                       (1 << 3)
+
+/* Flag values used by clSVMAllocARM: */
+#define CL_MEM_SVM_FINE_GRAIN_BUFFER_ARM                (1 << 10)
+#define CL_MEM_SVM_ATOMICS_ARM                          (1 << 11)
+
+typedef cl_bitfield cl_svm_mem_flags_arm;
+typedef cl_uint     cl_kernel_exec_info_arm;
+typedef cl_bitfield cl_device_svm_capabilities_arm;
+
+extern CL_API_ENTRY void * CL_API_CALL
+clSVMAllocARM(cl_context       context,
+              cl_svm_mem_flags_arm flags,
+              size_t           size,
+              cl_uint          alignment) CL_EXT_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY void CL_API_CALL
+clSVMFreeARM(cl_context        context,
+             void *            svm_pointer) CL_EXT_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueSVMFreeARM(cl_command_queue  command_queue,
+                    cl_uint           num_svm_pointers,
+                    void *            svm_pointers[],
+                    void (CL_CALLBACK * pfn_free_func)(cl_command_queue queue,
+                                                       cl_uint          num_svm_pointers,
+                                                       void *           svm_pointers[],
+                                                       void *           user_data),
+                    void *            user_data,
+                    cl_uint           num_events_in_wait_list,
+                    const cl_event *  event_wait_list,
+                    cl_event *        event) CL_EXT_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueSVMMemcpyARM(cl_command_queue  command_queue,
+                      cl_bool           blocking_copy,
+                      void *            dst_ptr,
+                      const void *      src_ptr,
+                      size_t            size,
+                      cl_uint           num_events_in_wait_list,
+                      const cl_event *  event_wait_list,
+                      cl_event *        event) CL_EXT_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueSVMMemFillARM(cl_command_queue  command_queue,
+                       void *            svm_ptr,
+                       const void *      pattern,
+                       size_t            pattern_size,
+                       size_t            size,
+                       cl_uint           num_events_in_wait_list,
+                       const cl_event *  event_wait_list,
+                       cl_event *        event) CL_EXT_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueSVMMapARM(cl_command_queue  command_queue,
+                   cl_bool           blocking_map,
+                   cl_map_flags      flags,
+                   void *            svm_ptr,
+                   size_t            size,
+                   cl_uint           num_events_in_wait_list,
+                   const cl_event *  event_wait_list,
+                   cl_event *        event) CL_EXT_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueSVMUnmapARM(cl_command_queue  command_queue,
+                     void *            svm_ptr,
+                     cl_uint           num_events_in_wait_list,
+                     const cl_event *  event_wait_list,
+                     cl_event *        event) CL_EXT_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clSetKernelArgSVMPointerARM(cl_kernel    kernel,
+                            cl_uint      arg_index,
+                            const void * arg_value) CL_EXT_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clSetKernelExecInfoARM(cl_kernel            kernel,
+                       cl_kernel_exec_info_arm  param_name,
+                       size_t               param_value_size,
+                       const void *         param_value) CL_EXT_SUFFIX__VERSION_1_2;
+
+/********************************
+ * cl_arm_get_core_id extension *
+ ********************************/
+
+#ifdef CL_VERSION_1_2
+
+#define cl_arm_get_core_id 1
+
+/* Device info property for bitfield of cores present */
+#define CL_DEVICE_COMPUTE_UNITS_BITFIELD_ARM      0x40BF
+
+#endif  /* CL_VERSION_1_2 */
+
+/*********************************
+* cl_arm_job_slot_selection
+*********************************/
+
+#define cl_arm_job_slot_selection 1
+
+/* cl_device_info */
+#define CL_DEVICE_JOB_SLOTS_ARM                   0x41E0
+
+/* cl_command_queue_properties */
+#define CL_QUEUE_JOB_SLOT_ARM                     0x41E1
+
+/*********************************
+* cl_arm_scheduling_controls
+*********************************/
+
+#define cl_arm_scheduling_controls 1
+
+/* cl_device_info */
+#define CL_DEVICE_SCHEDULING_CONTROLS_CAPABILITIES_ARM          0x41E4
+
+#define CL_DEVICE_SCHEDULING_KERNEL_BATCHING_ARM               (1 << 0)
+#define CL_DEVICE_SCHEDULING_WORKGROUP_BATCH_SIZE_ARM          (1 << 1)
+#define CL_DEVICE_SCHEDULING_WORKGROUP_BATCH_SIZE_MODIFIER_ARM (1 << 2)
+
+/* cl_kernel_info */
+#define CL_KERNEL_EXEC_INFO_WORKGROUP_BATCH_SIZE_ARM            0x41E5
+#define CL_KERNEL_EXEC_INFO_WORKGROUP_BATCH_SIZE_MODIFIER_ARM   0x41E6
+
+/* cl_queue_properties */
+#define CL_QUEUE_KERNEL_BATCHING_ARM                            0x41E7
+
+#ifdef __cplusplus
+}
+#endif
+
+
+#endif /* __CL_EXT_H */
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_ext_intel.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_ext_intel.h
new file mode 100644
index 000000000..aab82284c
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_ext_intel.h
@@ -0,0 +1,731 @@
+/*******************************************************************************
+ * Copyright (c) 2008-2020 The Khronos Group Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ******************************************************************************/
+/*****************************************************************************\
+
+Copyright (c) 2013-2020 Intel Corporation All Rights Reserved.
+
+THESE MATERIALS ARE PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL OR ITS
+CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THESE
+MATERIALS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+File Name: cl_ext_intel.h
+
+Abstract:
+
+Notes:
+
+\*****************************************************************************/
+
+#ifndef __CL_EXT_INTEL_H
+#define __CL_EXT_INTEL_H
+
+#include <CL/cl.h>
+#include <CL/cl_platform.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/***************************************
+* cl_intel_thread_local_exec extension *
+****************************************/
+
+#define cl_intel_thread_local_exec 1
+
+#define CL_QUEUE_THREAD_LOCAL_EXEC_ENABLE_INTEL      (((cl_bitfield)1) << 31)
+
+/***********************************************
+* cl_intel_device_partition_by_names extension *
+************************************************/
+
+#define cl_intel_device_partition_by_names 1
+
+#define CL_DEVICE_PARTITION_BY_NAMES_INTEL          0x4052
+#define CL_PARTITION_BY_NAMES_LIST_END_INTEL        -1
+
+/************************************************
+* cl_intel_accelerator extension                *
+* cl_intel_motion_estimation extension          *
+* cl_intel_advanced_motion_estimation extension *
+*************************************************/
+
+#define cl_intel_accelerator 1
+#define cl_intel_motion_estimation 1
+#define cl_intel_advanced_motion_estimation 1
+
+typedef struct _cl_accelerator_intel* cl_accelerator_intel;
+typedef cl_uint cl_accelerator_type_intel;
+typedef cl_uint cl_accelerator_info_intel;
+
+typedef struct _cl_motion_estimation_desc_intel {
+    cl_uint mb_block_type;
+    cl_uint subpixel_mode;
+    cl_uint sad_adjust_mode;
+    cl_uint search_path_type;
+} cl_motion_estimation_desc_intel;
+
+/* error codes */
+#define CL_INVALID_ACCELERATOR_INTEL                              -1094
+#define CL_INVALID_ACCELERATOR_TYPE_INTEL                         -1095
+#define CL_INVALID_ACCELERATOR_DESCRIPTOR_INTEL                   -1096
+#define CL_ACCELERATOR_TYPE_NOT_SUPPORTED_INTEL                   -1097
+
+/* cl_accelerator_type_intel */
+#define CL_ACCELERATOR_TYPE_MOTION_ESTIMATION_INTEL               0x0
+
+/* cl_accelerator_info_intel */
+#define CL_ACCELERATOR_DESCRIPTOR_INTEL                           0x4090
+#define CL_ACCELERATOR_REFERENCE_COUNT_INTEL                      0x4091
+#define CL_ACCELERATOR_CONTEXT_INTEL                              0x4092
+#define CL_ACCELERATOR_TYPE_INTEL                                 0x4093
+
+/* cl_motion_detect_desc_intel flags */
+#define CL_ME_MB_TYPE_16x16_INTEL                                 0x0
+#define CL_ME_MB_TYPE_8x8_INTEL                                   0x1
+#define CL_ME_MB_TYPE_4x4_INTEL                                   0x2
+
+#define CL_ME_SUBPIXEL_MODE_INTEGER_INTEL                         0x0
+#define CL_ME_SUBPIXEL_MODE_HPEL_INTEL                            0x1
+#define CL_ME_SUBPIXEL_MODE_QPEL_INTEL                            0x2
+
+#define CL_ME_SAD_ADJUST_MODE_NONE_INTEL                          0x0
+#define CL_ME_SAD_ADJUST_MODE_HAAR_INTEL                          0x1
+
+#define CL_ME_SEARCH_PATH_RADIUS_2_2_INTEL                        0x0
+#define CL_ME_SEARCH_PATH_RADIUS_4_4_INTEL                        0x1
+#define CL_ME_SEARCH_PATH_RADIUS_16_12_INTEL                      0x5
+
+#define CL_ME_SKIP_BLOCK_TYPE_16x16_INTEL                         0x0
+#define CL_ME_CHROMA_INTRA_PREDICT_ENABLED_INTEL                  0x1
+#define CL_ME_LUMA_INTRA_PREDICT_ENABLED_INTEL                    0x2
+#define CL_ME_SKIP_BLOCK_TYPE_8x8_INTEL                           0x4
+
+#define CL_ME_FORWARD_INPUT_MODE_INTEL                            0x1
+#define CL_ME_BACKWARD_INPUT_MODE_INTEL                           0x2
+#define CL_ME_BIDIRECTION_INPUT_MODE_INTEL                        0x3
+
+#define CL_ME_BIDIR_WEIGHT_QUARTER_INTEL                          16
+#define CL_ME_BIDIR_WEIGHT_THIRD_INTEL                            21
+#define CL_ME_BIDIR_WEIGHT_HALF_INTEL                             32
+#define CL_ME_BIDIR_WEIGHT_TWO_THIRD_INTEL                        43
+#define CL_ME_BIDIR_WEIGHT_THREE_QUARTER_INTEL                    48
+
+#define CL_ME_COST_PENALTY_NONE_INTEL                             0x0
+#define CL_ME_COST_PENALTY_LOW_INTEL                              0x1
+#define CL_ME_COST_PENALTY_NORMAL_INTEL                           0x2
+#define CL_ME_COST_PENALTY_HIGH_INTEL                             0x3
+
+#define CL_ME_COST_PRECISION_QPEL_INTEL                           0x0
+#define CL_ME_COST_PRECISION_HPEL_INTEL                           0x1
+#define CL_ME_COST_PRECISION_PEL_INTEL                            0x2
+#define CL_ME_COST_PRECISION_DPEL_INTEL                           0x3
+
+#define CL_ME_LUMA_PREDICTOR_MODE_VERTICAL_INTEL                  0x0
+#define CL_ME_LUMA_PREDICTOR_MODE_HORIZONTAL_INTEL                0x1
+#define CL_ME_LUMA_PREDICTOR_MODE_DC_INTEL                        0x2
+#define CL_ME_LUMA_PREDICTOR_MODE_DIAGONAL_DOWN_LEFT_INTEL        0x3
+
+#define CL_ME_LUMA_PREDICTOR_MODE_DIAGONAL_DOWN_RIGHT_INTEL       0x4
+#define CL_ME_LUMA_PREDICTOR_MODE_PLANE_INTEL                     0x4
+#define CL_ME_LUMA_PREDICTOR_MODE_VERTICAL_RIGHT_INTEL            0x5
+#define CL_ME_LUMA_PREDICTOR_MODE_HORIZONTAL_DOWN_INTEL           0x6
+#define CL_ME_LUMA_PREDICTOR_MODE_VERTICAL_LEFT_INTEL             0x7
+#define CL_ME_LUMA_PREDICTOR_MODE_HORIZONTAL_UP_INTEL             0x8
+
+#define CL_ME_CHROMA_PREDICTOR_MODE_DC_INTEL                      0x0
+#define CL_ME_CHROMA_PREDICTOR_MODE_HORIZONTAL_INTEL              0x1
+#define CL_ME_CHROMA_PREDICTOR_MODE_VERTICAL_INTEL                0x2
+#define CL_ME_CHROMA_PREDICTOR_MODE_PLANE_INTEL                   0x3
+
+/* cl_device_info */
+#define CL_DEVICE_ME_VERSION_INTEL                                0x407E
+
+#define CL_ME_VERSION_LEGACY_INTEL                                0x0
+#define CL_ME_VERSION_ADVANCED_VER_1_INTEL                        0x1
+#define CL_ME_VERSION_ADVANCED_VER_2_INTEL                        0x2
+
+extern CL_API_ENTRY cl_accelerator_intel CL_API_CALL
+clCreateAcceleratorINTEL(
+    cl_context                   context,
+    cl_accelerator_type_intel    accelerator_type,
+    size_t                       descriptor_size,
+    const void*                  descriptor,
+    cl_int*                      errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_accelerator_intel (CL_API_CALL *clCreateAcceleratorINTEL_fn)(
+    cl_context                   context,
+    cl_accelerator_type_intel    accelerator_type,
+    size_t                       descriptor_size,
+    const void*                  descriptor,
+    cl_int*                      errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetAcceleratorInfoINTEL(
+    cl_accelerator_intel         accelerator,
+    cl_accelerator_info_intel    param_name,
+    size_t                       param_value_size,
+    void*                        param_value,
+    size_t*                      param_value_size_ret) CL_EXT_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clGetAcceleratorInfoINTEL_fn)(
+    cl_accelerator_intel         accelerator,
+    cl_accelerator_info_intel    param_name,
+    size_t                       param_value_size,
+    void*                        param_value,
+    size_t*                      param_value_size_ret) CL_EXT_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clRetainAcceleratorINTEL(
+    cl_accelerator_intel         accelerator) CL_EXT_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clRetainAcceleratorINTEL_fn)(
+    cl_accelerator_intel         accelerator) CL_EXT_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clReleaseAcceleratorINTEL(
+    cl_accelerator_intel         accelerator) CL_EXT_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clReleaseAcceleratorINTEL_fn)(
+    cl_accelerator_intel         accelerator) CL_EXT_SUFFIX__VERSION_1_2;
+
+/******************************************
+* cl_intel_simultaneous_sharing extension *
+*******************************************/
+
+#define cl_intel_simultaneous_sharing 1
+
+#define CL_DEVICE_SIMULTANEOUS_INTEROPS_INTEL            0x4104
+#define CL_DEVICE_NUM_SIMULTANEOUS_INTEROPS_INTEL        0x4105
+
+/***********************************
+* cl_intel_egl_image_yuv extension *
+************************************/
+
+#define cl_intel_egl_image_yuv 1
+
+#define CL_EGL_YUV_PLANE_INTEL                           0x4107
+
+/********************************
+* cl_intel_packed_yuv extension *
+*********************************/
+
+#define cl_intel_packed_yuv 1
+
+#define CL_YUYV_INTEL                                    0x4076
+#define CL_UYVY_INTEL                                    0x4077
+#define CL_YVYU_INTEL                                    0x4078
+#define CL_VYUY_INTEL                                    0x4079
+
+/********************************************
+* cl_intel_required_subgroup_size extension *
+*********************************************/
+
+#define cl_intel_required_subgroup_size 1
+
+#define CL_DEVICE_SUB_GROUP_SIZES_INTEL                  0x4108
+#define CL_KERNEL_SPILL_MEM_SIZE_INTEL                   0x4109
+#define CL_KERNEL_COMPILE_SUB_GROUP_SIZE_INTEL           0x410A
+
+/****************************************
+* cl_intel_driver_diagnostics extension *
+*****************************************/
+
+#define cl_intel_driver_diagnostics 1
+
+typedef cl_uint cl_diagnostics_verbose_level;
+
+#define CL_CONTEXT_SHOW_DIAGNOSTICS_INTEL                0x4106
+
+#define CL_CONTEXT_DIAGNOSTICS_LEVEL_ALL_INTEL           ( 0xff )
+#define CL_CONTEXT_DIAGNOSTICS_LEVEL_GOOD_INTEL          ( 1 )
+#define CL_CONTEXT_DIAGNOSTICS_LEVEL_BAD_INTEL           ( 1 << 1 )
+#define CL_CONTEXT_DIAGNOSTICS_LEVEL_NEUTRAL_INTEL       ( 1 << 2 )
+
+/********************************
+* cl_intel_planar_yuv extension *
+*********************************/
+
+#define CL_NV12_INTEL                                       0x410E
+
+#define CL_MEM_NO_ACCESS_INTEL                              ( 1 << 24 )
+#define CL_MEM_ACCESS_FLAGS_UNRESTRICTED_INTEL              ( 1 << 25 )
+
+#define CL_DEVICE_PLANAR_YUV_MAX_WIDTH_INTEL                0x417E
+#define CL_DEVICE_PLANAR_YUV_MAX_HEIGHT_INTEL               0x417F
+
+/*******************************************************
+* cl_intel_device_side_avc_motion_estimation extension *
+********************************************************/
+
+#define CL_DEVICE_AVC_ME_VERSION_INTEL                      0x410B
+#define CL_DEVICE_AVC_ME_SUPPORTS_TEXTURE_SAMPLER_USE_INTEL 0x410C
+#define CL_DEVICE_AVC_ME_SUPPORTS_PREEMPTION_INTEL          0x410D
+
+#define CL_AVC_ME_VERSION_0_INTEL                           0x0   /* No support. */
+#define CL_AVC_ME_VERSION_1_INTEL                           0x1   /* First supported version. */
+
+#define CL_AVC_ME_MAJOR_16x16_INTEL                         0x0
+#define CL_AVC_ME_MAJOR_16x8_INTEL                          0x1
+#define CL_AVC_ME_MAJOR_8x16_INTEL                          0x2
+#define CL_AVC_ME_MAJOR_8x8_INTEL                           0x3
+
+#define CL_AVC_ME_MINOR_8x8_INTEL                           0x0
+#define CL_AVC_ME_MINOR_8x4_INTEL                           0x1
+#define CL_AVC_ME_MINOR_4x8_INTEL                           0x2
+#define CL_AVC_ME_MINOR_4x4_INTEL                           0x3
+
+#define CL_AVC_ME_MAJOR_FORWARD_INTEL                       0x0
+#define CL_AVC_ME_MAJOR_BACKWARD_INTEL                      0x1
+#define CL_AVC_ME_MAJOR_BIDIRECTIONAL_INTEL                 0x2
+
+#define CL_AVC_ME_PARTITION_MASK_ALL_INTEL                  0x0
+#define CL_AVC_ME_PARTITION_MASK_16x16_INTEL                0x7E
+#define CL_AVC_ME_PARTITION_MASK_16x8_INTEL                 0x7D
+#define CL_AVC_ME_PARTITION_MASK_8x16_INTEL                 0x7B
+#define CL_AVC_ME_PARTITION_MASK_8x8_INTEL                  0x77
+#define CL_AVC_ME_PARTITION_MASK_8x4_INTEL                  0x6F
+#define CL_AVC_ME_PARTITION_MASK_4x8_INTEL                  0x5F
+#define CL_AVC_ME_PARTITION_MASK_4x4_INTEL                  0x3F
+
+#define CL_AVC_ME_SEARCH_WINDOW_EXHAUSTIVE_INTEL            0x0
+#define CL_AVC_ME_SEARCH_WINDOW_SMALL_INTEL                 0x1
+#define CL_AVC_ME_SEARCH_WINDOW_TINY_INTEL                  0x2
+#define CL_AVC_ME_SEARCH_WINDOW_EXTRA_TINY_INTEL            0x3
+#define CL_AVC_ME_SEARCH_WINDOW_DIAMOND_INTEL               0x4
+#define CL_AVC_ME_SEARCH_WINDOW_LARGE_DIAMOND_INTEL         0x5
+#define CL_AVC_ME_SEARCH_WINDOW_RESERVED0_INTEL             0x6
+#define CL_AVC_ME_SEARCH_WINDOW_RESERVED1_INTEL             0x7
+#define CL_AVC_ME_SEARCH_WINDOW_CUSTOM_INTEL                0x8
+#define CL_AVC_ME_SEARCH_WINDOW_16x12_RADIUS_INTEL          0x9
+#define CL_AVC_ME_SEARCH_WINDOW_4x4_RADIUS_INTEL            0x2
+#define CL_AVC_ME_SEARCH_WINDOW_2x2_RADIUS_INTEL            0xa
+
+#define CL_AVC_ME_SAD_ADJUST_MODE_NONE_INTEL                0x0
+#define CL_AVC_ME_SAD_ADJUST_MODE_HAAR_INTEL                0x2
+
+#define CL_AVC_ME_SUBPIXEL_MODE_INTEGER_INTEL               0x0
+#define CL_AVC_ME_SUBPIXEL_MODE_HPEL_INTEL                  0x1
+#define CL_AVC_ME_SUBPIXEL_MODE_QPEL_INTEL                  0x3
+
+#define CL_AVC_ME_COST_PRECISION_QPEL_INTEL                 0x0
+#define CL_AVC_ME_COST_PRECISION_HPEL_INTEL                 0x1
+#define CL_AVC_ME_COST_PRECISION_PEL_INTEL                  0x2
+#define CL_AVC_ME_COST_PRECISION_DPEL_INTEL                 0x3
+
+#define CL_AVC_ME_BIDIR_WEIGHT_QUARTER_INTEL                0x10
+#define CL_AVC_ME_BIDIR_WEIGHT_THIRD_INTEL                  0x15
+#define CL_AVC_ME_BIDIR_WEIGHT_HALF_INTEL                   0x20
+#define CL_AVC_ME_BIDIR_WEIGHT_TWO_THIRD_INTEL              0x2B
+#define CL_AVC_ME_BIDIR_WEIGHT_THREE_QUARTER_INTEL          0x30
+
+#define CL_AVC_ME_BORDER_REACHED_LEFT_INTEL                 0x0
+#define CL_AVC_ME_BORDER_REACHED_RIGHT_INTEL                0x2
+#define CL_AVC_ME_BORDER_REACHED_TOP_INTEL                  0x4
+#define CL_AVC_ME_BORDER_REACHED_BOTTOM_INTEL               0x8
+
+#define CL_AVC_ME_SKIP_BLOCK_PARTITION_16x16_INTEL          0x0
+#define CL_AVC_ME_SKIP_BLOCK_PARTITION_8x8_INTEL            0x4000
+
+#define CL_AVC_ME_SKIP_BLOCK_16x16_FORWARD_ENABLE_INTEL     ( 0x1 << 24 )
+#define CL_AVC_ME_SKIP_BLOCK_16x16_BACKWARD_ENABLE_INTEL    ( 0x2 << 24 )
+#define CL_AVC_ME_SKIP_BLOCK_16x16_DUAL_ENABLE_INTEL        ( 0x3 << 24 )
+#define CL_AVC_ME_SKIP_BLOCK_8x8_FORWARD_ENABLE_INTEL       ( 0x55 << 24 )
+#define CL_AVC_ME_SKIP_BLOCK_8x8_BACKWARD_ENABLE_INTEL      ( 0xAA << 24 )
+#define CL_AVC_ME_SKIP_BLOCK_8x8_DUAL_ENABLE_INTEL          ( 0xFF << 24 )
+#define CL_AVC_ME_SKIP_BLOCK_8x8_0_FORWARD_ENABLE_INTEL     ( 0x1 << 24 )
+#define CL_AVC_ME_SKIP_BLOCK_8x8_0_BACKWARD_ENABLE_INTEL    ( 0x2 << 24 )
+#define CL_AVC_ME_SKIP_BLOCK_8x8_1_FORWARD_ENABLE_INTEL     ( 0x1 << 26 )
+#define CL_AVC_ME_SKIP_BLOCK_8x8_1_BACKWARD_ENABLE_INTEL    ( 0x2 << 26 )
+#define CL_AVC_ME_SKIP_BLOCK_8x8_2_FORWARD_ENABLE_INTEL     ( 0x1 << 28 )
+#define CL_AVC_ME_SKIP_BLOCK_8x8_2_BACKWARD_ENABLE_INTEL    ( 0x2 << 28 )
+#define CL_AVC_ME_SKIP_BLOCK_8x8_3_FORWARD_ENABLE_INTEL     ( 0x1 << 30 )
+#define CL_AVC_ME_SKIP_BLOCK_8x8_3_BACKWARD_ENABLE_INTEL    ( 0x2 << 30 )
+
+#define CL_AVC_ME_BLOCK_BASED_SKIP_4x4_INTEL                0x00
+#define CL_AVC_ME_BLOCK_BASED_SKIP_8x8_INTEL                0x80
+
+#define CL_AVC_ME_INTRA_16x16_INTEL                         0x0
+#define CL_AVC_ME_INTRA_8x8_INTEL                           0x1
+#define CL_AVC_ME_INTRA_4x4_INTEL                           0x2
+
+#define CL_AVC_ME_INTRA_LUMA_PARTITION_MASK_16x16_INTEL     0x6
+#define CL_AVC_ME_INTRA_LUMA_PARTITION_MASK_8x8_INTEL       0x5
+#define CL_AVC_ME_INTRA_LUMA_PARTITION_MASK_4x4_INTEL       0x3
+
+#define CL_AVC_ME_INTRA_NEIGHBOR_LEFT_MASK_ENABLE_INTEL         0x60
+#define CL_AVC_ME_INTRA_NEIGHBOR_UPPER_MASK_ENABLE_INTEL        0x10
+#define CL_AVC_ME_INTRA_NEIGHBOR_UPPER_RIGHT_MASK_ENABLE_INTEL  0x8
+#define CL_AVC_ME_INTRA_NEIGHBOR_UPPER_LEFT_MASK_ENABLE_INTEL   0x4
+
+#define CL_AVC_ME_LUMA_PREDICTOR_MODE_VERTICAL_INTEL            0x0
+#define CL_AVC_ME_LUMA_PREDICTOR_MODE_HORIZONTAL_INTEL          0x1
+#define CL_AVC_ME_LUMA_PREDICTOR_MODE_DC_INTEL                  0x2
+#define CL_AVC_ME_LUMA_PREDICTOR_MODE_DIAGONAL_DOWN_LEFT_INTEL  0x3
+#define CL_AVC_ME_LUMA_PREDICTOR_MODE_DIAGONAL_DOWN_RIGHT_INTEL 0x4
+#define CL_AVC_ME_LUMA_PREDICTOR_MODE_PLANE_INTEL               0x4
+#define CL_AVC_ME_LUMA_PREDICTOR_MODE_VERTICAL_RIGHT_INTEL      0x5
+#define CL_AVC_ME_LUMA_PREDICTOR_MODE_HORIZONTAL_DOWN_INTEL     0x6
+#define CL_AVC_ME_LUMA_PREDICTOR_MODE_VERTICAL_LEFT_INTEL       0x7
+#define CL_AVC_ME_LUMA_PREDICTOR_MODE_HORIZONTAL_UP_INTEL       0x8
+#define CL_AVC_ME_CHROMA_PREDICTOR_MODE_DC_INTEL                0x0
+#define CL_AVC_ME_CHROMA_PREDICTOR_MODE_HORIZONTAL_INTEL        0x1
+#define CL_AVC_ME_CHROMA_PREDICTOR_MODE_VERTICAL_INTEL          0x2
+#define CL_AVC_ME_CHROMA_PREDICTOR_MODE_PLANE_INTEL             0x3
+
+#define CL_AVC_ME_FRAME_FORWARD_INTEL                       0x1
+#define CL_AVC_ME_FRAME_BACKWARD_INTEL                      0x2
+#define CL_AVC_ME_FRAME_DUAL_INTEL                          0x3
+
+#define CL_AVC_ME_SLICE_TYPE_PRED_INTEL                     0x0
+#define CL_AVC_ME_SLICE_TYPE_BPRED_INTEL                    0x1
+#define CL_AVC_ME_SLICE_TYPE_INTRA_INTEL                    0x2
+
+#define CL_AVC_ME_INTERLACED_SCAN_TOP_FIELD_INTEL           0x0
+#define CL_AVC_ME_INTERLACED_SCAN_BOTTOM_FIELD_INTEL        0x1
+
+/*******************************************
+* cl_intel_unified_shared_memory extension *
+********************************************/
+
+/* These APIs are in sync with Revision Q of the cl_intel_unified_shared_memory spec! */
+
+#define cl_intel_unified_shared_memory 1
+
+/* cl_device_info */
+#define CL_DEVICE_HOST_MEM_CAPABILITIES_INTEL                   0x4190
+#define CL_DEVICE_DEVICE_MEM_CAPABILITIES_INTEL                 0x4191
+#define CL_DEVICE_SINGLE_DEVICE_SHARED_MEM_CAPABILITIES_INTEL   0x4192
+#define CL_DEVICE_CROSS_DEVICE_SHARED_MEM_CAPABILITIES_INTEL    0x4193
+#define CL_DEVICE_SHARED_SYSTEM_MEM_CAPABILITIES_INTEL          0x4194
+
+typedef cl_bitfield cl_device_unified_shared_memory_capabilities_intel;
+
+/* cl_device_unified_shared_memory_capabilities_intel - bitfield */
+#define CL_UNIFIED_SHARED_MEMORY_ACCESS_INTEL                   (1 << 0)
+#define CL_UNIFIED_SHARED_MEMORY_ATOMIC_ACCESS_INTEL            (1 << 1)
+#define CL_UNIFIED_SHARED_MEMORY_CONCURRENT_ACCESS_INTEL        (1 << 2)
+#define CL_UNIFIED_SHARED_MEMORY_CONCURRENT_ATOMIC_ACCESS_INTEL (1 << 3)
+
+typedef cl_properties cl_mem_properties_intel;
+
+/* cl_mem_properties_intel */
+#define CL_MEM_ALLOC_FLAGS_INTEL        0x4195
+
+typedef cl_bitfield cl_mem_alloc_flags_intel;
+
+/* cl_mem_alloc_flags_intel - bitfield */
+#define CL_MEM_ALLOC_WRITE_COMBINED_INTEL               (1 << 0)
+
+typedef cl_uint cl_mem_info_intel;
+
+/* cl_mem_alloc_info_intel */
+#define CL_MEM_ALLOC_TYPE_INTEL         0x419A
+#define CL_MEM_ALLOC_BASE_PTR_INTEL     0x419B
+#define CL_MEM_ALLOC_SIZE_INTEL         0x419C
+#define CL_MEM_ALLOC_DEVICE_INTEL       0x419D
+/* Enum values 0x419E-0x419F are reserved for future queries. */
+
+typedef cl_uint cl_unified_shared_memory_type_intel;
+
+/* cl_unified_shared_memory_type_intel */
+#define CL_MEM_TYPE_UNKNOWN_INTEL       0x4196
+#define CL_MEM_TYPE_HOST_INTEL          0x4197
+#define CL_MEM_TYPE_DEVICE_INTEL        0x4198
+#define CL_MEM_TYPE_SHARED_INTEL        0x4199
+
+typedef cl_uint cl_mem_advice_intel;
+
+/* cl_mem_advice_intel */
+/* Enum values 0x4208-0x420F are reserved for future memory advices. */
+
+/* cl_kernel_exec_info */
+#define CL_KERNEL_EXEC_INFO_INDIRECT_HOST_ACCESS_INTEL      0x4200
+#define CL_KERNEL_EXEC_INFO_INDIRECT_DEVICE_ACCESS_INTEL    0x4201
+#define CL_KERNEL_EXEC_INFO_INDIRECT_SHARED_ACCESS_INTEL    0x4202
+#define CL_KERNEL_EXEC_INFO_USM_PTRS_INTEL                  0x4203
+
+/* cl_command_type */
+#define CL_COMMAND_MEMFILL_INTEL        0x4204
+#define CL_COMMAND_MEMCPY_INTEL         0x4205
+#define CL_COMMAND_MIGRATEMEM_INTEL     0x4206
+#define CL_COMMAND_MEMADVISE_INTEL      0x4207
+
+extern CL_API_ENTRY void* CL_API_CALL
+clHostMemAllocINTEL(
+            cl_context context,
+            const cl_mem_properties_intel* properties,
+            size_t size,
+            cl_uint alignment,
+            cl_int* errcode_ret);
+
+typedef CL_API_ENTRY void* (CL_API_CALL *
+clHostMemAllocINTEL_fn)(
+            cl_context context,
+            const cl_mem_properties_intel* properties,
+            size_t size,
+            cl_uint alignment,
+            cl_int* errcode_ret);
+
+extern CL_API_ENTRY void* CL_API_CALL
+clDeviceMemAllocINTEL(
+            cl_context context,
+            cl_device_id device,
+            const cl_mem_properties_intel* properties,
+            size_t size,
+            cl_uint alignment,
+            cl_int* errcode_ret);
+
+typedef CL_API_ENTRY void* (CL_API_CALL *
+clDeviceMemAllocINTEL_fn)(
+            cl_context context,
+            cl_device_id device,
+            const cl_mem_properties_intel* properties,
+            size_t size,
+            cl_uint alignment,
+            cl_int* errcode_ret);
+
+extern CL_API_ENTRY void* CL_API_CALL
+clSharedMemAllocINTEL(
+            cl_context context,
+            cl_device_id device,
+            const cl_mem_properties_intel* properties,
+            size_t size,
+            cl_uint alignment,
+            cl_int* errcode_ret);
+
+typedef CL_API_ENTRY void* (CL_API_CALL *
+clSharedMemAllocINTEL_fn)(
+            cl_context context,
+            cl_device_id device,
+            const cl_mem_properties_intel* properties,
+            size_t size,
+            cl_uint alignment,
+            cl_int* errcode_ret);
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clMemFreeINTEL(
+            cl_context context,
+            void* ptr);
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *
+clMemFreeINTEL_fn)(
+            cl_context context,
+            void* ptr);
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clMemBlockingFreeINTEL(
+            cl_context context,
+            void* ptr);
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *
+clMemBlockingFreeINTEL_fn)(
+            cl_context context,
+            void* ptr);
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetMemAllocInfoINTEL(
+            cl_context context,
+            const void* ptr,
+            cl_mem_info_intel param_name,
+            size_t param_value_size,
+            void* param_value,
+            size_t* param_value_size_ret);
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *
+clGetMemAllocInfoINTEL_fn)(
+            cl_context context,
+            const void* ptr,
+            cl_mem_info_intel param_name,
+            size_t param_value_size,
+            void* param_value,
+            size_t* param_value_size_ret);
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clSetKernelArgMemPointerINTEL(
+            cl_kernel kernel,
+            cl_uint arg_index,
+            const void* arg_value);
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *
+clSetKernelArgMemPointerINTEL_fn)(
+            cl_kernel kernel,
+            cl_uint arg_index,
+            const void* arg_value);
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueMemsetINTEL(       /* Deprecated */
+            cl_command_queue command_queue,
+            void* dst_ptr,
+            cl_int value,
+            size_t size,
+            cl_uint num_events_in_wait_list,
+            const cl_event* event_wait_list,
+            cl_event* event);
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *
+clEnqueueMemsetINTEL_fn)(   /* Deprecated */
+            cl_command_queue command_queue,
+            void* dst_ptr,
+            cl_int value,
+            size_t size,
+            cl_uint num_events_in_wait_list,
+            const cl_event* event_wait_list,
+            cl_event* event);
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueMemFillINTEL(
+            cl_command_queue command_queue,
+            void* dst_ptr,
+            const void* pattern,
+            size_t pattern_size,
+            size_t size,
+            cl_uint num_events_in_wait_list,
+            const cl_event* event_wait_list,
+            cl_event* event);
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *
+clEnqueueMemFillINTEL_fn)(
+            cl_command_queue command_queue,
+            void* dst_ptr,
+            const void* pattern,
+            size_t pattern_size,
+            size_t size,
+            cl_uint num_events_in_wait_list,
+            const cl_event* event_wait_list,
+            cl_event* event);
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueMemcpyINTEL(
+            cl_command_queue command_queue,
+            cl_bool blocking,
+            void* dst_ptr,
+            const void* src_ptr,
+            size_t size,
+            cl_uint num_events_in_wait_list,
+            const cl_event* event_wait_list,
+            cl_event* event);
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *
+clEnqueueMemcpyINTEL_fn)(
+            cl_command_queue command_queue,
+            cl_bool blocking,
+            void* dst_ptr,
+            const void* src_ptr,
+            size_t size,
+            cl_uint num_events_in_wait_list,
+            const cl_event* event_wait_list,
+            cl_event* event);
+
+#ifdef CL_VERSION_1_2
+
+/* Because these APIs use cl_mem_migration_flags, they require
+   OpenCL 1.2: */
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueMigrateMemINTEL(
+            cl_command_queue command_queue,
+            const void* ptr,
+            size_t size,
+            cl_mem_migration_flags flags,
+            cl_uint num_events_in_wait_list,
+            const cl_event* event_wait_list,
+            cl_event* event);
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *
+clEnqueueMigrateMemINTEL_fn)(
+            cl_command_queue command_queue,
+            const void* ptr,
+            size_t size,
+            cl_mem_migration_flags flags,
+            cl_uint num_events_in_wait_list,
+            const cl_event* event_wait_list,
+            cl_event* event);
+
+#endif
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueMemAdviseINTEL(
+            cl_command_queue command_queue,
+            const void* ptr,
+            size_t size,
+            cl_mem_advice_intel advice,
+            cl_uint num_events_in_wait_list,
+            const cl_event* event_wait_list,
+            cl_event* event);
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *
+clEnqueueMemAdviseINTEL_fn)(
+            cl_command_queue command_queue,
+            const void* ptr,
+            size_t size,
+            cl_mem_advice_intel advice,
+            cl_uint num_events_in_wait_list,
+            const cl_event* event_wait_list,
+            cl_event* event);
+
+/***************************************************
+* cl_intel_create_buffer_with_properties extension *
+****************************************************/
+
+#define cl_intel_create_buffer_with_properties 1
+
+extern CL_API_ENTRY cl_mem CL_API_CALL
+clCreateBufferWithPropertiesINTEL(
+    cl_context   context,
+    const cl_mem_properties_intel* properties,
+    cl_mem_flags flags,
+    size_t       size,
+    void *       host_ptr,
+    cl_int *     errcode_ret) CL_EXT_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_mem (CL_API_CALL *
+clCreateBufferWithPropertiesINTEL_fn)(
+    cl_context   context,
+    const cl_mem_properties_intel* properties,
+    cl_mem_flags flags,
+    size_t       size,
+    void *       host_ptr,
+    cl_int *     errcode_ret) CL_EXT_SUFFIX__VERSION_1_0;
+
+/******************************************
+* cl_intel_mem_channel_property extension *
+*******************************************/
+
+#define CL_MEM_CHANNEL_INTEL            0x4213
+
+/*********************************
+* cl_intel_mem_force_host_memory *
+**********************************/
+
+#define cl_intel_mem_force_host_memory 1
+
+/* cl_mem_flags */
+#define CL_MEM_FORCE_HOST_MEMORY_INTEL                      (1 << 20)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __CL_EXT_INTEL_H */
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_gl.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_gl.h
new file mode 100644
index 000000000..b587f02a9
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_gl.h
@@ -0,0 +1,159 @@
+/*******************************************************************************
+ * Copyright (c) 2008-2020 The Khronos Group Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ ******************************************************************************/
+
+#ifndef __OPENCL_CL_GL_H
+#define __OPENCL_CL_GL_H
+
+#include <CL/cl.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef cl_uint     cl_gl_object_type;
+typedef cl_uint     cl_gl_texture_info;
+typedef cl_uint     cl_gl_platform_info;
+typedef struct __GLsync *cl_GLsync;
+
+/* cl_gl_object_type = 0x2000 - 0x200F enum values are currently taken           */
+#define CL_GL_OBJECT_BUFFER                     0x2000
+#define CL_GL_OBJECT_TEXTURE2D                  0x2001
+#define CL_GL_OBJECT_TEXTURE3D                  0x2002
+#define CL_GL_OBJECT_RENDERBUFFER               0x2003
+#ifdef CL_VERSION_1_2
+#define CL_GL_OBJECT_TEXTURE2D_ARRAY            0x200E
+#define CL_GL_OBJECT_TEXTURE1D                  0x200F
+#define CL_GL_OBJECT_TEXTURE1D_ARRAY            0x2010
+#define CL_GL_OBJECT_TEXTURE_BUFFER             0x2011
+#endif
+
+/* cl_gl_texture_info           */
+#define CL_GL_TEXTURE_TARGET                    0x2004
+#define CL_GL_MIPMAP_LEVEL                      0x2005
+#ifdef CL_VERSION_1_2
+#define CL_GL_NUM_SAMPLES                       0x2012
+#endif
+
+
+extern CL_API_ENTRY cl_mem CL_API_CALL
+clCreateFromGLBuffer(cl_context     context,
+                     cl_mem_flags   flags,
+                     cl_GLuint      bufobj,
+                     cl_int *       errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_2
+
+extern CL_API_ENTRY cl_mem CL_API_CALL
+clCreateFromGLTexture(cl_context      context,
+                      cl_mem_flags    flags,
+                      cl_GLenum       target,
+                      cl_GLint        miplevel,
+                      cl_GLuint       texture,
+                      cl_int *        errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+
+#endif
+
+extern CL_API_ENTRY cl_mem CL_API_CALL
+clCreateFromGLRenderbuffer(cl_context   context,
+                           cl_mem_flags flags,
+                           cl_GLuint    renderbuffer,
+                           cl_int *     errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetGLObjectInfo(cl_mem                memobj,
+                  cl_gl_object_type *   gl_object_type,
+                  cl_GLuint *           gl_object_name) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetGLTextureInfo(cl_mem               memobj,
+                   cl_gl_texture_info   param_name,
+                   size_t               param_value_size,
+                   void *               param_value,
+                   size_t *             param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueAcquireGLObjects(cl_command_queue      command_queue,
+                          cl_uint               num_objects,
+                          const cl_mem *        mem_objects,
+                          cl_uint               num_events_in_wait_list,
+                          const cl_event *      event_wait_list,
+                          cl_event *            event) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueReleaseGLObjects(cl_command_queue      command_queue,
+                          cl_uint               num_objects,
+                          const cl_mem *        mem_objects,
+                          cl_uint               num_events_in_wait_list,
+                          const cl_event *      event_wait_list,
+                          cl_event *            event) CL_API_SUFFIX__VERSION_1_0;
+
+
+/* Deprecated OpenCL 1.1 APIs */
+extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_1_DEPRECATED cl_mem CL_API_CALL
+clCreateFromGLTexture2D(cl_context      context,
+                        cl_mem_flags    flags,
+                        cl_GLenum       target,
+                        cl_GLint        miplevel,
+                        cl_GLuint       texture,
+                        cl_int *        errcode_ret) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+
+extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_1_DEPRECATED cl_mem CL_API_CALL
+clCreateFromGLTexture3D(cl_context      context,
+                        cl_mem_flags    flags,
+                        cl_GLenum       target,
+                        cl_GLint        miplevel,
+                        cl_GLuint       texture,
+                        cl_int *        errcode_ret) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+
+/* cl_khr_gl_sharing extension  */
+
+#define cl_khr_gl_sharing 1
+
+typedef cl_uint     cl_gl_context_info;
+
+/* Additional Error Codes  */
+#define CL_INVALID_GL_SHAREGROUP_REFERENCE_KHR  -1000
+
+/* cl_gl_context_info  */
+#define CL_CURRENT_DEVICE_FOR_GL_CONTEXT_KHR    0x2006
+#define CL_DEVICES_FOR_GL_CONTEXT_KHR           0x2007
+
+/* Additional cl_context_properties  */
+#define CL_GL_CONTEXT_KHR                       0x2008
+#define CL_EGL_DISPLAY_KHR                      0x2009
+#define CL_GLX_DISPLAY_KHR                      0x200A
+#define CL_WGL_HDC_KHR                          0x200B
+#define CL_CGL_SHAREGROUP_KHR                   0x200C
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetGLContextInfoKHR(const cl_context_properties * properties,
+                      cl_gl_context_info            param_name,
+                      size_t                        param_value_size,
+                      void *                        param_value,
+                      size_t *                      param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clGetGLContextInfoKHR_fn)(
+    const cl_context_properties * properties,
+    cl_gl_context_info            param_name,
+    size_t                        param_value_size,
+    void *                        param_value,
+    size_t *                      param_value_size_ret);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif  /* __OPENCL_CL_GL_H */
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_gl_ext.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_gl_ext.h
new file mode 100644
index 000000000..52107b111
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_gl_ext.h
@@ -0,0 +1,40 @@
+/*******************************************************************************
+ * Copyright (c) 2008-2020 The Khronos Group Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ ******************************************************************************/
+
+#ifndef __OPENCL_CL_GL_EXT_H
+#define __OPENCL_CL_GL_EXT_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <CL/cl_gl.h>
+
+/* 
+ *  cl_khr_gl_event extension
+ */
+#define CL_COMMAND_GL_FENCE_SYNC_OBJECT_KHR     0x200D
+
+extern CL_API_ENTRY cl_event CL_API_CALL
+clCreateEventFromGLsyncKHR(cl_context context,
+                           cl_GLsync  sync,
+                           cl_int *   errcode_ret) CL_EXT_SUFFIX__VERSION_1_1;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif	/* __OPENCL_CL_GL_EXT_H  */
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_half.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_half.h
new file mode 100644
index 000000000..ecc422332
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_half.h
@@ -0,0 +1,440 @@
+/*******************************************************************************
+ * Copyright (c) 2019-2020 The Khronos Group Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ ******************************************************************************/
+
+/**
+ * This is a header-only utility library that provides OpenCL host code with
+ * routines for converting to/from cl_half values.
+ *
+ * Example usage:
+ *
+ *    #include <CL/cl_half.h>
+ *    ...
+ *    cl_half h = cl_half_from_float(0.5f, CL_HALF_RTE);
+ *    cl_float f = cl_half_to_float(h);
+ */
+
+#ifndef OPENCL_CL_HALF_H
+#define OPENCL_CL_HALF_H
+
+#include <CL/cl_platform.h>
+
+#include <stdint.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+/**
+ * Rounding mode used when converting to cl_half.
+ */
+typedef enum
+{
+  CL_HALF_RTE, // round to nearest even
+  CL_HALF_RTZ, // round towards zero
+  CL_HALF_RTP, // round towards positive infinity
+  CL_HALF_RTN, // round towards negative infinity
+} cl_half_rounding_mode;
+
+
+/* Private utility macros. */
+#define CL_HALF_EXP_MASK 0x7C00
+#define CL_HALF_MAX_FINITE_MAG 0x7BFF
+
+
+/*
+ * Utility to deal with values that overflow when converting to half precision.
+ */
+static inline cl_half cl_half_handle_overflow(cl_half_rounding_mode rounding_mode,
+                                              uint16_t sign)
+{
+  if (rounding_mode == CL_HALF_RTZ)
+  {
+    // Round overflow towards zero -> largest finite number (preserving sign)
+    return (sign << 15) | CL_HALF_MAX_FINITE_MAG;
+  }
+  else if (rounding_mode == CL_HALF_RTP && sign)
+  {
+    // Round negative overflow towards positive infinity -> most negative finite number
+    return (1 << 15) | CL_HALF_MAX_FINITE_MAG;
+  }
+  else if (rounding_mode == CL_HALF_RTN && !sign)
+  {
+    // Round positive overflow towards negative infinity -> largest finite number
+    return CL_HALF_MAX_FINITE_MAG;
+  }
+
+  // Overflow to infinity
+  return (sign << 15) | CL_HALF_EXP_MASK;
+}
+
+/*
+ * Utility to deal with values that underflow when converting to half precision.
+ */
+static inline cl_half cl_half_handle_underflow(cl_half_rounding_mode rounding_mode,
+                                               uint16_t sign)
+{
+  if (rounding_mode == CL_HALF_RTP && !sign)
+  {
+    // Round underflow towards positive infinity -> smallest positive value
+    return (sign << 15) | 1;
+  }
+  else if (rounding_mode == CL_HALF_RTN && sign)
+  {
+    // Round underflow towards negative infinity -> largest negative value
+    return (sign << 15) | 1;
+  }
+
+  // Flush to zero
+  return (sign << 15);
+}
+
+
+/**
+ * Convert a cl_float to a cl_half.
+ */
+static inline cl_half cl_half_from_float(cl_float f, cl_half_rounding_mode rounding_mode)
+{
+  // Type-punning to get direct access to underlying bits
+  union
+  {
+    cl_float f;
+    uint32_t i;
+  } f32;
+  f32.f = f;
+
+  // Extract sign bit
+  uint16_t sign = f32.i >> 31;
+
+  // Extract FP32 exponent and mantissa
+  uint32_t f_exp = (f32.i >> (CL_FLT_MANT_DIG - 1)) & 0xFF;
+  uint32_t f_mant = f32.i & ((1 << (CL_FLT_MANT_DIG - 1)) - 1);
+
+  // Remove FP32 exponent bias
+  int32_t exp = f_exp - CL_FLT_MAX_EXP + 1;
+
+  // Add FP16 exponent bias
+  uint16_t h_exp = (uint16_t)(exp + CL_HALF_MAX_EXP - 1);
+
+  // Position of the bit that will become the FP16 mantissa LSB
+  uint32_t lsb_pos = CL_FLT_MANT_DIG - CL_HALF_MANT_DIG;
+
+  // Check for NaN / infinity
+  if (f_exp == 0xFF)
+  {
+    if (f_mant)
+    {
+      // NaN -> propagate mantissa and silence it
+      uint16_t h_mant = (uint16_t)(f_mant >> lsb_pos);
+      h_mant |= 0x200;
+      return (sign << 15) | CL_HALF_EXP_MASK | h_mant;
+    }
+    else
+    {
+      // Infinity -> zero mantissa
+      return (sign << 15) | CL_HALF_EXP_MASK;
+    }
+  }
+
+  // Check for zero
+  if (!f_exp && !f_mant)
+  {
+    return (sign << 15);
+  }
+
+  // Check for overflow
+  if (exp >= CL_HALF_MAX_EXP)
+  {
+    return cl_half_handle_overflow(rounding_mode, sign);
+  }
+
+  // Check for underflow
+  if (exp < (CL_HALF_MIN_EXP - CL_HALF_MANT_DIG - 1))
+  {
+    return cl_half_handle_underflow(rounding_mode, sign);
+  }
+
+  // Check for value that will become denormal
+  if (exp < -14)
+  {
+    // Denormal -> include the implicit 1 from the FP32 mantissa
+    h_exp = 0;
+    f_mant |= 1 << (CL_FLT_MANT_DIG - 1);
+
+    // Mantissa shift amount depends on exponent
+    lsb_pos = -exp + (CL_FLT_MANT_DIG - 25);
+  }
+
+  // Generate FP16 mantissa by shifting FP32 mantissa
+  uint16_t h_mant = (uint16_t)(f_mant >> lsb_pos);
+
+  // Check whether we need to round
+  uint32_t halfway = 1 << (lsb_pos - 1);
+  uint32_t mask = (halfway << 1) - 1;
+  switch (rounding_mode)
+  {
+    case CL_HALF_RTE:
+      if ((f_mant & mask) > halfway)
+      {
+        // More than halfway -> round up
+        h_mant += 1;
+      }
+      else if ((f_mant & mask) == halfway)
+      {
+        // Exactly halfway -> round to nearest even
+        if (h_mant & 0x1)
+          h_mant += 1;
+      }
+      break;
+    case CL_HALF_RTZ:
+      // Mantissa has already been truncated -> do nothing
+      break;
+    case CL_HALF_RTP:
+      if ((f_mant & mask) && !sign)
+      {
+        // Round positive numbers up
+        h_mant += 1;
+      }
+      break;
+    case CL_HALF_RTN:
+      if ((f_mant & mask) && sign)
+      {
+        // Round negative numbers down
+        h_mant += 1;
+      }
+      break;
+  }
+
+  // Check for mantissa overflow
+  if (h_mant & 0x400)
+  {
+    h_exp += 1;
+    h_mant = 0;
+  }
+
+  return (sign << 15) | (h_exp << 10) | h_mant;
+}
+
+
+/**
+ * Convert a cl_double to a cl_half.
+ */
+static inline cl_half cl_half_from_double(cl_double d, cl_half_rounding_mode rounding_mode)
+{
+  // Type-punning to get direct access to underlying bits
+  union
+  {
+    cl_double d;
+    uint64_t i;
+  } f64;
+  f64.d = d;
+
+  // Extract sign bit
+  uint16_t sign = f64.i >> 63;
+
+  // Extract FP64 exponent and mantissa
+  uint64_t d_exp = (f64.i >> (CL_DBL_MANT_DIG - 1)) & 0x7FF;
+  uint64_t d_mant = f64.i & (((uint64_t)1 << (CL_DBL_MANT_DIG - 1)) - 1);
+
+  // Remove FP64 exponent bias
+  int64_t exp = d_exp - CL_DBL_MAX_EXP + 1;
+
+  // Add FP16 exponent bias
+  uint16_t h_exp = (uint16_t)(exp + CL_HALF_MAX_EXP - 1);
+
+  // Position of the bit that will become the FP16 mantissa LSB
+  uint32_t lsb_pos = CL_DBL_MANT_DIG - CL_HALF_MANT_DIG;
+
+  // Check for NaN / infinity
+  if (d_exp == 0x7FF)
+  {
+    if (d_mant)
+    {
+      // NaN -> propagate mantissa and silence it
+      uint16_t h_mant = (uint16_t)(d_mant >> lsb_pos);
+      h_mant |= 0x200;
+      return (sign << 15) | CL_HALF_EXP_MASK | h_mant;
+    }
+    else
+    {
+      // Infinity -> zero mantissa
+      return (sign << 15) | CL_HALF_EXP_MASK;
+    }
+  }
+
+  // Check for zero
+  if (!d_exp && !d_mant)
+  {
+    return (sign << 15);
+  }
+
+  // Check for overflow
+  if (exp >= CL_HALF_MAX_EXP)
+  {
+    return cl_half_handle_overflow(rounding_mode, sign);
+  }
+
+  // Check for underflow
+  if (exp < (CL_HALF_MIN_EXP - CL_HALF_MANT_DIG - 1))
+  {
+    return cl_half_handle_underflow(rounding_mode, sign);
+  }
+
+  // Check for value that will become denormal
+  if (exp < -14)
+  {
+    // Include the implicit 1 from the FP64 mantissa
+    h_exp = 0;
+    d_mant |= (uint64_t)1 << (CL_DBL_MANT_DIG - 1);
+
+    // Mantissa shift amount depends on exponent
+    lsb_pos = (uint32_t)(-exp + (CL_DBL_MANT_DIG - 25));
+  }
+
+  // Generate FP16 mantissa by shifting FP64 mantissa
+  uint16_t h_mant = (uint16_t)(d_mant >> lsb_pos);
+
+  // Check whether we need to round
+  uint64_t halfway = (uint64_t)1 << (lsb_pos - 1);
+  uint64_t mask = (halfway << 1) - 1;
+  switch (rounding_mode)
+  {
+    case CL_HALF_RTE:
+      if ((d_mant & mask) > halfway)
+      {
+        // More than halfway -> round up
+        h_mant += 1;
+      }
+      else if ((d_mant & mask) == halfway)
+      {
+        // Exactly halfway -> round to nearest even
+        if (h_mant & 0x1)
+          h_mant += 1;
+      }
+      break;
+    case CL_HALF_RTZ:
+      // Mantissa has already been truncated -> do nothing
+      break;
+    case CL_HALF_RTP:
+      if ((d_mant & mask) && !sign)
+      {
+        // Round positive numbers up
+        h_mant += 1;
+      }
+      break;
+    case CL_HALF_RTN:
+      if ((d_mant & mask) && sign)
+      {
+        // Round negative numbers down
+        h_mant += 1;
+      }
+      break;
+  }
+
+  // Check for mantissa overflow
+  if (h_mant & 0x400)
+  {
+    h_exp += 1;
+    h_mant = 0;
+  }
+
+  return (sign << 15) | (h_exp << 10) | h_mant;
+}
+
+
+/**
+ * Convert a cl_half to a cl_float.
+ */
+static inline cl_float cl_half_to_float(cl_half h)
+{
+  // Type-punning to get direct access to underlying bits
+  union
+  {
+    cl_float f;
+    uint32_t i;
+  } f32;
+
+  // Extract sign bit
+  uint16_t sign = h >> 15;
+
+  // Extract FP16 exponent and mantissa
+  uint16_t h_exp = (h >> (CL_HALF_MANT_DIG - 1)) & 0x1F;
+  uint16_t h_mant = h & 0x3FF;
+
+  // Remove FP16 exponent bias
+  int32_t exp = h_exp - CL_HALF_MAX_EXP + 1;
+
+  // Add FP32 exponent bias
+  uint32_t f_exp = exp + CL_FLT_MAX_EXP - 1;
+
+  // Check for NaN / infinity
+  if (h_exp == 0x1F)
+  {
+    if (h_mant)
+    {
+      // NaN -> propagate mantissa and silence it
+      uint32_t f_mant = h_mant << (CL_FLT_MANT_DIG - CL_HALF_MANT_DIG);
+      f_mant |= 0x400000;
+      f32.i = (sign << 31) | 0x7F800000 | f_mant;
+      return f32.f;
+    }
+    else
+    {
+      // Infinity -> zero mantissa
+      f32.i = (sign << 31) | 0x7F800000;
+      return f32.f;
+    }
+  }
+
+  // Check for zero / denormal
+  if (h_exp == 0)
+  {
+    if (h_mant == 0)
+    {
+      // Zero -> zero exponent
+      f_exp = 0;
+    }
+    else
+    {
+      // Denormal -> normalize it
+      // - Shift mantissa to make most-significant 1 implicit
+      // - Adjust exponent accordingly
+      uint32_t shift = 0;
+      while ((h_mant & 0x400) == 0)
+      {
+        h_mant <<= 1;
+        shift++;
+      }
+      h_mant &= 0x3FF;
+      f_exp -= shift - 1;
+    }
+  }
+
+  f32.i = (sign << 31) | (f_exp << 23) | (h_mant << 13);
+  return f32.f;
+}
+
+
+#undef CL_HALF_EXP_MASK
+#undef CL_HALF_MAX_FINITE_MAG
+
+
+#ifdef __cplusplus
+}
+#endif
+
+
+#endif  /* OPENCL_CL_HALF_H */
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_icd.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_icd.h
new file mode 100644
index 000000000..8ff8b94f9
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_icd.h
@@ -0,0 +1,1294 @@
+/*******************************************************************************
+ * Copyright (c) 2019-2020 The Khronos Group Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ ******************************************************************************/
+
+#ifndef OPENCL_CL_ICD_H
+#define OPENCL_CL_ICD_H
+
+#include <CL/cl.h>
+#include <CL/cl_egl.h>
+#include <CL/cl_ext.h>
+#include <CL/cl_gl.h>
+
+#if defined(_WIN32)
+#include <CL/cl_d3d11.h>
+#include <CL/cl_d3d10.h>
+#include <CL/cl_dx9_media_sharing.h>
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * This file contains pointer type definitions for each of the CL API calls as
+ * well as a type definition for the dispatch table used by the Khronos ICD
+ * loader (see cl_khr_icd extension specification for background).
+ */
+
+/* API function pointer definitions */
+
+// Platform APIs
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetPlatformIDs)(
+    cl_uint num_entries, cl_platform_id *platforms,
+    cl_uint *num_platforms) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetPlatformInfo)(
+    cl_platform_id platform, cl_platform_info param_name,
+    size_t param_value_size, void *param_value,
+    size_t *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+// Device APIs
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetDeviceIDs)(
+    cl_platform_id platform, cl_device_type device_type, cl_uint num_entries,
+    cl_device_id *devices, cl_uint *num_devices) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetDeviceInfo)(
+    cl_device_id device, cl_device_info param_name, size_t param_value_size,
+    void *param_value, size_t *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_2
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clCreateSubDevices)(
+    cl_device_id in_device,
+    const cl_device_partition_property *partition_properties,
+    cl_uint num_entries, cl_device_id *out_devices, cl_uint *num_devices);
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clRetainDevice)(
+    cl_device_id device) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clReleaseDevice)(
+    cl_device_id device) CL_API_SUFFIX__VERSION_1_2;
+
+#else
+
+typedef void *cl_api_clCreateSubDevices;
+typedef void *cl_api_clRetainDevice;
+typedef void *cl_api_clReleaseDevice;
+
+#endif
+
+// Context APIs
+typedef CL_API_ENTRY cl_context(CL_API_CALL *cl_api_clCreateContext)(
+    const cl_context_properties *properties, cl_uint num_devices,
+    const cl_device_id *devices,
+    void(CL_CALLBACK *pfn_notify)(const char *, const void *, size_t, void *),
+    void *user_data, cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_context(CL_API_CALL *cl_api_clCreateContextFromType)(
+    const cl_context_properties *properties, cl_device_type device_type,
+    void(CL_CALLBACK *pfn_notify)(const char *, const void *, size_t, void *),
+    void *user_data, cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clRetainContext)(
+    cl_context context) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clReleaseContext)(
+    cl_context context) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetContextInfo)(
+    cl_context context, cl_context_info param_name, size_t param_value_size,
+    void *param_value, size_t *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+// Command Queue APIs
+typedef CL_API_ENTRY cl_command_queue(CL_API_CALL *cl_api_clCreateCommandQueue)(
+    cl_context context, cl_device_id device,
+    cl_command_queue_properties properties,
+    cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_2_0
+
+typedef CL_API_ENTRY
+cl_command_queue(CL_API_CALL *cl_api_clCreateCommandQueueWithProperties)(
+    cl_context /* context */, cl_device_id /* device */,
+    const cl_queue_properties * /* properties */,
+    cl_int * /* errcode_ret */) CL_API_SUFFIX__VERSION_2_0;
+
+#else
+
+typedef void *cl_api_clCreateCommandQueueWithProperties;
+
+#endif
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clRetainCommandQueue)(
+    cl_command_queue command_queue) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clReleaseCommandQueue)(
+    cl_command_queue command_queue) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetCommandQueueInfo)(
+    cl_command_queue command_queue, cl_command_queue_info param_name,
+    size_t param_value_size, void *param_value,
+    size_t *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+// Memory Object APIs
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateBuffer)(
+    cl_context context, cl_mem_flags flags, size_t size, void *host_ptr,
+    cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_2
+
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateImage)(
+    cl_context context, cl_mem_flags flags, const cl_image_format *image_format,
+    const cl_image_desc *image_desc, void *host_ptr,
+    cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+
+#else
+
+typedef void *cl_api_clCreateImage;
+
+#endif
+
+#ifdef CL_VERSION_3_0
+
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateBufferWithProperties)(
+    cl_context context, const cl_mem_properties *properties, cl_mem_flags flags,
+    size_t size, void *host_ptr,
+    cl_int *errcode_ret) CL_API_SUFFIX__VERSION_3_0;
+
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateImageWithProperties)(
+    cl_context context, const cl_mem_properties *properties, cl_mem_flags flags,
+    const cl_image_format *image_format, const cl_image_desc *image_desc,
+    void *host_ptr, cl_int *errcode_ret) CL_API_SUFFIX__VERSION_3_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL* cl_api_clSetContextDestructorCallback)(
+    cl_context context,
+    void(CL_CALLBACK* pfn_notify)(cl_context context, void* user_data),
+    void* user_data) CL_API_SUFFIX__VERSION_3_0;
+
+#else
+
+typedef void *cl_api_clCreateBufferWithProperties;
+typedef void *cl_api_clCreateImageWithProperties;
+typedef void *cl_api_clSetContextDestructorCallback;
+
+#endif
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clRetainMemObject)(
+    cl_mem memobj) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clReleaseMemObject)(
+    cl_mem memobj) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetSupportedImageFormats)(
+    cl_context context, cl_mem_flags flags, cl_mem_object_type image_type,
+    cl_uint num_entries, cl_image_format *image_formats,
+    cl_uint *num_image_formats) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetMemObjectInfo)(
+    cl_mem memobj, cl_mem_info param_name, size_t param_value_size,
+    void *param_value, size_t *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetImageInfo)(
+    cl_mem image, cl_image_info param_name, size_t param_value_size,
+    void *param_value, size_t *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_2_0
+
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreatePipe)(
+    cl_context /* context */, cl_mem_flags /* flags */,
+    cl_uint /* pipe_packet_size */, cl_uint /* pipe_max_packets */,
+    const cl_pipe_properties * /* properties */,
+    cl_int * /* errcode_ret */) CL_API_SUFFIX__VERSION_2_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetPipeInfo)(
+    cl_mem /* pipe */, cl_pipe_info /* param_name */,
+    size_t /* param_value_size */, void * /* param_value */,
+    size_t * /* param_value_size_ret */) CL_API_SUFFIX__VERSION_2_0;
+
+typedef CL_API_ENTRY void *(CL_API_CALL *cl_api_clSVMAlloc)(
+    cl_context /* context */, cl_svm_mem_flags /* flags */, size_t /* size */,
+    unsigned int /* alignment */)CL_API_SUFFIX__VERSION_2_0;
+
+typedef CL_API_ENTRY void(CL_API_CALL *cl_api_clSVMFree)(
+    cl_context /* context */,
+    void * /* svm_pointer */) CL_API_SUFFIX__VERSION_2_0;
+
+#else
+
+typedef void *cl_api_clCreatePipe;
+typedef void *cl_api_clGetPipeInfo;
+typedef void *cl_api_clSVMAlloc;
+typedef void *cl_api_clSVMFree;
+
+#endif
+
+// Sampler APIs
+typedef CL_API_ENTRY cl_sampler(CL_API_CALL *cl_api_clCreateSampler)(
+    cl_context context, cl_bool normalized_coords,
+    cl_addressing_mode addressing_mode, cl_filter_mode filter_mode,
+    cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clRetainSampler)(
+    cl_sampler sampler) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clReleaseSampler)(
+    cl_sampler sampler) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetSamplerInfo)(
+    cl_sampler sampler, cl_sampler_info param_name, size_t param_value_size,
+    void *param_value, size_t *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_2_0
+
+typedef CL_API_ENTRY
+cl_sampler(CL_API_CALL *cl_api_clCreateSamplerWithProperties)(
+    cl_context /* context */,
+    const cl_sampler_properties * /* sampler_properties */,
+    cl_int * /* errcode_ret */) CL_API_SUFFIX__VERSION_2_0;
+
+#else
+
+typedef void *cl_api_clCreateSamplerWithProperties;
+
+#endif
+
+// Program Object APIs
+typedef CL_API_ENTRY cl_program(CL_API_CALL *cl_api_clCreateProgramWithSource)(
+    cl_context context, cl_uint count, const char **strings,
+    const size_t *lengths, cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_program(CL_API_CALL *cl_api_clCreateProgramWithBinary)(
+    cl_context context, cl_uint num_devices, const cl_device_id *device_list,
+    const size_t *lengths, const unsigned char **binaries,
+    cl_int *binary_status, cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_2
+
+typedef CL_API_ENTRY
+cl_program(CL_API_CALL *cl_api_clCreateProgramWithBuiltInKernels)(
+    cl_context context, cl_uint num_devices, const cl_device_id *device_list,
+    const char *kernel_names, cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+
+#else
+
+typedef void *cl_api_clCreateProgramWithBuiltInKernels;
+
+#endif
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clRetainProgram)(
+    cl_program program) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clReleaseProgram)(
+    cl_program program) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clBuildProgram)(
+    cl_program program, cl_uint num_devices, const cl_device_id *device_list,
+    const char *options,
+    void(CL_CALLBACK *pfn_notify)(cl_program program, void *user_data),
+    void *user_data) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_2
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clCompileProgram)(
+    cl_program program, cl_uint num_devices, const cl_device_id *device_list,
+    const char *options, cl_uint num_input_headers,
+    const cl_program *input_headers, const char **header_include_names,
+    void(CL_CALLBACK *pfn_notify)(cl_program program, void *user_data),
+    void *user_data) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_program(CL_API_CALL *cl_api_clLinkProgram)(
+    cl_context context, cl_uint num_devices, const cl_device_id *device_list,
+    const char *options, cl_uint num_input_programs,
+    const cl_program *input_programs,
+    void(CL_CALLBACK *pfn_notify)(cl_program program, void *user_data),
+    void *user_data, cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+
+#else
+
+typedef void *cl_api_clCompileProgram;
+typedef void *cl_api_clLinkProgram;
+
+#endif
+
+#ifdef CL_VERSION_2_2
+
+typedef CL_API_ENTRY
+cl_int(CL_API_CALL *cl_api_clSetProgramSpecializationConstant)(
+    cl_program program, cl_uint spec_id, size_t spec_size,
+    const void *spec_value) CL_API_SUFFIX__VERSION_2_2;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clSetProgramReleaseCallback)(
+    cl_program program,
+    void(CL_CALLBACK *pfn_notify)(cl_program program, void *user_data),
+    void *user_data) CL_API_SUFFIX__VERSION_2_2;
+
+#else
+
+typedef void *cl_api_clSetProgramSpecializationConstant;
+typedef void *cl_api_clSetProgramReleaseCallback;
+
+#endif
+
+#ifdef CL_VERSION_1_2
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clUnloadPlatformCompiler)(
+    cl_platform_id platform) CL_API_SUFFIX__VERSION_1_2;
+
+#else
+
+typedef void *cl_api_clUnloadPlatformCompiler;
+
+#endif
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetProgramInfo)(
+    cl_program program, cl_program_info param_name, size_t param_value_size,
+    void *param_value, size_t *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetProgramBuildInfo)(
+    cl_program program, cl_device_id device, cl_program_build_info param_name,
+    size_t param_value_size, void *param_value,
+    size_t *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+// Kernel Object APIs
+typedef CL_API_ENTRY cl_kernel(CL_API_CALL *cl_api_clCreateKernel)(
+    cl_program program, const char *kernel_name,
+    cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clCreateKernelsInProgram)(
+    cl_program program, cl_uint num_kernels, cl_kernel *kernels,
+    cl_uint *num_kernels_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clRetainKernel)(
+    cl_kernel kernel) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clReleaseKernel)(
+    cl_kernel kernel) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clSetKernelArg)(
+    cl_kernel kernel, cl_uint arg_index, size_t arg_size,
+    const void *arg_value) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetKernelInfo)(
+    cl_kernel kernel, cl_kernel_info param_name, size_t param_value_size,
+    void *param_value, size_t *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_2
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetKernelArgInfo)(
+    cl_kernel kernel, cl_uint arg_indx, cl_kernel_arg_info param_name,
+    size_t param_value_size, void *param_value,
+    size_t *param_value_size_ret) CL_API_SUFFIX__VERSION_1_2;
+
+#else
+
+typedef void *cl_api_clGetKernelArgInfo;
+
+#endif
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetKernelWorkGroupInfo)(
+    cl_kernel kernel, cl_device_id device, cl_kernel_work_group_info param_name,
+    size_t param_value_size, void *param_value,
+    size_t *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_2_0
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clSetKernelArgSVMPointer)(
+    cl_kernel /* kernel */, cl_uint /* arg_index */,
+    const void * /* arg_value */) CL_API_SUFFIX__VERSION_2_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clSetKernelExecInfo)(
+    cl_kernel /* kernel */, cl_kernel_exec_info /* param_name */,
+    size_t /* param_value_size */,
+    const void * /* param_value */) CL_API_SUFFIX__VERSION_2_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetKernelSubGroupInfoKHR)(
+    cl_kernel /* in_kernel */, cl_device_id /*in_device*/,
+    cl_kernel_sub_group_info /* param_name */, size_t /*input_value_size*/,
+    const void * /*input_value*/, size_t /*param_value_size*/,
+    void * /*param_value*/,
+    size_t * /*param_value_size_ret*/) CL_EXT_SUFFIX__VERSION_2_0;
+
+#else
+
+typedef void *cl_api_clSetKernelArgSVMPointer;
+typedef void *cl_api_clSetKernelExecInfo;
+typedef void *cl_api_clGetKernelSubGroupInfoKHR;
+
+#endif
+
+// Event Object APIs
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clWaitForEvents)(
+    cl_uint num_events, const cl_event *event_list) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetEventInfo)(
+    cl_event event, cl_event_info param_name, size_t param_value_size,
+    void *param_value, size_t *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clRetainEvent)(cl_event event)
+    CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clReleaseEvent)(cl_event event)
+    CL_API_SUFFIX__VERSION_1_0;
+
+// Profiling APIs
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetEventProfilingInfo)(
+    cl_event event, cl_profiling_info param_name, size_t param_value_size,
+    void *param_value, size_t *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+// Flush and Finish APIs
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clFlush)(
+    cl_command_queue command_queue) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clFinish)(
+    cl_command_queue command_queue) CL_API_SUFFIX__VERSION_1_0;
+
+// Enqueued Commands APIs
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueReadBuffer)(
+    cl_command_queue command_queue, cl_mem buffer, cl_bool blocking_read,
+    size_t offset, size_t cb, void *ptr, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_1
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueReadBufferRect)(
+    cl_command_queue command_queue, cl_mem buffer, cl_bool blocking_read,
+    const size_t *buffer_origin, const size_t *host_origin,
+    const size_t *region, size_t buffer_row_pitch, size_t buffer_slice_pitch,
+    size_t host_row_pitch, size_t host_slice_pitch, void *ptr,
+    cl_uint num_events_in_wait_list, const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_1;
+
+#else
+
+typedef void *cl_api_clEnqueueReadBufferRect;
+
+#endif
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueWriteBuffer)(
+    cl_command_queue command_queue, cl_mem buffer, cl_bool blocking_write,
+    size_t offset, size_t cb, const void *ptr, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_1
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueWriteBufferRect)(
+    cl_command_queue command_queue, cl_mem buffer, cl_bool blocking_read,
+    const size_t *buffer_origin, const size_t *host_origin,
+    const size_t *region, size_t buffer_row_pitch, size_t buffer_slice_pitch,
+    size_t host_row_pitch, size_t host_slice_pitch, const void *ptr,
+    cl_uint num_events_in_wait_list, const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_1;
+
+#else
+
+typedef void *cl_api_clEnqueueWriteBufferRect;
+
+#endif
+
+#ifdef CL_VERSION_1_2
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueFillBuffer)(
+    cl_command_queue command_queue, cl_mem buffer, const void *pattern,
+    size_t pattern_size, size_t offset, size_t cb,
+    cl_uint num_events_in_wait_list, const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_2;
+
+#else
+
+typedef void *cl_api_clEnqueueFillBuffer;
+
+#endif
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueCopyBuffer)(
+    cl_command_queue command_queue, cl_mem src_buffer, cl_mem dst_buffer,
+    size_t src_offset, size_t dst_offset, size_t cb,
+    cl_uint num_events_in_wait_list, const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_1
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueCopyBufferRect)(
+    cl_command_queue command_queue, cl_mem src_buffer, cl_mem dst_buffer,
+    const size_t *src_origin, const size_t *dst_origin, const size_t *region,
+    size_t src_row_pitch, size_t src_slice_pitch, size_t dst_row_pitch,
+    size_t dst_slice_pitch, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_1;
+
+#else
+
+typedef void *cl_api_clEnqueueCopyBufferRect;
+
+#endif
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueReadImage)(
+    cl_command_queue command_queue, cl_mem image, cl_bool blocking_read,
+    const size_t *origin, const size_t *region, size_t row_pitch,
+    size_t slice_pitch, void *ptr, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueWriteImage)(
+    cl_command_queue command_queue, cl_mem image, cl_bool blocking_write,
+    const size_t *origin, const size_t *region, size_t input_row_pitch,
+    size_t input_slice_pitch, const void *ptr, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_2
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueFillImage)(
+    cl_command_queue command_queue, cl_mem image, const void *fill_color,
+    const size_t origin[3], const size_t region[3],
+    cl_uint num_events_in_wait_list, const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_2;
+
+#else
+
+typedef void *cl_api_clEnqueueFillImage;
+
+#endif
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueCopyImage)(
+    cl_command_queue command_queue, cl_mem src_image, cl_mem dst_image,
+    const size_t *src_origin, const size_t *dst_origin, const size_t *region,
+    cl_uint num_events_in_wait_list, const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueCopyImageToBuffer)(
+    cl_command_queue command_queue, cl_mem src_image, cl_mem dst_buffer,
+    const size_t *src_origin, const size_t *region, size_t dst_offset,
+    cl_uint num_events_in_wait_list, const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueCopyBufferToImage)(
+    cl_command_queue command_queue, cl_mem src_buffer, cl_mem dst_image,
+    size_t src_offset, const size_t *dst_origin, const size_t *region,
+    cl_uint num_events_in_wait_list, const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY void *(CL_API_CALL *cl_api_clEnqueueMapBuffer)(
+    cl_command_queue command_queue, cl_mem buffer, cl_bool blocking_map,
+    cl_map_flags map_flags, size_t offset, size_t cb,
+    cl_uint num_events_in_wait_list, const cl_event *event_wait_list,
+    cl_event *event, cl_int *errcode_ret)CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY void *(CL_API_CALL *cl_api_clEnqueueMapImage)(
+    cl_command_queue command_queue, cl_mem image, cl_bool blocking_map,
+    cl_map_flags map_flags, const size_t *origin, const size_t *region,
+    size_t *image_row_pitch, size_t *image_slice_pitch,
+    cl_uint num_events_in_wait_list, const cl_event *event_wait_list,
+    cl_event *event, cl_int *errcode_ret)CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueUnmapMemObject)(
+    cl_command_queue command_queue, cl_mem memobj, void *mapped_ptr,
+    cl_uint num_events_in_wait_list, const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_2
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueMigrateMemObjects)(
+    cl_command_queue command_queue, cl_uint num_mem_objects,
+    const cl_mem *mem_objects, cl_mem_migration_flags flags,
+    cl_uint num_events_in_wait_list, const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_2;
+
+#else
+
+typedef void *cl_api_clEnqueueMigrateMemObjects;
+
+#endif
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueNDRangeKernel)(
+    cl_command_queue command_queue, cl_kernel kernel, cl_uint work_dim,
+    const size_t *global_work_offset, const size_t *global_work_size,
+    const size_t *local_work_size, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueTask)(
+    cl_command_queue command_queue, cl_kernel kernel,
+    cl_uint num_events_in_wait_list, const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueNativeKernel)(
+    cl_command_queue command_queue, void(CL_CALLBACK *user_func)(void *),
+    void *args, size_t cb_args, cl_uint num_mem_objects, const cl_mem *mem_list,
+    const void **args_mem_loc, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_0;
+
+#ifdef CL_VERSION_1_2
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueMarkerWithWaitList)(
+    cl_command_queue command_queue, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueBarrierWithWaitList)(
+    cl_command_queue command_queue, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY void *(
+    CL_API_CALL *cl_api_clGetExtensionFunctionAddressForPlatform)(
+    cl_platform_id platform,
+    const char *function_name)CL_API_SUFFIX__VERSION_1_2;
+
+#else
+
+typedef void *cl_api_clEnqueueMarkerWithWaitList;
+typedef void *cl_api_clEnqueueBarrierWithWaitList;
+typedef void *cl_api_clGetExtensionFunctionAddressForPlatform;
+
+#endif
+
+// Shared Virtual Memory APIs
+
+#ifdef CL_VERSION_2_0
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueSVMFree)(
+    cl_command_queue /* command_queue */, cl_uint /* num_svm_pointers */,
+    void ** /* svm_pointers */,
+    void(CL_CALLBACK *pfn_free_func)(cl_command_queue /* queue */,
+                                     cl_uint /* num_svm_pointers */,
+                                     void ** /* svm_pointers[] */,
+                                     void * /* user_data */),
+    void * /* user_data */, cl_uint /* num_events_in_wait_list */,
+    const cl_event * /* event_wait_list */,
+    cl_event * /* event */) CL_API_SUFFIX__VERSION_2_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueSVMMemcpy)(
+    cl_command_queue /* command_queue */, cl_bool /* blocking_copy */,
+    void * /* dst_ptr */, const void * /* src_ptr */, size_t /* size */,
+    cl_uint /* num_events_in_wait_list */,
+    const cl_event * /* event_wait_list */,
+    cl_event * /* event */) CL_API_SUFFIX__VERSION_2_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueSVMMemFill)(
+    cl_command_queue /* command_queue */, void * /* svm_ptr */,
+    const void * /* pattern */, size_t /* pattern_size */, size_t /* size */,
+    cl_uint /* num_events_in_wait_list */,
+    const cl_event * /* event_wait_list */,
+    cl_event * /* event */) CL_API_SUFFIX__VERSION_2_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueSVMMap)(
+    cl_command_queue /* command_queue */, cl_bool /* blocking_map */,
+    cl_map_flags /* map_flags */, void * /* svm_ptr */, size_t /* size */,
+    cl_uint /* num_events_in_wait_list */,
+    const cl_event * /* event_wait_list */,
+    cl_event * /* event */) CL_API_SUFFIX__VERSION_2_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueSVMUnmap)(
+    cl_command_queue /* command_queue */, void * /* svm_ptr */,
+    cl_uint /* num_events_in_wait_list */,
+    const cl_event * /* event_wait_list */,
+    cl_event * /* event */) CL_API_SUFFIX__VERSION_2_0;
+
+#else
+
+typedef void *cl_api_clEnqueueSVMFree;
+typedef void *cl_api_clEnqueueSVMMemcpy;
+typedef void *cl_api_clEnqueueSVMMemFill;
+typedef void *cl_api_clEnqueueSVMMap;
+typedef void *cl_api_clEnqueueSVMUnmap;
+
+#endif
+
+// Deprecated APIs
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clSetCommandQueueProperty)(
+    cl_command_queue command_queue, cl_command_queue_properties properties,
+    cl_bool enable, cl_command_queue_properties *old_properties)
+    CL_EXT_SUFFIX__VERSION_1_0_DEPRECATED;
+
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateImage2D)(
+    cl_context context, cl_mem_flags flags, const cl_image_format *image_format,
+    size_t image_width, size_t image_height, size_t image_row_pitch,
+    void *host_ptr, cl_int *errcode_ret) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateImage3D)(
+    cl_context context, cl_mem_flags flags, const cl_image_format *image_format,
+    size_t image_width, size_t image_height, size_t image_depth,
+    size_t image_row_pitch, size_t image_slice_pitch, void *host_ptr,
+    cl_int *errcode_ret) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clUnloadCompiler)(void)
+    CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueMarker)(
+    cl_command_queue command_queue,
+    cl_event *event) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueWaitForEvents)(
+    cl_command_queue command_queue, cl_uint num_events,
+    const cl_event *event_list) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueBarrier)(
+    cl_command_queue command_queue) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+
+typedef CL_API_ENTRY void *(CL_API_CALL *cl_api_clGetExtensionFunctionAddress)(
+    const char *function_name)CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+
+// GL and other APIs
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateFromGLBuffer)(
+    cl_context context, cl_mem_flags flags, cl_GLuint bufobj,
+    int *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateFromGLTexture)(
+    cl_context context, cl_mem_flags flags, cl_GLenum target, cl_GLint miplevel,
+    cl_GLuint texture, cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateFromGLTexture2D)(
+    cl_context context, cl_mem_flags flags, cl_GLenum target, cl_GLint miplevel,
+    cl_GLuint texture, cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateFromGLTexture3D)(
+    cl_context context, cl_mem_flags flags, cl_GLenum target, cl_GLint miplevel,
+    cl_GLuint texture, cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateFromGLRenderbuffer)(
+    cl_context context, cl_mem_flags flags, cl_GLuint renderbuffer,
+    cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetGLObjectInfo)(
+    cl_mem memobj, cl_gl_object_type *gl_object_type,
+    cl_GLuint *gl_object_name) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetGLTextureInfo)(
+    cl_mem memobj, cl_gl_texture_info param_name, size_t param_value_size,
+    void *param_value, size_t *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueAcquireGLObjects)(
+    cl_command_queue command_queue, cl_uint num_objects,
+    const cl_mem *mem_objects, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueReleaseGLObjects)(
+    cl_command_queue command_queue, cl_uint num_objects,
+    const cl_mem *mem_objects, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_0;
+
+/* cl_khr_gl_sharing */
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetGLContextInfoKHR)(
+    const cl_context_properties *properties, cl_gl_context_info param_name,
+    size_t param_value_size, void *param_value, size_t *param_value_size_ret);
+
+/* cl_khr_gl_event */
+typedef CL_API_ENTRY cl_event(CL_API_CALL *cl_api_clCreateEventFromGLsyncKHR)(
+    cl_context context, cl_GLsync sync, cl_int *errcode_ret);
+
+#if defined(_WIN32)
+
+/* cl_khr_d3d10_sharing */
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetDeviceIDsFromD3D10KHR)(
+    cl_platform_id platform, cl_d3d10_device_source_khr d3d_device_source,
+    void *d3d_object, cl_d3d10_device_set_khr d3d_device_set,
+    cl_uint num_entries, cl_device_id *devices,
+    cl_uint *num_devices) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateFromD3D10BufferKHR)(
+    cl_context context, cl_mem_flags flags, ID3D10Buffer *resource,
+    cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateFromD3D10Texture2DKHR)(
+    cl_context context, cl_mem_flags flags, ID3D10Texture2D *resource,
+    UINT subresource, cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateFromD3D10Texture3DKHR)(
+    cl_context context, cl_mem_flags flags, ID3D10Texture3D *resource,
+    UINT subresource, cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY
+cl_int(CL_API_CALL *cl_api_clEnqueueAcquireD3D10ObjectsKHR)(
+    cl_command_queue command_queue, cl_uint num_objects,
+    const cl_mem *mem_objects, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY
+cl_int(CL_API_CALL *cl_api_clEnqueueReleaseD3D10ObjectsKHR)(
+    cl_command_queue command_queue, cl_uint num_objects,
+    const cl_mem *mem_objects, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_0;
+
+extern CL_API_ENTRY cl_int CL_API_CALL clGetDeviceIDsFromD3D10KHR(
+    cl_platform_id platform, cl_d3d10_device_source_khr d3d_device_source,
+    void *d3d_object, cl_d3d10_device_set_khr d3d_device_set,
+    cl_uint num_entries, cl_device_id *devices, cl_uint *num_devices);
+
+extern CL_API_ENTRY cl_mem CL_API_CALL
+clCreateFromD3D10BufferKHR(cl_context context, cl_mem_flags flags,
+                           ID3D10Buffer *resource, cl_int *errcode_ret);
+
+extern CL_API_ENTRY cl_mem CL_API_CALL clCreateFromD3D10Texture2DKHR(
+    cl_context context, cl_mem_flags flags, ID3D10Texture2D *resource,
+    UINT subresource, cl_int *errcode_ret);
+
+extern CL_API_ENTRY cl_mem CL_API_CALL clCreateFromD3D10Texture3DKHR(
+    cl_context context, cl_mem_flags flags, ID3D10Texture3D *resource,
+    UINT subresource, cl_int *errcode_ret);
+
+extern CL_API_ENTRY cl_int CL_API_CALL clEnqueueAcquireD3D10ObjectsKHR(
+    cl_command_queue command_queue, cl_uint num_objects,
+    const cl_mem *mem_objects, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list, cl_event *event);
+
+extern CL_API_ENTRY cl_int CL_API_CALL clEnqueueReleaseD3D10ObjectsKHR(
+    cl_command_queue command_queue, cl_uint num_objects,
+    const cl_mem *mem_objects, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list, cl_event *event);
+
+/* cl_khr_d3d11_sharing */
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetDeviceIDsFromD3D11KHR)(
+    cl_platform_id platform, cl_d3d11_device_source_khr d3d_device_source,
+    void *d3d_object, cl_d3d11_device_set_khr d3d_device_set,
+    cl_uint num_entries, cl_device_id *devices,
+    cl_uint *num_devices) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateFromD3D11BufferKHR)(
+    cl_context context, cl_mem_flags flags, ID3D11Buffer *resource,
+    cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateFromD3D11Texture2DKHR)(
+    cl_context context, cl_mem_flags flags, ID3D11Texture2D *resource,
+    UINT subresource, cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateFromD3D11Texture3DKHR)(
+    cl_context context, cl_mem_flags flags, ID3D11Texture3D *resource,
+    UINT subresource, cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY
+cl_int(CL_API_CALL *cl_api_clEnqueueAcquireD3D11ObjectsKHR)(
+    cl_command_queue command_queue, cl_uint num_objects,
+    const cl_mem *mem_objects, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY
+cl_int(CL_API_CALL *cl_api_clEnqueueReleaseD3D11ObjectsKHR)(
+    cl_command_queue command_queue, cl_uint num_objects,
+    const cl_mem *mem_objects, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_2;
+
+/* cl_khr_dx9_media_sharing */
+typedef CL_API_ENTRY
+cl_int(CL_API_CALL *cl_api_clGetDeviceIDsFromDX9MediaAdapterKHR)(
+    cl_platform_id platform, cl_uint num_media_adapters,
+    cl_dx9_media_adapter_type_khr *media_adapters_type, void *media_adapters,
+    cl_dx9_media_adapter_set_khr media_adapter_set, cl_uint num_entries,
+    cl_device_id *devices, cl_uint *num_devices) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateFromDX9MediaSurfaceKHR)(
+    cl_context context, cl_mem_flags flags,
+    cl_dx9_media_adapter_type_khr adapter_type, void *surface_info,
+    cl_uint plane, cl_int *errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY
+cl_int(CL_API_CALL *cl_api_clEnqueueAcquireDX9MediaSurfacesKHR)(
+    cl_command_queue command_queue, cl_uint num_objects,
+    const cl_mem *mem_objects, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY
+cl_int(CL_API_CALL *cl_api_clEnqueueReleaseDX9MediaSurfacesKHR)(
+    cl_command_queue command_queue, cl_uint num_objects,
+    const cl_mem *mem_objects, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_1_2;
+
+/* cl_khr_d3d11_sharing */
+extern CL_API_ENTRY cl_int CL_API_CALL clGetDeviceIDsFromD3D11KHR(
+    cl_platform_id platform, cl_d3d11_device_source_khr d3d_device_source,
+    void *d3d_object, cl_d3d11_device_set_khr d3d_device_set,
+    cl_uint num_entries, cl_device_id *devices, cl_uint *num_devices);
+
+extern CL_API_ENTRY cl_mem CL_API_CALL
+clCreateFromD3D11BufferKHR(cl_context context, cl_mem_flags flags,
+                           ID3D11Buffer *resource, cl_int *errcode_ret);
+
+extern CL_API_ENTRY cl_mem CL_API_CALL clCreateFromD3D11Texture2DKHR(
+    cl_context context, cl_mem_flags flags, ID3D11Texture2D *resource,
+    UINT subresource, cl_int *errcode_ret);
+
+extern CL_API_ENTRY cl_mem CL_API_CALL clCreateFromD3D11Texture3DKHR(
+    cl_context context, cl_mem_flags flags, ID3D11Texture3D *resource,
+    UINT subresource, cl_int *errcode_ret);
+
+extern CL_API_ENTRY cl_int CL_API_CALL clEnqueueAcquireD3D11ObjectsKHR(
+    cl_command_queue command_queue, cl_uint num_objects,
+    const cl_mem *mem_objects, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list, cl_event *event);
+
+extern CL_API_ENTRY cl_int CL_API_CALL clEnqueueReleaseD3D11ObjectsKHR(
+    cl_command_queue command_queue, cl_uint num_objects,
+    const cl_mem *mem_objects, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list, cl_event *event);
+
+/* cl_khr_dx9_media_sharing */
+extern CL_API_ENTRY cl_int CL_API_CALL clGetDeviceIDsFromDX9MediaAdapterKHR(
+    cl_platform_id platform, cl_uint num_media_adapters,
+    cl_dx9_media_adapter_type_khr *media_adapter_type, void *media_adapters,
+    cl_dx9_media_adapter_set_khr media_adapter_set, cl_uint num_entries,
+    cl_device_id *devices, cl_uint *num_devices);
+
+extern CL_API_ENTRY cl_mem CL_API_CALL clCreateFromDX9MediaSurfaceKHR(
+    cl_context context, cl_mem_flags flags,
+    cl_dx9_media_adapter_type_khr adapter_type, void *surface_info,
+    cl_uint plane, cl_int *errcode_ret);
+
+extern CL_API_ENTRY cl_int CL_API_CALL clEnqueueAcquireDX9MediaSurfacesKHR(
+    cl_command_queue command_queue, cl_uint num_objects,
+    const cl_mem *mem_objects, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list, cl_event *event);
+
+extern CL_API_ENTRY cl_int CL_API_CALL clEnqueueReleaseDX9MediaSurfacesKHR(
+    cl_command_queue command_queue, cl_uint num_objects,
+    const cl_mem *mem_objects, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list, cl_event *event);
+
+#else
+
+/* cl_khr_d3d10_sharing */
+typedef void *cl_api_clGetDeviceIDsFromD3D10KHR;
+typedef void *cl_api_clCreateFromD3D10BufferKHR;
+typedef void *cl_api_clCreateFromD3D10Texture2DKHR;
+typedef void *cl_api_clCreateFromD3D10Texture3DKHR;
+typedef void *cl_api_clEnqueueAcquireD3D10ObjectsKHR;
+typedef void *cl_api_clEnqueueReleaseD3D10ObjectsKHR;
+
+/* cl_khr_d3d11_sharing */
+typedef void *cl_api_clGetDeviceIDsFromD3D11KHR;
+typedef void *cl_api_clCreateFromD3D11BufferKHR;
+typedef void *cl_api_clCreateFromD3D11Texture2DKHR;
+typedef void *cl_api_clCreateFromD3D11Texture3DKHR;
+typedef void *cl_api_clEnqueueAcquireD3D11ObjectsKHR;
+typedef void *cl_api_clEnqueueReleaseD3D11ObjectsKHR;
+
+/* cl_khr_dx9_media_sharing */
+typedef void *cl_api_clCreateFromDX9MediaSurfaceKHR;
+typedef void *cl_api_clEnqueueAcquireDX9MediaSurfacesKHR;
+typedef void *cl_api_clEnqueueReleaseDX9MediaSurfacesKHR;
+typedef void *cl_api_clGetDeviceIDsFromDX9MediaAdapterKHR;
+
+#endif
+
+/* OpenCL 1.1 */
+
+#ifdef CL_VERSION_1_1
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clSetEventCallback)(
+    cl_event /* event */, cl_int /* command_exec_callback_type */,
+    void(CL_CALLBACK * /* pfn_notify */)(cl_event, cl_int, void *),
+    void * /* user_data */) CL_API_SUFFIX__VERSION_1_1;
+
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateSubBuffer)(
+    cl_mem /* buffer */, cl_mem_flags /* flags */,
+    cl_buffer_create_type /* buffer_create_type */,
+    const void * /* buffer_create_info */,
+    cl_int * /* errcode_ret */) CL_API_SUFFIX__VERSION_1_1;
+
+typedef CL_API_ENTRY
+cl_int(CL_API_CALL *cl_api_clSetMemObjectDestructorCallback)(
+    cl_mem /* memobj */,
+    void(CL_CALLBACK * /*pfn_notify*/)(cl_mem /* memobj */,
+                                       void * /*user_data*/),
+    void * /*user_data */) CL_API_SUFFIX__VERSION_1_1;
+
+typedef CL_API_ENTRY cl_event(CL_API_CALL *cl_api_clCreateUserEvent)(
+    cl_context /* context */,
+    cl_int * /* errcode_ret */) CL_API_SUFFIX__VERSION_1_1;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clSetUserEventStatus)(
+    cl_event /* event */,
+    cl_int /* execution_status */) CL_API_SUFFIX__VERSION_1_1;
+
+#else
+
+typedef void *cl_api_clSetEventCallback;
+typedef void *cl_api_clCreateSubBuffer;
+typedef void *cl_api_clSetMemObjectDestructorCallback;
+typedef void *cl_api_clCreateUserEvent;
+typedef void *cl_api_clSetUserEventStatus;
+
+#endif
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clCreateSubDevicesEXT)(
+    cl_device_id in_device,
+    const cl_device_partition_property_ext *partition_properties,
+    cl_uint num_entries, cl_device_id *out_devices, cl_uint *num_devices);
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clRetainDeviceEXT)(
+    cl_device_id device) CL_API_SUFFIX__VERSION_1_0;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clReleaseDeviceEXT)(
+    cl_device_id device) CL_API_SUFFIX__VERSION_1_0;
+
+/* cl_khr_egl_image */
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateFromEGLImageKHR)(
+    cl_context context, CLeglDisplayKHR display, CLeglImageKHR image,
+    cl_mem_flags flags, const cl_egl_image_properties_khr *properties,
+    cl_int *errcode_ret);
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueAcquireEGLObjectsKHR)(
+    cl_command_queue command_queue, cl_uint num_objects,
+    const cl_mem *mem_objects, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list, cl_event *event);
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueReleaseEGLObjectsKHR)(
+    cl_command_queue command_queue, cl_uint num_objects,
+    const cl_mem *mem_objects, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list, cl_event *event);
+
+/* cl_khr_egl_event */
+typedef CL_API_ENTRY cl_event(CL_API_CALL *cl_api_clCreateEventFromEGLSyncKHR)(
+    cl_context context, CLeglSyncKHR sync, CLeglDisplayKHR display,
+    cl_int *errcode_ret);
+
+#ifdef CL_VERSION_2_1
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clSetDefaultDeviceCommandQueue)(
+    cl_context context, cl_device_id device,
+    cl_command_queue command_queue) CL_API_SUFFIX__VERSION_2_1;
+
+typedef CL_API_ENTRY cl_program(CL_API_CALL *cl_api_clCreateProgramWithIL)(
+    cl_context context, const void *il, size_t length,
+    cl_int *errcode_ret) CL_API_SUFFIX__VERSION_2_1;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetKernelSubGroupInfo)(
+    cl_kernel kernel, cl_device_id device, cl_kernel_sub_group_info param_name,
+    size_t input_value_size, const void *input_value, size_t param_value_size,
+    void *param_value, size_t *param_value_size_ret) CL_API_SUFFIX__VERSION_2_1;
+
+typedef CL_API_ENTRY cl_kernel(CL_API_CALL *cl_api_clCloneKernel)(
+    cl_kernel source_kernel, cl_int *errcode_ret) CL_API_SUFFIX__VERSION_2_1;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueSVMMigrateMem)(
+    cl_command_queue command_queue, cl_uint num_svm_pointers,
+    const void **svm_pointers, const size_t *sizes,
+    cl_mem_migration_flags flags, cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event) CL_API_SUFFIX__VERSION_2_1;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetDeviceAndHostTimer)(
+    cl_device_id device, cl_ulong *device_timestamp,
+    cl_ulong *host_timestamp) CL_API_SUFFIX__VERSION_2_1;
+
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetHostTimer)(
+    cl_device_id device, cl_ulong *host_timestamp) CL_API_SUFFIX__VERSION_2_1;
+
+#else
+
+typedef void *cl_api_clSetDefaultDeviceCommandQueue;
+typedef void *cl_api_clCreateProgramWithIL;
+typedef void *cl_api_clGetKernelSubGroupInfo;
+typedef void *cl_api_clCloneKernel;
+typedef void *cl_api_clEnqueueSVMMigrateMem;
+typedef void *cl_api_clGetDeviceAndHostTimer;
+typedef void *cl_api_clGetHostTimer;
+
+#endif
+
+/* Vendor dispatch table struture */
+
+typedef struct _cl_icd_dispatch {
+  /* OpenCL 1.0 */
+  cl_api_clGetPlatformIDs clGetPlatformIDs;
+  cl_api_clGetPlatformInfo clGetPlatformInfo;
+  cl_api_clGetDeviceIDs clGetDeviceIDs;
+  cl_api_clGetDeviceInfo clGetDeviceInfo;
+  cl_api_clCreateContext clCreateContext;
+  cl_api_clCreateContextFromType clCreateContextFromType;
+  cl_api_clRetainContext clRetainContext;
+  cl_api_clReleaseContext clReleaseContext;
+  cl_api_clGetContextInfo clGetContextInfo;
+  cl_api_clCreateCommandQueue clCreateCommandQueue;
+  cl_api_clRetainCommandQueue clRetainCommandQueue;
+  cl_api_clReleaseCommandQueue clReleaseCommandQueue;
+  cl_api_clGetCommandQueueInfo clGetCommandQueueInfo;
+  cl_api_clSetCommandQueueProperty clSetCommandQueueProperty;
+  cl_api_clCreateBuffer clCreateBuffer;
+  cl_api_clCreateImage2D clCreateImage2D;
+  cl_api_clCreateImage3D clCreateImage3D;
+  cl_api_clRetainMemObject clRetainMemObject;
+  cl_api_clReleaseMemObject clReleaseMemObject;
+  cl_api_clGetSupportedImageFormats clGetSupportedImageFormats;
+  cl_api_clGetMemObjectInfo clGetMemObjectInfo;
+  cl_api_clGetImageInfo clGetImageInfo;
+  cl_api_clCreateSampler clCreateSampler;
+  cl_api_clRetainSampler clRetainSampler;
+  cl_api_clReleaseSampler clReleaseSampler;
+  cl_api_clGetSamplerInfo clGetSamplerInfo;
+  cl_api_clCreateProgramWithSource clCreateProgramWithSource;
+  cl_api_clCreateProgramWithBinary clCreateProgramWithBinary;
+  cl_api_clRetainProgram clRetainProgram;
+  cl_api_clReleaseProgram clReleaseProgram;
+  cl_api_clBuildProgram clBuildProgram;
+  cl_api_clUnloadCompiler clUnloadCompiler;
+  cl_api_clGetProgramInfo clGetProgramInfo;
+  cl_api_clGetProgramBuildInfo clGetProgramBuildInfo;
+  cl_api_clCreateKernel clCreateKernel;
+  cl_api_clCreateKernelsInProgram clCreateKernelsInProgram;
+  cl_api_clRetainKernel clRetainKernel;
+  cl_api_clReleaseKernel clReleaseKernel;
+  cl_api_clSetKernelArg clSetKernelArg;
+  cl_api_clGetKernelInfo clGetKernelInfo;
+  cl_api_clGetKernelWorkGroupInfo clGetKernelWorkGroupInfo;
+  cl_api_clWaitForEvents clWaitForEvents;
+  cl_api_clGetEventInfo clGetEventInfo;
+  cl_api_clRetainEvent clRetainEvent;
+  cl_api_clReleaseEvent clReleaseEvent;
+  cl_api_clGetEventProfilingInfo clGetEventProfilingInfo;
+  cl_api_clFlush clFlush;
+  cl_api_clFinish clFinish;
+  cl_api_clEnqueueReadBuffer clEnqueueReadBuffer;
+  cl_api_clEnqueueWriteBuffer clEnqueueWriteBuffer;
+  cl_api_clEnqueueCopyBuffer clEnqueueCopyBuffer;
+  cl_api_clEnqueueReadImage clEnqueueReadImage;
+  cl_api_clEnqueueWriteImage clEnqueueWriteImage;
+  cl_api_clEnqueueCopyImage clEnqueueCopyImage;
+  cl_api_clEnqueueCopyImageToBuffer clEnqueueCopyImageToBuffer;
+  cl_api_clEnqueueCopyBufferToImage clEnqueueCopyBufferToImage;
+  cl_api_clEnqueueMapBuffer clEnqueueMapBuffer;
+  cl_api_clEnqueueMapImage clEnqueueMapImage;
+  cl_api_clEnqueueUnmapMemObject clEnqueueUnmapMemObject;
+  cl_api_clEnqueueNDRangeKernel clEnqueueNDRangeKernel;
+  cl_api_clEnqueueTask clEnqueueTask;
+  cl_api_clEnqueueNativeKernel clEnqueueNativeKernel;
+  cl_api_clEnqueueMarker clEnqueueMarker;
+  cl_api_clEnqueueWaitForEvents clEnqueueWaitForEvents;
+  cl_api_clEnqueueBarrier clEnqueueBarrier;
+  cl_api_clGetExtensionFunctionAddress clGetExtensionFunctionAddress;
+  cl_api_clCreateFromGLBuffer clCreateFromGLBuffer;
+  cl_api_clCreateFromGLTexture2D clCreateFromGLTexture2D;
+  cl_api_clCreateFromGLTexture3D clCreateFromGLTexture3D;
+  cl_api_clCreateFromGLRenderbuffer clCreateFromGLRenderbuffer;
+  cl_api_clGetGLObjectInfo clGetGLObjectInfo;
+  cl_api_clGetGLTextureInfo clGetGLTextureInfo;
+  cl_api_clEnqueueAcquireGLObjects clEnqueueAcquireGLObjects;
+  cl_api_clEnqueueReleaseGLObjects clEnqueueReleaseGLObjects;
+  cl_api_clGetGLContextInfoKHR clGetGLContextInfoKHR;
+
+  /* cl_khr_d3d10_sharing */
+  cl_api_clGetDeviceIDsFromD3D10KHR clGetDeviceIDsFromD3D10KHR;
+  cl_api_clCreateFromD3D10BufferKHR clCreateFromD3D10BufferKHR;
+  cl_api_clCreateFromD3D10Texture2DKHR clCreateFromD3D10Texture2DKHR;
+  cl_api_clCreateFromD3D10Texture3DKHR clCreateFromD3D10Texture3DKHR;
+  cl_api_clEnqueueAcquireD3D10ObjectsKHR clEnqueueAcquireD3D10ObjectsKHR;
+  cl_api_clEnqueueReleaseD3D10ObjectsKHR clEnqueueReleaseD3D10ObjectsKHR;
+
+  /* OpenCL 1.1 */
+  cl_api_clSetEventCallback clSetEventCallback;
+  cl_api_clCreateSubBuffer clCreateSubBuffer;
+  cl_api_clSetMemObjectDestructorCallback clSetMemObjectDestructorCallback;
+  cl_api_clCreateUserEvent clCreateUserEvent;
+  cl_api_clSetUserEventStatus clSetUserEventStatus;
+  cl_api_clEnqueueReadBufferRect clEnqueueReadBufferRect;
+  cl_api_clEnqueueWriteBufferRect clEnqueueWriteBufferRect;
+  cl_api_clEnqueueCopyBufferRect clEnqueueCopyBufferRect;
+
+  /* cl_ext_device_fission */
+  cl_api_clCreateSubDevicesEXT clCreateSubDevicesEXT;
+  cl_api_clRetainDeviceEXT clRetainDeviceEXT;
+  cl_api_clReleaseDeviceEXT clReleaseDeviceEXT;
+
+  /* cl_khr_gl_event */
+  cl_api_clCreateEventFromGLsyncKHR clCreateEventFromGLsyncKHR;
+
+  /* OpenCL 1.2 */
+  cl_api_clCreateSubDevices clCreateSubDevices;
+  cl_api_clRetainDevice clRetainDevice;
+  cl_api_clReleaseDevice clReleaseDevice;
+  cl_api_clCreateImage clCreateImage;
+  cl_api_clCreateProgramWithBuiltInKernels clCreateProgramWithBuiltInKernels;
+  cl_api_clCompileProgram clCompileProgram;
+  cl_api_clLinkProgram clLinkProgram;
+  cl_api_clUnloadPlatformCompiler clUnloadPlatformCompiler;
+  cl_api_clGetKernelArgInfo clGetKernelArgInfo;
+  cl_api_clEnqueueFillBuffer clEnqueueFillBuffer;
+  cl_api_clEnqueueFillImage clEnqueueFillImage;
+  cl_api_clEnqueueMigrateMemObjects clEnqueueMigrateMemObjects;
+  cl_api_clEnqueueMarkerWithWaitList clEnqueueMarkerWithWaitList;
+  cl_api_clEnqueueBarrierWithWaitList clEnqueueBarrierWithWaitList;
+  cl_api_clGetExtensionFunctionAddressForPlatform
+      clGetExtensionFunctionAddressForPlatform;
+  cl_api_clCreateFromGLTexture clCreateFromGLTexture;
+
+  /* cl_khr_d3d11_sharing */
+  cl_api_clGetDeviceIDsFromD3D11KHR clGetDeviceIDsFromD3D11KHR;
+  cl_api_clCreateFromD3D11BufferKHR clCreateFromD3D11BufferKHR;
+  cl_api_clCreateFromD3D11Texture2DKHR clCreateFromD3D11Texture2DKHR;
+  cl_api_clCreateFromD3D11Texture3DKHR clCreateFromD3D11Texture3DKHR;
+  cl_api_clCreateFromDX9MediaSurfaceKHR clCreateFromDX9MediaSurfaceKHR;
+  cl_api_clEnqueueAcquireD3D11ObjectsKHR clEnqueueAcquireD3D11ObjectsKHR;
+  cl_api_clEnqueueReleaseD3D11ObjectsKHR clEnqueueReleaseD3D11ObjectsKHR;
+
+  /* cl_khr_dx9_media_sharing */
+  cl_api_clGetDeviceIDsFromDX9MediaAdapterKHR
+      clGetDeviceIDsFromDX9MediaAdapterKHR;
+  cl_api_clEnqueueAcquireDX9MediaSurfacesKHR
+      clEnqueueAcquireDX9MediaSurfacesKHR;
+  cl_api_clEnqueueReleaseDX9MediaSurfacesKHR
+      clEnqueueReleaseDX9MediaSurfacesKHR;
+
+  /* cl_khr_egl_image */
+  cl_api_clCreateFromEGLImageKHR clCreateFromEGLImageKHR;
+  cl_api_clEnqueueAcquireEGLObjectsKHR clEnqueueAcquireEGLObjectsKHR;
+  cl_api_clEnqueueReleaseEGLObjectsKHR clEnqueueReleaseEGLObjectsKHR;
+
+  /* cl_khr_egl_event */
+  cl_api_clCreateEventFromEGLSyncKHR clCreateEventFromEGLSyncKHR;
+
+  /* OpenCL 2.0 */
+  cl_api_clCreateCommandQueueWithProperties clCreateCommandQueueWithProperties;
+  cl_api_clCreatePipe clCreatePipe;
+  cl_api_clGetPipeInfo clGetPipeInfo;
+  cl_api_clSVMAlloc clSVMAlloc;
+  cl_api_clSVMFree clSVMFree;
+  cl_api_clEnqueueSVMFree clEnqueueSVMFree;
+  cl_api_clEnqueueSVMMemcpy clEnqueueSVMMemcpy;
+  cl_api_clEnqueueSVMMemFill clEnqueueSVMMemFill;
+  cl_api_clEnqueueSVMMap clEnqueueSVMMap;
+  cl_api_clEnqueueSVMUnmap clEnqueueSVMUnmap;
+  cl_api_clCreateSamplerWithProperties clCreateSamplerWithProperties;
+  cl_api_clSetKernelArgSVMPointer clSetKernelArgSVMPointer;
+  cl_api_clSetKernelExecInfo clSetKernelExecInfo;
+
+  /* cl_khr_sub_groups */
+  cl_api_clGetKernelSubGroupInfoKHR clGetKernelSubGroupInfoKHR;
+
+  /* OpenCL 2.1 */
+  cl_api_clCloneKernel clCloneKernel;
+  cl_api_clCreateProgramWithIL clCreateProgramWithIL;
+  cl_api_clEnqueueSVMMigrateMem clEnqueueSVMMigrateMem;
+  cl_api_clGetDeviceAndHostTimer clGetDeviceAndHostTimer;
+  cl_api_clGetHostTimer clGetHostTimer;
+  cl_api_clGetKernelSubGroupInfo clGetKernelSubGroupInfo;
+  cl_api_clSetDefaultDeviceCommandQueue clSetDefaultDeviceCommandQueue;
+
+  /* OpenCL 2.2 */
+  cl_api_clSetProgramReleaseCallback clSetProgramReleaseCallback;
+  cl_api_clSetProgramSpecializationConstant clSetProgramSpecializationConstant;
+
+  /* OpenCL 3.0 */
+  cl_api_clCreateBufferWithProperties clCreateBufferWithProperties;
+  cl_api_clCreateImageWithProperties clCreateImageWithProperties;
+  cl_api_clSetContextDestructorCallback clSetContextDestructorCallback;
+
+} cl_icd_dispatch;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* #ifndef OPENCL_CL_ICD_H */
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_platform.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_platform.h
new file mode 100644
index 000000000..2d69cc4e5
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_platform.h
@@ -0,0 +1,1384 @@
+/*******************************************************************************
+ * Copyright (c) 2008-2020 The Khronos Group Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ ******************************************************************************/
+
+#ifndef __CL_PLATFORM_H
+#define __CL_PLATFORM_H
+
+#include <CL/cl_version.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#if defined(_WIN32)
+    #define CL_API_ENTRY
+    #define CL_API_CALL     __stdcall
+    #define CL_CALLBACK     __stdcall
+#else
+    #define CL_API_ENTRY
+    #define CL_API_CALL
+    #define CL_CALLBACK
+#endif
+
+/*
+ * Deprecation flags refer to the last version of the header in which the
+ * feature was not deprecated.
+ *
+ * E.g. VERSION_1_1_DEPRECATED means the feature is present in 1.1 without
+ * deprecation but is deprecated in versions later than 1.1.
+ */
+
+#define CL_EXTENSION_WEAK_LINK
+#define CL_API_SUFFIX__VERSION_1_0
+#define CL_EXT_SUFFIX__VERSION_1_0
+#define CL_API_SUFFIX__VERSION_1_1
+#define CL_EXT_SUFFIX__VERSION_1_1
+#define CL_API_SUFFIX__VERSION_1_2
+#define CL_EXT_SUFFIX__VERSION_1_2
+#define CL_API_SUFFIX__VERSION_2_0
+#define CL_EXT_SUFFIX__VERSION_2_0
+#define CL_API_SUFFIX__VERSION_2_1
+#define CL_EXT_SUFFIX__VERSION_2_1
+#define CL_API_SUFFIX__VERSION_2_2
+#define CL_EXT_SUFFIX__VERSION_2_2
+#define CL_API_SUFFIX__VERSION_3_0
+#define CL_EXT_SUFFIX__VERSION_3_0
+#define CL_API_SUFFIX__EXPERIMENTAL
+#define CL_EXT_SUFFIX__EXPERIMENTAL
+
+
+#ifdef __GNUC__
+  #define CL_EXT_SUFFIX_DEPRECATED __attribute__((deprecated))
+  #define CL_EXT_PREFIX_DEPRECATED
+#elif defined(_WIN32)
+  #define CL_EXT_SUFFIX_DEPRECATED
+  #define CL_EXT_PREFIX_DEPRECATED __declspec(deprecated)
+#else
+  #define CL_EXT_SUFFIX_DEPRECATED
+  #define CL_EXT_PREFIX_DEPRECATED
+#endif
+
+#ifdef CL_USE_DEPRECATED_OPENCL_1_0_APIS
+    #define CL_EXT_SUFFIX__VERSION_1_0_DEPRECATED
+    #define CL_EXT_PREFIX__VERSION_1_0_DEPRECATED
+#else
+    #define CL_EXT_SUFFIX__VERSION_1_0_DEPRECATED CL_EXT_SUFFIX_DEPRECATED
+    #define CL_EXT_PREFIX__VERSION_1_0_DEPRECATED CL_EXT_PREFIX_DEPRECATED
+#endif
+
+#ifdef CL_USE_DEPRECATED_OPENCL_1_1_APIS
+    #define CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED
+    #define CL_EXT_PREFIX__VERSION_1_1_DEPRECATED
+#else
+    #define CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED CL_EXT_SUFFIX_DEPRECATED
+    #define CL_EXT_PREFIX__VERSION_1_1_DEPRECATED CL_EXT_PREFIX_DEPRECATED
+#endif
+
+#ifdef CL_USE_DEPRECATED_OPENCL_1_2_APIS
+    #define CL_EXT_SUFFIX__VERSION_1_2_DEPRECATED
+    #define CL_EXT_PREFIX__VERSION_1_2_DEPRECATED
+#else
+    #define CL_EXT_SUFFIX__VERSION_1_2_DEPRECATED CL_EXT_SUFFIX_DEPRECATED
+    #define CL_EXT_PREFIX__VERSION_1_2_DEPRECATED CL_EXT_PREFIX_DEPRECATED
+ #endif
+
+#ifdef CL_USE_DEPRECATED_OPENCL_2_0_APIS
+    #define CL_EXT_SUFFIX__VERSION_2_0_DEPRECATED
+    #define CL_EXT_PREFIX__VERSION_2_0_DEPRECATED
+#else
+    #define CL_EXT_SUFFIX__VERSION_2_0_DEPRECATED CL_EXT_SUFFIX_DEPRECATED
+    #define CL_EXT_PREFIX__VERSION_2_0_DEPRECATED CL_EXT_PREFIX_DEPRECATED
+#endif
+
+#ifdef CL_USE_DEPRECATED_OPENCL_2_1_APIS
+    #define CL_EXT_SUFFIX__VERSION_2_1_DEPRECATED
+    #define CL_EXT_PREFIX__VERSION_2_1_DEPRECATED
+#else
+    #define CL_EXT_SUFFIX__VERSION_2_1_DEPRECATED CL_EXT_SUFFIX_DEPRECATED
+    #define CL_EXT_PREFIX__VERSION_2_1_DEPRECATED CL_EXT_PREFIX_DEPRECATED
+#endif
+
+#ifdef CL_USE_DEPRECATED_OPENCL_2_2_APIS
+    #define CL_EXT_SUFFIX__VERSION_2_2_DEPRECATED
+    #define CL_EXT_PREFIX__VERSION_2_2_DEPRECATED
+#else
+    #define CL_EXT_SUFFIX__VERSION_2_2_DEPRECATED CL_EXT_SUFFIX_DEPRECATED
+    #define CL_EXT_PREFIX__VERSION_2_2_DEPRECATED CL_EXT_PREFIX_DEPRECATED
+#endif
+
+#if (defined (_WIN32) && defined(_MSC_VER))
+
+/* scalar types  */
+typedef signed   __int8         cl_char;
+typedef unsigned __int8         cl_uchar;
+typedef signed   __int16        cl_short;
+typedef unsigned __int16        cl_ushort;
+typedef signed   __int32        cl_int;
+typedef unsigned __int32        cl_uint;
+typedef signed   __int64        cl_long;
+typedef unsigned __int64        cl_ulong;
+
+typedef unsigned __int16        cl_half;
+typedef float                   cl_float;
+typedef double                  cl_double;
+
+/* Macro names and corresponding values defined by OpenCL */
+#define CL_CHAR_BIT         8
+#define CL_SCHAR_MAX        127
+#define CL_SCHAR_MIN        (-127-1)
+#define CL_CHAR_MAX         CL_SCHAR_MAX
+#define CL_CHAR_MIN         CL_SCHAR_MIN
+#define CL_UCHAR_MAX        255
+#define CL_SHRT_MAX         32767
+#define CL_SHRT_MIN         (-32767-1)
+#define CL_USHRT_MAX        65535
+#define CL_INT_MAX          2147483647
+#define CL_INT_MIN          (-2147483647-1)
+#define CL_UINT_MAX         0xffffffffU
+#define CL_LONG_MAX         ((cl_long) 0x7FFFFFFFFFFFFFFFLL)
+#define CL_LONG_MIN         ((cl_long) -0x7FFFFFFFFFFFFFFFLL - 1LL)
+#define CL_ULONG_MAX        ((cl_ulong) 0xFFFFFFFFFFFFFFFFULL)
+
+#define CL_FLT_DIG          6
+#define CL_FLT_MANT_DIG     24
+#define CL_FLT_MAX_10_EXP   +38
+#define CL_FLT_MAX_EXP      +128
+#define CL_FLT_MIN_10_EXP   -37
+#define CL_FLT_MIN_EXP      -125
+#define CL_FLT_RADIX        2
+#define CL_FLT_MAX          340282346638528859811704183484516925440.0f
+#define CL_FLT_MIN          1.175494350822287507969e-38f
+#define CL_FLT_EPSILON      1.1920928955078125e-7f
+
+#define CL_HALF_DIG          3
+#define CL_HALF_MANT_DIG     11
+#define CL_HALF_MAX_10_EXP   +4
+#define CL_HALF_MAX_EXP      +16
+#define CL_HALF_MIN_10_EXP   -4
+#define CL_HALF_MIN_EXP      -13
+#define CL_HALF_RADIX        2
+#define CL_HALF_MAX          65504.0f
+#define CL_HALF_MIN          6.103515625e-05f
+#define CL_HALF_EPSILON      9.765625e-04f
+
+#define CL_DBL_DIG          15
+#define CL_DBL_MANT_DIG     53
+#define CL_DBL_MAX_10_EXP   +308
+#define CL_DBL_MAX_EXP      +1024
+#define CL_DBL_MIN_10_EXP   -307
+#define CL_DBL_MIN_EXP      -1021
+#define CL_DBL_RADIX        2
+#define CL_DBL_MAX          1.7976931348623158e+308
+#define CL_DBL_MIN          2.225073858507201383090e-308
+#define CL_DBL_EPSILON      2.220446049250313080847e-16
+
+#define CL_M_E              2.7182818284590452354
+#define CL_M_LOG2E          1.4426950408889634074
+#define CL_M_LOG10E         0.43429448190325182765
+#define CL_M_LN2            0.69314718055994530942
+#define CL_M_LN10           2.30258509299404568402
+#define CL_M_PI             3.14159265358979323846
+#define CL_M_PI_2           1.57079632679489661923
+#define CL_M_PI_4           0.78539816339744830962
+#define CL_M_1_PI           0.31830988618379067154
+#define CL_M_2_PI           0.63661977236758134308
+#define CL_M_2_SQRTPI       1.12837916709551257390
+#define CL_M_SQRT2          1.41421356237309504880
+#define CL_M_SQRT1_2        0.70710678118654752440
+
+#define CL_M_E_F            2.718281828f
+#define CL_M_LOG2E_F        1.442695041f
+#define CL_M_LOG10E_F       0.434294482f
+#define CL_M_LN2_F          0.693147181f
+#define CL_M_LN10_F         2.302585093f
+#define CL_M_PI_F           3.141592654f
+#define CL_M_PI_2_F         1.570796327f
+#define CL_M_PI_4_F         0.785398163f
+#define CL_M_1_PI_F         0.318309886f
+#define CL_M_2_PI_F         0.636619772f
+#define CL_M_2_SQRTPI_F     1.128379167f
+#define CL_M_SQRT2_F        1.414213562f
+#define CL_M_SQRT1_2_F      0.707106781f
+
+#define CL_NAN              (CL_INFINITY - CL_INFINITY)
+#define CL_HUGE_VALF        ((cl_float) 1e50)
+#define CL_HUGE_VAL         ((cl_double) 1e500)
+#define CL_MAXFLOAT         CL_FLT_MAX
+#define CL_INFINITY         CL_HUGE_VALF
+
+#else
+
+#include <stdint.h>
+
+/* scalar types  */
+typedef int8_t          cl_char;
+typedef uint8_t         cl_uchar;
+typedef int16_t         cl_short;
+typedef uint16_t        cl_ushort;
+typedef int32_t         cl_int;
+typedef uint32_t        cl_uint;
+typedef int64_t         cl_long;
+typedef uint64_t        cl_ulong;
+
+typedef uint16_t        cl_half;
+typedef float           cl_float;
+typedef double          cl_double;
+
+/* Macro names and corresponding values defined by OpenCL */
+#define CL_CHAR_BIT         8
+#define CL_SCHAR_MAX        127
+#define CL_SCHAR_MIN        (-127-1)
+#define CL_CHAR_MAX         CL_SCHAR_MAX
+#define CL_CHAR_MIN         CL_SCHAR_MIN
+#define CL_UCHAR_MAX        255
+#define CL_SHRT_MAX         32767
+#define CL_SHRT_MIN         (-32767-1)
+#define CL_USHRT_MAX        65535
+#define CL_INT_MAX          2147483647
+#define CL_INT_MIN          (-2147483647-1)
+#define CL_UINT_MAX         0xffffffffU
+#define CL_LONG_MAX         ((cl_long) 0x7FFFFFFFFFFFFFFFLL)
+#define CL_LONG_MIN         ((cl_long) -0x7FFFFFFFFFFFFFFFLL - 1LL)
+#define CL_ULONG_MAX        ((cl_ulong) 0xFFFFFFFFFFFFFFFFULL)
+
+#define CL_FLT_DIG          6
+#define CL_FLT_MANT_DIG     24
+#define CL_FLT_MAX_10_EXP   +38
+#define CL_FLT_MAX_EXP      +128
+#define CL_FLT_MIN_10_EXP   -37
+#define CL_FLT_MIN_EXP      -125
+#define CL_FLT_RADIX        2
+#define CL_FLT_MAX          340282346638528859811704183484516925440.0f
+#define CL_FLT_MIN          1.175494350822287507969e-38f
+#define CL_FLT_EPSILON      1.1920928955078125e-7f
+
+#define CL_HALF_DIG          3
+#define CL_HALF_MANT_DIG     11
+#define CL_HALF_MAX_10_EXP   +4
+#define CL_HALF_MAX_EXP      +16
+#define CL_HALF_MIN_10_EXP   -4
+#define CL_HALF_MIN_EXP      -13
+#define CL_HALF_RADIX        2
+#define CL_HALF_MAX          65504.0f
+#define CL_HALF_MIN          6.103515625e-05f
+#define CL_HALF_EPSILON      9.765625e-04f
+
+#define CL_DBL_DIG          15
+#define CL_DBL_MANT_DIG     53
+#define CL_DBL_MAX_10_EXP   +308
+#define CL_DBL_MAX_EXP      +1024
+#define CL_DBL_MIN_10_EXP   -307
+#define CL_DBL_MIN_EXP      -1021
+#define CL_DBL_RADIX        2
+#define CL_DBL_MAX          179769313486231570814527423731704356798070567525844996598917476803157260780028538760589558632766878171540458953514382464234321326889464182768467546703537516986049910576551282076245490090389328944075868508455133942304583236903222948165808559332123348274797826204144723168738177180919299881250404026184124858368.0
+#define CL_DBL_MIN          2.225073858507201383090e-308
+#define CL_DBL_EPSILON      2.220446049250313080847e-16
+
+#define CL_M_E              2.7182818284590452354
+#define CL_M_LOG2E          1.4426950408889634074
+#define CL_M_LOG10E         0.43429448190325182765
+#define CL_M_LN2            0.69314718055994530942
+#define CL_M_LN10           2.30258509299404568402
+#define CL_M_PI             3.14159265358979323846
+#define CL_M_PI_2           1.57079632679489661923
+#define CL_M_PI_4           0.78539816339744830962
+#define CL_M_1_PI           0.31830988618379067154
+#define CL_M_2_PI           0.63661977236758134308
+#define CL_M_2_SQRTPI       1.12837916709551257390
+#define CL_M_SQRT2          1.41421356237309504880
+#define CL_M_SQRT1_2        0.70710678118654752440
+
+#define CL_M_E_F            2.718281828f
+#define CL_M_LOG2E_F        1.442695041f
+#define CL_M_LOG10E_F       0.434294482f
+#define CL_M_LN2_F          0.693147181f
+#define CL_M_LN10_F         2.302585093f
+#define CL_M_PI_F           3.141592654f
+#define CL_M_PI_2_F         1.570796327f
+#define CL_M_PI_4_F         0.785398163f
+#define CL_M_1_PI_F         0.318309886f
+#define CL_M_2_PI_F         0.636619772f
+#define CL_M_2_SQRTPI_F     1.128379167f
+#define CL_M_SQRT2_F        1.414213562f
+#define CL_M_SQRT1_2_F      0.707106781f
+
+#if defined( __GNUC__ )
+   #define CL_HUGE_VALF     __builtin_huge_valf()
+   #define CL_HUGE_VAL      __builtin_huge_val()
+   #define CL_NAN           __builtin_nanf( "" )
+#else
+   #define CL_HUGE_VALF     ((cl_float) 1e50)
+   #define CL_HUGE_VAL      ((cl_double) 1e500)
+   float nanf( const char * );
+   #define CL_NAN           nanf( "" )
+#endif
+#define CL_MAXFLOAT         CL_FLT_MAX
+#define CL_INFINITY         CL_HUGE_VALF
+
+#endif
+
+#include <stddef.h>
+
+/* Mirror types to GL types. Mirror types allow us to avoid deciding which 87s to load based on whether we are using GL or GLES here. */
+typedef unsigned int cl_GLuint;
+typedef int          cl_GLint;
+typedef unsigned int cl_GLenum;
+
+/*
+ * Vector types
+ *
+ *  Note:   OpenCL requires that all types be naturally aligned.
+ *          This means that vector types must be naturally aligned.
+ *          For example, a vector of four floats must be aligned to
+ *          a 16 byte boundary (calculated as 4 * the natural 4-byte
+ *          alignment of the float).  The alignment qualifiers here
+ *          will only function properly if your compiler supports them
+ *          and if you don't actively work to defeat them.  For example,
+ *          in order for a cl_float4 to be 16 byte aligned in a struct,
+ *          the start of the struct must itself be 16-byte aligned.
+ *
+ *          Maintaining proper alignment is the user's responsibility.
+ */
+
+/* Define basic vector types */
+#if defined( __VEC__ )
+  #if !defined(__clang__)
+     #include <altivec.h>   /* may be omitted depending on compiler. AltiVec spec provides no way to detect whether the header is required. */
+  #endif
+   typedef __vector unsigned char     __cl_uchar16;
+   typedef __vector signed char       __cl_char16;
+   typedef __vector unsigned short    __cl_ushort8;
+   typedef __vector signed short      __cl_short8;
+   typedef __vector unsigned int      __cl_uint4;
+   typedef __vector signed int        __cl_int4;
+   typedef __vector float             __cl_float4;
+   #define  __CL_UCHAR16__  1
+   #define  __CL_CHAR16__   1
+   #define  __CL_USHORT8__  1
+   #define  __CL_SHORT8__   1
+   #define  __CL_UINT4__    1
+   #define  __CL_INT4__     1
+   #define  __CL_FLOAT4__   1
+#endif
+
+#if defined( __SSE__ )
+    #if defined( __MINGW64__ )
+        #include <intrin.h>
+    #else
+        #include <xmmintrin.h>
+    #endif
+    #if defined( __GNUC__ )
+        typedef float __cl_float4   __attribute__((vector_size(16)));
+    #else
+        typedef __m128 __cl_float4;
+    #endif
+    #define __CL_FLOAT4__   1
+#endif
+
+#if defined( __SSE2__ )
+    #if defined( __MINGW64__ )
+        #include <intrin.h>
+    #else
+        #include <emmintrin.h>
+    #endif
+    #if defined( __GNUC__ )
+        typedef cl_uchar    __cl_uchar16    __attribute__((vector_size(16)));
+        typedef cl_char     __cl_char16     __attribute__((vector_size(16)));
+        typedef cl_ushort   __cl_ushort8    __attribute__((vector_size(16)));
+        typedef cl_short    __cl_short8     __attribute__((vector_size(16)));
+        typedef cl_uint     __cl_uint4      __attribute__((vector_size(16)));
+        typedef cl_int      __cl_int4       __attribute__((vector_size(16)));
+        typedef cl_ulong    __cl_ulong2     __attribute__((vector_size(16)));
+        typedef cl_long     __cl_long2      __attribute__((vector_size(16)));
+        typedef cl_double   __cl_double2    __attribute__((vector_size(16)));
+    #else
+        typedef __m128i __cl_uchar16;
+        typedef __m128i __cl_char16;
+        typedef __m128i __cl_ushort8;
+        typedef __m128i __cl_short8;
+        typedef __m128i __cl_uint4;
+        typedef __m128i __cl_int4;
+        typedef __m128i __cl_ulong2;
+        typedef __m128i __cl_long2;
+        typedef __m128d __cl_double2;
+    #endif
+    #define __CL_UCHAR16__  1
+    #define __CL_CHAR16__   1
+    #define __CL_USHORT8__  1
+    #define __CL_SHORT8__   1
+    #define __CL_INT4__     1
+    #define __CL_UINT4__    1
+    #define __CL_ULONG2__   1
+    #define __CL_LONG2__    1
+    #define __CL_DOUBLE2__  1
+#endif
+
+#if defined( __MMX__ )
+    #include <mmintrin.h>
+    #if defined( __GNUC__ )
+        typedef cl_uchar    __cl_uchar8     __attribute__((vector_size(8)));
+        typedef cl_char     __cl_char8      __attribute__((vector_size(8)));
+        typedef cl_ushort   __cl_ushort4    __attribute__((vector_size(8)));
+        typedef cl_short    __cl_short4     __attribute__((vector_size(8)));
+        typedef cl_uint     __cl_uint2      __attribute__((vector_size(8)));
+        typedef cl_int      __cl_int2       __attribute__((vector_size(8)));
+        typedef cl_ulong    __cl_ulong1     __attribute__((vector_size(8)));
+        typedef cl_long     __cl_long1      __attribute__((vector_size(8)));
+        typedef cl_float    __cl_float2     __attribute__((vector_size(8)));
+    #else
+        typedef __m64       __cl_uchar8;
+        typedef __m64       __cl_char8;
+        typedef __m64       __cl_ushort4;
+        typedef __m64       __cl_short4;
+        typedef __m64       __cl_uint2;
+        typedef __m64       __cl_int2;
+        typedef __m64       __cl_ulong1;
+        typedef __m64       __cl_long1;
+        typedef __m64       __cl_float2;
+    #endif
+    #define __CL_UCHAR8__   1
+    #define __CL_CHAR8__    1
+    #define __CL_USHORT4__  1
+    #define __CL_SHORT4__   1
+    #define __CL_INT2__     1
+    #define __CL_UINT2__    1
+    #define __CL_ULONG1__   1
+    #define __CL_LONG1__    1
+    #define __CL_FLOAT2__   1
+#endif
+
+#if defined( __AVX__ )
+    #if defined( __MINGW64__ )
+        #include <intrin.h>
+    #else
+        #include <immintrin.h>
+    #endif
+    #if defined( __GNUC__ )
+        typedef cl_float    __cl_float8     __attribute__((vector_size(32)));
+        typedef cl_double   __cl_double4    __attribute__((vector_size(32)));
+    #else
+        typedef __m256      __cl_float8;
+        typedef __m256d     __cl_double4;
+    #endif
+    #define __CL_FLOAT8__   1
+    #define __CL_DOUBLE4__  1
+#endif
+
+/* Define capabilities for anonymous struct members. */
+#if !defined(__cplusplus) && defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L
+#define  __CL_HAS_ANON_STRUCT__ 1
+#define  __CL_ANON_STRUCT__
+#elif defined( __GNUC__) && ! defined( __STRICT_ANSI__ )
+#define  __CL_HAS_ANON_STRUCT__ 1
+#define  __CL_ANON_STRUCT__ __extension__
+#elif defined( _WIN32) && defined(_MSC_VER) && ! defined(__STDC__)
+    #if _MSC_VER >= 1500
+   /* Microsoft Developer Studio 2008 supports anonymous structs, but
+    * complains by default. */
+    #define  __CL_HAS_ANON_STRUCT__ 1
+    #define  __CL_ANON_STRUCT__
+   /* Disable warning C4201: nonstandard extension used : nameless
+    * struct/union */
+    #pragma warning( push )
+    #pragma warning( disable : 4201 )
+    #endif
+#else
+#define  __CL_HAS_ANON_STRUCT__ 0
+#define  __CL_ANON_STRUCT__
+#endif
+
+/* Define alignment keys */
+#if defined( __GNUC__ ) || defined(__INTEGRITY)
+    #define CL_ALIGNED(_x)          __attribute__ ((aligned(_x)))
+#elif defined( _WIN32) && (_MSC_VER)
+    /* Alignment keys neutered on windows because MSVC can't swallow function arguments with alignment requirements     */
+    /* http://msdn.microsoft.com/en-us/library/373ak2y1%28VS.71%29.aspx                                                 */
+    /* #include <crtdefs.h>                                                                                             */
+    /* #define CL_ALIGNED(_x)          _CRT_ALIGN(_x)                                                                   */
+    #define CL_ALIGNED(_x)
+#else
+   #warning  Need to implement some method to align data here
+   #define  CL_ALIGNED(_x)
+#endif
+
+/* Indicate whether .xyzw, .s0123 and .hi.lo are supported */
+#if __CL_HAS_ANON_STRUCT__
+    /* .xyzw and .s0123...{f|F} are supported */
+    #define CL_HAS_NAMED_VECTOR_FIELDS 1
+    /* .hi and .lo are supported */
+    #define CL_HAS_HI_LO_VECTOR_FIELDS 1
+#endif
+
+/* Define cl_vector types */
+
+/* ---- cl_charn ---- */
+typedef union
+{
+    cl_char  CL_ALIGNED(2) s[2];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_char  x, y; };
+   __CL_ANON_STRUCT__ struct{ cl_char  s0, s1; };
+   __CL_ANON_STRUCT__ struct{ cl_char  lo, hi; };
+#endif
+#if defined( __CL_CHAR2__)
+    __cl_char2     v2;
+#endif
+}cl_char2;
+
+typedef union
+{
+    cl_char  CL_ALIGNED(4) s[4];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_char  x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_char  s0, s1, s2, s3; };
+   __CL_ANON_STRUCT__ struct{ cl_char2 lo, hi; };
+#endif
+#if defined( __CL_CHAR2__)
+    __cl_char2     v2[2];
+#endif
+#if defined( __CL_CHAR4__)
+    __cl_char4     v4;
+#endif
+}cl_char4;
+
+/* cl_char3 is identical in size, alignment and behavior to cl_char4. See section 6.1.5. */
+typedef  cl_char4  cl_char3;
+
+typedef union
+{
+    cl_char   CL_ALIGNED(8) s[8];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_char  x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_char  s0, s1, s2, s3, s4, s5, s6, s7; };
+   __CL_ANON_STRUCT__ struct{ cl_char4 lo, hi; };
+#endif
+#if defined( __CL_CHAR2__)
+    __cl_char2     v2[4];
+#endif
+#if defined( __CL_CHAR4__)
+    __cl_char4     v4[2];
+#endif
+#if defined( __CL_CHAR8__ )
+    __cl_char8     v8;
+#endif
+}cl_char8;
+
+typedef union
+{
+    cl_char  CL_ALIGNED(16) s[16];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_char  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+   __CL_ANON_STRUCT__ struct{ cl_char  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+   __CL_ANON_STRUCT__ struct{ cl_char8 lo, hi; };
+#endif
+#if defined( __CL_CHAR2__)
+    __cl_char2     v2[8];
+#endif
+#if defined( __CL_CHAR4__)
+    __cl_char4     v4[4];
+#endif
+#if defined( __CL_CHAR8__ )
+    __cl_char8     v8[2];
+#endif
+#if defined( __CL_CHAR16__ )
+    __cl_char16    v16;
+#endif
+}cl_char16;
+
+
+/* ---- cl_ucharn ---- */
+typedef union
+{
+    cl_uchar  CL_ALIGNED(2) s[2];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_uchar  x, y; };
+   __CL_ANON_STRUCT__ struct{ cl_uchar  s0, s1; };
+   __CL_ANON_STRUCT__ struct{ cl_uchar  lo, hi; };
+#endif
+#if defined( __cl_uchar2__)
+    __cl_uchar2     v2;
+#endif
+}cl_uchar2;
+
+typedef union
+{
+    cl_uchar  CL_ALIGNED(4) s[4];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_uchar  x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_uchar  s0, s1, s2, s3; };
+   __CL_ANON_STRUCT__ struct{ cl_uchar2 lo, hi; };
+#endif
+#if defined( __CL_UCHAR2__)
+    __cl_uchar2     v2[2];
+#endif
+#if defined( __CL_UCHAR4__)
+    __cl_uchar4     v4;
+#endif
+}cl_uchar4;
+
+/* cl_uchar3 is identical in size, alignment and behavior to cl_uchar4. See section 6.1.5. */
+typedef  cl_uchar4  cl_uchar3;
+
+typedef union
+{
+    cl_uchar   CL_ALIGNED(8) s[8];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_uchar  x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_uchar  s0, s1, s2, s3, s4, s5, s6, s7; };
+   __CL_ANON_STRUCT__ struct{ cl_uchar4 lo, hi; };
+#endif
+#if defined( __CL_UCHAR2__)
+    __cl_uchar2     v2[4];
+#endif
+#if defined( __CL_UCHAR4__)
+    __cl_uchar4     v4[2];
+#endif
+#if defined( __CL_UCHAR8__ )
+    __cl_uchar8     v8;
+#endif
+}cl_uchar8;
+
+typedef union
+{
+    cl_uchar  CL_ALIGNED(16) s[16];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_uchar  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+   __CL_ANON_STRUCT__ struct{ cl_uchar  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+   __CL_ANON_STRUCT__ struct{ cl_uchar8 lo, hi; };
+#endif
+#if defined( __CL_UCHAR2__)
+    __cl_uchar2     v2[8];
+#endif
+#if defined( __CL_UCHAR4__)
+    __cl_uchar4     v4[4];
+#endif
+#if defined( __CL_UCHAR8__ )
+    __cl_uchar8     v8[2];
+#endif
+#if defined( __CL_UCHAR16__ )
+    __cl_uchar16    v16;
+#endif
+}cl_uchar16;
+
+
+/* ---- cl_shortn ---- */
+typedef union
+{
+    cl_short  CL_ALIGNED(4) s[2];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_short  x, y; };
+   __CL_ANON_STRUCT__ struct{ cl_short  s0, s1; };
+   __CL_ANON_STRUCT__ struct{ cl_short  lo, hi; };
+#endif
+#if defined( __CL_SHORT2__)
+    __cl_short2     v2;
+#endif
+}cl_short2;
+
+typedef union
+{
+    cl_short  CL_ALIGNED(8) s[4];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_short  x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_short  s0, s1, s2, s3; };
+   __CL_ANON_STRUCT__ struct{ cl_short2 lo, hi; };
+#endif
+#if defined( __CL_SHORT2__)
+    __cl_short2     v2[2];
+#endif
+#if defined( __CL_SHORT4__)
+    __cl_short4     v4;
+#endif
+}cl_short4;
+
+/* cl_short3 is identical in size, alignment and behavior to cl_short4. See section 6.1.5. */
+typedef  cl_short4  cl_short3;
+
+typedef union
+{
+    cl_short   CL_ALIGNED(16) s[8];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_short  x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_short  s0, s1, s2, s3, s4, s5, s6, s7; };
+   __CL_ANON_STRUCT__ struct{ cl_short4 lo, hi; };
+#endif
+#if defined( __CL_SHORT2__)
+    __cl_short2     v2[4];
+#endif
+#if defined( __CL_SHORT4__)
+    __cl_short4     v4[2];
+#endif
+#if defined( __CL_SHORT8__ )
+    __cl_short8     v8;
+#endif
+}cl_short8;
+
+typedef union
+{
+    cl_short  CL_ALIGNED(32) s[16];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_short  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+   __CL_ANON_STRUCT__ struct{ cl_short  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+   __CL_ANON_STRUCT__ struct{ cl_short8 lo, hi; };
+#endif
+#if defined( __CL_SHORT2__)
+    __cl_short2     v2[8];
+#endif
+#if defined( __CL_SHORT4__)
+    __cl_short4     v4[4];
+#endif
+#if defined( __CL_SHORT8__ )
+    __cl_short8     v8[2];
+#endif
+#if defined( __CL_SHORT16__ )
+    __cl_short16    v16;
+#endif
+}cl_short16;
+
+
+/* ---- cl_ushortn ---- */
+typedef union
+{
+    cl_ushort  CL_ALIGNED(4) s[2];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_ushort  x, y; };
+   __CL_ANON_STRUCT__ struct{ cl_ushort  s0, s1; };
+   __CL_ANON_STRUCT__ struct{ cl_ushort  lo, hi; };
+#endif
+#if defined( __CL_USHORT2__)
+    __cl_ushort2     v2;
+#endif
+}cl_ushort2;
+
+typedef union
+{
+    cl_ushort  CL_ALIGNED(8) s[4];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_ushort  x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_ushort  s0, s1, s2, s3; };
+   __CL_ANON_STRUCT__ struct{ cl_ushort2 lo, hi; };
+#endif
+#if defined( __CL_USHORT2__)
+    __cl_ushort2     v2[2];
+#endif
+#if defined( __CL_USHORT4__)
+    __cl_ushort4     v4;
+#endif
+}cl_ushort4;
+
+/* cl_ushort3 is identical in size, alignment and behavior to cl_ushort4. See section 6.1.5. */
+typedef  cl_ushort4  cl_ushort3;
+
+typedef union
+{
+    cl_ushort   CL_ALIGNED(16) s[8];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_ushort  x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_ushort  s0, s1, s2, s3, s4, s5, s6, s7; };
+   __CL_ANON_STRUCT__ struct{ cl_ushort4 lo, hi; };
+#endif
+#if defined( __CL_USHORT2__)
+    __cl_ushort2     v2[4];
+#endif
+#if defined( __CL_USHORT4__)
+    __cl_ushort4     v4[2];
+#endif
+#if defined( __CL_USHORT8__ )
+    __cl_ushort8     v8;
+#endif
+}cl_ushort8;
+
+typedef union
+{
+    cl_ushort  CL_ALIGNED(32) s[16];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_ushort  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+   __CL_ANON_STRUCT__ struct{ cl_ushort  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+   __CL_ANON_STRUCT__ struct{ cl_ushort8 lo, hi; };
+#endif
+#if defined( __CL_USHORT2__)
+    __cl_ushort2     v2[8];
+#endif
+#if defined( __CL_USHORT4__)
+    __cl_ushort4     v4[4];
+#endif
+#if defined( __CL_USHORT8__ )
+    __cl_ushort8     v8[2];
+#endif
+#if defined( __CL_USHORT16__ )
+    __cl_ushort16    v16;
+#endif
+}cl_ushort16;
+
+
+/* ---- cl_halfn ---- */
+typedef union
+{
+    cl_half  CL_ALIGNED(4) s[2];
+#if __CL_HAS_ANON_STRUCT__
+    __CL_ANON_STRUCT__ struct{ cl_half  x, y; };
+    __CL_ANON_STRUCT__ struct{ cl_half  s0, s1; };
+    __CL_ANON_STRUCT__ struct{ cl_half  lo, hi; };
+#endif
+#if defined( __CL_HALF2__)
+    __cl_half2     v2;
+#endif
+}cl_half2;
+
+typedef union
+{
+    cl_half  CL_ALIGNED(8) s[4];
+#if __CL_HAS_ANON_STRUCT__
+    __CL_ANON_STRUCT__ struct{ cl_half  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct{ cl_half  s0, s1, s2, s3; };
+    __CL_ANON_STRUCT__ struct{ cl_half2 lo, hi; };
+#endif
+#if defined( __CL_HALF2__)
+    __cl_half2     v2[2];
+#endif
+#if defined( __CL_HALF4__)
+    __cl_half4     v4;
+#endif
+}cl_half4;
+
+/* cl_half3 is identical in size, alignment and behavior to cl_half4. See section 6.1.5. */
+typedef  cl_half4  cl_half3;
+
+typedef union
+{
+    cl_half   CL_ALIGNED(16) s[8];
+#if __CL_HAS_ANON_STRUCT__
+    __CL_ANON_STRUCT__ struct{ cl_half  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct{ cl_half  s0, s1, s2, s3, s4, s5, s6, s7; };
+    __CL_ANON_STRUCT__ struct{ cl_half4 lo, hi; };
+#endif
+#if defined( __CL_HALF2__)
+    __cl_half2     v2[4];
+#endif
+#if defined( __CL_HALF4__)
+    __cl_half4     v4[2];
+#endif
+#if defined( __CL_HALF8__ )
+    __cl_half8     v8;
+#endif
+}cl_half8;
+
+typedef union
+{
+    cl_half  CL_ALIGNED(32) s[16];
+#if __CL_HAS_ANON_STRUCT__
+    __CL_ANON_STRUCT__ struct{ cl_half  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+    __CL_ANON_STRUCT__ struct{ cl_half  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+    __CL_ANON_STRUCT__ struct{ cl_half8 lo, hi; };
+#endif
+#if defined( __CL_HALF2__)
+    __cl_half2     v2[8];
+#endif
+#if defined( __CL_HALF4__)
+    __cl_half4     v4[4];
+#endif
+#if defined( __CL_HALF8__ )
+    __cl_half8     v8[2];
+#endif
+#if defined( __CL_HALF16__ )
+    __cl_half16    v16;
+#endif
+}cl_half16;
+
+/* ---- cl_intn ---- */
+typedef union
+{
+    cl_int  CL_ALIGNED(8) s[2];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_int  x, y; };
+   __CL_ANON_STRUCT__ struct{ cl_int  s0, s1; };
+   __CL_ANON_STRUCT__ struct{ cl_int  lo, hi; };
+#endif
+#if defined( __CL_INT2__)
+    __cl_int2     v2;
+#endif
+}cl_int2;
+
+typedef union
+{
+    cl_int  CL_ALIGNED(16) s[4];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_int  x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_int  s0, s1, s2, s3; };
+   __CL_ANON_STRUCT__ struct{ cl_int2 lo, hi; };
+#endif
+#if defined( __CL_INT2__)
+    __cl_int2     v2[2];
+#endif
+#if defined( __CL_INT4__)
+    __cl_int4     v4;
+#endif
+}cl_int4;
+
+/* cl_int3 is identical in size, alignment and behavior to cl_int4. See section 6.1.5. */
+typedef  cl_int4  cl_int3;
+
+typedef union
+{
+    cl_int   CL_ALIGNED(32) s[8];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_int  x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_int  s0, s1, s2, s3, s4, s5, s6, s7; };
+   __CL_ANON_STRUCT__ struct{ cl_int4 lo, hi; };
+#endif
+#if defined( __CL_INT2__)
+    __cl_int2     v2[4];
+#endif
+#if defined( __CL_INT4__)
+    __cl_int4     v4[2];
+#endif
+#if defined( __CL_INT8__ )
+    __cl_int8     v8;
+#endif
+}cl_int8;
+
+typedef union
+{
+    cl_int  CL_ALIGNED(64) s[16];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_int  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+   __CL_ANON_STRUCT__ struct{ cl_int  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+   __CL_ANON_STRUCT__ struct{ cl_int8 lo, hi; };
+#endif
+#if defined( __CL_INT2__)
+    __cl_int2     v2[8];
+#endif
+#if defined( __CL_INT4__)
+    __cl_int4     v4[4];
+#endif
+#if defined( __CL_INT8__ )
+    __cl_int8     v8[2];
+#endif
+#if defined( __CL_INT16__ )
+    __cl_int16    v16;
+#endif
+}cl_int16;
+
+
+/* ---- cl_uintn ---- */
+typedef union
+{
+    cl_uint  CL_ALIGNED(8) s[2];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_uint  x, y; };
+   __CL_ANON_STRUCT__ struct{ cl_uint  s0, s1; };
+   __CL_ANON_STRUCT__ struct{ cl_uint  lo, hi; };
+#endif
+#if defined( __CL_UINT2__)
+    __cl_uint2     v2;
+#endif
+}cl_uint2;
+
+typedef union
+{
+    cl_uint  CL_ALIGNED(16) s[4];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_uint  x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_uint  s0, s1, s2, s3; };
+   __CL_ANON_STRUCT__ struct{ cl_uint2 lo, hi; };
+#endif
+#if defined( __CL_UINT2__)
+    __cl_uint2     v2[2];
+#endif
+#if defined( __CL_UINT4__)
+    __cl_uint4     v4;
+#endif
+}cl_uint4;
+
+/* cl_uint3 is identical in size, alignment and behavior to cl_uint4. See section 6.1.5. */
+typedef  cl_uint4  cl_uint3;
+
+typedef union
+{
+    cl_uint   CL_ALIGNED(32) s[8];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_uint  x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_uint  s0, s1, s2, s3, s4, s5, s6, s7; };
+   __CL_ANON_STRUCT__ struct{ cl_uint4 lo, hi; };
+#endif
+#if defined( __CL_UINT2__)
+    __cl_uint2     v2[4];
+#endif
+#if defined( __CL_UINT4__)
+    __cl_uint4     v4[2];
+#endif
+#if defined( __CL_UINT8__ )
+    __cl_uint8     v8;
+#endif
+}cl_uint8;
+
+typedef union
+{
+    cl_uint  CL_ALIGNED(64) s[16];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_uint  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+   __CL_ANON_STRUCT__ struct{ cl_uint  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+   __CL_ANON_STRUCT__ struct{ cl_uint8 lo, hi; };
+#endif
+#if defined( __CL_UINT2__)
+    __cl_uint2     v2[8];
+#endif
+#if defined( __CL_UINT4__)
+    __cl_uint4     v4[4];
+#endif
+#if defined( __CL_UINT8__ )
+    __cl_uint8     v8[2];
+#endif
+#if defined( __CL_UINT16__ )
+    __cl_uint16    v16;
+#endif
+}cl_uint16;
+
+/* ---- cl_longn ---- */
+typedef union
+{
+    cl_long  CL_ALIGNED(16) s[2];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_long  x, y; };
+   __CL_ANON_STRUCT__ struct{ cl_long  s0, s1; };
+   __CL_ANON_STRUCT__ struct{ cl_long  lo, hi; };
+#endif
+#if defined( __CL_LONG2__)
+    __cl_long2     v2;
+#endif
+}cl_long2;
+
+typedef union
+{
+    cl_long  CL_ALIGNED(32) s[4];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_long  x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_long  s0, s1, s2, s3; };
+   __CL_ANON_STRUCT__ struct{ cl_long2 lo, hi; };
+#endif
+#if defined( __CL_LONG2__)
+    __cl_long2     v2[2];
+#endif
+#if defined( __CL_LONG4__)
+    __cl_long4     v4;
+#endif
+}cl_long4;
+
+/* cl_long3 is identical in size, alignment and behavior to cl_long4. See section 6.1.5. */
+typedef  cl_long4  cl_long3;
+
+typedef union
+{
+    cl_long   CL_ALIGNED(64) s[8];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_long  x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_long  s0, s1, s2, s3, s4, s5, s6, s7; };
+   __CL_ANON_STRUCT__ struct{ cl_long4 lo, hi; };
+#endif
+#if defined( __CL_LONG2__)
+    __cl_long2     v2[4];
+#endif
+#if defined( __CL_LONG4__)
+    __cl_long4     v4[2];
+#endif
+#if defined( __CL_LONG8__ )
+    __cl_long8     v8;
+#endif
+}cl_long8;
+
+typedef union
+{
+    cl_long  CL_ALIGNED(128) s[16];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_long  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+   __CL_ANON_STRUCT__ struct{ cl_long  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+   __CL_ANON_STRUCT__ struct{ cl_long8 lo, hi; };
+#endif
+#if defined( __CL_LONG2__)
+    __cl_long2     v2[8];
+#endif
+#if defined( __CL_LONG4__)
+    __cl_long4     v4[4];
+#endif
+#if defined( __CL_LONG8__ )
+    __cl_long8     v8[2];
+#endif
+#if defined( __CL_LONG16__ )
+    __cl_long16    v16;
+#endif
+}cl_long16;
+
+
+/* ---- cl_ulongn ---- */
+typedef union
+{
+    cl_ulong  CL_ALIGNED(16) s[2];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_ulong  x, y; };
+   __CL_ANON_STRUCT__ struct{ cl_ulong  s0, s1; };
+   __CL_ANON_STRUCT__ struct{ cl_ulong  lo, hi; };
+#endif
+#if defined( __CL_ULONG2__)
+    __cl_ulong2     v2;
+#endif
+}cl_ulong2;
+
+typedef union
+{
+    cl_ulong  CL_ALIGNED(32) s[4];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_ulong  x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_ulong  s0, s1, s2, s3; };
+   __CL_ANON_STRUCT__ struct{ cl_ulong2 lo, hi; };
+#endif
+#if defined( __CL_ULONG2__)
+    __cl_ulong2     v2[2];
+#endif
+#if defined( __CL_ULONG4__)
+    __cl_ulong4     v4;
+#endif
+}cl_ulong4;
+
+/* cl_ulong3 is identical in size, alignment and behavior to cl_ulong4. See section 6.1.5. */
+typedef  cl_ulong4  cl_ulong3;
+
+typedef union
+{
+    cl_ulong   CL_ALIGNED(64) s[8];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_ulong  x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_ulong  s0, s1, s2, s3, s4, s5, s6, s7; };
+   __CL_ANON_STRUCT__ struct{ cl_ulong4 lo, hi; };
+#endif
+#if defined( __CL_ULONG2__)
+    __cl_ulong2     v2[4];
+#endif
+#if defined( __CL_ULONG4__)
+    __cl_ulong4     v4[2];
+#endif
+#if defined( __CL_ULONG8__ )
+    __cl_ulong8     v8;
+#endif
+}cl_ulong8;
+
+typedef union
+{
+    cl_ulong  CL_ALIGNED(128) s[16];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_ulong  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+   __CL_ANON_STRUCT__ struct{ cl_ulong  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+   __CL_ANON_STRUCT__ struct{ cl_ulong8 lo, hi; };
+#endif
+#if defined( __CL_ULONG2__)
+    __cl_ulong2     v2[8];
+#endif
+#if defined( __CL_ULONG4__)
+    __cl_ulong4     v4[4];
+#endif
+#if defined( __CL_ULONG8__ )
+    __cl_ulong8     v8[2];
+#endif
+#if defined( __CL_ULONG16__ )
+    __cl_ulong16    v16;
+#endif
+}cl_ulong16;
+
+
+/* --- cl_floatn ---- */
+
+typedef union
+{
+    cl_float  CL_ALIGNED(8) s[2];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_float  x, y; };
+   __CL_ANON_STRUCT__ struct{ cl_float  s0, s1; };
+   __CL_ANON_STRUCT__ struct{ cl_float  lo, hi; };
+#endif
+#if defined( __CL_FLOAT2__)
+    __cl_float2     v2;
+#endif
+}cl_float2;
+
+typedef union
+{
+    cl_float  CL_ALIGNED(16) s[4];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_float   x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_float   s0, s1, s2, s3; };
+   __CL_ANON_STRUCT__ struct{ cl_float2  lo, hi; };
+#endif
+#if defined( __CL_FLOAT2__)
+    __cl_float2     v2[2];
+#endif
+#if defined( __CL_FLOAT4__)
+    __cl_float4     v4;
+#endif
+}cl_float4;
+
+/* cl_float3 is identical in size, alignment and behavior to cl_float4. See section 6.1.5. */
+typedef  cl_float4  cl_float3;
+
+typedef union
+{
+    cl_float   CL_ALIGNED(32) s[8];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_float   x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_float   s0, s1, s2, s3, s4, s5, s6, s7; };
+   __CL_ANON_STRUCT__ struct{ cl_float4  lo, hi; };
+#endif
+#if defined( __CL_FLOAT2__)
+    __cl_float2     v2[4];
+#endif
+#if defined( __CL_FLOAT4__)
+    __cl_float4     v4[2];
+#endif
+#if defined( __CL_FLOAT8__ )
+    __cl_float8     v8;
+#endif
+}cl_float8;
+
+typedef union
+{
+    cl_float  CL_ALIGNED(64) s[16];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_float  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+   __CL_ANON_STRUCT__ struct{ cl_float  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+   __CL_ANON_STRUCT__ struct{ cl_float8 lo, hi; };
+#endif
+#if defined( __CL_FLOAT2__)
+    __cl_float2     v2[8];
+#endif
+#if defined( __CL_FLOAT4__)
+    __cl_float4     v4[4];
+#endif
+#if defined( __CL_FLOAT8__ )
+    __cl_float8     v8[2];
+#endif
+#if defined( __CL_FLOAT16__ )
+    __cl_float16    v16;
+#endif
+}cl_float16;
+
+/* --- cl_doublen ---- */
+
+typedef union
+{
+    cl_double  CL_ALIGNED(16) s[2];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_double  x, y; };
+   __CL_ANON_STRUCT__ struct{ cl_double s0, s1; };
+   __CL_ANON_STRUCT__ struct{ cl_double lo, hi; };
+#endif
+#if defined( __CL_DOUBLE2__)
+    __cl_double2     v2;
+#endif
+}cl_double2;
+
+typedef union
+{
+    cl_double  CL_ALIGNED(32) s[4];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_double  x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_double  s0, s1, s2, s3; };
+   __CL_ANON_STRUCT__ struct{ cl_double2 lo, hi; };
+#endif
+#if defined( __CL_DOUBLE2__)
+    __cl_double2     v2[2];
+#endif
+#if defined( __CL_DOUBLE4__)
+    __cl_double4     v4;
+#endif
+}cl_double4;
+
+/* cl_double3 is identical in size, alignment and behavior to cl_double4. See section 6.1.5. */
+typedef  cl_double4  cl_double3;
+
+typedef union
+{
+    cl_double   CL_ALIGNED(64) s[8];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_double  x, y, z, w; };
+   __CL_ANON_STRUCT__ struct{ cl_double  s0, s1, s2, s3, s4, s5, s6, s7; };
+   __CL_ANON_STRUCT__ struct{ cl_double4 lo, hi; };
+#endif
+#if defined( __CL_DOUBLE2__)
+    __cl_double2     v2[4];
+#endif
+#if defined( __CL_DOUBLE4__)
+    __cl_double4     v4[2];
+#endif
+#if defined( __CL_DOUBLE8__ )
+    __cl_double8     v8;
+#endif
+}cl_double8;
+
+typedef union
+{
+    cl_double  CL_ALIGNED(128) s[16];
+#if __CL_HAS_ANON_STRUCT__
+   __CL_ANON_STRUCT__ struct{ cl_double  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+   __CL_ANON_STRUCT__ struct{ cl_double  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+   __CL_ANON_STRUCT__ struct{ cl_double8 lo, hi; };
+#endif
+#if defined( __CL_DOUBLE2__)
+    __cl_double2     v2[8];
+#endif
+#if defined( __CL_DOUBLE4__)
+    __cl_double4     v4[4];
+#endif
+#if defined( __CL_DOUBLE8__ )
+    __cl_double8     v8[2];
+#endif
+#if defined( __CL_DOUBLE16__ )
+    __cl_double16    v16;
+#endif
+}cl_double16;
+
+/* Macro to facilitate debugging
+ * Usage:
+ *   Place CL_PROGRAM_STRING_DEBUG_INFO on the line before the first line of your source.
+ *   The first line ends with:   CL_PROGRAM_STRING_DEBUG_INFO \"
+ *   Each line thereafter of OpenCL C source must end with: \n\
+ *   The last line ends in ";
+ *
+ *   Example:
+ *
+ *   const char *my_program = CL_PROGRAM_STRING_DEBUG_INFO "\
+ *   kernel void foo( int a, float * b )             \n\
+ *   {                                               \n\
+ *      // my comment                                \n\
+ *      *b[ get_global_id(0)] = a;                   \n\
+ *   }                                               \n\
+ *   ";
+ *
+ * This should correctly set up the line, (column) and file information for your source
+ * string so you can do source level debugging.
+ */
+#define  __CL_STRINGIFY( _x )               # _x
+#define  _CL_STRINGIFY( _x )                __CL_STRINGIFY( _x )
+#define  CL_PROGRAM_STRING_DEBUG_INFO       "#line "  _CL_STRINGIFY(__LINE__) " \"" __FILE__ "\" \n\n"
+
+#ifdef __cplusplus
+}
+#endif
+
+#if defined( _WIN32) && defined(_MSC_VER) && ! defined(__STDC__)
+    #if _MSC_VER >=1500
+    #pragma warning( pop )
+    #endif
+#endif
+
+#endif  /* __CL_PLATFORM_H  */
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_va_api_media_sharing_intel.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_va_api_media_sharing_intel.h
new file mode 100644
index 000000000..0e7cd4d6f
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_va_api_media_sharing_intel.h
@@ -0,0 +1,160 @@
+/*******************************************************************************
+ * Copyright (c) 2008-2020 The Khronos Group Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ ******************************************************************************/
+/*****************************************************************************\
+
+Copyright (c) 2013-2019 Intel Corporation All Rights Reserved.
+
+THESE MATERIALS ARE PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL OR ITS
+CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THESE
+MATERIALS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+File Name: cl_va_api_media_sharing_intel.h
+
+Abstract:
+
+Notes:
+
+\*****************************************************************************/
+
+
+#ifndef __OPENCL_CL_VA_API_MEDIA_SHARING_INTEL_H
+#define __OPENCL_CL_VA_API_MEDIA_SHARING_INTEL_H
+
+#include <CL/cl.h>
+#include <CL/cl_platform.h>
+#include <va/va.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/******************************************
+* cl_intel_va_api_media_sharing extension *
+*******************************************/
+
+#define cl_intel_va_api_media_sharing 1
+
+/* error codes */
+#define CL_INVALID_VA_API_MEDIA_ADAPTER_INTEL               -1098
+#define CL_INVALID_VA_API_MEDIA_SURFACE_INTEL               -1099
+#define CL_VA_API_MEDIA_SURFACE_ALREADY_ACQUIRED_INTEL      -1100
+#define CL_VA_API_MEDIA_SURFACE_NOT_ACQUIRED_INTEL          -1101
+
+/* cl_va_api_device_source_intel */
+#define CL_VA_API_DISPLAY_INTEL                             0x4094
+
+/* cl_va_api_device_set_intel */
+#define CL_PREFERRED_DEVICES_FOR_VA_API_INTEL               0x4095
+#define CL_ALL_DEVICES_FOR_VA_API_INTEL                     0x4096
+
+/* cl_context_info */
+#define CL_CONTEXT_VA_API_DISPLAY_INTEL                     0x4097
+
+/* cl_mem_info */
+#define CL_MEM_VA_API_MEDIA_SURFACE_INTEL                   0x4098
+
+/* cl_image_info */
+#define CL_IMAGE_VA_API_PLANE_INTEL                         0x4099
+
+/* cl_command_type */
+#define CL_COMMAND_ACQUIRE_VA_API_MEDIA_SURFACES_INTEL      0x409A
+#define CL_COMMAND_RELEASE_VA_API_MEDIA_SURFACES_INTEL      0x409B
+
+typedef cl_uint cl_va_api_device_source_intel;
+typedef cl_uint cl_va_api_device_set_intel;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clGetDeviceIDsFromVA_APIMediaAdapterINTEL(
+    cl_platform_id                platform,
+    cl_va_api_device_source_intel media_adapter_type,
+    void*                         media_adapter,
+    cl_va_api_device_set_intel    media_adapter_set,
+    cl_uint                       num_entries,
+    cl_device_id*                 devices,
+    cl_uint*                      num_devices) CL_EXT_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL * clGetDeviceIDsFromVA_APIMediaAdapterINTEL_fn)(
+    cl_platform_id                platform,
+    cl_va_api_device_source_intel media_adapter_type,
+    void*                         media_adapter,
+    cl_va_api_device_set_intel    media_adapter_set,
+    cl_uint                       num_entries,
+    cl_device_id*                 devices,
+    cl_uint*                      num_devices) CL_EXT_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY cl_mem CL_API_CALL
+clCreateFromVA_APIMediaSurfaceINTEL(
+    cl_context                    context,
+    cl_mem_flags                  flags,
+    VASurfaceID*                  surface,
+    cl_uint                       plane,
+    cl_int*                       errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_mem (CL_API_CALL * clCreateFromVA_APIMediaSurfaceINTEL_fn)(
+    cl_context                    context,
+    cl_mem_flags                  flags,
+    VASurfaceID*                  surface,
+    cl_uint                       plane,
+    cl_int*                       errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueAcquireVA_APIMediaSurfacesINTEL(
+    cl_command_queue              command_queue,
+    cl_uint                       num_objects,
+    const cl_mem*                 mem_objects,
+    cl_uint                       num_events_in_wait_list,
+    const cl_event*               event_wait_list,
+    cl_event*                     event) CL_EXT_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueAcquireVA_APIMediaSurfacesINTEL_fn)(
+    cl_command_queue              command_queue,
+    cl_uint                       num_objects,
+    const cl_mem*                 mem_objects,
+    cl_uint                       num_events_in_wait_list,
+    const cl_event*               event_wait_list,
+    cl_event*                     event) CL_EXT_SUFFIX__VERSION_1_2;
+
+extern CL_API_ENTRY cl_int CL_API_CALL
+clEnqueueReleaseVA_APIMediaSurfacesINTEL(
+    cl_command_queue              command_queue,
+    cl_uint                       num_objects,
+    const cl_mem*                 mem_objects,
+    cl_uint                       num_events_in_wait_list,
+    const cl_event*               event_wait_list,
+    cl_event*                     event) CL_EXT_SUFFIX__VERSION_1_2;
+
+typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueReleaseVA_APIMediaSurfacesINTEL_fn)(
+    cl_command_queue              command_queue,
+    cl_uint                       num_objects,
+    const cl_mem*                 mem_objects,
+    cl_uint                       num_events_in_wait_list,
+    const cl_event*               event_wait_list,
+    cl_event*                     event) CL_EXT_SUFFIX__VERSION_1_2;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif  /* __OPENCL_CL_VA_API_MEDIA_SHARING_INTEL_H */
+
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_version.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_version.h
new file mode 100644
index 000000000..3844938d5
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_version.h
@@ -0,0 +1,81 @@
+/*******************************************************************************
+ * Copyright (c) 2018-2020 The Khronos Group Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ ******************************************************************************/
+
+#ifndef __CL_VERSION_H
+#define __CL_VERSION_H
+
+/* Detect which version to target */
+#if !defined(CL_TARGET_OPENCL_VERSION)
+#pragma message("cl_version.h: CL_TARGET_OPENCL_VERSION is not defined. Defaulting to 300 (OpenCL 3.0)")
+#define CL_TARGET_OPENCL_VERSION 300
+#endif
+#if CL_TARGET_OPENCL_VERSION != 100 && \
+    CL_TARGET_OPENCL_VERSION != 110 && \
+    CL_TARGET_OPENCL_VERSION != 120 && \
+    CL_TARGET_OPENCL_VERSION != 200 && \
+    CL_TARGET_OPENCL_VERSION != 210 && \
+    CL_TARGET_OPENCL_VERSION != 220 && \
+    CL_TARGET_OPENCL_VERSION != 300
+#pragma message("cl_version: CL_TARGET_OPENCL_VERSION is not a valid value (100, 110, 120, 200, 210, 220, 300). Defaulting to 300 (OpenCL 3.0)")
+#undef CL_TARGET_OPENCL_VERSION
+#define CL_TARGET_OPENCL_VERSION 300
+#endif
+
+
+/* OpenCL Version */
+#if CL_TARGET_OPENCL_VERSION >= 300 && !defined(CL_VERSION_3_0)
+#define CL_VERSION_3_0  1
+#endif
+#if CL_TARGET_OPENCL_VERSION >= 220 && !defined(CL_VERSION_2_2)
+#define CL_VERSION_2_2  1
+#endif
+#if CL_TARGET_OPENCL_VERSION >= 210 && !defined(CL_VERSION_2_1)
+#define CL_VERSION_2_1  1
+#endif
+#if CL_TARGET_OPENCL_VERSION >= 200 && !defined(CL_VERSION_2_0)
+#define CL_VERSION_2_0  1
+#endif
+#if CL_TARGET_OPENCL_VERSION >= 120 && !defined(CL_VERSION_1_2)
+#define CL_VERSION_1_2  1
+#endif
+#if CL_TARGET_OPENCL_VERSION >= 110 && !defined(CL_VERSION_1_1)
+#define CL_VERSION_1_1  1
+#endif
+#if CL_TARGET_OPENCL_VERSION >= 100 && !defined(CL_VERSION_1_0)
+#define CL_VERSION_1_0  1
+#endif
+
+/* Allow deprecated APIs for older OpenCL versions. */
+#if CL_TARGET_OPENCL_VERSION <= 220 && !defined(CL_USE_DEPRECATED_OPENCL_2_2_APIS)
+#define CL_USE_DEPRECATED_OPENCL_2_2_APIS
+#endif
+#if CL_TARGET_OPENCL_VERSION <= 210 && !defined(CL_USE_DEPRECATED_OPENCL_2_1_APIS)
+#define CL_USE_DEPRECATED_OPENCL_2_1_APIS
+#endif
+#if CL_TARGET_OPENCL_VERSION <= 200 && !defined(CL_USE_DEPRECATED_OPENCL_2_0_APIS)
+#define CL_USE_DEPRECATED_OPENCL_2_0_APIS
+#endif
+#if CL_TARGET_OPENCL_VERSION <= 120 && !defined(CL_USE_DEPRECATED_OPENCL_1_2_APIS)
+#define CL_USE_DEPRECATED_OPENCL_1_2_APIS
+#endif
+#if CL_TARGET_OPENCL_VERSION <= 110 && !defined(CL_USE_DEPRECATED_OPENCL_1_1_APIS)
+#define CL_USE_DEPRECATED_OPENCL_1_1_APIS
+#endif
+#if CL_TARGET_OPENCL_VERSION <= 100 && !defined(CL_USE_DEPRECATED_OPENCL_1_0_APIS)
+#define CL_USE_DEPRECATED_OPENCL_1_0_APIS
+#endif
+
+#endif  /* __CL_VERSION_H */
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/opencl.h b/tools/hitag2crack/common/OpenCL-Headers/CL/opencl.h
new file mode 100644
index 000000000..1c4e10c88
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/opencl.h
@@ -0,0 +1,33 @@
+/*******************************************************************************
+ * Copyright (c) 2008-2020 The Khronos Group Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ ******************************************************************************/
+
+#ifndef __OPENCL_H
+#define __OPENCL_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <CL/cl.h>
+#include <CL/cl_gl.h>
+#include <CL/cl_gl_ext.h>
+#include <CL/cl_ext.h>
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif  /* __OPENCL_H   */
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CODE_OF_CONDUCT.md b/tools/hitag2crack/common/OpenCL-Headers/CODE_OF_CONDUCT.md
new file mode 100644
index 000000000..a11610bd3
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/CODE_OF_CONDUCT.md
@@ -0,0 +1 @@
+A reminder that this issue tracker is managed by the Khronos Group. Interactions here should follow the Khronos Code of Conduct (https://www.khronos.org/developers/code-of-conduct), which prohibits aggressive or derogatory language. Please keep the discussion friendly and civil.
diff --git a/tools/hitag2crack/common/OpenCL-Headers/LICENSE b/tools/hitag2crack/common/OpenCL-Headers/LICENSE
new file mode 100644
index 000000000..d64569567
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/tools/hitag2crack/common/OpenCL-Headers/README.md b/tools/hitag2crack/common/OpenCL-Headers/README.md
new file mode 100644
index 000000000..3a9c817c3
--- /dev/null
+++ b/tools/hitag2crack/common/OpenCL-Headers/README.md
@@ -0,0 +1,74 @@
+# OpenCL<sup>TM</sup> API Headers
+
+This repository contains C language headers for the OpenCL API.
+
+The authoritative public repository for these headers is located at:
+
+https://github.com/KhronosGroup/OpenCL-Headers
+
+Issues, proposed fixes for issues, and other suggested changes should be
+created using Github.
+
+## CMake Package
+While the headers may just be copied as-is, this repository also contains a
+CMake script with an install rule to allow for packaging the headers.
+
+```bash
+cmake -S . -B build -DCMAKE_INSTALL_PREFIX=/chosen/install/prefix
+cmake --build build --target install
+```
+ 
+To consume the package:
+
+```bash
+cmake path/to/opencl/app -DOpenCLHeaders_ROOT=/chosen/install/prefix
+```
+
+```cmake
+cmake_minimum_required(VERSION 3.0)
+cmake_policy(VERSION 3.0...3.18.4)
+project(proj)
+add_executable(app main.cpp)
+find_package(OpenCLHeaders REQUIRED)
+target_link_libraries(app PRIVATE OpenCL::Headers)
+```
+
+## Branch Structure
+
+The OpenCL API headers in this repository are Unified headers and are designed
+to work with all released OpenCL versions.  This differs from previous OpenCL
+API headers, where version-specific API headers either existed in separate
+branches, or in separate folders in a branch.
+
+## Compiling for a Specific OpenCL Version
+
+By default, the OpenCL API headers in this repository are for the latest
+OpenCL version (currently OpenCL 2.2).  To use these API headers to target
+a different OpenCL version, an application may `#define` the preprocessor
+value `CL_TARGET_OPENCL_VERSION` before including the OpenCL API headers.
+The `CL_TARGET_OPENCL_VERSION` is a three digit decimal value representing
+the OpenCL API version.
+
+For example, to enforce usage of no more than the OpenCL 1.2 APIs, you may
+include the OpenCL API headers as follows:
+
+```c
+#define CL_TARGET_OPENCL_VERSION 120
+#include <CL/opencl.h>
+```
+
+## Directory Structure
+
+```
+README.md               This file
+LICENSE                 Source license for the OpenCL API headers
+CL/                     Unified OpenCL API headers tree
+```
+
+## License
+
+See [LICENSE](LICENSE).
+
+---
+
+OpenCL and the OpenCL logo are trademarks of Apple Inc. used by permission by Khronos.
diff --git a/tools/hitag2crack/common/hitagcrypto.c b/tools/hitag2crack/common/hitagcrypto.c
index a4b63c366..fc1a84051 100644
--- a/tools/hitag2crack/common/hitagcrypto.c
+++ b/tools/hitag2crack/common/hitagcrypto.c
@@ -208,7 +208,9 @@
 
 // We want the crypto functions to be as fast as possible, so optimize!
 // The best compiler optimization in Microchip's free XC32 edition is -O1
+#ifndef __APPLE__
 #pragma GCC optimize("O1")
+#endif
 
 // private, nonlinear function to generate 1 crypto bit
 static uint32_t hitag2_crypt(uint64_t x);
@@ -367,4 +369,6 @@ uint32_t hitag2_nstep(Hitag_State *pstate, uint32_t steps) {
 }
 
 // end of crypto core, revert to default optimization level
+#ifndef __APPLE__
 #pragma GCC reset_options
+#endif
diff --git a/tools/hitag2crack/crack2/ht2crack2buildtable.c b/tools/hitag2crack/crack2/ht2crack2buildtable.c
index 6f8319a02..8ea3186bb 100644
--- a/tools/hitag2crack/crack2/ht2crack2buildtable.c
+++ b/tools/hitag2crack/crack2/ht2crack2buildtable.c
@@ -427,7 +427,8 @@ static void *sorttable(void *dd) {
             close(fdin);
 
             // sort it
-            qsort_r(table, numentries, DATASIZE, datacmp, NULL);
+            void *dummy = NULL; // clang
+            qsort_r(table, numentries, DATASIZE, datacmp, dummy);
 
             // write to file
             sprintf(outfile, "sorted/%02x/%02x.bin", i, j);
diff --git a/tools/hitag2crack/crack5gpu/Makefile b/tools/hitag2crack/crack5gpu/Makefile
index 57e44641f..d5134e51a 100644
--- a/tools/hitag2crack/crack5gpu/Makefile
+++ b/tools/hitag2crack/crack5gpu/Makefile
@@ -2,6 +2,9 @@ MYSRCPATHS = ../common
 MYSRCS = ht2crackutils.c hitagcrypto.c
 MYCFLAGS =
 MYDEFS =
+
+platform = $(shell uname)
+
 ifeq ($(platform),Darwin)
     MYLDLIBS ?= -framework OpenCL
 else
@@ -11,6 +14,7 @@ else
     MYLDLIBS ?= -L/opt/nvidia/cuda/lib64 -lOpenCL
 endif
 MYINCLUDES +=-I ../common
+MYINCLUDES +=-I ../common/OpenCL-Headers
 
 BINS = ht2crack5gpu
 INSTALLTOOLS = $(BINS)
diff --git a/tools/hitag2crack/crack5opencl/.gitignore b/tools/hitag2crack/crack5opencl/.gitignore
new file mode 100644
index 000000000..037b9d34f
--- /dev/null
+++ b/tools/hitag2crack/crack5opencl/.gitignore
@@ -0,0 +1,2 @@
+ht2crack5opencl
+ht2crack5opencl.exe
diff --git a/tools/hitag2crack/crack5opencl/LICENSE.txt b/tools/hitag2crack/crack5opencl/LICENSE.txt
new file mode 100644
index 000000000..94a9ed024
--- /dev/null
+++ b/tools/hitag2crack/crack5opencl/LICENSE.txt
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.
diff --git a/tools/hitag2crack/crack5opencl/Makefile b/tools/hitag2crack/crack5opencl/Makefile
new file mode 100644
index 000000000..6d1c84e6c
--- /dev/null
+++ b/tools/hitag2crack/crack5opencl/Makefile
@@ -0,0 +1,77 @@
+MYSRCS = queue.c threads.c opencl.c hitag2.c
+MYCFLAGS =
+MYDEFS = -D TEST_UNIT=0
+
+platform = $(shell uname)
+
+ifeq ($(platform),Darwin)
+    MYLDLIBS ?= -framework OpenCL
+else
+    #MYINCLUDES ?=-I/usr/local/cuda-7.5/include
+    #MYINCLUDES ?=-I/opt/nvidia/cuda/include
+    #MYLDLIBS ?= -L/usr/local/cuda-7.5/lib64 -lOpenCL
+    MYLDLIBS ?= -L/opt/nvidia/cuda/lib64 -lOpenCL
+endif
+MYLDLIBS += -lpthread
+
+MYINCLUDES +=-I ../common
+MYINCLUDES +=-I ../common/OpenCL-Headers
+
+BINS = ht2crack5opencl
+INSTALLTOOLS = $(BINS)
+
+include ../../../Makefile.host
+
+# checking platform can be done only after Makefile.host
+ifneq (,$(findstring MINGW,$(platform)))
+    # Mingw uses by default Microsoft printf, we want the GNU printf (e.g. for %z)
+    # and setting _ISOC99_SOURCE sets internally __USE_MINGW_ANSI_STDIO=1
+    CFLAGS += -D_ISOC99_SOURCE
+endif
+
+WITH_CLANG=$(shell $(CC) --version 2>&1 | grep -c "clang")
+
+# disable sanitize on Linux
+ifeq ($(SANITIZE),1)
+ifeq ($(platform),Linux)
+
+CFLAGS := $(filter-out -fsanitize=address,$(CFLAGS))
+CFLAGS := $(filter-out -fno-omit-frame-pointer,$(CFLAGS))
+LDFLAGS := $(filter-out -fsanitize=address,$(CFLAGS))
+
+define errMsg
+Disabling SANITIZE here, is incompatibe with OpenCL on Linux, due to a bug.
+Check this (https://github.com/google/sanitizers/issues/611).
+endef
+$(warning $(errMsg))
+endif
+endif
+
+# clang
+ifeq ($(WITH_CLANG),1)
+ifeq ($(platform),Linux)
+CFLAGS += -fPIE
+endif
+endif
+
+# if debug and clang, add more CFLAGS
+ifeq ($(DEBUG),1)
+ifeq ($(WITH_CLANG),1)
+CFLAGS += -Weverything
+CFLAGS += -Wno-reserved-id-macro
+ifeq ($(platform),Linux)
+CFLAGS += -Wno-error=reserved-id-macro
+CFLAGS += -Wno-error=disabled-macro-expansion
+endif
+endif
+$(info CFLAGS are: $(CFLAGS))
+endif
+
+ht2crack5opencl : $(OBJDIR)/ht2crack5opencl.o ${MYOBJS}
+
+ifeq ($(platform),Darwin)
+ht2crack5opencl_clean:
+	@rm -rf *.dSYM
+
+clean: ht2crack5opencl_clean
+endif
diff --git a/tools/hitag2crack/crack5opencl/README.md b/tools/hitag2crack/crack5opencl/README.md
new file mode 100644
index 000000000..3d5635b23
--- /dev/null
+++ b/tools/hitag2crack/crack5opencl/README.md
@@ -0,0 +1,57 @@
+ht2crack5opencl
+
+
+
+Build
+-----
+
+It requires an OpenCL framework.
+
+If required, edit Makefile and adjust INCLUDE and LIBS directives to your setup.
+
+```
+make clean
+make
+```
+
+Run
+---
+
+You'll need just two nR aR pairs.  These are the
+encrypted nonces and challenge response values.  They should be in hex.
+
+```
+./ht2crack5opencl <UID> <nR1> <aR1> <nR2> <aR2>
+```
+
+UID is the UID of the tag that you used to gather the nR aR values.
+
+Following the help:
+
+```
+$ ./ht2crack5opencl 
+./ht2crack5opencl [options] {UID} {nR1} {aR1} {nR2} {aR2}
+
+Options:
+-p     : select OpenCL Platform(s). Multiple allowed (1,2,3,etc.). [Default: all]
+-d     : select OpenCL Device(s). Multiple allowed (1,2,3,etc.). [Default: all]
+-D     : select OpenCL Device Type. 0: GPU, 1: CPU, 2: all. [Default: GPU]
+-S     : select the thread scheduler type. 0: sequential, 1: asynchronous. [Default 1]
+-P     : select the Profile, from 0 to 10. [Default: auto-tuning]
+-F     : force verify key with OpenCL instead of CPU. [Default: disabled]
+-Q     : select queue engine. 0: forward, 1: reverse, 2: random. [Default: 0]
+-s     : show the list of OpenCL platforms/devices, then exit
+-V     : enable debug messages
+-v     : show the version
+-h     : show this help
+
+Example, select devices 1, 2 and 3 using platform 1 and 2, with random queue engine:
+
+./ht2crack5opencl -D 2 -Q 2 -p 1,2 -d 1,2,3 2ab12bf2 4B71E49D 6A606453 D79BD94B 16A2255B
+```
+
+You can found the correct OpenCL Platform ID's (-p) and Device ID's (-d) by:
+
+```
+./ht2crack5opencl -s
+```
diff --git a/tools/hitag2crack/crack5opencl/dolphin_macro.h b/tools/hitag2crack/crack5opencl/dolphin_macro.h
new file mode 100644
index 000000000..ea9708bab
--- /dev/null
+++ b/tools/hitag2crack/crack5opencl/dolphin_macro.h
@@ -0,0 +1,38 @@
+/****************************************************************************
+
+Author : Gabriele 'matrix' Gristina <gabriele.gristina@gmail.com>
+Date   : Sun Jan 10 13:59:37 CET 2021
+Version: 0.1beta
+License: GNU General Public License v3 or any later version (see LICENSE.txt)
+
+*****************************************************************************
+    Copyright (C) 2020-2021  <Gabriele Gristina>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+****************************************************************************/
+
+
+// trust me...i'm a dolphin :P
+// too many allocations, too many free to manage, I need dolphin macros :)
+// they could be buggy, but if you know how to fix them, do it
+
+#define MEMORY_FREE_ADD(a)      { freeList[freeListIdx++] = (void *)(a); }
+#define MEMORY_FREE_ALL         { int t=freeListIdx; while (t-- > 0) if (freeList[t]!=NULL) { free (freeList[t]); freeList[t]=NULL; } if (freeList!=NULL) { free (freeList); freeList=NULL; } }
+#define MEMORY_FREE_DEL(a)      { for (int i=0;i<freeListIdx;i++) { if(freeList[i] && a==freeList[i]) { free(freeList[i]); freeList[i]=NULL; break; } } }
+#define MEMORY_FREE_LIST(a,i)   { if (i > 0) { int t=(int)i; do { if (a[t]!=NULL) { free(a[t]); a[t]=NULL; } } while (--t >= 0); MEMORY_FREE_DEL(a) } }
+#define MEMORY_FREE_LIST_Z(a,i) { int t=(int)i; do { if (a[t]!=NULL) { free(a[t]); a[t]=NULL; } } while (--t >= 0); MEMORY_FREE_DEL(a) }
+#define MEMORY_FREE_OPENCL(c,i) { int t=(int)i; do { if (c.contexts[t]) clReleaseContext (c.contexts[t]); if (c.keystreams[t]) clReleaseMemObject (c.keystreams[t]); \
+                                  if (c.candidates[t]) clReleaseMemObject (c.candidates[t]); if (c.matches[t]) clReleaseMemObject (c.matches[t]); \
+                                  if (c.matches_found[t]) clReleaseMemObject (c.matches_found[t]); if (c.commands[t]) clReleaseCommandQueue (c.commands[t]); \
+                                  if (c.kernels[t]) clReleaseKernel (c.kernels[t]); if (c.programs[t]) clReleaseProgram (c.programs[t]); } while (--t >= 0); }
diff --git a/tools/hitag2crack/crack5opencl/hitag2.c b/tools/hitag2crack/crack5opencl/hitag2.c
new file mode 100644
index 000000000..a23093347
--- /dev/null
+++ b/tools/hitag2crack/crack5opencl/hitag2.c
@@ -0,0 +1,258 @@
+#include "ht2crack5opencl.h"
+#include "hitag2.h"
+
+//#if FORCE_HITAG2_FULL == 0
+
+// return a single bit from a value
+int bitn (uint64_t x, int bit)
+{
+        const uint64_t bitmask = (uint64_t)(1) << bit;
+
+        return (x & bitmask) ? 1 : 0;
+}
+
+// the sub-function R that rollback depends upon
+int fnR (uint64_t x)
+{
+        // renumbered bits because my state is 0-47, not 1-48
+        return (bitn(x, 1) ^ bitn(x, 2) ^ bitn(x, 5) ^
+                bitn(x, 6) ^ bitn(x, 7) ^ bitn(x, 15) ^
+                bitn(x, 21) ^ bitn(x, 22) ^ bitn(x, 25) ^
+                bitn(x, 29) ^ bitn(x, 40) ^ bitn(x, 41) ^
+                bitn(x, 42) ^ bitn(x, 45) ^ bitn(x, 46) ^ bitn(x, 47));
+}
+
+// the three filter sub-functions that feed fnf
+int fa(unsigned int i) {
+        return bitn(0x2C79, (int)i);
+}
+
+int fb(unsigned int i) {
+        return bitn(0x6671, (int)i);
+}
+
+// the filter function that generates a bit of output from the prng state
+int fnf (uint64_t s)
+{
+        const unsigned int x1 = (unsigned int)((bitn(s,  2) << 0) | (bitn(s,  3) << 1) | (bitn(s,  5) << 2) | (bitn(s,  6) << 3));
+        const unsigned int x2 = (unsigned int)((bitn(s,  8) << 0) | (bitn(s, 12) << 1) | (bitn(s, 14) << 2) | (bitn(s, 15) << 3));
+        const unsigned int x3 = (unsigned int)((bitn(s, 17) << 0) | (bitn(s, 21) << 1) | (bitn(s, 23) << 2) | (bitn(s, 26) << 3));
+        const unsigned int x4 = (unsigned int)((bitn(s, 28) << 0) | (bitn(s, 29) << 1) | (bitn(s, 31) << 2) | (bitn(s, 33) << 3));
+        const unsigned int x5 = (unsigned int)((bitn(s, 34) << 0) | (bitn(s, 43) << 1) | (bitn(s, 44) << 2) | (bitn(s, 46) << 3));
+
+        const unsigned int x6 = (unsigned int)((fa(x1) << 0) | (fb(x2) << 1) | (fb(x3) << 2) | (fb(x4) << 3) | (fa(x5) << 4));
+
+        return bitn (0x7907287B, (int) x6);
+}
+
+uint32_t hitag2_crypt (uint64_t x) {
+        const uint32_t ht2_function4a = 0x2C79; // 0010 1100 0111 1001
+        const uint32_t ht2_function4b = 0x6671; // 0110 0110 0111 0001
+        const uint32_t ht2_function5c = 0x7907287B; // 0111 1001 0000 0111 0010 1000 0111 1011
+
+        uint32_t bitindex;
+
+        bitindex = (ht2_function4a >> pickbits2_2(x, 1, 4)) & 1;
+        bitindex |= ((ht2_function4b << 1) >> pickbits1_1_2(x, 7, 11, 13)) & 0x02;
+        bitindex |= ((ht2_function4b << 2) >> pickbits1x4(x, 16, 20, 22, 25)) & 0x04;
+        bitindex |= ((ht2_function4b << 3) >> pickbits2_1_1(x, 27, 30, 32)) & 0x08;
+        bitindex |= ((ht2_function4a << 4) >> pickbits1_2_1(x, 33, 42, 45)) & 0x10;
+
+        #if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+        printf ("hitag2_crypt bitindex = %02x\n", bitindex);
+        #endif
+
+        return (ht2_function5c >> bitindex) & 1;
+}
+
+/*
+ * Return up to 32 crypto bits.
+ * Last bit is in least significant bit, earlier bits are shifted left.
+ * Note that the Hitag transmission protocol is least significant bit,
+ * so we may want to change this, or add a function, that returns the
+ * crypto output bits in the other order.
+ *
+ * Parameters:
+ * Hitag_State* pstate - in/out, internal cipher state after initialisation
+ * uint32_t steps      - number of bits requested, (capped at 32)
+ */
+uint32_t hitag2_nstep(Hitag_State *pstate, uint32_t steps) {
+        uint64_t cur_state = pstate->shiftreg;
+        uint32_t result = 0;
+        uint64_t lfsr = pstate->lfsr;
+
+        if (steps == 0) return 0;
+
+        do {
+                // update shift registers
+                if (lfsr & 1) {
+                        cur_state = (cur_state >> 1) | 0x800000000000;
+                        lfsr = (lfsr >> 1) ^ 0xB38083220073;
+
+                        // accumulate next bit of crypto
+                        result = (result << 1) | hitag2_crypt(cur_state);
+                } else {
+                        cur_state >>= 1;
+                        lfsr >>= 1;
+
+                        result = (result << 1) | hitag2_crypt(cur_state);
+                }
+        } while (--steps);
+
+        #if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+        #ifdef _ISOC99_SOURCE
+        printf ("hitag2_nstep cur_state = %012I64x, result %02x\n", cur_state, result);
+        #else
+        printf ("hitag2_nstep cur_state = %012" STR(OFF_FORMAT_X) ", result %02x\n", cur_state, result);
+        #endif
+        #endif // DEBUG_HITAG2
+
+        pstate->shiftreg = cur_state;
+        pstate->lfsr = lfsr;
+        return result;
+}
+
+/*
+ * Parameters:
+ * Hitag_State* pstate - output, internal state after initialisation
+ * uint64_t sharedkey  - 48 bit key shared between reader & tag
+ * uint32_t serialnum  - 32 bit tag serial number
+ * uint32_t initvector - 32 bit random IV from reader, part of tag authentication
+ */
+void hitag2_init (Hitag_State *pstate, uint64_t sharedkey, uint32_t serialnum, uint32_t initvector)
+{
+        // init state, from serial number and lowest 16 bits of shared key
+        uint64_t cur_state = ((sharedkey & 0xFFFF) << 32) | serialnum;
+
+        // mix the initialisation vector and highest 32 bits of the shared key
+        initvector ^= (uint32_t) (sharedkey >> 16);
+
+        // move 16 bits from (IV xor Shared Key) to top of uint64_t state
+        // these will be XORed in turn with output of the crypto function
+        cur_state |= (uint64_t) initvector << 48;
+        initvector >>= 16;
+
+        // unrolled loop is faster on PIC32 (MIPS), do 32 times
+        // shift register, then calc new bit
+        cur_state >>= 1;
+
+        int i;
+
+        for (i = 0; i < 16; i++) cur_state = (cur_state >> 1) ^ (uint64_t) hitag2_crypt(cur_state) << 46;
+
+        // highest 16 bits of IV XOR Shared Key
+        cur_state |= (uint64_t) initvector << 47;
+
+        for (i = 0; i < 15; i++) cur_state = (cur_state >> 1) ^ (uint64_t) hitag2_crypt(cur_state) << 46;
+
+        cur_state ^= (uint64_t) hitag2_crypt (cur_state) << 47;
+
+        pstate->shiftreg = cur_state;
+        #if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+        #ifdef _ISOC99_SOURCE
+        printf ("hitag2_init shiftreg = %012I64x\n", pstate->shiftreg);
+        #else
+        printf ("hitag2_init shiftreg = %012" STR(OFF_FORMAT_X) "\n", pstate->shiftreg);
+        #endif
+        #endif // DEBUG_HITAG2
+
+        /* naive version for reference, LFSR has 16 taps
+        pstate->lfsr = state ^ (state >>  2) ^ (state >>  3) ^ (state >>  6)
+                 ^ (state >>  7) ^ (state >>  8) ^ (state >> 16) ^ (state >> 22)
+                 ^ (state >> 23) ^ (state >> 26) ^ (state >> 30) ^ (state >> 41)
+                 ^ (state >> 42) ^ (state >> 43) ^ (state >> 46) ^ (state >> 47);
+        */
+
+        // optimise with one 64-bit intermediate
+        uint64_t temp = cur_state ^ (cur_state >> 1);
+
+        pstate->lfsr = cur_state ^ (cur_state >>  6) ^ (cur_state >> 16) ^
+                   (cur_state >> 26) ^ (cur_state >> 30) ^ (cur_state >> 41) ^
+                   (temp >>  2) ^ (temp >>  7) ^ (temp >> 22) ^ (temp >> 42) ^ (temp >> 46);
+
+        #if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+        #ifdef _ISOC99_SOURCE
+        printf ("hitag2_init lfsr = %012I64x\n", pstate->lfsr);
+        #else
+        printf ("hitag2_init lfsr = %012" STR(OFF_FORMAT_X) "\n", pstate->lfsr);
+        #endif
+        #endif // DEBUG_HITAG2
+}
+
+// try state
+
+// todo, changes arguments, only what is needed
+bool try_state (uint64_t s, uint32_t uid, uint32_t aR2, uint32_t nR1, uint32_t nR2, uint64_t *key)
+{
+  #if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+	printf ("s : %lu, uid: %u, aR2: %u, nR1: %u, nR2: %u\n", s, uid, aR2, nR1, nR2);
+	fflush (stdout);
+	#endif
+
+	Hitag_State hstate;
+	uint64_t keyrev, nR1xk;
+	uint32_t b = 0;
+
+	hstate.shiftreg = s;
+
+	//rollback(&hstate, 2);
+	hstate.shiftreg = (uint64_t)(((hstate.shiftreg << 1) & 0xffffffffffff) | (uint64_t)fnR(hstate.shiftreg));
+	hstate.shiftreg = (uint64_t)(((hstate.shiftreg << 1) & 0xffffffffffff) | (uint64_t)fnR(hstate.shiftreg));
+
+  #if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+	printf ("shiftreg : %lu\n", hstate.shiftreg);
+	fflush (stdout);
+	#endif
+
+	// recover key
+	keyrev = hstate.shiftreg & 0xffff;
+	nR1xk = (hstate.shiftreg >> 16) & 0xffffffff;
+
+  #if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+	printf ("keyrev: %lu, nR1xk: %lu\n", keyrev, nR1xk);
+	fflush (stdout);
+	#endif
+
+	for (int i = 0; i < 32; i++)
+	{
+		hstate.shiftreg = ((hstate.shiftreg) << 1) | ((uid >> (31 - i)) & 0x1);
+		b = (b << 1) | (unsigned int) fnf(hstate.shiftreg);
+	}
+
+  #if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+	printf ("shiftreg: %lu\n", hstate.shiftreg);
+	fflush (stdout);
+	#endif
+
+	keyrev |= (nR1xk ^ nR1 ^ b) << 16;
+
+  #if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+	printf ("keyrev: %lu\n", keyrev);
+	fflush (stdout);
+	#endif
+
+	// test key
+	hitag2_init (&hstate, keyrev, uid, nR2);
+	if ((aR2 ^ hitag2_nstep (&hstate, 32)) == 0xffffffff)
+	{
+		*key = rev64 (keyrev);
+
+		#if DEBUGME >= 2
+		#if ENABLE_EMOJ == 1
+		printf ("\nKey found ╭☞  ");
+		#else
+		printf ("\nKey found: ");
+		#endif
+		for (int i = 0; i < 6; i++) {
+			printf ("%02X", (uint8_t)(*key & 0xff));
+			*key = *key >> 8;
+		}
+		printf ("\n");
+		#endif
+		return true;
+	}
+
+	return false;
+}
+
+//#endif // FORCE_HITAG2_FULL = 0
diff --git a/tools/hitag2crack/crack5opencl/hitag2.h b/tools/hitag2crack/crack5opencl/hitag2.h
new file mode 100644
index 000000000..cc28e9464
--- /dev/null
+++ b/tools/hitag2crack/crack5opencl/hitag2.h
@@ -0,0 +1,84 @@
+#ifndef HITAG2_H
+#define HITAG2_H
+
+#include <stdint.h>
+#include <stdbool.h>
+
+// as the HITAG2 original implementation, with some minor changes
+
+#define i4(x,a,b,c,d) ((uint32_t)((((x)>>(a))&1)<<3)|(((x)>>(b))&1)<<2|(((x)>>(c))&1)<<1|(((x)>>(d))&1))
+#define f(state) ((0xdd3929b >> ( (((0x3c65 >> i4(state, 2, 3, 5, 6) ) & 1) <<4) \
+                                | ((( 0xee5 >> i4(state, 8,12,14,15) ) & 1) <<3) \
+                                | ((( 0xee5 >> i4(state,17,21,23,26) ) & 1) <<2) \
+                                | ((( 0xee5 >> i4(state,28,29,31,33) ) & 1) <<1) \
+                                | (((0x3c65 >> i4(state,34,43,44,46) ) & 1) ))) & 1)
+
+#define get_bit(n, word) ((word >> (n)) & 1)
+
+/*
+ * Hitag Crypto support macros
+ * These macros reverse the bit order in a byte, or *within* each byte of a
+ * 16 , 32 or 64 bit unsigned integer. (Not across the whole 16 etc bits.)
+ */
+#define rev8(X)   ((((X) >> 7) &1) + (((X) >> 5) &2) + (((X) >> 3) &4) \
+                  + (((X) >> 1) &8) + (((X) << 1) &16) + (((X) << 3) &32) \
+                  + (((X) << 5) &64) + (((X) << 7) &128) )
+#define rev16(X)  (rev8 (X) + (rev8 (X >> 8) << 8))
+#define rev32(X)  (rev16(X) + (rev16(X >> 16) << 16))
+#define rev64(X)  (rev32(X) + (rev32(X >> 32) << 32))
+
+typedef struct
+{
+        uint64_t shiftreg; // naive shift register, required for nonlinear fn input
+        uint64_t lfsr;     // fast lfsr, used to make software faster
+} Hitag_State;
+
+// return a single bit from a value
+int bitn (uint64_t x, int bit);
+
+// the sub-function R that rollback depends upon
+int fnR (uint64_t x);
+
+// the three filter sub-functions that feed fnf
+int fa(unsigned int i);
+
+int fb(unsigned int i);
+
+// the filter function that generates a bit of output from the prng state
+int fnf (uint64_t s);
+
+// macros to pick out 4 bits in various patterns of 1s & 2s & make a new number
+#define pickbits2_2(S, A, B)       ( ((S >> A) & 3) | ((S >> (B - 2)) & 0xC) )
+#define pickbits1x4(S, A, B, C, D) ( ((S >> A) & 1) | ((S >> (B - 1)) & 2) | ((S >> (C - 2)) & 4) | ((S >> (D - 3)) & 8) )
+#define pickbits1_1_2(S, A, B, C)  ( ((S >> A) & 1) | ((S >> (B - 1)) & 2) | ((S >> (C - 2)) & 0xC) )
+#define pickbits2_1_1(S, A, B, C)  ( ((S >> A) & 3) | ((S >> (B - 2)) & 4) | ((S >> (C - 3)) & 8) )
+#define pickbits1_2_1(S, A, B, C)  ( ((S >> A) & 1) | ((S >> (B - 1)) & 6) | ((S >> (C - 3)) & 8) )
+
+uint32_t hitag2_crypt (uint64_t x);
+
+/*
+ * Return up to 32 crypto bits.
+ * Last bit is in least significant bit, earlier bits are shifted left.
+ * Note that the Hitag transmission protocol is least significant bit,
+ * so we may want to change this, or add a function, that returns the
+ * crypto output bits in the other order.
+ *
+ * Parameters:
+ * Hitag_State* pstate - in/out, internal cipher state after initialisation
+ * uint32_t steps      - number of bits requested, (capped at 32)
+ */
+uint32_t hitag2_nstep(Hitag_State *pstate, uint32_t steps);
+
+/*
+ * Parameters:
+ * Hitag_State* pstate - output, internal state after initialisation
+ * uint64_t sharedkey  - 48 bit key shared between reader & tag
+ * uint32_t serialnum  - 32 bit tag serial number
+ * uint32_t initvector - 32 bit random IV from reader, part of tag authentication
+ */
+void hitag2_init (Hitag_State *pstate, uint64_t sharedkey, uint32_t serialnum, uint32_t initvector);
+
+// try_state
+bool try_state (uint64_t s, uint32_t uid, uint32_t aR2, uint32_t nR1, uint32_t nR2, uint64_t *key);
+
+#endif // HITAG2_H
diff --git a/tools/hitag2crack/crack5opencl/ht2crack5opencl.c b/tools/hitag2crack/crack5opencl/ht2crack5opencl.c
new file mode 100644
index 000000000..234f23a36
--- /dev/null
+++ b/tools/hitag2crack/crack5opencl/ht2crack5opencl.c
@@ -0,0 +1,2036 @@
+/* ht2crack5opencl.c
+ * This code is heavily based on the crack5gpu.
+ *
+ * Additional changes done by Gabriele 'matrix' Gristina <gabriele.gristina@gmail.com>
+ *  - Using optimized OpenCL kernel (ht2crack5opencl_kernel.cl)
+ *  - Rewriting OpenCL host code
+ *  - Add OpenCL Platforms/Devices enumeration, used to selectively enable kernel optimizations
+ *  - Support Multi-Platform (GPU & CPU), using custom async or sequential thread engine, and queue
+ *  - Reduce memory read from OpenCL device to host (for each iteration only the exact number of candidates are read, instead of a big buffer)
+ *  - Support 'Computing Profiles', to fine-tune workloads based on available resources
+ *  - Support HiTag2 Key check on device.
+ *    In this case reduce a lot the memory in use but but it loses on performance ~1 sec
+ *    (with GeForce GTX 1080 Ti, 70.449128 vs 71.062680 (Slice 4043/4096))
+ */
+
+#include <stdint.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <inttypes.h>
+#include <pthread.h>
+#include <fcntl.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <errno.h>
+#include <sys/time.h>
+#include <getopt.h>
+
+#include "ht2crack5opencl.h"
+#include "queue.h"
+#include "threads.h"
+#include "opencl.h"
+#include "hitag2.h"
+#include "dolphin_macro.h"
+
+#define MAX_BITSLICES 32
+#define VECTOR_SIZE (MAX_BITSLICES/8)
+
+typedef unsigned int __attribute__((aligned(VECTOR_SIZE))) __attribute__((vector_size(VECTOR_SIZE))) bitslice_value_t;
+typedef union {
+	bitslice_value_t value;
+	uint8_t bytes[MAX_BITSLICES / 8];
+} bitslice_t;
+
+static bitslice_t keystream[32];
+
+//uint64_t candidates[(1 << 20)];
+// Reduce type size of candidates array to fit OpenCL
+static uint16_t candidates[(1 << 20) * 3];
+
+// compute profile constants, from low to high workloads
+static unsigned int profiles[11][2] =
+{
+	{ 16384, 5 }, // 0, best for Intel GPU's with Neo
+	{ 8192,  6 }, // 1, only for Intel NEO
+	{ 4096,  7 }, // 2 (old 0) seems the best for all others (also NVIDIA) :D Apple/Intel GPU's stable here
+	{ 2048,  8 }, // 3 (old 1) usefull for any kind of CPU's
+	{ 1024,  9 },
+	{ 512,  10 },
+	{ 256,  11 },
+	{ 128,  12 }, // 7, (old 5) the last good value with NVIDIA GPU's
+	{ 64,   13 },
+	{ 32,   14 },
+	{ 16,   15 },
+};
+
+static uint64_t expand (uint64_t mask, uint64_t value)
+{
+	uint64_t fill = 0;
+
+	for (uint64_t bit_index = 0; bit_index < 48; bit_index++)
+	{
+		if (mask & 1)
+		{
+			fill |= (value & 1) << bit_index;
+			value >>= 1;
+		}
+		mask >>= 1;
+	}
+
+	return fill;
+}
+
+static void bitslice (const uint64_t value, bitslice_t *restrict bitsliced_value)
+{
+	// set constants
+	bitslice_t bs_zeroes, bs_ones;
+	memset (bs_ones.bytes, 0xff, VECTOR_SIZE);
+	memset (bs_zeroes.bytes, 0x00, VECTOR_SIZE);
+
+	for (size_t bit_idx = 0; bit_idx < 32; bit_idx++)
+	{
+		const bool bit = get_bit(32 - 1 - bit_idx, value);
+		bitsliced_value[bit_idx].value = (bit) ? bs_ones.value : bs_zeroes.value;
+	}
+}
+
+// convert byte-reversed 8 digit hex to unsigned long
+static unsigned long hexreversetoulong (char *hex) {
+	unsigned long ret = 0L;
+	unsigned int x;
+	char i;
+
+	if (strlen(hex) != 8)
+		return 0L;
+
+	for (i = 0 ; i < 4 ; ++i) {
+		if (sscanf(hex, "%2X", &x) != 1)
+			return 0L;
+		ret += ((unsigned long) x) << i * 8;
+		hex += 2;
+	}
+	return ret;
+}
+
+#if ENABLE_EMOJ == 1
+static const char *emoj[3][2] = { {"∩","つ"}, {"つ","⊃"}, {"⊃","੭ " } };
+#endif
+
+__attribute__((noreturn))
+static void usage (char *name)
+{
+	printf ("%s [options] {UID} {nR1} {aR1} {nR2} {aR2}\n\n" \
+		"Options:\n"
+		"-p     : select OpenCL Platform(s). Multiple allowed (1,2,3,etc.). [Default: all]\n"
+		"-d     : select OpenCL Device(s). Multiple allowed (1,2,3,etc.). [Default: all]\n"
+		"-D     : select OpenCL Device Type. 0: GPU, 1: CPU, 2: all. [Default: GPU]\n"
+		"-S     : select the thread scheduler type. 0: sequential, 1: asynchronous. [Default 1]\n"
+		"-P     : select the Profile, from 0 to 10. [Default: auto-tuning]\n"
+		"-F     : force verify key with OpenCL instead of CPU. [Default: disabled]\n"
+		"-Q     : select queue engine. 0: forward, 1: reverse, 2: random. [Default: 0]\n"
+		"-s     : show the list of OpenCL platforms/devices, then exit\n"
+		"-V     : enable debug messages\n"
+		"-v     : show the version\n"
+		"-h     : show this help\n\n", name);
+
+	printf ("Example, select devices 1, 2 and 3 using platform 1 and 2, with random queue engine:\n\n"
+		"%s -D 2 -Q 2 -p 1,2 -d 1,2,3 2ab12bf2 4B71E49D 6A606453 D79BD94B 16A2255B\n\n", name);
+
+	exit (8);
+}
+
+static bool parse_arg (char * restrict in, unsigned int *out, unsigned int *out_cnt, const int opt_type)
+{
+	unsigned int cnt = 0;
+
+	if (in == NULL)
+	{
+		out[cnt++] = 0xff;
+		*out_cnt = cnt;
+	}
+	else
+	{
+		if (strchr (in, ','))
+		{
+			// multiple values
+			char *saveptr = NULL;
+			char *next = strtok_r (in, ",", &saveptr);
+
+			do
+			{
+				unsigned int tmp_sel = (unsigned int) strtoul (next, NULL, 10);
+				if (errno == EINVAL || errno == ERANGE ||
+						(tmp_sel < 1 || tmp_sel > 16))
+				{
+					printf ("! Invalid %s argument\n", (opt_type == 0) ? "'platform'" : "'device'");
+					return false;
+				}
+
+				out[cnt++] = tmp_sel;
+
+			} while ((next = strtok_r (NULL, ",", &saveptr)) != NULL);
+
+			*out_cnt = cnt;
+
+			// todo: sort, uniq
+		}
+		else
+		{
+			out[0] = (unsigned int) strtoul (in, NULL, 10);
+			if (errno == EINVAL || errno == ERANGE)
+			{
+				printf ("! Invalid %s argument\n", (opt_type == 0) ? "'platform'" : "'device'");
+				return false;
+			}
+			*out_cnt = 1;
+		}
+	}
+
+	return true;
+}
+
+int main (int argc, char **argv)
+{
+	opencl_ctx_t ctx;
+
+	uint32_t uid = 0, nR1 = 0, aR1 = 0, nR2 = 0, aR2 = 0;
+	bool opencl_profiling = 0;
+	bool force_hitag2_opencl = false;
+	bool verbose = false;
+	bool show = false;
+
+	char *platforms_selected = NULL;
+	char *devices_selected = NULL;
+	unsigned int device_types_selected = 2;
+	unsigned int thread_scheduler_type_selected = THREAD_TYPE_ASYNC;
+	unsigned int profile_selected = 2;
+	unsigned int queue_type = 0;
+
+	uint32_t target = 0;
+	uint32_t **matches_found = NULL;
+	uint64_t **matches = NULL;
+
+	int opt;
+
+	while ((opt = getopt (argc, argv, "p:d:D:S:P:F:Q:svVh")) != -1)
+	{
+		switch (opt)
+		{
+			case 'p':
+					// 1, 2, 3, etc ..
+					platforms_selected = strdup (optarg);
+					break;
+			case 'd':
+					// 1, 2, 3, etc ...
+					devices_selected = strdup (optarg);
+					break;
+			case 'D':
+					// 0: gpu, 1: cpu, 2: all
+					device_types_selected = (unsigned int) strtoul (optarg, NULL, 10);
+					if (device_types_selected > 2)
+					{
+						printf ("! Invalid DEVICE TYPE argument (accepted values: from 0 to 2)\n");
+						usage (argv[0]);
+					}
+					break;
+			case 'S':
+					// 0: sequential, 1: async
+					thread_scheduler_type_selected = (unsigned int) strtoul (optarg, NULL, 10);
+					break;
+			case 'P':
+					profile_selected = (unsigned int) strtoul (optarg, NULL, 10);
+					if (profile_selected > 10)
+					{
+						printf ("! Invalid PROFILE argument (accepted valuee: from 0 to 10)\n");
+						usage (argv[0]);
+					}
+					break;
+			case 'F':
+					force_hitag2_opencl = true;
+					break;
+			case 'Q':
+					// 0: forward, 1: reverse, 2: random
+					queue_type = (unsigned int) strtoul (optarg, NULL, 10);
+					if (queue_type != QUEUE_TYPE_FORWARD && queue_type != QUEUE_TYPE_REVERSE && queue_type != QUEUE_TYPE_RANDOM)
+					{
+						printf ("! Invalid QUEUE TYPE argument (accepted values: 0, 1 or 2)\n");
+						usage (argv[0]);
+					}
+					break;
+			case 's':
+					show = true;
+					break;
+			case 'V':
+					verbose = true;
+					break;
+			case 'v':
+					printf ("Version: %s\n", VERSION);
+					exit (0);
+			case 'h':
+			default:
+					usage (argv[0]);
+		}
+	}
+
+	unsigned int plat_sel[16] = { 0 };
+	unsigned int plat_cnt = 0;
+	unsigned int dev_sel[16] = { 0 };
+	unsigned int dev_cnt = 0;
+
+	if (!parse_arg (platforms_selected, plat_sel, &plat_cnt, 0))
+	{
+		free (platforms_selected);
+		usage (argv[0]);
+	}
+
+	if (!parse_arg (devices_selected, dev_sel, &dev_cnt, 1))
+	{
+		free (platforms_selected);
+		free (devices_selected);
+		usage (argv[0]);
+	}
+
+	free (platforms_selected);
+	free (devices_selected);
+
+	if (device_types_selected == 0) device_types_selected = CL_DEVICE_TYPE_GPU;
+	else if (device_types_selected == 1) device_types_selected = CL_DEVICE_TYPE_CPU;
+	else device_types_selected = CL_DEVICE_TYPE_ALL;
+
+	if (show)
+	{
+		plat_sel[0] = 0xff;
+		dev_sel[0] = 0xff;
+		device_types_selected = CL_DEVICE_TYPE_ALL;
+	}
+
+	if (verbose)
+	{
+		if (plat_sel[0] == 0xff) printf ("Platforms selected    : ALL\n");
+		else
+		{
+			printf ("Platforms selected    : %u", plat_sel[0]);
+			for (unsigned int i = 1; i < plat_cnt; i++) printf (", %u", plat_sel[i]);
+			printf ("\n");
+		}
+
+		if (dev_sel[0] == 0xff)	printf ("Devices selected      : ALL\n");
+		else
+		{
+			printf ("Devices selected      : %u", dev_sel[0]);
+			for (unsigned int i = 1; i < dev_cnt; i++) printf (", %u", dev_sel[i]);
+			printf ("\n");
+		}
+
+		printf ("Device types selected : %s\n", (device_types_selected == CL_DEVICE_TYPE_GPU) ? "GPU" : (device_types_selected == CL_DEVICE_TYPE_CPU) ? "CPU" : "ALL");
+		printf ("Scheduler selected    : %s\n", (thread_scheduler_type_selected == 0) ? "sequential" : "async");
+		printf ("Profile selected      : %d\n", profile_selected);
+	}
+
+	if (!show)
+	{
+		if ((argc - optind) < 5)
+		{
+			#if DEBUGME > 0
+			printf ("! Invalid extra arguments\n");
+			#endif
+			usage (argv[0]);
+		}
+
+		for (int e = 0; e < 5; optind++, e++)
+		{
+			switch (e)
+			{
+				case 0: // UID
+					if (!strncmp (argv[optind], "0x", 2) || !strncmp (argv[optind], "0X", 2))
+					{
+						if (strlen(argv[optind]) != 2+8) { printf ("! Invalid UID length\n"); usage (argv[0]); }
+						uid = (uint32_t) rev32 (hexreversetoulong(argv[optind] + 2));
+					}
+					else
+					{
+						if (strlen(argv[optind]) != 8) { printf ("! Invalid UID length\n"); usage (argv[0]); }
+						uid = (uint32_t) rev32 (hexreversetoulong(argv[optind]));
+					}
+					break;
+
+				case 1: // nR1
+					if (!strncmp (argv[optind], "0x", 2) || !strncmp (argv[optind], "0X", 2))
+					{
+						if (strlen(argv[optind]) != 2+8) { printf ("! Invalid nR1 length\n"); usage (argv[0]); }
+						nR1 = (uint32_t) rev32 (hexreversetoulong(argv[optind] + 2));
+					}
+					else
+					{
+						if (strlen(argv[optind]) != 8) { printf ("! Invalid nR1 length\n"); usage (argv[0]); }
+						nR1 = (uint32_t) rev32 (hexreversetoulong(argv[optind]));
+					}
+					break;
+
+				case 2: // aR1
+					if (strlen(argv[optind]) != 8) { printf ("! Invalid aR1 length\n"); usage (argv[0]); }
+					aR1 = (uint32_t) strtoul (argv[optind], NULL, 16);
+					break;
+
+				case 3: // nR2
+					if (!strncmp (argv[optind], "0x", 2) || !strncmp (argv[optind], "0X", 2))
+					{
+						if (strlen(argv[optind]) != 2+8) { printf ("! Invalid nR2 length\n"); usage (argv[0]); }
+						nR2 = (uint32_t) rev32 (hexreversetoulong(argv[optind] + 2));
+					}
+					else
+					{
+						if (strlen(argv[optind]) != 8) { printf ("! Invalid nR2 length\n"); usage (argv[0]); }
+						nR2 = (uint32_t) rev32 (hexreversetoulong(argv[optind]));
+					}
+					break;
+
+				case 4: // aR2
+					if (strlen(argv[optind]) != 8) { printf ("! Invalid aR2 length\n"); usage (argv[0]); }
+					aR2 = (uint32_t) strtoul (argv[optind], NULL, 16);
+					break;
+
+				default: // skip invalid instead of show usage and exit
+					optind = argc;
+					break;
+			}
+		}
+	}
+
+	memset (&ctx, 0, sizeof (opencl_ctx_t));
+	memset (keystream, 0, sizeof (keystream));
+	memset (candidates, 0, sizeof (candidates));
+
+	ctx.profiling = opencl_profiling;
+	ctx.thread_sched_type = (short) thread_scheduler_type_selected;
+	ctx.force_hitag2_opencl = force_hitag2_opencl;
+
+	uint32_t checks[4] = { uid, aR2, nR1, nR2 };
+
+	if (!show)
+	{
+		if (verbose) printf ("uid: %u, aR2: %u, nR1: %u, nR2: %u\n", checks[0], checks[1], checks[2], checks[3]);
+
+		target = ~aR1;
+		// bitslice inverse target bits
+		bitslice (~target, keystream);
+
+		size_t layer_0_found = 0;
+
+		// compute layer 0 output
+		for (size_t i0 = 0; i0 < 1 << 20; i0++)
+		{
+			uint64_t state0 = expand (0x5806b4a2d16c, i0);
+
+			if (f(state0) == target >> 31)
+			{
+				// using uint64_t
+				// candidates[layer_0_found++] = state0;
+				// or
+				// cf kernel, state is now split in 3 shorts >> 2
+				candidates[(layer_0_found * 3) + 0] = (uint16_t)((state0 >> (32 + 2)) & 0xffff);
+				candidates[(layer_0_found * 3) + 1] = (uint16_t)((state0 >> (16 + 2)) & 0xffff);
+				candidates[(layer_0_found * 3) + 2] = (uint16_t)((state0 >> (0 + 2)) & 0xffff);
+				layer_0_found++;
+			}
+		}
+
+		#if DEBUGME >= 1
+		printf ("[debug] layer_0_found: %zu\n", layer_0_found);
+		#endif
+	}
+
+	// powered by dolphin's macros :)
+	int freeListIdx = 0;
+
+	// todo, calculate the max number of allocations to remove 0x40
+	void **freeList = (void **) malloc (0x40 * sizeof(void *));
+	if (!freeList)
+	{
+		printf ("Error: malloc (freeList) failed (%d): %s\n", errno, strerror (errno));
+		exit (3);
+	}
+
+	if (!show)
+	{
+		// load OpenCL kernel source
+		struct stat st;
+		const char *opencl_kernel = "ht2crack5opencl_kernel.cl";
+
+		int fd = open (opencl_kernel, O_RDONLY);
+		if (fd <= 0) {
+			printf ("Error: open (%s) failed (%d): %s\n", opencl_kernel, errno, strerror (errno));
+			exit (3);
+		}
+
+		if (fstat (fd, &st)) {
+			printf ("Error: stat (%s) failed (%d): %s\n", opencl_kernel, errno, strerror (errno));
+			close (fd);
+			exit (3);
+		}
+
+		ctx.kernelSource_len = (size_t) st.st_size;
+		ctx.kernelSource[0]  = (char *) calloc (ctx.kernelSource_len + 1, sizeof (char)); // size + \0
+		if (!ctx.kernelSource[0]) {
+			printf ("Error: calloc (ctx.kernelSource[0]) failed (%d): %s\n", errno, strerror (errno));
+			exit (3);
+		}
+
+		MEMORY_FREE_ADD(ctx.kernelSource[0])
+
+		if (read (fd, ctx.kernelSource[0], ctx.kernelSource_len) < (ssize_t) ctx.kernelSource_len)
+		{
+			printf ("Error: read (%s) failed (%d): %s\n", opencl_kernel, errno, strerror (errno));
+			close (fd);
+			MEMORY_FREE_ALL
+			exit (3);
+		}
+
+		ctx.kernelSource[0][ctx.kernelSource_len] = '\0';
+
+		close (fd);
+	}
+
+	// now discover and set up compute device(s)
+	int err = 0;
+	cl_uint ocl_platform_cnt = 0;
+	unsigned int ocl_platform_max = MAX_OPENCL_DEVICES; // 16
+
+	cl_platform_id *ocl_platforms = (cl_platform_id *) calloc (ocl_platform_max, sizeof (cl_platform_id));
+	if (!ocl_platforms)
+	{
+		printf ("Error: calloc (ocl_platforms) failed (%d): %s\n", errno, strerror (errno));
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	MEMORY_FREE_ADD(ocl_platforms)
+
+	// enum platforms
+	err = clGetPlatformIDs (ocl_platform_max, ocl_platforms, &ocl_platform_cnt);
+	if (err != CL_SUCCESS) {
+		printf ("Error: clGetPlatformIDs() failed (%d)\n", err);
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	if (ocl_platform_cnt == 0) {
+		printf ("No platforms found, exit\n");
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	// allocate memory to hold info about platforms/devices
+	compute_platform_ctx_t *cd_ctx = (compute_platform_ctx_t *) calloc (ocl_platform_cnt, sizeof (compute_platform_ctx_t));
+	if (!cd_ctx) {
+		printf ("Error: calloc (compute_platform_ctx_t) failed (%d): %s\n", errno, strerror (errno));
+		MEMORY_FREE_ALL
+		exit (err);
+	}
+
+	MEMORY_FREE_ADD(cd_ctx)
+
+	cl_platform_info ocl_platforms_info[3] = { CL_PLATFORM_NAME, CL_PLATFORM_VENDOR, CL_PLATFORM_VERSION };
+	unsigned int ocl_platforms_info_cnt = sizeof (ocl_platforms_info) / sizeof (cl_platform_info);
+
+	cl_device_info ocl_devices_info[8] = { CL_DEVICE_TYPE, CL_DEVICE_NAME, CL_DEVICE_VERSION, CL_DRIVER_VERSION, CL_DEVICE_VENDOR, CL_DEVICE_LOCAL_MEM_TYPE, CL_DEVICE_MAX_WORK_ITEM_SIZES, CL_DEVICE_MAX_COMPUTE_UNITS };
+	unsigned int ocl_devices_info_cnt = sizeof (ocl_devices_info) / sizeof (cl_device_info);
+
+	unsigned int info_idx = 0;
+	size_t tmp_len = 0;
+	char *tmp_buf = NULL;
+
+	unsigned int global_device_id = 0;
+	size_t selected_platforms_cnt = 0;
+	size_t selected_devices_cnt = 0;
+
+	if (show) verbose = true;
+
+	if (verbose) printf ("- Found %u OpenCL Platform(s)\n", ocl_platform_cnt);
+
+	for (cl_uint platform_idx = 0; platform_idx < ocl_platform_cnt; platform_idx++)
+	{
+		cd_ctx[platform_idx].platform_id = ocl_platforms[platform_idx];
+		cd_ctx[platform_idx].selected = plat_dev_enabled (platform_idx, plat_sel, plat_cnt, 0, 0);
+
+		if (cd_ctx[platform_idx].selected) selected_platforms_cnt++;
+
+		if (verbose) printf ("\n-- Platform ID: %d\n", platform_idx+1);
+
+		for (info_idx = 0; info_idx < ocl_platforms_info_cnt; info_idx++)
+		{
+			cl_platform_info ocl_info = ocl_platforms_info[info_idx];
+
+			err = clGetPlatformInfo (cd_ctx[platform_idx].platform_id, ocl_info, 0, NULL, &tmp_len);
+			if (err != CL_SUCCESS) {
+				printf ("Error: clGetPlatformInfo(param size) failed (%d)\n", err);
+				MEMORY_FREE_ALL
+				exit (2);
+			}
+
+			if (tmp_len > 0)
+			{
+				if (!(tmp_buf = (char *) calloc (tmp_len, sizeof (char))))
+				{
+					printf ("Error: calloc (ocl_info %u) failed (%d): %s\n", info_idx, errno, strerror (errno));
+					MEMORY_FREE_ALL
+					exit (2);
+				}
+
+				MEMORY_FREE_ADD(tmp_buf)
+
+				err = clGetPlatformInfo (cd_ctx[platform_idx].platform_id, ocl_info, tmp_len, tmp_buf, 0);
+				if (err != CL_SUCCESS) {
+					printf ("Error: clGetPlatformInfo(param) failed (%d)\n", err);
+					MEMORY_FREE_ALL
+					exit (2);
+				}
+			}
+			else
+			{
+				tmp_len = 4;
+				if (!(tmp_buf = (char *) calloc (tmp_len, sizeof (char))))
+				{
+					printf ("Error: calloc (ocl_info %u) failed (%d): %s\n", info_idx, errno, strerror (errno));
+					MEMORY_FREE_ALL
+					exit (2);
+				}
+
+				MEMORY_FREE_ADD(tmp_buf)
+
+				strncpy (tmp_buf, "N/A\0", tmp_len);
+			}
+
+			if (verbose)
+			{
+				const char *tmp_info_desc = (info_idx == 0) ? "Name" : (info_idx == 1) ? "Vendor" : "Version";
+
+				printf ("%14s: %s\n", tmp_info_desc, tmp_buf);
+			}
+
+			switch (info_idx)
+			{
+				case 0:
+					strncpy(cd_ctx[platform_idx].name, tmp_buf, tmp_len < 0xff ? tmp_len : 0xff-1);
+					break;
+				case 1:
+					strncpy(cd_ctx[platform_idx].vendor, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40-1);
+					break;
+				case 2:
+					strncpy(cd_ctx[platform_idx].version, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40-1);
+					break;
+			}
+
+			if (info_idx == 1)
+			{
+				// todo: do the same this devices
+				if (!strncmp (tmp_buf, "NVIDIA", 6)) cd_ctx[platform_idx].is_nv = true;
+				else if (!strncmp (tmp_buf, "Apple", 5)) { cd_ctx[platform_idx].is_apple = true; cd_ctx[platform_idx].warning = true; }
+				else if (!strncmp (tmp_buf, "Intel", 5)) cd_ctx[platform_idx].is_intel = true;
+			}
+
+			MEMORY_FREE_DEL(tmp_buf)
+		}
+
+		if (!show && verbose)
+		{
+			printf ("%14s: %s\n", "Selected", (cd_ctx[platform_idx].selected) ? "yes" : "no");
+			if (cd_ctx[platform_idx].warning) printf ("\n%14s: performance will not be optimal using this platform\n\n", "=====> Warning");
+		}
+
+		// enum devices with this platform
+		unsigned int ocl_device_cnt = 0;
+		unsigned int ocl_device_max = MAX_OPENCL_DEVICES;
+
+		cl_device_id *ocl_devices = (cl_device_id *) calloc (ocl_device_max, sizeof (cl_device_id));
+		if (!ocl_devices) {
+			printf ("Error: calloc (ocl_devices) failed (%d): %s\n", errno, strerror (errno));
+			MEMORY_FREE_ALL
+			exit (2);
+		}
+
+		MEMORY_FREE_ADD(ocl_devices)
+
+		err = clGetDeviceIDs (cd_ctx[platform_idx].platform_id, CL_DEVICE_TYPE_ALL, ocl_device_max, ocl_devices, &ocl_device_cnt);
+		if (ocl_device_cnt == 0)
+		{
+			if (device_types_selected == CL_DEVICE_TYPE_ALL) printf ("No device(s) available with platform id %d\n", platform_idx);
+			cd_ctx[platform_idx].device_cnt = 0;
+			continue;
+		}
+
+		if (err != CL_SUCCESS) {
+			printf ("Error: clGetDeviceIDs(cnt) failed (%d)\n", err);
+			MEMORY_FREE_ALL
+			exit (2);
+		}
+
+		if (verbose) printf ("%14s: %u\n", "Device(s)", ocl_device_cnt);
+
+		cd_ctx[platform_idx].device_cnt = ocl_device_cnt;
+
+		for (unsigned int device_idx = 0; device_idx < ocl_device_cnt; device_idx++)
+		{
+			memset (&cd_ctx[platform_idx].device[device_idx], 0, sizeof (compute_device_ctx_t));
+			cl_device_id ocl_device = ocl_devices[device_idx];
+			cd_ctx[platform_idx].device[device_idx].platform_id = cd_ctx[platform_idx].platform_id;
+
+			if (verbose) printf ("---- * ID: %u\n", global_device_id+1);
+
+			for (info_idx = 0; info_idx < ocl_devices_info_cnt; info_idx++)
+			{
+				cl_device_info ocl_dev_info = ocl_devices_info[info_idx];
+
+				if (info_idx == 0)
+				{
+					cl_device_type device_type;
+
+					err = clGetDeviceInfo (ocl_device, ocl_dev_info, sizeof (cl_device_type), &device_type, 0);
+					if (err != CL_SUCCESS) {
+						printf ("Error: clGetDeviceInfo(device_type) failed (%d)\n", err);
+						MEMORY_FREE_ALL
+						exit (2);
+					}
+
+					if (device_type & CL_DEVICE_TYPE_GPU) cd_ctx[platform_idx].device[device_idx].is_gpu = 1;
+
+					if (verbose) printf ("%14s: %s\n", "Device Type", (device_type & CL_DEVICE_TYPE_GPU) ? "GPU" : (device_type & CL_DEVICE_TYPE_CPU ) ? "CPU" : "Other");
+
+					cd_ctx[platform_idx].device[device_idx].selected = plat_dev_enabled (global_device_id, dev_sel, dev_cnt, (unsigned int) device_type, device_types_selected);
+					global_device_id++;
+					if (cd_ctx[platform_idx].device[device_idx].selected) selected_devices_cnt++;
+					continue;
+				}
+				else if (info_idx == 5)
+				{
+					cl_device_local_mem_type local_mem_type;
+
+					err = clGetDeviceInfo (ocl_device, ocl_dev_info, sizeof (cl_device_local_mem_type), &local_mem_type, 0);
+					if (err != CL_SUCCESS) {
+						printf ("Error: clGetDeviceInfo(local_mem_type) failed (%d)\n", err);
+						MEMORY_FREE_ALL
+						exit (2);
+					}
+
+					if (local_mem_type == CL_LOCAL || local_mem_type == CL_GLOBAL)
+					{
+						if (verbose) printf ("%14s: %s\n", "Local Mem Type", (local_mem_type == CL_LOCAL) ? "Local" : "Global");
+
+						if (cd_ctx[platform_idx].is_apple)
+						{
+							if (strncmp (cd_ctx[platform_idx].device[device_idx].vendor, "Intel", 5) != 0) cd_ctx[platform_idx].device[device_idx].have_local_memory = true;
+						}
+						else if (cd_ctx[platform_idx].is_nv) cd_ctx[platform_idx].device[device_idx].have_local_memory = true;
+/*
+						// swap the 'if' comment for enable local memory with apple gpu's (my Iris crash, abort 6)
+						// if (!(!strncmp (cd_ctx[platform_idx].device[device_idx].vendor, "Intel", 5) && cd_ctx[platform_idx].is_apple && !cd_ctx[platform_idx].device[device_idx].is_gpu))
+						if (!(!strncmp (cd_ctx[platform_idx].device[device_idx].vendor, "Intel", 5) && cd_ctx[platform_idx].is_apple))
+						{
+							cd_ctx[platform_idx].device[device_idx].have_local_memory = true;
+						}
+*/
+					}
+					else
+					{
+						if (verbose) printf ("%14s: None\n", "Local Mem Type");
+					}
+
+					if (verbose) printf ("%14s: %s\n", "Local Mem Opt", (cd_ctx[platform_idx].device[device_idx].have_local_memory) ? "yes" : "no");
+
+					continue;
+				}
+				else if (info_idx == 6)
+				{
+					size_t wis[3] = { 0 };
+					err = clGetDeviceInfo (ocl_device, ocl_dev_info, sizeof (size_t) * 3, wis, 0);
+					if (err != CL_SUCCESS) {
+						printf ("Error: clGetDeviceInfo(work_items_size) failed (%d)\n", err);
+						MEMORY_FREE_ALL
+						exit (2);
+					}
+
+					if (verbose) printf ("%14s: (%zu,%zu,%zu)\n", "Max Work-Items", wis[0], wis[1], wis[2]);
+
+					#if APPLE_GPU_BROKEN == 1
+					if (wis[1] < GLOBAL_WS_1 && cd_ctx[platform_idx].device[device_idx].is_apple_gpu)
+					{
+						cd_ctx[platform_idx].device[device_idx].unsupported = true;
+					}
+					#endif
+					continue;
+				}
+				else if (info_idx == 7)
+				{
+					cl_uint cores = 0;
+					err = clGetDeviceInfo (ocl_device, ocl_dev_info, sizeof (cl_uint), &cores, 0);
+					if (err != CL_SUCCESS) {
+						printf ("Error: clGetDeviceInfo(compute_units) failed (%d)\n", err);
+						MEMORY_FREE_ALL
+						exit (2);
+					}
+
+					if (verbose) printf ("%14s: %u\n", "Compute Units", cores);
+
+					cd_ctx[platform_idx].device[device_idx].compute_units = cores;
+					continue;
+				}
+
+				tmp_len = 0;
+				tmp_buf = NULL;
+
+				err = clGetDeviceInfo (ocl_device, ocl_dev_info, 0, NULL, &tmp_len);
+				if (err != CL_SUCCESS) {
+					printf ("Error: clGetDeviceInfo(param size) failed (%d)\n", err);
+					MEMORY_FREE_ALL
+					exit (2);
+				}
+
+				if (tmp_len > 0)
+				{
+					if (!(tmp_buf = (char *) calloc (tmp_len, sizeof (char))))
+					{
+						printf ("Error: calloc (ocl_dev_info %u) failed (%d): %s\n", info_idx, errno, strerror (errno));
+						MEMORY_FREE_ALL
+						exit (2);
+					}
+
+					MEMORY_FREE_ADD(tmp_buf)
+
+					err = clGetDeviceInfo (ocl_device, ocl_dev_info, tmp_len, tmp_buf, 0);
+					if (err != CL_SUCCESS) {
+						printf ("Error: clGetDeviceInfo(param) failed (%d)\n", err);
+						MEMORY_FREE_ALL
+						exit (2);
+					}
+				}
+				else
+				{
+					tmp_len = 4;
+					if (!(tmp_buf = (char *) calloc (tmp_len, sizeof (char))))
+					{
+						printf ("Error: calloc (ocl_dev_info %u) failed (%d): %s\n", info_idx, errno, strerror (errno));
+						MEMORY_FREE_ALL
+						exit (2);
+					}
+
+					MEMORY_FREE_ADD(tmp_buf)
+
+					strncpy (tmp_buf, "N/A\0", tmp_len);
+				}
+
+				if (verbose)
+				{
+					const char *tmp_dev_info_desc = (info_idx == 1) ? "Name" : (info_idx == 2) ? "Version" : (info_idx == 3) ? "Driver Version" : "Vendor";
+
+					printf ("%14s: %s\n", tmp_dev_info_desc, tmp_buf);
+				}
+
+				switch (info_idx)
+				{
+					case 1:
+						strncpy (cd_ctx[platform_idx].device[device_idx].name, tmp_buf, tmp_len < 0xff ? tmp_len : 0xff-1);
+						break;
+					case 2:
+						strncpy (cd_ctx[platform_idx].device[device_idx].version, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40-1);
+						break;
+					case 3:
+						strncpy (cd_ctx[platform_idx].device[device_idx].driver_version, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40-1);
+						break;
+					case 4:
+						strncpy (cd_ctx[platform_idx].device[device_idx].vendor, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40-1);
+						break;
+				}
+
+				if (info_idx == 4)
+				{
+					if (!strncmp (tmp_buf, "Intel", 5) && cd_ctx[platform_idx].is_apple)
+					{
+						// disable hitag2 with apple platform and not apple device vendor (< Apple M1)
+						ctx.force_hitag2_opencl = false;
+
+						cd_ctx[platform_idx].device[device_idx].is_apple_gpu = cd_ctx[platform_idx].device[device_idx].is_gpu;
+					}
+
+					if (!strncmp (tmp_buf, "NVIDIA", 6) && cd_ctx[platform_idx].is_nv)
+					{
+						unsigned int sm_maj = 0, sm_min = 0;
+
+						err  = clGetDeviceInfo (ocl_device, 0x4000, sizeof (unsigned int), &sm_maj, 0);
+						err |= clGetDeviceInfo (ocl_device, 0x4001, sizeof (unsigned int), &sm_min, 0);
+
+						if (err != CL_SUCCESS) {
+							printf ("Error: clGetDeviceInfo(sm_maj/sm_min) failed (%d)\n", err);
+							MEMORY_FREE_ALL
+							exit (2);
+						}
+
+						cd_ctx[platform_idx].device[device_idx].sm_maj = sm_maj;
+						cd_ctx[platform_idx].device[device_idx].sm_min = sm_min;
+
+						if (verbose) printf ("%14s: %u%u\n", "SM", sm_maj, sm_min);
+
+						if (sm_maj >= 5) // >= Maxwell
+						{
+							// https://docs.nvidia.com/cuda/parallel-thread-execution/index.html#logic-and-shift-instructions-lop3
+							// Requires sm_50 or higher.
+							cd_ctx[platform_idx].device[device_idx].have_lop3 = true;
+						}
+						else
+						{
+							cd_ctx[platform_idx].device[device_idx].warning = true;
+						}
+
+						cd_ctx[platform_idx].device[device_idx].is_nv = true;
+					}
+					else
+					{
+						cd_ctx[platform_idx].device[device_idx].warning = true;
+					}
+				}
+
+				MEMORY_FREE_DEL(tmp_buf)
+			}
+
+			if (!show && verbose) printf ("%14s: %s\n", "Selected", (cd_ctx[platform_idx].device[device_idx].selected) ? "yes" : "no");
+
+			if (cd_ctx[platform_idx].device[device_idx].unsupported)
+			{
+				printf ("\n%14s: this device was not supported, beacuse of missing resources\n\n", "=====> Warning");
+				continue;
+			}
+
+			if (cd_ctx[platform_idx].device[device_idx].warning)
+			{
+				if (!show && verbose) printf ("\n%14s: performance will not be optimal using this device\n\n", "=====> Warning");
+			}
+
+			cd_ctx[platform_idx].device[device_idx].device_id = ocl_device;
+		}
+		MEMORY_FREE_DEL(ocl_devices)
+	}
+	MEMORY_FREE_DEL(ocl_platforms)
+
+	// new selection engine, need to support multi-gpu system (with the same platform)
+
+	if (verbose) printf ("\n");
+
+	if (show)
+	{
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	if (selected_platforms_cnt == 0)
+	{
+		printf ("! No platform was selected ...\n");
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	if (selected_devices_cnt == 0)
+	{
+		printf ("! No device(s) was selected ...\n");
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	size_t w = 0, q = 0, g = 0;
+
+	size_t z = 0; // z is a dolphin's friend
+
+	// show selected devices
+
+	printf ("Selected %zu OpenCL Device(s)\n\n", selected_devices_cnt);
+
+	for (w = 0; w < ocl_platform_cnt; w++)
+	{
+		if (!cd_ctx[w].selected) continue;
+
+		for (q = 0; q < cd_ctx[w].device_cnt; q++)
+		{
+			if (!cd_ctx[w].device[q].selected) continue;
+
+			printf ("%2zu - %s", z, cd_ctx[w].device[q].name);
+			if (verbose)
+			{
+				printf (" (Lop3 %s, ", (cd_ctx[w].device[q].have_lop3) ? "yes" : "no");
+				printf ("Local Memory %s)", (cd_ctx[w].device[q].have_local_memory) ? "yes" : "no");
+			}
+			printf ("\n");
+
+			z++;
+		}
+	}
+	printf ("\n");
+
+	if (selected_devices_cnt != z)
+	{
+		printf ("BUG: z and selected_devices_cnt are not equal\n");
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	// time to eat some memory :P
+
+	if (!(ctx.device_ids = (cl_device_id *) calloc (selected_devices_cnt, sizeof (cl_device_id))))
+	{
+		printf ("Error: calloc (ctx.device_ids) failed (%d): %s\n", errno, strerror (errno));
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	MEMORY_FREE_ADD(ctx.device_ids)
+
+	if (!(ctx.contexts = (cl_context *) calloc (selected_devices_cnt, sizeof (cl_context))))
+	{
+		printf ("Error: calloc (ctx.contexts) failed (%d): %s\n", errno, strerror (errno));
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	MEMORY_FREE_ADD(ctx.contexts)
+
+	if (!(ctx.commands = (cl_command_queue *) calloc (selected_devices_cnt, sizeof (cl_command_queue))))
+	{
+		printf ("Error: calloc (ctx.commands) failed (%d): %s\n", errno, strerror (errno));
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	MEMORY_FREE_ADD(ctx.commands)
+
+	if (!(ctx.programs = (cl_program *) calloc (selected_devices_cnt, sizeof (cl_program))))
+	{
+		printf ("Error: calloc (ctx.programs) failed (%d): %s\n", errno, strerror (errno));
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	MEMORY_FREE_ADD(ctx.programs)
+
+	if (!(ctx.kernels = (cl_kernel *) calloc (selected_devices_cnt, sizeof (cl_kernel))))
+	{
+		printf ("Error: calloc (ctx.kernels) failed (%d): %s\n", errno, strerror (errno));
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	MEMORY_FREE_ADD(ctx.kernels)
+
+	if (!(matches = (uint64_t **) calloc (selected_devices_cnt, sizeof (uint64_t *))))
+	{
+		printf ("Error: calloc (**matches) failed (%d): %s\n", errno, strerror (errno));
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	MEMORY_FREE_ADD(matches)
+
+	if (!(matches_found = (uint32_t **) calloc (selected_devices_cnt, sizeof (uint32_t *))))
+	{
+		printf ("Error: calloc (**matches_found) failed (%d): %s\n", errno, strerror (errno));
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	MEMORY_FREE_ADD(matches_found)
+
+	if (!(ctx.keystreams = (cl_mem *) calloc (selected_devices_cnt, sizeof (cl_mem))))
+	{
+		printf ("Error: calloc (ctx.keystreams) failed (%d): %s\n", errno, strerror (errno));
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	MEMORY_FREE_ADD(ctx.keystreams)
+
+	if (!(ctx.candidates = (cl_mem *) calloc (selected_devices_cnt, sizeof (cl_mem))))
+	{
+		printf ("Error: calloc (ctx.candidates) failed (%d): %s\n", errno, strerror (errno));
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	MEMORY_FREE_ADD(ctx.candidates)
+
+	if (!(ctx.matches = (cl_mem *) calloc (selected_devices_cnt, sizeof (cl_mem))))
+	{
+		printf ("Error: calloc (ctx.matches) failed (%d): %s\n", errno, strerror (errno));
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	MEMORY_FREE_ADD(ctx.matches)
+
+	if (!(ctx.matches_found = (cl_mem *) calloc (selected_devices_cnt, sizeof (cl_mem))))
+	{
+		printf ("Error: calloc (ctx.matches_found) failed (%d): %s\n", errno, strerror (errno));
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	MEMORY_FREE_ADD(ctx.matches_found)
+
+	if (ctx.force_hitag2_opencl)
+	{
+		if (!(ctx.checks = (cl_mem *) calloc (selected_devices_cnt, sizeof (cl_mem))))
+		{
+			printf ("Error: calloc (ctx.checks) failed (%d): %s\n", errno, strerror (errno));
+			MEMORY_FREE_ALL
+			exit (2);
+		}
+
+		MEMORY_FREE_ADD(ctx.checks)
+	}
+
+	if (!(ctx.global_ws = (size_t *) calloc (selected_devices_cnt, sizeof (size_t))))
+	{
+		printf ("Error: calloc (ctx.global_ws) failed (%d): %s\n", errno, strerror (errno));
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	MEMORY_FREE_ADD(ctx.global_ws)
+
+	if (!(ctx.local_ws = (size_t *) calloc (selected_devices_cnt, sizeof (size_t))))
+	{
+		printf ("Error: calloc (ctx.local_ws) failed (%d): %s\n", errno, strerror (errno));
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	MEMORY_FREE_ADD(ctx.local_ws)
+
+	if (!(ctx.profiles = (int *) calloc (selected_devices_cnt, sizeof (int))))
+	{
+		printf ("Error: calloc (ctx.profiles) failed (%d): %s\n", errno, strerror (errno));
+		MEMORY_FREE_ALL
+		exit (2);
+	}
+
+	MEMORY_FREE_ADD(ctx.profiles)
+
+	// show buidlog in case of error
+	// todo: only for device models
+	unsigned int build_errors = 0;
+	unsigned int build_logs = 0;
+
+	cl_command_queue_properties queue_properties = 0;
+
+	if (opencl_profiling) queue_properties = CL_QUEUE_PROFILING_ENABLE;
+
+	// setup, phase 1
+
+	z = 0; // dolphin
+
+	for (w = 0; w < ocl_platform_cnt; w++)
+	{
+		if (!cd_ctx[w].selected) continue;
+
+		for (q = 0; q < cd_ctx[w].device_cnt; q++)
+		{
+			if (!cd_ctx[w].device[q].selected) continue;
+
+			ctx.device_ids[z] = cd_ctx[w].device[q].device_id;
+
+			// create the opencl context with the array
+			ctx.contexts[z] = clCreateContext (NULL, 1, &ctx.device_ids[z], NULL, NULL, &err);
+			if (!ctx.contexts[z] || err != CL_SUCCESS) {
+				printf ("[%zu] Error: clCreateContext() failed (%d)\n", z, err);
+				MEMORY_FREE_OPENCL(ctx, z)
+				MEMORY_FREE_LIST(matches,z)
+				MEMORY_FREE_LIST(matches_found, z)
+				MEMORY_FREE_ALL
+				exit (2);
+			}
+
+			// create comman queues for each selected devices
+			ctx.commands[z] = clCreateCommandQueue(ctx.contexts[z], ctx.device_ids[z], queue_properties, &err);
+			if (!ctx.commands[z] || err != CL_SUCCESS)
+			{
+				printf ("[%zu] Error: clCreateCommandQueue() failed (%d)\n", z, err);
+				MEMORY_FREE_OPENCL(ctx, z)
+				MEMORY_FREE_LIST(matches,z)
+				MEMORY_FREE_LIST(matches_found, z)
+				MEMORY_FREE_ALL
+				exit (2);
+			}
+
+			// from clang:
+			// warning: cast from 'char *(*)[1]' to 'const char **' increases required alignment from 1 to 8
+			const char *a = (const char *)ctx.kernelSource[0];
+			const char **ks = &a;
+
+			// create the compute program from the source buffer
+			//ctx.programs[z] = clCreateProgramWithSource(ctx.contexts[z], 1, (const char **) &ctx.kernelSource, &ctx.kernelSource_len, &err);
+			ctx.programs[z] = clCreateProgramWithSource(ctx.contexts[z], 1, ks, &ctx.kernelSource_len, &err);
+			if (!ctx.programs[z] || err != CL_SUCCESS)
+			{
+				printf ("[%zu] Error: clCreateProgramWithSource() failed (%d)\n", z, err);
+				MEMORY_FREE_OPENCL(ctx, z)
+				MEMORY_FREE_LIST(matches,z)
+				MEMORY_FREE_LIST(matches_found, z)
+				MEMORY_FREE_ALL
+				exit (2);
+			}
+
+			// build the program executable
+			bool have_local_memory = false;
+			size_t blen = 0;
+			char build_options[0x100];
+
+			memset (build_options, 0, sizeof (build_options));
+
+			strncpy (build_options, "-Werror", 8);
+			blen += 7;
+
+			if (cd_ctx[w].device[q].have_lop3) // enable lop3
+			{
+				strncpy (build_options+blen, " -D HAVE_LOP3", 14);
+				blen += 13;
+			}
+
+			if (ctx.force_hitag2_opencl)
+			{
+				// force using hitag2 key validation with OpenCL
+				strncpy (build_options+blen, " -D WITH_HITAG2_FULL", 21);
+				blen += 20;
+			}
+
+			// Intel's gpu are worst than Apple
+			#if APPLE_GPU_BROKEN == 0
+			if (cd_ctx[w].device[q].is_gpu && !strncmp (cd_ctx[w].device[q].vendor, "Intel", 5))
+			{
+				if (cd_ctx[w].is_apple || cd_ctx[w].is_intel)
+				{
+					strncpy (build_options+blen, " -D LOWPERF", 13);
+					blen += 12;
+				}
+			}
+			#endif
+
+			#if DEBUGME >= 1
+			printf ("[debug] Device %zu have local mem ? %d\n", z, cd_ctx[w].device[q].have_local_memory);
+			#endif
+
+			if (cd_ctx[w].device[q].have_local_memory) // kernel keystream memory optimization
+			{
+				have_local_memory = true;
+				strncpy (build_options+blen, " -D HAVE_LOCAL_MEMORY", 22);
+				blen += 21;
+			}
+
+			if (verbose) printf ("[%zu] Building OpenCL program with options (len %zu): %s\n", z, blen, build_options);
+
+			err = clBuildProgram(ctx.programs[z], 1, &ctx.device_ids[z], build_options, NULL, NULL);
+
+			#if DEBUGME == 0
+			if (err != CL_SUCCESS)
+			#endif
+			{
+				#if DEBUGME > 0
+				if (err != CL_SUCCESS)
+				#endif
+				{
+					printf ("[%zu] Error: clBuildProgram() failed (%d)\n", z, err);
+					build_errors++;
+				}
+
+				// todo: if same device model of other and build_logs > 0, continue
+
+				size_t len = 0;
+				err = clGetProgramBuildInfo(ctx.programs[z], cd_ctx[w].device[q].device_id, CL_PROGRAM_BUILD_LOG, 0, NULL, &len);
+				if (err != CL_SUCCESS) {
+					printf ("[%zu] Error: clGetProgramBuildInfo failed (%d)\n", z, err);
+					continue;
+//					exit (2);
+				}
+
+				if (len == 0) continue;
+
+				if (len > 0xdeadbe) len = 0xdeadbe; // limit build_log size
+
+				char *buffer = (char *) calloc (len, sizeof(char));
+				if (!buffer)
+				{
+					printf ("[%zu] Error: calloc (CL_PROGRAM_BUILD_LOG) failed (%d): %s\n", z, errno, strerror (errno));
+					continue;
+//					exit (2);
+				}
+
+				MEMORY_FREE_ADD(buffer)
+
+				err = clGetProgramBuildInfo(ctx.programs[z], cd_ctx[w].device[q].device_id, CL_PROGRAM_BUILD_LOG, len, buffer, 0);
+				if (err != CL_SUCCESS) {
+					printf ("[%zu] clGetProgramBuildInfo() failed (%d)\n", z, err);
+					MEMORY_FREE_DEL(buffer)
+					continue;
+//					exit (2);
+				}
+
+				#if DEBUGME > 0
+				if (len > 2)
+				#endif
+				{
+					printf ("[%zu] Build log (len %zu):\n--------\n%s\n--------\n", z, len, buffer);
+				}
+
+				MEMORY_FREE_DEL(buffer)
+
+				build_logs++;
+				#if DEBUGME == 0
+				continue; // todo: evaluate this, one or more can be broken, so continue
+				#endif
+			}
+
+			// todo, continue if build_errors
+
+			// Create the compute kernel in the program we wish to run
+			ctx.kernels[z] = clCreateKernel(ctx.programs[z], "find_state", &err);
+			if (!ctx.kernels[z] || err != CL_SUCCESS) {
+				printf ("[%zu] Error: clCreateKernel() failed (%d)\n", z, err);
+				MEMORY_FREE_OPENCL(ctx, z)
+				MEMORY_FREE_LIST(matches,z)
+				MEMORY_FREE_LIST(matches_found, z)
+				MEMORY_FREE_ALL
+				exit (3);
+			}
+
+			size_t wgs = 0;
+			err = clGetKernelWorkGroupInfo (ctx.kernels[z], cd_ctx[w].device[q].device_id, CL_KERNEL_WORK_GROUP_SIZE, sizeof (size_t), &wgs, NULL);
+			if (err != CL_SUCCESS) {
+				printf ("[%zu] Error: clGetKernelWorkGroupInfo(CL_KERNEL_WORK_GROUP_SIZE) failed (%d)\n", z, err);
+				MEMORY_FREE_OPENCL(ctx, z)
+				// if macros work, next 2 macro are not needed
+				MEMORY_FREE_LIST(matches,z)
+				MEMORY_FREE_LIST(matches_found, z)
+				MEMORY_FREE_ALL
+				exit (3);
+			}
+
+			ctx.local_ws[z] = wgs;
+
+			// never got it
+			if (ctx.local_ws[z] < 32 && have_local_memory)
+			{
+				printf ("Warning: local work-item size is less than the length of the keystream, and local memory optimization is enabled. An unexpected result could arise.\n");
+			}
+
+			z++;
+		}
+	}
+
+	// z is device counter, dolphin counter as well
+
+	// setup, phase 2 (select lower profile)
+
+	int profile = 0xff;
+
+	g = 0;
+
+	for (w = 0; w < ocl_platform_cnt; w++)
+	{
+		if (!cd_ctx[w].selected) continue;
+
+		for (q = 0; q < cd_ctx[w].device_cnt; q++)
+		{
+			if (!cd_ctx[w].device[q].selected) continue;
+
+			ctx.profiles[g] = (int) profile_selected; // start with default
+
+			#if DEBUGME > 1
+			printf ("[debug] Initial profile for device %zu: %d\n", z, ctx.profiles[g]);
+			#endif
+
+			// force profile to 0 with Apple GPU's to get it stable, and 1 for CPU
+			if (cd_ctx[w].is_apple && !strncmp (cd_ctx[w].device[q].vendor, "Intel", 5))
+			{
+				if (cd_ctx[w].device[q].is_gpu)
+				{
+					if (profile_selected > 2) ctx.profiles[g] = PROFILE_DEFAULT; // Apple-Intel GPU's, 2 is the old 0
+				}
+				else
+				{
+					if (profile_selected > 3) ctx.profiles[g] = PROFILE_DEFAULT; // Apple-Intel CPU's, 3 is the old 1
+				}
+			}
+
+			// force profile to 0 with Intel GPU and 2 wih Intel CPU's
+			if (cd_ctx[w].is_intel && !strncmp (cd_ctx[w].device[q].vendor, "Intel", 5))
+			{
+				if (cd_ctx[w].device[q].is_gpu)
+				{
+					ctx.profiles[g] = 0; // Intel GPU, work better with a very slow profile
+				}
+				else
+				{
+					if (profile_selected > 2) ctx.profiles[g] = PROFILE_DEFAULT; // Intel CPU (2 is the old 0)
+				}
+			}
+
+			// force profile to 2 with NVIDIA GPU's with NVIDIA platform
+			if (cd_ctx[w].is_nv && cd_ctx[w].device[q].is_gpu && !strncmp (cd_ctx[w].device[q].vendor, "NVIDIA", 6))
+			{
+				if (profile_selected > 10)
+				{
+					// NVIDIA RTX 3090 perform better with 5
+					ctx.profiles[g] = (cd_ctx[w].device[q].sm_maj >= 8) ? 5 : PROFILE_DEFAULT;
+				}
+			}
+
+			// probably unstested hw, set profile to 0
+			if (profile_selected == 0xff)
+			{
+				profile_selected = 0;
+				ctx.profiles[g] = 0;
+			}
+
+			// with same devices will be selected the best
+			// but for different devices in the same platform we need the worst for now (todo)
+			if (ctx.profiles[q] < profile) profile = ctx.profiles[q];
+		}
+	}
+
+	// profile consistency check
+	if (profile < 0 || profile > 10)
+	{
+		printf ("! Error: the selected profile is not allowed (%d)\n", profile);
+		MEMORY_FREE_OPENCL(ctx, z)
+		MEMORY_FREE_LIST_Z(matches, z)
+		MEMORY_FREE_LIST_Z(matches_found, z)
+		MEMORY_FREE_ALL
+		exit(2);
+	}
+
+	// setup, phase 3 (finis him)
+
+	z = 0;
+
+	for (w = 0; w < ocl_platform_cnt; w++)
+	{
+		if (!cd_ctx[w].selected) continue;
+
+		for (q = 0; q < cd_ctx[w].device_cnt; q++)
+		{
+			if (!cd_ctx[w].device[q].selected) continue;
+
+			ctx.global_ws[z] = (1 << profiles[profile][1]);
+
+			// the following happens with cpu devices or Apple GPU
+			if (ctx.local_ws[z] > 256)
+			{
+				if (cd_ctx[w].is_apple) ctx.local_ws[z] = 256;
+				else if (!cd_ctx[w].device[q].is_gpu) ctx.local_ws[z] = 256;
+			}
+
+			// dow't allow gws < lws
+			if (ctx.global_ws[z] < ctx.local_ws[z]) ctx.local_ws[z] = ctx.global_ws[z];
+
+			if (opencl_profiling) printf ("[%zu] global_ws %zu, local_ws %zu\n", g, ctx.global_ws[z], ctx.local_ws[z]);
+
+			if (!ctx.force_hitag2_opencl)
+			{
+				if (!(matches[z] = (uint64_t *) calloc ((uint32_t)(ctx.global_ws[z] * WGS_MATCHES_FACTOR), sizeof (uint64_t))))
+				{
+					printf ("[%zu] Error: calloc (matches) failed (%d): %s\n", g, errno, strerror (errno));
+					MEMORY_FREE_OPENCL(ctx, z)
+					MEMORY_FREE_LIST(matches, z)
+					MEMORY_FREE_LIST(matches_found, z)
+					MEMORY_FREE_ALL
+					exit (2);
+				}
+			}
+			else
+			{
+				// one
+				if (!(matches[z] = (uint64_t *) calloc (1, sizeof (uint64_t))))
+				{
+					printf ("[%zu] Error: calloc (matches) failed (%d): %s\n", z, errno, strerror (errno));
+					MEMORY_FREE_OPENCL(ctx, z)
+					MEMORY_FREE_LIST(matches, z)
+					MEMORY_FREE_LIST(matches_found, z)
+					MEMORY_FREE_ALL
+					exit (2);
+				}
+			}
+
+			if (!(matches_found[z] = (uint32_t *) calloc (1, sizeof (uint32_t))))
+			{
+				printf ("[%zu] Error: calloc (matches_found) failed (%d): %s\n", z, errno, strerror (errno));
+				MEMORY_FREE_OPENCL(ctx, z)
+				MEMORY_FREE_LIST_Z(matches, z)
+				MEMORY_FREE_LIST(matches_found, z)
+				MEMORY_FREE_ALL
+				exit (2);
+			}
+
+			ctx.candidates[z] = clCreateBuffer(ctx.contexts[z],  CL_MEM_READ_ONLY,  sizeof(uint16_t) * ((1 << 20) * 3), NULL, NULL);
+			//ctx.candidates = clCreateBuffer(ctx.contexts[z],  CL_MEM_READ_ONLY,  sizeof(uint64_t) * ((1 << 20)), NULL, NULL);
+			ctx.keystreams[z]  = clCreateBuffer(ctx.contexts[z],  CL_MEM_READ_ONLY,  VECTOR_SIZE * 32, NULL, NULL);
+
+			if (!ctx.force_hitag2_opencl)
+			{
+				ctx.matches[z] = clCreateBuffer(ctx.contexts[z], CL_MEM_WRITE_ONLY, sizeof(uint64_t) * (uint32_t)(ctx.global_ws[z]*WGS_MATCHES_FACTOR), NULL, NULL);
+			}
+			else // one
+			{
+				ctx.matches[z] = clCreateBuffer(ctx.contexts[z], CL_MEM_WRITE_ONLY, sizeof(uint64_t), NULL, NULL);
+			}
+
+			ctx.matches_found[z] = clCreateBuffer(ctx.contexts[z], CL_MEM_READ_WRITE, sizeof(uint32_t), NULL, NULL);
+
+			if (ctx.force_hitag2_opencl)
+			{
+				ctx.checks[z] = clCreateBuffer(ctx.contexts[z], CL_MEM_READ_ONLY, sizeof(uint32_t) * 4, NULL, NULL);
+				if (!ctx.checks[z])
+				{
+					printf ("[%zu] Error: invalid shared cl_mem (ctx.candidates|ctx.keystream|ctx.checks)\n", z);
+					MEMORY_FREE_OPENCL(ctx, z)
+					MEMORY_FREE_LIST_Z(matches, z)
+					MEMORY_FREE_LIST_Z(matches_found, z)
+					MEMORY_FREE_ALL
+					exit (3);
+				}
+			}
+
+			if (!ctx.candidates[z] || !ctx.keystreams[z])
+			{
+				printf ("[%zu] Error: invalid shared cl_mem (ctx.candidates|ctx.keystream)\n", z);
+				MEMORY_FREE_OPENCL(ctx, z)
+				MEMORY_FREE_LIST_Z(matches, z)
+				MEMORY_FREE_LIST_Z(matches_found, z)
+				MEMORY_FREE_ALL
+				exit (3);
+			}
+
+			if (!ctx.matches[z] || !ctx.matches_found[z])
+			{
+				printf ("[%zu] Error: invalid per-device cl_mem (ctx.matches or ctx.matches_found)\n", z);
+				MEMORY_FREE_OPENCL(ctx, z)
+				MEMORY_FREE_LIST_Z(matches, z)
+				MEMORY_FREE_LIST_Z(matches_found, z)
+				MEMORY_FREE_ALL
+				exit (3);
+			}
+
+			// Write our data set into the input array in device memory
+			// todo
+			// if z is last set CL_TRUE (blocking) else CL_FALSE (non-blocking)
+			// using this way, setup time can be reduced
+			err = clEnqueueWriteBuffer(ctx.commands[z], ctx.keystreams[z], CL_TRUE, 0, VECTOR_SIZE * 32, keystream, 0, NULL, NULL);
+			if (err != CL_SUCCESS)
+			{
+				printf ("[%zu] Error: clEnqueueWriteBuffer(ctx.keystream) failed (%d)\n", z, err);
+				MEMORY_FREE_OPENCL(ctx, z)
+				MEMORY_FREE_LIST_Z(matches, z)
+				MEMORY_FREE_LIST_Z(matches_found, z)
+				MEMORY_FREE_ALL
+				exit (3);
+			}
+
+			err = clEnqueueWriteBuffer(ctx.commands[z], ctx.candidates[z], CL_TRUE, 0, sizeof(uint16_t) * ((1 << 20) * 3), candidates, 0, NULL, NULL);
+//			err = clEnqueueWriteBuffer(ctx.commands[z], ctx.candidates, CL_TRUE, 0, sizeof(uint64_t) * ((1 << 20)), candidates, 0, NULL, NULL);
+			if (err != CL_SUCCESS)
+			{
+				printf ("[%zu] Error: clEnqueueWriteBuffer(ctx.candidates) failed (%d)\n", z, err);
+				MEMORY_FREE_OPENCL(ctx, z)
+				MEMORY_FREE_LIST_Z(matches, z)
+				MEMORY_FREE_LIST_Z(matches_found, z)
+				MEMORY_FREE_ALL
+				exit (3);
+			}
+
+			if (ctx.force_hitag2_opencl)
+			{
+				err = clEnqueueWriteBuffer(ctx.commands[z], ctx.checks[z], CL_TRUE, 0, sizeof(uint32_t) * 4, checks, 0, NULL, NULL);
+				if (err != CL_SUCCESS) {
+					printf ("[%zu] Error: clEnqueueWriteBuffer(ctx.checks) failed (%d)\n", z, err);
+					MEMORY_FREE_OPENCL(ctx, z)
+					MEMORY_FREE_LIST_Z(matches, z)
+					MEMORY_FREE_LIST_Z(matches_found, z)
+					MEMORY_FREE_ALL
+					exit (3);
+				}
+			}
+
+			// Set the arguments to our compute kernel
+			err  = clSetKernelArg (ctx.kernels[z], 1, sizeof(cl_mem), &ctx.candidates[z]);
+			err |= clSetKernelArg (ctx.kernels[z], 2, sizeof(cl_mem), &ctx.keystreams[z]);
+			err |= clSetKernelArg (ctx.kernels[z], 3, sizeof(cl_mem), &ctx.matches[z]);
+			if (ctx.force_hitag2_opencl) err |= clSetKernelArg (ctx.kernels[z], 5, sizeof(cl_mem), &ctx.checks[z]);
+
+			if (err != CL_SUCCESS) {
+				printf ("[%zu] Error: clSetKernelArg(ctx.candidates|ctx.keystream|ctx.matches|ctx.checks) failed (%d)\n", z, err);
+				MEMORY_FREE_OPENCL(ctx, z)
+				MEMORY_FREE_LIST_Z(matches, z)
+				MEMORY_FREE_LIST_Z(matches_found, z)
+				MEMORY_FREE_ALL
+				exit (3);
+			}
+
+			z++;
+		}
+	}
+
+	if (build_errors > 0)
+	{
+		#if DEBUGME >= 2
+		printf ("[debug] Detected build errors with %u device(s).\n", build_errors);
+		#endif
+		MEMORY_FREE_OPENCL(ctx, z)
+		MEMORY_FREE_LIST_Z(matches, z)
+		MEMORY_FREE_LIST_Z(matches_found, z)
+		MEMORY_FREE_ALL
+		exit (3);
+	}
+
+	// at this point z is the max value, still usefull for free's
+
+	#if DEBUGME > 0
+	printf ("[debug] Lower profile between %u device(s) is: %d\n", selected_devices_cnt, profile);
+	#endif
+
+	uint32_t max_step = profiles[profile][0];
+	uint32_t chunk = profiles[profile][1];
+
+	#if DEBUGME > 0
+	printf ("[debug] Init queue\n");
+	#endif
+
+	int ret = 0;
+	if ((ret = wu_queue_init (&ctx.queue_ctx, queue_type)) != 0)
+	{
+		printf ("! Error: wu_queue_init(%s) failed (%d): %s\n", wu_queue_strdesc (queue_type), ret, wu_queue_strerror (ret));
+		MEMORY_FREE_OPENCL(ctx, z)
+		MEMORY_FREE_LIST_Z(matches, z)
+		MEMORY_FREE_LIST_Z(matches_found, z)
+		MEMORY_FREE_ALL
+		exit(2);
+	}
+
+	#if DEBUGME > 0
+	printf ("[queue] Fill queue with pre-calculated offset using profile (%d): ", profile);
+	#endif
+
+	for (size_t step = 0; step < max_step; step++) wu_queue_push (&ctx.queue_ctx, step, step << chunk, max_step);
+
+	#if DEBUGME > 0
+	printf ("done\n");
+	#endif
+
+	// save selected_devices_cnt
+	size_t thread_count = selected_devices_cnt;
+
+	thread_ctx_t th_ctx;
+	memset (&th_ctx, 0, sizeof (thread_ctx_t));
+
+	thread_args_t *t_arg = (thread_args_t *) calloc (thread_count, sizeof (thread_args_t));
+	if (!t_arg)
+	{
+		printf ("Error: calloc (thread_args_t) failed (%d): %s\n", errno, strerror (errno));
+		MEMORY_FREE_OPENCL(ctx, z)
+		MEMORY_FREE_LIST_Z(matches, z)
+		MEMORY_FREE_LIST_Z(matches_found, z)
+		MEMORY_FREE_ALL
+		exit (3);
+	}
+
+	MEMORY_FREE_ADD(t_arg)
+
+	if ((ret = thread_init (&th_ctx, ctx.thread_sched_type, thread_count)) != 0)
+	{
+		printf ("Error: thread_init(%zu) failed (%d)\n", thread_count, ret);
+		MEMORY_FREE_OPENCL(ctx, z)
+		MEMORY_FREE_LIST_Z(matches, z)
+		MEMORY_FREE_LIST_Z(matches_found, z)
+		MEMORY_FREE_ALL
+		exit (3);
+	}
+
+	// preload constant values in threads memory, and start threads
+	for (z = 0; z < thread_count; z++)
+	{
+		t_arg[z].uid = uid;
+		t_arg[z].aR2 = aR2;
+		t_arg[z].nR1 = nR1;
+		t_arg[z].nR2 = nR2;
+		t_arg[z].max_step = max_step;
+		t_arg[z].ocl_ctx = &ctx;
+		t_arg[z].device_id = z;
+		t_arg[z].async = (ctx.thread_sched_type == THREAD_TYPE_ASYNC);
+		t_arg[z].thread_ctx = &th_ctx;
+
+		if (ctx.thread_sched_type == THREAD_TYPE_ASYNC)
+		{
+			t_arg[z].matches = matches[z];
+			t_arg[z].matches_found = matches_found[z];
+			t_arg[z].status = TH_START;
+		}
+	}
+
+	if (ctx.thread_sched_type == THREAD_TYPE_ASYNC)
+	{
+		if ((ret = thread_start (&th_ctx, t_arg)) != 0)
+		{
+			printf ("Error: thread_start() failed (%d): %s\n", ret, thread_strerror (ret));
+			thread_destroy (&th_ctx);
+			MEMORY_FREE_OPENCL(ctx, z)
+			MEMORY_FREE_LIST_Z(matches, z)
+			MEMORY_FREE_LIST_Z(matches_found, z)
+			MEMORY_FREE_ALL
+			exit (3);
+		}
+	}
+
+	#if DEBUGME >= 1
+	// they now are all in TH_WAIT locked by a cond_wait
+	// try the normal routine
+	if (ctx.thread_sched_type == THREAD_TYPE_ASYNC)
+	{
+		size_t th_status_err = 0;
+		for (z = 0; z < thread_count; z++)
+		{
+			pthread_mutex_lock (&thread_mutexs[z]);
+			thread_status_t tmp = t_arg[z].status;
+			pthread_mutex_unlock (&thread_mutexs[z]);
+
+			if (tmp != TH_START)
+			{
+				printf ("! Warning: Thread %zu is not in TH_START, found in %s\n", z, thread_status_strdesc (tmp));
+				th_status_err++;
+			}
+		}
+
+		if (th_status_err != 0)
+		{
+			printf ("! Warning: %zu thread(s) found in wrong initial state ...\n", th_status_err);
+		}
+		else
+		{
+			printf ("# %zu thread(s) ready\n", thread_count);
+		}
+	}
+	#endif // DEBUGME >= 1
+
+	bool found = false;
+	bool error = false;
+	bool show_overall_time = true;
+
+	struct timeval cpu_t_start, cpu_t_end, cpu_t_result;
+
+	fprintf (stderr, "Attack 5 - opencl - start (Max Slices %u, %s order", max_step, wu_queue_strdesc (ctx.queue_ctx.queue_type));
+
+	if (!verbose) fprintf (stderr, ")\n\n");
+	else fprintf (stderr, ", Profile %d, Async Threads %s, HiTag2 key verify on device %s)\n\n", profile, (ctx.thread_sched_type == THREAD_TYPE_ASYNC) ? "yes" : "no", (force_hitag2_opencl) ? "yes" : "no");
+
+	if (gettimeofday (&cpu_t_start, NULL) == -1)
+	{
+		printf ("! gettimeofday(start) failed (%d): %s\n", errno, strerror (errno));
+		show_overall_time = false;
+	}
+
+	if (ctx.thread_sched_type == THREAD_TYPE_ASYNC)
+	{
+		// crack hitag key or die tryin'
+		unsigned int th_cnt;
+
+		bool done = false;
+
+		do // master
+		{
+			th_cnt = 0;
+
+			for (z = 0; z < thread_count; z++)
+			{
+				#if TDEBUG >= 1 && DEBUGME == 1
+				if (thread_count == 1) { printf ("[%zu] get status from slave ...\n", z); fflush (stdout); }
+				#endif
+
+				pthread_mutex_lock (&th_ctx.thread_mutexs[z]);
+				thread_status_t cur_status = t_arg[z].status;
+				pthread_mutex_unlock (&th_ctx.thread_mutexs[z]);
+
+				#if TDEBUG >= 1 && DEBUGME == 1
+				if (thread_count == 1) { printf ("[%zu] slave status: %s\n", z, thread_status_strdesc (cur_status)); fflush (stdout); }
+				#endif
+
+				if (found)
+				{
+					#if TDEBUG >= 3
+					printf ("[%zu] Processing exit logic\n", z);
+					fflush (stdout);
+					#endif
+
+					if (cur_status < TH_FOUND_KEY)
+					{
+						#if TDEBUG >= 1
+						printf ("[%zu] key found from another thread, set quit\n", z);
+						fflush (stdout);
+						#endif
+						pthread_mutex_lock (&th_ctx.thread_mutexs[z]);
+						t_arg[z].status = TH_END;
+						t_arg[z].quit = true;
+						if (cur_status == TH_WAIT) pthread_cond_signal (&th_ctx.thread_conds[z]);
+						pthread_mutex_unlock (&th_ctx.thread_mutexs[z]);
+					}
+					else
+					{
+						if (thread_count == 1)
+						{
+							th_cnt++;
+							#if TDEBUG >= 1
+							printf ("[%zu] Increment th_cnt: %u/%zu\n", z, th_cnt, thread_count);
+							fflush (stdout);
+							#endif
+						}
+					}
+					continue;
+				}
+
+				if (cur_status == TH_WAIT)
+				{
+					pthread_mutex_lock (&th_ctx.thread_mutexs[z]);
+
+					if (found)
+					{
+						#if TDEBUG >= 1
+						printf ("[%zu] key is found in another thread 1\n", z);
+						fflush (stdout);
+						#endif
+						t_arg[z].status = TH_END;
+						t_arg[z].quit = true;
+						pthread_mutex_unlock (&th_ctx.thread_mutexs[z]);
+						continue;
+					}
+
+					if (wu_queue_done (&ctx.queue_ctx) != QUEUE_EMPTY)
+					{
+						t_arg[z].status = TH_PROCESSING;
+
+						#if TDEBUG >= 1
+						printf ("[master] slave [%zu], I give you another try (%s)\n", z, thread_status_strdesc (t_arg[z].status));
+						fflush (stdout);
+						#endif
+
+						pthread_cond_signal (&th_ctx.thread_conds[z]);
+						pthread_mutex_unlock (&th_ctx.thread_mutexs[z]);
+						continue;
+					}
+					else
+					{
+						#if TDEBUG >= 1
+						printf ("[master] slave [%zu], max step reached. Quit.\n", z);
+						fflush (stdout);
+						#endif
+
+						cur_status = t_arg[z].status = TH_END;
+						t_arg[z].quit = true;
+
+						pthread_cond_signal (&th_ctx.thread_conds[z]);
+						pthread_mutex_unlock (&th_ctx.thread_mutexs[z]);
+					}
+				}
+
+				if (cur_status == TH_PROCESSING)
+				{
+					if (th_ctx.enable_condusleep)
+					{
+						#if TDEBUG >= 1
+						printf ("[master] before pthread_cond_wait, TH_PROCESSING\n");
+						#endif
+						pthread_mutex_lock (&th_ctx.thread_mutex_usleep);
+						#if TDEBUG >= 1
+						printf ("[master] slave [%zu], I'm waiting you end of task, I'm in %s give me a signal.\n", z, thread_status_strdesc (t_arg[z].status));
+						fflush (stdout);
+						#endif
+						pthread_cond_wait (&th_ctx.thread_cond_usleep, &th_ctx.thread_mutex_usleep);
+						#if TDEBUG >= 1
+						printf ("[master] slave [%zu], got the signal with new state: %s.\n", z, thread_status_strdesc (t_arg[z].status));
+						fflush (stdout);
+						#endif
+
+						if (t_arg[z].status == TH_FOUND_KEY) found = true;
+
+						pthread_mutex_unlock (&th_ctx.thread_mutex_usleep);
+						#if TDEBUG >= 1
+						printf ("[master] after pthread_cond_wait, TH_PROCESSING\n");
+						#endif
+						continue;
+					}
+
+					if (found)
+					{
+						#if TDEBUG >= 1
+						printf ("[master] slave [%zu], the key is found. set TH_END from TH_PROCESSING\n", z);
+						fflush (stdout);
+						#endif
+
+						pthread_mutex_lock (&th_ctx.thread_mutexs[z]);
+						t_arg[z].status = TH_END;
+						t_arg[z].quit = true;
+						pthread_mutex_unlock (&th_ctx.thread_mutexs[z]);
+						continue;
+					}
+				}
+
+				if (cur_status == TH_ERROR)
+				{
+					// something went wrong
+					pthread_mutex_lock (&th_ctx.thread_mutexs[z]);
+					t_arg[z].status = TH_END;
+					t_arg[z].quit = true;
+					pthread_mutex_unlock (&th_ctx.thread_mutexs[z]);
+					continue;
+				}
+
+				// todo, do more clean exit logic
+				if (cur_status >= TH_FOUND_KEY)
+				{
+					th_cnt++;
+
+					if (cur_status == TH_FOUND_KEY)
+					{
+						thread_setEnd (&th_ctx, t_arg);
+						found = true;
+						done = true;
+					}
+				}
+			}
+
+			if (th_cnt == thread_count) done = true;
+
+		} while (!done);
+
+		// end of async engine
+	}
+	else if (ctx.thread_sched_type == THREAD_TYPE_SEQ)
+	{
+		uint32_t step = 0;
+		bool quit = false;
+
+		for (step = 0; step < max_step; step += thread_count)
+		{
+			for (z = 0; z < thread_count; z++)
+			{
+				t_arg[z].r = found;
+				t_arg[z].matches = matches[z];
+				t_arg[z].matches_found = matches_found[z];
+			}
+
+			if ((ret = thread_start (&th_ctx, t_arg)) != 0)
+			{
+				printf ("Error: thread_start() failed (%d): %s\n", ret, thread_strerror (ret));
+				thread_destroy (&th_ctx);
+				MEMORY_FREE_OPENCL(ctx, z)
+				MEMORY_FREE_LIST_Z(matches, z)
+				MEMORY_FREE_LIST_Z(matches_found, z)
+				MEMORY_FREE_ALL
+				exit (3);
+			}
+
+			// waiting threads return
+			thread_stop (&th_ctx);
+
+			for (z = 0; z < th_ctx.thread_count; z++)
+			{
+				if (t_arg[z].r) found = true;
+
+				if (t_arg[z].err)
+				{
+					error = true;
+					quit = true;
+				}
+			}
+
+			if (found || quit) break;
+		}
+	}
+
+	// if found, show the key here
+	for (size_t y = 0; y < thread_count; y++)
+	{
+		if (t_arg[y].r)
+		{
+			if (verbose) printf ("\n");
+
+			if (thread_count > 1) printf ("[%zu] ", y);
+
+			printf ("Key found @ slice %lu/%lu: ", t_arg[y].slice, t_arg[y].max_step);
+			for (int i = 0; i < 6; i++) {
+				printf ("%02X", (uint8_t)(t_arg[y].key & 0xff));
+				t_arg[y].key = t_arg[y].key >> 8;
+			}
+			printf ("\n");
+			fflush (stdout);
+			break;
+		}
+	}
+
+	if (show_overall_time)
+	{
+		if (gettimeofday (&cpu_t_end, NULL) == 0)
+		{
+			timersub (&cpu_t_end, &cpu_t_start, &cpu_t_result);
+		}
+		else
+		{
+			printf ("! gettimeofday(end) failed (%d): %s\n", errno, strerror (errno));
+			show_overall_time = false;
+		}
+	}
+
+	if (!found)
+	{
+		printf ("\nError. %s\n", (error) ? "something went wrong :(" : "Key not found :|");
+		if (error) exit(-1);
+	}
+
+	printf ("\nAttack 5 - opencl - end");
+
+	if (show_overall_time) printf (" in %ld.%06ld second(s).\n\n", (long int)cpu_t_result.tv_sec, (long int)cpu_t_result.tv_usec);
+	else printf ("\n");
+
+	fflush(stdout);
+
+	#if DEBUGME > 1
+	printf ("stop threads\n");
+	fflush (stdout);
+	#endif
+
+	thread_stop (&th_ctx);
+
+	#if DEBUGME > 1
+	printf ("destroy threads\n");
+	fflush (stdout);
+	#endif
+
+	if ((ret = thread_destroy (&th_ctx)) != 0)
+	{
+		#if DEBUGME > 0
+		printf ("Warning: thread_destroy() failed (%d): %s\n", ret, thread_strerror (ret));
+		#endif
+	}
+
+	#if DEBUGME > 1
+	printf ("wu_queue_destroy\n");
+	fflush (stdout);
+	#endif
+
+	if ((ret = wu_queue_destroy (&ctx.queue_ctx)) != 0)
+	{
+		#if DEBUGME > 0
+		printf ("Warning: wu_queue_destroy() failed (%d): %s\n", ret, wu_queue_strerror (ret));
+		#endif
+	}
+
+	z = selected_devices_cnt - 1;
+	MEMORY_FREE_OPENCL(ctx, z)
+	MEMORY_FREE_LIST_Z(matches, z)
+	MEMORY_FREE_LIST_Z(matches_found, z)
+	MEMORY_FREE_ALL
+
+	return (found) ? 0 : 1;
+}
diff --git a/tools/hitag2crack/crack5opencl/ht2crack5opencl.h b/tools/hitag2crack/crack5opencl/ht2crack5opencl.h
new file mode 100644
index 000000000..cc2a17798
--- /dev/null
+++ b/tools/hitag2crack/crack5opencl/ht2crack5opencl.h
@@ -0,0 +1,47 @@
+#ifndef HT2CRACK5OPENCL_H
+#define HT2CRACK5OPENCL_H
+
+#define VERSION "1.0"
+
+// enable generic debug messages
+#define DEBUGME 0
+
+//#define DEBUG_HITAG2 0 // you can set this (1) to enable debug messages in hitag2 cpu code
+
+#ifdef __APPLE__
+
+#if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+#define OFF_FORMAT_U llu
+#define OFF_FORMAT_X llx
+#endif // DEBUG_HITAG2
+
+#else // ! Apple
+
+#if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+#define OFF_FORMAT_U lu
+#define OFF_FORMAT_X lx
+#endif // DEBUG_HITAG2
+
+#endif // __APPLE__
+
+#if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+#define STR_STRING(x) #x
+#define STR(x) STR_STRING(x)
+#endif // DEBUG_HITAG2
+
+// some defines
+#define APPLE_GPU_BROKEN 0                          // if your Apple GPU is broken, try set to (1).
+//#define MAX_OPENCL_DEVICES 16                       // max number of concurrent devices (tested up to 4x RTX 3090)
+#define GLOBAL_WS_1 1024                            // default size of 2nd work-items dimension
+#define GLOBAL_WS_2 1                               // default size of 3rd work-items dimension
+#define PROFILE_DEFAULT 2                           // (0) is the best for Intel GPU's (NEO) and Apple GPU's (only Iris tested), (2) for all others. Some limitations are applyed later
+#define TDEBUG 0                                    // (0) hide or (1) enable thread's debug messages
+#define EXPERIMENTAL_RECOVERY 0                     // untested work-unit recovery logic, in case of failure. supported only with THREAD_SCHEDULER_TYPE as (0)
+//#define CLEAN_EXIT 1                                // (1) seems to be fixed, but add a global cond_wait/cond_signal pair to make sure threads end before free memory maybe an idea
+#define ENABLE_EMOJ 0                               // only for fun
+
+#define WGS_MATCHES_FACTOR_MID 1.41421              // Pythagoras, the square of 2, not full but probably good trade-off
+#define WGS_MATCHES_FACTOR_FULL 3.14159265359       // Pi, maybe is the correct one
+#define WGS_MATCHES_FACTOR WGS_MATCHES_FACTOR_MID   // trying with Pythagoras, but if you got the following error, change to Pi: 'clEnqueueReadBuffer(matches) failed (-30)'
+
+#endif // HT2CRACK5OPENCL_H
diff --git a/tools/hitag2crack/crack5opencl/ht2crack5opencl_kernel.cl b/tools/hitag2crack/crack5opencl/ht2crack5opencl_kernel.cl
new file mode 100644
index 000000000..39c5737f2
--- /dev/null
+++ b/tools/hitag2crack/crack5opencl/ht2crack5opencl_kernel.cl
@@ -0,0 +1,866 @@
+/* ht2crack5opencl_kernel.cl
+ * -------------------------
+ * This code is heavily based on crack5gpu implementation.
+ *
+ * Additional changes done by Gabriele 'matrix' Gristina <gabriele.gristina@gmail.com>
+ *  - generic code optimizations
+ *  - using local memory for keystream, if enabled by OpenCL host engine
+ *  - added the two macros bs_res () and bs_res_lut_1, used during the generation of intermediate results
+ *  - split lut3 function to some variants (tentative to reduce registers usage)
+ *  - add support for devices without lop3.b32 instruction (for ! NVIDIA platforms/devices, like Intel and Apple CPU/GPU, not tested on ADM)
+ *  - add HITAG2 routine to perform key verification, if enabled
+ *  - using local memory for uid, aR2, nR1, nR2 (if HITAG2 routine is enabled)
+ */
+
+#define MAX_BITSLICES 32
+#define KEYSTREAM_LENGTH 32
+
+typedef uint bitslice_t __attribute__((aligned(MAX_BITSLICES / 8)));
+
+#ifndef HAVE_LOP3
+// (0xf0&(0xcc^0xaa))
+inline static uint lut3_0x60(uint a, uint b, uint c) {
+	const uint r = b ^ c;
+	return a & r;
+}
+
+// (~((0xf0|0xcc)^0xaa))
+inline static uint lut3_0xa9(uint a, uint b, uint c) {
+	const uint r = a | b;
+	return ~(r ^ c);
+}
+
+// (~((0xf0|0xcc|0xaa)))
+inline static uint lut3_0x01(uint a, uint b, uint c) {
+	const uint r = a | b;
+	return ~(r | c);
+}
+
+// (((0xf0|0xcc)&0xaa))
+inline static uint lut3_0xa8(uint a, uint b, uint c) {
+	const uint r = a | b;
+	return r & c;
+}
+
+// (((0xf0|0xcc)&0xaa)^0xcc)
+inline static uint lut3_0x64(uint a, uint b, uint c) {
+	const uint r = (a | b) & c;
+	return r ^ b;
+}
+
+// (0xf0^0xaa^0xcc)
+inline static uint lut3_0x96(uint a, uint b, uint c) {
+	const uint r = a ^ b;
+	return r ^ c;
+}
+
+// (((0xf0^0xcc)|0xaa))
+inline static uint lut3_0xbe(uint a, uint b, uint c) {
+	const uint r = a ^ b;
+	return r | c;
+}
+
+// (~((0xf0^0xcc)&(0xaa^0xcc)))
+inline static uint lut3_0xdb(uint a, uint b, uint c) {
+	const uint r = a ^ b;
+	const uint r2 = c ^ b;
+	return ~(r & r2);
+}
+/*
+// (0xf0|(0xcc&0xaa))
+inline static uint lut3_0xf8(uint a, uint b, uint c) {
+	const uint r = b & c;
+	return a | r;
+}
+*/
+/*
+// (0xf0|(0xcc&(0x01)))
+inline static uint lut3_0xf8_0x1(uint a, uint b) {
+	const uint r = b & 0x1;
+	return a | r;
+}
+*/
+
+#ifdef WITH_HITAG2_FULL
+// (0xf0|(0xcc&(0xC)))
+inline static uint lut3_0xf8_0xC(uint a, uint b) {
+	const uint r = b & 0xC;
+	return a | r;
+}
+
+// (0xf0|0xcc|0xaa)
+inline static uint lut3_0xfe(uint a, uint b, uint c) {
+	const uint r = a | b;
+	return r | c;
+}
+#endif // WITH_HITAG2_FULL
+
+#else // HAVE_LOP3
+
+inline static uint lut3_0x01(uint a, uint b, uint c) {
+	uint r;
+	asm("lop3.b32 %0, %1, %2, %3, 0x01;" : "=r"(r): "r"(a), "r"(b), "r"(c));
+	return r;
+}
+
+inline static uint lut3_0x60(uint a, uint b, uint c) {
+	uint r;
+	asm("lop3.b32 %0, %1, %2, %3, 0x60;" : "=r"(r): "r"(a), "r"(b), "r"(c));
+	return r;
+}
+
+inline static uint lut3_0x64(uint a, uint b, uint c) {
+	uint r;
+	asm("lop3.b32 %0, %1, %2, %3, 0x64;" : "=r"(r): "r"(a), "r"(b), "r"(c));
+	return r;
+}
+
+inline static uint lut3_0x96(uint a, uint b, uint c) {
+	uint r;
+	asm("lop3.b32 %0, %1, %2, %3, 0x96;" : "=r"(r): "r"(a), "r"(b), "r"(c));
+	return r;
+}
+
+inline static uint lut3_0xa8(uint a, uint b, uint c) {
+	uint r;
+	asm("lop3.b32 %0, %1, %2, %3, 0xa8;" : "=r"(r): "r"(a), "r"(b), "r"(c));
+	return r;
+}
+
+inline static uint lut3_0xa9(uint a, uint b, uint c) {
+	uint r;
+	asm("lop3.b32 %0, %1, %2, %3, 0xa9;" : "=r"(r): "r"(a), "r"(b), "r"(c));
+	return r;
+}
+
+inline static uint lut3_0xbe(uint a, uint b, uint c) {
+	uint r;
+	asm("lop3.b32 %0, %1, %2, %3, 0xbe;" : "=r"(r): "r"(a), "r"(b), "r"(c));
+	return r;
+}
+
+inline static uint lut3_0xdb(uint a, uint b, uint c) {
+	uint r;
+	asm("lop3.b32 %0, %1, %2, %3, 0xdb;" : "=r"(r): "r"(a), "r"(b), "r"(c));
+	return r;
+}
+
+/*
+inline static uint lut3_0xf8(uint a, uint b, uint c) {
+	uint r;
+	asm("lop3.b32 %0, %1, %2, %3, 0xf8;" : "=r"(r): "r"(a), "r"(b), "r"(c));
+	return r;
+}
+*/
+/*
+inline static uint lut3_0xf8_0x1(uint a, uint b) {
+	uint r;
+	asm("lop3.b32 %0, %1, %2, 0x1, 0xf8;" : "=r"(r): "r"(a), "r"(b));
+	return r;
+}
+*/
+
+#ifdef WITH_HITAG2_FULL
+inline static uint lut3_0xf8_0xC(uint a, uint b) {
+	uint r;
+	asm("lop3.b32 %0, %1, %2, 0xC, 0xf8;" : "=r"(r): "r"(a), "r"(b));
+	return r;
+}
+
+inline static uint lut3_0xfe(uint a, uint b, uint c) {
+	uint r;
+	asm("lop3.b32 %0, %1, %2, %3, 0xfe;" : "=r"(r): "r"(a), "r"(b), "r"(c));
+	return r;
+}
+#endif // WITH_HITAG2_FULL
+
+#endif // HAVE_LOP3
+
+#define f_a_bs(a,b,c,d)       (lut3_0xa9(a,d,lut3_0x64(a,b,c))) // 2 luts
+#define f_b_bs(a,b,c,d)       (lut3_0xa8(d,c,a^b) ^ lut3_0x01(d,a,b)) // 2 luts, 2 xors
+#define f_c_bs(a,b,c,d,e)     (((lut3_0xdb((lut3_0xbe(c,e,d) & a), b, c)) ^ (lut3_0xbe(d,e,a) & lut3_0xbe(d,b,c))))
+#define bs_res(a,b,c)         (lut3_0x60(a,b,c))
+
+#define lfsr_bs(i)            (lut3_0x96(lut3_0x96(lut3_0x96(state[-2+i+ 0], state[-2+i+ 2], state[-2+i+ 3]),  \
+                                                   lut3_0x96(state[-2+i+ 6], state[-2+i+ 7], state[-2+i+ 8]),  \
+                                                   lut3_0x96(state[-2+i+16], state[-2+i+22], state[-2+i+23])), \
+                                         lut3_0x96(state[-2+i+26], state[-2+i+30], state[-2+i+41]), \
+                                         lut3_0x96(state[-2+i+42], state[-2+i+43], state[-2+i+46])) ^ state[-2+i+47])
+
+// 46 iterations * 4 ops
+static inline void bitslice (bitslice_t *restrict b, ulong x) {
+	for (uint i = 0; i < 46; ++i) {
+		b[i] = -(x & 1);
+		x >>= 1;
+	}
+}
+
+// don't care about the complexity of this function
+static inline ulong unbitslice (const bitslice_t *restrict b, const uint s) {
+	const bitslice_t mask = ((bitslice_t) 1) << s;
+	ulong result = 0;
+
+	for (int i = 47; i >= 0; --i) {
+		result <<= 1;
+		result |= (bool)(b[i] & mask);
+	}
+	return result;
+}
+
+///////////////////////////////
+
+#ifdef WITH_HITAG2_FULL
+
+/*
+ * Hitag Crypto support macros
+ * These macros reverse the bit order in a byte, or *within* each byte of a
+ * 16 , 32 or 64 bit unsigned integer. (Not across the whole 16 etc bits.)
+ */
+#define rev8(X)   ((((X) >> 7) &1) + (((X) >> 5) &2) + (((X) >> 3) &4) \
+                  + (((X) >> 1) &8) + (((X) << 1) &16) + (((X) << 3) &32) \
+                  + (((X) << 5) &64) + (((X) << 7) &128) )
+#define rev16(X)  (rev8 (X) + (rev8 (X >> 8) << 8))
+#define rev32(X)  (rev16(X) + (rev16(X >> 16) << 16))
+#define rev64(X)  (rev32(X) + (rev32(X >> 32) << 32))
+
+// (0xf0|(0xcc&0xaa))
+#define pickbits2_2_lut(a,b)     (lut3_0xf8_0xC(a,b))
+#define pickbits2_2(S)           pickbits2_2_lut( ((S >> 1) & 3) , (S >> 2) )
+
+// (0xf0|0xcc|0xaa)
+#define pickbits1_1_2_lut(a,b,c) (lut3_0xfe(a,b,c))
+#define pickbits1_1_2(S)         pickbits1_1_2_lut( ((S >> 7) & 1) , ((S >> 10) & 2) , ((S >> 11) & 0xC) )
+
+#define pickbits1x4_lut(a,b,c,d) (lut3_0xfe(a,b,c) | d)
+#define pickbits1x4(S)           pickbits1x4_lut( ((S >> 16) & 1) , ((S >> 19) & 2) , ((S >> 20) & 4) , ((S >> 22) & 8) )
+
+#define pickbits2_1_1_lut(a,b,c) (lut3_0xfe(a,b,c))
+#define pickbits2_1_1(S)         pickbits2_1_1_lut( ((S >> 27) & 3) , ((S >> 28) & 4) , ((S >> 29) & 8) )
+
+#define pickbits1_2_1_lut(a,b,c) (lut3_0xfe(a,b,c))
+#define pickbits1_2_1(S)         pickbits1_2_1_lut( ((S >> 33) & 1) , ((S >> 41) & 6) , ((S >> 42) & 8) )
+
+static uint hitag2_crypt (ulong x)
+{
+	const uint ht2_function4a = 0x2C79; // 0010 1100 0111 1001
+	const uint ht2_function4b = 0x6671; // 0110 0110 0111 0001
+	const uint ht2_function5c = 0x7907287B; // 0111 1001 0000 0111 0010 1000 0111 1011
+
+	uint bitindex;
+	bitindex = (ht2_function4a >> pickbits2_2(x)) & 1;
+	bitindex |= ((ht2_function4b << 1) >> pickbits1_1_2(x)) & 0x02;
+	bitindex |= ((ht2_function4b << 2) >> pickbits1x4(x)) & 0x04;
+	bitindex |= ((ht2_function4b << 3) >> pickbits2_1_1(x)) & 0x08;
+	bitindex |= ((ht2_function4a << 4) >> pickbits1_2_1(x)) & 0x10;
+
+	return (ht2_function5c >> bitindex) & 1;
+}
+
+static void hitag2_init2 (ulong *shiftreg, ulong *lfsr, const ulong sharedkey, const uint serialnum, uint initvector)
+{
+	ulong state = ((sharedkey & 0xFFFF) << 32) | serialnum;
+
+	initvector ^= (uint)(sharedkey >> 16);
+	state |= (ulong) initvector << 48;
+
+	initvector >>= 16;
+	state >>= 1;
+
+	for (uint x = 0; x < 16; x++) state = (state >> 1) ^ (ulong) hitag2_crypt (state) << 46;
+
+	state |= (ulong) initvector << 47;
+
+	for (uint x = 0; x < 15; x++) state = (state >> 1) ^ (ulong) hitag2_crypt (state) << 46;
+
+	state ^= (ulong) hitag2_crypt(state) << 47;
+
+	*shiftreg = state;
+
+//	ulong temp = state ^ (state >> 1);
+//	*lfsr = state ^ (state >>  6) ^ (state >> 16) ^ (state >> 26) ^ (state >> 30) ^ (state >> 41) ^
+//		(temp  >>  2) ^ (temp  >>  7) ^ (temp  >> 22) ^ (temp  >> 42) ^ (temp  >> 46);
+
+	*lfsr = (ulong) state ^
+		lut3_0x96 ((state >>  2), (state >>  3), (state >>  6)) ^
+		lut3_0x96 ((state >>  7), (state >>  8), (state >> 16)) ^
+		lut3_0x96 ((state >> 22), (state >> 23), (state >> 26)) ^
+		lut3_0x96 ((state >> 30), (state >> 41), (state >> 42)) ^
+		lut3_0x96 ((state >> 43), (state >> 46), (state >> 47));
+}
+
+static uint hitag2_nstep2 (ulong state, ulong lfsr)
+{
+	uint result = 0;
+	for (uint nsteps = 32; nsteps > 0; nsteps--)
+	{
+		if (lfsr & 1)
+		{
+			state  = (state >> 1) | 0x800000000000;
+			lfsr   = (lfsr >> 1) ^ 0xB38083220073;
+			result = (result << 1) | hitag2_crypt (state);
+		}
+		else
+		{
+			state >>= 1;
+			lfsr >>= 1;
+			result = (result << 1) | hitag2_crypt (state);
+		}
+	}
+	return result;
+}
+
+inline static int bitn(ulong x, int bit)
+{
+	const ulong bitmask = 1UL << bit;
+	return (x & bitmask) ? 1 : 0;
+}
+
+static int fnR (ulong x)
+{
+	return (bitn(x, 1) ^ bitn(x, 2) ^ bitn(x, 5) ^ bitn(x, 6) ^ bitn(x, 7) ^
+		bitn(x, 15) ^ bitn(x, 21) ^ bitn(x, 22) ^ bitn(x, 25) ^ bitn(x, 29) ^ bitn(x, 40) ^
+		bitn(x, 41) ^ bitn(x, 42) ^ bitn(x, 45) ^ bitn(x, 46) ^ bitn(x, 47));
+}
+
+inline static int fa(unsigned int i) {
+    return bitn(0x2C79, i);
+}
+
+inline static int fb(unsigned int i) {
+    return bitn(0x6671, i);
+}
+
+static int fnf (ulong s)
+{
+	const uint x1 = (bitn(s,  2) << 0) | lut3_0x96( (bitn(s,  3) << 1), (bitn(s,  5) << 2), (bitn(s,  6) << 3));
+	const uint x2 = (bitn(s,  8) << 0) | lut3_0x96( (bitn(s, 12) << 1), (bitn(s, 14) << 2), (bitn(s, 15) << 3));
+	const uint x3 = (bitn(s, 17) << 0) | lut3_0x96( (bitn(s, 21) << 1), (bitn(s, 23) << 2), (bitn(s, 26) << 3));
+	const uint x4 = (bitn(s, 28) << 0) | lut3_0x96( (bitn(s, 29) << 1), (bitn(s, 31) << 2), (bitn(s, 33) << 3));
+	const uint x5 = (bitn(s, 34) << 0) | lut3_0x96( (bitn(s, 43) << 1), (bitn(s, 44) << 2), (bitn(s, 46) << 3));
+	const uint x6 = lut3_0x96( (fa(x1) << 0), (fb(x2) << 1), lut3_0x96( (fb(x3) << 2), (fb(x4) << 3), (fa(x5) << 4)));
+
+	return bitn(0x7907287B, x6);
+}
+
+#endif // WITH_HITAG2_FULL
+
+// format this array with 32 bitsliced vectors of ones and zeroes representing the inverted keystream
+
+__kernel
+__attribute__((vec_type_hint(bitslice_t)))
+void find_state(const uint candidate_index_base,
+                __global const ushort *restrict candidates,
+//                __global const ulong *restrict candidates,
+                __global const bitslice_t *restrict _keystream,
+                __global ulong *restrict matches,
+#ifndef WITH_HITAG2_FULL
+                __global uint *restrict matches_found)
+#else
+		__global uint *restrict matches_found,
+		__global const uint *restrict _checks)
+#endif
+{
+	const size_t gid[2] = { get_global_id(0), get_global_id(1) };
+
+	// if (gid[0] == 0) printf("work-item 1,%u\n", gid[1]);
+
+	#ifdef HAVE_LOCAL_MEMORY
+	const size_t lid = get_local_id(0);
+	const size_t lsize = get_local_size(0);
+	#endif // HAVE_LOCAL_MEMORY
+
+	const uint index = 3 * (candidate_index_base + gid[0]); // dimension 0 should at least keep the execution units saturated - 8k is fine
+
+	const ulong3 c = { candidates[index], candidates[index + 1], candidates[index + 2] };
+
+	const ulong candidate = ( c.x << 32 | c.y << 16 | c.z );
+
+	#ifdef HAVE_LOCAL_MEMORY
+	// store keystream in local memory
+	__local bitslice_t keystream[32];
+
+	for (size_t i = lid; i < 32; i+= lsize) keystream[i] = _keystream[i];
+
+	#ifdef WITH_HITAG2_FULL
+	// store uid, aR2, nR1, nR2 in local memory
+	__local uint checks[4];
+
+	for (uint i = lid; i < 4; i+= lsize) checks[i] = _checks[i];
+	#endif
+
+	// threads syncronization
+	barrier (CLK_LOCAL_MEM_FENCE);
+	#else
+	#define keystream _keystream
+	#define checks _checks
+	#endif // HAVE_LOCAL_MEMORY
+
+	// we never actually set or use the lowest 2 bits the initial state, so we can save 2 bitslices everywhere
+	bitslice_t state[-2 + 48 + KEYSTREAM_LENGTH] = { 0 };
+
+	// set bits 0+2, 0+3, 0+5, 0+6, 0+8, 0+12, 0+14, 0+15, 0+17, 0+21, 0+23, 0+26, 0+28, 0+29, 0+31, 0+33, 0+34, 0+43, 0+44, 0+46
+	// get the 48-bit cipher states as 3 16-bit words from the host memory queue (to save 25% throughput)
+
+	// using 64bit candidate
+	//  const uint index = (candidate_index_base + gid[0]); // dimension 0 should at least keep the execution units saturated - 8k is fine
+	//  const ulong candidate = candidates[index];
+	//  bitslice (&state[-2 + 2], candidate >> 2);
+
+	// set all 48 state bits except the lowest 2
+	bitslice (&state[-2 + 2], candidate);
+
+	// set bits 3, 6, 8, 12, 15
+	state[-2 + 1 + 3] = 0xaaaaaaaa;
+	state[-2 + 1 + 6] = 0xcccccccc;
+	state[-2 + 1 + 8] = 0xf0f0f0f0;
+	state[-2 + 1 + 12] = 0xff00ff00;
+	state[-2 + 1 + 15] = 0xffff0000;
+
+	const uint i1 = gid[1]; // dimension 1 should be 1024
+	state[-2 + 18] = -((bool)(i1 & 0x1));
+	state[-2 + 22] = -((bool)(i1 & 0x2));
+	state[-2 + 24] = -((bool)(i1 & 0x4));
+	state[-2 + 27] = -((bool)(i1 & 0x8));
+	state[-2 + 30] = -((bool)(i1 & 0x10));
+	state[-2 + 32] = -((bool)(i1 & 0x20));
+	state[-2 + 35] = -((bool)(i1 & 0x40));
+	state[-2 + 45] = -((bool)(i1 & 0x80));
+	state[-2 + 47] = -((bool)(i1 & 0x100));
+	state[-2 + 48] = -((bool)(i1 & 0x200)); // guess lfsr output 0
+
+	// 0xfc07fef3f9fe
+	const bitslice_t filter1_0 = f_a_bs(state[-2 + 3], state[-2 + 4], state[-2 + 6], state[-2 + 7]);
+	const bitslice_t filter1_1 = f_b_bs(state[-2 + 9], state[-2 + 13], state[-2 + 15], state[-2 + 16]);
+	const bitslice_t filter1_2 = f_b_bs(state[-2 + 18], state[-2 + 22], state[-2 + 24], state[-2 + 27]);
+	const bitslice_t filter1_3 = f_b_bs(state[-2 + 29], state[-2 + 30], state[-2 + 32], state[-2 + 34]);
+	const bitslice_t filter1_4 = f_a_bs(state[-2 + 35], state[-2 + 44], state[-2 + 45], state[-2 + 47]);
+	const bitslice_t filter1 = f_c_bs(filter1_0, filter1_1, filter1_2, filter1_3, filter1_4);
+
+	const bitslice_t results1 = filter1 ^ keystream[1];
+	if (!results1) return;
+
+	const bitslice_t filter2_0 = f_a_bs(state[-2 + 4], state[-2 + 5], state[-2 + 7], state[-2 + 8]);
+	const bitslice_t filter2_3 = f_b_bs(state[-2 + 30], state[-2 + 31], state[-2 + 33], state[-2 + 35]);
+	const bitslice_t filter3_0 = f_a_bs(state[-2 + 5], state[-2 + 6], state[-2 + 8], state[-2 + 9]);
+	const bitslice_t filter5_2 = f_b_bs(state[-2 + 22], state[-2 + 26], state[-2 + 28], state[-2 + 31]);
+	const bitslice_t filter6_2 = f_b_bs(state[-2 + 23], state[-2 + 27], state[-2 + 29], state[-2 + 32]);
+	const bitslice_t filter7_2 = f_b_bs(state[-2 + 24], state[-2 + 28], state[-2 + 30], state[-2 + 33]);
+	const bitslice_t filter9_1 = f_b_bs(state[-2 + 17], state[-2 + 21], state[-2 + 23], state[-2 + 24]);
+	const bitslice_t filter9_2 = f_b_bs(state[-2 + 26], state[-2 + 30], state[-2 + 32], state[-2 + 35]);
+	const bitslice_t filter10_0 = f_a_bs(state[-2 + 12], state[-2 + 13], state[-2 + 15], state[-2 + 16]);
+	const bitslice_t filter11_0 = f_a_bs(state[-2 + 13], state[-2 + 14], state[-2 + 16], state[-2 + 17]);
+	const bitslice_t filter12_0 = f_a_bs(state[-2 + 14], state[-2 + 15], state[-2 + 17], state[-2 + 18]);
+	const bitslice_t filter14_1 = f_b_bs(state[-2 + 22], state[-2 + 26], state[-2 + 28], state[-2 + 29]);
+	const bitslice_t filter15_1 = f_b_bs(state[-2 + 23], state[-2 + 27], state[-2 + 29], state[-2 + 30]);
+	const bitslice_t filter15_3 = f_b_bs(state[-2 + 43], state[-2 + 44], state[-2 + 46], state[-2 + 48]);
+	const bitslice_t filter16_1 = f_b_bs(state[-2 + 24], state[-2 + 28], state[-2 + 30], state[-2 + 31]);
+
+	for (uint i2 = 0; i2 < 32; i2++) {
+		state[-2 + 10] = -((bool)(i2 & 0x1));
+		state[-2 + 19] = -((bool)(i2 & 0x2));
+		state[-2 + 25] = -((bool)(i2 & 0x4));
+		state[-2 + 36] = -((bool)(i2 & 0x8));
+		state[-2 + 49] = -((bool)(i2 & 0x10)); // guess lfsr output 1
+
+		// 0xfe07fffbfdff
+		const bitslice_t filter2_1 = f_b_bs(state[-2 + 10], state[-2 + 14], state[-2 + 16], state[-2 + 17]);
+		const bitslice_t filter2_2 = f_b_bs(state[-2 + 19], state[-2 + 23], state[-2 + 25], state[-2 + 28]);
+		const bitslice_t filter2_4 = f_a_bs(state[-2 + 36], state[-2 + 45], state[-2 + 46], state[-2 + 48]);
+		const bitslice_t filter2 = f_c_bs(filter2_0, filter2_1, filter2_2, filter2_3, filter2_4);
+
+		const bitslice_t results2 = bs_res(results1,filter2,keystream[2]);
+		if (!results2) continue;
+
+		state[-2 + 50] = lfsr_bs(2);
+		const bitslice_t filter3_3 = f_b_bs(state[-2 + 31], state[-2 + 32], state[-2 + 34], state[-2 + 36]);
+		const bitslice_t filter4_0 = f_a_bs(state[-2 + 6], state[-2 + 7], state[-2 + 9], state[-2 + 10]);
+		const bitslice_t filter4_1 = f_b_bs(state[-2 + 12], state[-2 + 16], state[-2 + 18], state[-2 + 19]);
+		const bitslice_t filter4_2 = f_b_bs(state[-2 + 21], state[-2 + 25], state[-2 + 27], state[-2 + 30]);
+		const bitslice_t filter7_0 = f_a_bs(state[-2 + 9], state[-2 + 10], state[-2 + 12], state[-2 + 13]);
+		const bitslice_t filter7_1 = f_b_bs(state[-2 + 15], state[-2 + 19], state[-2 + 21], state[-2 + 22]);
+		const bitslice_t filter8_2 = f_b_bs(state[-2 + 25], state[-2 + 29], state[-2 + 31], state[-2 + 34]);
+		const bitslice_t filter10_1 = f_b_bs(state[-2 + 18], state[-2 + 22], state[-2 + 24], state[-2 + 25]);
+		const bitslice_t filter10_2 = f_b_bs(state[-2 + 27], state[-2 + 31], state[-2 + 33], state[-2 + 36]);
+		const bitslice_t filter11_1 = f_b_bs(state[-2 + 19], state[-2 + 23], state[-2 + 25], state[-2 + 26]);
+		const bitslice_t filter13_0 = f_a_bs(state[-2 + 15], state[-2 + 16], state[-2 + 18], state[-2 + 19]);
+		const bitslice_t filter13_1 = f_b_bs(state[-2 + 21], state[-2 + 25], state[-2 + 27], state[-2 + 28]);
+		const bitslice_t filter16_0 = f_a_bs(state[-2 + 18], state[-2 + 19], state[-2 + 21], state[-2 + 22]);
+		const bitslice_t filter16_3 = f_b_bs(state[-2 + 44], state[-2 + 45], state[-2 + 47], state[-2 + 49]);
+		const bitslice_t filter17_1 = f_b_bs(state[-2 + 25], state[-2 + 29], state[-2 + 31], state[-2 + 32]);
+		const bitslice_t filter17_3 = f_b_bs(state[-2 + 45], state[-2 + 46], state[-2 + 48], state[-2 + 50]);
+
+		for (uint i3 = 0; i3 < 8; i3++) {
+			state[-2 + 11] = -((bool)(i3 & 0x1));
+			state[-2 + 20] = -((bool)(i3 & 0x2));
+			state[-2 + 37] = -((bool)(i3 & 0x4));
+
+			// 0xff07ffffffff
+			const bitslice_t filter3_1 = f_b_bs(state[-2 + 11], state[-2 + 15], state[-2 + 17], state[-2 + 18]);
+			const bitslice_t filter3_2 = f_b_bs(state[-2 + 20], state[-2 + 24], state[-2 + 26], state[-2 + 29]);
+			const bitslice_t filter3_4 = f_a_bs(state[-2 + 37], state[-2 + 46], state[-2 + 47], state[-2 + 49]);
+			const bitslice_t filter3 = f_c_bs(filter3_0, filter3_1, filter3_2, filter3_3, filter3_4);
+
+			const bitslice_t results3 = bs_res(results2,filter3,keystream[3]);
+			if (!results3) continue;
+
+			state[-2 + 51] = lfsr_bs(3);
+			state[-2 + 52] = lfsr_bs(4);
+			state[-2 + 53] = lfsr_bs(5);
+			state[-2 + 54] = lfsr_bs(6);
+			state[-2 + 55] = lfsr_bs(7);
+
+			const bitslice_t filter4_3 = f_b_bs(state[-2 + 32], state[-2 + 33], state[-2 + 35], state[-2 + 37]);
+			const bitslice_t filter5_0 = f_a_bs(state[-2 + 7], state[-2 + 8], state[-2 + 10], state[-2 + 11]);
+			const bitslice_t filter5_1 = f_b_bs(state[-2 + 13], state[-2 + 17], state[-2 + 19], state[-2 + 20]);
+			const bitslice_t filter6_0 = f_a_bs(state[-2 + 8], state[-2 + 9], state[-2 + 11], state[-2 + 12]);
+			const bitslice_t filter6_1 = f_b_bs(state[-2 + 14], state[-2 + 18], state[-2 + 20], state[-2 + 21]);
+			const bitslice_t filter8_0 = f_a_bs(state[-2 + 10], state[-2 + 11], state[-2 + 13], state[-2 + 14]);
+			const bitslice_t filter8_1 = f_b_bs(state[-2 + 16], state[-2 + 20], state[-2 + 22], state[-2 + 23]);
+			const bitslice_t filter9_0 = f_a_bs(state[-2 + 11], state[-2 + 12], state[-2 + 14], state[-2 + 15]);
+			const bitslice_t filter9_4 = f_a_bs(state[-2 + 43], state[-2 + 52], state[-2 + 53], state[-2 + 55]);
+			const bitslice_t filter11_2 = f_b_bs(state[-2 + 28], state[-2 + 32], state[-2 + 34], state[-2 + 37]);
+			const bitslice_t filter12_1 = f_b_bs(state[-2 + 20], state[-2 + 24], state[-2 + 26], state[-2 + 27]);
+			const bitslice_t filter14_0 = f_a_bs(state[-2 + 16], state[-2 + 17], state[-2 + 19], state[-2 + 20]);
+			const bitslice_t filter15_0 = f_a_bs(state[-2 + 17], state[-2 + 18], state[-2 + 20], state[-2 + 21]);
+			const bitslice_t filter17_0 = f_a_bs(state[-2 + 19], state[-2 + 20], state[-2 + 22], state[-2 + 23]);
+
+			for (uint i4 = 0; i4 < 2; i4++) {
+				state[-2 + 38] = -i4;
+
+				// 0xff87ffffffff
+				const bitslice_t filter4_4 = f_a_bs(state[-2 + 38], state[-2 + 47], state[-2 + 48], state[-2 + 50]);
+				const bitslice_t filter4 = f_c_bs(filter4_0, filter4_1, filter4_2, filter4_3, filter4_4);
+
+				const bitslice_t results4 = bs_res(results3,filter4,keystream[4]);
+				if (!results4) continue;
+
+				state[-2 + 56] = lfsr_bs(8);
+				const bitslice_t filter5_3 = f_b_bs(state[-2 + 33], state[-2 + 34], state[-2 + 36], state[-2 + 38]);
+				const bitslice_t filter10_4 = f_a_bs(state[-2 + 44], state[-2 + 53], state[-2 + 54], state[-2 + 56]);
+				const bitslice_t filter12_2 = f_b_bs(state[-2 + 29], state[-2 + 33], state[-2 + 35], state[-2 + 38]);
+
+				for (uint i5 = 0; i5 < 2; i5++) {
+					state[-2 + 39] = -i5;
+
+					// 0xffc7ffffffff
+					const bitslice_t filter5_4 = f_a_bs(state[-2 + 39], state[-2 + 48], state[-2 + 49], state[-2 + 51]);
+					const bitslice_t filter5 = f_c_bs(filter5_0, filter5_1, filter5_2, filter5_3, filter5_4);
+
+					const bitslice_t results5 = bs_res(results4,filter5,keystream[5]);
+					if (!results5) continue;
+
+					state[-2 + 57] = lfsr_bs(9);
+					const bitslice_t filter6_3 = f_b_bs(state[-2 + 34], state[-2 + 35], state[-2 + 37], state[-2 + 39]);
+					const bitslice_t filter11_4 = f_a_bs(state[-2 + 45], state[-2 + 54], state[-2 + 55], state[-2 + 57]);
+					const bitslice_t filter13_2 = f_b_bs(state[-2 + 30], state[-2 + 34], state[-2 + 36], state[-2 + 39]);
+
+					for (uint i6 = 0; i6 < 2; i6++) {
+						state[-2 + 40] = -i6;
+
+						// 0xffe7ffffffff
+						const bitslice_t filter6_4 = f_a_bs(state[-2 + 40], state[-2 + 49], state[-2 + 50], state[-2 + 52]);
+						const bitslice_t filter6 = f_c_bs(filter6_0, filter6_1, filter6_2, filter6_3, filter6_4);
+
+						const bitslice_t results6 = bs_res(results5,filter6,keystream[6]);
+						if (!results6) continue;
+
+						state[-2 + 58] = lfsr_bs(10);
+						const bitslice_t filter7_3 = f_b_bs(state[-2 + 35], state[-2 + 36], state[-2 + 38], state[-2 + 40]);
+						const bitslice_t filter12_4 = f_a_bs(state[-2 + 46], state[-2 + 55], state[-2 + 56], state[-2 + 58]);
+						const bitslice_t filter14_2 = f_b_bs(state[-2 + 31], state[-2 + 35], state[-2 + 37], state[-2 + 40]);
+						const bitslice_t filter17_2 = f_b_bs(state[-2 + 34], state[-2 + 38], state[-2 + 40], state[-2 + 43]);
+
+						#pragma unroll
+						for (uint i7 = 0; i7 < 2; i7++) {
+							state[-2 + 41] = -i7;
+
+							// 0xfff7ffffffff
+							const bitslice_t filter7_4 = f_a_bs(state[-2 + 41], state[-2 + 50], state[-2 + 51], state[-2 + 53]);
+							const bitslice_t filter7 = f_c_bs(filter7_0, filter7_1, filter7_2, filter7_3, filter7_4);
+
+							const bitslice_t results7 = bs_res(results6,filter7,keystream[7]);
+							if (!results7) continue;
+
+							state[-2 + 59] = lfsr_bs(11);
+							const bitslice_t filter8_3 = f_b_bs(state[-2 + 36], state[-2 + 37], state[-2 + 39], state[-2 + 41]);
+							const bitslice_t filter10_3 = f_b_bs(state[-2 + 38], state[-2 + 39], state[-2 + 41], state[-2 + 43]);
+							const bitslice_t filter10 = f_c_bs(filter10_0, filter10_1, filter10_2, filter10_3, filter10_4);
+							const bitslice_t filter12_3 = f_b_bs(state[-2 + 40], state[-2 + 41], state[-2 + 43], state[-2 + 45]);
+							const bitslice_t filter12 = f_c_bs(filter12_0, filter12_1, filter12_2, filter12_3, filter12_4);
+							const bitslice_t filter13_4 = f_a_bs(state[-2 + 47], state[-2 + 56], state[-2 + 57], state[-2 + 59]);
+							const bitslice_t filter15_2 = f_b_bs(state[-2 + 32], state[-2 + 36], state[-2 + 38], state[-2 + 41]);
+
+							#pragma unroll
+							for (uint i8 = 0; i8 < 2; i8++) {
+								state[-2 + 42] = -i8;
+
+								// 0xffffffffffff
+								const bitslice_t filter8_4 = f_a_bs(state[-2 + 42], state[-2 + 51], state[-2 + 52], state[-2 + 54]);
+								const bitslice_t filter8 = f_c_bs(filter8_0, filter8_1, filter8_2, filter8_3, filter8_4);
+
+								bitslice_t results8 = bs_res(results7,filter8,keystream[8]);
+								if (!results8) continue;
+
+								const bitslice_t filter9_3 = f_b_bs(state[-2 + 37], state[-2 + 38], state[-2 + 40], state[-2 + 42]);
+								const bitslice_t filter9 = f_c_bs(filter9_0, filter9_1, filter9_2, filter9_3, filter9_4);
+                                
+								results8 &= (filter9 ^ keystream[9]);
+								if (!results8) continue;
+
+								results8 &= (filter10 ^ keystream[10]);
+								if (!results8) continue;
+
+								const bitslice_t filter11_3 = f_b_bs(state[-2 + 39], state[-2 + 40], state[-2 + 42], state[-2 + 44]);
+								const bitslice_t filter11 = f_c_bs(filter11_0, filter11_1, filter11_2, filter11_3, filter11_4);
+
+								results8 &= (filter11 ^ keystream[11]);
+								if (!results8) continue;
+
+								results8 &= (filter12 ^ keystream[12]);
+								if (!results8) continue;
+
+								const bitslice_t filter13_3 = f_b_bs(state[-2 + 41], state[-2 + 42], state[-2 + 44], state[-2 + 46]);
+								const bitslice_t filter13 = f_c_bs(filter13_0, filter13_1, filter13_2, filter13_3, filter13_4);
+
+								results8 &= (filter13 ^ keystream[13]);
+								if (!results8) continue;
+
+								state[-2 + 60] = lfsr_bs(12);
+								const bitslice_t filter14_3 = f_b_bs(state[-2 + 42], state[-2 + 43], state[-2 + 45], state[-2 + 47]);
+								const bitslice_t filter14_4 = f_a_bs(state[-2 + 48], state[-2 + 57], state[-2 + 58], state[-2 + 60]);
+								const bitslice_t filter14 = f_c_bs(filter14_0, filter14_1, filter14_2, filter14_3, filter14_4);
+
+								results8 &= (filter14 ^ keystream[14]);
+								if (!results8) continue;
+
+								state[-2 + 61] = lfsr_bs(13);
+								const bitslice_t filter15_4 = f_a_bs(state[-2 + 49], state[-2 + 58], state[-2 + 59], state[-2 + 61]);
+								const bitslice_t filter15 = f_c_bs(filter15_0, filter15_1, filter15_2, filter15_3, filter15_4);
+
+								results8 &= (filter15 ^ keystream[15]);
+								if (!results8) continue;
+
+								state[-2 + 62] = lfsr_bs(14);
+								const bitslice_t filter16_2 = f_b_bs(state[-2 + 33], state[-2 + 37], state[-2 + 39], state[-2 + 42]);
+								const bitslice_t filter16_4 = f_a_bs(state[-2 + 50], state[-2 + 59], state[-2 + 60], state[-2 + 62]);
+								const bitslice_t filter16 = f_c_bs(filter16_0, filter16_1, filter16_2, filter16_3, filter16_4);
+
+								results8 &= (filter16 ^ keystream[16]);
+								if (!results8) continue;
+
+								state[-2 + 63] = lfsr_bs(15);
+								const bitslice_t filter17_4 = f_a_bs(state[-2 + 51], state[-2 + 60], state[-2 + 61], state[-2 + 63]);
+								const bitslice_t filter17 = f_c_bs(filter17_0, filter17_1, filter17_2, filter17_3, filter17_4);
+
+								results8 &= (filter17 ^ keystream[17]);
+								if (!results8) continue;
+
+								state[-2 + 64] = lfsr_bs(16);
+								const bitslice_t filter18_0 = f_a_bs(state[-2 + 20], state[-2 + 21], state[-2 + 23], state[-2 + 24]);
+								const bitslice_t filter18_1 = f_b_bs(state[-2 + 26], state[-2 + 30], state[-2 + 32], state[-2 + 33]);
+								const bitslice_t filter18_2 = f_b_bs(state[-2 + 35], state[-2 + 39], state[-2 + 41], state[-2 + 44]);
+								const bitslice_t filter18_3 = f_b_bs(state[-2 + 46], state[-2 + 47], state[-2 + 49], state[-2 + 51]);
+								const bitslice_t filter18_4 = f_a_bs(state[-2 + 52], state[-2 + 61], state[-2 + 62], state[-2 + 64]);
+								const bitslice_t filter18 = f_c_bs(filter18_0, filter18_1, filter18_2, filter18_3, filter18_4);
+
+								results8 &= (filter18 ^ keystream[18]);
+								if (!results8) continue;
+
+								state[-2 + 65] = lfsr_bs(17);
+								const bitslice_t filter19_0 = f_a_bs(state[-2 + 21], state[-2 + 22], state[-2 + 24], state[-2 + 25]);
+								const bitslice_t filter19_1 = f_b_bs(state[-2 + 27], state[-2 + 31], state[-2 + 33], state[-2 + 34]);
+								const bitslice_t filter19_2 = f_b_bs(state[-2 + 36], state[-2 + 40], state[-2 + 42], state[-2 + 45]);
+								const bitslice_t filter19_3 = f_b_bs(state[-2 + 47], state[-2 + 48], state[-2 + 50], state[-2 + 52]);
+								const bitslice_t filter19_4 = f_a_bs(state[-2 + 53], state[-2 + 62], state[-2 + 63], state[-2 + 65]);
+								const bitslice_t filter19 = f_c_bs(filter19_0, filter19_1, filter19_2, filter19_3, filter19_4);
+
+								results8 &= (filter19 ^ keystream[19]);
+								if (!results8) continue;
+
+								state[-2 + 66] = lfsr_bs(18);
+								const bitslice_t filter20_0 = f_a_bs(state[-2 + 22], state[-2 + 23], state[-2 + 25], state[-2 + 26]);
+								const bitslice_t filter20_1 = f_b_bs(state[-2 + 28], state[-2 + 32], state[-2 + 34], state[-2 + 35]);
+								const bitslice_t filter20_2 = f_b_bs(state[-2 + 37], state[-2 + 41], state[-2 + 43], state[-2 + 46]);
+								const bitslice_t filter20_3 = f_b_bs(state[-2 + 48], state[-2 + 49], state[-2 + 51], state[-2 + 53]);
+								const bitslice_t filter20_4 = f_a_bs(state[-2 + 54], state[-2 + 63], state[-2 + 64], state[-2 + 66]);
+								const bitslice_t filter20 = f_c_bs(filter20_0, filter20_1, filter20_2, filter20_3, filter20_4);
+
+								results8 &= (filter20 ^ keystream[20]);
+								if (!results8) continue;
+
+								state[-2 + 67] = lfsr_bs(19);
+								const bitslice_t filter21_0 = f_a_bs(state[-2 + 23], state[-2 + 24], state[-2 + 26], state[-2 + 27]);
+								const bitslice_t filter21_1 = f_b_bs(state[-2 + 29], state[-2 + 33], state[-2 + 35], state[-2 + 36]);
+								const bitslice_t filter21_2 = f_b_bs(state[-2 + 38], state[-2 + 42], state[-2 + 44], state[-2 + 47]);
+								const bitslice_t filter21_3 = f_b_bs(state[-2 + 49], state[-2 + 50], state[-2 + 52], state[-2 + 54]);
+								const bitslice_t filter21_4 = f_a_bs(state[-2 + 55], state[-2 + 64], state[-2 + 65], state[-2 + 67]);
+								const bitslice_t filter21 = f_c_bs(filter21_0, filter21_1, filter21_2, filter21_3, filter21_4);
+
+								results8 &= (filter21 ^ keystream[21]);
+								if (!results8) continue;
+
+								state[-2 + 68] = lfsr_bs(20);
+								const bitslice_t filter22_0 = f_a_bs(state[-2 + 24], state[-2 + 25], state[-2 + 27], state[-2 + 28]);
+								const bitslice_t filter22_1 = f_b_bs(state[-2 + 30], state[-2 + 34], state[-2 + 36], state[-2 + 37]);
+								const bitslice_t filter22_2 = f_b_bs(state[-2 + 39], state[-2 + 43], state[-2 + 45], state[-2 + 48]);
+								const bitslice_t filter22_3 = f_b_bs(state[-2 + 50], state[-2 + 51], state[-2 + 53], state[-2 + 55]);
+								const bitslice_t filter22_4 = f_a_bs(state[-2 + 56], state[-2 + 65], state[-2 + 66], state[-2 + 68]);
+								const bitslice_t filter22 = f_c_bs(filter22_0, filter22_1, filter22_2, filter22_3, filter22_4);
+
+								results8 &= (filter22 ^ keystream[22]);
+								if (!results8) continue;
+
+								state[-2 + 69] = lfsr_bs(21);
+								const bitslice_t filter23_0 = f_a_bs(state[-2 + 25], state[-2 + 26], state[-2 + 28], state[-2 + 29]);
+								const bitslice_t filter23_1 = f_b_bs(state[-2 + 31], state[-2 + 35], state[-2 + 37], state[-2 + 38]);
+								const bitslice_t filter23_2 = f_b_bs(state[-2 + 40], state[-2 + 44], state[-2 + 46], state[-2 + 49]);
+								const bitslice_t filter23_3 = f_b_bs(state[-2 + 51], state[-2 + 52], state[-2 + 54], state[-2 + 56]);
+								const bitslice_t filter23_4 = f_a_bs(state[-2 + 57], state[-2 + 66], state[-2 + 67], state[-2 + 69]);
+								const bitslice_t filter23 = f_c_bs(filter23_0, filter23_1, filter23_2, filter23_3, filter23_4);
+
+								results8 &= (filter23 ^ keystream[23]);
+								if (!results8) continue;
+
+								state[-2 + 70] = lfsr_bs(22);
+								const bitslice_t filter24_0 = f_a_bs(state[-2 + 26], state[-2 + 27], state[-2 + 29], state[-2 + 30]);
+								const bitslice_t filter24_1 = f_b_bs(state[-2 + 32], state[-2 + 36], state[-2 + 38], state[-2 + 39]);
+								const bitslice_t filter24_2 = f_b_bs(state[-2 + 41], state[-2 + 45], state[-2 + 47], state[-2 + 50]);
+								const bitslice_t filter24_3 = f_b_bs(state[-2 + 52], state[-2 + 53], state[-2 + 55], state[-2 + 57]);
+								const bitslice_t filter24_4 = f_a_bs(state[-2 + 58], state[-2 + 67], state[-2 + 68], state[-2 + 70]);
+								const bitslice_t filter24 = f_c_bs(filter24_0, filter24_1, filter24_2, filter24_3, filter24_4);
+
+								results8 &= (filter24 ^ keystream[24]);
+								if (!results8) continue;
+
+								state[-2 + 71] = lfsr_bs(23);
+								const bitslice_t filter25_0 = f_a_bs(state[-2 + 27], state[-2 + 28], state[-2 + 30], state[-2 + 31]);
+								const bitslice_t filter25_1 = f_b_bs(state[-2 + 33], state[-2 + 37], state[-2 + 39], state[-2 + 40]);
+								const bitslice_t filter25_2 = f_b_bs(state[-2 + 42], state[-2 + 46], state[-2 + 48], state[-2 + 51]);
+								const bitslice_t filter25_3 = f_b_bs(state[-2 + 53], state[-2 + 54], state[-2 + 56], state[-2 + 58]);
+								const bitslice_t filter25_4 = f_a_bs(state[-2 + 59], state[-2 + 68], state[-2 + 69], state[-2 + 71]);
+								const bitslice_t filter25 = f_c_bs(filter25_0, filter25_1, filter25_2, filter25_3, filter25_4);
+
+								results8 &= (filter25 ^ keystream[25]);
+								if (!results8) continue;
+
+								state[-2 + 72] = lfsr_bs(24);
+								const bitslice_t filter26_0 = f_a_bs(state[-2 + 28], state[-2 + 29], state[-2 + 31], state[-2 + 32]);
+								const bitslice_t filter26_1 = f_b_bs(state[-2 + 34], state[-2 + 38], state[-2 + 40], state[-2 + 41]);
+								const bitslice_t filter26_2 = f_b_bs(state[-2 + 43], state[-2 + 47], state[-2 + 49], state[-2 + 52]);
+								const bitslice_t filter26_3 = f_b_bs(state[-2 + 54], state[-2 + 55], state[-2 + 57], state[-2 + 59]);
+								const bitslice_t filter26_4 = f_a_bs(state[-2 + 60], state[-2 + 69], state[-2 + 70], state[-2 + 72]);
+								const bitslice_t filter26 = f_c_bs(filter26_0, filter26_1, filter26_2, filter26_3, filter26_4);
+
+								results8 &= (filter26 ^ keystream[26]);
+								if (!results8) continue;
+
+								state[-2 + 73] = lfsr_bs(25);
+								const bitslice_t filter27_0 = f_a_bs(state[-2 + 29], state[-2 + 30], state[-2 + 32], state[-2 + 33]);
+								const bitslice_t filter27_1 = f_b_bs(state[-2 + 35], state[-2 + 39], state[-2 + 41], state[-2 + 42]);
+								const bitslice_t filter27_2 = f_b_bs(state[-2 + 44], state[-2 + 48], state[-2 + 50], state[-2 + 53]);
+								const bitslice_t filter27_3 = f_b_bs(state[-2 + 55], state[-2 + 56], state[-2 + 58], state[-2 + 60]);
+								const bitslice_t filter27_4 = f_a_bs(state[-2 + 61], state[-2 + 70], state[-2 + 71], state[-2 + 73]);
+								const bitslice_t filter27 = f_c_bs(filter27_0, filter27_1, filter27_2, filter27_3, filter27_4);
+
+								results8 &= (filter27 ^ keystream[27]);
+								if (!results8) continue;
+
+								state[-2 + 74] = lfsr_bs(26);
+								const bitslice_t filter28_0 = f_a_bs(state[-2 + 30], state[-2 + 31], state[-2 + 33], state[-2 + 34]);
+								const bitslice_t filter28_1 = f_b_bs(state[-2 + 36], state[-2 + 40], state[-2 + 42], state[-2 + 43]);
+								const bitslice_t filter28_2 = f_b_bs(state[-2 + 45], state[-2 + 49], state[-2 + 51], state[-2 + 54]);
+								const bitslice_t filter28_3 = f_b_bs(state[-2 + 56], state[-2 + 57], state[-2 + 59], state[-2 + 61]);
+								const bitslice_t filter28_4 = f_a_bs(state[-2 + 62], state[-2 + 71], state[-2 + 72], state[-2 + 74]);
+								const bitslice_t filter28 = f_c_bs(filter28_0, filter28_1, filter28_2, filter28_3, filter28_4);
+
+								results8 &= (filter28 ^ keystream[28]);
+								if (!results8) continue;
+
+								state[-2 + 75] = lfsr_bs(27);
+								const bitslice_t filter29_0 = f_a_bs(state[-2 + 31], state[-2 + 32], state[-2 + 34], state[-2 + 35]);
+								const bitslice_t filter29_1 = f_b_bs(state[-2 + 37], state[-2 + 41], state[-2 + 43], state[-2 + 44]);
+								const bitslice_t filter29_2 = f_b_bs(state[-2 + 46], state[-2 + 50], state[-2 + 52], state[-2 + 55]);
+								const bitslice_t filter29_3 = f_b_bs(state[-2 + 57], state[-2 + 58], state[-2 + 60], state[-2 + 62]);
+								const bitslice_t filter29_4 = f_a_bs(state[-2 + 63], state[-2 + 72], state[-2 + 73], state[-2 + 75]);
+								const bitslice_t filter29 = f_c_bs(filter29_0, filter29_1, filter29_2, filter29_3, filter29_4);
+
+								results8 &= (filter29 ^ keystream[29]);
+								if (!results8) continue;
+
+								state[-2 + 76] = lfsr_bs(28);
+								const bitslice_t filter30_0 = f_a_bs(state[-2 + 32], state[-2 + 33], state[-2 + 35], state[-2 + 36]);
+								const bitslice_t filter30_1 = f_b_bs(state[-2 + 38], state[-2 + 42], state[-2 + 44], state[-2 + 45]);
+								const bitslice_t filter30_2 = f_b_bs(state[-2 + 47], state[-2 + 51], state[-2 + 53], state[-2 + 56]);
+								const bitslice_t filter30_3 = f_b_bs(state[-2 + 58], state[-2 + 59], state[-2 + 61], state[-2 + 63]);
+								const bitslice_t filter30_4 = f_a_bs(state[-2 + 64], state[-2 + 73], state[-2 + 74], state[-2 + 76]);
+								const bitslice_t filter30 = f_c_bs(filter30_0, filter30_1, filter30_2, filter30_3, filter30_4);
+
+								results8 &= (filter30 ^ keystream[30]);
+								if (!results8) continue;
+
+								state[-2 + 77] = lfsr_bs(29);
+								const bitslice_t filter31_0 = f_a_bs(state[-2 + 33], state[-2 + 34], state[-2 + 36], state[-2 + 37]);
+								const bitslice_t filter31_1 = f_b_bs(state[-2 + 39], state[-2 + 43], state[-2 + 45], state[-2 + 46]);
+								const bitslice_t filter31_2 = f_b_bs(state[-2 + 48], state[-2 + 52], state[-2 + 54], state[-2 + 57]);
+								const bitslice_t filter31_3 = f_b_bs(state[-2 + 59], state[-2 + 60], state[-2 + 62], state[-2 + 64]);
+								const bitslice_t filter31_4 = f_a_bs(state[-2 + 65], state[-2 + 74], state[-2 + 75], state[-2 + 77]);
+								const bitslice_t filter31 = f_c_bs(filter31_0, filter31_1, filter31_2, filter31_3, filter31_4);
+
+								results8 &= (filter31 ^ keystream[31]);
+								if (!results8) continue;
+
+								for (uint match_index = 0; match_index < MAX_BITSLICES && results8;) {
+									const uint shift = clz(results8) + 1;
+									match_index += shift;
+
+									#ifdef WITH_HITAG2_FULL
+
+									ulong state_check = unbitslice (&state[-2 + 2], MAX_BITSLICES - match_index);
+
+									// 2 rollback
+									state_check = (ulong)(((state_check << 1) & 0xffffffffffff) | (ulong)fnR(state_check));
+									state_check = (ulong)(((state_check << 1) & 0xffffffffffff) | (ulong)fnR(state_check));
+
+									// recover key
+									ulong keyrev = state_check & 0xffff;
+									ulong nR1xk = (state_check >> 16) & 0xffffffff;
+
+									uint b = 0;
+
+									for (uint i = 0; i < 32; i++) {
+										state_check = ((state_check) << 1) | ((checks[0] >> (31 - i)) & 0x1);
+										b = (b << 1) | fnf (state_check);
+									}
+
+									keyrev |= (nR1xk ^ checks[2] ^ b) << 16;
+
+									ulong lfsr = 0;
+
+									// test key
+									hitag2_init2 (&state_check, &lfsr, keyrev, checks[0], checks[3]);
+
+									if ((checks[1] ^ hitag2_nstep2 (state_check, lfsr)) == 0xffffffff)
+									{
+										// there can be only one (Highlander) :P
+										matches[atomic_inc(matches_found)] = rev64 (keyrev);
+										return;
+									}
+
+									#else
+
+									// take the state from layer 2 so we can recover the lowest 2 bits on the host by inverting the LFSR
+									matches[atomic_inc(matches_found)] = unbitslice (&state[-2 + 2], MAX_BITSLICES - match_index);
+
+
+									#endif // WITH_HITAG2_FULL
+
+									results8 <<= shift;
+								} // key check
+							} // 8
+						} // 7
+					} // 6
+				} // 5
+			} // 4
+		} // 3
+	} // 2
+} // 1
diff --git a/tools/hitag2crack/crack5opencl/opencl.c b/tools/hitag2crack/crack5opencl/opencl.c
new file mode 100644
index 000000000..161155b6c
--- /dev/null
+++ b/tools/hitag2crack/crack5opencl/opencl.c
@@ -0,0 +1,163 @@
+/****************************************************************************
+
+Author : Gabriele 'matrix' Gristina <gabriele.gristina@gmail.com>
+Date   : Sun Jan 10 13:59:37 CET 2021
+Version: 0.1beta
+License: GNU General Public License v3 or any later version (see LICENSE.txt)
+
+*****************************************************************************
+    Copyright (C) 2020-2021  <Gabriele Gristina>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+****************************************************************************/
+
+#include "opencl.h"
+
+bool plat_dev_enabled (unsigned int id, unsigned int *sel, unsigned int cnt, unsigned int cur_type, unsigned int allow_type)
+{
+	// usefull only with devices
+	if (allow_type != CL_DEVICE_TYPE_ALL)
+	{
+		if (cur_type != allow_type) return false;
+	}
+
+	if (sel[0] == 0xff) return true; // all
+	else
+	{
+		for (unsigned int i = 0; i < cnt; i++)
+		{
+			if (sel[i] == (id+1)) return true;
+		}
+	}
+
+	return false;
+}
+
+int runKernel (opencl_ctx_t *ctx, uint32_t cand_base, uint64_t *matches, uint32_t *matches_found, size_t id)
+{
+	int err = 0;
+
+	size_t global_ws[3] = { ctx->global_ws[id], GLOBAL_WS_1, GLOBAL_WS_2 };
+	size_t local_ws[3]  = { ctx->local_ws[id], 1, 1 };
+
+	if (ctx->profiling)
+	{
+		printf ("[%zu] global_ws %zu, ctx->local_ws: %zu\n", id, global_ws[0], local_ws[0]);
+		fflush (stdout);
+	}
+
+	*matches_found = 0;
+
+	// Write our data set into the input array in device memory
+	err = clEnqueueWriteBuffer (ctx->commands[id], ctx->matches_found[id], CL_TRUE, 0, sizeof(uint32_t), matches_found, 0, NULL, NULL);
+	if (err != CL_SUCCESS) {
+		printf ("[%zu] Error: clEnqueueWriteBuffer (matches_found) failed (%d)\n", id, err);
+		return -1;
+	}
+
+	// Set the arguments to our compute kernel
+	err  = clSetKernelArg (ctx->kernels[id], 0, sizeof(uint32_t), &cand_base);
+	err |= clSetKernelArg (ctx->kernels[id], 4, sizeof(cl_mem), &ctx->matches_found[id]);
+
+	if (err != CL_SUCCESS) {
+		printf ("[%zu] Error: clSetKernelArg (cand_base|ctx->matches_found) failed (%d)\n", id, err);
+		return -1;
+	}
+
+	cl_event event;
+
+	err = clEnqueueNDRangeKernel (ctx->commands[id], ctx->kernels[id], 2, NULL, global_ws, local_ws, 0, NULL, &event);
+	if (err != CL_SUCCESS) {
+		printf ("[%zu] Error: clEnqueueNDRangeKernel() failed (%d)\n", id, err);
+		return -1;
+	}
+
+	// todo, check if is possible remove
+	err = clFlush (ctx->commands[id]);
+	if (err != CL_SUCCESS) {
+		printf ("[%zu] Error: clFlush() failed (%d)\n", id, err);
+		return -1;
+	}
+
+	if (ctx->profiling)
+	{
+		err = clWaitForEvents (1, &event);
+		if (err != CL_SUCCESS) {
+			printf ("[%zu] Error: clWaitForEvents() failed (%d)\n", id, err);
+			return -1;
+		}
+
+		cl_ulong gpu_t_start = 0, gpu_t_end = 0;
+
+		err  = clGetEventProfilingInfo (event, CL_PROFILING_COMMAND_START, sizeof (cl_ulong), &gpu_t_start, NULL);
+		err |= clGetEventProfilingInfo (event, CL_PROFILING_COMMAND_END, sizeof (cl_ulong), &gpu_t_end, NULL);
+		if (err != CL_SUCCESS) {
+			printf ("[%zu] Error: clGetEventOPENCL_PROFILINGInfo() failed (%d)\n", id, err);
+			return -1;
+		}
+
+		const double time_ms = (double) (gpu_t_end - gpu_t_start) / 1000000;
+
+		printf ("[%zu] kernel exec time (ms): %.2f]\n", id, time_ms);
+		fflush (stdout);
+	}
+
+	err  = clReleaseEvent (event);
+	if (err != CL_SUCCESS) {
+		printf ("[%zu] Error: clReleaseEvent() failed (%d)\n", id, err);
+		return -1;
+	}
+
+	// Wait for the command commands to get serviced before reading back results
+	// todo, check if is possible remove, because of blocking clEnqueueReadBuffer (CL_TRUE)
+	err = clFinish (ctx->commands[id]);
+	if (err != CL_SUCCESS) {
+		printf ("[%zu] Error: clFinish() failed (%d)\n", id, err);
+		return -1;
+	}
+
+	// read back the matches counter first
+	err = clEnqueueReadBuffer (ctx->commands[id], ctx->matches_found[id], CL_TRUE, 0, sizeof(uint32_t), matches_found, 0, NULL, NULL);
+	if (err != CL_SUCCESS) {
+		printf ("[%zu] Error: clEnqueueReadBuffer(matches_found) failed (%d)\n", id, err);
+		return -1;
+	}
+
+	if (matches_found[0] > 0)
+	{
+		if (ctx->force_hitag2_opencl)
+		{
+			if (matches_found[0] != 1) printf ("[%zu] BUG: if match the counter must be 1. Here %u are founds\n", id, matches_found[0]);
+		}
+		else
+		{
+			if (matches_found[0] > (uint32_t)(ctx->global_ws[id]*WGS_MATCHES_FACTOR))
+			{
+				printf ("[%zu] BUG: the next clEnqueueReadBuffer will crash. 'matches' buffer (%u) is lower than requested (%u)\n", id, (uint32_t)(ctx->global_ws[id]*WGS_MATCHES_FACTOR), matches_found[0]);
+			}
+		}
+
+		err = clEnqueueReadBuffer(ctx->commands[id], ctx->matches[id], CL_TRUE, 0, sizeof(uint64_t) * matches_found[0], matches, 0, NULL, NULL);
+		if (err != CL_SUCCESS) {
+			printf ("[%zu] Error: clEnqueueReadBuffer(matches) failed (%d)\n", id, err);
+			return -1;
+		}
+
+		// key found
+		return 1;
+	}
+
+	// nada
+	return 0;
+}
diff --git a/tools/hitag2crack/crack5opencl/opencl.h b/tools/hitag2crack/crack5opencl/opencl.h
new file mode 100644
index 000000000..e91ace290
--- /dev/null
+++ b/tools/hitag2crack/crack5opencl/opencl.h
@@ -0,0 +1,129 @@
+/****************************************************************************
+
+Author : Gabriele 'matrix' Gristina <gabriele.gristina@gmail.com>
+Date   : Sun Jan 10 13:59:37 CET 2021
+Version: 0.1beta
+License: GNU General Public License v3 or any later version (see LICENSE.txt)
+
+*****************************************************************************
+    Copyright (C) 2020-2021  <Gabriele Gristina>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+****************************************************************************/
+
+#ifndef OPENCL_H
+#define OPENCL_H
+
+#ifdef __APPLE__
+#include <OpenCL/opencl.h>
+#else
+#define CL_TARGET_OPENCL_VERSION 220
+#define CL_USE_DEPRECATED_OPENCL_1_2_APIS
+#include <CL/cl.h>
+#endif
+
+#include "ht2crack5opencl.h"
+#include "queue.h"
+#include <stdbool.h>
+
+#include <stdio.h>
+
+// max number of concurrent devices (tested up to 4x RTX 3090)
+#define MAX_OPENCL_DEVICES 16
+
+// defines structures
+typedef struct compute_device_ctx
+{
+	char name[0xff];
+	char vendor[0x40];
+	char version[0x40];
+	char driver_version[0x40];
+
+	bool is_gpu, is_apple_gpu, is_nv;
+	bool have_lop3, have_local_memory;
+	bool warning, unsupported;
+
+	bool selected;
+	bool enabled;
+
+	unsigned char pad1[4];
+	unsigned int sm_maj;
+	unsigned int sm_min;
+	unsigned int compute_units;
+
+	cl_device_id device_id;
+	cl_platform_id platform_id;
+
+} compute_device_ctx_t;
+
+typedef struct compute_platform_ctx
+{
+	unsigned int device_cnt;
+	unsigned int compute_units_max;
+
+	bool is_nv, is_apple, is_intel;
+	bool warning;
+	bool selected;
+
+	unsigned char pad1[3];
+	compute_device_ctx_t device[0x10];
+
+	char name[0xff];
+	char vendor[0x40];
+	char version[0x40];
+
+	unsigned char pad2[1];
+	cl_platform_id platform_id;
+	cl_context context;
+	cl_program program;
+
+} compute_platform_ctx_t;
+
+typedef struct opencl_ctx
+{
+	char *kernelSource[1];
+	size_t kernelSource_len;
+
+	size_t *global_ws;
+	size_t *local_ws;
+	int *profiles;
+
+	cl_device_id *device_ids;       // compute device id's array
+	cl_context *contexts;           // compute contexts
+	cl_command_queue *commands;     // compute command queue (for each device)
+	cl_program *programs;           // compute program's
+	cl_kernel *kernels;             // compute kernel's
+
+//	cl_mem cand_base;               // device memory used for the candidate base
+	cl_mem *keystreams;             // device memory used for the keystream array
+	cl_mem *candidates;             // device memory used for the candidates array
+	cl_mem *matches;                // device memory used for the matches array
+	cl_mem *matches_found;          // device memory used for the matches_found array
+	cl_mem *checks;                 // device memory used for uid, aR2, nR1, nR2
+
+	wu_queue_ctx_t queue_ctx;
+	bool profiling;
+	unsigned char pad2[1];
+	short thread_sched_type;
+	bool force_hitag2_opencl;
+
+	unsigned char pad3[3];
+
+} opencl_ctx_t;
+
+bool plat_dev_enabled (unsigned int id, unsigned int *sel, unsigned int cnt, unsigned int cur_type, unsigned int allow_type);
+
+int runKernel (opencl_ctx_t *ctx, uint32_t cand_base, uint64_t *matches, uint32_t *matches_found, size_t id);
+
+#endif // OPENCL_H
diff --git a/tools/hitag2crack/crack5opencl/queue.c b/tools/hitag2crack/crack5opencl/queue.c
new file mode 100644
index 000000000..c32f1dbba
--- /dev/null
+++ b/tools/hitag2crack/crack5opencl/queue.c
@@ -0,0 +1,551 @@
+/****************************************************************************
+
+Author : Gabriele 'matrix' Gristina <gabriele.gristina@gmail.com>
+Date   : Sun Jan 10 13:59:37 CET 2021
+Version: 0.1beta
+License: GNU General Public License v3 or any later version (see LICENSE.txt)
+
+*****************************************************************************
+    Copyright (C) 2020-2021  <Gabriele Gristina>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+****************************************************************************/
+
+#include "queue.h"
+
+#if TEST_UNIT == 1
+int wu_queue_print (wu_queue_ctx_t *ctx)
+{
+	wu_queue_item_t *ptr = 0; //NULL;
+	size_t sum = 0;
+	int ret = -1;
+
+	if (!ctx) return -1;
+	if (!ctx->init) return ERROR_CTX_IS_NOT_INIT;
+
+	pthread_mutex_lock (&ctx->queue_mutex);
+
+	if ((ret = wu_queue_done (ctx)) != 0)
+	{
+		pthread_mutex_unlock (&ctx->queue_mutex);
+		return ret;
+	}
+
+	switch (ctx->queue_type)
+	{
+		case QUEUE_TYPE_FORWARD:
+			ptr = ctx->queue_head;
+			printf ("> show queue contents in FORWARD mode, from head\n");
+			break;
+		case QUEUE_TYPE_REVERSE:
+			ptr = ctx->queue_tail;
+			printf ("> show queue contents in REVERSE mode, from tail\n");
+			break;
+		case QUEUE_TYPE_RANDOM:
+			ptr = ctx->queue_head;
+			printf ("> show queue contents in RANDOM mode, from head\n");
+		default:
+			pthread_mutex_unlock (&ctx->queue_mutex);
+			return ERROR_QUEUE_TYPE_INVALID;
+	}
+
+	int cnt = 0;
+
+	printf ("# Queue size: %zu\n", ctx->queue_size);
+
+	do
+	{
+		sum += ptr->data.id;
+
+		if (cnt++ < 4) printf ("# ID %zu, OFF %zu, MAX %zu\n", ptr->data.id, ptr->data.off, ptr->data.max);
+
+		if (ctx->queue_type == QUEUE_TYPE_FORWARD || ctx->queue_type == QUEUE_TYPE_RANDOM)
+		{
+			if (!ptr->next) break;
+			ptr = ptr->next;
+		}
+		else if (ctx->queue_type == QUEUE_TYPE_REVERSE)
+		{
+			if (!ptr->prev) break;
+			ptr = ptr->prev;
+		}
+
+	} while (ptr);
+
+	if (!ptr)
+	{
+		printf ("! Fail: ptr must be not null here\n");
+		pthread_mutex_unlock (&ctx->queue_mutex);
+		return -1;
+	}
+
+	switch (ctx->queue_type)
+	{
+		case QUEUE_TYPE_RANDOM:
+			printf ("> show queue contents in RANDOM mode, from end to head\n");
+			break;
+		case QUEUE_TYPE_FORWARD:
+			printf ("> show queue contents in FORWARD mode, from end to head\n");
+			break;
+		case QUEUE_TYPE_REVERSE:
+			printf ("> show queue contents in REVERSE mode, from start to tail\n");
+			break;
+	}
+
+	cnt = 0;
+
+	do
+	{
+		sum -= ptr->data.id;
+		if (cnt++ < 4) printf ("# ID %zu, OFF %zu, MAX %zu\n", ptr->data.id, ptr->data.off, ptr->data.max);
+
+		if (ctx->queue_type == QUEUE_TYPE_FORWARD || ctx->queue_type == QUEUE_TYPE_RANDOM)
+		{
+			if (!ptr->prev) break;
+			ptr = ptr->prev;
+		}
+		else if (ctx->queue_type == QUEUE_TYPE_REVERSE)
+		{
+			if (!ptr->next) break;
+			ptr = ptr->next;
+		}
+
+	} while (ptr);
+
+	if (sum != 0)
+	{
+		printf ("! Fail: sum is not zero\n");
+		pthread_mutex_unlock (&ctx->queue_mutex);
+		return -1;
+	}
+
+	pthread_mutex_unlock (&ctx->queue_mutex);
+	return 0;
+}
+
+#endif
+
+const char *wu_queue_strerror (int error)
+{
+	switch (error)
+	{
+		case QUEUE_EMPTY: return (const char *) "QUERY_EMPTY";
+		case NO_ERROR: return (const char *) "NO_ERROR";
+		case ERROR_GENERIC: return (const char *) "ERROR_GENERIC";
+		case ERROR_QUEUE_TYPE_INVALID: return (const char *) "ERROR_QUEUE_TYPE_INVALID";
+		case ERROR_CTX_NULL: return (const char *) "ERROR_CTX_NULL";
+		case ERROR_CTX_IS_INIT: return (const char *) "ERROR_CTX_IS_INIT";
+		case ERROR_CTX_IS_NOT_INIT: return (const char *) "ERROR_CTX_IS_NOT_INIT";
+		case ERROR_MUTEXATTR_INIT: return (const char *) "ERROR_MUTEXATTR_INIT";
+		case ERROR_MUTEXATTR_SETTYPE: return (const char *) "ERROR_MUTEXATTR_SETTYPE";
+		case ERROR_MUTEX_INIT: return (const char *) "ERROR_MUTEX_INIT";
+		case ERROR_ALLOC: return (const char *) "ERROR_ALLOC";
+		case ERROR_UNDEFINED:
+		default:
+			return (const char *) "ERROR_UNDEFINED";
+	}
+}
+
+const char *wu_queue_strdesc (wu_queue_type_t type)
+{
+	switch (type)
+	{
+		case QUEUE_TYPE_FORWARD: return (const char *) "FORWARD";
+		case QUEUE_TYPE_REVERSE: return (const char *) "REVERSE";
+		case QUEUE_TYPE_RANDOM: return (const char *) "RANDOM";
+	}
+
+	return (const char *) "UNKNOWN";
+}
+
+int wu_queue_init (wu_queue_ctx_t *ctx, wu_queue_type_t queue_type)
+{
+	#if TEST_UNIT == 1
+	fprintf (stdout, "[%s] enter\n", __func__);
+	fflush (stdout);
+	#endif
+
+	if (!ctx) return ERROR_CTX_NULL;
+
+	// Conditional jump or move depends on uninitialised value(s). It's good as it
+	if (ctx->init) return ERROR_CTX_IS_INIT;
+
+	if (queue_type == QUEUE_TYPE_RANDOM) srand ((unsigned int) time(0));
+	else if (queue_type != QUEUE_TYPE_FORWARD && queue_type != QUEUE_TYPE_REVERSE)
+	{
+		#if TEST_UNIT == 1
+		fprintf (stderr, "! Error, invalid 'queue_type'.\n");
+		#endif
+		return ERROR_QUEUE_TYPE_INVALID;
+	}
+
+	memset (ctx, 0, sizeof (wu_queue_ctx_t));
+	ctx->queue_type = queue_type;
+	ctx->queue_head = 0; //NULL;
+	ctx->queue_tail = 0; //NULL;
+
+	int ret = 0;
+
+	if ((ret = pthread_mutexattr_init (&ctx->queue_mutex_attr)) != 0)
+	{
+		#if TEST_UNIT == 1
+		fprintf (stderr, "! Error, pthread_mutexattr_init() failed (%d): %s\n", ret, strerror (ret));
+		#endif
+		memset (ctx, 0, sizeof (wu_queue_ctx_t));
+		return ERROR_MUTEXATTR_INIT;
+	}
+
+	if ((ret = pthread_mutexattr_settype (&ctx->queue_mutex_attr, PTHREAD_MUTEX_ERRORCHECK)) != 0)
+	{
+		#if TEST_UNIT == 1
+		fprintf (stderr, "! Error, pthread_mutexattr_settype(PTHREAD_MUTEX_ERRORCHECK) failed (%d): %s\n", ret, strerror (ret));
+		#endif
+		pthread_mutexattr_destroy (&ctx->queue_mutex_attr);
+		memset (ctx, 0, sizeof (wu_queue_ctx_t));
+		return ERROR_MUTEXATTR_SETTYPE;
+	}
+
+	if ((ret = pthread_mutex_init (&ctx->queue_mutex, &ctx->queue_mutex_attr)) != 0)
+	{
+		#if TEST_UNIT == 1
+		fprintf (stderr, "! Error, pthread_mutex_init() failed (%d): %s\n", ret, strerror (ret));
+		#endif
+		pthread_mutexattr_destroy (&ctx->queue_mutex_attr);
+		memset (ctx, 0, sizeof (wu_queue_ctx_t));
+		return ERROR_MUTEX_INIT;
+	}
+
+	ctx->init = 1;
+	return NO_ERROR;
+}
+
+int wu_queue_done (wu_queue_ctx_t *ctx)
+{
+	if (!ctx) return ERROR_CTX_NULL;
+	if (!ctx->init) return ERROR_CTX_IS_NOT_INIT;
+
+	switch (ctx->queue_type)
+	{
+		case QUEUE_TYPE_RANDOM:  return (ctx->queue_head == NULL);
+		case QUEUE_TYPE_FORWARD: return (ctx->queue_head == NULL);
+		case QUEUE_TYPE_REVERSE: return (ctx->queue_tail == NULL);
+	}
+
+	return ERROR_QUEUE_TYPE_INVALID;
+}
+
+int wu_queue_push (wu_queue_ctx_t *ctx, size_t id, size_t off, size_t max)
+{
+	if (!ctx) return ERROR_CTX_NULL;
+	if (!ctx->init) return ERROR_CTX_IS_NOT_INIT;
+
+	pthread_mutex_lock (&ctx->queue_mutex);
+
+	wu_queue_item_t *ptr = 0; //NULL;
+
+	short first = 0;
+
+	if (ctx->queue_head == 0) first = 1;
+
+	if (!(ptr = (wu_queue_item_t *) malloc (sizeof (wu_queue_item_t))))
+	{
+		#if TEST_UNIT == 1
+		fprintf (stderr, "! Error: malloc() failed (%d): %s\n", errno, strerror (errno));
+		#endif
+		pthread_mutex_unlock (&ctx->queue_mutex);
+		return ERROR_ALLOC;
+	}
+
+	ptr->data.id = id;
+	ptr->data.off = off;
+	ptr->data.max = max;
+	ptr->next = 0; //NULL;
+	ptr->prev = 0; //NULL;
+
+	if (first) {
+		ctx->queue_head = ptr;
+		ctx->queue_tail = ptr;
+		ctx->queue_size++;
+		pthread_mutex_unlock (&ctx->queue_mutex);
+		return NO_ERROR;
+	}
+
+	// set tail
+	ptr->prev = ctx->queue_tail;
+	ctx->queue_tail = ptr;
+
+	// set head
+	wu_queue_item_t *last = ctx->queue_head;
+	while (last->next != 0) last = last->next;
+	last->next = ptr;
+
+	ctx->queue_size++;
+	pthread_mutex_unlock (&ctx->queue_mutex);
+	return NO_ERROR;
+}
+
+int wu_queue_pop (wu_queue_ctx_t *ctx, wu_queue_data_t *wu, short remove)
+{
+	if (!ctx) return ERROR_CTX_NULL;
+	if (!ctx->init) return ERROR_CTX_IS_NOT_INIT;
+
+	int ret = -1;
+	int rnd = 0;
+	wu_queue_item_t *ptr = 0, *ptrPrev = 0;
+
+	pthread_mutex_lock (&ctx->queue_mutex);
+
+	if ((ret = wu_queue_done (ctx)) != 0)
+	{
+		#if TEST_UNIT == 1
+		fprintf (stderr, "ret from wu_queue_done() (%d): %s\n", ret, wu_queue_strerror (ret));
+		#endif
+		pthread_mutex_unlock (&ctx->queue_mutex);
+		return ret;
+	}
+
+	switch (ctx->queue_type)
+	{
+		case QUEUE_TYPE_FORWARD:
+			ptr = ctx->queue_head;
+			break;
+		case QUEUE_TYPE_REVERSE:
+			ptr = ctx->queue_tail;
+			break;
+		case QUEUE_TYPE_RANDOM:
+			ptr = ctx->queue_head;
+			rnd = rand() % (int) ctx->queue_size;
+			for (int r = 0; r < rnd; r++)
+			{
+				ptrPrev = ptr;
+				ptr = ptr->next;
+			}
+			break;
+	}
+
+	if (!ptr)
+	{
+		pthread_mutex_unlock (&ctx->queue_mutex);
+		return ERROR_GENERIC;
+	}
+
+	if (!remove)
+	{
+		wu->id = ptr->data.id;
+		wu->off = ptr->data.off;
+		wu->max = ptr->data.max;
+	}
+
+	switch (ctx->queue_type)
+	{
+		case QUEUE_TYPE_FORWARD:
+			ctx->queue_head = (ctx->queue_head)->next;
+			break;
+		case QUEUE_TYPE_REVERSE:
+			ctx->queue_tail = (ctx->queue_tail)->prev;
+			break;
+		case QUEUE_TYPE_RANDOM: // from the head
+			#if TEST_UNIT == 1
+			fprintf (stdout, "pop id %ld\n", wu->id);
+			fflush (stdout);
+			#endif
+			if (ptrPrev == NULL)
+			{
+				ctx->queue_head = (ctx->queue_head)->next;
+			}
+			else
+			{
+				ptrPrev->next = ptr->next;
+			}
+			break;
+	}
+
+	memset (ptr, 0, sizeof (wu_queue_item_t));
+	free (ptr);
+	ptr = 0; //NULL;
+
+	ctx->queue_size--;
+
+	if (!remove) wu->rem = ctx->queue_size;
+
+	pthread_mutex_unlock (&ctx->queue_mutex);
+	return NO_ERROR;
+}
+
+int wu_queue_destroy (wu_queue_ctx_t *ctx)
+{
+	#if TEST_UNIT == 1
+	fprintf (stdout, "[%s] enter\n", __func__);
+	fflush (stdout);
+	#endif
+
+	if (!ctx) return ERROR_CTX_NULL;
+	if (!ctx->init) return ERROR_CTX_IS_NOT_INIT;
+
+	pthread_mutex_lock (&ctx->queue_mutex);
+
+	int ret = -1;
+
+	// unload the queue
+	while ((ret = wu_queue_pop (ctx, 0, 1)) == 0) {};
+
+	if (ret != QUEUE_EMPTY)
+	{
+		#if TEST_UNIT
+		fprintf (stderr, "! Error, wu_queue_pop() failed (%d): %s\n", ret, wu_queue_strerror (ret));
+		#endif
+		return ret;
+	}
+
+	#if TEST_UNIT == 1
+	printf ("ret from wu_queue_pop() (%d): %s\n", ret, wu_queue_strerror (ret));
+	#endif
+
+	#if TEST_UNIT == 1
+	if (ctx->queue_head != 0) fprintf (stderr, "queue_head not null\n");
+	if (ctx->queue_tail != 0) fprintf (stderr, "queue_tail not null\n");
+	#endif
+
+	ctx->queue_head = 0; //NULL;
+	ctx->queue_tail = 0; //NULL;
+	ctx->init = 0;
+
+	pthread_mutex_unlock (&ctx->queue_mutex);
+
+	pthread_mutex_destroy (&ctx->queue_mutex);
+	pthread_mutexattr_destroy (&ctx->queue_mutex_attr);
+
+	memset (ctx, 0, sizeof (wu_queue_ctx_t));
+	//ctx = 0; //NULL;
+
+	return (ret == 1) ? NO_ERROR : ERROR_GENERIC;
+}
+
+#if TEST_UNIT == 1
+int main (void)
+{
+	unsigned int profiles[11][2] =
+	{
+		{ 16384, 5 }, // 0, best for Intel GPU's with Neo
+		{ 8192,  6 }, // 1, only for Intel NEO
+		{ 4096,  7 }, // 2 (old 0) seems the best for all others (also NVIDIA) :D Apple/Intel GPU's stable here
+		{ 2048,  8 }, // 3 (old 1) usefull for any kind of CPU's
+		{ 1024,  9 },
+		{ 512,  10 },
+		{ 256,  11 },
+		{ 128,  12 }, // 7, (old 5) the last good value with NVIDIA GPU's
+		{ 64,   13 },
+		{ 32,   14 },
+		{ 16,   15 },
+	};
+
+	size_t err = 0, err_max = 1;
+	size_t id = 0;
+	size_t max = profiles[0][0];
+	size_t chunk = profiles[0][1];
+	size_t sum = 0;
+	int i = 0;
+
+	wu_queue_ctx_t ctx;
+	memset (&ctx, 0, sizeof (wu_queue_ctx_t));
+
+	printf("Selected the following config: max %zu, chunk %zu\n", max, chunk);
+	fflush (stdout);
+
+	wu_queue_type_t types[4] = { QUEUE_TYPE_FORWARD, QUEUE_TYPE_REVERSE, QUEUE_TYPE_RANDOM, 1234 };
+	int types_max = (int) (sizeof (types) / sizeof (wu_queue_type_t));
+	int ret = 0;
+
+	for (i = 0; i < types_max; i++)
+	{
+		printf ("[%d] trying wu_queue_init() in %s mode\n", i, wu_queue_strdesc (types[i]));
+
+		if ((ret = wu_queue_init (&ctx, types[i])) != 0)
+		{
+			fprintf (stderr, "[%d] Error: wu_queue_init(%s) failed (%d): %s\n", i, wu_queue_strdesc (types[i]), ret, wu_queue_strerror (ret));
+			err++;
+			continue;
+		}
+
+		printf ("[%d] trying wu_queue_push()\n", i);
+
+		for (id = 0; id < max; id++)
+		{
+			sum += id;
+			ret = wu_queue_push (&ctx, id, id << chunk, max);
+			if (ret != 0)
+			{
+				fprintf (stderr, "[%d] Error: wu_queue_push(%zu) failed (%d): %s\n", i, id, ret, wu_queue_strerror (ret));
+				err++;
+				continue;
+			}
+		}
+
+		printf("[%d] push sum: %zu\n", i, sum);
+
+		if (wu_queue_print (&ctx) == -1)
+		{
+			fprintf (stderr, "[%d] wu_queue_print() error\n", i);
+			err++;
+			continue;
+		}
+
+		wu_queue_data_t wu;
+
+		while ((ret = wu_queue_pop (&ctx, &wu, 0)) == 0) sum -= wu.id;
+
+		if (ret != QUEUE_EMPTY)
+		{
+			fprintf (stderr, "[%d] Error: wu_queue_pop() failed (%d): %s\n", i, ret, wu_queue_strerror (ret));
+			err++;
+			continue;
+		}
+
+		printf("[%d] pop sum: %zu\n", i, sum);
+
+		if (sum != 0)
+		{
+			fprintf (stderr, "[%d] Fail: sum is not zero (%zu)\n", i, sum);
+			err++;
+			continue;
+		}
+
+		if (wu_queue_print (&ctx) == -1)
+		{
+			fprintf (stderr, "[%d] wu_queue_print() error\n", i);
+			err++;
+			continue;
+		}
+
+		printf ("[%d] trying wu_queue_destroy()\n", i);
+		if ((ret = wu_queue_destroy (&ctx)) != 0)
+		{
+			fprintf (stderr, "! Error: wu_queue_destroy() failed (%d): %s\n", ret, wu_queue_strerror (ret));
+			err++;
+			continue;
+		}
+	}
+
+	printf ("Catched %zu/%zu error(s).\n", err, err_max);
+
+	if (err == err_max)
+	{
+		printf ("Self-Test pass\n");
+		return 0;
+	}
+
+	printf ("Self-Test fail\n");
+	return -1;
+}
+#endif // TEST_UNIT
diff --git a/tools/hitag2crack/crack5opencl/queue.h b/tools/hitag2crack/crack5opencl/queue.h
new file mode 100644
index 000000000..415b4aa8c
--- /dev/null
+++ b/tools/hitag2crack/crack5opencl/queue.h
@@ -0,0 +1,122 @@
+/****************************************************************************
+
+Author : Gabriele 'matrix' Gristina <gabriele.gristina@gmail.com>
+Date   : Sun Jan 10 13:59:37 CET 2021
+Version: 0.1beta
+License: GNU General Public License v3 or any later version (see LICENSE.txt)
+
+*****************************************************************************
+    Copyright (C) 2020-2021  <Gabriele Gristina>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+****************************************************************************/
+
+#ifndef QUEUE_H
+#define QUEUE_H
+
+// set 1 to enable the test unit
+#ifndef TEST_UNIT
+#define TEST_UNIT 0
+#endif
+
+#if TEST_UNIT == 1
+#include <stdio.h>
+#include <unistd.h>
+#include <errno.h>
+#endif
+
+#include <stdlib.h>
+#include <stddef.h>
+#include <string.h>
+#include <pthread.h>
+
+// enum errors
+typedef enum wu_queue_error
+{
+	QUEUE_EMPTY = 1,
+	NO_ERROR = 0,
+	ERROR_GENERIC = -1,
+	ERROR_QUEUE_TYPE_INVALID = -2,
+	ERROR_CTX_NULL = -3,
+	ERROR_CTX_IS_INIT = -4,
+	ERROR_CTX_IS_NOT_INIT = -5,
+	ERROR_MUTEXATTR_INIT = -6,
+	ERROR_MUTEXATTR_SETTYPE = -7,
+	ERROR_MUTEX_INIT = -8,
+	ERROR_ALLOC = -9,
+	ERROR_UNDEFINED = -10
+
+} wu_queue_error_t;
+
+// enum queue types
+typedef enum wu_queue_type
+{
+	QUEUE_TYPE_FORWARD = 0,
+	QUEUE_TYPE_REVERSE,
+	QUEUE_TYPE_RANDOM
+
+} wu_queue_type_t;
+
+// hold wu data
+typedef struct wu_queue_data
+{
+	size_t id;
+	size_t off;
+	size_t max;
+	size_t rem;
+
+} wu_queue_data_t;
+
+// lists
+typedef struct wu_queue_item wu_queue_item_t;
+struct wu_queue_item
+{
+	wu_queue_data_t data;
+	wu_queue_item_t *next;
+	wu_queue_item_t *prev;
+};
+
+// main ctx
+typedef struct wu_queue_ctx
+{
+	unsigned int init;
+
+	wu_queue_type_t queue_type;
+	wu_queue_item_t *queue_head;
+	wu_queue_item_t *queue_tail;
+
+	size_t queue_size;
+
+	// mutex
+	pthread_mutexattr_t queue_mutex_attr;
+//	unsigned char pad1[4];
+	pthread_mutex_t queue_mutex;
+
+} wu_queue_ctx_t;
+
+// exports
+int wu_queue_init (wu_queue_ctx_t *ctx, wu_queue_type_t queue_type);
+int wu_queue_done (wu_queue_ctx_t *ctx);
+int wu_queue_push (wu_queue_ctx_t *ctx, size_t id, size_t off, size_t max);
+int wu_queue_pop (wu_queue_ctx_t *ctx, wu_queue_data_t *wu, short remove);
+int wu_queue_destroy (wu_queue_ctx_t *ctx);
+
+const char *wu_queue_strdesc (wu_queue_type_t type);
+const char *wu_queue_strerror (int error);
+
+#if TEST_UNIT == 1
+int wu_queue_print (wu_queue_ctx_t *ctx);
+#endif
+
+#endif // QUEUE_H
diff --git a/tools/hitag2crack/crack5opencl/threads.c b/tools/hitag2crack/crack5opencl/threads.c
new file mode 100644
index 000000000..5c263233c
--- /dev/null
+++ b/tools/hitag2crack/crack5opencl/threads.c
@@ -0,0 +1,730 @@
+/****************************************************************************
+
+Author : Gabriele 'matrix' Gristina <gabriele.gristina@gmail.com>
+Date   : Sun Jan 10 13:59:37 CET 2021
+Version: 0.1beta
+License: GNU General Public License v3 or any later version (see LICENSE.txt)
+
+*****************************************************************************
+    Copyright (C) 2020-2021  <Gabriele Gristina>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+****************************************************************************/
+
+#include "threads.h"
+
+const char *thread_strerror (int error)
+{
+	switch (error)
+	{
+		case THREAD_NOERROR: return (const char *) "No error";
+	}
+
+	return (const char *) "GENERIC";
+}
+
+int thread_init (thread_ctx_t *ctx, short type, size_t thread_count)
+{
+	if (!ctx) return THREAD_ERROR_CTX_IS_NULL;
+	if (ctx->init) return THREAD_ERROR_CTX_IS_INIT;
+	if (type != THREAD_TYPE_ASYNC && type != THREAD_TYPE_SEQ) return THREAD_ERROR_TYPE_INVALID;
+	if (thread_count == 0) return THREAD_ERROR_COUNT_INVALID;
+
+	memset (ctx, 0, sizeof (thread_ctx_t));
+
+	ctx->thread_count = thread_count;
+	ctx->type = type;
+	ctx->enable_condusleep = (type == THREAD_TYPE_ASYNC && thread_count == 1);
+
+	ctx->thread_handles = (pthread_t *) calloc (thread_count, sizeof (pthread_t));
+	if (!ctx->thread_handles)
+	{
+		return THREAD_ERROR_ALLOC;
+	}
+
+	ctx->thread_mutexs = (pthread_mutex_t *) calloc (thread_count, sizeof (pthread_mutex_t));
+	if (!ctx->thread_mutexs)
+	{
+		free (ctx->thread_handles);
+		return THREAD_ERROR_ALLOC;
+	}
+
+	ctx->thread_conds = (pthread_cond_t *) calloc (thread_count, sizeof (pthread_cond_t));
+	if (!ctx->thread_conds)
+	{
+		free (ctx->thread_handles);
+		free (ctx->thread_mutexs);
+		return THREAD_ERROR_ALLOC;
+	}
+
+	if (pthread_attr_init (&ctx->attr) != 0)
+	{
+		free (ctx->thread_handles);
+		free (ctx->thread_mutexs);
+		free (ctx->thread_conds);
+		return THREAD_ERROR_ATTR;
+	}
+
+	pthread_attr_setdetachstate (&ctx->attr, PTHREAD_CREATE_JOINABLE);
+
+	if (pthread_mutexattr_init (&ctx->mutex_attr) != 0)
+	{
+		free (ctx->thread_handles);
+		free (ctx->thread_mutexs);
+		free (ctx->thread_conds);
+		pthread_attr_destroy (&ctx->attr);
+		return THREAD_ERROR_MUTEXATTR;
+	}
+
+	pthread_mutexattr_settype (&ctx->mutex_attr, PTHREAD_MUTEX_ERRORCHECK);
+
+	if (ctx->enable_condusleep)
+	{
+		if (pthread_mutex_init (&ctx->thread_mutex_usleep, NULL) != 0)
+		{
+			free (ctx->thread_handles);
+			free (ctx->thread_mutexs);
+			free (ctx->thread_conds);
+			pthread_attr_destroy (&ctx->attr);
+			pthread_mutexattr_destroy (&ctx->mutex_attr);
+			return THREAD_ERROR_MUTEX_USLEEP;
+		}
+
+		if (pthread_cond_init (&ctx->thread_cond_usleep, NULL) != 0)
+		{
+			free (ctx->thread_handles);
+			free (ctx->thread_mutexs);
+			free (ctx->thread_conds);
+			pthread_mutex_destroy (&ctx->thread_mutex_usleep);
+			pthread_attr_destroy (&ctx->attr);
+			pthread_mutexattr_destroy (&ctx->mutex_attr);
+			return THREAD_ERROR_COND_USLEEP;
+		}
+	}
+
+	int err = 0;
+	int z = 0;
+
+	for (z = 0; z < (int) ctx->thread_count; z++)
+	{
+		if (ctx->type == THREAD_TYPE_ASYNC)
+		{
+			if (pthread_mutex_init (&ctx->thread_mutexs[z], NULL) != 0)
+			{
+				err = THREAD_ERROR_MUTEX;
+				break;
+			}
+
+			if (pthread_cond_init (&ctx->thread_conds[z], NULL) != 0)
+			{
+				pthread_mutex_destroy (&ctx->thread_mutexs[z]);
+				err = THREAD_ERROR_COND;
+				break;
+			}
+		}
+	}
+
+	if (err != 0)
+	{
+		z--; // step back
+
+		for (; z >= 0; z--)
+		{
+			pthread_cond_destroy (&ctx->thread_conds[z]);
+			pthread_mutex_destroy (&ctx->thread_mutexs[z]);
+		}
+
+		if (ctx->enable_condusleep)
+		{
+			pthread_mutex_destroy (&ctx->thread_mutex_usleep);
+			pthread_cond_destroy (&ctx->thread_cond_usleep);
+		}
+
+		free (ctx->thread_handles);
+		free (ctx->thread_mutexs);
+		free (ctx->thread_conds);
+		pthread_attr_destroy (&ctx->attr);
+		pthread_mutexattr_destroy (&ctx->mutex_attr);
+		return err;
+	}
+
+	ctx->init = 1;
+	return 0;
+}
+
+int thread_destroy (thread_ctx_t *ctx)
+{
+	if (!ctx) return -1;
+	if (!ctx->init) return -2;
+
+	if (ctx->enable_condusleep)
+	{
+		pthread_cond_destroy (&ctx->thread_cond_usleep);
+		pthread_mutex_destroy (&ctx->thread_mutex_usleep);
+	}
+
+	for (size_t z = 0; z < ctx->thread_count; z++)
+	{
+		pthread_cond_destroy (&ctx->thread_conds[z]);
+		pthread_mutex_destroy (&ctx->thread_mutexs[z]);
+	}
+
+	pthread_mutexattr_destroy (&ctx->mutex_attr);
+	pthread_attr_init (&ctx->attr);
+
+	free (ctx->thread_conds);
+	free (ctx->thread_mutexs);
+	free (ctx->thread_handles);
+
+	memset (ctx, 0, sizeof (thread_ctx_t));
+	ctx->init = 0;
+	return 0;
+}
+
+int thread_start (thread_ctx_t *ctx, thread_args_t *t_arg)
+{
+	int err = 0;
+	int z = 0;
+
+	for (z = 0; z < (int) ctx->thread_count; z++)
+	{
+		if (pthread_create (&ctx->thread_handles[z], &ctx->attr, (ctx->type == THREAD_TYPE_ASYNC) ? computing_process_async : computing_process, (void *) &t_arg[z]) != 0)
+		{
+			err = THREAD_ERROR_CREATE;
+			break;
+		}
+	}
+
+	if (err != 0)
+	{
+		z--; // step back
+
+		for (; z >= 0; z++)
+		{
+			pthread_cancel (ctx->thread_handles[z]);
+			pthread_join (ctx->thread_handles[z], NULL);
+		}
+
+		return err;
+	}
+
+	return 0;
+}
+
+int thread_stop (thread_ctx_t *ctx)
+{
+	for (size_t z = 0; z < ctx->thread_count; z++)
+	{
+		if (ctx->type == THREAD_TYPE_ASYNC) pthread_cancel (ctx->thread_handles[z]);
+		pthread_join (ctx->thread_handles[z], NULL);
+	}
+
+	return 0;
+}
+
+__attribute__ ((format (printf, 1, 2)))
+void tprintf (const char * restrict format, ...)
+{
+	flockfile (stdout);
+
+	va_list va_args;
+	va_start (va_args, format);
+	vprintf (format, va_args);
+	va_end (va_args);
+
+	funlockfile (stdout);
+
+	fflush (stdout);
+}
+
+const char *thread_status_strdesc (thread_status_t s)
+{
+	switch (s)
+	{
+		case TH_START: return (const char *) "START";
+		case TH_WAIT: return (const char *) "WAIT";
+		case TH_PROCESSING: return (const char *) "PROCESSING";
+		case TH_ERROR: return (const char *) "ERROR";
+		case TH_STOP: return (const char *) "STOP";
+		case TH_FOUND_KEY: return (const char *) "FOUND_KEY";
+		case TH_END: return (const char *) "END";
+	}
+
+	return (const char *) "... or die tryin'";
+}
+
+bool thread_setEnd (thread_ctx_t *ctx, thread_args_t *t_arg)
+{
+	bool found = false;
+
+	size_t z;
+
+	int m_ret = 0;
+	int c_ret = 0;
+
+	for (z = 0; z < ctx->thread_count; z++)
+	{
+		m_ret = pthread_mutex_lock (&ctx->thread_mutexs[z]);
+		if (m_ret != 0)
+		{
+			tprintf ("[%zu] [%s] Error: pthread_mutex_lock() failed (%d): %s\n", z, __func__, m_ret, strerror (m_ret));
+		}
+
+		thread_status_t tmp = t_arg[z].status;
+
+		#if DEBUGME > 0
+		tprintf ("[%zu] [%s] Thread status: %s\n", z, __func__, thread_status_strdesc(t_arg[z].status));
+		#endif
+
+		if (tmp == TH_FOUND_KEY || tmp == TH_END || tmp == TH_ERROR)
+		{
+			if (tmp == TH_FOUND_KEY) found = true;
+			pthread_mutex_unlock (&ctx->thread_mutexs[z]);
+			continue;
+		}
+
+		#if DEBUGME > 0
+		tprintf ("[%zu] [%s] Set thread status to TH_STOP\n", z, __func__);
+		#endif
+
+		t_arg[z].status = TH_STOP;
+
+		if (tmp == TH_WAIT)
+		{
+			#if DEBUGME > 0
+			tprintf ("[%zu] [%s] Send cond_signal to thread\n", z, __func__);
+			#endif
+
+			c_ret = pthread_cond_signal (&ctx->thread_conds[z]);
+			if (c_ret != 0)
+			{
+				tprintf ("[%zu] [%s] Error: pthread_cond_signal() failed (%d): %s\n", z, __func__, c_ret, strerror (c_ret));
+			}
+		}
+
+		pthread_mutex_unlock (&ctx->thread_mutexs[z]);
+	}
+
+	return found;
+}
+
+void *computing_process (void *arg)
+{
+	thread_args_t *a = (thread_args_t *) arg;
+
+	uint64_t off = 0;
+
+	size_t z = a->device_id;
+	uint64_t *matches = a->matches;
+	uint32_t *matches_found = a->matches_found;
+
+	uint32_t uid = a->uid;
+	uint32_t aR2 = a->aR2;
+	uint32_t nR1 = a->nR1;
+	uint32_t nR2 = a->nR2;
+
+	opencl_ctx_t *ctx = a->ocl_ctx;
+
+	wu_queue_data_t wu;
+	wu_queue_pop (&ctx->queue_ctx, &wu, false);
+	off = wu.off;
+	a->slice = wu.id+1;
+
+	if (ctx->queue_ctx.queue_type == QUEUE_TYPE_RANDOM)
+	{
+		#if DEBUGME > 0
+		printf ("[%zu] Slice %zu (off %zu), max %zu, remain %zu slice(s)\n", z, wu.id+1, wu.off, wu.max, wu.rem);
+		#else
+		printf ("[%zu] Slice %zu/%zu (%zu remain)\n", z, wu.id+1, wu.max, wu.rem);
+		#endif // DEBUGME
+	}
+	else
+	{
+		#if DEBUGME > 0
+		printf ("[%zu] Slice %zu/%zu, off %zu\n", z, wu.id+1, wu.max, wu.off);
+		#else
+		printf ("[%zu] Slice %zu/%zu\n", z, wu.id+1, wu.max);
+		#endif // DEBUGME
+	}
+	fflush (stdout);
+
+	int ret = runKernel (ctx, (uint32_t) off, matches, matches_found, z);
+
+	a->r = false;
+	a->err = false;
+
+	if (ret < 1) // error or nada
+	{
+		if (ret == -1) a->err = true;
+		pthread_exit (NULL);
+	}
+
+	if (!ctx->force_hitag2_opencl)
+	{
+		#if DEBUGME >= 2
+		printf ("[slave][%zu] master, I found %5u candidates @ slice %zu\n", z, matches_found[0], a->slice+1);
+		fflush (stdout);
+		#endif
+
+		for (uint32_t match = 0; match < matches_found[0]; match++)
+		{
+			a->r = try_state (matches[match], uid, aR2, nR1, nR2, &a->key);
+			if (a->r) break;
+		}
+	}
+	else
+	{
+		// the OpenCL kernel return only one key if found, else nothing
+
+		#if TDEBUG >= 1
+		printf ("[slave][%zu] master, I found the key @ slice %zu\n", z, a->slice+1);
+		fflush (stdout);
+		#endif
+
+		a->r = true;
+		a->key = matches[0];
+	}
+
+	pthread_exit (NULL);
+}
+
+void *computing_process_async (void *arg)
+{
+	thread_args_t *a = (thread_args_t *) arg;
+
+	size_t z = a->device_id;
+
+	// TH_START, not really needed lock with mutex here
+	pthread_mutex_lock (&a->thread_ctx->thread_mutexs[z]);
+
+	// fetching data from thread struct, I hope they are good
+	thread_status_t status = a->status;
+
+	uint32_t uid = a->uid;
+	uint32_t aR2 = a->aR2;
+	uint32_t nR1 = a->nR1;
+	uint32_t nR2 = a->nR2;
+
+	uint64_t *matches = a->matches;
+	uint32_t *matches_found = a->matches_found;
+	size_t max_step = a->max_step;
+
+	opencl_ctx_t *ctx = a->ocl_ctx;
+
+	pthread_mutex_unlock (&a->thread_ctx->thread_mutexs[z]);
+
+	uint64_t off = 0;
+//	size_t slice = 0;
+	int ret = 0;
+
+	if (status == TH_START)
+	{
+		#if TDEBUG >= 1
+		printf ("[slave][%zu] plat id %d, uid %u, aR2 %u, nR1 %u, nR2 %u, Initial status: %s\n", z, ctx->id_platform, uid, aR2, nR1, nR2, thread_status_strdesc (status));
+		#endif
+		status = TH_WAIT;
+		// proceed to next
+	}
+
+	do // slave
+	{
+		if (status == TH_WAIT)
+		{
+			pthread_mutex_lock (&a->thread_ctx->thread_mutexs[z]);
+
+			// update thread status to WAIT, todo: check with multiple devices
+
+			if (a->status == TH_END) // other threads found the key
+			{
+				fflush(stdout);
+				status = TH_END;
+				a->quit = true;
+				pthread_mutex_unlock (&a->thread_ctx->thread_mutexs[z]);
+				pthread_exit (NULL);
+			}
+			else
+			{
+				a->status = TH_WAIT;
+
+				if (a->thread_ctx->enable_condusleep)
+				{
+					pthread_mutex_lock (&a->thread_ctx->thread_mutex_usleep);
+					pthread_cond_signal (&a->thread_ctx->thread_cond_usleep); // unlock master/TH_PROCESSING cond
+					#if TDEBUG >= 1
+					printf ("[slate][%zu] after pthread_cond_signal TH_WAIT\n", z);
+					fflush (stdout);
+					#endif
+					pthread_mutex_unlock (&a->thread_ctx->thread_mutex_usleep);
+				}
+			}
+
+			#if TDEBUG >= 1
+			printf ("[slave][%zu] master, i'm here to serve you. I'm in %s give me a signal.\n", z, thread_status_strdesc (status));
+			fflush (stdout);
+			#endif
+
+			pthread_cond_wait (&a->thread_ctx->thread_conds[z], &a->thread_ctx->thread_mutexs[z]);
+
+			status = a->status; // read new status from master
+
+			#if TDEBUG >= 2
+			printf ("[slave][%zu] master, got the signal with new state: %s.\n", z, thread_status_strdesc (status));
+			fflush (stdout);
+			#endif
+
+			pthread_mutex_unlock (&a->thread_ctx->thread_mutexs[z]);
+
+			if (status == TH_WAIT)
+			{
+				#if TDEBUG >=1
+				printf ("[slave] ! Error: need to be TH_PROCESSING or TH_END, not TH_WAIT ... exit\n");
+				fflush (stdout);
+				#endif
+				break;
+			}
+		}
+
+		if (status == TH_ERROR)
+		{
+			#if TDEBUG >= 1
+			printf ("[slave][%zu] master, got error signal, proceed with exit\n", z);
+			fflush (stdout);
+			#endif
+			pthread_exit (NULL);
+		}
+
+		if (status == TH_PROCESSING)
+		{
+			#if TDEBUG >= 2
+			printf ("[slave][%zu] master, got a work-unit, processing ...\n", z);
+			fflush (stdout);
+			#endif
+
+			wu_queue_data_t wu;
+			wu_queue_pop (&ctx->queue_ctx, &wu, false);
+			off = wu.off;
+			a->slice = wu.id+1;
+
+			if (ctx->queue_ctx.queue_type == QUEUE_TYPE_RANDOM)
+			{
+				#if DEBUGME > 0
+				printf ("[%zu] Slice %zu (off %zu), max %zu, remain %zu slice(s)\n", z, wu.id+1, wu.off, wu.max, wu.rem);
+				#else
+				printf ("[%zu] Slice %zu/%zu (%zu remain)\n", z, wu.id+1, wu.max, wu.rem);
+				#endif // DEBUGME
+			}
+			else
+			{
+				#if DEBUGME > 0
+				printf ("[%zu] Slice %zu/%zu, off %zu\n", z, wu.id+1, wu.max, wu.off);
+				#else
+				printf ("[%zu] Slice %zu/%zu\n", z, wu.id+1, wu.max);
+				#endif // DEBUGME
+			}
+
+			fflush (stdout);
+
+			ret = runKernel (ctx, (uint32_t) off, matches, matches_found, z);
+
+			if (ret < 1) // error or nada
+			{
+				if (ret == -1)
+				{
+					// untested code
+					pthread_mutex_lock (&a->thread_ctx->thread_mutexs[z]);
+					a->err = true;
+					a->status = TH_ERROR;
+					pthread_mutex_unlock (&a->thread_ctx->thread_mutexs[z]);
+					#if TDEBUG >= 1
+					printf ("[slave][%zu] master, something is broken, exit\n", z);
+					fflush (stdout);
+					#endif
+
+					if (a->thread_ctx->enable_condusleep)
+					{
+						pthread_mutex_lock (&a->thread_ctx->thread_mutex_usleep);
+						pthread_cond_signal (&a->thread_ctx->thread_cond_usleep); // unlock master/TH_PROCESSING cond
+						#if TDEBUG >= 1
+						printf ("[slave][%zu] after pthread_cond_signal TH_ERROR\n", z);
+						#endif
+						pthread_mutex_unlock (&a->thread_ctx->thread_mutex_usleep);
+					}
+
+					pthread_exit (NULL);
+					// end of unstested code
+				}
+
+				#if TDEBUG >= 1
+				printf ("[slave][%zu] master, process is done but no candidates found\n", z);
+				fflush (stdout);
+				#endif
+				pthread_mutex_lock (&a->thread_ctx->thread_mutexs[z]);
+
+				if (a->slice >= max_step) a->status = TH_END;
+				else a->status = TH_WAIT;
+
+				status = a->status;
+
+				pthread_mutex_unlock (&a->thread_ctx->thread_mutexs[z]);
+
+				if (a->thread_ctx->enable_condusleep)
+				{
+					pthread_mutex_lock (&a->thread_ctx->thread_mutex_usleep);
+					pthread_cond_signal (&a->thread_ctx->thread_cond_usleep); // unlock master/TH_PROCESSING cond
+					#if TDEBUG >= 1
+					printf ("[slave][%zu] after pthread_cond_signal TH_WAIT\n", z);
+					fflush (stdout);
+					#endif
+					pthread_mutex_unlock (&a->thread_ctx->thread_mutex_usleep);
+				}
+
+				continue;
+			}
+
+			if (!ctx->force_hitag2_opencl)
+			{
+				#if TDEBUG >= 1
+				printf ("[slave][%zu] master, we got %5u candidates. Proceed to validation\n", z, matches_found[0]);
+				fflush (stdout);
+				#endif
+
+				for (uint32_t match = 0; match < matches_found[0]; match++)
+				{
+					if (a->quit)
+					{
+						pthread_mutex_lock (&a->thread_ctx->thread_mutexs[z]);
+						a->status = TH_END;
+						pthread_mutex_unlock (&a->thread_ctx->thread_mutexs[z]);
+						#if TDEBUG >= 1
+						printf ("[slave][%zu] master, Another thread found the key, quit 2 \n", z);
+						fflush (stdout);
+						#endif
+
+						if (a->thread_ctx->enable_condusleep)
+						{
+							pthread_mutex_lock (&a->thread_ctx->thread_mutex_usleep);
+							pthread_cond_signal (&a->thread_ctx->thread_cond_usleep); // unlock master/TH_PROCESSING cond
+							#if TDEBUG >= 1
+							printf ("[slave][%zu] after pthread_cond_signal TH_END\n", z);
+							#endif
+							pthread_mutex_unlock (&a->thread_ctx->thread_mutex_usleep);
+						}
+
+						pthread_exit (NULL);
+					}
+
+					a->r = try_state (matches[match], uid, aR2, nR1, nR2, &a->key);
+					if (a->r)
+					{
+						pthread_mutex_lock (&a->thread_ctx->thread_mutexs[z]);
+						a->s = matches[match];
+						status = a->status = TH_FOUND_KEY;
+						a->quit = true;
+						pthread_mutex_unlock (&a->thread_ctx->thread_mutexs[z]);
+						#if TDEBUG >= 1
+						printf ("[slave][%zu] master, I found the key ! state %" STR(OFF_FORMAT_U) ", slice %zu\n", z, a->s, a->slice+1);
+						fflush (stdout);
+						#endif
+
+						if (a->thread_ctx->enable_condusleep)
+						{
+							pthread_mutex_lock (&a->thread_ctx->thread_mutex_usleep);
+							pthread_cond_signal (&a->thread_ctx->thread_cond_usleep); // unlock master/TH_PROCESSING cond
+							#if TDEBUG >= 1
+							printf ("[slave][%zu] after pthread_cond_signal TH_FOUND_KEY\n", z);
+							#endif
+							pthread_mutex_unlock (&a->thread_ctx->thread_mutex_usleep);
+						}
+
+						pthread_exit (NULL);
+					}
+				}
+
+				if (a->quit)
+				{
+					pthread_mutex_lock (&a->thread_ctx->thread_mutexs[z]);
+					a->status = TH_END;
+					pthread_mutex_unlock (&a->thread_ctx->thread_mutexs[z]);
+					#if TDEBUG >= 1
+					printf ("[slave][%zu] master, Another thread found the key, quit 1 \n", z);
+					fflush (stdout);
+					#endif
+
+					if (a->thread_ctx->enable_condusleep)
+					{
+						pthread_mutex_lock (&a->thread_ctx->thread_mutex_usleep);
+						pthread_cond_signal (&a->thread_ctx->thread_cond_usleep); // unlock master/TH_PROCESSING cond
+						#if TDEBUG >= 1
+						printf ("[slave][%zu] after pthread_cond_signal TH_END\n", z);
+						#endif
+						pthread_mutex_unlock (&a->thread_ctx->thread_mutex_usleep);
+					}
+
+					pthread_exit (NULL);
+				}
+
+				// setting internal status to wait
+				status = TH_WAIT;
+				continue;
+			}
+			else
+			{
+				// the OpenCL kernel return only one key if found, else nothing
+
+				pthread_mutex_lock (&a->thread_ctx->thread_mutexs[z]);
+				a->r = true;
+				a->key = matches[0];
+				status = a->status = TH_FOUND_KEY;
+				a->quit = true;
+				pthread_mutex_unlock (&a->thread_ctx->thread_mutexs[z]);
+				#if TDEBUG >= 1
+				printf ("[slave][%zu] master, I found the key at slice %zu\n", z, a->slice+1);
+				fflush (stdout);
+				#endif
+
+				if (a->thread_ctx->enable_condusleep)
+				{
+					pthread_mutex_lock (&a->thread_ctx->thread_mutex_usleep);
+					pthread_cond_signal (&a->thread_ctx->thread_cond_usleep); // unlock master/TH_PROCESSING cond
+					#if TDEBUG >= 1
+					printf ("[slave][%zu] after pthread_cond_signal TH_FOUND_KEY\n", z);
+					#endif
+					pthread_mutex_unlock (&a->thread_ctx->thread_mutex_usleep);
+				}
+
+				pthread_exit (NULL);
+			}
+		}
+
+		if (status >= TH_FOUND_KEY)
+		{
+			#if TDEBUG >= 1
+			if (status == TH_FOUND_KEY)
+			{
+				printf ("[slave][%zu] master, TH_FOUND_KEY, if you see this message, something is wrong\n", z);
+				fflush (stdout);
+			}
+			else if (status == TH_END)
+			{
+				printf ("[slave][%zu] master, TH_END reached\n", z);
+				fflush (stdout);
+			}
+			#endif
+			pthread_exit (NULL);
+		}
+
+	} while (status < TH_FOUND_KEY);
+
+	pthread_exit (NULL);
+}
diff --git a/tools/hitag2crack/crack5opencl/threads.h b/tools/hitag2crack/crack5opencl/threads.h
new file mode 100644
index 000000000..10f07f04b
--- /dev/null
+++ b/tools/hitag2crack/crack5opencl/threads.h
@@ -0,0 +1,143 @@
+/****************************************************************************
+
+Author : Gabriele 'matrix' Gristina <gabriele.gristina@gmail.com>
+Date   : Sun Jan 10 13:59:37 CET 2021
+Version: 0.1beta
+License: GNU General Public License v3 or any later version (see LICENSE.txt)
+
+*****************************************************************************
+    Copyright (C) 2020-2021  <Gabriele Gristina>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+****************************************************************************/
+
+#ifndef THREADS_H
+#define THREADS_H
+
+#include <stdio.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <pthread.h>
+
+#include "ht2crack5opencl.h"
+#include "opencl.h"
+#include "hitag2.h"
+
+typedef enum thread_status
+{
+	TH_START = 0,
+	TH_WAIT,
+	TH_PROCESSING,
+	TH_STOP,
+	TH_ERROR,
+	TH_FOUND_KEY,
+	TH_END
+
+} thread_status_t;
+
+typedef enum thread_type
+{
+	THREAD_TYPE_SEQ = 0,
+	THREAD_TYPE_ASYNC
+
+} thread_type_t;
+
+typedef enum thread_error
+{
+	THREAD_NOERROR = 0,
+	THREAD_ERROR_CTX_IS_NULL = -1,
+	THREAD_ERROR_CTX_IS_INIT = -2,
+	THREAD_ERROR_TYPE_INVALID = -3,
+	THREAD_ERROR_COUNT_INVALID = -4,
+	THREAD_ERROR_ATTR_SETDETACH = -5,
+	THREAD_ERROR_ATTR = -6,
+	THREAD_ERROR_MUTEXATTR = -7,
+	THREAD_ERROR_CREATE = -8,
+	THREAD_ERROR_MUTEX = -9,
+	THREAD_ERROR_COND = -10,
+	THREAD_ERROR_MUTEX_USLEEP = -11,
+	THREAD_ERROR_COND_USLEEP = -12,
+	THREAD_ERROR_GENERIC = -13,
+	THREAD_ERROR_ALLOC = -14
+
+} thread_error_t;
+
+typedef struct threads_ctx
+{
+	short init;
+	short type;
+
+	unsigned char pad1[4];
+	size_t thread_count;
+
+	pthread_t *thread_handles;
+
+	pthread_mutex_t *thread_mutexs;
+	pthread_cond_t *thread_conds;
+
+	short enable_condusleep;
+
+	// get rid of sleep/usleep call to synchronize threads
+	unsigned char pad2[6];
+	pthread_mutex_t thread_mutex_usleep;
+	pthread_cond_t thread_cond_usleep;
+
+	pthread_attr_t attr;
+	pthread_mutexattr_t mutex_attr;
+
+} thread_ctx_t;
+
+// used by threads engine
+typedef struct thread_arg
+{
+	thread_status_t status;
+	unsigned char pad1[4];
+	size_t max_threads;
+
+	uint64_t s;
+	uint32_t uid, nR1, aR1, nR2, aR2;
+	bool r;
+	bool err;
+	bool quit;
+	bool async;
+
+	uint64_t off;
+	uint64_t *matches;
+	uint32_t *matches_found;
+	size_t slice;
+	size_t max_step;
+	size_t device_id;
+
+	uint64_t key;
+
+	opencl_ctx_t *ocl_ctx;
+	thread_ctx_t *thread_ctx;
+
+} thread_args_t;
+
+int thread_init (thread_ctx_t *ctx, short type, size_t thread_count);
+int thread_start (thread_ctx_t *ctx, thread_args_t *args);
+int thread_stop (thread_ctx_t *ctx);
+
+void tprintf (const char * restrict format, ...);
+const char *thread_strerror (int error);
+const char *thread_status_strdesc (thread_status_t s);
+bool thread_setEnd (thread_ctx_t *ctx, thread_args_t *t_arg);
+
+void *computing_process (void *arg);
+void *computing_process_async (void *arg);
+
+int thread_destroy (thread_ctx_t *ctx);
+
+#endif // THREADS_H

From 2359bad00c3fe52c6ea25f7ac94ddf6d0d76903c Mon Sep 17 00:00:00 2001
From: Gabriele Gristina <matrix@users.noreply.github.com>
Date: Thu, 14 Jan 2021 00:03:29 +0100
Subject: [PATCH 352/682] update thread_strerror()

---
 tools/hitag2crack/crack5opencl/threads.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/tools/hitag2crack/crack5opencl/threads.c b/tools/hitag2crack/crack5opencl/threads.c
index 5c263233c..2c1e4c84f 100644
--- a/tools/hitag2crack/crack5opencl/threads.c
+++ b/tools/hitag2crack/crack5opencl/threads.c
@@ -29,6 +29,20 @@ const char *thread_strerror (int error)
 	switch (error)
 	{
 		case THREAD_NOERROR: return (const char *) "No error";
+		case THREAD_ERROR_CTX_IS_NULL: return (const char *) "CTX IS NULL";
+		case THREAD_ERROR_CTX_IS_INIT: return (const char *) "CTX IS INIT";
+		case THREAD_ERROR_TYPE_INVALID: return (const char *) "INVALID TYPE";
+		case THREAD_ERROR_COUNT_INVALID: return (const char *) "INVALID THREAD COUNT";
+		case THREAD_ERROR_ATTR_SETDETACH: return (const char *) "SETDETACHSTATE FAILED";
+		case THREAD_ERROR_ATTR: return (const char *) "INIT ATTR FAILED";
+		case THREAD_ERROR_MUTEXATTR: return (const char *) "INIT MUTEXATTR FAILED";
+		case THREAD_ERROR_CREATE: return (const char *) "PTHREAD CREATE FAILED";
+		case THREAD_ERROR_MUTEX: return (const char *) "INIT MUTEXFAILED";
+		case THREAD_ERROR_COND: return (const char *) "INIT COND FAILED";
+		case THREAD_ERROR_MUTEX_USLEEP: return (const char *) "INIT MUTEX USLEEP FAILED";
+		case THREAD_ERROR_COND_USLEEP: return (const char *) "INIT COND USLEEP FAILED";
+		case THREAD_ERROR_GENERIC: return (const char *) "GENERIC ERROR";
+		case THREAD_ERROR_ALLOC: return (const char *) "ALLOC FAILED";
 	}
 
 	return (const char *) "GENERIC";

From 509d7be7716dcd60a7138a9b0ac7fdba3fd432c7 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 14 Jan 2021 11:25:07 +0100
Subject: [PATCH 353/682] text

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 18b964704..526cda510 100644
--- a/README.md
+++ b/README.md
@@ -61,7 +61,7 @@ On the software side: quite a lot, see the [Changelog file](CHANGELOG.md).
 
 This repo compiles nicely on 
    - Proxspace v3.x
-     - [latest release v3.7.1](https://github.com/Gator96100/ProxSpace/releases)
+     - [latest release v3.7.2](https://github.com/Gator96100/ProxSpace/releases)
    - Windows/mingw environment with Qt5.6.1 & GCC 4.9
    - Ubuntu 16.04 -> 20.04
    - ParrotOS, Gentoo, Pentoo, Kali, Nethunter, Archlinux, Fedora, Debian

From 4af9777af6396a9ee118eb8c14b8677cd61f5e98 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Thu, 14 Jan 2021 11:33:29 +0100
Subject: [PATCH 354/682] text

---
 tools/hitag2crack/README.md              | 14 ++++++++++----
 tools/hitag2crack/crack5opencl/README.md |  6 +++---
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/tools/hitag2crack/README.md b/tools/hitag2crack/README.md
index 9e9e722ef..cf6bffb8d 100644
--- a/tools/hitag2crack/README.md
+++ b/tools/hitag2crack/README.md
@@ -5,7 +5,7 @@ Authors:
 
 * Attacks 1, 2, 3, 4 : Kevin Sheldrake <kev@headhacking.com>
 * Attacks 5, 5gpu : anonymous, based on https://github.com/factoritbv/hitag2hell by FactorIT B.V.
-* Attacks 5, 5opencl : Gabriele Gristina <gabriele.gristina@gmail.com>, based on 5gpu
+* Attack  5opencl : Gabriele Gristina <gabriele.gristina@gmail.com>, based on 5gpu
 
 Introduction
 ------------
@@ -108,6 +108,12 @@ Attack 5gpu
 Attack 5gpu is identical to attack 5, simply the code has been ported to OpenCL
 to run on GPUs and is therefore much faster than attack 5.
 
+Attack 5opencl
+--------------
+
+Attack 5opencl is an optimized OpenCL version based on 5gpu.
+It runs on multi GPUs/CPUs and is faster than 5gpu.
+
 Usage details: Attack 1
 -----------------------
 
@@ -209,7 +215,7 @@ $ ./ht2crack5 <UID> <nR1> <aR1> <nR2> <aR2>
 Usage details: Attack 5gpu/5opencl
 ----------------------------------
 
-Attack 5gpu requires two encrypted nonce and challenge
+Attacks 5gpu and 5opencl require two encrypted nonce and challenge
 response value pairs (nR, aR) for the tag's UID.
 
 ```
@@ -221,13 +227,13 @@ Stop once you got two pairs.
 $ ./ht2crack5gpu <UID> <nR1> <aR1> <nR2> <aR2>
 ```
 
-Attack 5opencl requires the same of 5gpu version.
+or
 
 ```
 $ ./ht2crack5opencl <UID> <nR1> <aR1> <nR2> <aR2>
 ```
 
-More details in crack5opencl/README.md
+5opencl supports a number of additional parameters, see crack5opencl/README.md for details.
 
 Usage details: Next steps
 -------------------------
diff --git a/tools/hitag2crack/crack5opencl/README.md b/tools/hitag2crack/crack5opencl/README.md
index 3d5635b23..1b7d05455 100644
--- a/tools/hitag2crack/crack5opencl/README.md
+++ b/tools/hitag2crack/crack5opencl/README.md
@@ -26,10 +26,10 @@ encrypted nonces and challenge response values.  They should be in hex.
 
 UID is the UID of the tag that you used to gather the nR aR values.
 
-Following the help:
+Usage:
 
 ```
-$ ./ht2crack5opencl 
+$ ./ht2crack5opencl
 ./ht2crack5opencl [options] {UID} {nR1} {aR1} {nR2} {aR2}
 
 Options:
@@ -50,7 +50,7 @@ Example, select devices 1, 2 and 3 using platform 1 and 2, with random queue eng
 ./ht2crack5opencl -D 2 -Q 2 -p 1,2 -d 1,2,3 2ab12bf2 4B71E49D 6A606453 D79BD94B 16A2255B
 ```
 
-You can found the correct OpenCL Platform ID's (-p) and Device ID's (-d) by:
+You can find the correct OpenCL Platform ID (-p) and Device ID (-d) with:
 
 ```
 ./ht2crack5opencl -s

From 08d6546af69c2bc0a6b80c159c0dadc3287b9055 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Thu, 14 Jan 2021 11:36:41 +0100
Subject: [PATCH 355/682] ht2crack5opencl: change default to GPU according to
 the help, thanks @matrix !

---
 tools/hitag2crack/crack5opencl/ht2crack5opencl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/hitag2crack/crack5opencl/ht2crack5opencl.c b/tools/hitag2crack/crack5opencl/ht2crack5opencl.c
index 234f23a36..4347e8eef 100644
--- a/tools/hitag2crack/crack5opencl/ht2crack5opencl.c
+++ b/tools/hitag2crack/crack5opencl/ht2crack5opencl.c
@@ -204,7 +204,7 @@ int main (int argc, char **argv)
 
 	char *platforms_selected = NULL;
 	char *devices_selected = NULL;
-	unsigned int device_types_selected = 2;
+	unsigned int device_types_selected = 0;
 	unsigned int thread_scheduler_type_selected = THREAD_TYPE_ASYNC;
 	unsigned int profile_selected = 2;
 	unsigned int queue_type = 0;

From 2fbdada59349ddd65b1c60f9b2f4376df0dcc87c Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Thu, 14 Jan 2021 11:39:24 +0100
Subject: [PATCH 356/682] changelog

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e5050bb6e..6a2c3e0ad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+ - Added `tools/hitag2crack/crack5opencl`, an optimized version of `crack5gpu` (@matrix)
  - Fixed Makefile to account for changes when running on Apple Silicon (@tcprst)
  - Added support for debugging ARM with JTAG & VSCode (@Gator96100)
  - Added MFUL "Gen1b" suport to `hf_mfu_setuid.lua` (@iceman1001)

From f2bc066858b22dfa397d2533dea1e724793dd220 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Thu, 14 Jan 2021 11:39:45 +0100
Subject: [PATCH 357/682] make style

---
 client/src/cmdanalyse.c                       |   40 +-
 client/src/cmdhfmfu.c                         |    8 +-
 client/src/cmdhw.c                            |    6 +-
 client/src/cmdlft55xx.c                       |   48 +-
 client/src/cmdsmartcard.c                     |   10 +-
 client/src/cmdusart.c                         |   24 +-
 client/src/fileutils.c                        |    4 +-
 client/src/fileutils.h                        |    2 +-
 client/src/preferences.c                      |  102 +-
 doc/commands.md                               |    4 +-
 .../hitag2crack/common/OpenCL-Headers/CL/cl.h |  600 +--
 .../common/OpenCL-Headers/CL/cl_d3d10.h       |   42 +-
 .../common/OpenCL-Headers/CL/cl_d3d11.h       |   42 +-
 .../OpenCL-Headers/CL/cl_dx9_media_sharing.h  |   39 +-
 .../CL/cl_dx9_media_sharing_intel.h           |   52 +-
 .../common/OpenCL-Headers/CL/cl_egl.h         |   50 +-
 .../common/OpenCL-Headers/CL/cl_ext.h         |  198 +-
 .../common/OpenCL-Headers/CL/cl_ext_intel.h   |  370 +-
 .../common/OpenCL-Headers/CL/cl_gl.h          |   44 +-
 .../common/OpenCL-Headers/CL/cl_gl_ext.h      |    4 +-
 .../common/OpenCL-Headers/CL/cl_half.h        |  554 ++-
 .../common/OpenCL-Headers/CL/cl_icd.h         |  354 +-
 .../common/OpenCL-Headers/CL/cl_platform.h    |  838 ++--
 .../CL/cl_va_api_media_sharing_intel.h        |   52 +-
 tools/hitag2crack/crack5opencl/hitag2.c       |  323 +-
 tools/hitag2crack/crack5opencl/hitag2.h       |   19 +-
 .../crack5opencl/ht2crack5opencl.c            | 3596 ++++++++---------
 tools/hitag2crack/crack5opencl/opencl.c       |  210 +-
 tools/hitag2crack/crack5opencl/opencl.h       |  113 +-
 tools/hitag2crack/crack5opencl/queue.c        |  806 ++--
 tools/hitag2crack/crack5opencl/queue.h        |   91 +-
 tools/hitag2crack/crack5opencl/threads.c      | 1115 +++--
 tools/hitag2crack/crack5opencl/threads.h      |  147 +-
 33 files changed, 4734 insertions(+), 5173 deletions(-)

diff --git a/client/src/cmdanalyse.c b/client/src/cmdanalyse.c
index 3f860c4e6..02ad3fcd0 100644
--- a/client/src/cmdanalyse.c
+++ b/client/src/cmdanalyse.c
@@ -242,7 +242,7 @@ static int CmdAnalyseLCR(const char *Cmd) {
     uint8_t data[100] = {0x00};
     int res = CLIParamHexToBuf(arg_get_str(ctx, 1), data, sizeof(data), &dlen);
     CLIParserFree(ctx);
-   
+
     if (res) {
         PrintAndLogEx(FAILED, "Error parsing bytes");
         return PM3_EINVARG;
@@ -272,7 +272,7 @@ static int CmdAnalyseCRC(const char *Cmd) {
     uint8_t data[1024] = {0x00};
     int res = CLIParamHexToBuf(arg_get_str(ctx, 1), data, sizeof(data), &dlen);
     CLIParserFree(ctx);
-   
+
     if (res) {
         PrintAndLogEx(FAILED, "Error parsing bytes");
         return PM3_EINVARG;
@@ -386,14 +386,14 @@ static int CmdAnalyseCHKSUM(const char *Cmd) {
     const char *s = arg_get_str(ctx, 2)->sval[0];
     bool verbose = arg_get_lit(ctx, 3);
     CLIParserFree(ctx);
-   
+
     uint32_t mlen = 0;
-    if (s) 
+    if (s)
         mlen = strlen(s);
 
     if (mlen > 8) {
         PrintAndLogEx(FAILED, "Mask value is max 4 hex bytes");
-        return PM3_EINVARG;        
+        return PM3_EINVARG;
     }
 
     uint32_t mask = 0;
@@ -487,7 +487,7 @@ static int CmdAnalyseTEASelfTest(const char *Cmd) {
     uint8_t v_le[8];
     memset(v_le, 0x00, sizeof(v_le));
     uint8_t *v_ptr = v_le;
-   
+
     SwapEndian64ex(data, 8, 4, v_ptr);
 
     // ENCRYPTION KEY:
@@ -856,7 +856,7 @@ static int CmdAnalyseNuid(const char *Cmd) {
     int res = CLIParamHexToBuf(arg_get_str(ctx, 1), uid, sizeof(uid), &uidlen);
     bool selftest = arg_get_lit(ctx, 2);
     CLIParserFree(ctx);
-   
+
     if (res) {
         PrintAndLogEx(FAILED, "Error parsing bytes");
         return PM3_EINVARG;
@@ -878,19 +878,19 @@ static int CmdAnalyseNuid(const char *Cmd) {
         PrintAndLogEx(INFO, "Self tests");
         bool test1 = (0 == memcmp(nuid, nuid_test1, sizeof(nuid)));
         PrintAndLogEx((test1) ? SUCCESS : FAILED, "1. %s -> %s ( %s )"
-            , sprint_hex_inrow(uid_test1, sizeof(uid_test1))
-            , sprint_hex(nuid, sizeof(nuid))
-            ,  test1 ? _GREEN_("ok") : _RED_("fail")
-            );
+                      , sprint_hex_inrow(uid_test1, sizeof(uid_test1))
+                      , sprint_hex(nuid, sizeof(nuid))
+                      ,  test1 ? _GREEN_("ok") : _RED_("fail")
+                     );
 
         memcpy(uid, uid_test2, sizeof(uid));
         mfc_generate4b_nuid(uid, nuid);
         bool test2 = (0 == memcmp(nuid, nuid_test2, sizeof(nuid)));
         PrintAndLogEx((test2) ? SUCCESS : FAILED, "2. %s -> %s ( %s )\n"
-            , sprint_hex_inrow(uid_test2, sizeof(uid_test2))
-            , sprint_hex(nuid, sizeof(nuid))
-            , test2 ? _GREEN_("ok") : _RED_("fail")
-            );
+                      , sprint_hex_inrow(uid_test2, sizeof(uid_test2))
+                      , sprint_hex(nuid, sizeof(nuid))
+                      , test2 ? _GREEN_("ok") : _RED_("fail")
+                     );
 
         return PM3_SUCCESS;
     }
@@ -922,7 +922,7 @@ static int CmdAnalyseDemodBuffer(const char *Cmd) {
     CLIExecWithReturn(ctx, Cmd, argtable, true);
     const char *s = arg_get_str(ctx, 1)->sval[0];
     CLIParserFree(ctx);
-   
+
     if (s == NULL) {
         PrintAndLogEx(FAILED, "Must provide a binary string");
         return PM3_EINVARG;
@@ -987,7 +987,7 @@ static int CmdAnalyseFoo(const char *Cmd) {
     CLIParserInit(&ctx, "analyze foo",
                   "experiments of cliparse",
                   "analyse foo -r a0000000a0002021"
-                  );
+                 );
 
     void *argtable[] = {
         arg_param_begin,
@@ -1001,8 +1001,8 @@ static int CmdAnalyseFoo(const char *Cmd) {
     uint8_t data[256];
     CLIGetHexWithReturn(ctx, 1, data, &datalen);
 
-    int data3len = 512;    
-    uint8_t data3[512];    
+    int data3len = 512;
+    uint8_t data3[512];
     CLIGetStrWithReturn(ctx, 1, data3, &data3len);
 
     CLIParserFree(ctx);
@@ -1010,7 +1010,7 @@ static int CmdAnalyseFoo(const char *Cmd) {
     PrintAndLogEx(INFO, "-r");
     PrintAndLogEx(INFO, "Got:  %s", sprint_hex_inrow(data, datalen));
     PrintAndLogEx(INFO, "Got:  %s", data3);
-    
+
     ClearGraph(false);
     GraphTraceLen = 15000;
 
diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index 9c0534c75..4d5106437 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -2746,7 +2746,7 @@ static int CmdHF14AMfUPwdGen(const char *Cmd) {
     bool selftest = arg_get_lit(ctx, 3);
     CLIParserFree(ctx);
 
-    if (selftest) 
+    if (selftest)
         return generator_selftest();
 
     if (u_len != 7) {
@@ -2873,9 +2873,9 @@ static int CmdHF14AMfuOtpTearoff(const char *Cmd) {
         return PM3_EINVARG;
     }
 
-   uint8_t teardata[8] = {0x00};
-   memcpy(teardata, data, sizeof(data));
-   memcpy(teardata + sizeof(data), test, sizeof(test));
+    uint8_t teardata[8] = {0x00};
+    memcpy(teardata, data, sizeof(data));
+    memcpy(teardata + sizeof(data), test, sizeof(test));
 
     PrintAndLogEx(INFO, "----------------- " _CYAN_("MFU Tear off") " ---------------------");
     PrintAndLogEx(INFO, "Starting Tear-off test");
diff --git a/client/src/cmdhw.c b/client/src/cmdhw.c
index 45281637c..b97a4f773 100644
--- a/client/src/cmdhw.c
+++ b/client/src/cmdhw.c
@@ -347,9 +347,9 @@ static int CmdDbg(const char *Cmd) {
     else if (lv1)
         dbg = 1;
     else if (lv2)
-        dbg = 2;    
+        dbg = 2;
     else if (lv3)
-        dbg = 3;    
+        dbg = 3;
     else if (lv4)
         dbg = 4;
 
@@ -817,7 +817,7 @@ static int CmdConnect(const char *Cmd) {
 
     int p_len = FILE_PATH_SIZE;
     char port[FILE_PATH_SIZE] = {0};
-    CLIGetStrWithReturn(ctx, 1, (uint8_t*)port, &p_len);
+    CLIGetStrWithReturn(ctx, 1, (uint8_t *)port, &p_len);
     uint32_t baudrate = arg_get_u32_def(ctx, 2, USART_BAUD_RATE);
     CLIParserFree(ctx);
 
diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index fe2ba09ca..a3e6bc176 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -80,11 +80,11 @@ static void print_usage_t55xx_downloadlink(uint8_t ShowAll, uint8_t dl_mode_defa
 }
 
 static void arg_add_t55xx_downloadlink(void *at[], uint8_t *idx, uint8_t show, uint8_t dl_mode_def) {
-    
-    char *r0 = (char*)calloc(56, sizeof(uint8_t));    
-    char *r1 = (char*)calloc(56, sizeof(uint8_t));
-    char *r2 = (char*)calloc(56, sizeof(uint8_t));
-    char *r3 = (char*)calloc(56, sizeof(uint8_t));
+
+    char *r0 = (char *)calloc(56, sizeof(uint8_t));
+    char *r1 = (char *)calloc(56, sizeof(uint8_t));
+    char *r2 = (char *)calloc(56, sizeof(uint8_t));
+    char *r3 = (char *)calloc(56, sizeof(uint8_t));
 
     sprintf(r0, "downlink - fixed bit length %s", (dl_mode_def == 0) ? "(detected def)" : "");
     sprintf(r1, "downlink - long leading reference %s", (dl_mode_def == 1) ? "(detected def)" : "");
@@ -98,12 +98,12 @@ static void arg_add_t55xx_downloadlink(void *at[], uint8_t *idx, uint8_t show, u
     at[n++] = arg_lit0(NULL, "r3", r3);
 
     if (show == T55XX_DLMODE_ALL) {
-        char *r4 = (char*)calloc(50, sizeof(uint8_t));
+        char *r4 = (char *)calloc(50, sizeof(uint8_t));
         sprintf(r4, "try all downlink modes %s", (dl_mode_def == 4) ? "(def)" : "");
         at[n++] = arg_lit0(NULL, "all", r4);
     }
     at[n++] = arg_param_end;
-    *idx = n;  
+    *idx = n;
 }
 
 
@@ -2876,7 +2876,7 @@ static int CmdT55xxWipe(const char *Cmd) {
                  );
 
     // 4 + (5 or 6)
-   void *argtable[9] = {
+    void *argtable[9] = {
         arg_param_begin,
         arg_str0("c", "cfg", "<hex>", "configuration block0 (4 hex bytes)"),
         arg_str0("p", "pwd", "<hex>", "password (4 hex bytes)"),
@@ -2887,7 +2887,7 @@ static int CmdT55xxWipe(const char *Cmd) {
     CLIExecWithReturn(ctx, Cmd, argtable, true);
 
     bool usepwd = false, gotconf = false;
-    uint32_t block0 = 0; 
+    uint32_t block0 = 0;
     int res = arg_get_u32_hexstr_def(ctx, 1, 0, &block0);
     if (res == 1) {
         gotconf = true;
@@ -2907,7 +2907,7 @@ static int CmdT55xxWipe(const char *Cmd) {
             PrintAndLogEx(WARNING, "Password should be 4 bytes, using default pwd");
     }
 
-    bool Q5 = arg_get_lit(ctx, 3); 
+    bool Q5 = arg_get_lit(ctx, 3);
     CLIParserFree(ctx);
 
     PrintAndLogEx(INFO, "Target " _YELLOW_("%s")" tag", (Q5) ? "Q5/T5555" : "T55x7");
@@ -3181,7 +3181,7 @@ static int CmdT55xxBruteForce(const char *Cmd) {
                   "lf t55xx bruteforce --r2 -s aaaaaa77 -e aaaaaa99\n"
                  );
 
-   void *argtable[3 + 6] = {
+    void *argtable[3 + 6] = {
         arg_param_begin,
         arg_str1("s", "start", "<hex>", "search start password (4 hex bytes)"),
         arg_str1("e", "end", "<hex>", "search end password (4 hex bytes)"),
@@ -3243,7 +3243,7 @@ static int CmdT55xxBruteForce(const char *Cmd) {
     curr = start_password;
 
     while (found == 0) {
-        
+
         PrintAndLogEx(NORMAL, "." NOLF);
 
         if (IsCancelled()) {
@@ -3308,7 +3308,7 @@ static int CmdT55xxRecoverPW(const char *Cmd) {
                  );
 
     // 2 + (5 or 6)
-   void *argtable[8] = {
+    void *argtable[8] = {
         arg_param_begin,
         arg_str1("p", "pwd", "<hex>", "password (4 hex bytes)"),
     };
@@ -3548,7 +3548,7 @@ static int CmdT55xxDetectPage1(const char *Cmd) {
                  );
 
     // 2 + (5 or 6)
-   void *argtable[7] = {
+    void *argtable[7] = {
         arg_param_begin,
         arg_lit0("1", NULL, "extract using data from graphbuffer"),
         arg_str0("p", "pwd", "<hex>", "password (4 hex bytes)"),
@@ -3565,7 +3565,7 @@ static int CmdT55xxDetectPage1(const char *Cmd) {
     if (res == 2) {
         PrintAndLogEx(INFO, "Password should be 4 hex bytes");
         return PM3_EINVARG;
-    } else if ( res == 1) {
+    } else if (res == 1) {
         usepwd = true;
     }
 
@@ -3606,7 +3606,7 @@ static int CmdT55xxDetectPage1(const char *Cmd) {
 
     if (use_graphbuf == false) {
         for (uint8_t dl_mode = downlink_mode; dl_mode < 4; dl_mode++) {
-            
+
             if (AcquireData(T55x7_PAGE1, T55x7_TRACE_BLOCK1, usepwd, password, dl_mode) == false)
                 continue;
 
@@ -3644,7 +3644,7 @@ static int CmdT55xxSetDeviceConfig(const char *Cmd) {
                   "lf t55xx deviceconfig -a 55 -b 14 -c 21 -d 30          -> default EM4305"
                  );
 
-   void *argtable[10 + 5] = {
+    void *argtable[10 + 5] = {
         arg_param_begin,
         arg_int0("a", NULL, "<8..255>", "Set start gap"),
         arg_int0("b", NULL, "<8..255>", "Set write gap"),
@@ -3677,7 +3677,7 @@ static int CmdT55xxSetDeviceConfig(const char *Cmd) {
 
     if ((r0 + r1 + r2 + r3) > 1) {
         PrintAndLogEx(FAILED, "Error multiple downlink encoding");
-        return PM3_EINVARG;        
+        return PM3_EINVARG;
     }
 
     uint8_t downlink_mode = 0;
@@ -3755,7 +3755,7 @@ static int CmdT55xxProtect(const char *Cmd) {
                  );
 
     // 4 + (5 or 6)
-   void *argtable[4 + 5] = {
+    void *argtable[4 + 5] = {
         arg_param_begin,
         arg_lit0("o", "override", "override safety check"),
         arg_str1("p", "pwd", "<hex>", "password (4 hex bytes)"),
@@ -3766,17 +3766,17 @@ static int CmdT55xxProtect(const char *Cmd) {
     CLIExecWithReturn(ctx, Cmd, argtable, true);
 
     uint8_t override = 0;
-    if (arg_get_lit(ctx, 1)) 
+    if (arg_get_lit(ctx, 1))
         override = 2;
 
     uint32_t password = 0;
-    bool usepwd = false; 
+    bool usepwd = false;
     int res = arg_get_u32_hexstr_def(ctx, 2, 0, &password);
     if (res == 2) {
         CLIParserFree(ctx);
         PrintAndLogEx(FAILED, "Error parsing password bytes");
         return PM3_EINVARG;
-    } else if ( res == 1) {
+    } else if (res == 1) {
         usepwd = true;
         override = 1;
     }
@@ -3942,7 +3942,7 @@ static int CmdT55xxSniff(const char *Cmd) {
     char dataText [100];
     int pulseBuffer[80] = { 0 }; // max should be 73 +/- - Holds Pulse widths
     char data[80]; //  linked to pulseBuffer. - Holds 0/1 from pulse widths
- 
+
     // setup and sample data from Proxmark
     // if not directed to existing sample/graphbuffer
     if (use_graphbuf == false) {
@@ -4159,7 +4159,7 @@ static int CmdT55xxSniff(const char *Cmd) {
         }
 
         // Print results
-        if (have_data) { 
+        if (have_data) {
             if (blockAddr == 7)
                 PrintAndLogEx(SUCCESS, "%-20s  | "_GREEN_("%8s")" | "_YELLOW_("%8s")" |  "_YELLOW_("%d")"  |   "_GREEN_("%d")"  | %3d | %3d | %s", modeText, pwdText, dataText, blockAddr, page, minWidth, maxWidth, data);
             else
diff --git a/client/src/cmdsmartcard.c b/client/src/cmdsmartcard.c
index 0b5bc4507..247090dd0 100644
--- a/client/src/cmdsmartcard.c
+++ b/client/src/cmdsmartcard.c
@@ -614,7 +614,7 @@ static int CmdSmartInfo(const char *Cmd) {
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
-    bool verbose = arg_get_lit(ctx, 1);    
+    bool verbose = arg_get_lit(ctx, 1);
     CLIParserFree(ctx);
 
     clearCommandBuffer();
@@ -628,7 +628,7 @@ static int CmdSmartInfo(const char *Cmd) {
     }
 
     if (resp.status != PM3_SUCCESS) {
-        if (verbose) { 
+        if (verbose) {
             PrintAndLogEx(WARNING, "smart card select failed");
         }
         return PM3_ESOFT;
@@ -685,7 +685,7 @@ static int CmdSmartReader(const char *Cmd) {
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
-    bool verbose = arg_get_lit(ctx, 1);    
+    bool verbose = arg_get_lit(ctx, 1);
     CLIParserFree(ctx);
 
     clearCommandBuffer();
@@ -700,7 +700,7 @@ static int CmdSmartReader(const char *Cmd) {
 
     if (resp.status != PM3_SUCCESS) {
         if (verbose) {
-             PrintAndLogEx(WARNING, "smart card select failed");
+            PrintAndLogEx(WARNING, "smart card select failed");
         }
         return PM3_ESOFT;
     }
@@ -733,7 +733,7 @@ static int CmdSmartSetClock(const char *Cmd) {
     bool c4 = arg_get_lit(ctx, 3);
     CLIParserFree(ctx);
 
-    if ((c16 + c8 + c4) > 1 ) {
+    if ((c16 + c8 + c4) > 1) {
         PrintAndLogEx(WARNING, "Only one clock speed can be used at a time");
         return PM3_EINVARG;
     }
diff --git a/client/src/cmdusart.c b/client/src/cmdusart.c
index 6be9ed743..92991be4c 100644
--- a/client/src/cmdusart.c
+++ b/client/src/cmdusart.c
@@ -14,7 +14,7 @@
 #include <stdio.h>
 #include <ctype.h>
 #include "cmdparser.h"    // command_t
-#include "cliparser.h"    // 
+#include "cliparser.h"    //
 #include "commonutil.h"   // ARRAYLEN
 #include "comms.h"
 #include "util_posix.h"
@@ -119,7 +119,7 @@ static int CmdUsartConfig(const char *Cmd) {
     bool po = arg_get_lit(ctx, 4);
     CLIParserFree(ctx);
 
-    if ((pn + pe + po) > 1 ) {
+    if ((pn + pe + po) > 1) {
         PrintAndLogEx(WARNING, "Only one parity can be used at a time");
         return PM3_EINVARG;
     }
@@ -160,7 +160,7 @@ static int usart_bt_testcomm(uint32_t baudrate, uint8_t parity) {
 static int CmdUsartBtFactory(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "usart btfactory",
-                  "Reset BT add-on to factory settings\n"                  
+                  "Reset BT add-on to factory settings\n"
                   "This requires\n"
                   "    1) BTpower to be turned ON\n"
                   "    2) BT add-on to NOT be connected\n"
@@ -361,22 +361,22 @@ static int CmdUsartBtPin(const char *Cmd) {
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
     int plen = 4;
-    char pin[5] = { 0, 0 ,0, 0, 0 };
+    char pin[5] = { 0, 0, 0, 0, 0 };
     CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)pin, sizeof(pin), &plen);
     CLIParserFree(ctx);
 
     if (plen != 4) {
         PrintAndLogEx(FAILED, "PIN must be 4 digits");
-        return PM3_EINVARG;        
+        return PM3_EINVARG;
     }
 
     for (uint8_t i = 0; i < plen; i++) {
         if (isdigit(pin[i]) == false) {
             PrintAndLogEx(FAILED, "PIN must be 4 digits");
-            return PM3_EINVARG;        
+            return PM3_EINVARG;
         }
     }
-   
+
     char string[6 + sizeof(pin)] = {0};
     sprintf(string, "AT+PIN%s", pin);
     uint8_t data[PM3_CMD_DATA_SIZE] = {0x00};
@@ -425,7 +425,7 @@ static int CmdUsartTX(const char *Cmd) {
     size_t i2 = 0;
     size_t n = strlen(s);
 
-    // strip / replace 
+    // strip / replace
     for (size_t i = 0; i < n; i++) {
         if ((i < n - 1) && (s[i] == '\\') && (s[i + 1] == '\\')) {
             i++;
@@ -469,7 +469,7 @@ static int CmdUsartRX(const char *Cmd) {
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
-    uint32_t waittime = arg_get_u32_def(ctx, 1, 0);    
+    uint32_t waittime = arg_get_u32_def(ctx, 1, 0);
     CLIParserFree(ctx);
 
     uint8_t data[PM3_CMD_DATA_SIZE] = {0x00};
@@ -501,7 +501,7 @@ static int CmdUsartTXRX(const char *Cmd) {
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
-    uint32_t waittime = arg_get_u32_def(ctx, 1, 1000);    
+    uint32_t waittime = arg_get_u32_def(ctx, 1, 1000);
     int slen = 0;
     char s[PM3_CMD_DATA_SIZE] = {0};
     CLIParamStrToBuf(arg_get_str(ctx, 2), (uint8_t *)s, sizeof(s), &slen);
@@ -568,7 +568,7 @@ static int CmdUsartTXhex(const char *Cmd) {
     uint8_t data[PM3_CMD_DATA_SIZE] = {0x00};
     int res = CLIParamHexToBuf(arg_get_str(ctx, 1), data, sizeof(data), &dlen);
     CLIParserFree(ctx);
-   
+
     if (res) {
         PrintAndLogEx(FAILED, "Error parsing bytes");
         return PM3_EINVARG;
@@ -591,7 +591,7 @@ static int CmdUsartRXhex(const char *Cmd) {
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
-    uint32_t waittime = arg_get_u32_def(ctx, 1, 0);    
+    uint32_t waittime = arg_get_u32_def(ctx, 1, 0);
     CLIParserFree(ctx);
 
     uint8_t data[PM3_CMD_DATA_SIZE] = {0x00};
diff --git a/client/src/fileutils.c b/client/src/fileutils.c
index 23444d62b..d68c95563 100644
--- a/client/src/fileutils.c
+++ b/client/src/fileutils.c
@@ -196,11 +196,11 @@ bool create_path(const char *dirname) {
 }
 */
 
-bool setDefaultPath (savePaths_t pathIndex, const char *Path) {
+bool setDefaultPath(savePaths_t pathIndex, const char *Path) {
 
     if (pathIndex < spItemCount) {
         if ((Path == NULL) && (session.defaultPaths[pathIndex] != NULL)) {
-            free (session.defaultPaths[pathIndex]);
+            free(session.defaultPaths[pathIndex]);
             session.defaultPaths[pathIndex] = NULL;
         }
 
diff --git a/client/src/fileutils.h b/client/src/fileutils.h
index 587e48ec6..480cb013b 100644
--- a/client/src/fileutils.h
+++ b/client/src/fileutils.h
@@ -78,7 +78,7 @@ typedef enum {
 
 int fileExists(const char *filename);
 //bool create_path(const char *dirname);
-bool setDefaultPath (savePaths_t pathIndex,const char *Path);  // set a path in the path list session.defaultPaths
+bool setDefaultPath(savePaths_t pathIndex, const char *Path);  // set a path in the path list session.defaultPaths
 
 char *newfilenamemcopy(const char *preferredName, const char *suffix);
 
diff --git a/client/src/preferences.c b/client/src/preferences.c
index 6a3207cd4..b133dd428 100644
--- a/client/src/preferences.c
+++ b/client/src/preferences.c
@@ -55,27 +55,27 @@ int preferences_load(void) {
     session.show_hints = true;
 
     session.bar_mode = STYLE_VALUE;
-    setDefaultPath (spDefault, "");
-    setDefaultPath (spDump, "");
-    setDefaultPath (spTrace, "");
+    setDefaultPath(spDefault, "");
+    setDefaultPath(spDump, "");
+    setDefaultPath(spTrace, "");
 
     // default save path
     if (get_my_user_directory() != NULL) // should return path to .proxmark3 folder
-        setDefaultPath (spDefault, get_my_user_directory());
+        setDefaultPath(spDefault, get_my_user_directory());
     else
-        setDefaultPath (spDefault, ".");
+        setDefaultPath(spDefault, ".");
 
     // default dump path
     if (get_my_user_directory() != NULL) // should return path to .proxmark3 folder
-        setDefaultPath (spDump, get_my_user_directory());
+        setDefaultPath(spDump, get_my_user_directory());
     else
-        setDefaultPath (spDump, ".");
+        setDefaultPath(spDump, ".");
 
     // default dump path
     if (get_my_user_directory() != NULL) // should return path to .proxmark3 folder
-        setDefaultPath (spTrace, get_my_user_directory());
+        setDefaultPath(spTrace, get_my_user_directory());
     else
-        setDefaultPath (spTrace, ".");
+        setDefaultPath(spTrace, ".");
 
     if (session.incognito) {
         PrintAndLogEx(INFO, "No preferences file will be loaded");
@@ -177,9 +177,9 @@ void preferences_save_callback(json_t *root) {
 
     JsonSaveBoolean(root, "os.supports.colors", session.supports_colors);
 
-   JsonSaveStr(root, "file.default.savepath", session.defaultPaths[spDefault]);
-   JsonSaveStr(root, "file.default.dumppath", session.defaultPaths[spDump]);
-   JsonSaveStr(root, "file.default.tracepath", session.defaultPaths[spTrace]);
+    JsonSaveStr(root, "file.default.savepath", session.defaultPaths[spDefault]);
+    JsonSaveStr(root, "file.default.dumppath", session.defaultPaths[spDump]);
+    JsonSaveStr(root, "file.default.tracepath", session.defaultPaths[spTrace]);
 
     // Plot window
     JsonSaveInt(root, "window.plot.xpos", session.plot.x);
@@ -262,15 +262,15 @@ void preferences_load_callback(json_t *root) {
 
     // default save path
     if (json_unpack_ex(root, &up_error, 0, "{s:s}", "file.default.savepath", &s1) == 0)
-        setDefaultPath (spDefault, s1);
+        setDefaultPath(spDefault, s1);
 
     // default dump path
     if (json_unpack_ex(root, &up_error, 0, "{s:s}", "file.default.dumppath", &s1) == 0)
-        setDefaultPath (spDump, s1);
+        setDefaultPath(spDump, s1);
 
     // default trace path
     if (json_unpack_ex(root, &up_error, 0, "{s:s}", "file.default.tracepath", &s1) == 0)
-        setDefaultPath (spTrace, s1);
+        setDefaultPath(spTrace, s1);
 
     // window plot
     if (json_unpack_ex(root, &up_error, 0, "{s:i}", "window.plot.xpos", &i1) == 0)
@@ -424,49 +424,49 @@ static void showSavePathState(savePaths_t path_index, prefShowOpt_t opt) {
     char s[50];
     switch (path_index) {
         case spDefault:
-            strcpy (s, "default save path......");
+            strcpy(s, "default save path......");
             break;
         case spDump:
-            strcpy (s, "dump save path.........");
+            strcpy(s, "dump save path.........");
             break;
         case spTrace:
-            strcpy (s, "trace save path........");
+            strcpy(s, "trace save path........");
             break;
         case spItemCount:
         default:
-            strcpy (s, _RED_("unknown")" save path......");
+            strcpy(s, _RED_("unknown")" save path......");
     }
 
     if ((session.defaultPaths[path_index] == NULL) || (strcmp(session.defaultPaths[path_index], "") == 0)) {
         PrintAndLogEx(INFO, "   %s %s "_WHITE_("not set"),
-            prefShowMsg(opt),
-            s
-        );
+                      prefShowMsg(opt),
+                      s
+                     );
     } else {
         PrintAndLogEx(INFO, "   %s %s "_GREEN_("%s"),
-            prefShowMsg(opt),
-            s,
-            session.defaultPaths[path_index]
-        );
+                      prefShowMsg(opt),
+                      s,
+                      session.defaultPaths[path_index]
+                     );
     }
 }
 
 static void showPlotPosState(void) {
     PrintAndLogEx(INFO, "    Plot window............ X "_GREEN_("%4d")" Y "_GREEN_("%4d")" H "_GREEN_("%4d")" W "_GREEN_("%4d"),
-        session.plot.x,
-        session.plot.y,
-        session.plot.h,
-        session.plot.w
-    );
+                  session.plot.x,
+                  session.plot.y,
+                  session.plot.h,
+                  session.plot.w
+                 );
 }
 
 static void showOverlayPosState(void) {
     PrintAndLogEx(INFO, "    Slider/Overlay window.. X "_GREEN_("%4d")" Y "_GREEN_("%4d")" H "_GREEN_("%4d")" W "_GREEN_("%4d"),
-        session.overlay.x,
-        session.overlay.y,
-        session.overlay.h,
-        session.overlay.w
-    );
+                  session.overlay.x,
+                  session.overlay.y,
+                  session.overlay.h,
+                  session.overlay.w
+                 );
 }
 
 static void showHintsState(prefShowOpt_t opt) {
@@ -521,8 +521,8 @@ static int setCmdEmoji(const char *Cmd) {
     bool show_alt = arg_get_lit(ctx, 3);
     bool show_none = arg_get_lit(ctx, 4);
     CLIParserFree(ctx);
-   
-    if ( (show_a + show_e + show_alt + show_none) > 1) {
+
+    if ((show_a + show_e + show_alt + show_none) > 1) {
         PrintAndLogEx(FAILED, "Can only set one option");
         return PM3_EINVARG;
     }
@@ -572,7 +572,7 @@ static int setCmdColor(const char *Cmd) {
     bool use_n = arg_get_lit(ctx, 2);
     CLIParserFree(ctx);
 
-    if ( (use_c + use_n) > 1) {
+    if ((use_c + use_n) > 1) {
         PrintAndLogEx(FAILED, "Can only set one option");
         return PM3_EINVARG;
     }
@@ -618,7 +618,7 @@ static int setCmdDebug(const char *Cmd) {
     bool use_full = arg_get_lit(ctx, 3);
     CLIParserFree(ctx);
 
-    if ( (use_off + use_simple + use_full) > 1) {
+    if ((use_off + use_simple + use_full) > 1) {
         PrintAndLogEx(FAILED, "Can only set one option");
         return PM3_EINVARG;
     }
@@ -662,7 +662,7 @@ static int setCmdDeviceDebug (const char *Cmd)
         arg_lit0(NULL, "error", "error messages"),
         arg_lit0(NULL, "info", "info messages"),
         arg_lit0(NULL, "dbg", "debug messages"),
-        arg_lit0(NULL, "ext", "extended debug messages"),        
+        arg_lit0(NULL, "ext", "extended debug messages"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
@@ -734,12 +734,12 @@ static int setCmdHint(const char *Cmd) {
     bool use_on = arg_get_lit(ctx, 2);
     CLIParserFree(ctx);
 
-    if ( (use_off + use_on) > 1) {
+    if ((use_off + use_on) > 1) {
         PrintAndLogEx(FAILED, "Can only set one option");
         return PM3_EINVARG;
     }
- 
-     bool new_value = session.show_hints;
+
+    bool new_value = session.show_hints;
     if (use_off) {
         new_value = false;
     }
@@ -777,11 +777,11 @@ static int setCmdPlotSliders(const char *Cmd) {
     bool use_on = arg_get_lit(ctx, 2);
     CLIParserFree(ctx);
 
-    if ( (use_off + use_on) > 1) {
+    if ((use_off + use_on) > 1) {
         PrintAndLogEx(FAILED, "Can only set one option");
         return PM3_EINVARG;
     }
- 
+
     bool new_value = session.overlay_sliders;
     if (use_off) {
         new_value = false;
@@ -801,7 +801,7 @@ static int setCmdPlotSliders(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
-static int setCmdSavePaths (const char *Cmd) {
+static int setCmdSavePaths(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "pref set savepath",
                   "Set presistent preference of file paths in the client",
@@ -861,8 +861,8 @@ static int setCmdSavePaths (const char *Cmd) {
 
     // Check path
     if (fileExists(path) == false && create_dir == false) {
-        PrintAndLogEx(ERR,"path does not exist... "_RED_("%s"), path);
-    } 
+        PrintAndLogEx(ERR, "path does not exist... "_RED_("%s"), path);
+    }
 
     // do we need to create it
     //    if (!fileExists(newValue))
@@ -871,7 +871,7 @@ static int setCmdSavePaths (const char *Cmd) {
     if (path_item < spItemCount) {
         if (strcmp(path, session.defaultPaths[path_item]) != 0) {
             showSavePathState(path_item, prefShowOLD);
-            setDefaultPath (path_item, path);
+            setDefaultPath(path_item, path);
             showSavePathState(path_item, prefShowNEW);
             preferences_save();
         } else {
@@ -902,7 +902,7 @@ static int setCmdBarMode(const char *Cmd) {
     bool show_val = arg_get_lit(ctx, 3);
     CLIParserFree(ctx);
 
-    if ( (show_bar + show_mix + show_val) > 1) {
+    if ((show_bar + show_mix + show_val) > 1) {
         PrintAndLogEx(FAILED, "Can only set one option");
         return PM3_EINVARG;
     }
diff --git a/doc/commands.md b/doc/commands.md
index 347fdaaa8..33b47f975 100644
--- a/doc/commands.md
+++ b/doc/commands.md
@@ -506,7 +506,7 @@ Check column "offline" for their availability.
 |command                  |offline |description
 |-------                  |------- |-----------
 |`hw help                `|Y       |`This help`
-|`hw connect             `|Y       |`connect Proxmark3 to serial port`
+|`hw connect             `|Y       |`Connect Proxmark3 to serial port`
 |`hw dbg                 `|N       |`Set Proxmark3 debug level`
 |`hw detectreader        `|N       |`Detect external reader field`
 |`hw fpgaoff             `|N       |`Set FPGA off`
@@ -515,7 +515,7 @@ Check column "offline" for their availability.
 |`hw ping                `|N       |`Test if the Proxmark3 is responsive`
 |`hw readmem             `|N       |`Read memory at decimal address from flash`
 |`hw reset               `|N       |`Reset the Proxmark3`
-|`hw setlfdivisor        `|N       |`Drive LF antenna at 12 MHz / (divisor + 1)`
+|`hw setlfdivisor        `|N       |`Drive LF antenna at 12MHz / (divisor + 1)`
 |`hw setmux              `|N       |`Set the ADC mux to a specific value`
 |`hw standalone          `|N       |`Jump to the standalone mode`
 |`hw status              `|N       |`Show runtime status information about the connected Proxmark3`
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl.h
index 3a5aae486..4e6103e49 100644
--- a/tools/hitag2crack/common/OpenCL-Headers/CL/cl.h
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl.h
@@ -26,15 +26,15 @@ extern "C" {
 
 /******************************************************************************/
 
-typedef struct _cl_platform_id *    cl_platform_id;
-typedef struct _cl_device_id *      cl_device_id;
-typedef struct _cl_context *        cl_context;
-typedef struct _cl_command_queue *  cl_command_queue;
-typedef struct _cl_mem *            cl_mem;
-typedef struct _cl_program *        cl_program;
-typedef struct _cl_kernel *         cl_kernel;
-typedef struct _cl_event *          cl_event;
-typedef struct _cl_sampler *        cl_sampler;
+typedef struct _cl_platform_id     *cl_platform_id;
+typedef struct _cl_device_id       *cl_device_id;
+typedef struct _cl_context         *cl_context;
+typedef struct _cl_command_queue   *cl_command_queue;
+typedef struct _cl_mem             *cl_mem;
+typedef struct _cl_program         *cl_program;
+typedef struct _cl_kernel          *cl_kernel;
+typedef struct _cl_event           *cl_event;
+typedef struct _cl_sampler         *cl_sampler;
 
 typedef cl_uint             cl_bool;                     /* WARNING!  Unlike cl_ types in cl_platform.h, cl_bool is not guaranteed to be the same size as the bool in kernels. */
 typedef cl_ulong            cl_bitfield;
@@ -147,13 +147,13 @@ typedef struct _cl_image_desc {
     union {
 #endif
 #endif
-      cl_mem                  buffer;
+    cl_mem                  buffer;
 #ifdef CL_VERSION_2_0
 #if defined(_MSC_VER) && defined(__STDC__)
     /* Anonymous unions are not supported in /Za builds */
 #else
-      cl_mem                  mem_object;
-    };
+    cl_mem                  mem_object;
+};
 #endif
 #if defined(_MSC_VER) && !defined(__STDC__)
 #pragma warning( pop )
@@ -945,39 +945,39 @@ typedef struct _cl_name_version {
 /* Platform API */
 extern CL_API_ENTRY cl_int CL_API_CALL
 clGetPlatformIDs(cl_uint          num_entries,
-                 cl_platform_id * platforms,
-                 cl_uint *        num_platforms) CL_API_SUFFIX__VERSION_1_0;
+                 cl_platform_id *platforms,
+                 cl_uint         *num_platforms) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clGetPlatformInfo(cl_platform_id   platform,
                   cl_platform_info param_name,
                   size_t           param_value_size,
-                  void *           param_value,
-                  size_t *         param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+                  void            *param_value,
+                  size_t          *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
 
 /* Device APIs */
 extern CL_API_ENTRY cl_int CL_API_CALL
 clGetDeviceIDs(cl_platform_id   platform,
                cl_device_type   device_type,
                cl_uint          num_entries,
-               cl_device_id *   devices,
-               cl_uint *        num_devices) CL_API_SUFFIX__VERSION_1_0;
+               cl_device_id    *devices,
+               cl_uint         *num_devices) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clGetDeviceInfo(cl_device_id    device,
                 cl_device_info  param_name,
                 size_t          param_value_size,
-                void *          param_value,
-                size_t *        param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+                void           *param_value,
+                size_t         *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef CL_VERSION_1_2
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clCreateSubDevices(cl_device_id                         in_device,
-                   const cl_device_partition_property * properties,
+                   const cl_device_partition_property *properties,
                    cl_uint                              num_devices,
-                   cl_device_id *                       out_devices,
-                   cl_uint *                            num_devices_ret) CL_API_SUFFIX__VERSION_1_2;
+                   cl_device_id                        *out_devices,
+                   cl_uint                             *num_devices_ret) CL_API_SUFFIX__VERSION_1_2;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clRetainDevice(cl_device_id device) CL_API_SUFFIX__VERSION_1_2;
@@ -996,36 +996,36 @@ clSetDefaultDeviceCommandQueue(cl_context           context,
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clGetDeviceAndHostTimer(cl_device_id    device,
-                        cl_ulong*       device_timestamp,
-                        cl_ulong*       host_timestamp) CL_API_SUFFIX__VERSION_2_1;
+                        cl_ulong       *device_timestamp,
+                        cl_ulong       *host_timestamp) CL_API_SUFFIX__VERSION_2_1;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clGetHostTimer(cl_device_id device,
-               cl_ulong *   host_timestamp) CL_API_SUFFIX__VERSION_2_1;
+               cl_ulong    *host_timestamp) CL_API_SUFFIX__VERSION_2_1;
 
 #endif
 
 /* Context APIs */
 extern CL_API_ENTRY cl_context CL_API_CALL
-clCreateContext(const cl_context_properties * properties,
+clCreateContext(const cl_context_properties *properties,
                 cl_uint              num_devices,
-                const cl_device_id * devices,
-                void (CL_CALLBACK * pfn_notify)(const char * errinfo,
-                                                const void * private_info,
-                                                size_t       cb,
-                                                void *       user_data),
-                void *               user_data,
-                cl_int *             errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+                const cl_device_id *devices,
+                void (CL_CALLBACK *pfn_notify)(const char *errinfo,
+                                               const void *private_info,
+                                               size_t       cb,
+                                               void        *user_data),
+                void                *user_data,
+                cl_int              *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_context CL_API_CALL
-clCreateContextFromType(const cl_context_properties * properties,
+clCreateContextFromType(const cl_context_properties *properties,
                         cl_device_type      device_type,
-                        void (CL_CALLBACK * pfn_notify)(const char * errinfo,
-                                                        const void * private_info,
-                                                        size_t       cb,
-                                                        void *       user_data),
-                        void *              user_data,
-                        cl_int *            errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+                        void (CL_CALLBACK *pfn_notify)(const char *errinfo,
+                                                       const void *private_info,
+                                                       size_t       cb,
+                                                       void        *user_data),
+                        void               *user_data,
+                        cl_int             *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clRetainContext(cl_context context) CL_API_SUFFIX__VERSION_1_0;
@@ -1037,16 +1037,16 @@ extern CL_API_ENTRY cl_int CL_API_CALL
 clGetContextInfo(cl_context         context,
                  cl_context_info    param_name,
                  size_t             param_value_size,
-                 void *             param_value,
-                 size_t *           param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+                 void              *param_value,
+                 size_t            *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef CL_VERSION_3_0
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clSetContextDestructorCallback(cl_context         context,
-                               void (CL_CALLBACK* pfn_notify)(cl_context context,
-                                                              void* user_data),
-                               void*              user_data) CL_API_SUFFIX__VERSION_3_0;
+                               void (CL_CALLBACK *pfn_notify)(cl_context context,
+                                       void *user_data),
+                               void              *user_data) CL_API_SUFFIX__VERSION_3_0;
 
 #endif
 
@@ -1057,8 +1057,8 @@ clSetContextDestructorCallback(cl_context         context,
 extern CL_API_ENTRY cl_command_queue CL_API_CALL
 clCreateCommandQueueWithProperties(cl_context               context,
                                    cl_device_id             device,
-                                   const cl_queue_properties *    properties,
-                                   cl_int *                 errcode_ret) CL_API_SUFFIX__VERSION_2_0;
+                                   const cl_queue_properties     *properties,
+                                   cl_int                  *errcode_ret) CL_API_SUFFIX__VERSION_2_0;
 
 #endif
 
@@ -1072,16 +1072,16 @@ extern CL_API_ENTRY cl_int CL_API_CALL
 clGetCommandQueueInfo(cl_command_queue      command_queue,
                       cl_command_queue_info param_name,
                       size_t                param_value_size,
-                      void *                param_value,
-                      size_t *              param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+                      void                 *param_value,
+                      size_t               *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
 
 /* Memory Object APIs */
 extern CL_API_ENTRY cl_mem CL_API_CALL
 clCreateBuffer(cl_context   context,
                cl_mem_flags flags,
                size_t       size,
-               void *       host_ptr,
-               cl_int *     errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+               void        *host_ptr,
+               cl_int      *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef CL_VERSION_1_1
 
@@ -1089,8 +1089,8 @@ extern CL_API_ENTRY cl_mem CL_API_CALL
 clCreateSubBuffer(cl_mem                   buffer,
                   cl_mem_flags             flags,
                   cl_buffer_create_type    buffer_create_type,
-                  const void *             buffer_create_info,
-                  cl_int *                 errcode_ret) CL_API_SUFFIX__VERSION_1_1;
+                  const void              *buffer_create_info,
+                  cl_int                  *errcode_ret) CL_API_SUFFIX__VERSION_1_1;
 
 #endif
 
@@ -1099,10 +1099,10 @@ clCreateSubBuffer(cl_mem                   buffer,
 extern CL_API_ENTRY cl_mem CL_API_CALL
 clCreateImage(cl_context              context,
               cl_mem_flags            flags,
-              const cl_image_format * image_format,
-              const cl_image_desc *   image_desc,
-              void *                  host_ptr,
-              cl_int *                errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+              const cl_image_format *image_format,
+              const cl_image_desc    *image_desc,
+              void                   *host_ptr,
+              cl_int                 *errcode_ret) CL_API_SUFFIX__VERSION_1_2;
 
 #endif
 
@@ -1113,8 +1113,8 @@ clCreatePipe(cl_context                 context,
              cl_mem_flags               flags,
              cl_uint                    pipe_packet_size,
              cl_uint                    pipe_max_packets,
-             const cl_pipe_properties * properties,
-             cl_int *                   errcode_ret) CL_API_SUFFIX__VERSION_2_0;
+             const cl_pipe_properties *properties,
+             cl_int                    *errcode_ret) CL_API_SUFFIX__VERSION_2_0;
 
 #endif
 
@@ -1122,20 +1122,20 @@ clCreatePipe(cl_context                 context,
 
 extern CL_API_ENTRY cl_mem CL_API_CALL
 clCreateBufferWithProperties(cl_context                context,
-                             const cl_mem_properties * properties,
+                             const cl_mem_properties *properties,
                              cl_mem_flags              flags,
                              size_t                    size,
-                             void *                    host_ptr,
-                             cl_int *                  errcode_ret) CL_API_SUFFIX__VERSION_3_0;
+                             void                     *host_ptr,
+                             cl_int                   *errcode_ret) CL_API_SUFFIX__VERSION_3_0;
 
 extern CL_API_ENTRY cl_mem CL_API_CALL
 clCreateImageWithProperties(cl_context                context,
-                            const cl_mem_properties * properties,
+                            const cl_mem_properties *properties,
                             cl_mem_flags              flags,
-                            const cl_image_format *   image_format,
-                            const cl_image_desc *     image_desc,
-                            void *                    host_ptr,
-                            cl_int *                  errcode_ret) CL_API_SUFFIX__VERSION_3_0;
+                            const cl_image_format    *image_format,
+                            const cl_image_desc      *image_desc,
+                            void                     *host_ptr,
+                            cl_int                   *errcode_ret) CL_API_SUFFIX__VERSION_3_0;
 
 #endif
 
@@ -1150,22 +1150,22 @@ clGetSupportedImageFormats(cl_context           context,
                            cl_mem_flags         flags,
                            cl_mem_object_type   image_type,
                            cl_uint              num_entries,
-                           cl_image_format *    image_formats,
-                           cl_uint *            num_image_formats) CL_API_SUFFIX__VERSION_1_0;
+                           cl_image_format     *image_formats,
+                           cl_uint             *num_image_formats) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clGetMemObjectInfo(cl_mem           memobj,
                    cl_mem_info      param_name,
                    size_t           param_value_size,
-                   void *           param_value,
-                   size_t *         param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+                   void            *param_value,
+                   size_t          *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clGetImageInfo(cl_mem           image,
                cl_image_info    param_name,
                size_t           param_value_size,
-               void *           param_value,
-               size_t *         param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+               void            *param_value,
+               size_t          *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef CL_VERSION_2_0
 
@@ -1173,8 +1173,8 @@ extern CL_API_ENTRY cl_int CL_API_CALL
 clGetPipeInfo(cl_mem           pipe,
               cl_pipe_info     param_name,
               size_t           param_value_size,
-              void *           param_value,
-              size_t *         param_value_size_ret) CL_API_SUFFIX__VERSION_2_0;
+              void            *param_value,
+              size_t          *param_value_size_ret) CL_API_SUFFIX__VERSION_2_0;
 
 #endif
 
@@ -1182,9 +1182,9 @@ clGetPipeInfo(cl_mem           pipe,
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clSetMemObjectDestructorCallback(cl_mem memobj,
-                                 void (CL_CALLBACK * pfn_notify)(cl_mem memobj,
-                                                                 void * user_data),
-                                 void * user_data) CL_API_SUFFIX__VERSION_1_1;
+                                 void (CL_CALLBACK *pfn_notify)(cl_mem memobj,
+                                         void *user_data),
+                                 void *user_data) CL_API_SUFFIX__VERSION_1_1;
 
 #endif
 
@@ -1192,7 +1192,7 @@ clSetMemObjectDestructorCallback(cl_mem memobj,
 
 #ifdef CL_VERSION_2_0
 
-extern CL_API_ENTRY void * CL_API_CALL
+extern CL_API_ENTRY void *CL_API_CALL
 clSVMAlloc(cl_context       context,
            cl_svm_mem_flags flags,
            size_t           size,
@@ -1200,7 +1200,7 @@ clSVMAlloc(cl_context       context,
 
 extern CL_API_ENTRY void CL_API_CALL
 clSVMFree(cl_context        context,
-          void *            svm_pointer) CL_API_SUFFIX__VERSION_2_0;
+          void             *svm_pointer) CL_API_SUFFIX__VERSION_2_0;
 
 #endif
 
@@ -1210,8 +1210,8 @@ clSVMFree(cl_context        context,
 
 extern CL_API_ENTRY cl_sampler CL_API_CALL
 clCreateSamplerWithProperties(cl_context                     context,
-                              const cl_sampler_properties *  sampler_properties,
-                              cl_int *                       errcode_ret) CL_API_SUFFIX__VERSION_2_0;
+                              const cl_sampler_properties   *sampler_properties,
+                              cl_int                        *errcode_ret) CL_API_SUFFIX__VERSION_2_0;
 
 #endif
 
@@ -1225,34 +1225,34 @@ extern CL_API_ENTRY cl_int CL_API_CALL
 clGetSamplerInfo(cl_sampler         sampler,
                  cl_sampler_info    param_name,
                  size_t             param_value_size,
-                 void *             param_value,
-                 size_t *           param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+                 void              *param_value,
+                 size_t            *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
 
 /* Program Object APIs */
 extern CL_API_ENTRY cl_program CL_API_CALL
 clCreateProgramWithSource(cl_context        context,
                           cl_uint           count,
-                          const char **     strings,
-                          const size_t *    lengths,
-                          cl_int *          errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+                          const char      **strings,
+                          const size_t     *lengths,
+                          cl_int           *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_program CL_API_CALL
 clCreateProgramWithBinary(cl_context                     context,
                           cl_uint                        num_devices,
-                          const cl_device_id *           device_list,
-                          const size_t *                 lengths,
-                          const unsigned char **         binaries,
-                          cl_int *                       binary_status,
-                          cl_int *                       errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+                          const cl_device_id            *device_list,
+                          const size_t                  *lengths,
+                          const unsigned char          **binaries,
+                          cl_int                        *binary_status,
+                          cl_int                        *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef CL_VERSION_1_2
 
 extern CL_API_ENTRY cl_program CL_API_CALL
 clCreateProgramWithBuiltInKernels(cl_context            context,
                                   cl_uint               num_devices,
-                                  const cl_device_id *  device_list,
-                                  const char *          kernel_names,
-                                  cl_int *              errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+                                  const cl_device_id   *device_list,
+                                  const char           *kernel_names,
+                                  cl_int               *errcode_ret) CL_API_SUFFIX__VERSION_1_2;
 
 #endif
 
@@ -1260,9 +1260,9 @@ clCreateProgramWithBuiltInKernels(cl_context            context,
 
 extern CL_API_ENTRY cl_program CL_API_CALL
 clCreateProgramWithIL(cl_context    context,
-                     const void*    il,
-                     size_t         length,
-                     cl_int*        errcode_ret) CL_API_SUFFIX__VERSION_2_1;
+                      const void    *il,
+                      size_t         length,
+                      cl_int        *errcode_ret) CL_API_SUFFIX__VERSION_2_1;
 
 #endif
 
@@ -1275,37 +1275,37 @@ clReleaseProgram(cl_program program) CL_API_SUFFIX__VERSION_1_0;
 extern CL_API_ENTRY cl_int CL_API_CALL
 clBuildProgram(cl_program           program,
                cl_uint              num_devices,
-               const cl_device_id * device_list,
-               const char *         options,
-               void (CL_CALLBACK *  pfn_notify)(cl_program program,
-                                                void * user_data),
-               void *               user_data) CL_API_SUFFIX__VERSION_1_0;
+               const cl_device_id *device_list,
+               const char          *options,
+               void (CL_CALLBACK   *pfn_notify)(cl_program program,
+                                                void *user_data),
+               void                *user_data) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef CL_VERSION_1_2
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clCompileProgram(cl_program           program,
                  cl_uint              num_devices,
-                 const cl_device_id * device_list,
-                 const char *         options,
+                 const cl_device_id *device_list,
+                 const char          *options,
                  cl_uint              num_input_headers,
-                 const cl_program *   input_headers,
-                 const char **        header_include_names,
-                 void (CL_CALLBACK *  pfn_notify)(cl_program program,
-                                                  void * user_data),
-                 void *               user_data) CL_API_SUFFIX__VERSION_1_2;
+                 const cl_program    *input_headers,
+                 const char         **header_include_names,
+                 void (CL_CALLBACK   *pfn_notify)(cl_program program,
+                                                  void *user_data),
+                 void                *user_data) CL_API_SUFFIX__VERSION_1_2;
 
 extern CL_API_ENTRY cl_program CL_API_CALL
 clLinkProgram(cl_context           context,
               cl_uint              num_devices,
-              const cl_device_id * device_list,
-              const char *         options,
+              const cl_device_id *device_list,
+              const char          *options,
               cl_uint              num_input_programs,
-              const cl_program *   input_programs,
-              void (CL_CALLBACK *  pfn_notify)(cl_program program,
-                                               void * user_data),
-              void *               user_data,
-              cl_int *             errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+              const cl_program    *input_programs,
+              void (CL_CALLBACK   *pfn_notify)(cl_program program,
+                                               void *user_data),
+              void                *user_data,
+              cl_int              *errcode_ret) CL_API_SUFFIX__VERSION_1_2;
 
 #endif
 
@@ -1313,15 +1313,15 @@ clLinkProgram(cl_context           context,
 
 extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_2_2_DEPRECATED cl_int CL_API_CALL
 clSetProgramReleaseCallback(cl_program          program,
-                            void (CL_CALLBACK * pfn_notify)(cl_program program,
-                                                            void * user_data),
-                            void *              user_data) CL_EXT_SUFFIX__VERSION_2_2_DEPRECATED;
+                            void (CL_CALLBACK *pfn_notify)(cl_program program,
+                                                           void *user_data),
+                            void               *user_data) CL_EXT_SUFFIX__VERSION_2_2_DEPRECATED;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clSetProgramSpecializationConstant(cl_program  program,
                                    cl_uint     spec_id,
                                    size_t      spec_size,
-                                   const void* spec_value) CL_API_SUFFIX__VERSION_2_2;
+                                   const void *spec_value) CL_API_SUFFIX__VERSION_2_2;
 
 #endif
 
@@ -1336,34 +1336,34 @@ extern CL_API_ENTRY cl_int CL_API_CALL
 clGetProgramInfo(cl_program         program,
                  cl_program_info    param_name,
                  size_t             param_value_size,
-                 void *             param_value,
-                 size_t *           param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+                 void              *param_value,
+                 size_t            *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clGetProgramBuildInfo(cl_program            program,
                       cl_device_id          device,
                       cl_program_build_info param_name,
                       size_t                param_value_size,
-                      void *                param_value,
-                      size_t *              param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+                      void                 *param_value,
+                      size_t               *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
 
 /* Kernel Object APIs */
 extern CL_API_ENTRY cl_kernel CL_API_CALL
 clCreateKernel(cl_program      program,
-               const char *    kernel_name,
-               cl_int *        errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+               const char     *kernel_name,
+               cl_int         *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clCreateKernelsInProgram(cl_program     program,
                          cl_uint        num_kernels,
-                         cl_kernel *    kernels,
-                         cl_uint *      num_kernels_ret) CL_API_SUFFIX__VERSION_1_0;
+                         cl_kernel     *kernels,
+                         cl_uint       *num_kernels_ret) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef CL_VERSION_2_1
 
 extern CL_API_ENTRY cl_kernel CL_API_CALL
 clCloneKernel(cl_kernel     source_kernel,
-              cl_int*       errcode_ret) CL_API_SUFFIX__VERSION_2_1;
+              cl_int       *errcode_ret) CL_API_SUFFIX__VERSION_2_1;
 
 #endif
 
@@ -1377,20 +1377,20 @@ extern CL_API_ENTRY cl_int CL_API_CALL
 clSetKernelArg(cl_kernel    kernel,
                cl_uint      arg_index,
                size_t       arg_size,
-               const void * arg_value) CL_API_SUFFIX__VERSION_1_0;
+               const void *arg_value) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef CL_VERSION_2_0
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clSetKernelArgSVMPointer(cl_kernel    kernel,
                          cl_uint      arg_index,
-                         const void * arg_value) CL_API_SUFFIX__VERSION_2_0;
+                         const void *arg_value) CL_API_SUFFIX__VERSION_2_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clSetKernelExecInfo(cl_kernel            kernel,
                     cl_kernel_exec_info  param_name,
                     size_t               param_value_size,
-                    const void *         param_value) CL_API_SUFFIX__VERSION_2_0;
+                    const void          *param_value) CL_API_SUFFIX__VERSION_2_0;
 
 #endif
 
@@ -1398,8 +1398,8 @@ extern CL_API_ENTRY cl_int CL_API_CALL
 clGetKernelInfo(cl_kernel       kernel,
                 cl_kernel_info  param_name,
                 size_t          param_value_size,
-                void *          param_value,
-                size_t *        param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+                void           *param_value,
+                size_t         *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef CL_VERSION_1_2
 
@@ -1408,8 +1408,8 @@ clGetKernelArgInfo(cl_kernel       kernel,
                    cl_uint         arg_indx,
                    cl_kernel_arg_info  param_name,
                    size_t          param_value_size,
-                   void *          param_value,
-                   size_t *        param_value_size_ret) CL_API_SUFFIX__VERSION_1_2;
+                   void           *param_value,
+                   size_t         *param_value_size_ret) CL_API_SUFFIX__VERSION_1_2;
 
 #endif
 
@@ -1418,8 +1418,8 @@ clGetKernelWorkGroupInfo(cl_kernel                  kernel,
                          cl_device_id               device,
                          cl_kernel_work_group_info  param_name,
                          size_t                     param_value_size,
-                         void *                     param_value,
-                         size_t *                   param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+                         void                      *param_value,
+                         size_t                    *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef CL_VERSION_2_1
 
@@ -1428,30 +1428,30 @@ clGetKernelSubGroupInfo(cl_kernel                   kernel,
                         cl_device_id                device,
                         cl_kernel_sub_group_info    param_name,
                         size_t                      input_value_size,
-                        const void*                 input_value,
+                        const void                 *input_value,
                         size_t                      param_value_size,
-                        void*                       param_value,
-                        size_t*                     param_value_size_ret) CL_API_SUFFIX__VERSION_2_1;
+                        void                       *param_value,
+                        size_t                     *param_value_size_ret) CL_API_SUFFIX__VERSION_2_1;
 
 #endif
 
 /* Event Object APIs */
 extern CL_API_ENTRY cl_int CL_API_CALL
 clWaitForEvents(cl_uint             num_events,
-                const cl_event *    event_list) CL_API_SUFFIX__VERSION_1_0;
+                const cl_event     *event_list) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clGetEventInfo(cl_event         event,
                cl_event_info    param_name,
                size_t           param_value_size,
-               void *           param_value,
-               size_t *         param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+               void            *param_value,
+               size_t          *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef CL_VERSION_1_1
 
 extern CL_API_ENTRY cl_event CL_API_CALL
 clCreateUserEvent(cl_context    context,
-                  cl_int *      errcode_ret) CL_API_SUFFIX__VERSION_1_1;
+                  cl_int       *errcode_ret) CL_API_SUFFIX__VERSION_1_1;
 
 #endif
 
@@ -1470,10 +1470,10 @@ clSetUserEventStatus(cl_event   event,
 extern CL_API_ENTRY cl_int CL_API_CALL
 clSetEventCallback(cl_event    event,
                    cl_int      command_exec_callback_type,
-                   void (CL_CALLBACK * pfn_notify)(cl_event event,
-                                                   cl_int   event_command_status,
-                                                   void *   user_data),
-                   void *      user_data) CL_API_SUFFIX__VERSION_1_1;
+                   void (CL_CALLBACK *pfn_notify)(cl_event event,
+                                                  cl_int   event_command_status,
+                                                  void    *user_data),
+                   void       *user_data) CL_API_SUFFIX__VERSION_1_1;
 
 #endif
 
@@ -1482,8 +1482,8 @@ extern CL_API_ENTRY cl_int CL_API_CALL
 clGetEventProfilingInfo(cl_event            event,
                         cl_profiling_info   param_name,
                         size_t              param_value_size,
-                        void *              param_value,
-                        size_t *            param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+                        void               *param_value,
+                        size_t             *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
 
 /* Flush and Finish APIs */
 extern CL_API_ENTRY cl_int CL_API_CALL
@@ -1499,10 +1499,10 @@ clEnqueueReadBuffer(cl_command_queue    command_queue,
                     cl_bool             blocking_read,
                     size_t              offset,
                     size_t              size,
-                    void *              ptr,
+                    void               *ptr,
                     cl_uint             num_events_in_wait_list,
-                    const cl_event *    event_wait_list,
-                    cl_event *          event) CL_API_SUFFIX__VERSION_1_0;
+                    const cl_event     *event_wait_list,
+                    cl_event           *event) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef CL_VERSION_1_1
 
@@ -1510,17 +1510,17 @@ extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueReadBufferRect(cl_command_queue    command_queue,
                         cl_mem              buffer,
                         cl_bool             blocking_read,
-                        const size_t *      buffer_origin,
-                        const size_t *      host_origin,
-                        const size_t *      region,
+                        const size_t       *buffer_origin,
+                        const size_t       *host_origin,
+                        const size_t       *region,
                         size_t              buffer_row_pitch,
                         size_t              buffer_slice_pitch,
                         size_t              host_row_pitch,
                         size_t              host_slice_pitch,
-                        void *              ptr,
+                        void               *ptr,
                         cl_uint             num_events_in_wait_list,
-                        const cl_event *    event_wait_list,
-                        cl_event *          event) CL_API_SUFFIX__VERSION_1_1;
+                        const cl_event     *event_wait_list,
+                        cl_event           *event) CL_API_SUFFIX__VERSION_1_1;
 
 #endif
 
@@ -1530,10 +1530,10 @@ clEnqueueWriteBuffer(cl_command_queue   command_queue,
                      cl_bool            blocking_write,
                      size_t             offset,
                      size_t             size,
-                     const void *       ptr,
+                     const void        *ptr,
                      cl_uint            num_events_in_wait_list,
-                     const cl_event *   event_wait_list,
-                     cl_event *         event) CL_API_SUFFIX__VERSION_1_0;
+                     const cl_event    *event_wait_list,
+                     cl_event          *event) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef CL_VERSION_1_1
 
@@ -1541,17 +1541,17 @@ extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueWriteBufferRect(cl_command_queue    command_queue,
                          cl_mem              buffer,
                          cl_bool             blocking_write,
-                         const size_t *      buffer_origin,
-                         const size_t *      host_origin,
-                         const size_t *      region,
+                         const size_t       *buffer_origin,
+                         const size_t       *host_origin,
+                         const size_t       *region,
                          size_t              buffer_row_pitch,
                          size_t              buffer_slice_pitch,
                          size_t              host_row_pitch,
                          size_t              host_slice_pitch,
-                         const void *        ptr,
+                         const void         *ptr,
                          cl_uint             num_events_in_wait_list,
-                         const cl_event *    event_wait_list,
-                         cl_event *          event) CL_API_SUFFIX__VERSION_1_1;
+                         const cl_event     *event_wait_list,
+                         cl_event           *event) CL_API_SUFFIX__VERSION_1_1;
 
 #endif
 
@@ -1560,13 +1560,13 @@ clEnqueueWriteBufferRect(cl_command_queue    command_queue,
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueFillBuffer(cl_command_queue   command_queue,
                     cl_mem             buffer,
-                    const void *       pattern,
+                    const void        *pattern,
                     size_t             pattern_size,
                     size_t             offset,
                     size_t             size,
                     cl_uint            num_events_in_wait_list,
-                    const cl_event *   event_wait_list,
-                    cl_event *         event) CL_API_SUFFIX__VERSION_1_2;
+                    const cl_event    *event_wait_list,
+                    cl_event          *event) CL_API_SUFFIX__VERSION_1_2;
 
 #endif
 
@@ -1578,8 +1578,8 @@ clEnqueueCopyBuffer(cl_command_queue    command_queue,
                     size_t              dst_offset,
                     size_t              size,
                     cl_uint             num_events_in_wait_list,
-                    const cl_event *    event_wait_list,
-                    cl_event *          event) CL_API_SUFFIX__VERSION_1_0;
+                    const cl_event     *event_wait_list,
+                    cl_event           *event) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef CL_VERSION_1_1
 
@@ -1587,16 +1587,16 @@ extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueCopyBufferRect(cl_command_queue    command_queue,
                         cl_mem              src_buffer,
                         cl_mem              dst_buffer,
-                        const size_t *      src_origin,
-                        const size_t *      dst_origin,
-                        const size_t *      region,
+                        const size_t       *src_origin,
+                        const size_t       *dst_origin,
+                        const size_t       *region,
                         size_t              src_row_pitch,
                         size_t              src_slice_pitch,
                         size_t              dst_row_pitch,
                         size_t              dst_slice_pitch,
                         cl_uint             num_events_in_wait_list,
-                        const cl_event *    event_wait_list,
-                        cl_event *          event) CL_API_SUFFIX__VERSION_1_1;
+                        const cl_event     *event_wait_list,
+                        cl_event           *event) CL_API_SUFFIX__VERSION_1_1;
 
 #endif
 
@@ -1604,39 +1604,39 @@ extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueReadImage(cl_command_queue     command_queue,
                    cl_mem               image,
                    cl_bool              blocking_read,
-                   const size_t *       origin,
-                   const size_t *       region,
+                   const size_t        *origin,
+                   const size_t        *region,
                    size_t               row_pitch,
                    size_t               slice_pitch,
-                   void *               ptr,
+                   void                *ptr,
                    cl_uint              num_events_in_wait_list,
-                   const cl_event *     event_wait_list,
-                   cl_event *           event) CL_API_SUFFIX__VERSION_1_0;
+                   const cl_event      *event_wait_list,
+                   cl_event            *event) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueWriteImage(cl_command_queue    command_queue,
                     cl_mem              image,
                     cl_bool             blocking_write,
-                    const size_t *      origin,
-                    const size_t *      region,
+                    const size_t       *origin,
+                    const size_t       *region,
                     size_t              input_row_pitch,
                     size_t              input_slice_pitch,
-                    const void *        ptr,
+                    const void         *ptr,
                     cl_uint             num_events_in_wait_list,
-                    const cl_event *    event_wait_list,
-                    cl_event *          event) CL_API_SUFFIX__VERSION_1_0;
+                    const cl_event     *event_wait_list,
+                    cl_event           *event) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef CL_VERSION_1_2
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueFillImage(cl_command_queue   command_queue,
                    cl_mem             image,
-                   const void *       fill_color,
-                   const size_t *     origin,
-                   const size_t *     region,
+                   const void        *fill_color,
+                   const size_t      *origin,
+                   const size_t      *region,
                    cl_uint            num_events_in_wait_list,
-                   const cl_event *   event_wait_list,
-                   cl_event *         event) CL_API_SUFFIX__VERSION_1_2;
+                   const cl_event    *event_wait_list,
+                   cl_event          *event) CL_API_SUFFIX__VERSION_1_2;
 
 #endif
 
@@ -1644,36 +1644,36 @@ extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueCopyImage(cl_command_queue     command_queue,
                    cl_mem               src_image,
                    cl_mem               dst_image,
-                   const size_t *       src_origin,
-                   const size_t *       dst_origin,
-                   const size_t *       region,
+                   const size_t        *src_origin,
+                   const size_t        *dst_origin,
+                   const size_t        *region,
                    cl_uint              num_events_in_wait_list,
-                   const cl_event *     event_wait_list,
-                   cl_event *           event) CL_API_SUFFIX__VERSION_1_0;
+                   const cl_event      *event_wait_list,
+                   cl_event            *event) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueCopyImageToBuffer(cl_command_queue command_queue,
                            cl_mem           src_image,
                            cl_mem           dst_buffer,
-                           const size_t *   src_origin,
-                           const size_t *   region,
+                           const size_t    *src_origin,
+                           const size_t    *region,
                            size_t           dst_offset,
                            cl_uint          num_events_in_wait_list,
-                           const cl_event * event_wait_list,
-                           cl_event *       event) CL_API_SUFFIX__VERSION_1_0;
+                           const cl_event *event_wait_list,
+                           cl_event        *event) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueCopyBufferToImage(cl_command_queue command_queue,
                            cl_mem           src_buffer,
                            cl_mem           dst_image,
                            size_t           src_offset,
-                           const size_t *   dst_origin,
-                           const size_t *   region,
+                           const size_t    *dst_origin,
+                           const size_t    *region,
                            cl_uint          num_events_in_wait_list,
-                           const cl_event * event_wait_list,
-                           cl_event *       event) CL_API_SUFFIX__VERSION_1_0;
+                           const cl_event *event_wait_list,
+                           cl_event        *event) CL_API_SUFFIX__VERSION_1_0;
 
-extern CL_API_ENTRY void * CL_API_CALL
+extern CL_API_ENTRY void *CL_API_CALL
 clEnqueueMapBuffer(cl_command_queue command_queue,
                    cl_mem           buffer,
                    cl_bool          blocking_map,
@@ -1681,42 +1681,42 @@ clEnqueueMapBuffer(cl_command_queue command_queue,
                    size_t           offset,
                    size_t           size,
                    cl_uint          num_events_in_wait_list,
-                   const cl_event * event_wait_list,
-                   cl_event *       event,
-                   cl_int *         errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+                   const cl_event *event_wait_list,
+                   cl_event        *event,
+                   cl_int          *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
 
-extern CL_API_ENTRY void * CL_API_CALL
+extern CL_API_ENTRY void *CL_API_CALL
 clEnqueueMapImage(cl_command_queue  command_queue,
                   cl_mem            image,
                   cl_bool           blocking_map,
                   cl_map_flags      map_flags,
-                  const size_t *    origin,
-                  const size_t *    region,
-                  size_t *          image_row_pitch,
-                  size_t *          image_slice_pitch,
+                  const size_t     *origin,
+                  const size_t     *region,
+                  size_t           *image_row_pitch,
+                  size_t           *image_slice_pitch,
                   cl_uint           num_events_in_wait_list,
-                  const cl_event *  event_wait_list,
-                  cl_event *        event,
-                  cl_int *          errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+                  const cl_event   *event_wait_list,
+                  cl_event         *event,
+                  cl_int           *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueUnmapMemObject(cl_command_queue command_queue,
                         cl_mem           memobj,
-                        void *           mapped_ptr,
+                        void            *mapped_ptr,
                         cl_uint          num_events_in_wait_list,
-                        const cl_event * event_wait_list,
-                        cl_event *       event) CL_API_SUFFIX__VERSION_1_0;
+                        const cl_event *event_wait_list,
+                        cl_event        *event) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef CL_VERSION_1_2
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueMigrateMemObjects(cl_command_queue       command_queue,
                            cl_uint                num_mem_objects,
-                           const cl_mem *         mem_objects,
+                           const cl_mem          *mem_objects,
                            cl_mem_migration_flags flags,
                            cl_uint                num_events_in_wait_list,
-                           const cl_event *       event_wait_list,
-                           cl_event *             event) CL_API_SUFFIX__VERSION_1_2;
+                           const cl_event        *event_wait_list,
+                           cl_event              *event) CL_API_SUFFIX__VERSION_1_2;
 
 #endif
 
@@ -1724,38 +1724,38 @@ extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueNDRangeKernel(cl_command_queue command_queue,
                        cl_kernel        kernel,
                        cl_uint          work_dim,
-                       const size_t *   global_work_offset,
-                       const size_t *   global_work_size,
-                       const size_t *   local_work_size,
+                       const size_t    *global_work_offset,
+                       const size_t    *global_work_size,
+                       const size_t    *local_work_size,
                        cl_uint          num_events_in_wait_list,
-                       const cl_event * event_wait_list,
-                       cl_event *       event) CL_API_SUFFIX__VERSION_1_0;
+                       const cl_event *event_wait_list,
+                       cl_event        *event) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueNativeKernel(cl_command_queue  command_queue,
-                      void (CL_CALLBACK * user_func)(void *),
-                      void *            args,
+                      void (CL_CALLBACK *user_func)(void *),
+                      void             *args,
                       size_t            cb_args,
                       cl_uint           num_mem_objects,
-                      const cl_mem *    mem_list,
-                      const void **     args_mem_loc,
+                      const cl_mem     *mem_list,
+                      const void      **args_mem_loc,
                       cl_uint           num_events_in_wait_list,
-                      const cl_event *  event_wait_list,
-                      cl_event *        event) CL_API_SUFFIX__VERSION_1_0;
+                      const cl_event   *event_wait_list,
+                      cl_event         *event) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef CL_VERSION_1_2
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueMarkerWithWaitList(cl_command_queue  command_queue,
                             cl_uint           num_events_in_wait_list,
-                            const cl_event *  event_wait_list,
-                            cl_event *        event) CL_API_SUFFIX__VERSION_1_2;
+                            const cl_event   *event_wait_list,
+                            cl_event         *event) CL_API_SUFFIX__VERSION_1_2;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueBarrierWithWaitList(cl_command_queue  command_queue,
                              cl_uint           num_events_in_wait_list,
-                             const cl_event *  event_wait_list,
-                             cl_event *        event) CL_API_SUFFIX__VERSION_1_2;
+                             const cl_event   *event_wait_list,
+                             cl_event         *event) CL_API_SUFFIX__VERSION_1_2;
 
 #endif
 
@@ -1764,52 +1764,52 @@ clEnqueueBarrierWithWaitList(cl_command_queue  command_queue,
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueSVMFree(cl_command_queue  command_queue,
                  cl_uint           num_svm_pointers,
-                 void *            svm_pointers[],
-                 void (CL_CALLBACK * pfn_free_func)(cl_command_queue queue,
-                                                    cl_uint          num_svm_pointers,
-                                                    void *           svm_pointers[],
-                                                    void *           user_data),
-                 void *            user_data,
+                 void             *svm_pointers[],
+                 void (CL_CALLBACK *pfn_free_func)(cl_command_queue queue,
+                                                   cl_uint          num_svm_pointers,
+                                                   void            *svm_pointers[],
+                                                   void            *user_data),
+                 void             *user_data,
                  cl_uint           num_events_in_wait_list,
-                 const cl_event *  event_wait_list,
-                 cl_event *        event) CL_API_SUFFIX__VERSION_2_0;
+                 const cl_event   *event_wait_list,
+                 cl_event         *event) CL_API_SUFFIX__VERSION_2_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueSVMMemcpy(cl_command_queue  command_queue,
                    cl_bool           blocking_copy,
-                   void *            dst_ptr,
-                   const void *      src_ptr,
+                   void             *dst_ptr,
+                   const void       *src_ptr,
                    size_t            size,
                    cl_uint           num_events_in_wait_list,
-                   const cl_event *  event_wait_list,
-                   cl_event *        event) CL_API_SUFFIX__VERSION_2_0;
+                   const cl_event   *event_wait_list,
+                   cl_event         *event) CL_API_SUFFIX__VERSION_2_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueSVMMemFill(cl_command_queue  command_queue,
-                    void *            svm_ptr,
-                    const void *      pattern,
+                    void             *svm_ptr,
+                    const void       *pattern,
                     size_t            pattern_size,
                     size_t            size,
                     cl_uint           num_events_in_wait_list,
-                    const cl_event *  event_wait_list,
-                    cl_event *        event) CL_API_SUFFIX__VERSION_2_0;
+                    const cl_event   *event_wait_list,
+                    cl_event         *event) CL_API_SUFFIX__VERSION_2_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueSVMMap(cl_command_queue  command_queue,
                 cl_bool           blocking_map,
                 cl_map_flags      flags,
-                void *            svm_ptr,
+                void             *svm_ptr,
                 size_t            size,
                 cl_uint           num_events_in_wait_list,
-                const cl_event *  event_wait_list,
-                cl_event *        event) CL_API_SUFFIX__VERSION_2_0;
+                const cl_event   *event_wait_list,
+                cl_event         *event) CL_API_SUFFIX__VERSION_2_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueSVMUnmap(cl_command_queue  command_queue,
-                  void *            svm_ptr,
+                  void             *svm_ptr,
                   cl_uint           num_events_in_wait_list,
-                  const cl_event *  event_wait_list,
-                  cl_event *        event) CL_API_SUFFIX__VERSION_2_0;
+                  const cl_event   *event_wait_list,
+                  cl_event         *event) CL_API_SUFFIX__VERSION_2_0;
 
 #endif
 
@@ -1818,12 +1818,12 @@ clEnqueueSVMUnmap(cl_command_queue  command_queue,
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueSVMMigrateMem(cl_command_queue         command_queue,
                        cl_uint                  num_svm_pointers,
-                       const void **            svm_pointers,
-                       const size_t *           sizes,
+                       const void             **svm_pointers,
+                       const size_t            *sizes,
                        cl_mem_migration_flags   flags,
                        cl_uint                  num_events_in_wait_list,
-                       const cl_event *         event_wait_list,
-                       cl_event *               event) CL_API_SUFFIX__VERSION_2_1;
+                       const cl_event          *event_wait_list,
+                       cl_event                *event) CL_API_SUFFIX__VERSION_2_1;
 
 #endif
 
@@ -1836,61 +1836,61 @@ clEnqueueSVMMigrateMem(cl_command_queue         command_queue,
  * check to make sure the address is not NULL, before using or
  * calling the returned function address.
  */
-extern CL_API_ENTRY void * CL_API_CALL
+extern CL_API_ENTRY void *CL_API_CALL
 clGetExtensionFunctionAddressForPlatform(cl_platform_id platform,
-                                         const char *   func_name) CL_API_SUFFIX__VERSION_1_2;
+                                         const char    *func_name) CL_API_SUFFIX__VERSION_1_2;
 
 #endif
 
 #ifdef CL_USE_DEPRECATED_OPENCL_1_0_APIS
-    /*
-     *  WARNING:
-     *     This API introduces mutable state into the OpenCL implementation. It has been REMOVED
-     *  to better facilitate thread safety.  The 1.0 API is not thread safe. It is not tested by the
-     *  OpenCL 1.1 conformance test, and consequently may not work or may not work dependably.
-     *  It is likely to be non-performant. Use of this API is not advised. Use at your own risk.
-     *
-     *  Software developers previously relying on this API are instructed to set the command queue
-     *  properties when creating the queue, instead.
-     */
-    extern CL_API_ENTRY cl_int CL_API_CALL
-    clSetCommandQueueProperty(cl_command_queue              command_queue,
-                              cl_command_queue_properties   properties,
-                              cl_bool                       enable,
-                              cl_command_queue_properties * old_properties) CL_EXT_SUFFIX__VERSION_1_0_DEPRECATED;
+/*
+ *  WARNING:
+ *     This API introduces mutable state into the OpenCL implementation. It has been REMOVED
+ *  to better facilitate thread safety.  The 1.0 API is not thread safe. It is not tested by the
+ *  OpenCL 1.1 conformance test, and consequently may not work or may not work dependably.
+ *  It is likely to be non-performant. Use of this API is not advised. Use at your own risk.
+ *
+ *  Software developers previously relying on this API are instructed to set the command queue
+ *  properties when creating the queue, instead.
+ */
+extern CL_API_ENTRY cl_int CL_API_CALL
+clSetCommandQueueProperty(cl_command_queue              command_queue,
+                          cl_command_queue_properties   properties,
+                          cl_bool                       enable,
+                          cl_command_queue_properties *old_properties) CL_EXT_SUFFIX__VERSION_1_0_DEPRECATED;
 #endif /* CL_USE_DEPRECATED_OPENCL_1_0_APIS */
 
 /* Deprecated OpenCL 1.1 APIs */
 extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_1_DEPRECATED cl_mem CL_API_CALL
 clCreateImage2D(cl_context              context,
                 cl_mem_flags            flags,
-                const cl_image_format * image_format,
+                const cl_image_format *image_format,
                 size_t                  image_width,
                 size_t                  image_height,
                 size_t                  image_row_pitch,
-                void *                  host_ptr,
-                cl_int *                errcode_ret) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+                void                   *host_ptr,
+                cl_int                 *errcode_ret) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
 
 extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_1_DEPRECATED cl_mem CL_API_CALL
 clCreateImage3D(cl_context              context,
                 cl_mem_flags            flags,
-                const cl_image_format * image_format,
+                const cl_image_format *image_format,
                 size_t                  image_width,
                 size_t                  image_height,
                 size_t                  image_depth,
                 size_t                  image_row_pitch,
                 size_t                  image_slice_pitch,
-                void *                  host_ptr,
-                cl_int *                errcode_ret) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+                void                   *host_ptr,
+                cl_int                 *errcode_ret) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
 
 extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_1_DEPRECATED cl_int CL_API_CALL
 clEnqueueMarker(cl_command_queue    command_queue,
-                cl_event *          event) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+                cl_event           *event) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
 
 extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_1_DEPRECATED cl_int CL_API_CALL
 clEnqueueWaitForEvents(cl_command_queue  command_queue,
-                        cl_uint          num_events,
-                        const cl_event * event_list) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+                       cl_uint          num_events,
+                       const cl_event *event_list) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
 
 extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_1_DEPRECATED cl_int CL_API_CALL
 clEnqueueBarrier(cl_command_queue command_queue) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
@@ -1898,29 +1898,29 @@ clEnqueueBarrier(cl_command_queue command_queue) CL_EXT_SUFFIX__VERSION_1_1_DEPR
 extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_1_DEPRECATED cl_int CL_API_CALL
 clUnloadCompiler(void) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
 
-extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_1_DEPRECATED void * CL_API_CALL
-clGetExtensionFunctionAddress(const char * func_name) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_1_DEPRECATED void *CL_API_CALL
+clGetExtensionFunctionAddress(const char *func_name) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
 
 /* Deprecated OpenCL 2.0 APIs */
 extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_2_DEPRECATED cl_command_queue CL_API_CALL
 clCreateCommandQueue(cl_context                     context,
                      cl_device_id                   device,
                      cl_command_queue_properties    properties,
-                     cl_int *                       errcode_ret) CL_EXT_SUFFIX__VERSION_1_2_DEPRECATED;
+                     cl_int                        *errcode_ret) CL_EXT_SUFFIX__VERSION_1_2_DEPRECATED;
 
 extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_2_DEPRECATED cl_sampler CL_API_CALL
 clCreateSampler(cl_context          context,
                 cl_bool             normalized_coords,
                 cl_addressing_mode  addressing_mode,
                 cl_filter_mode      filter_mode,
-                cl_int *            errcode_ret) CL_EXT_SUFFIX__VERSION_1_2_DEPRECATED;
+                cl_int             *errcode_ret) CL_EXT_SUFFIX__VERSION_1_2_DEPRECATED;
 
 extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_2_DEPRECATED cl_int CL_API_CALL
 clEnqueueTask(cl_command_queue  command_queue,
               cl_kernel         kernel,
               cl_uint           num_events_in_wait_list,
-              const cl_event *  event_wait_list,
-              cl_event *        event) CL_EXT_SUFFIX__VERSION_1_2_DEPRECATED;
+              const cl_event   *event_wait_list,
+              cl_event         *event) CL_EXT_SUFFIX__VERSION_1_2_DEPRECATED;
 
 #ifdef __cplusplus
 }
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_d3d10.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_d3d10.h
index 2b80d90cb..c355e4b42 100644
--- a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_d3d10.h
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_d3d10.h
@@ -75,50 +75,50 @@ typedef cl_uint cl_d3d10_device_set_khr;
 
 /******************************************************************************/
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clGetDeviceIDsFromD3D10KHR_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clGetDeviceIDsFromD3D10KHR_fn)(
     cl_platform_id             platform,
     cl_d3d10_device_source_khr d3d_device_source,
-    void *                     d3d_object,
+    void                      *d3d_object,
     cl_d3d10_device_set_khr    d3d_device_set,
     cl_uint                    num_entries,
-    cl_device_id *             devices,
-    cl_uint *                  num_devices) CL_API_SUFFIX__VERSION_1_0;
+    cl_device_id              *devices,
+    cl_uint                   *num_devices) CL_API_SUFFIX__VERSION_1_0;
 
-typedef CL_API_ENTRY cl_mem (CL_API_CALL *clCreateFromD3D10BufferKHR_fn)(
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *clCreateFromD3D10BufferKHR_fn)(
     cl_context     context,
     cl_mem_flags   flags,
-    ID3D10Buffer * resource,
-    cl_int *       errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+    ID3D10Buffer *resource,
+    cl_int        *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
 
-typedef CL_API_ENTRY cl_mem (CL_API_CALL *clCreateFromD3D10Texture2DKHR_fn)(
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *clCreateFromD3D10Texture2DKHR_fn)(
     cl_context        context,
     cl_mem_flags      flags,
-    ID3D10Texture2D * resource,
+    ID3D10Texture2D *resource,
     UINT              subresource,
-    cl_int *          errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+    cl_int           *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
 
-typedef CL_API_ENTRY cl_mem (CL_API_CALL *clCreateFromD3D10Texture3DKHR_fn)(
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *clCreateFromD3D10Texture3DKHR_fn)(
     cl_context        context,
     cl_mem_flags      flags,
-    ID3D10Texture3D * resource,
+    ID3D10Texture3D *resource,
     UINT              subresource,
-    cl_int *          errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+    cl_int           *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueAcquireD3D10ObjectsKHR_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clEnqueueAcquireD3D10ObjectsKHR_fn)(
     cl_command_queue command_queue,
     cl_uint          num_objects,
-    const cl_mem *   mem_objects,
+    const cl_mem    *mem_objects,
     cl_uint          num_events_in_wait_list,
-    const cl_event * event_wait_list,
-    cl_event *       event) CL_API_SUFFIX__VERSION_1_0;
+    const cl_event *event_wait_list,
+    cl_event        *event) CL_API_SUFFIX__VERSION_1_0;
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueReleaseD3D10ObjectsKHR_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clEnqueueReleaseD3D10ObjectsKHR_fn)(
     cl_command_queue command_queue,
     cl_uint          num_objects,
-    const cl_mem *   mem_objects,
+    const cl_mem    *mem_objects,
     cl_uint          num_events_in_wait_list,
-    const cl_event * event_wait_list,
-    cl_event *       event) CL_API_SUFFIX__VERSION_1_0;
+    const cl_event *event_wait_list,
+    cl_event        *event) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef __cplusplus
 }
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_d3d11.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_d3d11.h
index 10023dde0..f9aac7180 100644
--- a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_d3d11.h
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_d3d11.h
@@ -75,50 +75,50 @@ typedef cl_uint cl_d3d11_device_set_khr;
 
 /******************************************************************************/
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clGetDeviceIDsFromD3D11KHR_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clGetDeviceIDsFromD3D11KHR_fn)(
     cl_platform_id             platform,
     cl_d3d11_device_source_khr d3d_device_source,
-    void *                     d3d_object,
+    void                      *d3d_object,
     cl_d3d11_device_set_khr    d3d_device_set,
     cl_uint                    num_entries,
-    cl_device_id *             devices,
-    cl_uint *                  num_devices) CL_API_SUFFIX__VERSION_1_2;
+    cl_device_id              *devices,
+    cl_uint                   *num_devices) CL_API_SUFFIX__VERSION_1_2;
 
-typedef CL_API_ENTRY cl_mem (CL_API_CALL *clCreateFromD3D11BufferKHR_fn)(
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *clCreateFromD3D11BufferKHR_fn)(
     cl_context     context,
     cl_mem_flags   flags,
-    ID3D11Buffer * resource,
-    cl_int *       errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+    ID3D11Buffer *resource,
+    cl_int        *errcode_ret) CL_API_SUFFIX__VERSION_1_2;
 
-typedef CL_API_ENTRY cl_mem (CL_API_CALL *clCreateFromD3D11Texture2DKHR_fn)(
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *clCreateFromD3D11Texture2DKHR_fn)(
     cl_context        context,
     cl_mem_flags      flags,
-    ID3D11Texture2D * resource,
+    ID3D11Texture2D *resource,
     UINT              subresource,
-    cl_int *          errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+    cl_int           *errcode_ret) CL_API_SUFFIX__VERSION_1_2;
 
-typedef CL_API_ENTRY cl_mem (CL_API_CALL *clCreateFromD3D11Texture3DKHR_fn)(
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *clCreateFromD3D11Texture3DKHR_fn)(
     cl_context        context,
     cl_mem_flags      flags,
-    ID3D11Texture3D * resource,
+    ID3D11Texture3D *resource,
     UINT              subresource,
-    cl_int *          errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+    cl_int           *errcode_ret) CL_API_SUFFIX__VERSION_1_2;
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueAcquireD3D11ObjectsKHR_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clEnqueueAcquireD3D11ObjectsKHR_fn)(
     cl_command_queue command_queue,
     cl_uint          num_objects,
-    const cl_mem *   mem_objects,
+    const cl_mem    *mem_objects,
     cl_uint          num_events_in_wait_list,
-    const cl_event * event_wait_list,
-    cl_event *       event) CL_API_SUFFIX__VERSION_1_2;
+    const cl_event *event_wait_list,
+    cl_event        *event) CL_API_SUFFIX__VERSION_1_2;
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueReleaseD3D11ObjectsKHR_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clEnqueueReleaseD3D11ObjectsKHR_fn)(
     cl_command_queue command_queue,
     cl_uint          num_objects,
-    const cl_mem *   mem_objects,
+    const cl_mem    *mem_objects,
     cl_uint          num_events_in_wait_list,
-    const cl_event * event_wait_list,
-    cl_event *       event) CL_API_SUFFIX__VERSION_1_2;
+    const cl_event *event_wait_list,
+    cl_event        *event) CL_API_SUFFIX__VERSION_1_2;
 
 #ifdef __cplusplus
 }
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_dx9_media_sharing.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_dx9_media_sharing.h
index 048937005..162836d28 100644
--- a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_dx9_media_sharing.h
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_dx9_media_sharing.h
@@ -30,11 +30,10 @@ extern "C" {
 
 typedef cl_uint             cl_dx9_media_adapter_type_khr;
 typedef cl_uint             cl_dx9_media_adapter_set_khr;
-    
+
 #if defined(_WIN32)
 #include <d3d9.h>
-typedef struct _cl_dx9_surface_info_khr
-{
+typedef struct _cl_dx9_surface_info_khr {
     IDirect3DSurface9 *resource;
     HANDLE shared_handle;
 } cl_dx9_surface_info_khr;
@@ -76,39 +75,39 @@ typedef struct _cl_dx9_surface_info_khr
 
 /******************************************************************************/
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clGetDeviceIDsFromDX9MediaAdapterKHR_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clGetDeviceIDsFromDX9MediaAdapterKHR_fn)(
     cl_platform_id                   platform,
     cl_uint                          num_media_adapters,
-    cl_dx9_media_adapter_type_khr *  media_adapter_type,
-    void *                           media_adapters,
+    cl_dx9_media_adapter_type_khr   *media_adapter_type,
+    void                            *media_adapters,
     cl_dx9_media_adapter_set_khr     media_adapter_set,
     cl_uint                          num_entries,
-    cl_device_id *                   devices,
-    cl_uint *                        num_devices) CL_API_SUFFIX__VERSION_1_2;
+    cl_device_id                    *devices,
+    cl_uint                         *num_devices) CL_API_SUFFIX__VERSION_1_2;
 
-typedef CL_API_ENTRY cl_mem (CL_API_CALL *clCreateFromDX9MediaSurfaceKHR_fn)(
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *clCreateFromDX9MediaSurfaceKHR_fn)(
     cl_context                    context,
     cl_mem_flags                  flags,
     cl_dx9_media_adapter_type_khr adapter_type,
-    void *                        surface_info,
-    cl_uint                       plane,                                                                          
-    cl_int *                      errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+    void                         *surface_info,
+    cl_uint                       plane,
+    cl_int                       *errcode_ret) CL_API_SUFFIX__VERSION_1_2;
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueAcquireDX9MediaSurfacesKHR_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clEnqueueAcquireDX9MediaSurfacesKHR_fn)(
     cl_command_queue command_queue,
     cl_uint          num_objects,
-    const cl_mem *   mem_objects,
+    const cl_mem    *mem_objects,
     cl_uint          num_events_in_wait_list,
-    const cl_event * event_wait_list,
-    cl_event *       event) CL_API_SUFFIX__VERSION_1_2;
+    const cl_event *event_wait_list,
+    cl_event        *event) CL_API_SUFFIX__VERSION_1_2;
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueReleaseDX9MediaSurfacesKHR_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clEnqueueReleaseDX9MediaSurfacesKHR_fn)(
     cl_command_queue command_queue,
     cl_uint          num_objects,
-    const cl_mem *   mem_objects,
+    const cl_mem    *mem_objects,
     cl_uint          num_events_in_wait_list,
-    const cl_event * event_wait_list,
-    cl_event *       event) CL_API_SUFFIX__VERSION_1_2;
+    const cl_event *event_wait_list,
+    cl_event        *event) CL_API_SUFFIX__VERSION_1_2;
 
 #ifdef __cplusplus
 }
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_dx9_media_sharing_intel.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_dx9_media_sharing_intel.h
index 4525a175e..fb9994588 100644
--- a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_dx9_media_sharing_intel.h
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_dx9_media_sharing_intel.h
@@ -96,71 +96,71 @@ extern CL_API_ENTRY cl_int CL_API_CALL
 clGetDeviceIDsFromDX9INTEL(
     cl_platform_id              platform,
     cl_dx9_device_source_intel  dx9_device_source,
-    void*                       dx9_object,
+    void                       *dx9_object,
     cl_dx9_device_set_intel     dx9_device_set,
     cl_uint                     num_entries,
-    cl_device_id*               devices,
-    cl_uint*                    num_devices) CL_EXT_SUFFIX__VERSION_1_1;
+    cl_device_id               *devices,
+    cl_uint                    *num_devices) CL_EXT_SUFFIX__VERSION_1_1;
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL* clGetDeviceIDsFromDX9INTEL_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clGetDeviceIDsFromDX9INTEL_fn)(
     cl_platform_id              platform,
     cl_dx9_device_source_intel  dx9_device_source,
-    void*                       dx9_object,
+    void                       *dx9_object,
     cl_dx9_device_set_intel     dx9_device_set,
     cl_uint                     num_entries,
-    cl_device_id*               devices,
-    cl_uint*                    num_devices) CL_EXT_SUFFIX__VERSION_1_1;
+    cl_device_id               *devices,
+    cl_uint                    *num_devices) CL_EXT_SUFFIX__VERSION_1_1;
 
 extern CL_API_ENTRY cl_mem CL_API_CALL
 clCreateFromDX9MediaSurfaceINTEL(
     cl_context                  context,
     cl_mem_flags                flags,
-    IDirect3DSurface9*          resource,
+    IDirect3DSurface9          *resource,
     HANDLE                      sharedHandle,
     UINT                        plane,
-    cl_int*                     errcode_ret) CL_EXT_SUFFIX__VERSION_1_1;
+    cl_int                     *errcode_ret) CL_EXT_SUFFIX__VERSION_1_1;
 
-typedef CL_API_ENTRY cl_mem (CL_API_CALL *clCreateFromDX9MediaSurfaceINTEL_fn)(
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *clCreateFromDX9MediaSurfaceINTEL_fn)(
     cl_context                  context,
     cl_mem_flags                flags,
-    IDirect3DSurface9*          resource,
+    IDirect3DSurface9          *resource,
     HANDLE                      sharedHandle,
     UINT                        plane,
-    cl_int*                     errcode_ret) CL_EXT_SUFFIX__VERSION_1_1;
+    cl_int                     *errcode_ret) CL_EXT_SUFFIX__VERSION_1_1;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueAcquireDX9ObjectsINTEL(
     cl_command_queue            command_queue,
     cl_uint                     num_objects,
-    const cl_mem*               mem_objects,
+    const cl_mem               *mem_objects,
     cl_uint                     num_events_in_wait_list,
-    const cl_event*             event_wait_list,
-    cl_event*                   event) CL_EXT_SUFFIX__VERSION_1_1;
+    const cl_event             *event_wait_list,
+    cl_event                   *event) CL_EXT_SUFFIX__VERSION_1_1;
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueAcquireDX9ObjectsINTEL_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clEnqueueAcquireDX9ObjectsINTEL_fn)(
     cl_command_queue            command_queue,
     cl_uint                     num_objects,
-    const cl_mem*               mem_objects,
+    const cl_mem               *mem_objects,
     cl_uint                     num_events_in_wait_list,
-    const cl_event*             event_wait_list,
-    cl_event*                   event) CL_EXT_SUFFIX__VERSION_1_1;
+    const cl_event             *event_wait_list,
+    cl_event                   *event) CL_EXT_SUFFIX__VERSION_1_1;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueReleaseDX9ObjectsINTEL(
     cl_command_queue            command_queue,
     cl_uint                     num_objects,
-    cl_mem*                     mem_objects,
+    cl_mem                     *mem_objects,
     cl_uint                     num_events_in_wait_list,
-    const cl_event*             event_wait_list,
-    cl_event*                   event) CL_EXT_SUFFIX__VERSION_1_1;
+    const cl_event             *event_wait_list,
+    cl_event                   *event) CL_EXT_SUFFIX__VERSION_1_1;
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueReleaseDX9ObjectsINTEL_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clEnqueueReleaseDX9ObjectsINTEL_fn)(
     cl_command_queue            command_queue,
     cl_uint                     num_objects,
-    cl_mem*                     mem_objects,
+    cl_mem                     *mem_objects,
     cl_uint                     num_events_in_wait_list,
-    const cl_event*             event_wait_list,
-    cl_event*                   event) CL_EXT_SUFFIX__VERSION_1_1;
+    const cl_event             *event_wait_list,
+    cl_event                   *event) CL_EXT_SUFFIX__VERSION_1_1;
 
 #ifdef __cplusplus
 }
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_egl.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_egl.h
index c8bde80e1..b1670c6bb 100644
--- a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_egl.h
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_egl.h
@@ -34,13 +34,13 @@ extern "C" {
 #define CL_EGL_RESOURCE_NOT_ACQUIRED_KHR      -1092
 
 /* CLeglImageKHR is an opaque handle to an EGLImage */
-typedef void* CLeglImageKHR;
+typedef void *CLeglImageKHR;
 
 /* CLeglDisplayKHR is an opaque handle to an EGLDisplay */
-typedef void* CLeglDisplayKHR;
+typedef void *CLeglDisplayKHR;
 
 /* CLeglSyncKHR is an opaque handle to an EGLSync object */
-typedef void* CLeglSyncKHR;
+typedef void *CLeglSyncKHR;
 
 /* properties passed to clCreateFromEGLImageKHR */
 typedef intptr_t cl_egl_image_properties_khr;
@@ -53,50 +53,50 @@ clCreateFromEGLImageKHR(cl_context                  context,
                         CLeglDisplayKHR             egldisplay,
                         CLeglImageKHR               eglimage,
                         cl_mem_flags                flags,
-                        const cl_egl_image_properties_khr * properties,
-                        cl_int *                    errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+                        const cl_egl_image_properties_khr *properties,
+                        cl_int                     *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
 
-typedef CL_API_ENTRY cl_mem (CL_API_CALL *clCreateFromEGLImageKHR_fn)(
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *clCreateFromEGLImageKHR_fn)(
     cl_context                  context,
     CLeglDisplayKHR             egldisplay,
     CLeglImageKHR               eglimage,
     cl_mem_flags                flags,
-    const cl_egl_image_properties_khr * properties,
-    cl_int *                    errcode_ret);
+    const cl_egl_image_properties_khr *properties,
+    cl_int                     *errcode_ret);
 
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueAcquireEGLObjectsKHR(cl_command_queue command_queue,
                               cl_uint          num_objects,
-                              const cl_mem *   mem_objects,
+                              const cl_mem    *mem_objects,
                               cl_uint          num_events_in_wait_list,
-                              const cl_event * event_wait_list,
-                              cl_event *       event) CL_API_SUFFIX__VERSION_1_0;
+                              const cl_event *event_wait_list,
+                              cl_event        *event) CL_API_SUFFIX__VERSION_1_0;
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueAcquireEGLObjectsKHR_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clEnqueueAcquireEGLObjectsKHR_fn)(
     cl_command_queue command_queue,
     cl_uint          num_objects,
-    const cl_mem *   mem_objects,
+    const cl_mem    *mem_objects,
     cl_uint          num_events_in_wait_list,
-    const cl_event * event_wait_list,
-    cl_event *       event);
+    const cl_event *event_wait_list,
+    cl_event        *event);
 
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueReleaseEGLObjectsKHR(cl_command_queue command_queue,
                               cl_uint          num_objects,
-                              const cl_mem *   mem_objects,
+                              const cl_mem    *mem_objects,
                               cl_uint          num_events_in_wait_list,
-                              const cl_event * event_wait_list,
-                              cl_event *       event) CL_API_SUFFIX__VERSION_1_0;
+                              const cl_event *event_wait_list,
+                              cl_event        *event) CL_API_SUFFIX__VERSION_1_0;
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueReleaseEGLObjectsKHR_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clEnqueueReleaseEGLObjectsKHR_fn)(
     cl_command_queue command_queue,
     cl_uint          num_objects,
-    const cl_mem *   mem_objects,
+    const cl_mem    *mem_objects,
     cl_uint          num_events_in_wait_list,
-    const cl_event * event_wait_list,
-    cl_event *       event);
+    const cl_event *event_wait_list,
+    cl_event        *event);
 
 
 #define cl_khr_egl_event 1
@@ -105,13 +105,13 @@ extern CL_API_ENTRY cl_event CL_API_CALL
 clCreateEventFromEGLSyncKHR(cl_context      context,
                             CLeglSyncKHR    sync,
                             CLeglDisplayKHR display,
-                            cl_int *        errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+                            cl_int         *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
 
-typedef CL_API_ENTRY cl_event (CL_API_CALL *clCreateEventFromEGLSyncKHR_fn)(
+typedef CL_API_ENTRY cl_event(CL_API_CALL *clCreateEventFromEGLSyncKHR_fn)(
     cl_context      context,
     CLeglSyncKHR    sync,
     CLeglDisplayKHR display,
-    cl_int *        errcode_ret);
+    cl_int         *errcode_ret);
 
 #ifdef __cplusplus
 }
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_ext.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_ext.h
index 0239b6413..6ba1e9bbd 100644
--- a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_ext.h
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_ext.h
@@ -54,9 +54,9 @@ extern "C" {
  * before using.
  */
 #define cl_APPLE_SetMemObjectDestructor 1
-cl_int  CL_API_ENTRY clSetMemObjectDestructorAPPLE(  cl_mem memobj,
-                                        void (* pfn_notify)(cl_mem memobj, void * user_data),
-                                        void * user_data)             CL_EXT_SUFFIX__VERSION_1_0;
+cl_int  CL_API_ENTRY clSetMemObjectDestructorAPPLE(cl_mem memobj,
+                                                   void (* pfn_notify)(cl_mem memobj, void *user_data),
+                                                   void *user_data)             CL_EXT_SUFFIX__VERSION_1_0;
 
 
 /* Context Logging Functions
@@ -68,22 +68,22 @@ cl_int  CL_API_ENTRY clSetMemObjectDestructorAPPLE(  cl_mem memobj,
  * clLogMessagesToSystemLog forwards on all log messages to the Apple System Logger
  */
 #define cl_APPLE_ContextLoggingFunctions 1
-extern void CL_API_ENTRY clLogMessagesToSystemLogAPPLE(  const char * errstr,
-                                            const void * private_info,
-                                            size_t       cb,
-                                            void *       user_data)  CL_EXT_SUFFIX__VERSION_1_0;
+extern void CL_API_ENTRY clLogMessagesToSystemLogAPPLE(const char *errstr,
+                                                       const void *private_info,
+                                                       size_t       cb,
+                                                       void        *user_data)  CL_EXT_SUFFIX__VERSION_1_0;
 
 /* clLogMessagesToStdout sends all log messages to the file descriptor stdout */
-extern void CL_API_ENTRY clLogMessagesToStdoutAPPLE(   const char * errstr,
-                                          const void * private_info,
-                                          size_t       cb,
-                                          void *       user_data)    CL_EXT_SUFFIX__VERSION_1_0;
+extern void CL_API_ENTRY clLogMessagesToStdoutAPPLE(const char *errstr,
+                                                    const void *private_info,
+                                                    size_t       cb,
+                                                    void        *user_data)    CL_EXT_SUFFIX__VERSION_1_0;
 
 /* clLogMessagesToStderr sends all log messages to the file descriptor stderr */
-extern void CL_API_ENTRY clLogMessagesToStderrAPPLE(   const char * errstr,
-                                          const void * private_info,
-                                          size_t       cb,
-                                          void *       user_data)    CL_EXT_SUFFIX__VERSION_1_0;
+extern void CL_API_ENTRY clLogMessagesToStderrAPPLE(const char *errstr,
+                                                    const void *private_info,
+                                                    size_t       cb,
+                                                    void        *user_data)    CL_EXT_SUFFIX__VERSION_1_0;
 
 
 /************************
@@ -99,13 +99,13 @@ extern void CL_API_ENTRY clLogMessagesToStderrAPPLE(   const char * errstr,
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clIcdGetPlatformIDsKHR(cl_uint          num_entries,
-                       cl_platform_id * platforms,
-                       cl_uint *        num_platforms);
+                       cl_platform_id *platforms,
+                       cl_uint         *num_platforms);
 
 typedef CL_API_ENTRY cl_int
 (CL_API_CALL *clIcdGetPlatformIDsKHR_fn)(cl_uint          num_entries,
-                                         cl_platform_id * platforms,
-                                         cl_uint *        num_platforms);
+                                         cl_platform_id *platforms,
+                                         cl_uint         *num_platforms);
 
 
 /*******************************
@@ -125,15 +125,15 @@ typedef CL_API_ENTRY cl_int
 
 extern CL_API_ENTRY cl_program CL_API_CALL
 clCreateProgramWithILKHR(cl_context   context,
-                         const void * il,
+                         const void *il,
                          size_t       length,
-                         cl_int *     errcode_ret);
+                         cl_int      *errcode_ret);
 
 typedef CL_API_ENTRY cl_program
 (CL_API_CALL *clCreateProgramWithILKHR_fn)(cl_context   context,
-                                           const void * il,
+                                           const void *il,
                                            size_t       length,
-                                           cl_int *     errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
+                                           cl_int      *errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
 
 /* Extension: cl_khr_image2d_from_buffer
  *
@@ -203,14 +203,14 @@ typedef cl_properties cl_queue_properties_khr;
 extern CL_API_ENTRY cl_command_queue CL_API_CALL
 clCreateCommandQueueWithPropertiesKHR(cl_context context,
                                       cl_device_id device,
-                                      const cl_queue_properties_khr* properties,
-                                      cl_int* errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
+                                      const cl_queue_properties_khr *properties,
+                                      cl_int *errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
 
 typedef CL_API_ENTRY cl_command_queue
 (CL_API_CALL *clCreateCommandQueueWithPropertiesKHR_fn)(cl_context context,
                                                         cl_device_id device,
-                                                        const cl_queue_properties_khr* properties,
-                                                        cl_int* errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
+                                                        const cl_queue_properties_khr *properties,
+                                                        cl_int *errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
 
 
 /******************************************
@@ -282,17 +282,17 @@ typedef CL_API_ENTRY cl_int
 typedef cl_ulong  cl_device_partition_property_ext;
 extern CL_API_ENTRY cl_int CL_API_CALL
 clCreateSubDevicesEXT(cl_device_id   in_device,
-                      const cl_device_partition_property_ext * properties,
+                      const cl_device_partition_property_ext *properties,
                       cl_uint        num_entries,
-                      cl_device_id * out_devices,
-                      cl_uint *      num_devices) CL_EXT_SUFFIX__VERSION_1_1;
+                      cl_device_id *out_devices,
+                      cl_uint       *num_devices) CL_EXT_SUFFIX__VERSION_1_1;
 
 typedef CL_API_ENTRY cl_int
-(CL_API_CALL * clCreateSubDevicesEXT_fn)(cl_device_id   in_device,
-                                         const cl_device_partition_property_ext * properties,
-                                         cl_uint        num_entries,
-                                         cl_device_id * out_devices,
-                                         cl_uint *      num_devices) CL_EXT_SUFFIX__VERSION_1_1;
+(CL_API_CALL *clCreateSubDevicesEXT_fn)(cl_device_id   in_device,
+                                        const cl_device_partition_property_ext *properties,
+                                        cl_uint        num_entries,
+                                        cl_device_id *out_devices,
+                                        cl_uint       *num_devices) CL_EXT_SUFFIX__VERSION_1_1;
 
 /* cl_device_partition_property_ext */
 #define CL_DEVICE_PARTITION_EQUALLY_EXT             0x4050
@@ -340,20 +340,20 @@ typedef cl_bitfield cl_mem_migration_flags_ext;
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueMigrateMemObjectEXT(cl_command_queue command_queue,
                              cl_uint          num_mem_objects,
-                             const cl_mem *   mem_objects,
+                             const cl_mem    *mem_objects,
                              cl_mem_migration_flags_ext flags,
                              cl_uint          num_events_in_wait_list,
-                             const cl_event * event_wait_list,
-                             cl_event *       event);
+                             const cl_event *event_wait_list,
+                             cl_event        *event);
 
 typedef CL_API_ENTRY cl_int
 (CL_API_CALL *clEnqueueMigrateMemObjectEXT_fn)(cl_command_queue command_queue,
                                                cl_uint          num_mem_objects,
-                                               const cl_mem *   mem_objects,
+                                               const cl_mem    *mem_objects,
                                                cl_mem_migration_flags_ext flags,
                                                cl_uint          num_events_in_wait_list,
-                                               const cl_event * event_wait_list,
-                                               cl_event *       event);
+                                               const cl_event *event_wait_list,
+                                               cl_event        *event);
 
 
 /*********************************
@@ -391,8 +391,7 @@ clGetDeviceImageInfoQCOM(cl_device_id             device,
                          void                    *param_value,
                          size_t                  *param_value_size_ret);
 
-typedef struct _cl_mem_ext_host_ptr
-{
+typedef struct _cl_mem_ext_host_ptr {
     /* Type of external memory allocation. */
     /* Legal values will be defined in layered extensions. */
     cl_uint  allocation_type;
@@ -417,8 +416,7 @@ typedef struct _cl_mem_ext_host_ptr
 
 #define CL_MEM_ION_HOST_PTR_QCOM                  0x40A8
 
-typedef struct _cl_mem_ion_host_ptr
-{
+typedef struct _cl_mem_ion_host_ptr {
     /* Type of external memory allocation. */
     /* Must be CL_MEM_ION_HOST_PTR_QCOM for ION allocations. */
     cl_mem_ext_host_ptr  ext_host_ptr;
@@ -427,7 +425,7 @@ typedef struct _cl_mem_ion_host_ptr
     int                  ion_filedesc;
 
     /* Host pointer to the ION allocated memory */
-    void*                ion_hostptr;
+    void                *ion_hostptr;
 
 } cl_mem_ion_host_ptr;
 
@@ -438,14 +436,13 @@ typedef struct _cl_mem_ion_host_ptr
 
 #define CL_MEM_ANDROID_NATIVE_BUFFER_HOST_PTR_QCOM                  0x40C6
 
-typedef struct _cl_mem_android_native_buffer_host_ptr
-{
+typedef struct _cl_mem_android_native_buffer_host_ptr {
     /* Type of external memory allocation. */
     /* Must be CL_MEM_ANDROID_NATIVE_BUFFER_HOST_PTR_QCOM for Android native buffers. */
     cl_mem_ext_host_ptr  ext_host_ptr;
 
     /* Virtual pointer to the android native buffer */
-    void*                anb_ptr;
+    void                *anb_ptr;
 
 } cl_mem_android_native_buffer_host_ptr;
 
@@ -487,18 +484,18 @@ typedef struct _cl_mem_android_native_buffer_host_ptr
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueAcquireGrallocObjectsIMG(cl_command_queue      command_queue,
                                   cl_uint               num_objects,
-                                  const cl_mem *        mem_objects,
+                                  const cl_mem         *mem_objects,
                                   cl_uint               num_events_in_wait_list,
-                                  const cl_event *      event_wait_list,
-                                  cl_event *            event) CL_EXT_SUFFIX__VERSION_1_2;
+                                  const cl_event       *event_wait_list,
+                                  cl_event             *event) CL_EXT_SUFFIX__VERSION_1_2;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueReleaseGrallocObjectsIMG(cl_command_queue      command_queue,
                                   cl_uint               num_objects,
-                                  const cl_mem *        mem_objects,
+                                  const cl_mem         *mem_objects,
                                   cl_uint               num_events_in_wait_list,
-                                  const cl_event *      event_wait_list,
-                                  cl_event *            event) CL_EXT_SUFFIX__VERSION_1_2;
+                                  const cl_event       *event_wait_list,
+                                  cl_event             *event) CL_EXT_SUFFIX__VERSION_1_2;
 
 /******************************************
  * cl_img_generate_mipmap extension *
@@ -524,7 +521,7 @@ clEnqueueGenerateMipmapIMG(cl_command_queue          command_queue,
                            cl_uint                   num_events_in_wait_list,
                            const cl_event            *event_wait_list,
                            cl_event *event) CL_EXT_SUFFIX__VERSION_1_2;
-  
+
 /******************************************
  * cl_img_mem_properties extension *
  ******************************************/
@@ -561,20 +558,20 @@ clGetKernelSubGroupInfoKHR(cl_kernel    in_kernel,
                            cl_device_id in_device,
                            cl_kernel_sub_group_info param_name,
                            size_t       input_value_size,
-                           const void * input_value,
+                           const void *input_value,
                            size_t       param_value_size,
-                           void *       param_value,
-                           size_t *     param_value_size_ret) CL_EXT_SUFFIX__VERSION_2_0_DEPRECATED;
+                           void        *param_value,
+                           size_t      *param_value_size_ret) CL_EXT_SUFFIX__VERSION_2_0_DEPRECATED;
 
 typedef CL_API_ENTRY cl_int
-(CL_API_CALL * clGetKernelSubGroupInfoKHR_fn)(cl_kernel    in_kernel,
-                                              cl_device_id in_device,
-                                              cl_kernel_sub_group_info param_name,
-                                              size_t       input_value_size,
-                                              const void * input_value,
-                                              size_t       param_value_size,
-                                              void *       param_value,
-                                              size_t *     param_value_size_ret) CL_EXT_SUFFIX__VERSION_2_0_DEPRECATED;
+(CL_API_CALL *clGetKernelSubGroupInfoKHR_fn)(cl_kernel    in_kernel,
+                                             cl_device_id in_device,
+                                             cl_kernel_sub_group_info param_name,
+                                             size_t       input_value_size,
+                                             const void *input_value,
+                                             size_t       param_value_size,
+                                             void        *param_value,
+                                             size_t      *param_value_size_ret) CL_EXT_SUFFIX__VERSION_2_0_DEPRECATED;
 
 
 /*********************************
@@ -661,8 +658,7 @@ typedef cl_uint cl_version_khr;
 
 #define CL_NAME_VERSION_MAX_NAME_SIZE_KHR 64
 
-typedef struct _cl_name_version_khr
-{
+typedef struct _cl_name_version_khr {
     cl_version_khr version;
     char name[CL_NAME_VERSION_MAX_NAME_SIZE_KHR];
 } cl_name_version_khr;
@@ -739,12 +735,12 @@ typedef intptr_t cl_import_properties_arm;
  * function clCreateBuffer.
  */
 extern CL_API_ENTRY cl_mem CL_API_CALL
-clImportMemoryARM( cl_context context,
-                   cl_mem_flags flags,
-                   const cl_import_properties_arm *properties,
-                   void *memory,
-                   size_t size,
-                   cl_int *errcode_ret) CL_EXT_SUFFIX__VERSION_1_0;
+clImportMemoryARM(cl_context context,
+                  cl_mem_flags flags,
+                  const cl_import_properties_arm *properties,
+                  void *memory,
+                  size_t size,
+                  cl_int *errcode_ret) CL_EXT_SUFFIX__VERSION_1_0;
 
 
 /******************************************
@@ -783,7 +779,7 @@ typedef cl_bitfield cl_svm_mem_flags_arm;
 typedef cl_uint     cl_kernel_exec_info_arm;
 typedef cl_bitfield cl_device_svm_capabilities_arm;
 
-extern CL_API_ENTRY void * CL_API_CALL
+extern CL_API_ENTRY void *CL_API_CALL
 clSVMAllocARM(cl_context       context,
               cl_svm_mem_flags_arm flags,
               size_t           size,
@@ -791,68 +787,68 @@ clSVMAllocARM(cl_context       context,
 
 extern CL_API_ENTRY void CL_API_CALL
 clSVMFreeARM(cl_context        context,
-             void *            svm_pointer) CL_EXT_SUFFIX__VERSION_1_2;
+             void             *svm_pointer) CL_EXT_SUFFIX__VERSION_1_2;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueSVMFreeARM(cl_command_queue  command_queue,
                     cl_uint           num_svm_pointers,
-                    void *            svm_pointers[],
-                    void (CL_CALLBACK * pfn_free_func)(cl_command_queue queue,
-                                                       cl_uint          num_svm_pointers,
-                                                       void *           svm_pointers[],
-                                                       void *           user_data),
-                    void *            user_data,
+                    void             *svm_pointers[],
+                    void (CL_CALLBACK *pfn_free_func)(cl_command_queue queue,
+                                                      cl_uint          num_svm_pointers,
+                                                      void            *svm_pointers[],
+                                                      void            *user_data),
+                    void             *user_data,
                     cl_uint           num_events_in_wait_list,
-                    const cl_event *  event_wait_list,
-                    cl_event *        event) CL_EXT_SUFFIX__VERSION_1_2;
+                    const cl_event   *event_wait_list,
+                    cl_event         *event) CL_EXT_SUFFIX__VERSION_1_2;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueSVMMemcpyARM(cl_command_queue  command_queue,
                       cl_bool           blocking_copy,
-                      void *            dst_ptr,
-                      const void *      src_ptr,
+                      void             *dst_ptr,
+                      const void       *src_ptr,
                       size_t            size,
                       cl_uint           num_events_in_wait_list,
-                      const cl_event *  event_wait_list,
-                      cl_event *        event) CL_EXT_SUFFIX__VERSION_1_2;
+                      const cl_event   *event_wait_list,
+                      cl_event         *event) CL_EXT_SUFFIX__VERSION_1_2;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueSVMMemFillARM(cl_command_queue  command_queue,
-                       void *            svm_ptr,
-                       const void *      pattern,
+                       void             *svm_ptr,
+                       const void       *pattern,
                        size_t            pattern_size,
                        size_t            size,
                        cl_uint           num_events_in_wait_list,
-                       const cl_event *  event_wait_list,
-                       cl_event *        event) CL_EXT_SUFFIX__VERSION_1_2;
+                       const cl_event   *event_wait_list,
+                       cl_event         *event) CL_EXT_SUFFIX__VERSION_1_2;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueSVMMapARM(cl_command_queue  command_queue,
                    cl_bool           blocking_map,
                    cl_map_flags      flags,
-                   void *            svm_ptr,
+                   void             *svm_ptr,
                    size_t            size,
                    cl_uint           num_events_in_wait_list,
-                   const cl_event *  event_wait_list,
-                   cl_event *        event) CL_EXT_SUFFIX__VERSION_1_2;
+                   const cl_event   *event_wait_list,
+                   cl_event         *event) CL_EXT_SUFFIX__VERSION_1_2;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueSVMUnmapARM(cl_command_queue  command_queue,
-                     void *            svm_ptr,
+                     void             *svm_ptr,
                      cl_uint           num_events_in_wait_list,
-                     const cl_event *  event_wait_list,
-                     cl_event *        event) CL_EXT_SUFFIX__VERSION_1_2;
+                     const cl_event   *event_wait_list,
+                     cl_event         *event) CL_EXT_SUFFIX__VERSION_1_2;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clSetKernelArgSVMPointerARM(cl_kernel    kernel,
                             cl_uint      arg_index,
-                            const void * arg_value) CL_EXT_SUFFIX__VERSION_1_2;
+                            const void *arg_value) CL_EXT_SUFFIX__VERSION_1_2;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clSetKernelExecInfoARM(cl_kernel            kernel,
                        cl_kernel_exec_info_arm  param_name,
                        size_t               param_value_size,
-                       const void *         param_value) CL_EXT_SUFFIX__VERSION_1_2;
+                       const void          *param_value) CL_EXT_SUFFIX__VERSION_1_2;
 
 /********************************
  * cl_arm_get_core_id extension *
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_ext_intel.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_ext_intel.h
index aab82284c..55bdc515d 100644
--- a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_ext_intel.h
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_ext_intel.h
@@ -75,7 +75,7 @@ extern "C" {
 #define cl_intel_motion_estimation 1
 #define cl_intel_advanced_motion_estimation 1
 
-typedef struct _cl_accelerator_intel* cl_accelerator_intel;
+typedef struct _cl_accelerator_intel *cl_accelerator_intel;
 typedef cl_uint cl_accelerator_type_intel;
 typedef cl_uint cl_accelerator_info_intel;
 
@@ -171,43 +171,43 @@ clCreateAcceleratorINTEL(
     cl_context                   context,
     cl_accelerator_type_intel    accelerator_type,
     size_t                       descriptor_size,
-    const void*                  descriptor,
-    cl_int*                      errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
+    const void                  *descriptor,
+    cl_int                      *errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
 
-typedef CL_API_ENTRY cl_accelerator_intel (CL_API_CALL *clCreateAcceleratorINTEL_fn)(
+typedef CL_API_ENTRY cl_accelerator_intel(CL_API_CALL *clCreateAcceleratorINTEL_fn)(
     cl_context                   context,
     cl_accelerator_type_intel    accelerator_type,
     size_t                       descriptor_size,
-    const void*                  descriptor,
-    cl_int*                      errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
+    const void                  *descriptor,
+    cl_int                      *errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clGetAcceleratorInfoINTEL(
     cl_accelerator_intel         accelerator,
     cl_accelerator_info_intel    param_name,
     size_t                       param_value_size,
-    void*                        param_value,
-    size_t*                      param_value_size_ret) CL_EXT_SUFFIX__VERSION_1_2;
+    void                        *param_value,
+    size_t                      *param_value_size_ret) CL_EXT_SUFFIX__VERSION_1_2;
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clGetAcceleratorInfoINTEL_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clGetAcceleratorInfoINTEL_fn)(
     cl_accelerator_intel         accelerator,
     cl_accelerator_info_intel    param_name,
     size_t                       param_value_size,
-    void*                        param_value,
-    size_t*                      param_value_size_ret) CL_EXT_SUFFIX__VERSION_1_2;
+    void                        *param_value,
+    size_t                      *param_value_size_ret) CL_EXT_SUFFIX__VERSION_1_2;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clRetainAcceleratorINTEL(
     cl_accelerator_intel         accelerator) CL_EXT_SUFFIX__VERSION_1_2;
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clRetainAcceleratorINTEL_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clRetainAcceleratorINTEL_fn)(
     cl_accelerator_intel         accelerator) CL_EXT_SUFFIX__VERSION_1_2;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clReleaseAcceleratorINTEL(
     cl_accelerator_intel         accelerator) CL_EXT_SUFFIX__VERSION_1_2;
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clReleaseAcceleratorINTEL_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clReleaseAcceleratorINTEL_fn)(
     cl_accelerator_intel         accelerator) CL_EXT_SUFFIX__VERSION_1_2;
 
 /******************************************
@@ -472,171 +472,171 @@ typedef cl_uint cl_mem_advice_intel;
 #define CL_COMMAND_MIGRATEMEM_INTEL     0x4206
 #define CL_COMMAND_MEMADVISE_INTEL      0x4207
 
-extern CL_API_ENTRY void* CL_API_CALL
+extern CL_API_ENTRY void *CL_API_CALL
 clHostMemAllocINTEL(
-            cl_context context,
-            const cl_mem_properties_intel* properties,
-            size_t size,
-            cl_uint alignment,
-            cl_int* errcode_ret);
+    cl_context context,
+    const cl_mem_properties_intel *properties,
+    size_t size,
+    cl_uint alignment,
+    cl_int *errcode_ret);
 
-typedef CL_API_ENTRY void* (CL_API_CALL *
-clHostMemAllocINTEL_fn)(
-            cl_context context,
-            const cl_mem_properties_intel* properties,
-            size_t size,
-            cl_uint alignment,
-            cl_int* errcode_ret);
+typedef CL_API_ENTRY void *(CL_API_CALL *
+                            clHostMemAllocINTEL_fn)(
+                                cl_context context,
+                                const cl_mem_properties_intel *properties,
+                                size_t size,
+                                cl_uint alignment,
+                                cl_int *errcode_ret);
 
-extern CL_API_ENTRY void* CL_API_CALL
+extern CL_API_ENTRY void *CL_API_CALL
 clDeviceMemAllocINTEL(
-            cl_context context,
-            cl_device_id device,
-            const cl_mem_properties_intel* properties,
-            size_t size,
-            cl_uint alignment,
-            cl_int* errcode_ret);
+    cl_context context,
+    cl_device_id device,
+    const cl_mem_properties_intel *properties,
+    size_t size,
+    cl_uint alignment,
+    cl_int *errcode_ret);
 
-typedef CL_API_ENTRY void* (CL_API_CALL *
-clDeviceMemAllocINTEL_fn)(
-            cl_context context,
-            cl_device_id device,
-            const cl_mem_properties_intel* properties,
-            size_t size,
-            cl_uint alignment,
-            cl_int* errcode_ret);
+typedef CL_API_ENTRY void *(CL_API_CALL *
+                            clDeviceMemAllocINTEL_fn)(
+                                cl_context context,
+                                cl_device_id device,
+                                const cl_mem_properties_intel *properties,
+                                size_t size,
+                                cl_uint alignment,
+                                cl_int *errcode_ret);
 
-extern CL_API_ENTRY void* CL_API_CALL
+extern CL_API_ENTRY void *CL_API_CALL
 clSharedMemAllocINTEL(
-            cl_context context,
-            cl_device_id device,
-            const cl_mem_properties_intel* properties,
-            size_t size,
-            cl_uint alignment,
-            cl_int* errcode_ret);
+    cl_context context,
+    cl_device_id device,
+    const cl_mem_properties_intel *properties,
+    size_t size,
+    cl_uint alignment,
+    cl_int *errcode_ret);
 
-typedef CL_API_ENTRY void* (CL_API_CALL *
-clSharedMemAllocINTEL_fn)(
-            cl_context context,
-            cl_device_id device,
-            const cl_mem_properties_intel* properties,
-            size_t size,
-            cl_uint alignment,
-            cl_int* errcode_ret);
+typedef CL_API_ENTRY void *(CL_API_CALL *
+                            clSharedMemAllocINTEL_fn)(
+                                cl_context context,
+                                cl_device_id device,
+                                const cl_mem_properties_intel *properties,
+                                size_t size,
+                                cl_uint alignment,
+                                cl_int *errcode_ret);
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clMemFreeINTEL(
-            cl_context context,
-            void* ptr);
+    cl_context context,
+    void *ptr);
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *
-clMemFreeINTEL_fn)(
-            cl_context context,
-            void* ptr);
+typedef CL_API_ENTRY cl_int(CL_API_CALL *
+                            clMemFreeINTEL_fn)(
+                                cl_context context,
+                                void *ptr);
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clMemBlockingFreeINTEL(
-            cl_context context,
-            void* ptr);
+    cl_context context,
+    void *ptr);
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *
-clMemBlockingFreeINTEL_fn)(
-            cl_context context,
-            void* ptr);
+typedef CL_API_ENTRY cl_int(CL_API_CALL *
+                            clMemBlockingFreeINTEL_fn)(
+                                cl_context context,
+                                void *ptr);
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clGetMemAllocInfoINTEL(
-            cl_context context,
-            const void* ptr,
-            cl_mem_info_intel param_name,
-            size_t param_value_size,
-            void* param_value,
-            size_t* param_value_size_ret);
+    cl_context context,
+    const void *ptr,
+    cl_mem_info_intel param_name,
+    size_t param_value_size,
+    void *param_value,
+    size_t *param_value_size_ret);
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *
-clGetMemAllocInfoINTEL_fn)(
-            cl_context context,
-            const void* ptr,
-            cl_mem_info_intel param_name,
-            size_t param_value_size,
-            void* param_value,
-            size_t* param_value_size_ret);
+typedef CL_API_ENTRY cl_int(CL_API_CALL *
+                            clGetMemAllocInfoINTEL_fn)(
+                                cl_context context,
+                                const void *ptr,
+                                cl_mem_info_intel param_name,
+                                size_t param_value_size,
+                                void *param_value,
+                                size_t *param_value_size_ret);
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clSetKernelArgMemPointerINTEL(
-            cl_kernel kernel,
-            cl_uint arg_index,
-            const void* arg_value);
+    cl_kernel kernel,
+    cl_uint arg_index,
+    const void *arg_value);
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *
-clSetKernelArgMemPointerINTEL_fn)(
-            cl_kernel kernel,
-            cl_uint arg_index,
-            const void* arg_value);
+typedef CL_API_ENTRY cl_int(CL_API_CALL *
+                            clSetKernelArgMemPointerINTEL_fn)(
+                                cl_kernel kernel,
+                                cl_uint arg_index,
+                                const void *arg_value);
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueMemsetINTEL(       /* Deprecated */
-            cl_command_queue command_queue,
-            void* dst_ptr,
-            cl_int value,
-            size_t size,
-            cl_uint num_events_in_wait_list,
-            const cl_event* event_wait_list,
-            cl_event* event);
+    cl_command_queue command_queue,
+    void *dst_ptr,
+    cl_int value,
+    size_t size,
+    cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event);
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *
-clEnqueueMemsetINTEL_fn)(   /* Deprecated */
-            cl_command_queue command_queue,
-            void* dst_ptr,
-            cl_int value,
-            size_t size,
-            cl_uint num_events_in_wait_list,
-            const cl_event* event_wait_list,
-            cl_event* event);
+typedef CL_API_ENTRY cl_int(CL_API_CALL *
+                            clEnqueueMemsetINTEL_fn)(   /* Deprecated */
+                                cl_command_queue command_queue,
+                                void *dst_ptr,
+                                cl_int value,
+                                size_t size,
+                                cl_uint num_events_in_wait_list,
+                                const cl_event *event_wait_list,
+                                cl_event *event);
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueMemFillINTEL(
-            cl_command_queue command_queue,
-            void* dst_ptr,
-            const void* pattern,
-            size_t pattern_size,
-            size_t size,
-            cl_uint num_events_in_wait_list,
-            const cl_event* event_wait_list,
-            cl_event* event);
+    cl_command_queue command_queue,
+    void *dst_ptr,
+    const void *pattern,
+    size_t pattern_size,
+    size_t size,
+    cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event);
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *
-clEnqueueMemFillINTEL_fn)(
-            cl_command_queue command_queue,
-            void* dst_ptr,
-            const void* pattern,
-            size_t pattern_size,
-            size_t size,
-            cl_uint num_events_in_wait_list,
-            const cl_event* event_wait_list,
-            cl_event* event);
+typedef CL_API_ENTRY cl_int(CL_API_CALL *
+                            clEnqueueMemFillINTEL_fn)(
+                                cl_command_queue command_queue,
+                                void *dst_ptr,
+                                const void *pattern,
+                                size_t pattern_size,
+                                size_t size,
+                                cl_uint num_events_in_wait_list,
+                                const cl_event *event_wait_list,
+                                cl_event *event);
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueMemcpyINTEL(
-            cl_command_queue command_queue,
-            cl_bool blocking,
-            void* dst_ptr,
-            const void* src_ptr,
-            size_t size,
-            cl_uint num_events_in_wait_list,
-            const cl_event* event_wait_list,
-            cl_event* event);
+    cl_command_queue command_queue,
+    cl_bool blocking,
+    void *dst_ptr,
+    const void *src_ptr,
+    size_t size,
+    cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event);
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *
-clEnqueueMemcpyINTEL_fn)(
-            cl_command_queue command_queue,
-            cl_bool blocking,
-            void* dst_ptr,
-            const void* src_ptr,
-            size_t size,
-            cl_uint num_events_in_wait_list,
-            const cl_event* event_wait_list,
-            cl_event* event);
+typedef CL_API_ENTRY cl_int(CL_API_CALL *
+                            clEnqueueMemcpyINTEL_fn)(
+                                cl_command_queue command_queue,
+                                cl_bool blocking,
+                                void *dst_ptr,
+                                const void *src_ptr,
+                                size_t size,
+                                cl_uint num_events_in_wait_list,
+                                const cl_event *event_wait_list,
+                                cl_event *event);
 
 #ifdef CL_VERSION_1_2
 
@@ -645,45 +645,45 @@ clEnqueueMemcpyINTEL_fn)(
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueMigrateMemINTEL(
-            cl_command_queue command_queue,
-            const void* ptr,
-            size_t size,
-            cl_mem_migration_flags flags,
-            cl_uint num_events_in_wait_list,
-            const cl_event* event_wait_list,
-            cl_event* event);
+    cl_command_queue command_queue,
+    const void *ptr,
+    size_t size,
+    cl_mem_migration_flags flags,
+    cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event);
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *
-clEnqueueMigrateMemINTEL_fn)(
-            cl_command_queue command_queue,
-            const void* ptr,
-            size_t size,
-            cl_mem_migration_flags flags,
-            cl_uint num_events_in_wait_list,
-            const cl_event* event_wait_list,
-            cl_event* event);
+typedef CL_API_ENTRY cl_int(CL_API_CALL *
+                            clEnqueueMigrateMemINTEL_fn)(
+                                cl_command_queue command_queue,
+                                const void *ptr,
+                                size_t size,
+                                cl_mem_migration_flags flags,
+                                cl_uint num_events_in_wait_list,
+                                const cl_event *event_wait_list,
+                                cl_event *event);
 
 #endif
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueMemAdviseINTEL(
-            cl_command_queue command_queue,
-            const void* ptr,
-            size_t size,
-            cl_mem_advice_intel advice,
-            cl_uint num_events_in_wait_list,
-            const cl_event* event_wait_list,
-            cl_event* event);
+    cl_command_queue command_queue,
+    const void *ptr,
+    size_t size,
+    cl_mem_advice_intel advice,
+    cl_uint num_events_in_wait_list,
+    const cl_event *event_wait_list,
+    cl_event *event);
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *
-clEnqueueMemAdviseINTEL_fn)(
-            cl_command_queue command_queue,
-            const void* ptr,
-            size_t size,
-            cl_mem_advice_intel advice,
-            cl_uint num_events_in_wait_list,
-            const cl_event* event_wait_list,
-            cl_event* event);
+typedef CL_API_ENTRY cl_int(CL_API_CALL *
+                            clEnqueueMemAdviseINTEL_fn)(
+                                cl_command_queue command_queue,
+                                const void *ptr,
+                                size_t size,
+                                cl_mem_advice_intel advice,
+                                cl_uint num_events_in_wait_list,
+                                const cl_event *event_wait_list,
+                                cl_event *event);
 
 /***************************************************
 * cl_intel_create_buffer_with_properties extension *
@@ -694,20 +694,20 @@ clEnqueueMemAdviseINTEL_fn)(
 extern CL_API_ENTRY cl_mem CL_API_CALL
 clCreateBufferWithPropertiesINTEL(
     cl_context   context,
-    const cl_mem_properties_intel* properties,
+    const cl_mem_properties_intel *properties,
     cl_mem_flags flags,
     size_t       size,
-    void *       host_ptr,
-    cl_int *     errcode_ret) CL_EXT_SUFFIX__VERSION_1_0;
+    void        *host_ptr,
+    cl_int      *errcode_ret) CL_EXT_SUFFIX__VERSION_1_0;
 
-typedef CL_API_ENTRY cl_mem (CL_API_CALL *
-clCreateBufferWithPropertiesINTEL_fn)(
-    cl_context   context,
-    const cl_mem_properties_intel* properties,
-    cl_mem_flags flags,
-    size_t       size,
-    void *       host_ptr,
-    cl_int *     errcode_ret) CL_EXT_SUFFIX__VERSION_1_0;
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *
+                            clCreateBufferWithPropertiesINTEL_fn)(
+                                cl_context   context,
+                                const cl_mem_properties_intel *properties,
+                                cl_mem_flags flags,
+                                size_t       size,
+                                void        *host_ptr,
+                                cl_int      *errcode_ret) CL_EXT_SUFFIX__VERSION_1_0;
 
 /******************************************
 * cl_intel_mem_channel_property extension *
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_gl.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_gl.h
index b587f02a9..10ca62875 100644
--- a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_gl.h
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_gl.h
@@ -52,7 +52,7 @@ extern CL_API_ENTRY cl_mem CL_API_CALL
 clCreateFromGLBuffer(cl_context     context,
                      cl_mem_flags   flags,
                      cl_GLuint      bufobj,
-                     cl_int *       errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+                     cl_int        *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
 
 #ifdef CL_VERSION_1_2
 
@@ -62,7 +62,7 @@ clCreateFromGLTexture(cl_context      context,
                       cl_GLenum       target,
                       cl_GLint        miplevel,
                       cl_GLuint       texture,
-                      cl_int *        errcode_ret) CL_API_SUFFIX__VERSION_1_2;
+                      cl_int         *errcode_ret) CL_API_SUFFIX__VERSION_1_2;
 
 #endif
 
@@ -70,35 +70,35 @@ extern CL_API_ENTRY cl_mem CL_API_CALL
 clCreateFromGLRenderbuffer(cl_context   context,
                            cl_mem_flags flags,
                            cl_GLuint    renderbuffer,
-                           cl_int *     errcode_ret) CL_API_SUFFIX__VERSION_1_0;
+                           cl_int      *errcode_ret) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clGetGLObjectInfo(cl_mem                memobj,
-                  cl_gl_object_type *   gl_object_type,
-                  cl_GLuint *           gl_object_name) CL_API_SUFFIX__VERSION_1_0;
+                  cl_gl_object_type    *gl_object_type,
+                  cl_GLuint            *gl_object_name) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clGetGLTextureInfo(cl_mem               memobj,
                    cl_gl_texture_info   param_name,
                    size_t               param_value_size,
-                   void *               param_value,
-                   size_t *             param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+                   void                *param_value,
+                   size_t              *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueAcquireGLObjects(cl_command_queue      command_queue,
                           cl_uint               num_objects,
-                          const cl_mem *        mem_objects,
+                          const cl_mem         *mem_objects,
                           cl_uint               num_events_in_wait_list,
-                          const cl_event *      event_wait_list,
-                          cl_event *            event) CL_API_SUFFIX__VERSION_1_0;
+                          const cl_event       *event_wait_list,
+                          cl_event             *event) CL_API_SUFFIX__VERSION_1_0;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueReleaseGLObjects(cl_command_queue      command_queue,
                           cl_uint               num_objects,
-                          const cl_mem *        mem_objects,
+                          const cl_mem         *mem_objects,
                           cl_uint               num_events_in_wait_list,
-                          const cl_event *      event_wait_list,
-                          cl_event *            event) CL_API_SUFFIX__VERSION_1_0;
+                          const cl_event       *event_wait_list,
+                          cl_event             *event) CL_API_SUFFIX__VERSION_1_0;
 
 
 /* Deprecated OpenCL 1.1 APIs */
@@ -108,7 +108,7 @@ clCreateFromGLTexture2D(cl_context      context,
                         cl_GLenum       target,
                         cl_GLint        miplevel,
                         cl_GLuint       texture,
-                        cl_int *        errcode_ret) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+                        cl_int         *errcode_ret) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
 
 extern CL_API_ENTRY CL_EXT_PREFIX__VERSION_1_1_DEPRECATED cl_mem CL_API_CALL
 clCreateFromGLTexture3D(cl_context      context,
@@ -116,7 +116,7 @@ clCreateFromGLTexture3D(cl_context      context,
                         cl_GLenum       target,
                         cl_GLint        miplevel,
                         cl_GLuint       texture,
-                        cl_int *        errcode_ret) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+                        cl_int         *errcode_ret) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
 
 /* cl_khr_gl_sharing extension  */
 
@@ -139,18 +139,18 @@ typedef cl_uint     cl_gl_context_info;
 #define CL_CGL_SHAREGROUP_KHR                   0x200C
 
 extern CL_API_ENTRY cl_int CL_API_CALL
-clGetGLContextInfoKHR(const cl_context_properties * properties,
+clGetGLContextInfoKHR(const cl_context_properties *properties,
                       cl_gl_context_info            param_name,
                       size_t                        param_value_size,
-                      void *                        param_value,
-                      size_t *                      param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
+                      void                         *param_value,
+                      size_t                       *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clGetGLContextInfoKHR_fn)(
-    const cl_context_properties * properties,
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clGetGLContextInfoKHR_fn)(
+    const cl_context_properties *properties,
     cl_gl_context_info            param_name,
     size_t                        param_value_size,
-    void *                        param_value,
-    size_t *                      param_value_size_ret);
+    void                         *param_value,
+    size_t                       *param_value_size_ret);
 
 #ifdef __cplusplus
 }
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_gl_ext.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_gl_ext.h
index 52107b111..916c5189b 100644
--- a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_gl_ext.h
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_gl_ext.h
@@ -23,7 +23,7 @@ extern "C" {
 
 #include <CL/cl_gl.h>
 
-/* 
+/*
  *  cl_khr_gl_event extension
  */
 #define CL_COMMAND_GL_FENCE_SYNC_OBJECT_KHR     0x200D
@@ -31,7 +31,7 @@ extern "C" {
 extern CL_API_ENTRY cl_event CL_API_CALL
 clCreateEventFromGLsyncKHR(cl_context context,
                            cl_GLsync  sync,
-                           cl_int *   errcode_ret) CL_EXT_SUFFIX__VERSION_1_1;
+                           cl_int    *errcode_ret) CL_EXT_SUFFIX__VERSION_1_1;
 
 #ifdef __cplusplus
 }
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_half.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_half.h
index ecc422332..f394042a5 100644
--- a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_half.h
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_half.h
@@ -41,12 +41,11 @@ extern "C" {
 /**
  * Rounding mode used when converting to cl_half.
  */
-typedef enum
-{
-  CL_HALF_RTE, // round to nearest even
-  CL_HALF_RTZ, // round towards zero
-  CL_HALF_RTP, // round towards positive infinity
-  CL_HALF_RTN, // round towards negative infinity
+typedef enum {
+    CL_HALF_RTE, // round to nearest even
+    CL_HALF_RTZ, // round towards zero
+    CL_HALF_RTP, // round towards positive infinity
+    CL_HALF_RTN, // round towards negative infinity
 } cl_half_rounding_mode;
 
 
@@ -59,372 +58,317 @@ typedef enum
  * Utility to deal with values that overflow when converting to half precision.
  */
 static inline cl_half cl_half_handle_overflow(cl_half_rounding_mode rounding_mode,
-                                              uint16_t sign)
-{
-  if (rounding_mode == CL_HALF_RTZ)
-  {
-    // Round overflow towards zero -> largest finite number (preserving sign)
-    return (sign << 15) | CL_HALF_MAX_FINITE_MAG;
-  }
-  else if (rounding_mode == CL_HALF_RTP && sign)
-  {
-    // Round negative overflow towards positive infinity -> most negative finite number
-    return (1 << 15) | CL_HALF_MAX_FINITE_MAG;
-  }
-  else if (rounding_mode == CL_HALF_RTN && !sign)
-  {
-    // Round positive overflow towards negative infinity -> largest finite number
-    return CL_HALF_MAX_FINITE_MAG;
-  }
+                                              uint16_t sign) {
+    if (rounding_mode == CL_HALF_RTZ) {
+        // Round overflow towards zero -> largest finite number (preserving sign)
+        return (sign << 15) | CL_HALF_MAX_FINITE_MAG;
+    } else if (rounding_mode == CL_HALF_RTP && sign) {
+        // Round negative overflow towards positive infinity -> most negative finite number
+        return (1 << 15) | CL_HALF_MAX_FINITE_MAG;
+    } else if (rounding_mode == CL_HALF_RTN && !sign) {
+        // Round positive overflow towards negative infinity -> largest finite number
+        return CL_HALF_MAX_FINITE_MAG;
+    }
 
-  // Overflow to infinity
-  return (sign << 15) | CL_HALF_EXP_MASK;
+    // Overflow to infinity
+    return (sign << 15) | CL_HALF_EXP_MASK;
 }
 
 /*
  * Utility to deal with values that underflow when converting to half precision.
  */
 static inline cl_half cl_half_handle_underflow(cl_half_rounding_mode rounding_mode,
-                                               uint16_t sign)
-{
-  if (rounding_mode == CL_HALF_RTP && !sign)
-  {
-    // Round underflow towards positive infinity -> smallest positive value
-    return (sign << 15) | 1;
-  }
-  else if (rounding_mode == CL_HALF_RTN && sign)
-  {
-    // Round underflow towards negative infinity -> largest negative value
-    return (sign << 15) | 1;
-  }
+                                               uint16_t sign) {
+    if (rounding_mode == CL_HALF_RTP && !sign) {
+        // Round underflow towards positive infinity -> smallest positive value
+        return (sign << 15) | 1;
+    } else if (rounding_mode == CL_HALF_RTN && sign) {
+        // Round underflow towards negative infinity -> largest negative value
+        return (sign << 15) | 1;
+    }
 
-  // Flush to zero
-  return (sign << 15);
+    // Flush to zero
+    return (sign << 15);
 }
 
 
 /**
  * Convert a cl_float to a cl_half.
  */
-static inline cl_half cl_half_from_float(cl_float f, cl_half_rounding_mode rounding_mode)
-{
-  // Type-punning to get direct access to underlying bits
-  union
-  {
-    cl_float f;
-    uint32_t i;
-  } f32;
-  f32.f = f;
+static inline cl_half cl_half_from_float(cl_float f, cl_half_rounding_mode rounding_mode) {
+    // Type-punning to get direct access to underlying bits
+    union {
+        cl_float f;
+        uint32_t i;
+    } f32;
+    f32.f = f;
 
-  // Extract sign bit
-  uint16_t sign = f32.i >> 31;
+    // Extract sign bit
+    uint16_t sign = f32.i >> 31;
 
-  // Extract FP32 exponent and mantissa
-  uint32_t f_exp = (f32.i >> (CL_FLT_MANT_DIG - 1)) & 0xFF;
-  uint32_t f_mant = f32.i & ((1 << (CL_FLT_MANT_DIG - 1)) - 1);
+    // Extract FP32 exponent and mantissa
+    uint32_t f_exp = (f32.i >> (CL_FLT_MANT_DIG - 1)) & 0xFF;
+    uint32_t f_mant = f32.i & ((1 << (CL_FLT_MANT_DIG - 1)) - 1);
 
-  // Remove FP32 exponent bias
-  int32_t exp = f_exp - CL_FLT_MAX_EXP + 1;
+    // Remove FP32 exponent bias
+    int32_t exp = f_exp - CL_FLT_MAX_EXP + 1;
 
-  // Add FP16 exponent bias
-  uint16_t h_exp = (uint16_t)(exp + CL_HALF_MAX_EXP - 1);
+    // Add FP16 exponent bias
+    uint16_t h_exp = (uint16_t)(exp + CL_HALF_MAX_EXP - 1);
 
-  // Position of the bit that will become the FP16 mantissa LSB
-  uint32_t lsb_pos = CL_FLT_MANT_DIG - CL_HALF_MANT_DIG;
+    // Position of the bit that will become the FP16 mantissa LSB
+    uint32_t lsb_pos = CL_FLT_MANT_DIG - CL_HALF_MANT_DIG;
 
-  // Check for NaN / infinity
-  if (f_exp == 0xFF)
-  {
-    if (f_mant)
-    {
-      // NaN -> propagate mantissa and silence it
-      uint16_t h_mant = (uint16_t)(f_mant >> lsb_pos);
-      h_mant |= 0x200;
-      return (sign << 15) | CL_HALF_EXP_MASK | h_mant;
+    // Check for NaN / infinity
+    if (f_exp == 0xFF) {
+        if (f_mant) {
+            // NaN -> propagate mantissa and silence it
+            uint16_t h_mant = (uint16_t)(f_mant >> lsb_pos);
+            h_mant |= 0x200;
+            return (sign << 15) | CL_HALF_EXP_MASK | h_mant;
+        } else {
+            // Infinity -> zero mantissa
+            return (sign << 15) | CL_HALF_EXP_MASK;
+        }
     }
-    else
-    {
-      // Infinity -> zero mantissa
-      return (sign << 15) | CL_HALF_EXP_MASK;
+
+    // Check for zero
+    if (!f_exp && !f_mant) {
+        return (sign << 15);
     }
-  }
 
-  // Check for zero
-  if (!f_exp && !f_mant)
-  {
-    return (sign << 15);
-  }
+    // Check for overflow
+    if (exp >= CL_HALF_MAX_EXP) {
+        return cl_half_handle_overflow(rounding_mode, sign);
+    }
 
-  // Check for overflow
-  if (exp >= CL_HALF_MAX_EXP)
-  {
-    return cl_half_handle_overflow(rounding_mode, sign);
-  }
+    // Check for underflow
+    if (exp < (CL_HALF_MIN_EXP - CL_HALF_MANT_DIG - 1)) {
+        return cl_half_handle_underflow(rounding_mode, sign);
+    }
 
-  // Check for underflow
-  if (exp < (CL_HALF_MIN_EXP - CL_HALF_MANT_DIG - 1))
-  {
-    return cl_half_handle_underflow(rounding_mode, sign);
-  }
+    // Check for value that will become denormal
+    if (exp < -14) {
+        // Denormal -> include the implicit 1 from the FP32 mantissa
+        h_exp = 0;
+        f_mant |= 1 << (CL_FLT_MANT_DIG - 1);
 
-  // Check for value that will become denormal
-  if (exp < -14)
-  {
-    // Denormal -> include the implicit 1 from the FP32 mantissa
-    h_exp = 0;
-    f_mant |= 1 << (CL_FLT_MANT_DIG - 1);
+        // Mantissa shift amount depends on exponent
+        lsb_pos = -exp + (CL_FLT_MANT_DIG - 25);
+    }
 
-    // Mantissa shift amount depends on exponent
-    lsb_pos = -exp + (CL_FLT_MANT_DIG - 25);
-  }
+    // Generate FP16 mantissa by shifting FP32 mantissa
+    uint16_t h_mant = (uint16_t)(f_mant >> lsb_pos);
 
-  // Generate FP16 mantissa by shifting FP32 mantissa
-  uint16_t h_mant = (uint16_t)(f_mant >> lsb_pos);
+    // Check whether we need to round
+    uint32_t halfway = 1 << (lsb_pos - 1);
+    uint32_t mask = (halfway << 1) - 1;
+    switch (rounding_mode) {
+        case CL_HALF_RTE:
+            if ((f_mant & mask) > halfway) {
+                // More than halfway -> round up
+                h_mant += 1;
+            } else if ((f_mant & mask) == halfway) {
+                // Exactly halfway -> round to nearest even
+                if (h_mant & 0x1)
+                    h_mant += 1;
+            }
+            break;
+        case CL_HALF_RTZ:
+            // Mantissa has already been truncated -> do nothing
+            break;
+        case CL_HALF_RTP:
+            if ((f_mant & mask) && !sign) {
+                // Round positive numbers up
+                h_mant += 1;
+            }
+            break;
+        case CL_HALF_RTN:
+            if ((f_mant & mask) && sign) {
+                // Round negative numbers down
+                h_mant += 1;
+            }
+            break;
+    }
 
-  // Check whether we need to round
-  uint32_t halfway = 1 << (lsb_pos - 1);
-  uint32_t mask = (halfway << 1) - 1;
-  switch (rounding_mode)
-  {
-    case CL_HALF_RTE:
-      if ((f_mant & mask) > halfway)
-      {
-        // More than halfway -> round up
-        h_mant += 1;
-      }
-      else if ((f_mant & mask) == halfway)
-      {
-        // Exactly halfway -> round to nearest even
-        if (h_mant & 0x1)
-          h_mant += 1;
-      }
-      break;
-    case CL_HALF_RTZ:
-      // Mantissa has already been truncated -> do nothing
-      break;
-    case CL_HALF_RTP:
-      if ((f_mant & mask) && !sign)
-      {
-        // Round positive numbers up
-        h_mant += 1;
-      }
-      break;
-    case CL_HALF_RTN:
-      if ((f_mant & mask) && sign)
-      {
-        // Round negative numbers down
-        h_mant += 1;
-      }
-      break;
-  }
+    // Check for mantissa overflow
+    if (h_mant & 0x400) {
+        h_exp += 1;
+        h_mant = 0;
+    }
 
-  // Check for mantissa overflow
-  if (h_mant & 0x400)
-  {
-    h_exp += 1;
-    h_mant = 0;
-  }
-
-  return (sign << 15) | (h_exp << 10) | h_mant;
+    return (sign << 15) | (h_exp << 10) | h_mant;
 }
 
 
 /**
  * Convert a cl_double to a cl_half.
  */
-static inline cl_half cl_half_from_double(cl_double d, cl_half_rounding_mode rounding_mode)
-{
-  // Type-punning to get direct access to underlying bits
-  union
-  {
-    cl_double d;
-    uint64_t i;
-  } f64;
-  f64.d = d;
+static inline cl_half cl_half_from_double(cl_double d, cl_half_rounding_mode rounding_mode) {
+    // Type-punning to get direct access to underlying bits
+    union {
+        cl_double d;
+        uint64_t i;
+    } f64;
+    f64.d = d;
 
-  // Extract sign bit
-  uint16_t sign = f64.i >> 63;
+    // Extract sign bit
+    uint16_t sign = f64.i >> 63;
 
-  // Extract FP64 exponent and mantissa
-  uint64_t d_exp = (f64.i >> (CL_DBL_MANT_DIG - 1)) & 0x7FF;
-  uint64_t d_mant = f64.i & (((uint64_t)1 << (CL_DBL_MANT_DIG - 1)) - 1);
+    // Extract FP64 exponent and mantissa
+    uint64_t d_exp = (f64.i >> (CL_DBL_MANT_DIG - 1)) & 0x7FF;
+    uint64_t d_mant = f64.i & (((uint64_t)1 << (CL_DBL_MANT_DIG - 1)) - 1);
 
-  // Remove FP64 exponent bias
-  int64_t exp = d_exp - CL_DBL_MAX_EXP + 1;
+    // Remove FP64 exponent bias
+    int64_t exp = d_exp - CL_DBL_MAX_EXP + 1;
 
-  // Add FP16 exponent bias
-  uint16_t h_exp = (uint16_t)(exp + CL_HALF_MAX_EXP - 1);
+    // Add FP16 exponent bias
+    uint16_t h_exp = (uint16_t)(exp + CL_HALF_MAX_EXP - 1);
 
-  // Position of the bit that will become the FP16 mantissa LSB
-  uint32_t lsb_pos = CL_DBL_MANT_DIG - CL_HALF_MANT_DIG;
+    // Position of the bit that will become the FP16 mantissa LSB
+    uint32_t lsb_pos = CL_DBL_MANT_DIG - CL_HALF_MANT_DIG;
 
-  // Check for NaN / infinity
-  if (d_exp == 0x7FF)
-  {
-    if (d_mant)
-    {
-      // NaN -> propagate mantissa and silence it
-      uint16_t h_mant = (uint16_t)(d_mant >> lsb_pos);
-      h_mant |= 0x200;
-      return (sign << 15) | CL_HALF_EXP_MASK | h_mant;
+    // Check for NaN / infinity
+    if (d_exp == 0x7FF) {
+        if (d_mant) {
+            // NaN -> propagate mantissa and silence it
+            uint16_t h_mant = (uint16_t)(d_mant >> lsb_pos);
+            h_mant |= 0x200;
+            return (sign << 15) | CL_HALF_EXP_MASK | h_mant;
+        } else {
+            // Infinity -> zero mantissa
+            return (sign << 15) | CL_HALF_EXP_MASK;
+        }
     }
-    else
-    {
-      // Infinity -> zero mantissa
-      return (sign << 15) | CL_HALF_EXP_MASK;
+
+    // Check for zero
+    if (!d_exp && !d_mant) {
+        return (sign << 15);
     }
-  }
 
-  // Check for zero
-  if (!d_exp && !d_mant)
-  {
-    return (sign << 15);
-  }
+    // Check for overflow
+    if (exp >= CL_HALF_MAX_EXP) {
+        return cl_half_handle_overflow(rounding_mode, sign);
+    }
 
-  // Check for overflow
-  if (exp >= CL_HALF_MAX_EXP)
-  {
-    return cl_half_handle_overflow(rounding_mode, sign);
-  }
+    // Check for underflow
+    if (exp < (CL_HALF_MIN_EXP - CL_HALF_MANT_DIG - 1)) {
+        return cl_half_handle_underflow(rounding_mode, sign);
+    }
 
-  // Check for underflow
-  if (exp < (CL_HALF_MIN_EXP - CL_HALF_MANT_DIG - 1))
-  {
-    return cl_half_handle_underflow(rounding_mode, sign);
-  }
+    // Check for value that will become denormal
+    if (exp < -14) {
+        // Include the implicit 1 from the FP64 mantissa
+        h_exp = 0;
+        d_mant |= (uint64_t)1 << (CL_DBL_MANT_DIG - 1);
 
-  // Check for value that will become denormal
-  if (exp < -14)
-  {
-    // Include the implicit 1 from the FP64 mantissa
-    h_exp = 0;
-    d_mant |= (uint64_t)1 << (CL_DBL_MANT_DIG - 1);
+        // Mantissa shift amount depends on exponent
+        lsb_pos = (uint32_t)(-exp + (CL_DBL_MANT_DIG - 25));
+    }
 
-    // Mantissa shift amount depends on exponent
-    lsb_pos = (uint32_t)(-exp + (CL_DBL_MANT_DIG - 25));
-  }
+    // Generate FP16 mantissa by shifting FP64 mantissa
+    uint16_t h_mant = (uint16_t)(d_mant >> lsb_pos);
 
-  // Generate FP16 mantissa by shifting FP64 mantissa
-  uint16_t h_mant = (uint16_t)(d_mant >> lsb_pos);
+    // Check whether we need to round
+    uint64_t halfway = (uint64_t)1 << (lsb_pos - 1);
+    uint64_t mask = (halfway << 1) - 1;
+    switch (rounding_mode) {
+        case CL_HALF_RTE:
+            if ((d_mant & mask) > halfway) {
+                // More than halfway -> round up
+                h_mant += 1;
+            } else if ((d_mant & mask) == halfway) {
+                // Exactly halfway -> round to nearest even
+                if (h_mant & 0x1)
+                    h_mant += 1;
+            }
+            break;
+        case CL_HALF_RTZ:
+            // Mantissa has already been truncated -> do nothing
+            break;
+        case CL_HALF_RTP:
+            if ((d_mant & mask) && !sign) {
+                // Round positive numbers up
+                h_mant += 1;
+            }
+            break;
+        case CL_HALF_RTN:
+            if ((d_mant & mask) && sign) {
+                // Round negative numbers down
+                h_mant += 1;
+            }
+            break;
+    }
 
-  // Check whether we need to round
-  uint64_t halfway = (uint64_t)1 << (lsb_pos - 1);
-  uint64_t mask = (halfway << 1) - 1;
-  switch (rounding_mode)
-  {
-    case CL_HALF_RTE:
-      if ((d_mant & mask) > halfway)
-      {
-        // More than halfway -> round up
-        h_mant += 1;
-      }
-      else if ((d_mant & mask) == halfway)
-      {
-        // Exactly halfway -> round to nearest even
-        if (h_mant & 0x1)
-          h_mant += 1;
-      }
-      break;
-    case CL_HALF_RTZ:
-      // Mantissa has already been truncated -> do nothing
-      break;
-    case CL_HALF_RTP:
-      if ((d_mant & mask) && !sign)
-      {
-        // Round positive numbers up
-        h_mant += 1;
-      }
-      break;
-    case CL_HALF_RTN:
-      if ((d_mant & mask) && sign)
-      {
-        // Round negative numbers down
-        h_mant += 1;
-      }
-      break;
-  }
+    // Check for mantissa overflow
+    if (h_mant & 0x400) {
+        h_exp += 1;
+        h_mant = 0;
+    }
 
-  // Check for mantissa overflow
-  if (h_mant & 0x400)
-  {
-    h_exp += 1;
-    h_mant = 0;
-  }
-
-  return (sign << 15) | (h_exp << 10) | h_mant;
+    return (sign << 15) | (h_exp << 10) | h_mant;
 }
 
 
 /**
  * Convert a cl_half to a cl_float.
  */
-static inline cl_float cl_half_to_float(cl_half h)
-{
-  // Type-punning to get direct access to underlying bits
-  union
-  {
-    cl_float f;
-    uint32_t i;
-  } f32;
+static inline cl_float cl_half_to_float(cl_half h) {
+    // Type-punning to get direct access to underlying bits
+    union {
+        cl_float f;
+        uint32_t i;
+    } f32;
 
-  // Extract sign bit
-  uint16_t sign = h >> 15;
+    // Extract sign bit
+    uint16_t sign = h >> 15;
 
-  // Extract FP16 exponent and mantissa
-  uint16_t h_exp = (h >> (CL_HALF_MANT_DIG - 1)) & 0x1F;
-  uint16_t h_mant = h & 0x3FF;
+    // Extract FP16 exponent and mantissa
+    uint16_t h_exp = (h >> (CL_HALF_MANT_DIG - 1)) & 0x1F;
+    uint16_t h_mant = h & 0x3FF;
 
-  // Remove FP16 exponent bias
-  int32_t exp = h_exp - CL_HALF_MAX_EXP + 1;
+    // Remove FP16 exponent bias
+    int32_t exp = h_exp - CL_HALF_MAX_EXP + 1;
 
-  // Add FP32 exponent bias
-  uint32_t f_exp = exp + CL_FLT_MAX_EXP - 1;
+    // Add FP32 exponent bias
+    uint32_t f_exp = exp + CL_FLT_MAX_EXP - 1;
 
-  // Check for NaN / infinity
-  if (h_exp == 0x1F)
-  {
-    if (h_mant)
-    {
-      // NaN -> propagate mantissa and silence it
-      uint32_t f_mant = h_mant << (CL_FLT_MANT_DIG - CL_HALF_MANT_DIG);
-      f_mant |= 0x400000;
-      f32.i = (sign << 31) | 0x7F800000 | f_mant;
-      return f32.f;
+    // Check for NaN / infinity
+    if (h_exp == 0x1F) {
+        if (h_mant) {
+            // NaN -> propagate mantissa and silence it
+            uint32_t f_mant = h_mant << (CL_FLT_MANT_DIG - CL_HALF_MANT_DIG);
+            f_mant |= 0x400000;
+            f32.i = (sign << 31) | 0x7F800000 | f_mant;
+            return f32.f;
+        } else {
+            // Infinity -> zero mantissa
+            f32.i = (sign << 31) | 0x7F800000;
+            return f32.f;
+        }
     }
-    else
-    {
-      // Infinity -> zero mantissa
-      f32.i = (sign << 31) | 0x7F800000;
-      return f32.f;
-    }
-  }
 
-  // Check for zero / denormal
-  if (h_exp == 0)
-  {
-    if (h_mant == 0)
-    {
-      // Zero -> zero exponent
-      f_exp = 0;
+    // Check for zero / denormal
+    if (h_exp == 0) {
+        if (h_mant == 0) {
+            // Zero -> zero exponent
+            f_exp = 0;
+        } else {
+            // Denormal -> normalize it
+            // - Shift mantissa to make most-significant 1 implicit
+            // - Adjust exponent accordingly
+            uint32_t shift = 0;
+            while ((h_mant & 0x400) == 0) {
+                h_mant <<= 1;
+                shift++;
+            }
+            h_mant &= 0x3FF;
+            f_exp -= shift - 1;
+        }
     }
-    else
-    {
-      // Denormal -> normalize it
-      // - Shift mantissa to make most-significant 1 implicit
-      // - Adjust exponent accordingly
-      uint32_t shift = 0;
-      while ((h_mant & 0x400) == 0)
-      {
-        h_mant <<= 1;
-        shift++;
-      }
-      h_mant &= 0x3FF;
-      f_exp -= shift - 1;
-    }
-  }
 
-  f32.i = (sign << 31) | (f_exp << 23) | (h_mant << 13);
-  return f32.f;
+    f32.i = (sign << 31) | (f_exp << 23) | (h_mant << 13);
+    return f32.f;
 }
 
 
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_icd.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_icd.h
index 8ff8b94f9..1c9fb3b8a 100644
--- a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_icd.h
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_icd.h
@@ -163,10 +163,10 @@ typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateImageWithProperties)(
     const cl_image_format *image_format, const cl_image_desc *image_desc,
     void *host_ptr, cl_int *errcode_ret) CL_API_SUFFIX__VERSION_3_0;
 
-typedef CL_API_ENTRY cl_int(CL_API_CALL* cl_api_clSetContextDestructorCallback)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clSetContextDestructorCallback)(
     cl_context context,
-    void(CL_CALLBACK* pfn_notify)(cl_context context, void* user_data),
-    void* user_data) CL_API_SUFFIX__VERSION_3_0;
+    void(CL_CALLBACK *pfn_notify)(cl_context context, void *user_data),
+    void *user_data) CL_API_SUFFIX__VERSION_3_0;
 
 #else
 
@@ -428,10 +428,10 @@ typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetEventInfo)(
     void *param_value, size_t *param_value_size_ret) CL_API_SUFFIX__VERSION_1_0;
 
 typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clRetainEvent)(cl_event event)
-    CL_API_SUFFIX__VERSION_1_0;
+CL_API_SUFFIX__VERSION_1_0;
 
 typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clReleaseEvent)(cl_event event)
-    CL_API_SUFFIX__VERSION_1_0;
+CL_API_SUFFIX__VERSION_1_0;
 
 // Profiling APIs
 typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clGetEventProfilingInfo)(
@@ -637,8 +637,8 @@ typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueBarrierWithWaitList)(
 
 typedef CL_API_ENTRY void *(
     CL_API_CALL *cl_api_clGetExtensionFunctionAddressForPlatform)(
-    cl_platform_id platform,
-    const char *function_name)CL_API_SUFFIX__VERSION_1_2;
+        cl_platform_id platform,
+        const char *function_name)CL_API_SUFFIX__VERSION_1_2;
 
 #else
 
@@ -704,7 +704,7 @@ typedef void *cl_api_clEnqueueSVMUnmap;
 typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clSetCommandQueueProperty)(
     cl_command_queue command_queue, cl_command_queue_properties properties,
     cl_bool enable, cl_command_queue_properties *old_properties)
-    CL_EXT_SUFFIX__VERSION_1_0_DEPRECATED;
+CL_EXT_SUFFIX__VERSION_1_0_DEPRECATED;
 
 typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateImage2D)(
     cl_context context, cl_mem_flags flags, const cl_image_format *image_format,
@@ -718,7 +718,7 @@ typedef CL_API_ENTRY cl_mem(CL_API_CALL *cl_api_clCreateImage3D)(
     cl_int *errcode_ret) CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
 
 typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clUnloadCompiler)(void)
-    CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
+CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED;
 
 typedef CL_API_ENTRY cl_int(CL_API_CALL *cl_api_clEnqueueMarker)(
     cl_command_queue command_queue,
@@ -1102,188 +1102,188 @@ typedef void *cl_api_clGetHostTimer;
 /* Vendor dispatch table struture */
 
 typedef struct _cl_icd_dispatch {
-  /* OpenCL 1.0 */
-  cl_api_clGetPlatformIDs clGetPlatformIDs;
-  cl_api_clGetPlatformInfo clGetPlatformInfo;
-  cl_api_clGetDeviceIDs clGetDeviceIDs;
-  cl_api_clGetDeviceInfo clGetDeviceInfo;
-  cl_api_clCreateContext clCreateContext;
-  cl_api_clCreateContextFromType clCreateContextFromType;
-  cl_api_clRetainContext clRetainContext;
-  cl_api_clReleaseContext clReleaseContext;
-  cl_api_clGetContextInfo clGetContextInfo;
-  cl_api_clCreateCommandQueue clCreateCommandQueue;
-  cl_api_clRetainCommandQueue clRetainCommandQueue;
-  cl_api_clReleaseCommandQueue clReleaseCommandQueue;
-  cl_api_clGetCommandQueueInfo clGetCommandQueueInfo;
-  cl_api_clSetCommandQueueProperty clSetCommandQueueProperty;
-  cl_api_clCreateBuffer clCreateBuffer;
-  cl_api_clCreateImage2D clCreateImage2D;
-  cl_api_clCreateImage3D clCreateImage3D;
-  cl_api_clRetainMemObject clRetainMemObject;
-  cl_api_clReleaseMemObject clReleaseMemObject;
-  cl_api_clGetSupportedImageFormats clGetSupportedImageFormats;
-  cl_api_clGetMemObjectInfo clGetMemObjectInfo;
-  cl_api_clGetImageInfo clGetImageInfo;
-  cl_api_clCreateSampler clCreateSampler;
-  cl_api_clRetainSampler clRetainSampler;
-  cl_api_clReleaseSampler clReleaseSampler;
-  cl_api_clGetSamplerInfo clGetSamplerInfo;
-  cl_api_clCreateProgramWithSource clCreateProgramWithSource;
-  cl_api_clCreateProgramWithBinary clCreateProgramWithBinary;
-  cl_api_clRetainProgram clRetainProgram;
-  cl_api_clReleaseProgram clReleaseProgram;
-  cl_api_clBuildProgram clBuildProgram;
-  cl_api_clUnloadCompiler clUnloadCompiler;
-  cl_api_clGetProgramInfo clGetProgramInfo;
-  cl_api_clGetProgramBuildInfo clGetProgramBuildInfo;
-  cl_api_clCreateKernel clCreateKernel;
-  cl_api_clCreateKernelsInProgram clCreateKernelsInProgram;
-  cl_api_clRetainKernel clRetainKernel;
-  cl_api_clReleaseKernel clReleaseKernel;
-  cl_api_clSetKernelArg clSetKernelArg;
-  cl_api_clGetKernelInfo clGetKernelInfo;
-  cl_api_clGetKernelWorkGroupInfo clGetKernelWorkGroupInfo;
-  cl_api_clWaitForEvents clWaitForEvents;
-  cl_api_clGetEventInfo clGetEventInfo;
-  cl_api_clRetainEvent clRetainEvent;
-  cl_api_clReleaseEvent clReleaseEvent;
-  cl_api_clGetEventProfilingInfo clGetEventProfilingInfo;
-  cl_api_clFlush clFlush;
-  cl_api_clFinish clFinish;
-  cl_api_clEnqueueReadBuffer clEnqueueReadBuffer;
-  cl_api_clEnqueueWriteBuffer clEnqueueWriteBuffer;
-  cl_api_clEnqueueCopyBuffer clEnqueueCopyBuffer;
-  cl_api_clEnqueueReadImage clEnqueueReadImage;
-  cl_api_clEnqueueWriteImage clEnqueueWriteImage;
-  cl_api_clEnqueueCopyImage clEnqueueCopyImage;
-  cl_api_clEnqueueCopyImageToBuffer clEnqueueCopyImageToBuffer;
-  cl_api_clEnqueueCopyBufferToImage clEnqueueCopyBufferToImage;
-  cl_api_clEnqueueMapBuffer clEnqueueMapBuffer;
-  cl_api_clEnqueueMapImage clEnqueueMapImage;
-  cl_api_clEnqueueUnmapMemObject clEnqueueUnmapMemObject;
-  cl_api_clEnqueueNDRangeKernel clEnqueueNDRangeKernel;
-  cl_api_clEnqueueTask clEnqueueTask;
-  cl_api_clEnqueueNativeKernel clEnqueueNativeKernel;
-  cl_api_clEnqueueMarker clEnqueueMarker;
-  cl_api_clEnqueueWaitForEvents clEnqueueWaitForEvents;
-  cl_api_clEnqueueBarrier clEnqueueBarrier;
-  cl_api_clGetExtensionFunctionAddress clGetExtensionFunctionAddress;
-  cl_api_clCreateFromGLBuffer clCreateFromGLBuffer;
-  cl_api_clCreateFromGLTexture2D clCreateFromGLTexture2D;
-  cl_api_clCreateFromGLTexture3D clCreateFromGLTexture3D;
-  cl_api_clCreateFromGLRenderbuffer clCreateFromGLRenderbuffer;
-  cl_api_clGetGLObjectInfo clGetGLObjectInfo;
-  cl_api_clGetGLTextureInfo clGetGLTextureInfo;
-  cl_api_clEnqueueAcquireGLObjects clEnqueueAcquireGLObjects;
-  cl_api_clEnqueueReleaseGLObjects clEnqueueReleaseGLObjects;
-  cl_api_clGetGLContextInfoKHR clGetGLContextInfoKHR;
+    /* OpenCL 1.0 */
+    cl_api_clGetPlatformIDs clGetPlatformIDs;
+    cl_api_clGetPlatformInfo clGetPlatformInfo;
+    cl_api_clGetDeviceIDs clGetDeviceIDs;
+    cl_api_clGetDeviceInfo clGetDeviceInfo;
+    cl_api_clCreateContext clCreateContext;
+    cl_api_clCreateContextFromType clCreateContextFromType;
+    cl_api_clRetainContext clRetainContext;
+    cl_api_clReleaseContext clReleaseContext;
+    cl_api_clGetContextInfo clGetContextInfo;
+    cl_api_clCreateCommandQueue clCreateCommandQueue;
+    cl_api_clRetainCommandQueue clRetainCommandQueue;
+    cl_api_clReleaseCommandQueue clReleaseCommandQueue;
+    cl_api_clGetCommandQueueInfo clGetCommandQueueInfo;
+    cl_api_clSetCommandQueueProperty clSetCommandQueueProperty;
+    cl_api_clCreateBuffer clCreateBuffer;
+    cl_api_clCreateImage2D clCreateImage2D;
+    cl_api_clCreateImage3D clCreateImage3D;
+    cl_api_clRetainMemObject clRetainMemObject;
+    cl_api_clReleaseMemObject clReleaseMemObject;
+    cl_api_clGetSupportedImageFormats clGetSupportedImageFormats;
+    cl_api_clGetMemObjectInfo clGetMemObjectInfo;
+    cl_api_clGetImageInfo clGetImageInfo;
+    cl_api_clCreateSampler clCreateSampler;
+    cl_api_clRetainSampler clRetainSampler;
+    cl_api_clReleaseSampler clReleaseSampler;
+    cl_api_clGetSamplerInfo clGetSamplerInfo;
+    cl_api_clCreateProgramWithSource clCreateProgramWithSource;
+    cl_api_clCreateProgramWithBinary clCreateProgramWithBinary;
+    cl_api_clRetainProgram clRetainProgram;
+    cl_api_clReleaseProgram clReleaseProgram;
+    cl_api_clBuildProgram clBuildProgram;
+    cl_api_clUnloadCompiler clUnloadCompiler;
+    cl_api_clGetProgramInfo clGetProgramInfo;
+    cl_api_clGetProgramBuildInfo clGetProgramBuildInfo;
+    cl_api_clCreateKernel clCreateKernel;
+    cl_api_clCreateKernelsInProgram clCreateKernelsInProgram;
+    cl_api_clRetainKernel clRetainKernel;
+    cl_api_clReleaseKernel clReleaseKernel;
+    cl_api_clSetKernelArg clSetKernelArg;
+    cl_api_clGetKernelInfo clGetKernelInfo;
+    cl_api_clGetKernelWorkGroupInfo clGetKernelWorkGroupInfo;
+    cl_api_clWaitForEvents clWaitForEvents;
+    cl_api_clGetEventInfo clGetEventInfo;
+    cl_api_clRetainEvent clRetainEvent;
+    cl_api_clReleaseEvent clReleaseEvent;
+    cl_api_clGetEventProfilingInfo clGetEventProfilingInfo;
+    cl_api_clFlush clFlush;
+    cl_api_clFinish clFinish;
+    cl_api_clEnqueueReadBuffer clEnqueueReadBuffer;
+    cl_api_clEnqueueWriteBuffer clEnqueueWriteBuffer;
+    cl_api_clEnqueueCopyBuffer clEnqueueCopyBuffer;
+    cl_api_clEnqueueReadImage clEnqueueReadImage;
+    cl_api_clEnqueueWriteImage clEnqueueWriteImage;
+    cl_api_clEnqueueCopyImage clEnqueueCopyImage;
+    cl_api_clEnqueueCopyImageToBuffer clEnqueueCopyImageToBuffer;
+    cl_api_clEnqueueCopyBufferToImage clEnqueueCopyBufferToImage;
+    cl_api_clEnqueueMapBuffer clEnqueueMapBuffer;
+    cl_api_clEnqueueMapImage clEnqueueMapImage;
+    cl_api_clEnqueueUnmapMemObject clEnqueueUnmapMemObject;
+    cl_api_clEnqueueNDRangeKernel clEnqueueNDRangeKernel;
+    cl_api_clEnqueueTask clEnqueueTask;
+    cl_api_clEnqueueNativeKernel clEnqueueNativeKernel;
+    cl_api_clEnqueueMarker clEnqueueMarker;
+    cl_api_clEnqueueWaitForEvents clEnqueueWaitForEvents;
+    cl_api_clEnqueueBarrier clEnqueueBarrier;
+    cl_api_clGetExtensionFunctionAddress clGetExtensionFunctionAddress;
+    cl_api_clCreateFromGLBuffer clCreateFromGLBuffer;
+    cl_api_clCreateFromGLTexture2D clCreateFromGLTexture2D;
+    cl_api_clCreateFromGLTexture3D clCreateFromGLTexture3D;
+    cl_api_clCreateFromGLRenderbuffer clCreateFromGLRenderbuffer;
+    cl_api_clGetGLObjectInfo clGetGLObjectInfo;
+    cl_api_clGetGLTextureInfo clGetGLTextureInfo;
+    cl_api_clEnqueueAcquireGLObjects clEnqueueAcquireGLObjects;
+    cl_api_clEnqueueReleaseGLObjects clEnqueueReleaseGLObjects;
+    cl_api_clGetGLContextInfoKHR clGetGLContextInfoKHR;
 
-  /* cl_khr_d3d10_sharing */
-  cl_api_clGetDeviceIDsFromD3D10KHR clGetDeviceIDsFromD3D10KHR;
-  cl_api_clCreateFromD3D10BufferKHR clCreateFromD3D10BufferKHR;
-  cl_api_clCreateFromD3D10Texture2DKHR clCreateFromD3D10Texture2DKHR;
-  cl_api_clCreateFromD3D10Texture3DKHR clCreateFromD3D10Texture3DKHR;
-  cl_api_clEnqueueAcquireD3D10ObjectsKHR clEnqueueAcquireD3D10ObjectsKHR;
-  cl_api_clEnqueueReleaseD3D10ObjectsKHR clEnqueueReleaseD3D10ObjectsKHR;
+    /* cl_khr_d3d10_sharing */
+    cl_api_clGetDeviceIDsFromD3D10KHR clGetDeviceIDsFromD3D10KHR;
+    cl_api_clCreateFromD3D10BufferKHR clCreateFromD3D10BufferKHR;
+    cl_api_clCreateFromD3D10Texture2DKHR clCreateFromD3D10Texture2DKHR;
+    cl_api_clCreateFromD3D10Texture3DKHR clCreateFromD3D10Texture3DKHR;
+    cl_api_clEnqueueAcquireD3D10ObjectsKHR clEnqueueAcquireD3D10ObjectsKHR;
+    cl_api_clEnqueueReleaseD3D10ObjectsKHR clEnqueueReleaseD3D10ObjectsKHR;
 
-  /* OpenCL 1.1 */
-  cl_api_clSetEventCallback clSetEventCallback;
-  cl_api_clCreateSubBuffer clCreateSubBuffer;
-  cl_api_clSetMemObjectDestructorCallback clSetMemObjectDestructorCallback;
-  cl_api_clCreateUserEvent clCreateUserEvent;
-  cl_api_clSetUserEventStatus clSetUserEventStatus;
-  cl_api_clEnqueueReadBufferRect clEnqueueReadBufferRect;
-  cl_api_clEnqueueWriteBufferRect clEnqueueWriteBufferRect;
-  cl_api_clEnqueueCopyBufferRect clEnqueueCopyBufferRect;
+    /* OpenCL 1.1 */
+    cl_api_clSetEventCallback clSetEventCallback;
+    cl_api_clCreateSubBuffer clCreateSubBuffer;
+    cl_api_clSetMemObjectDestructorCallback clSetMemObjectDestructorCallback;
+    cl_api_clCreateUserEvent clCreateUserEvent;
+    cl_api_clSetUserEventStatus clSetUserEventStatus;
+    cl_api_clEnqueueReadBufferRect clEnqueueReadBufferRect;
+    cl_api_clEnqueueWriteBufferRect clEnqueueWriteBufferRect;
+    cl_api_clEnqueueCopyBufferRect clEnqueueCopyBufferRect;
 
-  /* cl_ext_device_fission */
-  cl_api_clCreateSubDevicesEXT clCreateSubDevicesEXT;
-  cl_api_clRetainDeviceEXT clRetainDeviceEXT;
-  cl_api_clReleaseDeviceEXT clReleaseDeviceEXT;
+    /* cl_ext_device_fission */
+    cl_api_clCreateSubDevicesEXT clCreateSubDevicesEXT;
+    cl_api_clRetainDeviceEXT clRetainDeviceEXT;
+    cl_api_clReleaseDeviceEXT clReleaseDeviceEXT;
 
-  /* cl_khr_gl_event */
-  cl_api_clCreateEventFromGLsyncKHR clCreateEventFromGLsyncKHR;
+    /* cl_khr_gl_event */
+    cl_api_clCreateEventFromGLsyncKHR clCreateEventFromGLsyncKHR;
 
-  /* OpenCL 1.2 */
-  cl_api_clCreateSubDevices clCreateSubDevices;
-  cl_api_clRetainDevice clRetainDevice;
-  cl_api_clReleaseDevice clReleaseDevice;
-  cl_api_clCreateImage clCreateImage;
-  cl_api_clCreateProgramWithBuiltInKernels clCreateProgramWithBuiltInKernels;
-  cl_api_clCompileProgram clCompileProgram;
-  cl_api_clLinkProgram clLinkProgram;
-  cl_api_clUnloadPlatformCompiler clUnloadPlatformCompiler;
-  cl_api_clGetKernelArgInfo clGetKernelArgInfo;
-  cl_api_clEnqueueFillBuffer clEnqueueFillBuffer;
-  cl_api_clEnqueueFillImage clEnqueueFillImage;
-  cl_api_clEnqueueMigrateMemObjects clEnqueueMigrateMemObjects;
-  cl_api_clEnqueueMarkerWithWaitList clEnqueueMarkerWithWaitList;
-  cl_api_clEnqueueBarrierWithWaitList clEnqueueBarrierWithWaitList;
-  cl_api_clGetExtensionFunctionAddressForPlatform
-      clGetExtensionFunctionAddressForPlatform;
-  cl_api_clCreateFromGLTexture clCreateFromGLTexture;
+    /* OpenCL 1.2 */
+    cl_api_clCreateSubDevices clCreateSubDevices;
+    cl_api_clRetainDevice clRetainDevice;
+    cl_api_clReleaseDevice clReleaseDevice;
+    cl_api_clCreateImage clCreateImage;
+    cl_api_clCreateProgramWithBuiltInKernels clCreateProgramWithBuiltInKernels;
+    cl_api_clCompileProgram clCompileProgram;
+    cl_api_clLinkProgram clLinkProgram;
+    cl_api_clUnloadPlatformCompiler clUnloadPlatformCompiler;
+    cl_api_clGetKernelArgInfo clGetKernelArgInfo;
+    cl_api_clEnqueueFillBuffer clEnqueueFillBuffer;
+    cl_api_clEnqueueFillImage clEnqueueFillImage;
+    cl_api_clEnqueueMigrateMemObjects clEnqueueMigrateMemObjects;
+    cl_api_clEnqueueMarkerWithWaitList clEnqueueMarkerWithWaitList;
+    cl_api_clEnqueueBarrierWithWaitList clEnqueueBarrierWithWaitList;
+    cl_api_clGetExtensionFunctionAddressForPlatform
+    clGetExtensionFunctionAddressForPlatform;
+    cl_api_clCreateFromGLTexture clCreateFromGLTexture;
 
-  /* cl_khr_d3d11_sharing */
-  cl_api_clGetDeviceIDsFromD3D11KHR clGetDeviceIDsFromD3D11KHR;
-  cl_api_clCreateFromD3D11BufferKHR clCreateFromD3D11BufferKHR;
-  cl_api_clCreateFromD3D11Texture2DKHR clCreateFromD3D11Texture2DKHR;
-  cl_api_clCreateFromD3D11Texture3DKHR clCreateFromD3D11Texture3DKHR;
-  cl_api_clCreateFromDX9MediaSurfaceKHR clCreateFromDX9MediaSurfaceKHR;
-  cl_api_clEnqueueAcquireD3D11ObjectsKHR clEnqueueAcquireD3D11ObjectsKHR;
-  cl_api_clEnqueueReleaseD3D11ObjectsKHR clEnqueueReleaseD3D11ObjectsKHR;
+    /* cl_khr_d3d11_sharing */
+    cl_api_clGetDeviceIDsFromD3D11KHR clGetDeviceIDsFromD3D11KHR;
+    cl_api_clCreateFromD3D11BufferKHR clCreateFromD3D11BufferKHR;
+    cl_api_clCreateFromD3D11Texture2DKHR clCreateFromD3D11Texture2DKHR;
+    cl_api_clCreateFromD3D11Texture3DKHR clCreateFromD3D11Texture3DKHR;
+    cl_api_clCreateFromDX9MediaSurfaceKHR clCreateFromDX9MediaSurfaceKHR;
+    cl_api_clEnqueueAcquireD3D11ObjectsKHR clEnqueueAcquireD3D11ObjectsKHR;
+    cl_api_clEnqueueReleaseD3D11ObjectsKHR clEnqueueReleaseD3D11ObjectsKHR;
 
-  /* cl_khr_dx9_media_sharing */
-  cl_api_clGetDeviceIDsFromDX9MediaAdapterKHR
-      clGetDeviceIDsFromDX9MediaAdapterKHR;
-  cl_api_clEnqueueAcquireDX9MediaSurfacesKHR
-      clEnqueueAcquireDX9MediaSurfacesKHR;
-  cl_api_clEnqueueReleaseDX9MediaSurfacesKHR
-      clEnqueueReleaseDX9MediaSurfacesKHR;
+    /* cl_khr_dx9_media_sharing */
+    cl_api_clGetDeviceIDsFromDX9MediaAdapterKHR
+    clGetDeviceIDsFromDX9MediaAdapterKHR;
+    cl_api_clEnqueueAcquireDX9MediaSurfacesKHR
+    clEnqueueAcquireDX9MediaSurfacesKHR;
+    cl_api_clEnqueueReleaseDX9MediaSurfacesKHR
+    clEnqueueReleaseDX9MediaSurfacesKHR;
 
-  /* cl_khr_egl_image */
-  cl_api_clCreateFromEGLImageKHR clCreateFromEGLImageKHR;
-  cl_api_clEnqueueAcquireEGLObjectsKHR clEnqueueAcquireEGLObjectsKHR;
-  cl_api_clEnqueueReleaseEGLObjectsKHR clEnqueueReleaseEGLObjectsKHR;
+    /* cl_khr_egl_image */
+    cl_api_clCreateFromEGLImageKHR clCreateFromEGLImageKHR;
+    cl_api_clEnqueueAcquireEGLObjectsKHR clEnqueueAcquireEGLObjectsKHR;
+    cl_api_clEnqueueReleaseEGLObjectsKHR clEnqueueReleaseEGLObjectsKHR;
 
-  /* cl_khr_egl_event */
-  cl_api_clCreateEventFromEGLSyncKHR clCreateEventFromEGLSyncKHR;
+    /* cl_khr_egl_event */
+    cl_api_clCreateEventFromEGLSyncKHR clCreateEventFromEGLSyncKHR;
 
-  /* OpenCL 2.0 */
-  cl_api_clCreateCommandQueueWithProperties clCreateCommandQueueWithProperties;
-  cl_api_clCreatePipe clCreatePipe;
-  cl_api_clGetPipeInfo clGetPipeInfo;
-  cl_api_clSVMAlloc clSVMAlloc;
-  cl_api_clSVMFree clSVMFree;
-  cl_api_clEnqueueSVMFree clEnqueueSVMFree;
-  cl_api_clEnqueueSVMMemcpy clEnqueueSVMMemcpy;
-  cl_api_clEnqueueSVMMemFill clEnqueueSVMMemFill;
-  cl_api_clEnqueueSVMMap clEnqueueSVMMap;
-  cl_api_clEnqueueSVMUnmap clEnqueueSVMUnmap;
-  cl_api_clCreateSamplerWithProperties clCreateSamplerWithProperties;
-  cl_api_clSetKernelArgSVMPointer clSetKernelArgSVMPointer;
-  cl_api_clSetKernelExecInfo clSetKernelExecInfo;
+    /* OpenCL 2.0 */
+    cl_api_clCreateCommandQueueWithProperties clCreateCommandQueueWithProperties;
+    cl_api_clCreatePipe clCreatePipe;
+    cl_api_clGetPipeInfo clGetPipeInfo;
+    cl_api_clSVMAlloc clSVMAlloc;
+    cl_api_clSVMFree clSVMFree;
+    cl_api_clEnqueueSVMFree clEnqueueSVMFree;
+    cl_api_clEnqueueSVMMemcpy clEnqueueSVMMemcpy;
+    cl_api_clEnqueueSVMMemFill clEnqueueSVMMemFill;
+    cl_api_clEnqueueSVMMap clEnqueueSVMMap;
+    cl_api_clEnqueueSVMUnmap clEnqueueSVMUnmap;
+    cl_api_clCreateSamplerWithProperties clCreateSamplerWithProperties;
+    cl_api_clSetKernelArgSVMPointer clSetKernelArgSVMPointer;
+    cl_api_clSetKernelExecInfo clSetKernelExecInfo;
 
-  /* cl_khr_sub_groups */
-  cl_api_clGetKernelSubGroupInfoKHR clGetKernelSubGroupInfoKHR;
+    /* cl_khr_sub_groups */
+    cl_api_clGetKernelSubGroupInfoKHR clGetKernelSubGroupInfoKHR;
 
-  /* OpenCL 2.1 */
-  cl_api_clCloneKernel clCloneKernel;
-  cl_api_clCreateProgramWithIL clCreateProgramWithIL;
-  cl_api_clEnqueueSVMMigrateMem clEnqueueSVMMigrateMem;
-  cl_api_clGetDeviceAndHostTimer clGetDeviceAndHostTimer;
-  cl_api_clGetHostTimer clGetHostTimer;
-  cl_api_clGetKernelSubGroupInfo clGetKernelSubGroupInfo;
-  cl_api_clSetDefaultDeviceCommandQueue clSetDefaultDeviceCommandQueue;
+    /* OpenCL 2.1 */
+    cl_api_clCloneKernel clCloneKernel;
+    cl_api_clCreateProgramWithIL clCreateProgramWithIL;
+    cl_api_clEnqueueSVMMigrateMem clEnqueueSVMMigrateMem;
+    cl_api_clGetDeviceAndHostTimer clGetDeviceAndHostTimer;
+    cl_api_clGetHostTimer clGetHostTimer;
+    cl_api_clGetKernelSubGroupInfo clGetKernelSubGroupInfo;
+    cl_api_clSetDefaultDeviceCommandQueue clSetDefaultDeviceCommandQueue;
 
-  /* OpenCL 2.2 */
-  cl_api_clSetProgramReleaseCallback clSetProgramReleaseCallback;
-  cl_api_clSetProgramSpecializationConstant clSetProgramSpecializationConstant;
+    /* OpenCL 2.2 */
+    cl_api_clSetProgramReleaseCallback clSetProgramReleaseCallback;
+    cl_api_clSetProgramSpecializationConstant clSetProgramSpecializationConstant;
 
-  /* OpenCL 3.0 */
-  cl_api_clCreateBufferWithProperties clCreateBufferWithProperties;
-  cl_api_clCreateImageWithProperties clCreateImageWithProperties;
-  cl_api_clSetContextDestructorCallback clSetContextDestructorCallback;
+    /* OpenCL 3.0 */
+    cl_api_clCreateBufferWithProperties clCreateBufferWithProperties;
+    cl_api_clCreateImageWithProperties clCreateImageWithProperties;
+    cl_api_clSetContextDestructorCallback clSetContextDestructorCallback;
 
 } cl_icd_dispatch;
 
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_platform.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_platform.h
index 2d69cc4e5..884e49e3e 100644
--- a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_platform.h
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_platform.h
@@ -24,13 +24,13 @@ extern "C" {
 #endif
 
 #if defined(_WIN32)
-    #define CL_API_ENTRY
-    #define CL_API_CALL     __stdcall
-    #define CL_CALLBACK     __stdcall
+#define CL_API_ENTRY
+#define CL_API_CALL     __stdcall
+#define CL_CALLBACK     __stdcall
 #else
-    #define CL_API_ENTRY
-    #define CL_API_CALL
-    #define CL_CALLBACK
+#define CL_API_ENTRY
+#define CL_API_CALL
+#define CL_CALLBACK
 #endif
 
 /*
@@ -61,62 +61,62 @@ extern "C" {
 
 
 #ifdef __GNUC__
-  #define CL_EXT_SUFFIX_DEPRECATED __attribute__((deprecated))
-  #define CL_EXT_PREFIX_DEPRECATED
+#define CL_EXT_SUFFIX_DEPRECATED __attribute__((deprecated))
+#define CL_EXT_PREFIX_DEPRECATED
 #elif defined(_WIN32)
-  #define CL_EXT_SUFFIX_DEPRECATED
-  #define CL_EXT_PREFIX_DEPRECATED __declspec(deprecated)
+#define CL_EXT_SUFFIX_DEPRECATED
+#define CL_EXT_PREFIX_DEPRECATED __declspec(deprecated)
 #else
-  #define CL_EXT_SUFFIX_DEPRECATED
-  #define CL_EXT_PREFIX_DEPRECATED
+#define CL_EXT_SUFFIX_DEPRECATED
+#define CL_EXT_PREFIX_DEPRECATED
 #endif
 
 #ifdef CL_USE_DEPRECATED_OPENCL_1_0_APIS
-    #define CL_EXT_SUFFIX__VERSION_1_0_DEPRECATED
-    #define CL_EXT_PREFIX__VERSION_1_0_DEPRECATED
+#define CL_EXT_SUFFIX__VERSION_1_0_DEPRECATED
+#define CL_EXT_PREFIX__VERSION_1_0_DEPRECATED
 #else
-    #define CL_EXT_SUFFIX__VERSION_1_0_DEPRECATED CL_EXT_SUFFIX_DEPRECATED
-    #define CL_EXT_PREFIX__VERSION_1_0_DEPRECATED CL_EXT_PREFIX_DEPRECATED
+#define CL_EXT_SUFFIX__VERSION_1_0_DEPRECATED CL_EXT_SUFFIX_DEPRECATED
+#define CL_EXT_PREFIX__VERSION_1_0_DEPRECATED CL_EXT_PREFIX_DEPRECATED
 #endif
 
 #ifdef CL_USE_DEPRECATED_OPENCL_1_1_APIS
-    #define CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED
-    #define CL_EXT_PREFIX__VERSION_1_1_DEPRECATED
+#define CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED
+#define CL_EXT_PREFIX__VERSION_1_1_DEPRECATED
 #else
-    #define CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED CL_EXT_SUFFIX_DEPRECATED
-    #define CL_EXT_PREFIX__VERSION_1_1_DEPRECATED CL_EXT_PREFIX_DEPRECATED
+#define CL_EXT_SUFFIX__VERSION_1_1_DEPRECATED CL_EXT_SUFFIX_DEPRECATED
+#define CL_EXT_PREFIX__VERSION_1_1_DEPRECATED CL_EXT_PREFIX_DEPRECATED
 #endif
 
 #ifdef CL_USE_DEPRECATED_OPENCL_1_2_APIS
-    #define CL_EXT_SUFFIX__VERSION_1_2_DEPRECATED
-    #define CL_EXT_PREFIX__VERSION_1_2_DEPRECATED
+#define CL_EXT_SUFFIX__VERSION_1_2_DEPRECATED
+#define CL_EXT_PREFIX__VERSION_1_2_DEPRECATED
 #else
-    #define CL_EXT_SUFFIX__VERSION_1_2_DEPRECATED CL_EXT_SUFFIX_DEPRECATED
-    #define CL_EXT_PREFIX__VERSION_1_2_DEPRECATED CL_EXT_PREFIX_DEPRECATED
- #endif
+#define CL_EXT_SUFFIX__VERSION_1_2_DEPRECATED CL_EXT_SUFFIX_DEPRECATED
+#define CL_EXT_PREFIX__VERSION_1_2_DEPRECATED CL_EXT_PREFIX_DEPRECATED
+#endif
 
 #ifdef CL_USE_DEPRECATED_OPENCL_2_0_APIS
-    #define CL_EXT_SUFFIX__VERSION_2_0_DEPRECATED
-    #define CL_EXT_PREFIX__VERSION_2_0_DEPRECATED
+#define CL_EXT_SUFFIX__VERSION_2_0_DEPRECATED
+#define CL_EXT_PREFIX__VERSION_2_0_DEPRECATED
 #else
-    #define CL_EXT_SUFFIX__VERSION_2_0_DEPRECATED CL_EXT_SUFFIX_DEPRECATED
-    #define CL_EXT_PREFIX__VERSION_2_0_DEPRECATED CL_EXT_PREFIX_DEPRECATED
+#define CL_EXT_SUFFIX__VERSION_2_0_DEPRECATED CL_EXT_SUFFIX_DEPRECATED
+#define CL_EXT_PREFIX__VERSION_2_0_DEPRECATED CL_EXT_PREFIX_DEPRECATED
 #endif
 
 #ifdef CL_USE_DEPRECATED_OPENCL_2_1_APIS
-    #define CL_EXT_SUFFIX__VERSION_2_1_DEPRECATED
-    #define CL_EXT_PREFIX__VERSION_2_1_DEPRECATED
+#define CL_EXT_SUFFIX__VERSION_2_1_DEPRECATED
+#define CL_EXT_PREFIX__VERSION_2_1_DEPRECATED
 #else
-    #define CL_EXT_SUFFIX__VERSION_2_1_DEPRECATED CL_EXT_SUFFIX_DEPRECATED
-    #define CL_EXT_PREFIX__VERSION_2_1_DEPRECATED CL_EXT_PREFIX_DEPRECATED
+#define CL_EXT_SUFFIX__VERSION_2_1_DEPRECATED CL_EXT_SUFFIX_DEPRECATED
+#define CL_EXT_PREFIX__VERSION_2_1_DEPRECATED CL_EXT_PREFIX_DEPRECATED
 #endif
 
 #ifdef CL_USE_DEPRECATED_OPENCL_2_2_APIS
-    #define CL_EXT_SUFFIX__VERSION_2_2_DEPRECATED
-    #define CL_EXT_PREFIX__VERSION_2_2_DEPRECATED
+#define CL_EXT_SUFFIX__VERSION_2_2_DEPRECATED
+#define CL_EXT_PREFIX__VERSION_2_2_DEPRECATED
 #else
-    #define CL_EXT_SUFFIX__VERSION_2_2_DEPRECATED CL_EXT_SUFFIX_DEPRECATED
-    #define CL_EXT_PREFIX__VERSION_2_2_DEPRECATED CL_EXT_PREFIX_DEPRECATED
+#define CL_EXT_SUFFIX__VERSION_2_2_DEPRECATED CL_EXT_SUFFIX_DEPRECATED
+#define CL_EXT_PREFIX__VERSION_2_2_DEPRECATED CL_EXT_PREFIX_DEPRECATED
 #endif
 
 #if (defined (_WIN32) && defined(_MSC_VER))
@@ -316,14 +316,14 @@ typedef double          cl_double;
 #define CL_M_SQRT1_2_F      0.707106781f
 
 #if defined( __GNUC__ )
-   #define CL_HUGE_VALF     __builtin_huge_valf()
-   #define CL_HUGE_VAL      __builtin_huge_val()
-   #define CL_NAN           __builtin_nanf( "" )
+#define CL_HUGE_VALF     __builtin_huge_valf()
+#define CL_HUGE_VAL      __builtin_huge_val()
+#define CL_NAN           __builtin_nanf( "" )
 #else
-   #define CL_HUGE_VALF     ((cl_float) 1e50)
-   #define CL_HUGE_VAL      ((cl_double) 1e500)
-   float nanf( const char * );
-   #define CL_NAN           nanf( "" )
+#define CL_HUGE_VALF     ((cl_float) 1e50)
+#define CL_HUGE_VAL      ((cl_double) 1e500)
+float nanf(const char *);
+#define CL_NAN           nanf( "" )
 #endif
 #define CL_MAXFLOAT         CL_FLT_MAX
 #define CL_INFINITY         CL_HUGE_VALF
@@ -355,126 +355,126 @@ typedef unsigned int cl_GLenum;
 
 /* Define basic vector types */
 #if defined( __VEC__ )
-  #if !defined(__clang__)
-     #include <altivec.h>   /* may be omitted depending on compiler. AltiVec spec provides no way to detect whether the header is required. */
-  #endif
-   typedef __vector unsigned char     __cl_uchar16;
-   typedef __vector signed char       __cl_char16;
-   typedef __vector unsigned short    __cl_ushort8;
-   typedef __vector signed short      __cl_short8;
-   typedef __vector unsigned int      __cl_uint4;
-   typedef __vector signed int        __cl_int4;
-   typedef __vector float             __cl_float4;
-   #define  __CL_UCHAR16__  1
-   #define  __CL_CHAR16__   1
-   #define  __CL_USHORT8__  1
-   #define  __CL_SHORT8__   1
-   #define  __CL_UINT4__    1
-   #define  __CL_INT4__     1
-   #define  __CL_FLOAT4__   1
+#if !defined(__clang__)
+#include <altivec.h>   /* may be omitted depending on compiler. AltiVec spec provides no way to detect whether the header is required. */
+#endif
+typedef __vector unsigned char     __cl_uchar16;
+typedef __vector signed char       __cl_char16;
+typedef __vector unsigned short    __cl_ushort8;
+typedef __vector signed short      __cl_short8;
+typedef __vector unsigned int      __cl_uint4;
+typedef __vector signed int        __cl_int4;
+typedef __vector float             __cl_float4;
+#define  __CL_UCHAR16__  1
+#define  __CL_CHAR16__   1
+#define  __CL_USHORT8__  1
+#define  __CL_SHORT8__   1
+#define  __CL_UINT4__    1
+#define  __CL_INT4__     1
+#define  __CL_FLOAT4__   1
 #endif
 
 #if defined( __SSE__ )
-    #if defined( __MINGW64__ )
-        #include <intrin.h>
-    #else
-        #include <xmmintrin.h>
-    #endif
-    #if defined( __GNUC__ )
-        typedef float __cl_float4   __attribute__((vector_size(16)));
-    #else
-        typedef __m128 __cl_float4;
-    #endif
-    #define __CL_FLOAT4__   1
+#if defined( __MINGW64__ )
+#include <intrin.h>
+#else
+#include <xmmintrin.h>
+#endif
+#if defined( __GNUC__ )
+typedef float __cl_float4   __attribute__((vector_size(16)));
+#else
+typedef __m128 __cl_float4;
+#endif
+#define __CL_FLOAT4__   1
 #endif
 
 #if defined( __SSE2__ )
-    #if defined( __MINGW64__ )
-        #include <intrin.h>
-    #else
-        #include <emmintrin.h>
-    #endif
-    #if defined( __GNUC__ )
-        typedef cl_uchar    __cl_uchar16    __attribute__((vector_size(16)));
-        typedef cl_char     __cl_char16     __attribute__((vector_size(16)));
-        typedef cl_ushort   __cl_ushort8    __attribute__((vector_size(16)));
-        typedef cl_short    __cl_short8     __attribute__((vector_size(16)));
-        typedef cl_uint     __cl_uint4      __attribute__((vector_size(16)));
-        typedef cl_int      __cl_int4       __attribute__((vector_size(16)));
-        typedef cl_ulong    __cl_ulong2     __attribute__((vector_size(16)));
-        typedef cl_long     __cl_long2      __attribute__((vector_size(16)));
-        typedef cl_double   __cl_double2    __attribute__((vector_size(16)));
-    #else
-        typedef __m128i __cl_uchar16;
-        typedef __m128i __cl_char16;
-        typedef __m128i __cl_ushort8;
-        typedef __m128i __cl_short8;
-        typedef __m128i __cl_uint4;
-        typedef __m128i __cl_int4;
-        typedef __m128i __cl_ulong2;
-        typedef __m128i __cl_long2;
-        typedef __m128d __cl_double2;
-    #endif
-    #define __CL_UCHAR16__  1
-    #define __CL_CHAR16__   1
-    #define __CL_USHORT8__  1
-    #define __CL_SHORT8__   1
-    #define __CL_INT4__     1
-    #define __CL_UINT4__    1
-    #define __CL_ULONG2__   1
-    #define __CL_LONG2__    1
-    #define __CL_DOUBLE2__  1
+#if defined( __MINGW64__ )
+#include <intrin.h>
+#else
+#include <emmintrin.h>
+#endif
+#if defined( __GNUC__ )
+typedef cl_uchar    __cl_uchar16    __attribute__((vector_size(16)));
+typedef cl_char     __cl_char16     __attribute__((vector_size(16)));
+typedef cl_ushort   __cl_ushort8    __attribute__((vector_size(16)));
+typedef cl_short    __cl_short8     __attribute__((vector_size(16)));
+typedef cl_uint     __cl_uint4      __attribute__((vector_size(16)));
+typedef cl_int      __cl_int4       __attribute__((vector_size(16)));
+typedef cl_ulong    __cl_ulong2     __attribute__((vector_size(16)));
+typedef cl_long     __cl_long2      __attribute__((vector_size(16)));
+typedef cl_double   __cl_double2    __attribute__((vector_size(16)));
+#else
+typedef __m128i __cl_uchar16;
+typedef __m128i __cl_char16;
+typedef __m128i __cl_ushort8;
+typedef __m128i __cl_short8;
+typedef __m128i __cl_uint4;
+typedef __m128i __cl_int4;
+typedef __m128i __cl_ulong2;
+typedef __m128i __cl_long2;
+typedef __m128d __cl_double2;
+#endif
+#define __CL_UCHAR16__  1
+#define __CL_CHAR16__   1
+#define __CL_USHORT8__  1
+#define __CL_SHORT8__   1
+#define __CL_INT4__     1
+#define __CL_UINT4__    1
+#define __CL_ULONG2__   1
+#define __CL_LONG2__    1
+#define __CL_DOUBLE2__  1
 #endif
 
 #if defined( __MMX__ )
-    #include <mmintrin.h>
-    #if defined( __GNUC__ )
-        typedef cl_uchar    __cl_uchar8     __attribute__((vector_size(8)));
-        typedef cl_char     __cl_char8      __attribute__((vector_size(8)));
-        typedef cl_ushort   __cl_ushort4    __attribute__((vector_size(8)));
-        typedef cl_short    __cl_short4     __attribute__((vector_size(8)));
-        typedef cl_uint     __cl_uint2      __attribute__((vector_size(8)));
-        typedef cl_int      __cl_int2       __attribute__((vector_size(8)));
-        typedef cl_ulong    __cl_ulong1     __attribute__((vector_size(8)));
-        typedef cl_long     __cl_long1      __attribute__((vector_size(8)));
-        typedef cl_float    __cl_float2     __attribute__((vector_size(8)));
-    #else
-        typedef __m64       __cl_uchar8;
-        typedef __m64       __cl_char8;
-        typedef __m64       __cl_ushort4;
-        typedef __m64       __cl_short4;
-        typedef __m64       __cl_uint2;
-        typedef __m64       __cl_int2;
-        typedef __m64       __cl_ulong1;
-        typedef __m64       __cl_long1;
-        typedef __m64       __cl_float2;
-    #endif
-    #define __CL_UCHAR8__   1
-    #define __CL_CHAR8__    1
-    #define __CL_USHORT4__  1
-    #define __CL_SHORT4__   1
-    #define __CL_INT2__     1
-    #define __CL_UINT2__    1
-    #define __CL_ULONG1__   1
-    #define __CL_LONG1__    1
-    #define __CL_FLOAT2__   1
+#include <mmintrin.h>
+#if defined( __GNUC__ )
+typedef cl_uchar    __cl_uchar8     __attribute__((vector_size(8)));
+typedef cl_char     __cl_char8      __attribute__((vector_size(8)));
+typedef cl_ushort   __cl_ushort4    __attribute__((vector_size(8)));
+typedef cl_short    __cl_short4     __attribute__((vector_size(8)));
+typedef cl_uint     __cl_uint2      __attribute__((vector_size(8)));
+typedef cl_int      __cl_int2       __attribute__((vector_size(8)));
+typedef cl_ulong    __cl_ulong1     __attribute__((vector_size(8)));
+typedef cl_long     __cl_long1      __attribute__((vector_size(8)));
+typedef cl_float    __cl_float2     __attribute__((vector_size(8)));
+#else
+typedef __m64       __cl_uchar8;
+typedef __m64       __cl_char8;
+typedef __m64       __cl_ushort4;
+typedef __m64       __cl_short4;
+typedef __m64       __cl_uint2;
+typedef __m64       __cl_int2;
+typedef __m64       __cl_ulong1;
+typedef __m64       __cl_long1;
+typedef __m64       __cl_float2;
+#endif
+#define __CL_UCHAR8__   1
+#define __CL_CHAR8__    1
+#define __CL_USHORT4__  1
+#define __CL_SHORT4__   1
+#define __CL_INT2__     1
+#define __CL_UINT2__    1
+#define __CL_ULONG1__   1
+#define __CL_LONG1__    1
+#define __CL_FLOAT2__   1
 #endif
 
 #if defined( __AVX__ )
-    #if defined( __MINGW64__ )
-        #include <intrin.h>
-    #else
-        #include <immintrin.h>
-    #endif
-    #if defined( __GNUC__ )
-        typedef cl_float    __cl_float8     __attribute__((vector_size(32)));
-        typedef cl_double   __cl_double4    __attribute__((vector_size(32)));
-    #else
-        typedef __m256      __cl_float8;
-        typedef __m256d     __cl_double4;
-    #endif
-    #define __CL_FLOAT8__   1
-    #define __CL_DOUBLE4__  1
+#if defined( __MINGW64__ )
+#include <intrin.h>
+#else
+#include <immintrin.h>
+#endif
+#if defined( __GNUC__ )
+typedef cl_float    __cl_float8     __attribute__((vector_size(32)));
+typedef cl_double   __cl_double4    __attribute__((vector_size(32)));
+#else
+typedef __m256      __cl_float8;
+typedef __m256d     __cl_double4;
+#endif
+#define __CL_FLOAT8__   1
+#define __CL_DOUBLE4__  1
 #endif
 
 /* Define capabilities for anonymous struct members. */
@@ -485,16 +485,16 @@ typedef unsigned int cl_GLenum;
 #define  __CL_HAS_ANON_STRUCT__ 1
 #define  __CL_ANON_STRUCT__ __extension__
 #elif defined( _WIN32) && defined(_MSC_VER) && ! defined(__STDC__)
-    #if _MSC_VER >= 1500
-   /* Microsoft Developer Studio 2008 supports anonymous structs, but
-    * complains by default. */
-    #define  __CL_HAS_ANON_STRUCT__ 1
-    #define  __CL_ANON_STRUCT__
-   /* Disable warning C4201: nonstandard extension used : nameless
-    * struct/union */
-    #pragma warning( push )
-    #pragma warning( disable : 4201 )
-    #endif
+#if _MSC_VER >= 1500
+/* Microsoft Developer Studio 2008 supports anonymous structs, but
+ * complains by default. */
+#define  __CL_HAS_ANON_STRUCT__ 1
+#define  __CL_ANON_STRUCT__
+/* Disable warning C4201: nonstandard extension used : nameless
+ * struct/union */
+#pragma warning( push )
+#pragma warning( disable : 4201 )
+#endif
 #else
 #define  __CL_HAS_ANON_STRUCT__ 0
 #define  __CL_ANON_STRUCT__
@@ -502,49 +502,47 @@ typedef unsigned int cl_GLenum;
 
 /* Define alignment keys */
 #if defined( __GNUC__ ) || defined(__INTEGRITY)
-    #define CL_ALIGNED(_x)          __attribute__ ((aligned(_x)))
+#define CL_ALIGNED(_x)          __attribute__ ((aligned(_x)))
 #elif defined( _WIN32) && (_MSC_VER)
-    /* Alignment keys neutered on windows because MSVC can't swallow function arguments with alignment requirements     */
-    /* http://msdn.microsoft.com/en-us/library/373ak2y1%28VS.71%29.aspx                                                 */
-    /* #include <crtdefs.h>                                                                                             */
-    /* #define CL_ALIGNED(_x)          _CRT_ALIGN(_x)                                                                   */
-    #define CL_ALIGNED(_x)
+/* Alignment keys neutered on windows because MSVC can't swallow function arguments with alignment requirements     */
+/* http://msdn.microsoft.com/en-us/library/373ak2y1%28VS.71%29.aspx                                                 */
+/* #include <crtdefs.h>                                                                                             */
+/* #define CL_ALIGNED(_x)          _CRT_ALIGN(_x)                                                                   */
+#define CL_ALIGNED(_x)
 #else
-   #warning  Need to implement some method to align data here
-   #define  CL_ALIGNED(_x)
+#warning  Need to implement some method to align data here
+#define  CL_ALIGNED(_x)
 #endif
 
 /* Indicate whether .xyzw, .s0123 and .hi.lo are supported */
 #if __CL_HAS_ANON_STRUCT__
-    /* .xyzw and .s0123...{f|F} are supported */
-    #define CL_HAS_NAMED_VECTOR_FIELDS 1
-    /* .hi and .lo are supported */
-    #define CL_HAS_HI_LO_VECTOR_FIELDS 1
+/* .xyzw and .s0123...{f|F} are supported */
+#define CL_HAS_NAMED_VECTOR_FIELDS 1
+/* .hi and .lo are supported */
+#define CL_HAS_HI_LO_VECTOR_FIELDS 1
 #endif
 
 /* Define cl_vector types */
 
 /* ---- cl_charn ---- */
-typedef union
-{
+typedef union {
     cl_char  CL_ALIGNED(2) s[2];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_char  x, y; };
-   __CL_ANON_STRUCT__ struct{ cl_char  s0, s1; };
-   __CL_ANON_STRUCT__ struct{ cl_char  lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_char  x, y; };
+    __CL_ANON_STRUCT__ struct { cl_char  s0, s1; };
+    __CL_ANON_STRUCT__ struct { cl_char  lo, hi; };
 #endif
 #if defined( __CL_CHAR2__)
     __cl_char2     v2;
 #endif
-}cl_char2;
+} cl_char2;
 
-typedef union
-{
+typedef union {
     cl_char  CL_ALIGNED(4) s[4];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_char  x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_char  s0, s1, s2, s3; };
-   __CL_ANON_STRUCT__ struct{ cl_char2 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_char  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_char  s0, s1, s2, s3; };
+    __CL_ANON_STRUCT__ struct { cl_char2 lo, hi; };
 #endif
 #if defined( __CL_CHAR2__)
     __cl_char2     v2[2];
@@ -552,18 +550,17 @@ typedef union
 #if defined( __CL_CHAR4__)
     __cl_char4     v4;
 #endif
-}cl_char4;
+} cl_char4;
 
 /* cl_char3 is identical in size, alignment and behavior to cl_char4. See section 6.1.5. */
 typedef  cl_char4  cl_char3;
 
-typedef union
-{
+typedef union {
     cl_char   CL_ALIGNED(8) s[8];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_char  x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_char  s0, s1, s2, s3, s4, s5, s6, s7; };
-   __CL_ANON_STRUCT__ struct{ cl_char4 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_char  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_char  s0, s1, s2, s3, s4, s5, s6, s7; };
+    __CL_ANON_STRUCT__ struct { cl_char4 lo, hi; };
 #endif
 #if defined( __CL_CHAR2__)
     __cl_char2     v2[4];
@@ -574,15 +571,14 @@ typedef union
 #if defined( __CL_CHAR8__ )
     __cl_char8     v8;
 #endif
-}cl_char8;
+} cl_char8;
 
-typedef union
-{
+typedef union {
     cl_char  CL_ALIGNED(16) s[16];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_char  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
-   __CL_ANON_STRUCT__ struct{ cl_char  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
-   __CL_ANON_STRUCT__ struct{ cl_char8 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_char  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+    __CL_ANON_STRUCT__ struct { cl_char  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+    __CL_ANON_STRUCT__ struct { cl_char8 lo, hi; };
 #endif
 #if defined( __CL_CHAR2__)
     __cl_char2     v2[8];
@@ -596,30 +592,28 @@ typedef union
 #if defined( __CL_CHAR16__ )
     __cl_char16    v16;
 #endif
-}cl_char16;
+} cl_char16;
 
 
 /* ---- cl_ucharn ---- */
-typedef union
-{
+typedef union {
     cl_uchar  CL_ALIGNED(2) s[2];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_uchar  x, y; };
-   __CL_ANON_STRUCT__ struct{ cl_uchar  s0, s1; };
-   __CL_ANON_STRUCT__ struct{ cl_uchar  lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_uchar  x, y; };
+    __CL_ANON_STRUCT__ struct { cl_uchar  s0, s1; };
+    __CL_ANON_STRUCT__ struct { cl_uchar  lo, hi; };
 #endif
 #if defined( __cl_uchar2__)
     __cl_uchar2     v2;
 #endif
-}cl_uchar2;
+} cl_uchar2;
 
-typedef union
-{
+typedef union {
     cl_uchar  CL_ALIGNED(4) s[4];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_uchar  x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_uchar  s0, s1, s2, s3; };
-   __CL_ANON_STRUCT__ struct{ cl_uchar2 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_uchar  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_uchar  s0, s1, s2, s3; };
+    __CL_ANON_STRUCT__ struct { cl_uchar2 lo, hi; };
 #endif
 #if defined( __CL_UCHAR2__)
     __cl_uchar2     v2[2];
@@ -627,18 +621,17 @@ typedef union
 #if defined( __CL_UCHAR4__)
     __cl_uchar4     v4;
 #endif
-}cl_uchar4;
+} cl_uchar4;
 
 /* cl_uchar3 is identical in size, alignment and behavior to cl_uchar4. See section 6.1.5. */
 typedef  cl_uchar4  cl_uchar3;
 
-typedef union
-{
+typedef union {
     cl_uchar   CL_ALIGNED(8) s[8];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_uchar  x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_uchar  s0, s1, s2, s3, s4, s5, s6, s7; };
-   __CL_ANON_STRUCT__ struct{ cl_uchar4 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_uchar  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_uchar  s0, s1, s2, s3, s4, s5, s6, s7; };
+    __CL_ANON_STRUCT__ struct { cl_uchar4 lo, hi; };
 #endif
 #if defined( __CL_UCHAR2__)
     __cl_uchar2     v2[4];
@@ -649,15 +642,14 @@ typedef union
 #if defined( __CL_UCHAR8__ )
     __cl_uchar8     v8;
 #endif
-}cl_uchar8;
+} cl_uchar8;
 
-typedef union
-{
+typedef union {
     cl_uchar  CL_ALIGNED(16) s[16];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_uchar  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
-   __CL_ANON_STRUCT__ struct{ cl_uchar  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
-   __CL_ANON_STRUCT__ struct{ cl_uchar8 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_uchar  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+    __CL_ANON_STRUCT__ struct { cl_uchar  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+    __CL_ANON_STRUCT__ struct { cl_uchar8 lo, hi; };
 #endif
 #if defined( __CL_UCHAR2__)
     __cl_uchar2     v2[8];
@@ -671,30 +663,28 @@ typedef union
 #if defined( __CL_UCHAR16__ )
     __cl_uchar16    v16;
 #endif
-}cl_uchar16;
+} cl_uchar16;
 
 
 /* ---- cl_shortn ---- */
-typedef union
-{
+typedef union {
     cl_short  CL_ALIGNED(4) s[2];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_short  x, y; };
-   __CL_ANON_STRUCT__ struct{ cl_short  s0, s1; };
-   __CL_ANON_STRUCT__ struct{ cl_short  lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_short  x, y; };
+    __CL_ANON_STRUCT__ struct { cl_short  s0, s1; };
+    __CL_ANON_STRUCT__ struct { cl_short  lo, hi; };
 #endif
 #if defined( __CL_SHORT2__)
     __cl_short2     v2;
 #endif
-}cl_short2;
+} cl_short2;
 
-typedef union
-{
+typedef union {
     cl_short  CL_ALIGNED(8) s[4];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_short  x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_short  s0, s1, s2, s3; };
-   __CL_ANON_STRUCT__ struct{ cl_short2 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_short  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_short  s0, s1, s2, s3; };
+    __CL_ANON_STRUCT__ struct { cl_short2 lo, hi; };
 #endif
 #if defined( __CL_SHORT2__)
     __cl_short2     v2[2];
@@ -702,18 +692,17 @@ typedef union
 #if defined( __CL_SHORT4__)
     __cl_short4     v4;
 #endif
-}cl_short4;
+} cl_short4;
 
 /* cl_short3 is identical in size, alignment and behavior to cl_short4. See section 6.1.5. */
 typedef  cl_short4  cl_short3;
 
-typedef union
-{
+typedef union {
     cl_short   CL_ALIGNED(16) s[8];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_short  x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_short  s0, s1, s2, s3, s4, s5, s6, s7; };
-   __CL_ANON_STRUCT__ struct{ cl_short4 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_short  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_short  s0, s1, s2, s3, s4, s5, s6, s7; };
+    __CL_ANON_STRUCT__ struct { cl_short4 lo, hi; };
 #endif
 #if defined( __CL_SHORT2__)
     __cl_short2     v2[4];
@@ -724,15 +713,14 @@ typedef union
 #if defined( __CL_SHORT8__ )
     __cl_short8     v8;
 #endif
-}cl_short8;
+} cl_short8;
 
-typedef union
-{
+typedef union {
     cl_short  CL_ALIGNED(32) s[16];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_short  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
-   __CL_ANON_STRUCT__ struct{ cl_short  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
-   __CL_ANON_STRUCT__ struct{ cl_short8 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_short  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+    __CL_ANON_STRUCT__ struct { cl_short  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+    __CL_ANON_STRUCT__ struct { cl_short8 lo, hi; };
 #endif
 #if defined( __CL_SHORT2__)
     __cl_short2     v2[8];
@@ -746,30 +734,28 @@ typedef union
 #if defined( __CL_SHORT16__ )
     __cl_short16    v16;
 #endif
-}cl_short16;
+} cl_short16;
 
 
 /* ---- cl_ushortn ---- */
-typedef union
-{
+typedef union {
     cl_ushort  CL_ALIGNED(4) s[2];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_ushort  x, y; };
-   __CL_ANON_STRUCT__ struct{ cl_ushort  s0, s1; };
-   __CL_ANON_STRUCT__ struct{ cl_ushort  lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_ushort  x, y; };
+    __CL_ANON_STRUCT__ struct { cl_ushort  s0, s1; };
+    __CL_ANON_STRUCT__ struct { cl_ushort  lo, hi; };
 #endif
 #if defined( __CL_USHORT2__)
     __cl_ushort2     v2;
 #endif
-}cl_ushort2;
+} cl_ushort2;
 
-typedef union
-{
+typedef union {
     cl_ushort  CL_ALIGNED(8) s[4];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_ushort  x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_ushort  s0, s1, s2, s3; };
-   __CL_ANON_STRUCT__ struct{ cl_ushort2 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_ushort  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_ushort  s0, s1, s2, s3; };
+    __CL_ANON_STRUCT__ struct { cl_ushort2 lo, hi; };
 #endif
 #if defined( __CL_USHORT2__)
     __cl_ushort2     v2[2];
@@ -777,18 +763,17 @@ typedef union
 #if defined( __CL_USHORT4__)
     __cl_ushort4     v4;
 #endif
-}cl_ushort4;
+} cl_ushort4;
 
 /* cl_ushort3 is identical in size, alignment and behavior to cl_ushort4. See section 6.1.5. */
 typedef  cl_ushort4  cl_ushort3;
 
-typedef union
-{
+typedef union {
     cl_ushort   CL_ALIGNED(16) s[8];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_ushort  x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_ushort  s0, s1, s2, s3, s4, s5, s6, s7; };
-   __CL_ANON_STRUCT__ struct{ cl_ushort4 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_ushort  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_ushort  s0, s1, s2, s3, s4, s5, s6, s7; };
+    __CL_ANON_STRUCT__ struct { cl_ushort4 lo, hi; };
 #endif
 #if defined( __CL_USHORT2__)
     __cl_ushort2     v2[4];
@@ -799,15 +784,14 @@ typedef union
 #if defined( __CL_USHORT8__ )
     __cl_ushort8     v8;
 #endif
-}cl_ushort8;
+} cl_ushort8;
 
-typedef union
-{
+typedef union {
     cl_ushort  CL_ALIGNED(32) s[16];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_ushort  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
-   __CL_ANON_STRUCT__ struct{ cl_ushort  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
-   __CL_ANON_STRUCT__ struct{ cl_ushort8 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_ushort  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+    __CL_ANON_STRUCT__ struct { cl_ushort  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+    __CL_ANON_STRUCT__ struct { cl_ushort8 lo, hi; };
 #endif
 #if defined( __CL_USHORT2__)
     __cl_ushort2     v2[8];
@@ -821,30 +805,28 @@ typedef union
 #if defined( __CL_USHORT16__ )
     __cl_ushort16    v16;
 #endif
-}cl_ushort16;
+} cl_ushort16;
 
 
 /* ---- cl_halfn ---- */
-typedef union
-{
+typedef union {
     cl_half  CL_ALIGNED(4) s[2];
 #if __CL_HAS_ANON_STRUCT__
-    __CL_ANON_STRUCT__ struct{ cl_half  x, y; };
-    __CL_ANON_STRUCT__ struct{ cl_half  s0, s1; };
-    __CL_ANON_STRUCT__ struct{ cl_half  lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_half  x, y; };
+    __CL_ANON_STRUCT__ struct { cl_half  s0, s1; };
+    __CL_ANON_STRUCT__ struct { cl_half  lo, hi; };
 #endif
 #if defined( __CL_HALF2__)
     __cl_half2     v2;
 #endif
-}cl_half2;
+} cl_half2;
 
-typedef union
-{
+typedef union {
     cl_half  CL_ALIGNED(8) s[4];
 #if __CL_HAS_ANON_STRUCT__
-    __CL_ANON_STRUCT__ struct{ cl_half  x, y, z, w; };
-    __CL_ANON_STRUCT__ struct{ cl_half  s0, s1, s2, s3; };
-    __CL_ANON_STRUCT__ struct{ cl_half2 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_half  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_half  s0, s1, s2, s3; };
+    __CL_ANON_STRUCT__ struct { cl_half2 lo, hi; };
 #endif
 #if defined( __CL_HALF2__)
     __cl_half2     v2[2];
@@ -852,18 +834,17 @@ typedef union
 #if defined( __CL_HALF4__)
     __cl_half4     v4;
 #endif
-}cl_half4;
+} cl_half4;
 
 /* cl_half3 is identical in size, alignment and behavior to cl_half4. See section 6.1.5. */
 typedef  cl_half4  cl_half3;
 
-typedef union
-{
+typedef union {
     cl_half   CL_ALIGNED(16) s[8];
 #if __CL_HAS_ANON_STRUCT__
-    __CL_ANON_STRUCT__ struct{ cl_half  x, y, z, w; };
-    __CL_ANON_STRUCT__ struct{ cl_half  s0, s1, s2, s3, s4, s5, s6, s7; };
-    __CL_ANON_STRUCT__ struct{ cl_half4 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_half  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_half  s0, s1, s2, s3, s4, s5, s6, s7; };
+    __CL_ANON_STRUCT__ struct { cl_half4 lo, hi; };
 #endif
 #if defined( __CL_HALF2__)
     __cl_half2     v2[4];
@@ -874,15 +855,14 @@ typedef union
 #if defined( __CL_HALF8__ )
     __cl_half8     v8;
 #endif
-}cl_half8;
+} cl_half8;
 
-typedef union
-{
+typedef union {
     cl_half  CL_ALIGNED(32) s[16];
 #if __CL_HAS_ANON_STRUCT__
-    __CL_ANON_STRUCT__ struct{ cl_half  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
-    __CL_ANON_STRUCT__ struct{ cl_half  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
-    __CL_ANON_STRUCT__ struct{ cl_half8 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_half  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+    __CL_ANON_STRUCT__ struct { cl_half  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+    __CL_ANON_STRUCT__ struct { cl_half8 lo, hi; };
 #endif
 #if defined( __CL_HALF2__)
     __cl_half2     v2[8];
@@ -896,29 +876,27 @@ typedef union
 #if defined( __CL_HALF16__ )
     __cl_half16    v16;
 #endif
-}cl_half16;
+} cl_half16;
 
 /* ---- cl_intn ---- */
-typedef union
-{
+typedef union {
     cl_int  CL_ALIGNED(8) s[2];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_int  x, y; };
-   __CL_ANON_STRUCT__ struct{ cl_int  s0, s1; };
-   __CL_ANON_STRUCT__ struct{ cl_int  lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_int  x, y; };
+    __CL_ANON_STRUCT__ struct { cl_int  s0, s1; };
+    __CL_ANON_STRUCT__ struct { cl_int  lo, hi; };
 #endif
 #if defined( __CL_INT2__)
     __cl_int2     v2;
 #endif
-}cl_int2;
+} cl_int2;
 
-typedef union
-{
+typedef union {
     cl_int  CL_ALIGNED(16) s[4];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_int  x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_int  s0, s1, s2, s3; };
-   __CL_ANON_STRUCT__ struct{ cl_int2 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_int  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_int  s0, s1, s2, s3; };
+    __CL_ANON_STRUCT__ struct { cl_int2 lo, hi; };
 #endif
 #if defined( __CL_INT2__)
     __cl_int2     v2[2];
@@ -926,18 +904,17 @@ typedef union
 #if defined( __CL_INT4__)
     __cl_int4     v4;
 #endif
-}cl_int4;
+} cl_int4;
 
 /* cl_int3 is identical in size, alignment and behavior to cl_int4. See section 6.1.5. */
 typedef  cl_int4  cl_int3;
 
-typedef union
-{
+typedef union {
     cl_int   CL_ALIGNED(32) s[8];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_int  x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_int  s0, s1, s2, s3, s4, s5, s6, s7; };
-   __CL_ANON_STRUCT__ struct{ cl_int4 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_int  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_int  s0, s1, s2, s3, s4, s5, s6, s7; };
+    __CL_ANON_STRUCT__ struct { cl_int4 lo, hi; };
 #endif
 #if defined( __CL_INT2__)
     __cl_int2     v2[4];
@@ -948,15 +925,14 @@ typedef union
 #if defined( __CL_INT8__ )
     __cl_int8     v8;
 #endif
-}cl_int8;
+} cl_int8;
 
-typedef union
-{
+typedef union {
     cl_int  CL_ALIGNED(64) s[16];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_int  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
-   __CL_ANON_STRUCT__ struct{ cl_int  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
-   __CL_ANON_STRUCT__ struct{ cl_int8 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_int  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+    __CL_ANON_STRUCT__ struct { cl_int  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+    __CL_ANON_STRUCT__ struct { cl_int8 lo, hi; };
 #endif
 #if defined( __CL_INT2__)
     __cl_int2     v2[8];
@@ -970,30 +946,28 @@ typedef union
 #if defined( __CL_INT16__ )
     __cl_int16    v16;
 #endif
-}cl_int16;
+} cl_int16;
 
 
 /* ---- cl_uintn ---- */
-typedef union
-{
+typedef union {
     cl_uint  CL_ALIGNED(8) s[2];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_uint  x, y; };
-   __CL_ANON_STRUCT__ struct{ cl_uint  s0, s1; };
-   __CL_ANON_STRUCT__ struct{ cl_uint  lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_uint  x, y; };
+    __CL_ANON_STRUCT__ struct { cl_uint  s0, s1; };
+    __CL_ANON_STRUCT__ struct { cl_uint  lo, hi; };
 #endif
 #if defined( __CL_UINT2__)
     __cl_uint2     v2;
 #endif
-}cl_uint2;
+} cl_uint2;
 
-typedef union
-{
+typedef union {
     cl_uint  CL_ALIGNED(16) s[4];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_uint  x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_uint  s0, s1, s2, s3; };
-   __CL_ANON_STRUCT__ struct{ cl_uint2 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_uint  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_uint  s0, s1, s2, s3; };
+    __CL_ANON_STRUCT__ struct { cl_uint2 lo, hi; };
 #endif
 #if defined( __CL_UINT2__)
     __cl_uint2     v2[2];
@@ -1001,18 +975,17 @@ typedef union
 #if defined( __CL_UINT4__)
     __cl_uint4     v4;
 #endif
-}cl_uint4;
+} cl_uint4;
 
 /* cl_uint3 is identical in size, alignment and behavior to cl_uint4. See section 6.1.5. */
 typedef  cl_uint4  cl_uint3;
 
-typedef union
-{
+typedef union {
     cl_uint   CL_ALIGNED(32) s[8];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_uint  x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_uint  s0, s1, s2, s3, s4, s5, s6, s7; };
-   __CL_ANON_STRUCT__ struct{ cl_uint4 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_uint  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_uint  s0, s1, s2, s3, s4, s5, s6, s7; };
+    __CL_ANON_STRUCT__ struct { cl_uint4 lo, hi; };
 #endif
 #if defined( __CL_UINT2__)
     __cl_uint2     v2[4];
@@ -1023,15 +996,14 @@ typedef union
 #if defined( __CL_UINT8__ )
     __cl_uint8     v8;
 #endif
-}cl_uint8;
+} cl_uint8;
 
-typedef union
-{
+typedef union {
     cl_uint  CL_ALIGNED(64) s[16];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_uint  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
-   __CL_ANON_STRUCT__ struct{ cl_uint  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
-   __CL_ANON_STRUCT__ struct{ cl_uint8 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_uint  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+    __CL_ANON_STRUCT__ struct { cl_uint  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+    __CL_ANON_STRUCT__ struct { cl_uint8 lo, hi; };
 #endif
 #if defined( __CL_UINT2__)
     __cl_uint2     v2[8];
@@ -1045,29 +1017,27 @@ typedef union
 #if defined( __CL_UINT16__ )
     __cl_uint16    v16;
 #endif
-}cl_uint16;
+} cl_uint16;
 
 /* ---- cl_longn ---- */
-typedef union
-{
+typedef union {
     cl_long  CL_ALIGNED(16) s[2];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_long  x, y; };
-   __CL_ANON_STRUCT__ struct{ cl_long  s0, s1; };
-   __CL_ANON_STRUCT__ struct{ cl_long  lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_long  x, y; };
+    __CL_ANON_STRUCT__ struct { cl_long  s0, s1; };
+    __CL_ANON_STRUCT__ struct { cl_long  lo, hi; };
 #endif
 #if defined( __CL_LONG2__)
     __cl_long2     v2;
 #endif
-}cl_long2;
+} cl_long2;
 
-typedef union
-{
+typedef union {
     cl_long  CL_ALIGNED(32) s[4];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_long  x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_long  s0, s1, s2, s3; };
-   __CL_ANON_STRUCT__ struct{ cl_long2 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_long  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_long  s0, s1, s2, s3; };
+    __CL_ANON_STRUCT__ struct { cl_long2 lo, hi; };
 #endif
 #if defined( __CL_LONG2__)
     __cl_long2     v2[2];
@@ -1075,18 +1045,17 @@ typedef union
 #if defined( __CL_LONG4__)
     __cl_long4     v4;
 #endif
-}cl_long4;
+} cl_long4;
 
 /* cl_long3 is identical in size, alignment and behavior to cl_long4. See section 6.1.5. */
 typedef  cl_long4  cl_long3;
 
-typedef union
-{
+typedef union {
     cl_long   CL_ALIGNED(64) s[8];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_long  x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_long  s0, s1, s2, s3, s4, s5, s6, s7; };
-   __CL_ANON_STRUCT__ struct{ cl_long4 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_long  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_long  s0, s1, s2, s3, s4, s5, s6, s7; };
+    __CL_ANON_STRUCT__ struct { cl_long4 lo, hi; };
 #endif
 #if defined( __CL_LONG2__)
     __cl_long2     v2[4];
@@ -1097,15 +1066,14 @@ typedef union
 #if defined( __CL_LONG8__ )
     __cl_long8     v8;
 #endif
-}cl_long8;
+} cl_long8;
 
-typedef union
-{
+typedef union {
     cl_long  CL_ALIGNED(128) s[16];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_long  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
-   __CL_ANON_STRUCT__ struct{ cl_long  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
-   __CL_ANON_STRUCT__ struct{ cl_long8 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_long  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+    __CL_ANON_STRUCT__ struct { cl_long  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+    __CL_ANON_STRUCT__ struct { cl_long8 lo, hi; };
 #endif
 #if defined( __CL_LONG2__)
     __cl_long2     v2[8];
@@ -1119,30 +1087,28 @@ typedef union
 #if defined( __CL_LONG16__ )
     __cl_long16    v16;
 #endif
-}cl_long16;
+} cl_long16;
 
 
 /* ---- cl_ulongn ---- */
-typedef union
-{
+typedef union {
     cl_ulong  CL_ALIGNED(16) s[2];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_ulong  x, y; };
-   __CL_ANON_STRUCT__ struct{ cl_ulong  s0, s1; };
-   __CL_ANON_STRUCT__ struct{ cl_ulong  lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_ulong  x, y; };
+    __CL_ANON_STRUCT__ struct { cl_ulong  s0, s1; };
+    __CL_ANON_STRUCT__ struct { cl_ulong  lo, hi; };
 #endif
 #if defined( __CL_ULONG2__)
     __cl_ulong2     v2;
 #endif
-}cl_ulong2;
+} cl_ulong2;
 
-typedef union
-{
+typedef union {
     cl_ulong  CL_ALIGNED(32) s[4];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_ulong  x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_ulong  s0, s1, s2, s3; };
-   __CL_ANON_STRUCT__ struct{ cl_ulong2 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_ulong  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_ulong  s0, s1, s2, s3; };
+    __CL_ANON_STRUCT__ struct { cl_ulong2 lo, hi; };
 #endif
 #if defined( __CL_ULONG2__)
     __cl_ulong2     v2[2];
@@ -1150,18 +1116,17 @@ typedef union
 #if defined( __CL_ULONG4__)
     __cl_ulong4     v4;
 #endif
-}cl_ulong4;
+} cl_ulong4;
 
 /* cl_ulong3 is identical in size, alignment and behavior to cl_ulong4. See section 6.1.5. */
 typedef  cl_ulong4  cl_ulong3;
 
-typedef union
-{
+typedef union {
     cl_ulong   CL_ALIGNED(64) s[8];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_ulong  x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_ulong  s0, s1, s2, s3, s4, s5, s6, s7; };
-   __CL_ANON_STRUCT__ struct{ cl_ulong4 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_ulong  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_ulong  s0, s1, s2, s3, s4, s5, s6, s7; };
+    __CL_ANON_STRUCT__ struct { cl_ulong4 lo, hi; };
 #endif
 #if defined( __CL_ULONG2__)
     __cl_ulong2     v2[4];
@@ -1172,15 +1137,14 @@ typedef union
 #if defined( __CL_ULONG8__ )
     __cl_ulong8     v8;
 #endif
-}cl_ulong8;
+} cl_ulong8;
 
-typedef union
-{
+typedef union {
     cl_ulong  CL_ALIGNED(128) s[16];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_ulong  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
-   __CL_ANON_STRUCT__ struct{ cl_ulong  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
-   __CL_ANON_STRUCT__ struct{ cl_ulong8 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_ulong  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+    __CL_ANON_STRUCT__ struct { cl_ulong  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+    __CL_ANON_STRUCT__ struct { cl_ulong8 lo, hi; };
 #endif
 #if defined( __CL_ULONG2__)
     __cl_ulong2     v2[8];
@@ -1194,31 +1158,29 @@ typedef union
 #if defined( __CL_ULONG16__ )
     __cl_ulong16    v16;
 #endif
-}cl_ulong16;
+} cl_ulong16;
 
 
 /* --- cl_floatn ---- */
 
-typedef union
-{
+typedef union {
     cl_float  CL_ALIGNED(8) s[2];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_float  x, y; };
-   __CL_ANON_STRUCT__ struct{ cl_float  s0, s1; };
-   __CL_ANON_STRUCT__ struct{ cl_float  lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_float  x, y; };
+    __CL_ANON_STRUCT__ struct { cl_float  s0, s1; };
+    __CL_ANON_STRUCT__ struct { cl_float  lo, hi; };
 #endif
 #if defined( __CL_FLOAT2__)
     __cl_float2     v2;
 #endif
-}cl_float2;
+} cl_float2;
 
-typedef union
-{
+typedef union {
     cl_float  CL_ALIGNED(16) s[4];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_float   x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_float   s0, s1, s2, s3; };
-   __CL_ANON_STRUCT__ struct{ cl_float2  lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_float   x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_float   s0, s1, s2, s3; };
+    __CL_ANON_STRUCT__ struct { cl_float2  lo, hi; };
 #endif
 #if defined( __CL_FLOAT2__)
     __cl_float2     v2[2];
@@ -1226,18 +1188,17 @@ typedef union
 #if defined( __CL_FLOAT4__)
     __cl_float4     v4;
 #endif
-}cl_float4;
+} cl_float4;
 
 /* cl_float3 is identical in size, alignment and behavior to cl_float4. See section 6.1.5. */
 typedef  cl_float4  cl_float3;
 
-typedef union
-{
+typedef union {
     cl_float   CL_ALIGNED(32) s[8];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_float   x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_float   s0, s1, s2, s3, s4, s5, s6, s7; };
-   __CL_ANON_STRUCT__ struct{ cl_float4  lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_float   x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_float   s0, s1, s2, s3, s4, s5, s6, s7; };
+    __CL_ANON_STRUCT__ struct { cl_float4  lo, hi; };
 #endif
 #if defined( __CL_FLOAT2__)
     __cl_float2     v2[4];
@@ -1248,15 +1209,14 @@ typedef union
 #if defined( __CL_FLOAT8__ )
     __cl_float8     v8;
 #endif
-}cl_float8;
+} cl_float8;
 
-typedef union
-{
+typedef union {
     cl_float  CL_ALIGNED(64) s[16];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_float  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
-   __CL_ANON_STRUCT__ struct{ cl_float  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
-   __CL_ANON_STRUCT__ struct{ cl_float8 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_float  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+    __CL_ANON_STRUCT__ struct { cl_float  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+    __CL_ANON_STRUCT__ struct { cl_float8 lo, hi; };
 #endif
 #if defined( __CL_FLOAT2__)
     __cl_float2     v2[8];
@@ -1270,30 +1230,28 @@ typedef union
 #if defined( __CL_FLOAT16__ )
     __cl_float16    v16;
 #endif
-}cl_float16;
+} cl_float16;
 
 /* --- cl_doublen ---- */
 
-typedef union
-{
+typedef union {
     cl_double  CL_ALIGNED(16) s[2];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_double  x, y; };
-   __CL_ANON_STRUCT__ struct{ cl_double s0, s1; };
-   __CL_ANON_STRUCT__ struct{ cl_double lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_double  x, y; };
+    __CL_ANON_STRUCT__ struct { cl_double s0, s1; };
+    __CL_ANON_STRUCT__ struct { cl_double lo, hi; };
 #endif
 #if defined( __CL_DOUBLE2__)
     __cl_double2     v2;
 #endif
-}cl_double2;
+} cl_double2;
 
-typedef union
-{
+typedef union {
     cl_double  CL_ALIGNED(32) s[4];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_double  x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_double  s0, s1, s2, s3; };
-   __CL_ANON_STRUCT__ struct{ cl_double2 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_double  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_double  s0, s1, s2, s3; };
+    __CL_ANON_STRUCT__ struct { cl_double2 lo, hi; };
 #endif
 #if defined( __CL_DOUBLE2__)
     __cl_double2     v2[2];
@@ -1301,18 +1259,17 @@ typedef union
 #if defined( __CL_DOUBLE4__)
     __cl_double4     v4;
 #endif
-}cl_double4;
+} cl_double4;
 
 /* cl_double3 is identical in size, alignment and behavior to cl_double4. See section 6.1.5. */
 typedef  cl_double4  cl_double3;
 
-typedef union
-{
+typedef union {
     cl_double   CL_ALIGNED(64) s[8];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_double  x, y, z, w; };
-   __CL_ANON_STRUCT__ struct{ cl_double  s0, s1, s2, s3, s4, s5, s6, s7; };
-   __CL_ANON_STRUCT__ struct{ cl_double4 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_double  x, y, z, w; };
+    __CL_ANON_STRUCT__ struct { cl_double  s0, s1, s2, s3, s4, s5, s6, s7; };
+    __CL_ANON_STRUCT__ struct { cl_double4 lo, hi; };
 #endif
 #if defined( __CL_DOUBLE2__)
     __cl_double2     v2[4];
@@ -1323,15 +1280,14 @@ typedef union
 #if defined( __CL_DOUBLE8__ )
     __cl_double8     v8;
 #endif
-}cl_double8;
+} cl_double8;
 
-typedef union
-{
+typedef union {
     cl_double  CL_ALIGNED(128) s[16];
 #if __CL_HAS_ANON_STRUCT__
-   __CL_ANON_STRUCT__ struct{ cl_double  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
-   __CL_ANON_STRUCT__ struct{ cl_double  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
-   __CL_ANON_STRUCT__ struct{ cl_double8 lo, hi; };
+    __CL_ANON_STRUCT__ struct { cl_double  x, y, z, w, __spacer4, __spacer5, __spacer6, __spacer7, __spacer8, __spacer9, sa, sb, sc, sd, se, sf; };
+    __CL_ANON_STRUCT__ struct { cl_double  s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, sA, sB, sC, sD, sE, sF; };
+    __CL_ANON_STRUCT__ struct { cl_double8 lo, hi; };
 #endif
 #if defined( __CL_DOUBLE2__)
     __cl_double2     v2[8];
@@ -1345,7 +1301,7 @@ typedef union
 #if defined( __CL_DOUBLE16__ )
     __cl_double16    v16;
 #endif
-}cl_double16;
+} cl_double16;
 
 /* Macro to facilitate debugging
  * Usage:
@@ -1376,9 +1332,9 @@ typedef union
 #endif
 
 #if defined( _WIN32) && defined(_MSC_VER) && ! defined(__STDC__)
-    #if _MSC_VER >=1500
-    #pragma warning( pop )
-    #endif
+#if _MSC_VER >=1500
+#pragma warning( pop )
+#endif
 #endif
 
 #endif  /* __CL_PLATFORM_H  */
diff --git a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_va_api_media_sharing_intel.h b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_va_api_media_sharing_intel.h
index 0e7cd4d6f..e9a1c6388 100644
--- a/tools/hitag2crack/common/OpenCL-Headers/CL/cl_va_api_media_sharing_intel.h
+++ b/tools/hitag2crack/common/OpenCL-Headers/CL/cl_va_api_media_sharing_intel.h
@@ -88,69 +88,69 @@ extern CL_API_ENTRY cl_int CL_API_CALL
 clGetDeviceIDsFromVA_APIMediaAdapterINTEL(
     cl_platform_id                platform,
     cl_va_api_device_source_intel media_adapter_type,
-    void*                         media_adapter,
+    void                         *media_adapter,
     cl_va_api_device_set_intel    media_adapter_set,
     cl_uint                       num_entries,
-    cl_device_id*                 devices,
-    cl_uint*                      num_devices) CL_EXT_SUFFIX__VERSION_1_2;
+    cl_device_id                 *devices,
+    cl_uint                      *num_devices) CL_EXT_SUFFIX__VERSION_1_2;
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL * clGetDeviceIDsFromVA_APIMediaAdapterINTEL_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clGetDeviceIDsFromVA_APIMediaAdapterINTEL_fn)(
     cl_platform_id                platform,
     cl_va_api_device_source_intel media_adapter_type,
-    void*                         media_adapter,
+    void                         *media_adapter,
     cl_va_api_device_set_intel    media_adapter_set,
     cl_uint                       num_entries,
-    cl_device_id*                 devices,
-    cl_uint*                      num_devices) CL_EXT_SUFFIX__VERSION_1_2;
+    cl_device_id                 *devices,
+    cl_uint                      *num_devices) CL_EXT_SUFFIX__VERSION_1_2;
 
 extern CL_API_ENTRY cl_mem CL_API_CALL
 clCreateFromVA_APIMediaSurfaceINTEL(
     cl_context                    context,
     cl_mem_flags                  flags,
-    VASurfaceID*                  surface,
+    VASurfaceID                  *surface,
     cl_uint                       plane,
-    cl_int*                       errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
+    cl_int                       *errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
 
-typedef CL_API_ENTRY cl_mem (CL_API_CALL * clCreateFromVA_APIMediaSurfaceINTEL_fn)(
+typedef CL_API_ENTRY cl_mem(CL_API_CALL *clCreateFromVA_APIMediaSurfaceINTEL_fn)(
     cl_context                    context,
     cl_mem_flags                  flags,
-    VASurfaceID*                  surface,
+    VASurfaceID                  *surface,
     cl_uint                       plane,
-    cl_int*                       errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
+    cl_int                       *errcode_ret) CL_EXT_SUFFIX__VERSION_1_2;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueAcquireVA_APIMediaSurfacesINTEL(
     cl_command_queue              command_queue,
     cl_uint                       num_objects,
-    const cl_mem*                 mem_objects,
+    const cl_mem                 *mem_objects,
     cl_uint                       num_events_in_wait_list,
-    const cl_event*               event_wait_list,
-    cl_event*                     event) CL_EXT_SUFFIX__VERSION_1_2;
+    const cl_event               *event_wait_list,
+    cl_event                     *event) CL_EXT_SUFFIX__VERSION_1_2;
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueAcquireVA_APIMediaSurfacesINTEL_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clEnqueueAcquireVA_APIMediaSurfacesINTEL_fn)(
     cl_command_queue              command_queue,
     cl_uint                       num_objects,
-    const cl_mem*                 mem_objects,
+    const cl_mem                 *mem_objects,
     cl_uint                       num_events_in_wait_list,
-    const cl_event*               event_wait_list,
-    cl_event*                     event) CL_EXT_SUFFIX__VERSION_1_2;
+    const cl_event               *event_wait_list,
+    cl_event                     *event) CL_EXT_SUFFIX__VERSION_1_2;
 
 extern CL_API_ENTRY cl_int CL_API_CALL
 clEnqueueReleaseVA_APIMediaSurfacesINTEL(
     cl_command_queue              command_queue,
     cl_uint                       num_objects,
-    const cl_mem*                 mem_objects,
+    const cl_mem                 *mem_objects,
     cl_uint                       num_events_in_wait_list,
-    const cl_event*               event_wait_list,
-    cl_event*                     event) CL_EXT_SUFFIX__VERSION_1_2;
+    const cl_event               *event_wait_list,
+    cl_event                     *event) CL_EXT_SUFFIX__VERSION_1_2;
 
-typedef CL_API_ENTRY cl_int (CL_API_CALL *clEnqueueReleaseVA_APIMediaSurfacesINTEL_fn)(
+typedef CL_API_ENTRY cl_int(CL_API_CALL *clEnqueueReleaseVA_APIMediaSurfacesINTEL_fn)(
     cl_command_queue              command_queue,
     cl_uint                       num_objects,
-    const cl_mem*                 mem_objects,
+    const cl_mem                 *mem_objects,
     cl_uint                       num_events_in_wait_list,
-    const cl_event*               event_wait_list,
-    cl_event*                     event) CL_EXT_SUFFIX__VERSION_1_2;
+    const cl_event               *event_wait_list,
+    cl_event                     *event) CL_EXT_SUFFIX__VERSION_1_2;
 
 #ifdef __cplusplus
 }
diff --git a/tools/hitag2crack/crack5opencl/hitag2.c b/tools/hitag2crack/crack5opencl/hitag2.c
index a23093347..181f029ac 100644
--- a/tools/hitag2crack/crack5opencl/hitag2.c
+++ b/tools/hitag2crack/crack5opencl/hitag2.c
@@ -4,65 +4,62 @@
 //#if FORCE_HITAG2_FULL == 0
 
 // return a single bit from a value
-int bitn (uint64_t x, int bit)
-{
-        const uint64_t bitmask = (uint64_t)(1) << bit;
+int bitn(uint64_t x, int bit) {
+    const uint64_t bitmask = (uint64_t)(1) << bit;
 
-        return (x & bitmask) ? 1 : 0;
+    return (x & bitmask) ? 1 : 0;
 }
 
 // the sub-function R that rollback depends upon
-int fnR (uint64_t x)
-{
-        // renumbered bits because my state is 0-47, not 1-48
-        return (bitn(x, 1) ^ bitn(x, 2) ^ bitn(x, 5) ^
-                bitn(x, 6) ^ bitn(x, 7) ^ bitn(x, 15) ^
-                bitn(x, 21) ^ bitn(x, 22) ^ bitn(x, 25) ^
-                bitn(x, 29) ^ bitn(x, 40) ^ bitn(x, 41) ^
-                bitn(x, 42) ^ bitn(x, 45) ^ bitn(x, 46) ^ bitn(x, 47));
+int fnR(uint64_t x) {
+    // renumbered bits because my state is 0-47, not 1-48
+    return (bitn(x, 1) ^ bitn(x, 2) ^ bitn(x, 5) ^
+            bitn(x, 6) ^ bitn(x, 7) ^ bitn(x, 15) ^
+            bitn(x, 21) ^ bitn(x, 22) ^ bitn(x, 25) ^
+            bitn(x, 29) ^ bitn(x, 40) ^ bitn(x, 41) ^
+            bitn(x, 42) ^ bitn(x, 45) ^ bitn(x, 46) ^ bitn(x, 47));
 }
 
 // the three filter sub-functions that feed fnf
 int fa(unsigned int i) {
-        return bitn(0x2C79, (int)i);
+    return bitn(0x2C79, (int)i);
 }
 
 int fb(unsigned int i) {
-        return bitn(0x6671, (int)i);
+    return bitn(0x6671, (int)i);
 }
 
 // the filter function that generates a bit of output from the prng state
-int fnf (uint64_t s)
-{
-        const unsigned int x1 = (unsigned int)((bitn(s,  2) << 0) | (bitn(s,  3) << 1) | (bitn(s,  5) << 2) | (bitn(s,  6) << 3));
-        const unsigned int x2 = (unsigned int)((bitn(s,  8) << 0) | (bitn(s, 12) << 1) | (bitn(s, 14) << 2) | (bitn(s, 15) << 3));
-        const unsigned int x3 = (unsigned int)((bitn(s, 17) << 0) | (bitn(s, 21) << 1) | (bitn(s, 23) << 2) | (bitn(s, 26) << 3));
-        const unsigned int x4 = (unsigned int)((bitn(s, 28) << 0) | (bitn(s, 29) << 1) | (bitn(s, 31) << 2) | (bitn(s, 33) << 3));
-        const unsigned int x5 = (unsigned int)((bitn(s, 34) << 0) | (bitn(s, 43) << 1) | (bitn(s, 44) << 2) | (bitn(s, 46) << 3));
+int fnf(uint64_t s) {
+    const unsigned int x1 = (unsigned int)((bitn(s,  2) << 0) | (bitn(s,  3) << 1) | (bitn(s,  5) << 2) | (bitn(s,  6) << 3));
+    const unsigned int x2 = (unsigned int)((bitn(s,  8) << 0) | (bitn(s, 12) << 1) | (bitn(s, 14) << 2) | (bitn(s, 15) << 3));
+    const unsigned int x3 = (unsigned int)((bitn(s, 17) << 0) | (bitn(s, 21) << 1) | (bitn(s, 23) << 2) | (bitn(s, 26) << 3));
+    const unsigned int x4 = (unsigned int)((bitn(s, 28) << 0) | (bitn(s, 29) << 1) | (bitn(s, 31) << 2) | (bitn(s, 33) << 3));
+    const unsigned int x5 = (unsigned int)((bitn(s, 34) << 0) | (bitn(s, 43) << 1) | (bitn(s, 44) << 2) | (bitn(s, 46) << 3));
 
-        const unsigned int x6 = (unsigned int)((fa(x1) << 0) | (fb(x2) << 1) | (fb(x3) << 2) | (fb(x4) << 3) | (fa(x5) << 4));
+    const unsigned int x6 = (unsigned int)((fa(x1) << 0) | (fb(x2) << 1) | (fb(x3) << 2) | (fb(x4) << 3) | (fa(x5) << 4));
 
-        return bitn (0x7907287B, (int) x6);
+    return bitn(0x7907287B, (int) x6);
 }
 
-uint32_t hitag2_crypt (uint64_t x) {
-        const uint32_t ht2_function4a = 0x2C79; // 0010 1100 0111 1001
-        const uint32_t ht2_function4b = 0x6671; // 0110 0110 0111 0001
-        const uint32_t ht2_function5c = 0x7907287B; // 0111 1001 0000 0111 0010 1000 0111 1011
+uint32_t hitag2_crypt(uint64_t x) {
+    const uint32_t ht2_function4a = 0x2C79; // 0010 1100 0111 1001
+    const uint32_t ht2_function4b = 0x6671; // 0110 0110 0111 0001
+    const uint32_t ht2_function5c = 0x7907287B; // 0111 1001 0000 0111 0010 1000 0111 1011
 
-        uint32_t bitindex;
+    uint32_t bitindex;
 
-        bitindex = (ht2_function4a >> pickbits2_2(x, 1, 4)) & 1;
-        bitindex |= ((ht2_function4b << 1) >> pickbits1_1_2(x, 7, 11, 13)) & 0x02;
-        bitindex |= ((ht2_function4b << 2) >> pickbits1x4(x, 16, 20, 22, 25)) & 0x04;
-        bitindex |= ((ht2_function4b << 3) >> pickbits2_1_1(x, 27, 30, 32)) & 0x08;
-        bitindex |= ((ht2_function4a << 4) >> pickbits1_2_1(x, 33, 42, 45)) & 0x10;
+    bitindex = (ht2_function4a >> pickbits2_2(x, 1, 4)) & 1;
+    bitindex |= ((ht2_function4b << 1) >> pickbits1_1_2(x, 7, 11, 13)) & 0x02;
+    bitindex |= ((ht2_function4b << 2) >> pickbits1x4(x, 16, 20, 22, 25)) & 0x04;
+    bitindex |= ((ht2_function4b << 3) >> pickbits2_1_1(x, 27, 30, 32)) & 0x08;
+    bitindex |= ((ht2_function4a << 4) >> pickbits1_2_1(x, 33, 42, 45)) & 0x10;
 
-        #if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
-        printf ("hitag2_crypt bitindex = %02x\n", bitindex);
-        #endif
+#if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+    printf("hitag2_crypt bitindex = %02x\n", bitindex);
+#endif
 
-        return (ht2_function5c >> bitindex) & 1;
+    return (ht2_function5c >> bitindex) & 1;
 }
 
 /*
@@ -77,39 +74,39 @@ uint32_t hitag2_crypt (uint64_t x) {
  * uint32_t steps      - number of bits requested, (capped at 32)
  */
 uint32_t hitag2_nstep(Hitag_State *pstate, uint32_t steps) {
-        uint64_t cur_state = pstate->shiftreg;
-        uint32_t result = 0;
-        uint64_t lfsr = pstate->lfsr;
+    uint64_t cur_state = pstate->shiftreg;
+    uint32_t result = 0;
+    uint64_t lfsr = pstate->lfsr;
 
-        if (steps == 0) return 0;
+    if (steps == 0) return 0;
 
-        do {
-                // update shift registers
-                if (lfsr & 1) {
-                        cur_state = (cur_state >> 1) | 0x800000000000;
-                        lfsr = (lfsr >> 1) ^ 0xB38083220073;
+    do {
+        // update shift registers
+        if (lfsr & 1) {
+            cur_state = (cur_state >> 1) | 0x800000000000;
+            lfsr = (lfsr >> 1) ^ 0xB38083220073;
 
-                        // accumulate next bit of crypto
-                        result = (result << 1) | hitag2_crypt(cur_state);
-                } else {
-                        cur_state >>= 1;
-                        lfsr >>= 1;
+            // accumulate next bit of crypto
+            result = (result << 1) | hitag2_crypt(cur_state);
+        } else {
+            cur_state >>= 1;
+            lfsr >>= 1;
 
-                        result = (result << 1) | hitag2_crypt(cur_state);
-                }
-        } while (--steps);
+            result = (result << 1) | hitag2_crypt(cur_state);
+        }
+    } while (--steps);
 
-        #if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
-        #ifdef _ISOC99_SOURCE
-        printf ("hitag2_nstep cur_state = %012I64x, result %02x\n", cur_state, result);
-        #else
-        printf ("hitag2_nstep cur_state = %012" STR(OFF_FORMAT_X) ", result %02x\n", cur_state, result);
-        #endif
-        #endif // DEBUG_HITAG2
+#if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+#ifdef _ISOC99_SOURCE
+    printf("hitag2_nstep cur_state = %012I64x, result %02x\n", cur_state, result);
+#else
+    printf("hitag2_nstep cur_state = %012" STR(OFF_FORMAT_X) ", result %02x\n", cur_state, result);
+#endif
+#endif // DEBUG_HITAG2
 
-        pstate->shiftreg = cur_state;
-        pstate->lfsr = lfsr;
-        return result;
+    pstate->shiftreg = cur_state;
+    pstate->lfsr = lfsr;
+    return result;
 }
 
 /*
@@ -119,140 +116,136 @@ uint32_t hitag2_nstep(Hitag_State *pstate, uint32_t steps) {
  * uint32_t serialnum  - 32 bit tag serial number
  * uint32_t initvector - 32 bit random IV from reader, part of tag authentication
  */
-void hitag2_init (Hitag_State *pstate, uint64_t sharedkey, uint32_t serialnum, uint32_t initvector)
-{
-        // init state, from serial number and lowest 16 bits of shared key
-        uint64_t cur_state = ((sharedkey & 0xFFFF) << 32) | serialnum;
+void hitag2_init(Hitag_State *pstate, uint64_t sharedkey, uint32_t serialnum, uint32_t initvector) {
+    // init state, from serial number and lowest 16 bits of shared key
+    uint64_t cur_state = ((sharedkey & 0xFFFF) << 32) | serialnum;
 
-        // mix the initialisation vector and highest 32 bits of the shared key
-        initvector ^= (uint32_t) (sharedkey >> 16);
+    // mix the initialisation vector and highest 32 bits of the shared key
+    initvector ^= (uint32_t)(sharedkey >> 16);
 
-        // move 16 bits from (IV xor Shared Key) to top of uint64_t state
-        // these will be XORed in turn with output of the crypto function
-        cur_state |= (uint64_t) initvector << 48;
-        initvector >>= 16;
+    // move 16 bits from (IV xor Shared Key) to top of uint64_t state
+    // these will be XORed in turn with output of the crypto function
+    cur_state |= (uint64_t) initvector << 48;
+    initvector >>= 16;
 
-        // unrolled loop is faster on PIC32 (MIPS), do 32 times
-        // shift register, then calc new bit
-        cur_state >>= 1;
+    // unrolled loop is faster on PIC32 (MIPS), do 32 times
+    // shift register, then calc new bit
+    cur_state >>= 1;
 
-        int i;
+    int i;
 
-        for (i = 0; i < 16; i++) cur_state = (cur_state >> 1) ^ (uint64_t) hitag2_crypt(cur_state) << 46;
+    for (i = 0; i < 16; i++) cur_state = (cur_state >> 1) ^ (uint64_t) hitag2_crypt(cur_state) << 46;
 
-        // highest 16 bits of IV XOR Shared Key
-        cur_state |= (uint64_t) initvector << 47;
+    // highest 16 bits of IV XOR Shared Key
+    cur_state |= (uint64_t) initvector << 47;
 
-        for (i = 0; i < 15; i++) cur_state = (cur_state >> 1) ^ (uint64_t) hitag2_crypt(cur_state) << 46;
+    for (i = 0; i < 15; i++) cur_state = (cur_state >> 1) ^ (uint64_t) hitag2_crypt(cur_state) << 46;
 
-        cur_state ^= (uint64_t) hitag2_crypt (cur_state) << 47;
+    cur_state ^= (uint64_t) hitag2_crypt(cur_state) << 47;
 
-        pstate->shiftreg = cur_state;
-        #if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
-        #ifdef _ISOC99_SOURCE
-        printf ("hitag2_init shiftreg = %012I64x\n", pstate->shiftreg);
-        #else
-        printf ("hitag2_init shiftreg = %012" STR(OFF_FORMAT_X) "\n", pstate->shiftreg);
-        #endif
-        #endif // DEBUG_HITAG2
+    pstate->shiftreg = cur_state;
+#if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+#ifdef _ISOC99_SOURCE
+    printf("hitag2_init shiftreg = %012I64x\n", pstate->shiftreg);
+#else
+    printf("hitag2_init shiftreg = %012" STR(OFF_FORMAT_X) "\n", pstate->shiftreg);
+#endif
+#endif // DEBUG_HITAG2
 
-        /* naive version for reference, LFSR has 16 taps
-        pstate->lfsr = state ^ (state >>  2) ^ (state >>  3) ^ (state >>  6)
-                 ^ (state >>  7) ^ (state >>  8) ^ (state >> 16) ^ (state >> 22)
-                 ^ (state >> 23) ^ (state >> 26) ^ (state >> 30) ^ (state >> 41)
-                 ^ (state >> 42) ^ (state >> 43) ^ (state >> 46) ^ (state >> 47);
-        */
+    /* naive version for reference, LFSR has 16 taps
+    pstate->lfsr = state ^ (state >>  2) ^ (state >>  3) ^ (state >>  6)
+             ^ (state >>  7) ^ (state >>  8) ^ (state >> 16) ^ (state >> 22)
+             ^ (state >> 23) ^ (state >> 26) ^ (state >> 30) ^ (state >> 41)
+             ^ (state >> 42) ^ (state >> 43) ^ (state >> 46) ^ (state >> 47);
+    */
 
-        // optimise with one 64-bit intermediate
-        uint64_t temp = cur_state ^ (cur_state >> 1);
+    // optimise with one 64-bit intermediate
+    uint64_t temp = cur_state ^ (cur_state >> 1);
 
-        pstate->lfsr = cur_state ^ (cur_state >>  6) ^ (cur_state >> 16) ^
+    pstate->lfsr = cur_state ^ (cur_state >>  6) ^ (cur_state >> 16) ^
                    (cur_state >> 26) ^ (cur_state >> 30) ^ (cur_state >> 41) ^
                    (temp >>  2) ^ (temp >>  7) ^ (temp >> 22) ^ (temp >> 42) ^ (temp >> 46);
 
-        #if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
-        #ifdef _ISOC99_SOURCE
-        printf ("hitag2_init lfsr = %012I64x\n", pstate->lfsr);
-        #else
-        printf ("hitag2_init lfsr = %012" STR(OFF_FORMAT_X) "\n", pstate->lfsr);
-        #endif
-        #endif // DEBUG_HITAG2
+#if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+#ifdef _ISOC99_SOURCE
+    printf("hitag2_init lfsr = %012I64x\n", pstate->lfsr);
+#else
+    printf("hitag2_init lfsr = %012" STR(OFF_FORMAT_X) "\n", pstate->lfsr);
+#endif
+#endif // DEBUG_HITAG2
 }
 
 // try state
 
 // todo, changes arguments, only what is needed
-bool try_state (uint64_t s, uint32_t uid, uint32_t aR2, uint32_t nR1, uint32_t nR2, uint64_t *key)
-{
-  #if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
-	printf ("s : %lu, uid: %u, aR2: %u, nR1: %u, nR2: %u\n", s, uid, aR2, nR1, nR2);
-	fflush (stdout);
-	#endif
+bool try_state(uint64_t s, uint32_t uid, uint32_t aR2, uint32_t nR1, uint32_t nR2, uint64_t *key) {
+#if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+    printf("s : %lu, uid: %u, aR2: %u, nR1: %u, nR2: %u\n", s, uid, aR2, nR1, nR2);
+    fflush(stdout);
+#endif
 
-	Hitag_State hstate;
-	uint64_t keyrev, nR1xk;
-	uint32_t b = 0;
+    Hitag_State hstate;
+    uint64_t keyrev, nR1xk;
+    uint32_t b = 0;
 
-	hstate.shiftreg = s;
+    hstate.shiftreg = s;
 
-	//rollback(&hstate, 2);
-	hstate.shiftreg = (uint64_t)(((hstate.shiftreg << 1) & 0xffffffffffff) | (uint64_t)fnR(hstate.shiftreg));
-	hstate.shiftreg = (uint64_t)(((hstate.shiftreg << 1) & 0xffffffffffff) | (uint64_t)fnR(hstate.shiftreg));
+    //rollback(&hstate, 2);
+    hstate.shiftreg = (uint64_t)(((hstate.shiftreg << 1) & 0xffffffffffff) | (uint64_t)fnR(hstate.shiftreg));
+    hstate.shiftreg = (uint64_t)(((hstate.shiftreg << 1) & 0xffffffffffff) | (uint64_t)fnR(hstate.shiftreg));
 
-  #if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
-	printf ("shiftreg : %lu\n", hstate.shiftreg);
-	fflush (stdout);
-	#endif
+#if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+    printf("shiftreg : %lu\n", hstate.shiftreg);
+    fflush(stdout);
+#endif
 
-	// recover key
-	keyrev = hstate.shiftreg & 0xffff;
-	nR1xk = (hstate.shiftreg >> 16) & 0xffffffff;
+    // recover key
+    keyrev = hstate.shiftreg & 0xffff;
+    nR1xk = (hstate.shiftreg >> 16) & 0xffffffff;
 
-  #if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
-	printf ("keyrev: %lu, nR1xk: %lu\n", keyrev, nR1xk);
-	fflush (stdout);
-	#endif
+#if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+    printf("keyrev: %lu, nR1xk: %lu\n", keyrev, nR1xk);
+    fflush(stdout);
+#endif
 
-	for (int i = 0; i < 32; i++)
-	{
-		hstate.shiftreg = ((hstate.shiftreg) << 1) | ((uid >> (31 - i)) & 0x1);
-		b = (b << 1) | (unsigned int) fnf(hstate.shiftreg);
-	}
+    for (int i = 0; i < 32; i++) {
+        hstate.shiftreg = ((hstate.shiftreg) << 1) | ((uid >> (31 - i)) & 0x1);
+        b = (b << 1) | (unsigned int) fnf(hstate.shiftreg);
+    }
 
-  #if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
-	printf ("shiftreg: %lu\n", hstate.shiftreg);
-	fflush (stdout);
-	#endif
+#if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+    printf("shiftreg: %lu\n", hstate.shiftreg);
+    fflush(stdout);
+#endif
 
-	keyrev |= (nR1xk ^ nR1 ^ b) << 16;
+    keyrev |= (nR1xk ^ nR1 ^ b) << 16;
 
-  #if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
-	printf ("keyrev: %lu\n", keyrev);
-	fflush (stdout);
-	#endif
+#if defined(DEBUG_HITAG2) && DEBUG_HITAG2 == 1
+    printf("keyrev: %lu\n", keyrev);
+    fflush(stdout);
+#endif
 
-	// test key
-	hitag2_init (&hstate, keyrev, uid, nR2);
-	if ((aR2 ^ hitag2_nstep (&hstate, 32)) == 0xffffffff)
-	{
-		*key = rev64 (keyrev);
+    // test key
+    hitag2_init(&hstate, keyrev, uid, nR2);
+    if ((aR2 ^ hitag2_nstep(&hstate, 32)) == 0xffffffff) {
+        *key = rev64(keyrev);
 
-		#if DEBUGME >= 2
-		#if ENABLE_EMOJ == 1
-		printf ("\nKey found ╭☞  ");
-		#else
-		printf ("\nKey found: ");
-		#endif
-		for (int i = 0; i < 6; i++) {
-			printf ("%02X", (uint8_t)(*key & 0xff));
-			*key = *key >> 8;
-		}
-		printf ("\n");
-		#endif
-		return true;
-	}
+#if DEBUGME >= 2
+#if ENABLE_EMOJ == 1
+        printf("\nKey found ╭☞  ");
+#else
+        printf("\nKey found: ");
+#endif
+        for (int i = 0; i < 6; i++) {
+            printf("%02X", (uint8_t)(*key & 0xff));
+            *key = *key >> 8;
+        }
+        printf("\n");
+#endif
+        return true;
+    }
 
-	return false;
+    return false;
 }
 
 //#endif // FORCE_HITAG2_FULL = 0
diff --git a/tools/hitag2crack/crack5opencl/hitag2.h b/tools/hitag2crack/crack5opencl/hitag2.h
index cc28e9464..964482c58 100644
--- a/tools/hitag2crack/crack5opencl/hitag2.h
+++ b/tools/hitag2crack/crack5opencl/hitag2.h
@@ -27,17 +27,16 @@
 #define rev32(X)  (rev16(X) + (rev16(X >> 16) << 16))
 #define rev64(X)  (rev32(X) + (rev32(X >> 32) << 32))
 
-typedef struct
-{
-        uint64_t shiftreg; // naive shift register, required for nonlinear fn input
-        uint64_t lfsr;     // fast lfsr, used to make software faster
+typedef struct {
+    uint64_t shiftreg; // naive shift register, required for nonlinear fn input
+    uint64_t lfsr;     // fast lfsr, used to make software faster
 } Hitag_State;
 
 // return a single bit from a value
-int bitn (uint64_t x, int bit);
+int bitn(uint64_t x, int bit);
 
 // the sub-function R that rollback depends upon
-int fnR (uint64_t x);
+int fnR(uint64_t x);
 
 // the three filter sub-functions that feed fnf
 int fa(unsigned int i);
@@ -45,7 +44,7 @@ int fa(unsigned int i);
 int fb(unsigned int i);
 
 // the filter function that generates a bit of output from the prng state
-int fnf (uint64_t s);
+int fnf(uint64_t s);
 
 // macros to pick out 4 bits in various patterns of 1s & 2s & make a new number
 #define pickbits2_2(S, A, B)       ( ((S >> A) & 3) | ((S >> (B - 2)) & 0xC) )
@@ -54,7 +53,7 @@ int fnf (uint64_t s);
 #define pickbits2_1_1(S, A, B, C)  ( ((S >> A) & 3) | ((S >> (B - 2)) & 4) | ((S >> (C - 3)) & 8) )
 #define pickbits1_2_1(S, A, B, C)  ( ((S >> A) & 1) | ((S >> (B - 1)) & 6) | ((S >> (C - 3)) & 8) )
 
-uint32_t hitag2_crypt (uint64_t x);
+uint32_t hitag2_crypt(uint64_t x);
 
 /*
  * Return up to 32 crypto bits.
@@ -76,9 +75,9 @@ uint32_t hitag2_nstep(Hitag_State *pstate, uint32_t steps);
  * uint32_t serialnum  - 32 bit tag serial number
  * uint32_t initvector - 32 bit random IV from reader, part of tag authentication
  */
-void hitag2_init (Hitag_State *pstate, uint64_t sharedkey, uint32_t serialnum, uint32_t initvector);
+void hitag2_init(Hitag_State *pstate, uint64_t sharedkey, uint32_t serialnum, uint32_t initvector);
 
 // try_state
-bool try_state (uint64_t s, uint32_t uid, uint32_t aR2, uint32_t nR1, uint32_t nR2, uint64_t *key);
+bool try_state(uint64_t s, uint32_t uid, uint32_t aR2, uint32_t nR1, uint32_t nR2, uint64_t *key);
 
 #endif // HITAG2_H
diff --git a/tools/hitag2crack/crack5opencl/ht2crack5opencl.c b/tools/hitag2crack/crack5opencl/ht2crack5opencl.c
index 4347e8eef..c1994c153 100644
--- a/tools/hitag2crack/crack5opencl/ht2crack5opencl.c
+++ b/tools/hitag2crack/crack5opencl/ht2crack5opencl.c
@@ -40,8 +40,8 @@
 
 typedef unsigned int __attribute__((aligned(VECTOR_SIZE))) __attribute__((vector_size(VECTOR_SIZE))) bitslice_value_t;
 typedef union {
-	bitslice_value_t value;
-	uint8_t bytes[MAX_BITSLICES / 8];
+    bitslice_value_t value;
+    uint8_t bytes[MAX_BITSLICES / 8];
 } bitslice_t;
 
 static bitslice_t keystream[32];
@@ -51,1986 +51,1776 @@ static bitslice_t keystream[32];
 static uint16_t candidates[(1 << 20) * 3];
 
 // compute profile constants, from low to high workloads
-static unsigned int profiles[11][2] =
-{
-	{ 16384, 5 }, // 0, best for Intel GPU's with Neo
-	{ 8192,  6 }, // 1, only for Intel NEO
-	{ 4096,  7 }, // 2 (old 0) seems the best for all others (also NVIDIA) :D Apple/Intel GPU's stable here
-	{ 2048,  8 }, // 3 (old 1) usefull for any kind of CPU's
-	{ 1024,  9 },
-	{ 512,  10 },
-	{ 256,  11 },
-	{ 128,  12 }, // 7, (old 5) the last good value with NVIDIA GPU's
-	{ 64,   13 },
-	{ 32,   14 },
-	{ 16,   15 },
+static unsigned int profiles[11][2] = {
+    { 16384, 5 }, // 0, best for Intel GPU's with Neo
+    { 8192,  6 }, // 1, only for Intel NEO
+    { 4096,  7 }, // 2 (old 0) seems the best for all others (also NVIDIA) :D Apple/Intel GPU's stable here
+    { 2048,  8 }, // 3 (old 1) usefull for any kind of CPU's
+    { 1024,  9 },
+    { 512,  10 },
+    { 256,  11 },
+    { 128,  12 }, // 7, (old 5) the last good value with NVIDIA GPU's
+    { 64,   13 },
+    { 32,   14 },
+    { 16,   15 },
 };
 
-static uint64_t expand (uint64_t mask, uint64_t value)
-{
-	uint64_t fill = 0;
+static uint64_t expand(uint64_t mask, uint64_t value) {
+    uint64_t fill = 0;
 
-	for (uint64_t bit_index = 0; bit_index < 48; bit_index++)
-	{
-		if (mask & 1)
-		{
-			fill |= (value & 1) << bit_index;
-			value >>= 1;
-		}
-		mask >>= 1;
-	}
+    for (uint64_t bit_index = 0; bit_index < 48; bit_index++) {
+        if (mask & 1) {
+            fill |= (value & 1) << bit_index;
+            value >>= 1;
+        }
+        mask >>= 1;
+    }
 
-	return fill;
+    return fill;
 }
 
-static void bitslice (const uint64_t value, bitslice_t *restrict bitsliced_value)
-{
-	// set constants
-	bitslice_t bs_zeroes, bs_ones;
-	memset (bs_ones.bytes, 0xff, VECTOR_SIZE);
-	memset (bs_zeroes.bytes, 0x00, VECTOR_SIZE);
+static void bitslice(const uint64_t value, bitslice_t *restrict bitsliced_value) {
+    // set constants
+    bitslice_t bs_zeroes, bs_ones;
+    memset(bs_ones.bytes, 0xff, VECTOR_SIZE);
+    memset(bs_zeroes.bytes, 0x00, VECTOR_SIZE);
 
-	for (size_t bit_idx = 0; bit_idx < 32; bit_idx++)
-	{
-		const bool bit = get_bit(32 - 1 - bit_idx, value);
-		bitsliced_value[bit_idx].value = (bit) ? bs_ones.value : bs_zeroes.value;
-	}
+    for (size_t bit_idx = 0; bit_idx < 32; bit_idx++) {
+        const bool bit = get_bit(32 - 1 - bit_idx, value);
+        bitsliced_value[bit_idx].value = (bit) ? bs_ones.value : bs_zeroes.value;
+    }
 }
 
 // convert byte-reversed 8 digit hex to unsigned long
-static unsigned long hexreversetoulong (char *hex) {
-	unsigned long ret = 0L;
-	unsigned int x;
-	char i;
+static unsigned long hexreversetoulong(char *hex) {
+    unsigned long ret = 0L;
+    unsigned int x;
+    char i;
 
-	if (strlen(hex) != 8)
-		return 0L;
+    if (strlen(hex) != 8)
+        return 0L;
 
-	for (i = 0 ; i < 4 ; ++i) {
-		if (sscanf(hex, "%2X", &x) != 1)
-			return 0L;
-		ret += ((unsigned long) x) << i * 8;
-		hex += 2;
-	}
-	return ret;
+    for (i = 0 ; i < 4 ; ++i) {
+        if (sscanf(hex, "%2X", &x) != 1)
+            return 0L;
+        ret += ((unsigned long) x) << i * 8;
+        hex += 2;
+    }
+    return ret;
 }
 
 #if ENABLE_EMOJ == 1
-static const char *emoj[3][2] = { {"∩","つ"}, {"つ","⊃"}, {"⊃","੭ " } };
+static const char *emoj[3][2] = { {"∩", "つ"}, {"つ", "⊃"}, {"⊃", "੭ " } };
 #endif
 
 __attribute__((noreturn))
-static void usage (char *name)
-{
-	printf ("%s [options] {UID} {nR1} {aR1} {nR2} {aR2}\n\n" \
-		"Options:\n"
-		"-p     : select OpenCL Platform(s). Multiple allowed (1,2,3,etc.). [Default: all]\n"
-		"-d     : select OpenCL Device(s). Multiple allowed (1,2,3,etc.). [Default: all]\n"
-		"-D     : select OpenCL Device Type. 0: GPU, 1: CPU, 2: all. [Default: GPU]\n"
-		"-S     : select the thread scheduler type. 0: sequential, 1: asynchronous. [Default 1]\n"
-		"-P     : select the Profile, from 0 to 10. [Default: auto-tuning]\n"
-		"-F     : force verify key with OpenCL instead of CPU. [Default: disabled]\n"
-		"-Q     : select queue engine. 0: forward, 1: reverse, 2: random. [Default: 0]\n"
-		"-s     : show the list of OpenCL platforms/devices, then exit\n"
-		"-V     : enable debug messages\n"
-		"-v     : show the version\n"
-		"-h     : show this help\n\n", name);
+static void usage(char *name) {
+    printf("%s [options] {UID} {nR1} {aR1} {nR2} {aR2}\n\n" \
+           "Options:\n"
+           "-p     : select OpenCL Platform(s). Multiple allowed (1,2,3,etc.). [Default: all]\n"
+           "-d     : select OpenCL Device(s). Multiple allowed (1,2,3,etc.). [Default: all]\n"
+           "-D     : select OpenCL Device Type. 0: GPU, 1: CPU, 2: all. [Default: GPU]\n"
+           "-S     : select the thread scheduler type. 0: sequential, 1: asynchronous. [Default 1]\n"
+           "-P     : select the Profile, from 0 to 10. [Default: auto-tuning]\n"
+           "-F     : force verify key with OpenCL instead of CPU. [Default: disabled]\n"
+           "-Q     : select queue engine. 0: forward, 1: reverse, 2: random. [Default: 0]\n"
+           "-s     : show the list of OpenCL platforms/devices, then exit\n"
+           "-V     : enable debug messages\n"
+           "-v     : show the version\n"
+           "-h     : show this help\n\n", name);
 
-	printf ("Example, select devices 1, 2 and 3 using platform 1 and 2, with random queue engine:\n\n"
-		"%s -D 2 -Q 2 -p 1,2 -d 1,2,3 2ab12bf2 4B71E49D 6A606453 D79BD94B 16A2255B\n\n", name);
+    printf("Example, select devices 1, 2 and 3 using platform 1 and 2, with random queue engine:\n\n"
+           "%s -D 2 -Q 2 -p 1,2 -d 1,2,3 2ab12bf2 4B71E49D 6A606453 D79BD94B 16A2255B\n\n", name);
 
-	exit (8);
+    exit(8);
 }
 
-static bool parse_arg (char * restrict in, unsigned int *out, unsigned int *out_cnt, const int opt_type)
-{
-	unsigned int cnt = 0;
+static bool parse_arg(char *restrict in, unsigned int *out, unsigned int *out_cnt, const int opt_type) {
+    unsigned int cnt = 0;
 
-	if (in == NULL)
-	{
-		out[cnt++] = 0xff;
-		*out_cnt = cnt;
-	}
-	else
-	{
-		if (strchr (in, ','))
-		{
-			// multiple values
-			char *saveptr = NULL;
-			char *next = strtok_r (in, ",", &saveptr);
+    if (in == NULL) {
+        out[cnt++] = 0xff;
+        *out_cnt = cnt;
+    } else {
+        if (strchr(in, ',')) {
+            // multiple values
+            char *saveptr = NULL;
+            char *next = strtok_r(in, ",", &saveptr);
 
-			do
-			{
-				unsigned int tmp_sel = (unsigned int) strtoul (next, NULL, 10);
-				if (errno == EINVAL || errno == ERANGE ||
-						(tmp_sel < 1 || tmp_sel > 16))
-				{
-					printf ("! Invalid %s argument\n", (opt_type == 0) ? "'platform'" : "'device'");
-					return false;
-				}
+            do {
+                unsigned int tmp_sel = (unsigned int) strtoul(next, NULL, 10);
+                if (errno == EINVAL || errno == ERANGE ||
+                        (tmp_sel < 1 || tmp_sel > 16)) {
+                    printf("! Invalid %s argument\n", (opt_type == 0) ? "'platform'" : "'device'");
+                    return false;
+                }
 
-				out[cnt++] = tmp_sel;
+                out[cnt++] = tmp_sel;
 
-			} while ((next = strtok_r (NULL, ",", &saveptr)) != NULL);
+            } while ((next = strtok_r(NULL, ",", &saveptr)) != NULL);
 
-			*out_cnt = cnt;
+            *out_cnt = cnt;
 
-			// todo: sort, uniq
-		}
-		else
-		{
-			out[0] = (unsigned int) strtoul (in, NULL, 10);
-			if (errno == EINVAL || errno == ERANGE)
-			{
-				printf ("! Invalid %s argument\n", (opt_type == 0) ? "'platform'" : "'device'");
-				return false;
-			}
-			*out_cnt = 1;
-		}
-	}
+            // todo: sort, uniq
+        } else {
+            out[0] = (unsigned int) strtoul(in, NULL, 10);
+            if (errno == EINVAL || errno == ERANGE) {
+                printf("! Invalid %s argument\n", (opt_type == 0) ? "'platform'" : "'device'");
+                return false;
+            }
+            *out_cnt = 1;
+        }
+    }
 
-	return true;
+    return true;
 }
 
-int main (int argc, char **argv)
-{
-	opencl_ctx_t ctx;
-
-	uint32_t uid = 0, nR1 = 0, aR1 = 0, nR2 = 0, aR2 = 0;
-	bool opencl_profiling = 0;
-	bool force_hitag2_opencl = false;
-	bool verbose = false;
-	bool show = false;
-
-	char *platforms_selected = NULL;
-	char *devices_selected = NULL;
-	unsigned int device_types_selected = 0;
-	unsigned int thread_scheduler_type_selected = THREAD_TYPE_ASYNC;
-	unsigned int profile_selected = 2;
-	unsigned int queue_type = 0;
-
-	uint32_t target = 0;
-	uint32_t **matches_found = NULL;
-	uint64_t **matches = NULL;
-
-	int opt;
-
-	while ((opt = getopt (argc, argv, "p:d:D:S:P:F:Q:svVh")) != -1)
-	{
-		switch (opt)
-		{
-			case 'p':
-					// 1, 2, 3, etc ..
-					platforms_selected = strdup (optarg);
-					break;
-			case 'd':
-					// 1, 2, 3, etc ...
-					devices_selected = strdup (optarg);
-					break;
-			case 'D':
-					// 0: gpu, 1: cpu, 2: all
-					device_types_selected = (unsigned int) strtoul (optarg, NULL, 10);
-					if (device_types_selected > 2)
-					{
-						printf ("! Invalid DEVICE TYPE argument (accepted values: from 0 to 2)\n");
-						usage (argv[0]);
-					}
-					break;
-			case 'S':
-					// 0: sequential, 1: async
-					thread_scheduler_type_selected = (unsigned int) strtoul (optarg, NULL, 10);
-					break;
-			case 'P':
-					profile_selected = (unsigned int) strtoul (optarg, NULL, 10);
-					if (profile_selected > 10)
-					{
-						printf ("! Invalid PROFILE argument (accepted valuee: from 0 to 10)\n");
-						usage (argv[0]);
-					}
-					break;
-			case 'F':
-					force_hitag2_opencl = true;
-					break;
-			case 'Q':
-					// 0: forward, 1: reverse, 2: random
-					queue_type = (unsigned int) strtoul (optarg, NULL, 10);
-					if (queue_type != QUEUE_TYPE_FORWARD && queue_type != QUEUE_TYPE_REVERSE && queue_type != QUEUE_TYPE_RANDOM)
-					{
-						printf ("! Invalid QUEUE TYPE argument (accepted values: 0, 1 or 2)\n");
-						usage (argv[0]);
-					}
-					break;
-			case 's':
-					show = true;
-					break;
-			case 'V':
-					verbose = true;
-					break;
-			case 'v':
-					printf ("Version: %s\n", VERSION);
-					exit (0);
-			case 'h':
-			default:
-					usage (argv[0]);
-		}
-	}
-
-	unsigned int plat_sel[16] = { 0 };
-	unsigned int plat_cnt = 0;
-	unsigned int dev_sel[16] = { 0 };
-	unsigned int dev_cnt = 0;
-
-	if (!parse_arg (platforms_selected, plat_sel, &plat_cnt, 0))
-	{
-		free (platforms_selected);
-		usage (argv[0]);
-	}
-
-	if (!parse_arg (devices_selected, dev_sel, &dev_cnt, 1))
-	{
-		free (platforms_selected);
-		free (devices_selected);
-		usage (argv[0]);
-	}
-
-	free (platforms_selected);
-	free (devices_selected);
-
-	if (device_types_selected == 0) device_types_selected = CL_DEVICE_TYPE_GPU;
-	else if (device_types_selected == 1) device_types_selected = CL_DEVICE_TYPE_CPU;
-	else device_types_selected = CL_DEVICE_TYPE_ALL;
-
-	if (show)
-	{
-		plat_sel[0] = 0xff;
-		dev_sel[0] = 0xff;
-		device_types_selected = CL_DEVICE_TYPE_ALL;
-	}
-
-	if (verbose)
-	{
-		if (plat_sel[0] == 0xff) printf ("Platforms selected    : ALL\n");
-		else
-		{
-			printf ("Platforms selected    : %u", plat_sel[0]);
-			for (unsigned int i = 1; i < plat_cnt; i++) printf (", %u", plat_sel[i]);
-			printf ("\n");
-		}
-
-		if (dev_sel[0] == 0xff)	printf ("Devices selected      : ALL\n");
-		else
-		{
-			printf ("Devices selected      : %u", dev_sel[0]);
-			for (unsigned int i = 1; i < dev_cnt; i++) printf (", %u", dev_sel[i]);
-			printf ("\n");
-		}
-
-		printf ("Device types selected : %s\n", (device_types_selected == CL_DEVICE_TYPE_GPU) ? "GPU" : (device_types_selected == CL_DEVICE_TYPE_CPU) ? "CPU" : "ALL");
-		printf ("Scheduler selected    : %s\n", (thread_scheduler_type_selected == 0) ? "sequential" : "async");
-		printf ("Profile selected      : %d\n", profile_selected);
-	}
-
-	if (!show)
-	{
-		if ((argc - optind) < 5)
-		{
-			#if DEBUGME > 0
-			printf ("! Invalid extra arguments\n");
-			#endif
-			usage (argv[0]);
-		}
-
-		for (int e = 0; e < 5; optind++, e++)
-		{
-			switch (e)
-			{
-				case 0: // UID
-					if (!strncmp (argv[optind], "0x", 2) || !strncmp (argv[optind], "0X", 2))
-					{
-						if (strlen(argv[optind]) != 2+8) { printf ("! Invalid UID length\n"); usage (argv[0]); }
-						uid = (uint32_t) rev32 (hexreversetoulong(argv[optind] + 2));
-					}
-					else
-					{
-						if (strlen(argv[optind]) != 8) { printf ("! Invalid UID length\n"); usage (argv[0]); }
-						uid = (uint32_t) rev32 (hexreversetoulong(argv[optind]));
-					}
-					break;
-
-				case 1: // nR1
-					if (!strncmp (argv[optind], "0x", 2) || !strncmp (argv[optind], "0X", 2))
-					{
-						if (strlen(argv[optind]) != 2+8) { printf ("! Invalid nR1 length\n"); usage (argv[0]); }
-						nR1 = (uint32_t) rev32 (hexreversetoulong(argv[optind] + 2));
-					}
-					else
-					{
-						if (strlen(argv[optind]) != 8) { printf ("! Invalid nR1 length\n"); usage (argv[0]); }
-						nR1 = (uint32_t) rev32 (hexreversetoulong(argv[optind]));
-					}
-					break;
-
-				case 2: // aR1
-					if (strlen(argv[optind]) != 8) { printf ("! Invalid aR1 length\n"); usage (argv[0]); }
-					aR1 = (uint32_t) strtoul (argv[optind], NULL, 16);
-					break;
-
-				case 3: // nR2
-					if (!strncmp (argv[optind], "0x", 2) || !strncmp (argv[optind], "0X", 2))
-					{
-						if (strlen(argv[optind]) != 2+8) { printf ("! Invalid nR2 length\n"); usage (argv[0]); }
-						nR2 = (uint32_t) rev32 (hexreversetoulong(argv[optind] + 2));
-					}
-					else
-					{
-						if (strlen(argv[optind]) != 8) { printf ("! Invalid nR2 length\n"); usage (argv[0]); }
-						nR2 = (uint32_t) rev32 (hexreversetoulong(argv[optind]));
-					}
-					break;
-
-				case 4: // aR2
-					if (strlen(argv[optind]) != 8) { printf ("! Invalid aR2 length\n"); usage (argv[0]); }
-					aR2 = (uint32_t) strtoul (argv[optind], NULL, 16);
-					break;
-
-				default: // skip invalid instead of show usage and exit
-					optind = argc;
-					break;
-			}
-		}
-	}
-
-	memset (&ctx, 0, sizeof (opencl_ctx_t));
-	memset (keystream, 0, sizeof (keystream));
-	memset (candidates, 0, sizeof (candidates));
-
-	ctx.profiling = opencl_profiling;
-	ctx.thread_sched_type = (short) thread_scheduler_type_selected;
-	ctx.force_hitag2_opencl = force_hitag2_opencl;
-
-	uint32_t checks[4] = { uid, aR2, nR1, nR2 };
-
-	if (!show)
-	{
-		if (verbose) printf ("uid: %u, aR2: %u, nR1: %u, nR2: %u\n", checks[0], checks[1], checks[2], checks[3]);
-
-		target = ~aR1;
-		// bitslice inverse target bits
-		bitslice (~target, keystream);
-
-		size_t layer_0_found = 0;
-
-		// compute layer 0 output
-		for (size_t i0 = 0; i0 < 1 << 20; i0++)
-		{
-			uint64_t state0 = expand (0x5806b4a2d16c, i0);
-
-			if (f(state0) == target >> 31)
-			{
-				// using uint64_t
-				// candidates[layer_0_found++] = state0;
-				// or
-				// cf kernel, state is now split in 3 shorts >> 2
-				candidates[(layer_0_found * 3) + 0] = (uint16_t)((state0 >> (32 + 2)) & 0xffff);
-				candidates[(layer_0_found * 3) + 1] = (uint16_t)((state0 >> (16 + 2)) & 0xffff);
-				candidates[(layer_0_found * 3) + 2] = (uint16_t)((state0 >> (0 + 2)) & 0xffff);
-				layer_0_found++;
-			}
-		}
-
-		#if DEBUGME >= 1
-		printf ("[debug] layer_0_found: %zu\n", layer_0_found);
-		#endif
-	}
-
-	// powered by dolphin's macros :)
-	int freeListIdx = 0;
-
-	// todo, calculate the max number of allocations to remove 0x40
-	void **freeList = (void **) malloc (0x40 * sizeof(void *));
-	if (!freeList)
-	{
-		printf ("Error: malloc (freeList) failed (%d): %s\n", errno, strerror (errno));
-		exit (3);
-	}
-
-	if (!show)
-	{
-		// load OpenCL kernel source
-		struct stat st;
-		const char *opencl_kernel = "ht2crack5opencl_kernel.cl";
-
-		int fd = open (opencl_kernel, O_RDONLY);
-		if (fd <= 0) {
-			printf ("Error: open (%s) failed (%d): %s\n", opencl_kernel, errno, strerror (errno));
-			exit (3);
-		}
-
-		if (fstat (fd, &st)) {
-			printf ("Error: stat (%s) failed (%d): %s\n", opencl_kernel, errno, strerror (errno));
-			close (fd);
-			exit (3);
-		}
-
-		ctx.kernelSource_len = (size_t) st.st_size;
-		ctx.kernelSource[0]  = (char *) calloc (ctx.kernelSource_len + 1, sizeof (char)); // size + \0
-		if (!ctx.kernelSource[0]) {
-			printf ("Error: calloc (ctx.kernelSource[0]) failed (%d): %s\n", errno, strerror (errno));
-			exit (3);
-		}
-
-		MEMORY_FREE_ADD(ctx.kernelSource[0])
-
-		if (read (fd, ctx.kernelSource[0], ctx.kernelSource_len) < (ssize_t) ctx.kernelSource_len)
-		{
-			printf ("Error: read (%s) failed (%d): %s\n", opencl_kernel, errno, strerror (errno));
-			close (fd);
-			MEMORY_FREE_ALL
-			exit (3);
-		}
-
-		ctx.kernelSource[0][ctx.kernelSource_len] = '\0';
-
-		close (fd);
-	}
-
-	// now discover and set up compute device(s)
-	int err = 0;
-	cl_uint ocl_platform_cnt = 0;
-	unsigned int ocl_platform_max = MAX_OPENCL_DEVICES; // 16
-
-	cl_platform_id *ocl_platforms = (cl_platform_id *) calloc (ocl_platform_max, sizeof (cl_platform_id));
-	if (!ocl_platforms)
-	{
-		printf ("Error: calloc (ocl_platforms) failed (%d): %s\n", errno, strerror (errno));
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	MEMORY_FREE_ADD(ocl_platforms)
-
-	// enum platforms
-	err = clGetPlatformIDs (ocl_platform_max, ocl_platforms, &ocl_platform_cnt);
-	if (err != CL_SUCCESS) {
-		printf ("Error: clGetPlatformIDs() failed (%d)\n", err);
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	if (ocl_platform_cnt == 0) {
-		printf ("No platforms found, exit\n");
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	// allocate memory to hold info about platforms/devices
-	compute_platform_ctx_t *cd_ctx = (compute_platform_ctx_t *) calloc (ocl_platform_cnt, sizeof (compute_platform_ctx_t));
-	if (!cd_ctx) {
-		printf ("Error: calloc (compute_platform_ctx_t) failed (%d): %s\n", errno, strerror (errno));
-		MEMORY_FREE_ALL
-		exit (err);
-	}
-
-	MEMORY_FREE_ADD(cd_ctx)
-
-	cl_platform_info ocl_platforms_info[3] = { CL_PLATFORM_NAME, CL_PLATFORM_VENDOR, CL_PLATFORM_VERSION };
-	unsigned int ocl_platforms_info_cnt = sizeof (ocl_platforms_info) / sizeof (cl_platform_info);
-
-	cl_device_info ocl_devices_info[8] = { CL_DEVICE_TYPE, CL_DEVICE_NAME, CL_DEVICE_VERSION, CL_DRIVER_VERSION, CL_DEVICE_VENDOR, CL_DEVICE_LOCAL_MEM_TYPE, CL_DEVICE_MAX_WORK_ITEM_SIZES, CL_DEVICE_MAX_COMPUTE_UNITS };
-	unsigned int ocl_devices_info_cnt = sizeof (ocl_devices_info) / sizeof (cl_device_info);
-
-	unsigned int info_idx = 0;
-	size_t tmp_len = 0;
-	char *tmp_buf = NULL;
-
-	unsigned int global_device_id = 0;
-	size_t selected_platforms_cnt = 0;
-	size_t selected_devices_cnt = 0;
-
-	if (show) verbose = true;
-
-	if (verbose) printf ("- Found %u OpenCL Platform(s)\n", ocl_platform_cnt);
-
-	for (cl_uint platform_idx = 0; platform_idx < ocl_platform_cnt; platform_idx++)
-	{
-		cd_ctx[platform_idx].platform_id = ocl_platforms[platform_idx];
-		cd_ctx[platform_idx].selected = plat_dev_enabled (platform_idx, plat_sel, plat_cnt, 0, 0);
-
-		if (cd_ctx[platform_idx].selected) selected_platforms_cnt++;
-
-		if (verbose) printf ("\n-- Platform ID: %d\n", platform_idx+1);
-
-		for (info_idx = 0; info_idx < ocl_platforms_info_cnt; info_idx++)
-		{
-			cl_platform_info ocl_info = ocl_platforms_info[info_idx];
-
-			err = clGetPlatformInfo (cd_ctx[platform_idx].platform_id, ocl_info, 0, NULL, &tmp_len);
-			if (err != CL_SUCCESS) {
-				printf ("Error: clGetPlatformInfo(param size) failed (%d)\n", err);
-				MEMORY_FREE_ALL
-				exit (2);
-			}
-
-			if (tmp_len > 0)
-			{
-				if (!(tmp_buf = (char *) calloc (tmp_len, sizeof (char))))
-				{
-					printf ("Error: calloc (ocl_info %u) failed (%d): %s\n", info_idx, errno, strerror (errno));
-					MEMORY_FREE_ALL
-					exit (2);
-				}
-
-				MEMORY_FREE_ADD(tmp_buf)
-
-				err = clGetPlatformInfo (cd_ctx[platform_idx].platform_id, ocl_info, tmp_len, tmp_buf, 0);
-				if (err != CL_SUCCESS) {
-					printf ("Error: clGetPlatformInfo(param) failed (%d)\n", err);
-					MEMORY_FREE_ALL
-					exit (2);
-				}
-			}
-			else
-			{
-				tmp_len = 4;
-				if (!(tmp_buf = (char *) calloc (tmp_len, sizeof (char))))
-				{
-					printf ("Error: calloc (ocl_info %u) failed (%d): %s\n", info_idx, errno, strerror (errno));
-					MEMORY_FREE_ALL
-					exit (2);
-				}
-
-				MEMORY_FREE_ADD(tmp_buf)
-
-				strncpy (tmp_buf, "N/A\0", tmp_len);
-			}
-
-			if (verbose)
-			{
-				const char *tmp_info_desc = (info_idx == 0) ? "Name" : (info_idx == 1) ? "Vendor" : "Version";
-
-				printf ("%14s: %s\n", tmp_info_desc, tmp_buf);
-			}
-
-			switch (info_idx)
-			{
-				case 0:
-					strncpy(cd_ctx[platform_idx].name, tmp_buf, tmp_len < 0xff ? tmp_len : 0xff-1);
-					break;
-				case 1:
-					strncpy(cd_ctx[platform_idx].vendor, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40-1);
-					break;
-				case 2:
-					strncpy(cd_ctx[platform_idx].version, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40-1);
-					break;
-			}
-
-			if (info_idx == 1)
-			{
-				// todo: do the same this devices
-				if (!strncmp (tmp_buf, "NVIDIA", 6)) cd_ctx[platform_idx].is_nv = true;
-				else if (!strncmp (tmp_buf, "Apple", 5)) { cd_ctx[platform_idx].is_apple = true; cd_ctx[platform_idx].warning = true; }
-				else if (!strncmp (tmp_buf, "Intel", 5)) cd_ctx[platform_idx].is_intel = true;
-			}
-
-			MEMORY_FREE_DEL(tmp_buf)
-		}
-
-		if (!show && verbose)
-		{
-			printf ("%14s: %s\n", "Selected", (cd_ctx[platform_idx].selected) ? "yes" : "no");
-			if (cd_ctx[platform_idx].warning) printf ("\n%14s: performance will not be optimal using this platform\n\n", "=====> Warning");
-		}
-
-		// enum devices with this platform
-		unsigned int ocl_device_cnt = 0;
-		unsigned int ocl_device_max = MAX_OPENCL_DEVICES;
-
-		cl_device_id *ocl_devices = (cl_device_id *) calloc (ocl_device_max, sizeof (cl_device_id));
-		if (!ocl_devices) {
-			printf ("Error: calloc (ocl_devices) failed (%d): %s\n", errno, strerror (errno));
-			MEMORY_FREE_ALL
-			exit (2);
-		}
-
-		MEMORY_FREE_ADD(ocl_devices)
-
-		err = clGetDeviceIDs (cd_ctx[platform_idx].platform_id, CL_DEVICE_TYPE_ALL, ocl_device_max, ocl_devices, &ocl_device_cnt);
-		if (ocl_device_cnt == 0)
-		{
-			if (device_types_selected == CL_DEVICE_TYPE_ALL) printf ("No device(s) available with platform id %d\n", platform_idx);
-			cd_ctx[platform_idx].device_cnt = 0;
-			continue;
-		}
-
-		if (err != CL_SUCCESS) {
-			printf ("Error: clGetDeviceIDs(cnt) failed (%d)\n", err);
-			MEMORY_FREE_ALL
-			exit (2);
-		}
-
-		if (verbose) printf ("%14s: %u\n", "Device(s)", ocl_device_cnt);
-
-		cd_ctx[platform_idx].device_cnt = ocl_device_cnt;
-
-		for (unsigned int device_idx = 0; device_idx < ocl_device_cnt; device_idx++)
-		{
-			memset (&cd_ctx[platform_idx].device[device_idx], 0, sizeof (compute_device_ctx_t));
-			cl_device_id ocl_device = ocl_devices[device_idx];
-			cd_ctx[platform_idx].device[device_idx].platform_id = cd_ctx[platform_idx].platform_id;
-
-			if (verbose) printf ("---- * ID: %u\n", global_device_id+1);
-
-			for (info_idx = 0; info_idx < ocl_devices_info_cnt; info_idx++)
-			{
-				cl_device_info ocl_dev_info = ocl_devices_info[info_idx];
-
-				if (info_idx == 0)
-				{
-					cl_device_type device_type;
-
-					err = clGetDeviceInfo (ocl_device, ocl_dev_info, sizeof (cl_device_type), &device_type, 0);
-					if (err != CL_SUCCESS) {
-						printf ("Error: clGetDeviceInfo(device_type) failed (%d)\n", err);
-						MEMORY_FREE_ALL
-						exit (2);
-					}
-
-					if (device_type & CL_DEVICE_TYPE_GPU) cd_ctx[platform_idx].device[device_idx].is_gpu = 1;
-
-					if (verbose) printf ("%14s: %s\n", "Device Type", (device_type & CL_DEVICE_TYPE_GPU) ? "GPU" : (device_type & CL_DEVICE_TYPE_CPU ) ? "CPU" : "Other");
-
-					cd_ctx[platform_idx].device[device_idx].selected = plat_dev_enabled (global_device_id, dev_sel, dev_cnt, (unsigned int) device_type, device_types_selected);
-					global_device_id++;
-					if (cd_ctx[platform_idx].device[device_idx].selected) selected_devices_cnt++;
-					continue;
-				}
-				else if (info_idx == 5)
-				{
-					cl_device_local_mem_type local_mem_type;
-
-					err = clGetDeviceInfo (ocl_device, ocl_dev_info, sizeof (cl_device_local_mem_type), &local_mem_type, 0);
-					if (err != CL_SUCCESS) {
-						printf ("Error: clGetDeviceInfo(local_mem_type) failed (%d)\n", err);
-						MEMORY_FREE_ALL
-						exit (2);
-					}
-
-					if (local_mem_type == CL_LOCAL || local_mem_type == CL_GLOBAL)
-					{
-						if (verbose) printf ("%14s: %s\n", "Local Mem Type", (local_mem_type == CL_LOCAL) ? "Local" : "Global");
-
-						if (cd_ctx[platform_idx].is_apple)
-						{
-							if (strncmp (cd_ctx[platform_idx].device[device_idx].vendor, "Intel", 5) != 0) cd_ctx[platform_idx].device[device_idx].have_local_memory = true;
-						}
-						else if (cd_ctx[platform_idx].is_nv) cd_ctx[platform_idx].device[device_idx].have_local_memory = true;
-/*
-						// swap the 'if' comment for enable local memory with apple gpu's (my Iris crash, abort 6)
-						// if (!(!strncmp (cd_ctx[platform_idx].device[device_idx].vendor, "Intel", 5) && cd_ctx[platform_idx].is_apple && !cd_ctx[platform_idx].device[device_idx].is_gpu))
-						if (!(!strncmp (cd_ctx[platform_idx].device[device_idx].vendor, "Intel", 5) && cd_ctx[platform_idx].is_apple))
-						{
-							cd_ctx[platform_idx].device[device_idx].have_local_memory = true;
-						}
-*/
-					}
-					else
-					{
-						if (verbose) printf ("%14s: None\n", "Local Mem Type");
-					}
-
-					if (verbose) printf ("%14s: %s\n", "Local Mem Opt", (cd_ctx[platform_idx].device[device_idx].have_local_memory) ? "yes" : "no");
-
-					continue;
-				}
-				else if (info_idx == 6)
-				{
-					size_t wis[3] = { 0 };
-					err = clGetDeviceInfo (ocl_device, ocl_dev_info, sizeof (size_t) * 3, wis, 0);
-					if (err != CL_SUCCESS) {
-						printf ("Error: clGetDeviceInfo(work_items_size) failed (%d)\n", err);
-						MEMORY_FREE_ALL
-						exit (2);
-					}
-
-					if (verbose) printf ("%14s: (%zu,%zu,%zu)\n", "Max Work-Items", wis[0], wis[1], wis[2]);
-
-					#if APPLE_GPU_BROKEN == 1
-					if (wis[1] < GLOBAL_WS_1 && cd_ctx[platform_idx].device[device_idx].is_apple_gpu)
-					{
-						cd_ctx[platform_idx].device[device_idx].unsupported = true;
-					}
-					#endif
-					continue;
-				}
-				else if (info_idx == 7)
-				{
-					cl_uint cores = 0;
-					err = clGetDeviceInfo (ocl_device, ocl_dev_info, sizeof (cl_uint), &cores, 0);
-					if (err != CL_SUCCESS) {
-						printf ("Error: clGetDeviceInfo(compute_units) failed (%d)\n", err);
-						MEMORY_FREE_ALL
-						exit (2);
-					}
-
-					if (verbose) printf ("%14s: %u\n", "Compute Units", cores);
-
-					cd_ctx[platform_idx].device[device_idx].compute_units = cores;
-					continue;
-				}
-
-				tmp_len = 0;
-				tmp_buf = NULL;
-
-				err = clGetDeviceInfo (ocl_device, ocl_dev_info, 0, NULL, &tmp_len);
-				if (err != CL_SUCCESS) {
-					printf ("Error: clGetDeviceInfo(param size) failed (%d)\n", err);
-					MEMORY_FREE_ALL
-					exit (2);
-				}
-
-				if (tmp_len > 0)
-				{
-					if (!(tmp_buf = (char *) calloc (tmp_len, sizeof (char))))
-					{
-						printf ("Error: calloc (ocl_dev_info %u) failed (%d): %s\n", info_idx, errno, strerror (errno));
-						MEMORY_FREE_ALL
-						exit (2);
-					}
-
-					MEMORY_FREE_ADD(tmp_buf)
-
-					err = clGetDeviceInfo (ocl_device, ocl_dev_info, tmp_len, tmp_buf, 0);
-					if (err != CL_SUCCESS) {
-						printf ("Error: clGetDeviceInfo(param) failed (%d)\n", err);
-						MEMORY_FREE_ALL
-						exit (2);
-					}
-				}
-				else
-				{
-					tmp_len = 4;
-					if (!(tmp_buf = (char *) calloc (tmp_len, sizeof (char))))
-					{
-						printf ("Error: calloc (ocl_dev_info %u) failed (%d): %s\n", info_idx, errno, strerror (errno));
-						MEMORY_FREE_ALL
-						exit (2);
-					}
-
-					MEMORY_FREE_ADD(tmp_buf)
-
-					strncpy (tmp_buf, "N/A\0", tmp_len);
-				}
-
-				if (verbose)
-				{
-					const char *tmp_dev_info_desc = (info_idx == 1) ? "Name" : (info_idx == 2) ? "Version" : (info_idx == 3) ? "Driver Version" : "Vendor";
-
-					printf ("%14s: %s\n", tmp_dev_info_desc, tmp_buf);
-				}
-
-				switch (info_idx)
-				{
-					case 1:
-						strncpy (cd_ctx[platform_idx].device[device_idx].name, tmp_buf, tmp_len < 0xff ? tmp_len : 0xff-1);
-						break;
-					case 2:
-						strncpy (cd_ctx[platform_idx].device[device_idx].version, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40-1);
-						break;
-					case 3:
-						strncpy (cd_ctx[platform_idx].device[device_idx].driver_version, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40-1);
-						break;
-					case 4:
-						strncpy (cd_ctx[platform_idx].device[device_idx].vendor, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40-1);
-						break;
-				}
-
-				if (info_idx == 4)
-				{
-					if (!strncmp (tmp_buf, "Intel", 5) && cd_ctx[platform_idx].is_apple)
-					{
-						// disable hitag2 with apple platform and not apple device vendor (< Apple M1)
-						ctx.force_hitag2_opencl = false;
-
-						cd_ctx[platform_idx].device[device_idx].is_apple_gpu = cd_ctx[platform_idx].device[device_idx].is_gpu;
-					}
-
-					if (!strncmp (tmp_buf, "NVIDIA", 6) && cd_ctx[platform_idx].is_nv)
-					{
-						unsigned int sm_maj = 0, sm_min = 0;
-
-						err  = clGetDeviceInfo (ocl_device, 0x4000, sizeof (unsigned int), &sm_maj, 0);
-						err |= clGetDeviceInfo (ocl_device, 0x4001, sizeof (unsigned int), &sm_min, 0);
-
-						if (err != CL_SUCCESS) {
-							printf ("Error: clGetDeviceInfo(sm_maj/sm_min) failed (%d)\n", err);
-							MEMORY_FREE_ALL
-							exit (2);
-						}
-
-						cd_ctx[platform_idx].device[device_idx].sm_maj = sm_maj;
-						cd_ctx[platform_idx].device[device_idx].sm_min = sm_min;
-
-						if (verbose) printf ("%14s: %u%u\n", "SM", sm_maj, sm_min);
-
-						if (sm_maj >= 5) // >= Maxwell
-						{
-							// https://docs.nvidia.com/cuda/parallel-thread-execution/index.html#logic-and-shift-instructions-lop3
-							// Requires sm_50 or higher.
-							cd_ctx[platform_idx].device[device_idx].have_lop3 = true;
-						}
-						else
-						{
-							cd_ctx[platform_idx].device[device_idx].warning = true;
-						}
-
-						cd_ctx[platform_idx].device[device_idx].is_nv = true;
-					}
-					else
-					{
-						cd_ctx[platform_idx].device[device_idx].warning = true;
-					}
-				}
-
-				MEMORY_FREE_DEL(tmp_buf)
-			}
-
-			if (!show && verbose) printf ("%14s: %s\n", "Selected", (cd_ctx[platform_idx].device[device_idx].selected) ? "yes" : "no");
-
-			if (cd_ctx[platform_idx].device[device_idx].unsupported)
-			{
-				printf ("\n%14s: this device was not supported, beacuse of missing resources\n\n", "=====> Warning");
-				continue;
-			}
-
-			if (cd_ctx[platform_idx].device[device_idx].warning)
-			{
-				if (!show && verbose) printf ("\n%14s: performance will not be optimal using this device\n\n", "=====> Warning");
-			}
-
-			cd_ctx[platform_idx].device[device_idx].device_id = ocl_device;
-		}
-		MEMORY_FREE_DEL(ocl_devices)
-	}
-	MEMORY_FREE_DEL(ocl_platforms)
-
-	// new selection engine, need to support multi-gpu system (with the same platform)
-
-	if (verbose) printf ("\n");
-
-	if (show)
-	{
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	if (selected_platforms_cnt == 0)
-	{
-		printf ("! No platform was selected ...\n");
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	if (selected_devices_cnt == 0)
-	{
-		printf ("! No device(s) was selected ...\n");
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	size_t w = 0, q = 0, g = 0;
-
-	size_t z = 0; // z is a dolphin's friend
-
-	// show selected devices
-
-	printf ("Selected %zu OpenCL Device(s)\n\n", selected_devices_cnt);
-
-	for (w = 0; w < ocl_platform_cnt; w++)
-	{
-		if (!cd_ctx[w].selected) continue;
-
-		for (q = 0; q < cd_ctx[w].device_cnt; q++)
-		{
-			if (!cd_ctx[w].device[q].selected) continue;
-
-			printf ("%2zu - %s", z, cd_ctx[w].device[q].name);
-			if (verbose)
-			{
-				printf (" (Lop3 %s, ", (cd_ctx[w].device[q].have_lop3) ? "yes" : "no");
-				printf ("Local Memory %s)", (cd_ctx[w].device[q].have_local_memory) ? "yes" : "no");
-			}
-			printf ("\n");
-
-			z++;
-		}
-	}
-	printf ("\n");
-
-	if (selected_devices_cnt != z)
-	{
-		printf ("BUG: z and selected_devices_cnt are not equal\n");
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	// time to eat some memory :P
-
-	if (!(ctx.device_ids = (cl_device_id *) calloc (selected_devices_cnt, sizeof (cl_device_id))))
-	{
-		printf ("Error: calloc (ctx.device_ids) failed (%d): %s\n", errno, strerror (errno));
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	MEMORY_FREE_ADD(ctx.device_ids)
-
-	if (!(ctx.contexts = (cl_context *) calloc (selected_devices_cnt, sizeof (cl_context))))
-	{
-		printf ("Error: calloc (ctx.contexts) failed (%d): %s\n", errno, strerror (errno));
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	MEMORY_FREE_ADD(ctx.contexts)
-
-	if (!(ctx.commands = (cl_command_queue *) calloc (selected_devices_cnt, sizeof (cl_command_queue))))
-	{
-		printf ("Error: calloc (ctx.commands) failed (%d): %s\n", errno, strerror (errno));
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	MEMORY_FREE_ADD(ctx.commands)
-
-	if (!(ctx.programs = (cl_program *) calloc (selected_devices_cnt, sizeof (cl_program))))
-	{
-		printf ("Error: calloc (ctx.programs) failed (%d): %s\n", errno, strerror (errno));
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	MEMORY_FREE_ADD(ctx.programs)
-
-	if (!(ctx.kernels = (cl_kernel *) calloc (selected_devices_cnt, sizeof (cl_kernel))))
-	{
-		printf ("Error: calloc (ctx.kernels) failed (%d): %s\n", errno, strerror (errno));
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	MEMORY_FREE_ADD(ctx.kernels)
-
-	if (!(matches = (uint64_t **) calloc (selected_devices_cnt, sizeof (uint64_t *))))
-	{
-		printf ("Error: calloc (**matches) failed (%d): %s\n", errno, strerror (errno));
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	MEMORY_FREE_ADD(matches)
-
-	if (!(matches_found = (uint32_t **) calloc (selected_devices_cnt, sizeof (uint32_t *))))
-	{
-		printf ("Error: calloc (**matches_found) failed (%d): %s\n", errno, strerror (errno));
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	MEMORY_FREE_ADD(matches_found)
-
-	if (!(ctx.keystreams = (cl_mem *) calloc (selected_devices_cnt, sizeof (cl_mem))))
-	{
-		printf ("Error: calloc (ctx.keystreams) failed (%d): %s\n", errno, strerror (errno));
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	MEMORY_FREE_ADD(ctx.keystreams)
-
-	if (!(ctx.candidates = (cl_mem *) calloc (selected_devices_cnt, sizeof (cl_mem))))
-	{
-		printf ("Error: calloc (ctx.candidates) failed (%d): %s\n", errno, strerror (errno));
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	MEMORY_FREE_ADD(ctx.candidates)
-
-	if (!(ctx.matches = (cl_mem *) calloc (selected_devices_cnt, sizeof (cl_mem))))
-	{
-		printf ("Error: calloc (ctx.matches) failed (%d): %s\n", errno, strerror (errno));
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	MEMORY_FREE_ADD(ctx.matches)
-
-	if (!(ctx.matches_found = (cl_mem *) calloc (selected_devices_cnt, sizeof (cl_mem))))
-	{
-		printf ("Error: calloc (ctx.matches_found) failed (%d): %s\n", errno, strerror (errno));
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	MEMORY_FREE_ADD(ctx.matches_found)
-
-	if (ctx.force_hitag2_opencl)
-	{
-		if (!(ctx.checks = (cl_mem *) calloc (selected_devices_cnt, sizeof (cl_mem))))
-		{
-			printf ("Error: calloc (ctx.checks) failed (%d): %s\n", errno, strerror (errno));
-			MEMORY_FREE_ALL
-			exit (2);
-		}
-
-		MEMORY_FREE_ADD(ctx.checks)
-	}
-
-	if (!(ctx.global_ws = (size_t *) calloc (selected_devices_cnt, sizeof (size_t))))
-	{
-		printf ("Error: calloc (ctx.global_ws) failed (%d): %s\n", errno, strerror (errno));
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	MEMORY_FREE_ADD(ctx.global_ws)
-
-	if (!(ctx.local_ws = (size_t *) calloc (selected_devices_cnt, sizeof (size_t))))
-	{
-		printf ("Error: calloc (ctx.local_ws) failed (%d): %s\n", errno, strerror (errno));
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	MEMORY_FREE_ADD(ctx.local_ws)
-
-	if (!(ctx.profiles = (int *) calloc (selected_devices_cnt, sizeof (int))))
-	{
-		printf ("Error: calloc (ctx.profiles) failed (%d): %s\n", errno, strerror (errno));
-		MEMORY_FREE_ALL
-		exit (2);
-	}
-
-	MEMORY_FREE_ADD(ctx.profiles)
-
-	// show buidlog in case of error
-	// todo: only for device models
-	unsigned int build_errors = 0;
-	unsigned int build_logs = 0;
-
-	cl_command_queue_properties queue_properties = 0;
-
-	if (opencl_profiling) queue_properties = CL_QUEUE_PROFILING_ENABLE;
-
-	// setup, phase 1
-
-	z = 0; // dolphin
-
-	for (w = 0; w < ocl_platform_cnt; w++)
-	{
-		if (!cd_ctx[w].selected) continue;
-
-		for (q = 0; q < cd_ctx[w].device_cnt; q++)
-		{
-			if (!cd_ctx[w].device[q].selected) continue;
-
-			ctx.device_ids[z] = cd_ctx[w].device[q].device_id;
-
-			// create the opencl context with the array
-			ctx.contexts[z] = clCreateContext (NULL, 1, &ctx.device_ids[z], NULL, NULL, &err);
-			if (!ctx.contexts[z] || err != CL_SUCCESS) {
-				printf ("[%zu] Error: clCreateContext() failed (%d)\n", z, err);
-				MEMORY_FREE_OPENCL(ctx, z)
-				MEMORY_FREE_LIST(matches,z)
-				MEMORY_FREE_LIST(matches_found, z)
-				MEMORY_FREE_ALL
-				exit (2);
-			}
-
-			// create comman queues for each selected devices
-			ctx.commands[z] = clCreateCommandQueue(ctx.contexts[z], ctx.device_ids[z], queue_properties, &err);
-			if (!ctx.commands[z] || err != CL_SUCCESS)
-			{
-				printf ("[%zu] Error: clCreateCommandQueue() failed (%d)\n", z, err);
-				MEMORY_FREE_OPENCL(ctx, z)
-				MEMORY_FREE_LIST(matches,z)
-				MEMORY_FREE_LIST(matches_found, z)
-				MEMORY_FREE_ALL
-				exit (2);
-			}
-
-			// from clang:
-			// warning: cast from 'char *(*)[1]' to 'const char **' increases required alignment from 1 to 8
-			const char *a = (const char *)ctx.kernelSource[0];
-			const char **ks = &a;
-
-			// create the compute program from the source buffer
-			//ctx.programs[z] = clCreateProgramWithSource(ctx.contexts[z], 1, (const char **) &ctx.kernelSource, &ctx.kernelSource_len, &err);
-			ctx.programs[z] = clCreateProgramWithSource(ctx.contexts[z], 1, ks, &ctx.kernelSource_len, &err);
-			if (!ctx.programs[z] || err != CL_SUCCESS)
-			{
-				printf ("[%zu] Error: clCreateProgramWithSource() failed (%d)\n", z, err);
-				MEMORY_FREE_OPENCL(ctx, z)
-				MEMORY_FREE_LIST(matches,z)
-				MEMORY_FREE_LIST(matches_found, z)
-				MEMORY_FREE_ALL
-				exit (2);
-			}
-
-			// build the program executable
-			bool have_local_memory = false;
-			size_t blen = 0;
-			char build_options[0x100];
-
-			memset (build_options, 0, sizeof (build_options));
-
-			strncpy (build_options, "-Werror", 8);
-			blen += 7;
-
-			if (cd_ctx[w].device[q].have_lop3) // enable lop3
-			{
-				strncpy (build_options+blen, " -D HAVE_LOP3", 14);
-				blen += 13;
-			}
-
-			if (ctx.force_hitag2_opencl)
-			{
-				// force using hitag2 key validation with OpenCL
-				strncpy (build_options+blen, " -D WITH_HITAG2_FULL", 21);
-				blen += 20;
-			}
-
-			// Intel's gpu are worst than Apple
-			#if APPLE_GPU_BROKEN == 0
-			if (cd_ctx[w].device[q].is_gpu && !strncmp (cd_ctx[w].device[q].vendor, "Intel", 5))
-			{
-				if (cd_ctx[w].is_apple || cd_ctx[w].is_intel)
-				{
-					strncpy (build_options+blen, " -D LOWPERF", 13);
-					blen += 12;
-				}
-			}
-			#endif
-
-			#if DEBUGME >= 1
-			printf ("[debug] Device %zu have local mem ? %d\n", z, cd_ctx[w].device[q].have_local_memory);
-			#endif
-
-			if (cd_ctx[w].device[q].have_local_memory) // kernel keystream memory optimization
-			{
-				have_local_memory = true;
-				strncpy (build_options+blen, " -D HAVE_LOCAL_MEMORY", 22);
-				blen += 21;
-			}
-
-			if (verbose) printf ("[%zu] Building OpenCL program with options (len %zu): %s\n", z, blen, build_options);
-
-			err = clBuildProgram(ctx.programs[z], 1, &ctx.device_ids[z], build_options, NULL, NULL);
-
-			#if DEBUGME == 0
-			if (err != CL_SUCCESS)
-			#endif
-			{
-				#if DEBUGME > 0
-				if (err != CL_SUCCESS)
-				#endif
-				{
-					printf ("[%zu] Error: clBuildProgram() failed (%d)\n", z, err);
-					build_errors++;
-				}
-
-				// todo: if same device model of other and build_logs > 0, continue
-
-				size_t len = 0;
-				err = clGetProgramBuildInfo(ctx.programs[z], cd_ctx[w].device[q].device_id, CL_PROGRAM_BUILD_LOG, 0, NULL, &len);
-				if (err != CL_SUCCESS) {
-					printf ("[%zu] Error: clGetProgramBuildInfo failed (%d)\n", z, err);
-					continue;
+int main(int argc, char **argv) {
+    opencl_ctx_t ctx;
+
+    uint32_t uid = 0, nR1 = 0, aR1 = 0, nR2 = 0, aR2 = 0;
+    bool opencl_profiling = 0;
+    bool force_hitag2_opencl = false;
+    bool verbose = false;
+    bool show = false;
+
+    char *platforms_selected = NULL;
+    char *devices_selected = NULL;
+    unsigned int device_types_selected = 0;
+    unsigned int thread_scheduler_type_selected = THREAD_TYPE_ASYNC;
+    unsigned int profile_selected = 2;
+    unsigned int queue_type = 0;
+
+    uint32_t target = 0;
+    uint32_t **matches_found = NULL;
+    uint64_t **matches = NULL;
+
+    int opt;
+
+    while ((opt = getopt(argc, argv, "p:d:D:S:P:F:Q:svVh")) != -1) {
+        switch (opt) {
+            case 'p':
+                // 1, 2, 3, etc ..
+                platforms_selected = strdup(optarg);
+                break;
+            case 'd':
+                // 1, 2, 3, etc ...
+                devices_selected = strdup(optarg);
+                break;
+            case 'D':
+                // 0: gpu, 1: cpu, 2: all
+                device_types_selected = (unsigned int) strtoul(optarg, NULL, 10);
+                if (device_types_selected > 2) {
+                    printf("! Invalid DEVICE TYPE argument (accepted values: from 0 to 2)\n");
+                    usage(argv[0]);
+                }
+                break;
+            case 'S':
+                // 0: sequential, 1: async
+                thread_scheduler_type_selected = (unsigned int) strtoul(optarg, NULL, 10);
+                break;
+            case 'P':
+                profile_selected = (unsigned int) strtoul(optarg, NULL, 10);
+                if (profile_selected > 10) {
+                    printf("! Invalid PROFILE argument (accepted valuee: from 0 to 10)\n");
+                    usage(argv[0]);
+                }
+                break;
+            case 'F':
+                force_hitag2_opencl = true;
+                break;
+            case 'Q':
+                // 0: forward, 1: reverse, 2: random
+                queue_type = (unsigned int) strtoul(optarg, NULL, 10);
+                if (queue_type != QUEUE_TYPE_FORWARD && queue_type != QUEUE_TYPE_REVERSE && queue_type != QUEUE_TYPE_RANDOM) {
+                    printf("! Invalid QUEUE TYPE argument (accepted values: 0, 1 or 2)\n");
+                    usage(argv[0]);
+                }
+                break;
+            case 's':
+                show = true;
+                break;
+            case 'V':
+                verbose = true;
+                break;
+            case 'v':
+                printf("Version: %s\n", VERSION);
+                exit(0);
+            case 'h':
+            default:
+                usage(argv[0]);
+        }
+    }
+
+    unsigned int plat_sel[16] = { 0 };
+    unsigned int plat_cnt = 0;
+    unsigned int dev_sel[16] = { 0 };
+    unsigned int dev_cnt = 0;
+
+    if (!parse_arg(platforms_selected, plat_sel, &plat_cnt, 0)) {
+        free(platforms_selected);
+        usage(argv[0]);
+    }
+
+    if (!parse_arg(devices_selected, dev_sel, &dev_cnt, 1)) {
+        free(platforms_selected);
+        free(devices_selected);
+        usage(argv[0]);
+    }
+
+    free(platforms_selected);
+    free(devices_selected);
+
+    if (device_types_selected == 0) device_types_selected = CL_DEVICE_TYPE_GPU;
+    else if (device_types_selected == 1) device_types_selected = CL_DEVICE_TYPE_CPU;
+    else device_types_selected = CL_DEVICE_TYPE_ALL;
+
+    if (show) {
+        plat_sel[0] = 0xff;
+        dev_sel[0] = 0xff;
+        device_types_selected = CL_DEVICE_TYPE_ALL;
+    }
+
+    if (verbose) {
+        if (plat_sel[0] == 0xff) printf("Platforms selected    : ALL\n");
+        else {
+            printf("Platforms selected    : %u", plat_sel[0]);
+            for (unsigned int i = 1; i < plat_cnt; i++) printf(", %u", plat_sel[i]);
+            printf("\n");
+        }
+
+        if (dev_sel[0] == 0xff)	printf("Devices selected      : ALL\n");
+        else {
+            printf("Devices selected      : %u", dev_sel[0]);
+            for (unsigned int i = 1; i < dev_cnt; i++) printf(", %u", dev_sel[i]);
+            printf("\n");
+        }
+
+        printf("Device types selected : %s\n", (device_types_selected == CL_DEVICE_TYPE_GPU) ? "GPU" : (device_types_selected == CL_DEVICE_TYPE_CPU) ? "CPU" : "ALL");
+        printf("Scheduler selected    : %s\n", (thread_scheduler_type_selected == 0) ? "sequential" : "async");
+        printf("Profile selected      : %d\n", profile_selected);
+    }
+
+    if (!show) {
+        if ((argc - optind) < 5) {
+#if DEBUGME > 0
+            printf("! Invalid extra arguments\n");
+#endif
+            usage(argv[0]);
+        }
+
+        for (int e = 0; e < 5; optind++, e++) {
+            switch (e) {
+                case 0: // UID
+                    if (!strncmp(argv[optind], "0x", 2) || !strncmp(argv[optind], "0X", 2)) {
+                        if (strlen(argv[optind]) != 2 + 8) { printf("! Invalid UID length\n"); usage(argv[0]); }
+                        uid = (uint32_t) rev32(hexreversetoulong(argv[optind] + 2));
+                    } else {
+                        if (strlen(argv[optind]) != 8) { printf("! Invalid UID length\n"); usage(argv[0]); }
+                        uid = (uint32_t) rev32(hexreversetoulong(argv[optind]));
+                    }
+                    break;
+
+                case 1: // nR1
+                    if (!strncmp(argv[optind], "0x", 2) || !strncmp(argv[optind], "0X", 2)) {
+                        if (strlen(argv[optind]) != 2 + 8) { printf("! Invalid nR1 length\n"); usage(argv[0]); }
+                        nR1 = (uint32_t) rev32(hexreversetoulong(argv[optind] + 2));
+                    } else {
+                        if (strlen(argv[optind]) != 8) { printf("! Invalid nR1 length\n"); usage(argv[0]); }
+                        nR1 = (uint32_t) rev32(hexreversetoulong(argv[optind]));
+                    }
+                    break;
+
+                case 2: // aR1
+                    if (strlen(argv[optind]) != 8) { printf("! Invalid aR1 length\n"); usage(argv[0]); }
+                    aR1 = (uint32_t) strtoul(argv[optind], NULL, 16);
+                    break;
+
+                case 3: // nR2
+                    if (!strncmp(argv[optind], "0x", 2) || !strncmp(argv[optind], "0X", 2)) {
+                        if (strlen(argv[optind]) != 2 + 8) { printf("! Invalid nR2 length\n"); usage(argv[0]); }
+                        nR2 = (uint32_t) rev32(hexreversetoulong(argv[optind] + 2));
+                    } else {
+                        if (strlen(argv[optind]) != 8) { printf("! Invalid nR2 length\n"); usage(argv[0]); }
+                        nR2 = (uint32_t) rev32(hexreversetoulong(argv[optind]));
+                    }
+                    break;
+
+                case 4: // aR2
+                    if (strlen(argv[optind]) != 8) { printf("! Invalid aR2 length\n"); usage(argv[0]); }
+                    aR2 = (uint32_t) strtoul(argv[optind], NULL, 16);
+                    break;
+
+                default: // skip invalid instead of show usage and exit
+                    optind = argc;
+                    break;
+            }
+        }
+    }
+
+    memset(&ctx, 0, sizeof(opencl_ctx_t));
+    memset(keystream, 0, sizeof(keystream));
+    memset(candidates, 0, sizeof(candidates));
+
+    ctx.profiling = opencl_profiling;
+    ctx.thread_sched_type = (short) thread_scheduler_type_selected;
+    ctx.force_hitag2_opencl = force_hitag2_opencl;
+
+    uint32_t checks[4] = { uid, aR2, nR1, nR2 };
+
+    if (!show) {
+        if (verbose) printf("uid: %u, aR2: %u, nR1: %u, nR2: %u\n", checks[0], checks[1], checks[2], checks[3]);
+
+        target = ~aR1;
+        // bitslice inverse target bits
+        bitslice(~target, keystream);
+
+        size_t layer_0_found = 0;
+
+        // compute layer 0 output
+        for (size_t i0 = 0; i0 < 1 << 20; i0++) {
+            uint64_t state0 = expand(0x5806b4a2d16c, i0);
+
+            if (f(state0) == target >> 31) {
+                // using uint64_t
+                // candidates[layer_0_found++] = state0;
+                // or
+                // cf kernel, state is now split in 3 shorts >> 2
+                candidates[(layer_0_found * 3) + 0] = (uint16_t)((state0 >> (32 + 2)) & 0xffff);
+                candidates[(layer_0_found * 3) + 1] = (uint16_t)((state0 >> (16 + 2)) & 0xffff);
+                candidates[(layer_0_found * 3) + 2] = (uint16_t)((state0 >> (0 + 2)) & 0xffff);
+                layer_0_found++;
+            }
+        }
+
+#if DEBUGME >= 1
+        printf("[debug] layer_0_found: %zu\n", layer_0_found);
+#endif
+    }
+
+    // powered by dolphin's macros :)
+    int freeListIdx = 0;
+
+    // todo, calculate the max number of allocations to remove 0x40
+    void **freeList = (void **) malloc(0x40 * sizeof(void *));
+    if (!freeList) {
+        printf("Error: malloc (freeList) failed (%d): %s\n", errno, strerror(errno));
+        exit(3);
+    }
+
+    if (!show) {
+        // load OpenCL kernel source
+        struct stat st;
+        const char *opencl_kernel = "ht2crack5opencl_kernel.cl";
+
+        int fd = open(opencl_kernel, O_RDONLY);
+        if (fd <= 0) {
+            printf("Error: open (%s) failed (%d): %s\n", opencl_kernel, errno, strerror(errno));
+            exit(3);
+        }
+
+        if (fstat(fd, &st)) {
+            printf("Error: stat (%s) failed (%d): %s\n", opencl_kernel, errno, strerror(errno));
+            close(fd);
+            exit(3);
+        }
+
+        ctx.kernelSource_len = (size_t) st.st_size;
+        ctx.kernelSource[0]  = (char *) calloc(ctx.kernelSource_len + 1, sizeof(char));   // size + \0
+        if (!ctx.kernelSource[0]) {
+            printf("Error: calloc (ctx.kernelSource[0]) failed (%d): %s\n", errno, strerror(errno));
+            exit(3);
+        }
+
+        MEMORY_FREE_ADD(ctx.kernelSource[0])
+
+        if (read(fd, ctx.kernelSource[0], ctx.kernelSource_len) < (ssize_t) ctx.kernelSource_len) {
+            printf("Error: read (%s) failed (%d): %s\n", opencl_kernel, errno, strerror(errno));
+            close(fd);
+            MEMORY_FREE_ALL
+            exit(3);
+        }
+
+        ctx.kernelSource[0][ctx.kernelSource_len] = '\0';
+
+        close(fd);
+    }
+
+    // now discover and set up compute device(s)
+    int err = 0;
+    cl_uint ocl_platform_cnt = 0;
+    unsigned int ocl_platform_max = MAX_OPENCL_DEVICES; // 16
+
+    cl_platform_id *ocl_platforms = (cl_platform_id *) calloc(ocl_platform_max, sizeof(cl_platform_id));
+    if (!ocl_platforms) {
+        printf("Error: calloc (ocl_platforms) failed (%d): %s\n", errno, strerror(errno));
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    MEMORY_FREE_ADD(ocl_platforms)
+
+    // enum platforms
+    err = clGetPlatformIDs(ocl_platform_max, ocl_platforms, &ocl_platform_cnt);
+    if (err != CL_SUCCESS) {
+        printf("Error: clGetPlatformIDs() failed (%d)\n", err);
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    if (ocl_platform_cnt == 0) {
+        printf("No platforms found, exit\n");
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    // allocate memory to hold info about platforms/devices
+    compute_platform_ctx_t *cd_ctx = (compute_platform_ctx_t *) calloc(ocl_platform_cnt, sizeof(compute_platform_ctx_t));
+    if (!cd_ctx) {
+        printf("Error: calloc (compute_platform_ctx_t) failed (%d): %s\n", errno, strerror(errno));
+        MEMORY_FREE_ALL
+        exit(err);
+    }
+
+    MEMORY_FREE_ADD(cd_ctx)
+
+    cl_platform_info ocl_platforms_info[3] = { CL_PLATFORM_NAME, CL_PLATFORM_VENDOR, CL_PLATFORM_VERSION };
+    unsigned int ocl_platforms_info_cnt = sizeof(ocl_platforms_info) / sizeof(cl_platform_info);
+
+    cl_device_info ocl_devices_info[8] = { CL_DEVICE_TYPE, CL_DEVICE_NAME, CL_DEVICE_VERSION, CL_DRIVER_VERSION, CL_DEVICE_VENDOR, CL_DEVICE_LOCAL_MEM_TYPE, CL_DEVICE_MAX_WORK_ITEM_SIZES, CL_DEVICE_MAX_COMPUTE_UNITS };
+    unsigned int ocl_devices_info_cnt = sizeof(ocl_devices_info) / sizeof(cl_device_info);
+
+    unsigned int info_idx = 0;
+    size_t tmp_len = 0;
+    char *tmp_buf = NULL;
+
+    unsigned int global_device_id = 0;
+    size_t selected_platforms_cnt = 0;
+    size_t selected_devices_cnt = 0;
+
+    if (show) verbose = true;
+
+    if (verbose) printf("- Found %u OpenCL Platform(s)\n", ocl_platform_cnt);
+
+    for (cl_uint platform_idx = 0; platform_idx < ocl_platform_cnt; platform_idx++) {
+        cd_ctx[platform_idx].platform_id = ocl_platforms[platform_idx];
+        cd_ctx[platform_idx].selected = plat_dev_enabled(platform_idx, plat_sel, plat_cnt, 0, 0);
+
+        if (cd_ctx[platform_idx].selected) selected_platforms_cnt++;
+
+        if (verbose) printf("\n-- Platform ID: %d\n", platform_idx + 1);
+
+        for (info_idx = 0; info_idx < ocl_platforms_info_cnt; info_idx++) {
+            cl_platform_info ocl_info = ocl_platforms_info[info_idx];
+
+            err = clGetPlatformInfo(cd_ctx[platform_idx].platform_id, ocl_info, 0, NULL, &tmp_len);
+            if (err != CL_SUCCESS) {
+                printf("Error: clGetPlatformInfo(param size) failed (%d)\n", err);
+                MEMORY_FREE_ALL
+                exit(2);
+            }
+
+            if (tmp_len > 0) {
+                if (!(tmp_buf = (char *) calloc(tmp_len, sizeof(char)))) {
+                    printf("Error: calloc (ocl_info %u) failed (%d): %s\n", info_idx, errno, strerror(errno));
+                    MEMORY_FREE_ALL
+                    exit(2);
+                }
+
+                MEMORY_FREE_ADD(tmp_buf)
+
+                err = clGetPlatformInfo(cd_ctx[platform_idx].platform_id, ocl_info, tmp_len, tmp_buf, 0);
+                if (err != CL_SUCCESS) {
+                    printf("Error: clGetPlatformInfo(param) failed (%d)\n", err);
+                    MEMORY_FREE_ALL
+                    exit(2);
+                }
+            } else {
+                tmp_len = 4;
+                if (!(tmp_buf = (char *) calloc(tmp_len, sizeof(char)))) {
+                    printf("Error: calloc (ocl_info %u) failed (%d): %s\n", info_idx, errno, strerror(errno));
+                    MEMORY_FREE_ALL
+                    exit(2);
+                }
+
+                MEMORY_FREE_ADD(tmp_buf)
+
+                strncpy(tmp_buf, "N/A\0", tmp_len);
+            }
+
+            if (verbose) {
+                const char *tmp_info_desc = (info_idx == 0) ? "Name" : (info_idx == 1) ? "Vendor" : "Version";
+
+                printf("%14s: %s\n", tmp_info_desc, tmp_buf);
+            }
+
+            switch (info_idx) {
+                case 0:
+                    strncpy(cd_ctx[platform_idx].name, tmp_buf, tmp_len < 0xff ? tmp_len : 0xff - 1);
+                    break;
+                case 1:
+                    strncpy(cd_ctx[platform_idx].vendor, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40 - 1);
+                    break;
+                case 2:
+                    strncpy(cd_ctx[platform_idx].version, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40 - 1);
+                    break;
+            }
+
+            if (info_idx == 1) {
+                // todo: do the same this devices
+                if (!strncmp(tmp_buf, "NVIDIA", 6)) cd_ctx[platform_idx].is_nv = true;
+                else if (!strncmp(tmp_buf, "Apple", 5)) { cd_ctx[platform_idx].is_apple = true; cd_ctx[platform_idx].warning = true; }
+                else if (!strncmp(tmp_buf, "Intel", 5)) cd_ctx[platform_idx].is_intel = true;
+            }
+
+            MEMORY_FREE_DEL(tmp_buf)
+        }
+
+        if (!show && verbose) {
+            printf("%14s: %s\n", "Selected", (cd_ctx[platform_idx].selected) ? "yes" : "no");
+            if (cd_ctx[platform_idx].warning) printf("\n%14s: performance will not be optimal using this platform\n\n", "=====> Warning");
+        }
+
+        // enum devices with this platform
+        unsigned int ocl_device_cnt = 0;
+        unsigned int ocl_device_max = MAX_OPENCL_DEVICES;
+
+        cl_device_id *ocl_devices = (cl_device_id *) calloc(ocl_device_max, sizeof(cl_device_id));
+        if (!ocl_devices) {
+            printf("Error: calloc (ocl_devices) failed (%d): %s\n", errno, strerror(errno));
+            MEMORY_FREE_ALL
+            exit(2);
+        }
+
+        MEMORY_FREE_ADD(ocl_devices)
+
+        err = clGetDeviceIDs(cd_ctx[platform_idx].platform_id, CL_DEVICE_TYPE_ALL, ocl_device_max, ocl_devices, &ocl_device_cnt);
+        if (ocl_device_cnt == 0) {
+            if (device_types_selected == CL_DEVICE_TYPE_ALL) printf("No device(s) available with platform id %d\n", platform_idx);
+            cd_ctx[platform_idx].device_cnt = 0;
+            continue;
+        }
+
+        if (err != CL_SUCCESS) {
+            printf("Error: clGetDeviceIDs(cnt) failed (%d)\n", err);
+            MEMORY_FREE_ALL
+            exit(2);
+        }
+
+        if (verbose) printf("%14s: %u\n", "Device(s)", ocl_device_cnt);
+
+        cd_ctx[platform_idx].device_cnt = ocl_device_cnt;
+
+        for (unsigned int device_idx = 0; device_idx < ocl_device_cnt; device_idx++) {
+            memset(&cd_ctx[platform_idx].device[device_idx], 0, sizeof(compute_device_ctx_t));
+            cl_device_id ocl_device = ocl_devices[device_idx];
+            cd_ctx[platform_idx].device[device_idx].platform_id = cd_ctx[platform_idx].platform_id;
+
+            if (verbose) printf("---- * ID: %u\n", global_device_id + 1);
+
+            for (info_idx = 0; info_idx < ocl_devices_info_cnt; info_idx++) {
+                cl_device_info ocl_dev_info = ocl_devices_info[info_idx];
+
+                if (info_idx == 0) {
+                    cl_device_type device_type;
+
+                    err = clGetDeviceInfo(ocl_device, ocl_dev_info, sizeof(cl_device_type), &device_type, 0);
+                    if (err != CL_SUCCESS) {
+                        printf("Error: clGetDeviceInfo(device_type) failed (%d)\n", err);
+                        MEMORY_FREE_ALL
+                        exit(2);
+                    }
+
+                    if (device_type & CL_DEVICE_TYPE_GPU) cd_ctx[platform_idx].device[device_idx].is_gpu = 1;
+
+                    if (verbose) printf("%14s: %s\n", "Device Type", (device_type & CL_DEVICE_TYPE_GPU) ? "GPU" : (device_type & CL_DEVICE_TYPE_CPU) ? "CPU" : "Other");
+
+                    cd_ctx[platform_idx].device[device_idx].selected = plat_dev_enabled(global_device_id, dev_sel, dev_cnt, (unsigned int) device_type, device_types_selected);
+                    global_device_id++;
+                    if (cd_ctx[platform_idx].device[device_idx].selected) selected_devices_cnt++;
+                    continue;
+                } else if (info_idx == 5) {
+                    cl_device_local_mem_type local_mem_type;
+
+                    err = clGetDeviceInfo(ocl_device, ocl_dev_info, sizeof(cl_device_local_mem_type), &local_mem_type, 0);
+                    if (err != CL_SUCCESS) {
+                        printf("Error: clGetDeviceInfo(local_mem_type) failed (%d)\n", err);
+                        MEMORY_FREE_ALL
+                        exit(2);
+                    }
+
+                    if (local_mem_type == CL_LOCAL || local_mem_type == CL_GLOBAL) {
+                        if (verbose) printf("%14s: %s\n", "Local Mem Type", (local_mem_type == CL_LOCAL) ? "Local" : "Global");
+
+                        if (cd_ctx[platform_idx].is_apple) {
+                            if (strncmp(cd_ctx[platform_idx].device[device_idx].vendor, "Intel", 5) != 0) cd_ctx[platform_idx].device[device_idx].have_local_memory = true;
+                        } else if (cd_ctx[platform_idx].is_nv) cd_ctx[platform_idx].device[device_idx].have_local_memory = true;
+                        /*
+                        						// swap the 'if' comment for enable local memory with apple gpu's (my Iris crash, abort 6)
+                        						// if (!(!strncmp (cd_ctx[platform_idx].device[device_idx].vendor, "Intel", 5) && cd_ctx[platform_idx].is_apple && !cd_ctx[platform_idx].device[device_idx].is_gpu))
+                        						if (!(!strncmp (cd_ctx[platform_idx].device[device_idx].vendor, "Intel", 5) && cd_ctx[platform_idx].is_apple))
+                        						{
+                        							cd_ctx[platform_idx].device[device_idx].have_local_memory = true;
+                        						}
+                        */
+                    } else {
+                        if (verbose) printf("%14s: None\n", "Local Mem Type");
+                    }
+
+                    if (verbose) printf("%14s: %s\n", "Local Mem Opt", (cd_ctx[platform_idx].device[device_idx].have_local_memory) ? "yes" : "no");
+
+                    continue;
+                } else if (info_idx == 6) {
+                    size_t wis[3] = { 0 };
+                    err = clGetDeviceInfo(ocl_device, ocl_dev_info, sizeof(size_t) * 3, wis, 0);
+                    if (err != CL_SUCCESS) {
+                        printf("Error: clGetDeviceInfo(work_items_size) failed (%d)\n", err);
+                        MEMORY_FREE_ALL
+                        exit(2);
+                    }
+
+                    if (verbose) printf("%14s: (%zu,%zu,%zu)\n", "Max Work-Items", wis[0], wis[1], wis[2]);
+
+#if APPLE_GPU_BROKEN == 1
+                    if (wis[1] < GLOBAL_WS_1 && cd_ctx[platform_idx].device[device_idx].is_apple_gpu) {
+                        cd_ctx[platform_idx].device[device_idx].unsupported = true;
+                    }
+#endif
+                    continue;
+                } else if (info_idx == 7) {
+                    cl_uint cores = 0;
+                    err = clGetDeviceInfo(ocl_device, ocl_dev_info, sizeof(cl_uint), &cores, 0);
+                    if (err != CL_SUCCESS) {
+                        printf("Error: clGetDeviceInfo(compute_units) failed (%d)\n", err);
+                        MEMORY_FREE_ALL
+                        exit(2);
+                    }
+
+                    if (verbose) printf("%14s: %u\n", "Compute Units", cores);
+
+                    cd_ctx[platform_idx].device[device_idx].compute_units = cores;
+                    continue;
+                }
+
+                tmp_len = 0;
+                tmp_buf = NULL;
+
+                err = clGetDeviceInfo(ocl_device, ocl_dev_info, 0, NULL, &tmp_len);
+                if (err != CL_SUCCESS) {
+                    printf("Error: clGetDeviceInfo(param size) failed (%d)\n", err);
+                    MEMORY_FREE_ALL
+                    exit(2);
+                }
+
+                if (tmp_len > 0) {
+                    if (!(tmp_buf = (char *) calloc(tmp_len, sizeof(char)))) {
+                        printf("Error: calloc (ocl_dev_info %u) failed (%d): %s\n", info_idx, errno, strerror(errno));
+                        MEMORY_FREE_ALL
+                        exit(2);
+                    }
+
+                    MEMORY_FREE_ADD(tmp_buf)
+
+                    err = clGetDeviceInfo(ocl_device, ocl_dev_info, tmp_len, tmp_buf, 0);
+                    if (err != CL_SUCCESS) {
+                        printf("Error: clGetDeviceInfo(param) failed (%d)\n", err);
+                        MEMORY_FREE_ALL
+                        exit(2);
+                    }
+                } else {
+                    tmp_len = 4;
+                    if (!(tmp_buf = (char *) calloc(tmp_len, sizeof(char)))) {
+                        printf("Error: calloc (ocl_dev_info %u) failed (%d): %s\n", info_idx, errno, strerror(errno));
+                        MEMORY_FREE_ALL
+                        exit(2);
+                    }
+
+                    MEMORY_FREE_ADD(tmp_buf)
+
+                    strncpy(tmp_buf, "N/A\0", tmp_len);
+                }
+
+                if (verbose) {
+                    const char *tmp_dev_info_desc = (info_idx == 1) ? "Name" : (info_idx == 2) ? "Version" : (info_idx == 3) ? "Driver Version" : "Vendor";
+
+                    printf("%14s: %s\n", tmp_dev_info_desc, tmp_buf);
+                }
+
+                switch (info_idx) {
+                    case 1:
+                        strncpy(cd_ctx[platform_idx].device[device_idx].name, tmp_buf, tmp_len < 0xff ? tmp_len : 0xff - 1);
+                        break;
+                    case 2:
+                        strncpy(cd_ctx[platform_idx].device[device_idx].version, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40 - 1);
+                        break;
+                    case 3:
+                        strncpy(cd_ctx[platform_idx].device[device_idx].driver_version, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40 - 1);
+                        break;
+                    case 4:
+                        strncpy(cd_ctx[platform_idx].device[device_idx].vendor, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40 - 1);
+                        break;
+                }
+
+                if (info_idx == 4) {
+                    if (!strncmp(tmp_buf, "Intel", 5) && cd_ctx[platform_idx].is_apple) {
+                        // disable hitag2 with apple platform and not apple device vendor (< Apple M1)
+                        ctx.force_hitag2_opencl = false;
+
+                        cd_ctx[platform_idx].device[device_idx].is_apple_gpu = cd_ctx[platform_idx].device[device_idx].is_gpu;
+                    }
+
+                    if (!strncmp(tmp_buf, "NVIDIA", 6) && cd_ctx[platform_idx].is_nv) {
+                        unsigned int sm_maj = 0, sm_min = 0;
+
+                        err  = clGetDeviceInfo(ocl_device, 0x4000, sizeof(unsigned int), &sm_maj, 0);
+                        err |= clGetDeviceInfo(ocl_device, 0x4001, sizeof(unsigned int), &sm_min, 0);
+
+                        if (err != CL_SUCCESS) {
+                            printf("Error: clGetDeviceInfo(sm_maj/sm_min) failed (%d)\n", err);
+                            MEMORY_FREE_ALL
+                            exit(2);
+                        }
+
+                        cd_ctx[platform_idx].device[device_idx].sm_maj = sm_maj;
+                        cd_ctx[platform_idx].device[device_idx].sm_min = sm_min;
+
+                        if (verbose) printf("%14s: %u%u\n", "SM", sm_maj, sm_min);
+
+                        if (sm_maj >= 5) { // >= Maxwell
+                            // https://docs.nvidia.com/cuda/parallel-thread-execution/index.html#logic-and-shift-instructions-lop3
+                            // Requires sm_50 or higher.
+                            cd_ctx[platform_idx].device[device_idx].have_lop3 = true;
+                        } else {
+                            cd_ctx[platform_idx].device[device_idx].warning = true;
+                        }
+
+                        cd_ctx[platform_idx].device[device_idx].is_nv = true;
+                    } else {
+                        cd_ctx[platform_idx].device[device_idx].warning = true;
+                    }
+                }
+
+                MEMORY_FREE_DEL(tmp_buf)
+            }
+
+            if (!show && verbose) printf("%14s: %s\n", "Selected", (cd_ctx[platform_idx].device[device_idx].selected) ? "yes" : "no");
+
+            if (cd_ctx[platform_idx].device[device_idx].unsupported) {
+                printf("\n%14s: this device was not supported, beacuse of missing resources\n\n", "=====> Warning");
+                continue;
+            }
+
+            if (cd_ctx[platform_idx].device[device_idx].warning) {
+                if (!show && verbose) printf("\n%14s: performance will not be optimal using this device\n\n", "=====> Warning");
+            }
+
+            cd_ctx[platform_idx].device[device_idx].device_id = ocl_device;
+        }
+        MEMORY_FREE_DEL(ocl_devices)
+    }
+    MEMORY_FREE_DEL(ocl_platforms)
+
+    // new selection engine, need to support multi-gpu system (with the same platform)
+
+    if (verbose) printf("\n");
+
+    if (show) {
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    if (selected_platforms_cnt == 0) {
+        printf("! No platform was selected ...\n");
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    if (selected_devices_cnt == 0) {
+        printf("! No device(s) was selected ...\n");
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    size_t w = 0, q = 0, g = 0;
+
+    size_t z = 0; // z is a dolphin's friend
+
+    // show selected devices
+
+    printf("Selected %zu OpenCL Device(s)\n\n", selected_devices_cnt);
+
+    for (w = 0; w < ocl_platform_cnt; w++) {
+        if (!cd_ctx[w].selected) continue;
+
+        for (q = 0; q < cd_ctx[w].device_cnt; q++) {
+            if (!cd_ctx[w].device[q].selected) continue;
+
+            printf("%2zu - %s", z, cd_ctx[w].device[q].name);
+            if (verbose) {
+                printf(" (Lop3 %s, ", (cd_ctx[w].device[q].have_lop3) ? "yes" : "no");
+                printf("Local Memory %s)", (cd_ctx[w].device[q].have_local_memory) ? "yes" : "no");
+            }
+            printf("\n");
+
+            z++;
+        }
+    }
+    printf("\n");
+
+    if (selected_devices_cnt != z) {
+        printf("BUG: z and selected_devices_cnt are not equal\n");
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    // time to eat some memory :P
+
+    if (!(ctx.device_ids = (cl_device_id *) calloc(selected_devices_cnt, sizeof(cl_device_id)))) {
+        printf("Error: calloc (ctx.device_ids) failed (%d): %s\n", errno, strerror(errno));
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    MEMORY_FREE_ADD(ctx.device_ids)
+
+    if (!(ctx.contexts = (cl_context *) calloc(selected_devices_cnt, sizeof(cl_context)))) {
+        printf("Error: calloc (ctx.contexts) failed (%d): %s\n", errno, strerror(errno));
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    MEMORY_FREE_ADD(ctx.contexts)
+
+    if (!(ctx.commands = (cl_command_queue *) calloc(selected_devices_cnt, sizeof(cl_command_queue)))) {
+        printf("Error: calloc (ctx.commands) failed (%d): %s\n", errno, strerror(errno));
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    MEMORY_FREE_ADD(ctx.commands)
+
+    if (!(ctx.programs = (cl_program *) calloc(selected_devices_cnt, sizeof(cl_program)))) {
+        printf("Error: calloc (ctx.programs) failed (%d): %s\n", errno, strerror(errno));
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    MEMORY_FREE_ADD(ctx.programs)
+
+    if (!(ctx.kernels = (cl_kernel *) calloc(selected_devices_cnt, sizeof(cl_kernel)))) {
+        printf("Error: calloc (ctx.kernels) failed (%d): %s\n", errno, strerror(errno));
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    MEMORY_FREE_ADD(ctx.kernels)
+
+    if (!(matches = (uint64_t **) calloc(selected_devices_cnt, sizeof(uint64_t *)))) {
+        printf("Error: calloc (**matches) failed (%d): %s\n", errno, strerror(errno));
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    MEMORY_FREE_ADD(matches)
+
+    if (!(matches_found = (uint32_t **) calloc(selected_devices_cnt, sizeof(uint32_t *)))) {
+        printf("Error: calloc (**matches_found) failed (%d): %s\n", errno, strerror(errno));
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    MEMORY_FREE_ADD(matches_found)
+
+    if (!(ctx.keystreams = (cl_mem *) calloc(selected_devices_cnt, sizeof(cl_mem)))) {
+        printf("Error: calloc (ctx.keystreams) failed (%d): %s\n", errno, strerror(errno));
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    MEMORY_FREE_ADD(ctx.keystreams)
+
+    if (!(ctx.candidates = (cl_mem *) calloc(selected_devices_cnt, sizeof(cl_mem)))) {
+        printf("Error: calloc (ctx.candidates) failed (%d): %s\n", errno, strerror(errno));
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    MEMORY_FREE_ADD(ctx.candidates)
+
+    if (!(ctx.matches = (cl_mem *) calloc(selected_devices_cnt, sizeof(cl_mem)))) {
+        printf("Error: calloc (ctx.matches) failed (%d): %s\n", errno, strerror(errno));
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    MEMORY_FREE_ADD(ctx.matches)
+
+    if (!(ctx.matches_found = (cl_mem *) calloc(selected_devices_cnt, sizeof(cl_mem)))) {
+        printf("Error: calloc (ctx.matches_found) failed (%d): %s\n", errno, strerror(errno));
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    MEMORY_FREE_ADD(ctx.matches_found)
+
+    if (ctx.force_hitag2_opencl) {
+        if (!(ctx.checks = (cl_mem *) calloc(selected_devices_cnt, sizeof(cl_mem)))) {
+            printf("Error: calloc (ctx.checks) failed (%d): %s\n", errno, strerror(errno));
+            MEMORY_FREE_ALL
+            exit(2);
+        }
+
+        MEMORY_FREE_ADD(ctx.checks)
+    }
+
+    if (!(ctx.global_ws = (size_t *) calloc(selected_devices_cnt, sizeof(size_t)))) {
+        printf("Error: calloc (ctx.global_ws) failed (%d): %s\n", errno, strerror(errno));
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    MEMORY_FREE_ADD(ctx.global_ws)
+
+    if (!(ctx.local_ws = (size_t *) calloc(selected_devices_cnt, sizeof(size_t)))) {
+        printf("Error: calloc (ctx.local_ws) failed (%d): %s\n", errno, strerror(errno));
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    MEMORY_FREE_ADD(ctx.local_ws)
+
+    if (!(ctx.profiles = (int *) calloc(selected_devices_cnt, sizeof(int)))) {
+        printf("Error: calloc (ctx.profiles) failed (%d): %s\n", errno, strerror(errno));
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+    MEMORY_FREE_ADD(ctx.profiles)
+
+    // show buidlog in case of error
+    // todo: only for device models
+    unsigned int build_errors = 0;
+    unsigned int build_logs = 0;
+
+    cl_command_queue_properties queue_properties = 0;
+
+    if (opencl_profiling) queue_properties = CL_QUEUE_PROFILING_ENABLE;
+
+    // setup, phase 1
+
+    z = 0; // dolphin
+
+    for (w = 0; w < ocl_platform_cnt; w++) {
+        if (!cd_ctx[w].selected) continue;
+
+        for (q = 0; q < cd_ctx[w].device_cnt; q++) {
+            if (!cd_ctx[w].device[q].selected) continue;
+
+            ctx.device_ids[z] = cd_ctx[w].device[q].device_id;
+
+            // create the opencl context with the array
+            ctx.contexts[z] = clCreateContext(NULL, 1, &ctx.device_ids[z], NULL, NULL, &err);
+            if (!ctx.contexts[z] || err != CL_SUCCESS) {
+                printf("[%zu] Error: clCreateContext() failed (%d)\n", z, err);
+                MEMORY_FREE_OPENCL(ctx, z)
+                MEMORY_FREE_LIST(matches, z)
+                MEMORY_FREE_LIST(matches_found, z)
+                MEMORY_FREE_ALL
+                exit(2);
+            }
+
+            // create comman queues for each selected devices
+            ctx.commands[z] = clCreateCommandQueue(ctx.contexts[z], ctx.device_ids[z], queue_properties, &err);
+            if (!ctx.commands[z] || err != CL_SUCCESS) {
+                printf("[%zu] Error: clCreateCommandQueue() failed (%d)\n", z, err);
+                MEMORY_FREE_OPENCL(ctx, z)
+                MEMORY_FREE_LIST(matches, z)
+                MEMORY_FREE_LIST(matches_found, z)
+                MEMORY_FREE_ALL
+                exit(2);
+            }
+
+            // from clang:
+            // warning: cast from 'char *(*)[1]' to 'const char **' increases required alignment from 1 to 8
+            const char *a = (const char *)ctx.kernelSource[0];
+            const char **ks = &a;
+
+            // create the compute program from the source buffer
+            //ctx.programs[z] = clCreateProgramWithSource(ctx.contexts[z], 1, (const char **) &ctx.kernelSource, &ctx.kernelSource_len, &err);
+            ctx.programs[z] = clCreateProgramWithSource(ctx.contexts[z], 1, ks, &ctx.kernelSource_len, &err);
+            if (!ctx.programs[z] || err != CL_SUCCESS) {
+                printf("[%zu] Error: clCreateProgramWithSource() failed (%d)\n", z, err);
+                MEMORY_FREE_OPENCL(ctx, z)
+                MEMORY_FREE_LIST(matches, z)
+                MEMORY_FREE_LIST(matches_found, z)
+                MEMORY_FREE_ALL
+                exit(2);
+            }
+
+            // build the program executable
+            bool have_local_memory = false;
+            size_t blen = 0;
+            char build_options[0x100];
+
+            memset(build_options, 0, sizeof(build_options));
+
+            strncpy(build_options, "-Werror", 8);
+            blen += 7;
+
+            if (cd_ctx[w].device[q].have_lop3) { // enable lop3
+                strncpy(build_options + blen, " -D HAVE_LOP3", 14);
+                blen += 13;
+            }
+
+            if (ctx.force_hitag2_opencl) {
+                // force using hitag2 key validation with OpenCL
+                strncpy(build_options + blen, " -D WITH_HITAG2_FULL", 21);
+                blen += 20;
+            }
+
+            // Intel's gpu are worst than Apple
+#if APPLE_GPU_BROKEN == 0
+            if (cd_ctx[w].device[q].is_gpu && !strncmp(cd_ctx[w].device[q].vendor, "Intel", 5)) {
+                if (cd_ctx[w].is_apple || cd_ctx[w].is_intel) {
+                    strncpy(build_options + blen, " -D LOWPERF", 13);
+                    blen += 12;
+                }
+            }
+#endif
+
+#if DEBUGME >= 1
+            printf("[debug] Device %zu have local mem ? %d\n", z, cd_ctx[w].device[q].have_local_memory);
+#endif
+
+            if (cd_ctx[w].device[q].have_local_memory) { // kernel keystream memory optimization
+                have_local_memory = true;
+                strncpy(build_options + blen, " -D HAVE_LOCAL_MEMORY", 22);
+                blen += 21;
+            }
+
+            if (verbose) printf("[%zu] Building OpenCL program with options (len %zu): %s\n", z, blen, build_options);
+
+            err = clBuildProgram(ctx.programs[z], 1, &ctx.device_ids[z], build_options, NULL, NULL);
+
+#if DEBUGME == 0
+            if (err != CL_SUCCESS)
+#endif
+            {
+#if DEBUGME > 0
+                if (err != CL_SUCCESS)
+#endif
+                {
+                    printf("[%zu] Error: clBuildProgram() failed (%d)\n", z, err);
+                    build_errors++;
+                }
+
+                // todo: if same device model of other and build_logs > 0, continue
+
+                size_t len = 0;
+                err = clGetProgramBuildInfo(ctx.programs[z], cd_ctx[w].device[q].device_id, CL_PROGRAM_BUILD_LOG, 0, NULL, &len);
+                if (err != CL_SUCCESS) {
+                    printf("[%zu] Error: clGetProgramBuildInfo failed (%d)\n", z, err);
+                    continue;
 //					exit (2);
-				}
+                }
 
-				if (len == 0) continue;
+                if (len == 0) continue;
 
-				if (len > 0xdeadbe) len = 0xdeadbe; // limit build_log size
+                if (len > 0xdeadbe) len = 0xdeadbe; // limit build_log size
 
-				char *buffer = (char *) calloc (len, sizeof(char));
-				if (!buffer)
-				{
-					printf ("[%zu] Error: calloc (CL_PROGRAM_BUILD_LOG) failed (%d): %s\n", z, errno, strerror (errno));
-					continue;
+                char *buffer = (char *) calloc(len, sizeof(char));
+                if (!buffer) {
+                    printf("[%zu] Error: calloc (CL_PROGRAM_BUILD_LOG) failed (%d): %s\n", z, errno, strerror(errno));
+                    continue;
 //					exit (2);
-				}
+                }
 
-				MEMORY_FREE_ADD(buffer)
+                MEMORY_FREE_ADD(buffer)
 
-				err = clGetProgramBuildInfo(ctx.programs[z], cd_ctx[w].device[q].device_id, CL_PROGRAM_BUILD_LOG, len, buffer, 0);
-				if (err != CL_SUCCESS) {
-					printf ("[%zu] clGetProgramBuildInfo() failed (%d)\n", z, err);
-					MEMORY_FREE_DEL(buffer)
-					continue;
+                err = clGetProgramBuildInfo(ctx.programs[z], cd_ctx[w].device[q].device_id, CL_PROGRAM_BUILD_LOG, len, buffer, 0);
+                if (err != CL_SUCCESS) {
+                    printf("[%zu] clGetProgramBuildInfo() failed (%d)\n", z, err);
+                    MEMORY_FREE_DEL(buffer)
+                    continue;
 //					exit (2);
-				}
+                }
 
-				#if DEBUGME > 0
-				if (len > 2)
-				#endif
-				{
-					printf ("[%zu] Build log (len %zu):\n--------\n%s\n--------\n", z, len, buffer);
-				}
+#if DEBUGME > 0
+                if (len > 2)
+#endif
+                {
+                    printf("[%zu] Build log (len %zu):\n--------\n%s\n--------\n", z, len, buffer);
+                }
 
-				MEMORY_FREE_DEL(buffer)
+                MEMORY_FREE_DEL(buffer)
 
-				build_logs++;
-				#if DEBUGME == 0
-				continue; // todo: evaluate this, one or more can be broken, so continue
-				#endif
-			}
+                build_logs++;
+#if DEBUGME == 0
+                continue; // todo: evaluate this, one or more can be broken, so continue
+#endif
+            }
 
-			// todo, continue if build_errors
+            // todo, continue if build_errors
 
-			// Create the compute kernel in the program we wish to run
-			ctx.kernels[z] = clCreateKernel(ctx.programs[z], "find_state", &err);
-			if (!ctx.kernels[z] || err != CL_SUCCESS) {
-				printf ("[%zu] Error: clCreateKernel() failed (%d)\n", z, err);
-				MEMORY_FREE_OPENCL(ctx, z)
-				MEMORY_FREE_LIST(matches,z)
-				MEMORY_FREE_LIST(matches_found, z)
-				MEMORY_FREE_ALL
-				exit (3);
-			}
+            // Create the compute kernel in the program we wish to run
+            ctx.kernels[z] = clCreateKernel(ctx.programs[z], "find_state", &err);
+            if (!ctx.kernels[z] || err != CL_SUCCESS) {
+                printf("[%zu] Error: clCreateKernel() failed (%d)\n", z, err);
+                MEMORY_FREE_OPENCL(ctx, z)
+                MEMORY_FREE_LIST(matches, z)
+                MEMORY_FREE_LIST(matches_found, z)
+                MEMORY_FREE_ALL
+                exit(3);
+            }
 
-			size_t wgs = 0;
-			err = clGetKernelWorkGroupInfo (ctx.kernels[z], cd_ctx[w].device[q].device_id, CL_KERNEL_WORK_GROUP_SIZE, sizeof (size_t), &wgs, NULL);
-			if (err != CL_SUCCESS) {
-				printf ("[%zu] Error: clGetKernelWorkGroupInfo(CL_KERNEL_WORK_GROUP_SIZE) failed (%d)\n", z, err);
-				MEMORY_FREE_OPENCL(ctx, z)
-				// if macros work, next 2 macro are not needed
-				MEMORY_FREE_LIST(matches,z)
-				MEMORY_FREE_LIST(matches_found, z)
-				MEMORY_FREE_ALL
-				exit (3);
-			}
+            size_t wgs = 0;
+            err = clGetKernelWorkGroupInfo(ctx.kernels[z], cd_ctx[w].device[q].device_id, CL_KERNEL_WORK_GROUP_SIZE, sizeof(size_t), &wgs, NULL);
+            if (err != CL_SUCCESS) {
+                printf("[%zu] Error: clGetKernelWorkGroupInfo(CL_KERNEL_WORK_GROUP_SIZE) failed (%d)\n", z, err);
+                MEMORY_FREE_OPENCL(ctx, z)
+                // if macros work, next 2 macro are not needed
+                MEMORY_FREE_LIST(matches, z)
+                MEMORY_FREE_LIST(matches_found, z)
+                MEMORY_FREE_ALL
+                exit(3);
+            }
 
-			ctx.local_ws[z] = wgs;
+            ctx.local_ws[z] = wgs;
 
-			// never got it
-			if (ctx.local_ws[z] < 32 && have_local_memory)
-			{
-				printf ("Warning: local work-item size is less than the length of the keystream, and local memory optimization is enabled. An unexpected result could arise.\n");
-			}
+            // never got it
+            if (ctx.local_ws[z] < 32 && have_local_memory) {
+                printf("Warning: local work-item size is less than the length of the keystream, and local memory optimization is enabled. An unexpected result could arise.\n");
+            }
 
-			z++;
-		}
-	}
+            z++;
+        }
+    }
 
-	// z is device counter, dolphin counter as well
+    // z is device counter, dolphin counter as well
 
-	// setup, phase 2 (select lower profile)
+    // setup, phase 2 (select lower profile)
 
-	int profile = 0xff;
+    int profile = 0xff;
 
-	g = 0;
+    g = 0;
 
-	for (w = 0; w < ocl_platform_cnt; w++)
-	{
-		if (!cd_ctx[w].selected) continue;
+    for (w = 0; w < ocl_platform_cnt; w++) {
+        if (!cd_ctx[w].selected) continue;
 
-		for (q = 0; q < cd_ctx[w].device_cnt; q++)
-		{
-			if (!cd_ctx[w].device[q].selected) continue;
+        for (q = 0; q < cd_ctx[w].device_cnt; q++) {
+            if (!cd_ctx[w].device[q].selected) continue;
 
-			ctx.profiles[g] = (int) profile_selected; // start with default
+            ctx.profiles[g] = (int) profile_selected; // start with default
 
-			#if DEBUGME > 1
-			printf ("[debug] Initial profile for device %zu: %d\n", z, ctx.profiles[g]);
-			#endif
+#if DEBUGME > 1
+            printf("[debug] Initial profile for device %zu: %d\n", z, ctx.profiles[g]);
+#endif
 
-			// force profile to 0 with Apple GPU's to get it stable, and 1 for CPU
-			if (cd_ctx[w].is_apple && !strncmp (cd_ctx[w].device[q].vendor, "Intel", 5))
-			{
-				if (cd_ctx[w].device[q].is_gpu)
-				{
-					if (profile_selected > 2) ctx.profiles[g] = PROFILE_DEFAULT; // Apple-Intel GPU's, 2 is the old 0
-				}
-				else
-				{
-					if (profile_selected > 3) ctx.profiles[g] = PROFILE_DEFAULT; // Apple-Intel CPU's, 3 is the old 1
-				}
-			}
+            // force profile to 0 with Apple GPU's to get it stable, and 1 for CPU
+            if (cd_ctx[w].is_apple && !strncmp(cd_ctx[w].device[q].vendor, "Intel", 5)) {
+                if (cd_ctx[w].device[q].is_gpu) {
+                    if (profile_selected > 2) ctx.profiles[g] = PROFILE_DEFAULT; // Apple-Intel GPU's, 2 is the old 0
+                } else {
+                    if (profile_selected > 3) ctx.profiles[g] = PROFILE_DEFAULT; // Apple-Intel CPU's, 3 is the old 1
+                }
+            }
 
-			// force profile to 0 with Intel GPU and 2 wih Intel CPU's
-			if (cd_ctx[w].is_intel && !strncmp (cd_ctx[w].device[q].vendor, "Intel", 5))
-			{
-				if (cd_ctx[w].device[q].is_gpu)
-				{
-					ctx.profiles[g] = 0; // Intel GPU, work better with a very slow profile
-				}
-				else
-				{
-					if (profile_selected > 2) ctx.profiles[g] = PROFILE_DEFAULT; // Intel CPU (2 is the old 0)
-				}
-			}
+            // force profile to 0 with Intel GPU and 2 wih Intel CPU's
+            if (cd_ctx[w].is_intel && !strncmp(cd_ctx[w].device[q].vendor, "Intel", 5)) {
+                if (cd_ctx[w].device[q].is_gpu) {
+                    ctx.profiles[g] = 0; // Intel GPU, work better with a very slow profile
+                } else {
+                    if (profile_selected > 2) ctx.profiles[g] = PROFILE_DEFAULT; // Intel CPU (2 is the old 0)
+                }
+            }
 
-			// force profile to 2 with NVIDIA GPU's with NVIDIA platform
-			if (cd_ctx[w].is_nv && cd_ctx[w].device[q].is_gpu && !strncmp (cd_ctx[w].device[q].vendor, "NVIDIA", 6))
-			{
-				if (profile_selected > 10)
-				{
-					// NVIDIA RTX 3090 perform better with 5
-					ctx.profiles[g] = (cd_ctx[w].device[q].sm_maj >= 8) ? 5 : PROFILE_DEFAULT;
-				}
-			}
+            // force profile to 2 with NVIDIA GPU's with NVIDIA platform
+            if (cd_ctx[w].is_nv && cd_ctx[w].device[q].is_gpu && !strncmp(cd_ctx[w].device[q].vendor, "NVIDIA", 6)) {
+                if (profile_selected > 10) {
+                    // NVIDIA RTX 3090 perform better with 5
+                    ctx.profiles[g] = (cd_ctx[w].device[q].sm_maj >= 8) ? 5 : PROFILE_DEFAULT;
+                }
+            }
 
-			// probably unstested hw, set profile to 0
-			if (profile_selected == 0xff)
-			{
-				profile_selected = 0;
-				ctx.profiles[g] = 0;
-			}
+            // probably unstested hw, set profile to 0
+            if (profile_selected == 0xff) {
+                profile_selected = 0;
+                ctx.profiles[g] = 0;
+            }
 
-			// with same devices will be selected the best
-			// but for different devices in the same platform we need the worst for now (todo)
-			if (ctx.profiles[q] < profile) profile = ctx.profiles[q];
-		}
-	}
+            // with same devices will be selected the best
+            // but for different devices in the same platform we need the worst for now (todo)
+            if (ctx.profiles[q] < profile) profile = ctx.profiles[q];
+        }
+    }
 
-	// profile consistency check
-	if (profile < 0 || profile > 10)
-	{
-		printf ("! Error: the selected profile is not allowed (%d)\n", profile);
-		MEMORY_FREE_OPENCL(ctx, z)
-		MEMORY_FREE_LIST_Z(matches, z)
-		MEMORY_FREE_LIST_Z(matches_found, z)
-		MEMORY_FREE_ALL
-		exit(2);
-	}
+    // profile consistency check
+    if (profile < 0 || profile > 10) {
+        printf("! Error: the selected profile is not allowed (%d)\n", profile);
+        MEMORY_FREE_OPENCL(ctx, z)
+        MEMORY_FREE_LIST_Z(matches, z)
+        MEMORY_FREE_LIST_Z(matches_found, z)
+        MEMORY_FREE_ALL
+        exit(2);
+    }
 
-	// setup, phase 3 (finis him)
+    // setup, phase 3 (finis him)
 
-	z = 0;
+    z = 0;
 
-	for (w = 0; w < ocl_platform_cnt; w++)
-	{
-		if (!cd_ctx[w].selected) continue;
+    for (w = 0; w < ocl_platform_cnt; w++) {
+        if (!cd_ctx[w].selected) continue;
 
-		for (q = 0; q < cd_ctx[w].device_cnt; q++)
-		{
-			if (!cd_ctx[w].device[q].selected) continue;
+        for (q = 0; q < cd_ctx[w].device_cnt; q++) {
+            if (!cd_ctx[w].device[q].selected) continue;
 
-			ctx.global_ws[z] = (1 << profiles[profile][1]);
+            ctx.global_ws[z] = (1 << profiles[profile][1]);
 
-			// the following happens with cpu devices or Apple GPU
-			if (ctx.local_ws[z] > 256)
-			{
-				if (cd_ctx[w].is_apple) ctx.local_ws[z] = 256;
-				else if (!cd_ctx[w].device[q].is_gpu) ctx.local_ws[z] = 256;
-			}
+            // the following happens with cpu devices or Apple GPU
+            if (ctx.local_ws[z] > 256) {
+                if (cd_ctx[w].is_apple) ctx.local_ws[z] = 256;
+                else if (!cd_ctx[w].device[q].is_gpu) ctx.local_ws[z] = 256;
+            }
 
-			// dow't allow gws < lws
-			if (ctx.global_ws[z] < ctx.local_ws[z]) ctx.local_ws[z] = ctx.global_ws[z];
+            // dow't allow gws < lws
+            if (ctx.global_ws[z] < ctx.local_ws[z]) ctx.local_ws[z] = ctx.global_ws[z];
 
-			if (opencl_profiling) printf ("[%zu] global_ws %zu, local_ws %zu\n", g, ctx.global_ws[z], ctx.local_ws[z]);
+            if (opencl_profiling) printf("[%zu] global_ws %zu, local_ws %zu\n", g, ctx.global_ws[z], ctx.local_ws[z]);
 
-			if (!ctx.force_hitag2_opencl)
-			{
-				if (!(matches[z] = (uint64_t *) calloc ((uint32_t)(ctx.global_ws[z] * WGS_MATCHES_FACTOR), sizeof (uint64_t))))
-				{
-					printf ("[%zu] Error: calloc (matches) failed (%d): %s\n", g, errno, strerror (errno));
-					MEMORY_FREE_OPENCL(ctx, z)
-					MEMORY_FREE_LIST(matches, z)
-					MEMORY_FREE_LIST(matches_found, z)
-					MEMORY_FREE_ALL
-					exit (2);
-				}
-			}
-			else
-			{
-				// one
-				if (!(matches[z] = (uint64_t *) calloc (1, sizeof (uint64_t))))
-				{
-					printf ("[%zu] Error: calloc (matches) failed (%d): %s\n", z, errno, strerror (errno));
-					MEMORY_FREE_OPENCL(ctx, z)
-					MEMORY_FREE_LIST(matches, z)
-					MEMORY_FREE_LIST(matches_found, z)
-					MEMORY_FREE_ALL
-					exit (2);
-				}
-			}
+            if (!ctx.force_hitag2_opencl) {
+                if (!(matches[z] = (uint64_t *) calloc((uint32_t)(ctx.global_ws[z] * WGS_MATCHES_FACTOR), sizeof(uint64_t)))) {
+                    printf("[%zu] Error: calloc (matches) failed (%d): %s\n", g, errno, strerror(errno));
+                    MEMORY_FREE_OPENCL(ctx, z)
+                    MEMORY_FREE_LIST(matches, z)
+                    MEMORY_FREE_LIST(matches_found, z)
+                    MEMORY_FREE_ALL
+                    exit(2);
+                }
+            } else {
+                // one
+                if (!(matches[z] = (uint64_t *) calloc(1, sizeof(uint64_t)))) {
+                    printf("[%zu] Error: calloc (matches) failed (%d): %s\n", z, errno, strerror(errno));
+                    MEMORY_FREE_OPENCL(ctx, z)
+                    MEMORY_FREE_LIST(matches, z)
+                    MEMORY_FREE_LIST(matches_found, z)
+                    MEMORY_FREE_ALL
+                    exit(2);
+                }
+            }
 
-			if (!(matches_found[z] = (uint32_t *) calloc (1, sizeof (uint32_t))))
-			{
-				printf ("[%zu] Error: calloc (matches_found) failed (%d): %s\n", z, errno, strerror (errno));
-				MEMORY_FREE_OPENCL(ctx, z)
-				MEMORY_FREE_LIST_Z(matches, z)
-				MEMORY_FREE_LIST(matches_found, z)
-				MEMORY_FREE_ALL
-				exit (2);
-			}
+            if (!(matches_found[z] = (uint32_t *) calloc(1, sizeof(uint32_t)))) {
+                printf("[%zu] Error: calloc (matches_found) failed (%d): %s\n", z, errno, strerror(errno));
+                MEMORY_FREE_OPENCL(ctx, z)
+                MEMORY_FREE_LIST_Z(matches, z)
+                MEMORY_FREE_LIST(matches_found, z)
+                MEMORY_FREE_ALL
+                exit(2);
+            }
 
-			ctx.candidates[z] = clCreateBuffer(ctx.contexts[z],  CL_MEM_READ_ONLY,  sizeof(uint16_t) * ((1 << 20) * 3), NULL, NULL);
-			//ctx.candidates = clCreateBuffer(ctx.contexts[z],  CL_MEM_READ_ONLY,  sizeof(uint64_t) * ((1 << 20)), NULL, NULL);
-			ctx.keystreams[z]  = clCreateBuffer(ctx.contexts[z],  CL_MEM_READ_ONLY,  VECTOR_SIZE * 32, NULL, NULL);
+            ctx.candidates[z] = clCreateBuffer(ctx.contexts[z],  CL_MEM_READ_ONLY,  sizeof(uint16_t) * ((1 << 20) * 3), NULL, NULL);
+            //ctx.candidates = clCreateBuffer(ctx.contexts[z],  CL_MEM_READ_ONLY,  sizeof(uint64_t) * ((1 << 20)), NULL, NULL);
+            ctx.keystreams[z]  = clCreateBuffer(ctx.contexts[z],  CL_MEM_READ_ONLY,  VECTOR_SIZE * 32, NULL, NULL);
 
-			if (!ctx.force_hitag2_opencl)
-			{
-				ctx.matches[z] = clCreateBuffer(ctx.contexts[z], CL_MEM_WRITE_ONLY, sizeof(uint64_t) * (uint32_t)(ctx.global_ws[z]*WGS_MATCHES_FACTOR), NULL, NULL);
-			}
-			else // one
-			{
-				ctx.matches[z] = clCreateBuffer(ctx.contexts[z], CL_MEM_WRITE_ONLY, sizeof(uint64_t), NULL, NULL);
-			}
+            if (!ctx.force_hitag2_opencl) {
+                ctx.matches[z] = clCreateBuffer(ctx.contexts[z], CL_MEM_WRITE_ONLY, sizeof(uint64_t) * (uint32_t)(ctx.global_ws[z] * WGS_MATCHES_FACTOR), NULL, NULL);
+            } else { // one
+                ctx.matches[z] = clCreateBuffer(ctx.contexts[z], CL_MEM_WRITE_ONLY, sizeof(uint64_t), NULL, NULL);
+            }
 
-			ctx.matches_found[z] = clCreateBuffer(ctx.contexts[z], CL_MEM_READ_WRITE, sizeof(uint32_t), NULL, NULL);
+            ctx.matches_found[z] = clCreateBuffer(ctx.contexts[z], CL_MEM_READ_WRITE, sizeof(uint32_t), NULL, NULL);
 
-			if (ctx.force_hitag2_opencl)
-			{
-				ctx.checks[z] = clCreateBuffer(ctx.contexts[z], CL_MEM_READ_ONLY, sizeof(uint32_t) * 4, NULL, NULL);
-				if (!ctx.checks[z])
-				{
-					printf ("[%zu] Error: invalid shared cl_mem (ctx.candidates|ctx.keystream|ctx.checks)\n", z);
-					MEMORY_FREE_OPENCL(ctx, z)
-					MEMORY_FREE_LIST_Z(matches, z)
-					MEMORY_FREE_LIST_Z(matches_found, z)
-					MEMORY_FREE_ALL
-					exit (3);
-				}
-			}
+            if (ctx.force_hitag2_opencl) {
+                ctx.checks[z] = clCreateBuffer(ctx.contexts[z], CL_MEM_READ_ONLY, sizeof(uint32_t) * 4, NULL, NULL);
+                if (!ctx.checks[z]) {
+                    printf("[%zu] Error: invalid shared cl_mem (ctx.candidates|ctx.keystream|ctx.checks)\n", z);
+                    MEMORY_FREE_OPENCL(ctx, z)
+                    MEMORY_FREE_LIST_Z(matches, z)
+                    MEMORY_FREE_LIST_Z(matches_found, z)
+                    MEMORY_FREE_ALL
+                    exit(3);
+                }
+            }
 
-			if (!ctx.candidates[z] || !ctx.keystreams[z])
-			{
-				printf ("[%zu] Error: invalid shared cl_mem (ctx.candidates|ctx.keystream)\n", z);
-				MEMORY_FREE_OPENCL(ctx, z)
-				MEMORY_FREE_LIST_Z(matches, z)
-				MEMORY_FREE_LIST_Z(matches_found, z)
-				MEMORY_FREE_ALL
-				exit (3);
-			}
+            if (!ctx.candidates[z] || !ctx.keystreams[z]) {
+                printf("[%zu] Error: invalid shared cl_mem (ctx.candidates|ctx.keystream)\n", z);
+                MEMORY_FREE_OPENCL(ctx, z)
+                MEMORY_FREE_LIST_Z(matches, z)
+                MEMORY_FREE_LIST_Z(matches_found, z)
+                MEMORY_FREE_ALL
+                exit(3);
+            }
 
-			if (!ctx.matches[z] || !ctx.matches_found[z])
-			{
-				printf ("[%zu] Error: invalid per-device cl_mem (ctx.matches or ctx.matches_found)\n", z);
-				MEMORY_FREE_OPENCL(ctx, z)
-				MEMORY_FREE_LIST_Z(matches, z)
-				MEMORY_FREE_LIST_Z(matches_found, z)
-				MEMORY_FREE_ALL
-				exit (3);
-			}
+            if (!ctx.matches[z] || !ctx.matches_found[z]) {
+                printf("[%zu] Error: invalid per-device cl_mem (ctx.matches or ctx.matches_found)\n", z);
+                MEMORY_FREE_OPENCL(ctx, z)
+                MEMORY_FREE_LIST_Z(matches, z)
+                MEMORY_FREE_LIST_Z(matches_found, z)
+                MEMORY_FREE_ALL
+                exit(3);
+            }
 
-			// Write our data set into the input array in device memory
-			// todo
-			// if z is last set CL_TRUE (blocking) else CL_FALSE (non-blocking)
-			// using this way, setup time can be reduced
-			err = clEnqueueWriteBuffer(ctx.commands[z], ctx.keystreams[z], CL_TRUE, 0, VECTOR_SIZE * 32, keystream, 0, NULL, NULL);
-			if (err != CL_SUCCESS)
-			{
-				printf ("[%zu] Error: clEnqueueWriteBuffer(ctx.keystream) failed (%d)\n", z, err);
-				MEMORY_FREE_OPENCL(ctx, z)
-				MEMORY_FREE_LIST_Z(matches, z)
-				MEMORY_FREE_LIST_Z(matches_found, z)
-				MEMORY_FREE_ALL
-				exit (3);
-			}
+            // Write our data set into the input array in device memory
+            // todo
+            // if z is last set CL_TRUE (blocking) else CL_FALSE (non-blocking)
+            // using this way, setup time can be reduced
+            err = clEnqueueWriteBuffer(ctx.commands[z], ctx.keystreams[z], CL_TRUE, 0, VECTOR_SIZE * 32, keystream, 0, NULL, NULL);
+            if (err != CL_SUCCESS) {
+                printf("[%zu] Error: clEnqueueWriteBuffer(ctx.keystream) failed (%d)\n", z, err);
+                MEMORY_FREE_OPENCL(ctx, z)
+                MEMORY_FREE_LIST_Z(matches, z)
+                MEMORY_FREE_LIST_Z(matches_found, z)
+                MEMORY_FREE_ALL
+                exit(3);
+            }
 
-			err = clEnqueueWriteBuffer(ctx.commands[z], ctx.candidates[z], CL_TRUE, 0, sizeof(uint16_t) * ((1 << 20) * 3), candidates, 0, NULL, NULL);
+            err = clEnqueueWriteBuffer(ctx.commands[z], ctx.candidates[z], CL_TRUE, 0, sizeof(uint16_t) * ((1 << 20) * 3), candidates, 0, NULL, NULL);
 //			err = clEnqueueWriteBuffer(ctx.commands[z], ctx.candidates, CL_TRUE, 0, sizeof(uint64_t) * ((1 << 20)), candidates, 0, NULL, NULL);
-			if (err != CL_SUCCESS)
-			{
-				printf ("[%zu] Error: clEnqueueWriteBuffer(ctx.candidates) failed (%d)\n", z, err);
-				MEMORY_FREE_OPENCL(ctx, z)
-				MEMORY_FREE_LIST_Z(matches, z)
-				MEMORY_FREE_LIST_Z(matches_found, z)
-				MEMORY_FREE_ALL
-				exit (3);
-			}
-
-			if (ctx.force_hitag2_opencl)
-			{
-				err = clEnqueueWriteBuffer(ctx.commands[z], ctx.checks[z], CL_TRUE, 0, sizeof(uint32_t) * 4, checks, 0, NULL, NULL);
-				if (err != CL_SUCCESS) {
-					printf ("[%zu] Error: clEnqueueWriteBuffer(ctx.checks) failed (%d)\n", z, err);
-					MEMORY_FREE_OPENCL(ctx, z)
-					MEMORY_FREE_LIST_Z(matches, z)
-					MEMORY_FREE_LIST_Z(matches_found, z)
-					MEMORY_FREE_ALL
-					exit (3);
-				}
-			}
-
-			// Set the arguments to our compute kernel
-			err  = clSetKernelArg (ctx.kernels[z], 1, sizeof(cl_mem), &ctx.candidates[z]);
-			err |= clSetKernelArg (ctx.kernels[z], 2, sizeof(cl_mem), &ctx.keystreams[z]);
-			err |= clSetKernelArg (ctx.kernels[z], 3, sizeof(cl_mem), &ctx.matches[z]);
-			if (ctx.force_hitag2_opencl) err |= clSetKernelArg (ctx.kernels[z], 5, sizeof(cl_mem), &ctx.checks[z]);
-
-			if (err != CL_SUCCESS) {
-				printf ("[%zu] Error: clSetKernelArg(ctx.candidates|ctx.keystream|ctx.matches|ctx.checks) failed (%d)\n", z, err);
-				MEMORY_FREE_OPENCL(ctx, z)
-				MEMORY_FREE_LIST_Z(matches, z)
-				MEMORY_FREE_LIST_Z(matches_found, z)
-				MEMORY_FREE_ALL
-				exit (3);
-			}
-
-			z++;
-		}
-	}
-
-	if (build_errors > 0)
-	{
-		#if DEBUGME >= 2
-		printf ("[debug] Detected build errors with %u device(s).\n", build_errors);
-		#endif
-		MEMORY_FREE_OPENCL(ctx, z)
-		MEMORY_FREE_LIST_Z(matches, z)
-		MEMORY_FREE_LIST_Z(matches_found, z)
-		MEMORY_FREE_ALL
-		exit (3);
-	}
-
-	// at this point z is the max value, still usefull for free's
-
-	#if DEBUGME > 0
-	printf ("[debug] Lower profile between %u device(s) is: %d\n", selected_devices_cnt, profile);
-	#endif
-
-	uint32_t max_step = profiles[profile][0];
-	uint32_t chunk = profiles[profile][1];
-
-	#if DEBUGME > 0
-	printf ("[debug] Init queue\n");
-	#endif
-
-	int ret = 0;
-	if ((ret = wu_queue_init (&ctx.queue_ctx, queue_type)) != 0)
-	{
-		printf ("! Error: wu_queue_init(%s) failed (%d): %s\n", wu_queue_strdesc (queue_type), ret, wu_queue_strerror (ret));
-		MEMORY_FREE_OPENCL(ctx, z)
-		MEMORY_FREE_LIST_Z(matches, z)
-		MEMORY_FREE_LIST_Z(matches_found, z)
-		MEMORY_FREE_ALL
-		exit(2);
-	}
-
-	#if DEBUGME > 0
-	printf ("[queue] Fill queue with pre-calculated offset using profile (%d): ", profile);
-	#endif
-
-	for (size_t step = 0; step < max_step; step++) wu_queue_push (&ctx.queue_ctx, step, step << chunk, max_step);
-
-	#if DEBUGME > 0
-	printf ("done\n");
-	#endif
-
-	// save selected_devices_cnt
-	size_t thread_count = selected_devices_cnt;
-
-	thread_ctx_t th_ctx;
-	memset (&th_ctx, 0, sizeof (thread_ctx_t));
-
-	thread_args_t *t_arg = (thread_args_t *) calloc (thread_count, sizeof (thread_args_t));
-	if (!t_arg)
-	{
-		printf ("Error: calloc (thread_args_t) failed (%d): %s\n", errno, strerror (errno));
-		MEMORY_FREE_OPENCL(ctx, z)
-		MEMORY_FREE_LIST_Z(matches, z)
-		MEMORY_FREE_LIST_Z(matches_found, z)
-		MEMORY_FREE_ALL
-		exit (3);
-	}
-
-	MEMORY_FREE_ADD(t_arg)
-
-	if ((ret = thread_init (&th_ctx, ctx.thread_sched_type, thread_count)) != 0)
-	{
-		printf ("Error: thread_init(%zu) failed (%d)\n", thread_count, ret);
-		MEMORY_FREE_OPENCL(ctx, z)
-		MEMORY_FREE_LIST_Z(matches, z)
-		MEMORY_FREE_LIST_Z(matches_found, z)
-		MEMORY_FREE_ALL
-		exit (3);
-	}
-
-	// preload constant values in threads memory, and start threads
-	for (z = 0; z < thread_count; z++)
-	{
-		t_arg[z].uid = uid;
-		t_arg[z].aR2 = aR2;
-		t_arg[z].nR1 = nR1;
-		t_arg[z].nR2 = nR2;
-		t_arg[z].max_step = max_step;
-		t_arg[z].ocl_ctx = &ctx;
-		t_arg[z].device_id = z;
-		t_arg[z].async = (ctx.thread_sched_type == THREAD_TYPE_ASYNC);
-		t_arg[z].thread_ctx = &th_ctx;
-
-		if (ctx.thread_sched_type == THREAD_TYPE_ASYNC)
-		{
-			t_arg[z].matches = matches[z];
-			t_arg[z].matches_found = matches_found[z];
-			t_arg[z].status = TH_START;
-		}
-	}
-
-	if (ctx.thread_sched_type == THREAD_TYPE_ASYNC)
-	{
-		if ((ret = thread_start (&th_ctx, t_arg)) != 0)
-		{
-			printf ("Error: thread_start() failed (%d): %s\n", ret, thread_strerror (ret));
-			thread_destroy (&th_ctx);
-			MEMORY_FREE_OPENCL(ctx, z)
-			MEMORY_FREE_LIST_Z(matches, z)
-			MEMORY_FREE_LIST_Z(matches_found, z)
-			MEMORY_FREE_ALL
-			exit (3);
-		}
-	}
-
-	#if DEBUGME >= 1
-	// they now are all in TH_WAIT locked by a cond_wait
-	// try the normal routine
-	if (ctx.thread_sched_type == THREAD_TYPE_ASYNC)
-	{
-		size_t th_status_err = 0;
-		for (z = 0; z < thread_count; z++)
-		{
-			pthread_mutex_lock (&thread_mutexs[z]);
-			thread_status_t tmp = t_arg[z].status;
-			pthread_mutex_unlock (&thread_mutexs[z]);
-
-			if (tmp != TH_START)
-			{
-				printf ("! Warning: Thread %zu is not in TH_START, found in %s\n", z, thread_status_strdesc (tmp));
-				th_status_err++;
-			}
-		}
-
-		if (th_status_err != 0)
-		{
-			printf ("! Warning: %zu thread(s) found in wrong initial state ...\n", th_status_err);
-		}
-		else
-		{
-			printf ("# %zu thread(s) ready\n", thread_count);
-		}
-	}
-	#endif // DEBUGME >= 1
-
-	bool found = false;
-	bool error = false;
-	bool show_overall_time = true;
-
-	struct timeval cpu_t_start, cpu_t_end, cpu_t_result;
-
-	fprintf (stderr, "Attack 5 - opencl - start (Max Slices %u, %s order", max_step, wu_queue_strdesc (ctx.queue_ctx.queue_type));
-
-	if (!verbose) fprintf (stderr, ")\n\n");
-	else fprintf (stderr, ", Profile %d, Async Threads %s, HiTag2 key verify on device %s)\n\n", profile, (ctx.thread_sched_type == THREAD_TYPE_ASYNC) ? "yes" : "no", (force_hitag2_opencl) ? "yes" : "no");
-
-	if (gettimeofday (&cpu_t_start, NULL) == -1)
-	{
-		printf ("! gettimeofday(start) failed (%d): %s\n", errno, strerror (errno));
-		show_overall_time = false;
-	}
-
-	if (ctx.thread_sched_type == THREAD_TYPE_ASYNC)
-	{
-		// crack hitag key or die tryin'
-		unsigned int th_cnt;
-
-		bool done = false;
-
-		do // master
-		{
-			th_cnt = 0;
-
-			for (z = 0; z < thread_count; z++)
-			{
-				#if TDEBUG >= 1 && DEBUGME == 1
-				if (thread_count == 1) { printf ("[%zu] get status from slave ...\n", z); fflush (stdout); }
-				#endif
-
-				pthread_mutex_lock (&th_ctx.thread_mutexs[z]);
-				thread_status_t cur_status = t_arg[z].status;
-				pthread_mutex_unlock (&th_ctx.thread_mutexs[z]);
-
-				#if TDEBUG >= 1 && DEBUGME == 1
-				if (thread_count == 1) { printf ("[%zu] slave status: %s\n", z, thread_status_strdesc (cur_status)); fflush (stdout); }
-				#endif
-
-				if (found)
-				{
-					#if TDEBUG >= 3
-					printf ("[%zu] Processing exit logic\n", z);
-					fflush (stdout);
-					#endif
-
-					if (cur_status < TH_FOUND_KEY)
-					{
-						#if TDEBUG >= 1
-						printf ("[%zu] key found from another thread, set quit\n", z);
-						fflush (stdout);
-						#endif
-						pthread_mutex_lock (&th_ctx.thread_mutexs[z]);
-						t_arg[z].status = TH_END;
-						t_arg[z].quit = true;
-						if (cur_status == TH_WAIT) pthread_cond_signal (&th_ctx.thread_conds[z]);
-						pthread_mutex_unlock (&th_ctx.thread_mutexs[z]);
-					}
-					else
-					{
-						if (thread_count == 1)
-						{
-							th_cnt++;
-							#if TDEBUG >= 1
-							printf ("[%zu] Increment th_cnt: %u/%zu\n", z, th_cnt, thread_count);
-							fflush (stdout);
-							#endif
-						}
-					}
-					continue;
-				}
-
-				if (cur_status == TH_WAIT)
-				{
-					pthread_mutex_lock (&th_ctx.thread_mutexs[z]);
-
-					if (found)
-					{
-						#if TDEBUG >= 1
-						printf ("[%zu] key is found in another thread 1\n", z);
-						fflush (stdout);
-						#endif
-						t_arg[z].status = TH_END;
-						t_arg[z].quit = true;
-						pthread_mutex_unlock (&th_ctx.thread_mutexs[z]);
-						continue;
-					}
-
-					if (wu_queue_done (&ctx.queue_ctx) != QUEUE_EMPTY)
-					{
-						t_arg[z].status = TH_PROCESSING;
-
-						#if TDEBUG >= 1
-						printf ("[master] slave [%zu], I give you another try (%s)\n", z, thread_status_strdesc (t_arg[z].status));
-						fflush (stdout);
-						#endif
-
-						pthread_cond_signal (&th_ctx.thread_conds[z]);
-						pthread_mutex_unlock (&th_ctx.thread_mutexs[z]);
-						continue;
-					}
-					else
-					{
-						#if TDEBUG >= 1
-						printf ("[master] slave [%zu], max step reached. Quit.\n", z);
-						fflush (stdout);
-						#endif
-
-						cur_status = t_arg[z].status = TH_END;
-						t_arg[z].quit = true;
-
-						pthread_cond_signal (&th_ctx.thread_conds[z]);
-						pthread_mutex_unlock (&th_ctx.thread_mutexs[z]);
-					}
-				}
-
-				if (cur_status == TH_PROCESSING)
-				{
-					if (th_ctx.enable_condusleep)
-					{
-						#if TDEBUG >= 1
-						printf ("[master] before pthread_cond_wait, TH_PROCESSING\n");
-						#endif
-						pthread_mutex_lock (&th_ctx.thread_mutex_usleep);
-						#if TDEBUG >= 1
-						printf ("[master] slave [%zu], I'm waiting you end of task, I'm in %s give me a signal.\n", z, thread_status_strdesc (t_arg[z].status));
-						fflush (stdout);
-						#endif
-						pthread_cond_wait (&th_ctx.thread_cond_usleep, &th_ctx.thread_mutex_usleep);
-						#if TDEBUG >= 1
-						printf ("[master] slave [%zu], got the signal with new state: %s.\n", z, thread_status_strdesc (t_arg[z].status));
-						fflush (stdout);
-						#endif
-
-						if (t_arg[z].status == TH_FOUND_KEY) found = true;
-
-						pthread_mutex_unlock (&th_ctx.thread_mutex_usleep);
-						#if TDEBUG >= 1
-						printf ("[master] after pthread_cond_wait, TH_PROCESSING\n");
-						#endif
-						continue;
-					}
-
-					if (found)
-					{
-						#if TDEBUG >= 1
-						printf ("[master] slave [%zu], the key is found. set TH_END from TH_PROCESSING\n", z);
-						fflush (stdout);
-						#endif
-
-						pthread_mutex_lock (&th_ctx.thread_mutexs[z]);
-						t_arg[z].status = TH_END;
-						t_arg[z].quit = true;
-						pthread_mutex_unlock (&th_ctx.thread_mutexs[z]);
-						continue;
-					}
-				}
-
-				if (cur_status == TH_ERROR)
-				{
-					// something went wrong
-					pthread_mutex_lock (&th_ctx.thread_mutexs[z]);
-					t_arg[z].status = TH_END;
-					t_arg[z].quit = true;
-					pthread_mutex_unlock (&th_ctx.thread_mutexs[z]);
-					continue;
-				}
-
-				// todo, do more clean exit logic
-				if (cur_status >= TH_FOUND_KEY)
-				{
-					th_cnt++;
-
-					if (cur_status == TH_FOUND_KEY)
-					{
-						thread_setEnd (&th_ctx, t_arg);
-						found = true;
-						done = true;
-					}
-				}
-			}
-
-			if (th_cnt == thread_count) done = true;
-
-		} while (!done);
-
-		// end of async engine
-	}
-	else if (ctx.thread_sched_type == THREAD_TYPE_SEQ)
-	{
-		uint32_t step = 0;
-		bool quit = false;
-
-		for (step = 0; step < max_step; step += thread_count)
-		{
-			for (z = 0; z < thread_count; z++)
-			{
-				t_arg[z].r = found;
-				t_arg[z].matches = matches[z];
-				t_arg[z].matches_found = matches_found[z];
-			}
-
-			if ((ret = thread_start (&th_ctx, t_arg)) != 0)
-			{
-				printf ("Error: thread_start() failed (%d): %s\n", ret, thread_strerror (ret));
-				thread_destroy (&th_ctx);
-				MEMORY_FREE_OPENCL(ctx, z)
-				MEMORY_FREE_LIST_Z(matches, z)
-				MEMORY_FREE_LIST_Z(matches_found, z)
-				MEMORY_FREE_ALL
-				exit (3);
-			}
-
-			// waiting threads return
-			thread_stop (&th_ctx);
-
-			for (z = 0; z < th_ctx.thread_count; z++)
-			{
-				if (t_arg[z].r) found = true;
-
-				if (t_arg[z].err)
-				{
-					error = true;
-					quit = true;
-				}
-			}
-
-			if (found || quit) break;
-		}
-	}
-
-	// if found, show the key here
-	for (size_t y = 0; y < thread_count; y++)
-	{
-		if (t_arg[y].r)
-		{
-			if (verbose) printf ("\n");
-
-			if (thread_count > 1) printf ("[%zu] ", y);
-
-			printf ("Key found @ slice %lu/%lu: ", t_arg[y].slice, t_arg[y].max_step);
-			for (int i = 0; i < 6; i++) {
-				printf ("%02X", (uint8_t)(t_arg[y].key & 0xff));
-				t_arg[y].key = t_arg[y].key >> 8;
-			}
-			printf ("\n");
-			fflush (stdout);
-			break;
-		}
-	}
-
-	if (show_overall_time)
-	{
-		if (gettimeofday (&cpu_t_end, NULL) == 0)
-		{
-			timersub (&cpu_t_end, &cpu_t_start, &cpu_t_result);
-		}
-		else
-		{
-			printf ("! gettimeofday(end) failed (%d): %s\n", errno, strerror (errno));
-			show_overall_time = false;
-		}
-	}
-
-	if (!found)
-	{
-		printf ("\nError. %s\n", (error) ? "something went wrong :(" : "Key not found :|");
-		if (error) exit(-1);
-	}
-
-	printf ("\nAttack 5 - opencl - end");
-
-	if (show_overall_time) printf (" in %ld.%06ld second(s).\n\n", (long int)cpu_t_result.tv_sec, (long int)cpu_t_result.tv_usec);
-	else printf ("\n");
-
-	fflush(stdout);
-
-	#if DEBUGME > 1
-	printf ("stop threads\n");
-	fflush (stdout);
-	#endif
-
-	thread_stop (&th_ctx);
-
-	#if DEBUGME > 1
-	printf ("destroy threads\n");
-	fflush (stdout);
-	#endif
-
-	if ((ret = thread_destroy (&th_ctx)) != 0)
-	{
-		#if DEBUGME > 0
-		printf ("Warning: thread_destroy() failed (%d): %s\n", ret, thread_strerror (ret));
-		#endif
-	}
-
-	#if DEBUGME > 1
-	printf ("wu_queue_destroy\n");
-	fflush (stdout);
-	#endif
-
-	if ((ret = wu_queue_destroy (&ctx.queue_ctx)) != 0)
-	{
-		#if DEBUGME > 0
-		printf ("Warning: wu_queue_destroy() failed (%d): %s\n", ret, wu_queue_strerror (ret));
-		#endif
-	}
-
-	z = selected_devices_cnt - 1;
-	MEMORY_FREE_OPENCL(ctx, z)
-	MEMORY_FREE_LIST_Z(matches, z)
-	MEMORY_FREE_LIST_Z(matches_found, z)
-	MEMORY_FREE_ALL
-
-	return (found) ? 0 : 1;
+            if (err != CL_SUCCESS) {
+                printf("[%zu] Error: clEnqueueWriteBuffer(ctx.candidates) failed (%d)\n", z, err);
+                MEMORY_FREE_OPENCL(ctx, z)
+                MEMORY_FREE_LIST_Z(matches, z)
+                MEMORY_FREE_LIST_Z(matches_found, z)
+                MEMORY_FREE_ALL
+                exit(3);
+            }
+
+            if (ctx.force_hitag2_opencl) {
+                err = clEnqueueWriteBuffer(ctx.commands[z], ctx.checks[z], CL_TRUE, 0, sizeof(uint32_t) * 4, checks, 0, NULL, NULL);
+                if (err != CL_SUCCESS) {
+                    printf("[%zu] Error: clEnqueueWriteBuffer(ctx.checks) failed (%d)\n", z, err);
+                    MEMORY_FREE_OPENCL(ctx, z)
+                    MEMORY_FREE_LIST_Z(matches, z)
+                    MEMORY_FREE_LIST_Z(matches_found, z)
+                    MEMORY_FREE_ALL
+                    exit(3);
+                }
+            }
+
+            // Set the arguments to our compute kernel
+            err  = clSetKernelArg(ctx.kernels[z], 1, sizeof(cl_mem), &ctx.candidates[z]);
+            err |= clSetKernelArg(ctx.kernels[z], 2, sizeof(cl_mem), &ctx.keystreams[z]);
+            err |= clSetKernelArg(ctx.kernels[z], 3, sizeof(cl_mem), &ctx.matches[z]);
+            if (ctx.force_hitag2_opencl) err |= clSetKernelArg(ctx.kernels[z], 5, sizeof(cl_mem), &ctx.checks[z]);
+
+            if (err != CL_SUCCESS) {
+                printf("[%zu] Error: clSetKernelArg(ctx.candidates|ctx.keystream|ctx.matches|ctx.checks) failed (%d)\n", z, err);
+                MEMORY_FREE_OPENCL(ctx, z)
+                MEMORY_FREE_LIST_Z(matches, z)
+                MEMORY_FREE_LIST_Z(matches_found, z)
+                MEMORY_FREE_ALL
+                exit(3);
+            }
+
+            z++;
+        }
+    }
+
+    if (build_errors > 0) {
+#if DEBUGME >= 2
+        printf("[debug] Detected build errors with %u device(s).\n", build_errors);
+#endif
+        MEMORY_FREE_OPENCL(ctx, z)
+        MEMORY_FREE_LIST_Z(matches, z)
+        MEMORY_FREE_LIST_Z(matches_found, z)
+        MEMORY_FREE_ALL
+        exit(3);
+    }
+
+    // at this point z is the max value, still usefull for free's
+
+#if DEBUGME > 0
+    printf("[debug] Lower profile between %u device(s) is: %d\n", selected_devices_cnt, profile);
+#endif
+
+    uint32_t max_step = profiles[profile][0];
+    uint32_t chunk = profiles[profile][1];
+
+#if DEBUGME > 0
+    printf("[debug] Init queue\n");
+#endif
+
+    int ret = 0;
+    if ((ret = wu_queue_init(&ctx.queue_ctx, queue_type)) != 0) {
+        printf("! Error: wu_queue_init(%s) failed (%d): %s\n", wu_queue_strdesc(queue_type), ret, wu_queue_strerror(ret));
+        MEMORY_FREE_OPENCL(ctx, z)
+        MEMORY_FREE_LIST_Z(matches, z)
+        MEMORY_FREE_LIST_Z(matches_found, z)
+        MEMORY_FREE_ALL
+        exit(2);
+    }
+
+#if DEBUGME > 0
+    printf("[queue] Fill queue with pre-calculated offset using profile (%d): ", profile);
+#endif
+
+    for (size_t step = 0; step < max_step; step++) wu_queue_push(&ctx.queue_ctx, step, step << chunk, max_step);
+
+#if DEBUGME > 0
+    printf("done\n");
+#endif
+
+    // save selected_devices_cnt
+    size_t thread_count = selected_devices_cnt;
+
+    thread_ctx_t th_ctx;
+    memset(&th_ctx, 0, sizeof(thread_ctx_t));
+
+    thread_args_t *t_arg = (thread_args_t *) calloc(thread_count, sizeof(thread_args_t));
+    if (!t_arg) {
+        printf("Error: calloc (thread_args_t) failed (%d): %s\n", errno, strerror(errno));
+        MEMORY_FREE_OPENCL(ctx, z)
+        MEMORY_FREE_LIST_Z(matches, z)
+        MEMORY_FREE_LIST_Z(matches_found, z)
+        MEMORY_FREE_ALL
+        exit(3);
+    }
+
+    MEMORY_FREE_ADD(t_arg)
+
+    if ((ret = thread_init(&th_ctx, ctx.thread_sched_type, thread_count)) != 0) {
+        printf("Error: thread_init(%zu) failed (%d)\n", thread_count, ret);
+        MEMORY_FREE_OPENCL(ctx, z)
+        MEMORY_FREE_LIST_Z(matches, z)
+        MEMORY_FREE_LIST_Z(matches_found, z)
+        MEMORY_FREE_ALL
+        exit(3);
+    }
+
+    // preload constant values in threads memory, and start threads
+    for (z = 0; z < thread_count; z++) {
+        t_arg[z].uid = uid;
+        t_arg[z].aR2 = aR2;
+        t_arg[z].nR1 = nR1;
+        t_arg[z].nR2 = nR2;
+        t_arg[z].max_step = max_step;
+        t_arg[z].ocl_ctx = &ctx;
+        t_arg[z].device_id = z;
+        t_arg[z].async = (ctx.thread_sched_type == THREAD_TYPE_ASYNC);
+        t_arg[z].thread_ctx = &th_ctx;
+
+        if (ctx.thread_sched_type == THREAD_TYPE_ASYNC) {
+            t_arg[z].matches = matches[z];
+            t_arg[z].matches_found = matches_found[z];
+            t_arg[z].status = TH_START;
+        }
+    }
+
+    if (ctx.thread_sched_type == THREAD_TYPE_ASYNC) {
+        if ((ret = thread_start(&th_ctx, t_arg)) != 0) {
+            printf("Error: thread_start() failed (%d): %s\n", ret, thread_strerror(ret));
+            thread_destroy(&th_ctx);
+            MEMORY_FREE_OPENCL(ctx, z)
+            MEMORY_FREE_LIST_Z(matches, z)
+            MEMORY_FREE_LIST_Z(matches_found, z)
+            MEMORY_FREE_ALL
+            exit(3);
+        }
+    }
+
+#if DEBUGME >= 1
+    // they now are all in TH_WAIT locked by a cond_wait
+    // try the normal routine
+    if (ctx.thread_sched_type == THREAD_TYPE_ASYNC) {
+        size_t th_status_err = 0;
+        for (z = 0; z < thread_count; z++) {
+            pthread_mutex_lock(&thread_mutexs[z]);
+            thread_status_t tmp = t_arg[z].status;
+            pthread_mutex_unlock(&thread_mutexs[z]);
+
+            if (tmp != TH_START) {
+                printf("! Warning: Thread %zu is not in TH_START, found in %s\n", z, thread_status_strdesc(tmp));
+                th_status_err++;
+            }
+        }
+
+        if (th_status_err != 0) {
+            printf("! Warning: %zu thread(s) found in wrong initial state ...\n", th_status_err);
+        } else {
+            printf("# %zu thread(s) ready\n", thread_count);
+        }
+    }
+#endif // DEBUGME >= 1
+
+    bool found = false;
+    bool error = false;
+    bool show_overall_time = true;
+
+    struct timeval cpu_t_start, cpu_t_end, cpu_t_result;
+
+    fprintf(stderr, "Attack 5 - opencl - start (Max Slices %u, %s order", max_step, wu_queue_strdesc(ctx.queue_ctx.queue_type));
+
+    if (!verbose) fprintf(stderr, ")\n\n");
+    else fprintf(stderr, ", Profile %d, Async Threads %s, HiTag2 key verify on device %s)\n\n", profile, (ctx.thread_sched_type == THREAD_TYPE_ASYNC) ? "yes" : "no", (force_hitag2_opencl) ? "yes" : "no");
+
+    if (gettimeofday(&cpu_t_start, NULL) == -1) {
+        printf("! gettimeofday(start) failed (%d): %s\n", errno, strerror(errno));
+        show_overall_time = false;
+    }
+
+    if (ctx.thread_sched_type == THREAD_TYPE_ASYNC) {
+        // crack hitag key or die tryin'
+        unsigned int th_cnt;
+
+        bool done = false;
+
+        do { // master
+            th_cnt = 0;
+
+            for (z = 0; z < thread_count; z++) {
+#if TDEBUG >= 1 && DEBUGME == 1
+                if (thread_count == 1) { printf("[%zu] get status from slave ...\n", z); fflush(stdout); }
+#endif
+
+                pthread_mutex_lock(&th_ctx.thread_mutexs[z]);
+                thread_status_t cur_status = t_arg[z].status;
+                pthread_mutex_unlock(&th_ctx.thread_mutexs[z]);
+
+#if TDEBUG >= 1 && DEBUGME == 1
+                if (thread_count == 1) { printf("[%zu] slave status: %s\n", z, thread_status_strdesc(cur_status)); fflush(stdout); }
+#endif
+
+                if (found) {
+#if TDEBUG >= 3
+                    printf("[%zu] Processing exit logic\n", z);
+                    fflush(stdout);
+#endif
+
+                    if (cur_status < TH_FOUND_KEY) {
+#if TDEBUG >= 1
+                        printf("[%zu] key found from another thread, set quit\n", z);
+                        fflush(stdout);
+#endif
+                        pthread_mutex_lock(&th_ctx.thread_mutexs[z]);
+                        t_arg[z].status = TH_END;
+                        t_arg[z].quit = true;
+                        if (cur_status == TH_WAIT) pthread_cond_signal(&th_ctx.thread_conds[z]);
+                        pthread_mutex_unlock(&th_ctx.thread_mutexs[z]);
+                    } else {
+                        if (thread_count == 1) {
+                            th_cnt++;
+#if TDEBUG >= 1
+                            printf("[%zu] Increment th_cnt: %u/%zu\n", z, th_cnt, thread_count);
+                            fflush(stdout);
+#endif
+                        }
+                    }
+                    continue;
+                }
+
+                if (cur_status == TH_WAIT) {
+                    pthread_mutex_lock(&th_ctx.thread_mutexs[z]);
+
+                    if (found) {
+#if TDEBUG >= 1
+                        printf("[%zu] key is found in another thread 1\n", z);
+                        fflush(stdout);
+#endif
+                        t_arg[z].status = TH_END;
+                        t_arg[z].quit = true;
+                        pthread_mutex_unlock(&th_ctx.thread_mutexs[z]);
+                        continue;
+                    }
+
+                    if (wu_queue_done(&ctx.queue_ctx) != QUEUE_EMPTY) {
+                        t_arg[z].status = TH_PROCESSING;
+
+#if TDEBUG >= 1
+                        printf("[master] slave [%zu], I give you another try (%s)\n", z, thread_status_strdesc(t_arg[z].status));
+                        fflush(stdout);
+#endif
+
+                        pthread_cond_signal(&th_ctx.thread_conds[z]);
+                        pthread_mutex_unlock(&th_ctx.thread_mutexs[z]);
+                        continue;
+                    } else {
+#if TDEBUG >= 1
+                        printf("[master] slave [%zu], max step reached. Quit.\n", z);
+                        fflush(stdout);
+#endif
+
+                        cur_status = t_arg[z].status = TH_END;
+                        t_arg[z].quit = true;
+
+                        pthread_cond_signal(&th_ctx.thread_conds[z]);
+                        pthread_mutex_unlock(&th_ctx.thread_mutexs[z]);
+                    }
+                }
+
+                if (cur_status == TH_PROCESSING) {
+                    if (th_ctx.enable_condusleep) {
+#if TDEBUG >= 1
+                        printf("[master] before pthread_cond_wait, TH_PROCESSING\n");
+#endif
+                        pthread_mutex_lock(&th_ctx.thread_mutex_usleep);
+#if TDEBUG >= 1
+                        printf("[master] slave [%zu], I'm waiting you end of task, I'm in %s give me a signal.\n", z, thread_status_strdesc(t_arg[z].status));
+                        fflush(stdout);
+#endif
+                        pthread_cond_wait(&th_ctx.thread_cond_usleep, &th_ctx.thread_mutex_usleep);
+#if TDEBUG >= 1
+                        printf("[master] slave [%zu], got the signal with new state: %s.\n", z, thread_status_strdesc(t_arg[z].status));
+                        fflush(stdout);
+#endif
+
+                        if (t_arg[z].status == TH_FOUND_KEY) found = true;
+
+                        pthread_mutex_unlock(&th_ctx.thread_mutex_usleep);
+#if TDEBUG >= 1
+                        printf("[master] after pthread_cond_wait, TH_PROCESSING\n");
+#endif
+                        continue;
+                    }
+
+                    if (found) {
+#if TDEBUG >= 1
+                        printf("[master] slave [%zu], the key is found. set TH_END from TH_PROCESSING\n", z);
+                        fflush(stdout);
+#endif
+
+                        pthread_mutex_lock(&th_ctx.thread_mutexs[z]);
+                        t_arg[z].status = TH_END;
+                        t_arg[z].quit = true;
+                        pthread_mutex_unlock(&th_ctx.thread_mutexs[z]);
+                        continue;
+                    }
+                }
+
+                if (cur_status == TH_ERROR) {
+                    // something went wrong
+                    pthread_mutex_lock(&th_ctx.thread_mutexs[z]);
+                    t_arg[z].status = TH_END;
+                    t_arg[z].quit = true;
+                    pthread_mutex_unlock(&th_ctx.thread_mutexs[z]);
+                    continue;
+                }
+
+                // todo, do more clean exit logic
+                if (cur_status >= TH_FOUND_KEY) {
+                    th_cnt++;
+
+                    if (cur_status == TH_FOUND_KEY) {
+                        thread_setEnd(&th_ctx, t_arg);
+                        found = true;
+                        done = true;
+                    }
+                }
+            }
+
+            if (th_cnt == thread_count) done = true;
+
+        } while (!done);
+
+        // end of async engine
+    } else if (ctx.thread_sched_type == THREAD_TYPE_SEQ) {
+        uint32_t step = 0;
+        bool quit = false;
+
+        for (step = 0; step < max_step; step += thread_count) {
+            for (z = 0; z < thread_count; z++) {
+                t_arg[z].r = found;
+                t_arg[z].matches = matches[z];
+                t_arg[z].matches_found = matches_found[z];
+            }
+
+            if ((ret = thread_start(&th_ctx, t_arg)) != 0) {
+                printf("Error: thread_start() failed (%d): %s\n", ret, thread_strerror(ret));
+                thread_destroy(&th_ctx);
+                MEMORY_FREE_OPENCL(ctx, z)
+                MEMORY_FREE_LIST_Z(matches, z)
+                MEMORY_FREE_LIST_Z(matches_found, z)
+                MEMORY_FREE_ALL
+                exit(3);
+            }
+
+            // waiting threads return
+            thread_stop(&th_ctx);
+
+            for (z = 0; z < th_ctx.thread_count; z++) {
+                if (t_arg[z].r) found = true;
+
+                if (t_arg[z].err) {
+                    error = true;
+                    quit = true;
+                }
+            }
+
+            if (found || quit) break;
+        }
+    }
+
+    // if found, show the key here
+    for (size_t y = 0; y < thread_count; y++) {
+        if (t_arg[y].r) {
+            if (verbose) printf("\n");
+
+            if (thread_count > 1) printf("[%zu] ", y);
+
+            printf("Key found @ slice %lu/%lu: ", t_arg[y].slice, t_arg[y].max_step);
+            for (int i = 0; i < 6; i++) {
+                printf("%02X", (uint8_t)(t_arg[y].key & 0xff));
+                t_arg[y].key = t_arg[y].key >> 8;
+            }
+            printf("\n");
+            fflush(stdout);
+            break;
+        }
+    }
+
+    if (show_overall_time) {
+        if (gettimeofday(&cpu_t_end, NULL) == 0) {
+            timersub(&cpu_t_end, &cpu_t_start, &cpu_t_result);
+        } else {
+            printf("! gettimeofday(end) failed (%d): %s\n", errno, strerror(errno));
+            show_overall_time = false;
+        }
+    }
+
+    if (!found) {
+        printf("\nError. %s\n", (error) ? "something went wrong :(" : "Key not found :|");
+        if (error) exit(-1);
+    }
+
+    printf("\nAttack 5 - opencl - end");
+
+    if (show_overall_time) printf(" in %ld.%06ld second(s).\n\n", (long int)cpu_t_result.tv_sec, (long int)cpu_t_result.tv_usec);
+    else printf("\n");
+
+    fflush(stdout);
+
+#if DEBUGME > 1
+    printf("stop threads\n");
+    fflush(stdout);
+#endif
+
+    thread_stop(&th_ctx);
+
+#if DEBUGME > 1
+    printf("destroy threads\n");
+    fflush(stdout);
+#endif
+
+    if ((ret = thread_destroy(&th_ctx)) != 0) {
+#if DEBUGME > 0
+        printf("Warning: thread_destroy() failed (%d): %s\n", ret, thread_strerror(ret));
+#endif
+    }
+
+#if DEBUGME > 1
+    printf("wu_queue_destroy\n");
+    fflush(stdout);
+#endif
+
+    if ((ret = wu_queue_destroy(&ctx.queue_ctx)) != 0) {
+#if DEBUGME > 0
+        printf("Warning: wu_queue_destroy() failed (%d): %s\n", ret, wu_queue_strerror(ret));
+#endif
+    }
+
+    z = selected_devices_cnt - 1;
+    MEMORY_FREE_OPENCL(ctx, z)
+    MEMORY_FREE_LIST_Z(matches, z)
+    MEMORY_FREE_LIST_Z(matches_found, z)
+    MEMORY_FREE_ALL
+
+    return (found) ? 0 : 1;
 }
diff --git a/tools/hitag2crack/crack5opencl/opencl.c b/tools/hitag2crack/crack5opencl/opencl.c
index 161155b6c..a16ce0f94 100644
--- a/tools/hitag2crack/crack5opencl/opencl.c
+++ b/tools/hitag2crack/crack5opencl/opencl.c
@@ -24,140 +24,128 @@ License: GNU General Public License v3 or any later version (see LICENSE.txt)
 
 #include "opencl.h"
 
-bool plat_dev_enabled (unsigned int id, unsigned int *sel, unsigned int cnt, unsigned int cur_type, unsigned int allow_type)
-{
-	// usefull only with devices
-	if (allow_type != CL_DEVICE_TYPE_ALL)
-	{
-		if (cur_type != allow_type) return false;
-	}
+bool plat_dev_enabled(unsigned int id, unsigned int *sel, unsigned int cnt, unsigned int cur_type, unsigned int allow_type) {
+    // usefull only with devices
+    if (allow_type != CL_DEVICE_TYPE_ALL) {
+        if (cur_type != allow_type) return false;
+    }
 
-	if (sel[0] == 0xff) return true; // all
-	else
-	{
-		for (unsigned int i = 0; i < cnt; i++)
-		{
-			if (sel[i] == (id+1)) return true;
-		}
-	}
+    if (sel[0] == 0xff) return true; // all
+    else {
+        for (unsigned int i = 0; i < cnt; i++) {
+            if (sel[i] == (id + 1)) return true;
+        }
+    }
 
-	return false;
+    return false;
 }
 
-int runKernel (opencl_ctx_t *ctx, uint32_t cand_base, uint64_t *matches, uint32_t *matches_found, size_t id)
-{
-	int err = 0;
+int runKernel(opencl_ctx_t *ctx, uint32_t cand_base, uint64_t *matches, uint32_t *matches_found, size_t id) {
+    int err = 0;
 
-	size_t global_ws[3] = { ctx->global_ws[id], GLOBAL_WS_1, GLOBAL_WS_2 };
-	size_t local_ws[3]  = { ctx->local_ws[id], 1, 1 };
+    size_t global_ws[3] = { ctx->global_ws[id], GLOBAL_WS_1, GLOBAL_WS_2 };
+    size_t local_ws[3]  = { ctx->local_ws[id], 1, 1 };
 
-	if (ctx->profiling)
-	{
-		printf ("[%zu] global_ws %zu, ctx->local_ws: %zu\n", id, global_ws[0], local_ws[0]);
-		fflush (stdout);
-	}
+    if (ctx->profiling) {
+        printf("[%zu] global_ws %zu, ctx->local_ws: %zu\n", id, global_ws[0], local_ws[0]);
+        fflush(stdout);
+    }
 
-	*matches_found = 0;
+    *matches_found = 0;
 
-	// Write our data set into the input array in device memory
-	err = clEnqueueWriteBuffer (ctx->commands[id], ctx->matches_found[id], CL_TRUE, 0, sizeof(uint32_t), matches_found, 0, NULL, NULL);
-	if (err != CL_SUCCESS) {
-		printf ("[%zu] Error: clEnqueueWriteBuffer (matches_found) failed (%d)\n", id, err);
-		return -1;
-	}
+    // Write our data set into the input array in device memory
+    err = clEnqueueWriteBuffer(ctx->commands[id], ctx->matches_found[id], CL_TRUE, 0, sizeof(uint32_t), matches_found, 0, NULL, NULL);
+    if (err != CL_SUCCESS) {
+        printf("[%zu] Error: clEnqueueWriteBuffer (matches_found) failed (%d)\n", id, err);
+        return -1;
+    }
 
-	// Set the arguments to our compute kernel
-	err  = clSetKernelArg (ctx->kernels[id], 0, sizeof(uint32_t), &cand_base);
-	err |= clSetKernelArg (ctx->kernels[id], 4, sizeof(cl_mem), &ctx->matches_found[id]);
+    // Set the arguments to our compute kernel
+    err  = clSetKernelArg(ctx->kernels[id], 0, sizeof(uint32_t), &cand_base);
+    err |= clSetKernelArg(ctx->kernels[id], 4, sizeof(cl_mem), &ctx->matches_found[id]);
 
-	if (err != CL_SUCCESS) {
-		printf ("[%zu] Error: clSetKernelArg (cand_base|ctx->matches_found) failed (%d)\n", id, err);
-		return -1;
-	}
+    if (err != CL_SUCCESS) {
+        printf("[%zu] Error: clSetKernelArg (cand_base|ctx->matches_found) failed (%d)\n", id, err);
+        return -1;
+    }
 
-	cl_event event;
+    cl_event event;
 
-	err = clEnqueueNDRangeKernel (ctx->commands[id], ctx->kernels[id], 2, NULL, global_ws, local_ws, 0, NULL, &event);
-	if (err != CL_SUCCESS) {
-		printf ("[%zu] Error: clEnqueueNDRangeKernel() failed (%d)\n", id, err);
-		return -1;
-	}
+    err = clEnqueueNDRangeKernel(ctx->commands[id], ctx->kernels[id], 2, NULL, global_ws, local_ws, 0, NULL, &event);
+    if (err != CL_SUCCESS) {
+        printf("[%zu] Error: clEnqueueNDRangeKernel() failed (%d)\n", id, err);
+        return -1;
+    }
 
-	// todo, check if is possible remove
-	err = clFlush (ctx->commands[id]);
-	if (err != CL_SUCCESS) {
-		printf ("[%zu] Error: clFlush() failed (%d)\n", id, err);
-		return -1;
-	}
+    // todo, check if is possible remove
+    err = clFlush(ctx->commands[id]);
+    if (err != CL_SUCCESS) {
+        printf("[%zu] Error: clFlush() failed (%d)\n", id, err);
+        return -1;
+    }
 
-	if (ctx->profiling)
-	{
-		err = clWaitForEvents (1, &event);
-		if (err != CL_SUCCESS) {
-			printf ("[%zu] Error: clWaitForEvents() failed (%d)\n", id, err);
-			return -1;
-		}
+    if (ctx->profiling) {
+        err = clWaitForEvents(1, &event);
+        if (err != CL_SUCCESS) {
+            printf("[%zu] Error: clWaitForEvents() failed (%d)\n", id, err);
+            return -1;
+        }
 
-		cl_ulong gpu_t_start = 0, gpu_t_end = 0;
+        cl_ulong gpu_t_start = 0, gpu_t_end = 0;
 
-		err  = clGetEventProfilingInfo (event, CL_PROFILING_COMMAND_START, sizeof (cl_ulong), &gpu_t_start, NULL);
-		err |= clGetEventProfilingInfo (event, CL_PROFILING_COMMAND_END, sizeof (cl_ulong), &gpu_t_end, NULL);
-		if (err != CL_SUCCESS) {
-			printf ("[%zu] Error: clGetEventOPENCL_PROFILINGInfo() failed (%d)\n", id, err);
-			return -1;
-		}
+        err  = clGetEventProfilingInfo(event, CL_PROFILING_COMMAND_START, sizeof(cl_ulong), &gpu_t_start, NULL);
+        err |= clGetEventProfilingInfo(event, CL_PROFILING_COMMAND_END, sizeof(cl_ulong), &gpu_t_end, NULL);
+        if (err != CL_SUCCESS) {
+            printf("[%zu] Error: clGetEventOPENCL_PROFILINGInfo() failed (%d)\n", id, err);
+            return -1;
+        }
 
-		const double time_ms = (double) (gpu_t_end - gpu_t_start) / 1000000;
+        const double time_ms = (double)(gpu_t_end - gpu_t_start) / 1000000;
 
-		printf ("[%zu] kernel exec time (ms): %.2f]\n", id, time_ms);
-		fflush (stdout);
-	}
+        printf("[%zu] kernel exec time (ms): %.2f]\n", id, time_ms);
+        fflush(stdout);
+    }
 
-	err  = clReleaseEvent (event);
-	if (err != CL_SUCCESS) {
-		printf ("[%zu] Error: clReleaseEvent() failed (%d)\n", id, err);
-		return -1;
-	}
+    err  = clReleaseEvent(event);
+    if (err != CL_SUCCESS) {
+        printf("[%zu] Error: clReleaseEvent() failed (%d)\n", id, err);
+        return -1;
+    }
 
-	// Wait for the command commands to get serviced before reading back results
-	// todo, check if is possible remove, because of blocking clEnqueueReadBuffer (CL_TRUE)
-	err = clFinish (ctx->commands[id]);
-	if (err != CL_SUCCESS) {
-		printf ("[%zu] Error: clFinish() failed (%d)\n", id, err);
-		return -1;
-	}
+    // Wait for the command commands to get serviced before reading back results
+    // todo, check if is possible remove, because of blocking clEnqueueReadBuffer (CL_TRUE)
+    err = clFinish(ctx->commands[id]);
+    if (err != CL_SUCCESS) {
+        printf("[%zu] Error: clFinish() failed (%d)\n", id, err);
+        return -1;
+    }
 
-	// read back the matches counter first
-	err = clEnqueueReadBuffer (ctx->commands[id], ctx->matches_found[id], CL_TRUE, 0, sizeof(uint32_t), matches_found, 0, NULL, NULL);
-	if (err != CL_SUCCESS) {
-		printf ("[%zu] Error: clEnqueueReadBuffer(matches_found) failed (%d)\n", id, err);
-		return -1;
-	}
+    // read back the matches counter first
+    err = clEnqueueReadBuffer(ctx->commands[id], ctx->matches_found[id], CL_TRUE, 0, sizeof(uint32_t), matches_found, 0, NULL, NULL);
+    if (err != CL_SUCCESS) {
+        printf("[%zu] Error: clEnqueueReadBuffer(matches_found) failed (%d)\n", id, err);
+        return -1;
+    }
 
-	if (matches_found[0] > 0)
-	{
-		if (ctx->force_hitag2_opencl)
-		{
-			if (matches_found[0] != 1) printf ("[%zu] BUG: if match the counter must be 1. Here %u are founds\n", id, matches_found[0]);
-		}
-		else
-		{
-			if (matches_found[0] > (uint32_t)(ctx->global_ws[id]*WGS_MATCHES_FACTOR))
-			{
-				printf ("[%zu] BUG: the next clEnqueueReadBuffer will crash. 'matches' buffer (%u) is lower than requested (%u)\n", id, (uint32_t)(ctx->global_ws[id]*WGS_MATCHES_FACTOR), matches_found[0]);
-			}
-		}
+    if (matches_found[0] > 0) {
+        if (ctx->force_hitag2_opencl) {
+            if (matches_found[0] != 1) printf("[%zu] BUG: if match the counter must be 1. Here %u are founds\n", id, matches_found[0]);
+        } else {
+            if (matches_found[0] > (uint32_t)(ctx->global_ws[id]*WGS_MATCHES_FACTOR)) {
+                printf("[%zu] BUG: the next clEnqueueReadBuffer will crash. 'matches' buffer (%u) is lower than requested (%u)\n", id, (uint32_t)(ctx->global_ws[id]*WGS_MATCHES_FACTOR), matches_found[0]);
+            }
+        }
 
-		err = clEnqueueReadBuffer(ctx->commands[id], ctx->matches[id], CL_TRUE, 0, sizeof(uint64_t) * matches_found[0], matches, 0, NULL, NULL);
-		if (err != CL_SUCCESS) {
-			printf ("[%zu] Error: clEnqueueReadBuffer(matches) failed (%d)\n", id, err);
-			return -1;
-		}
+        err = clEnqueueReadBuffer(ctx->commands[id], ctx->matches[id], CL_TRUE, 0, sizeof(uint64_t) * matches_found[0], matches, 0, NULL, NULL);
+        if (err != CL_SUCCESS) {
+            printf("[%zu] Error: clEnqueueReadBuffer(matches) failed (%d)\n", id, err);
+            return -1;
+        }
 
-		// key found
-		return 1;
-	}
+        // key found
+        return 1;
+    }
 
-	// nada
-	return 0;
+    // nada
+    return 0;
 }
diff --git a/tools/hitag2crack/crack5opencl/opencl.h b/tools/hitag2crack/crack5opencl/opencl.h
index e91ace290..410a7cb5a 100644
--- a/tools/hitag2crack/crack5opencl/opencl.h
+++ b/tools/hitag2crack/crack5opencl/opencl.h
@@ -43,87 +43,84 @@ License: GNU General Public License v3 or any later version (see LICENSE.txt)
 #define MAX_OPENCL_DEVICES 16
 
 // defines structures
-typedef struct compute_device_ctx
-{
-	char name[0xff];
-	char vendor[0x40];
-	char version[0x40];
-	char driver_version[0x40];
+typedef struct compute_device_ctx {
+    char name[0xff];
+    char vendor[0x40];
+    char version[0x40];
+    char driver_version[0x40];
 
-	bool is_gpu, is_apple_gpu, is_nv;
-	bool have_lop3, have_local_memory;
-	bool warning, unsupported;
+    bool is_gpu, is_apple_gpu, is_nv;
+    bool have_lop3, have_local_memory;
+    bool warning, unsupported;
 
-	bool selected;
-	bool enabled;
+    bool selected;
+    bool enabled;
 
-	unsigned char pad1[4];
-	unsigned int sm_maj;
-	unsigned int sm_min;
-	unsigned int compute_units;
+    unsigned char pad1[4];
+    unsigned int sm_maj;
+    unsigned int sm_min;
+    unsigned int compute_units;
 
-	cl_device_id device_id;
-	cl_platform_id platform_id;
+    cl_device_id device_id;
+    cl_platform_id platform_id;
 
 } compute_device_ctx_t;
 
-typedef struct compute_platform_ctx
-{
-	unsigned int device_cnt;
-	unsigned int compute_units_max;
+typedef struct compute_platform_ctx {
+    unsigned int device_cnt;
+    unsigned int compute_units_max;
 
-	bool is_nv, is_apple, is_intel;
-	bool warning;
-	bool selected;
+    bool is_nv, is_apple, is_intel;
+    bool warning;
+    bool selected;
 
-	unsigned char pad1[3];
-	compute_device_ctx_t device[0x10];
+    unsigned char pad1[3];
+    compute_device_ctx_t device[0x10];
 
-	char name[0xff];
-	char vendor[0x40];
-	char version[0x40];
+    char name[0xff];
+    char vendor[0x40];
+    char version[0x40];
 
-	unsigned char pad2[1];
-	cl_platform_id platform_id;
-	cl_context context;
-	cl_program program;
+    unsigned char pad2[1];
+    cl_platform_id platform_id;
+    cl_context context;
+    cl_program program;
 
 } compute_platform_ctx_t;
 
-typedef struct opencl_ctx
-{
-	char *kernelSource[1];
-	size_t kernelSource_len;
+typedef struct opencl_ctx {
+    char *kernelSource[1];
+    size_t kernelSource_len;
 
-	size_t *global_ws;
-	size_t *local_ws;
-	int *profiles;
+    size_t *global_ws;
+    size_t *local_ws;
+    int *profiles;
 
-	cl_device_id *device_ids;       // compute device id's array
-	cl_context *contexts;           // compute contexts
-	cl_command_queue *commands;     // compute command queue (for each device)
-	cl_program *programs;           // compute program's
-	cl_kernel *kernels;             // compute kernel's
+    cl_device_id *device_ids;       // compute device id's array
+    cl_context *contexts;           // compute contexts
+    cl_command_queue *commands;     // compute command queue (for each device)
+    cl_program *programs;           // compute program's
+    cl_kernel *kernels;             // compute kernel's
 
 //	cl_mem cand_base;               // device memory used for the candidate base
-	cl_mem *keystreams;             // device memory used for the keystream array
-	cl_mem *candidates;             // device memory used for the candidates array
-	cl_mem *matches;                // device memory used for the matches array
-	cl_mem *matches_found;          // device memory used for the matches_found array
-	cl_mem *checks;                 // device memory used for uid, aR2, nR1, nR2
+    cl_mem *keystreams;             // device memory used for the keystream array
+    cl_mem *candidates;             // device memory used for the candidates array
+    cl_mem *matches;                // device memory used for the matches array
+    cl_mem *matches_found;          // device memory used for the matches_found array
+    cl_mem *checks;                 // device memory used for uid, aR2, nR1, nR2
 
-	wu_queue_ctx_t queue_ctx;
-	bool profiling;
-	unsigned char pad2[1];
-	short thread_sched_type;
-	bool force_hitag2_opencl;
+    wu_queue_ctx_t queue_ctx;
+    bool profiling;
+    unsigned char pad2[1];
+    short thread_sched_type;
+    bool force_hitag2_opencl;
 
-	unsigned char pad3[3];
+    unsigned char pad3[3];
 
 } opencl_ctx_t;
 
-bool plat_dev_enabled (unsigned int id, unsigned int *sel, unsigned int cnt, unsigned int cur_type, unsigned int allow_type);
+bool plat_dev_enabled(unsigned int id, unsigned int *sel, unsigned int cnt, unsigned int cur_type, unsigned int allow_type);
 
-int runKernel (opencl_ctx_t *ctx, uint32_t cand_base, uint64_t *matches, uint32_t *matches_found, size_t id);
+int runKernel(opencl_ctx_t *ctx, uint32_t cand_base, uint64_t *matches, uint32_t *matches_found, size_t id);
 
 #endif // OPENCL_H
diff --git a/tools/hitag2crack/crack5opencl/queue.c b/tools/hitag2crack/crack5opencl/queue.c
index c32f1dbba..ee289f552 100644
--- a/tools/hitag2crack/crack5opencl/queue.c
+++ b/tools/hitag2crack/crack5opencl/queue.c
@@ -25,527 +25,493 @@ License: GNU General Public License v3 or any later version (see LICENSE.txt)
 #include "queue.h"
 
 #if TEST_UNIT == 1
-int wu_queue_print (wu_queue_ctx_t *ctx)
-{
-	wu_queue_item_t *ptr = 0; //NULL;
-	size_t sum = 0;
-	int ret = -1;
+int wu_queue_print(wu_queue_ctx_t *ctx) {
+    wu_queue_item_t *ptr = 0; //NULL;
+    size_t sum = 0;
+    int ret = -1;
 
-	if (!ctx) return -1;
-	if (!ctx->init) return ERROR_CTX_IS_NOT_INIT;
+    if (!ctx) return -1;
+    if (!ctx->init) return ERROR_CTX_IS_NOT_INIT;
 
-	pthread_mutex_lock (&ctx->queue_mutex);
+    pthread_mutex_lock(&ctx->queue_mutex);
 
-	if ((ret = wu_queue_done (ctx)) != 0)
-	{
-		pthread_mutex_unlock (&ctx->queue_mutex);
-		return ret;
-	}
+    if ((ret = wu_queue_done(ctx)) != 0) {
+        pthread_mutex_unlock(&ctx->queue_mutex);
+        return ret;
+    }
 
-	switch (ctx->queue_type)
-	{
-		case QUEUE_TYPE_FORWARD:
-			ptr = ctx->queue_head;
-			printf ("> show queue contents in FORWARD mode, from head\n");
-			break;
-		case QUEUE_TYPE_REVERSE:
-			ptr = ctx->queue_tail;
-			printf ("> show queue contents in REVERSE mode, from tail\n");
-			break;
-		case QUEUE_TYPE_RANDOM:
-			ptr = ctx->queue_head;
-			printf ("> show queue contents in RANDOM mode, from head\n");
-		default:
-			pthread_mutex_unlock (&ctx->queue_mutex);
-			return ERROR_QUEUE_TYPE_INVALID;
-	}
+    switch (ctx->queue_type) {
+        case QUEUE_TYPE_FORWARD:
+            ptr = ctx->queue_head;
+            printf("> show queue contents in FORWARD mode, from head\n");
+            break;
+        case QUEUE_TYPE_REVERSE:
+            ptr = ctx->queue_tail;
+            printf("> show queue contents in REVERSE mode, from tail\n");
+            break;
+        case QUEUE_TYPE_RANDOM:
+            ptr = ctx->queue_head;
+            printf("> show queue contents in RANDOM mode, from head\n");
+        default:
+            pthread_mutex_unlock(&ctx->queue_mutex);
+            return ERROR_QUEUE_TYPE_INVALID;
+    }
 
-	int cnt = 0;
+    int cnt = 0;
 
-	printf ("# Queue size: %zu\n", ctx->queue_size);
+    printf("# Queue size: %zu\n", ctx->queue_size);
 
-	do
-	{
-		sum += ptr->data.id;
+    do {
+        sum += ptr->data.id;
 
-		if (cnt++ < 4) printf ("# ID %zu, OFF %zu, MAX %zu\n", ptr->data.id, ptr->data.off, ptr->data.max);
+        if (cnt++ < 4) printf("# ID %zu, OFF %zu, MAX %zu\n", ptr->data.id, ptr->data.off, ptr->data.max);
 
-		if (ctx->queue_type == QUEUE_TYPE_FORWARD || ctx->queue_type == QUEUE_TYPE_RANDOM)
-		{
-			if (!ptr->next) break;
-			ptr = ptr->next;
-		}
-		else if (ctx->queue_type == QUEUE_TYPE_REVERSE)
-		{
-			if (!ptr->prev) break;
-			ptr = ptr->prev;
-		}
+        if (ctx->queue_type == QUEUE_TYPE_FORWARD || ctx->queue_type == QUEUE_TYPE_RANDOM) {
+            if (!ptr->next) break;
+            ptr = ptr->next;
+        } else if (ctx->queue_type == QUEUE_TYPE_REVERSE) {
+            if (!ptr->prev) break;
+            ptr = ptr->prev;
+        }
 
-	} while (ptr);
+    } while (ptr);
 
-	if (!ptr)
-	{
-		printf ("! Fail: ptr must be not null here\n");
-		pthread_mutex_unlock (&ctx->queue_mutex);
-		return -1;
-	}
+    if (!ptr) {
+        printf("! Fail: ptr must be not null here\n");
+        pthread_mutex_unlock(&ctx->queue_mutex);
+        return -1;
+    }
 
-	switch (ctx->queue_type)
-	{
-		case QUEUE_TYPE_RANDOM:
-			printf ("> show queue contents in RANDOM mode, from end to head\n");
-			break;
-		case QUEUE_TYPE_FORWARD:
-			printf ("> show queue contents in FORWARD mode, from end to head\n");
-			break;
-		case QUEUE_TYPE_REVERSE:
-			printf ("> show queue contents in REVERSE mode, from start to tail\n");
-			break;
-	}
+    switch (ctx->queue_type) {
+        case QUEUE_TYPE_RANDOM:
+            printf("> show queue contents in RANDOM mode, from end to head\n");
+            break;
+        case QUEUE_TYPE_FORWARD:
+            printf("> show queue contents in FORWARD mode, from end to head\n");
+            break;
+        case QUEUE_TYPE_REVERSE:
+            printf("> show queue contents in REVERSE mode, from start to tail\n");
+            break;
+    }
 
-	cnt = 0;
+    cnt = 0;
 
-	do
-	{
-		sum -= ptr->data.id;
-		if (cnt++ < 4) printf ("# ID %zu, OFF %zu, MAX %zu\n", ptr->data.id, ptr->data.off, ptr->data.max);
+    do {
+        sum -= ptr->data.id;
+        if (cnt++ < 4) printf("# ID %zu, OFF %zu, MAX %zu\n", ptr->data.id, ptr->data.off, ptr->data.max);
 
-		if (ctx->queue_type == QUEUE_TYPE_FORWARD || ctx->queue_type == QUEUE_TYPE_RANDOM)
-		{
-			if (!ptr->prev) break;
-			ptr = ptr->prev;
-		}
-		else if (ctx->queue_type == QUEUE_TYPE_REVERSE)
-		{
-			if (!ptr->next) break;
-			ptr = ptr->next;
-		}
+        if (ctx->queue_type == QUEUE_TYPE_FORWARD || ctx->queue_type == QUEUE_TYPE_RANDOM) {
+            if (!ptr->prev) break;
+            ptr = ptr->prev;
+        } else if (ctx->queue_type == QUEUE_TYPE_REVERSE) {
+            if (!ptr->next) break;
+            ptr = ptr->next;
+        }
 
-	} while (ptr);
+    } while (ptr);
 
-	if (sum != 0)
-	{
-		printf ("! Fail: sum is not zero\n");
-		pthread_mutex_unlock (&ctx->queue_mutex);
-		return -1;
-	}
+    if (sum != 0) {
+        printf("! Fail: sum is not zero\n");
+        pthread_mutex_unlock(&ctx->queue_mutex);
+        return -1;
+    }
 
-	pthread_mutex_unlock (&ctx->queue_mutex);
-	return 0;
+    pthread_mutex_unlock(&ctx->queue_mutex);
+    return 0;
 }
 
 #endif
 
-const char *wu_queue_strerror (int error)
-{
-	switch (error)
-	{
-		case QUEUE_EMPTY: return (const char *) "QUERY_EMPTY";
-		case NO_ERROR: return (const char *) "NO_ERROR";
-		case ERROR_GENERIC: return (const char *) "ERROR_GENERIC";
-		case ERROR_QUEUE_TYPE_INVALID: return (const char *) "ERROR_QUEUE_TYPE_INVALID";
-		case ERROR_CTX_NULL: return (const char *) "ERROR_CTX_NULL";
-		case ERROR_CTX_IS_INIT: return (const char *) "ERROR_CTX_IS_INIT";
-		case ERROR_CTX_IS_NOT_INIT: return (const char *) "ERROR_CTX_IS_NOT_INIT";
-		case ERROR_MUTEXATTR_INIT: return (const char *) "ERROR_MUTEXATTR_INIT";
-		case ERROR_MUTEXATTR_SETTYPE: return (const char *) "ERROR_MUTEXATTR_SETTYPE";
-		case ERROR_MUTEX_INIT: return (const char *) "ERROR_MUTEX_INIT";
-		case ERROR_ALLOC: return (const char *) "ERROR_ALLOC";
-		case ERROR_UNDEFINED:
-		default:
-			return (const char *) "ERROR_UNDEFINED";
-	}
+const char *wu_queue_strerror(int error) {
+    switch (error) {
+        case QUEUE_EMPTY:
+            return (const char *) "QUERY_EMPTY";
+        case NO_ERROR:
+            return (const char *) "NO_ERROR";
+        case ERROR_GENERIC:
+            return (const char *) "ERROR_GENERIC";
+        case ERROR_QUEUE_TYPE_INVALID:
+            return (const char *) "ERROR_QUEUE_TYPE_INVALID";
+        case ERROR_CTX_NULL:
+            return (const char *) "ERROR_CTX_NULL";
+        case ERROR_CTX_IS_INIT:
+            return (const char *) "ERROR_CTX_IS_INIT";
+        case ERROR_CTX_IS_NOT_INIT:
+            return (const char *) "ERROR_CTX_IS_NOT_INIT";
+        case ERROR_MUTEXATTR_INIT:
+            return (const char *) "ERROR_MUTEXATTR_INIT";
+        case ERROR_MUTEXATTR_SETTYPE:
+            return (const char *) "ERROR_MUTEXATTR_SETTYPE";
+        case ERROR_MUTEX_INIT:
+            return (const char *) "ERROR_MUTEX_INIT";
+        case ERROR_ALLOC:
+            return (const char *) "ERROR_ALLOC";
+        case ERROR_UNDEFINED:
+        default:
+            return (const char *) "ERROR_UNDEFINED";
+    }
 }
 
-const char *wu_queue_strdesc (wu_queue_type_t type)
-{
-	switch (type)
-	{
-		case QUEUE_TYPE_FORWARD: return (const char *) "FORWARD";
-		case QUEUE_TYPE_REVERSE: return (const char *) "REVERSE";
-		case QUEUE_TYPE_RANDOM: return (const char *) "RANDOM";
-	}
+const char *wu_queue_strdesc(wu_queue_type_t type) {
+    switch (type) {
+        case QUEUE_TYPE_FORWARD:
+            return (const char *) "FORWARD";
+        case QUEUE_TYPE_REVERSE:
+            return (const char *) "REVERSE";
+        case QUEUE_TYPE_RANDOM:
+            return (const char *) "RANDOM";
+    }
 
-	return (const char *) "UNKNOWN";
+    return (const char *) "UNKNOWN";
 }
 
-int wu_queue_init (wu_queue_ctx_t *ctx, wu_queue_type_t queue_type)
-{
-	#if TEST_UNIT == 1
-	fprintf (stdout, "[%s] enter\n", __func__);
-	fflush (stdout);
-	#endif
+int wu_queue_init(wu_queue_ctx_t *ctx, wu_queue_type_t queue_type) {
+#if TEST_UNIT == 1
+    fprintf(stdout, "[%s] enter\n", __func__);
+    fflush(stdout);
+#endif
 
-	if (!ctx) return ERROR_CTX_NULL;
+    if (!ctx) return ERROR_CTX_NULL;
 
-	// Conditional jump or move depends on uninitialised value(s). It's good as it
-	if (ctx->init) return ERROR_CTX_IS_INIT;
+    // Conditional jump or move depends on uninitialised value(s). It's good as it
+    if (ctx->init) return ERROR_CTX_IS_INIT;
 
-	if (queue_type == QUEUE_TYPE_RANDOM) srand ((unsigned int) time(0));
-	else if (queue_type != QUEUE_TYPE_FORWARD && queue_type != QUEUE_TYPE_REVERSE)
-	{
-		#if TEST_UNIT == 1
-		fprintf (stderr, "! Error, invalid 'queue_type'.\n");
-		#endif
-		return ERROR_QUEUE_TYPE_INVALID;
-	}
+    if (queue_type == QUEUE_TYPE_RANDOM) srand((unsigned int) time(0));
+    else if (queue_type != QUEUE_TYPE_FORWARD && queue_type != QUEUE_TYPE_REVERSE) {
+#if TEST_UNIT == 1
+        fprintf(stderr, "! Error, invalid 'queue_type'.\n");
+#endif
+        return ERROR_QUEUE_TYPE_INVALID;
+    }
 
-	memset (ctx, 0, sizeof (wu_queue_ctx_t));
-	ctx->queue_type = queue_type;
-	ctx->queue_head = 0; //NULL;
-	ctx->queue_tail = 0; //NULL;
+    memset(ctx, 0, sizeof(wu_queue_ctx_t));
+    ctx->queue_type = queue_type;
+    ctx->queue_head = 0; //NULL;
+    ctx->queue_tail = 0; //NULL;
 
-	int ret = 0;
+    int ret = 0;
 
-	if ((ret = pthread_mutexattr_init (&ctx->queue_mutex_attr)) != 0)
-	{
-		#if TEST_UNIT == 1
-		fprintf (stderr, "! Error, pthread_mutexattr_init() failed (%d): %s\n", ret, strerror (ret));
-		#endif
-		memset (ctx, 0, sizeof (wu_queue_ctx_t));
-		return ERROR_MUTEXATTR_INIT;
-	}
+    if ((ret = pthread_mutexattr_init(&ctx->queue_mutex_attr)) != 0) {
+#if TEST_UNIT == 1
+        fprintf(stderr, "! Error, pthread_mutexattr_init() failed (%d): %s\n", ret, strerror(ret));
+#endif
+        memset(ctx, 0, sizeof(wu_queue_ctx_t));
+        return ERROR_MUTEXATTR_INIT;
+    }
 
-	if ((ret = pthread_mutexattr_settype (&ctx->queue_mutex_attr, PTHREAD_MUTEX_ERRORCHECK)) != 0)
-	{
-		#if TEST_UNIT == 1
-		fprintf (stderr, "! Error, pthread_mutexattr_settype(PTHREAD_MUTEX_ERRORCHECK) failed (%d): %s\n", ret, strerror (ret));
-		#endif
-		pthread_mutexattr_destroy (&ctx->queue_mutex_attr);
-		memset (ctx, 0, sizeof (wu_queue_ctx_t));
-		return ERROR_MUTEXATTR_SETTYPE;
-	}
+    if ((ret = pthread_mutexattr_settype(&ctx->queue_mutex_attr, PTHREAD_MUTEX_ERRORCHECK)) != 0) {
+#if TEST_UNIT == 1
+        fprintf(stderr, "! Error, pthread_mutexattr_settype(PTHREAD_MUTEX_ERRORCHECK) failed (%d): %s\n", ret, strerror(ret));
+#endif
+        pthread_mutexattr_destroy(&ctx->queue_mutex_attr);
+        memset(ctx, 0, sizeof(wu_queue_ctx_t));
+        return ERROR_MUTEXATTR_SETTYPE;
+    }
 
-	if ((ret = pthread_mutex_init (&ctx->queue_mutex, &ctx->queue_mutex_attr)) != 0)
-	{
-		#if TEST_UNIT == 1
-		fprintf (stderr, "! Error, pthread_mutex_init() failed (%d): %s\n", ret, strerror (ret));
-		#endif
-		pthread_mutexattr_destroy (&ctx->queue_mutex_attr);
-		memset (ctx, 0, sizeof (wu_queue_ctx_t));
-		return ERROR_MUTEX_INIT;
-	}
+    if ((ret = pthread_mutex_init(&ctx->queue_mutex, &ctx->queue_mutex_attr)) != 0) {
+#if TEST_UNIT == 1
+        fprintf(stderr, "! Error, pthread_mutex_init() failed (%d): %s\n", ret, strerror(ret));
+#endif
+        pthread_mutexattr_destroy(&ctx->queue_mutex_attr);
+        memset(ctx, 0, sizeof(wu_queue_ctx_t));
+        return ERROR_MUTEX_INIT;
+    }
 
-	ctx->init = 1;
-	return NO_ERROR;
+    ctx->init = 1;
+    return NO_ERROR;
 }
 
-int wu_queue_done (wu_queue_ctx_t *ctx)
-{
-	if (!ctx) return ERROR_CTX_NULL;
-	if (!ctx->init) return ERROR_CTX_IS_NOT_INIT;
+int wu_queue_done(wu_queue_ctx_t *ctx) {
+    if (!ctx) return ERROR_CTX_NULL;
+    if (!ctx->init) return ERROR_CTX_IS_NOT_INIT;
 
-	switch (ctx->queue_type)
-	{
-		case QUEUE_TYPE_RANDOM:  return (ctx->queue_head == NULL);
-		case QUEUE_TYPE_FORWARD: return (ctx->queue_head == NULL);
-		case QUEUE_TYPE_REVERSE: return (ctx->queue_tail == NULL);
-	}
+    switch (ctx->queue_type) {
+        case QUEUE_TYPE_RANDOM:
+            return (ctx->queue_head == NULL);
+        case QUEUE_TYPE_FORWARD:
+            return (ctx->queue_head == NULL);
+        case QUEUE_TYPE_REVERSE:
+            return (ctx->queue_tail == NULL);
+    }
 
-	return ERROR_QUEUE_TYPE_INVALID;
+    return ERROR_QUEUE_TYPE_INVALID;
 }
 
-int wu_queue_push (wu_queue_ctx_t *ctx, size_t id, size_t off, size_t max)
-{
-	if (!ctx) return ERROR_CTX_NULL;
-	if (!ctx->init) return ERROR_CTX_IS_NOT_INIT;
+int wu_queue_push(wu_queue_ctx_t *ctx, size_t id, size_t off, size_t max) {
+    if (!ctx) return ERROR_CTX_NULL;
+    if (!ctx->init) return ERROR_CTX_IS_NOT_INIT;
 
-	pthread_mutex_lock (&ctx->queue_mutex);
+    pthread_mutex_lock(&ctx->queue_mutex);
 
-	wu_queue_item_t *ptr = 0; //NULL;
+    wu_queue_item_t *ptr = 0; //NULL;
 
-	short first = 0;
+    short first = 0;
 
-	if (ctx->queue_head == 0) first = 1;
+    if (ctx->queue_head == 0) first = 1;
 
-	if (!(ptr = (wu_queue_item_t *) malloc (sizeof (wu_queue_item_t))))
-	{
-		#if TEST_UNIT == 1
-		fprintf (stderr, "! Error: malloc() failed (%d): %s\n", errno, strerror (errno));
-		#endif
-		pthread_mutex_unlock (&ctx->queue_mutex);
-		return ERROR_ALLOC;
-	}
+    if (!(ptr = (wu_queue_item_t *) malloc(sizeof(wu_queue_item_t)))) {
+#if TEST_UNIT == 1
+        fprintf(stderr, "! Error: malloc() failed (%d): %s\n", errno, strerror(errno));
+#endif
+        pthread_mutex_unlock(&ctx->queue_mutex);
+        return ERROR_ALLOC;
+    }
 
-	ptr->data.id = id;
-	ptr->data.off = off;
-	ptr->data.max = max;
-	ptr->next = 0; //NULL;
-	ptr->prev = 0; //NULL;
+    ptr->data.id = id;
+    ptr->data.off = off;
+    ptr->data.max = max;
+    ptr->next = 0; //NULL;
+    ptr->prev = 0; //NULL;
 
-	if (first) {
-		ctx->queue_head = ptr;
-		ctx->queue_tail = ptr;
-		ctx->queue_size++;
-		pthread_mutex_unlock (&ctx->queue_mutex);
-		return NO_ERROR;
-	}
+    if (first) {
+        ctx->queue_head = ptr;
+        ctx->queue_tail = ptr;
+        ctx->queue_size++;
+        pthread_mutex_unlock(&ctx->queue_mutex);
+        return NO_ERROR;
+    }
 
-	// set tail
-	ptr->prev = ctx->queue_tail;
-	ctx->queue_tail = ptr;
+    // set tail
+    ptr->prev = ctx->queue_tail;
+    ctx->queue_tail = ptr;
 
-	// set head
-	wu_queue_item_t *last = ctx->queue_head;
-	while (last->next != 0) last = last->next;
-	last->next = ptr;
+    // set head
+    wu_queue_item_t *last = ctx->queue_head;
+    while (last->next != 0) last = last->next;
+    last->next = ptr;
 
-	ctx->queue_size++;
-	pthread_mutex_unlock (&ctx->queue_mutex);
-	return NO_ERROR;
+    ctx->queue_size++;
+    pthread_mutex_unlock(&ctx->queue_mutex);
+    return NO_ERROR;
 }
 
-int wu_queue_pop (wu_queue_ctx_t *ctx, wu_queue_data_t *wu, short remove)
-{
-	if (!ctx) return ERROR_CTX_NULL;
-	if (!ctx->init) return ERROR_CTX_IS_NOT_INIT;
+int wu_queue_pop(wu_queue_ctx_t *ctx, wu_queue_data_t *wu, short remove) {
+    if (!ctx) return ERROR_CTX_NULL;
+    if (!ctx->init) return ERROR_CTX_IS_NOT_INIT;
 
-	int ret = -1;
-	int rnd = 0;
-	wu_queue_item_t *ptr = 0, *ptrPrev = 0;
+    int ret = -1;
+    int rnd = 0;
+    wu_queue_item_t *ptr = 0, *ptrPrev = 0;
 
-	pthread_mutex_lock (&ctx->queue_mutex);
+    pthread_mutex_lock(&ctx->queue_mutex);
 
-	if ((ret = wu_queue_done (ctx)) != 0)
-	{
-		#if TEST_UNIT == 1
-		fprintf (stderr, "ret from wu_queue_done() (%d): %s\n", ret, wu_queue_strerror (ret));
-		#endif
-		pthread_mutex_unlock (&ctx->queue_mutex);
-		return ret;
-	}
+    if ((ret = wu_queue_done(ctx)) != 0) {
+#if TEST_UNIT == 1
+        fprintf(stderr, "ret from wu_queue_done() (%d): %s\n", ret, wu_queue_strerror(ret));
+#endif
+        pthread_mutex_unlock(&ctx->queue_mutex);
+        return ret;
+    }
 
-	switch (ctx->queue_type)
-	{
-		case QUEUE_TYPE_FORWARD:
-			ptr = ctx->queue_head;
-			break;
-		case QUEUE_TYPE_REVERSE:
-			ptr = ctx->queue_tail;
-			break;
-		case QUEUE_TYPE_RANDOM:
-			ptr = ctx->queue_head;
-			rnd = rand() % (int) ctx->queue_size;
-			for (int r = 0; r < rnd; r++)
-			{
-				ptrPrev = ptr;
-				ptr = ptr->next;
-			}
-			break;
-	}
+    switch (ctx->queue_type) {
+        case QUEUE_TYPE_FORWARD:
+            ptr = ctx->queue_head;
+            break;
+        case QUEUE_TYPE_REVERSE:
+            ptr = ctx->queue_tail;
+            break;
+        case QUEUE_TYPE_RANDOM:
+            ptr = ctx->queue_head;
+            rnd = rand() % (int) ctx->queue_size;
+            for (int r = 0; r < rnd; r++) {
+                ptrPrev = ptr;
+                ptr = ptr->next;
+            }
+            break;
+    }
 
-	if (!ptr)
-	{
-		pthread_mutex_unlock (&ctx->queue_mutex);
-		return ERROR_GENERIC;
-	}
+    if (!ptr) {
+        pthread_mutex_unlock(&ctx->queue_mutex);
+        return ERROR_GENERIC;
+    }
 
-	if (!remove)
-	{
-		wu->id = ptr->data.id;
-		wu->off = ptr->data.off;
-		wu->max = ptr->data.max;
-	}
+    if (!remove) {
+        wu->id = ptr->data.id;
+        wu->off = ptr->data.off;
+        wu->max = ptr->data.max;
+    }
 
-	switch (ctx->queue_type)
-	{
-		case QUEUE_TYPE_FORWARD:
-			ctx->queue_head = (ctx->queue_head)->next;
-			break;
-		case QUEUE_TYPE_REVERSE:
-			ctx->queue_tail = (ctx->queue_tail)->prev;
-			break;
-		case QUEUE_TYPE_RANDOM: // from the head
-			#if TEST_UNIT == 1
-			fprintf (stdout, "pop id %ld\n", wu->id);
-			fflush (stdout);
-			#endif
-			if (ptrPrev == NULL)
-			{
-				ctx->queue_head = (ctx->queue_head)->next;
-			}
-			else
-			{
-				ptrPrev->next = ptr->next;
-			}
-			break;
-	}
+    switch (ctx->queue_type) {
+        case QUEUE_TYPE_FORWARD:
+            ctx->queue_head = (ctx->queue_head)->next;
+            break;
+        case QUEUE_TYPE_REVERSE:
+            ctx->queue_tail = (ctx->queue_tail)->prev;
+            break;
+        case QUEUE_TYPE_RANDOM: // from the head
+#if TEST_UNIT == 1
+            fprintf(stdout, "pop id %ld\n", wu->id);
+            fflush(stdout);
+#endif
+            if (ptrPrev == NULL) {
+                ctx->queue_head = (ctx->queue_head)->next;
+            } else {
+                ptrPrev->next = ptr->next;
+            }
+            break;
+    }
 
-	memset (ptr, 0, sizeof (wu_queue_item_t));
-	free (ptr);
-	ptr = 0; //NULL;
+    memset(ptr, 0, sizeof(wu_queue_item_t));
+    free(ptr);
+    ptr = 0; //NULL;
 
-	ctx->queue_size--;
+    ctx->queue_size--;
 
-	if (!remove) wu->rem = ctx->queue_size;
+    if (!remove) wu->rem = ctx->queue_size;
 
-	pthread_mutex_unlock (&ctx->queue_mutex);
-	return NO_ERROR;
+    pthread_mutex_unlock(&ctx->queue_mutex);
+    return NO_ERROR;
 }
 
-int wu_queue_destroy (wu_queue_ctx_t *ctx)
-{
-	#if TEST_UNIT == 1
-	fprintf (stdout, "[%s] enter\n", __func__);
-	fflush (stdout);
-	#endif
+int wu_queue_destroy(wu_queue_ctx_t *ctx) {
+#if TEST_UNIT == 1
+    fprintf(stdout, "[%s] enter\n", __func__);
+    fflush(stdout);
+#endif
 
-	if (!ctx) return ERROR_CTX_NULL;
-	if (!ctx->init) return ERROR_CTX_IS_NOT_INIT;
+    if (!ctx) return ERROR_CTX_NULL;
+    if (!ctx->init) return ERROR_CTX_IS_NOT_INIT;
 
-	pthread_mutex_lock (&ctx->queue_mutex);
+    pthread_mutex_lock(&ctx->queue_mutex);
 
-	int ret = -1;
+    int ret = -1;
 
-	// unload the queue
-	while ((ret = wu_queue_pop (ctx, 0, 1)) == 0) {};
+    // unload the queue
+    while ((ret = wu_queue_pop(ctx, 0, 1)) == 0) {};
 
-	if (ret != QUEUE_EMPTY)
-	{
-		#if TEST_UNIT
-		fprintf (stderr, "! Error, wu_queue_pop() failed (%d): %s\n", ret, wu_queue_strerror (ret));
-		#endif
-		return ret;
-	}
+    if (ret != QUEUE_EMPTY) {
+#if TEST_UNIT
+        fprintf(stderr, "! Error, wu_queue_pop() failed (%d): %s\n", ret, wu_queue_strerror(ret));
+#endif
+        return ret;
+    }
 
-	#if TEST_UNIT == 1
-	printf ("ret from wu_queue_pop() (%d): %s\n", ret, wu_queue_strerror (ret));
-	#endif
+#if TEST_UNIT == 1
+    printf("ret from wu_queue_pop() (%d): %s\n", ret, wu_queue_strerror(ret));
+#endif
 
-	#if TEST_UNIT == 1
-	if (ctx->queue_head != 0) fprintf (stderr, "queue_head not null\n");
-	if (ctx->queue_tail != 0) fprintf (stderr, "queue_tail not null\n");
-	#endif
+#if TEST_UNIT == 1
+    if (ctx->queue_head != 0) fprintf(stderr, "queue_head not null\n");
+    if (ctx->queue_tail != 0) fprintf(stderr, "queue_tail not null\n");
+#endif
 
-	ctx->queue_head = 0; //NULL;
-	ctx->queue_tail = 0; //NULL;
-	ctx->init = 0;
+    ctx->queue_head = 0; //NULL;
+    ctx->queue_tail = 0; //NULL;
+    ctx->init = 0;
 
-	pthread_mutex_unlock (&ctx->queue_mutex);
+    pthread_mutex_unlock(&ctx->queue_mutex);
 
-	pthread_mutex_destroy (&ctx->queue_mutex);
-	pthread_mutexattr_destroy (&ctx->queue_mutex_attr);
+    pthread_mutex_destroy(&ctx->queue_mutex);
+    pthread_mutexattr_destroy(&ctx->queue_mutex_attr);
 
-	memset (ctx, 0, sizeof (wu_queue_ctx_t));
-	//ctx = 0; //NULL;
+    memset(ctx, 0, sizeof(wu_queue_ctx_t));
+    //ctx = 0; //NULL;
 
-	return (ret == 1) ? NO_ERROR : ERROR_GENERIC;
+    return (ret == 1) ? NO_ERROR : ERROR_GENERIC;
 }
 
 #if TEST_UNIT == 1
-int main (void)
-{
-	unsigned int profiles[11][2] =
-	{
-		{ 16384, 5 }, // 0, best for Intel GPU's with Neo
-		{ 8192,  6 }, // 1, only for Intel NEO
-		{ 4096,  7 }, // 2 (old 0) seems the best for all others (also NVIDIA) :D Apple/Intel GPU's stable here
-		{ 2048,  8 }, // 3 (old 1) usefull for any kind of CPU's
-		{ 1024,  9 },
-		{ 512,  10 },
-		{ 256,  11 },
-		{ 128,  12 }, // 7, (old 5) the last good value with NVIDIA GPU's
-		{ 64,   13 },
-		{ 32,   14 },
-		{ 16,   15 },
-	};
+int main(void) {
+    unsigned int profiles[11][2] = {
+        { 16384, 5 }, // 0, best for Intel GPU's with Neo
+        { 8192,  6 }, // 1, only for Intel NEO
+        { 4096,  7 }, // 2 (old 0) seems the best for all others (also NVIDIA) :D Apple/Intel GPU's stable here
+        { 2048,  8 }, // 3 (old 1) usefull for any kind of CPU's
+        { 1024,  9 },
+        { 512,  10 },
+        { 256,  11 },
+        { 128,  12 }, // 7, (old 5) the last good value with NVIDIA GPU's
+        { 64,   13 },
+        { 32,   14 },
+        { 16,   15 },
+    };
 
-	size_t err = 0, err_max = 1;
-	size_t id = 0;
-	size_t max = profiles[0][0];
-	size_t chunk = profiles[0][1];
-	size_t sum = 0;
-	int i = 0;
+    size_t err = 0, err_max = 1;
+    size_t id = 0;
+    size_t max = profiles[0][0];
+    size_t chunk = profiles[0][1];
+    size_t sum = 0;
+    int i = 0;
 
-	wu_queue_ctx_t ctx;
-	memset (&ctx, 0, sizeof (wu_queue_ctx_t));
+    wu_queue_ctx_t ctx;
+    memset(&ctx, 0, sizeof(wu_queue_ctx_t));
 
-	printf("Selected the following config: max %zu, chunk %zu\n", max, chunk);
-	fflush (stdout);
+    printf("Selected the following config: max %zu, chunk %zu\n", max, chunk);
+    fflush(stdout);
 
-	wu_queue_type_t types[4] = { QUEUE_TYPE_FORWARD, QUEUE_TYPE_REVERSE, QUEUE_TYPE_RANDOM, 1234 };
-	int types_max = (int) (sizeof (types) / sizeof (wu_queue_type_t));
-	int ret = 0;
+    wu_queue_type_t types[4] = { QUEUE_TYPE_FORWARD, QUEUE_TYPE_REVERSE, QUEUE_TYPE_RANDOM, 1234 };
+    int types_max = (int)(sizeof(types) / sizeof(wu_queue_type_t));
+    int ret = 0;
 
-	for (i = 0; i < types_max; i++)
-	{
-		printf ("[%d] trying wu_queue_init() in %s mode\n", i, wu_queue_strdesc (types[i]));
+    for (i = 0; i < types_max; i++) {
+        printf("[%d] trying wu_queue_init() in %s mode\n", i, wu_queue_strdesc(types[i]));
 
-		if ((ret = wu_queue_init (&ctx, types[i])) != 0)
-		{
-			fprintf (stderr, "[%d] Error: wu_queue_init(%s) failed (%d): %s\n", i, wu_queue_strdesc (types[i]), ret, wu_queue_strerror (ret));
-			err++;
-			continue;
-		}
+        if ((ret = wu_queue_init(&ctx, types[i])) != 0) {
+            fprintf(stderr, "[%d] Error: wu_queue_init(%s) failed (%d): %s\n", i, wu_queue_strdesc(types[i]), ret, wu_queue_strerror(ret));
+            err++;
+            continue;
+        }
 
-		printf ("[%d] trying wu_queue_push()\n", i);
+        printf("[%d] trying wu_queue_push()\n", i);
 
-		for (id = 0; id < max; id++)
-		{
-			sum += id;
-			ret = wu_queue_push (&ctx, id, id << chunk, max);
-			if (ret != 0)
-			{
-				fprintf (stderr, "[%d] Error: wu_queue_push(%zu) failed (%d): %s\n", i, id, ret, wu_queue_strerror (ret));
-				err++;
-				continue;
-			}
-		}
+        for (id = 0; id < max; id++) {
+            sum += id;
+            ret = wu_queue_push(&ctx, id, id << chunk, max);
+            if (ret != 0) {
+                fprintf(stderr, "[%d] Error: wu_queue_push(%zu) failed (%d): %s\n", i, id, ret, wu_queue_strerror(ret));
+                err++;
+                continue;
+            }
+        }
 
-		printf("[%d] push sum: %zu\n", i, sum);
+        printf("[%d] push sum: %zu\n", i, sum);
 
-		if (wu_queue_print (&ctx) == -1)
-		{
-			fprintf (stderr, "[%d] wu_queue_print() error\n", i);
-			err++;
-			continue;
-		}
+        if (wu_queue_print(&ctx) == -1) {
+            fprintf(stderr, "[%d] wu_queue_print() error\n", i);
+            err++;
+            continue;
+        }
 
-		wu_queue_data_t wu;
+        wu_queue_data_t wu;
 
-		while ((ret = wu_queue_pop (&ctx, &wu, 0)) == 0) sum -= wu.id;
+        while ((ret = wu_queue_pop(&ctx, &wu, 0)) == 0) sum -= wu.id;
 
-		if (ret != QUEUE_EMPTY)
-		{
-			fprintf (stderr, "[%d] Error: wu_queue_pop() failed (%d): %s\n", i, ret, wu_queue_strerror (ret));
-			err++;
-			continue;
-		}
+        if (ret != QUEUE_EMPTY) {
+            fprintf(stderr, "[%d] Error: wu_queue_pop() failed (%d): %s\n", i, ret, wu_queue_strerror(ret));
+            err++;
+            continue;
+        }
 
-		printf("[%d] pop sum: %zu\n", i, sum);
+        printf("[%d] pop sum: %zu\n", i, sum);
 
-		if (sum != 0)
-		{
-			fprintf (stderr, "[%d] Fail: sum is not zero (%zu)\n", i, sum);
-			err++;
-			continue;
-		}
+        if (sum != 0) {
+            fprintf(stderr, "[%d] Fail: sum is not zero (%zu)\n", i, sum);
+            err++;
+            continue;
+        }
 
-		if (wu_queue_print (&ctx) == -1)
-		{
-			fprintf (stderr, "[%d] wu_queue_print() error\n", i);
-			err++;
-			continue;
-		}
+        if (wu_queue_print(&ctx) == -1) {
+            fprintf(stderr, "[%d] wu_queue_print() error\n", i);
+            err++;
+            continue;
+        }
 
-		printf ("[%d] trying wu_queue_destroy()\n", i);
-		if ((ret = wu_queue_destroy (&ctx)) != 0)
-		{
-			fprintf (stderr, "! Error: wu_queue_destroy() failed (%d): %s\n", ret, wu_queue_strerror (ret));
-			err++;
-			continue;
-		}
-	}
+        printf("[%d] trying wu_queue_destroy()\n", i);
+        if ((ret = wu_queue_destroy(&ctx)) != 0) {
+            fprintf(stderr, "! Error: wu_queue_destroy() failed (%d): %s\n", ret, wu_queue_strerror(ret));
+            err++;
+            continue;
+        }
+    }
 
-	printf ("Catched %zu/%zu error(s).\n", err, err_max);
+    printf("Catched %zu/%zu error(s).\n", err, err_max);
 
-	if (err == err_max)
-	{
-		printf ("Self-Test pass\n");
-		return 0;
-	}
+    if (err == err_max) {
+        printf("Self-Test pass\n");
+        return 0;
+    }
 
-	printf ("Self-Test fail\n");
-	return -1;
+    printf("Self-Test fail\n");
+    return -1;
 }
 #endif // TEST_UNIT
diff --git a/tools/hitag2crack/crack5opencl/queue.h b/tools/hitag2crack/crack5opencl/queue.h
index 415b4aa8c..80304b0d3 100644
--- a/tools/hitag2crack/crack5opencl/queue.h
+++ b/tools/hitag2crack/crack5opencl/queue.h
@@ -42,81 +42,76 @@ License: GNU General Public License v3 or any later version (see LICENSE.txt)
 #include <pthread.h>
 
 // enum errors
-typedef enum wu_queue_error
-{
-	QUEUE_EMPTY = 1,
-	NO_ERROR = 0,
-	ERROR_GENERIC = -1,
-	ERROR_QUEUE_TYPE_INVALID = -2,
-	ERROR_CTX_NULL = -3,
-	ERROR_CTX_IS_INIT = -4,
-	ERROR_CTX_IS_NOT_INIT = -5,
-	ERROR_MUTEXATTR_INIT = -6,
-	ERROR_MUTEXATTR_SETTYPE = -7,
-	ERROR_MUTEX_INIT = -8,
-	ERROR_ALLOC = -9,
-	ERROR_UNDEFINED = -10
+typedef enum wu_queue_error {
+    QUEUE_EMPTY = 1,
+    NO_ERROR = 0,
+    ERROR_GENERIC = -1,
+    ERROR_QUEUE_TYPE_INVALID = -2,
+    ERROR_CTX_NULL = -3,
+    ERROR_CTX_IS_INIT = -4,
+    ERROR_CTX_IS_NOT_INIT = -5,
+    ERROR_MUTEXATTR_INIT = -6,
+    ERROR_MUTEXATTR_SETTYPE = -7,
+    ERROR_MUTEX_INIT = -8,
+    ERROR_ALLOC = -9,
+    ERROR_UNDEFINED = -10
 
 } wu_queue_error_t;
 
 // enum queue types
-typedef enum wu_queue_type
-{
-	QUEUE_TYPE_FORWARD = 0,
-	QUEUE_TYPE_REVERSE,
-	QUEUE_TYPE_RANDOM
+typedef enum wu_queue_type {
+    QUEUE_TYPE_FORWARD = 0,
+    QUEUE_TYPE_REVERSE,
+    QUEUE_TYPE_RANDOM
 
 } wu_queue_type_t;
 
 // hold wu data
-typedef struct wu_queue_data
-{
-	size_t id;
-	size_t off;
-	size_t max;
-	size_t rem;
+typedef struct wu_queue_data {
+    size_t id;
+    size_t off;
+    size_t max;
+    size_t rem;
 
 } wu_queue_data_t;
 
 // lists
 typedef struct wu_queue_item wu_queue_item_t;
-struct wu_queue_item
-{
-	wu_queue_data_t data;
-	wu_queue_item_t *next;
-	wu_queue_item_t *prev;
+struct wu_queue_item {
+    wu_queue_data_t data;
+    wu_queue_item_t *next;
+    wu_queue_item_t *prev;
 };
 
 // main ctx
-typedef struct wu_queue_ctx
-{
-	unsigned int init;
+typedef struct wu_queue_ctx {
+    unsigned int init;
 
-	wu_queue_type_t queue_type;
-	wu_queue_item_t *queue_head;
-	wu_queue_item_t *queue_tail;
+    wu_queue_type_t queue_type;
+    wu_queue_item_t *queue_head;
+    wu_queue_item_t *queue_tail;
 
-	size_t queue_size;
+    size_t queue_size;
 
-	// mutex
-	pthread_mutexattr_t queue_mutex_attr;
+    // mutex
+    pthread_mutexattr_t queue_mutex_attr;
 //	unsigned char pad1[4];
-	pthread_mutex_t queue_mutex;
+    pthread_mutex_t queue_mutex;
 
 } wu_queue_ctx_t;
 
 // exports
-int wu_queue_init (wu_queue_ctx_t *ctx, wu_queue_type_t queue_type);
-int wu_queue_done (wu_queue_ctx_t *ctx);
-int wu_queue_push (wu_queue_ctx_t *ctx, size_t id, size_t off, size_t max);
-int wu_queue_pop (wu_queue_ctx_t *ctx, wu_queue_data_t *wu, short remove);
-int wu_queue_destroy (wu_queue_ctx_t *ctx);
+int wu_queue_init(wu_queue_ctx_t *ctx, wu_queue_type_t queue_type);
+int wu_queue_done(wu_queue_ctx_t *ctx);
+int wu_queue_push(wu_queue_ctx_t *ctx, size_t id, size_t off, size_t max);
+int wu_queue_pop(wu_queue_ctx_t *ctx, wu_queue_data_t *wu, short remove);
+int wu_queue_destroy(wu_queue_ctx_t *ctx);
 
-const char *wu_queue_strdesc (wu_queue_type_t type);
-const char *wu_queue_strerror (int error);
+const char *wu_queue_strdesc(wu_queue_type_t type);
+const char *wu_queue_strerror(int error);
 
 #if TEST_UNIT == 1
-int wu_queue_print (wu_queue_ctx_t *ctx);
+int wu_queue_print(wu_queue_ctx_t *ctx);
 #endif
 
 #endif // QUEUE_H
diff --git a/tools/hitag2crack/crack5opencl/threads.c b/tools/hitag2crack/crack5opencl/threads.c
index 2c1e4c84f..5cb5a2b87 100644
--- a/tools/hitag2crack/crack5opencl/threads.c
+++ b/tools/hitag2crack/crack5opencl/threads.c
@@ -24,721 +24,664 @@ License: GNU General Public License v3 or any later version (see LICENSE.txt)
 
 #include "threads.h"
 
-const char *thread_strerror (int error)
-{
-	switch (error)
-	{
-		case THREAD_NOERROR: return (const char *) "No error";
-		case THREAD_ERROR_CTX_IS_NULL: return (const char *) "CTX IS NULL";
-		case THREAD_ERROR_CTX_IS_INIT: return (const char *) "CTX IS INIT";
-		case THREAD_ERROR_TYPE_INVALID: return (const char *) "INVALID TYPE";
-		case THREAD_ERROR_COUNT_INVALID: return (const char *) "INVALID THREAD COUNT";
-		case THREAD_ERROR_ATTR_SETDETACH: return (const char *) "SETDETACHSTATE FAILED";
-		case THREAD_ERROR_ATTR: return (const char *) "INIT ATTR FAILED";
-		case THREAD_ERROR_MUTEXATTR: return (const char *) "INIT MUTEXATTR FAILED";
-		case THREAD_ERROR_CREATE: return (const char *) "PTHREAD CREATE FAILED";
-		case THREAD_ERROR_MUTEX: return (const char *) "INIT MUTEXFAILED";
-		case THREAD_ERROR_COND: return (const char *) "INIT COND FAILED";
-		case THREAD_ERROR_MUTEX_USLEEP: return (const char *) "INIT MUTEX USLEEP FAILED";
-		case THREAD_ERROR_COND_USLEEP: return (const char *) "INIT COND USLEEP FAILED";
-		case THREAD_ERROR_GENERIC: return (const char *) "GENERIC ERROR";
-		case THREAD_ERROR_ALLOC: return (const char *) "ALLOC FAILED";
-	}
+const char *thread_strerror(int error) {
+    switch (error) {
+        case THREAD_NOERROR:
+            return (const char *) "No error";
+        case THREAD_ERROR_CTX_IS_NULL:
+            return (const char *) "CTX IS NULL";
+        case THREAD_ERROR_CTX_IS_INIT:
+            return (const char *) "CTX IS INIT";
+        case THREAD_ERROR_TYPE_INVALID:
+            return (const char *) "INVALID TYPE";
+        case THREAD_ERROR_COUNT_INVALID:
+            return (const char *) "INVALID THREAD COUNT";
+        case THREAD_ERROR_ATTR_SETDETACH:
+            return (const char *) "SETDETACHSTATE FAILED";
+        case THREAD_ERROR_ATTR:
+            return (const char *) "INIT ATTR FAILED";
+        case THREAD_ERROR_MUTEXATTR:
+            return (const char *) "INIT MUTEXATTR FAILED";
+        case THREAD_ERROR_CREATE:
+            return (const char *) "PTHREAD CREATE FAILED";
+        case THREAD_ERROR_MUTEX:
+            return (const char *) "INIT MUTEXFAILED";
+        case THREAD_ERROR_COND:
+            return (const char *) "INIT COND FAILED";
+        case THREAD_ERROR_MUTEX_USLEEP:
+            return (const char *) "INIT MUTEX USLEEP FAILED";
+        case THREAD_ERROR_COND_USLEEP:
+            return (const char *) "INIT COND USLEEP FAILED";
+        case THREAD_ERROR_GENERIC:
+            return (const char *) "GENERIC ERROR";
+        case THREAD_ERROR_ALLOC:
+            return (const char *) "ALLOC FAILED";
+    }
 
-	return (const char *) "GENERIC";
+    return (const char *) "GENERIC";
 }
 
-int thread_init (thread_ctx_t *ctx, short type, size_t thread_count)
-{
-	if (!ctx) return THREAD_ERROR_CTX_IS_NULL;
-	if (ctx->init) return THREAD_ERROR_CTX_IS_INIT;
-	if (type != THREAD_TYPE_ASYNC && type != THREAD_TYPE_SEQ) return THREAD_ERROR_TYPE_INVALID;
-	if (thread_count == 0) return THREAD_ERROR_COUNT_INVALID;
+int thread_init(thread_ctx_t *ctx, short type, size_t thread_count) {
+    if (!ctx) return THREAD_ERROR_CTX_IS_NULL;
+    if (ctx->init) return THREAD_ERROR_CTX_IS_INIT;
+    if (type != THREAD_TYPE_ASYNC && type != THREAD_TYPE_SEQ) return THREAD_ERROR_TYPE_INVALID;
+    if (thread_count == 0) return THREAD_ERROR_COUNT_INVALID;
 
-	memset (ctx, 0, sizeof (thread_ctx_t));
+    memset(ctx, 0, sizeof(thread_ctx_t));
 
-	ctx->thread_count = thread_count;
-	ctx->type = type;
-	ctx->enable_condusleep = (type == THREAD_TYPE_ASYNC && thread_count == 1);
+    ctx->thread_count = thread_count;
+    ctx->type = type;
+    ctx->enable_condusleep = (type == THREAD_TYPE_ASYNC && thread_count == 1);
 
-	ctx->thread_handles = (pthread_t *) calloc (thread_count, sizeof (pthread_t));
-	if (!ctx->thread_handles)
-	{
-		return THREAD_ERROR_ALLOC;
-	}
+    ctx->thread_handles = (pthread_t *) calloc(thread_count, sizeof(pthread_t));
+    if (!ctx->thread_handles) {
+        return THREAD_ERROR_ALLOC;
+    }
 
-	ctx->thread_mutexs = (pthread_mutex_t *) calloc (thread_count, sizeof (pthread_mutex_t));
-	if (!ctx->thread_mutexs)
-	{
-		free (ctx->thread_handles);
-		return THREAD_ERROR_ALLOC;
-	}
+    ctx->thread_mutexs = (pthread_mutex_t *) calloc(thread_count, sizeof(pthread_mutex_t));
+    if (!ctx->thread_mutexs) {
+        free(ctx->thread_handles);
+        return THREAD_ERROR_ALLOC;
+    }
 
-	ctx->thread_conds = (pthread_cond_t *) calloc (thread_count, sizeof (pthread_cond_t));
-	if (!ctx->thread_conds)
-	{
-		free (ctx->thread_handles);
-		free (ctx->thread_mutexs);
-		return THREAD_ERROR_ALLOC;
-	}
+    ctx->thread_conds = (pthread_cond_t *) calloc(thread_count, sizeof(pthread_cond_t));
+    if (!ctx->thread_conds) {
+        free(ctx->thread_handles);
+        free(ctx->thread_mutexs);
+        return THREAD_ERROR_ALLOC;
+    }
 
-	if (pthread_attr_init (&ctx->attr) != 0)
-	{
-		free (ctx->thread_handles);
-		free (ctx->thread_mutexs);
-		free (ctx->thread_conds);
-		return THREAD_ERROR_ATTR;
-	}
+    if (pthread_attr_init(&ctx->attr) != 0) {
+        free(ctx->thread_handles);
+        free(ctx->thread_mutexs);
+        free(ctx->thread_conds);
+        return THREAD_ERROR_ATTR;
+    }
 
-	pthread_attr_setdetachstate (&ctx->attr, PTHREAD_CREATE_JOINABLE);
+    pthread_attr_setdetachstate(&ctx->attr, PTHREAD_CREATE_JOINABLE);
 
-	if (pthread_mutexattr_init (&ctx->mutex_attr) != 0)
-	{
-		free (ctx->thread_handles);
-		free (ctx->thread_mutexs);
-		free (ctx->thread_conds);
-		pthread_attr_destroy (&ctx->attr);
-		return THREAD_ERROR_MUTEXATTR;
-	}
+    if (pthread_mutexattr_init(&ctx->mutex_attr) != 0) {
+        free(ctx->thread_handles);
+        free(ctx->thread_mutexs);
+        free(ctx->thread_conds);
+        pthread_attr_destroy(&ctx->attr);
+        return THREAD_ERROR_MUTEXATTR;
+    }
 
-	pthread_mutexattr_settype (&ctx->mutex_attr, PTHREAD_MUTEX_ERRORCHECK);
+    pthread_mutexattr_settype(&ctx->mutex_attr, PTHREAD_MUTEX_ERRORCHECK);
 
-	if (ctx->enable_condusleep)
-	{
-		if (pthread_mutex_init (&ctx->thread_mutex_usleep, NULL) != 0)
-		{
-			free (ctx->thread_handles);
-			free (ctx->thread_mutexs);
-			free (ctx->thread_conds);
-			pthread_attr_destroy (&ctx->attr);
-			pthread_mutexattr_destroy (&ctx->mutex_attr);
-			return THREAD_ERROR_MUTEX_USLEEP;
-		}
+    if (ctx->enable_condusleep) {
+        if (pthread_mutex_init(&ctx->thread_mutex_usleep, NULL) != 0) {
+            free(ctx->thread_handles);
+            free(ctx->thread_mutexs);
+            free(ctx->thread_conds);
+            pthread_attr_destroy(&ctx->attr);
+            pthread_mutexattr_destroy(&ctx->mutex_attr);
+            return THREAD_ERROR_MUTEX_USLEEP;
+        }
 
-		if (pthread_cond_init (&ctx->thread_cond_usleep, NULL) != 0)
-		{
-			free (ctx->thread_handles);
-			free (ctx->thread_mutexs);
-			free (ctx->thread_conds);
-			pthread_mutex_destroy (&ctx->thread_mutex_usleep);
-			pthread_attr_destroy (&ctx->attr);
-			pthread_mutexattr_destroy (&ctx->mutex_attr);
-			return THREAD_ERROR_COND_USLEEP;
-		}
-	}
+        if (pthread_cond_init(&ctx->thread_cond_usleep, NULL) != 0) {
+            free(ctx->thread_handles);
+            free(ctx->thread_mutexs);
+            free(ctx->thread_conds);
+            pthread_mutex_destroy(&ctx->thread_mutex_usleep);
+            pthread_attr_destroy(&ctx->attr);
+            pthread_mutexattr_destroy(&ctx->mutex_attr);
+            return THREAD_ERROR_COND_USLEEP;
+        }
+    }
 
-	int err = 0;
-	int z = 0;
+    int err = 0;
+    int z = 0;
 
-	for (z = 0; z < (int) ctx->thread_count; z++)
-	{
-		if (ctx->type == THREAD_TYPE_ASYNC)
-		{
-			if (pthread_mutex_init (&ctx->thread_mutexs[z], NULL) != 0)
-			{
-				err = THREAD_ERROR_MUTEX;
-				break;
-			}
+    for (z = 0; z < (int) ctx->thread_count; z++) {
+        if (ctx->type == THREAD_TYPE_ASYNC) {
+            if (pthread_mutex_init(&ctx->thread_mutexs[z], NULL) != 0) {
+                err = THREAD_ERROR_MUTEX;
+                break;
+            }
 
-			if (pthread_cond_init (&ctx->thread_conds[z], NULL) != 0)
-			{
-				pthread_mutex_destroy (&ctx->thread_mutexs[z]);
-				err = THREAD_ERROR_COND;
-				break;
-			}
-		}
-	}
+            if (pthread_cond_init(&ctx->thread_conds[z], NULL) != 0) {
+                pthread_mutex_destroy(&ctx->thread_mutexs[z]);
+                err = THREAD_ERROR_COND;
+                break;
+            }
+        }
+    }
 
-	if (err != 0)
-	{
-		z--; // step back
+    if (err != 0) {
+        z--; // step back
 
-		for (; z >= 0; z--)
-		{
-			pthread_cond_destroy (&ctx->thread_conds[z]);
-			pthread_mutex_destroy (&ctx->thread_mutexs[z]);
-		}
+        for (; z >= 0; z--) {
+            pthread_cond_destroy(&ctx->thread_conds[z]);
+            pthread_mutex_destroy(&ctx->thread_mutexs[z]);
+        }
 
-		if (ctx->enable_condusleep)
-		{
-			pthread_mutex_destroy (&ctx->thread_mutex_usleep);
-			pthread_cond_destroy (&ctx->thread_cond_usleep);
-		}
+        if (ctx->enable_condusleep) {
+            pthread_mutex_destroy(&ctx->thread_mutex_usleep);
+            pthread_cond_destroy(&ctx->thread_cond_usleep);
+        }
 
-		free (ctx->thread_handles);
-		free (ctx->thread_mutexs);
-		free (ctx->thread_conds);
-		pthread_attr_destroy (&ctx->attr);
-		pthread_mutexattr_destroy (&ctx->mutex_attr);
-		return err;
-	}
+        free(ctx->thread_handles);
+        free(ctx->thread_mutexs);
+        free(ctx->thread_conds);
+        pthread_attr_destroy(&ctx->attr);
+        pthread_mutexattr_destroy(&ctx->mutex_attr);
+        return err;
+    }
 
-	ctx->init = 1;
-	return 0;
+    ctx->init = 1;
+    return 0;
 }
 
-int thread_destroy (thread_ctx_t *ctx)
-{
-	if (!ctx) return -1;
-	if (!ctx->init) return -2;
+int thread_destroy(thread_ctx_t *ctx) {
+    if (!ctx) return -1;
+    if (!ctx->init) return -2;
 
-	if (ctx->enable_condusleep)
-	{
-		pthread_cond_destroy (&ctx->thread_cond_usleep);
-		pthread_mutex_destroy (&ctx->thread_mutex_usleep);
-	}
+    if (ctx->enable_condusleep) {
+        pthread_cond_destroy(&ctx->thread_cond_usleep);
+        pthread_mutex_destroy(&ctx->thread_mutex_usleep);
+    }
 
-	for (size_t z = 0; z < ctx->thread_count; z++)
-	{
-		pthread_cond_destroy (&ctx->thread_conds[z]);
-		pthread_mutex_destroy (&ctx->thread_mutexs[z]);
-	}
+    for (size_t z = 0; z < ctx->thread_count; z++) {
+        pthread_cond_destroy(&ctx->thread_conds[z]);
+        pthread_mutex_destroy(&ctx->thread_mutexs[z]);
+    }
 
-	pthread_mutexattr_destroy (&ctx->mutex_attr);
-	pthread_attr_init (&ctx->attr);
+    pthread_mutexattr_destroy(&ctx->mutex_attr);
+    pthread_attr_init(&ctx->attr);
 
-	free (ctx->thread_conds);
-	free (ctx->thread_mutexs);
-	free (ctx->thread_handles);
+    free(ctx->thread_conds);
+    free(ctx->thread_mutexs);
+    free(ctx->thread_handles);
 
-	memset (ctx, 0, sizeof (thread_ctx_t));
-	ctx->init = 0;
-	return 0;
+    memset(ctx, 0, sizeof(thread_ctx_t));
+    ctx->init = 0;
+    return 0;
 }
 
-int thread_start (thread_ctx_t *ctx, thread_args_t *t_arg)
-{
-	int err = 0;
-	int z = 0;
+int thread_start(thread_ctx_t *ctx, thread_args_t *t_arg) {
+    int err = 0;
+    int z = 0;
 
-	for (z = 0; z < (int) ctx->thread_count; z++)
-	{
-		if (pthread_create (&ctx->thread_handles[z], &ctx->attr, (ctx->type == THREAD_TYPE_ASYNC) ? computing_process_async : computing_process, (void *) &t_arg[z]) != 0)
-		{
-			err = THREAD_ERROR_CREATE;
-			break;
-		}
-	}
+    for (z = 0; z < (int) ctx->thread_count; z++) {
+        if (pthread_create(&ctx->thread_handles[z], &ctx->attr, (ctx->type == THREAD_TYPE_ASYNC) ? computing_process_async : computing_process, (void *) &t_arg[z]) != 0) {
+            err = THREAD_ERROR_CREATE;
+            break;
+        }
+    }
 
-	if (err != 0)
-	{
-		z--; // step back
+    if (err != 0) {
+        z--; // step back
 
-		for (; z >= 0; z++)
-		{
-			pthread_cancel (ctx->thread_handles[z]);
-			pthread_join (ctx->thread_handles[z], NULL);
-		}
+        for (; z >= 0; z++) {
+            pthread_cancel(ctx->thread_handles[z]);
+            pthread_join(ctx->thread_handles[z], NULL);
+        }
 
-		return err;
-	}
+        return err;
+    }
 
-	return 0;
+    return 0;
 }
 
-int thread_stop (thread_ctx_t *ctx)
-{
-	for (size_t z = 0; z < ctx->thread_count; z++)
-	{
-		if (ctx->type == THREAD_TYPE_ASYNC) pthread_cancel (ctx->thread_handles[z]);
-		pthread_join (ctx->thread_handles[z], NULL);
-	}
+int thread_stop(thread_ctx_t *ctx) {
+    for (size_t z = 0; z < ctx->thread_count; z++) {
+        if (ctx->type == THREAD_TYPE_ASYNC) pthread_cancel(ctx->thread_handles[z]);
+        pthread_join(ctx->thread_handles[z], NULL);
+    }
 
-	return 0;
+    return 0;
 }
 
-__attribute__ ((format (printf, 1, 2)))
-void tprintf (const char * restrict format, ...)
-{
-	flockfile (stdout);
+__attribute__((format(printf, 1, 2)))
+void tprintf(const char *restrict format, ...) {
+    flockfile(stdout);
 
-	va_list va_args;
-	va_start (va_args, format);
-	vprintf (format, va_args);
-	va_end (va_args);
+    va_list va_args;
+    va_start(va_args, format);
+    vprintf(format, va_args);
+    va_end(va_args);
 
-	funlockfile (stdout);
+    funlockfile(stdout);
 
-	fflush (stdout);
+    fflush(stdout);
 }
 
-const char *thread_status_strdesc (thread_status_t s)
-{
-	switch (s)
-	{
-		case TH_START: return (const char *) "START";
-		case TH_WAIT: return (const char *) "WAIT";
-		case TH_PROCESSING: return (const char *) "PROCESSING";
-		case TH_ERROR: return (const char *) "ERROR";
-		case TH_STOP: return (const char *) "STOP";
-		case TH_FOUND_KEY: return (const char *) "FOUND_KEY";
-		case TH_END: return (const char *) "END";
-	}
+const char *thread_status_strdesc(thread_status_t s) {
+    switch (s) {
+        case TH_START:
+            return (const char *) "START";
+        case TH_WAIT:
+            return (const char *) "WAIT";
+        case TH_PROCESSING:
+            return (const char *) "PROCESSING";
+        case TH_ERROR:
+            return (const char *) "ERROR";
+        case TH_STOP:
+            return (const char *) "STOP";
+        case TH_FOUND_KEY:
+            return (const char *) "FOUND_KEY";
+        case TH_END:
+            return (const char *) "END";
+    }
 
-	return (const char *) "... or die tryin'";
+    return (const char *) "... or die tryin'";
 }
 
-bool thread_setEnd (thread_ctx_t *ctx, thread_args_t *t_arg)
-{
-	bool found = false;
+bool thread_setEnd(thread_ctx_t *ctx, thread_args_t *t_arg) {
+    bool found = false;
 
-	size_t z;
+    size_t z;
 
-	int m_ret = 0;
-	int c_ret = 0;
+    int m_ret = 0;
+    int c_ret = 0;
 
-	for (z = 0; z < ctx->thread_count; z++)
-	{
-		m_ret = pthread_mutex_lock (&ctx->thread_mutexs[z]);
-		if (m_ret != 0)
-		{
-			tprintf ("[%zu] [%s] Error: pthread_mutex_lock() failed (%d): %s\n", z, __func__, m_ret, strerror (m_ret));
-		}
+    for (z = 0; z < ctx->thread_count; z++) {
+        m_ret = pthread_mutex_lock(&ctx->thread_mutexs[z]);
+        if (m_ret != 0) {
+            tprintf("[%zu] [%s] Error: pthread_mutex_lock() failed (%d): %s\n", z, __func__, m_ret, strerror(m_ret));
+        }
 
-		thread_status_t tmp = t_arg[z].status;
+        thread_status_t tmp = t_arg[z].status;
 
-		#if DEBUGME > 0
-		tprintf ("[%zu] [%s] Thread status: %s\n", z, __func__, thread_status_strdesc(t_arg[z].status));
-		#endif
+#if DEBUGME > 0
+        tprintf("[%zu] [%s] Thread status: %s\n", z, __func__, thread_status_strdesc(t_arg[z].status));
+#endif
 
-		if (tmp == TH_FOUND_KEY || tmp == TH_END || tmp == TH_ERROR)
-		{
-			if (tmp == TH_FOUND_KEY) found = true;
-			pthread_mutex_unlock (&ctx->thread_mutexs[z]);
-			continue;
-		}
+        if (tmp == TH_FOUND_KEY || tmp == TH_END || tmp == TH_ERROR) {
+            if (tmp == TH_FOUND_KEY) found = true;
+            pthread_mutex_unlock(&ctx->thread_mutexs[z]);
+            continue;
+        }
 
-		#if DEBUGME > 0
-		tprintf ("[%zu] [%s] Set thread status to TH_STOP\n", z, __func__);
-		#endif
+#if DEBUGME > 0
+        tprintf("[%zu] [%s] Set thread status to TH_STOP\n", z, __func__);
+#endif
 
-		t_arg[z].status = TH_STOP;
+        t_arg[z].status = TH_STOP;
 
-		if (tmp == TH_WAIT)
-		{
-			#if DEBUGME > 0
-			tprintf ("[%zu] [%s] Send cond_signal to thread\n", z, __func__);
-			#endif
+        if (tmp == TH_WAIT) {
+#if DEBUGME > 0
+            tprintf("[%zu] [%s] Send cond_signal to thread\n", z, __func__);
+#endif
 
-			c_ret = pthread_cond_signal (&ctx->thread_conds[z]);
-			if (c_ret != 0)
-			{
-				tprintf ("[%zu] [%s] Error: pthread_cond_signal() failed (%d): %s\n", z, __func__, c_ret, strerror (c_ret));
-			}
-		}
+            c_ret = pthread_cond_signal(&ctx->thread_conds[z]);
+            if (c_ret != 0) {
+                tprintf("[%zu] [%s] Error: pthread_cond_signal() failed (%d): %s\n", z, __func__, c_ret, strerror(c_ret));
+            }
+        }
 
-		pthread_mutex_unlock (&ctx->thread_mutexs[z]);
-	}
+        pthread_mutex_unlock(&ctx->thread_mutexs[z]);
+    }
 
-	return found;
+    return found;
 }
 
-void *computing_process (void *arg)
-{
-	thread_args_t *a = (thread_args_t *) arg;
+void *computing_process(void *arg) {
+    thread_args_t *a = (thread_args_t *) arg;
 
-	uint64_t off = 0;
+    uint64_t off = 0;
 
-	size_t z = a->device_id;
-	uint64_t *matches = a->matches;
-	uint32_t *matches_found = a->matches_found;
+    size_t z = a->device_id;
+    uint64_t *matches = a->matches;
+    uint32_t *matches_found = a->matches_found;
 
-	uint32_t uid = a->uid;
-	uint32_t aR2 = a->aR2;
-	uint32_t nR1 = a->nR1;
-	uint32_t nR2 = a->nR2;
+    uint32_t uid = a->uid;
+    uint32_t aR2 = a->aR2;
+    uint32_t nR1 = a->nR1;
+    uint32_t nR2 = a->nR2;
 
-	opencl_ctx_t *ctx = a->ocl_ctx;
+    opencl_ctx_t *ctx = a->ocl_ctx;
 
-	wu_queue_data_t wu;
-	wu_queue_pop (&ctx->queue_ctx, &wu, false);
-	off = wu.off;
-	a->slice = wu.id+1;
+    wu_queue_data_t wu;
+    wu_queue_pop(&ctx->queue_ctx, &wu, false);
+    off = wu.off;
+    a->slice = wu.id + 1;
 
-	if (ctx->queue_ctx.queue_type == QUEUE_TYPE_RANDOM)
-	{
-		#if DEBUGME > 0
-		printf ("[%zu] Slice %zu (off %zu), max %zu, remain %zu slice(s)\n", z, wu.id+1, wu.off, wu.max, wu.rem);
-		#else
-		printf ("[%zu] Slice %zu/%zu (%zu remain)\n", z, wu.id+1, wu.max, wu.rem);
-		#endif // DEBUGME
-	}
-	else
-	{
-		#if DEBUGME > 0
-		printf ("[%zu] Slice %zu/%zu, off %zu\n", z, wu.id+1, wu.max, wu.off);
-		#else
-		printf ("[%zu] Slice %zu/%zu\n", z, wu.id+1, wu.max);
-		#endif // DEBUGME
-	}
-	fflush (stdout);
+    if (ctx->queue_ctx.queue_type == QUEUE_TYPE_RANDOM) {
+#if DEBUGME > 0
+        printf("[%zu] Slice %zu (off %zu), max %zu, remain %zu slice(s)\n", z, wu.id + 1, wu.off, wu.max, wu.rem);
+#else
+        printf("[%zu] Slice %zu/%zu (%zu remain)\n", z, wu.id + 1, wu.max, wu.rem);
+#endif // DEBUGME
+    } else {
+#if DEBUGME > 0
+        printf("[%zu] Slice %zu/%zu, off %zu\n", z, wu.id + 1, wu.max, wu.off);
+#else
+        printf("[%zu] Slice %zu/%zu\n", z, wu.id + 1, wu.max);
+#endif // DEBUGME
+    }
+    fflush(stdout);
 
-	int ret = runKernel (ctx, (uint32_t) off, matches, matches_found, z);
+    int ret = runKernel(ctx, (uint32_t) off, matches, matches_found, z);
 
-	a->r = false;
-	a->err = false;
+    a->r = false;
+    a->err = false;
 
-	if (ret < 1) // error or nada
-	{
-		if (ret == -1) a->err = true;
-		pthread_exit (NULL);
-	}
+    if (ret < 1) { // error or nada
+        if (ret == -1) a->err = true;
+        pthread_exit(NULL);
+    }
 
-	if (!ctx->force_hitag2_opencl)
-	{
-		#if DEBUGME >= 2
-		printf ("[slave][%zu] master, I found %5u candidates @ slice %zu\n", z, matches_found[0], a->slice+1);
-		fflush (stdout);
-		#endif
+    if (!ctx->force_hitag2_opencl) {
+#if DEBUGME >= 2
+        printf("[slave][%zu] master, I found %5u candidates @ slice %zu\n", z, matches_found[0], a->slice + 1);
+        fflush(stdout);
+#endif
 
-		for (uint32_t match = 0; match < matches_found[0]; match++)
-		{
-			a->r = try_state (matches[match], uid, aR2, nR1, nR2, &a->key);
-			if (a->r) break;
-		}
-	}
-	else
-	{
-		// the OpenCL kernel return only one key if found, else nothing
+        for (uint32_t match = 0; match < matches_found[0]; match++) {
+            a->r = try_state(matches[match], uid, aR2, nR1, nR2, &a->key);
+            if (a->r) break;
+        }
+    } else {
+        // the OpenCL kernel return only one key if found, else nothing
 
-		#if TDEBUG >= 1
-		printf ("[slave][%zu] master, I found the key @ slice %zu\n", z, a->slice+1);
-		fflush (stdout);
-		#endif
+#if TDEBUG >= 1
+        printf("[slave][%zu] master, I found the key @ slice %zu\n", z, a->slice + 1);
+        fflush(stdout);
+#endif
 
-		a->r = true;
-		a->key = matches[0];
-	}
+        a->r = true;
+        a->key = matches[0];
+    }
 
-	pthread_exit (NULL);
+    pthread_exit(NULL);
 }
 
-void *computing_process_async (void *arg)
-{
-	thread_args_t *a = (thread_args_t *) arg;
+void *computing_process_async(void *arg) {
+    thread_args_t *a = (thread_args_t *) arg;
 
-	size_t z = a->device_id;
+    size_t z = a->device_id;
 
-	// TH_START, not really needed lock with mutex here
-	pthread_mutex_lock (&a->thread_ctx->thread_mutexs[z]);
+    // TH_START, not really needed lock with mutex here
+    pthread_mutex_lock(&a->thread_ctx->thread_mutexs[z]);
 
-	// fetching data from thread struct, I hope they are good
-	thread_status_t status = a->status;
+    // fetching data from thread struct, I hope they are good
+    thread_status_t status = a->status;
 
-	uint32_t uid = a->uid;
-	uint32_t aR2 = a->aR2;
-	uint32_t nR1 = a->nR1;
-	uint32_t nR2 = a->nR2;
+    uint32_t uid = a->uid;
+    uint32_t aR2 = a->aR2;
+    uint32_t nR1 = a->nR1;
+    uint32_t nR2 = a->nR2;
 
-	uint64_t *matches = a->matches;
-	uint32_t *matches_found = a->matches_found;
-	size_t max_step = a->max_step;
+    uint64_t *matches = a->matches;
+    uint32_t *matches_found = a->matches_found;
+    size_t max_step = a->max_step;
 
-	opencl_ctx_t *ctx = a->ocl_ctx;
+    opencl_ctx_t *ctx = a->ocl_ctx;
 
-	pthread_mutex_unlock (&a->thread_ctx->thread_mutexs[z]);
+    pthread_mutex_unlock(&a->thread_ctx->thread_mutexs[z]);
 
-	uint64_t off = 0;
+    uint64_t off = 0;
 //	size_t slice = 0;
-	int ret = 0;
+    int ret = 0;
 
-	if (status == TH_START)
-	{
-		#if TDEBUG >= 1
-		printf ("[slave][%zu] plat id %d, uid %u, aR2 %u, nR1 %u, nR2 %u, Initial status: %s\n", z, ctx->id_platform, uid, aR2, nR1, nR2, thread_status_strdesc (status));
-		#endif
-		status = TH_WAIT;
-		// proceed to next
-	}
+    if (status == TH_START) {
+#if TDEBUG >= 1
+        printf("[slave][%zu] plat id %d, uid %u, aR2 %u, nR1 %u, nR2 %u, Initial status: %s\n", z, ctx->id_platform, uid, aR2, nR1, nR2, thread_status_strdesc(status));
+#endif
+        status = TH_WAIT;
+        // proceed to next
+    }
 
-	do // slave
-	{
-		if (status == TH_WAIT)
-		{
-			pthread_mutex_lock (&a->thread_ctx->thread_mutexs[z]);
+    do { // slave
+        if (status == TH_WAIT) {
+            pthread_mutex_lock(&a->thread_ctx->thread_mutexs[z]);
 
-			// update thread status to WAIT, todo: check with multiple devices
+            // update thread status to WAIT, todo: check with multiple devices
 
-			if (a->status == TH_END) // other threads found the key
-			{
-				fflush(stdout);
-				status = TH_END;
-				a->quit = true;
-				pthread_mutex_unlock (&a->thread_ctx->thread_mutexs[z]);
-				pthread_exit (NULL);
-			}
-			else
-			{
-				a->status = TH_WAIT;
+            if (a->status == TH_END) { // other threads found the key
+                fflush(stdout);
+                status = TH_END;
+                a->quit = true;
+                pthread_mutex_unlock(&a->thread_ctx->thread_mutexs[z]);
+                pthread_exit(NULL);
+            } else {
+                a->status = TH_WAIT;
 
-				if (a->thread_ctx->enable_condusleep)
-				{
-					pthread_mutex_lock (&a->thread_ctx->thread_mutex_usleep);
-					pthread_cond_signal (&a->thread_ctx->thread_cond_usleep); // unlock master/TH_PROCESSING cond
-					#if TDEBUG >= 1
-					printf ("[slate][%zu] after pthread_cond_signal TH_WAIT\n", z);
-					fflush (stdout);
-					#endif
-					pthread_mutex_unlock (&a->thread_ctx->thread_mutex_usleep);
-				}
-			}
+                if (a->thread_ctx->enable_condusleep) {
+                    pthread_mutex_lock(&a->thread_ctx->thread_mutex_usleep);
+                    pthread_cond_signal(&a->thread_ctx->thread_cond_usleep);  // unlock master/TH_PROCESSING cond
+#if TDEBUG >= 1
+                    printf("[slate][%zu] after pthread_cond_signal TH_WAIT\n", z);
+                    fflush(stdout);
+#endif
+                    pthread_mutex_unlock(&a->thread_ctx->thread_mutex_usleep);
+                }
+            }
 
-			#if TDEBUG >= 1
-			printf ("[slave][%zu] master, i'm here to serve you. I'm in %s give me a signal.\n", z, thread_status_strdesc (status));
-			fflush (stdout);
-			#endif
+#if TDEBUG >= 1
+            printf("[slave][%zu] master, i'm here to serve you. I'm in %s give me a signal.\n", z, thread_status_strdesc(status));
+            fflush(stdout);
+#endif
 
-			pthread_cond_wait (&a->thread_ctx->thread_conds[z], &a->thread_ctx->thread_mutexs[z]);
+            pthread_cond_wait(&a->thread_ctx->thread_conds[z], &a->thread_ctx->thread_mutexs[z]);
 
-			status = a->status; // read new status from master
+            status = a->status; // read new status from master
 
-			#if TDEBUG >= 2
-			printf ("[slave][%zu] master, got the signal with new state: %s.\n", z, thread_status_strdesc (status));
-			fflush (stdout);
-			#endif
+#if TDEBUG >= 2
+            printf("[slave][%zu] master, got the signal with new state: %s.\n", z, thread_status_strdesc(status));
+            fflush(stdout);
+#endif
 
-			pthread_mutex_unlock (&a->thread_ctx->thread_mutexs[z]);
+            pthread_mutex_unlock(&a->thread_ctx->thread_mutexs[z]);
 
-			if (status == TH_WAIT)
-			{
-				#if TDEBUG >=1
-				printf ("[slave] ! Error: need to be TH_PROCESSING or TH_END, not TH_WAIT ... exit\n");
-				fflush (stdout);
-				#endif
-				break;
-			}
-		}
+            if (status == TH_WAIT) {
+#if TDEBUG >=1
+                printf("[slave] ! Error: need to be TH_PROCESSING or TH_END, not TH_WAIT ... exit\n");
+                fflush(stdout);
+#endif
+                break;
+            }
+        }
 
-		if (status == TH_ERROR)
-		{
-			#if TDEBUG >= 1
-			printf ("[slave][%zu] master, got error signal, proceed with exit\n", z);
-			fflush (stdout);
-			#endif
-			pthread_exit (NULL);
-		}
+        if (status == TH_ERROR) {
+#if TDEBUG >= 1
+            printf("[slave][%zu] master, got error signal, proceed with exit\n", z);
+            fflush(stdout);
+#endif
+            pthread_exit(NULL);
+        }
 
-		if (status == TH_PROCESSING)
-		{
-			#if TDEBUG >= 2
-			printf ("[slave][%zu] master, got a work-unit, processing ...\n", z);
-			fflush (stdout);
-			#endif
+        if (status == TH_PROCESSING) {
+#if TDEBUG >= 2
+            printf("[slave][%zu] master, got a work-unit, processing ...\n", z);
+            fflush(stdout);
+#endif
 
-			wu_queue_data_t wu;
-			wu_queue_pop (&ctx->queue_ctx, &wu, false);
-			off = wu.off;
-			a->slice = wu.id+1;
+            wu_queue_data_t wu;
+            wu_queue_pop(&ctx->queue_ctx, &wu, false);
+            off = wu.off;
+            a->slice = wu.id + 1;
 
-			if (ctx->queue_ctx.queue_type == QUEUE_TYPE_RANDOM)
-			{
-				#if DEBUGME > 0
-				printf ("[%zu] Slice %zu (off %zu), max %zu, remain %zu slice(s)\n", z, wu.id+1, wu.off, wu.max, wu.rem);
-				#else
-				printf ("[%zu] Slice %zu/%zu (%zu remain)\n", z, wu.id+1, wu.max, wu.rem);
-				#endif // DEBUGME
-			}
-			else
-			{
-				#if DEBUGME > 0
-				printf ("[%zu] Slice %zu/%zu, off %zu\n", z, wu.id+1, wu.max, wu.off);
-				#else
-				printf ("[%zu] Slice %zu/%zu\n", z, wu.id+1, wu.max);
-				#endif // DEBUGME
-			}
+            if (ctx->queue_ctx.queue_type == QUEUE_TYPE_RANDOM) {
+#if DEBUGME > 0
+                printf("[%zu] Slice %zu (off %zu), max %zu, remain %zu slice(s)\n", z, wu.id + 1, wu.off, wu.max, wu.rem);
+#else
+                printf("[%zu] Slice %zu/%zu (%zu remain)\n", z, wu.id + 1, wu.max, wu.rem);
+#endif // DEBUGME
+            } else {
+#if DEBUGME > 0
+                printf("[%zu] Slice %zu/%zu, off %zu\n", z, wu.id + 1, wu.max, wu.off);
+#else
+                printf("[%zu] Slice %zu/%zu\n", z, wu.id + 1, wu.max);
+#endif // DEBUGME
+            }
 
-			fflush (stdout);
+            fflush(stdout);
 
-			ret = runKernel (ctx, (uint32_t) off, matches, matches_found, z);
+            ret = runKernel(ctx, (uint32_t) off, matches, matches_found, z);
 
-			if (ret < 1) // error or nada
-			{
-				if (ret == -1)
-				{
-					// untested code
-					pthread_mutex_lock (&a->thread_ctx->thread_mutexs[z]);
-					a->err = true;
-					a->status = TH_ERROR;
-					pthread_mutex_unlock (&a->thread_ctx->thread_mutexs[z]);
-					#if TDEBUG >= 1
-					printf ("[slave][%zu] master, something is broken, exit\n", z);
-					fflush (stdout);
-					#endif
+            if (ret < 1) { // error or nada
+                if (ret == -1) {
+                    // untested code
+                    pthread_mutex_lock(&a->thread_ctx->thread_mutexs[z]);
+                    a->err = true;
+                    a->status = TH_ERROR;
+                    pthread_mutex_unlock(&a->thread_ctx->thread_mutexs[z]);
+#if TDEBUG >= 1
+                    printf("[slave][%zu] master, something is broken, exit\n", z);
+                    fflush(stdout);
+#endif
 
-					if (a->thread_ctx->enable_condusleep)
-					{
-						pthread_mutex_lock (&a->thread_ctx->thread_mutex_usleep);
-						pthread_cond_signal (&a->thread_ctx->thread_cond_usleep); // unlock master/TH_PROCESSING cond
-						#if TDEBUG >= 1
-						printf ("[slave][%zu] after pthread_cond_signal TH_ERROR\n", z);
-						#endif
-						pthread_mutex_unlock (&a->thread_ctx->thread_mutex_usleep);
-					}
+                    if (a->thread_ctx->enable_condusleep) {
+                        pthread_mutex_lock(&a->thread_ctx->thread_mutex_usleep);
+                        pthread_cond_signal(&a->thread_ctx->thread_cond_usleep);  // unlock master/TH_PROCESSING cond
+#if TDEBUG >= 1
+                        printf("[slave][%zu] after pthread_cond_signal TH_ERROR\n", z);
+#endif
+                        pthread_mutex_unlock(&a->thread_ctx->thread_mutex_usleep);
+                    }
 
-					pthread_exit (NULL);
-					// end of unstested code
-				}
+                    pthread_exit(NULL);
+                    // end of unstested code
+                }
 
-				#if TDEBUG >= 1
-				printf ("[slave][%zu] master, process is done but no candidates found\n", z);
-				fflush (stdout);
-				#endif
-				pthread_mutex_lock (&a->thread_ctx->thread_mutexs[z]);
+#if TDEBUG >= 1
+                printf("[slave][%zu] master, process is done but no candidates found\n", z);
+                fflush(stdout);
+#endif
+                pthread_mutex_lock(&a->thread_ctx->thread_mutexs[z]);
 
-				if (a->slice >= max_step) a->status = TH_END;
-				else a->status = TH_WAIT;
+                if (a->slice >= max_step) a->status = TH_END;
+                else a->status = TH_WAIT;
 
-				status = a->status;
+                status = a->status;
 
-				pthread_mutex_unlock (&a->thread_ctx->thread_mutexs[z]);
+                pthread_mutex_unlock(&a->thread_ctx->thread_mutexs[z]);
 
-				if (a->thread_ctx->enable_condusleep)
-				{
-					pthread_mutex_lock (&a->thread_ctx->thread_mutex_usleep);
-					pthread_cond_signal (&a->thread_ctx->thread_cond_usleep); // unlock master/TH_PROCESSING cond
-					#if TDEBUG >= 1
-					printf ("[slave][%zu] after pthread_cond_signal TH_WAIT\n", z);
-					fflush (stdout);
-					#endif
-					pthread_mutex_unlock (&a->thread_ctx->thread_mutex_usleep);
-				}
+                if (a->thread_ctx->enable_condusleep) {
+                    pthread_mutex_lock(&a->thread_ctx->thread_mutex_usleep);
+                    pthread_cond_signal(&a->thread_ctx->thread_cond_usleep);  // unlock master/TH_PROCESSING cond
+#if TDEBUG >= 1
+                    printf("[slave][%zu] after pthread_cond_signal TH_WAIT\n", z);
+                    fflush(stdout);
+#endif
+                    pthread_mutex_unlock(&a->thread_ctx->thread_mutex_usleep);
+                }
 
-				continue;
-			}
+                continue;
+            }
 
-			if (!ctx->force_hitag2_opencl)
-			{
-				#if TDEBUG >= 1
-				printf ("[slave][%zu] master, we got %5u candidates. Proceed to validation\n", z, matches_found[0]);
-				fflush (stdout);
-				#endif
+            if (!ctx->force_hitag2_opencl) {
+#if TDEBUG >= 1
+                printf("[slave][%zu] master, we got %5u candidates. Proceed to validation\n", z, matches_found[0]);
+                fflush(stdout);
+#endif
 
-				for (uint32_t match = 0; match < matches_found[0]; match++)
-				{
-					if (a->quit)
-					{
-						pthread_mutex_lock (&a->thread_ctx->thread_mutexs[z]);
-						a->status = TH_END;
-						pthread_mutex_unlock (&a->thread_ctx->thread_mutexs[z]);
-						#if TDEBUG >= 1
-						printf ("[slave][%zu] master, Another thread found the key, quit 2 \n", z);
-						fflush (stdout);
-						#endif
+                for (uint32_t match = 0; match < matches_found[0]; match++) {
+                    if (a->quit) {
+                        pthread_mutex_lock(&a->thread_ctx->thread_mutexs[z]);
+                        a->status = TH_END;
+                        pthread_mutex_unlock(&a->thread_ctx->thread_mutexs[z]);
+#if TDEBUG >= 1
+                        printf("[slave][%zu] master, Another thread found the key, quit 2 \n", z);
+                        fflush(stdout);
+#endif
 
-						if (a->thread_ctx->enable_condusleep)
-						{
-							pthread_mutex_lock (&a->thread_ctx->thread_mutex_usleep);
-							pthread_cond_signal (&a->thread_ctx->thread_cond_usleep); // unlock master/TH_PROCESSING cond
-							#if TDEBUG >= 1
-							printf ("[slave][%zu] after pthread_cond_signal TH_END\n", z);
-							#endif
-							pthread_mutex_unlock (&a->thread_ctx->thread_mutex_usleep);
-						}
+                        if (a->thread_ctx->enable_condusleep) {
+                            pthread_mutex_lock(&a->thread_ctx->thread_mutex_usleep);
+                            pthread_cond_signal(&a->thread_ctx->thread_cond_usleep);  // unlock master/TH_PROCESSING cond
+#if TDEBUG >= 1
+                            printf("[slave][%zu] after pthread_cond_signal TH_END\n", z);
+#endif
+                            pthread_mutex_unlock(&a->thread_ctx->thread_mutex_usleep);
+                        }
 
-						pthread_exit (NULL);
-					}
+                        pthread_exit(NULL);
+                    }
 
-					a->r = try_state (matches[match], uid, aR2, nR1, nR2, &a->key);
-					if (a->r)
-					{
-						pthread_mutex_lock (&a->thread_ctx->thread_mutexs[z]);
-						a->s = matches[match];
-						status = a->status = TH_FOUND_KEY;
-						a->quit = true;
-						pthread_mutex_unlock (&a->thread_ctx->thread_mutexs[z]);
-						#if TDEBUG >= 1
-						printf ("[slave][%zu] master, I found the key ! state %" STR(OFF_FORMAT_U) ", slice %zu\n", z, a->s, a->slice+1);
-						fflush (stdout);
-						#endif
+                    a->r = try_state(matches[match], uid, aR2, nR1, nR2, &a->key);
+                    if (a->r) {
+                        pthread_mutex_lock(&a->thread_ctx->thread_mutexs[z]);
+                        a->s = matches[match];
+                        status = a->status = TH_FOUND_KEY;
+                        a->quit = true;
+                        pthread_mutex_unlock(&a->thread_ctx->thread_mutexs[z]);
+#if TDEBUG >= 1
+                        printf("[slave][%zu] master, I found the key ! state %" STR(OFF_FORMAT_U) ", slice %zu\n", z, a->s, a->slice + 1);
+                        fflush(stdout);
+#endif
 
-						if (a->thread_ctx->enable_condusleep)
-						{
-							pthread_mutex_lock (&a->thread_ctx->thread_mutex_usleep);
-							pthread_cond_signal (&a->thread_ctx->thread_cond_usleep); // unlock master/TH_PROCESSING cond
-							#if TDEBUG >= 1
-							printf ("[slave][%zu] after pthread_cond_signal TH_FOUND_KEY\n", z);
-							#endif
-							pthread_mutex_unlock (&a->thread_ctx->thread_mutex_usleep);
-						}
+                        if (a->thread_ctx->enable_condusleep) {
+                            pthread_mutex_lock(&a->thread_ctx->thread_mutex_usleep);
+                            pthread_cond_signal(&a->thread_ctx->thread_cond_usleep);  // unlock master/TH_PROCESSING cond
+#if TDEBUG >= 1
+                            printf("[slave][%zu] after pthread_cond_signal TH_FOUND_KEY\n", z);
+#endif
+                            pthread_mutex_unlock(&a->thread_ctx->thread_mutex_usleep);
+                        }
 
-						pthread_exit (NULL);
-					}
-				}
+                        pthread_exit(NULL);
+                    }
+                }
 
-				if (a->quit)
-				{
-					pthread_mutex_lock (&a->thread_ctx->thread_mutexs[z]);
-					a->status = TH_END;
-					pthread_mutex_unlock (&a->thread_ctx->thread_mutexs[z]);
-					#if TDEBUG >= 1
-					printf ("[slave][%zu] master, Another thread found the key, quit 1 \n", z);
-					fflush (stdout);
-					#endif
+                if (a->quit) {
+                    pthread_mutex_lock(&a->thread_ctx->thread_mutexs[z]);
+                    a->status = TH_END;
+                    pthread_mutex_unlock(&a->thread_ctx->thread_mutexs[z]);
+#if TDEBUG >= 1
+                    printf("[slave][%zu] master, Another thread found the key, quit 1 \n", z);
+                    fflush(stdout);
+#endif
 
-					if (a->thread_ctx->enable_condusleep)
-					{
-						pthread_mutex_lock (&a->thread_ctx->thread_mutex_usleep);
-						pthread_cond_signal (&a->thread_ctx->thread_cond_usleep); // unlock master/TH_PROCESSING cond
-						#if TDEBUG >= 1
-						printf ("[slave][%zu] after pthread_cond_signal TH_END\n", z);
-						#endif
-						pthread_mutex_unlock (&a->thread_ctx->thread_mutex_usleep);
-					}
+                    if (a->thread_ctx->enable_condusleep) {
+                        pthread_mutex_lock(&a->thread_ctx->thread_mutex_usleep);
+                        pthread_cond_signal(&a->thread_ctx->thread_cond_usleep);  // unlock master/TH_PROCESSING cond
+#if TDEBUG >= 1
+                        printf("[slave][%zu] after pthread_cond_signal TH_END\n", z);
+#endif
+                        pthread_mutex_unlock(&a->thread_ctx->thread_mutex_usleep);
+                    }
 
-					pthread_exit (NULL);
-				}
+                    pthread_exit(NULL);
+                }
 
-				// setting internal status to wait
-				status = TH_WAIT;
-				continue;
-			}
-			else
-			{
-				// the OpenCL kernel return only one key if found, else nothing
+                // setting internal status to wait
+                status = TH_WAIT;
+                continue;
+            } else {
+                // the OpenCL kernel return only one key if found, else nothing
 
-				pthread_mutex_lock (&a->thread_ctx->thread_mutexs[z]);
-				a->r = true;
-				a->key = matches[0];
-				status = a->status = TH_FOUND_KEY;
-				a->quit = true;
-				pthread_mutex_unlock (&a->thread_ctx->thread_mutexs[z]);
-				#if TDEBUG >= 1
-				printf ("[slave][%zu] master, I found the key at slice %zu\n", z, a->slice+1);
-				fflush (stdout);
-				#endif
+                pthread_mutex_lock(&a->thread_ctx->thread_mutexs[z]);
+                a->r = true;
+                a->key = matches[0];
+                status = a->status = TH_FOUND_KEY;
+                a->quit = true;
+                pthread_mutex_unlock(&a->thread_ctx->thread_mutexs[z]);
+#if TDEBUG >= 1
+                printf("[slave][%zu] master, I found the key at slice %zu\n", z, a->slice + 1);
+                fflush(stdout);
+#endif
 
-				if (a->thread_ctx->enable_condusleep)
-				{
-					pthread_mutex_lock (&a->thread_ctx->thread_mutex_usleep);
-					pthread_cond_signal (&a->thread_ctx->thread_cond_usleep); // unlock master/TH_PROCESSING cond
-					#if TDEBUG >= 1
-					printf ("[slave][%zu] after pthread_cond_signal TH_FOUND_KEY\n", z);
-					#endif
-					pthread_mutex_unlock (&a->thread_ctx->thread_mutex_usleep);
-				}
+                if (a->thread_ctx->enable_condusleep) {
+                    pthread_mutex_lock(&a->thread_ctx->thread_mutex_usleep);
+                    pthread_cond_signal(&a->thread_ctx->thread_cond_usleep);  // unlock master/TH_PROCESSING cond
+#if TDEBUG >= 1
+                    printf("[slave][%zu] after pthread_cond_signal TH_FOUND_KEY\n", z);
+#endif
+                    pthread_mutex_unlock(&a->thread_ctx->thread_mutex_usleep);
+                }
 
-				pthread_exit (NULL);
-			}
-		}
+                pthread_exit(NULL);
+            }
+        }
 
-		if (status >= TH_FOUND_KEY)
-		{
-			#if TDEBUG >= 1
-			if (status == TH_FOUND_KEY)
-			{
-				printf ("[slave][%zu] master, TH_FOUND_KEY, if you see this message, something is wrong\n", z);
-				fflush (stdout);
-			}
-			else if (status == TH_END)
-			{
-				printf ("[slave][%zu] master, TH_END reached\n", z);
-				fflush (stdout);
-			}
-			#endif
-			pthread_exit (NULL);
-		}
+        if (status >= TH_FOUND_KEY) {
+#if TDEBUG >= 1
+            if (status == TH_FOUND_KEY) {
+                printf("[slave][%zu] master, TH_FOUND_KEY, if you see this message, something is wrong\n", z);
+                fflush(stdout);
+            } else if (status == TH_END) {
+                printf("[slave][%zu] master, TH_END reached\n", z);
+                fflush(stdout);
+            }
+#endif
+            pthread_exit(NULL);
+        }
 
-	} while (status < TH_FOUND_KEY);
+    } while (status < TH_FOUND_KEY);
 
-	pthread_exit (NULL);
+    pthread_exit(NULL);
 }
diff --git a/tools/hitag2crack/crack5opencl/threads.h b/tools/hitag2crack/crack5opencl/threads.h
index 10f07f04b..d60c16cfc 100644
--- a/tools/hitag2crack/crack5opencl/threads.h
+++ b/tools/hitag2crack/crack5opencl/threads.h
@@ -34,110 +34,105 @@ License: GNU General Public License v3 or any later version (see LICENSE.txt)
 #include "opencl.h"
 #include "hitag2.h"
 
-typedef enum thread_status
-{
-	TH_START = 0,
-	TH_WAIT,
-	TH_PROCESSING,
-	TH_STOP,
-	TH_ERROR,
-	TH_FOUND_KEY,
-	TH_END
+typedef enum thread_status {
+    TH_START = 0,
+    TH_WAIT,
+    TH_PROCESSING,
+    TH_STOP,
+    TH_ERROR,
+    TH_FOUND_KEY,
+    TH_END
 
 } thread_status_t;
 
-typedef enum thread_type
-{
-	THREAD_TYPE_SEQ = 0,
-	THREAD_TYPE_ASYNC
+typedef enum thread_type {
+    THREAD_TYPE_SEQ = 0,
+    THREAD_TYPE_ASYNC
 
 } thread_type_t;
 
-typedef enum thread_error
-{
-	THREAD_NOERROR = 0,
-	THREAD_ERROR_CTX_IS_NULL = -1,
-	THREAD_ERROR_CTX_IS_INIT = -2,
-	THREAD_ERROR_TYPE_INVALID = -3,
-	THREAD_ERROR_COUNT_INVALID = -4,
-	THREAD_ERROR_ATTR_SETDETACH = -5,
-	THREAD_ERROR_ATTR = -6,
-	THREAD_ERROR_MUTEXATTR = -7,
-	THREAD_ERROR_CREATE = -8,
-	THREAD_ERROR_MUTEX = -9,
-	THREAD_ERROR_COND = -10,
-	THREAD_ERROR_MUTEX_USLEEP = -11,
-	THREAD_ERROR_COND_USLEEP = -12,
-	THREAD_ERROR_GENERIC = -13,
-	THREAD_ERROR_ALLOC = -14
+typedef enum thread_error {
+    THREAD_NOERROR = 0,
+    THREAD_ERROR_CTX_IS_NULL = -1,
+    THREAD_ERROR_CTX_IS_INIT = -2,
+    THREAD_ERROR_TYPE_INVALID = -3,
+    THREAD_ERROR_COUNT_INVALID = -4,
+    THREAD_ERROR_ATTR_SETDETACH = -5,
+    THREAD_ERROR_ATTR = -6,
+    THREAD_ERROR_MUTEXATTR = -7,
+    THREAD_ERROR_CREATE = -8,
+    THREAD_ERROR_MUTEX = -9,
+    THREAD_ERROR_COND = -10,
+    THREAD_ERROR_MUTEX_USLEEP = -11,
+    THREAD_ERROR_COND_USLEEP = -12,
+    THREAD_ERROR_GENERIC = -13,
+    THREAD_ERROR_ALLOC = -14
 
 } thread_error_t;
 
-typedef struct threads_ctx
-{
-	short init;
-	short type;
+typedef struct threads_ctx {
+    short init;
+    short type;
 
-	unsigned char pad1[4];
-	size_t thread_count;
+    unsigned char pad1[4];
+    size_t thread_count;
 
-	pthread_t *thread_handles;
+    pthread_t *thread_handles;
 
-	pthread_mutex_t *thread_mutexs;
-	pthread_cond_t *thread_conds;
+    pthread_mutex_t *thread_mutexs;
+    pthread_cond_t *thread_conds;
 
-	short enable_condusleep;
+    short enable_condusleep;
 
-	// get rid of sleep/usleep call to synchronize threads
-	unsigned char pad2[6];
-	pthread_mutex_t thread_mutex_usleep;
-	pthread_cond_t thread_cond_usleep;
+    // get rid of sleep/usleep call to synchronize threads
+    unsigned char pad2[6];
+    pthread_mutex_t thread_mutex_usleep;
+    pthread_cond_t thread_cond_usleep;
 
-	pthread_attr_t attr;
-	pthread_mutexattr_t mutex_attr;
+    pthread_attr_t attr;
+    pthread_mutexattr_t mutex_attr;
 
 } thread_ctx_t;
 
 // used by threads engine
-typedef struct thread_arg
-{
-	thread_status_t status;
-	unsigned char pad1[4];
-	size_t max_threads;
+typedef struct thread_arg {
+    thread_status_t status;
+    unsigned char pad1[4];
+    size_t max_threads;
 
-	uint64_t s;
-	uint32_t uid, nR1, aR1, nR2, aR2;
-	bool r;
-	bool err;
-	bool quit;
-	bool async;
+    uint64_t s;
+    uint32_t uid, nR1, aR1, nR2, aR2;
+    bool r;
+    bool err;
+    bool quit;
+    bool async;
 
-	uint64_t off;
-	uint64_t *matches;
-	uint32_t *matches_found;
-	size_t slice;
-	size_t max_step;
-	size_t device_id;
+    uint64_t off;
+    uint64_t *matches;
+    uint32_t *matches_found;
+    size_t slice;
+    size_t max_step;
+    size_t device_id;
 
-	uint64_t key;
+    uint64_t key;
 
-	opencl_ctx_t *ocl_ctx;
-	thread_ctx_t *thread_ctx;
+    opencl_ctx_t *ocl_ctx;
+    thread_ctx_t *thread_ctx;
 
 } thread_args_t;
 
-int thread_init (thread_ctx_t *ctx, short type, size_t thread_count);
-int thread_start (thread_ctx_t *ctx, thread_args_t *args);
-int thread_stop (thread_ctx_t *ctx);
+int thread_init(thread_ctx_t *ctx, short type, size_t thread_count);
+int thread_start(thread_ctx_t *ctx, thread_args_t *args);
+int thread_stop(thread_ctx_t *ctx);
 
-void tprintf (const char * restrict format, ...);
-const char *thread_strerror (int error);
-const char *thread_status_strdesc (thread_status_t s);
-bool thread_setEnd (thread_ctx_t *ctx, thread_args_t *t_arg);
+void tprintf(const char *restrict format, ...);
+const char *thread_strerror(int error);
+const char *thread_status_strdesc(thread_status_t s);
+bool thread_setEnd(thread_ctx_t *ctx, thread_args_t *t_arg);
 
-void *computing_process (void *arg);
-void *computing_process_async (void *arg);
+void *computing_process(void *arg);
+void *computing_process_async(void *arg);
 
-int thread_destroy (thread_ctx_t *ctx);
+int thread_destroy(thread_ctx_t *ctx);
 
 #endif // THREADS_H

From 3f041165fc862ee8060d1aec7e24de71c3127440 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 14 Jan 2021 11:45:37 +0100
Subject: [PATCH 358/682] textual

---
 README.md | 49 +++++++++++++++++++++++++++++++++++--------------
 1 file changed, 35 insertions(+), 14 deletions(-)

diff --git a/README.md b/README.md
index 526cda510..4b2b7fed2 100644
--- a/README.md
+++ b/README.md
@@ -40,10 +40,24 @@
 |[Notes on Color usage](/doc/colors_notes.md)|[Makefile vs CMake](/doc/md/Development/Makefile-vs-CMake.md)|[Notes on Cloner guns](/doc/cloner_notes.md)|
 |[Notes on cliparser usage](/doc/cliparser.md)|[Notes on clocks](/doc/clocks.md)||
 
+
 ## Build for non-RDV4 Proxmark3 platforms
 
 In order to build this repo for other Proxmark3 platforms we urge you to read [Advanced compilation parameters](/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md)
 
+With other Proxmark3 platforms we mean: 
+  - RDV1
+  - RDV2
+  - RDV3 easy
+  - Proxmark Evolution (needs extra care)
+  - Radiowar black PCB version
+  - Ryscorp green PCB version
+  - Ryscorp Pm3Pro
+  - VX
+  - numerous Chinese adapted versions of the RDV3 easy (kkmoon, pisworks etc)
+
+### side note about size of these other Proxmark3 platforms
+You need to keep a eye on how large your ARM chip built-in flash memory is. With 512kb you are fine but if its 256kb you need to compile this repo with even less functionality.  When running the ./pm3-flash-all you can see which size your device have if you have the bootloader from this repo installed. Otherwise you will find the size reported in the start message when running the Proxmark3 client.
 
 ## What has changed?
 
@@ -53,7 +67,9 @@ On the hardware side:
   * added smart card module
   * added FPC connector
 
-On the software side: quite a lot, see the [Changelog file](CHANGELOG.md).
+On the software side:
+
+quite a lot, see the [Changelog file](CHANGELOG.md) which we try to keep updated.
 
 ## Development
 
@@ -67,7 +83,7 @@ This repo compiles nicely on
    - ParrotOS, Gentoo, Pentoo, Kali, Nethunter, Archlinux, Fedora, Debian
    - Rasbian
    - Android / Termux
-   - Mac OS X / Homebrew
+   - Mac OS X / Homebrew / Apple Silicon
    - WSL1  (Windows subsystem linux) on Windows 10
    - Docker container
       - [ RRG / Iceman repo based ubuntu 18.04 container ](https://hub.docker.com/r/secopsconsult/proxmark3)
@@ -76,12 +92,12 @@ This repo compiles nicely on
 Hardware to run client on
    - PC
    - Android
-   - Raspberry Pi & Raspberry Pi Zero
+   - Raspberry Pi, Raspberry Pi Zero
    - Nvidia Jetson Nano
 
 ## Precompiled binaries
 We don't maintain any precompiled binaries in this repo. There is community effort over at the Proxmark3 forum where @gator96100 has set up a google drive with many mingw binaries which is up-to-date. We link to these files here as to make it easier for users.
-If you are having troubles with these files, contact the package maintainer @gator96100 and read the [sticky thread at forum](http://www.proxmark.org/forum/viewtopic.php?pid=24763#p24763) where known issues has been documented.
+If you are having troubles with these files, contact the package maintainer [@gator96100](https://github.com/gator96100) and read the [sticky thread at forum](http://www.proxmark.org/forum/viewtopic.php?pid=24763#p24763) where known issues has been documented.
 
 
 Ref:
@@ -104,28 +120,32 @@ We usually merge your contributions fast since we do like the idea of getting a
 
 ## Issues & Troubleshooting
 Please search the [issues](https://github.com/rfidresearchgroup/proxmark3/issues) page here and see if your issue is listed in the first instance.
-Read the [Troubleshooting](/doc/md/Installation_Instructions/Troubleshooting.md) guide to weed out most known problems.
+Read the [Troubleshooting guide](/doc/md/Installation_Instructions/Troubleshooting.md) to weed out most known problems.
 
-Next place to visit is the [Proxmark Forum](http://www.proxmark.org/forum/index.php). Learn to search it well and finally Google / duckduckgo is your friend :)    You will find many blogposts, youtube videos, tweets, reddit
+Next place to visit is the [Proxmark3 Forum](http://www.proxmark.org/forum/index.php). Learn to search it well and finally Google / duckduckgo is your friend :) 
+You will find many blogposts, youtube videos, tweets, reddit
 
 ### Offical channels
+   - [Proxmark3 community discord server](https://discord.gg/QfPvGFRQxH)
    - [Proxmark3 IRC channel](http://webchat.freenode.net/?channels=#proxmark3)
    - [Proxmark3 sub reddit](https://www.reddit.com/r/proxmark3/)
-   - [Twitter](https://twitter.com/proxmark3/)
-   - [Proxmark3 community discord server](https://discord.gg/QfPvGFRQxH)
- 
- _no slack channel_
+   - [Proxmark3 Twitter](https://twitter.com/proxmark3/)   
+   - [Proxmark3 forum](http://www.proxmark.org/forum/index.php)
+   -  _no slack channel_
 
 Iceman has quite a few videos on his [youtube channel](https://www.youtube.com/c/ChrisHerrmann1001)
 
 ## Cheat sheet
 
-Thanks to Alex Dibs, you can enjoy a [command cheat sheet](/doc/cheatsheet.md)
+You can enjoy a [command cheat sheet](/doc/cheatsheet.md) and we are trying to keep it updated. 
+[Thanks to Alex Dib!](https://github.com/scund00r)
 
 ## Maintainers ( package, distro )
 
-To all distro, package maintainers, we tried to make your life easier. `make install` is now available and if you want to know more.
-- [Maintainers](/doc/md/Development/Maintainers.md)
+To all distro, package maintainers, we tried to make your life easier.
+
+`make install` is now available and if you want to know more.
+- [For maintainers](/doc/md/Development/Maintainers.md)
 
 ## Why didn't you base it on official Proxmark3 Master?
 
@@ -134,7 +154,8 @@ The separation from official Proxmark3 repo gives us a lot of freedom to create
 ## Proxmark3 GUI
 
 The official PM3-GUI from Gaucho will not work.
-The new [Proxmark3 Universal GUI](https://github.com/burma69/PM3UniversalGUI) will work more or less. Change is needed in order to show helptext when client isn't connected to a device.  We don't know how active the maintainers.
+
+The new [Proxmark3 Universal GUI](https://github.com/burma69/PM3UniversalGUI) will work more or less. Change is needed in order to show helptext when client isn't connected to a device.  We don't know how active the maintainers are.  There has been brought to our attention that there is quite a few Chinese Windows GUI available. Usually you find them on alibaba / taobao ads but we have no idea which fw/client they are compatible with.  Proceed with caution if you decide to go down that road.
 
 # Donations
 

From 97cb50dace9b161a6e73e919c2f5b1b1db862366 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 14 Jan 2021 11:53:59 +0100
Subject: [PATCH 359/682] text

---
 README.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 4b2b7fed2..0d15c46f5 100644
--- a/README.md
+++ b/README.md
@@ -56,8 +56,7 @@ With other Proxmark3 platforms we mean:
   - VX
   - numerous Chinese adapted versions of the RDV3 easy (kkmoon, pisworks etc)
 
-### side note about size of these other Proxmark3 platforms
-You need to keep a eye on how large your ARM chip built-in flash memory is. With 512kb you are fine but if its 256kb you need to compile this repo with even less functionality.  When running the ./pm3-flash-all you can see which size your device have if you have the bootloader from this repo installed. Otherwise you will find the size reported in the start message when running the Proxmark3 client.
+> ⚠ **Note**: About flash memory size of other Proxmark3 platforms. You need to keep a eye on how large your ARM chip built-in flash memory is. With 512kb you are fine but if its 256kb you need to compile this repo with even less functionality.  When running the `./pm3-flash-all` you can see which size your device have if you have the bootloader from this repo installed. Otherwise you will find the size reported in the start message when running the Proxmark3 client `./pm3`.
 
 ## What has changed?
 

From 69725b929b386308fc4b403169b278051e699759 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Thu, 14 Jan 2021 12:01:31 +0100
Subject: [PATCH 360/682] Add 5opencl to regression tests

---
 tools/hitag2crack/crack5opencl/ht2crack5opencl.c | 6 +++---
 tools/pm3_tests.sh                               | 9 +++++++++
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/tools/hitag2crack/crack5opencl/ht2crack5opencl.c b/tools/hitag2crack/crack5opencl/ht2crack5opencl.c
index c1994c153..bdff13ffc 100644
--- a/tools/hitag2crack/crack5opencl/ht2crack5opencl.c
+++ b/tools/hitag2crack/crack5opencl/ht2crack5opencl.c
@@ -1547,10 +1547,10 @@ int main(int argc, char **argv) {
 
     struct timeval cpu_t_start, cpu_t_end, cpu_t_result;
 
-    fprintf(stderr, "Attack 5 - opencl - start (Max Slices %u, %s order", max_step, wu_queue_strdesc(ctx.queue_ctx.queue_type));
+    printf("Attack 5 - opencl - start (Max Slices %u, %s order", max_step, wu_queue_strdesc(ctx.queue_ctx.queue_type));
 
-    if (!verbose) fprintf(stderr, ")\n\n");
-    else fprintf(stderr, ", Profile %d, Async Threads %s, HiTag2 key verify on device %s)\n\n", profile, (ctx.thread_sched_type == THREAD_TYPE_ASYNC) ? "yes" : "no", (force_hitag2_opencl) ? "yes" : "no");
+    if (!verbose) printf(")\n\n");
+    else printf(", Profile %d, Async Threads %s, HiTag2 key verify on device %s)\n\n", profile, (ctx.thread_sched_type == THREAD_TYPE_ASYNC) ? "yes" : "no", (force_hitag2_opencl) ? "yes" : "no");
 
     if (gettimeofday(&cpu_t_start, NULL) == -1) {
         printf("! gettimeofday(start) failed (%d): %s\n", errno, strerror(errno));
diff --git a/tools/pm3_tests.sh b/tools/pm3_tests.sh
index 36b2a3494..3c59949ee 100755
--- a/tools/pm3_tests.sh
+++ b/tools/pm3_tests.sh
@@ -318,6 +318,15 @@ while true; do
       HT2CRACK5GPUNRAR="B438220C 944FFD74 942C59E3 3D450B34"
       # Order of magnitude to crack it: ~15s -> tagged as "slow"
       if ! CheckExecute slow gpu "ht2crack5gpu test"        "cd $HT2CRACK5GPUPATH; ./ht2crack5gpu $HT2CRACK5GPUUID $HT2CRACK5GPUNRAR" "Key: $HT2CRACK5GPUKEY"; then break; fi
+
+      echo -e "\n${C_BLUE}Testing ht2crack5opencl:${C_NC} ${HT2CRACK5OPENCLPATH:=./tools/hitag2crack/crack5opencl/}"
+      if ! CheckFileExist "ht2crack5opencl exists"            "$HT2CRACK5OPENCLPATH/ht2crack5opencl"; then break; fi
+      HT2CRACK5OPENCLUID=12345678
+      HT2CRACK5OPENCLKEY=AABBCCDDEEFF
+      # The speed depends on the nRaR so we'll use two pairs known to work fast
+      HT2CRACK5OPENCLNRAR="B438220C 944FFD74 942C59E3 3D450B34"
+      # Order of magnitude to crack it: ~15s -> tagged as "slow"
+      if ! CheckExecute slow gpu "ht2crack5opencl test"        "cd $HT2CRACK5OPENCLPATH; ./ht2crack5opencl $HT2CRACK5OPENCLUID $HT2CRACK5OPENCLNRAR" "Key found.*: $HT2CRACK5OPENCLKEY"; then break; fi
     fi
     if $TESTALL || $TESTCLIENT; then
       echo -e "\n${C_BLUE}Testing client:${C_NC} ${CLIENTBIN:=./client/proxmark3}"

From 83532509bfad4884ebfa283654f1c293225be0fa Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 14 Jan 2021 12:08:44 +0100
Subject: [PATCH 361/682] disabled travis CI for repo

---
 .travis.yml => .travis.yml.old |  0
 README.md                      | 12 ++++++------
 2 files changed, 6 insertions(+), 6 deletions(-)
 rename .travis.yml => .travis.yml.old (100%)

diff --git a/.travis.yml b/.travis.yml.old
similarity index 100%
rename from .travis.yml
rename to .travis.yml.old
diff --git a/README.md b/README.md
index 0d15c46f5..95255014d 100644
--- a/README.md
+++ b/README.md
@@ -3,14 +3,14 @@
 
 
 
-| Releases     | Linux & OSX CI       | Windows CI | Coverity    | Contributors |
-| ------------------- |:-------------------:| -------------------:| -------------------:| -------------------:|
-| [![Latest release](https://img.shields.io/github/v/release/rfidresearchgroup/proxmark3)](https://github.com/RfidResearchGroup/proxmark3/releases/latest) | [![Build status](https://api.travis-ci.com/RfidResearchGroup/proxmark3.svg?branch=master)](https://travis-ci.com/RfidResearchGroup/proxmark3) | [![Build status](https://ci.appveyor.com/api/projects/status/b4gwrhq3nc876cuu/branch/master?svg=true)](https://ci.appveyor.com/project/RfidResearchGroup/proxmark3/branch/master) | [![Coverity Status](https://scan.coverity.com/projects/19334/badge.svg)](https://scan.coverity.com/projects/proxmark3-rrg-iceman-repo)| ![GitHub contributors](https://img.shields.io/github/contributors/rfidresearchgroup/proxmark3) |
+| Releases     | Coverity    | Contributors |
+| ------------------- | -------------------:| -------------------:|
+| [![Latest release](https://img.shields.io/github/v/release/rfidresearchgroup/proxmark3)](https://github.com/RfidResearchGroup/proxmark3/releases/latest) | [![Coverity Status](https://scan.coverity.com/projects/19334/badge.svg)](https://scan.coverity.com/projects/proxmark3-rrg-iceman-repo)| ![GitHub contributors](https://img.shields.io/github/contributors/rfidresearchgroup/proxmark3) |
 
 
-| Actions OSX CI    |  Actions Ubuntu CI    | 
-| ------------------- |:-------------------:|
-| ![MacOS Build and Test](https://github.com/RfidResearchGroup/proxmark3/workflows/MacOS%20Build%20and%20Test/badge.svg?branch=master) | ![Ubuntu Build and Test](https://github.com/RfidResearchGroup/proxmark3/workflows/Ubuntu%20Build%20and%20Test/badge.svg?branch=master) |
+| Actions OSX CI    |  Actions Ubuntu CI    | Windows CI |
+| ------------------- | -------------------:| -------------------:|
+| ![MacOS Build and Test](https://github.com/RfidResearchGroup/proxmark3/workflows/MacOS%20Build%20and%20Test/badge.svg?branch=master) | ![Ubuntu Build and Test](https://github.com/RfidResearchGroup/proxmark3/workflows/Ubuntu%20Build%20and%20Test/badge.svg?branch=master) | [![Build status](https://ci.appveyor.com/api/projects/status/b4gwrhq3nc876cuu/branch/master?svg=true)](https://ci.appveyor.com/project/RfidResearchGroup/proxmark3/branch/master) |
 
 
 # PROXMARK INSTALLATION AND OVERVIEW

From 3bb2273705f28c74c10c162bce0428ddebbd8162 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 14 Jan 2021 12:13:39 +0100
Subject: [PATCH 362/682] text

---
 doc/jtag_notes.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/doc/jtag_notes.md b/doc/jtag_notes.md
index 6344bb706..01b964365 100644
--- a/doc/jtag_notes.md
+++ b/doc/jtag_notes.md
@@ -81,3 +81,6 @@ GND | 6
 
 * https://github.com/Proxmark/proxmark3/wiki/De-Bricking-Segger
 
+## Stack Overflow write up article.
+https://stackoverflow.com/questions/48794076/error-halt-timed-out-wake-up-gdb/64291913#64291913
+

From 4e1bf5cb4998e42a07bede596cb4340a55917ff4 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 14 Jan 2021 12:30:30 +0100
Subject: [PATCH 363/682] text

---
 README.md | 27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/README.md b/README.md
index 95255014d..f2349b8dd 100644
--- a/README.md
+++ b/README.md
@@ -43,9 +43,9 @@
 
 ## Build for non-RDV4 Proxmark3 platforms
 
-In order to build this repo for other Proxmark3 platforms we urge you to read [Advanced compilation parameters](/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md)
+In order to build this repo for other/generic Proxmark3 platforms we urge you to read [Advanced compilation parameters](/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md)
 
-With other Proxmark3 platforms we mean: 
+With other/generic Proxmark3 platforms we mean: 
   - RDV1
   - RDV2
   - RDV3 easy
@@ -95,18 +95,15 @@ Hardware to run client on
    - Nvidia Jetson Nano
 
 ## Precompiled binaries
-We don't maintain any precompiled binaries in this repo. There is community effort over at the Proxmark3 forum where @gator96100 has set up a google drive with many mingw binaries which is up-to-date. We link to these files here as to make it easier for users.
+We don't maintain any precompiled binaries in this repo. There is community effort over at the Proxmark3 forum where @gator96100 has set up a AWS bucket with many mingw binaries which is up-to-date. We link to these files here as to make it easier for users.
+
 If you are having troubles with these files, contact the package maintainer [@gator96100](https://github.com/gator96100) and read the [sticky thread at forum](http://www.proxmark.org/forum/viewtopic.php?pid=24763#p24763) where known issues has been documented.
 
 
-Ref:
-For Proxmark3 RDV4
 - [Precompiled builds for RDV40 dedicated x64](https://www.proxmarkbuilds.org/#rdv40-64/)
-
-For Proxmark3 RDV4 with blueshark addon
 - [Precompiled builds for RDV40 dedicated with Bluetooth addon x64](https://www.proxmarkbuilds.org/#rdv40_bt-64/)
 
-Generice Proxmark3 devices (non RDV4),  for Proxmark3 Easy,  RDV1, RDV2, RDV3, etc etc
+Generic Proxmark3 devices (non RDV4),  for Proxmark3 Easy,  RDV1, RDV2, RDV3, etc etc
 - [Precompiled builds for RRG / Iceman repository x64](https://www.proxmarkbuilds.org/#rrg_other-64/)
 
 
@@ -125,14 +122,22 @@ Next place to visit is the [Proxmark3 Forum](http://www.proxmark.org/forum/index
 You will find many blogposts, youtube videos, tweets, reddit
 
 ### Offical channels
-   - [Proxmark3 community discord server](https://discord.gg/QfPvGFRQxH)
+   - [RFID Hacking community discord server](https://discord.gg/QfPvGFRQxH)
    - [Proxmark3 IRC channel](http://webchat.freenode.net/?channels=#proxmark3)
    - [Proxmark3 sub reddit](https://www.reddit.com/r/proxmark3/)
    - [Proxmark3 Twitter](https://twitter.com/proxmark3/)   
    - [Proxmark3 forum](http://www.proxmark.org/forum/index.php)
    -  _no slack channel_
 
-Iceman has quite a few videos on his [youtube channel](https://www.youtube.com/c/ChrisHerrmann1001)
+
+### Youtube channels
+Iceman has quite a few videos on his channel and Quentyn has risen up the last year with good informative videos. We suggest you check them out and smash that subscribe buttons!
+
+ - [Iceman channel](https://www.youtube.com/c/ChrisHerrmann1001)
+ - [Quentyn Taylor](https://www.youtube.com/channel/UCL91C3IZDv3wfj2ABhdRIrw)
+ - [Hacker warehouse channel](https://www.youtube.com/channel/UCimS6P854cQ23j6c_xst7EQ)
+
+_ if you think of some more good youtube channels to be on this list, let us know!_
 
 ## Cheat sheet
 
@@ -144,7 +149,7 @@ You can enjoy a [command cheat sheet](/doc/cheatsheet.md) and we are trying to k
 To all distro, package maintainers, we tried to make your life easier.
 
 `make install` is now available and if you want to know more.
-- [For maintainers](/doc/md/Development/Maintainers.md)
+- [Notes for maintainers](/doc/md/Development/Maintainers.md)
 
 ## Why didn't you base it on official Proxmark3 Master?
 

From 9a2296bebd84651764cfe8f36ec44f494996846a Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 14 Jan 2021 12:31:03 +0100
Subject: [PATCH 364/682] text

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index f2349b8dd..faf669694 100644
--- a/README.md
+++ b/README.md
@@ -137,7 +137,7 @@ Iceman has quite a few videos on his channel and Quentyn has risen up the last y
  - [Quentyn Taylor](https://www.youtube.com/channel/UCL91C3IZDv3wfj2ABhdRIrw)
  - [Hacker warehouse channel](https://www.youtube.com/channel/UCimS6P854cQ23j6c_xst7EQ)
 
-_ if you think of some more good youtube channels to be on this list, let us know!_
+_if you think of some more good youtube channels to be on this list, let us know!_
 
 ## Cheat sheet
 

From 2729ebc5af2bb4e9c3d7895735ba3ec0e57721e6 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 14 Jan 2021 12:48:48 +0100
Subject: [PATCH 365/682] text

---
 README.md | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/README.md b/README.md
index faf669694..7dd5da37c 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,4 @@
-# RRG / Iceman repo - Proxmark3
-
-
+# RRG / Iceman - Proxmark3
 
 
 | Releases     | Coverity    | Contributors |
@@ -13,7 +11,8 @@
 | ![MacOS Build and Test](https://github.com/RfidResearchGroup/proxmark3/workflows/MacOS%20Build%20and%20Test/badge.svg?branch=master) | ![Ubuntu Build and Test](https://github.com/RfidResearchGroup/proxmark3/workflows/Ubuntu%20Build%20and%20Test/badge.svg?branch=master) | [![Build status](https://ci.appveyor.com/api/projects/status/b4gwrhq3nc876cuu/branch/master?svg=true)](https://ci.appveyor.com/project/RfidResearchGroup/proxmark3/branch/master) |
 
 
-# PROXMARK INSTALLATION AND OVERVIEW
+
+# PROXMARK3 INSTALLATION AND OVERVIEW
 
 | FAQ's & Updates     | Installation        | Use of the Proxmark |
 | ------------------- |:-------------------:| -------------------:|
@@ -41,11 +40,13 @@
 |[Notes on cliparser usage](/doc/cliparser.md)|[Notes on clocks](/doc/clocks.md)||
 
 
-## Build for non-RDV4 Proxmark3 platforms
+## Build for Proxmark3 RDV4
+See the instruction links in the tables above to build, flash and run for your Proxmark3 RDV4 device.
 
-In order to build this repo for other/generic Proxmark3 platforms we urge you to read [Advanced compilation parameters](/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md)
+## Build for generic Proxmark3 platforms
+In order to build this repo for generic Proxmark3 platforms we urge you to read [Advanced compilation parameters](/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md)
 
-With other/generic Proxmark3 platforms we mean: 
+With generic Proxmark3 platforms we mean: 
   - RDV1
   - RDV2
   - RDV3 easy
@@ -95,15 +96,16 @@ Hardware to run client on
    - Nvidia Jetson Nano
 
 ## Precompiled binaries
-We don't maintain any precompiled binaries in this repo. There is community effort over at the Proxmark3 forum where @gator96100 has set up a AWS bucket with many mingw binaries which is up-to-date. We link to these files here as to make it easier for users.
-
-If you are having troubles with these files, contact the package maintainer [@gator96100](https://github.com/gator96100) and read the [sticky thread at forum](http://www.proxmark.org/forum/viewtopic.php?pid=24763#p24763) where known issues has been documented.
+We don't maintain any precompiled binaries in this repo. There is community effort over at the Proxmark3 forum where [@gator96100](https://github.com/gator96100) has set up a AWS bucket with precompiled Proxspace (Mingw) binaries which is recompiled every night and with that also up-to-date. We link to these files here as to make it easier for users.
+_If you use his pre-compiled Proxspace binaries do consider buy him a coffee for his efforts. Remember nothing says thank you as good as a donation._
 
+If you are having troubles with these files, contact the package maintainer [@gator96100](https://github.com/gator96100) and read [homepage of his proxmark builds](https://www.proxmarkbuilds.org/) or read the [sticky thread at forum](http://www.proxmark.org/forum/viewtopic.php?pid=24763#p24763) where known issues has been documented with regards to the precompiled builds.  
 
+Proxmark3 RDV4 devices
 - [Precompiled builds for RDV40 dedicated x64](https://www.proxmarkbuilds.org/#rdv40-64/)
 - [Precompiled builds for RDV40 dedicated with Bluetooth addon x64](https://www.proxmarkbuilds.org/#rdv40_bt-64/)
 
-Generic Proxmark3 devices (non RDV4),  for Proxmark3 Easy,  RDV1, RDV2, RDV3, etc etc
+Generic Proxmark3 devices
 - [Precompiled builds for RRG / Iceman repository x64](https://www.proxmarkbuilds.org/#rrg_other-64/)
 
 
@@ -157,7 +159,7 @@ The separation from official Proxmark3 repo gives us a lot of freedom to create
 
 ## Proxmark3 GUI
 
-The official PM3-GUI from Gaucho will not work.
+The official PM3-GUI from Gaucho will not work. Not to mention is quite old and not maintained any longer.
 
 The new [Proxmark3 Universal GUI](https://github.com/burma69/PM3UniversalGUI) will work more or less. Change is needed in order to show helptext when client isn't connected to a device.  We don't know how active the maintainers are.  There has been brought to our attention that there is quite a few Chinese Windows GUI available. Usually you find them on alibaba / taobao ads but we have no idea which fw/client they are compatible with.  Proceed with caution if you decide to go down that road.
 

From 851f5d22bfb9f6e8c483b88c3e14a965bc776925 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 14 Jan 2021 12:50:52 +0100
Subject: [PATCH 366/682] text

---
 README.md | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 7dd5da37c..b2581d98c 100644
--- a/README.md
+++ b/README.md
@@ -97,15 +97,16 @@ Hardware to run client on
 
 ## Precompiled binaries
 We don't maintain any precompiled binaries in this repo. There is community effort over at the Proxmark3 forum where [@gator96100](https://github.com/gator96100) has set up a AWS bucket with precompiled Proxspace (Mingw) binaries which is recompiled every night and with that also up-to-date. We link to these files here as to make it easier for users.
+
 _If you use his pre-compiled Proxspace binaries do consider buy him a coffee for his efforts. Remember nothing says thank you as good as a donation._
 
-If you are having troubles with these files, contact the package maintainer [@gator96100](https://github.com/gator96100) and read [homepage of his proxmark builds](https://www.proxmarkbuilds.org/) or read the [sticky thread at forum](http://www.proxmark.org/forum/viewtopic.php?pid=24763#p24763) where known issues has been documented with regards to the precompiled builds.  
+If you are having troubles with these files, contact the package maintainer [@gator96100](https://github.com/gator96100) and read the [homepage of his proxmark builds](https://www.proxmarkbuilds.org/) or read the [sticky thread at forum](http://www.proxmark.org/forum/viewtopic.php?pid=24763#p24763) where known issues has been documented with regards to the precompiled builds.  
 
-Proxmark3 RDV4 devices
+### Proxmark3 RDV4 devices
 - [Precompiled builds for RDV40 dedicated x64](https://www.proxmarkbuilds.org/#rdv40-64/)
 - [Precompiled builds for RDV40 dedicated with Bluetooth addon x64](https://www.proxmarkbuilds.org/#rdv40_bt-64/)
 
-Generic Proxmark3 devices
+### Generic Proxmark3 devices
 - [Precompiled builds for RRG / Iceman repository x64](https://www.proxmarkbuilds.org/#rrg_other-64/)
 
 

From d7baee2f0c20bfa1a4e875d9a7b9fe5fa135ed54 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 14 Jan 2021 14:23:00 +0100
Subject: [PATCH 367/682] swapped PM3OTHER -> PM3GENERIC,  while keeping
 PM3OTHER functionalitwise for backwards compat.

---
 Makefile.platform.sample                        |  2 +-
 client/src/cmdhw.c                              |  2 +-
 common_arm/Makefile.hal                         | 17 ++++++++++-------
 doc/md/Development/Maintainers.md               | 10 +++++-----
 doc/md/Development/Makefile-vs-CMake.md         |  2 +-
 .../4_Advanced-compilation-parameters.md        | 12 ++++++------
 6 files changed, 24 insertions(+), 21 deletions(-)

diff --git a/Makefile.platform.sample b/Makefile.platform.sample
index 8a31a0e9c..4ecb3b9f6 100644
--- a/Makefile.platform.sample
+++ b/Makefile.platform.sample
@@ -2,7 +2,7 @@
 # Run 'make PLATFORM=' to get an exhaustive list of possible parameters for this file.
 
 PLATFORM=PM3RDV4
-#PLATFORM=PM3OTHER
+#PLATFORM=PM3GENERIC
 # If you want more than one PLATFORM_EXTRAS option, separate them by spaces:
 #PLATFORM_EXTRAS=BTADDON
 #STANDALONE=HF_MSDSAL
diff --git a/client/src/cmdhw.c b/client/src/cmdhw.c
index b97a4f773..5c61d2cf4 100644
--- a/client/src/cmdhw.c
+++ b/client/src/cmdhw.c
@@ -963,7 +963,7 @@ void pm3_version(bool verbose, bool oneliner) {
 
         PrintAndLogEx(NORMAL, "\n [ " _YELLOW_("PROXMARK3") " ]");
         if (IfPm3Rdv4Fw() == false) {
-            PrintAndLogEx(NORMAL, "  firmware.................. %s", _YELLOW_("PM3OTHER"));
+            PrintAndLogEx(NORMAL, "  firmware.................. %s", _YELLOW_("PM3GENERIC"));
             if (IfPm3FpcUsartHost()) {
                 PrintAndLogEx(NORMAL, "  FPC USART for BT add-on... %s", _GREEN_("present"));
             }
diff --git a/common_arm/Makefile.hal b/common_arm/Makefile.hal
index bfbe56d34..d47bb3cf2 100644
--- a/common_arm/Makefile.hal
+++ b/common_arm/Makefile.hal
@@ -17,15 +17,15 @@ Known definitions:
 +============================================+
 | PLATFORM        | DESCRIPTION              |
 +============================================+
-| PM3RDV4 (def)   | Proxmark3 rdv4           |
+| PM3RDV4 (def)   | Proxmark3 RDV4           |
 +--------------------------------------------+
-| PM3OTHER        | Proxmark3 Generic target |
+| PM3GENERIC      | Proxmark3 generic target |
 +--------------------------------------------+
 
 +============================================+
 | PLATFORM_EXTRAS | DESCRIPTION              |
 +============================================+
-| BTADDON         | Proxmark3 rdv4 BT add-on |
+| BTADDON         | Proxmark3 RDV4 BT add-on |
 +--------------------------------------------+
 
 endef
@@ -33,10 +33,10 @@ endef
 define HELP_DEFINITIONS
 Options to define platform, platform extras and/or standalone mode:
 (1) Run make with your PLATFORM, PLATFORM_EXTRAS and/or STANDALONE choices as follows:
-make PLATFORM=PM3OTHER STANDALONE=$(HELP_EXAMPLE_STANDALONE)
+make PLATFORM=PM3GENERIC STANDALONE=$(HELP_EXAMPLE_STANDALONE)
 
 (2) Save a file called Makefile.platform with contents, e.g.:
-PLATFORM=PM3OTHER
+PLATFORM=PM3GENERIC
 
 or if you have a Proxmark 3 RDV4 with the BT add-on:
 PLATFORM=PM3RDV4
@@ -74,9 +74,12 @@ PLTNAME = Unknown Platform
 
 ifeq ($(PLATFORM),PM3RDV4)
     PLATFORM_DEFS = -DWITH_SMARTCARD -DWITH_FLASH -DRDV4
-    PLTNAME = Proxmark3 rdv4
+    PLTNAME = Proxmark3 RDV4
 else ifeq ($(PLATFORM),PM3OTHER)
-    PLTNAME = Proxmark3 Generic target
+    PLTNAME = Proxmark3 generic target
+else ifeq ($(PLATFORM),PM3GENERIC)
+    PLTNAME = Proxmark3 generic target
+
 else
     $(error Invalid or empty PLATFORM: $(PLATFORM). $(KNOWN_DEFINITIONS))
 endif
diff --git a/doc/md/Development/Maintainers.md b/doc/md/Development/Maintainers.md
index 66c736235..9af92bf72 100644
--- a/doc/md/Development/Maintainers.md
+++ b/doc/md/Development/Maintainers.md
@@ -34,17 +34,17 @@ E.g. you might need to move the documentation elsewhere according to your distro
 make install PREFIX=/usr INSTALLDOCSRELPATH=share/doc/proxmark3-${version}
 ```
 
-It's possible to add other firmwares as well with tagged names (`FWTAG=<mytag>`), e.g. here we're compiling another image for non-RDV4 devices:
+It's possible to add other firmwares as well with tagged names (`FWTAG=<mytag>`), e.g. here we're compiling another image for generic Proxmark3 devices:
 
 ```
-make -j fullimage PLATFORM=PM3OTHER PLATFORM_EXTRAS=
-make fullimage/install PLATFORM=PM3OTHER PLATFORM_EXTRAS= DESTDIR=build PREFIX=/usr FWTAG=other
+make -j fullimage PLATFORM=PM3GENERIC PLATFORM_EXTRAS=
+make fullimage/install PLATFORM=PM3GENERIC PLATFORM_EXTRAS= DESTDIR=build PREFIX=/usr FWTAG=generic
 ```
 
-and it will be added along the other firmware as:
+and it will be added along the other firmwares as:
 
 ```
-./build/usr/share/proxmark3/firmware/fullimage-other.elf
+./build/usr/share/proxmark3/firmware/fullimage-generic.elf
 ```
 
 For verbose usage and see the actual commands being executed, add `V=1`.
diff --git a/doc/md/Development/Makefile-vs-CMake.md b/doc/md/Development/Makefile-vs-CMake.md
index 675ba0e96..a6a9c497a 100644
--- a/doc/md/Development/Makefile-vs-CMake.md
+++ b/doc/md/Development/Makefile-vs-CMake.md
@@ -91,7 +91,7 @@ At the moment both are maintained because they don't perfectly overlap yet.
 
 | Feature | Makefile | Remarks |
 |-----|---|---|
-| Platform choice | `PLATFORM=` | values: `PM3RDV4`, `PM3OTHER` |
+| Platform choice | `PLATFORM=` | values: `PM3RDV4`, `PM3GENERIC` |
 | Platform size | `PLATFORM_SIZE=` | values: `256`, `512` |
 | Platform extras | `PLATFORM_EXTRAS=` | values: `BTADDON`, `FPC_USART_DEV` |
 | Skip LF/HF techs in the firmware | `SKIP_`*`=1` | see `common_arm/Makefile.hal` for a list |
diff --git a/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md b/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
index 61ad2d9d8..6dbe54d49 100644
--- a/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
+++ b/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
@@ -29,8 +29,8 @@ make SKIPBT=1
 
 ## Firmware
 
-By default, the firmware is of course tuned for the Proxmark3 Rdv4.0 device, which has built-in support for 256kb onboard flash SPI memory, Sim module (smart card support), FPC connector.
-These features make it very different from all other devices, there is non other like this one.
+By default, the firmware is of course tuned for the Proxmark3 RDV4 device, which has built-in support for 256kb onboard flash SPI memory, Sim module (smart card support), FPC connector.
+These features make it very different from all other Proxmark3 devices, there is non other like this one.
 
 **Recommendation**: if you don't have a RDV4, we strongly recommend your device to have at least a 512kb arm chip, since this repo is crossing 256kb limit. There is still a way to skip parts to make it fit on a 256kb device, see below.
 
@@ -43,8 +43,8 @@ Here are the supported values you can assign to `PLATFORM` in `Makefile.platform
 
 | PLATFORM        | DESCRIPTION              |
 |-----------------|--------------------------|
-| PM3RDV4 (def)   | Proxmark3 rdv4           |
-| PM3OTHER        | Proxmark3 generic target |
+| PM3RDV4 (def)   | Proxmark3 RDV4           |
+| PM3GENERIC      | Proxmark3 generic target |
 
 By default `PLATFORM=PM3RDV4`.
 
@@ -103,7 +103,7 @@ By default `STANDALONE=HF_MSDSAL`.
 
 If you own a Proxmark3 Easy with only 256kb, you can use a few definitions to help you getting a smaller firmware.
 
-First thing is of course to use the `PLATFORM=PM3OTHER`.
+First thing is of course to use the `PLATFORM=PM3GENERIC`.
 Adding `PLATFORM_SIZE=256` will provoke an error during compilation of the recovery image if your image is too big, so you can detect the problem before trying to flash the Proxmark3, e.g.
 ```
 [=] GEN proxmark3_recovery.bin
@@ -133,7 +133,7 @@ a series of `SKIP_*` allow to skip some of the functionalities and to get a smal
 
 So for example, at the time of writing, this is a valid `Makefile.platform` compiling an image for 256k:
 ```
-PLATFORM=PM3OTHER
+PLATFORM=PM3GENERIC
 PLATFORM_SIZE=256
 STANDALONE=
 SKIP_HITAG=1

From b0c160f236947d591bff6090da9c787f7910a0ba Mon Sep 17 00:00:00 2001
From: Niel Nielsen <nieldk@gmail.com>
Date: Thu, 14 Jan 2021 14:34:55 +0100
Subject: [PATCH 368/682] Added honor to Iceman1001

Added star command in honor of @Iceman1001 hard work on this project
---
 client/src/cmdparser.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/client/src/cmdparser.c b/client/src/cmdparser.c
index 137f72dc7..279f87664 100644
--- a/client/src/cmdparser.c
+++ b/client/src/cmdparser.c
@@ -210,6 +210,22 @@ int CmdsParse(const command_t Commands[], const char *Cmd) {
         return PM3_SUCCESS;
     }
 
+    if (strcmp(Cmd, "star") == 0) {
+        PrintAndLogEx(NORMAL, "");
+        PrintAndLogEx(NORMAL, "  \\o       o/");
+        PrintAndLogEx(NORMAL, "   v\\     /v");
+        PrintAndLogEx(NORMAL, "    <\\   />");
+        PrintAndLogEx(NORMAL, "     |\\o/|");
+        PrintAndLogEx(NORMAL, " _\\__o | o__/");
+        PrintAndLogEx(NORMAL, "     |/ \\|");
+        PrintAndLogEx(NORMAL, "    o/   \\o");
+        PrintAndLogEx(NORMAL, "   /v     v\\");
+        PrintAndLogEx(NORMAL, "  />       <\\");
+        PrintAndLogEx(NORMAL, "");
+        return PM3_SUCCESS;
+    }
+
+
     char cmd_name[128];
     memset(cmd_name, 0, sizeof(cmd_name));
 

From 694a48b65a6b9b26de82e51d35db7e78055a9681 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Thu, 14 Jan 2021 14:36:53 +0100
Subject: [PATCH 369/682] text

---
 armsrc/lfops.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/armsrc/lfops.c b/armsrc/lfops.c
index 32c9568d1..f8652c44a 100644
--- a/armsrc/lfops.c
+++ b/armsrc/lfops.c
@@ -154,7 +154,7 @@ t55xx_configurations_t T55xx_Timing  = {
         { 29 * 8, 17 * 8, 15 * 8, 40 * 8, 15 * 8, 0, 0 },           // Leading 0
         { 29 * 8, 17 * 8, 15 * 8, 31 * 8, 15 * 8, 47 * 8, 63 * 8 }  // 1 of 4
 #else
-// PM3OTHER or like offical repo
+// PM3GENERIC or like official repo
         { 31 * 8, 20 * 8, 18 * 8, 50 * 8, 15 * 8, 0, 0 },           // Default Fixed
         { 31 * 8, 20 * 8, 18 * 8, 50 * 8, 15 * 8, 0, 0 },           // Long Leading Ref.
         { 31 * 8, 20 * 8, 18 * 8, 40 * 8, 15 * 8, 0, 0 },           // Leading 0

From 49e32a12ec6c9396b1455c7db2ffb6f2a8f0841e Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Thu, 14 Jan 2021 14:41:08 +0100
Subject: [PATCH 370/682] Add warning for deprecated PM3OTHER

---
 common_arm/Makefile.hal | 1 +
 1 file changed, 1 insertion(+)

diff --git a/common_arm/Makefile.hal b/common_arm/Makefile.hal
index d47bb3cf2..cda6ac1b9 100644
--- a/common_arm/Makefile.hal
+++ b/common_arm/Makefile.hal
@@ -76,6 +76,7 @@ ifeq ($(PLATFORM),PM3RDV4)
     PLATFORM_DEFS = -DWITH_SMARTCARD -DWITH_FLASH -DRDV4
     PLTNAME = Proxmark3 RDV4
 else ifeq ($(PLATFORM),PM3OTHER)
+    $(warning PLATFORM=PM3OTHER is deprecated, please use PLATFORM=PM3GENERIC)
     PLTNAME = Proxmark3 generic target
 else ifeq ($(PLATFORM),PM3GENERIC)
     PLTNAME = Proxmark3 generic target

From 3ecebacdd2370dc0d068fe8abc2ea78f4cf23e39 Mon Sep 17 00:00:00 2001
From: Gabriele Gristina <matrix@users.noreply.github.com>
Date: Sat, 16 Jan 2021 01:08:30 +0100
Subject: [PATCH 371/682] move thread scheduler threads.c, move opencl engine
 in opencl.c, minor fixes

---
 .../crack5opencl/ht2crack5opencl.c            | 733 ++----------------
 tools/hitag2crack/crack5opencl/opencl.c       | 446 +++++++++++
 tools/hitag2crack/crack5opencl/opencl.h       |  15 +-
 tools/hitag2crack/crack5opencl/queue.c        |   4 +-
 tools/hitag2crack/crack5opencl/queue.h        |   2 +-
 tools/hitag2crack/crack5opencl/threads.c      | 265 ++++++-
 tools/hitag2crack/crack5opencl/threads.h      |  12 +-
 7 files changed, 753 insertions(+), 724 deletions(-)

diff --git a/tools/hitag2crack/crack5opencl/ht2crack5opencl.c b/tools/hitag2crack/crack5opencl/ht2crack5opencl.c
index bdff13ffc..87fb2c765 100644
--- a/tools/hitag2crack/crack5opencl/ht2crack5opencl.c
+++ b/tools/hitag2crack/crack5opencl/ht2crack5opencl.c
@@ -151,7 +151,7 @@ static bool parse_arg(char *restrict in, unsigned int *out, unsigned int *out_cn
                 unsigned int tmp_sel = (unsigned int) strtoul(next, NULL, 10);
                 if (errno == EINVAL || errno == ERANGE ||
                         (tmp_sel < 1 || tmp_sel > 16)) {
-                    printf("! Invalid %s argument\n", (opt_type == 0) ? "'platform'" : "'device'");
+                    printf("Error: invalid %s argument\n", (opt_type == 0) ? "'platform'" : "'device'");
                     return false;
                 }
 
@@ -165,7 +165,7 @@ static bool parse_arg(char *restrict in, unsigned int *out, unsigned int *out_cn
         } else {
             out[0] = (unsigned int) strtoul(in, NULL, 10);
             if (errno == EINVAL || errno == ERANGE) {
-                printf("! Invalid %s argument\n", (opt_type == 0) ? "'platform'" : "'device'");
+                printf("Error: invalid %s argument\n", (opt_type == 0) ? "'platform'" : "'device'");
                 return false;
             }
             *out_cnt = 1;
@@ -191,7 +191,6 @@ int main(int argc, char **argv) {
     unsigned int profile_selected = 2;
     unsigned int queue_type = 0;
 
-    uint32_t target = 0;
     uint32_t **matches_found = NULL;
     uint64_t **matches = NULL;
 
@@ -211,7 +210,7 @@ int main(int argc, char **argv) {
                 // 0: gpu, 1: cpu, 2: all
                 device_types_selected = (unsigned int) strtoul(optarg, NULL, 10);
                 if (device_types_selected > 2) {
-                    printf("! Invalid DEVICE TYPE argument (accepted values: from 0 to 2)\n");
+                    printf("Error: invalid DEVICE TYPE argument (accepted values: from 0 to 2)\n");
                     usage(argv[0]);
                 }
                 break;
@@ -222,7 +221,7 @@ int main(int argc, char **argv) {
             case 'P':
                 profile_selected = (unsigned int) strtoul(optarg, NULL, 10);
                 if (profile_selected > 10) {
-                    printf("! Invalid PROFILE argument (accepted valuee: from 0 to 10)\n");
+                    printf("Error: invalid PROFILE argument (accepted valuee: from 0 to 10)\n");
                     usage(argv[0]);
                 }
                 break;
@@ -233,7 +232,7 @@ int main(int argc, char **argv) {
                 // 0: forward, 1: reverse, 2: random
                 queue_type = (unsigned int) strtoul(optarg, NULL, 10);
                 if (queue_type != QUEUE_TYPE_FORWARD && queue_type != QUEUE_TYPE_REVERSE && queue_type != QUEUE_TYPE_RANDOM) {
-                    printf("! Invalid QUEUE TYPE argument (accepted values: 0, 1 or 2)\n");
+                    printf("Error: invalid QUEUE TYPE argument (accepted values: 0, 1 or 2)\n");
                     usage(argv[0]);
                 }
                 break;
@@ -298,13 +297,13 @@ int main(int argc, char **argv) {
 
         printf("Device types selected : %s\n", (device_types_selected == CL_DEVICE_TYPE_GPU) ? "GPU" : (device_types_selected == CL_DEVICE_TYPE_CPU) ? "CPU" : "ALL");
         printf("Scheduler selected    : %s\n", (thread_scheduler_type_selected == 0) ? "sequential" : "async");
-        printf("Profile selected      : %d\n", profile_selected);
+        printf("Profile selected      : %u\n", profile_selected);
     }
 
     if (!show) {
         if ((argc - optind) < 5) {
 #if DEBUGME > 0
-            printf("! Invalid extra arguments\n");
+            printf("Error: invalid extra arguments\n");
 #endif
             usage(argv[0]);
         }
@@ -313,41 +312,41 @@ int main(int argc, char **argv) {
             switch (e) {
                 case 0: // UID
                     if (!strncmp(argv[optind], "0x", 2) || !strncmp(argv[optind], "0X", 2)) {
-                        if (strlen(argv[optind]) != 2 + 8) { printf("! Invalid UID length\n"); usage(argv[0]); }
+                        if (strlen(argv[optind]) != 2 + 8) { printf("Error: invalid UID length\n"); usage(argv[0]); }
                         uid = (uint32_t) rev32(hexreversetoulong(argv[optind] + 2));
                     } else {
-                        if (strlen(argv[optind]) != 8) { printf("! Invalid UID length\n"); usage(argv[0]); }
+                        if (strlen(argv[optind]) != 8) { printf("Error: invalid UID length\n"); usage(argv[0]); }
                         uid = (uint32_t) rev32(hexreversetoulong(argv[optind]));
                     }
                     break;
 
                 case 1: // nR1
                     if (!strncmp(argv[optind], "0x", 2) || !strncmp(argv[optind], "0X", 2)) {
-                        if (strlen(argv[optind]) != 2 + 8) { printf("! Invalid nR1 length\n"); usage(argv[0]); }
+                        if (strlen(argv[optind]) != 2 + 8) { printf("Error: invalid nR1 length\n"); usage(argv[0]); }
                         nR1 = (uint32_t) rev32(hexreversetoulong(argv[optind] + 2));
                     } else {
-                        if (strlen(argv[optind]) != 8) { printf("! Invalid nR1 length\n"); usage(argv[0]); }
+                        if (strlen(argv[optind]) != 8) { printf("Error: invalid nR1 length\n"); usage(argv[0]); }
                         nR1 = (uint32_t) rev32(hexreversetoulong(argv[optind]));
                     }
                     break;
 
                 case 2: // aR1
-                    if (strlen(argv[optind]) != 8) { printf("! Invalid aR1 length\n"); usage(argv[0]); }
+                    if (strlen(argv[optind]) != 8) { printf("Error: invalid aR1 length\n"); usage(argv[0]); }
                     aR1 = (uint32_t) strtoul(argv[optind], NULL, 16);
                     break;
 
                 case 3: // nR2
                     if (!strncmp(argv[optind], "0x", 2) || !strncmp(argv[optind], "0X", 2)) {
-                        if (strlen(argv[optind]) != 2 + 8) { printf("! Invalid nR2 length\n"); usage(argv[0]); }
+                        if (strlen(argv[optind]) != 2 + 8) { printf("Error: invalid nR2 length\n"); usage(argv[0]); }
                         nR2 = (uint32_t) rev32(hexreversetoulong(argv[optind] + 2));
                     } else {
-                        if (strlen(argv[optind]) != 8) { printf("! Invalid nR2 length\n"); usage(argv[0]); }
+                        if (strlen(argv[optind]) != 8) { printf("Error: invalid nR2 length\n"); usage(argv[0]); }
                         nR2 = (uint32_t) rev32(hexreversetoulong(argv[optind]));
                     }
                     break;
 
                 case 4: // aR2
-                    if (strlen(argv[optind]) != 8) { printf("! Invalid aR2 length\n"); usage(argv[0]); }
+                    if (strlen(argv[optind]) != 8) { printf("Error: invalid aR2 length\n"); usage(argv[0]); }
                     aR2 = (uint32_t) strtoul(argv[optind], NULL, 16);
                     break;
 
@@ -371,7 +370,7 @@ int main(int argc, char **argv) {
     if (!show) {
         if (verbose) printf("uid: %u, aR2: %u, nR1: %u, nR2: %u\n", checks[0], checks[1], checks[2], checks[3]);
 
-        target = ~aR1;
+        uint32_t target = ~aR1;
         // bitslice inverse target bits
         bitslice(~target, keystream);
 
@@ -446,389 +445,33 @@ int main(int argc, char **argv) {
         close(fd);
     }
 
-    // now discover and set up compute device(s)
     int err = 0;
     cl_uint ocl_platform_cnt = 0;
-    unsigned int ocl_platform_max = MAX_OPENCL_DEVICES; // 16
-
-    cl_platform_id *ocl_platforms = (cl_platform_id *) calloc(ocl_platform_max, sizeof(cl_platform_id));
-    if (!ocl_platforms) {
-        printf("Error: calloc (ocl_platforms) failed (%d): %s\n", errno, strerror(errno));
-        MEMORY_FREE_ALL
-        exit(2);
-    }
-
-    MEMORY_FREE_ADD(ocl_platforms)
-
-    // enum platforms
-    err = clGetPlatformIDs(ocl_platform_max, ocl_platforms, &ocl_platform_cnt);
-    if (err != CL_SUCCESS) {
-        printf("Error: clGetPlatformIDs() failed (%d)\n", err);
-        MEMORY_FREE_ALL
-        exit(2);
-    }
-
-    if (ocl_platform_cnt == 0) {
-        printf("No platforms found, exit\n");
-        MEMORY_FREE_ALL
-        exit(2);
-    }
-
-    // allocate memory to hold info about platforms/devices
-    compute_platform_ctx_t *cd_ctx = (compute_platform_ctx_t *) calloc(ocl_platform_cnt, sizeof(compute_platform_ctx_t));
-    if (!cd_ctx) {
-        printf("Error: calloc (compute_platform_ctx_t) failed (%d): %s\n", errno, strerror(errno));
-        MEMORY_FREE_ALL
-        exit(err);
-    }
-
-    MEMORY_FREE_ADD(cd_ctx)
-
-    cl_platform_info ocl_platforms_info[3] = { CL_PLATFORM_NAME, CL_PLATFORM_VENDOR, CL_PLATFORM_VERSION };
-    unsigned int ocl_platforms_info_cnt = sizeof(ocl_platforms_info) / sizeof(cl_platform_info);
-
-    cl_device_info ocl_devices_info[8] = { CL_DEVICE_TYPE, CL_DEVICE_NAME, CL_DEVICE_VERSION, CL_DRIVER_VERSION, CL_DEVICE_VENDOR, CL_DEVICE_LOCAL_MEM_TYPE, CL_DEVICE_MAX_WORK_ITEM_SIZES, CL_DEVICE_MAX_COMPUTE_UNITS };
-    unsigned int ocl_devices_info_cnt = sizeof(ocl_devices_info) / sizeof(cl_device_info);
-
-    unsigned int info_idx = 0;
-    size_t tmp_len = 0;
-    char *tmp_buf = NULL;
-
-    unsigned int global_device_id = 0;
     size_t selected_platforms_cnt = 0;
     size_t selected_devices_cnt = 0;
+    compute_platform_ctx_t *cd_ctx = NULL;
 
     if (show) verbose = true;
 
-    if (verbose) printf("- Found %u OpenCL Platform(s)\n", ocl_platform_cnt);
-
-    for (cl_uint platform_idx = 0; platform_idx < ocl_platform_cnt; platform_idx++) {
-        cd_ctx[platform_idx].platform_id = ocl_platforms[platform_idx];
-        cd_ctx[platform_idx].selected = plat_dev_enabled(platform_idx, plat_sel, plat_cnt, 0, 0);
-
-        if (cd_ctx[platform_idx].selected) selected_platforms_cnt++;
-
-        if (verbose) printf("\n-- Platform ID: %d\n", platform_idx + 1);
-
-        for (info_idx = 0; info_idx < ocl_platforms_info_cnt; info_idx++) {
-            cl_platform_info ocl_info = ocl_platforms_info[info_idx];
-
-            err = clGetPlatformInfo(cd_ctx[platform_idx].platform_id, ocl_info, 0, NULL, &tmp_len);
-            if (err != CL_SUCCESS) {
-                printf("Error: clGetPlatformInfo(param size) failed (%d)\n", err);
-                MEMORY_FREE_ALL
-                exit(2);
-            }
-
-            if (tmp_len > 0) {
-                if (!(tmp_buf = (char *) calloc(tmp_len, sizeof(char)))) {
-                    printf("Error: calloc (ocl_info %u) failed (%d): %s\n", info_idx, errno, strerror(errno));
-                    MEMORY_FREE_ALL
-                    exit(2);
-                }
-
-                MEMORY_FREE_ADD(tmp_buf)
-
-                err = clGetPlatformInfo(cd_ctx[platform_idx].platform_id, ocl_info, tmp_len, tmp_buf, 0);
-                if (err != CL_SUCCESS) {
-                    printf("Error: clGetPlatformInfo(param) failed (%d)\n", err);
-                    MEMORY_FREE_ALL
-                    exit(2);
-                }
-            } else {
-                tmp_len = 4;
-                if (!(tmp_buf = (char *) calloc(tmp_len, sizeof(char)))) {
-                    printf("Error: calloc (ocl_info %u) failed (%d): %s\n", info_idx, errno, strerror(errno));
-                    MEMORY_FREE_ALL
-                    exit(2);
-                }
-
-                MEMORY_FREE_ADD(tmp_buf)
-
-                strncpy(tmp_buf, "N/A\0", tmp_len);
-            }
-
-            if (verbose) {
-                const char *tmp_info_desc = (info_idx == 0) ? "Name" : (info_idx == 1) ? "Vendor" : "Version";
-
-                printf("%14s: %s\n", tmp_info_desc, tmp_buf);
-            }
-
-            switch (info_idx) {
-                case 0:
-                    strncpy(cd_ctx[platform_idx].name, tmp_buf, tmp_len < 0xff ? tmp_len : 0xff - 1);
-                    break;
-                case 1:
-                    strncpy(cd_ctx[platform_idx].vendor, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40 - 1);
-                    break;
-                case 2:
-                    strncpy(cd_ctx[platform_idx].version, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40 - 1);
-                    break;
-            }
-
-            if (info_idx == 1) {
-                // todo: do the same this devices
-                if (!strncmp(tmp_buf, "NVIDIA", 6)) cd_ctx[platform_idx].is_nv = true;
-                else if (!strncmp(tmp_buf, "Apple", 5)) { cd_ctx[platform_idx].is_apple = true; cd_ctx[platform_idx].warning = true; }
-                else if (!strncmp(tmp_buf, "Intel", 5)) cd_ctx[platform_idx].is_intel = true;
-            }
-
-            MEMORY_FREE_DEL(tmp_buf)
-        }
-
-        if (!show && verbose) {
-            printf("%14s: %s\n", "Selected", (cd_ctx[platform_idx].selected) ? "yes" : "no");
-            if (cd_ctx[platform_idx].warning) printf("\n%14s: performance will not be optimal using this platform\n\n", "=====> Warning");
-        }
-
-        // enum devices with this platform
-        unsigned int ocl_device_cnt = 0;
-        unsigned int ocl_device_max = MAX_OPENCL_DEVICES;
-
-        cl_device_id *ocl_devices = (cl_device_id *) calloc(ocl_device_max, sizeof(cl_device_id));
-        if (!ocl_devices) {
-            printf("Error: calloc (ocl_devices) failed (%d): %s\n", errno, strerror(errno));
-            MEMORY_FREE_ALL
-            exit(2);
-        }
-
-        MEMORY_FREE_ADD(ocl_devices)
-
-        err = clGetDeviceIDs(cd_ctx[platform_idx].platform_id, CL_DEVICE_TYPE_ALL, ocl_device_max, ocl_devices, &ocl_device_cnt);
-        if (ocl_device_cnt == 0) {
-            if (device_types_selected == CL_DEVICE_TYPE_ALL) printf("No device(s) available with platform id %d\n", platform_idx);
-            cd_ctx[platform_idx].device_cnt = 0;
-            continue;
-        }
-
-        if (err != CL_SUCCESS) {
-            printf("Error: clGetDeviceIDs(cnt) failed (%d)\n", err);
-            MEMORY_FREE_ALL
-            exit(2);
-        }
-
-        if (verbose) printf("%14s: %u\n", "Device(s)", ocl_device_cnt);
-
-        cd_ctx[platform_idx].device_cnt = ocl_device_cnt;
-
-        for (unsigned int device_idx = 0; device_idx < ocl_device_cnt; device_idx++) {
-            memset(&cd_ctx[platform_idx].device[device_idx], 0, sizeof(compute_device_ctx_t));
-            cl_device_id ocl_device = ocl_devices[device_idx];
-            cd_ctx[platform_idx].device[device_idx].platform_id = cd_ctx[platform_idx].platform_id;
-
-            if (verbose) printf("---- * ID: %u\n", global_device_id + 1);
-
-            for (info_idx = 0; info_idx < ocl_devices_info_cnt; info_idx++) {
-                cl_device_info ocl_dev_info = ocl_devices_info[info_idx];
-
-                if (info_idx == 0) {
-                    cl_device_type device_type;
-
-                    err = clGetDeviceInfo(ocl_device, ocl_dev_info, sizeof(cl_device_type), &device_type, 0);
-                    if (err != CL_SUCCESS) {
-                        printf("Error: clGetDeviceInfo(device_type) failed (%d)\n", err);
-                        MEMORY_FREE_ALL
-                        exit(2);
-                    }
-
-                    if (device_type & CL_DEVICE_TYPE_GPU) cd_ctx[platform_idx].device[device_idx].is_gpu = 1;
-
-                    if (verbose) printf("%14s: %s\n", "Device Type", (device_type & CL_DEVICE_TYPE_GPU) ? "GPU" : (device_type & CL_DEVICE_TYPE_CPU) ? "CPU" : "Other");
-
-                    cd_ctx[platform_idx].device[device_idx].selected = plat_dev_enabled(global_device_id, dev_sel, dev_cnt, (unsigned int) device_type, device_types_selected);
-                    global_device_id++;
-                    if (cd_ctx[platform_idx].device[device_idx].selected) selected_devices_cnt++;
-                    continue;
-                } else if (info_idx == 5) {
-                    cl_device_local_mem_type local_mem_type;
-
-                    err = clGetDeviceInfo(ocl_device, ocl_dev_info, sizeof(cl_device_local_mem_type), &local_mem_type, 0);
-                    if (err != CL_SUCCESS) {
-                        printf("Error: clGetDeviceInfo(local_mem_type) failed (%d)\n", err);
-                        MEMORY_FREE_ALL
-                        exit(2);
-                    }
-
-                    if (local_mem_type == CL_LOCAL || local_mem_type == CL_GLOBAL) {
-                        if (verbose) printf("%14s: %s\n", "Local Mem Type", (local_mem_type == CL_LOCAL) ? "Local" : "Global");
-
-                        if (cd_ctx[platform_idx].is_apple) {
-                            if (strncmp(cd_ctx[platform_idx].device[device_idx].vendor, "Intel", 5) != 0) cd_ctx[platform_idx].device[device_idx].have_local_memory = true;
-                        } else if (cd_ctx[platform_idx].is_nv) cd_ctx[platform_idx].device[device_idx].have_local_memory = true;
-                        /*
-                        						// swap the 'if' comment for enable local memory with apple gpu's (my Iris crash, abort 6)
-                        						// if (!(!strncmp (cd_ctx[platform_idx].device[device_idx].vendor, "Intel", 5) && cd_ctx[platform_idx].is_apple && !cd_ctx[platform_idx].device[device_idx].is_gpu))
-                        						if (!(!strncmp (cd_ctx[platform_idx].device[device_idx].vendor, "Intel", 5) && cd_ctx[platform_idx].is_apple))
-                        						{
-                        							cd_ctx[platform_idx].device[device_idx].have_local_memory = true;
-                        						}
-                        */
-                    } else {
-                        if (verbose) printf("%14s: None\n", "Local Mem Type");
-                    }
-
-                    if (verbose) printf("%14s: %s\n", "Local Mem Opt", (cd_ctx[platform_idx].device[device_idx].have_local_memory) ? "yes" : "no");
-
-                    continue;
-                } else if (info_idx == 6) {
-                    size_t wis[3] = { 0 };
-                    err = clGetDeviceInfo(ocl_device, ocl_dev_info, sizeof(size_t) * 3, wis, 0);
-                    if (err != CL_SUCCESS) {
-                        printf("Error: clGetDeviceInfo(work_items_size) failed (%d)\n", err);
-                        MEMORY_FREE_ALL
-                        exit(2);
-                    }
-
-                    if (verbose) printf("%14s: (%zu,%zu,%zu)\n", "Max Work-Items", wis[0], wis[1], wis[2]);
-
-#if APPLE_GPU_BROKEN == 1
-                    if (wis[1] < GLOBAL_WS_1 && cd_ctx[platform_idx].device[device_idx].is_apple_gpu) {
-                        cd_ctx[platform_idx].device[device_idx].unsupported = true;
-                    }
-#endif
-                    continue;
-                } else if (info_idx == 7) {
-                    cl_uint cores = 0;
-                    err = clGetDeviceInfo(ocl_device, ocl_dev_info, sizeof(cl_uint), &cores, 0);
-                    if (err != CL_SUCCESS) {
-                        printf("Error: clGetDeviceInfo(compute_units) failed (%d)\n", err);
-                        MEMORY_FREE_ALL
-                        exit(2);
-                    }
-
-                    if (verbose) printf("%14s: %u\n", "Compute Units", cores);
-
-                    cd_ctx[platform_idx].device[device_idx].compute_units = cores;
-                    continue;
-                }
-
-                tmp_len = 0;
-                tmp_buf = NULL;
-
-                err = clGetDeviceInfo(ocl_device, ocl_dev_info, 0, NULL, &tmp_len);
-                if (err != CL_SUCCESS) {
-                    printf("Error: clGetDeviceInfo(param size) failed (%d)\n", err);
-                    MEMORY_FREE_ALL
-                    exit(2);
-                }
-
-                if (tmp_len > 0) {
-                    if (!(tmp_buf = (char *) calloc(tmp_len, sizeof(char)))) {
-                        printf("Error: calloc (ocl_dev_info %u) failed (%d): %s\n", info_idx, errno, strerror(errno));
-                        MEMORY_FREE_ALL
-                        exit(2);
-                    }
-
-                    MEMORY_FREE_ADD(tmp_buf)
-
-                    err = clGetDeviceInfo(ocl_device, ocl_dev_info, tmp_len, tmp_buf, 0);
-                    if (err != CL_SUCCESS) {
-                        printf("Error: clGetDeviceInfo(param) failed (%d)\n", err);
-                        MEMORY_FREE_ALL
-                        exit(2);
-                    }
-                } else {
-                    tmp_len = 4;
-                    if (!(tmp_buf = (char *) calloc(tmp_len, sizeof(char)))) {
-                        printf("Error: calloc (ocl_dev_info %u) failed (%d): %s\n", info_idx, errno, strerror(errno));
-                        MEMORY_FREE_ALL
-                        exit(2);
-                    }
-
-                    MEMORY_FREE_ADD(tmp_buf)
-
-                    strncpy(tmp_buf, "N/A\0", tmp_len);
-                }
-
-                if (verbose) {
-                    const char *tmp_dev_info_desc = (info_idx == 1) ? "Name" : (info_idx == 2) ? "Version" : (info_idx == 3) ? "Driver Version" : "Vendor";
-
-                    printf("%14s: %s\n", tmp_dev_info_desc, tmp_buf);
-                }
-
-                switch (info_idx) {
-                    case 1:
-                        strncpy(cd_ctx[platform_idx].device[device_idx].name, tmp_buf, tmp_len < 0xff ? tmp_len : 0xff - 1);
-                        break;
-                    case 2:
-                        strncpy(cd_ctx[platform_idx].device[device_idx].version, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40 - 1);
-                        break;
-                    case 3:
-                        strncpy(cd_ctx[platform_idx].device[device_idx].driver_version, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40 - 1);
-                        break;
-                    case 4:
-                        strncpy(cd_ctx[platform_idx].device[device_idx].vendor, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40 - 1);
-                        break;
-                }
-
-                if (info_idx == 4) {
-                    if (!strncmp(tmp_buf, "Intel", 5) && cd_ctx[platform_idx].is_apple) {
-                        // disable hitag2 with apple platform and not apple device vendor (< Apple M1)
-                        ctx.force_hitag2_opencl = false;
-
-                        cd_ctx[platform_idx].device[device_idx].is_apple_gpu = cd_ctx[platform_idx].device[device_idx].is_gpu;
-                    }
-
-                    if (!strncmp(tmp_buf, "NVIDIA", 6) && cd_ctx[platform_idx].is_nv) {
-                        unsigned int sm_maj = 0, sm_min = 0;
-
-                        err  = clGetDeviceInfo(ocl_device, 0x4000, sizeof(unsigned int), &sm_maj, 0);
-                        err |= clGetDeviceInfo(ocl_device, 0x4001, sizeof(unsigned int), &sm_min, 0);
-
-                        if (err != CL_SUCCESS) {
-                            printf("Error: clGetDeviceInfo(sm_maj/sm_min) failed (%d)\n", err);
-                            MEMORY_FREE_ALL
-                            exit(2);
-                        }
-
-                        cd_ctx[platform_idx].device[device_idx].sm_maj = sm_maj;
-                        cd_ctx[platform_idx].device[device_idx].sm_min = sm_min;
-
-                        if (verbose) printf("%14s: %u%u\n", "SM", sm_maj, sm_min);
-
-                        if (sm_maj >= 5) { // >= Maxwell
-                            // https://docs.nvidia.com/cuda/parallel-thread-execution/index.html#logic-and-shift-instructions-lop3
-                            // Requires sm_50 or higher.
-                            cd_ctx[platform_idx].device[device_idx].have_lop3 = true;
-                        } else {
-                            cd_ctx[platform_idx].device[device_idx].warning = true;
-                        }
-
-                        cd_ctx[platform_idx].device[device_idx].is_nv = true;
-                    } else {
-                        cd_ctx[platform_idx].device[device_idx].warning = true;
-                    }
-                }
-
-                MEMORY_FREE_DEL(tmp_buf)
-            }
-
-            if (!show && verbose) printf("%14s: %s\n", "Selected", (cd_ctx[platform_idx].device[device_idx].selected) ? "yes" : "no");
-
-            if (cd_ctx[platform_idx].device[device_idx].unsupported) {
-                printf("\n%14s: this device was not supported, beacuse of missing resources\n\n", "=====> Warning");
-                continue;
-            }
-
-            if (cd_ctx[platform_idx].device[device_idx].warning) {
-                if (!show && verbose) printf("\n%14s: performance will not be optimal using this device\n\n", "=====> Warning");
-            }
-
-            cd_ctx[platform_idx].device[device_idx].device_id = ocl_device;
-        }
-        MEMORY_FREE_DEL(ocl_devices)
+    // now discover and set up compute device(s)
+    if ((err = discoverDevices(profile_selected, device_types_selected, &ocl_platform_cnt, &selected_platforms_cnt, &selected_devices_cnt, &cd_ctx, plat_sel, plat_cnt, dev_sel, dev_cnt, verbose, show)) != 0)
+    {
+      printf ("Error: discoverDevices() failed\n");
+      if (err < -5) free (cd_ctx);
+      MEMORY_FREE_ALL
+      exit (2);
     }
-    MEMORY_FREE_DEL(ocl_platforms)
-
-    // new selection engine, need to support multi-gpu system (with the same platform)
 
     if (verbose) printf("\n");
 
+    // new selection engine, need to support multi-gpu system (with the same platform)
     if (show) {
         MEMORY_FREE_ALL
         exit(2);
     }
 
+    MEMORY_FREE_ADD(cd_ctx)
+
     if (selected_platforms_cnt == 0) {
         printf("! No platform was selected ...\n");
         MEMORY_FREE_ALL
@@ -855,6 +498,11 @@ int main(int argc, char **argv) {
         for (q = 0; q < cd_ctx[w].device_cnt; q++) {
             if (!cd_ctx[w].device[q].selected) continue;
 
+            if (cd_ctx[w].is_apple && !strncmp(cd_ctx[w].device[q].vendor, "Intel", 5)) {
+                // disable hitag2 with apple platform and not apple device vendor (< Apple M1)
+                ctx.force_hitag2_opencl = false;
+            }
+
             printf("%2zu - %s", z, cd_ctx[w].device[q].name);
             if (verbose) {
                 printf(" (Lop3 %s, ", (cd_ctx[w].device[q].have_lop3) ? "yes" : "no");
@@ -989,14 +637,6 @@ int main(int argc, char **argv) {
 
     MEMORY_FREE_ADD(ctx.local_ws)
 
-    if (!(ctx.profiles = (int *) calloc(selected_devices_cnt, sizeof(int)))) {
-        printf("Error: calloc (ctx.profiles) failed (%d): %s\n", errno, strerror(errno));
-        MEMORY_FREE_ALL
-        exit(2);
-    }
-
-    MEMORY_FREE_ADD(ctx.profiles)
-
     // show buidlog in case of error
     // todo: only for device models
     unsigned int build_errors = 0;
@@ -1121,7 +761,6 @@ int main(int argc, char **argv) {
                 if (err != CL_SUCCESS) {
                     printf("[%zu] Error: clGetProgramBuildInfo failed (%d)\n", z, err);
                     continue;
-//					exit (2);
                 }
 
                 if (len == 0) continue;
@@ -1132,17 +771,13 @@ int main(int argc, char **argv) {
                 if (!buffer) {
                     printf("[%zu] Error: calloc (CL_PROGRAM_BUILD_LOG) failed (%d): %s\n", z, errno, strerror(errno));
                     continue;
-//					exit (2);
                 }
 
-                MEMORY_FREE_ADD(buffer)
-
                 err = clGetProgramBuildInfo(ctx.programs[z], cd_ctx[w].device[q].device_id, CL_PROGRAM_BUILD_LOG, len, buffer, 0);
                 if (err != CL_SUCCESS) {
                     printf("[%zu] clGetProgramBuildInfo() failed (%d)\n", z, err);
-                    MEMORY_FREE_DEL(buffer)
+                    free (buffer);
                     continue;
-//					exit (2);
                 }
 
 #if DEBUGME > 0
@@ -1152,7 +787,7 @@ int main(int argc, char **argv) {
                     printf("[%zu] Build log (len %zu):\n--------\n%s\n--------\n", z, len, buffer);
                 }
 
-                MEMORY_FREE_DEL(buffer)
+                free (buffer);
 
                 build_logs++;
 #if DEBUGME == 0
@@ -1196,76 +831,13 @@ int main(int argc, char **argv) {
         }
     }
 
-    // z is device counter, dolphin counter as well
-
     // setup, phase 2 (select lower profile)
-
-    int profile = 0xff;
-
-    g = 0;
-
-    for (w = 0; w < ocl_platform_cnt; w++) {
-        if (!cd_ctx[w].selected) continue;
-
-        for (q = 0; q < cd_ctx[w].device_cnt; q++) {
-            if (!cd_ctx[w].device[q].selected) continue;
-
-            ctx.profiles[g] = (int) profile_selected; // start with default
-
-#if DEBUGME > 1
-            printf("[debug] Initial profile for device %zu: %d\n", z, ctx.profiles[g]);
-#endif
-
-            // force profile to 0 with Apple GPU's to get it stable, and 1 for CPU
-            if (cd_ctx[w].is_apple && !strncmp(cd_ctx[w].device[q].vendor, "Intel", 5)) {
-                if (cd_ctx[w].device[q].is_gpu) {
-                    if (profile_selected > 2) ctx.profiles[g] = PROFILE_DEFAULT; // Apple-Intel GPU's, 2 is the old 0
-                } else {
-                    if (profile_selected > 3) ctx.profiles[g] = PROFILE_DEFAULT; // Apple-Intel CPU's, 3 is the old 1
-                }
-            }
-
-            // force profile to 0 with Intel GPU and 2 wih Intel CPU's
-            if (cd_ctx[w].is_intel && !strncmp(cd_ctx[w].device[q].vendor, "Intel", 5)) {
-                if (cd_ctx[w].device[q].is_gpu) {
-                    ctx.profiles[g] = 0; // Intel GPU, work better with a very slow profile
-                } else {
-                    if (profile_selected > 2) ctx.profiles[g] = PROFILE_DEFAULT; // Intel CPU (2 is the old 0)
-                }
-            }
-
-            // force profile to 2 with NVIDIA GPU's with NVIDIA platform
-            if (cd_ctx[w].is_nv && cd_ctx[w].device[q].is_gpu && !strncmp(cd_ctx[w].device[q].vendor, "NVIDIA", 6)) {
-                if (profile_selected > 10) {
-                    // NVIDIA RTX 3090 perform better with 5
-                    ctx.profiles[g] = (cd_ctx[w].device[q].sm_maj >= 8) ? 5 : PROFILE_DEFAULT;
-                }
-            }
-
-            // probably unstested hw, set profile to 0
-            if (profile_selected == 0xff) {
-                profile_selected = 0;
-                ctx.profiles[g] = 0;
-            }
-
-            // with same devices will be selected the best
-            // but for different devices in the same platform we need the worst for now (todo)
-            if (ctx.profiles[q] < profile) profile = ctx.profiles[q];
-        }
-    }
-
-    // profile consistency check
-    if (profile < 0 || profile > 10) {
-        printf("! Error: the selected profile is not allowed (%d)\n", profile);
-        MEMORY_FREE_OPENCL(ctx, z)
-        MEMORY_FREE_LIST_Z(matches, z)
-        MEMORY_FREE_LIST_Z(matches_found, z)
-        MEMORY_FREE_ALL
-        exit(2);
-    }
+    unsigned int profile = get_smallest_profile (cd_ctx, ocl_platform_cnt);
 
     // setup, phase 3 (finis him)
 
+    // z is device counter, dolphin buggy counter as well
+
     z = 0;
 
     for (w = 0; w < ocl_platform_cnt; w++) {
@@ -1296,8 +868,7 @@ int main(int argc, char **argv) {
                     MEMORY_FREE_ALL
                     exit(2);
                 }
-            } else {
-                // one
+            } else { // one
                 if (!(matches[z] = (uint64_t *) calloc(1, sizeof(uint64_t)))) {
                     printf("[%zu] Error: calloc (matches) failed (%d): %s\n", z, errno, strerror(errno));
                     MEMORY_FREE_OPENCL(ctx, z)
@@ -1374,7 +945,7 @@ int main(int argc, char **argv) {
             }
 
             err = clEnqueueWriteBuffer(ctx.commands[z], ctx.candidates[z], CL_TRUE, 0, sizeof(uint16_t) * ((1 << 20) * 3), candidates, 0, NULL, NULL);
-//			err = clEnqueueWriteBuffer(ctx.commands[z], ctx.candidates, CL_TRUE, 0, sizeof(uint64_t) * ((1 << 20)), candidates, 0, NULL, NULL);
+            // err = clEnqueueWriteBuffer(ctx.commands[z], ctx.candidates, CL_TRUE, 0, sizeof(uint64_t) * ((1 << 20)), candidates, 0, NULL, NULL);
             if (err != CL_SUCCESS) {
                 printf("[%zu] Error: clEnqueueWriteBuffer(ctx.candidates) failed (%d)\n", z, err);
                 MEMORY_FREE_OPENCL(ctx, z)
@@ -1492,17 +1063,14 @@ int main(int argc, char **argv) {
         t_arg[z].aR2 = aR2;
         t_arg[z].nR1 = nR1;
         t_arg[z].nR2 = nR2;
-        t_arg[z].max_step = max_step;
+        t_arg[z].max_slices = max_step;
         t_arg[z].ocl_ctx = &ctx;
         t_arg[z].device_id = z;
-        t_arg[z].async = (ctx.thread_sched_type == THREAD_TYPE_ASYNC);
         t_arg[z].thread_ctx = &th_ctx;
-
-        if (ctx.thread_sched_type == THREAD_TYPE_ASYNC) {
-            t_arg[z].matches = matches[z];
-            t_arg[z].matches_found = matches_found[z];
-            t_arg[z].status = TH_START;
-        }
+        t_arg[z].r = false;
+        t_arg[z].matches = matches[z];
+        t_arg[z].matches_found = matches_found[z];
+        t_arg[z].status = TH_START;
     }
 
     if (ctx.thread_sched_type == THREAD_TYPE_ASYNC) {
@@ -1550,202 +1118,20 @@ int main(int argc, char **argv) {
     printf("Attack 5 - opencl - start (Max Slices %u, %s order", max_step, wu_queue_strdesc(ctx.queue_ctx.queue_type));
 
     if (!verbose) printf(")\n\n");
-    else printf(", Profile %d, Async Threads %s, HiTag2 key verify on device %s)\n\n", profile, (ctx.thread_sched_type == THREAD_TYPE_ASYNC) ? "yes" : "no", (force_hitag2_opencl) ? "yes" : "no");
+    else printf(", Profile %u, Async Threads %s, HiTag2 key verify on device %s)\n\n", profile, (ctx.thread_sched_type == THREAD_TYPE_ASYNC) ? "yes" : "no", (force_hitag2_opencl) ? "yes" : "no");
 
     if (gettimeofday(&cpu_t_start, NULL) == -1) {
-        printf("! gettimeofday(start) failed (%d): %s\n", errno, strerror(errno));
+        printf("Error: gettimeofday(start) failed (%d): %s\n", errno, strerror(errno));
         show_overall_time = false;
     }
 
-    if (ctx.thread_sched_type == THREAD_TYPE_ASYNC) {
-        // crack hitag key or die tryin'
-        unsigned int th_cnt;
-
-        bool done = false;
-
-        do { // master
-            th_cnt = 0;
-
-            for (z = 0; z < thread_count; z++) {
-#if TDEBUG >= 1 && DEBUGME == 1
-                if (thread_count == 1) { printf("[%zu] get status from slave ...\n", z); fflush(stdout); }
-#endif
-
-                pthread_mutex_lock(&th_ctx.thread_mutexs[z]);
-                thread_status_t cur_status = t_arg[z].status;
-                pthread_mutex_unlock(&th_ctx.thread_mutexs[z]);
-
-#if TDEBUG >= 1 && DEBUGME == 1
-                if (thread_count == 1) { printf("[%zu] slave status: %s\n", z, thread_status_strdesc(cur_status)); fflush(stdout); }
-#endif
-
-                if (found) {
-#if TDEBUG >= 3
-                    printf("[%zu] Processing exit logic\n", z);
-                    fflush(stdout);
-#endif
-
-                    if (cur_status < TH_FOUND_KEY) {
-#if TDEBUG >= 1
-                        printf("[%zu] key found from another thread, set quit\n", z);
-                        fflush(stdout);
-#endif
-                        pthread_mutex_lock(&th_ctx.thread_mutexs[z]);
-                        t_arg[z].status = TH_END;
-                        t_arg[z].quit = true;
-                        if (cur_status == TH_WAIT) pthread_cond_signal(&th_ctx.thread_conds[z]);
-                        pthread_mutex_unlock(&th_ctx.thread_mutexs[z]);
-                    } else {
-                        if (thread_count == 1) {
-                            th_cnt++;
-#if TDEBUG >= 1
-                            printf("[%zu] Increment th_cnt: %u/%zu\n", z, th_cnt, thread_count);
-                            fflush(stdout);
-#endif
-                        }
-                    }
-                    continue;
-                }
-
-                if (cur_status == TH_WAIT) {
-                    pthread_mutex_lock(&th_ctx.thread_mutexs[z]);
-
-                    if (found) {
-#if TDEBUG >= 1
-                        printf("[%zu] key is found in another thread 1\n", z);
-                        fflush(stdout);
-#endif
-                        t_arg[z].status = TH_END;
-                        t_arg[z].quit = true;
-                        pthread_mutex_unlock(&th_ctx.thread_mutexs[z]);
-                        continue;
-                    }
-
-                    if (wu_queue_done(&ctx.queue_ctx) != QUEUE_EMPTY) {
-                        t_arg[z].status = TH_PROCESSING;
-
-#if TDEBUG >= 1
-                        printf("[master] slave [%zu], I give you another try (%s)\n", z, thread_status_strdesc(t_arg[z].status));
-                        fflush(stdout);
-#endif
-
-                        pthread_cond_signal(&th_ctx.thread_conds[z]);
-                        pthread_mutex_unlock(&th_ctx.thread_mutexs[z]);
-                        continue;
-                    } else {
-#if TDEBUG >= 1
-                        printf("[master] slave [%zu], max step reached. Quit.\n", z);
-                        fflush(stdout);
-#endif
-
-                        cur_status = t_arg[z].status = TH_END;
-                        t_arg[z].quit = true;
-
-                        pthread_cond_signal(&th_ctx.thread_conds[z]);
-                        pthread_mutex_unlock(&th_ctx.thread_mutexs[z]);
-                    }
-                }
-
-                if (cur_status == TH_PROCESSING) {
-                    if (th_ctx.enable_condusleep) {
-#if TDEBUG >= 1
-                        printf("[master] before pthread_cond_wait, TH_PROCESSING\n");
-#endif
-                        pthread_mutex_lock(&th_ctx.thread_mutex_usleep);
-#if TDEBUG >= 1
-                        printf("[master] slave [%zu], I'm waiting you end of task, I'm in %s give me a signal.\n", z, thread_status_strdesc(t_arg[z].status));
-                        fflush(stdout);
-#endif
-                        pthread_cond_wait(&th_ctx.thread_cond_usleep, &th_ctx.thread_mutex_usleep);
-#if TDEBUG >= 1
-                        printf("[master] slave [%zu], got the signal with new state: %s.\n", z, thread_status_strdesc(t_arg[z].status));
-                        fflush(stdout);
-#endif
-
-                        if (t_arg[z].status == TH_FOUND_KEY) found = true;
-
-                        pthread_mutex_unlock(&th_ctx.thread_mutex_usleep);
-#if TDEBUG >= 1
-                        printf("[master] after pthread_cond_wait, TH_PROCESSING\n");
-#endif
-                        continue;
-                    }
-
-                    if (found) {
-#if TDEBUG >= 1
-                        printf("[master] slave [%zu], the key is found. set TH_END from TH_PROCESSING\n", z);
-                        fflush(stdout);
-#endif
-
-                        pthread_mutex_lock(&th_ctx.thread_mutexs[z]);
-                        t_arg[z].status = TH_END;
-                        t_arg[z].quit = true;
-                        pthread_mutex_unlock(&th_ctx.thread_mutexs[z]);
-                        continue;
-                    }
-                }
-
-                if (cur_status == TH_ERROR) {
-                    // something went wrong
-                    pthread_mutex_lock(&th_ctx.thread_mutexs[z]);
-                    t_arg[z].status = TH_END;
-                    t_arg[z].quit = true;
-                    pthread_mutex_unlock(&th_ctx.thread_mutexs[z]);
-                    continue;
-                }
-
-                // todo, do more clean exit logic
-                if (cur_status >= TH_FOUND_KEY) {
-                    th_cnt++;
-
-                    if (cur_status == TH_FOUND_KEY) {
-                        thread_setEnd(&th_ctx, t_arg);
-                        found = true;
-                        done = true;
-                    }
-                }
-            }
-
-            if (th_cnt == thread_count) done = true;
-
-        } while (!done);
-
-        // end of async engine
-    } else if (ctx.thread_sched_type == THREAD_TYPE_SEQ) {
-        uint32_t step = 0;
-        bool quit = false;
-
-        for (step = 0; step < max_step; step += thread_count) {
-            for (z = 0; z < thread_count; z++) {
-                t_arg[z].r = found;
-                t_arg[z].matches = matches[z];
-                t_arg[z].matches_found = matches_found[z];
-            }
-
-            if ((ret = thread_start(&th_ctx, t_arg)) != 0) {
-                printf("Error: thread_start() failed (%d): %s\n", ret, thread_strerror(ret));
-                thread_destroy(&th_ctx);
-                MEMORY_FREE_OPENCL(ctx, z)
-                MEMORY_FREE_LIST_Z(matches, z)
-                MEMORY_FREE_LIST_Z(matches_found, z)
-                MEMORY_FREE_ALL
-                exit(3);
-            }
-
-            // waiting threads return
-            thread_stop(&th_ctx);
-
-            for (z = 0; z < th_ctx.thread_count; z++) {
-                if (t_arg[z].r) found = true;
-
-                if (t_arg[z].err) {
-                    error = true;
-                    quit = true;
-                }
-            }
-
-            if (found || quit) break;
-        }
+    // Hokuto Hyakuretsu Ken
+    ret = thread_start_scheduler (&th_ctx, t_arg, &ctx.queue_ctx);
+    if (ret < 0) {
+        printf("Error: thread_start_scheduler() failed (%d): %s\n", ret, thread_strerror(ret));
+        error = true;
+    } else if (ret == 0) {
+        found = true;
     }
 
     // if found, show the key here
@@ -1755,7 +1141,7 @@ int main(int argc, char **argv) {
 
             if (thread_count > 1) printf("[%zu] ", y);
 
-            printf("Key found @ slice %lu/%lu: ", t_arg[y].slice, t_arg[y].max_step);
+            printf("Key found @ slice %zu/%zu: ", t_arg[y].slice, t_arg[y].max_slices);
             for (int i = 0; i < 6; i++) {
                 printf("%02X", (uint8_t)(t_arg[y].key & 0xff));
                 t_arg[y].key = t_arg[y].key >> 8;
@@ -1770,14 +1156,13 @@ int main(int argc, char **argv) {
         if (gettimeofday(&cpu_t_end, NULL) == 0) {
             timersub(&cpu_t_end, &cpu_t_start, &cpu_t_result);
         } else {
-            printf("! gettimeofday(end) failed (%d): %s\n", errno, strerror(errno));
+            printf("Error. gettimeofday(end) failed (%d): %s\n", errno, strerror(errno));
             show_overall_time = false;
         }
     }
 
     if (!found) {
         printf("\nError. %s\n", (error) ? "something went wrong :(" : "Key not found :|");
-        if (error) exit(-1);
     }
 
     printf("\nAttack 5 - opencl - end");
@@ -1792,17 +1177,19 @@ int main(int argc, char **argv) {
     fflush(stdout);
 #endif
 
-    thread_stop(&th_ctx);
+    if (!error && th_ctx.type != THREAD_TYPE_SEQ) thread_stop(&th_ctx);
 
 #if DEBUGME > 1
     printf("destroy threads\n");
     fflush(stdout);
 #endif
 
-    if ((ret = thread_destroy(&th_ctx)) != 0) {
+    if (!error) {
+        if ((ret = thread_destroy(&th_ctx)) != 0) {
 #if DEBUGME > 0
-        printf("Warning: thread_destroy() failed (%d): %s\n", ret, thread_strerror(ret));
+            printf("Warning: thread_destroy() failed (%d): %s\n", ret, thread_strerror(ret));
 #endif
+        }
     }
 
 #if DEBUGME > 1
diff --git a/tools/hitag2crack/crack5opencl/opencl.c b/tools/hitag2crack/crack5opencl/opencl.c
index a16ce0f94..ecee691b7 100644
--- a/tools/hitag2crack/crack5opencl/opencl.c
+++ b/tools/hitag2crack/crack5opencl/opencl.c
@@ -40,6 +40,452 @@ bool plat_dev_enabled(unsigned int id, unsigned int *sel, unsigned int cnt, unsi
     return false;
 }
 
+unsigned int get_smallest_profile (compute_platform_ctx_t *cd_ctx, size_t ocl_platform_cnt)
+{
+    unsigned int profile = 0xff;
+
+    size_t x = 0, y = 0;
+
+    for (x = 0; x < ocl_platform_cnt; x++) {
+        if (!cd_ctx[x].selected) continue;
+
+        for (y = 0; y < cd_ctx[x].device_cnt; y++) {
+            if (!cd_ctx[x].device[y].selected) continue;
+
+#if DEBUGME > 1
+            printf("[debug] Initial profile for device %zu: %d\n", z, cd_ctx[x].device[y].profile);
+#endif
+
+            // with same devices will be selected the best
+            // but for different devices in the same platform we need the worst for now (todo)
+            if (cd_ctx[x].device[y].profile < profile) profile = cd_ctx[x].device[y].profile;
+        }
+    }
+
+    // at worst, set profile to 0
+    if (profile > 10) profile = 0;
+
+    return profile;
+}
+
+int discoverDevices(unsigned int profile_selected, uint32_t device_types_selected, cl_uint *platform_detected_cnt, size_t *selected_platforms_cnt, size_t *selected_devices_cnt, compute_platform_ctx_t **cd_ctx, unsigned int *plat_sel, unsigned int plat_cnt, unsigned int *dev_sel, unsigned int dev_cnt, bool verbose, bool show)
+{
+    int err = 0;
+    unsigned int ocl_platform_max = MAX_OPENCL_DEVICES; // 16
+    cl_uint ocl_platform_cnt;
+
+    cl_platform_id *ocl_platforms = (cl_platform_id *) calloc(ocl_platform_max, sizeof(cl_platform_id));
+    if (!ocl_platforms) {
+        printf("Error: calloc (ocl_platforms) failed (%d): %s\n", errno, strerror(errno));
+        return -2;
+    }
+
+    // enum platforms
+    err = clGetPlatformIDs(ocl_platform_max, ocl_platforms, &ocl_platform_cnt);
+    if (err != CL_SUCCESS) {
+        printf("Error: clGetPlatformIDs() failed (%d)\n", err);
+        free (ocl_platforms);
+        return -3;
+    }
+
+    if (ocl_platform_cnt == 0) {
+        printf("No platforms found, exit\n");
+        free (ocl_platforms);
+        return -4;
+    }
+
+    // allocate memory to hold info about platforms/devices
+    *cd_ctx = (compute_platform_ctx_t *) calloc(ocl_platform_cnt, sizeof(compute_platform_ctx_t));
+    if (*cd_ctx == NULL) {
+        printf("Error: calloc (compute_platform_ctx_t) failed (%d): %s\n", errno, strerror(errno));
+        free (ocl_platforms);
+        return -5;
+    }
+
+    cl_platform_info ocl_platforms_info[3] = { CL_PLATFORM_NAME, CL_PLATFORM_VENDOR, CL_PLATFORM_VERSION };
+    unsigned int ocl_platforms_info_cnt = sizeof(ocl_platforms_info) / sizeof(cl_platform_info);
+
+    cl_device_info ocl_devices_info[8] = { CL_DEVICE_TYPE, CL_DEVICE_NAME, CL_DEVICE_VERSION, CL_DRIVER_VERSION, CL_DEVICE_VENDOR, CL_DEVICE_LOCAL_MEM_TYPE, CL_DEVICE_MAX_WORK_ITEM_SIZES, CL_DEVICE_MAX_COMPUTE_UNITS };
+    unsigned int ocl_devices_info_cnt = sizeof(ocl_devices_info) / sizeof(cl_device_info);
+
+    unsigned int info_idx = 0;
+    size_t tmp_len = 0;
+    char *tmp_buf = NULL;
+
+    unsigned int global_device_id = 0;
+
+    if (verbose) printf("- Found %u OpenCL Platform(s)\n", ocl_platform_cnt);
+
+    for (cl_uint platform_idx = 0; platform_idx < ocl_platform_cnt; platform_idx++) {
+        (*cd_ctx)[platform_idx].platform_id = ocl_platforms[platform_idx];
+        (*cd_ctx)[platform_idx].selected = plat_dev_enabled(platform_idx, plat_sel, plat_cnt, 0, 0);
+
+        if ((*cd_ctx)[platform_idx].selected) (*selected_platforms_cnt)++;
+
+        if (verbose) printf("\n-- Platform ID: %d\n", platform_idx + 1);
+
+        for (info_idx = 0; info_idx < ocl_platforms_info_cnt; info_idx++) {
+            cl_platform_info ocl_info = ocl_platforms_info[info_idx];
+
+            err = clGetPlatformInfo((*cd_ctx)[platform_idx].platform_id, ocl_info, 0, NULL, &tmp_len);
+            if (err != CL_SUCCESS) {
+                printf("Error: clGetPlatformInfo(param size) failed (%d)\n", err);
+                free (*cd_ctx);
+                free (ocl_platforms);
+                return -6;
+            }
+
+            if (tmp_len > 0) {
+                if (!(tmp_buf = (char *) calloc(tmp_len, sizeof(char)))) {
+                    printf("Error: calloc (ocl_info %u) failed (%d): %s\n", info_idx, errno, strerror(errno));
+                    free (*cd_ctx);
+                    free (ocl_platforms);
+                    return -7;
+                }
+
+                err = clGetPlatformInfo((*cd_ctx)[platform_idx].platform_id, ocl_info, tmp_len, tmp_buf, 0);
+                if (err != CL_SUCCESS) {
+                    printf("Error: clGetPlatformInfo(param) failed (%d)\n", err);
+                    free (tmp_buf);
+                    free (*cd_ctx);
+                    free (ocl_platforms);
+                    return -8;
+                }
+            } else {
+                tmp_len = 4;
+                if (!(tmp_buf = (char *) calloc(tmp_len, sizeof(char)))) {
+                    printf("Error: calloc (ocl_info %u) failed (%d): %s\n", info_idx, errno, strerror(errno));
+                    free (*cd_ctx);
+                    free (ocl_platforms);
+                    return -7;
+                }
+
+                strncpy(tmp_buf, "N/A\0", tmp_len);
+            }
+
+            if (verbose) {
+                const char *tmp_info_desc = (info_idx == 0) ? "Name" : (info_idx == 1) ? "Vendor" : "Version";
+
+                printf("%14s: %s\n", tmp_info_desc, tmp_buf);
+            }
+
+            switch (info_idx) {
+                case 0:
+                    strncpy((*cd_ctx)[platform_idx].name, tmp_buf, tmp_len < 0xff ? tmp_len : 0xff - 1);
+                    break;
+                case 1:
+                    strncpy((*cd_ctx)[platform_idx].vendor, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40 - 1);
+                    break;
+                case 2:
+                    strncpy((*cd_ctx)[platform_idx].version, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40 - 1);
+                    break;
+            }
+
+            if (info_idx == 1) {
+                if (!strncmp(tmp_buf, "NVIDIA", 6)) (*cd_ctx)[platform_idx].is_nv = true;
+                else if (!strncmp(tmp_buf, "Apple", 5)) { (*cd_ctx)[platform_idx].is_apple = true; (*cd_ctx)[platform_idx].warning = true; }
+                else if (!strncmp(tmp_buf, "Intel", 5)) (*cd_ctx)[platform_idx].is_intel = true;
+                else if (!strncmp(tmp_buf, "The pocl project", 16)) (*cd_ctx)[platform_idx].is_pocl = true;
+            }
+
+            free (tmp_buf);
+        }
+
+        if (!show && verbose) {
+            printf("%14s: %s\n", "Selected", ((*cd_ctx)[platform_idx].selected) ? "yes" : "no");
+            if ((*cd_ctx)[platform_idx].warning) printf("\n%14s: performance will not be optimal using this platform\n\n", "=====> Warning");
+        }
+
+        // enum devices with this platform
+        unsigned int ocl_device_cnt = 0;
+        unsigned int ocl_device_max = MAX_OPENCL_DEVICES;
+
+        cl_device_id *ocl_devices = (cl_device_id *) calloc(ocl_device_max, sizeof(cl_device_id));
+        if (!ocl_devices) {
+            printf("Error: calloc (ocl_devices) failed (%d): %s\n", errno, strerror(errno));
+            free (*cd_ctx);
+            free (ocl_platforms);
+            return -7;
+        }
+
+        err = clGetDeviceIDs((*cd_ctx)[platform_idx].platform_id, CL_DEVICE_TYPE_ALL, ocl_device_max, ocl_devices, &ocl_device_cnt);
+        if (ocl_device_cnt == 0) {
+            if (device_types_selected == CL_DEVICE_TYPE_ALL) printf("No device(s) available with platform id %d\n", platform_idx);
+            (*cd_ctx)[platform_idx].device_cnt = 0;
+            continue;
+        }
+
+        if (err != CL_SUCCESS) {
+            printf("Error: clGetDeviceIDs(cnt) failed (%d)\n", err);
+            free (ocl_devices);
+            free (*cd_ctx);
+            free (ocl_platforms);
+            return -9;
+        }
+
+        if (verbose) printf("%14s: %u\n", "Device(s)", ocl_device_cnt);
+
+        (*cd_ctx)[platform_idx].device_cnt = ocl_device_cnt;
+
+        for (unsigned int device_idx = 0; device_idx < ocl_device_cnt; device_idx++) {
+            memset(&(*cd_ctx)[platform_idx].device[device_idx], 0, sizeof(compute_device_ctx_t));
+            cl_device_id ocl_device = ocl_devices[device_idx];
+            (*cd_ctx)[platform_idx].device[device_idx].platform_id = (*cd_ctx)[platform_idx].platform_id;
+
+            if (verbose) printf("---- * ID: %u\n", global_device_id + 1);
+
+            for (info_idx = 0; info_idx < ocl_devices_info_cnt; info_idx++) {
+                cl_device_info ocl_dev_info = ocl_devices_info[info_idx];
+
+                if (info_idx == 0) {
+                    cl_device_type device_type;
+
+                    err = clGetDeviceInfo(ocl_device, ocl_dev_info, sizeof(cl_device_type), &device_type, 0);
+                    if (err != CL_SUCCESS) {
+                        printf("Error: clGetDeviceInfo(device_type) failed (%d)\n", err);
+                        free (ocl_devices);
+                        free (*cd_ctx);
+                        free (ocl_platforms);
+                        return -10;
+                    }
+
+                    if (device_type & CL_DEVICE_TYPE_GPU) (*cd_ctx)[platform_idx].device[device_idx].is_gpu = 1;
+                    else if ((device_type & CL_DEVICE_TYPE_CPU) && (*cd_ctx)[platform_idx].is_pocl) {
+                        (*cd_ctx)[platform_idx].device[device_idx].profile = (profile_selected > 1) ? 0 : profile_selected;
+                    }
+
+                    if (verbose) printf("%14s: %s\n", "Device Type", (device_type & CL_DEVICE_TYPE_GPU) ? "GPU" : (device_type & CL_DEVICE_TYPE_CPU) ? "CPU" : "Other");
+
+                    (*cd_ctx)[platform_idx].device[device_idx].selected = plat_dev_enabled(global_device_id, dev_sel, dev_cnt, (unsigned int) device_type, device_types_selected);
+                    global_device_id++;
+                    if ((*cd_ctx)[platform_idx].device[device_idx].selected) (*selected_devices_cnt)++;
+                    continue;
+                } else if (info_idx == 5) {
+                    cl_device_local_mem_type local_mem_type;
+
+                    err = clGetDeviceInfo(ocl_device, ocl_dev_info, sizeof(cl_device_local_mem_type), &local_mem_type, 0);
+                    if (err != CL_SUCCESS) {
+                        printf("Error: clGetDeviceInfo(local_mem_type) failed (%d)\n", err);
+                        free (ocl_devices);
+                        free (*cd_ctx);
+                        free (ocl_platforms);
+                        return -10;
+                    }
+
+                    if (local_mem_type == CL_LOCAL || local_mem_type == CL_GLOBAL) {
+                        if (verbose) printf("%14s: %s\n", "Local Mem Type", (local_mem_type == CL_LOCAL) ? "Local" : "Global");
+                        if ((*cd_ctx)[platform_idx].is_apple) {
+                            if (strncmp((*cd_ctx)[platform_idx].device[device_idx].vendor, "Intel", 5) != 0) {
+                                (*cd_ctx)[platform_idx].device[device_idx].have_local_memory = true;
+
+                                if ((*cd_ctx)[platform_idx].device[device_idx].is_gpu) {
+                                    if (profile_selected > 2) (*cd_ctx)[platform_idx].device[device_idx].profile = PROFILE_DEFAULT; // Apple-Intel GPU's
+                                } else {
+                                    if (profile_selected > 3) (*cd_ctx)[platform_idx].device[device_idx].profile = PROFILE_DEFAULT; // Apple-Intel CPU's
+                                }
+                            }
+                        } else if ((*cd_ctx)[platform_idx].is_nv) {
+                            (*cd_ctx)[platform_idx].device[device_idx].have_local_memory = true;
+                        }
+                    } else {
+                        if (verbose) printf("%14s: None\n", "Local Mem Type");
+                    }
+
+                    if (verbose) printf("%14s: %s\n", "Local Mem Opt", ((*cd_ctx)[platform_idx].device[device_idx].have_local_memory) ? "yes" : "no");
+
+                    continue;
+                } else if (info_idx == 6) {
+                    size_t wis[3] = { 0 };
+                    err = clGetDeviceInfo(ocl_device, ocl_dev_info, sizeof(size_t) * 3, wis, 0);
+                    if (err != CL_SUCCESS) {
+                        printf("Error: clGetDeviceInfo(work_items_size) failed (%d)\n", err);
+                        free (ocl_devices);
+                        free (*cd_ctx);
+                        free (ocl_platforms);
+                        return -10;
+                    }
+
+                    if (verbose) printf("%14s: (%zu,%zu,%zu)\n", "Max Work-Items", wis[0], wis[1], wis[2]);
+
+#if APPLE_GPU_BROKEN == 1
+                    if (wis[1] < GLOBAL_WS_1 && (*cd_ctx)[platform_idx].device[device_idx].is_apple_gpu) {
+                        (*cd_ctx)[platform_idx].device[device_idx].unsupported = true;
+                    }
+#endif
+                    continue;
+                } else if (info_idx == 7) {
+                    cl_uint cores = 0;
+                    err = clGetDeviceInfo(ocl_device, ocl_dev_info, sizeof(cl_uint), &cores, 0);
+                    if (err != CL_SUCCESS) {
+                        printf("Error: clGetDeviceInfo(compute_units) failed (%d)\n", err);
+                        free (ocl_devices);
+                        free (*cd_ctx);
+                        free (ocl_platforms);
+                        return -10;
+                    }
+
+                    if (verbose) printf("%14s: %u\n", "Compute Units", cores);
+
+                    (*cd_ctx)[platform_idx].device[device_idx].compute_units = cores;
+                    continue;
+                }
+
+                tmp_len = 0;
+                tmp_buf = NULL;
+
+                err = clGetDeviceInfo(ocl_device, ocl_dev_info, 0, NULL, &tmp_len);
+                if (err != CL_SUCCESS) {
+                    printf("Error: clGetDeviceInfo(param size) failed (%d)\n", err);
+                    free (ocl_devices);
+                    free (*cd_ctx);
+                    free (ocl_platforms);
+                    return -10;
+                }
+
+                if (tmp_len > 0) {
+                    if (!(tmp_buf = (char *) calloc(tmp_len, sizeof(char)))) {
+                        printf("Error: calloc (ocl_dev_info %u) failed (%d): %s\n", info_idx, errno, strerror(errno));
+                        free (ocl_devices);
+                        free (*cd_ctx);
+                        free (ocl_platforms);
+                        return -7;
+                    }
+
+                    err = clGetDeviceInfo(ocl_device, ocl_dev_info, tmp_len, tmp_buf, 0);
+                    if (err != CL_SUCCESS) {
+                        printf("Error: clGetDeviceInfo(param) failed (%d)\n", err);
+                        free (tmp_buf);
+                        free (ocl_devices);
+                        free (*cd_ctx);
+                        free (ocl_platforms);
+                        return -10;
+                    }
+                } else {
+                    tmp_len = 4;
+                    if (!(tmp_buf = (char *) calloc(tmp_len, sizeof(char)))) {
+                        printf("Error: calloc (ocl_dev_info %u) failed (%d): %s\n", info_idx, errno, strerror(errno));
+                        free (ocl_devices);
+                        free (*cd_ctx);
+                        free (ocl_platforms);
+                        return -7;
+                    }
+
+                    strncpy(tmp_buf, "N/A\0", tmp_len);
+                }
+
+                if (verbose) {
+                    const char *tmp_dev_info_desc = (info_idx == 1) ? "Name" : (info_idx == 2) ? "Version" : (info_idx == 3) ? "Driver Version" : "Vendor";
+
+                    printf("%14s: %s\n", tmp_dev_info_desc, tmp_buf);
+                }
+
+                switch (info_idx) {
+                    case 1:
+                        strncpy((*cd_ctx)[platform_idx].device[device_idx].name, tmp_buf, tmp_len < 0xff ? tmp_len : 0xff - 1);
+                        break;
+                    case 2:
+                        strncpy((*cd_ctx)[platform_idx].device[device_idx].version, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40 - 1);
+                        break;
+                    case 3:
+                        strncpy((*cd_ctx)[platform_idx].device[device_idx].driver_version, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40 - 1);
+                        break;
+                    case 4:
+                        strncpy((*cd_ctx)[platform_idx].device[device_idx].vendor, tmp_buf, tmp_len < 0x40 ? tmp_len : 0x40 - 1);
+                        break;
+                }
+
+                if (info_idx == 1) {
+                   // force profile to 0-1 with Jetson Nano
+                   if (strstr(tmp_buf, "Tegra") && (*cd_ctx)[platform_idx].is_pocl) {
+                       (*cd_ctx)[platform_idx].device[device_idx].profile = (profile_selected > 1) ? 0 : profile_selected;
+                   }
+                } else if (info_idx == 4) {
+                    if (!strncmp(tmp_buf, "Intel", 5)) {
+                        if ((*cd_ctx)[platform_idx].is_apple) {
+                            (*cd_ctx)[platform_idx].device[device_idx].is_apple_gpu = (*cd_ctx)[platform_idx].device[device_idx].is_gpu;
+                        }
+
+                        // force profile to 0 with Intel GPU and 2 wih Intel CPU's
+                        if ((*cd_ctx)[platform_idx].is_intel) {
+                            if ((*cd_ctx)[platform_idx].device[device_idx].is_gpu) {
+                                (*cd_ctx)[platform_idx].device[device_idx].profile = 0; // Intel GPU's, work better with a very slow profile
+                            } else {
+                                 (*cd_ctx)[platform_idx].device[device_idx].profile = (profile_selected > 2) ? PROFILE_DEFAULT : profile_selected; // Intel CPU's
+                            }
+                        }
+                    }
+
+                    if (!strncmp(tmp_buf, "NVIDIA", 6) && (*cd_ctx)[platform_idx].is_nv) {
+                        unsigned int sm_maj = 0, sm_min = 0;
+
+                        err  = clGetDeviceInfo(ocl_device, 0x4000, sizeof(unsigned int), &sm_maj, 0);
+                        err |= clGetDeviceInfo(ocl_device, 0x4001, sizeof(unsigned int), &sm_min, 0);
+
+                        if (err != CL_SUCCESS) {
+                            printf("Error: clGetDeviceInfo(sm_maj/sm_min) failed (%d)\n", err);
+                            free (tmp_buf);
+                            free (ocl_devices);
+                            free (*cd_ctx);
+                            free (ocl_platforms);
+                            return -10;
+                        }
+
+                        (*cd_ctx)[platform_idx].device[device_idx].sm_maj = sm_maj;
+                        (*cd_ctx)[platform_idx].device[device_idx].sm_min = sm_min;
+
+                        if (verbose) printf("%14s: %u%u\n", "SM", sm_maj, sm_min);
+
+                        if (sm_maj >= 5) { // >= Maxwell
+                            // https://docs.nvidia.com/cuda/parallel-thread-execution/index.html#logic-and-shift-instructions-lop3
+                            // Requires sm_50 or higher.
+                            (*cd_ctx)[platform_idx].device[device_idx].have_lop3 = true;
+                        } else {
+                            (*cd_ctx)[platform_idx].device[device_idx].warning = true;
+                        }
+
+                        (*cd_ctx)[platform_idx].device[device_idx].is_nv = true;
+
+                        if ((*cd_ctx)[platform_idx].device[device_idx].is_gpu) {
+                            if (profile_selected > 10) {
+                                // NVIDIA RTX 3090 perform better with 5
+                                (*cd_ctx)[platform_idx].device[device_idx].profile = (sm_maj >= 8) ? 5 : PROFILE_DEFAULT;
+                            }
+                        }
+                    } else {
+                        (*cd_ctx)[platform_idx].device[device_idx].warning = true;
+                    }
+                }
+
+                free (tmp_buf);
+            }
+
+            if (!show && verbose) printf("%14s: %s\n", "Selected", ((*cd_ctx)[platform_idx].device[device_idx].selected) ? "yes" : "no");
+
+            if ((*cd_ctx)[platform_idx].device[device_idx].unsupported) {
+                printf("\n%14s: this device was not supported, beacuse of missing resources\n\n", "=====> Warning");
+                continue;
+            }
+
+            if ((*cd_ctx)[platform_idx].device[device_idx].warning) {
+                if (!show && verbose) printf("\n%14s: performance will not be optimal using this device\n\n", "=====> Warning");
+            }
+
+            (*cd_ctx)[platform_idx].device[device_idx].device_id = ocl_device;
+        }
+        free (ocl_devices);
+        ocl_devices = NULL;
+    }
+
+    free (ocl_platforms);
+    ocl_platforms = NULL;
+
+    *platform_detected_cnt = ocl_platform_cnt;
+
+    if (show) free (*cd_ctx);
+
+    return 0;
+}
+
 int runKernel(opencl_ctx_t *ctx, uint32_t cand_base, uint64_t *matches, uint32_t *matches_found, size_t id) {
     int err = 0;
 
diff --git a/tools/hitag2crack/crack5opencl/opencl.h b/tools/hitag2crack/crack5opencl/opencl.h
index 410a7cb5a..462dbbb4f 100644
--- a/tools/hitag2crack/crack5opencl/opencl.h
+++ b/tools/hitag2crack/crack5opencl/opencl.h
@@ -38,6 +38,7 @@ License: GNU General Public License v3 or any later version (see LICENSE.txt)
 #include <stdbool.h>
 
 #include <stdio.h>
+#include <errno.h>
 
 // max number of concurrent devices (tested up to 4x RTX 3090)
 #define MAX_OPENCL_DEVICES 16
@@ -54,9 +55,10 @@ typedef struct compute_device_ctx {
     bool warning, unsupported;
 
     bool selected;
-    bool enabled;
 
-    unsigned char pad1[4];
+    unsigned char pad1[1];
+    unsigned int profile;
+
     unsigned int sm_maj;
     unsigned int sm_min;
     unsigned int compute_units;
@@ -70,11 +72,11 @@ typedef struct compute_platform_ctx {
     unsigned int device_cnt;
     unsigned int compute_units_max;
 
-    bool is_nv, is_apple, is_intel;
+    bool is_nv, is_apple, is_intel, is_pocl;
     bool warning;
     bool selected;
 
-    unsigned char pad1[3];
+    unsigned char pad1[2];
     compute_device_ctx_t device[0x10];
 
     char name[0xff];
@@ -94,7 +96,7 @@ typedef struct opencl_ctx {
 
     size_t *global_ws;
     size_t *local_ws;
-    int *profiles;
+    unsigned int *profiles;
 
     cl_device_id *device_ids;       // compute device id's array
     cl_context *contexts;           // compute contexts
@@ -120,7 +122,8 @@ typedef struct opencl_ctx {
 } opencl_ctx_t;
 
 bool plat_dev_enabled(unsigned int id, unsigned int *sel, unsigned int cnt, unsigned int cur_type, unsigned int allow_type);
-
+unsigned int get_smallest_profile (compute_platform_ctx_t *cd_ctx, size_t ocl_platform_cnt);
+int discoverDevices(unsigned int profile_selected, uint32_t device_types_selected, cl_uint *ocl_platform_cnt, size_t *selected_platforms_cnt, size_t *selected_devices_cnt, compute_platform_ctx_t **cd_ctx, unsigned int *plat_sel, unsigned int plat_cnt, unsigned int *dev_sel, unsigned int dev_cnt, bool verbose, bool show);
 int runKernel(opencl_ctx_t *ctx, uint32_t cand_base, uint64_t *matches, uint32_t *matches_found, size_t id);
 
 #endif // OPENCL_H
diff --git a/tools/hitag2crack/crack5opencl/queue.c b/tools/hitag2crack/crack5opencl/queue.c
index ee289f552..861387cb3 100644
--- a/tools/hitag2crack/crack5opencl/queue.c
+++ b/tools/hitag2crack/crack5opencl/queue.c
@@ -340,7 +340,7 @@ int wu_queue_pop(wu_queue_ctx_t *ctx, wu_queue_data_t *wu, short remove) {
             break;
         case QUEUE_TYPE_RANDOM: // from the head
 #if TEST_UNIT == 1
-            fprintf(stdout, "pop id %ld\n", wu->id);
+            fprintf(stdout, "pop id %zu\n", wu->id);
             fflush(stdout);
 #endif
             if (ptrPrev == NULL) {
@@ -441,9 +441,9 @@ int main(void) {
 
     wu_queue_type_t types[4] = { QUEUE_TYPE_FORWARD, QUEUE_TYPE_REVERSE, QUEUE_TYPE_RANDOM, 1234 };
     int types_max = (int)(sizeof(types) / sizeof(wu_queue_type_t));
-    int ret = 0;
 
     for (i = 0; i < types_max; i++) {
+        int ret = 0;
         printf("[%d] trying wu_queue_init() in %s mode\n", i, wu_queue_strdesc(types[i]));
 
         if ((ret = wu_queue_init(&ctx, types[i])) != 0) {
diff --git a/tools/hitag2crack/crack5opencl/queue.h b/tools/hitag2crack/crack5opencl/queue.h
index 80304b0d3..9fe3cf97d 100644
--- a/tools/hitag2crack/crack5opencl/queue.h
+++ b/tools/hitag2crack/crack5opencl/queue.h
@@ -95,7 +95,7 @@ typedef struct wu_queue_ctx {
 
     // mutex
     pthread_mutexattr_t queue_mutex_attr;
-//	unsigned char pad1[4];
+    unsigned char pad1[4];
     pthread_mutex_t queue_mutex;
 
 } wu_queue_ctx_t;
diff --git a/tools/hitag2crack/crack5opencl/threads.c b/tools/hitag2crack/crack5opencl/threads.c
index 5cb5a2b87..ff79a4c74 100644
--- a/tools/hitag2crack/crack5opencl/threads.c
+++ b/tools/hitag2crack/crack5opencl/threads.c
@@ -56,6 +56,8 @@ const char *thread_strerror(int error) {
             return (const char *) "GENERIC ERROR";
         case THREAD_ERROR_ALLOC:
             return (const char *) "ALLOC FAILED";
+        case THREAD_ERROR_INTERNAL:
+            return (const char *) "INTERNAL ERROR";
     }
 
     return (const char *) "GENERIC";
@@ -174,6 +176,198 @@ int thread_init(thread_ctx_t *ctx, short type, size_t thread_count) {
     return 0;
 }
 
+int thread_start_scheduler (thread_ctx_t *ctx, thread_args_t *t_arg, wu_queue_ctx_t *queue_ctx)
+{
+    size_t z = 0;
+    bool found = false;
+    bool done = false;
+    unsigned int th_cnt = 0;
+
+    if (ctx->type == THREAD_TYPE_SEQ) {
+        bool error = false;
+        uint32_t slice = 0;
+        for (slice = 0; slice < t_arg[0].max_slices; slice += ctx->thread_count) {
+            int err = 0;
+
+            if ((err = thread_start(ctx, t_arg)) != 0) {
+                printf("Error: thread_start() failed (%d): %s\n", err, thread_strerror(err));
+            }
+
+            // waiting threads return
+            if (err == 0) thread_stop(ctx);
+
+            for (z = 0; z < ctx->thread_count; z++) {
+                if (t_arg[z].r) {
+                    found = true;
+                    break;
+                }
+
+                if (t_arg[z].err) {
+                    error = true;
+                }
+            }
+
+            // internel err
+            if (error && err == 0) {
+                thread_destroy(ctx);
+                err = THREAD_ERROR_INTERNAL;
+            }
+
+            if (err != 0) return err;
+
+            if (found) break;
+        }
+    } else if (ctx->type == THREAD_TYPE_ASYNC) {
+
+        // crack hitag key or die tryin'
+        do { // master
+            th_cnt = 0;
+
+            for (z = 0; z < ctx->thread_count; z++) {
+#if TDEBUG >= 1 && DEBUGME == 1
+                if (ctx->thread_count == 1) { printf("[%zu] get status from thread ...\n", z); fflush(stdout); }
+#endif
+
+                pthread_mutex_lock(&ctx->thread_mutexs[z]);
+                thread_status_t cur_status = t_arg[z].status;
+                pthread_mutex_unlock(&ctx->thread_mutexs[z]);
+
+#if TDEBUG >= 1 && DEBUGME == 1
+                if (ctx->thread_count == 1) { printf("[%zu] thread status: %s\n", z, thread_status_strdesc(cur_status)); fflush(stdout); }
+#endif
+                if (found) {
+#if TDEBUG >= 3
+                    printf("[%zu] Processing exit logic\n", z);
+                    fflush(stdout);
+#endif
+
+                    if (cur_status < TH_FOUND_KEY) {
+#if TDEBUG >= 1
+                        printf("[%zu] key found from another thread, set quit\n", z);
+                        fflush(stdout);
+#endif
+                        pthread_mutex_lock(&ctx->thread_mutexs[z]);
+                        t_arg[z].status = TH_END;
+                        t_arg[z].quit = true;
+                        if (cur_status == TH_WAIT) pthread_cond_signal(&ctx->thread_conds[z]);
+                        pthread_mutex_unlock(&ctx->thread_mutexs[z]);
+                    } else {
+                        if (ctx->thread_count == 1) {
+                            th_cnt++;
+#if TDEBUG >= 1
+                            printf("[%zu] Increment th_cnt: %u/%zu\n", z, th_cnt, ctx->thread_count);
+                            fflush(stdout);
+#endif
+                        }
+                    }
+                    continue;
+                }
+
+                if (cur_status == TH_WAIT) {
+                    pthread_mutex_lock(&ctx->thread_mutexs[z]);
+
+                    if (found) {
+#if TDEBUG >= 1
+                        printf("[%zu] key is found in another thread 1\n", z);
+                        fflush(stdout);
+#endif
+                        t_arg[z].status = TH_END;
+                        t_arg[z].quit = true;
+                        pthread_mutex_unlock(&ctx->thread_mutexs[z]);
+                        continue;
+                    }
+
+                    if (wu_queue_done(queue_ctx) != QUEUE_EMPTY) {
+                        t_arg[z].status = TH_PROCESSING;
+
+#if TDEBUG >= 1
+                        printf("[master] thread [%zu], I give you another try (%s)\n", z, thread_status_strdesc(t_arg[z].status));
+                        fflush(stdout);
+#endif
+
+                        pthread_cond_signal(&ctx->thread_conds[z]);
+                        pthread_mutex_unlock(&ctx->thread_mutexs[z]);
+                        continue;
+                    } else {
+#if TDEBUG >= 1
+                        printf("[master] thread [%zu], max step reached. Quit.\n", z);
+                        fflush(stdout);
+#endif
+
+                        cur_status = t_arg[z].status = TH_END;
+                        t_arg[z].quit = true;
+
+                        pthread_cond_signal(&ctx->thread_conds[z]);
+                        pthread_mutex_unlock(&ctx->thread_mutexs[z]);
+                    }
+                }
+
+                if (cur_status == TH_PROCESSING) {
+                    if (ctx->enable_condusleep) {
+#if TDEBUG >= 1
+                        printf("[master] before pthread_cond_wait, TH_PROCESSING\n");
+                        fflush(stdout);
+#endif
+                        pthread_mutex_lock(&ctx->thread_mutex_usleep);
+#if TDEBUG >= 1
+                        printf("[master] thread [%zu], I'm waiting you end of task, I'm in %s give me a signal.\n", z, thread_status_strdesc(t_arg[z].status));
+                        fflush(stdout);
+#endif
+                        pthread_cond_wait(&ctx->thread_cond_usleep, &ctx->thread_mutex_usleep);
+#if TDEBUG >= 1
+                        printf("[master] thread [%zu], got the signal with new state: %s.\n", z, thread_status_strdesc(t_arg[z].status));
+                        fflush(stdout);
+#endif
+                        if (t_arg[z].status == TH_FOUND_KEY) found = true;
+
+                        pthread_mutex_unlock(&ctx->thread_mutex_usleep);
+#if TDEBUG >= 1
+                        printf("[master] after pthread_cond_wait, TH_PROCESSING\n");
+                        fflush(stdout);
+#endif
+                        continue;
+                    }
+
+                    if (found) {
+#if TDEBUG >= 1
+                        printf("[master] thread [%zu], the key is found. set TH_END from TH_PROCESSING\n", z);
+                        fflush(stdout);
+#endif
+                        pthread_mutex_lock(&ctx->thread_mutexs[z]);
+                        t_arg[z].status = TH_END;
+                        t_arg[z].quit = true;
+                        pthread_mutex_unlock(&ctx->thread_mutexs[z]);
+                        continue;
+                    }
+                }
+                if (cur_status == TH_ERROR) {
+                    // something went wrong
+                    pthread_mutex_lock(&ctx->thread_mutexs[z]);
+                    t_arg[z].status = TH_END;
+                    t_arg[z].quit = true;
+                    pthread_mutex_unlock(&ctx->thread_mutexs[z]);
+                    continue;
+                }
+
+                if (cur_status >= TH_FOUND_KEY) {
+                    th_cnt++;
+
+                    if (cur_status == TH_FOUND_KEY) {
+                        thread_setEnd(ctx, t_arg);
+                        found = true;
+                        done = true;
+                    }
+                }
+            }
+
+            if (th_cnt == ctx->thread_count) done = true;
+
+        } while (!done);
+    }
+
+    return (found) ? 0 : 1;
+}
+
 int thread_destroy(thread_ctx_t *ctx) {
     if (!ctx) return -1;
     if (!ctx->init) return -2;
@@ -258,8 +452,6 @@ const char *thread_status_strdesc(thread_status_t s) {
             return (const char *) "PROCESSING";
         case TH_ERROR:
             return (const char *) "ERROR";
-        case TH_STOP:
-            return (const char *) "STOP";
         case TH_FOUND_KEY:
             return (const char *) "FOUND_KEY";
         case TH_END:
@@ -274,11 +466,10 @@ bool thread_setEnd(thread_ctx_t *ctx, thread_args_t *t_arg) {
 
     size_t z;
 
-    int m_ret = 0;
     int c_ret = 0;
 
     for (z = 0; z < ctx->thread_count; z++) {
-        m_ret = pthread_mutex_lock(&ctx->thread_mutexs[z]);
+        int m_ret = pthread_mutex_lock(&ctx->thread_mutexs[z]);
         if (m_ret != 0) {
             tprintf("[%zu] [%s] Error: pthread_mutex_lock() failed (%d): %s\n", z, __func__, m_ret, strerror(m_ret));
         }
@@ -296,10 +487,10 @@ bool thread_setEnd(thread_ctx_t *ctx, thread_args_t *t_arg) {
         }
 
 #if DEBUGME > 0
-        tprintf("[%zu] [%s] Set thread status to TH_STOP\n", z, __func__);
+        tprintf("[%zu] [%s] Set thread status to TH_END\n", z, __func__);
 #endif
 
-        t_arg[z].status = TH_STOP;
+        t_arg[z].status = TH_END;
 
         if (tmp == TH_WAIT) {
 #if DEBUGME > 0
@@ -366,7 +557,7 @@ void *computing_process(void *arg) {
 
     if (!ctx->force_hitag2_opencl) {
 #if DEBUGME >= 2
-        printf("[slave][%zu] master, I found %5u candidates @ slice %zu\n", z, matches_found[0], a->slice + 1);
+        printf("[%s][%zu] master, I found %5u candidates @ slice %zu\n", __func__, z, matches_found[0], a->slice + 1);
         fflush(stdout);
 #endif
 
@@ -378,7 +569,7 @@ void *computing_process(void *arg) {
         // the OpenCL kernel return only one key if found, else nothing
 
 #if TDEBUG >= 1
-        printf("[slave][%zu] master, I found the key @ slice %zu\n", z, a->slice + 1);
+        printf("[%s][%zu] master, I found the key @ slice %zu\n", __func__, z, a->slice + 1);
         fflush(stdout);
 #endif
 
@@ -400,32 +591,31 @@ void *computing_process_async(void *arg) {
     // fetching data from thread struct, I hope they are good
     thread_status_t status = a->status;
 
+    uint64_t *matches = a->matches;
+    uint32_t *matches_found = a->matches_found;
     uint32_t uid = a->uid;
     uint32_t aR2 = a->aR2;
     uint32_t nR1 = a->nR1;
     uint32_t nR2 = a->nR2;
 
-    uint64_t *matches = a->matches;
-    uint32_t *matches_found = a->matches_found;
-    size_t max_step = a->max_step;
+    size_t max_slices = a->max_slices;
 
     opencl_ctx_t *ctx = a->ocl_ctx;
 
     pthread_mutex_unlock(&a->thread_ctx->thread_mutexs[z]);
 
     uint64_t off = 0;
-//	size_t slice = 0;
     int ret = 0;
 
     if (status == TH_START) {
 #if TDEBUG >= 1
-        printf("[slave][%zu] plat id %d, uid %u, aR2 %u, nR1 %u, nR2 %u, Initial status: %s\n", z, ctx->id_platform, uid, aR2, nR1, nR2, thread_status_strdesc(status));
+        printf("[%s][%zu] plat id %d, uid %u, aR2 %u, nR1 %u, nR2 %u, Initial status: %s\n", __func__, z, ctx->id_platform, uid, aR2, nR1, nR2, thread_status_strdesc(status));
 #endif
         status = TH_WAIT;
         // proceed to next
     }
 
-    do { // slave
+    do {
         if (status == TH_WAIT) {
             pthread_mutex_lock(&a->thread_ctx->thread_mutexs[z]);
 
@@ -433,7 +623,7 @@ void *computing_process_async(void *arg) {
 
             if (a->status == TH_END) { // other threads found the key
                 fflush(stdout);
-                status = TH_END;
+                //status = TH_END;
                 a->quit = true;
                 pthread_mutex_unlock(&a->thread_ctx->thread_mutexs[z]);
                 pthread_exit(NULL);
@@ -444,7 +634,7 @@ void *computing_process_async(void *arg) {
                     pthread_mutex_lock(&a->thread_ctx->thread_mutex_usleep);
                     pthread_cond_signal(&a->thread_ctx->thread_cond_usleep);  // unlock master/TH_PROCESSING cond
 #if TDEBUG >= 1
-                    printf("[slate][%zu] after pthread_cond_signal TH_WAIT\n", z);
+                    printf("[%s][%zu] after pthread_cond_signal TH_WAIT\n", __func__, z);
                     fflush(stdout);
 #endif
                     pthread_mutex_unlock(&a->thread_ctx->thread_mutex_usleep);
@@ -452,7 +642,7 @@ void *computing_process_async(void *arg) {
             }
 
 #if TDEBUG >= 1
-            printf("[slave][%zu] master, i'm here to serve you. I'm in %s give me a signal.\n", z, thread_status_strdesc(status));
+            printf("[%s][%zu] master, i'm here to serve you. I'm in %s give me a signal.\n", __func__, z, thread_status_strdesc(status));
             fflush(stdout);
 #endif
 
@@ -461,7 +651,7 @@ void *computing_process_async(void *arg) {
             status = a->status; // read new status from master
 
 #if TDEBUG >= 2
-            printf("[slave][%zu] master, got the signal with new state: %s.\n", z, thread_status_strdesc(status));
+            printf("[%s][%zu] master, got the signal with new state: %s.\n", __func__, z, thread_status_strdesc(status));
             fflush(stdout);
 #endif
 
@@ -469,7 +659,7 @@ void *computing_process_async(void *arg) {
 
             if (status == TH_WAIT) {
 #if TDEBUG >=1
-                printf("[slave] ! Error: need to be TH_PROCESSING or TH_END, not TH_WAIT ... exit\n");
+                printf("[%s] ! Error: need to be TH_PROCESSING or TH_END, not TH_WAIT ... exit\n", __func__);
                 fflush(stdout);
 #endif
                 break;
@@ -478,7 +668,7 @@ void *computing_process_async(void *arg) {
 
         if (status == TH_ERROR) {
 #if TDEBUG >= 1
-            printf("[slave][%zu] master, got error signal, proceed with exit\n", z);
+            printf("[%s][%zu] master, got error signal, proceed with exit\n", __func__, z);
             fflush(stdout);
 #endif
             pthread_exit(NULL);
@@ -486,7 +676,7 @@ void *computing_process_async(void *arg) {
 
         if (status == TH_PROCESSING) {
 #if TDEBUG >= 2
-            printf("[slave][%zu] master, got a work-unit, processing ...\n", z);
+            printf("[%s][%zu] master, got a work-unit, processing ...\n", __func__, z);
             fflush(stdout);
 #endif
 
@@ -521,7 +711,7 @@ void *computing_process_async(void *arg) {
                     a->status = TH_ERROR;
                     pthread_mutex_unlock(&a->thread_ctx->thread_mutexs[z]);
 #if TDEBUG >= 1
-                    printf("[slave][%zu] master, something is broken, exit\n", z);
+                    printf("[%s][%zu] master, something is broken, exit\n", __func__, z);
                     fflush(stdout);
 #endif
 
@@ -529,7 +719,7 @@ void *computing_process_async(void *arg) {
                         pthread_mutex_lock(&a->thread_ctx->thread_mutex_usleep);
                         pthread_cond_signal(&a->thread_ctx->thread_cond_usleep);  // unlock master/TH_PROCESSING cond
 #if TDEBUG >= 1
-                        printf("[slave][%zu] after pthread_cond_signal TH_ERROR\n", z);
+                        printf("[%s][%zu] after pthread_cond_signal TH_ERROR\n", __func__, z);
 #endif
                         pthread_mutex_unlock(&a->thread_ctx->thread_mutex_usleep);
                     }
@@ -539,12 +729,12 @@ void *computing_process_async(void *arg) {
                 }
 
 #if TDEBUG >= 1
-                printf("[slave][%zu] master, process is done but no candidates found\n", z);
+                printf("[%s][%zu] master, process is done but no candidates found\n", __func__, z);
                 fflush(stdout);
 #endif
                 pthread_mutex_lock(&a->thread_ctx->thread_mutexs[z]);
 
-                if (a->slice >= max_step) a->status = TH_END;
+                if (a->slice >= max_slices) a->status = TH_END;
                 else a->status = TH_WAIT;
 
                 status = a->status;
@@ -555,7 +745,7 @@ void *computing_process_async(void *arg) {
                     pthread_mutex_lock(&a->thread_ctx->thread_mutex_usleep);
                     pthread_cond_signal(&a->thread_ctx->thread_cond_usleep);  // unlock master/TH_PROCESSING cond
 #if TDEBUG >= 1
-                    printf("[slave][%zu] after pthread_cond_signal TH_WAIT\n", z);
+                    printf("[%s][%zu] after pthread_cond_signal TH_WAIT\n", __func__, z);
                     fflush(stdout);
 #endif
                     pthread_mutex_unlock(&a->thread_ctx->thread_mutex_usleep);
@@ -566,7 +756,7 @@ void *computing_process_async(void *arg) {
 
             if (!ctx->force_hitag2_opencl) {
 #if TDEBUG >= 1
-                printf("[slave][%zu] master, we got %5u candidates. Proceed to validation\n", z, matches_found[0]);
+                printf("[%s][%zu] master, we got %5u candidates. Proceed to validation\n", __func__, z, matches_found[0]);
                 fflush(stdout);
 #endif
 
@@ -576,7 +766,7 @@ void *computing_process_async(void *arg) {
                         a->status = TH_END;
                         pthread_mutex_unlock(&a->thread_ctx->thread_mutexs[z]);
 #if TDEBUG >= 1
-                        printf("[slave][%zu] master, Another thread found the key, quit 2 \n", z);
+                        printf("[%s][%zu] master, Another thread found the key, quit 2 \n", __func__, z);
                         fflush(stdout);
 #endif
 
@@ -584,7 +774,8 @@ void *computing_process_async(void *arg) {
                             pthread_mutex_lock(&a->thread_ctx->thread_mutex_usleep);
                             pthread_cond_signal(&a->thread_ctx->thread_cond_usleep);  // unlock master/TH_PROCESSING cond
 #if TDEBUG >= 1
-                            printf("[slave][%zu] after pthread_cond_signal TH_END\n", z);
+                            printf("[%s][%zu] after pthread_cond_signal TH_END\n", __func__, z);
+                            fflush (stdout);
 #endif
                             pthread_mutex_unlock(&a->thread_ctx->thread_mutex_usleep);
                         }
@@ -600,7 +791,7 @@ void *computing_process_async(void *arg) {
                         a->quit = true;
                         pthread_mutex_unlock(&a->thread_ctx->thread_mutexs[z]);
 #if TDEBUG >= 1
-                        printf("[slave][%zu] master, I found the key ! state %" STR(OFF_FORMAT_U) ", slice %zu\n", z, a->s, a->slice + 1);
+                        printf("[%s][%zu] master, I found the key ! state %" STR(OFF_FORMAT_U) ", slice %zu\n", __func__, z, a->s, a->slice + 1);
                         fflush(stdout);
 #endif
 
@@ -608,7 +799,7 @@ void *computing_process_async(void *arg) {
                             pthread_mutex_lock(&a->thread_ctx->thread_mutex_usleep);
                             pthread_cond_signal(&a->thread_ctx->thread_cond_usleep);  // unlock master/TH_PROCESSING cond
 #if TDEBUG >= 1
-                            printf("[slave][%zu] after pthread_cond_signal TH_FOUND_KEY\n", z);
+                            printf("[%s][%zu] after pthread_cond_signal TH_FOUND_KEY\n", __func__, z);
 #endif
                             pthread_mutex_unlock(&a->thread_ctx->thread_mutex_usleep);
                         }
@@ -622,7 +813,7 @@ void *computing_process_async(void *arg) {
                     a->status = TH_END;
                     pthread_mutex_unlock(&a->thread_ctx->thread_mutexs[z]);
 #if TDEBUG >= 1
-                    printf("[slave][%zu] master, Another thread found the key, quit 1 \n", z);
+                    printf("[%s][%zu] master, Another thread found the key, quit 1 \n", __func__, z);
                     fflush(stdout);
 #endif
 
@@ -630,7 +821,7 @@ void *computing_process_async(void *arg) {
                         pthread_mutex_lock(&a->thread_ctx->thread_mutex_usleep);
                         pthread_cond_signal(&a->thread_ctx->thread_cond_usleep);  // unlock master/TH_PROCESSING cond
 #if TDEBUG >= 1
-                        printf("[slave][%zu] after pthread_cond_signal TH_END\n", z);
+                        printf("[%s][%zu] after pthread_cond_signal TH_END\n", __func__, z);
 #endif
                         pthread_mutex_unlock(&a->thread_ctx->thread_mutex_usleep);
                     }
@@ -651,7 +842,7 @@ void *computing_process_async(void *arg) {
                 a->quit = true;
                 pthread_mutex_unlock(&a->thread_ctx->thread_mutexs[z]);
 #if TDEBUG >= 1
-                printf("[slave][%zu] master, I found the key at slice %zu\n", z, a->slice + 1);
+                printf("[%s][%zu] master, I found the key at slice %zu\n", __func__, z, a->slice + 1);
                 fflush(stdout);
 #endif
 
@@ -659,7 +850,7 @@ void *computing_process_async(void *arg) {
                     pthread_mutex_lock(&a->thread_ctx->thread_mutex_usleep);
                     pthread_cond_signal(&a->thread_ctx->thread_cond_usleep);  // unlock master/TH_PROCESSING cond
 #if TDEBUG >= 1
-                    printf("[slave][%zu] after pthread_cond_signal TH_FOUND_KEY\n", z);
+                    printf("[%s][%zu] after pthread_cond_signal TH_FOUND_KEY\n", __func__, z);
 #endif
                     pthread_mutex_unlock(&a->thread_ctx->thread_mutex_usleep);
                 }
@@ -671,10 +862,10 @@ void *computing_process_async(void *arg) {
         if (status >= TH_FOUND_KEY) {
 #if TDEBUG >= 1
             if (status == TH_FOUND_KEY) {
-                printf("[slave][%zu] master, TH_FOUND_KEY, if you see this message, something is wrong\n", z);
+                printf("[%s][%zu] master, TH_FOUND_KEY, if you see this message, something is wrong\n", __func__, z);
                 fflush(stdout);
             } else if (status == TH_END) {
-                printf("[slave][%zu] master, TH_END reached\n", z);
+                printf("[%s][%zu] master, TH_END reached\n", __func__, z);
                 fflush(stdout);
             }
 #endif
diff --git a/tools/hitag2crack/crack5opencl/threads.h b/tools/hitag2crack/crack5opencl/threads.h
index d60c16cfc..15874a5a1 100644
--- a/tools/hitag2crack/crack5opencl/threads.h
+++ b/tools/hitag2crack/crack5opencl/threads.h
@@ -38,7 +38,6 @@ typedef enum thread_status {
     TH_START = 0,
     TH_WAIT,
     TH_PROCESSING,
-    TH_STOP,
     TH_ERROR,
     TH_FOUND_KEY,
     TH_END
@@ -66,7 +65,8 @@ typedef enum thread_error {
     THREAD_ERROR_MUTEX_USLEEP = -11,
     THREAD_ERROR_COND_USLEEP = -12,
     THREAD_ERROR_GENERIC = -13,
-    THREAD_ERROR_ALLOC = -14
+    THREAD_ERROR_ALLOC = -14,
+    THREAD_ERROR_INTERNAL = -15
 
 } thread_error_t;
 
@@ -92,6 +92,7 @@ typedef struct threads_ctx {
     pthread_attr_t attr;
     pthread_mutexattr_t mutex_attr;
 
+    unsigned char pad3[4];
 } thread_ctx_t;
 
 // used by threads engine
@@ -105,13 +106,13 @@ typedef struct thread_arg {
     bool r;
     bool err;
     bool quit;
-    bool async;
 
+    unsigned char pad2[1];
     uint64_t off;
     uint64_t *matches;
     uint32_t *matches_found;
     size_t slice;
-    size_t max_step;
+    size_t max_slices;
     size_t device_id;
 
     uint64_t key;
@@ -124,11 +125,12 @@ typedef struct thread_arg {
 int thread_init(thread_ctx_t *ctx, short type, size_t thread_count);
 int thread_start(thread_ctx_t *ctx, thread_args_t *args);
 int thread_stop(thread_ctx_t *ctx);
+int thread_start_scheduler(thread_ctx_t *ctx, thread_args_t *t_arg, wu_queue_ctx_t *queue_ctx);
+bool thread_setEnd(thread_ctx_t *ctx, thread_args_t *t_arg);
 
 void tprintf(const char *restrict format, ...);
 const char *thread_strerror(int error);
 const char *thread_status_strdesc(thread_status_t s);
-bool thread_setEnd(thread_ctx_t *ctx, thread_args_t *t_arg);
 
 void *computing_process(void *arg);
 void *computing_process_async(void *arg);

From c15266dfc2fa8ca8f260cfb15dee60c15ee4db4c Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Sat, 16 Jan 2021 01:59:02 +0100
Subject: [PATCH 372/682] added timeouts

---
 armsrc/em4x50.c          | 255 ++++++++++++++++++++++-----------------
 client/src/cmdlfem4x50.c |  22 +++-
 2 files changed, 159 insertions(+), 118 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index a90d977ea..80e675165 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -40,6 +40,7 @@
 #define EM4X50_T_TAG_WAITING_FOR_SIGNAL     75
 #define EM4X50_T_WAITING_FOR_DBLLIW         1550
 #define EM4X50_T_WAITING_FOR_ACK            4
+//#define EM4X50_T_SIMULATION_TIMEOUT       100
 
 // the following value seems to be critical; if it's too low (e.g. < 120)
 // some cards are no longer readable although they're ok
@@ -669,62 +670,53 @@ static int get_word_from_bitstream(uint32_t *data) {
     return PM3_EOPABORTED;
 }
 
-static bool em4x50_sim_send_bit(uint8_t bit) {
+static int em4x50_sim_send_bit(uint8_t bit) {
 
-    uint16_t check = 0;
+    uint16_t timeout = EM4X50_T_TAG_FULL_PERIOD;
 
     for (int t = 0; t < EM4X50_T_TAG_FULL_PERIOD; t++) {
 
         // wait until SSC_CLK goes HIGH
         // used as a simple detection of a reader field?
-        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
-            WDT_HIT();
-            if (check == 1000) {
-                if (BUTTON_PRESS())
-                    return false;
-                check = 0;
-            }
-            ++check;
+        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) && (timeout--));
+        
+        if (timeout == 0) {
+            return PM3_ETIMEOUT;
         }
+        timeout = EM4X50_T_TAG_FULL_PERIOD;
 
         if (bit)
             OPEN_COIL();
         else
             SHORT_COIL();
 
-        check = 0;
-
         //wait until SSC_CLK goes LOW
-        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
-            WDT_HIT();
-            if (check == 1000) {
-                if (BUTTON_PRESS())
-                    return false;
-                check = 0;
-            }
-            ++check;
+        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK && (timeout--));
+        if (timeout == 0) {
+            return PM3_ETIMEOUT;
         }
+        timeout = EM4X50_T_TAG_FULL_PERIOD;
 
         if (t == EM4X50_T_TAG_HALF_PERIOD)
             bit ^= 1;
 
     }
 
-    return true;
+    return PM3_SUCCESS;
 }
 
-static bool em4x50_sim_send_byte(uint8_t byte) {
+static int em4x50_sim_send_byte(uint8_t byte) {
 
     // send byte
     for (int i = 0; i < 8; i++)
-        if (!em4x50_sim_send_bit((byte >> (7 - i)) & 1))
-            return false;
+        if (em4x50_sim_send_bit((byte >> (7 - i)) & 1) == PM3_ETIMEOUT)
+            return PM3_ETIMEOUT;
 
-    return true;
+    return PM3_SUCCESS;
 
 }
 
-static bool em4x50_sim_send_byte_with_parity(uint8_t byte) {
+static int em4x50_sim_send_byte_with_parity(uint8_t byte) {
 
     uint8_t parity = 0x0;
 
@@ -732,16 +724,18 @@ static bool em4x50_sim_send_byte_with_parity(uint8_t byte) {
     for (int i = 0; i < 8; i++)
         parity ^= (byte >> i) & 1;
 
-    if (em4x50_sim_send_byte(byte) == false)
-        return false;;
+    if (em4x50_sim_send_byte(byte) == PM3_ETIMEOUT) {
+        return PM3_ETIMEOUT;
+    }
 
-    if (em4x50_sim_send_bit(parity) == false)
-        return false;
+    if (em4x50_sim_send_bit(parity) == PM3_ETIMEOUT) {
+        return PM3_ETIMEOUT;
+    }
 
-    return true;
+    return PM3_SUCCESS;
 }
 
-static bool em4x50_sim_send_word(uint32_t word) {
+static int em4x50_sim_send_word(uint32_t word) {
 
     uint8_t cparity = 0x00;
 
@@ -750,8 +744,8 @@ static bool em4x50_sim_send_word(uint32_t word) {
 
     // 4 bytes each with even row parity bit
     for (int i = 0; i < 4; i++) {
-        if (em4x50_sim_send_byte_with_parity((word >> ((3 - i) * 8)) & 0xFF) == false) {
-            return false;
+        if (em4x50_sim_send_byte_with_parity((word >> ((3 - i) * 8)) & 0xFF) == PM3_ETIMEOUT) {
+            return PM3_ETIMEOUT;
         }
     }
 
@@ -762,47 +756,36 @@ static bool em4x50_sim_send_word(uint32_t word) {
             cparity ^= (((word >> ((3 - j) * 8)) & 0xFF) >> (7 - i)) & 1;
         }
     }
-    if (em4x50_sim_send_byte(cparity) == false)
-        return false;
+    if (em4x50_sim_send_byte(cparity) == PM3_ETIMEOUT) {
+        return PM3_ETIMEOUT;
+    }
 
     // stop bit
-    if (em4x50_sim_send_bit(0) == false)
-        return false;
+    if (em4x50_sim_send_bit(0) == PM3_ETIMEOUT) {
+        return PM3_ETIMEOUT;
+    }
 
-    return true;
+    return PM3_SUCCESS;
 }
 
 static int wait_cycles(int maxperiods) {
 
-    int period = 0, check = 0;
+    int EM4X50_T_SIMULATION_TIMEOUT = 500;
+    int period = 0, timeout = EM4X50_T_SIMULATION_TIMEOUT;
 
     while (period < maxperiods) {
         
-        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
-            WDT_HIT();
-            
-            if (check == 1000) {
-                if (BUTTON_PRESS()) {
-                    return PM3_EOPABORTED;
-                }
-                check = 0;
-            }
-            ++check;
+        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) && (timeout--));
+        if (timeout <= 0) {
+            return PM3_ETIMEOUT;
         }
-
-        check = 0;
+        timeout = EM4X50_T_SIMULATION_TIMEOUT;
         
-        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
-            WDT_HIT();
-            
-            if (check == 1000) {
-                if (BUTTON_PRESS()) {
-                    return PM3_EOPABORTED;
-                }
-                check = 0;
-            }
-            ++check;
+        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK && (timeout--));
+        if (timeout <= 0) {
+            return PM3_ETIMEOUT;
         }
+        timeout = EM4X50_T_SIMULATION_TIMEOUT;
         
         period++;
     }
@@ -810,14 +793,21 @@ static int wait_cycles(int maxperiods) {
     return PM3_SUCCESS;
 }
  
-static uint8_t em4x50_sim_read_bit(void) {
+static int em4x50_sim_read_bit(void) {
 
+    int EM4X50_T_SIMULATION_TIMEOUT = 500;
     int cycles = 0;
+    int timeout1 = EM4X50_T_SIMULATION_TIMEOUT;
+    int timeout2 = EM4X50_T_SIMULATION_TIMEOUT;
 
     while (cycles < EM4X50_T_TAG_FULL_PERIOD) {
 
         // wait until reader field disappears
-        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
+        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) && (timeout1--));
+        if (timeout1 <= 0) {
+            return PM3_ETIMEOUT;
+        }
+        timeout1 = EM4X50_T_SIMULATION_TIMEOUT;
 
         // reader field is off, reset timer TC0
         AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
@@ -829,12 +819,17 @@ static uint8_t em4x50_sim_read_bit(void) {
             if (AT91C_BASE_TC0->TC_CV > T0 * EM4X50_ZERO_DETECTION) {
 
                 // gap detected; wait until reader field is switched on again
-                while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK);
+                while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK && (timeout2--));
                 
+                if (timeout2 <= 0) {
+                    return PM3_ETIMEOUT;
+                }
+                timeout2 = EM4X50_T_SIMULATION_TIMEOUT;
+
                 // now we have a reference "position", from here it will take
                 // slightly less 32 cycles until the end of the bit period
-                wait_cycles(EM4X50_T_TAG_FULL_PERIOD - EM4X50_ZERO_DETECTION);
-                
+                wait_cycles(28);
+
                 // end of bit period is reached; return with bit value "0"
                 // (cf. datasheet)
                 return 0;
@@ -851,46 +846,68 @@ static uint8_t em4x50_sim_read_bit(void) {
     return 1;
 }
  
-static uint8_t em4x50_sim_read_byte(void) {
+static int em4x50_sim_read_byte(void) {
     
-    uint8_t byte = 0;
+    int bit = 0, byte = 0;
     
     for (int i = 0; i < 8; i++) {
         byte <<= 1;
-        byte |= em4x50_sim_read_bit();
+        bit = em4x50_sim_read_bit();
+        if (bit == PM3_ETIMEOUT) {
+            return PM3_ETIMEOUT;
+        }
+        byte |= bit;
     }
         
     return byte;
 }
 
-static bool em4x50_sim_read_byte_with_parity_check(uint8_t *byte) {
+static int em4x50_sim_read_byte_with_parity_check(uint8_t *byte) {
     
-    uint8_t parity = 0, pval = 0;
+    int bit = 0, pval = 0;
+    uint8_t parity = 0;
     
     for (int i = 0; i < 8; i++) {
         *byte <<= 1;
-        *byte |= em4x50_sim_read_bit();
+        bit = em4x50_sim_read_bit();
+        if (bit == PM3_ETIMEOUT) {
+            return PM3_ETIMEOUT;
+        }
+        *byte |= bit;
+
         parity ^= ((*byte) & 1);
     }
         
     pval = em4x50_sim_read_bit();
+    if (pval == PM3_ETIMEOUT) {
+        return PM3_ETIMEOUT;
+    }
 
-    return (parity == pval);
+    return (parity == pval) ? PM3_SUCCESS : PM3_EFAILED;
 }
 
-static bool em4x50_sim_read_word(uint32_t *word) {
+static int em4x50_sim_read_word(uint32_t *word) {
     
-    uint8_t parities = 0, parities_calculated = 0, stop_bit = 0;
+    int stop_bit = 0;
+    int parities = 0, parities_calculated = 0;
     uint8_t bytes[4] = {0};
 
     // read plain data
     for (int i = 0; i < 4; i++) {
-         em4x50_sim_read_byte_with_parity_check(&bytes[i]);
+        if (em4x50_sim_read_byte_with_parity_check(&bytes[i]) != PM3_SUCCESS) {
+            return PM3_ETIMEOUT;
+        }
     }
         
     // read column parities and stop bit
     parities = em4x50_sim_read_byte();
+    if (parities == PM3_ETIMEOUT) {
+        return PM3_ETIMEOUT;
+    }
     stop_bit = em4x50_sim_read_bit();
+    if (stop_bit == PM3_ETIMEOUT) {
+        return PM3_ETIMEOUT;
+    }
 
     // calculate column parities from data
     for (int i = 0; i < 8; i++) {
@@ -904,10 +921,10 @@ static bool em4x50_sim_read_word(uint32_t *word) {
     
     // check parities
     if ((parities == parities_calculated) && (stop_bit == 0)) {
-        return true;
+        return PM3_SUCCESS;
     }
     
-    return false;
+    return PM3_EFAILED;
 }
 
 static void em4x50_sim_send_ack(void) {
@@ -963,7 +980,9 @@ static int em4x50_sim_handle_login_command(uint32_t *tag) {
 
     // read password
     uint32_t password = 0;
-    bool pwd_ok = em4x50_sim_read_word(&password);
+    int pwd = em4x50_sim_read_word(&password);
+    
+    em4x50_sim_read_word(&password);
     //wait_cycles(15);
 
     // processing pause time (corresponds to a "1" bit)
@@ -972,14 +991,13 @@ static int em4x50_sim_handle_login_command(uint32_t *tag) {
     // empirically determined delay (to be examined seperately)
     wait_cycles(1);
     
-    if (pwd_ok && (password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
+    if ((pwd == PM3_SUCCESS) && (password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
         em4x50_sim_send_ack();
         gLogin = true;
     } else {
         em4x50_sim_send_nak();
         gLogin = false;
     }
-    
     // continue with standard read mode
     return EM4X50_COMMAND_STANDARD_READ;
 }
@@ -1004,15 +1022,15 @@ static int em4x50_sim_handle_write_command(uint32_t *tag) {
 
     // read address
     uint8_t address = 0;
-    bool addr_ok = em4x50_sim_read_byte_with_parity_check(&address);
+    int addr = em4x50_sim_read_byte_with_parity_check(&address);
     // read data
     uint32_t data = 0;
-    bool word_ok = em4x50_sim_read_word(&data);
+    int word = em4x50_sim_read_word(&data);
         
     // write access time
     wait_cycles(EM4X50_T_TAG_TWA);
 
-    if ((addr_ok == false) || (word_ok == false)) {
+    if ((addr != PM3_SUCCESS) || (word != PM3_SUCCESS)) {
         em4x50_sim_send_nak();
         return EM4X50_COMMAND_STANDARD_READ;
     }
@@ -1103,7 +1121,7 @@ static int em4x50_sim_handle_write_command(uint32_t *tag) {
 
 static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
 
-    bool pwd_ok = false;
+    int pwd = 0;
     
     if (gWritePasswordProcess == false) {
         
@@ -1111,14 +1129,14 @@ static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
 
         // read password
         uint32_t act_password = 0;
-        pwd_ok = em4x50_sim_read_word(&act_password);
+        pwd = em4x50_sim_read_word(&act_password);
         
-        wait_cycles(15);
+        //wait_cycles(15);
 
         // processing pause time (corresponds to a "1" bit)
         em4x50_sim_send_bit(1);
         
-        if (pwd_ok && (act_password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
+        if ((pwd == PM3_SUCCESS) && (act_password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
             em4x50_sim_send_ack();
             gLogin = true;
         } else {
@@ -1138,19 +1156,20 @@ static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
 
         // read new password
         uint32_t new_password = 0;
-        pwd_ok = em4x50_sim_read_word(&new_password);
-        
+        pwd = em4x50_sim_read_word(&new_password);
+
         // write access time
         wait_cycles(EM4X50_T_TAG_TWA);
 
-        if (pwd_ok) {
+        if (pwd == PM3_SUCCESS) {
             em4x50_sim_send_ack();
             tag[EM4X50_DEVICE_PASSWORD] = reflect32(new_password);
         } else {
             em4x50_sim_send_ack();
             return EM4X50_COMMAND_STANDARD_READ;
         }
-        //OPEN_COIL();
+        
+        //wait_cycles(15);
 
         // EEPROM write time
         wait_cycles(EM4X50_T_TAG_TWEE);
@@ -1158,7 +1177,7 @@ static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
         // strange: need some sort of 'waveform correction', otherwise ack signal
         // will not be detected; sending a single "1" seems to solve the problem
         em4x50_sim_send_bit(1);
-        
+
         em4x50_sim_send_ack();
 
         // continue with standard read mode
@@ -1171,17 +1190,17 @@ static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
 
 static int em4x50_sim_handle_selective_read_command(uint32_t *tag) {
 
-    int command = PM3_EOPABORTED;
+    int command = 0;
     
     // read password
     uint32_t address = 0;
-    bool addr_ok = em4x50_sim_read_word(&address);
-    wait_cycles(15);
+    int addr = em4x50_sim_read_word(&address);
+    //wait_cycles(15);
 
     // processing pause time (corresponds to a "1" bit)
     em4x50_sim_send_bit(1);
 
-    if (addr_ok) {
+    if (addr == PM3_SUCCESS) {
         em4x50_sim_send_ack();
     } else {
         em4x50_sim_send_nak();
@@ -1224,12 +1243,12 @@ static int em4x50_sim_handle_selective_read_command(uint32_t *tag) {
         }
     }
 
-    return command;
+    return PM3_EOPABORTED;
 }
 
 static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
     
-    int command = PM3_EOPABORTED;
+    int command = 0;
     
     // extract control data
     int fwr = reflect32(tag[EM4X50_CONTROL]) & 0xFF;      // first word read
@@ -1264,17 +1283,20 @@ static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
             }
         }
     }
-    return command;
+
+    return PM3_EOPABORTED;
 }
 
 // reader requests receive mode (rm) by sending two zeros
 static int check_rm_request(uint32_t *tag) {
     
     // look for first zero
-    if (em4x50_sim_read_bit() == 0) {
+    int bit = em4x50_sim_read_bit();
+    if (bit == 0) {
 
         // look for second zero
-        if (em4x50_sim_read_bit() == 0) {
+        bit = em4x50_sim_read_bit();
+        if (bit == 0) {
 
             // if command before was EM4X50_COMMAND_WRITE_PASSWORD
             // switch to separate process
@@ -1289,7 +1311,7 @@ static int check_rm_request(uint32_t *tag) {
         }
     }
     
-    return PM3_SUCCESS;
+    return (bit != PM3_ETIMEOUT) ? PM3_SUCCESS : PM3_ETIMEOUT;
 }
 
 static int em4x50_sim_send_listen_window(uint32_t *tag) {
@@ -1785,7 +1807,7 @@ void em4x50_writepwd(em4x50_data_t *etd) {
 // simulate uploaded data in emulator memory
 void em4x50_sim(uint32_t *password) {
     
-    int status = PM3_SUCCESS;
+    int command = PM3_ENODATA;
     
     uint8_t *em4x50_mem = BigBuf_get_EM_addr();
     uint32_t tag[EM4X50_NO_WORDS] = {0x0};
@@ -1806,10 +1828,14 @@ void em4x50_sim(uint32_t *password) {
         gLogin = false;
 
         // start with inital command = standard read mode
-        int command = EM4X50_COMMAND_STANDARD_READ;
+        command = EM4X50_COMMAND_STANDARD_READ;
 
         for (;;) {
 
+            if (data_available()) {
+                command = PM3_EOPABORTED;
+            }
+            
             switch (command) {
 
                 case EM4X50_COMMAND_LOGIN:
@@ -1831,24 +1857,25 @@ void em4x50_sim(uint32_t *password) {
                 case EM4X50_COMMAND_SELECTIVE_READ:
                     command =  em4x50_sim_handle_selective_read_command(tag);
                     break;
-
-                default:
+                    
+                case EM4X50_COMMAND_STANDARD_READ:
                     command = em4x50_sim_handle_standard_read_command(tag);
                     break;
             }
-
+            
             if (command == PM3_EOPABORTED) {
                 break;
             }
+            
+            if (command == PM3_ETIMEOUT) {
+                command = EM4X50_COMMAND_STANDARD_READ;
+            }
         }
-        
-    } else {
-        status = PM3_ENODATA;
     }
-
+    
     BigBuf_free();
     lf_finalize();
-    reply_ng(CMD_LF_EM4X50_SIM, status, NULL, 0);
+    reply_ng(CMD_LF_EM4X50_SIM, command, NULL, 0);
 }
 
 void em4x50_test(em4x50_test_t *ett) {
diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c
index 3aea9e981..f71696268 100644
--- a/client/src/cmdlfem4x50.c
+++ b/client/src/cmdlfem4x50.c
@@ -1249,11 +1249,25 @@ int CmdEM4x50Sim(const char *Cmd) {
     clearCommandBuffer();
     SendCommandNG(CMD_LF_EM4X50_SIM, (uint8_t *)&password, sizeof(password));
     PacketResponseNG resp;
-    WaitForResponse(CMD_LF_EM4X50_SIM, &resp);
-    if (resp.status == PM3_SUCCESS)
-        PrintAndLogEx(INFO, "Done");
+    
+    PrintAndLogEx(INFO, "Press pm3-button to abort simulation");
+    bool keypress = kbd_enter_pressed();
+    while (keypress == false) {
+        keypress = kbd_enter_pressed();
+
+        if (WaitForResponseTimeout(CMD_LF_EM4X50_SIM, &resp, 1500)) {
+            break;
+        }
+
+    }
+    if (keypress) {
+        SendCommandNG(CMD_BREAK_LOOP, NULL, 0);
+    }
+
+    if ((resp.status == PM3_SUCCESS) || (resp.status == PM3_EOPABORTED))
+        PrintAndLogEx(SUCCESS, "Done");
     else
-        PrintAndLogEx(FAILED, "No valid em4x50 data in memory.");
+        PrintAndLogEx(FAILED, "No valid em4x50 data in memory");
 
     return resp.status;
 }

From cff48f84c6f9fa1ae65ed872b0d916ad8bf052fd Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Sat, 16 Jan 2021 19:40:42 +0100
Subject: [PATCH 373/682] refactoring

---
 armsrc/em4x50.c          | 70 +++++++++++-----------------------------
 client/src/cmdlfem4x50.c |  7 ++--
 2 files changed, 23 insertions(+), 54 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index 80e675165..b0bbe827e 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -708,9 +708,9 @@ static int em4x50_sim_send_bit(uint8_t bit) {
 static int em4x50_sim_send_byte(uint8_t byte) {
 
     // send byte
-    for (int i = 0; i < 8; i++)
-        if (em4x50_sim_send_bit((byte >> (7 - i)) & 1) == PM3_ETIMEOUT)
-            return PM3_ETIMEOUT;
+    for (int i = 0; i < 8; i++) {
+        em4x50_sim_send_bit((byte >> (7 - i)) & 1);
+    }
 
     return PM3_SUCCESS;
 
@@ -724,13 +724,8 @@ static int em4x50_sim_send_byte_with_parity(uint8_t byte) {
     for (int i = 0; i < 8; i++)
         parity ^= (byte >> i) & 1;
 
-    if (em4x50_sim_send_byte(byte) == PM3_ETIMEOUT) {
-        return PM3_ETIMEOUT;
-    }
-
-    if (em4x50_sim_send_bit(parity) == PM3_ETIMEOUT) {
-        return PM3_ETIMEOUT;
-    }
+    em4x50_sim_send_byte(byte);
+    em4x50_sim_send_bit(parity);
 
     return PM3_SUCCESS;
 }
@@ -744,9 +739,7 @@ static int em4x50_sim_send_word(uint32_t word) {
 
     // 4 bytes each with even row parity bit
     for (int i = 0; i < 4; i++) {
-        if (em4x50_sim_send_byte_with_parity((word >> ((3 - i) * 8)) & 0xFF) == PM3_ETIMEOUT) {
-            return PM3_ETIMEOUT;
-        }
+        em4x50_sim_send_byte_with_parity((word >> ((3 - i) * 8)) & 0xFF);
     }
 
     // column parity
@@ -756,14 +749,10 @@ static int em4x50_sim_send_word(uint32_t word) {
             cparity ^= (((word >> ((3 - j) * 8)) & 0xFF) >> (7 - i)) & 1;
         }
     }
-    if (em4x50_sim_send_byte(cparity) == PM3_ETIMEOUT) {
-        return PM3_ETIMEOUT;
-    }
+    em4x50_sim_send_byte(cparity);
 
     // stop bit
-    if (em4x50_sim_send_bit(0) == PM3_ETIMEOUT) {
-        return PM3_ETIMEOUT;
-    }
+    em4x50_sim_send_bit(0);
 
     return PM3_SUCCESS;
 }
@@ -848,15 +837,11 @@ static int em4x50_sim_read_bit(void) {
  
 static int em4x50_sim_read_byte(void) {
     
-    int bit = 0, byte = 0;
+    int byte = 0;
     
     for (int i = 0; i < 8; i++) {
         byte <<= 1;
-        bit = em4x50_sim_read_bit();
-        if (bit == PM3_ETIMEOUT) {
-            return PM3_ETIMEOUT;
-        }
-        byte |= bit;
+        byte |= em4x50_sim_read_bit();
     }
         
     return byte;
@@ -864,24 +849,16 @@ static int em4x50_sim_read_byte(void) {
 
 static int em4x50_sim_read_byte_with_parity_check(uint8_t *byte) {
     
-    int bit = 0, pval = 0;
+    int pval = 0;
     uint8_t parity = 0;
     
     for (int i = 0; i < 8; i++) {
         *byte <<= 1;
-        bit = em4x50_sim_read_bit();
-        if (bit == PM3_ETIMEOUT) {
-            return PM3_ETIMEOUT;
-        }
-        *byte |= bit;
-
+        *byte |= em4x50_sim_read_bit();
         parity ^= ((*byte) & 1);
     }
         
     pval = em4x50_sim_read_bit();
-    if (pval == PM3_ETIMEOUT) {
-        return PM3_ETIMEOUT;
-    }
 
     return (parity == pval) ? PM3_SUCCESS : PM3_EFAILED;
 }
@@ -894,20 +871,12 @@ static int em4x50_sim_read_word(uint32_t *word) {
 
     // read plain data
     for (int i = 0; i < 4; i++) {
-        if (em4x50_sim_read_byte_with_parity_check(&bytes[i]) != PM3_SUCCESS) {
-            return PM3_ETIMEOUT;
-        }
+        em4x50_sim_read_byte_with_parity_check(&bytes[i]);
     }
-        
+
     // read column parities and stop bit
     parities = em4x50_sim_read_byte();
-    if (parities == PM3_ETIMEOUT) {
-        return PM3_ETIMEOUT;
-    }
     stop_bit = em4x50_sim_read_bit();
-    if (stop_bit == PM3_ETIMEOUT) {
-        return PM3_ETIMEOUT;
-    }
 
     // calculate column parities from data
     for (int i = 0; i < 8; i++) {
@@ -1217,8 +1186,7 @@ static int em4x50_sim_handle_selective_read_command(uint32_t *tag) {
     // last word read protected
     int lwrp = (reflect32(tag[EM4X50_PROTECTION]) >> 8) & 0xFF;
     
-    // iceman,  will need a usb cmd check to break as well
-    while (BUTTON_PRESS() == false) {
+    while ((BUTTON_PRESS() == false) && (data_available() == false)) {
 
         WDT_HIT();
 
@@ -1260,7 +1228,7 @@ static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
     int lwrp = (reflect32(tag[EM4X50_PROTECTION]) >> 8) & 0xFF;
 
     // iceman,  will need a usb cmd check to break as well
-    while (BUTTON_PRESS() == false) {
+    while ((BUTTON_PRESS() == false) && (data_available() == false)) {
 
         WDT_HIT();
 
@@ -1832,10 +1800,6 @@ void em4x50_sim(uint32_t *password) {
 
         for (;;) {
 
-            if (data_available()) {
-                command = PM3_EOPABORTED;
-            }
-            
             switch (command) {
 
                 case EM4X50_COMMAND_LOGIN:
@@ -1863,10 +1827,12 @@ void em4x50_sim(uint32_t *password) {
                     break;
             }
             
+            // stop if key (pm3 button or enter key) has been pressed
             if (command == PM3_EOPABORTED) {
                 break;
             }
             
+            // if timeout (e.g. no reader field) go on with standard read mode
             if (command == PM3_ETIMEOUT) {
                 command = EM4X50_COMMAND_STANDARD_READ;
             }
diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c
index f71696268..908ab3bfa 100644
--- a/client/src/cmdlfem4x50.c
+++ b/client/src/cmdlfem4x50.c
@@ -1212,6 +1212,7 @@ int CmdEM4x50Restore(const char *Cmd) {
 
 int CmdEM4x50Sim(const char *Cmd) {
     
+    int status = PM3_EFAILED;
     uint32_t password = 0;
     
     CLIParserContext *ctx;
@@ -1256,16 +1257,18 @@ int CmdEM4x50Sim(const char *Cmd) {
         keypress = kbd_enter_pressed();
 
         if (WaitForResponseTimeout(CMD_LF_EM4X50_SIM, &resp, 1500)) {
+            status = resp.status;
             break;
         }
 
     }
     if (keypress) {
         SendCommandNG(CMD_BREAK_LOOP, NULL, 0);
+        status = PM3_EOPABORTED;
     }
 
-    if ((resp.status == PM3_SUCCESS) || (resp.status == PM3_EOPABORTED))
-        PrintAndLogEx(SUCCESS, "Done");
+    if ((status == PM3_SUCCESS) || (status == PM3_EOPABORTED))
+        PrintAndLogEx(INFO, "Done");
     else
         PrintAndLogEx(FAILED, "No valid em4x50 data in memory");
 

From 03d56596cb8811abe0d4eaa0cc085191cbcebcca Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Sun, 17 Jan 2021 00:27:08 +0100
Subject: [PATCH 374/682] clean up

---
 armsrc/em4x50.c | 189 +++++++++++++++++++++++++-----------------------
 1 file changed, 97 insertions(+), 92 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index b0bbe827e..eed22bb96 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -40,7 +40,8 @@
 #define EM4X50_T_TAG_WAITING_FOR_SIGNAL     75
 #define EM4X50_T_WAITING_FOR_DBLLIW         1550
 #define EM4X50_T_WAITING_FOR_ACK            4
-//#define EM4X50_T_SIMULATION_TIMEOUT       100
+#define EM4X50_T_SIMULATION_TIMEOUT_READ    400
+#define EM4X50_T_SIMULATION_TIMEOUT_WAIT    50
 
 // the following value seems to be critical; if it's too low (e.g. < 120)
 // some cards are no longer readable although they're ok
@@ -221,6 +222,8 @@ static void em4x50_setup_sim(void) {
 
     // Watchdog hit
     WDT_HIT();
+    
+    LEDsoff();
 }
 
 // calculate signal properties (mean amplitudes) from measured data:
@@ -670,7 +673,7 @@ static int get_word_from_bitstream(uint32_t *data) {
     return PM3_EOPABORTED;
 }
 
-static int em4x50_sim_send_bit(uint8_t bit) {
+static void em4x50_sim_send_bit(uint8_t bit) {
 
     uint16_t timeout = EM4X50_T_TAG_FULL_PERIOD;
 
@@ -681,7 +684,7 @@ static int em4x50_sim_send_bit(uint8_t bit) {
         while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) && (timeout--));
         
         if (timeout == 0) {
-            return PM3_ETIMEOUT;
+            return;
         }
         timeout = EM4X50_T_TAG_FULL_PERIOD;
 
@@ -693,7 +696,7 @@ static int em4x50_sim_send_bit(uint8_t bit) {
         //wait until SSC_CLK goes LOW
         while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK && (timeout--));
         if (timeout == 0) {
-            return PM3_ETIMEOUT;
+            return;
         }
         timeout = EM4X50_T_TAG_FULL_PERIOD;
 
@@ -701,36 +704,28 @@ static int em4x50_sim_send_bit(uint8_t bit) {
             bit ^= 1;
 
     }
-
-    return PM3_SUCCESS;
 }
 
-static int em4x50_sim_send_byte(uint8_t byte) {
+static void em4x50_sim_send_byte(uint8_t byte, bool paritycheck) {
 
     // send byte
     for (int i = 0; i < 8; i++) {
         em4x50_sim_send_bit((byte >> (7 - i)) & 1);
     }
 
-    return PM3_SUCCESS;
+    if (paritycheck) {
 
+        uint8_t parity = 0x0;
+
+        for (int i = 0; i < 8; i++) {
+            parity ^= (byte >> i) & 1;
+        }
+
+        em4x50_sim_send_bit(parity);
+    }
 }
 
-static int em4x50_sim_send_byte_with_parity(uint8_t byte) {
-
-    uint8_t parity = 0x0;
-
-    // send byte with parity (even)
-    for (int i = 0; i < 8; i++)
-        parity ^= (byte >> i) & 1;
-
-    em4x50_sim_send_byte(byte);
-    em4x50_sim_send_bit(parity);
-
-    return PM3_SUCCESS;
-}
-
-static int em4x50_sim_send_word(uint32_t word) {
+static void em4x50_sim_send_word(uint32_t word) {
 
     uint8_t cparity = 0x00;
 
@@ -739,7 +734,7 @@ static int em4x50_sim_send_word(uint32_t word) {
 
     // 4 bytes each with even row parity bit
     for (int i = 0; i < 4; i++) {
-        em4x50_sim_send_byte_with_parity((word >> ((3 - i) * 8)) & 0xFF);
+        em4x50_sim_send_byte((word >> ((3 - i) * 8)) & 0xFF, true);
     }
 
     // column parity
@@ -749,56 +744,44 @@ static int em4x50_sim_send_word(uint32_t word) {
             cparity ^= (((word >> ((3 - j) * 8)) & 0xFF) >> (7 - i)) & 1;
         }
     }
-    em4x50_sim_send_byte(cparity);
+    em4x50_sim_send_byte(cparity, false);
 
     // stop bit
     em4x50_sim_send_bit(0);
-
-    return PM3_SUCCESS;
 }
 
-static int wait_cycles(int maxperiods) {
+static void wait_cycles(int maxperiods) {
 
-    int EM4X50_T_SIMULATION_TIMEOUT = 500;
-    int period = 0, timeout = EM4X50_T_SIMULATION_TIMEOUT;
+    int period = 0, timeout = EM4X50_T_SIMULATION_TIMEOUT_WAIT;
 
     while (period < maxperiods) {
         
         while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) && (timeout--));
         if (timeout <= 0) {
-            return PM3_ETIMEOUT;
+            return;
         }
-        timeout = EM4X50_T_SIMULATION_TIMEOUT;
+        timeout = EM4X50_T_SIMULATION_TIMEOUT_WAIT;
         
         while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK && (timeout--));
         if (timeout <= 0) {
-            return PM3_ETIMEOUT;
+            return;
         }
-        timeout = EM4X50_T_SIMULATION_TIMEOUT;
+        timeout = EM4X50_T_SIMULATION_TIMEOUT_WAIT;
         
         period++;
     }
-    
-    return PM3_SUCCESS;
 }
  
 static int em4x50_sim_read_bit(void) {
 
-    int EM4X50_T_SIMULATION_TIMEOUT = 500;
     int cycles = 0;
-    int timeout1 = EM4X50_T_SIMULATION_TIMEOUT;
-    int timeout2 = EM4X50_T_SIMULATION_TIMEOUT;
+    int timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
 
     while (cycles < EM4X50_T_TAG_FULL_PERIOD) {
 
         // wait until reader field disappears
-        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) && (timeout1--));
-        if (timeout1 <= 0) {
-            return PM3_ETIMEOUT;
-        }
-        timeout1 = EM4X50_T_SIMULATION_TIMEOUT;
+        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
 
-        // reader field is off, reset timer TC0
         AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
 
         // now check until reader switches on carrier field
@@ -808,15 +791,15 @@ static int em4x50_sim_read_bit(void) {
             if (AT91C_BASE_TC0->TC_CV > T0 * EM4X50_ZERO_DETECTION) {
 
                 // gap detected; wait until reader field is switched on again
-                while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK && (timeout2--));
+                while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK && (timeout--));
                 
-                if (timeout2 <= 0) {
+                if (timeout <= 0) {
                     return PM3_ETIMEOUT;
                 }
-                timeout2 = EM4X50_T_SIMULATION_TIMEOUT;
+                timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
 
                 // now we have a reference "position", from here it will take
-                // slightly less 32 cycles until the end of the bit period
+                // slightly less than 32 cycles until the end of the bit period
                 wait_cycles(28);
 
                 // end of bit period is reached; return with bit value "0"
@@ -834,48 +817,45 @@ static int em4x50_sim_read_bit(void) {
     // reached 64 cycles (= EM4X50_T_TAG_FULL_PERIOD) -> return bit value "1"
     return 1;
 }
- 
-static int em4x50_sim_read_byte(void) {
-    
-    int byte = 0;
-    
-    for (int i = 0; i < 8; i++) {
-        byte <<= 1;
-        byte |= em4x50_sim_read_bit();
-    }
-        
-    return byte;
-}
 
-static int em4x50_sim_read_byte_with_parity_check(uint8_t *byte) {
-    
-    int pval = 0;
-    uint8_t parity = 0;
+static bool em4x50_sim_read_byte(uint8_t *byte, bool paritycheck) {
     
     for (int i = 0; i < 8; i++) {
         *byte <<= 1;
         *byte |= em4x50_sim_read_bit();
-        parity ^= ((*byte) & 1);
     }
         
-    pval = em4x50_sim_read_bit();
+    if (paritycheck) {
 
-    return (parity == pval) ? PM3_SUCCESS : PM3_EFAILED;
+        int pval = em4x50_sim_read_bit();
+        uint8_t parity = 0;
+
+        for (int i = 0; i < 8; i++) {
+            parity ^= ((*byte) >> i) & 1;
+        }
+
+        if (parity != pval) {
+            return false;
+        }
+    }
+
+    return true;
+        
 }
 
-static int em4x50_sim_read_word(uint32_t *word) {
+static bool em4x50_sim_read_word(uint32_t *word) {
     
-    int stop_bit = 0;
-    int parities = 0, parities_calculated = 0;
+    uint8_t stop_bit = 0;
+    uint8_t parities = 0, parities_calculated = 0;
     uint8_t bytes[4] = {0};
 
     // read plain data
     for (int i = 0; i < 4; i++) {
-        em4x50_sim_read_byte_with_parity_check(&bytes[i]);
+        em4x50_sim_read_byte(&bytes[i], true);
     }
 
     // read column parities and stop bit
-    parities = em4x50_sim_read_byte();
+    em4x50_sim_read_byte(&parities, false);
     stop_bit = em4x50_sim_read_bit();
 
     // calculate column parities from data
@@ -890,10 +870,10 @@ static int em4x50_sim_read_word(uint32_t *word) {
     
     // check parities
     if ((parities == parities_calculated) && (stop_bit == 0)) {
-        return PM3_SUCCESS;
+        return true;
     }
     
-    return PM3_EFAILED;
+    return false;
 }
 
 static void em4x50_sim_send_ack(void) {
@@ -949,9 +929,11 @@ static int em4x50_sim_handle_login_command(uint32_t *tag) {
 
     // read password
     uint32_t password = 0;
-    int pwd = em4x50_sim_read_word(&password);
+    bool pwd = em4x50_sim_read_word(&password);
+    
+    // signal that reader sent the password
+    LED_D_ON();
     
-    em4x50_sim_read_word(&password);
     //wait_cycles(15);
 
     // processing pause time (corresponds to a "1" bit)
@@ -960,12 +942,14 @@ static int em4x50_sim_handle_login_command(uint32_t *tag) {
     // empirically determined delay (to be examined seperately)
     wait_cycles(1);
     
-    if ((pwd == PM3_SUCCESS) && (password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
+    if (pwd && (password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
         em4x50_sim_send_ack();
         gLogin = true;
+        LED_A_ON();
     } else {
         em4x50_sim_send_nak();
         gLogin = false;
+        LED_A_OFF();
     }
     // continue with standard read mode
     return EM4X50_COMMAND_STANDARD_READ;
@@ -991,15 +975,15 @@ static int em4x50_sim_handle_write_command(uint32_t *tag) {
 
     // read address
     uint8_t address = 0;
-    int addr = em4x50_sim_read_byte_with_parity_check(&address);
+    bool addr = em4x50_sim_read_byte(&address, true);
     // read data
     uint32_t data = 0;
-    int word = em4x50_sim_read_word(&data);
+    bool word = em4x50_sim_read_word(&data);
         
     // write access time
     wait_cycles(EM4X50_T_TAG_TWA);
 
-    if ((addr != PM3_SUCCESS) || (word != PM3_SUCCESS)) {
+    if ((addr == false) || (word == false)) {
         em4x50_sim_send_nak();
         return EM4X50_COMMAND_STANDARD_READ;
     }
@@ -1051,8 +1035,13 @@ static int em4x50_sim_handle_write_command(uint32_t *tag) {
 
         default:
             if ((address >= fwwp) && (address <= lwwp) && (gLogin == false)) {
-                em4x50_sim_send_nak();
-                return EM4X50_COMMAND_STANDARD_READ;
+                if (gLogin) {
+                    tag[address] = reflect32(data);
+                    em4x50_sim_send_ack();
+                } else {
+                    em4x50_sim_send_nak();
+                    return EM4X50_COMMAND_STANDARD_READ;
+                }
             } else {
                 tag[address] = reflect32(data);
                 em4x50_sim_send_ack();
@@ -1090,7 +1079,7 @@ static int em4x50_sim_handle_write_command(uint32_t *tag) {
 
 static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
 
-    int pwd = 0;
+    bool pwd = false;
     
     if (gWritePasswordProcess == false) {
         
@@ -1105,7 +1094,7 @@ static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
         // processing pause time (corresponds to a "1" bit)
         em4x50_sim_send_bit(1);
         
-        if ((pwd == PM3_SUCCESS) && (act_password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
+        if (pwd && (act_password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
             em4x50_sim_send_ack();
             gLogin = true;
         } else {
@@ -1130,7 +1119,7 @@ static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
         // write access time
         wait_cycles(EM4X50_T_TAG_TWA);
 
-        if (pwd == PM3_SUCCESS) {
+        if (pwd) {
             em4x50_sim_send_ack();
             tag[EM4X50_DEVICE_PASSWORD] = reflect32(new_password);
         } else {
@@ -1163,13 +1152,13 @@ static int em4x50_sim_handle_selective_read_command(uint32_t *tag) {
     
     // read password
     uint32_t address = 0;
-    int addr = em4x50_sim_read_word(&address);
+    bool addr = em4x50_sim_read_word(&address);
     //wait_cycles(15);
 
     // processing pause time (corresponds to a "1" bit)
     em4x50_sim_send_bit(1);
 
-    if (addr == PM3_SUCCESS) {
+    if (addr) {
         em4x50_sim_send_ack();
     } else {
         em4x50_sim_send_nak();
@@ -1217,7 +1206,7 @@ static int em4x50_sim_handle_selective_read_command(uint32_t *tag) {
 static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
     
     int command = 0;
-    
+
     // extract control data
     int fwr = reflect32(tag[EM4X50_CONTROL]) & 0xFF;      // first word read
     int lwr = (reflect32(tag[EM4X50_CONTROL]) >> 8) & 0xFF; // last word read
@@ -1244,7 +1233,7 @@ static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
                 return command;
             }
 
-            if ((i >= fwrp) && (i <= lwrp)) {
+            if ((gLogin == false) && (i >= fwrp) && (i <= lwrp)) {
                 em4x50_sim_send_word(0x00);
             } else {
                 em4x50_sim_send_word(reflect32(tag[i]));
@@ -1273,7 +1262,7 @@ static int check_rm_request(uint32_t *tag) {
             } else {
                 // read mode request detected, get command from reader
                 uint8_t command = 0;
-                em4x50_sim_read_byte_with_parity_check(&command);
+                em4x50_sim_read_byte(&command, true);
                 return command;
             }
         }
@@ -1773,6 +1762,10 @@ void em4x50_writepwd(em4x50_data_t *etd) {
 }
 
 // simulate uploaded data in emulator memory
+// LED A -> operations that require authentication are possible
+// LED B -> standard read mode is active
+// LED C -> command has been transmitted by reader
+// LED D -> password has been caught from reader
 void em4x50_sim(uint32_t *password) {
     
     int command = PM3_ENODATA;
@@ -1803,26 +1796,38 @@ void em4x50_sim(uint32_t *password) {
             switch (command) {
 
                 case EM4X50_COMMAND_LOGIN:
+                    LED_B_OFF();
+                    LED_C_OFF();
                     command = em4x50_sim_handle_login_command(tag);
                     break;
 
                 case EM4X50_COMMAND_RESET:
+                    LED_B_OFF();
+                    LED_C_OFF();
                     command =  em4x50_sim_handle_reset_command(tag);
                     break;
 
                 case EM4X50_COMMAND_WRITE:
+                    LED_B_OFF();
+                    LED_C_OFF();
                     command =  em4x50_sim_handle_write_command(tag);
                     break;
 
                 case EM4X50_COMMAND_WRITE_PASSWORD:
+                    LED_B_OFF();
+                    LED_C_OFF();
                     command =  em4x50_sim_handle_writepwd_command(tag);
                     break;
 
                 case EM4X50_COMMAND_SELECTIVE_READ:
+                    LED_B_OFF();
+                    LED_C_ON();
                     command =  em4x50_sim_handle_selective_read_command(tag);
                     break;
                     
                 case EM4X50_COMMAND_STANDARD_READ:
+                    LED_B_ON();
+                    LED_C_OFF();
                     command = em4x50_sim_handle_standard_read_command(tag);
                     break;
             }
@@ -1832,7 +1837,7 @@ void em4x50_sim(uint32_t *password) {
                 break;
             }
             
-            // if timeout (e.g. no reader field) go on with standard read mode
+            // if timeout (e.g. no reader field) continue with standard read mode
             if (command == PM3_ETIMEOUT) {
                 command = EM4X50_COMMAND_STANDARD_READ;
             }

From 473d89342b7ab2bfad28787d65b51d9e993469e7 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Sun, 17 Jan 2021 23:35:21 +0100
Subject: [PATCH 375/682] rearrangements

---
 armsrc/em4x50.c | 1264 ++++++++++++++++++++++++-----------------------
 1 file changed, 637 insertions(+), 627 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index eed22bb96..9d9da9a8d 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -40,8 +40,8 @@
 #define EM4X50_T_TAG_WAITING_FOR_SIGNAL     75
 #define EM4X50_T_WAITING_FOR_DBLLIW         1550
 #define EM4X50_T_WAITING_FOR_ACK            4
-#define EM4X50_T_SIMULATION_TIMEOUT_READ    400
-#define EM4X50_T_SIMULATION_TIMEOUT_WAIT    50
+#define EM4X50_T_SIMULATION_TIMEOUT_READ    5000 // 400
+#define EM4X50_T_SIMULATION_TIMEOUT_WAIT    5000 // 50
 
 // the following value seems to be critical; if it's too low (e.g. < 120)
 // some cards are no longer readable although they're ok
@@ -62,10 +62,12 @@
 int gHigh = 190;
 int gLow = 60;
 
-// a global parameter is needed to indicate whether a previous login was
-// successful, so operations that require authentication can be handled
+// indication whether a previous login has been successful, so operations
+// that require authentication can be handled
 bool gLogin = false;
-// additionally a global variable to identify the WritePassword process
+// WritePassword process in simulation mode is handled in a different way
+// compared to operations like read, write, login, so it is necessary to
+// to be able to identfiy it
 bool gWritePasswordProcess = false;
 
 static int em4x50_sim_send_listen_window(uint32_t *tag);
@@ -673,627 +675,6 @@ static int get_word_from_bitstream(uint32_t *data) {
     return PM3_EOPABORTED;
 }
 
-static void em4x50_sim_send_bit(uint8_t bit) {
-
-    uint16_t timeout = EM4X50_T_TAG_FULL_PERIOD;
-
-    for (int t = 0; t < EM4X50_T_TAG_FULL_PERIOD; t++) {
-
-        // wait until SSC_CLK goes HIGH
-        // used as a simple detection of a reader field?
-        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) && (timeout--));
-        
-        if (timeout == 0) {
-            return;
-        }
-        timeout = EM4X50_T_TAG_FULL_PERIOD;
-
-        if (bit)
-            OPEN_COIL();
-        else
-            SHORT_COIL();
-
-        //wait until SSC_CLK goes LOW
-        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK && (timeout--));
-        if (timeout == 0) {
-            return;
-        }
-        timeout = EM4X50_T_TAG_FULL_PERIOD;
-
-        if (t == EM4X50_T_TAG_HALF_PERIOD)
-            bit ^= 1;
-
-    }
-}
-
-static void em4x50_sim_send_byte(uint8_t byte, bool paritycheck) {
-
-    // send byte
-    for (int i = 0; i < 8; i++) {
-        em4x50_sim_send_bit((byte >> (7 - i)) & 1);
-    }
-
-    if (paritycheck) {
-
-        uint8_t parity = 0x0;
-
-        for (int i = 0; i < 8; i++) {
-            parity ^= (byte >> i) & 1;
-        }
-
-        em4x50_sim_send_bit(parity);
-    }
-}
-
-static void em4x50_sim_send_word(uint32_t word) {
-
-    uint8_t cparity = 0x00;
-
-    // word has tobe sent in msb, not lsb
-    word = reflect32(word);
-
-    // 4 bytes each with even row parity bit
-    for (int i = 0; i < 4; i++) {
-        em4x50_sim_send_byte((word >> ((3 - i) * 8)) & 0xFF, true);
-    }
-
-    // column parity
-    for (int i = 0; i < 8; i++) {
-        cparity <<= 1;
-        for (int j = 0; j < 4; j++) {
-            cparity ^= (((word >> ((3 - j) * 8)) & 0xFF) >> (7 - i)) & 1;
-        }
-    }
-    em4x50_sim_send_byte(cparity, false);
-
-    // stop bit
-    em4x50_sim_send_bit(0);
-}
-
-static void wait_cycles(int maxperiods) {
-
-    int period = 0, timeout = EM4X50_T_SIMULATION_TIMEOUT_WAIT;
-
-    while (period < maxperiods) {
-        
-        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) && (timeout--));
-        if (timeout <= 0) {
-            return;
-        }
-        timeout = EM4X50_T_SIMULATION_TIMEOUT_WAIT;
-        
-        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK && (timeout--));
-        if (timeout <= 0) {
-            return;
-        }
-        timeout = EM4X50_T_SIMULATION_TIMEOUT_WAIT;
-        
-        period++;
-    }
-}
- 
-static int em4x50_sim_read_bit(void) {
-
-    int cycles = 0;
-    int timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
-
-    while (cycles < EM4X50_T_TAG_FULL_PERIOD) {
-
-        // wait until reader field disappears
-        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
-
-        AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
-
-        // now check until reader switches on carrier field
-        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
-
-            // check if cycle (i.e. off -> on -> off) takes longer than T0
-            if (AT91C_BASE_TC0->TC_CV > T0 * EM4X50_ZERO_DETECTION) {
-
-                // gap detected; wait until reader field is switched on again
-                while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK && (timeout--));
-                
-                if (timeout <= 0) {
-                    return PM3_ETIMEOUT;
-                }
-                timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
-
-                // now we have a reference "position", from here it will take
-                // slightly less than 32 cycles until the end of the bit period
-                wait_cycles(28);
-
-                // end of bit period is reached; return with bit value "0"
-                // (cf. datasheet)
-                return 0;
-            }
-
-        }
-
-        // no gap detected, i.e. reader field is still up;
-        // continue with counting cycles
-        cycles++;
-    }
-
-    // reached 64 cycles (= EM4X50_T_TAG_FULL_PERIOD) -> return bit value "1"
-    return 1;
-}
-
-static bool em4x50_sim_read_byte(uint8_t *byte, bool paritycheck) {
-    
-    for (int i = 0; i < 8; i++) {
-        *byte <<= 1;
-        *byte |= em4x50_sim_read_bit();
-    }
-        
-    if (paritycheck) {
-
-        int pval = em4x50_sim_read_bit();
-        uint8_t parity = 0;
-
-        for (int i = 0; i < 8; i++) {
-            parity ^= ((*byte) >> i) & 1;
-        }
-
-        if (parity != pval) {
-            return false;
-        }
-    }
-
-    return true;
-        
-}
-
-static bool em4x50_sim_read_word(uint32_t *word) {
-    
-    uint8_t stop_bit = 0;
-    uint8_t parities = 0, parities_calculated = 0;
-    uint8_t bytes[4] = {0};
-
-    // read plain data
-    for (int i = 0; i < 4; i++) {
-        em4x50_sim_read_byte(&bytes[i], true);
-    }
-
-    // read column parities and stop bit
-    em4x50_sim_read_byte(&parities, false);
-    stop_bit = em4x50_sim_read_bit();
-
-    // calculate column parities from data
-    for (int i = 0; i < 8; i++) {
-        parities_calculated <<= 1;
-        for (int j = 0; j < 4; j++) {
-            parities_calculated ^= (bytes[j] >> (7 - i)) & 1;
-        }
-    }
-    
-    *word = BYTES2UINT32(bytes);
-    
-    // check parities
-    if ((parities == parities_calculated) && (stop_bit == 0)) {
-        return true;
-    }
-    
-    return false;
-}
-
-static void em4x50_sim_send_ack(void) {
-
-    SHORT_COIL();
-    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
-
-    OPEN_COIL();
-    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
-
-    SHORT_COIL();
-    wait_cycles(3 * EM4X50_T_TAG_HALF_PERIOD);
-
-    OPEN_COIL();
-    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
-
-    SHORT_COIL();
-    wait_cycles(3 * EM4X50_T_TAG_HALF_PERIOD);
-
-    OPEN_COIL();
-    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
-    
-    SHORT_COIL();
-}
-
-static void em4x50_sim_send_nak(void) {
-
-    SHORT_COIL();
-    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
-
-    OPEN_COIL();
-    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
-
-    SHORT_COIL();
-    wait_cycles(3 * EM4X50_T_TAG_HALF_PERIOD);
-
-    OPEN_COIL();
-    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
-
-    SHORT_COIL();
-    wait_cycles(EM4X50_T_TAG_FULL_PERIOD);
-
-    OPEN_COIL();
-    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
-
-    SHORT_COIL();
-    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
-
-    OPEN_COIL();
-}
-
-static int em4x50_sim_handle_login_command(uint32_t *tag) {
-
-    // read password
-    uint32_t password = 0;
-    bool pwd = em4x50_sim_read_word(&password);
-    
-    // signal that reader sent the password
-    LED_D_ON();
-    
-    //wait_cycles(15);
-
-    // processing pause time (corresponds to a "1" bit)
-    em4x50_sim_send_bit(1);
-
-    // empirically determined delay (to be examined seperately)
-    wait_cycles(1);
-    
-    if (pwd && (password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
-        em4x50_sim_send_ack();
-        gLogin = true;
-        LED_A_ON();
-    } else {
-        em4x50_sim_send_nak();
-        gLogin = false;
-        LED_A_OFF();
-    }
-    // continue with standard read mode
-    return EM4X50_COMMAND_STANDARD_READ;
-}
-
-static int em4x50_sim_handle_reset_command(uint32_t *tag) {
-
-    // processing pause time (corresponds to a "1" bit)
-    em4x50_sim_send_bit(1);
-
-    // send ACK
-    em4x50_sim_send_ack();
-    gLogin = false;
-    
-    // wait for tinit
-    wait_cycles(EM4X50_T_TAG_TINIT);
-    
-    // continue with standard read mode
-    return EM4X50_COMMAND_STANDARD_READ;
-}
-
-static int em4x50_sim_handle_write_command(uint32_t *tag) {
-
-    // read address
-    uint8_t address = 0;
-    bool addr = em4x50_sim_read_byte(&address, true);
-    // read data
-    uint32_t data = 0;
-    bool word = em4x50_sim_read_word(&data);
-        
-    // write access time
-    wait_cycles(EM4X50_T_TAG_TWA);
-
-    if ((addr == false) || (word == false)) {
-        em4x50_sim_send_nak();
-        return EM4X50_COMMAND_STANDARD_READ;
-    }
-
-    // extract necessary control data
-    bool raw = (tag[EM4X50_CONTROL] >> CONFIG_BLOCK) & READ_AFTER_WRITE;
-    // extract protection data:
-    // first word write protected
-    int fwwp = reflect8((tag[EM4X50_PROTECTION] >> 24) & 0xFF);
-    // last word write protected
-    int lwwp = reflect8((tag[EM4X50_PROTECTION] >> 16) & 0xFF);
-    
-    switch (address) {
-
-        case EM4X50_DEVICE_PASSWORD:
-            em4x50_sim_send_nak();
-            return EM4X50_COMMAND_STANDARD_READ;
-            break;
-
-        case EM4X50_PROTECTION:
-            if (gLogin) {
-                tag[address] = reflect32(data);
-                em4x50_sim_send_ack();
-            } else {
-                em4x50_sim_send_nak();
-                return EM4X50_COMMAND_STANDARD_READ;
-            }
-            break;
-
-        case EM4X50_CONTROL:
-            if (gLogin) {
-                tag[address] = reflect32(data);
-                em4x50_sim_send_ack();
-            } else {
-                em4x50_sim_send_nak();
-                return EM4X50_COMMAND_STANDARD_READ;
-            }
-            break;
-
-        case EM4X50_DEVICE_SERIAL:
-            em4x50_sim_send_nak();
-            return EM4X50_COMMAND_STANDARD_READ;
-            break;
-
-        case EM4X50_DEVICE_ID:
-            em4x50_sim_send_nak();
-            return EM4X50_COMMAND_STANDARD_READ;
-            break;
-
-        default:
-            if ((address >= fwwp) && (address <= lwwp) && (gLogin == false)) {
-                if (gLogin) {
-                    tag[address] = reflect32(data);
-                    em4x50_sim_send_ack();
-                } else {
-                    em4x50_sim_send_nak();
-                    return EM4X50_COMMAND_STANDARD_READ;
-                }
-            } else {
-                tag[address] = reflect32(data);
-                em4x50_sim_send_ack();
-            }
-            break;
-    }
-    
-    // EEPROM write time
-    wait_cycles(EM4X50_T_TAG_TWEE);
-    
-    // strange: need some sort of 'waveform correction', otherwise ack signal
-    // will not be detected; sending a single "1" seems to solve the problem
-    em4x50_sim_send_bit(1);
-    
-    em4x50_sim_send_ack();
-
-    // if "read after write" (raw) bit is set, send written data once
-    if (raw) {
-        int command = em4x50_sim_send_listen_window(tag);
-        if (command != PM3_SUCCESS) {
-            return command;
-        }
-
-        command = em4x50_sim_send_listen_window(tag);
-        if (command != PM3_SUCCESS) {
-            return command;
-        }
-
-        em4x50_sim_send_word(tag[address]);
-    }
-
-    // continue with standard read mode
-    return EM4X50_COMMAND_STANDARD_READ;
-}
-
-static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
-
-    bool pwd = false;
-    
-    if (gWritePasswordProcess == false) {
-        
-        gWritePasswordProcess = true;
-
-        // read password
-        uint32_t act_password = 0;
-        pwd = em4x50_sim_read_word(&act_password);
-        
-        //wait_cycles(15);
-
-        // processing pause time (corresponds to a "1" bit)
-        em4x50_sim_send_bit(1);
-        
-        if (pwd && (act_password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
-            em4x50_sim_send_ack();
-            gLogin = true;
-        } else {
-            em4x50_sim_send_nak();
-            gLogin = false;
-            return EM4X50_COMMAND_STANDARD_READ;
-        }
-
-        int command = em4x50_sim_send_listen_window(tag);
-        if (command != PM3_SUCCESS) {
-            return command;
-        }
-
-    } else {
-
-        gWritePasswordProcess = false;
-
-        // read new password
-        uint32_t new_password = 0;
-        pwd = em4x50_sim_read_word(&new_password);
-
-        // write access time
-        wait_cycles(EM4X50_T_TAG_TWA);
-
-        if (pwd) {
-            em4x50_sim_send_ack();
-            tag[EM4X50_DEVICE_PASSWORD] = reflect32(new_password);
-        } else {
-            em4x50_sim_send_ack();
-            return EM4X50_COMMAND_STANDARD_READ;
-        }
-        
-        //wait_cycles(15);
-
-        // EEPROM write time
-        wait_cycles(EM4X50_T_TAG_TWEE);
-        
-        // strange: need some sort of 'waveform correction', otherwise ack signal
-        // will not be detected; sending a single "1" seems to solve the problem
-        em4x50_sim_send_bit(1);
-
-        em4x50_sim_send_ack();
-
-        // continue with standard read mode
-        return EM4X50_COMMAND_STANDARD_READ;
-    }
-    
-    // call writepwd function again for else branch
-    return EM4X50_COMMAND_WRITE_PASSWORD;
-}
-
-static int em4x50_sim_handle_selective_read_command(uint32_t *tag) {
-
-    int command = 0;
-    
-    // read password
-    uint32_t address = 0;
-    bool addr = em4x50_sim_read_word(&address);
-    //wait_cycles(15);
-
-    // processing pause time (corresponds to a "1" bit)
-    em4x50_sim_send_bit(1);
-
-    if (addr) {
-        em4x50_sim_send_ack();
-    } else {
-        em4x50_sim_send_nak();
-        return EM4X50_COMMAND_STANDARD_READ;
-    }
-
-    // extract control data
-    int fwr = address & 0xFF;           // first word read
-    int lwr = (address >> 8) & 0xFF;    // last word read
-
-    // extract protection data:
-    // first word read protected
-    int fwrp = reflect32(tag[EM4X50_PROTECTION]) & 0xFF;
-    // last word read protected
-    int lwrp = (reflect32(tag[EM4X50_PROTECTION]) >> 8) & 0xFF;
-    
-    while ((BUTTON_PRESS() == false) && (data_available() == false)) {
-
-        WDT_HIT();
-
-        command = em4x50_sim_send_listen_window(tag);
-        if (command != PM3_SUCCESS) {
-            return command;
-        }
-
-        for (int i = fwr; i <= lwr; i++) {
-
-            command = em4x50_sim_send_listen_window(tag);
-            if (command != PM3_SUCCESS) {
-                return command;
-            }
-
-            // if not authenticated do not send read protected words
-            if ((gLogin == false) && (i >= fwrp) && (i <= lwrp)) {
-                em4x50_sim_send_word(0x00);
-            } else {
-                em4x50_sim_send_word(reflect32(tag[i]));
-            }
-        }
-    }
-
-    return PM3_EOPABORTED;
-}
-
-static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
-    
-    int command = 0;
-
-    // extract control data
-    int fwr = reflect32(tag[EM4X50_CONTROL]) & 0xFF;      // first word read
-    int lwr = (reflect32(tag[EM4X50_CONTROL]) >> 8) & 0xFF; // last word read
-    // extract protection data:
-    // first word read protected
-    int fwrp = reflect32(tag[EM4X50_PROTECTION]) & 0xFF;
-    // last word read protected
-    int lwrp = (reflect32(tag[EM4X50_PROTECTION]) >> 8) & 0xFF;
-
-    // iceman,  will need a usb cmd check to break as well
-    while ((BUTTON_PRESS() == false) && (data_available() == false)) {
-
-        WDT_HIT();
-
-        command = em4x50_sim_send_listen_window(tag);
-        if (command != PM3_SUCCESS) {
-            return command;
-        }
-
-        for (int i = fwr; i <= lwr; i++) {
-
-            command = em4x50_sim_send_listen_window(tag);
-            if (command != PM3_SUCCESS) {
-                return command;
-            }
-
-            if ((gLogin == false) && (i >= fwrp) && (i <= lwrp)) {
-                em4x50_sim_send_word(0x00);
-            } else {
-                em4x50_sim_send_word(reflect32(tag[i]));
-            }
-        }
-    }
-
-    return PM3_EOPABORTED;
-}
-
-// reader requests receive mode (rm) by sending two zeros
-static int check_rm_request(uint32_t *tag) {
-    
-    // look for first zero
-    int bit = em4x50_sim_read_bit();
-    if (bit == 0) {
-
-        // look for second zero
-        bit = em4x50_sim_read_bit();
-        if (bit == 0) {
-
-            // if command before was EM4X50_COMMAND_WRITE_PASSWORD
-            // switch to separate process
-            if (gWritePasswordProcess) {
-                return EM4X50_COMMAND_WRITE_PASSWORD;
-            } else {
-                // read mode request detected, get command from reader
-                uint8_t command = 0;
-                em4x50_sim_read_byte(&command, true);
-                return command;
-            }
-        }
-    }
-    
-    return (bit != PM3_ETIMEOUT) ? PM3_SUCCESS : PM3_ETIMEOUT;
-}
-
-static int em4x50_sim_send_listen_window(uint32_t *tag) {
-    
-    SHORT_COIL();
-    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
-
-    OPEN_COIL();
-    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
-
-    SHORT_COIL();
-    wait_cycles(2 * EM4X50_T_TAG_FULL_PERIOD);
-
-    OPEN_COIL();
-    int command = check_rm_request(tag);
-    if (command != PM3_SUCCESS) {
-        return command;
-    }
-
-    SHORT_COIL();
-    wait_cycles(EM4X50_T_TAG_FULL_PERIOD);
-
-    return PM3_SUCCESS;
-}
-
 // simple login to EM4x50,
 // used in operations that require authentication
 static bool login(uint32_t password) {
@@ -1619,7 +1000,7 @@ static int write(uint32_t word, uint32_t addresses) {
                 for (int i = 0; i < 50; i++) {
                     wait_timer(T0 * EM4X50_T_TAG_FULL_PERIOD);
                 }
-                
+
                 if (check_ack(false)) {
                     return PM3_SUCCESS;
                 }
@@ -1761,6 +1142,635 @@ void em4x50_writepwd(em4x50_data_t *etd) {
     reply_ng(CMD_LF_EM4X50_WRITEPWD, status, NULL, 0);
 }
 
+// send bit in receive mode by counting carrier cycles
+static void em4x50_sim_send_bit(uint8_t bit) {
+
+    uint16_t timeout = EM4X50_T_TAG_FULL_PERIOD;
+
+    for (int t = 0; t < EM4X50_T_TAG_FULL_PERIOD; t++) {
+
+        // wait until SSC_CLK goes HIGH
+        // used as a simple detection of a reader field?
+        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) && (timeout--));
+        
+        if (timeout == 0) {
+            return;
+        }
+        timeout = EM4X50_T_TAG_FULL_PERIOD;
+
+        if (bit)
+            OPEN_COIL();
+        else
+            SHORT_COIL();
+
+        //wait until SSC_CLK goes LOW
+        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK && (timeout--));
+        if (timeout == 0) {
+            return;
+        }
+        timeout = EM4X50_T_TAG_FULL_PERIOD;
+
+        if (t == EM4X50_T_TAG_HALF_PERIOD)
+            bit ^= 1;
+
+    }
+}
+
+// send byte in receive mode either with or without parity check (even)
+static void em4x50_sim_send_byte(uint8_t byte, bool paritycheck) {
+
+    // send byte
+    for (int i = 0; i < 8; i++) {
+        em4x50_sim_send_bit((byte >> (7 - i)) & 1);
+    }
+
+    if (paritycheck) {
+
+        uint8_t parity = 0x0;
+
+        for (int i = 0; i < 8; i++) {
+            parity ^= (byte >> i) & 1;
+        }
+
+        em4x50_sim_send_bit(parity);
+    }
+}
+
+// send complete word in receive mode (including all parity checks)
+static void em4x50_sim_send_word(uint32_t word) {
+
+    uint8_t cparity = 0x00;
+
+    // word has tobe sent in msb, not lsb
+    word = reflect32(word);
+
+    // 4 bytes each with even row parity bit
+    for (int i = 0; i < 4; i++) {
+        em4x50_sim_send_byte((word >> ((3 - i) * 8)) & 0xFF, true);
+    }
+
+    // column parity
+    for (int i = 0; i < 8; i++) {
+        cparity <<= 1;
+        for (int j = 0; j < 4; j++) {
+            cparity ^= (((word >> ((3 - j) * 8)) & 0xFF) >> (7 - i)) & 1;
+        }
+    }
+    em4x50_sim_send_byte(cparity, false);
+
+    // stop bit
+    em4x50_sim_send_bit(0);
+}
+
+// wait for <maxperiods> pulses of carrier frequency
+static void wait_cycles(int maxperiods) {
+
+    int period = 0, timeout = EM4X50_T_SIMULATION_TIMEOUT_WAIT;
+
+    while (period < maxperiods) {
+        
+        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) && (timeout--));
+        if (timeout <= 0) {
+            return;
+        }
+        timeout = EM4X50_T_SIMULATION_TIMEOUT_WAIT;
+        
+        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK && (timeout--));
+        if (timeout <= 0) {
+            return;
+        }
+        timeout = EM4X50_T_SIMULATION_TIMEOUT_WAIT;
+        
+        period++;
+    }
+}
+
+// read single bit while simulating
+static int em4x50_sim_read_bit(void) {
+
+    int cycles = 0;
+    int timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
+
+    while (cycles < EM4X50_T_TAG_FULL_PERIOD) {
+
+        // wait until reader field disappears
+        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
+
+        AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
+
+        // now check until reader switches on carrier field
+        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
+
+            // check if cycle (i.e. off -> on -> off) takes longer than T0
+            if (AT91C_BASE_TC0->TC_CV > T0 * EM4X50_ZERO_DETECTION) {
+
+                // gap detected; wait until reader field is switched on again
+                while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK && (timeout--));
+                
+                if (timeout <= 0) {
+                    return PM3_ETIMEOUT;
+                }
+                timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
+
+                // now we have a reference "position", from here it will take
+                // slightly less than 32 cycles until the end of the bit period
+                wait_cycles(28);
+
+                // end of bit period is reached; return with bit value "0"
+                // (cf. datasheet)
+                return 0;
+            }
+
+        }
+
+        // no gap detected, i.e. reader field is still up;
+        // continue with counting cycles
+        cycles++;
+    }
+
+    // reached 64 cycles (= EM4X50_T_TAG_FULL_PERIOD) -> return bit value "1"
+    return 1;
+}
+
+// read byte in while simulation either with or without parity check (even)
+static bool em4x50_sim_read_byte(uint8_t *byte, bool paritycheck) {
+    
+    for (int i = 0; i < 8; i++) {
+        *byte <<= 1;
+        *byte |= em4x50_sim_read_bit();
+    }
+        
+    if (paritycheck) {
+
+        int pval = em4x50_sim_read_bit();
+        uint8_t parity = 0;
+
+        for (int i = 0; i < 8; i++) {
+            parity ^= ((*byte) >> i) & 1;
+        }
+
+        if (parity != pval) {
+            return false;
+        }
+    }
+
+    return true;
+        
+}
+
+// read complete word while simulating
+static bool em4x50_sim_read_word(uint32_t *word) {
+    
+    uint8_t stop_bit = 0;
+    uint8_t parities = 0, parities_calculated = 0;
+    uint8_t bytes[4] = {0};
+
+    // read plain data
+    for (int i = 0; i < 4; i++) {
+        em4x50_sim_read_byte(&bytes[i], true);
+    }
+
+    // read column parities and stop bit
+    em4x50_sim_read_byte(&parities, false);
+    stop_bit = em4x50_sim_read_bit();
+
+    // calculate column parities from data
+    for (int i = 0; i < 8; i++) {
+        parities_calculated <<= 1;
+        for (int j = 0; j < 4; j++) {
+            parities_calculated ^= (bytes[j] >> (7 - i)) & 1;
+        }
+    }
+    
+    *word = BYTES2UINT32(bytes);
+    
+    // check parities
+    if ((parities == parities_calculated) && (stop_bit == 0)) {
+        return true;
+    }
+    
+    return false;
+}
+
+// check if reader requests receive mode (rm) by sending two zeros
+static int check_rm_request(uint32_t *tag) {
+    
+    // look for first zero
+    int bit = em4x50_sim_read_bit();
+    if (bit == 0) {
+
+        // look for second zero
+        bit = em4x50_sim_read_bit();
+        if (bit == 0) {
+
+            // if command before was EM4X50_COMMAND_WRITE_PASSWORD
+            // switch to separate process
+            if (gWritePasswordProcess) {
+                return EM4X50_COMMAND_WRITE_PASSWORD;
+            } else {
+                // read mode request detected, get command from reader
+                uint8_t command = 0;
+                em4x50_sim_read_byte(&command, true);
+                return command;
+            }
+        }
+    }
+    
+    return (bit != PM3_ETIMEOUT) ? PM3_SUCCESS : PM3_ETIMEOUT;
+}
+
+// send single listen window while simulating
+static int em4x50_sim_send_listen_window(uint32_t *tag) {
+    
+    SHORT_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    OPEN_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    SHORT_COIL();
+    wait_cycles(2 * EM4X50_T_TAG_FULL_PERIOD);
+
+    OPEN_COIL();
+    int command = check_rm_request(tag);
+    if (command != PM3_SUCCESS) {
+        return command;
+    }
+
+    SHORT_COIL();
+    wait_cycles(EM4X50_T_TAG_FULL_PERIOD);
+
+    return PM3_SUCCESS;
+}
+
+// send ack
+static void em4x50_sim_send_ack(void) {
+
+    SHORT_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    OPEN_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    SHORT_COIL();
+    wait_cycles(3 * EM4X50_T_TAG_HALF_PERIOD);
+
+    OPEN_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    SHORT_COIL();
+    wait_cycles(3 * EM4X50_T_TAG_HALF_PERIOD);
+
+    OPEN_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+    
+    SHORT_COIL();
+}
+
+// send nak
+static void em4x50_sim_send_nak(void) {
+
+    SHORT_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    OPEN_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    SHORT_COIL();
+    wait_cycles(3 * EM4X50_T_TAG_HALF_PERIOD);
+
+    OPEN_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    SHORT_COIL();
+    wait_cycles(EM4X50_T_TAG_FULL_PERIOD);
+
+    OPEN_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    SHORT_COIL();
+    wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
+
+    OPEN_COIL();
+}
+
+// standard read mode process (simulation mode) 
+static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
+    
+    int command = 0;
+
+    // extract control data
+    int fwr = reflect32(tag[EM4X50_CONTROL]) & 0xFF;      // first word read
+    int lwr = (reflect32(tag[EM4X50_CONTROL]) >> 8) & 0xFF; // last word read
+    // extract protection data:
+    // first word read protected
+    int fwrp = reflect32(tag[EM4X50_PROTECTION]) & 0xFF;
+    // last word read protected
+    int lwrp = (reflect32(tag[EM4X50_PROTECTION]) >> 8) & 0xFF;
+
+    // iceman,  will need a usb cmd check to break as well
+    while ((BUTTON_PRESS() == false) && (data_available() == false)) {
+
+        WDT_HIT();
+
+        command = em4x50_sim_send_listen_window(tag);
+        if (command != PM3_SUCCESS) {
+            return command;
+        }
+
+        for (int i = fwr; i <= lwr; i++) {
+
+            command = em4x50_sim_send_listen_window(tag);
+            if (command != PM3_SUCCESS) {
+                return command;
+            }
+
+            if ((gLogin == false) && (i >= fwrp) && (i <= lwrp)) {
+                em4x50_sim_send_word(0x00);
+            } else {
+                em4x50_sim_send_word(reflect32(tag[i]));
+            }
+        }
+    }
+
+    return PM3_EOPABORTED;
+}
+
+// selective read mode process (simulation mode)
+static int em4x50_sim_handle_selective_read_command(uint32_t *tag) {
+
+    int command = 0;
+    
+    // read password
+    uint32_t address = 0;
+    bool addr = em4x50_sim_read_word(&address);
+    
+    // processing pause time (corresponds to a "1" bit)
+    em4x50_sim_send_bit(1);
+
+    if (addr) {
+        em4x50_sim_send_ack();
+    } else {
+        em4x50_sim_send_nak();
+        return EM4X50_COMMAND_STANDARD_READ;
+    }
+
+    // extract control data
+    int fwr = address & 0xFF;           // first word read
+    int lwr = (address >> 8) & 0xFF;    // last word read
+
+    // extract protection data:
+    // first word read protected
+    int fwrp = reflect32(tag[EM4X50_PROTECTION]) & 0xFF;
+    // last word read protected
+    int lwrp = (reflect32(tag[EM4X50_PROTECTION]) >> 8) & 0xFF;
+    
+    while ((BUTTON_PRESS() == false) && (data_available() == false)) {
+
+        WDT_HIT();
+
+        command = em4x50_sim_send_listen_window(tag);
+        if (command != PM3_SUCCESS) {
+            return command;
+        }
+
+        for (int i = fwr; i <= lwr; i++) {
+
+            command = em4x50_sim_send_listen_window(tag);
+            if (command != PM3_SUCCESS) {
+                return command;
+            }
+
+            // if not authenticated do not send read protected words
+            if ((gLogin == false) && (i >= fwrp) && (i <= lwrp)) {
+                em4x50_sim_send_word(0x00);
+            } else {
+                em4x50_sim_send_word(reflect32(tag[i]));
+            }
+        }
+    }
+
+    return PM3_EOPABORTED;
+}
+
+// login process (simulation mode)
+static int em4x50_sim_handle_login_command(uint32_t *tag) {
+
+    // read password
+    uint32_t password = 0;
+    bool pwd = em4x50_sim_read_word(&password);
+    
+    // signal that reader sent the password
+    LED_D_ON();
+    
+    // processing pause time (corresponds to a "1" bit)
+    em4x50_sim_send_bit(1);
+
+    // empirically determined delay (to be examined seperately)
+    wait_cycles(1);
+    
+    if (pwd && (password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
+        em4x50_sim_send_ack();
+        gLogin = true;
+        LED_A_ON();
+    } else {
+        em4x50_sim_send_nak();
+        gLogin = false;
+        LED_A_OFF();
+    }
+    // continue with standard read mode
+    return EM4X50_COMMAND_STANDARD_READ;
+}
+
+// reset process (simulation mode)
+static int em4x50_sim_handle_reset_command(uint32_t *tag) {
+
+    // processing pause time (corresponds to a "1" bit)
+    em4x50_sim_send_bit(1);
+
+    // send ACK
+    em4x50_sim_send_ack();
+    gLogin = false;
+    LED_A_OFF();
+    
+    // wait for tinit
+    wait_cycles(EM4X50_T_TAG_TINIT);
+    
+    // continue with standard read mode
+    return EM4X50_COMMAND_STANDARD_READ;
+}
+
+// write process (simulation mode)
+static int em4x50_sim_handle_write_command(uint32_t *tag) {
+
+    // read address
+    uint8_t address = 0;
+    bool addr = em4x50_sim_read_byte(&address, true);
+    // read data
+    uint32_t data = 0;
+    bool word = em4x50_sim_read_word(&data);
+        
+    // write access time
+    wait_cycles(EM4X50_T_TAG_TWA);
+
+    if ((addr == false) || (word == false)) {
+        em4x50_sim_send_nak();
+        return EM4X50_COMMAND_STANDARD_READ;
+    }
+
+    // extract necessary control data
+    bool raw = (tag[EM4X50_CONTROL] >> CONFIG_BLOCK) & READ_AFTER_WRITE;
+    // extract protection data:
+    // first word write protected
+    int fwwp = reflect8((tag[EM4X50_PROTECTION] >> 24) & 0xFF);
+    // last word write protected
+    int lwwp = reflect8((tag[EM4X50_PROTECTION] >> 16) & 0xFF);
+
+    switch (address) {
+
+        case EM4X50_DEVICE_PASSWORD:
+            em4x50_sim_send_nak();
+            return EM4X50_COMMAND_STANDARD_READ;
+            break;
+
+        case EM4X50_PROTECTION:
+            if (gLogin) {
+                tag[address] = reflect32(data);
+                em4x50_sim_send_ack();
+            } else {
+                em4x50_sim_send_nak();
+                return EM4X50_COMMAND_STANDARD_READ;
+            }
+            break;
+
+        case EM4X50_CONTROL:
+            if (gLogin) {
+                tag[address] = reflect32(data);
+                em4x50_sim_send_ack();
+            } else {
+                em4x50_sim_send_nak();
+                return EM4X50_COMMAND_STANDARD_READ;
+            }
+            break;
+
+        case EM4X50_DEVICE_SERIAL:
+            em4x50_sim_send_nak();
+            return EM4X50_COMMAND_STANDARD_READ;
+            break;
+
+        case EM4X50_DEVICE_ID:
+            em4x50_sim_send_nak();
+            return EM4X50_COMMAND_STANDARD_READ;
+            break;
+
+        default:
+            if ((address >= fwwp) && (address <= lwwp)) {
+                if (gLogin) {
+                    tag[address] = reflect32(data);
+                    em4x50_sim_send_ack();
+                } else {
+                    em4x50_sim_send_nak();
+                    return EM4X50_COMMAND_STANDARD_READ;
+                }
+            } else {
+                tag[address] = reflect32(data);
+                em4x50_sim_send_ack();
+            }
+            break;
+    }
+    
+    // EEPROM write time
+    // strange: need some sort of 'waveform correction', otherwise ack signal
+    // will not be detected; sending a single "1" as last "bit"" of Twee
+    // seems to solve the problem
+    wait_cycles(EM4X50_T_TAG_TWEE - EM4X50_T_TAG_FULL_PERIOD);
+    em4x50_sim_send_bit(1);
+    em4x50_sim_send_ack();
+
+    // if "read after write" (raw) bit is set, send written data once
+    if (raw) {
+        int command = em4x50_sim_send_listen_window(tag);
+        if (command != PM3_SUCCESS) {
+            return command;
+        }
+
+        command = em4x50_sim_send_listen_window(tag);
+        if (command != PM3_SUCCESS) {
+            return command;
+        }
+
+        em4x50_sim_send_word(tag[address]);
+    }
+
+    // continue with standard read mode
+    return EM4X50_COMMAND_STANDARD_READ;
+}
+
+// write password process (simulation mode)
+static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
+
+    bool pwd = false;
+    
+    if (gWritePasswordProcess == false) {
+        
+        gWritePasswordProcess = true;
+
+        // read password
+        uint32_t act_password = 0;
+        pwd = em4x50_sim_read_word(&act_password);
+        
+        // processing pause time (corresponds to a "1" bit)
+        em4x50_sim_send_bit(1);
+        
+        if (pwd && (act_password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
+            em4x50_sim_send_ack();
+            gLogin = true;
+        } else {
+            em4x50_sim_send_nak();
+            gLogin = false;
+            return EM4X50_COMMAND_STANDARD_READ;
+        }
+
+        int command = em4x50_sim_send_listen_window(tag);
+        if (command != PM3_SUCCESS) {
+            return command;
+        }
+
+    } else {
+
+        gWritePasswordProcess = false;
+
+        // read new password
+        uint32_t new_password = 0;
+        pwd = em4x50_sim_read_word(&new_password);
+
+        // write access time
+        wait_cycles(EM4X50_T_TAG_TWA);
+
+        if (pwd) {
+            em4x50_sim_send_ack();
+            tag[EM4X50_DEVICE_PASSWORD] = reflect32(new_password);
+        } else {
+            em4x50_sim_send_ack();
+            return EM4X50_COMMAND_STANDARD_READ;
+        }
+        
+        // EEPROM write time
+        // strange: need some sort of 'waveform correction', otherwise ack signal
+        // will not be detected; sending a single "1" as last part of Twee
+        // seems to solve the problem
+        wait_cycles(EM4X50_T_TAG_TWEE - EM4X50_T_TAG_FULL_PERIOD);
+        em4x50_sim_send_bit(1);
+        em4x50_sim_send_ack();
+
+        // continue with standard read mode
+        return EM4X50_COMMAND_STANDARD_READ;
+    }
+    
+    // call writepwd function again for else branch
+    return EM4X50_COMMAND_WRITE_PASSWORD;
+}
+
 // simulate uploaded data in emulator memory
 // LED A -> operations that require authentication are possible
 // LED B -> standard read mode is active

From 78d1e09595cabe07dbd96f81108f06dbdded0d82 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Mon, 18 Jan 2021 00:01:22 +0100
Subject: [PATCH 376/682] deleted test functions, clean up

---
 armsrc/appmain.c         |   4 -
 armsrc/em4x50.c          | 134 +++------------------------------
 armsrc/em4x50.h          |   1 -
 client/src/cmdlfem4x50.c | 158 ---------------------------------------
 client/src/cmdlfem4x50.h |   1 -
 include/em4x50.h         |   9 ---
 include/pm3_cmd.h        |   1 -
 7 files changed, 9 insertions(+), 299 deletions(-)

diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index 5f70fa957..dca2def3b 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -1172,10 +1172,6 @@ static void PacketReceived(PacketCommandNG *packet) {
             em4x50_chk((uint8_t *)packet->data.asBytes);
             break;
         }
-        case CMD_LF_EM4X50_TEST: {
-            em4x50_test((em4x50_test_t *)packet->data.asBytes);
-            break;
-        }
 #endif
 
 #ifdef WITH_EM4x70
diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index 9d9da9a8d..c87f7a01e 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -70,37 +70,12 @@ bool gLogin = false;
 // to be able to identfiy it
 bool gWritePasswordProcess = false;
 
-static int em4x50_sim_send_listen_window(uint32_t *tag);
-
-void catch_samples(void);
-
 // do nothing for <period> using timer0
 static void wait_timer(uint32_t period) {
     AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
     while (AT91C_BASE_TC0->TC_CV < period);
 }
 
-void catch_samples(void) {
-
-    uint8_t sample = 0;
-
-    if (EM4X50_MAX_NO_SAMPLES > CARD_MEMORY_SIZE) {
-        Dbprintf("exeeded emulator memory size");
-        return;
-    }
-
-    uint8_t *em4x50_sample_buffer = BigBuf_get_addr();
-
-    memcpy(em4x50_sample_buffer, &gHigh, 1);
-    memcpy(em4x50_sample_buffer + 1, &gLow, 1);
-
-    for (int i = 2; i < EM4X50_MAX_NO_SAMPLES + 2; i++) {
-        sample = AT91C_BASE_SSC->SSC_RHR;
-        memcpy(em4x50_sample_buffer + i, &sample, 1);
-        wait_timer(T0); // 8µs delay
-    }
-}
-
 // extract and check parities
 // return result of parity check and extracted plain data
 static bool extract_parities(uint64_t word, uint32_t *data) {
@@ -387,7 +362,7 @@ static void em4x50_reader_send_byte(uint8_t byte) {
     }
 }
 
-// send byte followed by its (equal) parity bit
+// send byte followed by its (even) parity bit
 static void em4x50_reader_send_byte_with_parity(uint8_t byte) {
     int parity = 0, bit = 0;
 
@@ -537,8 +512,6 @@ static bool check_ack(bool bliw) {
         
         if (check_pulse_length(get_pulse_length(), 2 * EM4X50_T_TAG_FULL_PERIOD)) {
 
-            //catch_samples();
-            
             // The received signal is either ACK or NAK.
 
             if (check_pulse_length(get_pulse_length(), 2 * EM4X50_T_TAG_FULL_PERIOD)) {
@@ -1245,7 +1218,7 @@ static void wait_cycles(int maxperiods) {
     }
 }
 
-// read single bit while simulating
+// read single bit in simulation mode
 static int em4x50_sim_read_bit(void) {
 
     int cycles = 0;
@@ -1292,7 +1265,7 @@ static int em4x50_sim_read_bit(void) {
     return 1;
 }
 
-// read byte in while simulation either with or without parity check (even)
+// read byte in simulation mode either with or without parity check (even)
 static bool em4x50_sim_read_byte(uint8_t *byte, bool paritycheck) {
     
     for (int i = 0; i < 8; i++) {
@@ -1318,7 +1291,7 @@ static bool em4x50_sim_read_byte(uint8_t *byte, bool paritycheck) {
         
 }
 
-// read complete word while simulating
+// read complete word in simulation mode
 static bool em4x50_sim_read_word(uint32_t *word) {
     
     uint8_t stop_bit = 0;
@@ -1379,7 +1352,7 @@ static int check_rm_request(uint32_t *tag) {
     return (bit != PM3_ETIMEOUT) ? PM3_SUCCESS : PM3_ETIMEOUT;
 }
 
-// send single listen window while simulating
+// send single listen window in simulation mode
 static int em4x50_sim_send_listen_window(uint32_t *tag) {
     
     SHORT_COIL();
@@ -1454,7 +1427,7 @@ static void em4x50_sim_send_nak(void) {
     OPEN_COIL();
 }
 
-// standard read mode process (simulation mode) 
+// standard read mode process (simulation mode)
 static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
     
     int command = 0;
@@ -1560,13 +1533,10 @@ static int em4x50_sim_handle_login_command(uint32_t *tag) {
     uint32_t password = 0;
     bool pwd = em4x50_sim_read_word(&password);
     
-    // signal that reader sent the password
-    LED_D_ON();
-    
     // processing pause time (corresponds to a "1" bit)
     em4x50_sim_send_bit(1);
 
-    // empirically determined delay (to be examined seperately)
+    // empirically determined delay (to be checked in detail)
     wait_cycles(1);
     
     if (pwd && (password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
@@ -1593,7 +1563,7 @@ static int em4x50_sim_handle_reset_command(uint32_t *tag) {
     gLogin = false;
     LED_A_OFF();
     
-    // wait for tinit
+    // wait for initialization (tinit)
     wait_cycles(EM4X50_T_TAG_TINIT);
     
     // continue with standard read mode
@@ -1681,7 +1651,7 @@ static int em4x50_sim_handle_write_command(uint32_t *tag) {
     
     // EEPROM write time
     // strange: need some sort of 'waveform correction', otherwise ack signal
-    // will not be detected; sending a single "1" as last "bit"" of Twee
+    // will not be detected; sending a single "1" as last "bit" of Twee
     // seems to solve the problem
     wait_cycles(EM4X50_T_TAG_TWEE - EM4X50_T_TAG_FULL_PERIOD);
     em4x50_sim_send_bit(1);
@@ -1775,7 +1745,6 @@ static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
 // LED A -> operations that require authentication are possible
 // LED B -> standard read mode is active
 // LED C -> command has been transmitted by reader
-// LED D -> password has been caught from reader
 void em4x50_sim(uint32_t *password) {
     
     int command = PM3_ENODATA;
@@ -1858,88 +1827,3 @@ void em4x50_sim(uint32_t *password) {
     lf_finalize();
     reply_ng(CMD_LF_EM4X50_SIM, command, NULL, 0);
 }
-
-void em4x50_test(em4x50_test_t *ett) {
-
-    int status = 0;
-
-    // set field on or off
-    if (ett->field != -1) {
-        em4x50_setup_read();
-        if (ett->field == 1) {
-            LED_A_ON();
-        } else {
-            HIGH(GPIO_SSC_DOUT);
-            LED_A_OFF();
-        }
-        status = ett->field;
-    }
-
-    // check field status
-    if (ett->check_field) {
-        em4x50_setup_sim();
-        bool field_on = false;
-        while (BUTTON_PRESS() == false) {
-
-            if (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
-                if (field_on == false) {
-                    Dbprintf("field on");
-                    field_on = true;
-                }
-            } else if (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK){
-                if (field_on == true) {
-                    Dbprintf("field off");
-                    field_on = false;
-                }
-            }
-        }
-        status = 1;
-    }
-    
-    // timing values
-    if (ett->cycles != 0) {
-        uint32_t tval = 0;
-        uint32_t tvalhigh[ett->cycles];
-        uint32_t tvallow[ett->cycles];
-
-        em4x50_setup_sim();
-        while (AT91C_BASE_TC0->TC_CV > 0);
-        
-        for (int t = 0; t < ett->cycles; t++) {
-        
-            // field on -> high value
-            AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
-            tval = AT91C_BASE_TC0->TC_CV;
-            while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
-            tvalhigh[t] = AT91C_BASE_TC0->TC_CV - tval;
-
-            // filed off -> zero value
-            AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
-            tval = AT91C_BASE_TC0->TC_CV;
-            while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK);
-            tvallow[t] = AT91C_BASE_TC0->TC_CV - tval;
-        }
-        
-        for (int t = 0; t < ett->cycles; t++) {
-            Dbprintf("%03i %li %li", t, tvallow[t], tvalhigh[t]);
-        }
-
-    }
-        
-    // perform reset
-    if (ett->reset) {
-        em4x50_setup_read();
-
-        status = PM3_EFAILED;
-        if (get_signalproperties() && find_em4x50_tag()) {
-
-            if (reset() == PM3_SUCCESS) {
-                status = 1;
-            }
-        }
-
-        lf_finalize();
-    }
-
-    reply_ng(CMD_LF_EM4X50_TEST, status, NULL, 0);
-}
diff --git a/armsrc/em4x50.h b/armsrc/em4x50.h
index 5d4812f42..72304192b 100644
--- a/armsrc/em4x50.h
+++ b/armsrc/em4x50.h
@@ -22,6 +22,5 @@ void em4x50_login(uint32_t *password);
 void em4x50_sim(uint32_t *password);
 void em4x50_reader(void);
 void em4x50_chk(uint8_t *filename);
-void em4x50_test(em4x50_test_t *ett);
 
 #endif /* EM4X50_H */
diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c
index 908ab3bfa..84c331337 100644
--- a/client/src/cmdlfem4x50.c
+++ b/client/src/cmdlfem4x50.c
@@ -23,86 +23,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static void write_gnuplot_config_file(int gHigh, int gLow) {
-
-    const char *fn = "../data/data.gnu";
-    FILE *fp = NULL;
-
-    if ((fp = fopen(fn, "w+")) == false) {
-        PrintAndLogEx(WARNING, "Fail, open file %s", fn);
-    }
-
-    fprintf(fp, "set term qt size 1400, 350 enhanced\n");
-    fprintf(fp, "set border 31 front linecolor rgb 'dark-grey' linewidth 1.000 dashtype solid\n");
-    fprintf(fp, "set xtics  0, 1 textcolor rgb 'dark-grey'\n");
-    fprintf(fp, "set ytics  0, 64 textcolor rgb 'dark-grey'\n");
-    fprintf(fp, "set title 'EM4x50 signal (amplitude vs time)'\n");
-    fprintf(fp, "set title  font ',14' textcolor rgb 'white'\n");
-    fprintf(fp, "set xlabel 'time / ms'\n");
-    fprintf(fp, "set xlabel  font ',12' textcolor rgb 'dark-grey'\n");
-    fprintf(fp, "set ylabel 'amplitude'\n");
-    fprintf(fp, "set ylabel  font ',12' textcolor rgb 'dark-grey'\n");
-    fprintf(fp, "set key textcolor 'green'\n");
-    fprintf(fp, "set grid\n");
-    fprintf(fp, "#set time textcolor 'dark-grey'\n");
-    fprintf(fp, "plot [0:][-50:300] '../data/data.dat' u ($1/1000):2 w l linecolor 'green' title '500/4', '../data/data.dat' u ($1/1000):3 w l linecolor 'yellow' title 'gHigh = %i', '../data/data.dat' u ($1/1000):4 w l linecolor 'yellow' title 'gLow = %i'\n", gHigh, gLow);
-    fprintf(fp, "pause -1\n");
-
-    fclose(fp);
-}
-
-static void get_samples(void) {
-
-    int gHigh = 0, gLow = 0;
-    const char *fn = "../data/data.dat";
-    FILE *fp = NULL;
-
-    // download from BigBuf memory
-    uint8_t data[EM4X50_MAX_NO_SAMPLES + 2] = {0x0};
-    if (GetFromDevice(BIG_BUF, data, EM4X50_MAX_NO_SAMPLES + 2, 0, NULL, 0, NULL, 2500, false) == false) {
-        PrintAndLogEx(WARNING, "Fail, transfer from device time-out");
-    }
-
-    if ((fp = fopen(fn, "w+")) == false) {
-        PrintAndLogEx(WARNING, "Fail, open file %s", fn);
-    }
-
-    gHigh = data[0];
-    gLow = data[1];
-    for (int i = 2; i < EM4X50_MAX_NO_SAMPLES + 2; i++) {
-        fprintf(fp, "%i %i %i %i\n", (i - 2) * 8, data[i], gHigh, gLow);
-    }
-
-    fclose(fp);
-
-    write_gnuplot_config_file(gHigh, gLow);
-}
-
-/*
-static void get_time_samples(void) {
-
-    const char *fn = "../data/data.dat";
-    FILE *fp = NULL;
-
-    // download from BigBuf memory
-    uint32_t data[EM4X50_MAX_TIME_SAMPLES] = {0x0};
-    if (GetFromDevice(BIG_BUF, (uint8_t *)data, EM4X50_MAX_TIME_SAMPLES, 0, NULL, 0, NULL, 2500, false) == false) {
-        PrintAndLogEx(WARNING, "Fail, transfer from device time-out");
-    }
-
-    if ((fp = fopen(fn, "w+")) == false) {
-        PrintAndLogEx(WARNING, "Fail, open file %s", fn);
-    }
-
-    for (int i = 0; i < EM4X50_MAX_TIME_SAMPLES; i++) {
-        PrintAndLogEx(INFO, "%i %"PRIu32"", i, data[i]);
-        fprintf(fp, "%i %"PRIu32"\n", i, data[i]);
-    }
-
-    fclose(fp);
-}
-*/
-
 static void prepare_result(const uint8_t *data, int fwr, int lwr, em4x50_word_t *words) {
 
     // restructure received result in "em4x50_word_t" structure
@@ -423,8 +343,6 @@ int CmdEM4x50Login(const char *Cmd) {
     else
         PrintAndLogEx(FAILED, "Login " _RED_("failed"));
 
-    get_samples();
-    
     return resp.status;
 }
 
@@ -1275,81 +1193,6 @@ int CmdEM4x50Sim(const char *Cmd) {
     return resp.status;
 }
 
-int CmdEM4x50Test(const char *Cmd) {
-    CLIParserContext *ctx;
-    CLIParserInit(&ctx, "lf em 4x50 test",
-                  "perform EM4x50 tests.",
-                  "lf em 4x50 test --field on   -> reader field on\n"
-                  "lf em 4x50 test --field off  -> reader field off\n"
-                  "lf em 4x50 test --check      -> check on/off status of reader field\n"
-                  "lf em 4x50 test --cycles 100 -> measure time of 100 field cycles\n"
-                  "lf em 4x50 test --reset      -> intitiate reset command\n"
-                 );
-
-    void *argtable[] = {
-        arg_param_begin,
-        arg_str0(NULL, "field", "on/off", "field on/off"),
-        arg_lit0(NULL, "check", "check if field is on or off"),
-        arg_int0(NULL, "cycles", "<dec>", "number of field cycles"),
-        arg_lit0(NULL, "reset", "initiates a manual reset command"),
-        arg_param_end
-    };
-
-    CLIExecWithReturn(ctx, Cmd, argtable, true);
-
-    // option: field
-    int slen = 0;
-    char format[3] = {0};
-    CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)format, sizeof(format), &slen);
-    em4x50_test_t ett = {.field = -1};
-    if (slen != 0) {
-        if (strcmp(format, "on") == 0) {
-            ett.field = 1;
-        } else if (strcmp(format, "off") == 0) {
-            ett.field = 0;
-        } else {
-            PrintAndLogEx(INFO, "Unknown option for --field: %s", format);
-            return PM3_ESOFT;
-        }
-    }
-
-    // option: check_field
-    ett.check_field = arg_get_lit(ctx, 2);
-    // option: cycles
-    ett.cycles = arg_get_int_def(ctx, 3, 0);
-    // option: reset
-    ett.reset = arg_get_lit(ctx, 4);
-
-    CLIParserFree(ctx);
-
-    // start
-    clearCommandBuffer();
-    PacketResponseNG resp;
-    SendCommandNG(CMD_LF_EM4X50_TEST, (uint8_t *)&ett, sizeof(ett));
-    WaitForResponse(CMD_LF_EM4X50_TEST, &resp);
-
-    // print response
-    if (resp.status == 1) {
-        if (ett.field == 1)
-            PrintAndLogEx(SUCCESS, "Field switched " _GREEN_("on"));
-        if (ett.check_field == 1)
-            PrintAndLogEx(SUCCESS, "Field status evaluated");
-        if (ett.reset == 1)
-            PrintAndLogEx(SUCCESS, "reset command " _GREEN_("ok"));
-    } else if (resp.status == 0) {
-        if (ett.field == 1)
-            PrintAndLogEx(SUCCESS, "Field switched " _GREEN_("off"));
-        if (ett.reset == 1)
-            PrintAndLogEx(SUCCESS, "reset command " _GREEN_("failed"));
-    } else if (resp.status == -1) {
-        PrintAndLogEx(INFO, "Nothing done");
-    } else {
-        PrintAndLogEx(FAILED, "Test call " _RED_("failed"));
-    }
-
-    return resp.status;
-}
-
 static command_t CommandTable[] = {
     {"help",   CmdHelp,              AlwaysAvailable, "This help"},
     {"brute",  CmdEM4x50Brute,       IfPm3EM4x50,     "guess password of EM4x50"},
@@ -1367,7 +1210,6 @@ static command_t CommandTable[] = {
     {"eload",  CmdEM4x50ELoad,       IfPm3EM4x50,     "upload dump of EM4x50 to emulator memory"},
     {"esave",  CmdEM4x50ESave,       IfPm3EM4x50,     "save emulator memory to file"},
     {"eview",  CmdEM4x50EView,       IfPm3EM4x50,     "view EM4x50 content in emulator memory"},
-    {"test",   CmdEM4x50Test,        IfPm3EM4x50,     "perform EM4x50 tests"},
     {NULL, NULL, NULL, NULL}
 };
 
diff --git a/client/src/cmdlfem4x50.h b/client/src/cmdlfem4x50.h
index df9c587de..0d5c04bc6 100644
--- a/client/src/cmdlfem4x50.h
+++ b/client/src/cmdlfem4x50.h
@@ -34,6 +34,5 @@ int CmdEM4x50ELoad(const char *Cmd);
 int CmdEM4x50ESave(const char *Cmd);
 int CmdEM4x50Chk(const char *Cmd);
 int CmdEM4x50EView(const char *Cmd);
-int CmdEM4x50Test(const char *Cmd);
 
 #endif
diff --git a/include/em4x50.h b/include/em4x50.h
index a2d1dfe23..ff0090547 100644
--- a/include/em4x50.h
+++ b/include/em4x50.h
@@ -36,8 +36,6 @@
 // misc
 #define TIMEOUT                     2000
 #define DUMP_FILESIZE               136
-#define EM4X50_MAX_NO_SAMPLES       1000
-#define EM4X50_MAX_TIME_SAMPLES     1000
 
 #define BYTES2UINT32(x) ((x[0] << 24) | (x[1] << 16) | (x[2] << 8) | (x[3]))
 
@@ -50,13 +48,6 @@ typedef struct {
     uint32_t addresses;
 } PACKED em4x50_data_t;
 
-typedef struct {
-    bool check_field;
-    bool reset;
-    int field;
-    int cycles;
-} PACKED em4x50_test_t;
-
 typedef struct {
     uint8_t byte[4];
 } PACKED em4x50_word_t;
diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h
index 022b602e3..e3dc29aee 100644
--- a/include/pm3_cmd.h
+++ b/include/pm3_cmd.h
@@ -516,7 +516,6 @@ typedef struct {
 #define CMD_LF_EM4X50_READER                                              0x0251
 #define CMD_LF_EM4X50_ESET                                                0x0252
 #define CMD_LF_EM4X50_CHK                                                 0x0253
-#define CMD_LF_EM4X50_TEST                                                0x0254
 #define CMD_LF_EM4X70_INFO                                                0x0260
 #define CMD_LF_EM4X70_WRITE                                               0x0261
 #define CMD_LF_EM4X70_UNLOCK                                              0x0262

From a931cea2f64ca0e69726719c300888144db448ff Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Tue, 19 Jan 2021 00:20:03 +0100
Subject: [PATCH 377/682] First fully functional version of 4x50 sim

---
 armsrc/em4x50.c | 43 ++++++++++++++++++++++++-------------------
 1 file changed, 24 insertions(+), 19 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index c87f7a01e..c5f4ec319 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -40,8 +40,10 @@
 #define EM4X50_T_TAG_WAITING_FOR_SIGNAL     75
 #define EM4X50_T_WAITING_FOR_DBLLIW         1550
 #define EM4X50_T_WAITING_FOR_ACK            4
-#define EM4X50_T_SIMULATION_TIMEOUT_READ    5000 // 400
-#define EM4X50_T_SIMULATION_TIMEOUT_WAIT    5000 // 50
+
+// timeout values for simulation mode (may vary with regard to reader)
+#define EM4X50_T_SIMULATION_TIMEOUT_READ    600
+#define EM4X50_T_SIMULATION_TIMEOUT_WAIT    50
 
 // the following value seems to be critical; if it's too low (e.g. < 120)
 // some cards are no longer readable although they're ok
@@ -1118,18 +1120,19 @@ void em4x50_writepwd(em4x50_data_t *etd) {
 // send bit in receive mode by counting carrier cycles
 static void em4x50_sim_send_bit(uint8_t bit) {
 
-    uint16_t timeout = EM4X50_T_TAG_FULL_PERIOD;
+    //uint16_t timeout = EM4X50_T_TAG_FULL_PERIOD;
+    uint16_t timeout = 500;
 
     for (int t = 0; t < EM4X50_T_TAG_FULL_PERIOD; t++) {
 
         // wait until SSC_CLK goes HIGH
         // used as a simple detection of a reader field?
-        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) && (timeout--));
+        while ((timeout--) && !(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
         
-        if (timeout == 0) {
+        if (timeout <= 0) {
             return;
         }
-        timeout = EM4X50_T_TAG_FULL_PERIOD;
+        timeout = 500;
 
         if (bit)
             OPEN_COIL();
@@ -1137,11 +1140,11 @@ static void em4x50_sim_send_bit(uint8_t bit) {
             SHORT_COIL();
 
         //wait until SSC_CLK goes LOW
-        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK && (timeout--));
-        if (timeout == 0) {
+        while ((timeout--) && (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
+        if (timeout <= 0) {
             return;
         }
-        timeout = EM4X50_T_TAG_FULL_PERIOD;
+        timeout = 500;
 
         if (t == EM4X50_T_TAG_HALF_PERIOD)
             bit ^= 1;
@@ -1202,13 +1205,13 @@ static void wait_cycles(int maxperiods) {
 
     while (period < maxperiods) {
         
-        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) && (timeout--));
+        while ((timeout--) && !(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
         if (timeout <= 0) {
             return;
         }
         timeout = EM4X50_T_SIMULATION_TIMEOUT_WAIT;
         
-        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK && (timeout--));
+        while ((timeout--) && (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
         if (timeout <= 0) {
             return;
         }
@@ -1238,7 +1241,7 @@ static int em4x50_sim_read_bit(void) {
             if (AT91C_BASE_TC0->TC_CV > T0 * EM4X50_ZERO_DETECTION) {
 
                 // gap detected; wait until reader field is switched on again
-                while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK && (timeout--));
+                while ((timeout--) && (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
                 
                 if (timeout <= 0) {
                     return PM3_ETIMEOUT;
@@ -1253,7 +1256,6 @@ static int em4x50_sim_read_bit(void) {
                 // (cf. datasheet)
                 return 0;
             }
-
         }
 
         // no gap detected, i.e. reader field is still up;
@@ -1433,7 +1435,7 @@ static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
     int command = 0;
 
     // extract control data
-    int fwr = reflect32(tag[EM4X50_CONTROL]) & 0xFF;      // first word read
+    int fwr = reflect32(tag[EM4X50_CONTROL]) & 0xFF;        // first word read
     int lwr = (reflect32(tag[EM4X50_CONTROL]) >> 8) & 0xFF; // last word read
     // extract protection data:
     // first word read protected
@@ -1441,7 +1443,6 @@ static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
     // last word read protected
     int lwrp = (reflect32(tag[EM4X50_PROTECTION]) >> 8) & 0xFF;
 
-    // iceman,  will need a usb cmd check to break as well
     while ((BUTTON_PRESS() == false) && (data_available() == false)) {
 
         WDT_HIT();
@@ -1536,9 +1537,6 @@ static int em4x50_sim_handle_login_command(uint32_t *tag) {
     // processing pause time (corresponds to a "1" bit)
     em4x50_sim_send_bit(1);
 
-    // empirically determined delay (to be checked in detail)
-    wait_cycles(1);
-    
     if (pwd && (password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
         em4x50_sim_send_ack();
         gLogin = true;
@@ -1766,6 +1764,7 @@ void em4x50_sim(uint32_t *password) {
         // init
         em4x50_setup_sim();
         gLogin = false;
+        gWritePasswordProcess = false;
 
         // start with inital command = standard read mode
         command = EM4X50_COMMAND_STANDARD_READ;
@@ -1809,6 +1808,12 @@ void em4x50_sim(uint32_t *password) {
                     LED_C_OFF();
                     command = em4x50_sim_handle_standard_read_command(tag);
                     break;
+                    
+                // bit errors during reading may lead to unknown commands
+                // -> continue with standard read mode
+                default:
+                    command = EM4X50_COMMAND_STANDARD_READ;
+                    break;
             }
             
             // stop if key (pm3 button or enter key) has been pressed
@@ -1822,7 +1827,7 @@ void em4x50_sim(uint32_t *password) {
             }
         }
     }
-    
+
     BigBuf_free();
     lf_finalize();
     reply_ng(CMD_LF_EM4X50_SIM, command, NULL, 0);

From 6b6f104d9aa6c140c3177b10fb168e871437ec20 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Wed, 20 Jan 2021 00:58:48 +0100
Subject: [PATCH 378/682] if no carrier clear former authentication

---
 armsrc/em4x50.c | 43 +++++++++++++++++--------------------------
 1 file changed, 17 insertions(+), 26 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index c5f4ec319..05bcfce0e 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -78,6 +78,7 @@ static void wait_timer(uint32_t period) {
     while (AT91C_BASE_TC0->TC_CV < period);
 }
 
+
 // extract and check parities
 // return result of parity check and extracted plain data
 static bool extract_parities(uint64_t word, uint32_t *data) {
@@ -177,17 +178,9 @@ static void em4x50_setup_read(void) {
 }
 
 static void em4x50_setup_sim(void) {
-    StopTicks();
-
     FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
-
-    sample_config *sc = getSamplingConfig();
-    sc->decimation = 1;
-    sc->averaging = 0;
-    sc->divisor = LF_DIVISOR_125;
-
-    FpgaSendCommand(FPGA_CMD_SET_DIVISOR, sc->divisor);
     FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT);
+    FpgaSendCommand(FPGA_CMD_SET_DIVISOR, LF_DIVISOR_125);
 
     AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK;
     AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
@@ -444,7 +437,7 @@ static int find_double_listen_window(bool bcommand) {
                 // first listen window found
 
                 if (bcommand) {
-                    
+
                     // data transmission from card has to be stopped, because
                     // a commamd shall be issued
 
@@ -463,6 +456,7 @@ static int find_double_listen_window(bool bcommand) {
                         // send RM for request mode
                         em4x50_reader_send_bit(0);
                         em4x50_reader_send_bit(0);
+
                         LED_B_OFF();
 
                         return PM3_SUCCESS;
@@ -511,7 +505,7 @@ static bool check_ack(bool bliw) {
     while (count_cycles < EM4X50_T_WAITING_FOR_ACK) {
         if (BUTTON_PRESS())
             return false;
-        
+
         if (check_pulse_length(get_pulse_length(), 2 * EM4X50_T_TAG_FULL_PERIOD)) {
 
             // The received signal is either ACK or NAK.
@@ -661,12 +655,11 @@ static bool login(uint32_t password) {
         // send password
         em4x50_reader_send_word(password);
 
-        wait_timer(T0 * (EM4X50_T_TAG_TPP));
+        wait_timer(T0 * EM4X50_T_TAG_TPP);
 
         // check if ACK is returned
-        if (check_ack(false)) {
+        if (check_ack(false))
             return PM3_SUCCESS;
-        }
 
     } else {
         if (DBGLEVEL >= DBG_DEBUG)
@@ -808,7 +801,7 @@ static int reset(void) {
 
         // send reset command
         em4x50_reader_send_byte_with_parity(EM4X50_COMMAND_RESET);
-        
+
         if (check_ack(false))
             return PM3_SUCCESS;
 
@@ -924,7 +917,7 @@ void em4x50_info(em4x50_data_t *etd) {
     }
 
     lf_finalize();
-    
+
     reply_ng(CMD_LF_EM4X50_INFO, status, (uint8_t *)words, EM4X50_TAG_MAX_NO_BYTES);
 }
 
@@ -941,7 +934,6 @@ void em4x50_reader(void) {
 
     LOW(GPIO_SSC_DOUT);
     lf_finalize();
-    
     reply_ng(CMD_LF_EM4X50_READER, now, (uint8_t *)words, 4 * now);
 }
 
@@ -970,15 +962,14 @@ static int write(uint32_t word, uint32_t addresses) {
             // look for ACK sequence
             if (check_ack(false)) {
 
-                // now EM4x50 needs T0 * EM4X50_T_TAG_TWEE (EEPROM write time)
+                // now EM4x50 needs T0 * EM4X50_T_TAG_TWEE (EEPROM write time = 3.2ms = 50 * 64 periods)
                 // for saving data and should return with ACK
                 for (int i = 0; i < 50; i++) {
                     wait_timer(T0 * EM4X50_T_TAG_FULL_PERIOD);
                 }
 
-                if (check_ack(false)) {
+                if (check_ack(false))
                     return PM3_SUCCESS;
-                }
             }
         }
     } else {
@@ -1019,15 +1010,14 @@ static int write_password(uint32_t password, uint32_t new_password) {
 
                 if (check_ack(false)) {
 
-                    // now EM4x50 needs T0 * EM4X50_T_TAG_TWEE (EEPROM write time)
+                    // now EM4x50 needs T0 * EM4X50_T_TAG_TWEE (EEPROM write time = 3.2ms = 50 * 64 periods)
                     // for saving data and should return with ACK
                     for (int i = 0; i < 50; i++) {
                         wait_timer(T0 * EM4X50_T_TAG_FULL_PERIOD);
                     }
 
-                    if (check_ack(false)) {
+                    if (check_ack(false))
                         return PM3_SUCCESS;
-                    }
                 }
             }
         }
@@ -1425,8 +1415,6 @@ static void em4x50_sim_send_nak(void) {
 
     SHORT_COIL();
     wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
-
-    OPEN_COIL();
 }
 
 // standard read mode process (simulation mode)
@@ -1821,9 +1809,12 @@ void em4x50_sim(uint32_t *password) {
                 break;
             }
             
-            // if timeout (e.g. no reader field) continue with standard read mode
+            // if timeout (e.g. no reader field) continue with standard read
+            // mode and reset former authentication
             if (command == PM3_ETIMEOUT) {
                 command = EM4X50_COMMAND_STANDARD_READ;
+                gLogin = false;
+                LED_A_OFF();
             }
         }
     }

From ecb5879da8749f8a420ae110ec4c09926c4e21a6 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Wed, 20 Jan 2021 01:06:09 +0100
Subject: [PATCH 379/682] entry for extended sim function for EM4x50

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6a2c3e0ad..dbe79d9bf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+ - Added half duplex support for `lf em 4x50 sim` (sim function is now complete) (@tharexde)
  - Added `tools/hitag2crack/crack5opencl`, an optimized version of `crack5gpu` (@matrix)
  - Fixed Makefile to account for changes when running on Apple Silicon (@tcprst)
  - Added support for debugging ARM with JTAG & VSCode (@Gator96100)

From 08c2d447fd49e26e37d38a59d10f707576a54d33 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Wed, 20 Jan 2021 01:08:20 +0100
Subject: [PATCH 380/682] textual

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index dbe79d9bf..323774a34 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,7 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
- - Added half duplex support for `lf em 4x50 sim` (sim function is now complete) (@tharexde)
+ - Added support for bidirectional communication for `lf em 4x50 sim` (@tharexde)
  - Added `tools/hitag2crack/crack5opencl`, an optimized version of `crack5gpu` (@matrix)
  - Fixed Makefile to account for changes when running on Apple Silicon (@tcprst)
  - Added support for debugging ARM with JTAG & VSCode (@Gator96100)

From 0555b69b689d00c2848d1523d70504ec06227a3f Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 20 Jan 2021 11:58:43 +0100
Subject: [PATCH 381/682] update docs

---
 client/cmdscripts/rdv4_init_extflash.cmd         |  2 +-
 client/luascripts/init_rdv4.lua                  | 10 +++++-----
 doc/cheatsheet.md                                |  6 +++---
 doc/cliparser_todo.txt                           |  2 --
 .../2_Configuration-and-Verification.md          | 16 ++++++++--------
 5 files changed, 17 insertions(+), 19 deletions(-)

diff --git a/client/cmdscripts/rdv4_init_extflash.cmd b/client/cmdscripts/rdv4_init_extflash.cmd
index 6fe6de3ba..da0447ce4 100755
--- a/client/cmdscripts/rdv4_init_extflash.cmd
+++ b/client/cmdscripts/rdv4_init_extflash.cmd
@@ -3,4 +3,4 @@
 mem load -f mfc_default_keys --mfc
 mem load -f t55xx_default_pwds --t55xx
 mem load -f iclass_default_keys --iclass
-lf t55xx deviceconfig z p
+lf t55xx deviceconfig -z -p
diff --git a/client/luascripts/init_rdv4.lua b/client/luascripts/init_rdv4.lua
index a724ed189..8e429e67d 100644
--- a/client/luascripts/init_rdv4.lua
+++ b/client/luascripts/init_rdv4.lua
@@ -3,7 +3,7 @@ local ansicolors  = require('ansicolors')
 
 copyright = 'Copyright (c) 2019 IceSQL AB. All rights reserved.'
 author = 'Christian Herrmann'
-version = 'v1.0.1'
+version = 'v1.0.2'
 desc = [[
 This script initialize a Proxmark3 RDV4.0 with
   - uploading dictionary files to flashmem
@@ -82,10 +82,10 @@ function main(args)
     -- T55x7 Device configuration
     print('Configure T55XX device side to match RDV4')
     print(dash)
-    core.console('lf t55xx deviceconfig r 0 a 29 b 17 c 15 d 47 e 15 p')
-    core.console('lf t55xx deviceconfig r 1 a 29 b 17 c 18 d 50 e 15 p')
-    core.console('lf t55xx deviceconfig r 2 a 29 b 17 c 18 d 40 e 15 p')
-    core.console('lf t55xx deviceconfig r 3 a 29 b 17 c 15 d 31 e 15 f 47 g 63 p')
+    core.console('lf t55xx deviceconfig -r 0 -a 29 -b 17 -c 15 -d 47 -e 15 -p')
+    core.console('lf t55xx deviceconfig -r 1 -a 29 -b 17 -c 18 -d 50 -e 15 -p')
+    core.console('lf t55xx deviceconfig -r 2 -a 29 -b 17 -c 18 -d 40 -e 15 -p')
+    core.console('lf t55xx deviceconfig -r 3 -a 29 -b 17 -c 15 -d 31 -e 15 -f 47 -g 63 -p')
 
     print('')
     print('')
diff --git a/doc/cheatsheet.md b/doc/cheatsheet.md
index b4b536053..1220bf173 100644
--- a/doc/cheatsheet.md
+++ b/doc/cheatsheet.md
@@ -544,10 +544,10 @@ Set timings to default
 ```
 Options
 ---
-p            : persist to flashmemory
-z            : Set default t55x7 timings (use p to save if required)
+-p            : persist to flash memory (RDV4)
+-z            : Set default t55x7 timings (use `-p` to save if required)
 
-pm3 --> lf t55xx deviceconfig z p
+pm3 --> lf t55xx deviceconfig -z -p
 ```
 
 Write to T55xx block
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index dbe4e53a7..335c6491f 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -122,7 +122,5 @@ lf t55xx restore
 lf t55xx trace
 lf t55xx wakeup
 lf t55xx write
-lf t55xx bruteforce
-lf t55xx chk
 lf t55xx special
 script run
diff --git a/doc/md/Use_of_Proxmark/2_Configuration-and-Verification.md b/doc/md/Use_of_Proxmark/2_Configuration-and-Verification.md
index 17b22f6c6..ad76ecd9a 100644
--- a/doc/md/Use_of_Proxmark/2_Configuration-and-Verification.md
+++ b/doc/md/Use_of_Proxmark/2_Configuration-and-Verification.md
@@ -8,16 +8,16 @@ You will need to run these commands to make sure your rdv4 is prepared
 
 The lua script actually executes the following commands below.  These are here because of documentation, you can jump down to *Verify sim module firmware version* part.
 ```
-[usb] pm3 --> mem load f mfc_default_keys m
-[usb] pm3 --> mem load f t55xx_default_pwds t
-[usb] pm3 --> mem load f iclass_default_keys i
-[usb] pm3 --> lf t55xx deviceconfig a 29 b 17 c 15 d 47 e 15 p
-[usb] pm3 --> lf t55xx deviceconfig r 1 a 31 b 20 c 18 d 50 e 15 p
-[usb] pm3 --> lf t55xx deviceconfig r 2 a 31 b 20 c 18 d 40 e 15 p
-[usb] pm3 --> lf t55xx deviceconfig r 3 a 29 b 17 c 15 d 31 e 15 f 47 g 63 p
+[usb] pm3 --> mem load -f mfc_default_keys -m
+[usb] pm3 --> mem load -f t55xx_default_pwds -t
+[usb] pm3 --> mem load -f iclass_default_keys -i
+[usb] pm3 --> lf t55xx deviceconfig -a 29 -b 17 -c 15 -d 47 -e 15 -p
+[usb] pm3 --> lf t55xx deviceconfig -r 1 -a 31 -b 20 -c 18 -d 50 -e 15 -p
+[usb] pm3 --> lf t55xx deviceconfig -r 2 -a 31 -b 20 -c 18 -d 40 -e 15 -p
+[usb] pm3 --> lf t55xx deviceconfig -r 3 -a 29 -b 17 -c 15 -d 31 -e 15 -f 47 -g 63 -p
 
 Set all t55xx settings to defaults (will set all 4 at once)
-[usb] pm3 --> lf t55xx deviceconfig z p
+[usb] pm3 --> lf t55xx deviceconfig -z -p
 ```
 
 

From abb0d1c437440ffe0a2ecb774584991eae0979d6 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 20 Jan 2021 12:22:52 +0100
Subject: [PATCH 382/682] forgot the 'r' change became long param '--r0'

---
 client/luascripts/init_rdv4.lua                           | 8 ++++----
 .../Use_of_Proxmark/2_Configuration-and-Verification.md   | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/client/luascripts/init_rdv4.lua b/client/luascripts/init_rdv4.lua
index 8e429e67d..69a76852d 100644
--- a/client/luascripts/init_rdv4.lua
+++ b/client/luascripts/init_rdv4.lua
@@ -82,10 +82,10 @@ function main(args)
     -- T55x7 Device configuration
     print('Configure T55XX device side to match RDV4')
     print(dash)
-    core.console('lf t55xx deviceconfig -r 0 -a 29 -b 17 -c 15 -d 47 -e 15 -p')
-    core.console('lf t55xx deviceconfig -r 1 -a 29 -b 17 -c 18 -d 50 -e 15 -p')
-    core.console('lf t55xx deviceconfig -r 2 -a 29 -b 17 -c 18 -d 40 -e 15 -p')
-    core.console('lf t55xx deviceconfig -r 3 -a 29 -b 17 -c 15 -d 31 -e 15 -f 47 -g 63 -p')
+    core.console('lf t55xx deviceconfig --r0 -a 29 -b 17 -c 15 -d 47 -e 15 -p')
+    core.console('lf t55xx deviceconfig --r1 -a 29 -b 17 -c 18 -d 50 -e 15 -p')
+    core.console('lf t55xx deviceconfig --r2 -a 29 -b 17 -c 18 -d 40 -e 15 -p')
+    core.console('lf t55xx deviceconfig --r3 -a 29 -b 17 -c 15 -d 31 -e 15 -f 47 -g 63 -p')
 
     print('')
     print('')
diff --git a/doc/md/Use_of_Proxmark/2_Configuration-and-Verification.md b/doc/md/Use_of_Proxmark/2_Configuration-and-Verification.md
index ad76ecd9a..55e05af92 100644
--- a/doc/md/Use_of_Proxmark/2_Configuration-and-Verification.md
+++ b/doc/md/Use_of_Proxmark/2_Configuration-and-Verification.md
@@ -11,10 +11,10 @@ The lua script actually executes the following commands below.  These are here b
 [usb] pm3 --> mem load -f mfc_default_keys -m
 [usb] pm3 --> mem load -f t55xx_default_pwds -t
 [usb] pm3 --> mem load -f iclass_default_keys -i
-[usb] pm3 --> lf t55xx deviceconfig -a 29 -b 17 -c 15 -d 47 -e 15 -p
-[usb] pm3 --> lf t55xx deviceconfig -r 1 -a 31 -b 20 -c 18 -d 50 -e 15 -p
-[usb] pm3 --> lf t55xx deviceconfig -r 2 -a 31 -b 20 -c 18 -d 40 -e 15 -p
-[usb] pm3 --> lf t55xx deviceconfig -r 3 -a 29 -b 17 -c 15 -d 31 -e 15 -f 47 -g 63 -p
+[usb] pm3 --> lf t55xx deviceconfig --r0 -a 29 -b 17 -c 15 -d 47 -e 15 -p
+[usb] pm3 --> lf t55xx deviceconfig --r1 -a 31 -b 20 -c 18 -d 50 -e 15 -p
+[usb] pm3 --> lf t55xx deviceconfig --r2 -a 31 -b 20 -c 18 -d 40 -e 15 -p
+[usb] pm3 --> lf t55xx deviceconfig --r3 -a 29 -b 17 -c 15 -d 31 -e 15 -f 47 -g 63 -p
 
 Set all t55xx settings to defaults (will set all 4 at once)
 [usb] pm3 --> lf t55xx deviceconfig -z -p

From 0b37e2a06238227a3e678790533959393c1f590c Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 20 Jan 2021 14:15:43 +0100
Subject: [PATCH 383/682] text updates

---
 .../Troubleshooting.md                        |  2 ++
 .../Windows-Installation-Instructions.md      | 24 +++++++++++++++++--
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/doc/md/Installation_Instructions/Troubleshooting.md b/doc/md/Installation_Instructions/Troubleshooting.md
index 85a45f852..273bab50d 100644
--- a/doc/md/Installation_Instructions/Troubleshooting.md
+++ b/doc/md/Installation_Instructions/Troubleshooting.md
@@ -123,11 +123,13 @@ proxmark3
 
 and you must adapt accordingly the file path of some commands, e.g.
 
+using the executable direct:
 ```
 proxmark3 <YOUR_PORT_HERE> --flash --image /usr/local/share/proxmark3/firmware/fullimage.elf
 <>
 proxmark3 <YOUR_PORT_HERE> --flash --image /usr/share/proxmark3/firmware/fullimage.elf
 
+using the script:
 pm3 --> smart upgrade -f /usr/local/share/proxmark3/firmware/sim011.bin
 <>
 pm3 --> smart upgrade -f /usr/share/proxmark3/firmware/sim011.bin
diff --git a/doc/md/Installation_Instructions/Windows-Installation-Instructions.md b/doc/md/Installation_Instructions/Windows-Installation-Instructions.md
index 6000f42f2..842fa3773 100644
--- a/doc/md/Installation_Instructions/Windows-Installation-Instructions.md
+++ b/doc/md/Installation_Instructions/Windows-Installation-Instructions.md
@@ -1,15 +1,26 @@
 # Installing on Windows
+<a id="top"></a>
+
+## Table of Contents
+
+  * [Installing dev-environment with ProxSpace](#installing-dev-environment-with-proxspace)
+  * [Installing pre-compiled binaries with ProxSpace](#installing-pre-compiled-binaries-with-proxspace)
+  * [Installing dev-environment with WSL 1](#installing-dev-environment-with-wsl-1)
 
 There are two ways to install, build and use Proxmark3 on Windows:
 
 * Using Gator96100 **ProxSpace**, a package to assist in your Windows installation of MinGW
 * Using native **WSL 1**, if you're running a Windows 10 version recent enough (FCU 1709 or later)
 
+We have listed three ways to use these two setups  (dev environment vs pre-compiled binaries)
+
 ---
 
-# Installing on Windows with ProxSpace
+## Installing dev-environment with ProxSpace
+^[Top](#top)
 
 ## Video Installation guide
+_note:  this video is a bit out-of-date but still informative_
 [![Windows Installation tutorial](https://github.com/5w0rdfish/Proxmark3-RDV4-ParrotOS/blob/master/screenshot-www.youtube.com-2019.03.17-20-44-33.png)](https://youtu.be/zzF0NCMJnYU "Windows Installation Tutorial")
 
 ## Driver Installation
@@ -64,7 +75,15 @@ To use the compiled client, the only differences are that executables end with `
 
 Now you're ready to follow the [compilation instructions](/doc/md/Use_of_Proxmark/0_Compilation-Instructions.md).
 
-# Installing on Windows with WSL 1
+# Installing pre-compiled binaries with ProxSpace
+^[Top](#top)
+
+to be done (tcprst)
+
+
+
+# Installing dev-environment with WSL 1
+^[Top](#top)
 
 WSL 1 requires to run on Windows 10 version 1709 or above. Previous windows versions didn't have support for COM ports.
 
@@ -82,6 +101,7 @@ Make sure your WSL can launch Windows processes to get the `pm3` scripts working
 
 If you want to run the graphical components of the Proxmark3 client, you need to install a X Server such as [VcXsrv](https://sourceforge.net/projects/vcxsrv/) or [Xming](https://sourceforge.net/projects/xming/) and launch it, e.g. by executing XLaunch.
 
+
 ## Window terminal Installation
 Microsoft has recent released a new terminal for their OS.  It is much better experience than old `cmd.exe` so we strongly recommend installing it.
 It is also open sourced, ref [terminal](https://github.com/microsoft/terminal). You can download and install from here: [windows terminal](https://aka.ms/terminal)

From 9945e1b358178665d9da8ee7432924c3b65b997f Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 20 Jan 2021 14:28:49 +0100
Subject: [PATCH 384/682] added some sleeps

---
 client/luascripts/init_rdv4.lua | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/client/luascripts/init_rdv4.lua b/client/luascripts/init_rdv4.lua
index 69a76852d..08574a2fe 100644
--- a/client/luascripts/init_rdv4.lua
+++ b/client/luascripts/init_rdv4.lua
@@ -1,9 +1,10 @@
 local getopt = require('getopt')
 local ansicolors  = require('ansicolors')
+local utils = require('utils')
 
 copyright = 'Copyright (c) 2019 IceSQL AB. All rights reserved.'
 author = 'Christian Herrmann'
-version = 'v1.0.2'
+version = 'v1.0.3'
 desc = [[
 This script initialize a Proxmark3 RDV4.0 with
   - uploading dictionary files to flashmem
@@ -83,9 +84,13 @@ function main(args)
     print('Configure T55XX device side to match RDV4')
     print(dash)
     core.console('lf t55xx deviceconfig --r0 -a 29 -b 17 -c 15 -d 47 -e 15 -p')
+    utils.Sleep(1)
     core.console('lf t55xx deviceconfig --r1 -a 29 -b 17 -c 18 -d 50 -e 15 -p')
+    utils.Sleep(1)
     core.console('lf t55xx deviceconfig --r2 -a 29 -b 17 -c 18 -d 40 -e 15 -p')
+    utils.Sleep(1)
     core.console('lf t55xx deviceconfig --r3 -a 29 -b 17 -c 15 -d 31 -e 15 -f 47 -g 63 -p')
+    utils.Sleep(1)
 
     print('')
     print('')

From f91249c2a4bf7f0fe72cb6f6f0dcdfc103270d62 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 20 Jan 2021 14:32:16 +0100
Subject: [PATCH 385/682] text

---
 .../Windows-Installation-Instructions.md                 | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/doc/md/Installation_Instructions/Windows-Installation-Instructions.md b/doc/md/Installation_Instructions/Windows-Installation-Instructions.md
index 842fa3773..d9f708a47 100644
--- a/doc/md/Installation_Instructions/Windows-Installation-Instructions.md
+++ b/doc/md/Installation_Instructions/Windows-Installation-Instructions.md
@@ -23,7 +23,9 @@ We have listed three ways to use these two setups  (dev environment vs pre-compi
 _note:  this video is a bit out-of-date but still informative_
 [![Windows Installation tutorial](https://github.com/5w0rdfish/Proxmark3-RDV4-ParrotOS/blob/master/screenshot-www.youtube.com-2019.03.17-20-44-33.png)](https://youtu.be/zzF0NCMJnYU "Windows Installation Tutorial")
 
-## Driver Installation
+## Driver Installation ( Windows 7 )
+
+_note: for Windows 7 you will this step.  On a later Windows edition skip this._
 
 Install required drivers for your Windows installation. You may need admin privileges to do this.  
 Step by step guides are online such as [RyscCorps](https://store.ryscc.com/blogs/news/how-to-install-a-proxmark3-driver-on-windows-10).
@@ -73,8 +75,11 @@ pacman -S mingw-w64-x86_64-astyle
 
 To use the compiled client, the only differences are that executables end with `.exe` (e.g. `proxmark3.exe`) and that the Proxmark3 port is one of your `comX` ports where "X" is the com port number assigned to proxmark3 under Windows, so commands like `proxmark3 /dev/ttyACMX` become `proxmark3.exe comX`.
 
+## Done!
+
 Now you're ready to follow the [compilation instructions](/doc/md/Use_of_Proxmark/0_Compilation-Instructions.md).
 
+
 # Installing pre-compiled binaries with ProxSpace
 ^[Top](#top)
 
@@ -167,5 +172,7 @@ echo "export DISPLAY=:0" >> ~/.bashrc
 
 Note that it may take a quite long time for a freshly plugged Proxmark3 to be visible on a WSL /dev/ttySX port.
 
+## Done!
+
 Now you're ready to follow the [compilation instructions](/doc/md/Use_of_Proxmark/0_Compilation-Instructions.md).
 

From e09d8b27a2957d692bb0eaffe5af96301dba31d9 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Wed, 20 Jan 2021 19:29:57 +0100
Subject: [PATCH 386/682] timeout define instead of hardcoded value

---
 armsrc/em4x50.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index 05bcfce0e..f27a21367 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -1111,7 +1111,7 @@ void em4x50_writepwd(em4x50_data_t *etd) {
 static void em4x50_sim_send_bit(uint8_t bit) {
 
     //uint16_t timeout = EM4X50_T_TAG_FULL_PERIOD;
-    uint16_t timeout = 500;
+    uint16_t timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
 
     for (int t = 0; t < EM4X50_T_TAG_FULL_PERIOD; t++) {
 
@@ -1122,7 +1122,7 @@ static void em4x50_sim_send_bit(uint8_t bit) {
         if (timeout <= 0) {
             return;
         }
-        timeout = 500;
+        timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
 
         if (bit)
             OPEN_COIL();
@@ -1134,7 +1134,7 @@ static void em4x50_sim_send_bit(uint8_t bit) {
         if (timeout <= 0) {
             return;
         }
-        timeout = 500;
+        timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
 
         if (t == EM4X50_T_TAG_HALF_PERIOD)
             bit ^= 1;

From e061645c6beb333caa801921b124c2def5ed855d Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Wed, 20 Jan 2021 19:37:38 +0100
Subject: [PATCH 387/682] deleted unneeded include statement

---
 client/src/cmdlfem4x70.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/client/src/cmdlfem4x70.h b/client/src/cmdlfem4x70.h
index c72450e88..75e3e27fc 100644
--- a/client/src/cmdlfem4x70.h
+++ b/client/src/cmdlfem4x70.h
@@ -12,7 +12,6 @@
 #define CMDLFEM4X70_H__
 
 #include "common.h"
-#include "em4x70.h"
 
 #define TIMEOUT                     2000
 

From d41a884c2f0b90665286266571b05c7321ac92a0 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Wed, 20 Jan 2021 19:47:14 +0100
Subject: [PATCH 388/682] restoring filename from commit.

---
 client/src/cmdlfem4x70.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/client/src/cmdlfem4x70.h b/client/src/cmdlfem4x70.h
index 75e3e27fc..f0f221b06 100644
--- a/client/src/cmdlfem4x70.h
+++ b/client/src/cmdlfem4x70.h
@@ -12,6 +12,7 @@
 #define CMDLFEM4X70_H__
 
 #include "common.h"
+#include "em4x50.h"
 
 #define TIMEOUT                     2000
 

From 843dd9bef49b3b5931574e9534c744205a0d2a42 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Wed, 20 Jan 2021 19:47:55 +0100
Subject: [PATCH 389/682] deleted unneeded include statement

---
 client/src/cmdlfem4x70.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/client/src/cmdlfem4x70.h b/client/src/cmdlfem4x70.h
index f0f221b06..75e3e27fc 100644
--- a/client/src/cmdlfem4x70.h
+++ b/client/src/cmdlfem4x70.h
@@ -12,7 +12,6 @@
 #define CMDLFEM4X70_H__
 
 #include "common.h"
-#include "em4x50.h"
 
 #define TIMEOUT                     2000
 

From 7094994b574d1f58fed1e6780c6ae03989fc11b8 Mon Sep 17 00:00:00 2001
From: Marcos Del Sol Vives <marcos@orca.pet>
Date: Fri, 22 Jan 2021 16:05:45 +0100
Subject: [PATCH 390/682] Fix nonce acquisition

---
 armsrc/mifarecmd.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/armsrc/mifarecmd.c b/armsrc/mifarecmd.c
index 7faa0c268..a4f1d3d83 100644
--- a/armsrc/mifarecmd.c
+++ b/armsrc/mifarecmd.c
@@ -696,7 +696,7 @@ void MifareAcquireNonces(uint32_t arg0, uint32_t flags) {
 
     LED_C_ON();
 
-    for (uint16_t i = 0; i <= PM3_CMD_DATA_SIZE - 4; i += 4) {
+    while (num_nonces < PM3_CMD_DATA_SIZE / 4) {
 
         // Test if the action was cancelled
         if (BUTTON_PRESS()) {
@@ -746,18 +746,14 @@ void MifareAcquireNonces(uint32_t arg0, uint32_t flags) {
             continue;
         }
 
-        num_nonces++;
-
         // Save the tag nonce (nt)
-        buf[i]   = answer[0];
-        buf[i + 1] = answer[1];
-        buf[i + 2] = answer[2];
-        buf[i + 3] = answer[3];
+        memcpy(buf + num_nonces * 4, answer, 4);
+        num_nonces++;
     }
 
     LED_C_OFF();
     LED_B_ON();
-    reply_old(CMD_ACK, isOK, cuid, num_nonces - 1, buf, sizeof(buf));
+    reply_old(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));
     LED_B_OFF();
 
     if (DBGLEVEL >= 3) DbpString("AcquireNonces finished");

From 8bf89436f86a600a8707b8433426f4f2aa1f00d2 Mon Sep 17 00:00:00 2001
From: Marcos Del Sol Vives <marcos@orca.pet>
Date: Fri, 22 Jan 2021 16:06:39 +0100
Subject: [PATCH 391/682] Improve error messages on encrypted nonce acquisition

---
 armsrc/mifarecmd.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/armsrc/mifarecmd.c b/armsrc/mifarecmd.c
index a4f1d3d83..4880d01e9 100644
--- a/armsrc/mifarecmd.c
+++ b/armsrc/mifarecmd.c
@@ -822,7 +822,7 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags,
         if (!have_uid) { // need a full select cycle to get the uid first
             iso14a_card_select_t card_info;
             if (!iso14443a_select_card(uid, &card_info, &cuid, true, 0, true)) {
-                if (DBGLEVEL >= DBG_ERROR) Dbprintf("AcquireNonces: Can't select card (ALL)");
+                if (DBGLEVEL >= DBG_ERROR) Dbprintf("AcquireEncryptedNonces: Can't select card (ALL)");
                 continue;
             }
             switch (card_info.uidlen) {
@@ -841,7 +841,7 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags,
             have_uid = true;
         } else { // no need for anticollision. We can directly select the card
             if (!iso14443a_fast_select_card(uid, cascade_levels)) {
-                if (DBGLEVEL >= DBG_ERROR) Dbprintf("AcquireNonces: Can't select card (UID)");
+                if (DBGLEVEL >= DBG_ERROR) Dbprintf("AcquireEncryptedNonces: Can't select card (UID)");
                 continue;
             }
         }
@@ -851,7 +851,7 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags,
 
         uint32_t nt1;
         if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST, &nt1, NULL)) {
-            if (DBGLEVEL >= DBG_ERROR) Dbprintf("AcquireNonces: Auth1 error");
+            if (DBGLEVEL >= DBG_ERROR) Dbprintf("AcquireEncryptedNonces: Auth1 error");
             continue;
         }
 
@@ -862,7 +862,7 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags,
         CHK_TIMEOUT();
 
         if (len != 4) {
-            if (DBGLEVEL >= DBG_ERROR) Dbprintf("AcquireNonces: Auth2 error len=%d", len);
+            if (DBGLEVEL >= DBG_ERROR) Dbprintf("AcquireEncryptedNonces: Auth2 error len=%d", len);
             continue;
         }
 

From 37f4dee7277c62e5be0ec22c330c5f14273d117b Mon Sep 17 00:00:00 2001
From: Marcos Del Sol Vives <marcos@orca.pet>
Date: Fri, 22 Jan 2021 22:21:08 +0100
Subject: [PATCH 392/682] Fix out of bounds read

---
 client/src/ui.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/ui.c b/client/src/ui.c
index 3b85f4e94..293a98c58 100644
--- a/client/src/ui.c
+++ b/client/src/ui.c
@@ -474,7 +474,7 @@ static bool emojify_token(const char *token, uint8_t token_length, const char **
                 case EMO_ALTTEXT: {
                     int j = 0;
                     *emojified_token_length = 0;
-                    while (EmojiAltTable[j].alias && EmojiAltTable[i].alttext) {
+                    while (EmojiAltTable[j].alias && EmojiAltTable[j].alttext) {
                         if ((strlen(EmojiAltTable[j].alias) == token_length) && (0 == memcmp(EmojiAltTable[j].alias, token, token_length))) {
                             *emojified_token = EmojiAltTable[j].alttext;
                             *emojified_token_length = strlen(EmojiAltTable[j].alttext);

From 4d2d65a0c6d5a498dbf329287c5ce1e9453f5eef Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 22 Jan 2021 22:58:50 +0100
Subject: [PATCH 393/682] lf fdx reader - check both 125 / 134 freqs.

---
 client/src/cmdlffdxb.c | 39 ++++++++++++++++++++++++++-------------
 1 file changed, 26 insertions(+), 13 deletions(-)

diff --git a/client/src/cmdlffdxb.c b/client/src/cmdlffdxb.c
index 529f63019..fdead8ea9 100644
--- a/client/src/cmdlffdxb.c
+++ b/client/src/cmdlffdxb.c
@@ -653,16 +653,10 @@ static int CmdFdxBReader(const char *Cmd) {
         return res;
     }
 
-    int16_t tmp_div = config.divisor;
-    if (tmp_div != LF_DIVISOR_134) {
-        config.divisor = LF_DIVISOR_134;
-        config.verbose = false;
-        res = lf_config(&config);
-        if (res != PM3_SUCCESS) {
-            PrintAndLogEx(ERR, "failed to change LF configuration");
-            return res;
-        }
-    }
+    config.verbose = false;
+
+    int16_t old_div = config.divisor;
+    int16_t curr_div = config.divisor;
 
     if (cm) {
         PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
@@ -670,13 +664,32 @@ static int CmdFdxBReader(const char *Cmd) {
 
     int ret = PM3_SUCCESS;
     do {
+
+        if (curr_div == LF_DIVISOR_125) {
+            config.divisor = LF_DIVISOR_134;
+            res = lf_config(&config);
+            if (res != PM3_SUCCESS) {
+                PrintAndLogEx(ERR, "failed to change to 134 KHz LF configuration");
+                return res;
+            }
+        } else {
+            config.divisor = LF_DIVISOR_125;
+            res = lf_config(&config);
+            if (res != PM3_SUCCESS) {
+                PrintAndLogEx(ERR, "failed to change to 125 KHz LF configuration");
+                return res;
+            }
+        }
+        curr_div = config.divisor;
+
         lf_read(false, 10000);
         ret = demodFDXB(!cm); // be verbose only if not in continuous mode
-        //PrintAndLogEx(INPLACE, "");
+
     } while (cm && !kbd_enter_pressed());
 
-    if (tmp_div != LF_DIVISOR_134) {
-        config.divisor = tmp_div;
+
+    if (old_div != curr_div) {
+        config.divisor = old_div;
         res = lf_config(&config);
         if (res != PM3_SUCCESS) {
             PrintAndLogEx(ERR, "failed to restore LF configuration");

From 2987fdb18734fc0bb012b36f0a2000815d39e991 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 23 Jan 2021 19:08:45 +0100
Subject: [PATCH 394/682] added warning prefix

---
 client/deps/cliparser/argtable3.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/client/deps/cliparser/argtable3.c b/client/deps/cliparser/argtable3.c
index 2fe32b082..43701d735 100644
--- a/client/deps/cliparser/argtable3.c
+++ b/client/deps/cliparser/argtable3.c
@@ -2554,18 +2554,18 @@ static void arg_lit_errorfn(
 
     switch (errorcode) {
         case EMINCOUNT:
-            fprintf(fp, "%s: missing option ", progname);
+            fprintf(fp, "[!] %s: missing option ", progname);
             arg_print_option(fp, shortopts, longopts, datatype, "\n");
             fprintf(fp, "\n");
             break;
 
         case EMAXCOUNT:
-            fprintf(fp, "%s: extraneous option ", progname);
+            fprintf(fp, "[!] %s: extraneous option ", progname);
             arg_print_option(fp, shortopts, longopts, datatype, "\n");
             break;
     }
 
-    ARG_TRACE(("%s:errorfn(%p, %p, %d, %s, %s)\n", __FILE__, parent, fp,
+    ARG_TRACE(("[!] %s:errorfn(%p, %p, %d, %s, %s)\n", __FILE__, parent, fp,
                errorcode, argval, progname));
 }
 
@@ -2859,7 +2859,7 @@ static void arg_rex_errorfn(struct arg_rex *parent,
     /* make argval NULL safe */
     argval = argval ? argval : "";
 
-    fprintf(fp, "%s: ", progname);
+    fprintf(fp, "[!] %s: ", progname);
     switch (errorcode) {
         case EMINCOUNT:
             fputs("missing option ", fp);
@@ -3790,7 +3790,7 @@ static void arg_str_errorfn(
     /* make argval NULL safe */
     argval = argval ? argval : "";
 
-    fprintf(fp, "%s: ", progname);
+    fprintf(fp, "[!] %s: ", progname);
     switch (errorcode) {
         case EMINCOUNT:
             fputs("missing option ", fp);

From b2ba09b8b4d21429647d9b9be6bae4db1cbaa3d7 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Sat, 23 Jan 2021 22:37:25 +0100
Subject: [PATCH 395/682] changelog

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 323774a34..868fe6877 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
 
 ## [unreleased][unreleased]
  - Added support for bidirectional communication for `lf em 4x50 sim` (@tharexde)
+ - Change `PLATFORM=PM3OTHER` to `PLATFORM=PM3GENERIC` (@iceman1001)
  - Added `tools/hitag2crack/crack5opencl`, an optimized version of `crack5gpu` (@matrix)
  - Fixed Makefile to account for changes when running on Apple Silicon (@tcprst)
  - Added support for debugging ARM with JTAG & VSCode (@Gator96100)

From 0fee0c97cb7526f58f279e43a91dc0a06e450738 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Sat, 23 Jan 2021 22:38:07 +0100
Subject: [PATCH 396/682] make style

---
 armsrc/em4x50.c                               |  80 +++++------
 client/src/cmdlfem4x50.c                      |   6 +-
 doc/commands.md                               |  27 ++--
 .../crack5opencl/ht2crack5opencl.c            |  19 ++-
 tools/hitag2crack/crack5opencl/opencl.c       | 134 +++++++++---------
 tools/hitag2crack/crack5opencl/opencl.h       |   2 +-
 tools/hitag2crack/crack5opencl/threads.c      |   5 +-
 7 files changed, 135 insertions(+), 138 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index f27a21367..a9eea7ad2 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -185,7 +185,7 @@ static void em4x50_setup_sim(void) {
     AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK;
     AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
     AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK;
-    
+
     AT91C_BASE_PMC->PMC_PCER |= (1 << AT91C_ID_TC0);
     AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME;
     AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;
@@ -194,7 +194,7 @@ static void em4x50_setup_sim(void) {
 
     // Watchdog hit
     WDT_HIT();
-    
+
     LEDsoff();
 }
 
@@ -1118,7 +1118,7 @@ static void em4x50_sim_send_bit(uint8_t bit) {
         // wait until SSC_CLK goes HIGH
         // used as a simple detection of a reader field?
         while ((timeout--) && !(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
-        
+
         if (timeout <= 0) {
             return;
         }
@@ -1194,19 +1194,19 @@ static void wait_cycles(int maxperiods) {
     int period = 0, timeout = EM4X50_T_SIMULATION_TIMEOUT_WAIT;
 
     while (period < maxperiods) {
-        
+
         while ((timeout--) && !(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
         if (timeout <= 0) {
             return;
         }
         timeout = EM4X50_T_SIMULATION_TIMEOUT_WAIT;
-        
+
         while ((timeout--) && (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
         if (timeout <= 0) {
             return;
         }
         timeout = EM4X50_T_SIMULATION_TIMEOUT_WAIT;
-        
+
         period++;
     }
 }
@@ -1232,7 +1232,7 @@ static int em4x50_sim_read_bit(void) {
 
                 // gap detected; wait until reader field is switched on again
                 while ((timeout--) && (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
-                
+
                 if (timeout <= 0) {
                     return PM3_ETIMEOUT;
                 }
@@ -1259,12 +1259,12 @@ static int em4x50_sim_read_bit(void) {
 
 // read byte in simulation mode either with or without parity check (even)
 static bool em4x50_sim_read_byte(uint8_t *byte, bool paritycheck) {
-    
+
     for (int i = 0; i < 8; i++) {
         *byte <<= 1;
         *byte |= em4x50_sim_read_bit();
     }
-        
+
     if (paritycheck) {
 
         int pval = em4x50_sim_read_bit();
@@ -1280,12 +1280,12 @@ static bool em4x50_sim_read_byte(uint8_t *byte, bool paritycheck) {
     }
 
     return true;
-        
+
 }
 
 // read complete word in simulation mode
 static bool em4x50_sim_read_word(uint32_t *word) {
-    
+
     uint8_t stop_bit = 0;
     uint8_t parities = 0, parities_calculated = 0;
     uint8_t bytes[4] = {0};
@@ -1306,20 +1306,20 @@ static bool em4x50_sim_read_word(uint32_t *word) {
             parities_calculated ^= (bytes[j] >> (7 - i)) & 1;
         }
     }
-    
+
     *word = BYTES2UINT32(bytes);
-    
+
     // check parities
     if ((parities == parities_calculated) && (stop_bit == 0)) {
         return true;
     }
-    
+
     return false;
 }
 
 // check if reader requests receive mode (rm) by sending two zeros
 static int check_rm_request(uint32_t *tag) {
-    
+
     // look for first zero
     int bit = em4x50_sim_read_bit();
     if (bit == 0) {
@@ -1340,13 +1340,13 @@ static int check_rm_request(uint32_t *tag) {
             }
         }
     }
-    
+
     return (bit != PM3_ETIMEOUT) ? PM3_SUCCESS : PM3_ETIMEOUT;
 }
 
 // send single listen window in simulation mode
 static int em4x50_sim_send_listen_window(uint32_t *tag) {
-    
+
     SHORT_COIL();
     wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
 
@@ -1388,7 +1388,7 @@ static void em4x50_sim_send_ack(void) {
 
     OPEN_COIL();
     wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
-    
+
     SHORT_COIL();
 }
 
@@ -1419,7 +1419,7 @@ static void em4x50_sim_send_nak(void) {
 
 // standard read mode process (simulation mode)
 static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
-    
+
     int command = 0;
 
     // extract control data
@@ -1462,11 +1462,11 @@ static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
 static int em4x50_sim_handle_selective_read_command(uint32_t *tag) {
 
     int command = 0;
-    
+
     // read password
     uint32_t address = 0;
     bool addr = em4x50_sim_read_word(&address);
-    
+
     // processing pause time (corresponds to a "1" bit)
     em4x50_sim_send_bit(1);
 
@@ -1486,7 +1486,7 @@ static int em4x50_sim_handle_selective_read_command(uint32_t *tag) {
     int fwrp = reflect32(tag[EM4X50_PROTECTION]) & 0xFF;
     // last word read protected
     int lwrp = (reflect32(tag[EM4X50_PROTECTION]) >> 8) & 0xFF;
-    
+
     while ((BUTTON_PRESS() == false) && (data_available() == false)) {
 
         WDT_HIT();
@@ -1521,7 +1521,7 @@ static int em4x50_sim_handle_login_command(uint32_t *tag) {
     // read password
     uint32_t password = 0;
     bool pwd = em4x50_sim_read_word(&password);
-    
+
     // processing pause time (corresponds to a "1" bit)
     em4x50_sim_send_bit(1);
 
@@ -1548,10 +1548,10 @@ static int em4x50_sim_handle_reset_command(uint32_t *tag) {
     em4x50_sim_send_ack();
     gLogin = false;
     LED_A_OFF();
-    
+
     // wait for initialization (tinit)
     wait_cycles(EM4X50_T_TAG_TINIT);
-    
+
     // continue with standard read mode
     return EM4X50_COMMAND_STANDARD_READ;
 }
@@ -1565,7 +1565,7 @@ static int em4x50_sim_handle_write_command(uint32_t *tag) {
     // read data
     uint32_t data = 0;
     bool word = em4x50_sim_read_word(&data);
-        
+
     // write access time
     wait_cycles(EM4X50_T_TAG_TWA);
 
@@ -1634,7 +1634,7 @@ static int em4x50_sim_handle_write_command(uint32_t *tag) {
             }
             break;
     }
-    
+
     // EEPROM write time
     // strange: need some sort of 'waveform correction', otherwise ack signal
     // will not be detected; sending a single "1" as last "bit" of Twee
@@ -1666,18 +1666,18 @@ static int em4x50_sim_handle_write_command(uint32_t *tag) {
 static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
 
     bool pwd = false;
-    
+
     if (gWritePasswordProcess == false) {
-        
+
         gWritePasswordProcess = true;
 
         // read password
         uint32_t act_password = 0;
         pwd = em4x50_sim_read_word(&act_password);
-        
+
         // processing pause time (corresponds to a "1" bit)
         em4x50_sim_send_bit(1);
-        
+
         if (pwd && (act_password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
             em4x50_sim_send_ack();
             gLogin = true;
@@ -1710,7 +1710,7 @@ static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
             em4x50_sim_send_ack();
             return EM4X50_COMMAND_STANDARD_READ;
         }
-        
+
         // EEPROM write time
         // strange: need some sort of 'waveform correction', otherwise ack signal
         // will not be detected; sending a single "1" as last part of Twee
@@ -1722,7 +1722,7 @@ static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
         // continue with standard read mode
         return EM4X50_COMMAND_STANDARD_READ;
     }
-    
+
     // call writepwd function again for else branch
     return EM4X50_COMMAND_WRITE_PASSWORD;
 }
@@ -1732,15 +1732,15 @@ static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
 // LED B -> standard read mode is active
 // LED C -> command has been transmitted by reader
 void em4x50_sim(uint32_t *password) {
-    
+
     int command = PM3_ENODATA;
-    
+
     uint8_t *em4x50_mem = BigBuf_get_EM_addr();
     uint32_t tag[EM4X50_NO_WORDS] = {0x0};
 
     for (int i = 0; i < EM4X50_NO_WORDS; i++)
         tag[i] = bytes_to_num(em4x50_mem + (i * 4), 4);
-    
+
     // via eload uploaded dump usually does not contain a password
     if (tag[EM4X50_DEVICE_PASSWORD] == 0) {
         tag[EM4X50_DEVICE_PASSWORD] = reflect32(*password);
@@ -1790,25 +1790,25 @@ void em4x50_sim(uint32_t *password) {
                     LED_C_ON();
                     command =  em4x50_sim_handle_selective_read_command(tag);
                     break;
-                    
+
                 case EM4X50_COMMAND_STANDARD_READ:
                     LED_B_ON();
                     LED_C_OFF();
                     command = em4x50_sim_handle_standard_read_command(tag);
                     break;
-                    
+
                 // bit errors during reading may lead to unknown commands
                 // -> continue with standard read mode
                 default:
                     command = EM4X50_COMMAND_STANDARD_READ;
                     break;
             }
-            
+
             // stop if key (pm3 button or enter key) has been pressed
             if (command == PM3_EOPABORTED) {
                 break;
             }
-            
+
             // if timeout (e.g. no reader field) continue with standard read
             // mode and reset former authentication
             if (command == PM3_ETIMEOUT) {
diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c
index 84c331337..ae99bd8a6 100644
--- a/client/src/cmdlfem4x50.c
+++ b/client/src/cmdlfem4x50.c
@@ -1129,10 +1129,10 @@ int CmdEM4x50Restore(const char *Cmd) {
 }
 
 int CmdEM4x50Sim(const char *Cmd) {
-    
+
     int status = PM3_EFAILED;
     uint32_t password = 0;
-    
+
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "lf em 4x50 sim",
                   "Simulates a EM4x50 tag.\n"
@@ -1168,7 +1168,7 @@ int CmdEM4x50Sim(const char *Cmd) {
     clearCommandBuffer();
     SendCommandNG(CMD_LF_EM4X50_SIM, (uint8_t *)&password, sizeof(password));
     PacketResponseNG resp;
-    
+
     PrintAndLogEx(INFO, "Press pm3-button to abort simulation");
     bool keypress = kbd_enter_pressed();
     while (keypress == false) {
diff --git a/doc/commands.md b/doc/commands.md
index 33b47f975..3c55c5368 100644
--- a/doc/commands.md
+++ b/doc/commands.md
@@ -38,6 +38,7 @@ Check column "offline" for their availability.
 |`analyse nuid           `|Y       |`create NUID from 7byte UID`
 |`analyse demodbuff      `|Y       |`Load binary string to demodbuffer`
 |`analyse freq           `|Y       |`Calc wave lengths`
+|`analyse foo            `|Y       |`muxer`
 
 
 ### data
@@ -883,25 +884,25 @@ Check column "offline" for their availability.
 |`lf t55xx help          `|Y       |`This help`
 |`lf t55xx clonehelp     `|N       |`Shows the available clone commands`
 |`lf t55xx config        `|Y       |`Set/Get T55XX configuration (modulation, inverted, offset, rate)`
-|`lf t55xx dangerraw     `|N       |`Sends raw bitstream. Dangerous, do not use!! b <bitstream> t <timing>`
-|`lf t55xx detect        `|Y       |`[1] Try detecting the tag modulation from reading the configuration block.`
-|`lf t55xx deviceconfig  `|N       |`Set/Get T55XX device configuration (startgap, writegap, write0, write1, readgap`
-|`lf t55xx dump          `|N       |`[password] [o] Dump T55xx card Page 0 block 0-7. Optional [password], [override]`
-|`lf t55xx info          `|Y       |`[1] Show T55x7 configuration data (page 0/ blk 0)`
-|`lf t55xx p1detect      `|N       |`[1] Try detecting if this is a t55xx tag by reading page 1`
-|`lf t55xx read          `|N       |`b <block> p [password] [o] [1] -- Read T55xx block data. Optional [p password], [override], [page1]`
+|`lf t55xx dangerraw     `|N       |`Sends raw bitstream. Dangerous, do not use!!`
+|`lf t55xx detect        `|Y       |`Try detecting the tag modulation from reading the configuration block`
+|`lf t55xx deviceconfig  `|N       |`Set/Get T55XX device configuration`
+|`lf t55xx dump          `|N       |`Dump T55xx card Page 0 block 0-7`
+|`lf t55xx info          `|Y       |`Show T55x7 configuration data (page 0/ blk 0)`
+|`lf t55xx p1detect      `|N       |`Try detecting if this is a t55xx tag by reading page 1`
+|`lf t55xx read          `|N       |`Read T55xx block data`
 |`lf t55xx resetread     `|N       |`Send Reset Cmd then lf read the stream to attempt to identify the start of it (needs a demod and/or plot after)`
-|`lf t55xx restore       `|N       |`f <filename> [p <password>] Restore T55xx card Page 0 / Page 1 blocks`
-|`lf t55xx trace         `|Y       |`[1] Show T55x7 traceability data (page 1/ blk 0-1)`
+|`lf t55xx restore       `|N       |`Restore T55xx card Page 0 / Page 1 blocks`
+|`lf t55xx trace         `|Y       |`Show T55x7 traceability data (page 1/ blk 0-1)`
 |`lf t55xx wakeup        `|N       |`Send AOR wakeup command`
-|`lf t55xx write         `|N       |`b <block> d <data> p [password] [1] -- Write T55xx block data. Optional [p password], [page1]`
-|`lf t55xx bruteforce    `|N       |`<start password> <end password> Simple bruteforce attack to find password`
+|`lf t55xx write         `|N       |`Write T55xx block data`
+|`lf t55xx bruteforce    `|N       |`Simple bruteforce attack to find password`
 |`lf t55xx chk           `|N       |`Check passwords from dictionary/flash`
 |`lf t55xx protect       `|N       |`Password protect tag`
-|`lf t55xx recoverpw     `|N       |`[password] Try to recover from bad password write from a cloner. Only use on PW protected chips!`
+|`lf t55xx recoverpw     `|N       |`Try to recover from bad password write from a cloner`
 |`lf t55xx sniff         `|Y       |`Attempt to recover T55xx commands from sample buffer`
 |`lf t55xx special       `|N       |`Show block changes with 64 different offsets`
-|`lf t55xx wipe          `|N       |`[q] Wipe a T55xx tag and set defaults (will destroy any data on tag)`
+|`lf t55xx wipe          `|N       |`Wipe a T55xx tag and set defaults (will destroy any data on tag)`
 
 
 ### lf viking
diff --git a/tools/hitag2crack/crack5opencl/ht2crack5opencl.c b/tools/hitag2crack/crack5opencl/ht2crack5opencl.c
index 87fb2c765..924932b2c 100644
--- a/tools/hitag2crack/crack5opencl/ht2crack5opencl.c
+++ b/tools/hitag2crack/crack5opencl/ht2crack5opencl.c
@@ -454,12 +454,11 @@ int main(int argc, char **argv) {
     if (show) verbose = true;
 
     // now discover and set up compute device(s)
-    if ((err = discoverDevices(profile_selected, device_types_selected, &ocl_platform_cnt, &selected_platforms_cnt, &selected_devices_cnt, &cd_ctx, plat_sel, plat_cnt, dev_sel, dev_cnt, verbose, show)) != 0)
-    {
-      printf ("Error: discoverDevices() failed\n");
-      if (err < -5) free (cd_ctx);
-      MEMORY_FREE_ALL
-      exit (2);
+    if ((err = discoverDevices(profile_selected, device_types_selected, &ocl_platform_cnt, &selected_platforms_cnt, &selected_devices_cnt, &cd_ctx, plat_sel, plat_cnt, dev_sel, dev_cnt, verbose, show)) != 0) {
+        printf("Error: discoverDevices() failed\n");
+        if (err < -5) free(cd_ctx);
+        MEMORY_FREE_ALL
+        exit(2);
     }
 
     if (verbose) printf("\n");
@@ -776,7 +775,7 @@ int main(int argc, char **argv) {
                 err = clGetProgramBuildInfo(ctx.programs[z], cd_ctx[w].device[q].device_id, CL_PROGRAM_BUILD_LOG, len, buffer, 0);
                 if (err != CL_SUCCESS) {
                     printf("[%zu] clGetProgramBuildInfo() failed (%d)\n", z, err);
-                    free (buffer);
+                    free(buffer);
                     continue;
                 }
 
@@ -787,7 +786,7 @@ int main(int argc, char **argv) {
                     printf("[%zu] Build log (len %zu):\n--------\n%s\n--------\n", z, len, buffer);
                 }
 
-                free (buffer);
+                free(buffer);
 
                 build_logs++;
 #if DEBUGME == 0
@@ -832,7 +831,7 @@ int main(int argc, char **argv) {
     }
 
     // setup, phase 2 (select lower profile)
-    unsigned int profile = get_smallest_profile (cd_ctx, ocl_platform_cnt);
+    unsigned int profile = get_smallest_profile(cd_ctx, ocl_platform_cnt);
 
     // setup, phase 3 (finis him)
 
@@ -1126,7 +1125,7 @@ int main(int argc, char **argv) {
     }
 
     // Hokuto Hyakuretsu Ken
-    ret = thread_start_scheduler (&th_ctx, t_arg, &ctx.queue_ctx);
+    ret = thread_start_scheduler(&th_ctx, t_arg, &ctx.queue_ctx);
     if (ret < 0) {
         printf("Error: thread_start_scheduler() failed (%d): %s\n", ret, thread_strerror(ret));
         error = true;
diff --git a/tools/hitag2crack/crack5opencl/opencl.c b/tools/hitag2crack/crack5opencl/opencl.c
index ecee691b7..98b85714e 100644
--- a/tools/hitag2crack/crack5opencl/opencl.c
+++ b/tools/hitag2crack/crack5opencl/opencl.c
@@ -40,8 +40,7 @@ bool plat_dev_enabled(unsigned int id, unsigned int *sel, unsigned int cnt, unsi
     return false;
 }
 
-unsigned int get_smallest_profile (compute_platform_ctx_t *cd_ctx, size_t ocl_platform_cnt)
-{
+unsigned int get_smallest_profile(compute_platform_ctx_t *cd_ctx, size_t ocl_platform_cnt) {
     unsigned int profile = 0xff;
 
     size_t x = 0, y = 0;
@@ -68,8 +67,7 @@ unsigned int get_smallest_profile (compute_platform_ctx_t *cd_ctx, size_t ocl_pl
     return profile;
 }
 
-int discoverDevices(unsigned int profile_selected, uint32_t device_types_selected, cl_uint *platform_detected_cnt, size_t *selected_platforms_cnt, size_t *selected_devices_cnt, compute_platform_ctx_t **cd_ctx, unsigned int *plat_sel, unsigned int plat_cnt, unsigned int *dev_sel, unsigned int dev_cnt, bool verbose, bool show)
-{
+int discoverDevices(unsigned int profile_selected, uint32_t device_types_selected, cl_uint *platform_detected_cnt, size_t *selected_platforms_cnt, size_t *selected_devices_cnt, compute_platform_ctx_t **cd_ctx, unsigned int *plat_sel, unsigned int plat_cnt, unsigned int *dev_sel, unsigned int dev_cnt, bool verbose, bool show) {
     int err = 0;
     unsigned int ocl_platform_max = MAX_OPENCL_DEVICES; // 16
     cl_uint ocl_platform_cnt;
@@ -84,13 +82,13 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
     err = clGetPlatformIDs(ocl_platform_max, ocl_platforms, &ocl_platform_cnt);
     if (err != CL_SUCCESS) {
         printf("Error: clGetPlatformIDs() failed (%d)\n", err);
-        free (ocl_platforms);
+        free(ocl_platforms);
         return -3;
     }
 
     if (ocl_platform_cnt == 0) {
         printf("No platforms found, exit\n");
-        free (ocl_platforms);
+        free(ocl_platforms);
         return -4;
     }
 
@@ -98,7 +96,7 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
     *cd_ctx = (compute_platform_ctx_t *) calloc(ocl_platform_cnt, sizeof(compute_platform_ctx_t));
     if (*cd_ctx == NULL) {
         printf("Error: calloc (compute_platform_ctx_t) failed (%d): %s\n", errno, strerror(errno));
-        free (ocl_platforms);
+        free(ocl_platforms);
         return -5;
     }
 
@@ -120,7 +118,7 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
         (*cd_ctx)[platform_idx].platform_id = ocl_platforms[platform_idx];
         (*cd_ctx)[platform_idx].selected = plat_dev_enabled(platform_idx, plat_sel, plat_cnt, 0, 0);
 
-        if ((*cd_ctx)[platform_idx].selected) (*selected_platforms_cnt)++;
+        if ((*cd_ctx)[platform_idx].selected)(*selected_platforms_cnt)++;
 
         if (verbose) printf("\n-- Platform ID: %d\n", platform_idx + 1);
 
@@ -130,33 +128,33 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
             err = clGetPlatformInfo((*cd_ctx)[platform_idx].platform_id, ocl_info, 0, NULL, &tmp_len);
             if (err != CL_SUCCESS) {
                 printf("Error: clGetPlatformInfo(param size) failed (%d)\n", err);
-                free (*cd_ctx);
-                free (ocl_platforms);
+                free(*cd_ctx);
+                free(ocl_platforms);
                 return -6;
             }
 
             if (tmp_len > 0) {
                 if (!(tmp_buf = (char *) calloc(tmp_len, sizeof(char)))) {
                     printf("Error: calloc (ocl_info %u) failed (%d): %s\n", info_idx, errno, strerror(errno));
-                    free (*cd_ctx);
-                    free (ocl_platforms);
+                    free(*cd_ctx);
+                    free(ocl_platforms);
                     return -7;
                 }
 
                 err = clGetPlatformInfo((*cd_ctx)[platform_idx].platform_id, ocl_info, tmp_len, tmp_buf, 0);
                 if (err != CL_SUCCESS) {
                     printf("Error: clGetPlatformInfo(param) failed (%d)\n", err);
-                    free (tmp_buf);
-                    free (*cd_ctx);
-                    free (ocl_platforms);
+                    free(tmp_buf);
+                    free(*cd_ctx);
+                    free(ocl_platforms);
                     return -8;
                 }
             } else {
                 tmp_len = 4;
                 if (!(tmp_buf = (char *) calloc(tmp_len, sizeof(char)))) {
                     printf("Error: calloc (ocl_info %u) failed (%d): %s\n", info_idx, errno, strerror(errno));
-                    free (*cd_ctx);
-                    free (ocl_platforms);
+                    free(*cd_ctx);
+                    free(ocl_platforms);
                     return -7;
                 }
 
@@ -182,13 +180,13 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
             }
 
             if (info_idx == 1) {
-                if (!strncmp(tmp_buf, "NVIDIA", 6)) (*cd_ctx)[platform_idx].is_nv = true;
+                if (!strncmp(tmp_buf, "NVIDIA", 6))(*cd_ctx)[platform_idx].is_nv = true;
                 else if (!strncmp(tmp_buf, "Apple", 5)) { (*cd_ctx)[platform_idx].is_apple = true; (*cd_ctx)[platform_idx].warning = true; }
-                else if (!strncmp(tmp_buf, "Intel", 5)) (*cd_ctx)[platform_idx].is_intel = true;
-                else if (!strncmp(tmp_buf, "The pocl project", 16)) (*cd_ctx)[platform_idx].is_pocl = true;
+                else if (!strncmp(tmp_buf, "Intel", 5))(*cd_ctx)[platform_idx].is_intel = true;
+                else if (!strncmp(tmp_buf, "The pocl project", 16))(*cd_ctx)[platform_idx].is_pocl = true;
             }
 
-            free (tmp_buf);
+            free(tmp_buf);
         }
 
         if (!show && verbose) {
@@ -203,8 +201,8 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
         cl_device_id *ocl_devices = (cl_device_id *) calloc(ocl_device_max, sizeof(cl_device_id));
         if (!ocl_devices) {
             printf("Error: calloc (ocl_devices) failed (%d): %s\n", errno, strerror(errno));
-            free (*cd_ctx);
-            free (ocl_platforms);
+            free(*cd_ctx);
+            free(ocl_platforms);
             return -7;
         }
 
@@ -217,9 +215,9 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
 
         if (err != CL_SUCCESS) {
             printf("Error: clGetDeviceIDs(cnt) failed (%d)\n", err);
-            free (ocl_devices);
-            free (*cd_ctx);
-            free (ocl_platforms);
+            free(ocl_devices);
+            free(*cd_ctx);
+            free(ocl_platforms);
             return -9;
         }
 
@@ -243,13 +241,13 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
                     err = clGetDeviceInfo(ocl_device, ocl_dev_info, sizeof(cl_device_type), &device_type, 0);
                     if (err != CL_SUCCESS) {
                         printf("Error: clGetDeviceInfo(device_type) failed (%d)\n", err);
-                        free (ocl_devices);
-                        free (*cd_ctx);
-                        free (ocl_platforms);
+                        free(ocl_devices);
+                        free(*cd_ctx);
+                        free(ocl_platforms);
                         return -10;
                     }
 
-                    if (device_type & CL_DEVICE_TYPE_GPU) (*cd_ctx)[platform_idx].device[device_idx].is_gpu = 1;
+                    if (device_type & CL_DEVICE_TYPE_GPU)(*cd_ctx)[platform_idx].device[device_idx].is_gpu = 1;
                     else if ((device_type & CL_DEVICE_TYPE_CPU) && (*cd_ctx)[platform_idx].is_pocl) {
                         (*cd_ctx)[platform_idx].device[device_idx].profile = (profile_selected > 1) ? 0 : profile_selected;
                     }
@@ -258,7 +256,7 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
 
                     (*cd_ctx)[platform_idx].device[device_idx].selected = plat_dev_enabled(global_device_id, dev_sel, dev_cnt, (unsigned int) device_type, device_types_selected);
                     global_device_id++;
-                    if ((*cd_ctx)[platform_idx].device[device_idx].selected) (*selected_devices_cnt)++;
+                    if ((*cd_ctx)[platform_idx].device[device_idx].selected)(*selected_devices_cnt)++;
                     continue;
                 } else if (info_idx == 5) {
                     cl_device_local_mem_type local_mem_type;
@@ -266,9 +264,9 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
                     err = clGetDeviceInfo(ocl_device, ocl_dev_info, sizeof(cl_device_local_mem_type), &local_mem_type, 0);
                     if (err != CL_SUCCESS) {
                         printf("Error: clGetDeviceInfo(local_mem_type) failed (%d)\n", err);
-                        free (ocl_devices);
-                        free (*cd_ctx);
-                        free (ocl_platforms);
+                        free(ocl_devices);
+                        free(*cd_ctx);
+                        free(ocl_platforms);
                         return -10;
                     }
 
@@ -279,9 +277,9 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
                                 (*cd_ctx)[platform_idx].device[device_idx].have_local_memory = true;
 
                                 if ((*cd_ctx)[platform_idx].device[device_idx].is_gpu) {
-                                    if (profile_selected > 2) (*cd_ctx)[platform_idx].device[device_idx].profile = PROFILE_DEFAULT; // Apple-Intel GPU's
+                                    if (profile_selected > 2)(*cd_ctx)[platform_idx].device[device_idx].profile = PROFILE_DEFAULT;  // Apple-Intel GPU's
                                 } else {
-                                    if (profile_selected > 3) (*cd_ctx)[platform_idx].device[device_idx].profile = PROFILE_DEFAULT; // Apple-Intel CPU's
+                                    if (profile_selected > 3)(*cd_ctx)[platform_idx].device[device_idx].profile = PROFILE_DEFAULT;  // Apple-Intel CPU's
                                 }
                             }
                         } else if ((*cd_ctx)[platform_idx].is_nv) {
@@ -299,9 +297,9 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
                     err = clGetDeviceInfo(ocl_device, ocl_dev_info, sizeof(size_t) * 3, wis, 0);
                     if (err != CL_SUCCESS) {
                         printf("Error: clGetDeviceInfo(work_items_size) failed (%d)\n", err);
-                        free (ocl_devices);
-                        free (*cd_ctx);
-                        free (ocl_platforms);
+                        free(ocl_devices);
+                        free(*cd_ctx);
+                        free(ocl_platforms);
                         return -10;
                     }
 
@@ -318,9 +316,9 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
                     err = clGetDeviceInfo(ocl_device, ocl_dev_info, sizeof(cl_uint), &cores, 0);
                     if (err != CL_SUCCESS) {
                         printf("Error: clGetDeviceInfo(compute_units) failed (%d)\n", err);
-                        free (ocl_devices);
-                        free (*cd_ctx);
-                        free (ocl_platforms);
+                        free(ocl_devices);
+                        free(*cd_ctx);
+                        free(ocl_platforms);
                         return -10;
                     }
 
@@ -336,37 +334,37 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
                 err = clGetDeviceInfo(ocl_device, ocl_dev_info, 0, NULL, &tmp_len);
                 if (err != CL_SUCCESS) {
                     printf("Error: clGetDeviceInfo(param size) failed (%d)\n", err);
-                    free (ocl_devices);
-                    free (*cd_ctx);
-                    free (ocl_platforms);
+                    free(ocl_devices);
+                    free(*cd_ctx);
+                    free(ocl_platforms);
                     return -10;
                 }
 
                 if (tmp_len > 0) {
                     if (!(tmp_buf = (char *) calloc(tmp_len, sizeof(char)))) {
                         printf("Error: calloc (ocl_dev_info %u) failed (%d): %s\n", info_idx, errno, strerror(errno));
-                        free (ocl_devices);
-                        free (*cd_ctx);
-                        free (ocl_platforms);
+                        free(ocl_devices);
+                        free(*cd_ctx);
+                        free(ocl_platforms);
                         return -7;
                     }
 
                     err = clGetDeviceInfo(ocl_device, ocl_dev_info, tmp_len, tmp_buf, 0);
                     if (err != CL_SUCCESS) {
                         printf("Error: clGetDeviceInfo(param) failed (%d)\n", err);
-                        free (tmp_buf);
-                        free (ocl_devices);
-                        free (*cd_ctx);
-                        free (ocl_platforms);
+                        free(tmp_buf);
+                        free(ocl_devices);
+                        free(*cd_ctx);
+                        free(ocl_platforms);
                         return -10;
                     }
                 } else {
                     tmp_len = 4;
                     if (!(tmp_buf = (char *) calloc(tmp_len, sizeof(char)))) {
                         printf("Error: calloc (ocl_dev_info %u) failed (%d): %s\n", info_idx, errno, strerror(errno));
-                        free (ocl_devices);
-                        free (*cd_ctx);
-                        free (ocl_platforms);
+                        free(ocl_devices);
+                        free(*cd_ctx);
+                        free(ocl_platforms);
                         return -7;
                     }
 
@@ -395,10 +393,10 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
                 }
 
                 if (info_idx == 1) {
-                   // force profile to 0-1 with Jetson Nano
-                   if (strstr(tmp_buf, "Tegra") && (*cd_ctx)[platform_idx].is_pocl) {
-                       (*cd_ctx)[platform_idx].device[device_idx].profile = (profile_selected > 1) ? 0 : profile_selected;
-                   }
+                    // force profile to 0-1 with Jetson Nano
+                    if (strstr(tmp_buf, "Tegra") && (*cd_ctx)[platform_idx].is_pocl) {
+                        (*cd_ctx)[platform_idx].device[device_idx].profile = (profile_selected > 1) ? 0 : profile_selected;
+                    }
                 } else if (info_idx == 4) {
                     if (!strncmp(tmp_buf, "Intel", 5)) {
                         if ((*cd_ctx)[platform_idx].is_apple) {
@@ -410,7 +408,7 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
                             if ((*cd_ctx)[platform_idx].device[device_idx].is_gpu) {
                                 (*cd_ctx)[platform_idx].device[device_idx].profile = 0; // Intel GPU's, work better with a very slow profile
                             } else {
-                                 (*cd_ctx)[platform_idx].device[device_idx].profile = (profile_selected > 2) ? PROFILE_DEFAULT : profile_selected; // Intel CPU's
+                                (*cd_ctx)[platform_idx].device[device_idx].profile = (profile_selected > 2) ? PROFILE_DEFAULT : profile_selected; // Intel CPU's
                             }
                         }
                     }
@@ -423,10 +421,10 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
 
                         if (err != CL_SUCCESS) {
                             printf("Error: clGetDeviceInfo(sm_maj/sm_min) failed (%d)\n", err);
-                            free (tmp_buf);
-                            free (ocl_devices);
-                            free (*cd_ctx);
-                            free (ocl_platforms);
+                            free(tmp_buf);
+                            free(ocl_devices);
+                            free(*cd_ctx);
+                            free(ocl_platforms);
                             return -10;
                         }
 
@@ -456,7 +454,7 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
                     }
                 }
 
-                free (tmp_buf);
+                free(tmp_buf);
             }
 
             if (!show && verbose) printf("%14s: %s\n", "Selected", ((*cd_ctx)[platform_idx].device[device_idx].selected) ? "yes" : "no");
@@ -472,16 +470,16 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
 
             (*cd_ctx)[platform_idx].device[device_idx].device_id = ocl_device;
         }
-        free (ocl_devices);
+        free(ocl_devices);
         ocl_devices = NULL;
     }
 
-    free (ocl_platforms);
+    free(ocl_platforms);
     ocl_platforms = NULL;
 
     *platform_detected_cnt = ocl_platform_cnt;
 
-    if (show) free (*cd_ctx);
+    if (show) free(*cd_ctx);
 
     return 0;
 }
diff --git a/tools/hitag2crack/crack5opencl/opencl.h b/tools/hitag2crack/crack5opencl/opencl.h
index 462dbbb4f..76e9857bc 100644
--- a/tools/hitag2crack/crack5opencl/opencl.h
+++ b/tools/hitag2crack/crack5opencl/opencl.h
@@ -122,7 +122,7 @@ typedef struct opencl_ctx {
 } opencl_ctx_t;
 
 bool plat_dev_enabled(unsigned int id, unsigned int *sel, unsigned int cnt, unsigned int cur_type, unsigned int allow_type);
-unsigned int get_smallest_profile (compute_platform_ctx_t *cd_ctx, size_t ocl_platform_cnt);
+unsigned int get_smallest_profile(compute_platform_ctx_t *cd_ctx, size_t ocl_platform_cnt);
 int discoverDevices(unsigned int profile_selected, uint32_t device_types_selected, cl_uint *ocl_platform_cnt, size_t *selected_platforms_cnt, size_t *selected_devices_cnt, compute_platform_ctx_t **cd_ctx, unsigned int *plat_sel, unsigned int plat_cnt, unsigned int *dev_sel, unsigned int dev_cnt, bool verbose, bool show);
 int runKernel(opencl_ctx_t *ctx, uint32_t cand_base, uint64_t *matches, uint32_t *matches_found, size_t id);
 
diff --git a/tools/hitag2crack/crack5opencl/threads.c b/tools/hitag2crack/crack5opencl/threads.c
index ff79a4c74..963425cff 100644
--- a/tools/hitag2crack/crack5opencl/threads.c
+++ b/tools/hitag2crack/crack5opencl/threads.c
@@ -176,8 +176,7 @@ int thread_init(thread_ctx_t *ctx, short type, size_t thread_count) {
     return 0;
 }
 
-int thread_start_scheduler (thread_ctx_t *ctx, thread_args_t *t_arg, wu_queue_ctx_t *queue_ctx)
-{
+int thread_start_scheduler(thread_ctx_t *ctx, thread_args_t *t_arg, wu_queue_ctx_t *queue_ctx) {
     size_t z = 0;
     bool found = false;
     bool done = false;
@@ -775,7 +774,7 @@ void *computing_process_async(void *arg) {
                             pthread_cond_signal(&a->thread_ctx->thread_cond_usleep);  // unlock master/TH_PROCESSING cond
 #if TDEBUG >= 1
                             printf("[%s][%zu] after pthread_cond_signal TH_END\n", __func__, z);
-                            fflush (stdout);
+                            fflush(stdout);
 #endif
                             pthread_mutex_unlock(&a->thread_ctx->thread_mutex_usleep);
                         }

From 078a28550f458972401a7dd10f9f350687ec84e8 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 25 Jan 2021 14:28:47 +0100
Subject: [PATCH 397/682] hf mf hardnested - these are called with u16 in the
 source

---
 client/deps/hardnested/hardnested_bruteforce.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/deps/hardnested/hardnested_bruteforce.h b/client/deps/hardnested/hardnested_bruteforce.h
index 8766362d7..a8e6786d5 100644
--- a/client/deps/hardnested/hardnested_bruteforce.h
+++ b/client/deps/hardnested/hardnested_bruteforce.h
@@ -25,7 +25,7 @@
 typedef struct guess_sum_a8 {
     float prob;
     uint64_t num_states;
-    uint8_t sum_a8_idx;
+    uint16_t sum_a8_idx;
 } guess_sum_a8_t;
 
 typedef struct noncelistentry {
@@ -40,7 +40,7 @@ typedef struct noncelist {
     guess_sum_a8_t sum_a8_guess[NUM_SUMS];
     bool sum_a8_guess_dirty;
     float expected_num_brute_force;
-    uint8_t BitFlips[0x400];
+    uint16_t BitFlips[0x400];
     uint32_t *states_bitarray[2];
     uint32_t num_states_bitarray[2];
     bool all_bitflips_dirty[2];

From ba8cd6894265bf2095a604d86df0278fb37fff11 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 25 Jan 2021 14:31:17 +0100
Subject: [PATCH 398/682] hf mf hardnested - NUM_SUMS is 19, making loop
 iterator smaller

---
 client/src/cmdhfmfhard.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/client/src/cmdhfmfhard.c b/client/src/cmdhfmfhard.c
index d75e6b0a3..9061868eb 100644
--- a/client/src/cmdhfmfhard.c
+++ b/client/src/cmdhfmfhard.c
@@ -575,7 +575,7 @@ static void init_nonce_memory(void) {
         nonces[i].num = 0;
         nonces[i].Sum = 0;
         nonces[i].first = NULL;
-        for (uint16_t j = 0; j < NUM_SUMS; j++) {
+        for (uint8_t j = 0; j < NUM_SUMS; j++) {
             nonces[i].sum_a8_guess[j].sum_a8_idx = j;
             nonces[i].sum_a8_guess[j].prob = 0.0;
         }
@@ -679,7 +679,7 @@ static float sum_probability(uint16_t i_K, uint16_t n, uint16_t k) {
     double p_T_is_k_when_S_is_K = p_hypergeometric(i_K, n, k);
     double p_S_is_K = p_K[i_K];
     double p_T_is_k = 0;
-    for (uint16_t i = 0; i < NUM_SUMS; i++) {
+    for (uint8_t i = 0; i < NUM_SUMS; i++) {
         p_T_is_k += p_K[i] * p_hypergeometric(i, n, k);
     }
     return (p_T_is_k_when_S_is_K * p_S_is_K / p_T_is_k);
@@ -1044,7 +1044,7 @@ static void estimate_sum_a8(void) {
     if (first_byte_num == 256) {
         for (uint16_t i = 0; i < 256; i++) {
             if (nonces[i].sum_a8_guess_dirty) {
-                for (uint16_t j = 0; j < NUM_SUMS; j++) {
+                for (uint8_t j = 0; j < NUM_SUMS; j++) {
                     uint16_t sum_a8_idx = nonces[i].sum_a8_guess[j].sum_a8_idx;
                     nonces[i].sum_a8_guess[j].prob = sum_probability(sum_a8_idx, nonces[i].num, nonces[i].Sum);
                 }
@@ -1102,7 +1102,7 @@ static int read_nonce_file(char *filename) {
     sprintf(progress_string, "Target Block=%d, Keytype=%c", trgBlockNo, trgKeyType == 0 ? 'A' : 'B');
     hardnested_print_progress(num_acquired_nonces, progress_string, (float)(1LL << 47), 0);
 
-    for (uint16_t i = 0; i < NUM_SUMS; i++) {
+    for (uint8_t i = 0; i < NUM_SUMS; i++) {
         if (first_byte_Sum == sums[i]) {
             first_byte_Sum = i;
             break;
@@ -1152,14 +1152,20 @@ __attribute__((force_align_arg_pointer))
                 return NULL;
             }
             for (uint16_t i = first_byte; i <= last_byte; i++) {
+
                 if (nonces[i].BitFlips[bitflip] == 0 && nonces[i].BitFlips[bitflip ^ 0x100] == 0
                         && nonces[i].first != NULL && nonces[i ^ (bitflip & 0xff)].first != NULL) {
+
                     uint8_t parity1 = (nonces[i].first->par_enc) >> 3;                  // parity of first byte
                     uint8_t parity2 = (nonces[i ^ (bitflip & 0xff)].first->par_enc) >> 3; // parity of nonce with bits flipped
+
                     if ((parity1 == parity2 && !(bitflip & 0x100))          // bitflip
                             || (parity1 != parity2 && (bitflip & 0x100))) {     // not bitflip
+
                         nonces[i].BitFlips[bitflip] = 1;
+
                         for (odd_even_t odd_even = EVEN_STATE; odd_even <= ODD_STATE; odd_even++) {
+
                             if (bitflip_bitarrays[odd_even][bitflip] != NULL) {
                                 uint32_t old_count = nonces[i].num_states_bitarray[odd_even];
                                 nonces[i].num_states_bitarray[odd_even] = count_bitarray_AND(nonces[i].states_bitarray[odd_even], bitflip_bitarrays[odd_even][bitflip]);
@@ -1344,7 +1350,7 @@ static void simulate_acquire_nonces(void) {
 
         if (first_byte_num == 256) {
             if (hardnested_stage == CHECK_1ST_BYTES) {
-                for (uint16_t i = 0; i < NUM_SUMS; i++) {
+                for (uint8_t i = 0; i < NUM_SUMS; i++) {
                     if (first_byte_Sum == sums[i]) {
                         first_byte_Sum = i;
                         break;
@@ -1471,7 +1477,7 @@ static int acquire_nonces(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_
 
             if (first_byte_num == 256) {
                 if (hardnested_stage == CHECK_1ST_BYTES) {
-                    for (uint16_t i = 0; i < NUM_SUMS; i++) {
+                    for (uint8_t i = 0; i < NUM_SUMS; i++) {
                         if (first_byte_Sum == sums[i]) {
                             first_byte_Sum = i;
                             break;

From 134ddf631382e9ed1062801efc4aa40c8ad63a25 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Mon, 25 Jan 2021 17:31:25 +0100
Subject: [PATCH 399/682] hardnested offline: avoid reaching out for pm3

---
 client/src/cmdhfmf.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index e9b87add6..9e0b2ba3e 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -576,6 +576,9 @@ static int GetHFMF14AUID(uint8_t *uid, int *uidlen) {
 }
 
 static char *GenerateFilename(const char *prefix, const char *suffix) {
+    if (! IfPm3Iso14443a()) {
+        return NULL;
+    }
     uint8_t uid[10] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
     int uidlen = 0;
     char *fptr = calloc(sizeof(char) * (strlen(prefix) + strlen(suffix)) + sizeof(uid) * 2 + 1,  sizeof(uint8_t));
@@ -1972,8 +1975,9 @@ static int CmdHF14AMfNestedHard(const char *Cmd) {
     uint64_t foundkey = 0;
     int16_t isOK = mfnestedhard(blockNo, keyType, key, trgBlockNo, trgKeyType, know_target_key ? trgkey : NULL, nonce_file_read, nonce_file_write, slow, tests, &foundkey, filename);
 
-    if (tests == 0)
+    if ((tests == 0) && IfPm3Iso14443a()) {
         DropField();
+    }
 
     if (isOK) {
         switch (isOK) {

From 2305411a1d600be5a0fbcb1dd296f5e3fe00d6be Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 25 Jan 2021 19:38:47 +0100
Subject: [PATCH 400/682] hf mf hardnested - added missing init

---
 client/deps/hardnested/hardnested_bf_core.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/client/deps/hardnested/hardnested_bf_core.c b/client/deps/hardnested/hardnested_bf_core.c
index 719578331..feb08997b 100644
--- a/client/deps/hardnested/hardnested_bf_core.c
+++ b/client/deps/hardnested/hardnested_bf_core.c
@@ -143,7 +143,7 @@ bitslice_test_nonces_t bitslice_test_nonces_NOSIMD;
 bitslice_test_nonces_t bitslice_test_nonces_dispatch;
 
 #if defined (_WIN32)
-#define malloc_bitslice(x) __builtin_assume_aligned(_aligned_malloc((x), MAX_BITSLICES/8), MAX_BITSLICES/8)
+#define malloc_bitslice(x) __builtin_assume_aligned(_aligned_malloc((x), MAX_BITSLICES / 8), MAX_BITSLICES / 8)
 #define free_bitslice(x) _aligned_free(x)
 #elif defined (__APPLE__)
 static void *malloc_bitslice(size_t x) {
@@ -156,7 +156,7 @@ static void *malloc_bitslice(size_t x) {
 }
 #define free_bitslice(x) free(x)
 #else
-#define malloc_bitslice(x) memalign(MAX_BITSLICES/8, (x))
+#define malloc_bitslice(x) memalign(MAX_BITSLICES / 8, (x))
 #define free_bitslice(x) free(x)
 #endif
 
@@ -559,6 +559,7 @@ void SetSIMDInstr(SIMDExecInstr instr) {
 static SIMDExecInstr GetSIMDInstr(void) {
     SIMDExecInstr instr;
 
+    __builtin_cpu_init();
 #if defined(COMPILER_HAS_SIMD_AVX512)
     if (__builtin_cpu_supports("avx512f"))
         instr = SIMD_AVX512;
@@ -575,7 +576,7 @@ static SIMDExecInstr GetSIMDInstr(void) {
             instr = SIMD_MMX;
         else
 #endif
-            instr = SIMD_NONE;
+        instr = SIMD_NONE;
 
     return instr;
 }

From 77d51cae384172e2a81526108f23ce62f6e71d8e Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 25 Jan 2021 20:55:28 +0100
Subject: [PATCH 401/682] hf mf hardnested - just making sure its cleared

---
 client/src/cmdhfmfhard.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/client/src/cmdhfmfhard.c b/client/src/cmdhfmfhard.c
index 9061868eb..052353d5a 100644
--- a/client/src/cmdhfmfhard.c
+++ b/client/src/cmdhfmfhard.c
@@ -2079,6 +2079,8 @@ static void free_candidates_memory(statelist_t *sl) {
         return;
 
     free_candidates_memory(sl->next);
+    sl->len[0] = 0;
+    sl->len[1] = 0;
     free(sl);
 }
 

From c571b1e0ad35e55e4c6cb7b76064addaba509027 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 25 Jan 2021 20:59:32 +0100
Subject: [PATCH 402/682] hf mf hardnested - clear these too

---
 client/deps/hardnested/hardnested_bruteforce.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/client/deps/hardnested/hardnested_bruteforce.c b/client/deps/hardnested/hardnested_bruteforce.c
index 0c768f400..a589040ac 100644
--- a/client/deps/hardnested/hardnested_bruteforce.c
+++ b/client/deps/hardnested/hardnested_bruteforce.c
@@ -465,7 +465,8 @@ float brute_force_benchmark(void) {
 
     free(test_candidates[0].states[ODD_STATE]);
     free(test_candidates[0].states[EVEN_STATE]);
-
+    test_candidates[0].len[ODD_STATE] = 0;
+    test_candidates[0].len[EVEN_STATE] = 0;
     return bf_rate;
 }
 

From 20fccb16aa487ef4db91965091bafd5df51c193e Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 25 Jan 2021 22:12:17 +0100
Subject: [PATCH 403/682] hf mf hardnested - changed to calloc,  and some text

---
 client/src/cmdhfmfhard.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhfmfhard.c b/client/src/cmdhfmfhard.c
index 052353d5a..84b9aaf43 100644
--- a/client/src/cmdhfmfhard.c
+++ b/client/src/cmdhfmfhard.c
@@ -1668,7 +1668,7 @@ static inline bool bitflips_match(uint8_t byte, uint32_t state, odd_even_t odd_e
     if (!possible) {
 #ifdef DEBUG_KEY_ELIMINATION
         if (!quiet && known_target_key != -1 && state == test_state[odd_even]) {
-            PrintAndLogEx(NORMAL, "Initial state lists: %s test state eliminated by bitflip property.\n", odd_even == EVEN_STATE ? "even" : "odd");
+            PrintAndLogEx(INFO, "Initial state lists: %s test state eliminated by bitflip property.", odd_even == EVEN_STATE ? "even" : "odd");
             sprintf(failstr, "Initial %s Byte Bitflip property", odd_even == EVEN_STATE ? "even" : "odd");
         }
 #endif
@@ -1791,14 +1791,14 @@ static void add_matching_states(statelist_t *cands, uint8_t part_sum_a0, uint8_t
 static statelist_t *add_more_candidates(void) {
     statelist_t *new_candidates;
     if (candidates == NULL) {
-        candidates = (statelist_t *)malloc(sizeof(statelist_t));
+        candidates = (statelist_t *)calloc(sizeof(statelist_t), sizeof(uint8_t));
         new_candidates = candidates;
     } else {
         new_candidates = candidates;
         while (new_candidates->next != NULL) {
             new_candidates = new_candidates->next;
         }
-        new_candidates = new_candidates->next = (statelist_t *)malloc(sizeof(statelist_t));
+        new_candidates = new_candidates->next = (statelist_t *)calloc(sizeof(statelist_t), sizeof(uint8_t));
     }
     new_candidates->next = NULL;
     new_candidates->len[ODD_STATE] = 0;
@@ -1813,14 +1813,15 @@ static void add_bitflip_candidates(uint8_t byte) {
 
     for (odd_even_t odd_even = EVEN_STATE; odd_even <= ODD_STATE; odd_even++) {
         uint32_t worstcase_size = nonces[byte].num_states_bitarray[odd_even] + 1;
-        candidates1->states[odd_even] = (uint32_t *)malloc(sizeof(uint32_t) * worstcase_size);
+        candidates1->states[odd_even] = (uint32_t *)calloc(worstcase_size, sizeof(uint32_t));
         if (candidates1->states[odd_even] == NULL) {
-            PrintAndLogEx(ERR, "Out of memory error in add_bitflip_candidates().\n");
+            PrintAndLogEx(ERR, "Out of memory error in add_bitflip_candidates()");
             exit(4);
         }
 
         bitarray_to_list(byte, nonces[byte].states_bitarray[odd_even], candidates1->states[odd_even], &(candidates1->len[odd_even]), odd_even);
 
+        // slim down the allocated memory.
         if (candidates1->len[odd_even] + 1 < worstcase_size) {
             candidates1->states[odd_even] = realloc(candidates1->states[odd_even], sizeof(uint32_t) * (candidates1->len[odd_even] + 1));
         }

From 658a62f76157ee02d0ae0182d0fef0c5205e06ef Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Mon, 25 Jan 2021 23:48:15 +0100
Subject: [PATCH 404/682] hardnested: add missing init, fixing some segfault

---
 client/src/cmdhfmfhard.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/client/src/cmdhfmfhard.c b/client/src/cmdhfmfhard.c
index 84b9aaf43..6d685ce96 100644
--- a/client/src/cmdhfmfhard.c
+++ b/client/src/cmdhfmfhard.c
@@ -2179,6 +2179,9 @@ int mfnestedhard(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBloc
     get_SIMD_instruction_set(instr_set);
     PrintAndLogEx(SUCCESS, "Using %s SIMD core.", instr_set);
 
+    // initialize static arrays
+    memset(part_sum_count, 0, sizeof(part_sum_count));
+
     srand((unsigned) time(NULL));
     brute_force_per_second = brute_force_benchmark();
     write_stats = false;

From 1ca5d3c53c02c8d2700ac88e4ce950df7499b6bf Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Mon, 25 Jan 2021 23:52:14 +0100
Subject: [PATCH 405/682] 4x50 standalone mode

---
 armsrc/Standalone/Makefile.hal  |   7 +-
 armsrc/Standalone/Makefile.inc  |   4 +
 armsrc/Standalone/lf_tharexde.c | 271 ++++++++++++++++++++++++++++++++
 armsrc/em4x50.c                 | 249 +++++++++++++++++------------
 armsrc/em4x50.h                 |   8 +
 include/em4x50.h                |  11 ++
 6 files changed, 450 insertions(+), 100 deletions(-)
 create mode 100644 armsrc/Standalone/lf_tharexde.c

diff --git a/armsrc/Standalone/Makefile.hal b/armsrc/Standalone/Makefile.hal
index d5414f661..552267611 100644
--- a/armsrc/Standalone/Makefile.hal
+++ b/armsrc/Standalone/Makefile.hal
@@ -35,6 +35,9 @@ define KNOWN_STANDALONE_DEFINITIONS
 | LF_SAMYRUN      | HID26 read/clone/sim                   |
 |                 | - Samy Kamkar                          |
 +----------------------------------------------------------+
+| LF_THAREXDE     | Simulate/read EM4x50 tags              |
+| (RDV4 only)     | storing in flashmem                    |
++----------------------------------------------------------+
 | HF_14ASNIFF     | 14a sniff to flashmem                  |
 | (RDV4 only)     |                                        |
 +----------------------------------------------------------+
@@ -67,10 +70,10 @@ define KNOWN_STANDALONE_DEFINITIONS
 +----------------------------------------------------------+
 endef
 
-STANDALONE_MODES := LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RWC LF_HIDBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN
+STANDALONE_MODES := LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RWC LF_HIDBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN LF_THAREXDE
 STANDALONE_MODES += HF_14ASNIFF HF_AVEFUL HF_BOG HF_COLIN HF_ICECLASS HF_LEGIC HF_MATTYRUN HF_MSDSAL HF_TCPRST HF_YOUNG
 STANDALONE_MODES_REQ_SMARTCARD :=
-STANDALONE_MODES_REQ_FLASH := LF_ICEHID HF_14ASNIFF HF_BOG HF_COLIN HF_ICECLASS
+STANDALONE_MODES_REQ_FLASH := LF_ICEHID LF_THAREXDE HF_14ASNIFF HF_BOG HF_COLIN HF_ICECLASS
 ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES)),)
     STANDALONE_PLATFORM_DEFS += -DWITH_STANDALONE_$(STANDALONE)
     ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES_REQ_SMARTCARD)),)
diff --git a/armsrc/Standalone/Makefile.inc b/armsrc/Standalone/Makefile.inc
index 087a4d927..519dc2087 100644
--- a/armsrc/Standalone/Makefile.inc
+++ b/armsrc/Standalone/Makefile.inc
@@ -73,3 +73,7 @@ endif
 ifneq (,$(findstring WITH_STANDALONE_HF_ICECLASS,$(APP_CFLAGS)))
     SRC_STANDALONE = hf_iceclass.c
 endif
+# WITH_STANDALONE_LF_THAREXDE
+ifneq (,$(findstring WITH_STANDALONE_LF_THAREXDE,$(APP_CFLAGS)))
+    SRC_STANDALONE = lf_tharexde.c
+endif
diff --git a/armsrc/Standalone/lf_tharexde.c b/armsrc/Standalone/lf_tharexde.c
new file mode 100644
index 000000000..41fd96d34
--- /dev/null
+++ b/armsrc/Standalone/lf_tharexde.c
@@ -0,0 +1,271 @@
+//-----------------------------------------------------------------------------
+// tharexde, 2021
+//
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// main code for EM4x50 simulator and collector aka THAREXDE
+//-----------------------------------------------------------------------------
+#include <inttypes.h>
+#include "ticks.h"
+#include "standalone.h"
+#include "proxmark3_arm.h"
+#include "appmain.h"
+#include "BigBuf.h"
+#include "fpgaloader.h"
+#include "util.h"
+#include "dbprint.h"
+#include "spiffs.h"
+#include "../em4x50.h"
+
+/*
+ * `lf_tharexde` simulates EM4x50 dumps uploaded  words/blocks, reads words of standard read
+ * mode of EM4x50 tags and stores them in internal flash.
+ * It requires RDV4 hardware (for flash and battery).
+ *
+ * On entering stand-alone mode, this module will start simulating EM4x50 data.
+ * Data is read from eml dump file uploaded to flash memory.
+ *
+ * On switching to read/record mode by pressing pm3 button, module will start
+ * reading/recording EM4x50 data. Every found / collected data will be
+ * written/appended to the logfile in flash as a text string.
+ *
+ * LEDs:
+ * - LED A: simulating
+ * - LED B: reading / record
+ * - LED C: writing to flash
+ * - LED D: unmounting/sync'ing flash (normally < 100ms)
+ *
+ * To upload input file (eml format) to flash:
+ * - mem spiffs load f <filename> o lf_em4x50_simulate.eml
+ *
+ * To retrieve log file from flash:
+ * - mem spiffs dump o lf_em4x50_collect.log f <filename>
+ *
+ * This module emits debug strings during normal operation -- so try it out in
+ * the lab connected to PM3 client before taking it into the field.
+ *
+ * To delete the input file from flash:
+ * - mem spiffs remove lf_em4x50_simulate.eml
+ *
+ * To delete the log file from flash:
+ * - mem spiffs remove lf_em4x50_collect.log
+ */
+
+#define STATE_SIM                       0
+#define STATE_READ                      1
+#define EM4X50_TAG_WORD                 45
+#define LF_EM4X50_INPUTFILE_SIM         "lf_em4x50_simulate.eml"
+#define LF_EM4X50_LOGFILE_COLLECT       "lf_em4x50_collect.log"
+
+bool input_exists;
+bool log_exists;
+
+static void LoadDataInstructions(const char *inputfile) {
+    Dbprintf("");
+    Dbprintf("To load datafile to flash and display it:");
+    Dbprintf(_YELLOW_("1.") " edit input file %s", inputfile);
+    Dbprintf(_YELLOW_("2.") " start proxmark3 client");
+    Dbprintf(_YELLOW_("3.") " mem spiffs load f <filename> o %s", inputfile);
+    Dbprintf(_YELLOW_("4.") " start standalone mode");
+}
+
+static void DownloadLogInstructions(const char *logfile) {
+    Dbprintf("");
+    Dbprintf("To get the logfile from flash and display it:");
+    Dbprintf(_YELLOW_("1.") " mem spiffs dump o %s f <filename>", logfile);
+    Dbprintf(_YELLOW_("2.") " exit proxmark3 client");
+    Dbprintf(_YELLOW_("3.") " cat <filename>");
+}
+
+static bool get_input_data_from_file(uint32_t *tag, char *inputfile) {
+
+    size_t now = 0;
+    if (exists_in_spiffs(inputfile)) {
+
+        uint32_t size = size_in_spiffs(inputfile);
+        uint8_t *mem = BigBuf_malloc(size);
+
+        Dbprintf(_YELLOW_("found input file %s"), inputfile);
+
+        rdv40_spiffs_read_as_filetype(inputfile, mem, size, RDV40_SPIFFS_SAFETY_SAFE);
+
+        now = size / 9;
+        for (int i = 0; i < now; i++)
+            for (int j = 0; j < 4; j++)
+                tag[i] |= (hex2int(mem[2 * j + 9 * i]) << 4 | hex2int(mem[2 * j + 1 + 9 * i])) << ((3 - j) * 8);
+
+        Dbprintf(_YELLOW_("read tag data from input file"));
+    }
+
+    BigBuf_free();
+
+    return ((now == EM4X50_NO_WORDS) && (tag[EM4X50_DEVICE_SERIAL] != tag[EM4X50_DEVICE_ID]));
+}
+
+static void append(const char *filename, uint8_t *entry, size_t entry_len) {
+
+    LED_D_ON();
+    if (log_exists == false) {
+        rdv40_spiffs_write(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
+        log_exists = true;
+    } else {
+        rdv40_spiffs_append(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
+    }
+    LED_D_OFF();
+}
+
+void ModInfo(void) {
+    DbpString(_YELLOW_("  LF EM4x50 sim/collector mode") " - a.k.a tharexde");
+}
+
+void RunMod(void) {
+
+    bool state_change = true;
+    int no_words = 0, command = 0;
+    uint8_t entry[81], state = STATE_SIM;
+    uint32_t tag[EM4X50_NO_WORDS] = {0x0};
+
+    rdv40_spiffs_lazy_mount();
+
+    StandAloneMode();
+    Dbprintf(_YELLOW_("Standalone mode THAREXDE started"));
+
+    for (;;) {
+
+        WDT_HIT();
+        if (data_available()) {
+            break;
+        }
+
+        // press button - toggle between SIM and READ
+        // hold button - exit
+        int button_pressed = BUTTON_CLICKED(1000);
+        if (button_pressed == BUTTON_SINGLE_CLICK) {
+
+            SpinUp(100);
+
+            switch (state) {
+
+                case STATE_SIM:
+                    state = STATE_READ;
+                    break;
+                case STATE_READ:
+                    state = STATE_SIM;
+                    break;
+                default:
+                    break;
+            }
+
+            state_change = true;
+
+        } else if (button_pressed == BUTTON_HOLD) {
+            SpinDown(100);
+            break;
+        }
+
+        if (state == STATE_SIM) {
+
+            if (state_change) {
+
+                LEDsoff();
+                LED_A_ON();
+                Dbprintf("");
+                Dbprintf(_YELLOW_("switched to EM4x50 simulating mode"));
+
+                if (get_input_data_from_file(tag, LF_EM4X50_INPUTFILE_SIM)) {
+                    Dbprintf(_YELLOW_("tag data ok"));
+                } else {
+                    Dbprintf(_RED_("error in tag data"));
+                }
+                
+                // init; start with command = standard read mode
+                em4x50_setup_sim();
+                gLogin = false;
+                gWritePasswordProcess = false;
+                command = EM4X50_COMMAND_STANDARD_READ;
+
+                state_change = false;
+            }
+
+            em4x50_handle_commands(&command, tag);
+
+            // stop if key (pm3 button or enter key) has been pressed
+            if (command == PM3_EOPABORTED) {
+                break;
+            }
+
+            // if timeout (e.g. no reader field) continue with standard read
+            // mode and reset former authentication
+            if (command == PM3_ETIMEOUT) {
+                command = EM4X50_COMMAND_STANDARD_READ;
+                gLogin = false;
+            }
+            
+        } else if (state == STATE_READ) {
+
+            if (state_change) {
+
+                LEDsoff();
+                LED_B_ON();
+                Dbprintf("");
+                Dbprintf(_YELLOW_("switched to EM4x50 reading mode"));
+
+                memset(entry, 0, sizeof(entry));
+                memset(tag, 0, sizeof(tag));
+
+                log_exists = exists_in_spiffs(LF_EM4X50_LOGFILE_COLLECT);
+                
+                em4x50_setup_read();
+                
+                state_change = false;
+            }
+
+            standard_read(&no_words, tag);
+
+            // reset timers
+            AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; // re-enable timer and wait for TC0
+            AT91C_BASE_TC0->TC_RC  = 0; // set TIOA (carry bit) on overflow, return to zero
+            AT91C_BASE_TC0->TC_RA  = 1; // clear carry bit on next clock cycle
+            AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; // reset and re-enable timer
+
+            if (no_words > 0) {
+
+                memset(entry, 0, sizeof(entry));
+
+                Dbprintf("");
+                sprintf((char *)entry, "found new EM4x50 tag:");
+                Dbprintf("%s", entry);
+                strcat((char *)entry, "\n");
+                append(LF_EM4X50_LOGFILE_COLLECT, entry, strlen((char *)entry));
+
+                for (int i = 0; i < no_words; i++) {
+
+                    sprintf((char *)entry, "  %2i -> 0x%08"PRIx32"", i + 1, tag[i]);
+                    Dbprintf("%s", entry);
+                    strcat((char *)entry, "\n");
+                    append(LF_EM4X50_LOGFILE_COLLECT, entry, strlen((char *)entry));
+                }
+            }
+            
+            memset(tag, 0, sizeof(tag));
+            no_words = 0;
+        }
+    }
+
+    if (state == STATE_READ) {
+        DownloadLogInstructions(LF_EM4X50_LOGFILE_COLLECT);
+    } else {
+        LoadDataInstructions(LF_EM4X50_INPUTFILE_SIM);
+    }
+
+    LED_D_ON();
+    rdv40_spiffs_lazy_unmount();
+    LED_D_OFF();
+
+    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+    LEDsoff();
+    Dbprintf("");
+    Dbprintf(_YELLOW_("[=] Standalone mode THAREXDE stopped"));
+}
diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index f27a21367..49fa0221e 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -24,11 +24,17 @@
 // TIMER_CLOCK1 = MCK/2, MCK is running at 48 MHz, Timer is running at 48/2 = 24 MHz
 // EM4x50 units (T0) have duration of 8 microseconds (us), which is 1/125000 per second (carrier)
 // T0 = TIMER_CLOCK1 / 125000 = 192
-
 #ifndef T0
 #define T0                                  192
 #endif
 
+// the following terms are used (for carrier frequency of 125 kHz):
+// 1 us = 1.5 ticks
+// 1 cycle = 1 period = 8 us = 12 ticks
+// 1 bit = 64 cycles = 768 ticks = 512 us
+#define CYCLES2TICKS                        12
+
+// given in cycles/periods
 #define EM4X50_T_TAG_QUARTER_PERIOD         16
 #define EM4X50_T_TAG_HALF_PERIOD            32
 #define EM4X50_T_TAG_THREE_QUARTER_PERIOD   48
@@ -40,27 +46,21 @@
 #define EM4X50_T_TAG_WAITING_FOR_SIGNAL     75
 #define EM4X50_T_WAITING_FOR_DBLLIW         1550
 #define EM4X50_T_WAITING_FOR_ACK            4
+#define EM4X50_TAG_TOLERANCE                8
+#define EM4X50_ZERO_DETECTION               3
 
-// timeout values for simulation mode (may vary with regard to reader)
+// timeout values (empirical) for simulation mode (may vary with regard to reader)
 #define EM4X50_T_SIMULATION_TIMEOUT_READ    600
 #define EM4X50_T_SIMULATION_TIMEOUT_WAIT    50
 
-// the following value seems to be critical; if it's too low (e.g. < 120)
-// some cards are no longer readable although they're ok
+// the following value (pulses) seems to be critical; if it's too low
+//(e.g. < 120) some cards are no longer readable although they're ok
 #define EM4X50_T_WAITING_FOR_SNGLLIW        140
 
-#define EM4X50_TAG_TOLERANCE                8
-#define EM4X50_ZERO_DETECTION               3
+// div
 #define EM4X50_TAG_WORD                     45
 #define EM4X50_TAG_MAX_NO_BYTES             136
 
-#define EM4X50_COMMAND_LOGIN                0x01
-#define EM4X50_COMMAND_RESET                0x80
-#define EM4X50_COMMAND_WRITE                0x12
-#define EM4X50_COMMAND_WRITE_PASSWORD       0x11
-#define EM4X50_COMMAND_SELECTIVE_READ       0x0A
-#define EM4X50_COMMAND_STANDARD_READ        0x02 // virtual command
-
 int gHigh = 190;
 int gLow = 60;
 
@@ -74,11 +74,15 @@ bool gWritePasswordProcess = false;
 
 // do nothing for <period> using timer0
 static void wait_timer(uint32_t period) {
-    AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
-    while (AT91C_BASE_TC0->TC_CV < period);
+    
+    int timeout = period;
+    uint32_t tval = GetTicks();
+    
+    //AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
+    //while (AT91C_BASE_TC0->TC_CV < period);
+    while ((timeout--) && (GetTicks() - tval < period));
 }
 
-
 // extract and check parities
 // return result of parity check and extracted plain data
 static bool extract_parities(uint64_t word, uint32_t *data) {
@@ -130,13 +134,16 @@ static bool extract_parities(uint64_t word, uint32_t *data) {
     return false;
 }
 
-static void em4x50_setup_read(void) {
+void em4x50_setup_read(void) {
 
     FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
     FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
 
+    StartTicks();
+    
     // 50ms for the resonant antenna to settle.
-    SpinDelay(50);
+    //SpinDelay(50);
+    WaitMS(50);
 
     // Now set up the SSC to get the ADC samples that are now streaming at us.
     FpgaSetupSsc(FPGA_MAJOR_MODE_LF_READER);
@@ -154,6 +161,7 @@ static void em4x50_setup_read(void) {
     // Disable modulation at default, which means enable the field
     LOW(GPIO_SSC_DOUT);
 
+    /*
     // Enable Peripheral Clock for
     //   TIMER_CLOCK0, used to measure exact timing before answering
     AT91C_BASE_PMC->PMC_PCER |= (1 << AT91C_ID_TC0);// | (1 << AT91C_ID_TC1);
@@ -172,12 +180,13 @@ static void em4x50_setup_read(void) {
 
     // synchronized startup procedure
     while (AT91C_BASE_TC0->TC_CV > 0) {}; // wait until TC1 returned to zero
-
+    */
+     
     // Watchdog hit
     WDT_HIT();
 }
 
-static void em4x50_setup_sim(void) {
+void em4x50_setup_sim(void) {
     FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
     FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT);
     FpgaSendCommand(FPGA_CMD_SET_DIVISOR, LF_DIVISOR_125);
@@ -186,12 +195,15 @@ static void em4x50_setup_sim(void) {
     AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
     AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK;
     
+    StartTicks();
+    /*
     AT91C_BASE_PMC->PMC_PCER |= (1 << AT91C_ID_TC0);
     AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME;
     AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;
     AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK;
     AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
-
+    */
+     
     // Watchdog hit
     WDT_HIT();
     
@@ -200,7 +212,7 @@ static void em4x50_setup_sim(void) {
 
 // calculate signal properties (mean amplitudes) from measured data:
 // 32 amplitudes (maximum values) -> mean amplitude value -> gHigh -> gLow
-static bool get_signalproperties(void) {
+bool get_signalproperties(void) {
 
     bool signal_found = false;
     int no_periods = 32, pct = 75, noise = 140;
@@ -208,6 +220,7 @@ static bool get_signalproperties(void) {
     uint8_t sample_max_mean = 0;
     uint8_t sample_max[no_periods];
     uint32_t sample_max_sum = 0;
+    uint32_t tval = 0;
     memset(sample_max, 0x00, sizeof(sample_max));
 
     LED_A_ON();
@@ -218,7 +231,8 @@ static bool get_signalproperties(void) {
         if (BUTTON_PRESS()) return false;
 
         // about 2 samples per bit period
-        wait_timer(T0 * EM4X50_T_TAG_HALF_PERIOD);
+        //wait_timer(T0 * EM4X50_T_TAG_HALF_PERIOD);
+        wait_timer(12 * EM4X50_T_TAG_HALF_PERIOD);
 
         // ignore first samples
         if ((i > SIGNAL_IGNORE_FIRST_SAMPLES) && (AT91C_BASE_SSC->SSC_RHR > noise)) {
@@ -236,8 +250,10 @@ static bool get_signalproperties(void) {
     // 3 single "full periods" to eliminate the influence of a listen window
     for (int i = 0; i < no_periods; i++) {
 
-        AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
-        while (AT91C_BASE_TC0->TC_CV < T0 * 3 * EM4X50_T_TAG_FULL_PERIOD) {
+        //AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
+        //while (AT91C_BASE_TC0->TC_CV < T0 * 3 * EM4X50_T_TAG_FULL_PERIOD) {
+        tval = GetTicks();
+        while (GetTicks() - tval < 12 * 3 * EM4X50_T_TAG_FULL_PERIOD) {
 
             if (BUTTON_PRESS()) return false;
 
@@ -268,12 +284,14 @@ static bool get_signalproperties(void) {
 static bool invalid_bit(void) {
 
     // get sample at 3/4 of bit period
-    wait_timer(T0 * EM4X50_T_TAG_THREE_QUARTER_PERIOD);
+    //wait_timer(T0 * EM4X50_T_TAG_THREE_QUARTER_PERIOD);
+    wait_timer(12 * EM4X50_T_TAG_THREE_QUARTER_PERIOD);
 
     uint8_t sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 
     // wait until end of bit period
-    wait_timer(T0 * EM4X50_T_TAG_QUARTER_PERIOD);
+    //wait_timer(T0 * EM4X50_T_TAG_QUARTER_PERIOD);
+    wait_timer(12 * EM4X50_T_TAG_QUARTER_PERIOD);
 
     // bit in "undefined" state?
     if (sample <= gHigh && sample >= gLow)
@@ -284,7 +302,7 @@ static bool invalid_bit(void) {
 
 static uint32_t get_pulse_length(void) {
 
-    int32_t timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD);
+    int32_t timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD), tval = 0;
 
     // iterates pulse length (low -> high -> low)
 
@@ -296,7 +314,8 @@ static uint32_t get_pulse_length(void) {
     if (timeout == 0)
         return 0;
 
-    AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
+    //AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
+    tval = GetTicks();
     timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD);
 
     while (sample < gHigh && (timeout--))
@@ -312,41 +331,59 @@ static uint32_t get_pulse_length(void) {
     if (timeout == 0)
         return 0;
 
-    return (uint32_t)AT91C_BASE_TC0->TC_CV;
+    //return (uint32_t)AT91C_BASE_TC0->TC_CV;
+    return GetTicks() - tval;
 
 }
 
 // check if pulse length <pl> corresponds to given length <length>
 static bool check_pulse_length(uint32_t pl, int length) {
-    return ((pl >= T0 * (length - EM4X50_TAG_TOLERANCE)) && (pl <= T0 * (length + EM4X50_TAG_TOLERANCE)));
+    //return ((pl >= T0 * (length - EM4X50_TAG_TOLERANCE)) && (pl <= T0 * (length + EM4X50_TAG_TOLERANCE)));
+    return ((pl >= 12 * (length - EM4X50_TAG_TOLERANCE)) && (pl <= 12 * (length + EM4X50_TAG_TOLERANCE)));
 }
 
 // send single bit according to EM4x50 application note and datasheet
 static void em4x50_reader_send_bit(int bit) {
+    int timeout = 500;
+
     // reset clock for the next bit
-    AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
+    //AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
+    uint32_t tval = GetTicks();
 
     if (bit == 0) {
 
         // disable modulation (activate the field) for 7 cycles of carrier
         // period (Opt64)
         LOW(GPIO_SSC_DOUT);
-        while (AT91C_BASE_TC0->TC_CV < T0 * 7);
-
+        //while (AT91C_BASE_TC0->TC_CV < T0 * 7);
+        while ((timeout--) && (GetTicks() - tval < 12 * 7));
+        if (timeout <= 0)
+            return;
+        timeout = 500;
+        
         // enable modulation (drop the field) for remaining first
         // half of bit period
         HIGH(GPIO_SSC_DOUT);
-        while (AT91C_BASE_TC0->TC_CV < T0 * EM4X50_T_TAG_HALF_PERIOD);
+        //while (AT91C_BASE_TC0->TC_CV < T0 * EM4X50_T_TAG_HALF_PERIOD);
+        while ((timeout--) && (GetTicks() - tval < 12 * EM4X50_T_TAG_HALF_PERIOD));
+        if (timeout <= 0)
+            return;
+        timeout = 500;
 
         // disable modulation for second half of bit period
         LOW(GPIO_SSC_DOUT);
-        while (AT91C_BASE_TC0->TC_CV < T0 * EM4X50_T_TAG_FULL_PERIOD);
+        //while (AT91C_BASE_TC0->TC_CV < T0 * EM4X50_T_TAG_FULL_PERIOD);
+        while ((timeout--) && (GetTicks() - tval < 12 * EM4X50_T_TAG_FULL_PERIOD));
+        if (timeout <= 0)
+            return;
+        timeout = 500;
 
     } else {
 
         // bit = "1" means disable modulation for full bit period
         LOW(GPIO_SSC_DOUT);
-        while (AT91C_BASE_TC0->TC_CV < T0 * EM4X50_T_TAG_FULL_PERIOD);
+        //while (AT91C_BASE_TC0->TC_CV < T0 * EM4X50_T_TAG_FULL_PERIOD);
+        while ((timeout--) && (GetTicks() - tval < 12 * EM4X50_T_TAG_FULL_PERIOD));
     }
 }
 
@@ -446,7 +483,8 @@ static int find_double_listen_window(bool bcommand) {
                     // second window follows - sync on this to issue a command
 
                     // skip the next bit...
-                    wait_timer(T0 * EM4X50_T_TAG_FULL_PERIOD);
+                    //wait_timer(T0 * EM4X50_T_TAG_FULL_PERIOD);
+                    wait_timer(12 * EM4X50_T_TAG_FULL_PERIOD);
 
                     // ...and check if the following bit does make sense
                     // (if not it is the correct position within the second
@@ -484,7 +522,7 @@ static int find_double_listen_window(bool bcommand) {
 
 // function is used to check wether a tag on the proxmark is an
 // EM4x50 tag or not -> speed up "lf search" process
-static bool find_em4x50_tag(void) {
+bool find_em4x50_tag(void) {
     return find_single_listen_window();
 }
 
@@ -524,7 +562,8 @@ static bool check_ack(bool bliw) {
 
                     // wait for 2 bits (remaining "bit" of ACK signal + first
                     // "bit" of listen window)
-                    wait_timer(T0 * 2 * EM4X50_T_TAG_FULL_PERIOD);
+                    //wait_timer(T0 * 2 * EM4X50_T_TAG_FULL_PERIOD);
+                    wait_timer(12 * 2 * EM4X50_T_TAG_FULL_PERIOD);
 
                     // check for listen window (if first bit cannot be interpreted
                     // as a valid bit it must belong to a listen window)
@@ -655,7 +694,8 @@ static bool login(uint32_t password) {
         // send password
         em4x50_reader_send_word(password);
 
-        wait_timer(T0 * EM4X50_T_TAG_TPP);
+        //wait_timer(T0 * EM4X50_T_TAG_TPP);
+        wait_timer(12 * EM4X50_T_TAG_TPP);
 
         // check if ACK is returned
         if (check_ack(false))
@@ -815,7 +855,7 @@ static int reset(void) {
 
 // reads data that tag transmits when exposed to reader field
 // (standard read mode); number of read words is saved in <now>
-static int standard_read(int *now, uint32_t *words) {
+int standard_read(int *now, uint32_t *words) {
 
     int fwr = *now, res = PM3_EFAILED;
 
@@ -823,8 +863,11 @@ static int standard_read(int *now, uint32_t *words) {
     if ((res = find_double_listen_window(false)) == PM3_SUCCESS) {
 
         // read and save words until following double listen window is detected
-        while ((res = get_word_from_bitstream(&words[*now])) == EM4X50_TAG_WORD)
+        res = get_word_from_bitstream(&words[*now]);
+        while (res == EM4X50_TAG_WORD) {
             (*now)++;
+            res = get_word_from_bitstream(&words[*now]);
+        }
 
         // number of detected words
         *now -= fwr;
@@ -957,7 +1000,8 @@ static int write(uint32_t word, uint32_t addresses) {
         } else {
 
             // wait for T0 * EM4X50_T_TAG_TWA (write access time)
-            wait_timer(T0 * EM4X50_T_TAG_TWA);
+            //wait_timer(T0 * EM4X50_T_TAG_TWA);
+            wait_timer(12 * EM4X50_T_TAG_TWA);
 
             // look for ACK sequence
             if (check_ack(false)) {
@@ -965,7 +1009,8 @@ static int write(uint32_t word, uint32_t addresses) {
                 // now EM4x50 needs T0 * EM4X50_T_TAG_TWEE (EEPROM write time = 3.2ms = 50 * 64 periods)
                 // for saving data and should return with ACK
                 for (int i = 0; i < 50; i++) {
-                    wait_timer(T0 * EM4X50_T_TAG_FULL_PERIOD);
+                    //wait_timer(T0 * EM4X50_T_TAG_FULL_PERIOD);
+                    wait_timer(12 * EM4X50_T_TAG_FULL_PERIOD);
                 }
 
                 if (check_ack(false))
@@ -996,7 +1041,8 @@ static int write_password(uint32_t password, uint32_t new_password) {
         } else {
 
             // wait for T0 * EM4x50_T_TAG_TPP (processing pause time)
-            wait_timer(T0 * EM4X50_T_TAG_TPP);
+            //wait_timer(T0 * EM4X50_T_TAG_TPP);
+            wait_timer(12 * EM4X50_T_TAG_TPP);
 
             // look for ACK sequence and send rm request
             // during following listen window
@@ -1006,14 +1052,16 @@ static int write_password(uint32_t password, uint32_t new_password) {
                 em4x50_reader_send_word(new_password);
 
                 // wait for T0 * EM4X50_T_TAG_TWA (write access time)
-                wait_timer(T0 * EM4X50_T_TAG_TWA);
+                //wait_timer(T0 * EM4X50_T_TAG_TWA);
+                wait_timer(12 * EM4X50_T_TAG_TWA);
 
                 if (check_ack(false)) {
 
                     // now EM4x50 needs T0 * EM4X50_T_TAG_TWEE (EEPROM write time = 3.2ms = 50 * 64 periods)
                     // for saving data and should return with ACK
                     for (int i = 0; i < 50; i++) {
-                        wait_timer(T0 * EM4X50_T_TAG_FULL_PERIOD);
+                        //wait_timer(T0 * EM4X50_T_TAG_FULL_PERIOD);
+                        wait_timer(12 * EM4X50_T_TAG_FULL_PERIOD);
                     }
 
                     if (check_ack(false))
@@ -1216,23 +1264,23 @@ static int em4x50_sim_read_bit(void) {
 
     int cycles = 0;
     int timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
+    uint32_t tval = 0;
 
     while (cycles < EM4X50_T_TAG_FULL_PERIOD) {
 
         // wait until reader field disappears
         while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
 
-        AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
-
         // now check until reader switches on carrier field
+        tval = GetTicks();
         while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
 
-            // check if cycle (i.e. off -> on -> off) takes longer than T0
-            if (AT91C_BASE_TC0->TC_CV > T0 * EM4X50_ZERO_DETECTION) {
+            // check if current cycle takes longer than "usual""
+            if (GetTicks() - tval > EM4X50_ZERO_DETECTION * CYCLES2TICKS) {
 
                 // gap detected; wait until reader field is switched on again
                 while ((timeout--) && (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
-                
+
                 if (timeout <= 0) {
                     return PM3_ETIMEOUT;
                 }
@@ -1727,13 +1775,61 @@ static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
     return EM4X50_COMMAND_WRITE_PASSWORD;
 }
 
+void em4x50_handle_commands(int *command, uint32_t *tag) {
+    
+    switch (*command) {
+
+        case EM4X50_COMMAND_LOGIN:
+            LED_B_OFF();
+            LED_C_OFF();
+            *command = em4x50_sim_handle_login_command(tag);
+            break;
+
+        case EM4X50_COMMAND_RESET:
+            LED_B_OFF();
+            LED_C_OFF();
+            *command =  em4x50_sim_handle_reset_command(tag);
+            break;
+
+        case EM4X50_COMMAND_WRITE:
+            LED_B_OFF();
+            LED_C_OFF();
+            *command =  em4x50_sim_handle_write_command(tag);
+            break;
+
+        case EM4X50_COMMAND_WRITE_PASSWORD:
+            LED_B_OFF();
+            LED_C_OFF();
+            *command =  em4x50_sim_handle_writepwd_command(tag);
+            break;
+
+        case EM4X50_COMMAND_SELECTIVE_READ:
+            LED_B_OFF();
+            LED_C_ON();
+            *command =  em4x50_sim_handle_selective_read_command(tag);
+            break;
+            
+        case EM4X50_COMMAND_STANDARD_READ:
+            LED_B_ON();
+            LED_C_OFF();
+            *command = em4x50_sim_handle_standard_read_command(tag);
+            break;
+            
+        // bit errors during reading may lead to unknown commands
+        // -> continue with standard read mode
+        default:
+            *command = EM4X50_COMMAND_STANDARD_READ;
+            break;
+    }
+}
+
 // simulate uploaded data in emulator memory
 // LED A -> operations that require authentication are possible
 // LED B -> standard read mode is active
 // LED C -> command has been transmitted by reader
 void em4x50_sim(uint32_t *password) {
     
-    int command = PM3_ENODATA;
+    int command = 0;
     
     uint8_t *em4x50_mem = BigBuf_get_EM_addr();
     uint32_t tag[EM4X50_NO_WORDS] = {0x0};
@@ -1759,50 +1855,7 @@ void em4x50_sim(uint32_t *password) {
 
         for (;;) {
 
-            switch (command) {
-
-                case EM4X50_COMMAND_LOGIN:
-                    LED_B_OFF();
-                    LED_C_OFF();
-                    command = em4x50_sim_handle_login_command(tag);
-                    break;
-
-                case EM4X50_COMMAND_RESET:
-                    LED_B_OFF();
-                    LED_C_OFF();
-                    command =  em4x50_sim_handle_reset_command(tag);
-                    break;
-
-                case EM4X50_COMMAND_WRITE:
-                    LED_B_OFF();
-                    LED_C_OFF();
-                    command =  em4x50_sim_handle_write_command(tag);
-                    break;
-
-                case EM4X50_COMMAND_WRITE_PASSWORD:
-                    LED_B_OFF();
-                    LED_C_OFF();
-                    command =  em4x50_sim_handle_writepwd_command(tag);
-                    break;
-
-                case EM4X50_COMMAND_SELECTIVE_READ:
-                    LED_B_OFF();
-                    LED_C_ON();
-                    command =  em4x50_sim_handle_selective_read_command(tag);
-                    break;
-                    
-                case EM4X50_COMMAND_STANDARD_READ:
-                    LED_B_ON();
-                    LED_C_OFF();
-                    command = em4x50_sim_handle_standard_read_command(tag);
-                    break;
-                    
-                // bit errors during reading may lead to unknown commands
-                // -> continue with standard read mode
-                default:
-                    command = EM4X50_COMMAND_STANDARD_READ;
-                    break;
-            }
+            em4x50_handle_commands(&command, tag);
             
             // stop if key (pm3 button or enter key) has been pressed
             if (command == PM3_EOPABORTED) {
diff --git a/armsrc/em4x50.h b/armsrc/em4x50.h
index 72304192b..cf35cc6a4 100644
--- a/armsrc/em4x50.h
+++ b/armsrc/em4x50.h
@@ -13,6 +13,14 @@
 
 #include "../include/em4x50.h"
 
+void em4x50_setup_read(void);
+bool get_signalproperties(void);
+bool find_em4x50_tag(void);
+int standard_read(int *now, uint32_t *words);
+
+void em4x50_setup_sim(void);
+void em4x50_handle_commands(int *command, uint32_t *tag);
+
 void em4x50_info(em4x50_data_t *etd);
 void em4x50_write(em4x50_data_t *etd);
 void em4x50_writepwd(em4x50_data_t *etd);
diff --git a/include/em4x50.h b/include/em4x50.h
index ff0090547..80210cfc2 100644
--- a/include/em4x50.h
+++ b/include/em4x50.h
@@ -33,6 +33,14 @@
 #define FIRST_WORD_WRITE_INHIBITED  2       // third byte
 #define LAST_WORD_WRITE_INHIBITED   3       // fourth byte
 
+// commands
+#define EM4X50_COMMAND_LOGIN                0x01
+#define EM4X50_COMMAND_RESET                0x80
+#define EM4X50_COMMAND_WRITE                0x12
+#define EM4X50_COMMAND_WRITE_PASSWORD       0x11
+#define EM4X50_COMMAND_SELECTIVE_READ       0x0A
+#define EM4X50_COMMAND_STANDARD_READ        0x02 // virtual command
+
 // misc
 #define TIMEOUT                     2000
 #define DUMP_FILESIZE               136
@@ -52,4 +60,7 @@ typedef struct {
     uint8_t byte[4];
 } PACKED em4x50_word_t;
 
+extern bool gLogin;
+extern bool gWritePasswordProcess;
+
 #endif /* EM4X50_H__ */

From 6a13a0c349cca53c17bc95fad40b414c3941eab3 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Tue, 26 Jan 2021 01:07:32 +0100
Subject: [PATCH 406/682] hardnested: one more init

---
 client/src/cmdhfmfhard.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhfmfhard.c b/client/src/cmdhfmfhard.c
index 6d685ce96..58bd00671 100644
--- a/client/src/cmdhfmfhard.c
+++ b/client/src/cmdhfmfhard.c
@@ -2179,8 +2179,8 @@ int mfnestedhard(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t trgBloc
     get_SIMD_instruction_set(instr_set);
     PrintAndLogEx(SUCCESS, "Using %s SIMD core.", instr_set);
 
-    // initialize static arrays
     memset(part_sum_count, 0, sizeof(part_sum_count));
+    real_sum_a8 = 0;
 
     srand((unsigned) time(NULL));
     brute_force_per_second = brute_force_benchmark();

From 05c5985073aef2045d5b84ac707d00480c378802 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 26 Jan 2021 10:47:55 +0100
Subject: [PATCH 407/682] fix #1173  - added guards

---
 client/deps/hardnested/hardnested_bf_core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/client/deps/hardnested/hardnested_bf_core.c b/client/deps/hardnested/hardnested_bf_core.c
index feb08997b..e856d26e1 100644
--- a/client/deps/hardnested/hardnested_bf_core.c
+++ b/client/deps/hardnested/hardnested_bf_core.c
@@ -559,7 +559,10 @@ void SetSIMDInstr(SIMDExecInstr instr) {
 static SIMDExecInstr GetSIMDInstr(void) {
     SIMDExecInstr instr;
 
+#if defined(COMPILER_HAS_SIMD)
     __builtin_cpu_init();
+#endif
+
 #if defined(COMPILER_HAS_SIMD_AVX512)
     if (__builtin_cpu_supports("avx512f"))
         instr = SIMD_AVX512;

From fad3658604060706e3a77a5224905cd629dda166 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 26 Jan 2021 22:26:19 +0100
Subject: [PATCH 408/682] fix 'lf t55 sniff' input params

---
 client/src/cmdlft55xx.c | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index a3e6bc176..675e37af3 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -3883,24 +3883,39 @@ static int CmdT55xxSniff(const char *Cmd) {
     CLIExecWithReturn(ctx, Cmd, argtable, true);
     bool use_graphbuf = arg_get_lit(ctx, 1);
     uint8_t tolerance = arg_get_int_def(ctx, 2, 5);
-    uint8_t width1 = arg_get_int(ctx, 3);
-    uint8_t width0 = arg_get_int(ctx, 4);
+    int opt_width1 = arg_get_int_def(ctx, 3, -1);
+    int opt_width0 = arg_get_int_def(ctx, 4, -1);
     CLIParserFree(ctx);
 
-    if (width0 && width1 == 0) {
+    if (opt_width0 > 0  && opt_width1 == -1) {
         PrintAndLogEx(ERR, _RED_("Missing sample width for ONE"));
         return PM3_EINVARG;
     }
 
-    if (width1 && width0 == 0) {
+    if (opt_width1 > 0 && opt_width0 == -1) {
         PrintAndLogEx(ERR, _RED_("Missing sample width for ZERO"));
         return PM3_EINVARG;
     }
 
-    if ((width0 == 0) || (width1 == 0)) {
-        PrintAndLogEx(ERR, "Must call with --one and --zero params");
+    if (opt_width0 == 0) {
+        PrintAndLogEx(ERR, "Must call with --zero larger than 0");
         return PM3_EINVARG;
     }
+    if ((opt_width0 == 0) || (opt_width1 == 0)) {
+        PrintAndLogEx(ERR, "Must call with --one larger than 0");
+        return PM3_EINVARG;
+    }
+
+    uint8_t width1 = 0;
+    uint8_t width0 = 0;
+
+    if (opt_width0 > -1) 
+        width0 = (uint8_t)opt_width0 & 0xFF;
+
+    if (opt_width1 > -1) 
+        width1 = (uint8_t)opt_width1 & 0xFF;
+
+
 
     /*
         Notes:

From 11b94e7748ac561cea9844bfadcf4f9ab18d7ffe Mon Sep 17 00:00:00 2001
From: McEloff <eloff@mail.ru>
Date: Wed, 27 Jan 2021 01:14:20 +0300
Subject: [PATCH 409/682] `trace list -t mf` - now can use external dictionary
 keys file

---
 CHANGELOG.md           |  1 +
 client/src/cmdhflist.c | 13 +++++------
 client/src/cmdhflist.h |  2 +-
 client/src/cmdtrace.c  | 50 +++++++++++++++++++++++++++++++++++++-----
 4 files changed, 53 insertions(+), 13 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 868fe6877..ffd6aa4cc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+ - Added `trace list -t mf` - now can use external dictionary keys file
  - Added support for bidirectional communication for `lf em 4x50 sim` (@tharexde)
  - Change `PLATFORM=PM3OTHER` to `PLATFORM=PM3GENERIC` (@iceman1001)
  - Added `tools/hitag2crack/crack5opencl`, an optimized version of `crack5gpu` (@matrix)
diff --git a/client/src/cmdhflist.c b/client/src/cmdhflist.c
index 945edda06..dbe80ef5a 100644
--- a/client/src/cmdhflist.c
+++ b/client/src/cmdhflist.c
@@ -17,7 +17,6 @@
 
 #include "commonutil.h"  // ARRAYLEN
 #include "mifare/mifarehost.h"
-#include "mifare/mifaredefault.h"
 #include "parity.h"         // oddparity
 #include "ui.h"
 #include "crc16.h"
@@ -1335,7 +1334,7 @@ void annotateMifare(char *exp, size_t size, uint8_t *cmd, uint8_t cmdsize, uint8
 
 }
 
-bool DecodeMifareData(uint8_t *cmd, uint8_t cmdsize, uint8_t *parity, bool isResponse, uint8_t *mfData, size_t *mfDataLen) {
+bool DecodeMifareData(uint8_t *cmd, uint8_t cmdsize, uint8_t *parity, bool isResponse, uint8_t *mfData, size_t *mfDataLen, const uint64_t *dicKeys, uint32_t dicKeysCount) {
     static struct Crypto1State *traceCrypto1;
 
     *mfDataLen = 0;
@@ -1383,12 +1382,12 @@ bool DecodeMifareData(uint8_t *cmd, uint8_t cmdsize, uint8_t *parity, bool isRes
             }
 
             // check default keys
-            if (!traceCrypto1) {
-                for (int i = 0; i < ARRAYLEN(g_mifare_default_keys); i++) {
-                    if (NestedCheckKey(g_mifare_default_keys[i], &AuthData, cmd, cmdsize, parity)) {
-                        PrintAndLogEx(NORMAL, "            |            |  *  |%61s " _GREEN_("%012" PRIX64) "|     |", "key", g_mifare_default_keys[i]);
+            if (!traceCrypto1 && dicKeys != NULL && dicKeysCount > 0) {
+                for (int i = 0; i < dicKeysCount; i++) {
+                    if (NestedCheckKey(dicKeys[i], &AuthData, cmd, cmdsize, parity)) {
+                        PrintAndLogEx(NORMAL, "            |            |  *  |%60s " _GREEN_("%012" PRIX64) "|     |", "key", dicKeys[i]);
 
-                        mfLastKey = g_mifare_default_keys[i];
+                        mfLastKey = dicKeys[i];
                         traceCrypto1 = lfsr_recovery64(AuthData.ks2, AuthData.ks3);
                         break;
                     };
diff --git a/client/src/cmdhflist.h b/client/src/cmdhflist.h
index f12f2a61d..ff7f7f799 100644
--- a/client/src/cmdhflist.h
+++ b/client/src/cmdhflist.h
@@ -51,7 +51,7 @@ void annotateMifare(char *exp, size_t size, uint8_t *cmd, uint8_t cmdsize, uint8
 void annotateLTO(char *exp, size_t size, uint8_t *cmd, uint8_t cmdsize);
 void annotateCryptoRF(char *exp, size_t size, uint8_t *cmd, uint8_t cmdsize);
 
-bool DecodeMifareData(uint8_t *cmd, uint8_t cmdsize, uint8_t *parity, bool isResponse, uint8_t *mfData, size_t *mfDataLen);
+bool DecodeMifareData(uint8_t *cmd, uint8_t cmdsize, uint8_t *parity, bool isResponse, uint8_t *mfData, size_t *mfDataLen, const uint64_t *dicKeys, uint32_t dicKeysCount);
 bool NTParityChk(TAuthData *ad, uint32_t ntx);
 bool NestedCheckKey(uint64_t key, TAuthData *ad, uint8_t *cmd, uint8_t cmdsize, uint8_t *parity);
 bool CheckCrypto1Parity(uint8_t *cmd_enc, uint8_t cmdsize, uint8_t *cmd, uint8_t *parity_enc);
diff --git a/client/src/cmdtrace.c b/client/src/cmdtrace.c
index f934caebe..d53f47883 100644
--- a/client/src/cmdtrace.c
+++ b/client/src/cmdtrace.c
@@ -15,6 +15,8 @@
 #include "protocols.h"
 #include "parity.h"             // oddparity
 #include "cmdhflist.h"          // annotations
+#include "commonutil.h"         // ARRAYLEN
+#include "mifare/mifaredefault.h"          // mifare default key array
 #include "comms.h"              // for sending cmds to device. GetFromBigBuf
 #include "fileutils.h"          // for saveFile
 #include "cmdlfhitag.h"         // annotate hitag
@@ -131,7 +133,8 @@ static uint16_t printHexLine(uint16_t tracepos, uint16_t traceLen, uint8_t *trac
     return ret;
 }
 
-static uint16_t printTraceLine(uint16_t tracepos, uint16_t traceLen, uint8_t *trace, uint8_t protocol, bool showWaitCycles, bool markCRCBytes, uint32_t *prev_eot, bool use_us) {
+static uint16_t printTraceLine(uint16_t tracepos, uint16_t traceLen, uint8_t *trace, uint8_t protocol, bool showWaitCycles, bool markCRCBytes, uint32_t *prev_eot, bool use_us, 
+                               const uint64_t *mfDicKeys, uint32_t mfDicKeysCount) {
     // sanity check
     if (is_last_record(tracepos, traceLen)) {
         PrintAndLogEx(DEBUG, "last record triggered.  t-pos: %u  t-len %u", tracepos, traceLen);
@@ -428,7 +431,7 @@ static uint16_t printTraceLine(uint16_t tracepos, uint16_t traceLen, uint8_t *tr
     }
 
     if (protocol == PROTO_MIFARE) {
-        if (DecodeMifareData(frame, data_len, parityBytes, hdr->isResponse, mfData, &mfDataLen)) {
+        if (DecodeMifareData(frame, data_len, parityBytes, hdr->isResponse, mfData, &mfDataLen, mfDicKeys, mfDicKeysCount)) {
             memset(explanation, 0x00, sizeof(explanation));
             if (hdr->isResponse == false) {
                 annotateIso14443a(explanation, sizeof(explanation), mfData, mfDataLen);
@@ -612,8 +615,9 @@ int CmdTraceList(const char *Cmd) {
                   "trace list -t hitags   -> interpret as " _YELLOW_("HitagS") " communications\n"
                   "trace list -t lto      -> interpret as " _YELLOW_("LTO-CM") " communications\n"
                   "trace list -t cryptorf -> interpret as " _YELLOW_("CryptoRF") " communitcations\n"
-                  "trace list -t 14a -f    -> show frame delay times\n"
-                  "trace list -t 14a -1    -> use trace buffer "
+                  "trace list -t mf -d <mfc_default_keys.dic>    -> use dictionary keys file\n"
+                  "trace list -t 14a -f                          -> show frame delay times\n"
+                  "trace list -t 14a -1                          -> use trace buffer "
                  );
 
     void *argtable[] = {
@@ -626,6 +630,7 @@ int CmdTraceList(const char *Cmd) {
         arg_lit0("x", NULL, "show hexdump to convert to pcap(ng)\n"
                  "                                   or to import into Wireshark using encapsulation type \"ISO 14443\""),
         arg_strx0("t", "type", NULL, "protocol to annotate the trace"),
+        arg_strx0("d", "dict", NULL, "use dictionary keys file"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);
@@ -642,6 +647,10 @@ int CmdTraceList(const char *Cmd) {
     CLIParamStrToBuf(arg_get_str(ctx, 7), (uint8_t *)type, sizeof(type), &tlen);
     str_lower(type);
 
+    int diclen = 0;
+    char dictionary[FILE_PATH_SIZE] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 8), (uint8_t *)dictionary, sizeof(dictionary), &diclen);
+
     CLIParserFree(ctx);
 
     clearCommandBuffer();
@@ -742,6 +751,34 @@ int CmdTraceList(const char *Cmd) {
         }
 
 
+        const uint64_t *dicKeys = NULL;
+        uint32_t dicKeysCount = 0;
+        bool dictionaryLoad = false;
+
+        if (protocol == PROTO_MIFARE) {
+            if (diclen > 0) {
+                uint8_t *keyBlock = NULL;
+                int res = loadFileDICTIONARY_safe(dictionary, (void **) &keyBlock, 6, &dicKeysCount);
+                if (res != PM3_SUCCESS || dicKeysCount == 0 || keyBlock == NULL) {
+                    PrintAndLogEx(FAILED, "An error occurred while loading the dictionary! (we will use the default keys now)");
+                } else {
+                    dicKeys = calloc(dicKeysCount, sizeof(uint64_t));
+                    for (int i = 0; i < dicKeysCount; i++) {
+                        uint64_t key = bytes_to_num(keyBlock + i * 6, 6);
+                        memcpy((uint8_t *) &dicKeys[i], &key, sizeof(uint64_t));
+                    }
+                    dictionaryLoad = true;
+                }
+                if (keyBlock != NULL) {
+                    free(keyBlock);
+                }
+            }
+            if (dicKeys == NULL) {
+                dicKeys = g_mifare_default_keys;
+                dicKeysCount = ARRAYLEN(g_mifare_default_keys);
+            }
+        }
+
         PrintAndLogEx(NORMAL, "");
         if (use_relative) {
             PrintAndLogEx(NORMAL, "        Gap |   Duration | Src | Data (! denotes parity error, ' denotes short bytes)                    | CRC | Annotation");
@@ -761,11 +798,14 @@ int CmdTraceList(const char *Cmd) {
         }
 
         while (tracepos < g_traceLen) {
-            tracepos = printTraceLine(tracepos, g_traceLen, g_trace, protocol, show_wait_cycles, mark_crc, prev_EOT, use_us);
+            tracepos = printTraceLine(tracepos, g_traceLen, g_trace, protocol, show_wait_cycles, mark_crc, prev_EOT, use_us, dicKeys, dicKeysCount);
 
             if (kbd_enter_pressed())
                 break;
         }
+
+        if (dictionaryLoad)
+            free((void *) dicKeys);
     }
 
     if (show_hex)

From d53fda3d3d7cb20fbed67df3b7a50ea33f927cf8 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Wed, 27 Jan 2021 01:03:10 +0100
Subject: [PATCH 410/682] first working version (complete)

---
 armsrc/Standalone/lf_tharexde.c | 58 ++++++++++++---------------------
 1 file changed, 21 insertions(+), 37 deletions(-)

diff --git a/armsrc/Standalone/lf_tharexde.c b/armsrc/Standalone/lf_tharexde.c
index 41fd96d34..8304edb2a 100644
--- a/armsrc/Standalone/lf_tharexde.c
+++ b/armsrc/Standalone/lf_tharexde.c
@@ -20,20 +20,21 @@
 #include "../em4x50.h"
 
 /*
- * `lf_tharexde` simulates EM4x50 dumps uploaded  words/blocks, reads words of standard read
- * mode of EM4x50 tags and stores them in internal flash.
+ * `lf_tharexde` simulates EM4x50 dumps uploaded to flash, reads words
+ * transmitted by EM4x50 tags in standard read mode and stores them in
+ * internal flash.
  * It requires RDV4 hardware (for flash and battery).
  *
  * On entering stand-alone mode, this module will start simulating EM4x50 data.
  * Data is read from eml dump file uploaded to flash memory.
  *
  * On switching to read/record mode by pressing pm3 button, module will start
- * reading/recording EM4x50 data. Every found / collected data will be
- * written/appended to the logfile in flash as a text string.
+ * reading EM4x50 data. Each collected data set will be written/appended to the
+ * logfile in flash as a text string.
  *
  * LEDs:
  * - LED A: simulating
- * - LED B: reading / record
+ * - LED B: reading/recording
  * - LED C: writing to flash
  * - LED D: unmounting/sync'ing flash (normally < 100ms)
  *
@@ -124,11 +125,10 @@ void RunMod(void) {
 
     bool state_change = true;
     int no_words = 0, command = 0;
-    uint8_t entry[81], state = STATE_SIM;
+    uint8_t entry[400], state = STATE_SIM;
     uint32_t tag[EM4X50_NO_WORDS] = {0x0};
 
     rdv40_spiffs_lazy_mount();
-
     StandAloneMode();
     Dbprintf(_YELLOW_("Standalone mode THAREXDE started"));
 
@@ -144,10 +144,7 @@ void RunMod(void) {
         int button_pressed = BUTTON_CLICKED(1000);
         if (button_pressed == BUTTON_SINGLE_CLICK) {
 
-            SpinUp(100);
-
             switch (state) {
-
                 case STATE_SIM:
                     state = STATE_READ;
                     break;
@@ -161,7 +158,6 @@ void RunMod(void) {
             state_change = true;
 
         } else if (button_pressed == BUTTON_HOLD) {
-            SpinDown(100);
             break;
         }
 
@@ -210,47 +206,35 @@ void RunMod(void) {
                 LEDsoff();
                 LED_B_ON();
                 Dbprintf("");
-                Dbprintf(_YELLOW_("switched to EM4x50 reading mode"));
-
-                memset(entry, 0, sizeof(entry));
-                memset(tag, 0, sizeof(tag));
+                Dbprintf(_YELLOW_("switched to EM4x50 reading mode\n"));
 
                 log_exists = exists_in_spiffs(LF_EM4X50_LOGFILE_COLLECT);
-                
                 em4x50_setup_read();
-                
                 state_change = false;
             }
 
+            no_words = 0;
+            memset(tag, 0, sizeof(tag));
             standard_read(&no_words, tag);
 
-            // reset timers
-            AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; // re-enable timer and wait for TC0
-            AT91C_BASE_TC0->TC_RC  = 0; // set TIOA (carry bit) on overflow, return to zero
-            AT91C_BASE_TC0->TC_RA  = 1; // clear carry bit on next clock cycle
-            AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; // reset and re-enable timer
-
             if (no_words > 0) {
 
                 memset(entry, 0, sizeof(entry));
 
-                Dbprintf("");
-                sprintf((char *)entry, "found new EM4x50 tag:");
-                Dbprintf("%s", entry);
-                strcat((char *)entry, "\n");
-                append(LF_EM4X50_LOGFILE_COLLECT, entry, strlen((char *)entry));
-
+                sprintf((char *)entry, "found EM4x50 tag:\n");
                 for (int i = 0; i < no_words; i++) {
-
-                    sprintf((char *)entry, "  %2i -> 0x%08"PRIx32"", i + 1, tag[i]);
-                    Dbprintf("%s", entry);
-                    strcat((char *)entry, "\n");
-                    append(LF_EM4X50_LOGFILE_COLLECT, entry, strlen((char *)entry));
+                    sprintf((char *)entry + strlen((char *)entry), "%08"PRIx32"\n", tag[i]);
                 }
+                Dbprintf("%s", entry);
+                sprintf((char *)entry + strlen((char *)entry), "\n");
+                append(LF_EM4X50_LOGFILE_COLLECT, entry, strlen((char *)entry));
             }
-            
-            memset(tag, 0, sizeof(tag));
-            no_words = 0;
+
+            // reset timer
+            AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; // re-enable timer and wait for TC0
+            AT91C_BASE_TC0->TC_RC  = 0; // set TIOA (carry bit) on overflow, return to zero
+            AT91C_BASE_TC0->TC_RA  = 1; // clear carry bit on next clock cycle
+            AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; // reset and re-enable timer
         }
     }
 

From 1c3d3b350a709bd95142aecae6d289a8a2828341 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Wed, 27 Jan 2021 01:10:57 +0100
Subject: [PATCH 411/682] - used WaitUS() instead of own function for reading
 operations - used GetTicks() instead of using direct timer TC0 => standalone
 mode functions can be simplified significantly

---
 armsrc/em4x50.c | 114 ++++++++++--------------------------------------
 1 file changed, 23 insertions(+), 91 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index 49fa0221e..b2107298c 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -28,11 +28,12 @@
 #define T0                                  192
 #endif
 
-// the following terms are used (for carrier frequency of 125 kHz):
+// conversions (carrier frequency 125 kHz):
 // 1 us = 1.5 ticks
 // 1 cycle = 1 period = 8 us = 12 ticks
-// 1 bit = 64 cycles = 768 ticks = 512 us
+// 1 bit = 64 cycles = 768 ticks = 512 us (for Opt64)
 #define CYCLES2TICKS                        12
+#define CYCLES2MUSEC                        8
 
 // given in cycles/periods
 #define EM4X50_T_TAG_QUARTER_PERIOD         16
@@ -46,8 +47,8 @@
 #define EM4X50_T_TAG_WAITING_FOR_SIGNAL     75
 #define EM4X50_T_WAITING_FOR_DBLLIW         1550
 #define EM4X50_T_WAITING_FOR_ACK            4
-#define EM4X50_TAG_TOLERANCE                8
-#define EM4X50_ZERO_DETECTION               3
+#define EM4X50_T_TOLERANCE                  8
+#define EM4X50_T_ZERO_DETECTION             3
 
 // timeout values (empirical) for simulation mode (may vary with regard to reader)
 #define EM4X50_T_SIMULATION_TIMEOUT_READ    600
@@ -72,17 +73,6 @@ bool gLogin = false;
 // to be able to identfiy it
 bool gWritePasswordProcess = false;
 
-// do nothing for <period> using timer0
-static void wait_timer(uint32_t period) {
-    
-    int timeout = period;
-    uint32_t tval = GetTicks();
-    
-    //AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
-    //while (AT91C_BASE_TC0->TC_CV < period);
-    while ((timeout--) && (GetTicks() - tval < period));
-}
-
 // extract and check parities
 // return result of parity check and extracted plain data
 static bool extract_parities(uint64_t word, uint32_t *data) {
@@ -142,7 +132,6 @@ void em4x50_setup_read(void) {
     StartTicks();
     
     // 50ms for the resonant antenna to settle.
-    //SpinDelay(50);
     WaitMS(50);
 
     // Now set up the SSC to get the ADC samples that are now streaming at us.
@@ -161,27 +150,6 @@ void em4x50_setup_read(void) {
     // Disable modulation at default, which means enable the field
     LOW(GPIO_SSC_DOUT);
 
-    /*
-    // Enable Peripheral Clock for
-    //   TIMER_CLOCK0, used to measure exact timing before answering
-    AT91C_BASE_PMC->PMC_PCER |= (1 << AT91C_ID_TC0);// | (1 << AT91C_ID_TC1);
-    AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME;
-
-    // Disable timer during configuration
-    AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;
-
-    // TC0: Capture mode, default timer source = MCK/2 (TIMER_CLOCK1), no triggers
-    AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK;
-
-    // TC1: Capture mode, default timer source = MCK/2 (TIMER_CLOCK1), no triggers
-
-    // Enable and reset counters
-    AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
-
-    // synchronized startup procedure
-    while (AT91C_BASE_TC0->TC_CV > 0) {}; // wait until TC1 returned to zero
-    */
-     
     // Watchdog hit
     WDT_HIT();
 }
@@ -196,13 +164,6 @@ void em4x50_setup_sim(void) {
     AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK;
     
     StartTicks();
-    /*
-    AT91C_BASE_PMC->PMC_PCER |= (1 << AT91C_ID_TC0);
-    AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME;
-    AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;
-    AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK;
-    AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
-    */
      
     // Watchdog hit
     WDT_HIT();
@@ -231,8 +192,7 @@ bool get_signalproperties(void) {
         if (BUTTON_PRESS()) return false;
 
         // about 2 samples per bit period
-        //wait_timer(T0 * EM4X50_T_TAG_HALF_PERIOD);
-        wait_timer(12 * EM4X50_T_TAG_HALF_PERIOD);
+        WaitUS(EM4X50_T_TAG_HALF_PERIOD * CYCLES2MUSEC);
 
         // ignore first samples
         if ((i > SIGNAL_IGNORE_FIRST_SAMPLES) && (AT91C_BASE_SSC->SSC_RHR > noise)) {
@@ -250,8 +210,6 @@ bool get_signalproperties(void) {
     // 3 single "full periods" to eliminate the influence of a listen window
     for (int i = 0; i < no_periods; i++) {
 
-        //AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
-        //while (AT91C_BASE_TC0->TC_CV < T0 * 3 * EM4X50_T_TAG_FULL_PERIOD) {
         tval = GetTicks();
         while (GetTicks() - tval < 12 * 3 * EM4X50_T_TAG_FULL_PERIOD) {
 
@@ -284,14 +242,12 @@ bool get_signalproperties(void) {
 static bool invalid_bit(void) {
 
     // get sample at 3/4 of bit period
-    //wait_timer(T0 * EM4X50_T_TAG_THREE_QUARTER_PERIOD);
-    wait_timer(12 * EM4X50_T_TAG_THREE_QUARTER_PERIOD);
+    WaitUS(EM4X50_T_TAG_THREE_QUARTER_PERIOD * CYCLES2MUSEC);
 
     uint8_t sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 
     // wait until end of bit period
-    //wait_timer(T0 * EM4X50_T_TAG_QUARTER_PERIOD);
-    wait_timer(12 * EM4X50_T_TAG_QUARTER_PERIOD);
+    WaitUS(EM4X50_T_TAG_QUARTER_PERIOD * CYCLES2MUSEC);
 
     // bit in "undefined" state?
     if (sample <= gHigh && sample >= gLow)
@@ -314,7 +270,6 @@ static uint32_t get_pulse_length(void) {
     if (timeout == 0)
         return 0;
 
-    //AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
     tval = GetTicks();
     timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD);
 
@@ -331,23 +286,20 @@ static uint32_t get_pulse_length(void) {
     if (timeout == 0)
         return 0;
 
-    //return (uint32_t)AT91C_BASE_TC0->TC_CV;
     return GetTicks() - tval;
 
 }
 
 // check if pulse length <pl> corresponds to given length <length>
 static bool check_pulse_length(uint32_t pl, int length) {
-    //return ((pl >= T0 * (length - EM4X50_TAG_TOLERANCE)) && (pl <= T0 * (length + EM4X50_TAG_TOLERANCE)));
-    return ((pl >= 12 * (length - EM4X50_TAG_TOLERANCE)) && (pl <= 12 * (length + EM4X50_TAG_TOLERANCE)));
+    return ((pl >= (length - EM4X50_T_TOLERANCE) * CYCLES2TICKS) &&
+            (pl <= (length + EM4X50_T_TOLERANCE) * CYCLES2TICKS));
 }
 
 // send single bit according to EM4x50 application note and datasheet
 static void em4x50_reader_send_bit(int bit) {
-    int timeout = 500;
 
     // reset clock for the next bit
-    //AT91C_BASE_TC0->TC_CCR = AT91C_TC_SWTRG;
     uint32_t tval = GetTicks();
 
     if (bit == 0) {
@@ -356,34 +308,22 @@ static void em4x50_reader_send_bit(int bit) {
         // period (Opt64)
         LOW(GPIO_SSC_DOUT);
         //while (AT91C_BASE_TC0->TC_CV < T0 * 7);
-        while ((timeout--) && (GetTicks() - tval < 12 * 7));
-        if (timeout <= 0)
-            return;
-        timeout = 500;
+        while (GetTicks() - tval < 7 * CYCLES2TICKS);
         
         // enable modulation (drop the field) for remaining first
         // half of bit period
         HIGH(GPIO_SSC_DOUT);
-        //while (AT91C_BASE_TC0->TC_CV < T0 * EM4X50_T_TAG_HALF_PERIOD);
-        while ((timeout--) && (GetTicks() - tval < 12 * EM4X50_T_TAG_HALF_PERIOD));
-        if (timeout <= 0)
-            return;
-        timeout = 500;
+        while (GetTicks() - tval < EM4X50_T_TAG_HALF_PERIOD * CYCLES2TICKS);
 
         // disable modulation for second half of bit period
         LOW(GPIO_SSC_DOUT);
-        //while (AT91C_BASE_TC0->TC_CV < T0 * EM4X50_T_TAG_FULL_PERIOD);
-        while ((timeout--) && (GetTicks() - tval < 12 * EM4X50_T_TAG_FULL_PERIOD));
-        if (timeout <= 0)
-            return;
-        timeout = 500;
+        while (GetTicks() - tval < EM4X50_T_TAG_FULL_PERIOD * CYCLES2TICKS);
 
     } else {
 
         // bit = "1" means disable modulation for full bit period
         LOW(GPIO_SSC_DOUT);
-        //while (AT91C_BASE_TC0->TC_CV < T0 * EM4X50_T_TAG_FULL_PERIOD);
-        while ((timeout--) && (GetTicks() - tval < 12 * EM4X50_T_TAG_FULL_PERIOD));
+        while (GetTicks() - tval < EM4X50_T_TAG_FULL_PERIOD * CYCLES2TICKS);
     }
 }
 
@@ -483,8 +423,7 @@ static int find_double_listen_window(bool bcommand) {
                     // second window follows - sync on this to issue a command
 
                     // skip the next bit...
-                    //wait_timer(T0 * EM4X50_T_TAG_FULL_PERIOD);
-                    wait_timer(12 * EM4X50_T_TAG_FULL_PERIOD);
+                    WaitUS(EM4X50_T_TAG_FULL_PERIOD * CYCLES2MUSEC);
 
                     // ...and check if the following bit does make sense
                     // (if not it is the correct position within the second
@@ -562,8 +501,7 @@ static bool check_ack(bool bliw) {
 
                     // wait for 2 bits (remaining "bit" of ACK signal + first
                     // "bit" of listen window)
-                    //wait_timer(T0 * 2 * EM4X50_T_TAG_FULL_PERIOD);
-                    wait_timer(12 * 2 * EM4X50_T_TAG_FULL_PERIOD);
+                    WaitUS(2 * EM4X50_T_TAG_FULL_PERIOD * CYCLES2MUSEC);
 
                     // check for listen window (if first bit cannot be interpreted
                     // as a valid bit it must belong to a listen window)
@@ -694,8 +632,7 @@ static bool login(uint32_t password) {
         // send password
         em4x50_reader_send_word(password);
 
-        //wait_timer(T0 * EM4X50_T_TAG_TPP);
-        wait_timer(12 * EM4X50_T_TAG_TPP);
+        WaitUS(EM4X50_T_TAG_TPP * CYCLES2MUSEC);
 
         // check if ACK is returned
         if (check_ack(false))
@@ -1000,8 +937,7 @@ static int write(uint32_t word, uint32_t addresses) {
         } else {
 
             // wait for T0 * EM4X50_T_TAG_TWA (write access time)
-            //wait_timer(T0 * EM4X50_T_TAG_TWA);
-            wait_timer(12 * EM4X50_T_TAG_TWA);
+            WaitUS(EM4X50_T_TAG_TWA * CYCLES2MUSEC);
 
             // look for ACK sequence
             if (check_ack(false)) {
@@ -1009,8 +945,7 @@ static int write(uint32_t word, uint32_t addresses) {
                 // now EM4x50 needs T0 * EM4X50_T_TAG_TWEE (EEPROM write time = 3.2ms = 50 * 64 periods)
                 // for saving data and should return with ACK
                 for (int i = 0; i < 50; i++) {
-                    //wait_timer(T0 * EM4X50_T_TAG_FULL_PERIOD);
-                    wait_timer(12 * EM4X50_T_TAG_FULL_PERIOD);
+                    WaitUS(EM4X50_T_TAG_FULL_PERIOD * CYCLES2MUSEC);
                 }
 
                 if (check_ack(false))
@@ -1041,8 +976,7 @@ static int write_password(uint32_t password, uint32_t new_password) {
         } else {
 
             // wait for T0 * EM4x50_T_TAG_TPP (processing pause time)
-            //wait_timer(T0 * EM4X50_T_TAG_TPP);
-            wait_timer(12 * EM4X50_T_TAG_TPP);
+            WaitUS(EM4X50_T_TAG_TPP * CYCLES2MUSEC);
 
             // look for ACK sequence and send rm request
             // during following listen window
@@ -1052,16 +986,14 @@ static int write_password(uint32_t password, uint32_t new_password) {
                 em4x50_reader_send_word(new_password);
 
                 // wait for T0 * EM4X50_T_TAG_TWA (write access time)
-                //wait_timer(T0 * EM4X50_T_TAG_TWA);
-                wait_timer(12 * EM4X50_T_TAG_TWA);
+                WaitUS(EM4X50_T_TAG_TWA * CYCLES2MUSEC);
 
                 if (check_ack(false)) {
 
                     // now EM4x50 needs T0 * EM4X50_T_TAG_TWEE (EEPROM write time = 3.2ms = 50 * 64 periods)
                     // for saving data and should return with ACK
                     for (int i = 0; i < 50; i++) {
-                        //wait_timer(T0 * EM4X50_T_TAG_FULL_PERIOD);
-                        wait_timer(12 * EM4X50_T_TAG_FULL_PERIOD);
+                        WaitUS(EM4X50_T_TAG_FULL_PERIOD * CYCLES2MUSEC);
                     }
 
                     if (check_ack(false))
@@ -1276,7 +1208,7 @@ static int em4x50_sim_read_bit(void) {
         while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
 
             // check if current cycle takes longer than "usual""
-            if (GetTicks() - tval > EM4X50_ZERO_DETECTION * CYCLES2TICKS) {
+            if (GetTicks() - tval > EM4X50_T_ZERO_DETECTION * CYCLES2TICKS) {
 
                 // gap detected; wait until reader field is switched on again
                 while ((timeout--) && (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));

From d39e0939b6139d662f8eba63536201800a273d12 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 27 Jan 2021 09:09:42 +0100
Subject: [PATCH 412/682] fix t55xx protect/recoverpw - make param pwd optional

---
 client/src/cmdlft55xx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index 675e37af3..cd4947b4d 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -3310,7 +3310,7 @@ static int CmdT55xxRecoverPW(const char *Cmd) {
     // 2 + (5 or 6)
     void *argtable[8] = {
         arg_param_begin,
-        arg_str1("p", "pwd", "<hex>", "password (4 hex bytes)"),
+        arg_str0("p", "pwd", "<hex>", "password (4 hex bytes)"),
     };
     uint8_t idx = 2;
     arg_add_t55xx_downloadlink(argtable, &idx, T55XX_DLMODE_ALL, T55XX_DLMODE_ALL);
@@ -3758,7 +3758,7 @@ static int CmdT55xxProtect(const char *Cmd) {
     void *argtable[4 + 5] = {
         arg_param_begin,
         arg_lit0("o", "override", "override safety check"),
-        arg_str1("p", "pwd", "<hex>", "password (4 hex bytes)"),
+        arg_str0("p", "pwd", "<hex>", "password (4 hex bytes)"),
         arg_str1("n", "new", "<hex>", "new password (4 hex bytes)"),
     };
     uint8_t idx = 4;

From 2218b4e7db5ecc06b266ee27e033e56daa937f73 Mon Sep 17 00:00:00 2001
From: Eloff <eloff@mail.ru>
Date: Wed, 27 Jan 2021 14:43:50 +0300
Subject: [PATCH 413/682] minor fix

---
 client/src/cmdtrace.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdtrace.c b/client/src/cmdtrace.c
index d53f47883..a95503813 100644
--- a/client/src/cmdtrace.c
+++ b/client/src/cmdtrace.c
@@ -615,7 +615,7 @@ int CmdTraceList(const char *Cmd) {
                   "trace list -t hitags   -> interpret as " _YELLOW_("HitagS") " communications\n"
                   "trace list -t lto      -> interpret as " _YELLOW_("LTO-CM") " communications\n"
                   "trace list -t cryptorf -> interpret as " _YELLOW_("CryptoRF") " communitcations\n"
-                  "trace list -t mf -d <mfc_default_keys.dic>    -> use dictionary keys file\n"
+                  "trace list -t mf --dict <mfc_default_keys>    -> use dictionary keys file\n"
                   "trace list -t 14a -f                          -> show frame delay times\n"
                   "trace list -t 14a -1                          -> use trace buffer "
                  );
@@ -630,7 +630,7 @@ int CmdTraceList(const char *Cmd) {
         arg_lit0("x", NULL, "show hexdump to convert to pcap(ng)\n"
                  "                                   or to import into Wireshark using encapsulation type \"ISO 14443\""),
         arg_strx0("t", "type", NULL, "protocol to annotate the trace"),
-        arg_strx0("d", "dict", NULL, "use dictionary keys file"),
+        arg_strx0(NULL, "dict", "<file>", "use dictionary keys file"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);
@@ -648,8 +648,11 @@ int CmdTraceList(const char *Cmd) {
     str_lower(type);
 
     int diclen = 0;
-    char dictionary[FILE_PATH_SIZE] = {0};
-    CLIParamStrToBuf(arg_get_str(ctx, 8), (uint8_t *)dictionary, sizeof(dictionary), &diclen);
+    char dictionary[FILE_PATH_SIZE + 2] = {0};
+    if (CLIParamStrToBuf(arg_get_str(ctx, 8), (uint8_t *)dictionary, FILE_PATH_SIZE, &diclen)) {
+        PrintAndLogEx(FAILED, "Dictionary file name too long or invalid.");
+        diclen = 0;
+    }
 
     CLIParserFree(ctx);
 

From 35cc4125bddebcafae58d68ae057f79da5ad6ba3 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 27 Jan 2021 14:11:36 +0100
Subject: [PATCH 414/682] lf search - now use cliparser

---
 client/src/cmdlf.c | 60 +++++++++++++++++++++++-----------------------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index 2ee55eebf..4999c4d1e 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -216,20 +216,7 @@ static int usage_lf_simpsk(void) {
     PrintAndLogEx(NORMAL, "       d <hexdata>    Data to sim as hex - omit to sim from DemodBuffer");
     return PM3_SUCCESS;
 }
-static int usage_lf_find(void) {
-    PrintAndLogEx(NORMAL, "Usage:  lf search [h] <0|1> [u]");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h             This help");
-    PrintAndLogEx(NORMAL, "       <0|1>         Use data from Graphbuffer, if not set, try reading data from tag.");
-    PrintAndLogEx(NORMAL, "       u             Search for Unknown tags, if not set, reads only known tags.");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL,  _YELLOW_("      lf search") "      - try reading data from tag & search for known tags");
-    PrintAndLogEx(NORMAL,  _YELLOW_("      lf search 1") "    - use data from GraphBuffer & search for known tags");
-    PrintAndLogEx(NORMAL,  _YELLOW_("      lf search u") "    - try reading data from tag & search for known and unknown tags");
-    PrintAndLogEx(NORMAL,  _YELLOW_("      lf search 1 u") "  - use data from GraphBuffer & search for known and unknown tags");
-    return PM3_SUCCESS;
-}
+
 
 static int CmdLFTune(const char *Cmd) {
 
@@ -1405,22 +1392,33 @@ out:
 }
 
 int CmdLFfind(const char *Cmd) {
-    int retval = PM3_SUCCESS;
-    int ans = 0;
-    size_t minLength = 2000;
-    char cmdp = tolower(param_getchar(Cmd, 0));
-    char testRaw = param_getchar(Cmd, 1);
 
-    if (strlen(Cmd) > 3 || cmdp == 'h') return usage_lf_find();
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf search",
+                  "Read and search for valid known tag. For offline mode, you can `data load` first then search.",
+                  "lf search       -> try reading data from tag & search for known tag\n"
+                  "lf search -1    -> use data from GraphBuffer & search for known tag\n"
+                  "lf search -u    -> try reading data from tag & search for known and unknown tag\n"
+                  "lf search -1u   -> use data from GraphBuffer & search for known and unknown tag\n"
+                 );
 
-    if (cmdp == 'u') testRaw = 'u';
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0("1", NULL, "Use data from Graphbuffer to search"),
+        arg_lit0("u", NULL, "Search for unknown tags, if not set, reads only known tags"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool use_gb = arg_get_lit(ctx, 1);
+    bool search_unk = arg_get_lit(ctx, 2);
+    CLIParserFree(ctx);
 
-    bool isOnline = (session.pm3_present && (cmdp != '1'));
-
-    if (isOnline)
+    bool is_online = (session.pm3_present && (use_gb == false));
+    if (is_online)
         lf_read(false, 30000);
 
-    if (GraphTraceLen < minLength) {
+    size_t min_length = 2000;
+    if (GraphTraceLen < min_length) {
         PrintAndLogEx(FAILED, "Data in Graphbuffer was too small.");
         return PM3_ESOFT;
     }
@@ -1434,7 +1432,7 @@ int CmdLFfind(const char *Cmd) {
     PrintAndLogEx(INFO, "");
 
     // only run these tests if device is online
-    if (isOnline) {
+    if (is_online) {
 
         if (IfPm3Hitag()) {
             if (readHitagUid()) {
@@ -1474,6 +1472,8 @@ int CmdLFfind(const char *Cmd) {
         }
     }
 
+    int retval = PM3_SUCCESS;
+
     if (demodVisa2k(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Visa2000 ID") " found!"); goto out;}
     if (demodDestron(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("FDX-A FECAVA Destron ID") " found!"); goto out;} // to do before HID
     if (demodHID(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("HID Prox ID") " found!"); goto out;}
@@ -1502,10 +1502,10 @@ int CmdLFfind(const char *Cmd) {
 
     PrintAndLogEx(FAILED, _RED_("No known 125/134 kHz tags found!"));
 
-    if (testRaw == 'u') {
+    if (search_unk) {
         //test unknown tag formats (raw mode)
         PrintAndLogEx(INFO, "\nChecking for unknown tags:\n");
-        ans = AutoCorrelate(GraphBuffer, GraphBuffer, GraphTraceLen, 8000, false, false);
+        int ans = AutoCorrelate(GraphBuffer, GraphBuffer, GraphTraceLen, 8000, false, false);
         if (ans > 0) {
 
             PrintAndLogEx(INFO, "Possible auto correlation of %d repeating samples", ans);
@@ -1544,7 +1544,7 @@ int CmdLFfind(const char *Cmd) {
 
 out:
     // identify chipset
-    if (CheckChipType(isOnline) == false) {
+    if (CheckChipType(is_online) == false) {
         PrintAndLogEx(DEBUG, "Automatic chip type detection " _RED_("failed"));
         retval = false;
     }
@@ -1586,7 +1586,7 @@ static command_t CommandTable[] = {
     {"config",      CmdLFConfig,        IfPm3Lf,         "Get/Set config for LF sampling, bit/sample, decimation, frequency"},
     {"cmdread",     CmdLFCommandRead,   IfPm3Lf,         "Modulate LF reader field to send command before read (all periods in microseconds)"},
     {"read",        CmdLFRead,          IfPm3Lf,         "Read LF tag"},
-    {"search",      CmdLFfind,          AlwaysAvailable, "Read and Search for valid known tag (in offline mode it you can load first then search)"},
+    {"search",      CmdLFfind,          AlwaysAvailable, "Read and Search for valid known tag"},
     {"sim",         CmdLFSim,           IfPm3Lf,         "Simulate LF tag from buffer with optional GAP (in microseconds)"},
     {"simask",      CmdLFaskSim,        IfPm3Lf,         "Simulate " _YELLOW_("LF ASK tag") " from demodbuffer or input"},
     {"simfsk",      CmdLFfskSim,        IfPm3Lf,         "Simulate " _YELLOW_("LF FSK tag") " from demodbuffer or input"},

From 3176d05a2afba14a835f7b90f6136d92935188b7 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 27 Jan 2021 14:14:59 +0100
Subject: [PATCH 415/682] lf simbidir - now use cliparser

---
 client/src/cmdlf.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index 4999c4d1e..00f0dea27 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -217,7 +217,6 @@ static int usage_lf_simpsk(void) {
     return PM3_SUCCESS;
 }
 
-
 static int CmdLFTune(const char *Cmd) {
 
     CLIParserContext *ctx;
@@ -1250,7 +1249,20 @@ int CmdLFpskSim(const char *Cmd) {
 }
 
 int CmdLFSimBidir(const char *Cmd) {
-    (void)Cmd; // Cmd is not used so far
+
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf simbidir",
+                  "Simulate LF tag with bidirectional data transmission between reader and tag",
+                  "lf simbidir"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
+
     // Set ADC to twice the carrier for a slight supersampling
     // HACK: not implemented in ARMSRC.
     PrintAndLogEx(INFO, "Not implemented yet.");
@@ -1591,7 +1603,7 @@ static command_t CommandTable[] = {
     {"simask",      CmdLFaskSim,        IfPm3Lf,         "Simulate " _YELLOW_("LF ASK tag") " from demodbuffer or input"},
     {"simfsk",      CmdLFfskSim,        IfPm3Lf,         "Simulate " _YELLOW_("LF FSK tag") " from demodbuffer or input"},
     {"simpsk",      CmdLFpskSim,        IfPm3Lf,         "Simulate " _YELLOW_("LF PSK tag") " from demodbuffer or input"},
-//    {"simpsk",      CmdLFnrzSim,        IfPm3Lf,         "Simulate " _YELLOW_("LF NRZ tag") " from demodbuffer or input"},
+//    {"simnrz",      CmdLFnrzSim,        IfPm3Lf,         "Simulate " _YELLOW_("LF NRZ tag") " from demodbuffer or input"},
     {"simbidir",    CmdLFSimBidir,      IfPm3Lf,         "Simulate LF tag (with bidirectional data transmission between reader and tag)"},
     {"sniff",       CmdLFSniff,         IfPm3Lf,         "Sniff LF traffic between reader and tag"},
     {"tune",        CmdLFTune,          IfPm3Lf,         "Continuously measure LF antenna tuning"},

From 7f78b0a85dc60394dc00e7048e93e20d695ceba6 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 27 Jan 2021 14:36:43 +0100
Subject: [PATCH 416/682] text and test fix for lf search

---
 client/luascripts/tests/data_tracetest.lua |  6 +-
 doc/cliparser_todo.txt                     |  3 +-
 tools/pm3_tests.sh                         | 92 +++++++++++-----------
 3 files changed, 50 insertions(+), 51 deletions(-)

diff --git a/client/luascripts/tests/data_tracetest.lua b/client/luascripts/tests/data_tracetest.lua
index 1e75b707b..5773e0bcf 100644
--- a/client/luascripts/tests/data_tracetest.lua
+++ b/client/luascripts/tests/data_tracetest.lua
@@ -7,11 +7,11 @@ local ansicolors = require('ansicolors')
 
 copyright = ''
 author = 'Iceman'
-version = 'v1.0.3'
+version = 'v1.0.4'
 desc = [[
 This script will load several traces files in current working directory/traces/ folder and do
 "data load"
-"lf search 1 u"
+"lf search -1u"
 
 The following tracefiles will be loaded:
    em*.pm3
@@ -109,7 +109,7 @@ local function main(args)
     end
     p.close();
 
-    local cmdLFSEARCH = 'lf search 1 u'
+    local cmdLFSEARCH = 'lf search -1u'
 
     -- main loop
     io.write('Starting to test traces > ')
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 335c6491f..0738d589e 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -1,5 +1,6 @@
 clear
 pref
+analyse foo
 data biphaserawdecode
 data detectclock
 data fsktonrz
@@ -95,12 +96,10 @@ hf mf ice
 lf config
 lf cmdread
 lf read
-lf search
 lf sim
 lf simask
 lf simfsk
 lf simpsk
-lf simbidir
 lf sniff
 lf em 410x
 lf em 4x05
diff --git a/tools/pm3_tests.sh b/tools/pm3_tests.sh
index 3c59949ee..0ef81b7c5 100755
--- a/tools/pm3_tests.sh
+++ b/tools/pm3_tests.sh
@@ -347,112 +347,112 @@ while true; do
       if ! CheckExecute "trace load/list x"       "$CLIENTBIN -c 'trace load -f traces/hf_14a_mfu.trace; trace list -x1 -t 14a;'" "0.0101840425"; then break; fi
 
       echo -e "\n${C_BLUE}Testing LF:${C_NC}"
-      if ! CheckExecute "lf AWID test"          "$CLIENTBIN -c 'data load -f traces/lf_AWID-15-259.pm3;lf search 1'" "AWID ID found"; then break; fi
-      if ! CheckExecute "lf EM410x test"        "$CLIENTBIN -c 'data load -f traces/lf_EM4102-1.pm3;lf search 1'" "EM410x ID found"; then break; fi
-      if ! CheckExecute "lf EM4x05 test"        "$CLIENTBIN -c 'data load -f traces/lf_EM4x05.pm3;lf search 1'" "FDX-B ID found"; then break; fi
-      if ! CheckExecute "lf FDX-A FECAVA test"  "$CLIENTBIN -c 'data load -f traces/lf_EM4305_fdxa_destron.pm3;lf search 1'" "FDX-A FECAVA Destron ID found"; then break; fi
-      if ! CheckExecute "lf FDX-B test"         "$CLIENTBIN -c 'data load -f traces/lf_HomeAgain1600.pm3;lf search 1'" "FDX-B ID found"; then break; fi
+      if ! CheckExecute "lf AWID test"          "$CLIENTBIN -c 'data load -f traces/lf_AWID-15-259.pm3;lf search -1'" "AWID ID found"; then break; fi
+      if ! CheckExecute "lf EM410x test"        "$CLIENTBIN -c 'data load -f traces/lf_EM4102-1.pm3;lf search -1'" "EM410x ID found"; then break; fi
+      if ! CheckExecute "lf EM4x05 test"        "$CLIENTBIN -c 'data load -f traces/lf_EM4x05.pm3;lf search -1'" "FDX-B ID found"; then break; fi
+      if ! CheckExecute "lf FDX-A FECAVA test"  "$CLIENTBIN -c 'data load -f traces/lf_EM4305_fdxa_destron.pm3;lf search -1'" "FDX-A FECAVA Destron ID found"; then break; fi
+      if ! CheckExecute "lf FDX-B test"         "$CLIENTBIN -c 'data load -f traces/lf_HomeAgain1600.pm3;lf search -1'" "FDX-B ID found"; then break; fi
       if ! CheckExecute "lf FDX/BioThermo test" "$CLIENTBIN -c 'data load -f traces/lf_FDXB_Bio-Thermo.pm3; lf fdxb demod'" "95.2 F / 35.1 C"; then break; fi
-      if ! CheckExecute "lf GPROXII test"       "$CLIENTBIN -c 'data load -f traces/lf_GProx_36_30_14489.pm3; lf search 1'" "Guardall G-Prox II ID found"; then break; fi
-      if ! CheckExecute "lf HID Prox test"      "$CLIENTBIN -c 'data load -f traces/lf_HID-proxCardII-05512-11432784-1.pm3;lf search 1'" "HID Prox ID found"; then break; fi
-      if ! CheckExecute "lf IDTECK test"        "$CLIENTBIN -c 'data load -f traces/lf_IDTECK_4944544BAC40E069.pm3; lf search 1'" "Idteck ID found"; then break; fi
-      if ! CheckExecute "lf INDALA test"        "$CLIENTBIN -c 'data load -f traces/lf_Indala-504278295.pm3;lf search 1'" "Indala ID found"; then break; fi
-      if ! CheckExecute "lf KERI test"          "$CLIENTBIN -c 'data load -f traces/lf_Keri.pm3;lf search 1'" "Pyramid ID found"; then break; fi
-      if ! CheckExecute "lf NEXWATCH test"      "$CLIENTBIN -c 'data load -f traces/lf_NEXWATCH_Quadrakey-521512301.pm3;lf search 1 '" "NexWatch ID found"; then break; fi
-      if ! CheckExecute "lf SECURAKEY test"     "$CLIENTBIN -c 'data load -f traces/lf_NEXWATCH_Securakey-64169.pm3;lf search 1 '" "Securakey ID found"; then break; fi
-      if ! CheckExecute "lf PAC test"           "$CLIENTBIN -c 'data load -f traces/lf_PAC-8E4C058E.pm3;lf search 1'" "PAC/Stanley ID found"; then break; fi
-      if ! CheckExecute "lf PARADOX test"       "$CLIENTBIN -c 'data load -f traces/lf_Paradox-96_40426-APJN08.pm3;lf search 1'" "Paradox ID found"; then break; fi
-      if ! CheckExecute "lf VIKING test"        "$CLIENTBIN -c 'data load -f traces/lf_Transit999-best.pm3;lf search 1'" "Viking ID found"; then break; fi
-      if ! CheckExecute "lf VISA2000 test"      "$CLIENTBIN -c 'data load -f traces/lf_VISA2000.pm3;lf search 1'" "Visa2000 ID found"; then break; fi
+      if ! CheckExecute "lf GPROXII test"       "$CLIENTBIN -c 'data load -f traces/lf_GProx_36_30_14489.pm3; lf search -1'" "Guardall G-Prox II ID found"; then break; fi
+      if ! CheckExecute "lf HID Prox test"      "$CLIENTBIN -c 'data load -f traces/lf_HID-proxCardII-05512-11432784-1.pm3;lf search -1'" "HID Prox ID found"; then break; fi
+      if ! CheckExecute "lf IDTECK test"        "$CLIENTBIN -c 'data load -f traces/lf_IDTECK_4944544BAC40E069.pm3; lf search -1'" "Idteck ID found"; then break; fi
+      if ! CheckExecute "lf INDALA test"        "$CLIENTBIN -c 'data load -f traces/lf_Indala-504278295.pm3;lf search -1'" "Indala ID found"; then break; fi
+      if ! CheckExecute "lf KERI test"          "$CLIENTBIN -c 'data load -f traces/lf_Keri.pm3;lf search -1'" "Pyramid ID found"; then break; fi
+      if ! CheckExecute "lf NEXWATCH test"      "$CLIENTBIN -c 'data load -f traces/lf_NEXWATCH_Quadrakey-521512301.pm3;lf search -1 '" "NexWatch ID found"; then break; fi
+      if ! CheckExecute "lf SECURAKEY test"     "$CLIENTBIN -c 'data load -f traces/lf_NEXWATCH_Securakey-64169.pm3;lf search -1 '" "Securakey ID found"; then break; fi
+      if ! CheckExecute "lf PAC test"           "$CLIENTBIN -c 'data load -f traces/lf_PAC-8E4C058E.pm3;lf search -1'" "PAC/Stanley ID found"; then break; fi
+      if ! CheckExecute "lf PARADOX test"       "$CLIENTBIN -c 'data load -f traces/lf_Paradox-96_40426-APJN08.pm3;lf search -1'" "Paradox ID found"; then break; fi
+      if ! CheckExecute "lf VIKING test"        "$CLIENTBIN -c 'data load -f traces/lf_Transit999-best.pm3;lf search -1'" "Viking ID found"; then break; fi
+      if ! CheckExecute "lf VISA2000 test"      "$CLIENTBIN -c 'data load -f traces/lf_VISA2000.pm3;lf search -1'" "Visa2000 ID found"; then break; fi
 
-      if ! CheckExecute slow "lf T55 awid 26 test"               "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_awid_26.pm3; lf search 1'" "AWID ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 awid 26 test"               "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_awid_26.pm3; lf search -1'" "AWID ID found"; then break; fi
       if ! CheckExecute slow "lf T55 awid 26 test2"              "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_awid_26.pm3; lf awid demod'" \
                                                                      "AWID - len: 26 FC: 224 Card: 1337 - Wiegand: 3c00a73"; then break; fi
-      if ! CheckExecute slow "lf T55 awid 50 test"               "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_awid_50.pm3; lf search 1'" "AWID ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 awid 50 test"               "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_awid_50.pm3; lf search -1'" "AWID ID found"; then break; fi
       if ! CheckExecute slow "lf T55 awid 50 test2"              "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_awid_50.pm3; lf awid demod'" \
                                                                      "AWID - len: 50 FC: 2001 Card: 13371337 - Wiegand: 20fa201980f92, Raw: 0128b12eb1811d7117e22111"; then break; fi
-      if ! CheckExecute slow "lf T55 em410x test"                "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_em410x.pm3; lf search 1'" "EM410x ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 em410x test"                "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_em410x.pm3; lf search -1'" "EM410x ID found"; then break; fi
       if ! CheckExecute slow "lf T55 em410x test2"               "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_em410x.pm3; lf em 410x demod'" \
                                                                      "EM 410x ID 0F0368568B"; then break; fi
-      if ! CheckExecute slow "lf T55 fdxb_animal test"           "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_fdxb_animal.pm3; lf search 1'" "FDX-B ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 fdxb_animal test"           "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_fdxb_animal.pm3; lf search -1'" "FDX-B ID found"; then break; fi
       if ! CheckExecute slow "lf T55 fdxb_animal test2"          "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_fdxb_animal.pm3; lf fdxb demod'" \
                                                                      "Animal ID          999-000000112233"; then break; fi
-      if ! CheckExecute slow "lf T55 fdxb_extended test"         "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_fdxb_extended.pm3; lf search 1'" "FDX-B ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 fdxb_extended test"         "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_fdxb_extended.pm3; lf search -1'" "FDX-B ID found"; then break; fi
       if ! CheckExecute slow "lf T55 fdxb_extended test2"        "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_fdxb_extended.pm3; lf fdxb demod'" \
                                                                      "temperature     95.2 F / 35.1 C"; then break; fi
-      if ! CheckExecute slow "lf T55 gallagher test"             "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_gallagher.pm3; lf search 1'" "GALLAGHER ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 gallagher test"             "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_gallagher.pm3; lf search -1'" "GALLAGHER ID found"; then break; fi
       if ! CheckExecute slow "lf T55 gallagher test2"            "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_gallagher.pm3; lf gallagher demod'" \
                                                                      "GALLAGHER - Region: 0 FC: 27865 CN: 682758 Issue Level: 13"; then break; fi
-      if ! CheckExecute slow "lf T55 gproxii test"               "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_gproxii.pm3; lf search 1'" "Guardall G-Prox II ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 gproxii test"               "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_gproxii.pm3; lf search -1'" "Guardall G-Prox II ID found"; then break; fi
       if ! CheckExecute slow "lf T55 gproxii test2"              "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_gproxii.pm3; lf gproxii demod'" \
                                                                      "G-Prox-II - len: 26 FC: 123 Card: 11223, Raw: f98c7038c63356c7ac26398c"; then break; fi
-      if ! CheckExecute slow "lf T55 hid test"                   "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_hid.pm3; lf search 1'" "HID Prox ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 hid test"                   "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_hid.pm3; lf search -1'" "HID Prox ID found"; then break; fi
       if ! CheckExecute slow "lf T55 hid test2"                  "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_hid.pm3; lf hid demod'" \
                                                                      "HID H10301 26-bit;  FC: 118  CN: 1603"; then break; fi
-      if ! CheckExecute slow "lf T55 hid_48 test"                "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_hid_48.pm3; lf search 1'" "HID Prox ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 hid_48 test"                "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_hid_48.pm3; lf search -1'" "HID Prox ID found"; then break; fi
       if ! CheckExecute slow "lf T55 hid_48 test2"               "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_hid_48.pm3; lf hid demod'" \
                                                                      "HID Corporate 1000 48-bit"; then break; fi
-      if ! CheckExecute slow "lf T55 indala_hedem test"          "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_indala_hedem.pm3; lf search 1'" "Indala ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 indala_hedem test"          "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_indala_hedem.pm3; lf search -1'" "Indala ID found"; then break; fi
       if ! CheckExecute slow "lf T55 indala_hedem test2"         "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_indala_hedem.pm3; lf indala demod'" \
                                                                      "Heden-2L    \| 888"; then break; fi
-      if ! CheckExecute slow "lf T55 indala test"                "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_indala.pm3; lf search 1'" "Indala ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 indala test"                "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_indala.pm3; lf search -1'" "Indala ID found"; then break; fi
       if ! CheckExecute slow "lf T55 indala test2"               "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_indala.pm3; lf indala demod'" \
                                                                      "Fmt 26 FC: 123 Card: 1337 checksum: 10"; then break; fi
-      if ! CheckExecute slow "lf T55 indala_224 test"            "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_indala_224.pm3; lf search 1'" "Indala ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 indala_224 test"            "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_indala_224.pm3; lf search -1'" "Indala ID found"; then break; fi
       if ! CheckExecute slow "lf T55 indala_224 test2"           "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_indala_224.pm3; lf indala demod'" \
                                                                      "Indala (len 224)  Raw: 80000001b23523a6c2e31eba3cbee4afb3c6ad1fcf649393928c14e5"; then break; fi
-      if ! CheckExecute slow "lf T55 io test"                    "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_io.pm3; lf search 1'" "IO Prox ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 io test"                    "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_io.pm3; lf search -1'" "IO Prox ID found"; then break; fi
       if ! CheckExecute slow "lf T55 io test2"                   "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_io.pm3; lf io demod'" \
                                                                      "IO Prox - XSF(01)01:01337, Raw: 007840603059cf3f (ok)"; then break; fi
-      if ! CheckExecute slow "lf T55 jablotron test"             "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_jablotron.pm3; lf search 1'" "Jablotron ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 jablotron test"             "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_jablotron.pm3; lf search -1'" "Jablotron ID found"; then break; fi
       if ! CheckExecute slow "lf T55 jablotron test2"            "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_jablotron.pm3; lf jablotron demod'" \
                                                                      "Printed: 1410-00-0011-2233"; then break; fi
-      if ! CheckExecute slow "lf T55 keri test"                  "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_keri.pm3; lf search 1'" "KERI ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 keri test"                  "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_keri.pm3; lf search -1'" "KERI ID found"; then break; fi
       if ! CheckExecute slow "lf T55 keri test2"                 "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_keri.pm3; lf keri demod'" \
                                                                      "KERI - Internal ID: 112233, Raw: E00000008001B669"; then break; fi
-      if ! CheckExecute slow "lf T55 keri_internalid test"       "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_keri_internalid.pm3; lf search 1'" "KERI ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 keri_internalid test"       "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_keri_internalid.pm3; lf search -1'" "KERI ID found"; then break; fi
       if ! CheckExecute slow "lf T55 keri_internalid test2"      "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_keri_internalid.pm3; lf keri demod'" \
                                                                      "KERI - Internal ID: 12345, Raw: E000000080003039"; then break; fi
-      if ! CheckExecute slow "lf T55 keri_msid test"             "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_keri_msid.pm3; lf search 1'" "KERI ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 keri_msid test"             "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_keri_msid.pm3; lf search -1'" "KERI ID found"; then break; fi
       if ! CheckExecute slow "lf T55 keri_msid test2"            "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_keri_msid.pm3; lf keri demod'" \
                                                                      "Descrambled MS - FC: 6 Card: 12345"; then break; fi
-#      if ! CheckExecute slow "lf T55 motorola test"              "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_motorola.pm3; lf search 1'" "Indala ID found"; then break; fi
+#      if ! CheckExecute slow "lf T55 motorola test"              "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_motorola.pm3; lf search -1'" "Indala ID found"; then break; fi
       if ! CheckExecute slow "lf T55 motorola test2"             "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_motorola.pm3; lf motorola demod'" \
                                                                      "Motorola - fmt: 26 FC: 258 Card: 2, Raw: A0000000A0002021"; then break; fi
-      if ! CheckExecute slow "lf T55 nedap test"                 "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_nedap.pm3; lf search 1'" "NEDAP ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 nedap test"                 "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_nedap.pm3; lf search -1'" "NEDAP ID found"; then break; fi
       if ! CheckExecute slow "lf T55 nedap test2"                "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_nedap.pm3; lf nedap demod'" \
                                                                      "NEDAP (64b) - ID: 12345 subtype: 1 customer code: 291 / 0x123 Raw: FF82246508209953"; then break; fi
-      if ! CheckExecute slow "lf T55 nexwatch test"              "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_nexwatch.pm3; lf search 1'" "NexWatch ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 nexwatch test"              "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_nexwatch.pm3; lf search -1'" "NexWatch ID found"; then break; fi
       if ! CheckExecute slow "lf T55 nexwatch test2"             "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_nexwatch.pm3; lf nexwatch demod'" \
                                                                      "Raw : 5600000000213C9F8F150C00"; then break; fi
-      if ! CheckExecute slow "lf T55 nexwatch_nexkey test"       "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_nexwatch_nexkey.pm3; lf search 1'" "NexWatch ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 nexwatch_nexkey test"       "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_nexwatch_nexkey.pm3; lf search -1'" "NexWatch ID found"; then break; fi
       if ! CheckExecute slow "lf T55 nexwatch_nexkey test2"      "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_nexwatch_nexkey.pm3; lf nexwatch demod'" \
                                                                      "88bit id : 521512301 (0x1f15a56d)"; then break; fi
-      if ! CheckExecute slow "lf T55 nexwatch_quadrakey test"    "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_nexwatch_quadrakey.pm3; lf search 1'" "NexWatch ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 nexwatch_quadrakey test"    "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_nexwatch_quadrakey.pm3; lf search -1'" "NexWatch ID found"; then break; fi
       if ! CheckExecute slow "lf T55 nexwatch_quadrakey test2"   "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_nexwatch_quadrakey.pm3; lf nexwatch demod'" \
                                                                      "88bit id : 521512301 (0x1f15a56d)"; then break; fi
-      if ! CheckExecute slow "lf T55 noralsy test"               "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_noralsy.pm3; lf search 1'" "Noralsy ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 noralsy test"               "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_noralsy.pm3; lf search -1'" "Noralsy ID found"; then break; fi
       if ! CheckExecute slow "lf T55 noralsy test2"              "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_noralsy.pm3; lf noralsy demod'" \
                                                                      "Noralsy - Card: 112233, Year: 2000, Raw: BB0214FF0110002233070000"; then break; fi
-      if ! CheckExecute slow "lf T55 pac test"                   "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_pac.pm3; lf search 1'" "PAC/Stanley ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 pac test"                   "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_pac.pm3; lf search -1'" "PAC/Stanley ID found"; then break; fi
       if ! CheckExecute slow "lf T55 pac test2"                  "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_pac.pm3; lf pac demod'" \
                                                                      "PAC/Stanley - Card: CD4F5552, Raw: FF2049906D8511C593155B56D5B2649F"; then break; fi
-      if ! CheckExecute slow "lf T55 paradox test"               "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_paradox.pm3; lf search 1'" "Paradox ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 paradox test"               "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_paradox.pm3; lf search -1'" "Paradox ID found"; then break; fi
       if ! CheckExecute slow "lf T55 paradox test2"              "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_paradox.pm3; lf paradox demod'" \
                                                                      "Paradox - ID: 004209dea FC: 96 Card: 40426, Checksum: b2, Raw: 0f55555695596a6a9999a59a"; then break; fi
-      if ! CheckExecute slow "lf T55 presco test"                "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_presco.pm3; lf search 1'" "Presco ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 presco test"                "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_presco.pm3; lf search -1'" "Presco ID found"; then break; fi
       if ! CheckExecute slow "lf T55 presco test2"               "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_presco.pm3; lf presco demod'" \
                                                                      "Presco Site code: 30 User code: 8665 Full code: 1E8021D9 Raw: 10D0000000000000000000001E8021D9"; then break; fi
-      if ! CheckExecute slow "lf T55 pyramid test"               "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_pyramid.pm3; lf search 1'" "Pyramid ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 pyramid test"               "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_pyramid.pm3; lf search -1'" "Pyramid ID found"; then break; fi
       if ! CheckExecute slow "lf T55 pyramid test2"              "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_pyramid.pm3; lf pyramid demod'" \
                                                                      "Pyramid - len: 26, FC: 123 Card: 11223 - Wiegand: 2f657ae, Raw: 00010101010101010101016eb35e5da4"; then break; fi
-      if ! CheckExecute slow "lf T55 securakey test"             "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_securakey.pm3; lf search 1'" "Securakey ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 securakey test"             "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_securakey.pm3; lf search -1'" "Securakey ID found"; then break; fi
       if ! CheckExecute slow "lf T55 securakey test2"            "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_securakey.pm3; lf securakey demod'" \
                                                                      "Securakey - len: 26 FC: 0x35 Card: 64169, Raw: 7FCB400001ADEA5344300000"; then break; fi
-      if ! CheckExecute slow "lf T55 viking test"                "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_viking.pm3; lf search 1'" "Viking ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 viking test"                "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_viking.pm3; lf search -1'" "Viking ID found"; then break; fi
       if ! CheckExecute slow "lf T55 viking test2"               "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_viking.pm3; lf viking demod'" \
                                                                      "Viking - Card 0001A337, Raw: F200000001A337CF"; then break; fi
-      if ! CheckExecute slow "lf T55 visa2000 test"              "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_visa2000.pm3; lf search 1'" "Visa2000 ID found"; then break; fi
+      if ! CheckExecute slow "lf T55 visa2000 test"              "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_visa2000.pm3; lf search -1'" "Visa2000 ID found"; then break; fi
       if ! CheckExecute slow "lf T55 visa2000 test2"             "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_visa2000.pm3; lf visa2000 demod'" \
                                                                      "Visa2000 - Card 112233, Raw: 564953320001B66900000183"; then break; fi
 

From fdcc4b741c0f6debb621fe7d981a8336dff8a50f Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 27 Jan 2021 22:52:08 +0100
Subject: [PATCH 417/682] fix lf em 4x05 write - pwd/data.  t55xx chk - now
 uses cliparser,  and color to cliparser empty message

---
 client/deps/cliparser/cliparser.c |  54 +++++++--
 client/deps/cliparser/cliparser.h |   9 +-
 client/src/cmdanalyse.c           |  18 ++-
 client/src/cmdlfem4x05.c          |  48 +++++---
 client/src/cmdlft55xx.c           | 192 +++++++++++++++---------------
 5 files changed, 197 insertions(+), 124 deletions(-)

diff --git a/client/deps/cliparser/cliparser.c b/client/deps/cliparser/cliparser.c
index 6c249e9cb..f3f3c581e 100644
--- a/client/deps/cliparser/cliparser.c
+++ b/client/deps/cliparser/cliparser.c
@@ -118,7 +118,7 @@ int CLIParserParseArg(CLIParserContext *ctx, int argc, char **argv, void *vargta
     if (nerrors > 0) {
         /* Display the error details contained in the arg_end struct.*/
         arg_print_errors(stdout, ((struct arg_end *)(ctx->argtable)[vargtableLen - 1]), ctx->programName);
-        PrintAndLogEx(WARNING, "Try '%s --help' for more information.\n", ctx->programName);
+        PrintAndLogEx(WARNING, "Try " _YELLOW_("'%s --help'") " for more information.\n", ctx->programName);
         fflush(stdout);
         return 3;
     }
@@ -269,15 +269,19 @@ int CLIParamStrToBuf(struct arg_str *argstr, uint8_t *data, int maxdatalen, int
     return 0;
 }
 
+// hexstr ->  u64,  w optional len input and default value fallback.
+// 0 = failed
+// 1 = OK
+// 3 = optional param - not set
 uint64_t arg_get_u64_hexstr_def(CLIParserContext *ctx, uint8_t paramnum, uint64_t def) {
     uint64_t rv = 0;
-    uint8_t data[8];
-    int datalen = 0;
-    int res = CLIParamHexToBuf(arg_get_str(ctx, paramnum), data, sizeof(data), &datalen);
-    if (res == 0 && datalen > 0) {
-        for (uint8_t i = 0; i < datalen; i++) {
+    uint8_t d[8];
+    int dlen = 0;
+    int res = CLIParamHexToBuf(arg_get_str(ctx, paramnum), d, sizeof(d), &dlen);
+    if (res == 0 && dlen > 0) {
+        for (uint8_t i = 0; i < dlen; i++) {
             rv <<= 8;
-            rv |= data[i];
+            rv |= d[i];
         }
     } else  {
         rv = def;
@@ -285,11 +289,38 @@ uint64_t arg_get_u64_hexstr_def(CLIParserContext *ctx, uint8_t paramnum, uint64_
     return rv;
 }
 
-int arg_get_u32_hexstr_def(CLIParserContext *ctx, uint8_t paramnum, uint32_t def, uint32_t *out) {
-    return arg_get_u32_hexstr_def_nlen(ctx, paramnum, def, out, 4);
+// hexstr ->  u64,  w optional len input and default value fallback.
+// 0 = failed
+// 1 = OK
+// 2 = wrong len param, use default
+// 3 = optional param,  if fail, use default.
+int arg_get_u64_hexstr_def_nlen(CLIParserContext *ctx, uint8_t paramnum, uint64_t def, uint64_t *out, uint8_t nlen, bool optional) {
+    int n = 0;
+    uint8_t d[nlen];
+    int res = CLIParamHexToBuf(arg_get_str(ctx, paramnum), d, sizeof(d), &n);
+    if (res == 0 && n == nlen) {
+        uint64_t rv = 0;
+        for (uint8_t i = 0; i < n; i++) {
+            rv <<= 8;
+            rv |= d[i];
+        }
+        *out = rv;
+        return 1;
+    } else if (res == 0 && n) {
+        *out = def;
+        return 2;
+    } else if (res == 0 && n == 0 && optional) {
+        *out = def;
+        return 3;
+    }
+    return 0;
 }
 
-int arg_get_u32_hexstr_def_nlen(CLIParserContext *ctx, uint8_t paramnum, uint32_t def, uint32_t *out, uint8_t nlen) {
+int arg_get_u32_hexstr_def(CLIParserContext *ctx, uint8_t paramnum, uint32_t def, uint32_t *out) {
+    return arg_get_u32_hexstr_def_nlen(ctx, paramnum, def, out, 4, false);
+}
+
+int arg_get_u32_hexstr_def_nlen(CLIParserContext *ctx, uint8_t paramnum, uint32_t def, uint32_t *out, uint8_t nlen, bool optional) {
     int n = 0;
     uint8_t d[nlen];
     int res = CLIParamHexToBuf(arg_get_str(ctx, paramnum), d, sizeof(d), &n);
@@ -304,6 +335,9 @@ int arg_get_u32_hexstr_def_nlen(CLIParserContext *ctx, uint8_t paramnum, uint32_
     } else if (res == 0 && n) {
         *out = def;
         return 2;
+    } else if (res == 0 && n == 0 && optional) {
+        *out = def;
+        return 3;
     }
     return 0;
 }
diff --git a/client/deps/cliparser/cliparser.h b/client/deps/cliparser/cliparser.h
index 40fd5c2f7..78bb59f32 100644
--- a/client/deps/cliparser/cliparser.h
+++ b/client/deps/cliparser/cliparser.h
@@ -68,6 +68,13 @@ int CLIParamHexToBuf(struct arg_str *argstr, uint8_t *data, int maxdatalen, int
 int CLIParamStrToBuf(struct arg_str *argstr, uint8_t *data, int maxdatalen, int *datalen);
 
 uint64_t arg_get_u64_hexstr_def(CLIParserContext *ctx, uint8_t paramnum, uint64_t def);
+int arg_get_u64_hexstr_def_nlen(CLIParserContext *ctx, uint8_t paramnum, uint64_t def, uint64_t *out, uint8_t nlen, bool optional);
 int arg_get_u32_hexstr_def(CLIParserContext *ctx, uint8_t paramnum, uint32_t def, uint32_t *out);
-int arg_get_u32_hexstr_def_nlen(CLIParserContext *ctx, uint8_t paramnum, uint32_t def, uint32_t *out, uint8_t nlen);
+int arg_get_u32_hexstr_def_nlen(CLIParserContext *ctx, uint8_t paramnum, uint32_t def, uint32_t *out, uint8_t nlen, bool optional);
+
+#define CP_SUCCESS_OPTIONAL  1
+#define CP_SUCCESS           0
+#define CP_ENOPARAM         -1
+#define CP_WRONGLEN         -2
+
 #endif
diff --git a/client/src/cmdanalyse.c b/client/src/cmdanalyse.c
index 02ad3fcd0..4cdd35e68 100644
--- a/client/src/cmdanalyse.c
+++ b/client/src/cmdanalyse.c
@@ -170,6 +170,14 @@ static uint16_t calcBSDchecksum4(uint8_t *bytes, uint8_t len, uint32_t mask) {
     return sum;
 }
 
+// 0xFF - ( n1 ^ n... )
+static uint16_t calcXORchecksum(uint8_t *bytes, uint8_t len, uint32_t mask) {
+    return 0xFF - calcSumByteXor(bytes, len, mask);
+}
+
+
+//2148050707DB0A0E000001C4000000
+
 // measuring LFSR maximum length
 static int CmdAnalyseLfsr(const char *Cmd) {
     CLIParserContext *ctx;
@@ -421,11 +429,12 @@ static int CmdAnalyseCHKSUM(const char *Cmd) {
     PrintAndLogEx(INFO, "Mask value 0x%x", mask);
 
     if (verbose) {
-        PrintAndLogEx(INFO, "     add          | sub         | add 1's compl    | sub 1's compl   | xor");
-        PrintAndLogEx(INFO, "byte nibble crumb | byte nibble | byte nibble cumb | byte nibble     | byte nibble cumb |  BSD       |");
-        PrintAndLogEx(INFO, "------------------+-------------+------------------+-----------------+--------------------");
+        PrintAndLogEx(INFO, "------------------+-------------+------------------+-----------------+------------------+-----------+-------------");
+        PrintAndLogEx(INFO, "     add          | sub         | add 1's compl    | sub 1's compl   | xor              |           |");
+        PrintAndLogEx(INFO, "byte nibble crumb | byte nibble | byte nibble cumb | byte nibble     | byte nibble cumb |  BSD      | 0xFF - (n^n)");
+        PrintAndLogEx(INFO, "------------------+-------------+------------------+-----------------+------------------+-----------+-------------");
     }
-    PrintAndLogEx(INFO, "0x%X 0x%X   0x%X  | 0x%X 0x%X   | 0x%X 0x%X   0x%X | 0x%X 0x%X       | 0x%X 0x%X   0x%X  | 0x%X  0x%X |\n",
+    PrintAndLogEx(INFO, "0x%X 0x%X   0x%X  | 0x%X 0x%X   | 0x%X 0x%X   0x%X | 0x%X 0x%X       | 0x%X 0x%X   0x%X   | 0x%X  0x%X | 0x%X\n",
                   calcSumByteAdd(data, dlen, mask)
                   , calcSumNibbleAdd(data, dlen, mask)
                   , calcSumCrumbAdd(data, dlen, mask)
@@ -441,6 +450,7 @@ static int CmdAnalyseCHKSUM(const char *Cmd) {
                   , calcSumCrumbXor(data, dlen, mask)
                   , calcBSDchecksum8(data, dlen, mask)
                   , calcBSDchecksum4(data, dlen, mask)
+                  , calcXORchecksum(data, dlen, mask)
                  );
     return PM3_SUCCESS;
 }
diff --git a/client/src/cmdlfem4x05.c b/client/src/cmdlfem4x05.c
index c0dc8c2ee..87303124b 100644
--- a/client/src/cmdlfem4x05.c
+++ b/client/src/cmdlfem4x05.c
@@ -773,15 +773,38 @@ int CmdEM4x05Write(const char *Cmd) {
     void *argtable[] = {
         arg_param_begin,
         arg_int0("a", "addr", "<dec>", "memory address to write to. (0-13)"),
-        arg_str1("d", "data", "<hex>", "data to write, 4 bytes hex"),
-        arg_str0("p", "pwd", "<hex>", "optional - password, 4 bytes hex"),
+        arg_str1("d", "data", "<hex>", "data to write (4 hex bytes)"),
+        arg_str0("p", "pwd", "<hex>", "password (4 hex bytes)"),
         arg_lit0(NULL, "po", "protect operation"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
     uint8_t addr = (uint8_t)arg_get_int_def(ctx, 1, 50);
-    uint32_t data = arg_get_u32(ctx, 2);
-    uint64_t inputpwd = arg_get_u64_hexstr_def(ctx, 3, 0xFFFFFFFFFFFFFFFF);
+    uint32_t data = 0;
+    int res = arg_get_u32_hexstr_def(ctx, 2, 0, &data);
+    if (res == 2) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(WARNING, "Data must be 4 hex bytes");
+        return PM3_EINVARG;
+    } else if (res == 0) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(WARNING, "Data must be 4 hex bytes");
+        return PM3_EINVARG;
+    }
+
+    bool use_pwd = false;
+    uint32_t pwd = 0;
+    res = arg_get_u32_hexstr_def_nlen(ctx, 3, 0, &pwd, 4, true);
+    if (res == 2) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(WARNING, "Password must be 4 hex bytes");
+        return PM3_EINVARG;
+    } else if (res == 3) {
+        use_pwd = false;
+    } else if (res == 1) {
+        use_pwd = true;
+    }
+
     bool protect_operation = arg_get_lit(ctx, 4);
     CLIParserFree(ctx);
 
@@ -790,22 +813,19 @@ int CmdEM4x05Write(const char *Cmd) {
         return PM3_EINVARG;
     }
 
-    bool use_pwd = false;
-    uint32_t pwd = (inputpwd != 0xFFFFFFFFFFFFFFFF) ? (inputpwd & 0xFFFFFFFF) : 0;
-    if (pwd == 0xFFFFFFFF) {
-        if (protect_operation)
-            PrintAndLogEx(INFO, "Writing protection words data %08X", data);
-        else
-            PrintAndLogEx(INFO, "Writing address %d data %08X", addr, data);
-    } else {
-        use_pwd = true;
+    if (use_pwd) {
         if (protect_operation)
             PrintAndLogEx(INFO, "Writing protection words data %08X using password %08X", data, pwd);
         else
             PrintAndLogEx(INFO, "Writing address %d data %08X using password %08X", addr, data, pwd);
+    } else {
+        if (protect_operation)
+            PrintAndLogEx(INFO, "Writing protection words data %08X", data);
+        else
+            PrintAndLogEx(INFO, "Writing address %d data %08X", addr, data);
     }
 
-    int res = PM3_SUCCESS;
+    res = PM3_SUCCESS;
     // set Protect Words
     if (protect_operation) {
         res = em4x05_protect(pwd, use_pwd, data);
diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index cd4947b4d..d98347342 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -262,26 +262,7 @@ static int usage_t55xx_wakup(void) {
     PrintAndLogEx(NORMAL, _YELLOW_("      lf t55xx wakeup p 11223344") "  - send wakeup password");
     return PM3_SUCCESS;
 }
-static int usage_t55xx_chk(void) {
-    PrintAndLogEx(NORMAL, "This command uses a dictionary attack");
-    PrintAndLogEx(NORMAL, "press " _YELLOW_("'enter'") " to cancel the command");
-    PrintAndLogEx(NORMAL,  _RED_("WARNING:") " this may brick non-password protected chips!");
-    PrintAndLogEx(NORMAL, "Try to reading block 7 before\n");
-    PrintAndLogEx(NORMAL, "Usage: lf t55xx chk [h] [m] [r <mode>] [f <*.dic>] [e <em4100 id>]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     h            - this help");
-    PrintAndLogEx(NORMAL, "     m            - use dictionary from flashmemory\n");
-    print_usage_t55xx_downloadlink(T55XX_DLMODE_ALL, T55XX_DLMODE_ALL);
-    PrintAndLogEx(NORMAL, "     f <*.dic>    - loads a default keys dictionary file <*.dic>");
-    PrintAndLogEx(NORMAL, "     e <EM4100>   - will try the calculated password from some cloners based on EM4100 ID");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("       lf t55xx chk m"));
-    PrintAndLogEx(NORMAL, _YELLOW_("       lf t55xx chk f t55xx_default_pwds"));
-    PrintAndLogEx(NORMAL, _YELLOW_("       lf t55xx chk e aa11223344"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
+
 static int usage_t55xx_dangerraw(void) {
     PrintAndLogEx(NORMAL, "This command allows to emit arbitrary raw commands on T5577 and cut the field after arbitrary duration.");
     PrintAndLogEx(NORMAL, _RED_("WARNING:") " this may lock definitively the tag in an unusable state!");
@@ -2974,68 +2955,83 @@ static bool IsCancelled(void) {
 
 // load a default pwd file.
 static int CmdT55xxChkPwds(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf t55xx chk",
+                  "This command uses a dictionary attack.\n"
+                  "For some cloners, try '--em' for known pwdgen algo.\n"
+                  "Try to reading Page 0 block 7 before.\n"
+                  _RED_("WARNING:") _CYAN_(" this may brick non-password protected chips!"),
+                  "lf t55xx chk -m                     -> use dictionary from flash memory (RDV4)\n"
+                  "lf t55xx chk -f my_dictionary_pwds  -> loads a default keys dictionary file\n"
+                  "lf t55xx chk --em aa11223344        -> try known pwdgen algo from some cloners based on EM4100 ID"
+                 );
 
+    // 4 + (5 or 6)
+   void *argtable[9] = {
+        arg_param_begin,
+        arg_lit0("m", "fm", "use dictionary from flash memory (RDV4)"),
+        arg_str0("f", "file", "<filename>", "file name"),
+        arg_str0(NULL, "em", "<hex>", "EM4100 ID (5 hex bytes)"),
+    };
+    uint8_t idx = 4;
+    arg_add_t55xx_downloadlink(argtable, &idx, T55XX_DLMODE_ALL, T55XX_DLMODE_ALL);
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    bool from_flash = arg_get_lit(ctx, 1);
+
+    int fnlen = 0;
     char filename[FILE_PATH_SIZE] = {0};
-    bool found = false;
-    uint8_t timeout = 0;
-    uint8_t *keyBlock = NULL;
-    bool from_flash = false;
-    bool try_all_dl_modes = false;
-    uint8_t downlink_mode = 0;
-    bool use_pwd_file = false;
-    int dl_mode; // to try each downlink mode for each password
-    uint8_t cmdp = 0;
-    bool errors = false;
-    bool useCardPassword = false;
-    uint32_t cardPassword = 0x00;
-    uint64_t cardID = 0x00;
+    CLIParamStrToBuf(arg_get_str(ctx, 2), (uint8_t *)filename, sizeof(filename), &fnlen);
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_t55xx_chk();
-            case 'r':
-                downlink_mode = param_get8ex(Cmd, cmdp + 1, 0, 10);
-                if (downlink_mode >= 4) {
-                    try_all_dl_modes = true;
-                    downlink_mode = 0;
-                }
-                cmdp += 2;
-                break;
-            case 'm':
-                from_flash = true;
-                cmdp++;
-                break;
-            case 'f':
-                if (param_getstr(Cmd, cmdp + 1, filename, sizeof(filename)) == 0) {
-                    PrintAndLogEx(ERR, "Error, no filename after 'f' was found");
-                    errors = true;
-                }
-                use_pwd_file = true;
-                cmdp += 2;
-                break;
-            case 'e':
                 // White cloner password based on EM4100 ID
-                useCardPassword = true;
-                cardID = param_get64ex(Cmd, cmdp + 1, 0, 16);
-                uint32_t card32Bit = cardID & 0xFFFFFFFF;
-                cardPassword = lf_t55xx_white_pwdgen(card32Bit);
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
+    bool use_calc_password = false;
+    uint32_t card_password = 0x00;
+    uint64_t cardid = 0;
+    int res = arg_get_u64_hexstr_def_nlen(ctx, 3, 0x00, &cardid, 5, true);
+    if (res == 1) {
+        use_calc_password = true;
+        uint32_t calc = cardid & 0xFFFFFFFF;
+        card_password = lf_t55xx_white_pwdgen(calc);
+    }
+    if (res == 2) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(WARNING, "EM4100 ID must be 5 hex bytes");
+        return PM3_EINVARG;
+    }
+    if (res == 0) {
+        CLIParserFree(ctx);
+        return PM3_EINVARG;
     }
 
-    if (errors) return usage_t55xx_chk();
+    bool r0 = arg_get_lit(ctx, 4);
+    bool r1 = arg_get_lit(ctx, 5);
+    bool r2 = arg_get_lit(ctx, 6);
+    bool r3 = arg_get_lit(ctx, 7);
+    bool ra = arg_get_lit(ctx, 8);
+    CLIParserFree(ctx);
 
+    if ((r0 + r1 + r2 + r3 + ra) > 1) {
+        PrintAndLogEx(FAILED, "Error multiple downlink encoding");
+        return PM3_EINVARG;
+    }
+
+    uint8_t downlink_mode = config.downlink_mode;
+    if (r0)
+        downlink_mode = refFixedBit;
+    else if (r1)
+        downlink_mode = refLongLeading;
+    else if (r2)
+        downlink_mode = refLeading0;
+    else if (r3)
+        downlink_mode = ref1of4;
+
+    bool use_pwd_file = false;
     if (strlen(filename) == 0) {
         snprintf(filename, sizeof(filename), "t55xx_default_pwds");
         use_pwd_file = true;
     }
 
+    PrintAndLogEx(INFO, "press " _GREEN_("'enter'") " to cancel the command");
     PrintAndLogEx(NORMAL, "");
     /*
     // block 7,  page1 = false, usepwd = false, override = false, pwd = 00000000
@@ -3047,6 +3043,8 @@ static int CmdT55xxChkPwds(const char *Cmd) {
     }
     */
 
+    bool found = false;
+
     uint64_t t1 = msclock();
     uint8_t flags = downlink_mode << 3;
 
@@ -3055,6 +3053,7 @@ static int CmdT55xxChkPwds(const char *Cmd) {
         SendCommandNG(CMD_LF_T55XX_CHK_PWDS, &flags, sizeof(flags));
         PacketResponseNG resp;
 
+        uint8_t timeout = 0;
         while (!WaitForResponseTimeout(CMD_LF_T55XX_CHK_PWDS, &resp, 2000)) {
             timeout++;
             PrintAndLogEx(NORMAL, "." NOLF);
@@ -3090,55 +3089,59 @@ static int CmdT55xxChkPwds(const char *Cmd) {
         goto out;
     }
 
-    // try calculated password
-    if (useCardPassword) {
+    // to try each downlink mode for each password
+    int dl_mode; 
 
-        PrintAndLogEx(INFO, "testing %08"PRIX32" generated ", cardPassword);
+    // try calculated password
+    if (use_calc_password) {
+
+        PrintAndLogEx(INFO, "testing %08"PRIX32" generated ", card_password);
         for (dl_mode = downlink_mode; dl_mode <= 3; dl_mode++) {
 
-            if (!AcquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, cardPassword, dl_mode)) {
+            if (!AcquireData(T55x7_PAGE0, T55x7_CONFIGURATION_BLOCK, true, card_password, dl_mode)) {
                 continue;
             }
 
-            found = t55xxTryDetectModulationEx(dl_mode, T55XX_PrintConfig, 0, cardPassword);
+            found = t55xxTryDetectModulationEx(dl_mode, T55XX_PrintConfig, 0, card_password);
             if (found) {
-                PrintAndLogEx(SUCCESS, "found valid password : [ " _GREEN_("%08"PRIX32) " ]", cardPassword);
-                dl_mode = 4; // Exit other downlink mode checks
+                PrintAndLogEx(SUCCESS, "found valid password : [ " _GREEN_("%08"PRIX32) " ]", card_password);
+                break;
             }
 
-            if (!try_all_dl_modes) // Exit loop if not trying all downlink modes
-                dl_mode = 4;
+            if (ra == false)
+                break;
         }
     }
 
     if ((found == false) && use_pwd_file) {
         uint32_t keycount = 0;
+        uint8_t *keyblock = NULL;
 
-        int res = loadFileDICTIONARY_safe(filename, (void **) &keyBlock, 4, &keycount);
-        if (res != PM3_SUCCESS || keycount == 0 || keyBlock == NULL) {
+        res = loadFileDICTIONARY_safe(filename, (void **) &keyblock, 4, &keycount);
+        if (res != PM3_SUCCESS || keycount == 0 || keyblock == NULL) {
             PrintAndLogEx(WARNING, "no keys found in file");
-            if (keyBlock != NULL)
-                free(keyBlock);
+            if (keyblock != NULL)
+                free(keyblock);
 
             return PM3_ESOFT;
         }
 
-        PrintAndLogEx(INFO, "press " _YELLOW_("'enter'") " to cancel the command");
+        PrintAndLogEx(INFO, "press " _GREEN_("'enter'") " to cancel the command");
 
-        for (uint32_t c = 0; c < keycount; ++c) {
+        for (uint32_t c = 0; c < keycount && found == false; ++c) {
 
             if (!session.pm3_present) {
                 PrintAndLogEx(WARNING, "device offline\n");
-                free(keyBlock);
+                free(keyblock);
                 return PM3_ENODATA;
             }
 
             if (IsCancelled()) {
-                free(keyBlock);
+                free(keyblock);
                 return PM3_EOPABORTED;
             }
 
-            uint32_t curr_password = bytes_to_num(keyBlock + 4 * c, 4);
+            uint32_t curr_password = bytes_to_num(keyblock + 4 * c, 4);
 
             PrintAndLogEx(INFO, "testing %08"PRIX32, curr_password);
             for (dl_mode = downlink_mode; dl_mode <= 3; dl_mode++) {
@@ -3150,20 +3153,19 @@ static int CmdT55xxChkPwds(const char *Cmd) {
                 found = t55xxTryDetectModulationEx(dl_mode, T55XX_PrintConfig, 0, curr_password);
                 if (found) {
                     PrintAndLogEx(SUCCESS, "found valid password: [ " _GREEN_("%08"PRIX32) " ]", curr_password);
-                    dl_mode = 4; // Exit other downlink mode checks
-                    c = keycount; // Exit loop
+                    break;
                 }
 
-                if (!try_all_dl_modes) // Exit loop if not trying all downlink modes
-                    dl_mode = 4;
+                if (ra == false) // Exit loop if not trying all downlink modes
+                    break;
             }
         }
+
+        free(keyblock);
     }
 
     if (found == false)
-        PrintAndLogEx(WARNING, "check pwd failed");
-
-    free(keyBlock);
+        PrintAndLogEx(WARNING, "failed to find password");
 
 out:
     t1 = msclock() - t1;

From f6462137cfe10c9100e9bb659a1359867771b0df Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 27 Jan 2021 23:18:01 +0100
Subject: [PATCH 418/682] standalone mode LF_EM4100RWC, LF_EM4100RSWB - odd big
 buff static pointer usage

---
 armsrc/Standalone/lf_em4100rswb.c | 19 +++++++++++--------
 armsrc/Standalone/lf_em4100rwc.c  |  8 ++++----
 2 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/armsrc/Standalone/lf_em4100rswb.c b/armsrc/Standalone/lf_em4100rswb.c
index 14bab8357..e6e55f340 100644
--- a/armsrc/Standalone/lf_em4100rswb.c
+++ b/armsrc/Standalone/lf_em4100rswb.c
@@ -76,14 +76,13 @@ static int bruteforceSpeed[] = {10, 12, 14, 16};
 // In high[] must be nulls
 static uint64_t low[] = {0, 0, 0, 0};
 static uint32_t high[] = {0, 0, 0, 0};
-static uint8_t *bba;
 static int buflen;
 
 void ModInfo(void) {
     DbpString("  LF EM4100 read/sim/write/brute mode");
 }
 
-static uint64_t ReversQuads(uint64_t bits) {
+static uint64_t rev_quads(uint64_t bits) {
     uint64_t result = 0;
     for (int i = 0; i < 16; i++) {
         result += ((bits >> (60 - 4 * i)) & 0xf) << (4 * i);
@@ -92,6 +91,7 @@ static uint64_t ReversQuads(uint64_t bits) {
 }
 
 static void FillBuff(uint8_t bit) {
+    uint8_t *bba = BigBuf_get_addr();
     memset(bba + buflen, bit, LF_CLOCK / 2);
     buflen += (LF_CLOCK / 2);
     memset(bba + buflen, bit ^ 1, LF_CLOCK / 2);
@@ -99,24 +99,29 @@ static void FillBuff(uint8_t bit) {
 }
 
 static void ConstructEM410xEmulBuf(uint64_t id) {
-    bba = BigBuf_get_addr();
-
     int i, j, binary[4], parity[4];
     buflen = 0;
+
     for (i = 0; i < 9; i++)
         FillBuff(1);
+
     parity[0] = parity[1] = parity[2] = parity[3] = 0;
+
     for (i = 0; i < 10; i++) {
         for (j = 3; j >= 0; j--, id /= 2)
             binary[j] = id % 2;
+
         for (j = 0; j < 4; j++)
             FillBuff(binary[j]);
+
         FillBuff(binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
         for (j = 0; j < 4; j++)
             parity[j] ^= binary[j];
     }
+
     for (j = 0; j < 4; j++)
         FillBuff(parity[j]);
+
     FillBuff(0);
 }
 
@@ -197,7 +202,6 @@ static uint64_t PackEmID(uint64_t original, int newCardNum) {
     return buf;
 }
 
-
 static void PrintFcAndCardNum(uint64_t lowData) {
     // Calculate Facility Code and Card Number from high and low
     uint32_t fc = (lowData >> 17) & 0xFF;
@@ -222,7 +226,7 @@ static int BruteEMTag(uint64_t originalCard, int slot) {
         cardnum = cardnum + direction;
         uint64_t currentCard = PackEmID(originalCard, cardnum);
         Dbprintf("[=] >>  Simulating card id %"PRIx64" <<", currentCard);
-        ConstructEM410xEmulBuf(ReversQuads(currentCard));
+        ConstructEM410xEmulBuf(rev_quads(currentCard));
         SimulateTagLowFrequencyEx(buflen, 0, 1, bruteforceSpeed[bruteforceSpeedCurrent] * 10000);
 
         int button_pressed = BUTTON_CLICKED(1000);
@@ -267,7 +271,7 @@ static int ExecuteMode(int mode, int slot) {
             return LF_RWSB_UNKNOWN_RESULT;
         case LF_RWSB_MODE_SIM:
             Dbprintf("[=] >>  Sim mode started  <<");
-            ConstructEM410xEmulBuf(ReversQuads(low[slot]));
+            ConstructEM410xEmulBuf(rev_quads(low[slot]));
             SimulateTagLowFrequency(buflen, 0, 1);
             return LF_RWSB_UNKNOWN_RESULT;
         case LF_RWSB_MODE_WRITE:
@@ -310,7 +314,6 @@ void RunMod() {
     int slot = 0;
     mode = SwitchMode(mode, slot);
 
-    bba = BigBuf_get_addr();
     for (;;) {
         WDT_HIT();
         if (data_available()) break;
diff --git a/armsrc/Standalone/lf_em4100rwc.c b/armsrc/Standalone/lf_em4100rwc.c
index d095b944b..911f97f0e 100644
--- a/armsrc/Standalone/lf_em4100rwc.c
+++ b/armsrc/Standalone/lf_em4100rwc.c
@@ -41,7 +41,7 @@
 // In high[] must be nulls
 static uint64_t low[] = {0x565AF781C7, 0x540053E4E2, 0x1234567890, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
 static uint32_t high[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
-static uint8_t *bba, slots_count;
+static uint8_t slots_count;
 static int buflen;
 
 void ModInfo(void) {
@@ -57,6 +57,7 @@ static uint64_t rev_quads(uint64_t bits) {
 }
 
 static void fillbuff(uint8_t bit) {
+    uint8_t *bba = BigBuf_get_addr();
     memset(bba + buflen, bit, LF_CLOCK / 2);
     buflen += (LF_CLOCK / 2);
     memset(bba + buflen, bit ^ 1, LF_CLOCK / 2);
@@ -66,8 +67,8 @@ static void fillbuff(uint8_t bit) {
 static void construct_EM410x_emul(uint64_t id) {
 
     int i, j;
-    int binary[4] = {0};
-    int parity[4] = {0};
+    int binary[4] = {0,0,0,0};
+    int parity[4] = {0,0,0,0};
     buflen = 0;
 
     for (i = 0; i < 9; i++)
@@ -138,7 +139,6 @@ void RunMod(void) {
     //      3 - write to T5555 tag
     uint8_t state = 0;
     slots_count = ARRAYLEN(low);
-    bba = BigBuf_get_addr();
     led_slot(selected);
     for (;;) {
 

From a5c40fa07b475db11db688304df6e5bddfeb7646 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 27 Jan 2021 23:30:37 +0100
Subject: [PATCH 419/682] minor renaming

---
 armsrc/Standalone/lf_em4100emul.c | 41 ++++++++++++++++++-------------
 armsrc/Standalone/lf_em4100rswb.c | 22 ++++++++---------
 armsrc/Standalone/lf_em4100rwc.c  | 12 ++++-----
 3 files changed, 41 insertions(+), 34 deletions(-)

diff --git a/armsrc/Standalone/lf_em4100emul.c b/armsrc/Standalone/lf_em4100emul.c
index e6ac2f6ff..dd44c843e 100644
--- a/armsrc/Standalone/lf_em4100emul.c
+++ b/armsrc/Standalone/lf_em4100emul.c
@@ -21,19 +21,19 @@
 #include "commonutil.h"
 
 #define MAX_IND 16 // 4 LEDs - 2^4 combinations
-#define CLOCK 64 //for 125kHz
+#define LF_CLOCK 64 // for 125kHz
 
 // low & high - array for storage IDs. Its length must be equal.
 // Predefined IDs must be stored in low[].
 static uint64_t low[] = {0x565A1140BE, 0x365A398149, 0x5555555555, 0xFFFFFFFFFF};
-static uint8_t *bba, slots_count;
+static uint8_t slots_count;
 static int buflen;
 
 void ModInfo(void) {
     DbpString("  LF EM4100 simulator standalone mode");
 }
 
-static uint64_t ReversQuads(uint64_t bits) {
+static uint64_t rev_quads(uint64_t bits) {
     uint64_t result = 0;
     for (int i = 0; i < 16; i++) {
         result += ((bits >> (60 - 4 * i)) & 0xf) << (4 * i);
@@ -41,32 +41,40 @@ static uint64_t ReversQuads(uint64_t bits) {
     return result >> 24;
 }
 
-static void FillBuff(uint8_t bit) {
-    memset(bba + buflen, bit, CLOCK / 2);
-    buflen += (CLOCK / 2);
-    memset(bba + buflen, bit ^ 1, CLOCK / 2);
-    buflen += (CLOCK / 2);
+static void fill_buff(uint8_t bit) {
+    uint8_t *bba = BigBuf_get_addr();
+    memset(bba + buflen, bit, LF_CLOCK / 2);
+    buflen += (LF_CLOCK / 2);
+    memset(bba + buflen, bit ^ 1, LF_CLOCK / 2);
+    buflen += (LF_CLOCK / 2);
 }
 
 static void ConstructEM410xEmulBuf(uint64_t id) {
 
-    int i, j, binary[4], parity[4];
+    int i, j;
+    int binary[4] = {0,0,0,0};
+    int parity[4] = {0,0,0,0};
     buflen = 0;
+
     for (i = 0; i < 9; i++)
-        FillBuff(1);
-    parity[0] = parity[1] = parity[2] = parity[3] = 0;
+        fill_buff(1);
+
     for (i = 0; i < 10; i++) {
         for (j = 3; j >= 0; j--, id /= 2)
             binary[j] = id % 2;
+
         for (j = 0; j < 4; j++)
-            FillBuff(binary[j]);
-        FillBuff(binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
+            fill_buff(binary[j]);
+
+        fill_buff(binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
         for (j = 0; j < 4; j++)
             parity[j] ^= binary[j];
     }
+
     for (j = 0; j < 4; j++)
-        FillBuff(parity[j]);
-    FillBuff(0);
+        fill_buff(parity[j]);
+
+    fill_buff(0);
 }
 
 static void LED_Slot(int i) {
@@ -85,14 +93,13 @@ void RunMod(void) {
 
     int selected = 0; //selected slot after start
     slots_count = ARRAYLEN(low);
-    bba = BigBuf_get_addr();
     for (;;) {
         WDT_HIT();
         if (data_available()) break;
         SpinDelay(100);
         SpinUp(100);
         LED_Slot(selected);
-        ConstructEM410xEmulBuf(ReversQuads(low[selected]));
+        ConstructEM410xEmulBuf(rev_quads(low[selected]));
         SimulateTagLowFrequency(buflen, 0, true);
         selected = (selected + 1) % slots_count;
     }
diff --git a/armsrc/Standalone/lf_em4100rswb.c b/armsrc/Standalone/lf_em4100rswb.c
index e6e55f340..8e723185f 100644
--- a/armsrc/Standalone/lf_em4100rswb.c
+++ b/armsrc/Standalone/lf_em4100rswb.c
@@ -53,8 +53,8 @@
 #include "flashmem.h"
 #endif
 
-#define LF_CLOCK 64 //for 125kHz
-#define LF_RWSB_T55XX_TYPE 1 //Tag type: 0 - T5555, 1-T55x7
+#define LF_CLOCK 64 // for 125kHz
+#define LF_RWSB_T55XX_TYPE 1 // Tag type: 0 - T5555, 1-T55x7
 
 #define LF_RWSB_UNKNOWN_RESULT 0
 #define LF_RWSB_BRUTE_STOPED 1
@@ -90,7 +90,7 @@ static uint64_t rev_quads(uint64_t bits) {
     return result >> 24;
 }
 
-static void FillBuff(uint8_t bit) {
+static void fill_buff(uint8_t bit) {
     uint8_t *bba = BigBuf_get_addr();
     memset(bba + buflen, bit, LF_CLOCK / 2);
     buflen += (LF_CLOCK / 2);
@@ -99,30 +99,30 @@ static void FillBuff(uint8_t bit) {
 }
 
 static void ConstructEM410xEmulBuf(uint64_t id) {
-    int i, j, binary[4], parity[4];
+    int i, j;
+    int binary[4] = {0,0,0,0};
+    int parity[4] = {0,0,0,0};
     buflen = 0;
 
     for (i = 0; i < 9; i++)
-        FillBuff(1);
-
-    parity[0] = parity[1] = parity[2] = parity[3] = 0;
+        fill_buff(1);
 
     for (i = 0; i < 10; i++) {
         for (j = 3; j >= 0; j--, id /= 2)
             binary[j] = id % 2;
 
         for (j = 0; j < 4; j++)
-            FillBuff(binary[j]);
+            fill_buff(binary[j]);
 
-        FillBuff(binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
+        fill_buff(binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
         for (j = 0; j < 4; j++)
             parity[j] ^= binary[j];
     }
 
     for (j = 0; j < 4; j++)
-        FillBuff(parity[j]);
+        fill_buff(parity[j]);
 
-    FillBuff(0);
+    fill_buff(0);
 }
 
 static void LED_Update(int mode, int slot) {
diff --git a/armsrc/Standalone/lf_em4100rwc.c b/armsrc/Standalone/lf_em4100rwc.c
index 911f97f0e..9240feb47 100644
--- a/armsrc/Standalone/lf_em4100rwc.c
+++ b/armsrc/Standalone/lf_em4100rwc.c
@@ -56,7 +56,7 @@ static uint64_t rev_quads(uint64_t bits) {
     return result >> 24;
 }
 
-static void fillbuff(uint8_t bit) {
+static void fill_buff(uint8_t bit) {
     uint8_t *bba = BigBuf_get_addr();
     memset(bba + buflen, bit, LF_CLOCK / 2);
     buflen += (LF_CLOCK / 2);
@@ -72,24 +72,24 @@ static void construct_EM410x_emul(uint64_t id) {
     buflen = 0;
 
     for (i = 0; i < 9; i++)
-        fillbuff(1);
+        fill_buff(1);
 
     for (i = 0; i < 10; i++) {
         for (j = 3; j >= 0; j--, id /= 2)
             binary[j] = id % 2;
 
         for (j = 0; j < 4; j++)
-            fillbuff(binary[j]);
+            fill_buff(binary[j]);
 
-        fillbuff(binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
+        fill_buff(binary[0] ^ binary[1] ^ binary[2] ^ binary[3]);
         for (j = 0; j < 4; j++)
             parity[j] ^= binary[j];
     }
 
     for (j = 0; j < 4; j++)
-        fillbuff(parity[j]);
+        fill_buff(parity[j]);
 
-    fillbuff(0);
+    fill_buff(0);
 }
 
 static void led_slot(int i) {

From f8925aa5f3e1d0f66b9353e6f8c04246b692b3dd Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 27 Jan 2021 23:45:32 +0100
Subject: [PATCH 420/682] added more links

---
 doc/jtag_notes.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/doc/jtag_notes.md b/doc/jtag_notes.md
index 01b964365..f7392d53f 100644
--- a/doc/jtag_notes.md
+++ b/doc/jtag_notes.md
@@ -60,6 +60,9 @@ TCK | 23
 GND | 6
 3.3 | 1
 
+# Where to find more information?
+There has been lots of articles and blogposts about recoving, debricking, JTAG your Proxmark3 and you find here below a sortiment of resources that will be of help.
+
 ## Third party notes on using a BusPirate
 
 * https://github.com/Proxmark/proxmark3/wiki/Debricking-Proxmark3-with-buspirate
@@ -84,3 +87,6 @@ GND | 6
 ## Stack Overflow write up article.
 https://stackoverflow.com/questions/48794076/error-halt-timed-out-wake-up-gdb/64291913#64291913
 
+## Old original doc,  
+Describes the SEGGER JLINK, JTAG process but be warned,  this document is old.
+https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/original_proxmark3/Compiling%20Proxmark%20source%20and%20firmware%20upgrading%20v1.pdf
\ No newline at end of file

From 02c1034caa9080ea13bf3146f808241baed459f5 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 00:35:14 +0100
Subject: [PATCH 421/682] fix #1175 - biphase demod identification of value
 clocks now fails if no changes detected

---
 common/lfdemod.c | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/common/lfdemod.c b/common/lfdemod.c
index 171417143..221dba8d6 100644
--- a/common/lfdemod.c
+++ b/common/lfdemod.c
@@ -41,6 +41,8 @@
 #include <stdlib.h>  // qsort
 #include "parity.h"  // for parity test
 #include "pm3_cmd.h" // error codes
+#include "commonutil.h"  // Arraylen
+
 // **********************************************************************************************
 // ---------------------------------Utilities Section--------------------------------------------
 // **********************************************************************************************
@@ -770,6 +772,22 @@ int DetectASKClock(uint8_t *dest, size_t size, int *clock, int maxErr) {
         //if (g_debugMode == 2) prnt("DEBUG ASK: clk %d, # Errors %d, Current Best Clk %d, bestStart %d", clk[k], bestErr[k], clk[best], bestStart[best]);
     }
 
+    bool chg = false;
+    for (i = 0; i < ARRAYLEN(bestErr); i++) {
+        chg = (bestErr[i] != 1000);
+        if (chg)
+            break;
+        chg = (bestStart[i] != 0);
+        if (chg)
+            break;
+    }
+
+    // just noise - no super good detection. good enough
+    if (chg == false) {
+        if (g_debugMode == 2) prnt("DEBUG DetectASKClock: no good values detected - aborting");
+        return -2;
+    }
+
     if (!found_clk)
         *clock = clk[best];
 
@@ -1671,12 +1689,12 @@ int askdemod_ext(uint8_t *bits, size_t *size, int *clk, int *invert, int maxErr,
     *startIdx = start - (*clk / 2);
     if (g_debugMode == 2) prnt("DEBUG: (askdemod_ext) Weak wave detected: startIdx %i", *startIdx);
 
-    int lastBit;  //set first clock check - can go negative
-    size_t i, bitnum = 0;     //output counter
+    int lastBit;              // set first clock check - can go negative
+    size_t i, bitnum = 0;     // output counter
     uint8_t midBit = 0;
-    uint8_t tol = 0;  //clock tolerance adjust - waves will be accepted as within the clock if they fall + or - this value + clock from last valid wave
-    if (*clk <= 32) tol = 1;    //clock tolerance may not be needed anymore currently set to + or - 1 but could be increased for poor waves or removed entirely
-    size_t MaxBits = 3072;    //max bits to collect
+    uint8_t tol = 0;          // clock tolerance adjust - waves will be accepted as within the clock if they fall + or - this value + clock from last valid wave
+    if (*clk <= 32) tol = 1;  // clock tolerance may not be needed anymore currently set to + or - 1 but could be increased for poor waves or removed entirely
+    size_t MaxBits = 3072;    // max bits to collect
     lastBit = start - *clk;
 
     for (i = start; i < *size; ++i) {

From 58cbe90469c7e0c720afab426f9b22219f0f9d9d Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 01:21:52 +0100
Subject: [PATCH 422/682] rename

---
 client/src/cmddata.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/client/src/cmddata.c b/client/src/cmddata.c
index 7c6fd4785..d2d28d0f0 100644
--- a/client/src/cmddata.c
+++ b/client/src/cmddata.c
@@ -769,22 +769,22 @@ static int CmdBiphaseDecodeRaw(const char *Cmd) {
 int ASKbiphaseDemod(int offset, int clk, int invert, int maxErr, bool verbose) {
     //ask raw demod GraphBuffer first
 
-    uint8_t BitStream[MAX_DEMOD_BUF_LEN];
-    size_t size = getFromGraphBuf(BitStream);
+    uint8_t bs[MAX_DEMOD_BUF_LEN];
+    size_t size = getFromGraphBuf(bs);
     if (size == 0) {
         PrintAndLogEx(DEBUG, "DEBUG: no data in graphbuf");
         return PM3_ESOFT;
     }
     int startIdx = 0;
     //invert here inverts the ask raw demoded bits which has no effect on the demod, but we need the pointer
-    int errCnt = askdemod_ext(BitStream, &size, &clk, &invert, maxErr, 0, 0, &startIdx);
+    int errCnt = askdemod_ext(bs, &size, &clk, &invert, maxErr, 0, 0, &startIdx);
     if (errCnt < 0 || errCnt > maxErr) {
         PrintAndLogEx(DEBUG, "DEBUG: no data or error found %d, clock: %d", errCnt, clk);
         return PM3_ESOFT;
     }
 
     //attempt to Biphase decode BitStream
-    errCnt = BiphaseRawDecode(BitStream, &size, &offset, invert);
+    errCnt = BiphaseRawDecode(bs, &size, &offset, invert);
     if (errCnt < 0) {
         if (g_debugMode || verbose) PrintAndLogEx(DEBUG, "DEBUG: Error BiphaseRawDecode: %d", errCnt);
         return PM3_ESOFT;
@@ -795,7 +795,7 @@ int ASKbiphaseDemod(int offset, int clk, int invert, int maxErr, bool verbose) {
     }
 
     //success set DemodBuffer and return
-    setDemodBuff(BitStream, size, 0);
+    setDemodBuff(bs, size, 0);
     setClockGrid(clk, startIdx + clk * offset / 2);
     if (g_debugMode || verbose) {
         PrintAndLogEx(DEBUG, "Biphase Decoded using offset %d | clock %d | #errors %d | start index %d\ndata\n", offset, clk, errCnt, (startIdx + clk * offset / 2));

From 65c11ee0e4f971b688836e985ebb847d3f1543a2 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 11:49:25 +0100
Subject: [PATCH 423/682] litte rename

---
 armsrc/Standalone/lf_em4100emul.c | 5 +++--
 armsrc/Standalone/lf_em4100rswb.c | 6 +++---
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/armsrc/Standalone/lf_em4100emul.c b/armsrc/Standalone/lf_em4100emul.c
index dd44c843e..e23986ab7 100644
--- a/armsrc/Standalone/lf_em4100emul.c
+++ b/armsrc/Standalone/lf_em4100emul.c
@@ -49,7 +49,7 @@ static void fill_buff(uint8_t bit) {
     buflen += (LF_CLOCK / 2);
 }
 
-static void ConstructEM410xEmulBuf(uint64_t id) {
+static void construct_EM410x_emul(uint64_t id) {
 
     int i, j;
     int binary[4] = {0,0,0,0};
@@ -96,10 +96,11 @@ void RunMod(void) {
     for (;;) {
         WDT_HIT();
         if (data_available()) break;
+
         SpinDelay(100);
         SpinUp(100);
         LED_Slot(selected);
-        ConstructEM410xEmulBuf(rev_quads(low[selected]));
+        construct_EM410x_emul(rev_quads(low[selected]));
         SimulateTagLowFrequency(buflen, 0, true);
         selected = (selected + 1) % slots_count;
     }
diff --git a/armsrc/Standalone/lf_em4100rswb.c b/armsrc/Standalone/lf_em4100rswb.c
index 8e723185f..060795bd1 100644
--- a/armsrc/Standalone/lf_em4100rswb.c
+++ b/armsrc/Standalone/lf_em4100rswb.c
@@ -98,7 +98,7 @@ static void fill_buff(uint8_t bit) {
     buflen += (LF_CLOCK / 2);
 }
 
-static void ConstructEM410xEmulBuf(uint64_t id) {
+static void construct_EM410x_emul(uint64_t id) {
     int i, j;
     int binary[4] = {0,0,0,0};
     int parity[4] = {0,0,0,0};
@@ -226,7 +226,7 @@ static int BruteEMTag(uint64_t originalCard, int slot) {
         cardnum = cardnum + direction;
         uint64_t currentCard = PackEmID(originalCard, cardnum);
         Dbprintf("[=] >>  Simulating card id %"PRIx64" <<", currentCard);
-        ConstructEM410xEmulBuf(rev_quads(currentCard));
+        construct_EM410x_emul(rev_quads(currentCard));
         SimulateTagLowFrequencyEx(buflen, 0, 1, bruteforceSpeed[bruteforceSpeedCurrent] * 10000);
 
         int button_pressed = BUTTON_CLICKED(1000);
@@ -271,7 +271,7 @@ static int ExecuteMode(int mode, int slot) {
             return LF_RWSB_UNKNOWN_RESULT;
         case LF_RWSB_MODE_SIM:
             Dbprintf("[=] >>  Sim mode started  <<");
-            ConstructEM410xEmulBuf(rev_quads(low[slot]));
+            construct_EM410x_emul(rev_quads(low[slot]));
             SimulateTagLowFrequency(buflen, 0, 1);
             return LF_RWSB_UNKNOWN_RESULT;
         case LF_RWSB_MODE_WRITE:

From 6e0673fd02ad381c457f3dc5aeb5969ee7ccbde4 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 12:05:32 +0100
Subject: [PATCH 424/682] cppchecker fixes

---
 armsrc/iclass.c | 28 ++++++++++++----------------
 armsrc/iclass.h |  3 +--
 2 files changed, 13 insertions(+), 18 deletions(-)

diff --git a/armsrc/iclass.c b/armsrc/iclass.c
index 5cb5d71ae..f31f17204 100644
--- a/armsrc/iclass.c
+++ b/armsrc/iclass.c
@@ -408,9 +408,9 @@ int do_iclass_simulation(int simulationMode, uint8_t *reader_mac_buf) {
     // Tag    CSN
 
     uint8_t *modulated_response = NULL;
-    int modulated_response_size = 0;
+    int modulated_response_size;
     uint8_t *trace_data = NULL;
-    int trace_data_size = 0;
+    int trace_data_size;
 
     // Respond SOF -- takes 1 bytes
     uint8_t *resp_sof = BigBuf_malloc(1);
@@ -498,10 +498,9 @@ int do_iclass_simulation(int simulationMode, uint8_t *reader_mac_buf) {
 
     bool button_pressed = false;
     uint8_t cmd, options, block;
-    int len = 0;
+    int len, kc_attempt = 0;
     bool exit_loop = false;
     bool using_kc = false;
-    int kc_attempt = 0;
 
     while (exit_loop == false) {
         WDT_HIT();
@@ -1364,7 +1363,9 @@ static bool select_iclass_tag_ex(picopass_hdr *hdr, bool use_credit_key, uint32_
             return false;
 
         memcpy(hdr->epurse, resp, sizeof(hdr->epurse));
-        *status |= FLAG_ICLASS_CC;
+
+        if (status)
+            *status |= FLAG_ICLASS_CC;
 
     }  else {
 
@@ -1469,16 +1470,9 @@ void ReaderIClass(uint8_t flags) {
     switch_off();
 }
 
-// used with function select_and_auth (cmdhficlass.c)
-// which needs to authenticate before doing more things like read/write
-// selects and authenticate to a card,  sends back div_key and mac to client.
-void iClass_Authentication(uint8_t *msg) {
-}
-
 bool authenticate_iclass_tag(iclass_auth_req_t *payload, picopass_hdr *hdr, uint32_t *start_time, uint32_t *eof_time, uint8_t *mac_out) {
 
     uint8_t cmd_check[9] = { ICLASS_CMD_CHECK };
-    uint8_t div_key[8] = {0};
     uint8_t mac[4] = {0};
     uint8_t resp_auth[4] = {0};
     uint8_t ccnr[12] = {0};
@@ -1495,6 +1489,8 @@ bool authenticate_iclass_tag(iclass_auth_req_t *payload, picopass_hdr *hdr, uint
         memcpy(cmd_check + 1, payload->key, 8);
 
     } else {
+        
+        uint8_t div_key[8] = {0};
         if (payload->use_raw)
             memcpy(div_key, payload->key, 8);
         else
@@ -1792,7 +1788,7 @@ static bool iclass_writeblock_ext(uint8_t blockno, uint8_t *data, uint8_t *mac,
 
     uint8_t resp[10] = {0};
     uint32_t eof_time = 0, start_time = 0;
-    bool isOK = iclass_send_cmd_with_retries(write, sizeof(write), resp, sizeof(resp), 10, 3, &start_time, ICLASS_READER_TIMEOUT_UPDATE, &eof_time);
+    bool isOK = iclass_send_cmd_with_retries(write, write_len, resp, sizeof(resp), 10, 3, &start_time, ICLASS_READER_TIMEOUT_UPDATE, &eof_time);
     if (isOK == false) {
         return false;
     }
@@ -1833,7 +1829,7 @@ void iClass_WriteBlock(uint8_t *msg) {
     // select tag.
     uint32_t eof_time = 0;
     picopass_hdr hdr = {0};
-    bool res = select_iclass_tag(&hdr, payload->req.use_credit_key, &eof_time);
+    uint8_t res = select_iclass_tag(&hdr, payload->req.use_credit_key, &eof_time);
     if (res == false) {
         goto out;
     }
@@ -1889,7 +1885,7 @@ void iClass_WriteBlock(uint8_t *msg) {
             res = false;
             switch_off();
             if (payload->req.send_reply)
-                reply_ng(CMD_HF_ICLASS_WRITEBL, PM3_ETEAROFF, (uint8_t *)&res, sizeof(uint8_t));
+                reply_ng(CMD_HF_ICLASS_WRITEBL, PM3_ETEAROFF, (uint8_t*)&res, sizeof(uint8_t));
             return;
         } else {
 
@@ -1931,7 +1927,7 @@ out:
     switch_off();
 
     if (payload->req.send_reply)
-        reply_ng(CMD_HF_ICLASS_WRITEBL, PM3_SUCCESS, (uint8_t *)&res, sizeof(uint8_t));
+        reply_ng(CMD_HF_ICLASS_WRITEBL, PM3_SUCCESS, (uint8_t*)&res, sizeof(uint8_t));
 }
 
 void iClass_Restore(iclass_restore_req_t *msg) {
diff --git a/armsrc/iclass.h b/armsrc/iclass.h
index 1895ebbf6..b41b79ce8 100644
--- a/armsrc/iclass.h
+++ b/armsrc/iclass.h
@@ -16,7 +16,7 @@
 #include "pm3_cmd.h"
 
 void SniffIClass(uint8_t jam_search_len, uint8_t *jam_search_string);
-void ReaderIClass(uint8_t arg0);
+void ReaderIClass(uint8_t flags);
 
 void iClass_WriteBlock(uint8_t *msg);
 void iClass_Dump(uint8_t *msg);
@@ -29,7 +29,6 @@ void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain
 void iclass_simulate(uint8_t sim_type, uint8_t num_csns, bool send_reply, uint8_t *datain, uint8_t *dataout,  uint16_t *dataoutlen);
 
 void iClass_Authentication_fast(uint64_t arg0, uint64_t arg1, uint8_t *datain);
-void iClass_Authentication(uint8_t *bytes);
 bool iclass_auth(iclass_auth_req_t *payload, uint8_t *out);
 
 void iClass_ReadBlock(uint8_t *msg);

From 3c07e264c95daf0b4e744aa14fdf1e4a2395cfce Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 12:11:24 +0100
Subject: [PATCH 425/682] cppchecker fixes

---
 armsrc/em4x50.c | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index a9eea7ad2..53abff5d3 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -646,7 +646,7 @@ static int get_word_from_bitstream(uint32_t *data) {
 
 // simple login to EM4x50,
 // used in operations that require authentication
-static bool login(uint32_t password) {
+static int login(uint32_t password) {
     if (request_receive_mode() == PM3_SUCCESS) {
 
         // send login command
@@ -722,7 +722,7 @@ static bool brute(uint32_t start, uint32_t stop, uint32_t *pwd) {
 void em4x50_login(uint32_t *password) {
     em4x50_setup_read();
 
-    uint8_t status = PM3_EFAILED;
+    int status = PM3_EFAILED;
     if (get_signalproperties() && find_em4x50_tag())
         status = login(*password);
 
@@ -1111,7 +1111,7 @@ void em4x50_writepwd(em4x50_data_t *etd) {
 static void em4x50_sim_send_bit(uint8_t bit) {
 
     //uint16_t timeout = EM4X50_T_TAG_FULL_PERIOD;
-    uint16_t timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
+    int16_t timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
 
     for (int t = 0; t < EM4X50_T_TAG_FULL_PERIOD; t++) {
 
@@ -1236,7 +1236,7 @@ static int em4x50_sim_read_bit(void) {
                 if (timeout <= 0) {
                     return PM3_ETIMEOUT;
                 }
-                timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
+                // timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
 
                 // now we have a reference "position", from here it will take
                 // slightly less than 32 cycles until the end of the bit period
@@ -1420,8 +1420,6 @@ static void em4x50_sim_send_nak(void) {
 // standard read mode process (simulation mode)
 static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
 
-    int command = 0;
-
     // extract control data
     int fwr = reflect32(tag[EM4X50_CONTROL]) & 0xFF;        // first word read
     int lwr = (reflect32(tag[EM4X50_CONTROL]) >> 8) & 0xFF; // last word read
@@ -1435,7 +1433,7 @@ static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
 
         WDT_HIT();
 
-        command = em4x50_sim_send_listen_window(tag);
+        int command = em4x50_sim_send_listen_window(tag);
         if (command != PM3_SUCCESS) {
             return command;
         }
@@ -1461,8 +1459,6 @@ static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
 // selective read mode process (simulation mode)
 static int em4x50_sim_handle_selective_read_command(uint32_t *tag) {
 
-    int command = 0;
-
     // read password
     uint32_t address = 0;
     bool addr = em4x50_sim_read_word(&address);
@@ -1491,7 +1487,7 @@ static int em4x50_sim_handle_selective_read_command(uint32_t *tag) {
 
         WDT_HIT();
 
-        command = em4x50_sim_send_listen_window(tag);
+        int command = em4x50_sim_send_listen_window(tag);
         if (command != PM3_SUCCESS) {
             return command;
         }

From a9b265ff1b9e3c69d14659b27117ffeaf6b2d3f2 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 12:16:02 +0100
Subject: [PATCH 426/682] cppcheck fixes call from hf_aveful with NULL

---
 armsrc/mifareutil.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/armsrc/mifareutil.c b/armsrc/mifareutil.c
index 07cf7b098..8fc747a97 100644
--- a/armsrc/mifareutil.c
+++ b/armsrc/mifareutil.c
@@ -68,9 +68,12 @@ uint8_t mf_crypto1_encrypt4bit(struct Crypto1State *pcs, uint8_t data) {
 
 // send X byte basic commands
 int mifare_sendcmd(uint8_t cmd, uint8_t *data, uint8_t data_size, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing) {
+    
     uint8_t dcmd[data_size + 3];
     dcmd[0] = cmd;
-    memcpy(dcmd + 1, data, data_size);
+    if (data_size > 0)
+        memcpy(dcmd + 1, data, data_size);
+
     AddCrc14A(dcmd, data_size + 1);
     ReaderTransmit(dcmd, sizeof(dcmd), timing);
     int len = ReaderReceive(answer, answer_parity);

From 31df889f97ff93de7cae20079dc545d0aca3fd36 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 12:42:32 +0100
Subject: [PATCH 427/682] cppchecker fix - format string

---
 tools/fpga_compress/fpga_compress.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/tools/fpga_compress/fpga_compress.c b/tools/fpga_compress/fpga_compress.c
index 005e66fce..859a2b858 100644
--- a/tools/fpga_compress/fpga_compress.c
+++ b/tools/fpga_compress/fpga_compress.c
@@ -115,7 +115,7 @@ static int zlib_compress(FILE *infile[], uint8_t num_infiles, FILE *outfile) {
     }
     LZ4_freeStreamHC(lz4_streamhc);
 
-    fprintf(stdout, "compressed %u input bytes to %u output bytes\n", total_size, current_out);
+    fprintf(stdout, "compressed %u input bytes to %d output bytes\n", total_size, current_out);
 
     if (current_out == 0) {
         fprintf(stderr, "Error in lz4");
@@ -399,9 +399,6 @@ int main(int argc, char **argv) {
             int ret = generate_fpga_version_info(infiles, infile_names, num_input_files, outfile);
             free(infile_names);
             free(infiles);
-            if (ret) {
-                return (EXIT_FAILURE);
-            }
             return (ret);
         } else {
             int ret = zlib_compress(infiles, num_input_files, outfile);

From 84bc13884135ddc6d142cc7858cbe40d191f2ea4 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 12:46:26 +0100
Subject: [PATCH 428/682] cppchecker fix - might be called with UID == NULL

---
 common/iso15693tools.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/common/iso15693tools.c b/common/iso15693tools.c
index 725baedb6..aa5119533 100644
--- a/common/iso15693tools.c
+++ b/common/iso15693tools.c
@@ -15,14 +15,15 @@
 // uid[]     the UID in transmission order
 // return: ptr to string
 char *iso15693_sprintUID(char *dest, uint8_t *uid) {
-
     static char tempbuf[3 * 8 + 1] = {0};
     if (dest == NULL)
         dest = tempbuf;
 
-    sprintf(dest, "%02X %02X %02X %02X %02X %02X %02X %02X",
-            uid[7], uid[6], uid[5], uid[4],
-            uid[3], uid[2], uid[1], uid[0]
-           );
+    if (uid) {
+        sprintf(dest, "%02X %02X %02X %02X %02X %02X %02X %02X",
+                uid[7], uid[6], uid[5], uid[4],
+                uid[3], uid[2], uid[1], uid[0]
+                );
+    }
     return dest;
 }

From 3c8cefd8982a5c01407fa8e92129e867d2852e07 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 12:51:33 +0100
Subject: [PATCH 429/682] forgot to remove

---
 armsrc/appmain.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index dca2def3b..33ea032de 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -1666,10 +1666,6 @@ static void PacketReceived(PacketCommandNG *packet) {
             iClass_ReadBlock(packet->data.asBytes);
             break;
         }
-        case CMD_HF_ICLASS_AUTH: { //check
-            iClass_Authentication(packet->data.asBytes);
-            break;
-        }
         case CMD_HF_ICLASS_CHKKEYS: {
             iClass_Authentication_fast(packet->oldarg[0], packet->oldarg[1], packet->data.asBytes);
             break;

From c0f4abb8d474b6e5778996f17380d9c05de1a9b3 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 12:52:10 +0100
Subject: [PATCH 430/682] cppchecker fix

---
 armsrc/iso15693.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/armsrc/iso15693.c b/armsrc/iso15693.c
index ef4695e20..5050fc117 100644
--- a/armsrc/iso15693.c
+++ b/armsrc/iso15693.c
@@ -1845,9 +1845,8 @@ void BruteforceIso15693Afi(uint32_t speed) {
 
     int datalen = 5;
     uint32_t eof_time = 0;
-    uint32_t start_time = GetCountSspClk();
     int recvlen = SendDataTag(data, datalen, true, speed, recv, sizeof(recv), 0, ISO15693_READER_TIMEOUT, &eof_time);
-    start_time = eof_time + DELAY_ISO15693_VICC_TO_VCD_READER;
+    uint32_t start_time = eof_time + DELAY_ISO15693_VICC_TO_VCD_READER;
 
     WDT_HIT();
 

From 6579ca908e731d6a49df0ab2bc547bd51cd407df Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 12:52:43 +0100
Subject: [PATCH 431/682] remove unused usb command

---
 include/pm3_cmd.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h
index e3dc29aee..6b7f5df07 100644
--- a/include/pm3_cmd.h
+++ b/include/pm3_cmd.h
@@ -593,7 +593,6 @@ typedef struct {
 #define CMD_HF_ICLASS_READBL                                              0x0396
 #define CMD_HF_ICLASS_WRITEBL                                             0x0397
 #define CMD_HF_ICLASS_EML_MEMSET                                          0x0398
-#define CMD_HF_ICLASS_AUTH                                                0x0399
 #define CMD_HF_ICLASS_CHKKEYS                                             0x039A
 #define CMD_HF_ICLASS_RESTORE                                             0x039B
 

From fd7a25beedbb4870a90f87f45362491ecfd957e8 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 13:34:03 +0100
Subject: [PATCH 432/682] cppchecker fix - hf mfu restore and key param

---
 client/src/cmdhfmfu.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index 4d5106437..ac9d44802 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -992,7 +992,6 @@ uint32_t GetHF14AMfU_Type(void) {
                 else if (memcmp(version, "\x00\x04\x04\x05\x02\x01\x15", 7) == 0) { tagtype = NTAG_I2C_2K; break; }
                 else if (memcmp(version, "\x00\x04\x04\x05\x02\x02\x13", 7) == 0) { tagtype = NTAG_I2C_1K_PLUS; break; }
                 else if (memcmp(version, "\x00\x04\x04\x05\x02\x02\x15", 7) == 0) { tagtype = NTAG_I2C_2K_PLUS; break; }
-                else if (memcmp(version, "\x00\x34\x21\x01\x01\x00\x0E", 7) == 0) { tagtype = UL; break; }
                 else if (version[2] == 0x04) { tagtype = NTAG; break; }
                 else if (version[2] == 0x03) { tagtype = UL_EV1; }
                 break;
@@ -2064,7 +2063,16 @@ static int CmdHF14AMfURestore(const char *Cmd) {
     bool verbose = arg_get_lit(ctx, 7);
     CLIParserFree(ctx);
 
+
     bool has_key = false;
+    if (ak_len > 0) {
+        if (ak_len != 4 || ak_len != 16) {
+            PrintAndLogEx(ERR, "Wrong key length. expected 4 or 16, got %d", ak_len);
+            return PM3_EINVARG;
+        } else {
+            has_key = true;
+        }
+    }
 
     uint8_t *dump = NULL;
     size_t bytes_read = 0;

From 12a28fcd16e5934b8d7bed94ecebf3bbc2ad0121 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 13:38:58 +0100
Subject: [PATCH 433/682] cppchecker fix hf 14b

---
 client/src/cmdhf14b.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/client/src/cmdhf14b.c b/client/src/cmdhf14b.c
index 5676aa41f..ff297a4f9 100644
--- a/client/src/cmdhf14b.c
+++ b/client/src/cmdhf14b.c
@@ -26,7 +26,7 @@
 #include "mifare/ndef.h"   // NDEFRecordsDecodeAndPrint
 #include "aidsearch.h"
 
-
+#define MAX_14B_TIMEOUT 40542464 // = (2^32-1) * (8*16) / 13560000Hz * 1000ms/s
 #define TIMEOUT 2000
 #define APDU_TIMEOUT 2000
 
@@ -202,7 +202,6 @@ static bool wait_cmd_14b(bool verbose, bool is_select) {
                               (crc) ? _GREEN_("ok") : _RED_("fail")
                              );
             } else if (len == 0) {
-                if (verbose)
                     PrintAndLogEx(INFO, "no response from tag");
             } else {
                 PrintAndLogEx(SUCCESS, "%s", sprint_hex(data, len));
@@ -300,7 +299,7 @@ static int CmdHF14BCmdRaw(const char *Cmd) {
         arg_lit0(NULL, "sr",            "activate field, use SRx ST select"),
         arg_lit0(NULL, "cts",           "activate field, use ASK C-ticket select"),
         arg_lit0("c", "crc",            "calculate and append CRC"),
-        arg_lit0("r", "noresponse",         "do not read response from card"),
+        arg_lit0(NULL, "noresponse", "do not read response from card"),
         arg_int0("t", "timeout",   "<dec>", "timeout in ms"),
         arg_lit0("v", "verbose",            "verbose"),
         arg_strx0("d", "data",     "<hex>", "data, bytes to send"),
@@ -353,7 +352,7 @@ static int CmdHF14BCmdRaw(const char *Cmd) {
             user_timeout = MAX_14B_TIMEOUT;
             PrintAndLogEx(INFO, "set timeout to 40542 seconds (11.26 hours). The max we can wait for response");
         }
-        time_wait = 13560000 / 1000 / (8 * 16) * user_timeout; // timeout in ETUs (time to transfer 1 bit, approx. 9.4 us)
+        time_wait = (uint32_t)((13560000 / 1000 / (8 * 16)) * user_timeout); // timeout in ETUs (time to transfer 1 bit, approx. 9.4 us)
         if (verbose)
             PrintAndLogEx(INFO, "using timeout %u", user_timeout);
     }
@@ -408,8 +407,7 @@ static bool get_14b_UID(iso14b_card_select_t *card) {
     if (card == NULL)
         return false;
 
-    int status = 0;
-
+    int status;
     PacketResponseNG resp;
     clearCommandBuffer();
     SendCommandMIX(CMD_HF_ISO14443B_COMMAND, ISO14B_CONNECT | ISO14B_SELECT_SR | ISO14B_DISCONNECT, 0, 0, NULL, 0);
@@ -1544,13 +1542,13 @@ static int handle_14b_apdu(bool chainingin, uint8_t *datain, int datainlen, bool
 
     uint32_t time_wait = 0;
     if (user_timeout > 0) {
-#define MAX_14B_TIMEOUT 40542464 // = (2^32-1) * (8*16) / 13560000Hz * 1000ms/s
+
         flags |= ISO14B_SET_TIMEOUT;
         if (user_timeout > MAX_14B_TIMEOUT) {
             user_timeout = MAX_14B_TIMEOUT;
             PrintAndLogEx(INFO, "set timeout to 40542 seconds (11.26 hours). The max we can wait for response");
         }
-        time_wait = 13560000 / 1000 / (8 * 16) * user_timeout; // timeout in ETUs (time to transfer 1 bit, approx. 9.4 us)
+        time_wait = (uint32_t)((13560000 / 1000 / (8 * 16)) * user_timeout); // timeout in ETUs (time to transfer 1 bit, approx. 9.4 us)
     }
 
     // "Command APDU" length should be 5+255+1, but javacard's APDU buffer might be smaller - 133 bytes

From 785d790ea0d3e0cd2b4a10f09735e8cd41d3d715 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 13:48:28 +0100
Subject: [PATCH 434/682] cppchecker fix

---
 client/src/cmdlfem4x05.c | 51 +++++++++++++++++++---------------------
 1 file changed, 24 insertions(+), 27 deletions(-)

diff --git a/client/src/cmdlfem4x05.c b/client/src/cmdlfem4x05.c
index 87303124b..0a65c1cb2 100644
--- a/client/src/cmdlfem4x05.c
+++ b/client/src/cmdlfem4x05.c
@@ -125,10 +125,9 @@ static int doPreambleSearch(size_t *startIdx) {
 
     // skip first two 0 bits as they might have been missed in the demod
     uint8_t preamble[EM_PREAMBLE_LEN] = {0, 0, 0, 0, 1, 0, 1, 0};
-    uint8_t errpreamble[EM_PREAMBLE_LEN] = {0, 0, 0, 0, 0, 0, 0, 1};
-
     if (!preambleSearchEx(DemodBuffer, preamble, EM_PREAMBLE_LEN, &size, startIdx, true)) {
 
+        uint8_t errpreamble[EM_PREAMBLE_LEN] = {0, 0, 0, 0, 0, 0, 0, 1};
         if (!preambleSearchEx(DemodBuffer, errpreamble, EM_PREAMBLE_LEN, &size, startIdx, true)) {
             PrintAndLogEx(DEBUG, "DEBUG: Error - EM4305 preamble not found :: %zu", *startIdx);
             return PM3_ESOFT;
@@ -258,10 +257,10 @@ static int em4x05_setdemod_buffer(uint32_t *word, size_t idx) {
 // should cover 90% of known used configs
 // the rest will need to be manually demoded for now...
 static int em4x05_demod_resp(uint32_t *word, bool onlyPreamble) {
-    size_t idx = 0;
     *word = 0;
+    int res;
+    size_t idx = 0;
     bool found_err = false;
-    int res = PM3_SUCCESS;
     do {
         if (detectASK_MAN()) {
             res = doPreambleSearch(&idx);
@@ -1694,6 +1693,10 @@ int CmdEM4x05Unlock(const char *Cmd) {
 
         // write
         res = unlock_write_protect(use_pwd, pwd, write_value, verbose);
+        if (res != PM3_SUCCESS) {
+            PrintAndLogEx(WARNING, "failed unlock write");
+            return PM3_ESOFT;
+        }
 
         // read after trigger
         res = em4x05_read_word_ext(14, pwd, use_pwd, &word14);
@@ -1853,7 +1856,7 @@ int CmdEM4x05Unlock(const char *Cmd) {
         PrintAndLogEx(INFO, "Old protection word => " _YELLOW_("%08X"), search_value);
         char bitstring[9] = {0};
         for (int i = 0; i < 8; i++) {
-            bitstring[i] = bitflips & (0xF << ((7 - i) * 4)) ? 'x' : '.';
+            bitstring[i] = (bitflips & (0xF << ((7 - i) * 4))) ? 'x' : '.';
         }
         // compute number of bits flipped
 
@@ -1955,23 +1958,8 @@ uint32_t static em4x05_Sniff_GetBlock(char *bits, bool fwd) {
 
 int CmdEM4x05Sniff(const char *Cmd) {
 
-    bool sampleData = true;
-    bool haveData = false;
-    size_t idx = 0;
-    char cmdText [100];
-    char dataText [100];
-    char blkAddr[4];
-    char bits[80];
-    int bitidx;
-    int ZeroWidth;    // 32-42 "1" is 32
-    int CycleWidth;
-    size_t pulseSamples;
-    size_t pktOffset;
-    int i;
-    bool eop = false;
-    uint32_t tmpValue;
-    bool pwd = false;
-    bool fwd = false;
+    bool pwd = false, fwd = false;
+    bool haveData, sampleData = true;
 
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "lf em 4x05_sniff",
@@ -1988,12 +1976,21 @@ int CmdEM4x05Sniff(const char *Cmd) {
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
-
-    sampleData = !arg_get_lit(ctx, 1);
+    sampleData = (arg_get_lit(ctx, 1) == false);
     fwd = arg_get_lit(ctx, 2);
-
     CLIParserFree(ctx);
 
+    char cmdText[100];
+    char dataText[100];
+    char blkAddr[4];
+    char bits[80];
+    int i, bitidx;
+    int ZeroWidth;    // 32-42 "1" is 32
+    int CycleWidth;
+    size_t idx = 0, pulseSamples, pktOffset;
+    uint32_t tmpValue;
+    bool eop = false;
+
     // setup and sample data from Proxmark
     // if not directed to existing sample/graphbuffer
     if (sampleData) {
@@ -2076,7 +2073,7 @@ int CmdEM4x05Sniff(const char *Cmd) {
                             haveData = true;
                             sprintf(cmdText, "Write");
                             tmpValue = (bits[4] - '0') + ((bits[5] - '0') << 1) + ((bits[6] - '0') << 2)  + ((bits[7] - '0') << 3);
-                            sprintf(blkAddr, "%d", tmpValue);
+                            sprintf(blkAddr, "%u", tmpValue);
                             if (tmpValue == 2) {
                                 pwd = true;
                             }
@@ -2090,7 +2087,7 @@ int CmdEM4x05Sniff(const char *Cmd) {
                             pwd = false;
                             sprintf(cmdText, "Read");
                             tmpValue = (bits[4] - '0') + ((bits[5] - '0') << 1) + ((bits[6] - '0') << 2)  + ((bits[7] - '0') << 3);
-                            sprintf(blkAddr, "%d", tmpValue);
+                            sprintf(blkAddr, "%u", tmpValue);
                             sprintf(dataText, " ");
                         }
 

From 46767a07e7bc365d2127d392d8eff1a4876a7fab Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 13:50:27 +0100
Subject: [PATCH 435/682] cppchecker

---
 client/src/graph.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/graph.c b/client/src/graph.c
index 21b77e427..eac2048be 100644
--- a/client/src/graph.c
+++ b/client/src/graph.c
@@ -149,7 +149,7 @@ void convertGraphFromBitstreamEx(int hi, int low) {
 }
 
 // Get or auto-detect ask clock rate
-int GetAskClock(const char *str, bool printAns) {
+int GetAskClock(const char *str, bool verbose) {
     if (getSignalProperties()->isnoise)
         return -1;
 

From 3fead5b93c641e61ca5336e39566c7c325cad789 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 13:53:37 +0100
Subject: [PATCH 436/682] cppchecker...

---
 client/src/graph.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/graph.c b/client/src/graph.c
index eac2048be..5c3221716 100644
--- a/client/src/graph.c
+++ b/client/src/graph.c
@@ -183,7 +183,7 @@ int GetAskClock(const char *str, bool verbose) {
         setClockGrid(clock1, idx);
     }
     // Only print this message if we're not looping something
-    if (printAns || g_debugMode)
+    if (verbose || g_debugMode)
         PrintAndLogEx(SUCCESS, "Auto-detected clock rate: %d, Best Starting Position: %d", clock1, idx);
 
     free(bits);

From 3ad822844f4a0f83de26cfb67808fc13d795cabd Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 14:08:47 +0100
Subject: [PATCH 437/682] cppchecker ...

---
 client/src/cmdhf14b.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/client/src/cmdhf14b.c b/client/src/cmdhf14b.c
index ff297a4f9..4de6ddd12 100644
--- a/client/src/cmdhf14b.c
+++ b/client/src/cmdhf14b.c
@@ -26,7 +26,7 @@
 #include "mifare/ndef.h"   // NDEFRecordsDecodeAndPrint
 #include "aidsearch.h"
 
-#define MAX_14B_TIMEOUT 40542464 // = (2^32-1) * (8*16) / 13560000Hz * 1000ms/s
+#define MAX_14B_TIMEOUT    (uint32_t)40542464 // = (2^32-1) * (8*16) / 13560000Hz * 1000ms/s
 #define TIMEOUT 2000
 #define APDU_TIMEOUT 2000
 
@@ -346,7 +346,6 @@ static int CmdHF14BCmdRaw(const char *Cmd) {
     uint32_t time_wait = 0;
     if (user_timeout > 0) {
 
-#define MAX_14B_TIMEOUT 40542464 // = (2^32-1) * (8*16) / 13560000Hz * 1000ms/s
         flags |= ISO14B_SET_TIMEOUT;
         if (user_timeout > MAX_14B_TIMEOUT) {
             user_timeout = MAX_14B_TIMEOUT;

From beb6a8bf110e5323a40684b195e459f323c525e2 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 14:09:25 +0100
Subject: [PATCH 438/682] cppchecker

---
 client/src/cmddata.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmddata.c b/client/src/cmddata.c
index d2d28d0f0..82f05bb59 100644
--- a/client/src/cmddata.c
+++ b/client/src/cmddata.c
@@ -1576,7 +1576,7 @@ int getSamplesEx(uint32_t start, uint32_t end, bool verbose) {
 
     uint32_t n = end - start;
 
-    if (n <= 0 || n > pm3_capabilities.bigbuf_size - 1)
+    if (n == 0 || n > pm3_capabilities.bigbuf_size - 1)
         n = pm3_capabilities.bigbuf_size - 1;
 
     if (verbose)

From 10e28291236f3de530ad12c06874bbef1ecd3492 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 14:11:33 +0100
Subject: [PATCH 439/682] cppchecker fix UID might be NULL

---
 client/src/cmdhf15.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/client/src/cmdhf15.c b/client/src/cmdhf15.c
index 3eebbce74..04ffbae45 100644
--- a/client/src/cmdhf15.c
+++ b/client/src/cmdhf15.c
@@ -459,6 +459,10 @@ static int nxp_15693_print_signature(uint8_t *uid, uint8_t *signature) {
 // uid[8] tag uid
 // returns description of the best match
 static const char *getTagInfo_15(uint8_t *uid) {
+    if (uid == NULL) {
+        return "";
+    }
+
     uint64_t myuid, mask;
     int i = 0, best = -1;
     memcpy(&myuid, uid, sizeof(uint64_t));

From 11a95d73510ddee705e85a0c64f017f186bfd35d Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 14:16:42 +0100
Subject: [PATCH 440/682] cppchecker fix

---
 client/src/cmdhfemrtd.c | 31 ++++++++++++-------------------
 1 file changed, 12 insertions(+), 19 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index afe5b6b6f..255939ab0 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -191,12 +191,10 @@ static int emrtd_exchange_commands_noout(const char *cmd, bool activate_field, b
 
 static char emrtd_calculate_check_digit(char *data) {
     int mrz_weight[] = {7, 3, 1};
-    int cd = 0;
-    int value = 0;
-    char d;
+    int value, cd = 0;
 
     for (int i = 0; i < strlen(data); i++) {
-        d = data[i];
+        char d = data[i];
         if ('A' <= d && d <= 'Z') {
             value = d - 55;
         } else if ('a' <= d && d <= 'z') {
@@ -652,19 +650,16 @@ static bool emrtd_lds_get_data_by_tag(uint8_t *datain, size_t datainlen, uint8_t
         offset += emrtd_get_asn1_field_length(datain, datainlen, offset);
     }
 
-    int e_idlen = 0;
-    int e_datalen = 0;
-    int e_fieldlen = 0;
     while (offset < datainlen) {
         PrintAndLogEx(DEBUG, "emrtd_lds_get_data_by_tag, offset: %i, data: %X", offset, *(datain + offset));
         // Determine element ID length to set as offset on asn1datalength
-        e_idlen = emrtd_lds_determine_tag_length(*(datain + offset));
+        int e_idlen = emrtd_lds_determine_tag_length(*(datain + offset));
 
         // Get the length of the element
-        e_datalen = emrtd_get_asn1_data_length(datain + offset, datainlen - offset, e_idlen);
+        int e_datalen = emrtd_get_asn1_data_length(datain + offset, datainlen - offset, e_idlen);
 
         // Get the length of the element's length
-        e_fieldlen = emrtd_get_asn1_field_length(datain + offset, datainlen - offset, e_idlen);
+        int e_fieldlen = emrtd_get_asn1_field_length(datain + offset, datainlen - offset, e_idlen);
 
         PrintAndLogEx(DEBUG, "emrtd_lds_get_data_by_tag, e_idlen: %02X, e_datalen: %02X, e_fieldlen: %02X", e_idlen, e_datalen, e_fieldlen);
 
@@ -828,7 +823,8 @@ static bool emrtd_dump_file(uint8_t *ks_enc, uint8_t *ks_mac, uint8_t *ssc, cons
 
     char *filepath = calloc(strlen(path) + 100, sizeof(char));
     if (filepath == NULL)
-        return PM3_EMALLOC;
+        return false;
+
     strcpy(filepath, path);
     strncat(filepath, PATHSEP, 2);
     strcat(filepath, name);
@@ -1649,8 +1645,6 @@ static int emrtd_parse_ef_sod_hashes(uint8_t *data, size_t datalen, uint8_t *has
 
     size_t emrtdsiglen = 0;
     size_t hashlistlen = 0;
-    size_t e_datalen = 0;
-    size_t e_fieldlen = 0;
     size_t offset = 0;
 
     if (emrtd_ef_sod_extract_signatures(data, datalen, emrtdsig, &emrtdsiglen) != PM3_SUCCESS) {
@@ -1670,10 +1664,10 @@ static int emrtd_parse_ef_sod_hashes(uint8_t *data, size_t datalen, uint8_t *has
 
     while (offset < hashlistlen) {
         // Get the length of the element
-        e_datalen = emrtd_get_asn1_data_length(hashlist + offset, hashlistlen - offset, 1);
+        int e_datalen = emrtd_get_asn1_data_length(hashlist + offset, hashlistlen - offset, 1);
 
         // Get the length of the element's length
-        e_fieldlen = emrtd_get_asn1_field_length(hashlist + offset, hashlistlen - offset, 1);
+        int e_fieldlen = emrtd_get_asn1_field_length(hashlist + offset, hashlistlen - offset, 1);
 
         switch (hashlist[offset]) {
             case 0x30:
@@ -1703,11 +1697,10 @@ static int emrtd_print_ef_sod_info(uint8_t *dg_hashes_calc, uint8_t *dg_hashes_s
         PrintAndLogEx(SUCCESS, "Hash algorithm: " _YELLOW_("%s"), hashalg_table[hash_algo].name);
 
         uint8_t all_zeroes[64] = { 0x00 };
-        bool calc_all_zero, sod_all_zero, hash_matches;
         for (int i = 1; i <= 16; i++) {
-            calc_all_zero = (memcmp(dg_hashes_calc + (i * 64), all_zeroes, hashalg_table[hash_algo].hashlen) == 0);
-            sod_all_zero = (memcmp(dg_hashes_sod + (i * 64), all_zeroes, hashalg_table[hash_algo].hashlen) == 0);
-            hash_matches = (memcmp(dg_hashes_sod + (i * 64), dg_hashes_calc + (i * 64), hashalg_table[hash_algo].hashlen) == 0);
+            bool calc_all_zero = (memcmp(dg_hashes_calc + (i * 64), all_zeroes, hashalg_table[hash_algo].hashlen) == 0);
+            bool sod_all_zero = (memcmp(dg_hashes_sod + (i * 64), all_zeroes, hashalg_table[hash_algo].hashlen) == 0);
+            bool hash_matches = (memcmp(dg_hashes_sod + (i * 64), dg_hashes_calc + (i * 64), hashalg_table[hash_algo].hashlen) == 0);
             // Ignore files we don't haven't read and lack hashes to
             if (calc_all_zero == true && sod_all_zero == true) {
                 continue;

From a5f42128099ce68bf2d765f31edcf71baeb1476e Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 14:18:44 +0100
Subject: [PATCH 441/682] cppchecker fix

---
 client/src/cmdhficlass.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c
index 7b90a5bbf..2a0e678c6 100644
--- a/client/src/cmdhficlass.c
+++ b/client/src/cmdhficlass.c
@@ -68,7 +68,7 @@ bool check_known_default(uint8_t *csn, uint8_t *epurse, uint8_t *rmac, uint8_t *
 
     iclass_prekey_t *prekey = calloc(ICLASS_KEYS_MAX, sizeof(iclass_prekey_t));
     if (prekey == false) {
-        return PM3_EMALLOC;
+        return false;
     }
 
     uint8_t ccnr[12];
@@ -1075,10 +1075,8 @@ static int CmdHFiClassDecrypt(const char *Cmd) {
 
                 PrintAndLogEx(NORMAL, "");
                 PrintAndLogEx(INFO, "Block 9 decoder");
-                uint8_t pinsize = 0;
                 if (use_sc) {
-                    pinsize = GetPinSize(decrypted + (8 * 6));
-
+                    uint8_t pinsize = GetPinSize(decrypted + (8 * 6));
                     if (pinsize > 0) {
 
                         uint64_t pin = bytes_to_num(decrypted + (8 * 9), 5);

From 12c0eb97fb111def689e761d53beef33f94c277b Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 14:20:33 +0100
Subject: [PATCH 442/682] cppchecker fix

---
 client/src/cmdhfmfu.c       | 2 +-
 client/src/cmdhfwaveshare.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index ac9d44802..9af773420 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -2066,7 +2066,7 @@ static int CmdHF14AMfURestore(const char *Cmd) {
 
     bool has_key = false;
     if (ak_len > 0) {
-        if (ak_len != 4 || ak_len != 16) {
+        if (ak_len != 4 && ak_len != 16) {
             PrintAndLogEx(ERR, "Wrong key length. expected 4 or 16, got %d", ak_len);
             return PM3_EINVARG;
         } else {
diff --git a/client/src/cmdhfwaveshare.c b/client/src/cmdhfwaveshare.c
index 932012f98..813795bc5 100644
--- a/client/src/cmdhfwaveshare.c
+++ b/client/src/cmdhfwaveshare.c
@@ -1004,7 +1004,7 @@ static int CmdHF14AWSLoadBmp(const char *Cmd) {
                  );
 
     char modeldesc[40];
-    snprintf(modeldesc, sizeof(modeldesc), "model number [0 - %u] of your tag", MEND - 1);
+    snprintf(modeldesc, sizeof(modeldesc), "model number [0 - %d] of your tag", MEND - 1);
 
     void *argtable[] = {
         arg_param_begin,

From 66332149571dc7bb3f10d5eeaa65d1009ac42d0d Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 14:22:44 +0100
Subject: [PATCH 443/682] cppchecker fix

---
 client/src/cmdhfwaveshare.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/client/src/cmdhfwaveshare.c b/client/src/cmdhfwaveshare.c
index 813795bc5..d2a0e7b6e 100644
--- a/client/src/cmdhfwaveshare.c
+++ b/client/src/cmdhfwaveshare.c
@@ -183,8 +183,6 @@ static void dither_chan_inplace(int16_t *chan, uint16_t width, uint16_t height)
             }
             if (Y < height - 1) {
                 chan[X - 1 + (Y + 1) * width] = chan[X - 1 + (Y + 1) * width] + m[1] / 16 * err;
-            }
-            if (Y < height - 1) {
                 chan[X     + (Y + 1) * width] = chan[X     + (Y + 1) * width] + m[2] / 16 * err;
             }
             if ((X < width - 1) && (Y < height - 1)) {
@@ -250,8 +248,6 @@ static void dither_rgb_inplace(int16_t *chanR, int16_t *chanG, int16_t *chanB, u
                     chanR[XX - 1 + (Y + 1) * width] = (chanR[XX - 1 + (Y + 1) * width] + m[3] / 16 * errR);
                     chanG[XX - 1 + (Y + 1) * width] = (chanG[XX - 1 + (Y + 1) * width] + m[3] / 16 * errG);
                     chanB[XX - 1 + (Y + 1) * width] = (chanB[XX - 1 + (Y + 1) * width] + m[3] / 16 * errB);
-                }
-                if (Y < height - 1) {
                     chanR[XX     + (Y + 1) * width] = (chanR[XX     + (Y + 1) * width] + m[2] / 16 * errR);
                     chanG[XX     + (Y + 1) * width] = (chanG[XX     + (Y + 1) * width] + m[2] / 16 * errG);
                     chanB[XX     + (Y + 1) * width] = (chanB[XX     + (Y + 1) * width] + m[2] / 16 * errB);
@@ -271,8 +267,6 @@ static void dither_rgb_inplace(int16_t *chanR, int16_t *chanG, int16_t *chanB, u
                     chanR[XX - 1 + (Y + 1) * width] = (chanR[XX - 1 + (Y + 1) * width] + m[1] / 16 * errR);
                     chanG[XX - 1 + (Y + 1) * width] = (chanG[XX - 1 + (Y + 1) * width] + m[1] / 16 * errG);
                     chanB[XX - 1 + (Y + 1) * width] = (chanB[XX - 1 + (Y + 1) * width] + m[1] / 16 * errB);
-                }
-                if (Y < height - 1) {
                     chanR[XX     + (Y + 1) * width] = (chanR[XX     + (Y + 1) * width] + m[2] / 16 * errR);
                     chanG[XX     + (Y + 1) * width] = (chanG[XX     + (Y + 1) * width] + m[2] / 16 * errG);
                     chanB[XX     + (Y + 1) * width] = (chanB[XX     + (Y + 1) * width] + m[2] / 16 * errB);

From 2c73337bde37e2271534b621d454c85e2fe6e364 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 14:32:57 +0100
Subject: [PATCH 444/682] cppchecker ,, silence a warning

---
 client/src/preferences.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/client/src/preferences.c b/client/src/preferences.c
index b133dd428..92a91e54a 100644
--- a/client/src/preferences.c
+++ b/client/src/preferences.c
@@ -834,7 +834,7 @@ static int setCmdSavePaths(const char *Cmd) {
     CLIParserFree(ctx);
 
     if (deflen == 0 && dulen == 0 && tlen == 0) {
-        PrintAndLogEx(FAILED, "Must give atleast one path");
+        PrintAndLogEx(FAILED, "Must give at least one path");
         return PM3_EINVARG;
     }
 
@@ -853,6 +853,11 @@ static int setCmdSavePaths(const char *Cmd) {
         path = trace_path;
     }
 
+    if (path == NULL) {
+        PrintAndLogEx(FAILED, "Must give at least one path");
+        return PM3_EINVARG;
+    }
+
     // remove trailing slash.
     size_t nplen = strlen(path);
     if ((path[nplen - 1] == '/') || (path[nplen - 1] == '\\')) {

From 56b4a480cdb4efd6b63e242f3f234b0aee9fe4f4 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 14:33:30 +0100
Subject: [PATCH 445/682] cppchecker fix,  realloc should already freed it

---
 client/src/ui.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/ui.c b/client/src/ui.c
index 293a98c58..99c2cdde5 100644
--- a/client/src/ui.c
+++ b/client/src/ui.c
@@ -106,7 +106,7 @@ int searchHomeFilePath(char **foundpath, const char *subdir, const char *filenam
         pathlen += strlen(subdir);
         char *tmp = realloc(path, pathlen * sizeof(char));
         if (tmp == NULL) {
-            free(path);
+            //free(path);
             return PM3_EMALLOC;
         }
         path = tmp;
@@ -146,7 +146,7 @@ int searchHomeFilePath(char **foundpath, const char *subdir, const char *filenam
     pathlen += strlen(filename);
     char *tmp = realloc(path, pathlen * sizeof(char));
     if (tmp == NULL) {
-        free(path);
+        //free(path);
         return PM3_EMALLOC;
     }
     path = tmp;

From 405b93f1099a22d3aa56eda82755d3296009c89d Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 15:29:52 +0100
Subject: [PATCH 446/682] coverity fix 309975

---
 client/src/cmdlft55xx.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index d98347342..3903a9547 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -2966,8 +2966,11 @@ static int CmdT55xxChkPwds(const char *Cmd) {
                   "lf t55xx chk --em aa11223344        -> try known pwdgen algo from some cloners based on EM4100 ID"
                  );
 
-    // 4 + (5 or 6)
-   void *argtable[9] = {
+   // Calculate size of argtable accordingly:
+   // 1 (help) + 3 (three user specified params) + ( 5 or 6  T55XX_DLMODE)
+   // 4 + (T55XX_DLMODE_xxx 5)
+   // 4 + (T55XX_DLMODE_ALL 6) == 10
+   void *argtable[10] = {
         arg_param_begin,
         arg_lit0("m", "fm", "use dictionary from flash memory (RDV4)"),
         arg_str0("f", "file", "<filename>", "file name"),

From 6737f6f3cde8455a8692c8460b7dca8c7bb130a0 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 20:31:39 +0100
Subject: [PATCH 447/682] sanitize fix - lf/hf tune heap overflow

---
 client/src/cmdlfgallagher.c |  1 -
 client/src/cmdtrace.c       |  9 ++++-----
 client/src/ui.c             | 31 +++++++++++++++++--------------
 3 files changed, 21 insertions(+), 20 deletions(-)

diff --git a/client/src/cmdlfgallagher.c b/client/src/cmdlfgallagher.c
index 12b6b9b49..3e13aadf3 100644
--- a/client/src/cmdlfgallagher.c
+++ b/client/src/cmdlfgallagher.c
@@ -277,7 +277,6 @@ static int CmdGallagherSim(const char *Cmd) {
         return resp.status;
 
     return PM3_SUCCESS;
-    return PM3_SUCCESS;
 }
 
 static command_t CommandTable[] = {
diff --git a/client/src/cmdtrace.c b/client/src/cmdtrace.c
index a95503813..c47eff9d3 100644
--- a/client/src/cmdtrace.c
+++ b/client/src/cmdtrace.c
@@ -582,11 +582,10 @@ static int CmdTraceSave(const char *Cmd) {
 
     if (g_traceLen == 0) {
         download_trace();
-    }
-
-    if (g_traceLen == 0) {
-        PrintAndLogEx(WARNING, "trace is empty, nothing to save");
-        return PM3_SUCCESS;
+        if (g_traceLen == 0) {
+            PrintAndLogEx(WARNING, "trace is empty, nothing to save");
+            return PM3_SUCCESS;
+        }
     }
 
     saveFile(filename, ".trace", g_trace, g_traceLen);
diff --git a/client/src/ui.c b/client/src/ui.c
index 99c2cdde5..3c4069f5b 100644
--- a/client/src/ui.c
+++ b/client/src/ui.c
@@ -642,9 +642,12 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
     prev_cols = cols;
 #endif
     int width = cols - 35;
+    if (width < 1)
+        return;
+
 #define PERCENTAGE(V, T)   ((V * width) / T)
     // x/8 fractional part of the percentage
-#define PERCENTAGEFRAC(V, T)   ((int)(((((float)V * width) / T) - ((V * width) / T)) * 8))
+#define PERCENTAGEFRAC(V, T)   ((uint8_t)(((((float)V * width) / T) - ((V * width) / T)) * 8))
 
     const char *smoothtable[] = {
         "\xe2\x80\x80",
@@ -658,14 +661,15 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
         "\xe2\x96\x88",
     };
 
-    uint8_t mode = (session.emoji_mode == EMO_EMOJI);
+    int mode = (session.emoji_mode == EMO_EMOJI);
 
     const char *block[] = {"#", "\xe2\x96\x88"};
     // use a 3-byte space in emoji mode to ease computations
     const char *space[] = {" ", "\xe2\x80\x80"};
-    uint8_t unit = strlen(block[mode]);
+
+    size_t unit = strlen(block[mode]);
     // +1 for \0
-    char *bar = calloc(unit * width + 1, sizeof(uint8_t));
+    char *bar = (char *)calloc(unit * width + 1, sizeof(uint8_t));
 
     uint8_t value = PERCENTAGE(count, max);
 
@@ -687,7 +691,7 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
     }
     // color buffer
     size_t collen = strlen(bar) + 40;
-    char *cbar = calloc(collen, sizeof(uint8_t));
+    char *cbar = (char *)calloc(collen, sizeof(uint8_t));
 
     // Add colors
     if (session.supports_colors) {
@@ -695,23 +699,23 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
         int p20 = unit * (width * 20 / 100);
         snprintf(cbar,  collen,  _GREEN_("%.*s"), p60, bar);
         snprintf(cbar + strlen(cbar), collen - strlen(cbar), _CYAN_("%.*s"), p20,  bar + p60);
-        snprintf(cbar + strlen(cbar), collen - strlen(cbar), _YELLOW_("%.*s"), unit * width - p60 - p20, bar + p60 + p20);
+        snprintf(cbar + strlen(cbar), collen - strlen(cbar), _YELLOW_("%.*s"), (int)(unit * width - p60 - p20), bar + p60 + p20);
     } else {
         snprintf(cbar,  collen,  "%s", bar);
     }
 
-    size_t len = strlen(cbar) + 32;
-    char *buffer = calloc(len, sizeof(uint8_t));
+    size_t olen = strlen(cbar) + 40;
+    char *out = (char *)calloc(olen, sizeof(uint8_t));
 
     switch (style) {
         case STYLE_BAR: {
-            sprintf(buffer, "%s", cbar);
-            printf("\b%c[2K\r[" _YELLOW_("=")"] %s", 27, buffer);
+            sprintf(out, "%s", cbar);
+            printf("\b%c[2K\r[" _YELLOW_("=")"] %s", 27, out);
             break;
         }
         case STYLE_MIXED: {
-            sprintf(buffer, "%s [ %zu mV / %2u V / %2u Vmax ]   ", cbar, count, (uint32_t)(count / 1000), (uint32_t)(max / 1000));
-            printf("\b%c[2K\r[" _YELLOW_("=")"] %s ", 27, buffer);
+            sprintf(out, "%s [ %zu mV / %2u V / %2u Vmax ]", cbar, count, (uint32_t)(count / 1000), (uint32_t)(max / 1000));
+            printf("\b%c[2K\r[" _YELLOW_("=")"] %s", 27, out);
             break;
         }
         case STYLE_VALUE: {
@@ -719,9 +723,8 @@ void print_progress(size_t count, uint64_t max, barMode_t style) {
             break;
         }
     }
-
     fflush(stdout);
-    free(buffer);
+    free(out);
     free(bar);
     free(cbar);
 }

From 90fb78ff1b5bbbd0559ff45fcb642a8b0be52790 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 21:38:30 +0100
Subject: [PATCH 448/682] cppchecker fix

---
 client/src/loclass/ikeys.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/client/src/loclass/ikeys.c b/client/src/loclass/ikeys.c
index d2798a14e..c311e93b1 100644
--- a/client/src/loclass/ikeys.c
+++ b/client/src/loclass/ikeys.c
@@ -91,12 +91,12 @@ uint8_t pi[35] = {
  * @param n bitnumber
  * @return
  */
-#define getSixBitByte(c, n)  ((uint8_t)(((c) >> (42 - 6 * (n))) & 0x3F))
-/*
+//#define getSixBitByte(c, n)  ((uint8_t)(((c) >> (42 - 6 * (n))) & 0x3F))
+
 static inline uint8_t getSixBitByte(uint64_t c, int n) {
     return (c >> (42 - 6 * n)) & 0x3F;
 }
-*/
+
 /**
  * @brief Puts back a six-bit 'byte' into a uint64_t.
  * @param c buffer

From 165ceb122f7a905fa8d7f063a405dd2cec47dd56 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 28 Jan 2021 21:41:57 +0100
Subject: [PATCH 449/682] update to correct filename for the sample file

---
 client/src/cmdhficlass.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c
index 2a0e678c6..45268b4da 100644
--- a/client/src/cmdhficlass.c
+++ b/client/src/cmdhficlass.c
@@ -2074,7 +2074,7 @@ static int CmdHFiClass_loclass(const char *Cmd) {
                   "  <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>\n"
                   "  <8 byte CSN><8 byte CC><4 byte NR><4 byte MAC>\n"
                   "   ... totalling N*24 bytes",
-                  "hf iclass loclass -f iclass-dump.bin\n"
+                  "hf iclass loclass -f iclass_dump.bin\n"
                   "hf iclass loclass --test");
 
     void *argtable[] = {

From 82de4c134c3048c11e6491bd9b87c1cdd35f6cfa Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Thu, 28 Jan 2021 23:32:47 +0100
Subject: [PATCH 450/682] changed LED behavior

---
 armsrc/Standalone/lf_tharexde.c |  10 +--
 armsrc/em4x50.c                 | 106 +++++++++++++++++---------------
 2 files changed, 63 insertions(+), 53 deletions(-)

diff --git a/armsrc/Standalone/lf_tharexde.c b/armsrc/Standalone/lf_tharexde.c
index 8304edb2a..96e8fb48d 100644
--- a/armsrc/Standalone/lf_tharexde.c
+++ b/armsrc/Standalone/lf_tharexde.c
@@ -93,9 +93,11 @@ static bool get_input_data_from_file(uint32_t *tag, char *inputfile) {
         rdv40_spiffs_read_as_filetype(inputfile, mem, size, RDV40_SPIFFS_SAFETY_SAFE);
 
         now = size / 9;
-        for (int i = 0; i < now; i++)
-            for (int j = 0; j < 4; j++)
+        for (int i = 0; i < now; i++) {
+            for (int j = 0; j < 4; j++) {
                 tag[i] |= (hex2int(mem[2 * j + 9 * i]) << 4 | hex2int(mem[2 * j + 1 + 9 * i])) << ((3 - j) * 8);
+            }
+        }
 
         Dbprintf(_YELLOW_("read tag data from input file"));
     }
@@ -107,14 +109,12 @@ static bool get_input_data_from_file(uint32_t *tag, char *inputfile) {
 
 static void append(const char *filename, uint8_t *entry, size_t entry_len) {
 
-    LED_D_ON();
     if (log_exists == false) {
         rdv40_spiffs_write(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
         log_exists = true;
     } else {
         rdv40_spiffs_append(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
     }
-    LED_D_OFF();
 }
 
 void ModInfo(void) {
@@ -179,6 +179,7 @@ void RunMod(void) {
                 // init; start with command = standard read mode
                 em4x50_setup_sim();
                 gLogin = false;
+                LED_D_OFF();
                 gWritePasswordProcess = false;
                 command = EM4X50_COMMAND_STANDARD_READ;
 
@@ -197,6 +198,7 @@ void RunMod(void) {
             if (command == PM3_ETIMEOUT) {
                 command = EM4X50_COMMAND_STANDARD_READ;
                 gLogin = false;
+                LED_D_OFF();
             }
             
         } else if (state == STATE_READ) {
diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index b2107298c..14097c485 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -167,8 +167,6 @@ void em4x50_setup_sim(void) {
      
     // Watchdog hit
     WDT_HIT();
-    
-    LEDsoff();
 }
 
 // calculate signal properties (mean amplitudes) from measured data:
@@ -184,8 +182,6 @@ bool get_signalproperties(void) {
     uint32_t tval = 0;
     memset(sample_max, 0x00, sizeof(sample_max));
 
-    LED_A_ON();
-
     // wait until signal/noise > 1 (max. 32 periods)
     for (int i = 0; i < EM4X50_T_TAG_WAITING_FOR_SIGNAL; i++) {
 
@@ -202,7 +198,6 @@ bool get_signalproperties(void) {
     }
 
     if (signal_found == false) {
-        LED_A_OFF();
         return false;
     }
 
@@ -230,8 +225,6 @@ bool get_signalproperties(void) {
     gHigh = sample_ref + pct * (sample_max_mean - sample_ref) / 100;
     gLow = sample_ref - pct * (sample_max_mean - sample_ref) / 100;
 
-    LED_A_OFF();
-
     return true;
 }
 
@@ -368,8 +361,6 @@ static void em4x50_reader_send_word(const uint32_t word) {
 static bool find_single_listen_window(void) {
     int cnt_pulses = 0;
 
-    LED_B_ON();
-
     while (cnt_pulses < EM4X50_T_WAITING_FOR_SNGLLIW) {
 
         // identification of listen window is done via evaluation of
@@ -379,14 +370,12 @@ static bool find_single_listen_window(void) {
             if (check_pulse_length(get_pulse_length(), 2 * EM4X50_T_TAG_FULL_PERIOD)) {
 
                 // found listen window
-                LED_B_OFF();
                 return true;
             }
         }
         cnt_pulses++;
     }
 
-    LED_B_OFF();
     return false;
 }
 
@@ -398,12 +387,11 @@ static bool find_single_listen_window(void) {
 static int find_double_listen_window(bool bcommand) {
     int cnt_pulses = 0;
 
-    LED_B_ON();
-
     while (cnt_pulses < EM4X50_T_WAITING_FOR_DBLLIW) {
 
-        if (BUTTON_PRESS())
+        if (BUTTON_PRESS()) {
             return PM3_EOPABORTED;
+        }
 
         // identification of listen window is done via evaluation of
         // pulse lengths
@@ -434,8 +422,6 @@ static int find_double_listen_window(bool bcommand) {
                         em4x50_reader_send_bit(0);
                         em4x50_reader_send_bit(0);
 
-                        LED_B_OFF();
-
                         return PM3_SUCCESS;
                     }
 
@@ -443,8 +429,6 @@ static int find_double_listen_window(bool bcommand) {
 
                 if (check_pulse_length(get_pulse_length(), 3 * EM4X50_T_TAG_FULL_PERIOD)) {
 
-                    LED_B_OFF();
-
                     // return although second listen window consists of one
                     // more bit period but this period is necessary for
                     // evaluating further pulse lengths
@@ -455,7 +439,6 @@ static int find_double_listen_window(bool bcommand) {
         cnt_pulses++;
     }
 
-    LED_B_OFF();
     return PM3_EFAILED;
 }
 
@@ -535,8 +518,6 @@ static int get_word_from_bitstream(uint32_t *data) {
     uint32_t pl = 0;
     uint64_t word = 0x0;
 
-    LED_C_ON();
-
     *data = 0x0;
 
     // initial bit value depends on last pulse length of listen window
@@ -607,8 +588,6 @@ static int get_word_from_bitstream(uint32_t *data) {
 
         } else if (check_pulse_length(pl, 3 * EM4X50_T_TAG_FULL_PERIOD)) {
 
-            LED_C_OFF();
-
             // pulse length of 3 indicates listen window -> clear last
             // bit (= 0) and return (without parities)
             word >>= 2;
@@ -616,8 +595,6 @@ static int get_word_from_bitstream(uint32_t *data) {
         }
     }
 
-    LED_C_OFF();
-
     return PM3_EOPABORTED;
 }
 
@@ -700,9 +677,14 @@ void em4x50_login(uint32_t *password) {
     em4x50_setup_read();
 
     uint8_t status = PM3_EFAILED;
-    if (get_signalproperties() && find_em4x50_tag())
+    LED_C_ON();
+    if (get_signalproperties() && find_em4x50_tag()) {
+        LED_C_OFF();
+        LED_D_ON();
         status = login(*password);
+    }
 
+    LEDsoff();
     lf_finalize();
     reply_ng(CMD_LF_EM4X50_LOGIN, status, NULL, 0);
 }
@@ -713,9 +695,14 @@ void em4x50_brute(em4x50_data_t *etd) {
 
     bool bsuccess = false;
     uint32_t pwd = 0x0;
-    if (get_signalproperties() && find_em4x50_tag())
+    LED_C_ON();
+    if (get_signalproperties() && find_em4x50_tag()) {
+        LED_C_OFF();
+        LED_D_ON();
         bsuccess = brute(etd->password1, etd->password2, &pwd);
+    }
 
+    LEDsoff();
     lf_finalize();
     reply_ng(CMD_LF_EM4X50_BRUTE, bsuccess ? PM3_SUCCESS : PM3_EFAILED, (uint8_t *)(&pwd), sizeof(pwd));
 }
@@ -743,8 +730,12 @@ void em4x50_chk(uint8_t *filename) {
     em4x50_setup_read();
 
     // set gHigh and gLow
+    LED_C_ON();
     if (get_signalproperties() && find_em4x50_tag()) {
 
+        LED_C_OFF();
+        LED_D_ON();
+
         // try to login with current password
         for (int i = 0; i < pwd_count; i++) {
 
@@ -759,8 +750,11 @@ void em4x50_chk(uint8_t *filename) {
             for (int j = 0; j < 4; j++)
                 pwd |= (*(pwds + 4 * i + j)) << ((3 - j) * 8);
 
-            if ((status = login(pwd)) == PM3_SUCCESS)
+            if ((status = login(pwd)) == PM3_SUCCESS) {
+                SpinUp(50);
+                SpinDown(50);
                 break;
+            }
         }
     }
 
@@ -768,6 +762,7 @@ void em4x50_chk(uint8_t *filename) {
 
 #endif
 
+    LEDsoff();
     lf_finalize();
     reply_ng(CMD_LF_EM4X50_CHK, status, (uint8_t *)&pwd, sizeof(pwd));
 }
@@ -859,8 +854,12 @@ void em4x50_read(em4x50_data_t *etd) {
     em4x50_setup_read();
 
     // set gHigh and gLow
+    LED_C_ON();
     if (get_signalproperties() && find_em4x50_tag()) {
 
+        LED_C_OFF();
+        LED_D_ON();
+
         // try to login with given password
         if (etd->pwd_given)
             blogin = (login(etd->password1) == PM3_SUCCESS);
@@ -870,9 +869,9 @@ void em4x50_read(em4x50_data_t *etd) {
             status = selective_read(etd->addresses, words);
     }
 
+    LEDsoff();
     LOW(GPIO_SSC_DOUT);
     lf_finalize();
-
     reply_ng(CMD_LF_EM4X50_READ, status, (uint8_t *)words, EM4X50_TAG_MAX_NO_BYTES);
 }
 
@@ -886,7 +885,10 @@ void em4x50_info(em4x50_data_t *etd) {
 
     em4x50_setup_read();
 
+    LED_C_ON();
     if (get_signalproperties() && find_em4x50_tag()) {
+        LED_C_OFF();
+        LED_D_ON();
 
         // login with given password
         if (etd->pwd_given)
@@ -896,8 +898,8 @@ void em4x50_info(em4x50_data_t *etd) {
             status = selective_read(addresses, words);
     }
 
+    LEDsoff();
     lf_finalize();
-
     reply_ng(CMD_LF_EM4X50_INFO, status, (uint8_t *)words, EM4X50_TAG_MAX_NO_BYTES);
 }
 
@@ -909,9 +911,14 @@ void em4x50_reader(void) {
 
     em4x50_setup_read();
 
-    if (get_signalproperties() && find_em4x50_tag())
+    LED_C_ON();
+    if (get_signalproperties() && find_em4x50_tag()) {
+        LED_C_OFF();
+        LED_D_ON();
         standard_read(&now, words);
+    }
 
+    LEDsoff();
     LOW(GPIO_SSC_DOUT);
     lf_finalize();
     reply_ng(CMD_LF_EM4X50_READER, now, (uint8_t *)words, 4 * now);
@@ -1018,8 +1025,12 @@ void em4x50_write(em4x50_data_t *etd) {
 
     em4x50_setup_read();
 
+    LED_C_ON();
     if (get_signalproperties() && find_em4x50_tag()) {
 
+        LED_C_OFF();
+        LED_D_ON();
+
         // if password is given try to login first
         status = PM3_SUCCESS;
         if (etd->pwd_given)
@@ -1060,6 +1071,7 @@ void em4x50_write(em4x50_data_t *etd) {
         }
     }
 
+    LEDsoff();
     lf_finalize();
     reply_ng(CMD_LF_EM4X50_WRITE, status, (uint8_t *)words, EM4X50_TAG_MAX_NO_BYTES);
 }
@@ -1070,8 +1082,12 @@ void em4x50_writepwd(em4x50_data_t *etd) {
 
     em4x50_setup_read();
 
+    LED_C_ON();
     if (get_signalproperties() && find_em4x50_tag()) {
 
+        LED_C_OFF();
+        LED_D_ON();
+
         // login and change password
         if (login(etd->password1) == PM3_SUCCESS) {
 
@@ -1083,6 +1099,7 @@ void em4x50_writepwd(em4x50_data_t *etd) {
         }
     }
 
+    LEDsoff();
     lf_finalize();
     reply_ng(CMD_LF_EM4X50_WRITEPWD, status, NULL, 0);
 }
@@ -1308,6 +1325,8 @@ static int check_rm_request(uint32_t *tag) {
         bit = em4x50_sim_read_bit();
         if (bit == 0) {
 
+            LED_C_ON();
+            
             // if command before was EM4X50_COMMAND_WRITE_PASSWORD
             // switch to separate process
             if (gWritePasswordProcess) {
@@ -1508,11 +1527,11 @@ static int em4x50_sim_handle_login_command(uint32_t *tag) {
     if (pwd && (password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
         em4x50_sim_send_ack();
         gLogin = true;
-        LED_A_ON();
+        LED_D_ON();
     } else {
         em4x50_sim_send_nak();
         gLogin = false;
-        LED_A_OFF();
+        LED_D_OFF();
     }
     // continue with standard read mode
     return EM4X50_COMMAND_STANDARD_READ;
@@ -1527,7 +1546,7 @@ static int em4x50_sim_handle_reset_command(uint32_t *tag) {
     // send ACK
     em4x50_sim_send_ack();
     gLogin = false;
-    LED_A_OFF();
+    LED_D_OFF();
     
     // wait for initialization (tinit)
     wait_cycles(EM4X50_T_TAG_TINIT);
@@ -1712,37 +1731,26 @@ void em4x50_handle_commands(int *command, uint32_t *tag) {
     switch (*command) {
 
         case EM4X50_COMMAND_LOGIN:
-            LED_B_OFF();
-            LED_C_OFF();
             *command = em4x50_sim_handle_login_command(tag);
             break;
 
         case EM4X50_COMMAND_RESET:
-            LED_B_OFF();
-            LED_C_OFF();
             *command =  em4x50_sim_handle_reset_command(tag);
             break;
 
         case EM4X50_COMMAND_WRITE:
-            LED_B_OFF();
-            LED_C_OFF();
             *command =  em4x50_sim_handle_write_command(tag);
             break;
 
         case EM4X50_COMMAND_WRITE_PASSWORD:
-            LED_B_OFF();
-            LED_C_OFF();
             *command =  em4x50_sim_handle_writepwd_command(tag);
             break;
 
         case EM4X50_COMMAND_SELECTIVE_READ:
-            LED_B_OFF();
-            LED_C_ON();
             *command =  em4x50_sim_handle_selective_read_command(tag);
             break;
             
         case EM4X50_COMMAND_STANDARD_READ:
-            LED_B_ON();
             LED_C_OFF();
             *command = em4x50_sim_handle_standard_read_command(tag);
             break;
@@ -1756,9 +1764,8 @@ void em4x50_handle_commands(int *command, uint32_t *tag) {
 }
 
 // simulate uploaded data in emulator memory
-// LED A -> operations that require authentication are possible
-// LED B -> standard read mode is active
-// LED C -> command has been transmitted by reader
+// LED C -> reader command has been detected
+// LED D -> operations that require authentication are possible
 void em4x50_sim(uint32_t *password) {
     
     int command = 0;
@@ -1778,6 +1785,7 @@ void em4x50_sim(uint32_t *password) {
     if (tag[EM4X50_DEVICE_SERIAL] != tag[EM4X50_DEVICE_ID]) {
 
         // init
+        LEDsoff();
         em4x50_setup_sim();
         gLogin = false;
         gWritePasswordProcess = false;
@@ -1799,7 +1807,7 @@ void em4x50_sim(uint32_t *password) {
             if (command == PM3_ETIMEOUT) {
                 command = EM4X50_COMMAND_STANDARD_READ;
                 gLogin = false;
-                LED_A_OFF();
+                LED_D_OFF();
             }
         }
     }

From a0c92d20bbd905d5999c439d99de6f8987d0e85d Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Fri, 29 Jan 2021 00:28:05 +0100
Subject: [PATCH 451/682] make style + cleanup

---
 armsrc/em4x50.c | 92 ++++++++++++++++++++++++-------------------------
 armsrc/em4x50.h |  2 --
 2 files changed, 45 insertions(+), 49 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index 14097c485..5478da58d 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -130,7 +130,7 @@ void em4x50_setup_read(void) {
     FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_ADC | FPGA_LF_ADC_READER_FIELD);
 
     StartTicks();
-    
+
     // 50ms for the resonant antenna to settle.
     WaitMS(50);
 
@@ -162,16 +162,16 @@ void em4x50_setup_sim(void) {
     AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK;
     AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
     AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK;
-    
+
     StartTicks();
-     
+
     // Watchdog hit
     WDT_HIT();
 }
 
 // calculate signal properties (mean amplitudes) from measured data:
 // 32 amplitudes (maximum values) -> mean amplitude value -> gHigh -> gLow
-bool get_signalproperties(void) {
+static bool get_signalproperties(void) {
 
     bool signal_found = false;
     int no_periods = 32, pct = 75, noise = 140;
@@ -302,7 +302,7 @@ static void em4x50_reader_send_bit(int bit) {
         LOW(GPIO_SSC_DOUT);
         //while (AT91C_BASE_TC0->TC_CV < T0 * 7);
         while (GetTicks() - tval < 7 * CYCLES2TICKS);
-        
+
         // enable modulation (drop the field) for remaining first
         // half of bit period
         HIGH(GPIO_SSC_DOUT);
@@ -444,7 +444,7 @@ static int find_double_listen_window(bool bcommand) {
 
 // function is used to check wether a tag on the proxmark is an
 // EM4x50 tag or not -> speed up "lf search" process
-bool find_em4x50_tag(void) {
+static bool find_em4x50_tag(void) {
     return find_single_listen_window();
 }
 
@@ -600,7 +600,7 @@ static int get_word_from_bitstream(uint32_t *data) {
 
 // simple login to EM4x50,
 // used in operations that require authentication
-static bool login(uint32_t password) {
+static int login(uint32_t password) {
     if (request_receive_mode() == PM3_SUCCESS) {
 
         // send login command
@@ -1107,7 +1107,6 @@ void em4x50_writepwd(em4x50_data_t *etd) {
 // send bit in receive mode by counting carrier cycles
 static void em4x50_sim_send_bit(uint8_t bit) {
 
-    //uint16_t timeout = EM4X50_T_TAG_FULL_PERIOD;
     uint16_t timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
 
     for (int t = 0; t < EM4X50_T_TAG_FULL_PERIOD; t++) {
@@ -1115,7 +1114,7 @@ static void em4x50_sim_send_bit(uint8_t bit) {
         // wait until SSC_CLK goes HIGH
         // used as a simple detection of a reader field?
         while ((timeout--) && !(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
-        
+
         if (timeout <= 0) {
             return;
         }
@@ -1191,19 +1190,19 @@ static void wait_cycles(int maxperiods) {
     int period = 0, timeout = EM4X50_T_SIMULATION_TIMEOUT_WAIT;
 
     while (period < maxperiods) {
-        
+
         while ((timeout--) && !(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
         if (timeout <= 0) {
             return;
         }
         timeout = EM4X50_T_SIMULATION_TIMEOUT_WAIT;
-        
+
         while ((timeout--) && (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
         if (timeout <= 0) {
             return;
         }
         timeout = EM4X50_T_SIMULATION_TIMEOUT_WAIT;
-        
+
         period++;
     }
 }
@@ -1256,12 +1255,12 @@ static int em4x50_sim_read_bit(void) {
 
 // read byte in simulation mode either with or without parity check (even)
 static bool em4x50_sim_read_byte(uint8_t *byte, bool paritycheck) {
-    
+
     for (int i = 0; i < 8; i++) {
         *byte <<= 1;
         *byte |= em4x50_sim_read_bit();
     }
-        
+
     if (paritycheck) {
 
         int pval = em4x50_sim_read_bit();
@@ -1277,12 +1276,11 @@ static bool em4x50_sim_read_byte(uint8_t *byte, bool paritycheck) {
     }
 
     return true;
-        
 }
 
 // read complete word in simulation mode
 static bool em4x50_sim_read_word(uint32_t *word) {
-    
+
     uint8_t stop_bit = 0;
     uint8_t parities = 0, parities_calculated = 0;
     uint8_t bytes[4] = {0};
@@ -1303,20 +1301,20 @@ static bool em4x50_sim_read_word(uint32_t *word) {
             parities_calculated ^= (bytes[j] >> (7 - i)) & 1;
         }
     }
-    
+
     *word = BYTES2UINT32(bytes);
-    
+
     // check parities
     if ((parities == parities_calculated) && (stop_bit == 0)) {
         return true;
     }
-    
+
     return false;
 }
 
 // check if reader requests receive mode (rm) by sending two zeros
 static int check_rm_request(uint32_t *tag) {
-    
+
     // look for first zero
     int bit = em4x50_sim_read_bit();
     if (bit == 0) {
@@ -1326,7 +1324,7 @@ static int check_rm_request(uint32_t *tag) {
         if (bit == 0) {
 
             LED_C_ON();
-            
+
             // if command before was EM4X50_COMMAND_WRITE_PASSWORD
             // switch to separate process
             if (gWritePasswordProcess) {
@@ -1339,13 +1337,13 @@ static int check_rm_request(uint32_t *tag) {
             }
         }
     }
-    
+
     return (bit != PM3_ETIMEOUT) ? PM3_SUCCESS : PM3_ETIMEOUT;
 }
 
 // send single listen window in simulation mode
 static int em4x50_sim_send_listen_window(uint32_t *tag) {
-    
+
     SHORT_COIL();
     wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
 
@@ -1387,7 +1385,7 @@ static void em4x50_sim_send_ack(void) {
 
     OPEN_COIL();
     wait_cycles(EM4X50_T_TAG_HALF_PERIOD);
-    
+
     SHORT_COIL();
 }
 
@@ -1418,7 +1416,7 @@ static void em4x50_sim_send_nak(void) {
 
 // standard read mode process (simulation mode)
 static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
-    
+
     int command = 0;
 
     // extract control data
@@ -1461,11 +1459,11 @@ static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
 static int em4x50_sim_handle_selective_read_command(uint32_t *tag) {
 
     int command = 0;
-    
+
     // read password
     uint32_t address = 0;
     bool addr = em4x50_sim_read_word(&address);
-    
+
     // processing pause time (corresponds to a "1" bit)
     em4x50_sim_send_bit(1);
 
@@ -1485,7 +1483,7 @@ static int em4x50_sim_handle_selective_read_command(uint32_t *tag) {
     int fwrp = reflect32(tag[EM4X50_PROTECTION]) & 0xFF;
     // last word read protected
     int lwrp = (reflect32(tag[EM4X50_PROTECTION]) >> 8) & 0xFF;
-    
+
     while ((BUTTON_PRESS() == false) && (data_available() == false)) {
 
         WDT_HIT();
@@ -1520,7 +1518,7 @@ static int em4x50_sim_handle_login_command(uint32_t *tag) {
     // read password
     uint32_t password = 0;
     bool pwd = em4x50_sim_read_word(&password);
-    
+
     // processing pause time (corresponds to a "1" bit)
     em4x50_sim_send_bit(1);
 
@@ -1547,10 +1545,10 @@ static int em4x50_sim_handle_reset_command(uint32_t *tag) {
     em4x50_sim_send_ack();
     gLogin = false;
     LED_D_OFF();
-    
+
     // wait for initialization (tinit)
     wait_cycles(EM4X50_T_TAG_TINIT);
-    
+
     // continue with standard read mode
     return EM4X50_COMMAND_STANDARD_READ;
 }
@@ -1564,7 +1562,7 @@ static int em4x50_sim_handle_write_command(uint32_t *tag) {
     // read data
     uint32_t data = 0;
     bool word = em4x50_sim_read_word(&data);
-        
+
     // write access time
     wait_cycles(EM4X50_T_TAG_TWA);
 
@@ -1633,7 +1631,7 @@ static int em4x50_sim_handle_write_command(uint32_t *tag) {
             }
             break;
     }
-    
+
     // EEPROM write time
     // strange: need some sort of 'waveform correction', otherwise ack signal
     // will not be detected; sending a single "1" as last "bit" of Twee
@@ -1665,18 +1663,18 @@ static int em4x50_sim_handle_write_command(uint32_t *tag) {
 static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
 
     bool pwd = false;
-    
+
     if (gWritePasswordProcess == false) {
-        
+
         gWritePasswordProcess = true;
 
         // read password
         uint32_t act_password = 0;
         pwd = em4x50_sim_read_word(&act_password);
-        
+
         // processing pause time (corresponds to a "1" bit)
         em4x50_sim_send_bit(1);
-        
+
         if (pwd && (act_password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
             em4x50_sim_send_ack();
             gLogin = true;
@@ -1709,7 +1707,7 @@ static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
             em4x50_sim_send_ack();
             return EM4X50_COMMAND_STANDARD_READ;
         }
-        
+
         // EEPROM write time
         // strange: need some sort of 'waveform correction', otherwise ack signal
         // will not be detected; sending a single "1" as last part of Twee
@@ -1721,13 +1719,13 @@ static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
         // continue with standard read mode
         return EM4X50_COMMAND_STANDARD_READ;
     }
-    
+
     // call writepwd function again for else branch
     return EM4X50_COMMAND_WRITE_PASSWORD;
 }
 
 void em4x50_handle_commands(int *command, uint32_t *tag) {
-    
+
     switch (*command) {
 
         case EM4X50_COMMAND_LOGIN:
@@ -1749,12 +1747,12 @@ void em4x50_handle_commands(int *command, uint32_t *tag) {
         case EM4X50_COMMAND_SELECTIVE_READ:
             *command =  em4x50_sim_handle_selective_read_command(tag);
             break;
-            
+
         case EM4X50_COMMAND_STANDARD_READ:
             LED_C_OFF();
             *command = em4x50_sim_handle_standard_read_command(tag);
             break;
-            
+
         // bit errors during reading may lead to unknown commands
         // -> continue with standard read mode
         default:
@@ -1767,15 +1765,15 @@ void em4x50_handle_commands(int *command, uint32_t *tag) {
 // LED C -> reader command has been detected
 // LED D -> operations that require authentication are possible
 void em4x50_sim(uint32_t *password) {
-    
+
     int command = 0;
-    
+
     uint8_t *em4x50_mem = BigBuf_get_EM_addr();
     uint32_t tag[EM4X50_NO_WORDS] = {0x0};
 
     for (int i = 0; i < EM4X50_NO_WORDS; i++)
         tag[i] = bytes_to_num(em4x50_mem + (i * 4), 4);
-    
+
     // via eload uploaded dump usually does not contain a password
     if (tag[EM4X50_DEVICE_PASSWORD] == 0) {
         tag[EM4X50_DEVICE_PASSWORD] = reflect32(*password);
@@ -1796,12 +1794,12 @@ void em4x50_sim(uint32_t *password) {
         for (;;) {
 
             em4x50_handle_commands(&command, tag);
-            
+
             // stop if key (pm3 button or enter key) has been pressed
             if (command == PM3_EOPABORTED) {
                 break;
             }
-            
+
             // if timeout (e.g. no reader field) continue with standard read
             // mode and reset former authentication
             if (command == PM3_ETIMEOUT) {
diff --git a/armsrc/em4x50.h b/armsrc/em4x50.h
index cf35cc6a4..d47579dcc 100644
--- a/armsrc/em4x50.h
+++ b/armsrc/em4x50.h
@@ -14,8 +14,6 @@
 #include "../include/em4x50.h"
 
 void em4x50_setup_read(void);
-bool get_signalproperties(void);
-bool find_em4x50_tag(void);
 int standard_read(int *now, uint32_t *words);
 
 void em4x50_setup_sim(void);

From b3c0e00174903f6a69b54782dd31bfc61c46b7dd Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 29 Jan 2021 11:56:31 +0100
Subject: [PATCH 452/682] wiegand encode -  now "-w" format param is optional, 
 if excluded it tries to convert to all known formats and output

---
 client/src/cmdwiegand.c      | 50 +++++++++---------------
 client/src/wiegand_formats.c | 74 +++++++++++++++++++++++++++++++++---
 client/src/wiegand_formats.h |  4 +-
 3 files changed, 91 insertions(+), 37 deletions(-)

diff --git a/client/src/cmdwiegand.c b/client/src/cmdwiegand.c
index 8e154e300..e3b0418ac 100644
--- a/client/src/cmdwiegand.c
+++ b/client/src/cmdwiegand.c
@@ -25,24 +25,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static void print_wiegand_code(wiegand_message_t *packed) {
-    const char *s = "Encoded wiegand: ";
-    if (packed->Top != 0) {
-        PrintAndLogEx(SUCCESS, "%s" _GREEN_("%X%08X%08X"),
-                      s,
-                      (uint32_t)packed->Top,
-                      (uint32_t)packed->Mid,
-                      (uint32_t)packed->Bot
-                     );
-    } else {
-        PrintAndLogEx(SUCCESS, "%s" _YELLOW_("%X%08X"),
-                      s,
-                      (uint32_t)packed->Mid,
-                      (uint32_t)packed->Bot
-                     );
-    }
-}
-
 int CmdWiegandList(const char *Cmd) {
 
     CLIParserContext *ctx;
@@ -76,7 +58,7 @@ int CmdWiegandEncode(const char *Cmd) {
         arg_u64_1(NULL, "cn", "<dec>", "card number"),
         arg_u64_0(NULL, "issue", "<dec>", "issue level"),
         arg_u64_0(NULL, "oem", "<dec>", "OEM code"),
-        arg_str1("w", "wiegand", "<format>", "see `wiegand list` for available formats"),
+        arg_str0("w", "wiegand", "<format>", "see `wiegand list` for available formats"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
@@ -94,21 +76,27 @@ int CmdWiegandEncode(const char *Cmd) {
     CLIParamStrToBuf(arg_get_str(ctx, 5), (uint8_t *)format, sizeof(format), &len);
     CLIParserFree(ctx);
 
-    int idx = HIDFindCardFormat(format);
-    if (idx == -1) {
-        PrintAndLogEx(WARNING, "Unknown format: %s", format);
-        return PM3_EINVARG;
+    int idx = -1;
+    if (len) {
+        idx = HIDFindCardFormat(format);
+        if (idx == -1) {
+            PrintAndLogEx(WARNING, "Unknown format: %s", format);
+            return PM3_EINVARG;
+        }
     }
 
-    wiegand_message_t packed;
-    memset(&packed, 0, sizeof(wiegand_message_t));
-
-    if (HIDPack(idx, &data, &packed) == false) {
-        PrintAndLogEx(WARNING, "The card data could not be encoded in the selected format.");
-        return PM3_ESOFT;
+    if (idx != -1) {
+        wiegand_message_t packed;
+        memset(&packed, 0, sizeof(wiegand_message_t));
+        if (HIDPack(idx, &data, &packed) == false) {
+            PrintAndLogEx(WARNING, "The card data could not be encoded in the selected format.");
+            return PM3_ESOFT;
+        }
+        print_wiegand_code(&packed);
+    } else {
+        // try all formats and print only the ones that work.
+        HIDPackTryAll(&data);
     }
-
-    print_wiegand_code(&packed);
     return PM3_SUCCESS;
 }
 
diff --git a/client/src/wiegand_formats.c b/client/src/wiegand_formats.c
index 78d0bf828..ba8169d37 100644
--- a/client/src/wiegand_formats.c
+++ b/client/src/wiegand_formats.c
@@ -8,8 +8,10 @@
 // HID card format packing/unpacking routines
 //-----------------------------------------------------------------------------
 #include "wiegand_formats.h"
+#include <stdlib.h>
 #include "commonutil.h"
 
+
 static bool Pack_H10301(wiegand_card_t *card, wiegand_message_t *packed) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
@@ -823,7 +825,7 @@ static const cardformat_t FormatTable[] = {
     {"Optus34", Pack_Optus,   Unpack_Optus,   "Indala Optus 34-bit",        {1, 1, 0, 0, 0}}, // from cardinfo.barkweb.com.au
     {"Smartpass", Pack_Smartpass, Unpack_Smartpass, "Cardkey Smartpass 34-bit", {1, 1, 1, 0, 0}}, // from cardinfo.barkweb.com.au
     {"BQT", Pack_bqt, Unpack_bqt, "BQT 34-bit", {1, 1, 0, 0, 1}}, // from cardinfo.barkweb.com.au
-    {"C1k35s",  Pack_C1k35s,  Unpack_C1k35s,  "HID Corporate 1000 35-bit standard layout", {1, 1, 0, 0, 1}}, // imported from old pack/unpack
+    {"C1k35s",  Pack_C1k35s,  Unpack_C1k35s,  "HID Corporate 1000 35-bit std", {1, 1, 0, 0, 1}}, // imported from old pack/unpack
     {"C15001",  Pack_C15001,  Unpack_C15001,  "HID KeyScan 36-bit",         {1, 1, 0, 1, 1}}, // from Proxmark forums
     {"S12906",  Pack_S12906,  Unpack_S12906,  "HID Simplex 36-bit",         {1, 1, 1, 0, 1}}, // from cardinfo.barkweb.com.au
     {"Sie36",   Pack_Sie36,   Unpack_Sie36,   "HID 36-bit Siemens",         {1, 1, 0, 0, 1}}, // from cardinfo.barkweb.com.au
@@ -834,7 +836,7 @@ static const cardformat_t FormatTable[] = {
     {"MDI37",  Pack_MDI37, Unpack_MDI37,  "PointGuard MDI 37-bit",   {1, 1, 0, 0, 1}}, // from cardinfo.barkweb.com.au
     {"P10001",  Pack_P10001,  Unpack_P10001,  "HID P10001 Honeywell 40-bit", {1, 1, 0, 1, 0}}, // from cardinfo.barkweb.com.au
     {"Casi40",  Pack_CasiRusco40, Unpack_CasiRusco40, "Casi-Rusco 40-bit",   {1, 0, 0, 0, 0}}, // from cardinfo.barkweb.com.au
-    {"C1k48s",  Pack_C1k48s,  Unpack_C1k48s,  "HID Corporate 1000 48-bit standard layout", {1, 1, 0, 0, 1}}, // imported from old pack/unpack
+    {"C1k48s",  Pack_C1k48s,  Unpack_C1k48s,  "HID Corporate 1000 48-bit std", {1, 1, 0, 0, 1}}, // imported from old pack/unpack
     {NULL, NULL, NULL, NULL, {0, 0, 0, 0, 0}} // Must null terminate array
 };
 
@@ -842,18 +844,59 @@ void HIDListFormats(void) {
     if (FormatTable[0].Name == NULL)
         return;
 
-    PrintAndLogEx(NORMAL, "%-10s %s", "Name", "Description");
-    PrintAndLogEx(NORMAL, "------------------------------------------------------------");
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "%-10s %s", "Name", "Description");
+    PrintAndLogEx(INFO, "------------------------------------------------------------");
 
     int i = 0;
     while (FormatTable[i].Name) {
-        PrintAndLogEx(NORMAL, _YELLOW_("%-10s")" %-30s", FormatTable[i].Name, FormatTable[i].Descrp);
+        PrintAndLogEx(INFO, _YELLOW_("%-10s")" %-30s", FormatTable[i].Name, FormatTable[i].Descrp);
         ++i;
     }
     PrintAndLogEx(NORMAL, "");
     return;
 }
 
+void print_desc_wiegand(cardformat_t *fmt, wiegand_message_t *packed) {
+
+    char *s = calloc(128, sizeof(uint8_t));
+    sprintf(s, _YELLOW_("%-10s")" %-30s",  fmt->Name, fmt->Descrp);
+
+    if (packed->Top != 0) {
+        PrintAndLogEx(SUCCESS, "%s --> " _GREEN_("%X%08X%08X"),
+                      s,
+                      (uint32_t)packed->Top,
+                      (uint32_t)packed->Mid,
+                      (uint32_t)packed->Bot
+                     );
+    } else {
+        PrintAndLogEx(SUCCESS, "%s --> " _YELLOW_("%X%08X"),
+                      s,
+                      (uint32_t)packed->Mid,
+                      (uint32_t)packed->Bot
+                     );
+    }
+    free(s);
+}
+
+void print_wiegand_code(wiegand_message_t *packed) {
+    const char *s = "Encoded wiegand: ";
+    if (packed->Top != 0) {
+        PrintAndLogEx(SUCCESS, "%s" _GREEN_("%X%08X%08X"),
+                      s,
+                      (uint32_t)packed->Top,
+                      (uint32_t)packed->Mid,
+                      (uint32_t)packed->Bot
+                     );
+    } else {
+        PrintAndLogEx(SUCCESS, "%s" _YELLOW_("%X%08X"),
+                      s,
+                      (uint32_t)packed->Mid,
+                      (uint32_t)packed->Bot
+                     );
+    }
+}
+
 cardformat_t HIDGetCardFormat(int idx) {
     return FormatTable[idx];
 }
@@ -886,6 +929,26 @@ bool HIDPack(int format_idx, wiegand_card_t *card, wiegand_message_t *packed) {
     return FormatTable[format_idx].Pack(card, packed);
 }
 
+void HIDPackTryAll(wiegand_card_t *card) {
+
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "%-10s %-30s --> Encoded wiegand", "Name", "Description");
+    PrintAndLogEx(INFO, "----------------------------------------------------------------------");
+
+    wiegand_message_t packed;
+    int i = 0;
+    while (FormatTable[i].Name) {
+        memset(&packed, 0, sizeof(wiegand_message_t));
+        bool res = FormatTable[i].Pack(card, &packed);
+        if (res) {
+            cardformat_t fmt = HIDGetCardFormat(i);
+            print_desc_wiegand(&fmt, &packed);
+        }
+        i++;
+    }
+    PrintAndLogEx(NORMAL, "");
+}
+
 static void HIDDisplayUnpackedCard(wiegand_card_t *card, const cardformat_t format) {
 
     /*
@@ -951,3 +1014,4 @@ bool HIDTryUnpack(wiegand_message_t *packed, bool ignore_parity) {
 
     return result;
 }
+
diff --git a/client/src/wiegand_formats.h b/client/src/wiegand_formats.h
index 4ac36fdcf..531de1e12 100644
--- a/client/src/wiegand_formats.h
+++ b/client/src/wiegand_formats.h
@@ -44,5 +44,7 @@ int HIDFindCardFormat(const char *format);
 cardformat_t HIDGetCardFormat(int idx);
 bool HIDPack(int format_idx, wiegand_card_t *card, wiegand_message_t *packed);
 bool HIDTryUnpack(wiegand_message_t *packed, bool ignore_parity);
-
+void HIDPackTryAll(wiegand_card_t *card);
+void print_wiegand_code(wiegand_message_t *packed);
+void print_desc_wiegand(cardformat_t *fmt, wiegand_message_t *packed);
 #endif

From dc01b63d4999f37c22518d98264539d26c6c6b0f Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 29 Jan 2021 11:59:32 +0100
Subject: [PATCH 453/682] analyse demodbuff - bad reference to string pointer
 after free

---
 client/src/cmdanalyse.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/client/src/cmdanalyse.c b/client/src/cmdanalyse.c
index 4cdd35e68..87c989618 100644
--- a/client/src/cmdanalyse.c
+++ b/client/src/cmdanalyse.c
@@ -931,19 +931,14 @@ static int CmdAnalyseDemodBuffer(const char *Cmd) {
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
     const char *s = arg_get_str(ctx, 1)->sval[0];
-    CLIParserFree(ctx);
-
-    if (s == NULL) {
-        PrintAndLogEx(FAILED, "Must provide a binary string");
-        return PM3_EINVARG;
-    }
-
     int len = MIN(strlen(s), MAX_DEMOD_BUF_LEN);
 
     // add 1 for null terminator.
     uint8_t *data = calloc(len + 1,  sizeof(uint8_t));
-    if (data == NULL)
+    if (data == NULL) {
+        CLIParserFree(ctx);
         return PM3_EMALLOC;
+    }
 
     for (int i = 0; i <= strlen(s); i++) {
         char c = s[i];
@@ -954,6 +949,9 @@ static int CmdAnalyseDemodBuffer(const char *Cmd) {
 
         PrintAndLogEx(NORMAL, "%c" NOLF, c);
     }
+
+    CLIParserFree(ctx);
+
     PrintAndLogEx(NORMAL, "");
     DemodBufferLen = len;
     free(data);

From 249d3e7d1e6ffa6018e1984536394040dc2e786c Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 29 Jan 2021 12:04:19 +0100
Subject: [PATCH 454/682] text

---
 CHANGELOG.md                     | 2 ++
 client/src/wiegand_formatutils.c | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ffd6aa4cc..13743da0c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,8 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+ - Changed `wiegand encode` - format param is now optional, w/o it will try encode all formats (@iceman1001)
+ - Fix cppchecker warnings (@iceman1001)
  - Added `trace list -t mf` - now can use external dictionary keys file
  - Added support for bidirectional communication for `lf em 4x50 sim` (@tharexde)
  - Change `PLATFORM=PM3OTHER` to `PLATFORM=PM3GENERIC` (@iceman1001)
diff --git a/client/src/wiegand_formatutils.c b/client/src/wiegand_formatutils.c
index 3879e616e..212a30151 100644
--- a/client/src/wiegand_formatutils.c
+++ b/client/src/wiegand_formatutils.c
@@ -121,6 +121,12 @@ bool set_nonlinear_field(wiegand_message_t *data, uint64_t value, uint8_t numBit
 }
 
 static uint8_t get_length_from_header(wiegand_message_t *data) {
+/**
+ * detect if message has "preamble" / "sentinel bit"
+ * 
+ */
+
+
     uint8_t len = 0;
     uint32_t hfmt = 0; // for calculating card length
 

From 831a3ad2fa7f7c140de63435ab3e3248153fd9b6 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 29 Jan 2021 12:13:54 +0100
Subject: [PATCH 455/682] hw dbg - fix wrong param

---
 client/src/cmdhw.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhw.c b/client/src/cmdhw.c
index 5c61d2cf4..274dc31b3 100644
--- a/client/src/cmdhw.c
+++ b/client/src/cmdhw.c
@@ -332,8 +332,8 @@ static int CmdDbg(const char *Cmd) {
     bool lv0 = arg_get_lit(ctx, 1);
     bool lv1 = arg_get_lit(ctx, 2);
     bool lv2 = arg_get_lit(ctx, 3);
-    bool lv3 = arg_get_lit(ctx, 3);
-    bool lv4 = arg_get_lit(ctx, 4);
+    bool lv3 = arg_get_lit(ctx, 4);
+    bool lv4 = arg_get_lit(ctx, 5);
     CLIParserFree(ctx);
 
     if ((lv0 + lv1 + lv2 + lv3 + lv4) > 1) {

From ead26ec3c3f0bb453c80c60a23b1303366e68a48 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 29 Jan 2021 16:06:26 +0100
Subject: [PATCH 456/682] lf t55xx special - now uses cliparser

---
 client/src/cmdlft55xx.c | 18 +++++++++++++++---
 client/src/cmdlft55xx.h |  2 +-
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index 3903a9547..788d4ad91 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -1504,8 +1504,20 @@ bool test(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk, bool *Q5)
     return false;
 }
 
-int special(const char *Cmd) {
-    (void)Cmd; // Cmd is not used so far
+int CmdT55xxSpecial(const char *Cmd) {
+
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf t55xx special",
+                  "Show block changes with 64 different offsets,  data taken from Demod buffer.",
+                  "lf t55xx special\n"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIParserFree(ctx);
 
     uint8_t bits[32] = {0x00};
 
@@ -4216,7 +4228,7 @@ static command_t CommandTable[] = {
     {"protect",      CmdT55xxProtect,         IfPm3Lf,         "Password protect tag"},
     {"recoverpw",    CmdT55xxRecoverPW,       IfPm3Lf,         "Try to recover from bad password write from a cloner"},
     {"sniff",        CmdT55xxSniff,           AlwaysAvailable, "Attempt to recover T55xx commands from sample buffer"},
-    {"special",      special,                 IfPm3Lf,         "Show block changes with 64 different offsets"},
+    {"special",      CmdT55xxSpecial,         IfPm3Lf,         "Show block changes with 64 different offsets"},
     {"wipe",         CmdT55xxWipe,            IfPm3Lf,         "Wipe a T55xx tag and set defaults (will destroy any data on tag)"},
     {NULL, NULL, NULL, NULL}
 };
diff --git a/client/src/cmdlft55xx.h b/client/src/cmdlft55xx.h
index 336dbfc76..83a35b848 100644
--- a/client/src/cmdlft55xx.h
+++ b/client/src/cmdlft55xx.h
@@ -196,7 +196,7 @@ bool testKnownConfigBlock(uint32_t block0);
 
 bool tryDetectP1(bool getData);
 bool test(uint8_t mode, uint8_t *offset, int *fndBitRate, uint8_t clk, bool *Q5);
-int  special(const char *Cmd);
+int  CmdT55xxSpecial(const char *Cmd);
 bool AcquireData(uint8_t page, uint8_t block, bool pwdmode, uint32_t password, uint8_t downlink_mode);
 uint8_t t55xx_try_one_password(uint32_t password, uint8_t downlink_mode, bool try_all_dl_modes);
 

From 3b37ca1d4c0e7978e728e0b6b9bd56cb5e7f5cb8 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 29 Jan 2021 16:06:45 +0100
Subject: [PATCH 457/682] coverity fix #308455

---
 client/src/cmdlft55xx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index 788d4ad91..89204952d 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -3581,6 +3581,7 @@ static int CmdT55xxDetectPage1(const char *Cmd) {
     int res = arg_get_u32_hexstr_def(ctx, 2, 0, &password);
     if (res == 2) {
         PrintAndLogEx(INFO, "Password should be 4 hex bytes");
+        CLIParserFree(ctx);
         return PM3_EINVARG;
     } else if (res == 1) {
         usepwd = true;

From f65b5eb96da91c3ad948f29fb878707a73347837 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 29 Jan 2021 16:10:33 +0100
Subject: [PATCH 458/682] coverity fix #308194

---
 armsrc/em4x70.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/armsrc/em4x70.c b/armsrc/em4x70.c
index 77cfbb2dd..bc9d467cc 100644
--- a/armsrc/em4x70.c
+++ b/armsrc/em4x70.c
@@ -662,9 +662,10 @@ void em4x70_write(em4x70_data_t *etd) {
 
         if (status) {
             // Read Tag after writing
-            em4x70_read_id();
-            em4x70_read_um1();
-            em4x70_read_um2();
+            if (em4x70_read_id()) {
+                em4x70_read_um1();
+                em4x70_read_um2();
+            }
         }
 
     }

From 145a0319229903d7c09d8b390166ee6a27e4792b Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 29 Jan 2021 16:16:46 +0100
Subject: [PATCH 459/682] coverity fix #308205

---
 armsrc/Standalone/hf_iceclass.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/armsrc/Standalone/hf_iceclass.c b/armsrc/Standalone/hf_iceclass.c
index 88ccfaa47..27e1bf5ab 100644
--- a/armsrc/Standalone/hf_iceclass.c
+++ b/armsrc/Standalone/hf_iceclass.c
@@ -170,12 +170,9 @@ static void save_to_flash(uint8_t *data, uint16_t datalen, char *filename) {
                 data[4], data[5], data[6], data[7]
                );
     } else {
-        int name_len = SPIFFS_OBJ_NAME_LEN;
-        int filename_len = strlen(filename);
-
+        int fnlen = MIN(strlen(filename), SPIFFS_OBJ_NAME_LEN);
         // if the given name len longer than buffer allows, cut it down to size
-        name_len = (name_len >= SPIFFS_OBJ_NAME_LEN) ? SPIFFS_OBJ_NAME_LEN : filename_len;
-        memcpy(fn, filename, name_len);
+        memcpy(fn, filename, fnlen);
     }
 
     int res;

From a6e4b03c28be37000354c0cd845c145e0a5aebe6 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 29 Jan 2021 16:18:09 +0100
Subject: [PATCH 460/682] coverty finds this a deadcode,  cppchecker
 complains...

---
 client/src/preferences.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/client/src/preferences.c b/client/src/preferences.c
index 92a91e54a..d961d2c6f 100644
--- a/client/src/preferences.c
+++ b/client/src/preferences.c
@@ -853,11 +853,6 @@ static int setCmdSavePaths(const char *Cmd) {
         path = trace_path;
     }
 
-    if (path == NULL) {
-        PrintAndLogEx(FAILED, "Must give at least one path");
-        return PM3_EINVARG;
-    }
-
     // remove trailing slash.
     size_t nplen = strlen(path);
     if ((path[nplen - 1] == '/') || (path[nplen - 1] == '\\')) {

From 33a17fcd6706e6e27cf7f1b15984d55996762b73 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 29 Jan 2021 16:47:02 +0100
Subject: [PATCH 461/682] cppchecker fixes

---
 armsrc/Standalone/hf_tcprst.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/armsrc/Standalone/hf_tcprst.c b/armsrc/Standalone/hf_tcprst.c
index 11b2b1935..f9d8b0b59 100644
--- a/armsrc/Standalone/hf_tcprst.c
+++ b/armsrc/Standalone/hf_tcprst.c
@@ -248,11 +248,9 @@ void RunMod(void) {
                         dynamic_response_info.response[0] = receivedCmd[0];
 
                         if (memcmp("\x02\xa2\xb0\x00\x00\x1d\x51\x69", receivedCmd, 8) == 0) {
-                            dynamic_response_info.response[0] = receivedCmd[0];
                             memcpy(dynamic_response_info.response + 1, ndef, 31);
                             dynamic_response_info.response_n = 32;
                         } else if (memcmp("\x02\x00\x20\x00\x01\x00\x6e\xa9", receivedCmd, 8) == 0) {
-                            dynamic_response_info.response[0] = receivedCmd[0];
                             dynamic_response_info.response[1] = 0x63;
                             dynamic_response_info.response[2] = 0x00;
                             dynamic_response_info.response_n = 3;
@@ -260,14 +258,12 @@ void RunMod(void) {
                             memcpy(verify_pwd + 5, receivedCmd + 6, 16);
                             DbpString("Reader sent password: ");
                             Dbhexdump(16, verify_pwd + 5, 0);
-                            dynamic_response_info.response[0] = receivedCmd[0];
                             dynamic_response_info.response[1] = 0x90;
                             dynamic_response_info.response[2] = 0x00;
                             dynamic_response_info.response_n = 3;
                             gotkey = true;
                             state = STATE_DUMP;
                         } else {
-                            dynamic_response_info.response[0] = receivedCmd[0];
                             dynamic_response_info.response[1] = 0x90;
                             dynamic_response_info.response[2] = 0x00;
                             dynamic_response_info.response_n = 3;
@@ -321,7 +317,7 @@ void RunMod(void) {
                     LED_B_ON();
                     uint8_t apdulen = iso14_apdu(apdus[i], (uint16_t) apdusLen[i], false, apdubuffer, NULL);
 
-                    if (apdulen > 0) {
+                    if (apdulen > 2) {
                         DbpString(_YELLOW_("[ ") "Proxmark command" _YELLOW_(" ]"));
                         Dbhexdump(apdusLen[i], apdus[i], false);
                         DbpString(_GREEN_("[ ") "Card answer" _GREEN_(" ]"));
@@ -429,11 +425,9 @@ void RunMod(void) {
                         dynamic_response_info.response[0] = receivedCmd[0];
 
                         if (memcmp("\x02\xa2\xb0\x00\x00\x1d\x51\x69", receivedCmd, 8) == 0) {
-                            dynamic_response_info.response[0] = receivedCmd[0];
                             memcpy(dynamic_response_info.response + 1, ndef, 31);
                             dynamic_response_info.response_n = 32;
                         } else if (memcmp("\x02\x00\x20\x00\x01\x00\x6e\xa9", receivedCmd, 8) == 0) {
-                            dynamic_response_info.response[0] = receivedCmd[0];
                             dynamic_response_info.response[1] = 0x63;
                             dynamic_response_info.response[2] = 0x00;
                             dynamic_response_info.response_n = 3;
@@ -441,12 +435,10 @@ void RunMod(void) {
                             memcpy(verify_pwd + 5, receivedCmd + 6, 16);
                             DbpString("Reader sent password: ");
                             Dbhexdump(16, verify_pwd + 5, 0);
-                            dynamic_response_info.response[0] = receivedCmd[0];
                             dynamic_response_info.response[1] = 0x90;
                             dynamic_response_info.response[2] = 0x00;
                             dynamic_response_info.response_n = 3;
                         } else {
-                            dynamic_response_info.response[0] = receivedCmd[0];
                             dynamic_response_info.response[1] = 0x90;
                             dynamic_response_info.response[2] = 0x00;
                             dynamic_response_info.response_n = 3;

From 76f2c2c95e8d8551bc0df3232cc46fa283b4875c Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 29 Jan 2021 16:51:06 +0100
Subject: [PATCH 462/682] cppchecker fix

---
 client/src/cmdhfmf.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index 9e0b2ba3e..475c687fb 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -3546,8 +3546,6 @@ static int CmdHF14AMfSim(const char *Cmd) {
         }
         showSectorTable(k_sector, k_sectorsCount);
     }
-
-    k_sectorsCount = MIFARE_4K_MAXSECTOR;
     return PM3_SUCCESS;
 }
 

From 3f370438e5b9ed4ad5abee230e9f1efc7a43380e Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 29 Jan 2021 18:59:50 +0100
Subject: [PATCH 463/682] cppchecker noticed ct vs pt is swapped.  Question is
 where was the error introduced?  pt (plaintext) ct (cryptotext)

---
 common/cryptorf/cryptolib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/common/cryptorf/cryptolib.c b/common/cryptorf/cryptolib.c
index bf597317b..a59f4109a 100644
--- a/common/cryptorf/cryptolib.c
+++ b/common/cryptorf/cryptolib.c
@@ -307,7 +307,7 @@ static void cm_crypt(const CryptoAction ca, const uint8_t offset, const uint8_t
     }
 }
 
-void cm_encrypt(const uint8_t offset, const uint8_t len, const uint8_t *ct, uint8_t *pt, crypto_state s) {
+void cm_encrypt(const uint8_t offset, const uint8_t len, const uint8_t *pt, uint8_t *ct, crypto_state s) {
     next_n(true, 5, 0, s);
     next(true, 0, s);
     cm_crypt(CA_ENCRYPT, offset, len, ct, pt, s);

From 4320486a3bf7250a77edb7762662aa55fbc51fdc Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 29 Jan 2021 19:04:35 +0100
Subject: [PATCH 464/682] cppchecker fixes

---
 common/cryptorf/cryptolib.c |  2 +-
 tools/cryptorf/sma.cpp      | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/common/cryptorf/cryptolib.c b/common/cryptorf/cryptolib.c
index a59f4109a..ec6ab7468 100644
--- a/common/cryptorf/cryptolib.c
+++ b/common/cryptorf/cryptolib.c
@@ -310,7 +310,7 @@ static void cm_crypt(const CryptoAction ca, const uint8_t offset, const uint8_t
 void cm_encrypt(const uint8_t offset, const uint8_t len, const uint8_t *pt, uint8_t *ct, crypto_state s) {
     next_n(true, 5, 0, s);
     next(true, 0, s);
-    cm_crypt(CA_ENCRYPT, offset, len, ct, pt, s);
+    cm_crypt(CA_ENCRYPT, offset, len, pt, ct, s);
 }
 
 void cm_decrypt(const uint8_t offset, const uint8_t len, const uint8_t *ct, uint8_t *pt, crypto_state s) {
diff --git a/tools/cryptorf/sma.cpp b/tools/cryptorf/sma.cpp
index 05b9f344f..a51281ad8 100644
--- a/tools/cryptorf/sma.cpp
+++ b/tools/cryptorf/sma.cpp
@@ -701,7 +701,7 @@ void combine_valid_left_right_states(vector<cs_t> *plcstates, vector<cs_t> *prcs
         }
     }
     printf("Found a total of " _YELLOW_("%llu")" combinations, ", ((unsigned long long)plcstates->size()) * prcstates->size());
-    printf("but only " _GREEN_("%lu")" were valid!\n", pgc_candidates->size());
+    printf("but only " _GREEN_("%zu")" were valid!\n", pgc_candidates->size());
 }
 
 int main(int argc, const char *argv[]) {
@@ -814,7 +814,7 @@ int main(int argc, const char *argv[]) {
 
     printf("Determing the right states that correspond to the keystream\n");
     rbits = sm_right(ks, mask, &rstates);
-    printf("Top-bin for the right state contains " _GREEN_("%d")" correct bits\n", rbits);
+    printf("Top-bin for the right state contains " _GREEN_("%u")" correct bits\n", rbits);
     printf("Total count of right bins: " _YELLOW_("%lu") "\n", (unsigned long)rstates.size());
 
     if (rbits < 96) {
@@ -827,16 +827,16 @@ int main(int argc, const char *argv[]) {
         printf("Using the state from the top-right bin: " _YELLOW_("0x%07" PRIx64)"\n", rstate_after_gc);
 
         search_gc_candidates_right(rstate_before_gc, rstate_after_gc, Q, &crstates);
-        printf("Found " _YELLOW_("%lu")" right candidates using the meet-in-the-middle attack\n", crstates.size());
+        printf("Found " _YELLOW_("%zu")" right candidates using the meet-in-the-middle attack\n", crstates.size());
         if (crstates.size() == 0) continue;
 
         printf("Calculating left states using the (unknown bits) mask from the top-right state\n");
         sm_left(ks, mask, &clstates);
-        printf("Found a total of " _YELLOW_("%lu")" left cipher states, recovering left candidates...\n", clstates.size());
+        printf("Found a total of " _YELLOW_("%zu")" left cipher states, recovering left candidates...\n", clstates.size());
         if (clstates.size() == 0) continue;
 
         search_gc_candidates_left(lstate_before_gc, Q, &clstates);
-        printf("The meet-in-the-middle attack returned " _YELLOW_("%lu")" left cipher candidates\n", clstates.size());
+        printf("The meet-in-the-middle attack returned " _YELLOW_("%zu")" left cipher candidates\n", clstates.size());
         if (clstates.size() == 0) continue;
 
         printf("Combining left and right states, disposing invalid combinations\n");

From 7750e60ac39193abfaa0d51a7028eade1c8ed107 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 29 Jan 2021 19:12:36 +0100
Subject: [PATCH 465/682] cppchecker fixes.  wrong format string. shadows
 outer...

---
 tools/cryptorf/sma_multi.cpp | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/tools/cryptorf/sma_multi.cpp b/tools/cryptorf/sma_multi.cpp
index 390c98495..bb1676aad 100644
--- a/tools/cryptorf/sma_multi.cpp
+++ b/tools/cryptorf/sma_multi.cpp
@@ -371,7 +371,7 @@ static inline void sm_left_mask(const uint8_t *ks, uint8_t *mask, uint64_t rstat
 
 std::atomic<bool> key_found{0};
 std::atomic<uint64_t> key{0};
-std::atomic<size_t> topbits{0};
+std::atomic<size_t> g_topbits{0};
 std::mutex g_ice_mtx;
 static uint32_t g_num_cpus = std::thread::hardware_concurrency();
 
@@ -421,9 +421,9 @@ static void ice_sm_right_thread(
         }
 
         g_ice_mtx.lock();
-        if (bits > topbits.load(std::memory_order_relaxed)) {
+        if (bits > g_topbits.load(std::memory_order_relaxed)) {
             // Copy the winning mask
-            topbits = bits;
+            g_topbits = bits;
             memcpy(mask, tmp_mask, 16);
         }
         g_ice_mtx.unlock();
@@ -450,7 +450,7 @@ static void ice_sm_right_thread(
 static uint32_t ice_sm_right(const uint8_t *ks, uint8_t *mask, vector<uint64_t> *pcrstates) {
 
     map<uint64_t, uint64_t> bincstates;
-    topbits = ATOMIC_VAR_INIT(0);
+    g_topbits = ATOMIC_VAR_INIT(0);
 
     std::vector<std::thread> threads(g_num_cpus);
     for (uint8_t m = 0; m < g_num_cpus; m++) {
@@ -474,7 +474,7 @@ static uint32_t ice_sm_right(const uint8_t *ks, uint8_t *mask, vector<uint64_t>
     // Reverse the vector order (so the higest bin comes first)
     reverse(pcrstates->begin(), pcrstates->end());
 
-    return topbits;
+    return g_topbits;
 }
 
 static void ice_sm_left_thread(
@@ -899,7 +899,7 @@ void combine_valid_left_right_states(vector<cs_t> *plcstates, vector<cs_t> *prcs
         inner = *plcstates;
     }
 
-    printf("Outer  " _YELLOW_("%lu")" , inner " _YELLOW_("%lu") "\n", outer.size(), inner.size());
+    printf("Outer  " _YELLOW_("%zu")" , inner " _YELLOW_("%zu") "\n", outer.size(), inner.size());
 
     // Clean up the candidate list
     pgc_candidates->clear();
@@ -928,7 +928,7 @@ void combine_valid_left_right_states(vector<cs_t> *plcstates, vector<cs_t> *prcs
         }
     }
     printf("Found a total of " _YELLOW_("%llu")" combinations, ", ((unsigned long long)plcstates->size()) * prcstates->size());
-    printf("but only " _GREEN_("%lu")" were valid!\n", pgc_candidates->size());
+    printf("but only " _GREEN_("%zu")" were valid!\n", pgc_candidates->size());
 }
 
 static void ice_compare(
@@ -1080,8 +1080,8 @@ int main(int argc, const char *argv[]) {
     //rbits = sm_right(ks, mask, &rstates);
     rbits = ice_sm_right(ks, mask, &rstates);
 
-    printf("Top-bin for the right state contains " _GREEN_("%d")" correct bits\n", rbits);
-    printf("Total count of right bins: " _YELLOW_("%lu") "\n", (unsigned long)rstates.size());
+    printf("Top-bin for the right state contains " _GREEN_("%u")" correct bits\n", rbits);
+    printf("Total count of right bins: " _YELLOW_("%zu") "\n", (unsigned long)rstates.size());
 
     if (rbits < 96) {
         printf(_RED_("\n  WARNING!!! Better find another trace, the right top-bin is < 96 bits\n\n"));
@@ -1093,19 +1093,19 @@ int main(int argc, const char *argv[]) {
         printf("Using the state from the top-right bin: " _YELLOW_("0x%07" PRIx64)"\n", rstate_after_gc);
 
         search_gc_candidates_right(rstate_before_gc, rstate_after_gc, Q, &crstates);
-        printf("Found " _YELLOW_("%lu")" right candidates using the meet-in-the-middle attack\n", crstates.size());
+        printf("Found " _YELLOW_("%zu")" right candidates using the meet-in-the-middle attack\n", crstates.size());
         if (crstates.size() == 0) continue;
 
         printf("Calculating left states using the (unknown bits) mask from the top-right state\n");
         //sm_left(ks, mask, &clstates);
         ice_sm_left(ks, mask, &clstates);
 
-        printf("Found a total of " _YELLOW_("%lu")" left cipher states, recovering left candidates...\n", clstates.size());
+        printf("Found a total of " _YELLOW_("%zu")" left cipher states, recovering left candidates...\n", clstates.size());
         if (clstates.size() == 0) continue;
         search_gc_candidates_left(lstate_before_gc, Q, &clstates);
 
 
-        printf("The meet-in-the-middle attack returned " _YELLOW_("%lu")" left cipher candidates\n", clstates.size());
+        printf("The meet-in-the-middle attack returned " _YELLOW_("%zu")" left cipher candidates\n", clstates.size());
         if (clstates.size() == 0) continue;
 
         printf("Combining left and right states, disposing invalid combinations\n");

From c50c0f1630bc104717c12556f89fffe2d55e33cb Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 29 Jan 2021 19:28:13 +0100
Subject: [PATCH 466/682] cppchecker fix, removed odd loop

---
 common/crc32.c | 21 +++++++++++----------
 common/crc32.h |  4 ++--
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/common/crc32.c b/common/crc32.c
index baf6ddd28..574d499b2 100644
--- a/common/crc32.c
+++ b/common/crc32.c
@@ -18,17 +18,18 @@ static void crc32_byte(uint32_t *crc, const uint8_t value) {
     }
 }
 
-void crc32_ex(const uint8_t *data, const size_t len, uint8_t *crc) {
-    uint32_t desfire_crc = CRC32_PRESET;
-    for (size_t i = 0; i < len; i++) {
-        crc32_byte(&desfire_crc, data[i]);
-    }
-    uint32_t crctmp = htole32(desfire_crc);
-    for (size_t i = 0; i < sizeof(uint32_t); i++) {
-        crc[i] = ((uint8_t *) &crctmp)[i];
+void crc32_ex(const uint8_t *d, const size_t n, uint8_t *crc) {
+    uint32_t c = CRC32_PRESET;
+    for (size_t i = 0; i < n; i++) {
+        crc32_byte(&c, d[i]);
     }
+    crc[0] = (uint8_t) c;
+    crc[1] = (uint8_t)(c >> 8);
+    crc[2] = (uint8_t)(c >> 16);
+    crc[3] = (uint8_t)(c >> 24);
 }
 
-void crc32_append(uint8_t *data, const size_t len) {
-    crc32_ex(data, len, data + len);
+
+void crc32_append(uint8_t *d, const size_t n) {
+    crc32_ex(d, n, d + n);
 }
diff --git a/common/crc32.h b/common/crc32.h
index a6bbee16a..2cbe45e6c 100644
--- a/common/crc32.h
+++ b/common/crc32.h
@@ -11,7 +11,7 @@
 
 #include "common.h"
 
-void crc32_ex(const uint8_t *data, const size_t len, uint8_t *crc);
-void crc32_append(uint8_t *data, const size_t len);
+void crc32_ex(const uint8_t *d, const size_t n, uint8_t *crc);
+void crc32_append(uint8_t *d, const size_t n);
 
 #endif

From e42985b65ca4e7084f26bbfdb0135cca7f391614 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 29 Jan 2021 19:28:45 +0100
Subject: [PATCH 467/682] testing crc32

---
 client/src/cmdanalyse.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/client/src/cmdanalyse.c b/client/src/cmdanalyse.c
index 87c989618..5f6860e95 100644
--- a/client/src/cmdanalyse.c
+++ b/client/src/cmdanalyse.c
@@ -19,6 +19,7 @@
 #include "ui.h"           // PrintAndLog
 #include "crc.h"
 #include "crc16.h"        // crc16 ccitt
+#include "crc32.h"        // crc32_ex
 #include "tea.h"
 #include "legic_prng.h"
 #include "cmddata.h"      // demodbuffer
@@ -361,6 +362,12 @@ static int CmdAnalyseCRC(const char *Cmd) {
     uint16_t crcEE = b1 << 8 | b2;
     PrintAndLogEx(INFO, "FeliCa          | %04x or %04x (31C3 expected)\n", crcEE, Crc16ex(CRC_FELICA, dataStr, sizeof(dataStr)));
 
+
+    uint32_t crc32 = 0;
+    crc32_ex(dataStr, sizeof(dataStr), (uint8_t *)&crc32);
+    PrintAndLogEx(INFO, "CRC32 (desfire) | %08x ( expected)", crc32);
+    PrintAndLogEx(INFO, "---------------------------------------------------------------\n\n\n");
+
     return PM3_SUCCESS;
 }
 

From ea5625c304d07ca8655db218e1b3013645170bfe Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 29 Jan 2021 20:35:18 +0100
Subject: [PATCH 468/682] chg: cliparse error message unified to pm3 style

---
 client/deps/cliparser/argtable3.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/client/deps/cliparser/argtable3.c b/client/deps/cliparser/argtable3.c
index 43701d735..783bd303b 100644
--- a/client/deps/cliparser/argtable3.c
+++ b/client/deps/cliparser/argtable3.c
@@ -830,7 +830,7 @@ static void arg_date_errorfn(
     /* make argval NULL safe */
     argval = argval ? argval : "";
 
-    fprintf(fp, "%s: ", progname);
+    fprintf(fp, "[!] %s: ", progname);
     switch (errorcode) {
         case EMINCOUNT:
             fputs("missing option ", fp);
@@ -846,11 +846,11 @@ static void arg_date_errorfn(
             struct tm tm;
             char buff[200];
 
-            fprintf(fp, "illegal timestamp format \"%s\"\n", argval);
+            fprintf(fp, "[!] illegal timestamp format \"%s\"\n", argval);
             memset(&tm, 0, sizeof(tm));
             arg_strptime("1999-12-31 23:59:59", "%F %H:%M:%S", &tm);
             strftime(buff, sizeof(buff), parent->format, &tm);
-            printf("correct format is \"%s\"\n", buff);
+            printf("[+] correct format is \"%s\"\n", buff);
             break;
         }
     }
@@ -1442,7 +1442,7 @@ static void arg_dbl_errorfn(
     /* make argval NULL safe */
     argval = argval ? argval : "";
 
-    fprintf(fp, "%s: ", progname);
+    fprintf(fp, "[!] %s: ", progname);
     switch (errorcode) {
         case EMINCOUNT:
             fputs("missing option ", fp);
@@ -1455,7 +1455,7 @@ static void arg_dbl_errorfn(
             break;
 
         case EBADDOUBLE:
-            fprintf(fp, "invalid argument \"%s\" to option ", argval);
+            fprintf(fp, "[!] invalid argument \"%s\" to option ", argval);
             arg_print_option(fp, shortopts, longopts, datatype, "\n");
             break;
     }
@@ -1805,7 +1805,7 @@ static void arg_file_errorfn(
     /* make argval NULL safe */
     argval = argval ? argval : "";
 
-    fprintf(fp, "%s: ", progname);
+    fprintf(fp, "[!] %s: ", progname);
     switch (errorcode) {
         case EMINCOUNT:
             fputs("missing option ", fp);
@@ -1818,7 +1818,7 @@ static void arg_file_errorfn(
             break;
 
         default:
-            fprintf(fp, "unknown error at \"%s\"\n", argval);
+            fprintf(fp, "[!] unknown error at \"%s\"\n", argval);
     }
 }
 
@@ -2136,7 +2136,7 @@ static void arg_int_errorfn(
     /* make argval NULL safe */
     argval = argval ? argval : "";
 
-    fprintf(fp, "%s: ", progname);
+    fprintf(fp, "[!] %s: ", progname);
     switch (errorcode) {
         case EMINCOUNT:
             fputs("missing option ", fp);
@@ -2149,7 +2149,7 @@ static void arg_int_errorfn(
             break;
 
         case EBADINT:
-            fprintf(fp, "invalid argument \"%s\" to option ", argval);
+            fprintf(fp, "[!] invalid argument \"%s\" to option ", argval);
             arg_print_option(fp, shortopts, longopts, datatype, "\n");
             break;
 
@@ -2394,7 +2394,7 @@ static void arg_u64_errorfn(
     /* make argval NULL safe */
     argval = argval ? argval : "";
 
-    fprintf(fp, "%s: ", progname);
+    fprintf(fp, "[!] %s: ", progname);
     switch (errorcode) {
         case EMINCOUNT:
             fputs("missing option ", fp);
@@ -2407,7 +2407,7 @@ static void arg_u64_errorfn(
             break;
 
         case EBADINT:
-            fprintf(fp, "invalid argument \"%s\" to option ", argval);
+            fprintf(fp, "[!] invalid argument \"%s\" to option ", argval);
             arg_print_option(fp, shortopts, longopts, datatype, "\n");
             break;
 

From e29bbcf6c374582816cca1406c897e68dd135d9b Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 29 Jan 2021 20:35:36 +0100
Subject: [PATCH 469/682] text

---
 client/src/cmdwiegand.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdwiegand.c b/client/src/cmdwiegand.c
index e3b0418ac..3fcce3214 100644
--- a/client/src/cmdwiegand.c
+++ b/client/src/cmdwiegand.c
@@ -49,7 +49,8 @@ int CmdWiegandEncode(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "wiegand encode",
                   "Encode wiegand formatted number to raw hex",
-                  "wiegand encode -w H10301 --fc 101 --cn 1337"
+                  "wiegand encode --fc 101 --cn 1337               ->  show all formats\n"
+                  "wiegand encode -w H10301 --fc 101 --cn 1337     ->  H10301 format "
                  );
 
     void *argtable[] = {

From 8f8263ae59df4a8faab33b37cb144a81f74309e2 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Fri, 29 Jan 2021 23:27:33 +0300
Subject: [PATCH 470/682] emrtd: Fix EF_DG2 image dumping

---
 client/src/cmdhfemrtd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 255939ab0..604beb68c 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -713,8 +713,8 @@ static int emrtd_dump_ef_dg2(uint8_t *file_contents, size_t file_length, const c
     // Note: Doing file_length - 6 to account for the longest data we're checking.
     // Checks first byte before the rest to reduce overhead
     for (offset = 0; offset < file_length - 6; offset++) {
-        if ((file_contents[offset] == 0xFF && memcmp(jpeg_header, file_contents + offset, 4) != 0) ||
-                (file_contents[offset] == 0x00 && memcmp(jpeg2k_header, file_contents + offset, 6) != 0)) {
+        if ((file_contents[offset] == 0xFF && memcmp(jpeg_header, file_contents + offset, 4) == 0) ||
+                (file_contents[offset] == 0x00 && memcmp(jpeg2k_header, file_contents + offset, 6) == 0)) {
             datalen = file_length - offset;
             break;
         }

From 8edbe86b5d20923dd22f671d2f061c35bbc34264 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Sat, 30 Jan 2021 00:19:22 +0100
Subject: [PATCH 471/682] added entry for standalone mode lf_tharexde (EM4x50
 sim/read)

---
 CHANGELOG.md                                                | 1 +
 doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md | 1 +
 2 files changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 323774a34..79529f2c4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+ - Added `LF_THAREXDE` standalone mode which simulates and reads EM4x50 cards (@tharexde)
  - Added support for bidirectional communication for `lf em 4x50 sim` (@tharexde)
  - Added `tools/hitag2crack/crack5opencl`, an optimized version of `crack5gpu` (@matrix)
  - Fixed Makefile to account for changes when running on Apple Silicon (@tcprst)
diff --git a/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md b/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
index 6dbe54d49..2ba6aeaba 100644
--- a/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
+++ b/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
@@ -79,6 +79,7 @@ Here are the supported values you can assign to `STANDALONE` in `Makefile.platfo
 |-----------------|----------------------------------------|
 |                 | No standalone mode
 | LF_SKELETON     | standalone mode skeleton - Iceman1001
+| LF_THAREXDE     | LF EM4x50 simulator/read standalone mode - tharexde
 | LF_EM4100EMUL   | LF EM4100 simulator standalone mode - temskiy
 | LF_EM4100RSWB   | LF EM4100 read/write/clone/brute mode - Monster1024
 | LF_EM4100RWC    | LF EM4100 read/write/clone mode - temskiy

From a72058243bd4625ded659dd1a1dc32c0c9e7c9f5 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sun, 31 Jan 2021 01:07:51 +0100
Subject: [PATCH 472/682] lcd-h is renamed

---
 armsrc/appmain.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index 33ea032de..6a6058d3b 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -50,7 +50,7 @@
 #include "crc16.h"
 
 #ifdef WITH_LCD
-#include "LCD.h"
+#include "LCD_disabled.h"
 #endif
 
 #ifdef WITH_SMARTCARD

From 3a051b326615dc322bb4f6e0216416d94a174c08 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sun, 31 Jan 2021 01:09:27 +0100
Subject: [PATCH 473/682] lf indala sim - now it works again

---
 client/src/cmdlfindala.c | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/client/src/cmdlfindala.c b/client/src/cmdlfindala.c
index da2662af1..b210116a8 100644
--- a/client/src/cmdlfindala.c
+++ b/client/src/cmdlfindala.c
@@ -544,7 +544,8 @@ static int CmdIndalaSim(const char *Cmd) {
 
     // raw param
     int raw_len = 0;
-    uint8_t raw[(7 * 4) + 1 ];
+    uint8_t raw[(7 * 4) + 1];
+    memset(raw, 0, sizeof(raw));
     CLIGetHexWithReturn(ctx, 1, raw, &raw_len);
 
     bool is_long_uid = (raw_len == 28);
@@ -569,15 +570,21 @@ static int CmdIndalaSim(const char *Cmd) {
     uint8_t bs[224];
     memset(bs, 0x00, sizeof(bs));
 
-    uint8_t counter = 223;
-    for (uint8_t i = 0; i < raw_len; i++) {
+    uint8_t counter = 0;
+    for (int8_t i = 0; i < raw_len; i++) {
         uint8_t tmp = raw[i];
-        for (uint8_t j = 0; j < 8; j++) {
-            bs[counter--] = tmp & 1;
-            tmp >>= 1;
-        }
+        bs[counter++] = (tmp >> 7) & 1;
+        bs[counter++] = (tmp >> 6) & 1;
+        bs[counter++] = (tmp >> 5) & 1;
+        bs[counter++] = (tmp >> 4) & 1;
+        bs[counter++] = (tmp >> 3) & 1;
+        bs[counter++] = (tmp >> 2) & 1;
+        bs[counter++] = (tmp >> 1) & 1;
+        bs[counter++] = tmp & 1;
     }
 
+    // a0 00 00 00 bd 98 9a 11
+    
     // indala PSK
     // It has to send either 64bits (8bytes) or 224bits (28bytes).  Zero padding needed if not.
     // lf simpsk 1 c 32 r 2 d 0102030405060708
@@ -593,10 +600,10 @@ static int CmdIndalaSim(const char *Cmd) {
     payload->carrier =  2;
     payload->invert = 0;
     payload->clock = 32;
-    memcpy(payload->data, bs, sizeof(bs));
+    memcpy(payload->data, bs, raw_len * 8);
 
     clearCommandBuffer();
-    SendCommandNG(CMD_LF_PSK_SIMULATE, (uint8_t *)payload,  sizeof(lf_psksim_t) + sizeof(bs));
+    SendCommandNG(CMD_LF_PSK_SIMULATE, (uint8_t *)payload,  sizeof(lf_psksim_t) + (raw_len * 8));
     free(payload);
 
     PacketResponseNG resp;

From 31e1db1bc2559d375b33ab761090544016e8f562 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sun, 31 Jan 2021 23:43:15 +0100
Subject: [PATCH 474/682] hf 14a info - identify HID SEOS.  ATQA: 00 01, SAK 20

---
 client/src/cmdhf14a.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index e772d406e..f03dc8687 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -1422,7 +1422,8 @@ typedef enum {
     MTDESFIRE = 4,
     MTPLUS = 8,
     MTULTRALIGHT = 16,
-    MTOTHER = 32
+    HID_SEOS = 32,
+    MTOTHER = 64
 } nxp_mifare_type_t;
 
 // Based on NXP AN10833 Rev 3.6 and NXP AN10834 Rev 4.1
@@ -1525,11 +1526,17 @@ static int detect_nxp_card(uint8_t sak, uint16_t atqa, uint64_t select_status) {
                         type |= MTPLUS;
                     }
                 } else {
-                    printTag("MIFARE Plus EV1 2K/4K in SL3");
-                    printTag("MIFARE Plus S 2K/4K in SL3");
-                    printTag("MIFARE Plus X 2K/4K in SL3");
-                    printTag("MIFARE Plus SE 1K");
-                    type |= MTPLUS;
+
+                    if ((atqa & 0x0001) == 0x0001) {
+                        printTag("HID SEOS (smartmx / javacard)");
+                        type |= HID_SEOS;
+                    } else {
+                        printTag("MIFARE Plus EV1 2K/4K in SL3");
+                        printTag("MIFARE Plus S 2K/4K in SL3");
+                        printTag("MIFARE Plus X 2K/4K in SL3");
+                        printTag("MIFARE Plus SE 1K");
+                        type |= MTPLUS;
+                    }
                 }
 
                 printTag("NTAG 4xx");

From 06a521f0907273e5df7169c4f6e0bd2a16a574e8 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 1 Feb 2021 10:12:30 +0100
Subject: [PATCH 475/682] good to have tools for NDEF and NFC Forum support on
 other devices

---
 tools/Makefile | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tools/Makefile b/tools/Makefile
index df6a0682f..5640a5598 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -18,3 +18,13 @@ get_xorsearch:
 #	unzzip-big XORSearch_V1_11_2.zip
 #  linux
 #	gunzip  XORSearch_V1_11_2.zip
+
+# Python impl of NDEF FORUM 1-5 protocol
+get_nfcpy:
+    $(MKDIR) nfcpy
+    $(WGET) https://github.com/nfcpy/nfcpy.git
+
+# Python tool to create, modify and print NDEF records
+get_ndeftool:
+    $(MKDIR) ndeftool
+    $(WGET) https://github.com/nfcpy/ndeftool.git

From d224549d66b6865f5f3f88bd1db1e32d0b6a651a Mon Sep 17 00:00:00 2001
From: Gabriele Gristina <matrix@users.noreply.github.com>
Date: Mon, 1 Feb 2021 19:08:42 +0100
Subject: [PATCH 476/682] fix bug with platform/device selection

---
 tools/hitag2crack/crack5opencl/opencl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/hitag2crack/crack5opencl/opencl.c b/tools/hitag2crack/crack5opencl/opencl.c
index 98b85714e..5251a7627 100644
--- a/tools/hitag2crack/crack5opencl/opencl.c
+++ b/tools/hitag2crack/crack5opencl/opencl.c
@@ -254,7 +254,8 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
 
                     if (verbose) printf("%14s: %s\n", "Device Type", (device_type & CL_DEVICE_TYPE_GPU) ? "GPU" : (device_type & CL_DEVICE_TYPE_CPU) ? "CPU" : "Other");
 
-                    (*cd_ctx)[platform_idx].device[device_idx].selected = plat_dev_enabled(global_device_id, dev_sel, dev_cnt, (unsigned int) device_type, device_types_selected);
+                    if ((*cd_ctx)[platform_idx].selected == false) (*cd_ctx)[platform_idx].device[device_idx].selected = false;
+                    else (*cd_ctx)[platform_idx].device[device_idx].selected = plat_dev_enabled(global_device_id, dev_sel, dev_cnt, (unsigned int) device_type, device_types_selected);
                     global_device_id++;
                     if ((*cd_ctx)[platform_idx].device[device_idx].selected)(*selected_devices_cnt)++;
                     continue;

From 40230532f5056c7b21458b168eae0a9d1195b757 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 1 Feb 2021 23:23:34 +0100
Subject: [PATCH 477/682] text

---
 armsrc/lfops.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/armsrc/lfops.c b/armsrc/lfops.c
index f8652c44a..c09843aec 100644
--- a/armsrc/lfops.c
+++ b/armsrc/lfops.c
@@ -1009,7 +1009,7 @@ void CmdFSKsimTAGEx(uint8_t fchigh, uint8_t fclow, uint8_t separator, uint8_t cl
 
     WDT_HIT();
 
-    Dbprintf("Simulating with fcHigh: %d, fcLow: %d, clk: %d, STT: %d, n: %d", fchigh, fclow, clk, separator, n);
+    Dbprintf("FSK simulating with FC/%d, fcHigh: %d, fcLow: %d, STT: %d, n: %d", clk, fchigh, fclow, separator, n);
 
     if (ledcontrol) LED_A_ON();
     SimulateTagLowFrequencyEx(n, 0, ledcontrol, numcycles);
@@ -1122,10 +1122,10 @@ void CmdASKsimTAG(uint8_t encoding, uint8_t invert, uint8_t separator, uint8_t c
 
     WDT_HIT();
 
-    Dbprintf("Simulating with clk: %d, invert: %d, encoding: %s (%d), separator: %d, n: %d"
+    Dbprintf("ASK simulating with FC/ %d, invert: %d, encoding: %s (%d), separator: %d, n: %d"
              , clk
              , invert
-             , (encoding == 2) ? "BI" : (encoding == 1) ? "ASK" : "RAW"
+             , (encoding == 2) ? "BI" : (encoding == 1) ? "ASK/MAN" : "RAW/MAN"
              , encoding
              , separator
              , n
@@ -1176,7 +1176,7 @@ void CmdPSKsimTAG(uint8_t carrier, uint8_t invert, uint8_t clk, uint16_t size, u
 
     WDT_HIT();
 
-    Dbprintf("Simulating with Carrier: %d, clk: %d, invert: %d, n: %d", carrier, clk, invert, n);
+    Dbprintf("PSK simulating with FC/%d , RC/%d, invert %d, n %d", clk, carrier, invert, n);
 
     if (ledcontrol) LED_A_ON();
     SimulateTagLowFrequency(n, 0, ledcontrol);
@@ -1220,7 +1220,7 @@ void CmdNRZsimTAG(uint8_t invert, uint8_t separator, uint8_t clk, uint16_t size,
 
     WDT_HIT();
 
-    Dbprintf("Simulating with clk: %d, invert: %d, separator: %d, n: %d"
+    Dbprintf("NRZ simulating with FC/%d, invert: %d, separator: %d, n: %d"
              , clk
              , invert
              , separator

From aad7d4c8df90f53cacb628a9ac124a7fd48afa33 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 1 Feb 2021 23:27:26 +0100
Subject: [PATCH 478/682] text

---
 armsrc/lfops.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/armsrc/lfops.c b/armsrc/lfops.c
index c09843aec..d31224c90 100644
--- a/armsrc/lfops.c
+++ b/armsrc/lfops.c
@@ -1009,7 +1009,7 @@ void CmdFSKsimTAGEx(uint8_t fchigh, uint8_t fclow, uint8_t separator, uint8_t cl
 
     WDT_HIT();
 
-    Dbprintf("FSK simulating with FC/%d, fcHigh: %d, fcLow: %d, STT: %d, n: %d", clk, fchigh, fclow, separator, n);
+    Dbprintf("FSK simulating with FC/%d, fcHigh %d, fcLow %d, STT %d, n %d", clk, fchigh, fclow, separator, n);
 
     if (ledcontrol) LED_A_ON();
     SimulateTagLowFrequencyEx(n, 0, ledcontrol, numcycles);
@@ -1122,7 +1122,7 @@ void CmdASKsimTAG(uint8_t encoding, uint8_t invert, uint8_t separator, uint8_t c
 
     WDT_HIT();
 
-    Dbprintf("ASK simulating with FC/ %d, invert: %d, encoding: %s (%d), separator: %d, n: %d"
+    Dbprintf("ASK simulating with FC/%d, invert %d, encoding %s (%d), separator %d, n %d"
              , clk
              , invert
              , (encoding == 2) ? "BI" : (encoding == 1) ? "ASK/MAN" : "RAW/MAN"
@@ -1176,7 +1176,7 @@ void CmdPSKsimTAG(uint8_t carrier, uint8_t invert, uint8_t clk, uint16_t size, u
 
     WDT_HIT();
 
-    Dbprintf("PSK simulating with FC/%d , RC/%d, invert %d, n %d", clk, carrier, invert, n);
+    Dbprintf("PSK simulating with FC/%d, RC/%d, invert %d, n %d", clk, carrier, invert, n);
 
     if (ledcontrol) LED_A_ON();
     SimulateTagLowFrequency(n, 0, ledcontrol);
@@ -1220,7 +1220,7 @@ void CmdNRZsimTAG(uint8_t invert, uint8_t separator, uint8_t clk, uint16_t size,
 
     WDT_HIT();
 
-    Dbprintf("NRZ simulating with FC/%d, invert: %d, separator: %d, n: %d"
+    Dbprintf("NRZ simulating with FC/%d, invert %d, separator %d, n %d"
              , clk
              , invert
              , separator

From fa3a1f1cbf2939cb54066dda356a0ad3641d056e Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 1 Feb 2021 23:52:48 +0100
Subject: [PATCH 479/682] lf simpsk - now uses cliparser. And simulation can be
 broken by enter or button press

---
 client/src/cmdlf.c | 276 ++++++++++++++++++++++++++-------------------
 1 file changed, 162 insertions(+), 114 deletions(-)

diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index 00f0dea27..bce083a86 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -203,19 +203,7 @@ static int usage_lf_simask(void) {
     PrintAndLogEx(NORMAL, "       d <hexdata>    Data to sim as hex - omit to sim from DemodBuffer");
     return PM3_SUCCESS;
 }
-static int usage_lf_simpsk(void) {
-    PrintAndLogEx(NORMAL, "Usage: lf simpsk [1|2|3] [c <clock>] [i] [r <carrier>] [d <raw hex to sim>]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h              This help");
-    PrintAndLogEx(NORMAL, "       c <clock>      Manually set clock - can autodetect if using DemodBuffer");
-    PrintAndLogEx(NORMAL, "       i              invert data");
-    PrintAndLogEx(NORMAL, "       1              set PSK1 (default)");
-    PrintAndLogEx(NORMAL, "       2              set PSK2");
-    PrintAndLogEx(NORMAL, "       3              set PSK3");
-    PrintAndLogEx(NORMAL, "       r <carrier>    2|4|8 are valid carriers: default = 2");
-    PrintAndLogEx(NORMAL, "       d <hexdata>    Data to sim as hex - omit to sim from DemodBuffer");
-    return PM3_SUCCESS;
-}
+
 
 static int CmdLFTune(const char *Cmd) {
 
@@ -865,8 +853,6 @@ int CmdLFSim(const char *Cmd) {
 
     PrintAndLogEx(DEBUG, "DEBUG: Uploading %zu bytes", GraphTraceLen);
 
-    PacketResponseNG resp;
-
     struct pupload {
         uint8_t flag;
         uint16_t offset;
@@ -881,6 +867,8 @@ int CmdLFSim(const char *Cmd) {
     // fast push mode
     conn.block_after_ACK = true;
 
+    PacketResponseNG resp;
+
     //can send only 512 bits at a time (1 byte sent per bit...)
     for (uint16_t i = 0; i < GraphTraceLen; i += PM3_CMD_DATA_SIZE - 3) {
 
@@ -903,8 +891,6 @@ int CmdLFSim(const char *Cmd) {
 
     // Disable fast mode before last command
     conn.block_after_ACK = false;
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(INFO, "Simulating");
 
     struct p {
         uint16_t len;
@@ -916,11 +902,24 @@ int CmdLFSim(const char *Cmd) {
     clearCommandBuffer();
     SendCommandNG(CMD_LF_SIMULATE, (uint8_t *)&payload, sizeof(payload));
 
-    WaitForResponse(CMD_LF_SIMULATE, &resp);
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " or pm3-button to exit");
 
+    for (;;) {
+        if (kbd_enter_pressed()) {
+            SendCommandNG(CMD_BREAK_LOOP, NULL, 0);
+            PrintAndLogEx(DEBUG, "User aborted");
+            break;
+        }
+
+        if (WaitForResponseTimeout(CMD_LF_SIMULATE, &resp, 1000)) {
+            if (resp.status == PM3_EOPABORTED) {
+                PrintAndLogEx(DEBUG, "Button pressed, user aborted");
+                break;
+            }
+        }
+    }
     PrintAndLogEx(INFO, "Done");
-    if (resp.status != PM3_EOPABORTED)
-        return resp.status;
     return PM3_SUCCESS;
 }
 
@@ -1012,19 +1011,31 @@ int CmdLFfskSim(const char *Cmd) {
     payload->clock = clk;
     memcpy(payload->data, DemodBuffer, size);
 
-    PrintAndLogEx(INFO, "Simulating");
-
     clearCommandBuffer();
     SendCommandNG(CMD_LF_FSK_SIMULATE, (uint8_t *)payload,  sizeof(lf_fsksim_t) + size);
     free(payload);
 
     setClockGrid(clk, 0);
-    PacketResponseNG resp;
-    WaitForResponse(CMD_LF_FSK_SIMULATE, &resp);
 
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " or pm3-button to exit");
+
+    for (;;) {
+        if (kbd_enter_pressed()) {
+            SendCommandNG(CMD_BREAK_LOOP, NULL, 0);
+            PrintAndLogEx(DEBUG, "User aborted");
+            break;
+        }
+
+        PacketResponseNG resp;
+        if (WaitForResponseTimeout(CMD_LF_FSK_SIMULATE, &resp, 1000)) {
+            if (resp.status == PM3_EOPABORTED) {
+                PrintAndLogEx(DEBUG, "Button pressed, user aborted");
+                break;
+            }
+        }
+    }
     PrintAndLogEx(INFO, "Done");
-    if (resp.status != PM3_EOPABORTED)
-        return resp.status;
     return PM3_SUCCESS;
 }
 
@@ -1114,113 +1125,140 @@ int CmdLFaskSim(const char *Cmd) {
     payload->clock = clk;
     memcpy(payload->data, DemodBuffer, size);
 
-    PrintAndLogEx(INFO, "Simulating");
-
     clearCommandBuffer();
     SendCommandNG(CMD_LF_ASK_SIMULATE, (uint8_t *)payload,  sizeof(lf_asksim_t) + size);
     free(payload);
 
-    PacketResponseNG resp;
-    WaitForResponse(CMD_LF_ASK_SIMULATE, &resp);
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " or pm3-button to exit");
 
+    for (;;) {
+        if (kbd_enter_pressed()) {
+            SendCommandNG(CMD_BREAK_LOOP, NULL, 0);
+            PrintAndLogEx(DEBUG, "User aborted");
+            break;
+        }
+
+        PacketResponseNG resp;
+        if (WaitForResponseTimeout(CMD_LF_ASK_SIMULATE, &resp, 1000)) {
+            if (resp.status == PM3_EOPABORTED) {
+                PrintAndLogEx(DEBUG, "Button pressed, user aborted");
+                break;
+            }
+        }
+    }
     PrintAndLogEx(INFO, "Done");
-    if (resp.status != PM3_EOPABORTED)
-        return resp.status;
     return PM3_SUCCESS;
 }
 
 // sim psk data given carrier, clock, invert
 // - allow pull data from DemodBuffer or parameters
 int CmdLFpskSim(const char *Cmd) {
-    //might be able to autodetect FC and clock from Graphbuffer if using demod buffer
-    //will need carrier, Clock, and bitstream
-    uint8_t carrier = 0, clk = 0;
-    uint8_t invert = 0;
-    bool errors = false;
-    char hexData[64] = {0x00}; // store entered hex data
-    uint8_t data[255] = {0x00};
-    int dataLen = 0;
-    uint8_t cmdp = 0;
-    uint8_t pskType = 1;
+ 
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf simpsk",
+                  "Simulate LF PSK tag from demodbuffer or input",
+                  "lf simpsk -1 --clk 32 --rc 2 -d a0000000bd989a11   --> simulate a indala tag manually\n"
+                 );
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_lf_simpsk();
-            case 'i':
-                invert = 1;
-                cmdp++;
-                break;
-            case 'c':
-                errors |= param_getdec(Cmd, cmdp + 1, &clk);
-                cmdp += 2;
-                break;
-            case 'r':
-                errors |= param_getdec(Cmd, cmdp + 1, &carrier);
-                cmdp += 2;
-                break;
-            case '1':
-                pskType = 1;
-                cmdp++;
-                break;
-            case '2':
-                pskType = 2;
-                cmdp++;
-                break;
-            case '3':
-                pskType = 3;
-                cmdp++;
-                break;
-            case 'd':
-                dataLen = param_getstr(Cmd, cmdp + 1, hexData, sizeof(hexData));
-                if (dataLen == 0)
-                    errors = true;
-                else
-                    dataLen = hextobinarray((char *)data, hexData);
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0("1", "psk1", "set PSK1 (default)"),
+        arg_lit0("2", "psk2", "set PSK2"),
+        arg_lit0("3", "psk3", "set PSK3"),        
+        arg_lit0("i", "inv", "invert data"),
+        arg_u64_0("c", "clk", "<dec>", "manually set clock - can autodetect if using DemodBuffer (default 32)"),
+        arg_u64_0(NULL, "rc", "<dec>", "2|4|8 are valid carriers (default 2)"),
+        arg_str0("d", "data", "<hex>", "data to sim - omit to use DemodBuffer"),
+        arg_lit0("v", "verbose", "verbose output"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool use_psk1 = arg_get_lit(ctx, 1);
+    bool use_psk2 = arg_get_lit(ctx, 2);
+    bool use_psk3 = arg_get_lit(ctx, 3);
+    bool invert = arg_get_lit(ctx, 4);
+    uint8_t clk = arg_get_u32_def(ctx, 5, 0);
+    uint8_t carrier = arg_get_u32_def(ctx, 6, 2);
+    int raw_len = 64;
+    char raw[64] = {0};
+    CLIGetStrWithReturn(ctx, 7, (uint8_t*)raw, &raw_len);
+    bool verbose = arg_get_lit(ctx, 8);
+    CLIParserFree(ctx);
 
-                if (dataLen == 0) errors = true;
-                if (errors) PrintAndLogEx(ERR, "Error getting hex data");
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
+    if ((use_psk1 + use_psk2 + use_psk3) > 1) {
+        PrintAndLogEx(ERR, "only one PSK mode can be set");
+        return PM3_EINVARG;
     }
+    
+    if (carrier != 2 && carrier != 4 && carrier != 8) {
+        PrintAndLogEx(ERR, "Wrong carrier given, expected <2|4|8>");
+        return PM3_EINVARG;
+    }
+
+    uint8_t psk_type = 1;
+    if (use_psk2)
+        psk_type = 2;
+    if (use_psk3)
+        psk_type = 3;
+
+
+    uint8_t bs[256] = {0x00};
+    int bs_len = hextobinarray((char *)bs, raw);
+    if (bs_len == 0) {
+        PrintAndLogEx(ERR, "Failed to convert to binary string array");
+        return PM3_EINVARG;
+    }
+
     // No args
-    if (cmdp == 0 && DemodBufferLen == 0)
-        errors = true;
+    //if (DemodBufferLen == 0)
+    //    errors = true;
 
-    //Validations
-    if (errors) return usage_lf_simpsk();
 
-    if (dataLen == 0) { //using DemodBuffer
+    if (bs_len == 0) { 
+        // Using data from DemodBuffer
+        // might be able to autodetect FC and clock from Graphbuffer if using demod buffer
+        // will need carrier, clock, and bitstream
         PrintAndLogEx(INFO, "Getting Clocks");
 
-        if (clk == 0) clk = GetPskClock("", false);
-        PrintAndLogEx(INFO, "clk: %d", clk);
+        int res = 0;
+        if (clk == 0) {
+            res = GetPskClock("", verbose);
+            if ( res < 1) {
+                clk = 32;
+            } else {
+                clk = (uint8_t)res;
+            }
+        }
 
-        if (!carrier) carrier = GetPskCarrier(false);
-        PrintAndLogEx(INFO, "carrier: %d", carrier);
+        if (carrier == 0) {
+             res = GetPskCarrier(verbose);
+             if (res < 1 ) {
+                 carrier = 2;
+             } else {
+                 carrier = (uint8_t)res;
+             }
+        }
+        PrintAndLogEx(INFO, "Using clk: %u,  carrier: %u", clk, carrier);
 
     } else {
-        setDemodBuff(data, dataLen, 0);
+        setDemodBuff(bs, bs_len, 0);
     }
 
-    if (clk == 0) clk = 32;
-
-    if (carrier != 2 && carrier != 4 && carrier != 8)
-        carrier = 2;
-
-    if (pskType != 1) {
-        if (pskType == 2) {
-            //need to convert psk2 to psk1 data before sim
-            psk2TOpsk1(DemodBuffer, DemodBufferLen);
-        } else {
-            PrintAndLogEx(WARNING, "Sorry, PSK3 not yet available");
-        }
+    if (clk == 0) {
+        PrintAndLogEx(INFO, "Autodetection of clock failed, falling back to FC/32");
+        clk = 32;
     }
+
+
+    if (psk_type == 2) {
+        //need to convert psk2 to psk1 data before sim
+        psk2TOpsk1(DemodBuffer, DemodBufferLen);
+    } else if (psk_type == 3) {
+        PrintAndLogEx(WARNING, "PSK3 not yet available. Falling back to PSK1");
+        psk_type = 1;
+    }
+
     size_t size = DemodBufferLen;
     if (size > (PM3_CMD_DATA_SIZE - sizeof(lf_psksim_t))) {
         PrintAndLogEx(WARNING, "DemodBuffer too long for current implementation - length: %zu - max: %zu", size, PM3_CMD_DATA_SIZE - sizeof(lf_psksim_t));
@@ -1232,19 +1270,29 @@ int CmdLFpskSim(const char *Cmd) {
     payload->invert = invert;
     payload->clock = clk;
     memcpy(payload->data, DemodBuffer, size);
-
-    PrintAndLogEx(INFO, "Simulating");
-
     clearCommandBuffer();
     SendCommandNG(CMD_LF_PSK_SIMULATE, (uint8_t *)payload,  sizeof(lf_psksim_t) + size);
     free(payload);
 
-    PacketResponseNG resp;
-    WaitForResponse(CMD_LF_PSK_SIMULATE, &resp);
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " or pm3-button to exit");
 
+    for (;;) {
+        if (kbd_enter_pressed()) {
+            SendCommandNG(CMD_BREAK_LOOP, NULL, 0);
+            PrintAndLogEx(DEBUG, "User aborted");
+            break;
+        }
+
+        PacketResponseNG resp;
+        if (WaitForResponseTimeout(CMD_LF_PSK_SIMULATE, &resp, 1000)) {
+            if (resp.status == PM3_EOPABORTED) {
+                PrintAndLogEx(DEBUG, "Button pressed, user aborted");
+                break;
+            }
+        }
+    }
     PrintAndLogEx(INFO, "Done");
-    if (resp.status != PM3_EOPABORTED)
-        return resp.status;
     return PM3_SUCCESS;
 }
 

From edc81655769ae6548e6adbc270132aa570dc4677 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 2 Feb 2021 09:13:13 +0100
Subject: [PATCH 480/682] lf psksim - correct swapping with user data or
 demodbuffer data

---
 client/src/cmdlf.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index bce083a86..fcc868d91 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -1202,24 +1202,23 @@ int CmdLFpskSim(const char *Cmd) {
     if (use_psk3)
         psk_type = 3;
 
+    // to detect if raw_hex was supplied  or of 
 
-    uint8_t bs[256] = {0x00};
-    int bs_len = hextobinarray((char *)bs, raw);
-    if (bs_len == 0) {
-        PrintAndLogEx(ERR, "Failed to convert to binary string array");
+    // No args
+    if (raw_len == 0 && DemodBufferLen == 0) {
+        PrintAndLogEx(ERR, "No user supplied nor any data to found inside Demodbuffer");
         return PM3_EINVARG;
     }
 
-    // No args
-    //if (DemodBufferLen == 0)
-    //    errors = true;
 
+    uint8_t bs[256] = {0x00};
+    int bs_len = hextobinarray((char *)bs, raw);
 
     if (bs_len == 0) { 
         // Using data from DemodBuffer
         // might be able to autodetect FC and clock from Graphbuffer if using demod buffer
         // will need carrier, clock, and bitstream
-        PrintAndLogEx(INFO, "Getting Clocks");
+        PrintAndLogEx(INFO, "No user supplied data, using Demodbuffer...");
 
         int res = 0;
         if (clk == 0) {
@@ -1239,29 +1238,30 @@ int CmdLFpskSim(const char *Cmd) {
                  carrier = (uint8_t)res;
              }
         }
-        PrintAndLogEx(INFO, "Using clk: %u,  carrier: %u", clk, carrier);
+
+        PrintAndLogEx(DEBUG, "Detected FC/%u, RC/%u, n %zu ", clk, carrier, DemodBufferLen);
 
     } else {
         setDemodBuff(bs, bs_len, 0);
     }
 
     if (clk == 0) {
-        PrintAndLogEx(INFO, "Autodetection of clock failed, falling back to FC/32");
+        PrintAndLogEx(DEBUG, "Autodetection of clock failed, falling back to FC/32");
         clk = 32;
     }
 
-
     if (psk_type == 2) {
         //need to convert psk2 to psk1 data before sim
         psk2TOpsk1(DemodBuffer, DemodBufferLen);
     } else if (psk_type == 3) {
-        PrintAndLogEx(WARNING, "PSK3 not yet available. Falling back to PSK1");
+        PrintAndLogEx(INFO, "PSK3 not yet available. Falling back to PSK1");
         psk_type = 1;
     }
 
     size_t size = DemodBufferLen;
     if (size > (PM3_CMD_DATA_SIZE - sizeof(lf_psksim_t))) {
         PrintAndLogEx(WARNING, "DemodBuffer too long for current implementation - length: %zu - max: %zu", size, PM3_CMD_DATA_SIZE - sizeof(lf_psksim_t));
+        PrintAndLogEx(INFO, "Continuing with trimmed down data");
         size = PM3_CMD_DATA_SIZE - sizeof(lf_psksim_t);
     }
 

From ed3d12724b31ccd91741565c93730a1e11785e63 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 2 Feb 2021 15:33:42 +0100
Subject: [PATCH 481/682] text

---
 armsrc/lfops.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/armsrc/lfops.c b/armsrc/lfops.c
index d31224c90..6ee75b8c1 100644
--- a/armsrc/lfops.c
+++ b/armsrc/lfops.c
@@ -1009,7 +1009,7 @@ void CmdFSKsimTAGEx(uint8_t fchigh, uint8_t fclow, uint8_t separator, uint8_t cl
 
     WDT_HIT();
 
-    Dbprintf("FSK simulating with FC/%d, fcHigh %d, fcLow %d, STT %d, n %d", clk, fchigh, fclow, separator, n);
+    Dbprintf("FSK simulating with rf/%d, fc high %d, fc low %d, STT %d, n %d", clk, fchigh, fclow, separator, n);
 
     if (ledcontrol) LED_A_ON();
     SimulateTagLowFrequencyEx(n, 0, ledcontrol, numcycles);
@@ -1122,10 +1122,10 @@ void CmdASKsimTAG(uint8_t encoding, uint8_t invert, uint8_t separator, uint8_t c
 
     WDT_HIT();
 
-    Dbprintf("ASK simulating with FC/%d, invert %d, encoding %s (%d), separator %d, n %d"
+    Dbprintf("ASK simulating with rf/%d, invert %d, encoding %s (%d), separator %d, n %d"
              , clk
              , invert
-             , (encoding == 2) ? "BI" : (encoding == 1) ? "ASK/MAN" : "RAW/MAN"
+             , (encoding == 2) ? "ASK/BI" : (encoding == 1) ? "ASK/MAN" : "RAW/MAN"
              , encoding
              , separator
              , n
@@ -1176,7 +1176,7 @@ void CmdPSKsimTAG(uint8_t carrier, uint8_t invert, uint8_t clk, uint16_t size, u
 
     WDT_HIT();
 
-    Dbprintf("PSK simulating with FC/%d, RC/%d, invert %d, n %d", clk, carrier, invert, n);
+    Dbprintf("PSK simulating with rf/%d, fc/%d, invert %d, n %d", clk, carrier, invert, n);
 
     if (ledcontrol) LED_A_ON();
     SimulateTagLowFrequency(n, 0, ledcontrol);
@@ -1220,7 +1220,7 @@ void CmdNRZsimTAG(uint8_t invert, uint8_t separator, uint8_t clk, uint16_t size,
 
     WDT_HIT();
 
-    Dbprintf("NRZ simulating with FC/%d, invert %d, separator %d, n %d"
+    Dbprintf("NRZ simulating with rf/%d, invert %d, separator %d, n %d"
              , clk
              , invert
              , separator

From 72a837d813cb4aee486cdacfa941b7d9e7790fcc Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 2 Feb 2021 16:33:43 +0100
Subject: [PATCH 482/682] text, more cliparser, hid/awid sim can use keypress
 too

---
 client/src/cmdlf.c     | 509 ++++++++++++++++++-----------------------
 client/src/cmdlf.h     |   1 +
 client/src/cmdlfawid.c |  13 +-
 client/src/cmdlfhid.c  |  16 +-
 client/src/graph.c     |   1 -
 5 files changed, 236 insertions(+), 304 deletions(-)

diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index fcc868d91..45febccff 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -112,19 +112,6 @@ static int usage_lf_read(void) {
     PrintAndLogEx(NORMAL, "  use " _YELLOW_("'lf config'")" to set parameters.");
     return PM3_SUCCESS;
 }
-static int usage_lf_sim(void) {
-    PrintAndLogEx(NORMAL, "Simulate low frequency tag from graphbuffer.");
-    PrintAndLogEx(NORMAL, "Usage: lf sim [h] <gap>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h         This help");
-    PrintAndLogEx(NORMAL, "       <gap>     Start gap (in microseconds)");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("         lf sim 240") "     - start simulating with 240ms gap");
-    PrintAndLogEx(NORMAL, _YELLOW_("         lf sim"));
-    PrintAndLogEx(NORMAL, "Extras:");
-    PrintAndLogEx(NORMAL, "  use " _YELLOW_("'lf config'")" to set parameters.");
-    return PM3_SUCCESS;
-}
 static int usage_lf_sniff(void) {
     PrintAndLogEx(NORMAL, "Sniff low frequency signal.");
     PrintAndLogEx(NORMAL, "Usage: lf sniff [h] [q] [s #samples] [@]");
@@ -165,45 +152,32 @@ static int usage_lf_config(void) {
     PrintAndLogEx(NORMAL, _YELLOW_("      lf sniff") "               - performs a sniff (no active field)");
     return PM3_SUCCESS;
 }
-static int usage_lf_simfsk(void) {
-    PrintAndLogEx(NORMAL, "Usage: lf simfsk [h] [c <clock>] [H <fcHigh>] [L <fcLow>] [d <hexdata>]");
-    PrintAndLogEx(NORMAL, "there are about four FSK modulations to know of.");
-    PrintAndLogEx(NORMAL, "FSK1  -  where fc/8 = high  and fc/5 = low");
-    PrintAndLogEx(NORMAL, "FSK1a -  is inverted FSK1,  ie:   fc/5 = high and fc/8 = low");
-    PrintAndLogEx(NORMAL, "FSK2  -  where fc/10 = high  and fc/8 = low");
-    PrintAndLogEx(NORMAL, "FSK2a -  is inverted FSK2,  ie:   fc/10 = high and fc/8 = low");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h              This help");
-    PrintAndLogEx(NORMAL, "       c <clock>      Manually set clock - can autodetect if using DemodBuffer");
-    PrintAndLogEx(NORMAL, "       H <fcHigh>     Manually set the larger Field Clock");
-    PrintAndLogEx(NORMAL, "       L <fcLow>      Manually set the smaller Field Clock");
-    //PrintAndLogEx(NORMAL, "       s              TBD- -STT to enable a gap between playback repetitions - default: no gap");
-    PrintAndLogEx(NORMAL, "       d <hexdata>    Data to sim as hex - omit to sim from DemodBuffer");
-    PrintAndLogEx(NORMAL, "\n  NOTE: if you set one clock manually set them all manually");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL,  _YELLOW_("       lf simfsk c 40 H 8 L 5 d 010203") "      -  FSK1  rf/40  data 010203");
-    PrintAndLogEx(NORMAL,  _YELLOW_("       lf simfsk c 40 H 5 L 8 d 010203") "      -  FSK1a rf/40  data 010203");
-    PrintAndLogEx(NORMAL,  _YELLOW_("       lf simfsk c 64 H 10 L 8 d 010203") "     -  FSK2  rf/64  data 010203");
-    PrintAndLogEx(NORMAL,  _YELLOW_("       lf simfsk c 64 H 8 L 10 d 010203") "     -  FSK2a rf/64  data 010203");
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
-static int usage_lf_simask(void) {
-    PrintAndLogEx(NORMAL, "Usage: lf simask [c <clock>] [i] [b|m|r] [s] [d <raw hex to sim>]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h              This help");
-    PrintAndLogEx(NORMAL, "       c <clock>      Manually set clock - can autodetect if using DemodBuffer");
-    PrintAndLogEx(NORMAL, "       i              invert data");
-    PrintAndLogEx(NORMAL, "       b              sim ask/biphase");
-    PrintAndLogEx(NORMAL, "       m              sim ask/manchester - Default");
-    PrintAndLogEx(NORMAL, "       r              sim ask/raw");
-    PrintAndLogEx(NORMAL, "       s              add t55xx Sequence Terminator gap - default: no gaps (only manchester)");
-    PrintAndLogEx(NORMAL, "       d <hexdata>    Data to sim as hex - omit to sim from DemodBuffer");
-    return PM3_SUCCESS;
-}
 
+// Informative user function.
+// loop and wait for either keyboard press or pm3 button to exit
+// if key event, send break loop cmd to Pm3
+int lfsim_wait_check(uint32_t cmd) {
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " or pm3-button to abort simulation");
+
+    for (;;) {
+        if (kbd_enter_pressed()) {
+            SendCommandNG(CMD_BREAK_LOOP, NULL, 0);
+            PrintAndLogEx(DEBUG, "User aborted");
+            break;
+        }
+
+        PacketResponseNG resp;
+        if (WaitForResponseTimeout(cmd, &resp, 1000)) {
+            if (resp.status == PM3_EOPABORTED) {
+                PrintAndLogEx(DEBUG, "Button pressed, user aborted");
+                break;
+            }
+        }
+    }
+    PrintAndLogEx(INFO, "Done");
+    return PM3_SUCCESS;
+}
 
 static int CmdLFTune(const char *Cmd) {
 
@@ -834,8 +808,27 @@ static void ChkBitstream(void) {
 //Attempt to simulate any wave in buffer (one bit per output sample)
 // converts GraphBuffer to bitstream (based on zero crossings) if needed.
 int CmdLFSim(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf sim",
+                  "Simulate low frequency tag from graphbuffer\n"
+                  "Use " _YELLOW_("`lf config`") _CYAN_(" to set parameters"),
+                  "lf sim\n"
+                  "lf sim --gap 240 --> start simulating with 240ms gap"
+                 );
 
-    if (!session.pm3_present) return PM3_ENOTTY;
+    void *argtable[] = {
+        arg_param_begin,
+        arg_u64_0("g", "gap", "<ms>", "start gap in microseconds"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    uint16_t gap = arg_get_u32_def(ctx, 1, 0);
+    CLIParserFree(ctx); 
+
+    if (session.pm3_present == false) {
+        PrintAndLogEx(DEBUG, "DEBUG: no proxmark present");
+        return PM3_ENOTTY;
+    }
 
     // sanity check
     if (GraphTraceLen < 20) {
@@ -843,11 +836,6 @@ int CmdLFSim(const char *Cmd) {
         return PM3_ENODATA;
     }
 
-    uint8_t cmdp = tolower(param_getchar(Cmd, 0));
-    if (cmdp == 'h') return usage_lf_sim();
-
-    uint16_t gap = param_get32ex(Cmd, 0, 0, 10) & 0xFFFF;
-
     // convert to bitstream if necessary
     ChkBitstream();
 
@@ -870,6 +858,7 @@ int CmdLFSim(const char *Cmd) {
     PacketResponseNG resp;
 
     //can send only 512 bits at a time (1 byte sent per bit...)
+    PrintAndLogEx(INFO, "." NOLF);
     for (uint16_t i = 0; i < GraphTraceLen; i += PM3_CMD_DATA_SIZE - 3) {
 
         size_t len = MIN((GraphTraceLen - i), PM3_CMD_DATA_SIZE - 3);
@@ -882,7 +871,7 @@ int CmdLFSim(const char *Cmd) {
         SendCommandNG(CMD_LF_UPLOAD_SIM_SAMPLES, (uint8_t *)&payload_up, sizeof(struct pupload));
         WaitForResponse(CMD_LF_UPLOAD_SIM_SAMPLES, &resp);
         if (resp.status != PM3_SUCCESS) {
-            PrintAndLogEx(INFO, "Bigbuf is full.");
+            PrintAndLogEx(INFO, "Bigbuf is full");
             break;
         }
         PrintAndLogEx(NORMAL, "." NOLF);
@@ -900,113 +889,111 @@ int CmdLFSim(const char *Cmd) {
     payload.gap = gap;
 
     clearCommandBuffer();
-    SendCommandNG(CMD_LF_SIMULATE, (uint8_t *)&payload, sizeof(payload));
-
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " or pm3-button to exit");
-
-    for (;;) {
-        if (kbd_enter_pressed()) {
-            SendCommandNG(CMD_BREAK_LOOP, NULL, 0);
-            PrintAndLogEx(DEBUG, "User aborted");
-            break;
-        }
-
-        if (WaitForResponseTimeout(CMD_LF_SIMULATE, &resp, 1000)) {
-            if (resp.status == PM3_EOPABORTED) {
-                PrintAndLogEx(DEBUG, "Button pressed, user aborted");
-                break;
-            }
-        }
-    }
-    PrintAndLogEx(INFO, "Done");
-    return PM3_SUCCESS;
+    SendCommandNG(CMD_LF_SIMULATE, (uint8_t *)&payload, sizeof(payload));   
+    return lfsim_wait_check(CMD_LF_SIMULATE);
 }
 
 // sim fsk data given clock, fcHigh, fcLow, invert
 // - allow pull data from DemodBuffer
 int CmdLFfskSim(const char *Cmd) {
-    //might be able to autodetect FCs and clock from Graphbuffer if using demod buffer
-    // otherwise will need FChigh, FClow, Clock, and bitstream
-    uint8_t fcHigh = 0, fcLow = 0, clk = 0;
-    bool errors = false, separator = false;
-    char hexData[64] = {0x00}; // store entered hex data
-    uint8_t data[255] = {0x00};
-    int dataLen = 0;
-    uint8_t cmdp = 0;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf simfsk",
+                  "Simulate FSK tag from demodbuffer or input. There are about four FSK modulations to know of.\n"
+                  "FSK1  -  where fc/8 = high  and fc/5 = low\n"
+                  "FSK1a -  is inverted FSK1,  ie:   fc/5 = high and fc/8 = low\n"
+                  "FSK2  -  where fc/10 = high  and fc/8 = low\n"
+                  "FSK2a -  is inverted FSK2,  ie:   fc/10 = high and fc/8 = low\n\n"
+                  "NOTE: if you set one clock manually set them all manually",
+                  "lf simfsk -c 40 --high 8 --low 5 -d 010203  --> FSK1  rf/40  data 010203\n"
+                  "lf simfsk -c 40 --high 5 --low 8 -d 010203  --> FSK1a rf/40  data 010203\n"
+                  "lf simfsk -c 64 --high 10 --low 8 -d 010203 --> FSK2  rf/64  data 010203\n"
+                  "lf simfsk -c 64 --high 8 --low 10 -d 010203 --> FSK2a rf/64  data 010203\n\n"
+                  "lf simfsk -c 50 --high 10 --low 8 -d 1D5559555569A9A555A59569        --> simulate HID Prox tag manually\n"
+                  "lf simfsk -c 50 --high 10 --low 8 --stt -d 011DB2487E8D811111111111  --> simulate AWID tag manually"
+                 );
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (param_getchar(Cmd, cmdp)) {
-            case 'h':
-                return usage_lf_simfsk();
-            case 'c':
-                errors |= param_getdec(Cmd, cmdp + 1, &clk);
-                cmdp += 2;
-                break;
-            case 'H':
-                errors |= param_getdec(Cmd, cmdp + 1, &fcHigh);
-                cmdp += 2;
-                break;
-            case 'L':
-                errors |= param_getdec(Cmd, cmdp + 1, &fcLow);
-                cmdp += 2;
-                break;
-            case 's':
-                separator = true;
-                cmdp++;
-                break;
-            case 'd':
-                dataLen = param_getstr(Cmd, cmdp + 1, hexData, sizeof(hexData));
-                if (dataLen == 0)
-                    errors = true;
-                else
-                    dataLen = hextobinarray((char *)data, hexData);
+    void *argtable[] = {
+        arg_param_begin,
+        arg_u64_0("c", "clk", "<dec>", "manually set clock - can autodetect if using DemodBuffer (default 64)"),
+        arg_u64_0(NULL, "low", "<dec>", "manually set larger Field Clock"),
+        arg_u64_0(NULL, "high", "<dec>", "manually set smaller Field Clock"),        
+        arg_lit0(NULL, "stt", "TBD! - STT to enable a gap between playback repetitions (default: no gap)"),
+        arg_str0("d", "data", "<hex>", "data to sim - omit to use DemodBuffer"),
+        arg_lit0("v", "verbose", "verbose output"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    uint8_t clk = arg_get_u32_def(ctx, 1, 0);
+    uint8_t fclow = arg_get_u32_def(ctx, 2, 0);
+    uint8_t fchigh = arg_get_u32_def(ctx, 3, 0);
+    bool separator = arg_get_lit(ctx, 4);
 
-                if (dataLen == 0) errors = true;
-                if (errors) PrintAndLogEx(ERR, "Error getting hex data");
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
+    int raw_len = 64;
+    char raw[64] = {0};
+    CLIGetStrWithReturn(ctx, 5, (uint8_t*)raw, &raw_len);
+    bool verbose = arg_get_lit(ctx, 6);
+    CLIParserFree(ctx); 
 
     // No args
-    if (cmdp == 0 && DemodBufferLen == 0) return usage_lf_simfsk();
+    if (raw_len == 0 && DemodBufferLen == 0) {
+        PrintAndLogEx(ERR, "No user supplied data nor inside Demodbuffer");
+        return PM3_EINVARG;
+    }
 
-    //Validations
-    if (errors) return usage_lf_simfsk();
+    if (verbose && separator) {
+        PrintAndLogEx(INFO, "STT gap isn't implemented yet. Skipping...");
+        separator = 0;
+    }
 
-    int firstClockEdge = 0;
-    if (dataLen == 0) { //using DemodBuffer
-        if (clk == 0 || fcHigh == 0 || fcLow == 0) { //manual settings must set them all
-            uint8_t ans = fskClocks(&fcHigh, &fcLow, &clk, &firstClockEdge);
-            if (ans == 0) {
-                if (!fcHigh) fcHigh = 10;
-                if (!fcLow) fcLow = 8;
-                if (!clk) clk = 50;
+    uint8_t bs[256] = {0x00};
+    int bs_len = hextobinarray((char *)bs, raw);
+    if (bs_len == 0) {
+        // Using data from DemodBuffer
+        // might be able to autodetect FC and clock from Graphbuffer if using demod buffer
+        // will need clock, fchigh, fclow and bitstream
+        PrintAndLogEx(INFO, "No user supplied data, using Demodbuffer...");
+
+        if (clk == 0 || fchigh == 0 || fclow == 0) {
+            int firstClockEdge = 0;
+            bool res = fskClocks(&fchigh, &fclow, &clk, &firstClockEdge);
+            if (res == false) {
+                clk = 0;
+                fchigh = 0;
+                fclow = 0;
             }
         }
+        PrintAndLogEx(DEBUG, "Detected rf/%u, High fc/%u, Low fc/%u, n %zu ", clk, fchigh, fclow, DemodBufferLen);
+
     } else {
-        setDemodBuff(data, dataLen, 0);
+        setDemodBuff(bs, bs_len, 0);
     }
 
     //default if not found
-    if (clk == 0) clk = 50;
-    if (fcHigh == 0) fcHigh = 10;
-    if (fcLow == 0) fcLow = 8;
+    if (clk == 0) {
+        clk = 50;
+        PrintAndLogEx(DEBUG, "Autodetection of clock failed, falling back to rf/%u", clk);
+    }
+
+    if (fchigh == 0) {
+        fchigh = 10;
+        PrintAndLogEx(DEBUG, "Autodetection of larger clock failed, falling back to fc/%u", fchigh);
+    }
+
+    if (fclow == 0) {
+        fclow = 8;
+        PrintAndLogEx(DEBUG, "Autodetection of smaller clock failed, falling back to fc/%u", fclow);
+    }
 
     size_t size = DemodBufferLen;
     if (size > (PM3_CMD_DATA_SIZE - sizeof(lf_fsksim_t))) {
         PrintAndLogEx(WARNING, "DemodBuffer too long for current implementation - length: %zu - max: %zu", size, PM3_CMD_DATA_SIZE - sizeof(lf_fsksim_t));
+        PrintAndLogEx(INFO, "Continuing with trimmed down data");
         size = PM3_CMD_DATA_SIZE - sizeof(lf_fsksim_t);
     }
 
     lf_fsksim_t *payload = calloc(1, sizeof(lf_fsksim_t) + size);
-    payload->fchigh = fcHigh;
-    payload->fclow =  fcLow;
+    payload->fchigh = fchigh;
+    payload->fclow =  fclow;
     payload->separator = separator;
     payload->clock = clk;
     memcpy(payload->data, DemodBuffer, size);
@@ -1014,112 +1001,110 @@ int CmdLFfskSim(const char *Cmd) {
     clearCommandBuffer();
     SendCommandNG(CMD_LF_FSK_SIMULATE, (uint8_t *)payload,  sizeof(lf_fsksim_t) + size);
     free(payload);
-
     setClockGrid(clk, 0);
 
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " or pm3-button to exit");
-
-    for (;;) {
-        if (kbd_enter_pressed()) {
-            SendCommandNG(CMD_BREAK_LOOP, NULL, 0);
-            PrintAndLogEx(DEBUG, "User aborted");
-            break;
-        }
-
-        PacketResponseNG resp;
-        if (WaitForResponseTimeout(CMD_LF_FSK_SIMULATE, &resp, 1000)) {
-            if (resp.status == PM3_EOPABORTED) {
-                PrintAndLogEx(DEBUG, "Button pressed, user aborted");
-                break;
-            }
-        }
-    }
-    PrintAndLogEx(INFO, "Done");
-    return PM3_SUCCESS;
+    return lfsim_wait_check(CMD_LF_FSK_SIMULATE);
 }
 
 // sim ask data given clock, invert, manchester or raw, separator
 // - allow pull data from DemodBuffer
 int CmdLFaskSim(const char *Cmd) {
-    // autodetect clock from Graphbuffer if using demod buffer
-    // needs clock, invert, manchester/raw as m or r, separator as s, and bitstream
-    uint8_t encoding = 1, separator = 0, clk = 0, invert = 0;
-    bool errors = false;
-    char hexData[64] = {0x00};
-    uint8_t data[255] = {0x00}; // store entered hex data
-    int dataLen = 0;
-    uint8_t cmdp = 0;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf simask",
+                  "Simulate ASK tag from demodbuffer or input",
+                  "lf simask --clk 32 --am -d 0102030405   --> simulate ASK/MAN rf/32\n"
+                  "lf simask --clk 32 --bi -d 0102030405   --> simulate ASK/BIPHASE rf/32\n\n"
+                  "lf simask --clk 64 --am -d ffbd8001686f1924               --> simulate a EM410x tag\n"
+                  "lf simask --clk 64 --am --stt -d 5649533200003F340000001B --> simulate a VISA2K tag"
+                 );
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_lf_simask();
-            case 'i':
-                invert = 1;
-                cmdp++;
-                break;
-            case 'c':
-                errors |= param_getdec(Cmd, cmdp + 1, &clk);
-                cmdp += 2;
-                break;
-            case 'b':
-                encoding = 2; //biphase
-                cmdp++;
-                break;
-            case 'm':
-                encoding = 1; //manchester
-                cmdp++;
-                break;
-            case 'r':
-                encoding = 0; //raw
-                cmdp++;
-                break;
-            case 's':
-                separator = 1;
-                cmdp++;
-                break;
-            case 'd':
-                dataLen = param_getstr(Cmd, cmdp + 1, hexData, sizeof(hexData));
-                if (dataLen == 0)
-                    errors = true;
-                else
-                    dataLen = hextobinarray((char *)data, hexData);
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0("i", "inv", "invert data"),
+        arg_u64_0("c", "clk", "<dec>", "manually set clock - can autodetect if using DemodBuffer (default 64)"),
+        arg_lit0(NULL, "bi", "ask/biphase encoding"),
+        arg_lit0(NULL, "am", "ask/manchester encoding (default)"),
+        arg_lit0(NULL, "ar", "ask/raw encoding"),
+        arg_lit0(NULL, "stt", "add t55xx Sequence Terminator gap - default: no gaps (only manchester)"),
+        arg_str0("d", "data", "<hex>", "data to sim - omit to use DemodBuffer"),
+        arg_lit0("v", "verbose", "verbose output"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool invert = arg_get_lit(ctx, 1);
+    uint8_t clk = arg_get_u32_def(ctx, 2, 0);
+    bool use_bi = arg_get_lit(ctx, 3);
+    bool use_am = arg_get_lit(ctx, 4);
+    bool use_ar = arg_get_lit(ctx, 5);
+    bool separator = arg_get_lit(ctx, 6);
 
-                if (dataLen == 0) errors = true;
-                if (errors) PrintAndLogEx(ERR, "Error getting hex data, datalen: %d", dataLen);
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
+    int raw_len = 64;
+    char raw[64] = {0};
+    CLIGetStrWithReturn(ctx, 7, (uint8_t*)raw, &raw_len);
+    bool verbose = arg_get_lit(ctx, 8);
+    CLIParserFree(ctx); 
+
+    if ((use_bi + use_am + use_ar) > 1) {
+        PrintAndLogEx(ERR, "only one encoding can be set");
+        return PM3_EINVARG;
     }
 
+    uint8_t encoding = 1;
+    if (use_bi)
+        encoding = 2;
+    else if (use_ar)
+        encoding = 0;
+
     // No args
-    if (cmdp == 0 && DemodBufferLen == 0) return usage_lf_simask();
-
-    //Validations
-    if (errors) return usage_lf_simask();
-
-    if (dataLen == 0) { //using DemodBuffer
-        if (clk == 0)
-            clk = GetAskClock("0", false);
-    } else {
-        setDemodBuff(data, dataLen, 0);
+    if (raw_len == 0 && DemodBufferLen == 0) {
+        PrintAndLogEx(ERR, "No user supplied data nor any inside Demodbuffer");
+        return PM3_EINVARG;
+    }
+
+    uint8_t bs[256] = {0x00};
+    int bs_len = hextobinarray((char *)bs, raw);
+    if (bs_len == 0) { 
+        // Using data from DemodBuffer
+        // might be able to autodetect FC and clock from Graphbuffer if using demod buffer
+        // will need carrier, clock, and bitstream
+        PrintAndLogEx(INFO, "No user supplied data, using Demodbuffer...");
+
+        int res = 0;
+        if (clk == 0) {
+            res = GetAskClock("0", verbose);
+            if (res < 1) {
+                clk = 64;
+            } else {
+                clk = (uint8_t)res;
+            }
+        }
+
+        PrintAndLogEx(DEBUG, "Detected rf/%u, n %zu ", clk, DemodBufferLen);
+
+    } else {
+        setDemodBuff(bs, bs_len, 0);
+    }
+
+
+    if (clk == 0) {
+        clk = 32;
+        PrintAndLogEx(DEBUG, "Autodetection of clock failed, falling back to rf/%u", clk);
+    }
+
+    if (encoding == 0) {
+        clk /= 2; // askraw needs to double the clock speed
+        PrintAndLogEx(DEBUG, "ASK/RAW needs half rf. Using rf/%u", clk);
     }
-    if (clk == 0) clk = 64;
-    if (encoding == 0) clk /= 2; //askraw needs to double the clock speed
 
     size_t size = DemodBufferLen;
     if (size > (PM3_CMD_DATA_SIZE - sizeof(lf_asksim_t))) {
         PrintAndLogEx(WARNING, "DemodBuffer too long for current implementation - length: %zu - max: %zu", size, PM3_CMD_DATA_SIZE - sizeof(lf_asksim_t));
+        PrintAndLogEx(INFO, "Continuing with trimmed down data");
         size = PM3_CMD_DATA_SIZE - sizeof(lf_asksim_t);
     }
 
     lf_asksim_t *payload = calloc(1, sizeof(lf_asksim_t) + size);
-    payload->encoding =  encoding;
+    payload->encoding = encoding;
     payload->invert = invert;
     payload->separator = separator;
     payload->clock = clk;
@@ -1128,27 +1113,9 @@ int CmdLFaskSim(const char *Cmd) {
     clearCommandBuffer();
     SendCommandNG(CMD_LF_ASK_SIMULATE, (uint8_t *)payload,  sizeof(lf_asksim_t) + size);
     free(payload);
+    setClockGrid(clk, 0);
 
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " or pm3-button to exit");
-
-    for (;;) {
-        if (kbd_enter_pressed()) {
-            SendCommandNG(CMD_BREAK_LOOP, NULL, 0);
-            PrintAndLogEx(DEBUG, "User aborted");
-            break;
-        }
-
-        PacketResponseNG resp;
-        if (WaitForResponseTimeout(CMD_LF_ASK_SIMULATE, &resp, 1000)) {
-            if (resp.status == PM3_EOPABORTED) {
-                PrintAndLogEx(DEBUG, "Button pressed, user aborted");
-                break;
-            }
-        }
-    }
-    PrintAndLogEx(INFO, "Done");
-    return PM3_SUCCESS;
+    return lfsim_wait_check(CMD_LF_ASK_SIMULATE);
 }
 
 // sim psk data given carrier, clock, invert
@@ -1157,8 +1124,9 @@ int CmdLFpskSim(const char *Cmd) {
  
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "lf simpsk",
-                  "Simulate LF PSK tag from demodbuffer or input",
-                  "lf simpsk -1 --clk 32 --rc 2 -d a0000000bd989a11   --> simulate a indala tag manually\n"
+                  "Simulate PSK tag from demodbuffer or input",
+                  "lf simpsk -1 --clk 40 --fc 4 -d 01020304   --> simulate PSK1 rf/40 psksub fc/4, data 01020304\n\n"
+                  "lf simpsk -1 --clk 32 --fc 2 -d a0000000bd989a11   --> simulate a indala tag manually"
                  );
 
     void *argtable[] = {
@@ -1168,7 +1136,7 @@ int CmdLFpskSim(const char *Cmd) {
         arg_lit0("3", "psk3", "set PSK3"),        
         arg_lit0("i", "inv", "invert data"),
         arg_u64_0("c", "clk", "<dec>", "manually set clock - can autodetect if using DemodBuffer (default 32)"),
-        arg_u64_0(NULL, "rc", "<dec>", "2|4|8 are valid carriers (default 2)"),
+        arg_u64_0(NULL, "fc", "<dec>", "2|4|8 are valid carriers (default 2)"),
         arg_str0("d", "data", "<hex>", "data to sim - omit to use DemodBuffer"),
         arg_lit0("v", "verbose", "verbose output"),
         arg_param_end
@@ -1202,15 +1170,12 @@ int CmdLFpskSim(const char *Cmd) {
     if (use_psk3)
         psk_type = 3;
 
-    // to detect if raw_hex was supplied  or of 
-
     // No args
     if (raw_len == 0 && DemodBufferLen == 0) {
-        PrintAndLogEx(ERR, "No user supplied nor any data to found inside Demodbuffer");
+        PrintAndLogEx(ERR, "No user supplied data nor any inside Demodbuffer");
         return PM3_EINVARG;
     }
 
-
     uint8_t bs[256] = {0x00};
     int bs_len = hextobinarray((char *)bs, raw);
 
@@ -1239,15 +1204,15 @@ int CmdLFpskSim(const char *Cmd) {
              }
         }
 
-        PrintAndLogEx(DEBUG, "Detected FC/%u, RC/%u, n %zu ", clk, carrier, DemodBufferLen);
+        PrintAndLogEx(DEBUG, "Detected rf/%u, fc/%u, n %zu ", clk, carrier, DemodBufferLen);
 
     } else {
         setDemodBuff(bs, bs_len, 0);
     }
 
     if (clk == 0) {
-        PrintAndLogEx(DEBUG, "Autodetection of clock failed, falling back to FC/32");
         clk = 32;
+        PrintAndLogEx(DEBUG, "Autodetection of clock failed, falling back to rf/%u", clk);
     }
 
     if (psk_type == 2) {
@@ -1273,27 +1238,9 @@ int CmdLFpskSim(const char *Cmd) {
     clearCommandBuffer();
     SendCommandNG(CMD_LF_PSK_SIMULATE, (uint8_t *)payload,  sizeof(lf_psksim_t) + size);
     free(payload);
+    setClockGrid(clk, 0);
 
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " or pm3-button to exit");
-
-    for (;;) {
-        if (kbd_enter_pressed()) {
-            SendCommandNG(CMD_BREAK_LOOP, NULL, 0);
-            PrintAndLogEx(DEBUG, "User aborted");
-            break;
-        }
-
-        PacketResponseNG resp;
-        if (WaitForResponseTimeout(CMD_LF_PSK_SIMULATE, &resp, 1000)) {
-            if (resp.status == PM3_EOPABORTED) {
-                PrintAndLogEx(DEBUG, "Button pressed, user aborted");
-                break;
-            }
-        }
-    }
-    PrintAndLogEx(INFO, "Done");
-    return PM3_SUCCESS;
+    return lfsim_wait_check(CMD_LF_PSK_SIMULATE);
 }
 
 int CmdLFSimBidir(const char *Cmd) {
@@ -1612,6 +1559,7 @@ out:
 }
 
 static command_t CommandTable[] = {
+    {"help",        CmdHelp,            AlwaysAvailable, "This help"},
     {"-----------", CmdHelp,            AlwaysAvailable, "-------------- " _CYAN_("Low Frequency") " --------------"},
     {"awid",        CmdLFAWID,          AlwaysAvailable, "{ AWID RFIDs...              }"},
     {"cotag",       CmdLFCOTAG,         AlwaysAvailable, "{ COTAG CHIPs...             }"},
@@ -1642,20 +1590,19 @@ static command_t CommandTable[] = {
     {"viking",      CmdLFViking,        AlwaysAvailable, "{ Viking RFIDs...            }"},
     {"visa2000",    CmdLFVisa2k,        AlwaysAvailable, "{ Visa2000 RFIDs...          }"},
     {"-----------", CmdHelp,            AlwaysAvailable, "--------------------- " _CYAN_("General") " ---------------------"},
-    {"help",        CmdHelp,            AlwaysAvailable, "This help"},
     {"config",      CmdLFConfig,        IfPm3Lf,         "Get/Set config for LF sampling, bit/sample, decimation, frequency"},
     {"cmdread",     CmdLFCommandRead,   IfPm3Lf,         "Modulate LF reader field to send command before read (all periods in microseconds)"},
     {"read",        CmdLFRead,          IfPm3Lf,         "Read LF tag"},
     {"search",      CmdLFfind,          AlwaysAvailable, "Read and Search for valid known tag"},
-    {"sim",         CmdLFSim,           IfPm3Lf,         "Simulate LF tag from buffer with optional GAP (in microseconds)"},
-    {"simask",      CmdLFaskSim,        IfPm3Lf,         "Simulate " _YELLOW_("LF ASK tag") " from demodbuffer or input"},
-    {"simfsk",      CmdLFfskSim,        IfPm3Lf,         "Simulate " _YELLOW_("LF FSK tag") " from demodbuffer or input"},
-    {"simpsk",      CmdLFpskSim,        IfPm3Lf,         "Simulate " _YELLOW_("LF PSK tag") " from demodbuffer or input"},
-//    {"simnrz",      CmdLFnrzSim,        IfPm3Lf,         "Simulate " _YELLOW_("LF NRZ tag") " from demodbuffer or input"},
+    {"sim",         CmdLFSim,           IfPm3Lf,         "Simulate LF tag from buffer"},
+    {"simask",      CmdLFaskSim,        IfPm3Lf,         "Simulate " _YELLOW_("ASK") " tag"},
+    {"simfsk",      CmdLFfskSim,        IfPm3Lf,         "Simulate " _YELLOW_("FSK") " tag"},
+    {"simpsk",      CmdLFpskSim,        IfPm3Lf,         "Simulate " _YELLOW_("PSK") " tag"},
+//    {"simnrz",      CmdLFnrzSim,        IfPm3Lf,         "Simulate " _YELLOW_("NRZ") " tag"},
     {"simbidir",    CmdLFSimBidir,      IfPm3Lf,         "Simulate LF tag (with bidirectional data transmission between reader and tag)"},
     {"sniff",       CmdLFSniff,         IfPm3Lf,         "Sniff LF traffic between reader and tag"},
     {"tune",        CmdLFTune,          IfPm3Lf,         "Continuously measure LF antenna tuning"},
-//    {"vchdemod",    CmdVchDemod,        AlwaysAvailable, "['clone'] -- Demodulate samples for VeriChip"},
+//    {"vchdemod",    CmdVchDemod,        AlwaysAvailable, "Demodulate samples for VeriChip"},
 //    {"flexdemod",   CmdFlexdemod,       AlwaysAvailable, "Demodulate samples for Motorola FlexPass"},
     {NULL, NULL, NULL, NULL}
 };
diff --git a/client/src/cmdlf.h b/client/src/cmdlf.h
index bcc695764..645d00627 100644
--- a/client/src/cmdlf.h
+++ b/client/src/cmdlf.h
@@ -37,4 +37,5 @@ int lf_sniff(bool verbose, uint32_t samples);
 int lf_config(sample_config *config);
 int lf_getconfig(sample_config *config);
 
+int lfsim_wait_check(uint32_t cmd);
 #endif
diff --git a/client/src/cmdlfawid.c b/client/src/cmdlfawid.c
index c54c3cd1d..300f09430 100644
--- a/client/src/cmdlfawid.c
+++ b/client/src/cmdlfawid.c
@@ -438,8 +438,7 @@ static int CmdAWIDSim(const char *Cmd) {
         return PM3_ESOFT;
     }
 
-    PrintAndLogEx(SUCCESS, "Simulating AWID %u -- FC: " _YELLOW_("%u") " CN: " _YELLOW_("%u"), fmtlen, fc, cn);
-    PrintAndLogEx(SUCCESS, "Press pm3-button to abort simulation or run another command");
+    PrintAndLogEx(SUCCESS, "Simulating "_YELLOW_("AWID %u") " -- FC: " _YELLOW_("%u") " CN: " _YELLOW_("%u"), fmtlen, fc, cn);
 
     // AWID uses: FSK2a fcHigh: 10, fcLow: 8, clk: 50, invert: 1
     // arg1 --- fcHigh<<8 + fcLow
@@ -456,13 +455,7 @@ static int CmdAWIDSim(const char *Cmd) {
     SendCommandNG(CMD_LF_FSK_SIMULATE, (uint8_t *)payload,  sizeof(lf_fsksim_t) + sizeof(bs));
     free(payload);
 
-    PacketResponseNG resp;
-    WaitForResponse(CMD_LF_FSK_SIMULATE, &resp);
-
-    PrintAndLogEx(INFO, "Done");
-    if (resp.status != PM3_EOPABORTED)
-        return resp.status;
-    return PM3_SUCCESS;
+    return lfsim_wait_check(CMD_LF_FSK_SIMULATE);
 }
 
 static int CmdAWIDBrute(const char *Cmd) {
@@ -630,7 +623,7 @@ int getAWIDBits(uint8_t fmtlen, uint32_t fc, uint32_t cn, uint8_t *bits) {
     if (bitLen != 88)
         return PM3_ESOFT;
 
-    PrintAndLogEx(SUCCESS, "awid raw bits:\n %s \n", sprint_bin(bits, bitLen));
+    PrintAndLogEx(DEBUG, "awid raw bits:\n %s \n", sprint_bin(bits, bitLen));
 
     return PM3_SUCCESS;
 }
diff --git a/client/src/cmdlfhid.c b/client/src/cmdlfhid.c
index 46a8febbe..76dd36177 100644
--- a/client/src/cmdlfhid.c
+++ b/client/src/cmdlfhid.c
@@ -25,12 +25,12 @@
 #include <inttypes.h>
 #include "cmdparser.h"    // command_t
 #include "comms.h"
-#include "commonutil.h"  // ARRAYLEN
+#include "commonutil.h"   // ARRAYLEN
 #include "cliparser.h"
 #include "ui.h"
 #include "graph.h"
-#include "cmddata.h"  //for g_debugMode, demodbuff cmds
-#include "cmdlf.h"    // lf_read
+#include "cmddata.h"      // g_debugMode, demodbuff cmds
+#include "cmdlf.h"        // lf_read, lfsim_wait_check
 #include "util_posix.h"
 #include "lfdemod.h"
 #include "wiegand_formats.h"
@@ -300,8 +300,6 @@ static int CmdHIDSim(const char *Cmd) {
         PrintAndLogEx(INFO, "Simulating HID tag using raw " _GREEN_("%s"),  raw);
     }
 
-    PrintAndLogEx(INFO, "Press pm3-button to abort simulation");
-
     lf_hidsim_t payload;
     payload.hi2 = packed.Top;
     payload.hi = packed.Mid;
@@ -310,13 +308,7 @@ static int CmdHIDSim(const char *Cmd) {
 
     clearCommandBuffer();
     SendCommandNG(CMD_LF_HID_SIMULATE, (uint8_t *)&payload,  sizeof(payload));
-    PacketResponseNG resp;
-    WaitForResponse(CMD_LF_HID_SIMULATE, &resp);
-    PrintAndLogEx(INFO, "Done");
-    if (resp.status != PM3_EOPABORTED)
-        return resp.status;
-
-    return PM3_SUCCESS;
+    return lfsim_wait_check(CMD_LF_HID_SIMULATE);
 }
 
 static int CmdHIDClone(const char *Cmd) {
diff --git a/client/src/graph.c b/client/src/graph.c
index 5c3221716..5a9fb3b33 100644
--- a/client/src/graph.c
+++ b/client/src/graph.c
@@ -352,7 +352,6 @@ bool fskClocks(uint8_t *fc1, uint8_t *fc2, uint8_t *rf1, int *firstClockEdge) {
 
     if (*rf1 == 0) {
         PrintAndLogEx(DEBUG, "DEBUG: Clock detect error");
-
         return false;
     }
     return true;

From ea7d4ae49631c1ebdc326cc5b07aece318668fb6 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 2 Feb 2021 16:34:45 +0100
Subject: [PATCH 483/682] lf em 410x reader - new param "-b" to break after
 once,  use together with continouse mode.\n  lf em 410x spoof - works again

---
 client/src/cmdlfem410x.c | 69 +++++++++++++++++++++-------------------
 1 file changed, 36 insertions(+), 33 deletions(-)

diff --git a/client/src/cmdlfem410x.c b/client/src/cmdlfem410x.c
index c2ee95a9d..c836bcd01 100644
--- a/client/src/cmdlfem410x.c
+++ b/client/src/cmdlfem410x.c
@@ -320,11 +320,11 @@ static int CmdEM410xDemod(const char *Cmd) {
 
     void *argtable[] = {
         arg_param_begin,
-        arg_u64_0(NULL, "clk", "<dec>", "optional - clock (default autodetect)"),
-        arg_u64_0(NULL, "err", "<dec>", "optional - maximum allowed errors (default 100)"),
-        arg_u64_0(NULL, "len", "<dec>", "optional - maximum length"),
-        arg_lit0("i", "invert", "optional - invert output"),
-        arg_lit0("a", "amp", "optional - amplify signal"),
+        arg_u64_0(NULL, "clk", "<dec>", "clock (default autodetect)"),
+        arg_u64_0(NULL, "err", "<dec>", "maximum allowed errors (default 100)"),
+        arg_u64_0(NULL, "len", "<dec>", "maximum length"),
+        arg_lit0("i", "invert", "invert output"),
+        arg_lit0("a", "amp", "amplify signal"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
@@ -359,12 +359,13 @@ static int CmdEM410xReader(const char *Cmd) {
 
     void *argtable[] = {
         arg_param_begin,
-        arg_u64_0(NULL, "clk", "<dec>", "optional - clock (default autodetect)"),
-        arg_u64_0(NULL, "err", "<dec>", "optional - maximum allowed errors (default 100)"),
-        arg_u64_0(NULL, "len", "<dec>", "optional - maximum length"),
-        arg_lit0("i", "invert", "optional - invert output"),
-        arg_lit0("a", "amp", "optional - amplify signal"),
-        arg_lit0("@", NULL, "optional - continuous reader mode"),
+        arg_u64_0(NULL, "clk", "<dec>", "clock (default autodetect)"),
+        arg_u64_0(NULL, "err", "<dec>", "maximum allowed errors (default 100)"),
+        arg_u64_0(NULL, "len", "<dec>", "maximum length"),
+        arg_lit0("i", "invert", "invert output"),
+        arg_lit0("a", "amp", "amplify signal"),
+        arg_lit0("b", NULL, "break on first found"),
+        arg_lit0("@", NULL, "continuous reader mode"),
         arg_lit0("v", "verbose", "verbose output"),
         arg_param_end
     };
@@ -375,8 +376,9 @@ static int CmdEM410xReader(const char *Cmd) {
     size_t max_len = arg_get_u32_def(ctx, 3, 0);
     bool invert = arg_get_lit(ctx, 4);
     bool amplify = arg_get_lit(ctx, 5);
-    bool cm = arg_get_lit(ctx, 6);
-    bool verbose = arg_get_lit(ctx, 7);
+    bool break_first = arg_get_lit(ctx, 6);
+    bool cm = arg_get_lit(ctx, 7);
+    bool verbose = arg_get_lit(ctx, 8);
     CLIParserFree(ctx);
 
     if (cm) {
@@ -388,6 +390,10 @@ static int CmdEM410xReader(const char *Cmd) {
         uint64_t lo = 0;
         lf_read(false, 12288);
         AskEm410xDemod(clk, invert, max_err, max_len, amplify, &hi, &lo, verbose);
+
+        if (break_first && g_em410xid != 0) {
+            break;
+        }
     } while (cm && !kbd_enter_pressed());
 
     return PM3_SUCCESS;
@@ -406,8 +412,8 @@ static int CmdEM410xSim(const char *Cmd) {
 
     void *argtable[] = {
         arg_param_begin,
-        arg_u64_0(NULL, "clk", "<dec>", "optional - clock [32|64] (default 64)"),
-        arg_str1("i", "id", "<hex>", "ID number (5 hex bytes)"),
+        arg_u64_0(NULL, "clk", "<dec>", "<32|64> clock (default 64)"),
+        arg_str1(NULL, "id", "<hex>", "ID number (5 hex bytes)"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);
@@ -425,11 +431,8 @@ static int CmdEM410xSim(const char *Cmd) {
     }
 
     PrintAndLogEx(SUCCESS, "Starting simulating UID "_YELLOW_("%s")" clock: "_YELLOW_("%d"), sprint_hex_inrow(uid, sizeof(uid)), clk);
-    PrintAndLogEx(SUCCESS, "Press pm3-button to abort simulation");
-
     em410x_construct_emul_graph(uid, clk);
-
-    CmdLFSim("0"); // 240 start_gap.
+    CmdLFSim("");
     return PM3_SUCCESS;
 }
 
@@ -445,8 +448,8 @@ static int CmdEM410xBrute(const char *Cmd) {
 
     void *argtable[] = {
         arg_param_begin,
-        arg_u64_1(NULL, "clk", "<dec>", "optional - clock [32|64] (default 64)"),
-        arg_u64_1(NULL, "delay", "<dec>", "optional - pause delay in milliseconds between UIDs simulation (default 1000ms)"),
+        arg_u64_0(NULL, "clk", "<dec>", "<32|64> clock (default 64)"),
+        arg_u64_0(NULL, "delay", "<dec>", "pause delay in milliseconds between UIDs simulation (default 1000ms)"),
         arg_str1("f", "file", "<hex>", "file with UIDs in HEX format, one per line"),
         arg_param_end
     };
@@ -536,7 +539,8 @@ static int CmdEM410xBrute(const char *Cmd) {
     uint8_t testuid[5];
     for (uint32_t c = 0; c < uidcnt; ++c) {
         if (kbd_enter_pressed()) {
-            PrintAndLogEx(WARNING, "\nAborted via keyboard!\n");
+            SendCommandNG(CMD_BREAK_LOOP, NULL, 0);
+            PrintAndLogEx(INFO, "\nAborted via keyboard!\n");
             free(uidblock);
             return PM3_EOPABORTED;
         }
@@ -549,9 +553,7 @@ static int CmdEM410xBrute(const char *Cmd) {
                      );
 
         em410x_construct_emul_graph(testuid, clk);
-
-        CmdLFSim("0"); //240 start_gap.
-
+        CmdLFSim(""); //240 start_gap.
         msleep(delay);
     }
     free(uidblock);
@@ -575,9 +577,10 @@ static int CmdEM410xSpoof(const char *Cmd) {
     CLIParserFree(ctx);
 
     // loops if the captured ID was in XL-format.
-    CmdEM410xReader("-@");
-    PrintAndLogEx(SUCCESS, "# Replaying captured ID: "_YELLOW_("%010" PRIx64), g_em410xid);
-    CmdLFaskSim("");
+    g_em410xid = 0;
+    CmdEM410xReader("-b@");
+    PrintAndLogEx(SUCCESS, "Replaying captured ID "_YELLOW_("%010" PRIx64), g_em410xid);
+    CmdLFSim("");
     return PM3_SUCCESS;
 }
 
@@ -585,15 +588,15 @@ static int CmdEM410xClone(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "lf em 410x clone",
                   "Writes EM410x ID to a T55x7 or Q5/T5555 tag",
-                  "lf em 410x clone --uid 0F0368568B        -> write id to T55x7 tag\n"
-                  "lf em 410x clone --uid 0F0368568B --q5   -> write id to Q5/T5555 tag"
+                  "lf em 410x clone --id 0F0368568B        -> write id to T55x7 tag\n"
+                  "lf em 410x clone --id 0F0368568B --q5   -> write id to Q5/T5555 tag"
                  );
 
     void *argtable[] = {
         arg_param_begin,
-        arg_u64_0(NULL, "clk", "<dec>", "optional - clock <16|32|40|64> (default 64)"),
-        arg_str1("u", "uid", "<hex>", "ID number (5 hex bytes)"),
-        arg_lit0(NULL, "q5", "optional - specify writing to Q5/T5555 tag"),
+        arg_u64_0(NULL, "clk", "<dec>", "<16|32|40|64> clock (default 64)"),
+        arg_str1(NULL, "id", "<hex>", "ID number (5 hex bytes)"),
+        arg_lit0(NULL, "q5", "specify writing to Q5/T5555 tag"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);

From 47c27d751cbdb4251702bb5dbbeaa363dc8437a9 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 2 Feb 2021 17:55:54 +0100
Subject: [PATCH 484/682] lf awid/hid/io/410x watch - now works with user side
 abort

---
 armsrc/lfops.c           | 60 +++++++++++-----------------------------
 client/src/cmdlfawid.c   |  5 +---
 client/src/cmdlfem410x.c |  6 +---
 client/src/cmdlfhid.c    |  5 +---
 client/src/cmdlfio.c     |  5 +---
 5 files changed, 20 insertions(+), 61 deletions(-)

diff --git a/armsrc/lfops.c b/armsrc/lfops.c
index 6ee75b8c1..b4daed774 100644
--- a/armsrc/lfops.c
+++ b/armsrc/lfops.c
@@ -1251,20 +1251,13 @@ int lf_hid_watch(int findone, uint32_t *high, uint32_t *low) {
     BigBuf_Clear_keep_EM();
 
     int res = PM3_SUCCESS;
-    uint16_t interval = 0;
-    while (BUTTON_PRESS() == false) {
+    for (;;) {
 
         WDT_HIT();
 
-        // cancel w usb command.
-        if (interval == 4000) {
-            if (data_available()) {
-                res = PM3_EOPABORTED;
-                break;
-            }
-            interval = 0;
-        } else {
-            interval++;
+        if (data_available() || BUTTON_PRESS()) {
+            res = PM3_EOPABORTED;
+            break;
         }
 
         DoAcquisition_default(-1, false);
@@ -1360,20 +1353,13 @@ int lf_awid_watch(int findone, uint32_t *high, uint32_t *low) {
     LFSetupFPGAForADC(LF_DIVISOR_125, true);
 
     int res = PM3_SUCCESS;
-    uint16_t interval = 0;
-    while (BUTTON_PRESS() == false) {
+    for (;;) {
 
         WDT_HIT();
 
-        // cancel w usb command.
-        if (interval == 4000) {
-            if (data_available()) {
-                res = PM3_EOPABORTED;
-                break;
-            }
-            interval = 0;
-        } else {
-            interval++;
+        if (data_available() || BUTTON_PRESS()) {
+            res = PM3_EOPABORTED;
+            break;
         }
 
         DoAcquisition_default(-1, false);
@@ -1465,19 +1451,12 @@ int lf_em410x_watch(int findone, uint32_t *high, uint64_t *low) {
     LFSetupFPGAForADC(LF_DIVISOR_125, true);
 
     int res = PM3_SUCCESS;
-    uint16_t interval = 0;
-    while (BUTTON_PRESS() == false) {
+    for (;;) {
         WDT_HIT();
 
-        // cancel w usb command.
-        if (interval == 4000) {
-            if (data_available()) {
-                res = PM3_EOPABORTED;
-                break;
-            }
-            interval = 0;
-        } else {
-            interval++;
+        if (data_available() || BUTTON_PRESS()) {
+            res = PM3_EOPABORTED;
+            break;
         }
 
         DoAcquisition_default(-1, false);
@@ -1541,20 +1520,13 @@ int lf_io_watch(int findone, uint32_t *high, uint32_t *low) {
     LFSetupFPGAForADC(LF_DIVISOR_125, true);
 
     int res = PM3_SUCCESS;
-    uint16_t interval = 0;
-    while (BUTTON_PRESS() == false) {
+    for (;;) {
 
         WDT_HIT();
 
-        // cancel w usb command.
-        if (interval == 4000) {
-            if (data_available()) {
-                res = PM3_EOPABORTED;
-                break;
-            }
-            interval = 0;
-        } else {
-            interval++;
+        if (data_available() || BUTTON_PRESS()) {
+            res = PM3_EOPABORTED;
+            break;
         }
 
         DoAcquisition_default(-1, false);
diff --git a/client/src/cmdlfawid.c b/client/src/cmdlfawid.c
index 300f09430..1a06e72e2 100644
--- a/client/src/cmdlfawid.c
+++ b/client/src/cmdlfawid.c
@@ -129,10 +129,7 @@ static int CmdAWIDWatch(const char *Cmd) {
     PrintAndLogEx(INFO, "Press pm3-button to stop reading cards");
     clearCommandBuffer();
     SendCommandNG(CMD_LF_AWID_WATCH, NULL, 0);
-    PacketResponseNG resp;
-    WaitForResponse(CMD_LF_AWID_WATCH, &resp);
-    PrintAndLogEx(INFO, "Done");
-    return resp.status;
+    return lfsim_wait_check(CMD_LF_AWID_WATCH);
 }
 
 //by marshmellow
diff --git a/client/src/cmdlfem410x.c b/client/src/cmdlfem410x.c
index c836bcd01..5587017d2 100644
--- a/client/src/cmdlfem410x.c
+++ b/client/src/cmdlfem410x.c
@@ -287,13 +287,9 @@ static int CmdEM410xWatch(const char *Cmd) {
     CLIParserFree(ctx);
 
     PrintAndLogEx(SUCCESS, "Watching for EM410x cards - place tag on antenna");
-    PrintAndLogEx(INFO, "Press pm3-button to stop reading cards");
     clearCommandBuffer();
     SendCommandNG(CMD_LF_EM410X_WATCH, NULL, 0);
-    PacketResponseNG resp;
-    WaitForResponse(CMD_LF_EM410X_WATCH, &resp);
-    PrintAndLogEx(INFO, "Done");
-    return resp.status;
+    return lfsim_wait_check(CMD_LF_EM410X_WATCH);
 }
 
 //by marshmellow
diff --git a/client/src/cmdlfhid.c b/client/src/cmdlfhid.c
index 76dd36177..4550127be 100644
--- a/client/src/cmdlfhid.c
+++ b/client/src/cmdlfhid.c
@@ -223,10 +223,7 @@ static int CmdHIDWatch(const char *Cmd) {
     PrintAndLogEx(INFO, "Press pm3-button to stop reading cards");
     clearCommandBuffer();
     SendCommandNG(CMD_LF_HID_WATCH, NULL, 0);
-    PacketResponseNG resp;
-    WaitForResponse(CMD_LF_HID_WATCH, &resp);
-    PrintAndLogEx(INFO, "Done");
-    return resp.status;
+    return lfsim_wait_check(CMD_LF_HID_WATCH);
 }
 
 static int CmdHIDSim(const char *Cmd) {
diff --git a/client/src/cmdlfio.c b/client/src/cmdlfio.c
index fd9ce6d1d..3752522ad 100644
--- a/client/src/cmdlfio.c
+++ b/client/src/cmdlfio.c
@@ -50,10 +50,7 @@ static int CmdIOProxWatch(const char *Cmd) {
     PrintAndLogEx(INFO, "Press pm3-button to stop reading cards");
     clearCommandBuffer();
     SendCommandNG(CMD_LF_IO_WATCH, NULL, 0);
-    PacketResponseNG resp;
-    WaitForResponse(CMD_LF_IO_WATCH, &resp);
-    PrintAndLogEx(INFO, "Done");
-    return resp.status;
+    return lfsim_wait_check(CMD_LF_IO_WATCH);
 }
 
 //IO-Prox demod - FSK RF/64 with preamble of 000000001

From a78e610f1893252786a6aff8265c634480ef9ac2 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 2 Feb 2021 20:49:36 +0100
Subject: [PATCH 485/682] nespress defaults

---
 client/dictionaries/mfc_default_keys.dic | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/client/dictionaries/mfc_default_keys.dic b/client/dictionaries/mfc_default_keys.dic
index 9f716608a..9d5d84551 100644
--- a/client/dictionaries/mfc_default_keys.dic
+++ b/client/dictionaries/mfc_default_keys.dic
@@ -1283,4 +1283,11 @@ AABAFFCC7612
 17D071403C20
 #
 534F4C415249
-534f4c303232
\ No newline at end of file
+534f4c303232
+#
+# Nespresso, smart card
+# 
+ff9a84635bd2
+6f30126ee7e4
+6039abb101bb
+f1a1239a4487
\ No newline at end of file

From 92b1ccc935148e170eff602fed7697d979d6c172 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 3 Feb 2021 00:14:40 +0100
Subject: [PATCH 486/682] wiegand encode - now has option to add hid preamble
 or not

---
 client/src/cmdlfem410x.c     |   6 +-
 client/src/cmdlfhid.c        |   6 +-
 client/src/cmdwiegand.c      |   6 +-
 client/src/wiegand_formats.c | 185 ++++++++++++++++++++++-------------
 client/src/wiegand_formats.h |   6 +-
 5 files changed, 129 insertions(+), 80 deletions(-)

diff --git a/client/src/cmdlfem410x.c b/client/src/cmdlfem410x.c
index 5587017d2..04f0254aa 100644
--- a/client/src/cmdlfem410x.c
+++ b/client/src/cmdlfem410x.c
@@ -286,7 +286,7 @@ static int CmdEM410xWatch(const char *Cmd) {
     CLIExecWithReturn(ctx, Cmd, argtable, true);
     CLIParserFree(ctx);
 
-    PrintAndLogEx(SUCCESS, "Watching for EM410x cards - place tag on antenna");
+    PrintAndLogEx(SUCCESS, "Watching for EM410x cards - place tag on Proxmark3 antenna");
     clearCommandBuffer();
     SendCommandNG(CMD_LF_EM410X_WATCH, NULL, 0);
     return lfsim_wait_check(CMD_LF_EM410X_WATCH);
@@ -542,14 +542,14 @@ static int CmdEM410xBrute(const char *Cmd) {
         }
 
         memcpy(testuid, uidblock + 5 * c, 5);
-        PrintAndLogEx(INFO, "Bruteforce %d / %d: simulating UID " _YELLOW_("%s")
+        PrintAndLogEx(INFO, "Bruteforce %d / %u: simulating UID " _YELLOW_("%s")
                       , c + 1
                       , uidcnt
                       , sprint_hex_inrow(testuid, sizeof(testuid))
                      );
 
         em410x_construct_emul_graph(testuid, clk);
-        CmdLFSim(""); //240 start_gap.
+        CmdLFSim("");
         msleep(delay);
     }
     free(uidblock);
diff --git a/client/src/cmdlfhid.c b/client/src/cmdlfhid.c
index 4550127be..47eeca45b 100644
--- a/client/src/cmdlfhid.c
+++ b/client/src/cmdlfhid.c
@@ -58,7 +58,7 @@ static int sendTry(uint8_t format_idx, wiegand_card_t *card, uint32_t delay, boo
     wiegand_message_t packed;
     memset(&packed, 0, sizeof(wiegand_message_t));
 
-    if (HIDPack(format_idx, card, &packed) == false) {
+    if (HIDPack(format_idx, card, &packed, true) == false) {
         PrintAndLogEx(WARNING, "The card data could not be encoded in the selected format.");
         return PM3_ESOFT;
     }
@@ -284,7 +284,7 @@ static int CmdHIDSim(const char *Cmd) {
         packed.Mid = mid;
         packed.Bot = bot;
     } else {
-        if (HIDPack(format_idx, &card, &packed) == false) {
+        if (HIDPack(format_idx, &card, &packed, true) == false) {
             PrintAndLogEx(WARNING, "The card data could not be encoded in the selected format.");
             return PM3_ESOFT;
         }
@@ -390,7 +390,7 @@ static int CmdHIDClone(const char *Cmd) {
         packed.Mid = mid;
         packed.Bot = bot;
     } else {
-        if (HIDPack(format_idx, &card, &packed) == false) {
+        if (HIDPack(format_idx, &card, &packed, true) == false) {
             PrintAndLogEx(WARNING, "The card data could not be encoded in the selected format.");
             return PM3_ESOFT;
         }
diff --git a/client/src/cmdwiegand.c b/client/src/cmdwiegand.c
index 3fcce3214..55e4d6e9c 100644
--- a/client/src/cmdwiegand.c
+++ b/client/src/cmdwiegand.c
@@ -60,6 +60,7 @@ int CmdWiegandEncode(const char *Cmd) {
         arg_u64_0(NULL, "issue", "<dec>", "issue level"),
         arg_u64_0(NULL, "oem", "<dec>", "OEM code"),
         arg_str0("w", "wiegand", "<format>", "see `wiegand list` for available formats"),
+        arg_lit0(NULL, "pre", "add HID preamble to wiegand"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
@@ -75,6 +76,7 @@ int CmdWiegandEncode(const char *Cmd) {
     int len = 0;
     char format[16] = {0};
     CLIParamStrToBuf(arg_get_str(ctx, 5), (uint8_t *)format, sizeof(format), &len);
+    bool preamble = arg_get_lit(ctx, 6);
     CLIParserFree(ctx);
 
     int idx = -1;
@@ -89,14 +91,14 @@ int CmdWiegandEncode(const char *Cmd) {
     if (idx != -1) {
         wiegand_message_t packed;
         memset(&packed, 0, sizeof(wiegand_message_t));
-        if (HIDPack(idx, &data, &packed) == false) {
+        if (HIDPack(idx, &data, &packed, preamble) == false) {
             PrintAndLogEx(WARNING, "The card data could not be encoded in the selected format.");
             return PM3_ESOFT;
         }
         print_wiegand_code(&packed);
     } else {
         // try all formats and print only the ones that work.
-        HIDPackTryAll(&data);
+        HIDPackTryAll(&data, preamble);
     }
     return PM3_SUCCESS;
 }
diff --git a/client/src/wiegand_formats.c b/client/src/wiegand_formats.c
index ba8169d37..b2ec25e4c 100644
--- a/client/src/wiegand_formats.c
+++ b/client/src/wiegand_formats.c
@@ -12,7 +12,7 @@
 #include "commonutil.h"
 
 
-static bool Pack_H10301(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_H10301(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0xFF) return false; // Can't encode FC.
@@ -25,7 +25,9 @@ static bool Pack_H10301(wiegand_card_t *card, wiegand_message_t *packed) {
     packed->Bot |= (card->FacilityCode & 0xFF) << 17;
     packed->Bot |= oddparity32((packed->Bot >> 1) & 0xFFF) & 1;
     packed->Bot |= (evenparity32((packed->Bot >> 13) & 0xFFF) & 1) << 25;
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_H10301(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -40,7 +42,7 @@ static bool Unpack_H10301(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_Tecom27(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_Tecom27(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0x7FF) return false; // Can't encode FC.
@@ -51,7 +53,9 @@ static bool Pack_Tecom27(wiegand_card_t *card, wiegand_message_t *packed) {
     packed->Length = 27;
     set_nonlinear_field(packed, card->FacilityCode, 10, (uint8_t[]) {15, 19, 24, 23, 22, 18, 6, 10, 14, 3, 2});
     set_nonlinear_field(packed, card->CardNumber, 16, (uint8_t[]) {0, 1, 13, 12, 9, 26, 20, 16, 17, 21, 25, 7, 8, 11, 4, 5});
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_Tecom27(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -64,7 +68,7 @@ static bool Unpack_Tecom27(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_2804W(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_2804W(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0x0FF) return false; // Can't encode FC.
@@ -84,7 +88,9 @@ static bool Pack_2804W(wiegand_card_t *card, wiegand_message_t *packed) {
     set_bit_by_position(packed,
                         oddparity32(get_linear_field(packed, 0, 27))
                         , 27);
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_2804W(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -101,7 +107,7 @@ static bool Unpack_2804W(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_ATSW30(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_ATSW30(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0xFFF) return false; // Can't encode FC.
@@ -118,7 +124,9 @@ static bool Pack_ATSW30(wiegand_card_t *card, wiegand_message_t *packed) {
     set_bit_by_position(packed,
                         oddparity32(get_linear_field(packed, 13, 16))
                         , 29);
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_ATSW30(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -134,7 +142,7 @@ static bool Unpack_ATSW30(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_ADT31(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_ADT31(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0x0F) return false; // Can't encode FC.
@@ -146,7 +154,9 @@ static bool Pack_ADT31(wiegand_card_t *card, wiegand_message_t *packed) {
     set_linear_field(packed, card->FacilityCode, 1, 4);
     set_linear_field(packed, card->CardNumber, 5, 23);
     // Parity not known, but 4 bits are unused.
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_ADT31(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -158,7 +168,7 @@ static bool Unpack_ADT31(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_Kastle(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_Kastle(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0x00FF) return false; // Can't encode FC.
@@ -173,7 +183,9 @@ static bool Pack_Kastle(wiegand_card_t *card, wiegand_message_t *packed) {
     set_linear_field(packed, card->CardNumber, 15, 16);
     set_bit_by_position(packed, evenparity32(get_linear_field(packed, 1, 16)), 0);
     set_bit_by_position(packed, oddparity32(get_linear_field(packed, 14, 17)), 31);
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_Kastle(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -191,7 +203,7 @@ static bool Unpack_Kastle(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_Kantech(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_Kantech(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0xFF) return false; // Can't encode FC.
@@ -202,7 +214,9 @@ static bool Pack_Kantech(wiegand_card_t *card, wiegand_message_t *packed) {
     packed->Length = 32;
     set_linear_field(packed, card->FacilityCode, 7, 8);
     set_linear_field(packed, card->CardNumber, 15, 16);
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_Kantech(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -214,7 +228,7 @@ static bool Unpack_Kantech(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_D10202(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_D10202(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0x007F) return false; // Can't encode FC.
@@ -227,7 +241,9 @@ static bool Pack_D10202(wiegand_card_t *card, wiegand_message_t *packed) {
     set_linear_field(packed, card->CardNumber, 8, 24);
     set_bit_by_position(packed, evenparity32(get_linear_field(packed, 1, 16)), 0);
     set_bit_by_position(packed, oddparity32(get_linear_field(packed, 16, 16)), 32);
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_D10202(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -243,7 +259,7 @@ static bool Unpack_D10202(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_H10306(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_H10306(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0xFFFF) return false; // Can't encode FC.
@@ -257,7 +273,9 @@ static bool Pack_H10306(wiegand_card_t *card, wiegand_message_t *packed) {
     packed->Mid |= (card->FacilityCode & 0x8000) >> 15;
     packed->Mid |= (evenparity32((packed->Mid & 0x00000001) ^ (packed->Bot & 0xFFFE0000)) & 1) << 1;
     packed->Bot |= (oddparity32(packed->Bot & 0x0001FFFE) & 1);
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_H10306(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -275,7 +293,7 @@ static bool Unpack_H10306(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_N10002(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_N10002(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0xFF) return false; // Can't encode FC.
@@ -286,7 +304,9 @@ static bool Pack_N10002(wiegand_card_t *card, wiegand_message_t *packed) {
     packed->Length = 34; // Set number of bits
     set_linear_field(packed, card->FacilityCode, 9, 8);
     set_linear_field(packed, card->CardNumber, 17, 16);
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_N10002(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -299,7 +319,7 @@ static bool Unpack_N10002(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_C1k35s(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_C1k35s(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0xFFF) return false; // Can't encode FC.
@@ -314,7 +334,9 @@ static bool Pack_C1k35s(wiegand_card_t *card, wiegand_message_t *packed) {
     packed->Mid |= (evenparity32((packed->Mid & 0x00000001) ^ (packed->Bot & 0xB6DB6DB6)) & 1) << 1;
     packed->Bot |= (oddparity32((packed->Mid & 0x00000003) ^ (packed->Bot & 0x6DB6DB6C)) & 1);
     packed->Mid |= (oddparity32((packed->Mid & 0x00000003) ^ (packed->Bot & 0xFFFFFFFF)) & 1) << 2;
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_C1k35s(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -331,7 +353,7 @@ static bool Unpack_C1k35s(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_H10320(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_H10320(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0) return false; // Can't encode FC. (none in this format)
@@ -356,7 +378,9 @@ static bool Pack_H10320(wiegand_card_t *card, wiegand_message_t *packed) {
     set_bit_by_position(packed, evenparity32(
     get_nonlinear_field(packed, 8, (uint8_t[]) {3, 7, 11, 15, 19, 23, 29, 31})
                         ), 35);
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_H10320(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -383,7 +407,7 @@ static bool Unpack_H10320(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_S12906(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_S12906(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0xFF) return false; // Can't encode FC.
@@ -397,7 +421,9 @@ static bool Pack_S12906(wiegand_card_t *card, wiegand_message_t *packed) {
     set_linear_field(packed, card->CardNumber, 11, 24);
     set_bit_by_position(packed, oddparity32(get_linear_field(packed, 1, 17)), 0);
     set_bit_by_position(packed, oddparity32(get_linear_field(packed, 17, 18)), 35);
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_S12906(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -414,7 +440,7 @@ static bool Unpack_S12906(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_Sie36(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_Sie36(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0x0003FFFF) return false; // Can't encode FC.
@@ -431,7 +457,9 @@ static bool Pack_Sie36(wiegand_card_t *card, wiegand_message_t *packed) {
     set_bit_by_position(packed,
     evenparity32(get_nonlinear_field(packed, 23, (uint8_t[]) {1, 2, 4, 5, 7, 8, 10, 11, 13, 14, 16, 17, 19, 20, 22, 23, 25, 26, 28, 29, 31, 32, 34}))
     , 35);
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_Sie36(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -447,7 +475,7 @@ static bool Unpack_Sie36(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_C15001(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_C15001(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0x000000FF) return false; // Can't encode FC.
@@ -461,7 +489,9 @@ static bool Pack_C15001(wiegand_card_t *card, wiegand_message_t *packed) {
     set_linear_field(packed, card->CardNumber, 19, 16);
     set_bit_by_position(packed, evenparity32(get_linear_field(packed, 1, 17)), 0);
     set_bit_by_position(packed, oddparity32(get_linear_field(packed, 18, 17)), 35);
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_C15001(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -478,7 +508,7 @@ static bool Unpack_C15001(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_H10302(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_H10302(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0) return false; // Can't encode FC. (none in this format)
@@ -490,7 +520,9 @@ static bool Pack_H10302(wiegand_card_t *card, wiegand_message_t *packed) {
     set_linear_field(packed, card->CardNumber, 1, 35);
     set_bit_by_position(packed, evenparity32(get_linear_field(packed, 1, 18)), 0);
     set_bit_by_position(packed, oddparity32(get_linear_field(packed, 18, 18)), 36);
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_H10302(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -505,7 +537,7 @@ static bool Unpack_H10302(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_H10304(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_H10304(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0x0000FFFF) return false; // Can't encode FC.
@@ -520,7 +552,9 @@ static bool Pack_H10304(wiegand_card_t *card, wiegand_message_t *packed) {
 
     set_bit_by_position(packed, evenparity32(get_linear_field(packed, 1, 18)), 0);
     set_bit_by_position(packed, oddparity32(get_linear_field(packed, 18, 18)), 36);
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_H10304(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -536,7 +570,7 @@ static bool Unpack_H10304(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_HGeneric37(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_HGeneric37(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0) return false; // Not used in this format
@@ -552,26 +586,25 @@ static bool Pack_HGeneric37(wiegand_card_t *card, wiegand_message_t *packed) {
 
     // even1
     set_bit_by_position(packed,
-                        evenparity32(
-    get_nonlinear_field(packed, 8, (uint8_t[]) {4, 8, 12, 16, 20, 24, 28, 32})
-                        )
-    , 0
-                       );
+        evenparity32(
+            get_nonlinear_field(packed, 8, (uint8_t[]) {4, 8, 12, 16, 20, 24, 28, 32}))
+            , 0
+            );
     // odd1
     set_bit_by_position(packed,
-                        oddparity32(
-    get_nonlinear_field(packed, 8, (uint8_t[]) {6, 10, 14, 18, 22, 26, 30, 34})
-                        )
-    , 2
-                       );
+        oddparity32(
+            get_nonlinear_field(packed, 8, (uint8_t[]) {6, 10, 14, 18, 22, 26, 30, 34}))
+            , 2
+            );
     // even2
     set_bit_by_position(packed,
-                        evenparity32(
-    get_nonlinear_field(packed, 8, (uint8_t[]) {7, 11, 15, 19, 23, 27, 31, 35})
-                        )
-    , 3
-                       );
-    return add_HID_header(packed);
+        evenparity32(
+            get_nonlinear_field(packed, 8, (uint8_t[]) {7, 11, 15, 19, 23, 27, 31, 35}))
+            , 3
+            );
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_HGeneric37(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -589,7 +622,7 @@ static bool Unpack_HGeneric37(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_MDI37(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_MDI37(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (card->FacilityCode > 0x0000F) return false; // Can't encode FC.
@@ -604,7 +637,9 @@ static bool Pack_MDI37(wiegand_card_t *card, wiegand_message_t *packed) {
 
     set_bit_by_position(packed, evenparity32(get_linear_field(packed, 1, 18)), 0);
     set_bit_by_position(packed, oddparity32(get_linear_field(packed, 18, 18)), 36);
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_MDI37(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -622,7 +657,7 @@ static bool Unpack_MDI37(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_P10001(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_P10001(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
 
     memset(packed, 0, sizeof(wiegand_message_t));
 
@@ -641,7 +676,9 @@ static bool Pack_P10001(wiegand_card_t *card, wiegand_message_t *packed) {
                      get_linear_field(packed, 16, 8) ^
                      get_linear_field(packed, 24, 8)
                      , 32, 8);
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_P10001(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -661,7 +698,7 @@ static bool Unpack_P10001(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_C1k48s(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_C1k48s(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
 
     memset(packed, 0, sizeof(wiegand_message_t));
 
@@ -677,7 +714,9 @@ static bool Pack_C1k48s(wiegand_card_t *card, wiegand_message_t *packed) {
     packed->Mid |= (evenparity32((packed->Mid & 0x00001B6D) ^ (packed->Bot & 0xB6DB6DB6)) & 1) << 14;
     packed->Bot |= (oddparity32((packed->Mid & 0x000036DB) ^ (packed->Bot & 0x6DB6DB6C)) & 1);
     packed->Mid |= (oddparity32((packed->Mid & 0x00007FFF) ^ (packed->Bot & 0xFFFFFFFF)) & 1) << 15;
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_C1k48s(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -694,7 +733,7 @@ static bool Unpack_C1k48s(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_CasiRusco40(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_CasiRusco40(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
 
     memset(packed, 0, sizeof(wiegand_message_t));
 
@@ -706,7 +745,9 @@ static bool Pack_CasiRusco40(wiegand_card_t *card, wiegand_message_t *packed) {
     packed->Length = 40; // Set number of bits
     set_linear_field(packed, card->CardNumber, 1, 38);
 
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_CasiRusco40(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -718,7 +759,7 @@ static bool Unpack_CasiRusco40(wiegand_message_t *packed, wiegand_card_t *card)
     return true;
 }
 
-static bool Pack_Optus(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_Optus(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
 
     memset(packed, 0, sizeof(wiegand_message_t));
 
@@ -731,7 +772,9 @@ static bool Pack_Optus(wiegand_card_t *card, wiegand_message_t *packed) {
     set_linear_field(packed, card->CardNumber, 1, 16);
     set_linear_field(packed, card->FacilityCode, 22, 11);
 
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_Optus(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -744,7 +787,7 @@ static bool Unpack_Optus(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_Smartpass(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_Smartpass(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
 
     memset(packed, 0, sizeof(wiegand_message_t));
 
@@ -758,7 +801,9 @@ static bool Pack_Smartpass(wiegand_card_t *card, wiegand_message_t *packed) {
     set_linear_field(packed, card->FacilityCode, 1, 13);
     set_linear_field(packed, card->IssueLevel, 14, 3);
     set_linear_field(packed, card->CardNumber, 17, 16);
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_Smartpass(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -772,7 +817,7 @@ static bool Unpack_Smartpass(wiegand_message_t *packed, wiegand_card_t *card) {
     return true;
 }
 
-static bool Pack_bqt(wiegand_card_t *card, wiegand_message_t *packed) {
+static bool Pack_bqt(wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
 
     memset(packed, 0, sizeof(wiegand_message_t));
 
@@ -793,7 +838,9 @@ static bool Pack_bqt(wiegand_card_t *card, wiegand_message_t *packed) {
                         oddparity32(get_linear_field(packed, 17, 16))
                         , 33);
 
-    return add_HID_header(packed);
+    if (preamble)
+        return add_HID_header(packed);
+    return true;
 }
 
 static bool Unpack_bqt(wiegand_message_t *packed, wiegand_card_t *card) {
@@ -920,16 +967,16 @@ int HIDFindCardFormat(const char *format) {
     return -1;
 }
 
-bool HIDPack(int format_idx, wiegand_card_t *card, wiegand_message_t *packed) {
+bool HIDPack(int format_idx, wiegand_card_t *card, wiegand_message_t *packed, bool preamble) {
     memset(packed, 0, sizeof(wiegand_message_t));
 
     if (format_idx < 0 || format_idx >= ARRAYLEN(FormatTable))
         return false;
 
-    return FormatTable[format_idx].Pack(card, packed);
+    return FormatTable[format_idx].Pack(card, packed, preamble);
 }
 
-void HIDPackTryAll(wiegand_card_t *card) {
+void HIDPackTryAll(wiegand_card_t *card, bool preamble) {
 
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "%-10s %-30s --> Encoded wiegand", "Name", "Description");
@@ -939,7 +986,7 @@ void HIDPackTryAll(wiegand_card_t *card) {
     int i = 0;
     while (FormatTable[i].Name) {
         memset(&packed, 0, sizeof(wiegand_message_t));
-        bool res = FormatTable[i].Pack(card, &packed);
+        bool res = FormatTable[i].Pack(card, &packed, preamble);
         if (res) {
             cardformat_t fmt = HIDGetCardFormat(i);
             print_desc_wiegand(&fmt, &packed);
diff --git a/client/src/wiegand_formats.h b/client/src/wiegand_formats.h
index 531de1e12..921b1840a 100644
--- a/client/src/wiegand_formats.h
+++ b/client/src/wiegand_formats.h
@@ -33,7 +33,7 @@ typedef struct {
 // Structure for defined Wiegand card formats available for packing/unpacking
 typedef struct {
     const char *Name;
-    bool (*Pack)(wiegand_card_t *card, wiegand_message_t *packed);
+    bool (*Pack)(wiegand_card_t *card, wiegand_message_t *packed, bool preamble);
     bool (*Unpack)(wiegand_message_t *packed, wiegand_card_t *card);
     const char *Descrp;
     cardformatdescriptor_t Fields;
@@ -42,9 +42,9 @@ typedef struct {
 void HIDListFormats(void);
 int HIDFindCardFormat(const char *format);
 cardformat_t HIDGetCardFormat(int idx);
-bool HIDPack(int format_idx, wiegand_card_t *card, wiegand_message_t *packed);
+bool HIDPack(int format_idx, wiegand_card_t *card, wiegand_message_t *packed, bool preamble);
 bool HIDTryUnpack(wiegand_message_t *packed, bool ignore_parity);
-void HIDPackTryAll(wiegand_card_t *card);
+void HIDPackTryAll(wiegand_card_t *card, bool preamble);
 void print_wiegand_code(wiegand_message_t *packed);
 void print_desc_wiegand(cardformat_t *fmt, wiegand_message_t *packed);
 #endif

From ff98bb047d3048c6b992add4da27986bfb7a407d Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 3 Feb 2021 00:15:19 +0100
Subject: [PATCH 487/682] lf t55xx wipe - better handling of wrong length pwd

---
 client/src/cmdlft55xx.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index 89204952d..54111f040 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -2895,9 +2895,10 @@ static int CmdT55xxWipe(const char *Cmd) {
     res = arg_get_u32_hexstr_def(ctx, 2, 0x51243648, &password);
     if (res) {
         usepwd = true;
+    }
 
-        if (usepwd && res == 2)
-            PrintAndLogEx(WARNING, "Password should be 4 bytes, using default pwd");
+    if (res == 2) {
+        PrintAndLogEx(WARNING, "Password should be 4 bytes, using default pwd");
     }
 
     bool Q5 = arg_get_lit(ctx, 3);

From d69e681f319cb8e98b2ab2792978714e751c5686 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 3 Feb 2021 00:16:16 +0100
Subject: [PATCH 488/682] text

---
 doc/cliparser_todo.txt | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 0738d589e..12dcc34ab 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -96,10 +96,6 @@ hf mf ice
 lf config
 lf cmdread
 lf read
-lf sim
-lf simask
-lf simfsk
-lf simpsk
 lf sniff
 lf em 410x
 lf em 4x05
@@ -121,5 +117,4 @@ lf t55xx restore
 lf t55xx trace
 lf t55xx wakeup
 lf t55xx write
-lf t55xx special
 script run

From 5a102a434727b97d91811cca03b4b1c451279359 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 3 Feb 2021 09:22:36 +0100
Subject: [PATCH 489/682] lf sniff - now uses cliparser

---
 client/src/cmdlf.c | 80 +++++++++++++++-------------------------------
 1 file changed, 26 insertions(+), 54 deletions(-)

diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index 45febccff..73b538ddb 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -112,24 +112,7 @@ static int usage_lf_read(void) {
     PrintAndLogEx(NORMAL, "  use " _YELLOW_("'lf config'")" to set parameters.");
     return PM3_SUCCESS;
 }
-static int usage_lf_sniff(void) {
-    PrintAndLogEx(NORMAL, "Sniff low frequency signal.");
-    PrintAndLogEx(NORMAL, "Usage: lf sniff [h] [q] [s #samples] [@]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h         This help");
-    PrintAndLogEx(NORMAL, "       q            silent (optional)");
-    PrintAndLogEx(NORMAL, "       s #samples   number of samples to collect (optional)");
-    PrintAndLogEx(NORMAL, "       @            run continuously until a key is pressed (optional)");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "      lf sniff");
-    PrintAndLogEx(NORMAL, _CYAN_(" oscilloscope style") ":");
-    PrintAndLogEx(NORMAL, _YELLOW_("      data plot"));
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf sniff q s 3000 @"));
-    PrintAndLogEx(NORMAL, "Extras:");
-    PrintAndLogEx(NORMAL, "  use " _YELLOW_("'lf config'")" to set parameters.");
-    PrintAndLogEx(NORMAL, "  use " _YELLOW_("'data plot'")" to look at it");
-    return PM3_SUCCESS;
-}
+
 static int usage_lf_config(void) {
     PrintAndLogEx(NORMAL, "Usage: lf config [h] [L | H | q <divisor> | f <freq>] [b <bps>] [d <decim>] [a 0|1]");
     PrintAndLogEx(NORMAL, "Options:");
@@ -748,49 +731,38 @@ int lf_sniff(bool verbose, uint32_t samples) {
 }
 
 int CmdLFSniff(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf sniff",
+                  "Sniff low frequency signal.\n"
+                  " - use " _YELLOW_("`lf config`") _CYAN_(" to set parameters.\n")
+                  _CYAN_(" - use ") _YELLOW_("`data plot`") _CYAN_(" to look at it"),
+                  "lf sniff -v\n"
+                  "lf sniff -s 3000 -@    --> oscilloscope style \n"
+                 );
 
-    if (!session.pm3_present) return PM3_ENOTTY;
+    void *argtable[] = {
+        arg_param_begin,
+        arg_u64_0("s", "samples", "<dec>", "number of samples to collect"),
+        arg_lit0("v", "verbose", "verbose output"),
+        arg_lit0("@", NULL, "continuous sniffing mode"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    uint32_t samples = arg_get_u32_def(ctx, 1, 0);
+    bool verbose = arg_get_lit(ctx, 2);
+    bool cm = arg_get_lit(ctx, 3);
+    CLIParserFree(ctx);
 
-    bool errors = false;
-    bool verbose = true;
-    bool continuous = false;
-    uint32_t samples = 0;
-    uint8_t cmdp = 0;
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_lf_sniff();
-            case 's':
-                samples = param_get32ex(Cmd, cmdp + 1, 0, 10);
-                cmdp += 2;
-                break;
-            case 'q':
-                verbose = false;
-                cmdp++;
-                break;
-            case '@':
-                continuous = true;
-                cmdp++;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
+    if (session.pm3_present == false)
+        return PM3_ENOTTY;
 
-    //Validations
-    if (errors) return usage_lf_sniff();
-    if (continuous) {
-        PrintAndLogEx(INFO, "Press " _GREEN_("Enter") " to exit");
+    if (cm) {
+        PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
     }
     int ret = PM3_SUCCESS;
     do {
         ret = lf_sniff(verbose, samples);
-        if (kbd_enter_pressed()) {
-            break;
-        }
-    } while (continuous);
+    } while (cm && !kbd_enter_pressed());
     return ret;
 }
 

From f9c2f35c8bd8eef5dda8267213828a6e65d9b2b9 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 3 Feb 2021 10:33:02 +0100
Subject: [PATCH 490/682] lf read - now uses cliparser

---
 client/src/cmdlf.c | 81 ++++++++++++++--------------------------------
 1 file changed, 25 insertions(+), 56 deletions(-)

diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index 73b538ddb..5e0f8beec 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -93,26 +93,6 @@ static int usage_lf_cmdread(void) {
     PrintAndLogEx(NORMAL, "  use " _YELLOW_("'lf config'")" to set parameters.");
     return PM3_SUCCESS;
 }
-static int usage_lf_read(void) {
-    PrintAndLogEx(NORMAL, "Usage: lf read [h] [q] [s #samples] [@]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h            This help");
-    PrintAndLogEx(NORMAL, "       q            silent (optional)");
-    PrintAndLogEx(NORMAL, "       s #samples   number of samples to collect (optional)");
-    PrintAndLogEx(NORMAL, "       @            run continuously until a key is pressed (optional)");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, "      lf read");
-    PrintAndLogEx(NORMAL, "- collecting quietly 12000 samples:");
-    PrintAndLogEx(NORMAL, "      lf read q s 12000     - ");
-    PrintAndLogEx(NORMAL, "- oscilloscope style:");
-    PrintAndLogEx(NORMAL, "      data plot");
-    PrintAndLogEx(NORMAL, "      lf read q s 3000 @");
-    PrintAndLogEx(NORMAL, "Extras:");
-    PrintAndLogEx(NORMAL, "  use " _YELLOW_("'lf config'")" to set parameters.");
-    return PM3_SUCCESS;
-}
-
 static int usage_lf_config(void) {
     PrintAndLogEx(NORMAL, "Usage: lf config [h] [L | H | q <divisor> | f <freq>] [b <bps>] [d <decim>] [a 0|1]");
     PrintAndLogEx(NORMAL, "Options:");
@@ -654,49 +634,38 @@ int lf_read(bool verbose, uint32_t samples) {
 }
 
 int CmdLFRead(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf read",
+                  "Sniff low frequency signal.\n"
+                  " - use " _YELLOW_("`lf config`") _CYAN_(" to set parameters.\n")
+                  _CYAN_(" - use ") _YELLOW_("`data plot`") _CYAN_(" to look at it"),
+                  "lf read -v -s 12000   --> collect 12000 samples\n"
+                  "lf read -s 3000 -@    --> oscilloscope style \n"
+                 );
 
-    if (!session.pm3_present) return PM3_ENOTTY;
+    void *argtable[] = {
+        arg_param_begin,
+        arg_u64_0("s", "samples", "<dec>", "number of samples to collect"),
+        arg_lit0("v", "verbose", "verbose output"),
+        arg_lit0("@", NULL, "continuous reading mode"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    uint32_t samples = arg_get_u32_def(ctx, 1, 0);
+    bool verbose = arg_get_lit(ctx, 2);
+    bool cm = arg_get_lit(ctx, 3);
+    CLIParserFree(ctx);
 
-    bool errors = false;
-    bool verbose = true;
-    bool continuous = false;
-    uint32_t samples = 0;
-    uint8_t cmdp = 0;
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_lf_read();
-            case 's':
-                samples = param_get32ex(Cmd, cmdp + 1, 0, 10);
-                cmdp += 2;
-                break;
-            case 'q':
-                verbose = false;
-                cmdp++;
-                break;
-            case '@':
-                continuous = true;
-                cmdp++;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
+    if (session.pm3_present == false)
+        return PM3_ENOTTY;
 
-    //Validations
-    if (errors) return usage_lf_read();
-    if (continuous) {
-        PrintAndLogEx(INFO, "Press " _GREEN_("Enter") " to exit");
+    if (cm) {
+        PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
     }
     int ret = PM3_SUCCESS;
     do {
         ret = lf_read(verbose, samples);
-        if (kbd_enter_pressed()) {
-            break;
-        }
-    } while (continuous);
+    } while (cm && !kbd_enter_pressed());
     return ret;
 }
 

From e3aa035be724d9c3a846944e29268221c3576b2f Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 3 Feb 2021 16:00:33 +0100
Subject: [PATCH 491/682] fix: lf config set decimate or divisor to 8 is now
 possible

---
 armsrc/lfsampling.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/armsrc/lfsampling.c b/armsrc/lfsampling.c
index ef1d128cc..f45fe8920 100644
--- a/armsrc/lfsampling.c
+++ b/armsrc/lfsampling.c
@@ -73,11 +73,11 @@ void printSamples(void) {
 void setSamplingConfig(sample_config *sc) {
 
     // decimation (1-8) how many bits of adc sample value to save
-    if (sc->decimation > 0 && sc->decimation < 8)
+    if (sc->decimation > 0 && sc->decimation < 9)
         config.decimation = sc->decimation;
 
     // bits per sample (1-8)
-    if (sc->bits_per_sample > 0 && sc->bits_per_sample < 8)
+    if (sc->bits_per_sample > 0 && sc->bits_per_sample < 9)
         config.bits_per_sample = sc->bits_per_sample;
 
     //

From 967f5ffd510b0f73b8071ceb044e7354b7f66b7d Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 3 Feb 2021 16:00:54 +0100
Subject: [PATCH 492/682] lf config - now uses cliparser

---
 client/src/cmdlf.c | 182 ++++++++++++++++++++++-----------------------
 1 file changed, 87 insertions(+), 95 deletions(-)

diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index 5e0f8beec..a4495f3f2 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -93,28 +93,6 @@ static int usage_lf_cmdread(void) {
     PrintAndLogEx(NORMAL, "  use " _YELLOW_("'lf config'")" to set parameters.");
     return PM3_SUCCESS;
 }
-static int usage_lf_config(void) {
-    PrintAndLogEx(NORMAL, "Usage: lf config [h] [L | H | q <divisor> | f <freq>] [b <bps>] [d <decim>] [a 0|1]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h                 This help");
-    PrintAndLogEx(NORMAL, "       L                 Low frequency (125 kHz)");
-    PrintAndLogEx(NORMAL, "       H                 High frequency (134 kHz)");
-    PrintAndLogEx(NORMAL, "       q <divisor>       Manually set freq divisor. %d -> 134 kHz, %d -> 125 kHz", LF_DIVISOR_134, LF_DIVISOR_125);
-    PrintAndLogEx(NORMAL, "       f <freq>          Manually set frequency in kHz");
-    PrintAndLogEx(NORMAL, "       b <bps>           Sets resolution of bits per sample. Default (max): 8");
-    PrintAndLogEx(NORMAL, "       d <decimate>      Sets decimation. A value of N saves only 1 in N samples. Default: 1");
-    PrintAndLogEx(NORMAL, "       a [0|1]           Averaging - if set, will average the stored sample value when decimating. Default: 1");
-    PrintAndLogEx(NORMAL, "       t <threshold>     Sets trigger threshold. 0 means no threshold (range: 0-128)");
-    PrintAndLogEx(NORMAL, "       s <samplestoskip> Sets a number of samples to skip before capture. Default: 0");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf config") "              - shows current config");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf config b 8 L") "        - samples at 125 kHz, 8bps.");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf config H b 4 d 3") "    - samples at 134 kHz, averages three samples into one, stored with ");
-    PrintAndLogEx(NORMAL, "                                a resolution of 4 bits per sample.");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf read") "                - performs a read (active field)");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf sniff") "               - performs a sniff (no active field)");
-    return PM3_SUCCESS;
-}
 
 // Informative user function.
 // loop and wait for either keyboard press or pm3 button to exit
@@ -501,14 +479,59 @@ int lf_config(sample_config *config) {
 }
 
 int CmdLFConfig(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf config",
+                  "Get/Set config for LF sampling, bit/sample, decimation, frequency\n"
+                  "These changes are temporary, will be reset after a power cycle.\n\n"
+                  " - use " _YELLOW_("`lf read`") _CYAN_(" performs a read (active field)\n")
+                  _CYAN_(" - use ") _YELLOW_("`lf sniff`") _CYAN_(" performs a sniff (no active field)"),
+                  "lf config                    --> shows current config\n"
+                  "lf config -b 8 --125         --> samples at 125 kHz, 8 bps\n"
+                  "lf config -b 4 --134 --dec 3 --> samples at 134 kHz, averages three samples into one, stored with a resolution of 4 bits per sample"
+                  "lf config --trig 20 -s 10000 --> trigger sampling when above 20, skip 10 000 first samples after triggered\n"
+                 );
 
-    if (!session.pm3_present) return PM3_ENOTTY;
+    char div_str[70] = {0};
+    sprintf(div_str, "Manually set freq divisor. %d -> 134 kHz, %d -> 125 kHz", LF_DIVISOR_134, LF_DIVISOR_125);
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_lit0(NULL, "125", "125 kHz frequency"),
+        arg_lit0(NULL, "134", "134 kHz frequency"),
+        arg_int0("a", "avg", "<0|1>", "averaging - if set, will average the stored sample value when decimating (default 1)"),
+        arg_int0("b", "bps", "<1-8>", "sets resolution of bits per sample (default 8)"),
+        arg_int0(NULL, "dec", "<1-8>", "sets decimation. A value of N saves only 1 in N samples (default 1)"),
+        arg_int0(NULL, "divisor", "<19-255>", div_str),
+        arg_int0("f", "freq", "<47-600>", "manually set frequency in kHz"),
+        arg_int0("s", "skip", "<dec>", "sets a number of samples to skip before capture (default 0)"),
+        arg_int0("t", "trig", "<0-128>", "sets trigger threshold. 0 means no threshold"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool use_125 = arg_get_lit(ctx, 1);
+    bool use_134 = arg_get_lit(ctx, 2);
+    int8_t avg = arg_get_int_def(ctx, 3, 0);
+    int8_t bps = arg_get_int_def(ctx, 4, -1);
+    int8_t dec = arg_get_int_def(ctx, 5, -1);
+    int16_t div = arg_get_int_def(ctx, 6, -1);
+    int16_t freq = arg_get_int_def(ctx, 7, -1);
+    int32_t skip = arg_get_int_def(ctx, 8, -1);
+    int16_t trigg = arg_get_int_def(ctx, 9, -1);
+    CLIParserFree(ctx);  
+
+    if (session.pm3_present == false) 
+        return PM3_ENOTTY;
 
     // if called with no params, just print the device config
     if (strlen(Cmd) == 0) {
         return lf_config(NULL);
     }
 
+    if (use_125 + use_134 > 1) {
+        PrintAndLogEx(ERR,"use only one of 125 or 134 params");
+        return PM3_EINVARG;
+    }
+
     sample_config config = {
         .decimation = -1,
         .bits_per_sample = -1,
@@ -519,87 +542,56 @@ int CmdLFConfig(const char *Cmd) {
         .verbose = true
     };
 
-    bool errors = false;
+    /*
+    int8_t bps = arg_get_int_def(ctx, 4, 8);
+    int8_t dec = arg_get_int_def(ctx, 5, 1);
+    int16_t div = arg_get_int_def(ctx, 6, 95);
+    int16_t freq = arg_get_int_def(ctx, 7, 125);
+*/
+    if (use_125)
+        config.divisor = LF_DIVISOR_125;
 
-    uint8_t cmdp = 0;
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (param_getchar(Cmd, cmdp)) {
-            case 'h':
-                return usage_lf_config();
-            case 'H':
-                config.divisor = LF_DIVISOR_134;
-                cmdp++;
-                break;
-            case 'L':
-                config.divisor = LF_DIVISOR_125;
-                cmdp++;
-                break;
-            case 'q':
-                config.divisor = param_get8ex(Cmd, cmdp + 1, 95, 10);
-                if (config.divisor < 19) {
-                    PrintAndLogEx(ERR, "divisor must be between 19 and 255");
-                    return PM3_EINVARG;
-                }
-                cmdp += 2;
-                break;
-            case 'f': {
-                int freq = param_get32ex(Cmd, cmdp + 1, 125, 10);
-                config.divisor = LF_FREQ2DIV(freq);
-                if (config.divisor < 19) {
-                    PrintAndLogEx(ERR, "freq must be between 47 and 600");
-                    return PM3_EINVARG;
-                }
-                cmdp += 2;
-                break;
-            }
-            case 't': {
-                uint8_t trigg = 0;
-                errors |= param_getdec(Cmd, cmdp + 1, &trigg);
-                cmdp += 2;
-                if (!errors) {
-                    config.trigger_threshold = trigg;
-                    g_lf_threshold_set = (config.trigger_threshold > 0);
-                }
-                break;
-            }
-            case 'b': {
-                config.bits_per_sample = param_get8ex(Cmd, cmdp + 1, 8, 10);
+    if (use_134)
+        config.divisor = LF_DIVISOR_134;
 
-                // bps is limited to 8
-                if (config.bits_per_sample >> 4)
-                    config.bits_per_sample = 8;
+    config.averaging = (avg == 1);
 
-                cmdp += 2;
-                break;
-            }
-            case 'd': {
-                config.decimation = param_get8ex(Cmd, cmdp + 1, 1, 10);
+    if (bps > -1) {
+        // bps is limited to 8
+        config.bits_per_sample = (bps & 0x0F);
+        if (config.bits_per_sample > 8)
+            config.bits_per_sample = 8;
+    }
 
-                // decimation is limited to 255
-                if (config.decimation >> 4)
-                    config.decimation = 8;
+    if ( dec > -1 ) {
+        // decimation is limited to 8
+        config.decimation = (dec & 0x0F);
+        if (config.decimation > 8)
+            config.decimation = 8;
+    }
 
-                cmdp += 2;
-                break;
-            }
-            case 'a':
-                config.averaging = (param_getchar(Cmd, cmdp + 1) == '1');
-                cmdp += 2;
-                break;
-            case 's':
-                config.samples_to_skip = param_get32ex(Cmd, cmdp + 1, 0, 10);
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = 1;
-                break;
+    if ( div > -1 ) {
+        config.divisor = div;
+        if (config.divisor < 19) {
+            PrintAndLogEx(ERR, "divisor must be between 19 and 255");
+            return PM3_EINVARG;
         }
     }
 
-    // validations
-    if (errors) return usage_lf_config();
+    if (freq > -1 ) {
+        config.divisor = LF_FREQ2DIV(freq);
+        if (config.divisor < 19) {
+            PrintAndLogEx(ERR, "freq must be between 47 and 600");
+            return PM3_EINVARG;
+        }
+    }
 
+    if (trigg > -1) {
+        config.trigger_threshold = trigg;
+        g_lf_threshold_set = (config.trigger_threshold > 0);
+    }
+
+    config.samples_to_skip = skip;
     return lf_config(&config);
 }
 

From a065e21bed43804d37d60f3b24263bacb3f7208c Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Thu, 4 Feb 2021 13:10:29 +0100
Subject: [PATCH 493/682] Update openocd configurations

---
 ...chip-at91sam7s.cfg => board-at91sam7s.cfg} |  2 ++
 tools/jtag_openocd/interface-armusbocd.cfg    |  8 -----
 tools/jtag_openocd/interface-busblaster.cfg   | 10 ------
 tools/jtag_openocd/interface-buspirate.cfg    |  8 ++---
 tools/jtag_openocd/interface-c232hm.cfg       | 11 +------
 tools/jtag_openocd/interface-jlink.cfg        |  4 ---
 tools/jtag_openocd/interface-jtagkey.cfg      |  8 -----
 tools/jtag_openocd/interface-raspberrypi.cfg  | 21 +-----------
 tools/jtag_openocd/interface-raspberrypi2.cfg | 21 +-----------
 tools/jtag_openocd/interface-shikra.cfg       |  6 ----
 tools/jtag_openocd/interface-wiggler.cfg      |  7 ----
 .../jtag_openocd/openocd_configuration.sample | 33 +++++++++++++++++--
 tools/jtag_openocd/openocd_flash_dump.sh      |  2 +-
 tools/jtag_openocd/openocd_flash_recovery.sh  |  2 +-
 tools/jtag_openocd/openocd_interactive.sh     |  2 +-
 15 files changed, 41 insertions(+), 104 deletions(-)
 rename tools/jtag_openocd/{chip-at91sam7s.cfg => board-at91sam7s.cfg} (96%)
 delete mode 100644 tools/jtag_openocd/interface-armusbocd.cfg
 delete mode 100644 tools/jtag_openocd/interface-busblaster.cfg
 delete mode 100644 tools/jtag_openocd/interface-jlink.cfg
 delete mode 100644 tools/jtag_openocd/interface-jtagkey.cfg
 delete mode 100644 tools/jtag_openocd/interface-shikra.cfg
 delete mode 100644 tools/jtag_openocd/interface-wiggler.cfg

diff --git a/tools/jtag_openocd/chip-at91sam7s.cfg b/tools/jtag_openocd/board-at91sam7s.cfg
similarity index 96%
rename from tools/jtag_openocd/chip-at91sam7s.cfg
rename to tools/jtag_openocd/board-at91sam7s.cfg
index 7c546e45a..960c1461b 100644
--- a/tools/jtag_openocd/chip-at91sam7s.cfg
+++ b/tools/jtag_openocd/board-at91sam7s.cfg
@@ -28,3 +28,5 @@ gdb_memory_map enable
 sam7x.cpu configure -work-area-virt 0 -work-area-phys 0x00200000 -work-area-size 0x10000 -work-area-backup 0
 flash bank sam7x.flash.0 at91sam7 0 0 0 0 sam7x.cpu 0 0 0 0 0 0 0 18432
 flash bank sam7x.flash.1 at91sam7 0 0 0 0 sam7x.cpu 1 0 0 0 0 0 0 18432
+transport select jtag
+adapter speed 1000
diff --git a/tools/jtag_openocd/interface-armusbocd.cfg b/tools/jtag_openocd/interface-armusbocd.cfg
deleted file mode 100644
index 4820136f0..000000000
--- a/tools/jtag_openocd/interface-armusbocd.cfg
+++ /dev/null
@@ -1,8 +0,0 @@
-# Commands specific to the Olimex ARM-USB-OCD Dongle
-interface ft2232
-ft2232_device_desc "Olimex OpenOCD JTAG"
-ft2232_layout "olimex-jtag"
-ft2232_vid_pid 0x15BA 0x0003
-jtag_speed 2
-jtag_nsrst_delay 200
-jtag_ntrst_delay 200
diff --git a/tools/jtag_openocd/interface-busblaster.cfg b/tools/jtag_openocd/interface-busblaster.cfg
deleted file mode 100644
index bd1df2c5f..000000000
--- a/tools/jtag_openocd/interface-busblaster.cfg
+++ /dev/null
@@ -1,10 +0,0 @@
-# Commands specific to the Bus Blaster
-interface ftdi
-ftdi_device_desc "Dual RS232-HS"
-ftdi_vid_pid 0x0403 0x6010
-
-ftdi_layout_init 0x0c08 0x0f1b
-ftdi_layout_signal nTRST -data 0x0100 -noe 0x0400
-ftdi_layout_signal nSRST -data 0x0200 -noe 0x0800
-
-adapter_khz 1000
diff --git a/tools/jtag_openocd/interface-buspirate.cfg b/tools/jtag_openocd/interface-buspirate.cfg
index 8eccadd79..cb14b2365 100644
--- a/tools/jtag_openocd/interface-buspirate.cfg
+++ b/tools/jtag_openocd/interface-buspirate.cfg
@@ -1,10 +1,8 @@
 # Commands specific to the BusPirate
-interface buspirate
-buspirate_port /dev/ttyUSB0
-adapter_khz 1000
 
-# Communication speed
-buspirate_speed normal # or fast
+source [find interface/buspirate.cfg]
+
+buspirate_port /dev/ttyUSB0
 
 # Voltage regulator: enabled = 1 or disabled = 0
 buspirate_vreg 1
diff --git a/tools/jtag_openocd/interface-c232hm.cfg b/tools/jtag_openocd/interface-c232hm.cfg
index f4d0f471a..af37913de 100644
--- a/tools/jtag_openocd/interface-c232hm.cfg
+++ b/tools/jtag_openocd/interface-c232hm.cfg
@@ -11,13 +11,4 @@
 # Black  <> GND
 # Red    <> 3.3   (don't connect if C232HM-EDSL-0! power via USB instead)
 
-interface ftdi
-#ftdi_device_desc "C232HM-DDHSL-0"
-#ftdi_device_desc "C232HM-EDHSL-0"
-ftdi_vid_pid 0x0403 0x6014
-
-ftdi_layout_init 0x0008 0x400b
-ftdi_layout_signal LED -ndata 0x4000
-
-transport select jtag
-adapter_khz 1000
+source [find interface/ftdi/c232hm.cfg]
diff --git a/tools/jtag_openocd/interface-jlink.cfg b/tools/jtag_openocd/interface-jlink.cfg
deleted file mode 100644
index 011cb7844..000000000
--- a/tools/jtag_openocd/interface-jlink.cfg
+++ /dev/null
@@ -1,4 +0,0 @@
-# Commands specific to the Segger J-Link
-interface jlink
-transport select jtag
-adapter_khz 1000
diff --git a/tools/jtag_openocd/interface-jtagkey.cfg b/tools/jtag_openocd/interface-jtagkey.cfg
deleted file mode 100644
index 420e6e97e..000000000
--- a/tools/jtag_openocd/interface-jtagkey.cfg
+++ /dev/null
@@ -1,8 +0,0 @@
-# Commands specific to the Amontec JTAGKey
-interface ft2232
-ft2232_device_desc "Amontec JTAGkey A"
-ft2232_layout jtagkey
-ft2232_vid_pid 0x0403 0xcff8
-jtag_khz 200
-jtag_nsrst_delay 200
-jtag_ntrst_delay 200
diff --git a/tools/jtag_openocd/interface-raspberrypi.cfg b/tools/jtag_openocd/interface-raspberrypi.cfg
index 984afe41b..6cb9af881 100644
--- a/tools/jtag_openocd/interface-raspberrypi.cfg
+++ b/tools/jtag_openocd/interface-raspberrypi.cfg
@@ -12,26 +12,7 @@
 #  6     <> GND
 #  1     <> 3.3
 
-interface bcm2835gpio
-
-# This file is meant for first versions of Raspberry Pi
-# You can check yours with:
-# dd if=/proc/device-tree/soc/ranges bs=4 skip=1 count=1 2>/dev/null|xxd -p
-# if it returns 20000000, you're fine
-# if it returns 3F000000, use interface-raspberrypi2.cfg
-bcm2835gpio_peripheral_base 0x20000000
-
-# Transition delay calculation: SPEED_COEFF/khz - SPEED_OFFSET
-# These depend on system clock, calibrated for stock 700MHz
-# bcm2835gpio_speed SPEED_COEFF SPEED_OFFSET
-bcm2835gpio_speed_coeffs 113714 28
-
-# Each of the JTAG lines need a gpio number set: tck tms tdi tdo
-# Header pin numbers: 23 22 19 21
-bcm2835gpio_jtag_nums 11 25 10 9
+source [find interface/raspberrypi-native.cfg]
 
 bcm2835gpio_srst_num 18
 reset_config srst_only srst_push_pull
-
-transport select jtag
-adapter_khz 1000
diff --git a/tools/jtag_openocd/interface-raspberrypi2.cfg b/tools/jtag_openocd/interface-raspberrypi2.cfg
index dc97479d5..52cb74ea9 100644
--- a/tools/jtag_openocd/interface-raspberrypi2.cfg
+++ b/tools/jtag_openocd/interface-raspberrypi2.cfg
@@ -12,26 +12,7 @@
 #  6     <> GND
 #  1     <> 3.3
 
-interface bcm2835gpio
-
-# This file is meant for recent versions of Raspberry Pi
-# You can check yours with:
-# dd if=/proc/device-tree/soc/ranges bs=4 skip=1 count=1 2>/dev/null|xxd -p
-# if it returns 20000000, use interface-raspberrypi.cfg
-# if it returns 3F000000, you're fine
-bcm2835gpio_peripheral_base 0x3F000000
-
-# Transition delay calculation: SPEED_COEFF/khz - SPEED_OFFSET
-# These depend on system clock, calibrated for stock 700MHz
-# bcm2835gpio_speed SPEED_COEFF SPEED_OFFSET
-bcm2835gpio_speed_coeffs 146203 36
-
-# Each of the JTAG lines need a gpio number set: tck tms tdi tdo
-# Header pin numbers: 23 22 19 21
-bcm2835gpio_jtag_nums 11 25 10 9
+source [find interface/raspberrypi2-native.cfg]
 
 bcm2835gpio_srst_num 18
 reset_config srst_only srst_push_pull
-
-transport select jtag
-adapter_khz 1000
diff --git a/tools/jtag_openocd/interface-shikra.cfg b/tools/jtag_openocd/interface-shikra.cfg
deleted file mode 100644
index ba4b21419..000000000
--- a/tools/jtag_openocd/interface-shikra.cfg
+++ /dev/null
@@ -1,6 +0,0 @@
-# Commands specific to the Shikra
-interface ftdi
-transport select jtag
-ftdi_vid_pid 0x0403 0x6014
-ftdi_layout_init 0x0c08 0x0f1b
-adapter_khz 2000
diff --git a/tools/jtag_openocd/interface-wiggler.cfg b/tools/jtag_openocd/interface-wiggler.cfg
deleted file mode 100644
index ce9a1da06..000000000
--- a/tools/jtag_openocd/interface-wiggler.cfg
+++ /dev/null
@@ -1,7 +0,0 @@
-# Commands specific to the Wiggler
-interface parport
-parport_port 0x378
-parport_cable wiggler
-jtag_speed 0
-jtag_nsrst_delay 200
-jtag_ntrst_delay 200
diff --git a/tools/jtag_openocd/openocd_configuration.sample b/tools/jtag_openocd/openocd_configuration.sample
index 466e28d9b..10262de65 100644
--- a/tools/jtag_openocd/openocd_configuration.sample
+++ b/tools/jtag_openocd/openocd_configuration.sample
@@ -1,7 +1,34 @@
 CONFIG_GEN=general.cfg
-CONFIG_CHIP=chip-at91sam7s.cfg
+CONFIG_BOARD=board-at91sam7s.cfg
 IMAGE=../../recovery/proxmark3_recovery.bin
 DUMP="dump_$(date +'%Y%m%d-%H%M%S').bin"
 
-# Example using Segger Jlink:
-CONFIG_IF=interface-jlink.cfg
+# One can use openocd-provided interfaces or local interface files
+# Here are a few examples
+
+# Segger Jlink:
+CONFIG_IF=interface/jlink.cfg
+
+# Raspberry Pi models Pi1, Pi2 and Pi Zero (read interface-raspberrypi.cfg for pinout)
+#CONFIG_IF=interface-raspberrypi.cfg
+
+# Raspberry Pi models 2+ and above (read interface-raspberrypi2.cfg for pinout)
+#CONFIG_IF=interface-raspberrypi2.cfg
+
+# DP BusBlaster:
+#CONFIG_IF=interface/ftdi/dp_busblaster.cfg
+
+# BusPirate:
+#CONFIG_IF=interface-buspirate.cfg
+
+# C232HM-DDHSL-0 and C232HM-EDSL-0 (beware! read interface-c232hm.cfg instructions)
+#CONFIG_IF=interface-c232hm.cfg
+
+# Olimex ARM-USB-OCD Dongle:
+#CONFIG_IF=interface/ftdi/olimex-arm-usb-ocd.cfg
+
+# Amontec JTAGKey:
+#CONFIG_IF=interface/ftdi/jtagkey.cfg
+
+# Wiggler:
+#CONFIG_IF=interface/parport.cfg
diff --git a/tools/jtag_openocd/openocd_flash_dump.sh b/tools/jtag_openocd/openocd_flash_dump.sh
index 4791b9112..040c8530c 100755
--- a/tools/jtag_openocd/openocd_flash_dump.sh
+++ b/tools/jtag_openocd/openocd_flash_dump.sh
@@ -7,4 +7,4 @@ if [ -e "$DUMP" ]; then
     echo "$DUMP exists already. Abort!"
     exit 1
 fi
-openocd -f $CONFIG_GEN -f $CONFIG_IF -f $CONFIG_CHIP -c "init;halt;dump_image $DUMP 0x100000 0x80000;exit"
+openocd -f $CONFIG_GEN -f $CONFIG_IF -f $CONFIG_BOARD -c "init;halt;dump_image $DUMP 0x100000 0x80000;exit"
diff --git a/tools/jtag_openocd/openocd_flash_recovery.sh b/tools/jtag_openocd/openocd_flash_recovery.sh
index 490cf4abd..d902274db 100755
--- a/tools/jtag_openocd/openocd_flash_recovery.sh
+++ b/tools/jtag_openocd/openocd_flash_recovery.sh
@@ -7,4 +7,4 @@ if [ ! -e "$IMAGE" ]; then
     echo "$IMAGE missing. Abort!"
     exit 1
 fi
-openocd -f $CONFIG_GEN -f $CONFIG_IF -f $CONFIG_CHIP -c "init;halt;flash erase_sector 0 0 15;flash erase_sector 1 0 15;flash write_image $IMAGE 0x100000;exit"
+openocd -f $CONFIG_GEN -f $CONFIG_IF -f $CONFIG_BOARD -c "init;halt;flash erase_sector 0 0 15;flash erase_sector 1 0 15;flash write_image $IMAGE 0x100000;exit"
diff --git a/tools/jtag_openocd/openocd_interactive.sh b/tools/jtag_openocd/openocd_interactive.sh
index 995ee6913..c4f7e4142 100755
--- a/tools/jtag_openocd/openocd_interactive.sh
+++ b/tools/jtag_openocd/openocd_interactive.sh
@@ -6,4 +6,4 @@ cd $(dirname "$0")
 echo "*********************************************"
 echo "Connect to OpenOCD via: telnet localhost $(awk '/^telnet_port/{print$2}' $CONFIG_GEN)"
 echo "*********************************************"
-openocd -f $CONFIG_GEN -f $CONFIG_IF -f $CONFIG_CHIP
+openocd -f $CONFIG_GEN -f $CONFIG_IF -f $CONFIG_BOARD

From 7034aa525737cf4f62065c79b2edcb3209f29013 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Thu, 4 Feb 2021 14:02:35 +0100
Subject: [PATCH 494/682] openocd: revert to deprecated adapter_khz

---
 tools/jtag_openocd/board-at91sam7s.cfg | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/jtag_openocd/board-at91sam7s.cfg b/tools/jtag_openocd/board-at91sam7s.cfg
index 960c1461b..9f570632a 100644
--- a/tools/jtag_openocd/board-at91sam7s.cfg
+++ b/tools/jtag_openocd/board-at91sam7s.cfg
@@ -29,4 +29,6 @@ sam7x.cpu configure -work-area-virt 0 -work-area-phys 0x00200000 -work-area-size
 flash bank sam7x.flash.0 at91sam7 0 0 0 0 sam7x.cpu 0 0 0 0 0 0 0 18432
 flash bank sam7x.flash.1 at91sam7 0 0 0 0 sam7x.cpu 1 0 0 0 0 0 0 18432
 transport select jtag
-adapter speed 1000
+# Since some 0.10.0 versions, "adapter_khz" is deprecated in favor of "adapter speed" but there are also some 0.10.0 not recognizing "adapter speed" so we'll stick to "adapter_khz" for now...
+# adapter speed 1000
+adapter_khz 1000

From 6c31cda33bd2610dbcd51e97665ff5262853c3f2 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Thu, 4 Feb 2021 14:49:15 +0100
Subject: [PATCH 495/682] jtag notes

---
 doc/jtag_notes.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/jtag_notes.md b/doc/jtag_notes.md
index f7392d53f..9029958e6 100644
--- a/doc/jtag_notes.md
+++ b/doc/jtag_notes.md
@@ -8,7 +8,7 @@ The RDV4 repository contains helper scripts for JTAG flashing.
 
 * Get OpenOCD, e.g.: `apt-get install openocd`
 * Create `tools/jtag_openocd/openocd_configuration` by copying [`tools/jtag_openocd/openocd_configuration.sample`](/tools/jtag_openocd/openocd_configuration.sample)
-* Tune it to fit your JTAG tool: adapt `CONFIG_IF` to refer to the `interface-*.cfg` file corresponding to your JTAG tool. By default `openocd_configuration.sample` is set up to work with the J-Link.
+* Tune it to fit your JTAG tool: adapt `CONFIG_IF` to refer to your JTAG tool. `openocd_configuration.sample` contains several examples and is set up by default to work with the J-Link.
 * Wire the Proxmark3 to the JTAG tool. How to do it depends on the tool. See below for examples. **Warning:** don't plug the Proxmark3 on USB if the tool delivers already the voltage to the Proxmark3, which is most probably the case.
 * Then just run
 
@@ -25,7 +25,7 @@ For advanced usages there are also `openocd_flash_dump.sh` for dumping the conte
 
 The RDV4 JTAG header is quite smaller compared to other Proxmark3 platforms.  
 If you're using a J-Link, there is a [convenient adapter](https://github.com/RfidResearchGroup/proxmark3/wiki/Tools#jtag-adapter) made by Proxgrind.  
-You can also make yours with some 1.27mm headers (look for `1.27mm header` on Aliexpress) or Pogo pins.
+You can also make yours with some 1.27mm headers (look for `1.27mm header` on Aliexpress) or Pogo pins or buy an already made clip, e.g. search `dykb clamp` on Aliexpress and take a 1.27mm single-row 6P version.
 
 ## JLink pinout
 

From 2a17cb554525c40aad7f93fc9820b48f7392891f Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 4 Feb 2021 22:01:23 +0100
Subject: [PATCH 496/682] lf cmdread - now uses cliparser.  Had to change the
 "extra" param structure to fit.\n lf config - now has a reset param

---
 client/src/cmdlf.c | 232 ++++++++++++++++++++++-----------------------
 1 file changed, 112 insertions(+), 120 deletions(-)

diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index a4495f3f2..2f5384e36 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -64,36 +64,6 @@ static bool g_lf_threshold_set = false;
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_lf_cmdread(void) {
-    PrintAndLogEx(NORMAL, "Usage: lf cmdread d <delay duration> z <zero duration> o <one duration> [e <symbol> <duration>] c <cmd symbols> [q] [s #samples] [@]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h             This help");
-    PrintAndLogEx(NORMAL, "       d <duration>  delay OFF period, (0 for bitbang mode)");
-    PrintAndLogEx(NORMAL, "       z <duration>  ZERO time period");
-    PrintAndLogEx(NORMAL, "       o <duration>  ONE time period");
-    PrintAndLogEx(NORMAL, "       e <symbol> <duration> Extra symbol definition and duration (up to %i)", LF_CMDREAD_MAX_EXTRA_SYMBOLS);
-    PrintAndLogEx(NORMAL, "       b <duration>  B period");
-    PrintAndLogEx(NORMAL, "       c <cmd>       Command symbols (0/1/...)");
-    PrintAndLogEx(NORMAL, "       q             silent (optional)");
-    PrintAndLogEx(NORMAL, "       s #samples    number of samples to collect (optional)");
-    PrintAndLogEx(NORMAL, "       @             run continuously until a key is pressed (optional)");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "       ************* " _YELLOW_("All periods in decimal and in microseconds (us)"));
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _CYAN_(" probing for Hitag 1/Hitag S") ":");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf cmdread d 50 z 116 o 166 e W 3000 c W00110"));
-    PrintAndLogEx(NORMAL, _CYAN_(" probing for Hitag 2") ":");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf cmdread d 50 z 116 o 166 e W 3000 c W11000"));
-    PrintAndLogEx(NORMAL, _CYAN_(" probing for Hitag 2, oscilloscope style") ":");
-    PrintAndLogEx(NORMAL, _YELLOW_("      data plot"));
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf cmdread d 50 z 116 o 166 e W 3000 c W11000 q s 2000 @"));
-    PrintAndLogEx(NORMAL, _CYAN_(" probing for Hitag (us)") ":");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf cmdread d 48 z 112 o 176 e W 3000 e S 240 e E 336 c W0S00000010000E"));
-    PrintAndLogEx(NORMAL, "Extras:");
-    PrintAndLogEx(NORMAL, "  use " _YELLOW_("'lf config'")" to set parameters.");
-    return PM3_SUCCESS;
-}
-
 // Informative user function.
 // loop and wait for either keyboard press or pm3 button to exit
 // if key event, send break loop cmd to Pm3
@@ -239,14 +209,51 @@ static int CmdLFTune(const char *Cmd) {
 
 /* send a LF command before reading */
 int CmdLFCommandRead(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf cmdread",
+                  "Modulate LF reader field to send command before read. All periods in microseconds.\n"
+                  " - use " _YELLOW_("`lf config`") _CYAN_(" to set parameters"),
+                  "lf cmdread -d 50 -z 116 -o 166 -e W3000 -c W00110                           --> probing for Hitag 1/S\n"
+                  "lf cmdread -d 50 -z 116 -o 166 -e W3000 -c W11000                           --> probing for Hitag 2\n"
+                  "lf cmdread -d 50 -z 116 -o 166 -e W3000 -c W11000 -q -s 2000 -@             --> probing for Hitag 2, oscilloscope style\n"
+                  "lf cmdread -d 48 -z 112 -o 176 -e W3000 -e S240 -e E336 -c W0S00000010000E  --> probing for Hitag (us)\n"
+                 );
 
-    if (!session.pm3_present) return PM3_ENOTTY;
+    char div_str[70] = {0};
+    sprintf(div_str, "Extra symbol definition and duration (up to %i)", LF_CMDREAD_MAX_EXTRA_SYMBOLS);
 
-    bool errors = false;
-    bool verbose = true;
-    bool continuous = false;
-    uint32_t samples = 0;
-    uint16_t datalen = 0;
+    void *argtable[] = {
+        arg_param_begin,
+        arg_u64_0("d", "duration", "<us>", "delay OFF period, (0 for bitbang mode)"),
+        arg_str0("c", "cmd", "<0|1|...>", "command symbols"),
+        arg_strx0("e", "extra", "<us>", div_str),
+        arg_u64_0("o", "one", "<us>", "ONE time period"),
+        arg_u64_0("z", "zero", "<us>", "ZERO time period"),
+        arg_u64_0("s", "samples", "<dec>", "number of samples to collect"),
+        arg_lit0("v", "verbose", "verbose output"),
+        arg_lit0("@", NULL, "continuous mode"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+    uint32_t delay = arg_get_u32_def(ctx, 1, 0);
+
+    int cmd_len = 128;
+    char cmd[128] = {0};
+    CLIGetStrWithReturn(ctx, 2, (uint8_t*)cmd, &cmd_len);
+
+    int extra_arg_len = 250;
+    char extra_arg[250] = {0};
+    CLIGetStrWithReturn(ctx, 3, (uint8_t*)extra_arg, &extra_arg_len);
+
+    uint16_t period_1 = arg_get_u32_def(ctx, 4, 0);
+    uint16_t period_0 = arg_get_u32_def(ctx, 5, 0);
+    uint32_t samples = arg_get_u32_def(ctx, 6, 0);
+    bool verbose = arg_get_lit(ctx, 7);
+    bool cm = arg_get_lit(ctx, 8);
+    CLIParserFree(ctx);  
+
+    if (session.pm3_present == false)
+        return PM3_ENOTTY;
 
     const uint8_t payload_header_size = 12 + (3 * LF_CMDREAD_MAX_EXTRA_SYMBOLS);
     struct p {
@@ -259,76 +266,57 @@ int CmdLFCommandRead(const char *Cmd) {
         bool     verbose : 1;
         uint8_t data[PM3_CMD_DATA_SIZE - payload_header_size];
     } PACKED payload;
+    payload.delay = delay;
+    payload.period_1 = period_1;
+    payload.period_0 = period_0;
     payload.samples = samples;
     payload.verbose = verbose;
-    uint8_t index_extra = 0;
+    memcpy(payload.data, cmd, cmd_len);
 
-    uint8_t cmdp = 0;
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_lf_cmdread();
-            case 'c':  // cmd bytes 1010
-                datalen = param_getstr(Cmd, cmdp + 1, (char *)&payload.data, sizeof(payload.data));
-                cmdp += 2;
-                break;
-            case 'd':  // delay
-                payload.delay = param_get32ex(Cmd, cmdp + 1, 0, 10);
-                cmdp += 2;
-                break;
-            case 'z':  // zero
-                payload.period_0 = param_get32ex(Cmd, cmdp + 1, 0, 10) & 0xFFFF;
-                cmdp += 2;
-                break;
-            case 'o':  // ones
-                payload.period_1 = param_get32ex(Cmd, cmdp + 1, 0, 10) & 0xFFFF;
-                cmdp += 2;
-                break;
-            case 'e':  // extra symbol definition
-                if (index_extra < LF_CMDREAD_MAX_EXTRA_SYMBOLS - 1) {
-                    payload.symbol_extra[index_extra] = param_getchar(Cmd, cmdp + 1);
-                    payload.period_extra[index_extra] = param_get32ex(Cmd, cmdp + 2, 0, 10) & 0xFFFF;
-                    index_extra++;
-                    cmdp += 3;
-                } else {
-                    PrintAndLogEx(WARNING, "Too many extra symbols, please define up to %i symbols", LF_CMDREAD_MAX_EXTRA_SYMBOLS);
-                    errors = true;
-                }
-                break;
-            case 's':
-                samples = param_get32ex(Cmd, cmdp + 1, 0, 10);
-                payload.samples = samples;
-                cmdp += 2;
-                break;
-            case 'q':
-                verbose = false;
-                payload.verbose = verbose;
-                cmdp++;
-                break;
-            case '@':
-                continuous = true;
-                cmdp++;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
+    // extra symbol definition
+    uint8_t index_extra = 0;
+    int i = 0;
+    for (; i < extra_arg_len; ) {
+
+        if (index_extra < LF_CMDREAD_MAX_EXTRA_SYMBOLS - 1) {
+            payload.symbol_extra[index_extra] = extra_arg[i];
+            int tmp = atoi(extra_arg + (i + 1));
+            payload.period_extra[index_extra] = tmp;
+            index_extra++;
+            i++;
+            while (extra_arg[i] >= 0x30 && extra_arg[i] <= 0x39)
+                i++;
+
+        } else {
+            PrintAndLogEx(WARNING, "Too many extra symbols, please define up to %i symbols", LF_CMDREAD_MAX_EXTRA_SYMBOLS);
         }
     }
 
     // bitbang mode
     if (payload.delay == 0) {
         if (payload.period_0 < 7 || payload.period_1 < 7) {
-            PrintAndLogEx(WARNING, "warning periods cannot be less than 7us in bit bang mode");
+            PrintAndLogEx(WARNING, "periods cannot be less than 7us in bit bang mode");
             return PM3_EINVARG;
         }
     }
 
-    //Validations
-    if (errors || cmdp == 0)  return usage_lf_cmdread();
-    if (continuous) {
-        PrintAndLogEx(INFO, "Press " _GREEN_("Enter") " to exit");
+    PrintAndLogEx(DEBUG, "Cmd read - settings");
+    PrintAndLogEx(DEBUG, "-------------------");
+    PrintAndLogEx(DEBUG, "delay: %u ,  zero %u , one %u , samples %u", payload.delay, payload.period_0,  payload.period_1, payload.samples);
+    PrintAndLogEx(DEBUG, "Extra symbols");
+    PrintAndLogEx(DEBUG, "-------------");
+    for (i = 0; i < LF_CMDREAD_MAX_EXTRA_SYMBOLS; i++) {
+        if (payload.symbol_extra[i] == 0x00)
+            continue;
+
+        PrintAndLogEx(DEBUG, "  %c - %u", payload.symbol_extra[i], payload.period_extra[i]);
     }
+    PrintAndLogEx(DEBUG, "data: %s", payload.data);
+
+    if (cm) {
+        PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
+    }
+
     if (verbose) {
         PrintAndLogEx(SUCCESS, "Sending command...");
     }
@@ -336,11 +324,11 @@ int CmdLFCommandRead(const char *Cmd) {
     int ret = PM3_SUCCESS;
     do {
         clearCommandBuffer();
-        SendCommandNG(CMD_LF_MOD_THEN_ACQ_RAW_ADC, (uint8_t *)&payload, payload_header_size + datalen);
+        SendCommandNG(CMD_LF_MOD_THEN_ACQ_RAW_ADC, (uint8_t *)&payload, payload_header_size + cmd_len);
 
         PacketResponseNG resp;
 
-        uint8_t i = 10;
+        i = 10;
         // 20sec wait loop
         while (!WaitForResponseTimeout(CMD_LF_MOD_THEN_ACQ_RAW_ADC, &resp, 2000) && i != 0) {
             if (verbose) {
@@ -351,25 +339,23 @@ int CmdLFCommandRead(const char *Cmd) {
         if (verbose) {
             PrintAndLogEx(NORMAL, "");
         }
-        if (resp.status == PM3_SUCCESS) {
-            if (i) {
-                if (verbose) {
-                    PrintAndLogEx(SUCCESS, "downloading response signal data");
-                }
-                getSamples(samples, false);
-                ret = PM3_SUCCESS;
-            } else {
-                PrintAndLogEx(WARNING, "timeout while waiting for reply.");
-                return PM3_ETIMEOUT;
-            }
-        } else {
+        if (resp.status != PM3_SUCCESS) {
             PrintAndLogEx(WARNING, "command failed.");
             return PM3_ESOFT;
         }
-        if (kbd_enter_pressed()) {
-            break;
+
+        if (i) {
+            if (verbose) {
+                PrintAndLogEx(SUCCESS, "downloading response signal data");
+            }
+            getSamples(samples, false);
+            ret = PM3_SUCCESS;
+        } else {
+            PrintAndLogEx(WARNING, "timeout while waiting for reply.");
+            return PM3_ETIMEOUT;
         }
-    } while (continuous);
+
+    } while (cm && kbd_enter_pressed() == false);
     return ret;
 }
 
@@ -487,7 +473,7 @@ int CmdLFConfig(const char *Cmd) {
                   _CYAN_(" - use ") _YELLOW_("`lf sniff`") _CYAN_(" performs a sniff (no active field)"),
                   "lf config                    --> shows current config\n"
                   "lf config -b 8 --125         --> samples at 125 kHz, 8 bps\n"
-                  "lf config -b 4 --134 --dec 3 --> samples at 134 kHz, averages three samples into one, stored with a resolution of 4 bits per sample"
+                  "lf config -b 4 --134 --dec 3 --> samples at 134 kHz, averages three samples into one, stored with a resolution of 4 bits per sample\n"
                   "lf config --trig 20 -s 10000 --> trigger sampling when above 20, skip 10 000 first samples after triggered\n"
                  );
 
@@ -503,6 +489,7 @@ int CmdLFConfig(const char *Cmd) {
         arg_int0(NULL, "dec", "<1-8>", "sets decimation. A value of N saves only 1 in N samples (default 1)"),
         arg_int0(NULL, "divisor", "<19-255>", div_str),
         arg_int0("f", "freq", "<47-600>", "manually set frequency in kHz"),
+        arg_lit0("r", "reset", "reset values to defaults"),
         arg_int0("s", "skip", "<dec>", "sets a number of samples to skip before capture (default 0)"),
         arg_int0("t", "trig", "<0-128>", "sets trigger threshold. 0 means no threshold"),
         arg_param_end
@@ -515,8 +502,9 @@ int CmdLFConfig(const char *Cmd) {
     int8_t dec = arg_get_int_def(ctx, 5, -1);
     int16_t div = arg_get_int_def(ctx, 6, -1);
     int16_t freq = arg_get_int_def(ctx, 7, -1);
-    int32_t skip = arg_get_int_def(ctx, 8, -1);
-    int16_t trigg = arg_get_int_def(ctx, 9, -1);
+    bool reset = arg_get_lit(ctx, 8);
+    int32_t skip = arg_get_int_def(ctx, 9, -1);
+    int16_t trigg = arg_get_int_def(ctx, 10, -1);
     CLIParserFree(ctx);  
 
     if (session.pm3_present == false) 
@@ -542,12 +530,16 @@ int CmdLFConfig(const char *Cmd) {
         .verbose = true
     };
 
-    /*
-    int8_t bps = arg_get_int_def(ctx, 4, 8);
-    int8_t dec = arg_get_int_def(ctx, 5, 1);
-    int16_t div = arg_get_int_def(ctx, 6, 95);
-    int16_t freq = arg_get_int_def(ctx, 7, 125);
-*/
+    if (reset) {
+        config.decimation = 1;
+        config.bits_per_sample = 8;
+        config.averaging = 1,
+        config.divisor = LF_DIVISOR_125;
+        config.samples_to_skip = 0;        
+        config.trigger_threshold = 0;
+        g_lf_threshold_set = false;
+    }
+
     if (use_125)
         config.divisor = LF_DIVISOR_125;
 
@@ -657,7 +649,7 @@ int CmdLFRead(const char *Cmd) {
     int ret = PM3_SUCCESS;
     do {
         ret = lf_read(verbose, samples);
-    } while (cm && !kbd_enter_pressed());
+    } while (cm && kbd_enter_pressed() == false);
     return ret;
 }
 
@@ -1524,7 +1516,7 @@ static command_t CommandTable[] = {
     {"visa2000",    CmdLFVisa2k,        AlwaysAvailable, "{ Visa2000 RFIDs...          }"},
     {"-----------", CmdHelp,            AlwaysAvailable, "--------------------- " _CYAN_("General") " ---------------------"},
     {"config",      CmdLFConfig,        IfPm3Lf,         "Get/Set config for LF sampling, bit/sample, decimation, frequency"},
-    {"cmdread",     CmdLFCommandRead,   IfPm3Lf,         "Modulate LF reader field to send command before read (all periods in microseconds)"},
+    {"cmdread",     CmdLFCommandRead,   IfPm3Lf,         "Modulate LF reader field to send command before read"},
     {"read",        CmdLFRead,          IfPm3Lf,         "Read LF tag"},
     {"search",      CmdLFfind,          AlwaysAvailable, "Read and Search for valid known tag"},
     {"sim",         CmdLFSim,           IfPm3Lf,         "Simulate LF tag from buffer"},

From 63739b25d3f4c9f4157677e88433c1b92d14ce18 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 4 Feb 2021 22:02:07 +0100
Subject: [PATCH 497/682] started to add touch nd go keygen algo from
 metrodroid

---
 client/src/cmdanalyse.c |  8 ++++++++
 common/generator.c      | 16 +++++++++++++++-
 common/generator.h      |  2 ++
 3 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdanalyse.c b/client/src/cmdanalyse.c
index 5f6860e95..eb83fdc9c 100644
--- a/client/src/cmdanalyse.c
+++ b/client/src/cmdanalyse.c
@@ -13,6 +13,7 @@
 #include <string.h>
 #include <ctype.h>        // tolower
 #include <math.h>
+#include <inttypes.h>     // PRIx64 macro
 #include "commonutil.h"   // reflect...
 #include "comms.h"        // clearCommandBuffer
 #include "cmdparser.h"    // command_t
@@ -550,6 +551,13 @@ static int CmdAnalyseA(const char *Cmd) {
         PrintAndLogEx(FAILED, "Error parsing bytes");
         return PM3_EINVARG;
     }
+
+    uint64_t key = 0;
+    res = mfc_algo_touch_one(data, 0, 0, &key);
+    if (res == PM3_SUCCESS) {
+        PrintAndLogEx(SUCCESS, "KEY A | %012" PRIx64, key);
+    }
+
     CLIParserFree(ctx);
     return PM3_SUCCESS;
 
diff --git a/common/generator.c b/common/generator.c
index 90a3d92f6..8c2927a41 100644
--- a/common/generator.c
+++ b/common/generator.c
@@ -465,7 +465,6 @@ int mfdes_kdf_input_gallagher(uint8_t *uid, uint8_t uidLen, uint8_t keyNo, uint3
     return PM3_SUCCESS;
 }
 
-
 int mfc_generate4b_nuid(uint8_t *uid, uint8_t *nuid) {
     uint16_t crc;
     uint8_t b1, b2;
@@ -481,6 +480,21 @@ int mfc_generate4b_nuid(uint8_t *uid, uint8_t *nuid) {
     return PM3_SUCCESS;
 }
 
+int mfc_algo_touch_one(uint8_t *uid, uint8_t sector, uint8_t keytype, uint64_t *key) {
+    if (uid == NULL) return PM3_EINVARG;
+    if (key == NULL) return PM3_EINVARG;
+
+    *key = (
+        (uint64_t)(uid[1] ^ uid[2] ^ uid[3]) << 40 |
+        (uint64_t)uid[1] << 32 |
+        (uint64_t)uid[2] << 24 |
+        (uint64_t)(((uid[0] + uid[1] + uid[2] + uid[3]) % 0x100) ^ uid[3]) << 16 |
+        (uint64_t)0  << 8 |
+        (uint64_t)0 
+    );
+    return PM3_SUCCESS;
+}
+
 //------------------------------------
 // Self tests
 //------------------------------------
diff --git a/common/generator.h b/common/generator.h
index 601d36fda..e0c045426 100644
--- a/common/generator.h
+++ b/common/generator.h
@@ -43,6 +43,8 @@ int mfc_algo_sky_all(uint8_t *uid, uint8_t *keys);
 
 int mfc_generate4b_nuid(uint8_t *uid, uint8_t *nuid);
 
+int mfc_algo_touch_one(uint8_t *uid, uint8_t sector, uint8_t keytype, uint64_t *key);
+
 uint32_t lf_t55xx_white_pwdgen(uint32_t id);
 
 int mfdes_kdf_input_gallagher(uint8_t *uid, uint8_t uidLen, uint8_t keyNo, uint32_t aid, uint8_t *kdfInputOut, uint8_t *kdfInputLen);

From 4da7d93c51823ebbe35dc31da761986c5e325158 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 4 Feb 2021 22:05:05 +0100
Subject: [PATCH 498/682] remove dubbles

---
 client/dictionaries/mfc_default_keys.dic | 6 ++++--
 doc/cliparser.md                         | 6 +++++-
 doc/cliparser_todo.txt                   | 4 ----
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/client/dictionaries/mfc_default_keys.dic b/client/dictionaries/mfc_default_keys.dic
index 9d5d84551..21319bc3e 100644
--- a/client/dictionaries/mfc_default_keys.dic
+++ b/client/dictionaries/mfc_default_keys.dic
@@ -1286,8 +1286,10 @@ AABAFFCC7612
 534f4c303232
 #
 # Nespresso, smart card
-# 
+# key-gen algo, these keys are for one card
 ff9a84635bd2
 6f30126ee7e4
 6039abb101bb
-f1a1239a4487
\ No newline at end of file
+f1a1239a4487
+#
+b882fd4a9f78
diff --git a/doc/cliparser.md b/doc/cliparser.md
index 1f28b9f82..a837a5afc 100644
--- a/doc/cliparser.md
+++ b/doc/cliparser.md
@@ -55,10 +55,14 @@ It will also add the `-h --help` option automatic.
     -h --help       : help
     --cn            : card number
     --fn            : facility number
-    --q5            : target is lf q5 card
+    --q5            : target is LF T5555/Q5 card
+    --em            : target is LF EM4305/4469 card
     --raw           : raw data
+    -d --data       : hex data supplied
+    -f --file       : filename supplied
     -k --key        : key supplied
     -n --keyno      : key number to use
+    -p --pwd        : password supplied
     -v --verbose    : flag when output should provide more information, not considered debug.
     -1 --buffer     : use the sample buffer
 
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 12dcc34ab..65a0d2448 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -93,10 +93,6 @@ hf mf gen3uid
 hf mf gen3blk
 hf mf gen3freeze
 hf mf ice
-lf config
-lf cmdread
-lf read
-lf sniff
 lf em 410x
 lf em 4x05
 lf em 4x50

From 7d1897cd527b97cea57e6a5224a899a247f3850f Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 4 Feb 2021 22:36:08 +0100
Subject: [PATCH 499/682] lf em 410x brute - now works without pressing enter
 every time to continue one step

---
 client/src/cmdlf.c       | 75 ++++++++++++++++++++++------------------
 client/src/cmdlf.h       |  2 +-
 client/src/cmdlfem410x.c | 26 ++++++++++++--
 3 files changed, 65 insertions(+), 38 deletions(-)

diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index 2f5384e36..86de80dbd 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -730,40 +730,8 @@ static void ChkBitstream(void) {
     }
 }
 
-//Attempt to simulate any wave in buffer (one bit per output sample)
-// converts GraphBuffer to bitstream (based on zero crossings) if needed.
-int CmdLFSim(const char *Cmd) {
-    CLIParserContext *ctx;
-    CLIParserInit(&ctx, "lf sim",
-                  "Simulate low frequency tag from graphbuffer\n"
-                  "Use " _YELLOW_("`lf config`") _CYAN_(" to set parameters"),
-                  "lf sim\n"
-                  "lf sim --gap 240 --> start simulating with 240ms gap"
-                 );
-
-    void *argtable[] = {
-        arg_param_begin,
-        arg_u64_0("g", "gap", "<ms>", "start gap in microseconds"),
-        arg_param_end
-    };
-    CLIExecWithReturn(ctx, Cmd, argtable, true);
-    uint16_t gap = arg_get_u32_def(ctx, 1, 0);
-    CLIParserFree(ctx); 
-
-    if (session.pm3_present == false) {
-        PrintAndLogEx(DEBUG, "DEBUG: no proxmark present");
-        return PM3_ENOTTY;
-    }
-
-    // sanity check
-    if (GraphTraceLen < 20) {
-        PrintAndLogEx(ERR, "No data in Graphbuffer");
-        return PM3_ENODATA;
-    }
-
-    // convert to bitstream if necessary
-    ChkBitstream();
-
+// Uploads GraphBuffer to device, in order to be used for LF SIM.
+int lfsim_upload_gb(void) {
     PrintAndLogEx(DEBUG, "DEBUG: Uploading %zu bytes", GraphTraceLen);
 
     struct pupload {
@@ -802,9 +770,48 @@ int CmdLFSim(const char *Cmd) {
         PrintAndLogEx(NORMAL, "." NOLF);
         payload_up.flag = 0;
     }
+    PrintAndLogEx(NORMAL, "");
 
     // Disable fast mode before last command
     conn.block_after_ACK = false;
+    return PM3_SUCCESS;
+}
+
+//Attempt to simulate any wave in buffer (one bit per output sample)
+// converts GraphBuffer to bitstream (based on zero crossings) if needed.
+int CmdLFSim(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf sim",
+                  "Simulate low frequency tag from graphbuffer\n"
+                  "Use " _YELLOW_("`lf config`") _CYAN_(" to set parameters"),
+                  "lf sim\n"
+                  "lf sim --gap 240 --> start simulating with 240ms gap"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_u64_0("g", "gap", "<ms>", "start gap in microseconds"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    uint16_t gap = arg_get_u32_def(ctx, 1, 0);
+    CLIParserFree(ctx); 
+
+    if (session.pm3_present == false) {
+        PrintAndLogEx(DEBUG, "DEBUG: no proxmark present");
+        return PM3_ENOTTY;
+    }
+
+    // sanity check
+    if (GraphTraceLen < 20) {
+        PrintAndLogEx(ERR, "No data in Graphbuffer");
+        return PM3_ENODATA;
+    }
+
+    // convert to bitstream if necessary
+    ChkBitstream();
+
+    lfsim_upload_gb();
 
     struct p {
         uint16_t len;
diff --git a/client/src/cmdlf.h b/client/src/cmdlf.h
index 645d00627..c68289c45 100644
--- a/client/src/cmdlf.h
+++ b/client/src/cmdlf.h
@@ -36,6 +36,6 @@ int lf_read(bool verbose, uint32_t samples);
 int lf_sniff(bool verbose, uint32_t samples);
 int lf_config(sample_config *config);
 int lf_getconfig(sample_config *config);
-
+int lfsim_upload_gb(void);
 int lfsim_wait_check(uint32_t cmd);
 #endif
diff --git a/client/src/cmdlfem410x.c b/client/src/cmdlfem410x.c
index 04f0254aa..0cb6518fa 100644
--- a/client/src/cmdlfem410x.c
+++ b/client/src/cmdlfem410x.c
@@ -536,7 +536,7 @@ static int CmdEM410xBrute(const char *Cmd) {
     for (uint32_t c = 0; c < uidcnt; ++c) {
         if (kbd_enter_pressed()) {
             SendCommandNG(CMD_BREAK_LOOP, NULL, 0);
-            PrintAndLogEx(INFO, "\nAborted via keyboard!\n");
+            PrintAndLogEx(INFO, "Aborted via keyboard!\n");
             free(uidblock);
             return PM3_EOPABORTED;
         }
@@ -549,8 +549,28 @@ static int CmdEM410xBrute(const char *Cmd) {
                      );
 
         em410x_construct_emul_graph(testuid, clk);
-        CmdLFSim("");
-        msleep(delay);
+
+        lfsim_upload_gb();
+
+        struct p {
+            uint16_t len;
+            uint16_t gap;
+        } PACKED payload;
+        payload.len = GraphTraceLen;
+        payload.gap = 0;
+
+        clearCommandBuffer();
+        SendCommandNG(CMD_LF_SIMULATE, (uint8_t *)&payload, sizeof(payload));   
+        
+        PacketResponseNG resp;
+        if (WaitForResponseTimeout(CMD_LF_SIMULATE, &resp, delay)) {
+            if (resp.status == PM3_EOPABORTED) {
+                PrintAndLogEx(INFO, "Button pressed, user aborted");
+                break;
+            }
+        }
+
+//        msleep(delay);
     }
     free(uidblock);
     return PM3_SUCCESS;

From b6cac81b3bdff7d5708f0c2d160023f0e5983dd3 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 5 Feb 2021 08:58:19 +0100
Subject: [PATCH 500/682] lf t55xx wakeup - now uses cliparser

---
 client/src/cmdlft55xx.c | 90 ++++++++++++++++++++---------------------
 1 file changed, 45 insertions(+), 45 deletions(-)

diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index 54111f040..d11ed8e0d 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -250,18 +250,7 @@ static int usage_t55xx_detect(void) {
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
-static int usage_t55xx_wakup(void) {
-    PrintAndLogEx(NORMAL, "Usage:  lf t55xx wakeup [h] [r <mode>] p <password>");
-    PrintAndLogEx(NORMAL, "This commands sends the Answer-On-Request command and leaves the readerfield ON afterwards.");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     h            - this help");
-    PrintAndLogEx(NORMAL, "     p <password> - password 4bytes (8 hex symbols)");
-    print_usage_t55xx_downloadlink(T55XX_DLMODE_SINGLE, config.downlink_mode);
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf t55xx wakeup p 11223344") "  - send wakeup password");
-    return PM3_SUCCESS;
-}
+
 
 static int usage_t55xx_dangerraw(void) {
     PrintAndLogEx(NORMAL, "This command allows to emit arbitrary raw commands on T5577 and cut the field after arbitrary duration.");
@@ -1554,40 +1543,51 @@ int printConfiguration(t55xx_conf_block_t b) {
 }
 
 static int CmdT55xxWakeUp(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf t55xx wakeup",
+                  "This commands sends the Answer-On-Request command and leaves the readerfield ON afterwards",
+                  "lf t55xx wakeup -p 11223344   --> send wakeup with password\n"
+                 );
+
+    // 3 + (5 or 6)
+    void *argtable[8] = {
+        arg_param_begin,
+        arg_str1("p", "pwd", "<hex>", "password (4 hex bytes)"),
+        arg_lit0("v", "verbose", "verbose output"),
+    };
+    uint8_t idx = 3;
+    arg_add_t55xx_downloadlink(argtable, &idx, T55XX_DLMODE_SINGLE, config.downlink_mode);
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
 
     uint32_t password = 0;
-    uint8_t cmdp = 0;
-    bool errors = false;
-    uint8_t downlink_mode = config.downlink_mode;
-    bool quiet = false;
-
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_t55xx_wakup();
-            case 'p':
-                password = param_get32ex(Cmd, cmdp + 1, 0, 16);
-                cmdp += 2;
-                break;
-            case 'r':
-                downlink_mode = param_get8ex(Cmd, cmdp + 1, 0, 10);
-                if (downlink_mode > 3)
-                    downlink_mode = 0;
-
-                cmdp += 2;
-                break;
-            case 'q':
-                quiet = true;
-                cmdp++;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
+    int res = arg_get_u32_hexstr_def(ctx, 1, 0, &password);
+    if (res == 0 || res == 2) {
+        PrintAndLogEx(ERR, "Password should be 4 hex bytes");
+        CLIParserFree(ctx);
+        return PM3_EINVARG;
     }
 
-    if (errors) return usage_t55xx_wakup();
+    bool verbose = arg_get_lit(ctx, 2);    
+    bool r0 = arg_get_lit(ctx, 3);
+    bool r1 = arg_get_lit(ctx, 4);
+    bool r2 = arg_get_lit(ctx, 5);
+    bool r3 = arg_get_lit(ctx, 6);
+    CLIParserFree(ctx);
+
+    if ((r0 + r1 + r2 + r3) > 1) {
+        PrintAndLogEx(FAILED, "Error multiple downlink encoding");
+        return PM3_EINVARG;
+    }
+
+    uint8_t downlink_mode = config.downlink_mode;
+    if (r0)
+        downlink_mode = refFixedBit;
+    else if (r1)
+        downlink_mode = refLongLeading;
+    else if (r2)
+        downlink_mode = refLeading0;
+    else if (r3)
+        downlink_mode = ref1of4;
 
     struct p {
         uint32_t password;
@@ -1595,16 +1595,16 @@ static int CmdT55xxWakeUp(const char *Cmd) {
     } PACKED payload;
 
     payload.password = password;
-    payload.flags = (downlink_mode & 3) << 3;
+    payload.flags = (downlink_mode << 3);
 
     clearCommandBuffer();
     SendCommandNG(CMD_LF_T55XX_WAKEUP, (uint8_t *)&payload, sizeof(payload));
-    if (!WaitForResponseTimeout(CMD_LF_T55XX_WAKEUP, NULL, 1000)) {
+    if (WaitForResponseTimeout(CMD_LF_T55XX_WAKEUP, NULL, 1000) == false) {
         PrintAndLogEx(WARNING, "command execution time out");
         return PM3_ETIMEOUT;
     }
 
-    if (!quiet)
+    if (verbose)
         PrintAndLogEx(SUCCESS, "Wake up command sent. Try read now");
 
     return PM3_SUCCESS;

From 793b55053f5a00338a8bfe84cfc4e38c3a6d6dd9 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 5 Feb 2021 08:58:46 +0100
Subject: [PATCH 501/682] clean up

---
 client/src/cmdlfem410x.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/client/src/cmdlfem410x.c b/client/src/cmdlfem410x.c
index 0cb6518fa..0bd692ddd 100644
--- a/client/src/cmdlfem410x.c
+++ b/client/src/cmdlfem410x.c
@@ -569,8 +569,6 @@ static int CmdEM410xBrute(const char *Cmd) {
                 break;
             }
         }
-
-//        msleep(delay);
     }
     free(uidblock);
     return PM3_SUCCESS;

From 5941ee6799b75d8996a6467a4ca0ea03ef06ed99 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 5 Feb 2021 12:25:07 +0100
Subject: [PATCH 502/682] lf t55xx p1detect - too small alloc for argtable

---
 client/src/cmdlft55xx.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index d11ed8e0d..3614a0e2f 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -98,7 +98,7 @@ static void arg_add_t55xx_downloadlink(void *at[], uint8_t *idx, uint8_t show, u
     at[n++] = arg_lit0(NULL, "r3", r3);
 
     if (show == T55XX_DLMODE_ALL) {
-        char *r4 = (char *)calloc(50, sizeof(uint8_t));
+        char *r4 = (char *)calloc(56, sizeof(uint8_t));
         sprintf(r4, "try all downlink modes %s", (dl_mode_def == 4) ? "(def)" : "");
         at[n++] = arg_lit0(NULL, "all", r4);
     }
@@ -106,7 +106,6 @@ static void arg_add_t55xx_downloadlink(void *at[], uint8_t *idx, uint8_t show, u
     *idx = n;
 }
 
-
 static int usage_t55xx_config(void) {
     PrintAndLogEx(NORMAL, "Usage: lf t55xx config [c <blk0>] [d <demodulation>] [i [0/1]] [o <offset>] [Q5 [0/1]] [ST [0/1]]");
     PrintAndLogEx(NORMAL, "Options:");
@@ -3565,8 +3564,8 @@ static int CmdT55xxDetectPage1(const char *Cmd) {
                   "lf t55xx p1detect -p 11223344 --r3\n"
                  );
 
-    // 2 + (5 or 6)
-    void *argtable[7] = {
+     // 1 (help) + 2 (two user specified params) + ( 5  T55XX_DLMODE_SINGLE)
+    void *argtable[8] = {
         arg_param_begin,
         arg_lit0("1", NULL, "extract using data from graphbuffer"),
         arg_str0("p", "pwd", "<hex>", "password (4 hex bytes)"),

From 6bcf31e68c09aef9687bc2b3d3212eb858ccbf04 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 5 Feb 2021 14:32:52 +0100
Subject: [PATCH 503/682] lf t55 detect - now use cliparse .. which also makes
 it work with the wakeup command again

---
 client/src/cmdlft55xx.c | 297 +++++++++++++++++++++-------------------
 1 file changed, 153 insertions(+), 144 deletions(-)

diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index 3614a0e2f..64a6c0ae4 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -235,22 +235,6 @@ static int usage_t55xx_restore(void) {
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
-static int usage_t55xx_detect(void) {
-    PrintAndLogEx(NORMAL, "Usage:  lf t55xx detect [1] [r <mode>] [p <password>]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     1            - if set, use Graphbuffer otherwise read data from tag.");
-    PrintAndLogEx(NORMAL, "     p <password  - OPTIONAL password (8 hex characters)");
-    print_usage_t55xx_downloadlink(T55XX_DLMODE_ALL, T55XX_DLMODE_ALL);
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf t55xx detect"));
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf t55xx detect 1"));
-    PrintAndLogEx(NORMAL, _YELLOW_("      lf t55xx detect p 11223344"));
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
-
-
 static int usage_t55xx_dangerraw(void) {
     PrintAndLogEx(NORMAL, "This command allows to emit arbitrary raw commands on T5577 and cut the field after arbitrary duration.");
     PrintAndLogEx(NORMAL, _RED_("WARNING:") " this may lock definitively the tag in an unusable state!");
@@ -266,7 +250,6 @@ static int usage_t55xx_dangerraw(void) {
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
-
 static int usage_t55xx_clonehelp(void) {
     PrintAndLogEx(NORMAL, "For cloning specific techs on T55xx tags, see commands available in corresponding LF sub-menus, e.g.:");
     PrintAndLogEx(NORMAL, _GREEN_("lf awid clone"));
@@ -903,66 +886,156 @@ static void T55xx_Print_DownlinkMode(uint8_t downlink_mode) {
     PrintAndLogEx(NORMAL, msg);
 }
 
-// Define prototype to call from within detect.
-static int CmdT55xxWakeUp(const char *Cmd);
+static int CmdT55xxWakeUp(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf t55xx wakeup",
+                  "This commands sends the Answer-On-Request command and leaves the readerfield ON afterwards",
+                  "lf t55xx wakeup -p 11223344   --> send wakeup with password\n"
+                 );
+
+    // 1 (help) + 2 (two user specified params) + (5 T55XX_DLMODE_SINGLE)
+    void *argtable[3 + 5] = {
+        arg_param_begin,
+        arg_str0("p", "pwd", "<hex>", "password (4 hex bytes)"),
+        arg_lit0("v", "verbose", "verbose output"),
+    };
+    uint8_t idx = 3;
+    arg_add_t55xx_downloadlink(argtable, &idx, T55XX_DLMODE_SINGLE, config.downlink_mode);
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    uint32_t password = 0;
+    int res = arg_get_u32_hexstr_def_nlen(ctx, 2, 0, &password, 4, true);
+    if (res == 0 || res == 2) {
+        PrintAndLogEx(ERR, "Password should be 4 hex bytes");
+        CLIParserFree(ctx);
+        return PM3_EINVARG;
+    }
+
+    bool verbose = arg_get_lit(ctx, 2);    
+    bool r0 = arg_get_lit(ctx, 3);
+    bool r1 = arg_get_lit(ctx, 4);
+    bool r2 = arg_get_lit(ctx, 5);
+    bool r3 = arg_get_lit(ctx, 6);
+    CLIParserFree(ctx);
+
+    if ((r0 + r1 + r2 + r3) > 1) {
+        PrintAndLogEx(FAILED, "Error multiple downlink encoding");
+        return PM3_EINVARG;
+    }
+
+    uint8_t downlink_mode = config.downlink_mode;
+    if (r0)
+        downlink_mode = refFixedBit;
+    else if (r1)
+        downlink_mode = refLongLeading;
+    else if (r2)
+        downlink_mode = refLeading0;
+    else if (r3)
+        downlink_mode = ref1of4;
+
+    struct p {
+        uint32_t password;
+        uint8_t flags;
+    } PACKED payload;
+
+    payload.password = password;
+    payload.flags = (downlink_mode << 3);
+
+    clearCommandBuffer();
+    SendCommandNG(CMD_LF_T55XX_WAKEUP, (uint8_t *)&payload, sizeof(payload));
+    if (WaitForResponseTimeout(CMD_LF_T55XX_WAKEUP, NULL, 1000) == false) {
+        PrintAndLogEx(WARNING, "command execution time out");
+        return PM3_ETIMEOUT;
+    }
+
+    if (verbose)
+        PrintAndLogEx(SUCCESS, "Wake up command sent. Try read now");
+
+    return PM3_SUCCESS;
+}
 
 static int CmdT55xxDetect(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf t55xx detect",
+                  "Try detecting the tag modulation from reading the configuration block",
+                  "lf t55xx detect\n"
+                  "lf t55xx detect -1\n"
+                  "lf t55xx detect -p 11223344\n"
+                 );
+
+    // 1 (help) + 2 (two user specified params) + (6 T55XX_DLMODE_ALL)
+    void *argtable[3 + 6] = {
+        arg_param_begin,        
+        arg_lit0("1", NULL, "extract using data from graphbuffer"),
+        arg_str0("p", "pwd", "<hex>", "password (4 hex bytes)"),
+    };
+    uint8_t idx = 3;
+    arg_add_t55xx_downloadlink(argtable, &idx, T55XX_DLMODE_ALL, config.downlink_mode);
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    bool use_gb = arg_get_lit(ctx, 1);
 
-    bool errors = false;
-    bool useGB = false;
     bool usepwd = false;
+    uint64_t password = -1;
+    uint32_t tmp_pwd = 0;
+    int res = arg_get_u32_hexstr_def_nlen(ctx, 2, 0, &tmp_pwd, 4, true);
+    if (res == 0 || res == 2) {
+        PrintAndLogEx(ERR, "Password should be 4 hex bytes");
+        CLIParserFree(ctx);
+        return PM3_EINVARG;
+    }
+    if (res == 1) {
+        usepwd = true;
+        password = tmp_pwd;
+    }
+
+    bool r0 = arg_get_lit(ctx, 3);
+    bool r1 = arg_get_lit(ctx, 4);
+    bool r2 = arg_get_lit(ctx, 5);
+    bool r3 = arg_get_lit(ctx, 6);
+    bool ra = arg_get_lit(ctx, 7);
+    CLIParserFree(ctx);
+
+    if ((r0 + r1 + r2 + r3 + ra) > 1) {
+        PrintAndLogEx(FAILED, "Error multiple downlink encoding");
+        return PM3_EINVARG;
+    }
+
+    bool try_all_dl_modes = false;
+    uint8_t downlink_mode = config.downlink_mode;
+    if (r0)
+        downlink_mode = refFixedBit;
+    else if (r1)
+        downlink_mode = refLongLeading;
+    else if (r2)
+        downlink_mode = refLeading0;
+    else if (r3)
+        downlink_mode = ref1of4;
+
+    if (ra)
+        try_all_dl_modes = true;
+
     bool try_with_pwd = false;
-    bool try_all_dl_modes = true;
     bool found = false;
     bool usewake = false;
-    uint64_t password = -1;
-    uint8_t cmdp = 0;
-    uint8_t downlink_mode = 0;
-    char wakecmd[20] = { 0x00 };
-    struct timespec sleepperiod;
 
     // Setup the 90ms time value to sleep for after the wake, to allow delay init to complete (~70ms)
+    struct timespec sleepperiod;
     sleepperiod.tv_sec = 0;
     sleepperiod.tv_nsec = 90000000;
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_t55xx_detect();
-            case 'p':
-                password = param_get32ex(Cmd, cmdp + 1, 0, 16);
-                sprintf(wakecmd, "p %08x q", (uint32_t)(password & 0xFFFFFFFF));
-                usepwd = true;
-                cmdp += 2;
-                break;
-            case '1':
-                useGB = true;
-                cmdp++;
-                break;
-            case 'r':
-                downlink_mode = param_get8ex(Cmd, cmdp + 1, 0, 10);
-                if (downlink_mode <= 3) try_all_dl_modes = false; // User selected ONLY 1 so honor.
-                if (downlink_mode == 4) try_all_dl_modes = true;
-                if (downlink_mode > 3) downlink_mode = 0;
-                cmdp += 2;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
-    }
-    if (errors) return usage_t55xx_detect();
-
-
     // detect called so clear data blocks
     T55x7_ClearAllBlockData();
 
     // sanity check.
-    if (SanityOfflineCheck(useGB) != PM3_SUCCESS)
+    if (SanityOfflineCheck(use_gb) != PM3_SUCCESS)
         return PM3_ESOFT;
 
-    if (useGB == false) {
+    if (use_gb == false) {
+
+        char wakecmd[20] = { 0x00 };
+        sprintf(wakecmd, "-p %08" PRIx64, password);
+
         // do ... while not found and not yet tried with wake (for AOR or Init Delay)
         do {
             // do ... while to check without password then loop back if password supplied
@@ -975,7 +1048,7 @@ static int CmdT55xxDetect(const char *Cmd) {
                             if (try_with_pwd)
                                 CmdT55xxWakeUp(wakecmd);
                             else
-                                CmdT55xxWakeUp("q");
+                                CmdT55xxWakeUp("");
                             // sleep 90 ms
                             nanosleep(&sleepperiod, &sleepperiod);
                         }
@@ -987,7 +1060,6 @@ static int CmdT55xxDetect(const char *Cmd) {
                             continue;
 
                         found = true;
-
                         break;
                     }
                 } else {
@@ -996,7 +1068,7 @@ static int CmdT55xxDetect(const char *Cmd) {
                         if (try_with_pwd)
                             CmdT55xxWakeUp(wakecmd);
                         else
-                            CmdT55xxWakeUp("q");
+                            CmdT55xxWakeUp("");
                         // sleep 90 ms
                         nanosleep(&sleepperiod, &sleepperiod);
                     }
@@ -1007,7 +1079,7 @@ static int CmdT55xxDetect(const char *Cmd) {
                 }
 
                 // toggle so we loop back if not found and try with pwd
-                if (!found && usepwd)
+                if (found == false && usepwd)
                     try_with_pwd = !try_with_pwd;
 
                 // force exit as detect block has been found
@@ -1017,7 +1089,7 @@ static int CmdT55xxDetect(const char *Cmd) {
             } while (try_with_pwd);
             // Toggle so we loop back and try with wakeup.
             usewake = !usewake;
-        } while (!found && usewake);
+        } while (found == false && usewake);
     } else {
         found = t55xxTryDetectModulation(downlink_mode, T55XX_PrintConfig);
     }
@@ -1541,74 +1613,6 @@ int printConfiguration(t55xx_conf_block_t b) {
     return PM3_SUCCESS;
 }
 
-static int CmdT55xxWakeUp(const char *Cmd) {
-    CLIParserContext *ctx;
-    CLIParserInit(&ctx, "lf t55xx wakeup",
-                  "This commands sends the Answer-On-Request command and leaves the readerfield ON afterwards",
-                  "lf t55xx wakeup -p 11223344   --> send wakeup with password\n"
-                 );
-
-    // 3 + (5 or 6)
-    void *argtable[8] = {
-        arg_param_begin,
-        arg_str1("p", "pwd", "<hex>", "password (4 hex bytes)"),
-        arg_lit0("v", "verbose", "verbose output"),
-    };
-    uint8_t idx = 3;
-    arg_add_t55xx_downloadlink(argtable, &idx, T55XX_DLMODE_SINGLE, config.downlink_mode);
-    CLIExecWithReturn(ctx, Cmd, argtable, true);
-
-    uint32_t password = 0;
-    int res = arg_get_u32_hexstr_def(ctx, 1, 0, &password);
-    if (res == 0 || res == 2) {
-        PrintAndLogEx(ERR, "Password should be 4 hex bytes");
-        CLIParserFree(ctx);
-        return PM3_EINVARG;
-    }
-
-    bool verbose = arg_get_lit(ctx, 2);    
-    bool r0 = arg_get_lit(ctx, 3);
-    bool r1 = arg_get_lit(ctx, 4);
-    bool r2 = arg_get_lit(ctx, 5);
-    bool r3 = arg_get_lit(ctx, 6);
-    CLIParserFree(ctx);
-
-    if ((r0 + r1 + r2 + r3) > 1) {
-        PrintAndLogEx(FAILED, "Error multiple downlink encoding");
-        return PM3_EINVARG;
-    }
-
-    uint8_t downlink_mode = config.downlink_mode;
-    if (r0)
-        downlink_mode = refFixedBit;
-    else if (r1)
-        downlink_mode = refLongLeading;
-    else if (r2)
-        downlink_mode = refLeading0;
-    else if (r3)
-        downlink_mode = ref1of4;
-
-    struct p {
-        uint32_t password;
-        uint8_t flags;
-    } PACKED payload;
-
-    payload.password = password;
-    payload.flags = (downlink_mode << 3);
-
-    clearCommandBuffer();
-    SendCommandNG(CMD_LF_T55XX_WAKEUP, (uint8_t *)&payload, sizeof(payload));
-    if (WaitForResponseTimeout(CMD_LF_T55XX_WAKEUP, NULL, 1000) == false) {
-        PrintAndLogEx(WARNING, "command execution time out");
-        return PM3_ETIMEOUT;
-    }
-
-    if (verbose)
-        PrintAndLogEx(SUCCESS, "Wake up command sent. Try read now");
-
-    return PM3_SUCCESS;
-}
-
 static int CmdT55xxWriteBlock(const char *Cmd) {
     uint8_t block = 0xFF;    // default to invalid block
     uint32_t data = 0;       // default to blank Block
@@ -2867,8 +2871,8 @@ static int CmdT55xxWipe(const char *Cmd) {
                   "lf t55xx wipe -p 11223344   -> wipes a T55x7 tag, config block 0x000880E0, using pwd"
                  );
 
-    // 4 + (5 or 6)
-    void *argtable[9] = {
+    // 1 (help) + 3 (three user specified params) + (5 T55XX_DLMODE_SINGLE)
+    void *argtable[4 + 5] = {
         arg_param_begin,
         arg_str0("c", "cfg", "<hex>", "configuration block0 (4 hex bytes)"),
         arg_str0("p", "pwd", "<hex>", "password (4 hex bytes)"),
@@ -2978,11 +2982,14 @@ static int CmdT55xxChkPwds(const char *Cmd) {
                   "lf t55xx chk --em aa11223344        -> try known pwdgen algo from some cloners based on EM4100 ID"
                  );
 
-   // Calculate size of argtable accordingly:
-   // 1 (help) + 3 (three user specified params) + ( 5 or 6  T55XX_DLMODE)
-   // 4 + (T55XX_DLMODE_xxx 5)
-   // 4 + (T55XX_DLMODE_ALL 6) == 10
-   void *argtable[10] = {
+    /*
+      Calculate size of argtable accordingly:
+      1 (help) + 3 (three user specified params) + ( 5 or 6  T55XX_DLMODE)
+      start index to call arg_add_t55xx_downloadlink() is 4 (1 + 3) given the above sample
+    */
+
+   // 1 (help) + 3 (three user specified params) + (6 T55XX_DLMODE_ALL)
+   void *argtable[4 + 6] = {
         arg_param_begin,
         arg_lit0("m", "fm", "use dictionary from flash memory (RDV4)"),
         arg_str0("f", "file", "<filename>", "file name"),
@@ -3198,6 +3205,7 @@ static int CmdT55xxBruteForce(const char *Cmd) {
                   "lf t55xx bruteforce --r2 -s aaaaaa77 -e aaaaaa99\n"
                  );
 
+     // 1 (help) + 2 (two user specified params) + (6 T55XX_DLMODE_ALL)
     void *argtable[3 + 6] = {
         arg_param_begin,
         arg_str1("s", "start", "<hex>", "search start password (4 hex bytes)"),
@@ -3324,8 +3332,8 @@ static int CmdT55xxRecoverPW(const char *Cmd) {
                   "lf t55xx recoverpw -p 11223344 --r3\n"
                  );
 
-    // 2 + (5 or 6)
-    void *argtable[8] = {
+     // 1 (help) + 1 (one user specified params) + (6 T55XX_DLMODE_ALL)
+    void *argtable[2 + 6] = {
         arg_param_begin,
         arg_str0("p", "pwd", "<hex>", "password (4 hex bytes)"),
     };
@@ -3564,8 +3572,8 @@ static int CmdT55xxDetectPage1(const char *Cmd) {
                   "lf t55xx p1detect -p 11223344 --r3\n"
                  );
 
-     // 1 (help) + 2 (two user specified params) + ( 5  T55XX_DLMODE_SINGLE)
-    void *argtable[8] = {
+     // 1 (help) + 2 (two user specified params) + (5 T55XX_DLMODE_SINGLE)
+    void *argtable[3 + 5] = {
         arg_param_begin,
         arg_lit0("1", NULL, "extract using data from graphbuffer"),
         arg_str0("p", "pwd", "<hex>", "password (4 hex bytes)"),
@@ -3662,6 +3670,7 @@ static int CmdT55xxSetDeviceConfig(const char *Cmd) {
                   "lf t55xx deviceconfig -a 55 -b 14 -c 21 -d 30          -> default EM4305"
                  );
 
+     // 1 (help) + 9 (nine user specified params) + (5 T55XX_DLMODE_SINGLE)
     void *argtable[10 + 5] = {
         arg_param_begin,
         arg_int0("a", NULL, "<8..255>", "Set start gap"),
@@ -3772,7 +3781,7 @@ static int CmdT55xxProtect(const char *Cmd) {
                   "lf t55xx protect -p 11223344 -n 00000000  -> use pwd 11223344, sets new pwd 00000000"
                  );
 
-    // 4 + (5 or 6)
+    // 1 (help) + 3 (three user specified params) + (5 T55XX_DLMODE_SINGLE)
     void *argtable[4 + 5] = {
         arg_param_begin,
         arg_lit0("o", "override", "override safety check"),

From 1c576d10c86a52d4d465522f88e72ba2932fd187 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 5 Feb 2021 16:37:08 +0100
Subject: [PATCH 504/682] lf t55xx dangerraw - now uses cliparser

---
 client/src/cmdlft55xx.c | 95 +++++++++++++++--------------------------
 client/src/util.c       | 22 ++++++++--
 client/src/util.h       |  2 +
 3 files changed, 56 insertions(+), 63 deletions(-)

diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index 64a6c0ae4..6a7a2881d 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -235,21 +235,7 @@ static int usage_t55xx_restore(void) {
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
-static int usage_t55xx_dangerraw(void) {
-    PrintAndLogEx(NORMAL, "This command allows to emit arbitrary raw commands on T5577 and cut the field after arbitrary duration.");
-    PrintAndLogEx(NORMAL, _RED_("WARNING:") " this may lock definitively the tag in an unusable state!");
-    PrintAndLogEx(NORMAL, "Uncontrolled usage can easily write an invalid configuration, activate lock bits,");
-    PrintAndLogEx(NORMAL, "OTP bit, password protection bit, deactivate test-mode, lock your card forever.");
-    PrintAndLogEx(NORMAL, "Uncontrolled usage is known to the State of California to cause cancer.");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Usage:  lf t55xx dangerraw [h] [b <bitstream> t <timing>]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "     h                 - This help");
-    PrintAndLogEx(NORMAL, "     b <bitstream>     - raw bitstream");
-    PrintAndLogEx(NORMAL, "     t <timing>        - time in microseconds before dropping the field");
-    PrintAndLogEx(NORMAL, "");
-    return PM3_SUCCESS;
-}
+
 static int usage_t55xx_clonehelp(void) {
     PrintAndLogEx(NORMAL, "For cloning specific techs on T55xx tags, see commands available in corresponding LF sub-menus, e.g.:");
     PrintAndLogEx(NORMAL, _GREEN_("lf awid clone"));
@@ -1698,59 +1684,48 @@ static int CmdT55xxWriteBlock(const char *Cmd) {
 }
 
 static int CmdT55xxDangerousRaw(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "lf t55xx dangerraw",
+                  "This command allows to emit arbitrary raw commands on T5577 and cut the field after arbitrary duration.\n"
+                  "Uncontrolled usage can easily write an invalid configuration, activate lock bits,\n"
+                  "OTP bit, password protection bit, deactivate test-mode, lock your card forever.\n"
+                  _RED_("WARNING:") _CYAN_(" this may lock definitively the tag in an unusable state!"),
+                  "lf t55xx dangerraw -d 01000000000000010000100000000100000000 -t 3200\n"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1("d", "data", NULL, "raw bit string"),
+        arg_int1("t", "time", "<us>", "<0 - 200000> time in microseconds before dropping the field"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
     // supports only default downlink mode
     t55xx_test_block_t ng;
     ng.time = 0;
     ng.bitlen = 0;
     memset(ng.data, 0x00, sizeof(ng.data));
-    bool errors = false;
-    uint8_t cmdp = 0;
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_t55xx_dangerraw();
-            case 't':
-                ng.time = param_get32ex(Cmd, cmdp + 1, 0, 10);
-                if (ng.time == 0 || ng.time > 200000) {
-                    PrintAndLogEx(ERR, "Timing off 1..200000 limits, got %i", ng.time);
-                    errors = true;
-                    break;
-                }
-                cmdp += 2;
-                break;
-            case 'b': {
-                uint32_t n = param_getlength(Cmd, cmdp + 1);
-                if (n > 128) {
-                    PrintAndLogEx(ERR, "Bitstream too long, max 128 bits, got %i", n);
-                    errors = true;
-                    break;
-                }
-                for (uint8_t i = 0; i < n; i++) {
-                    char c = param_getchar_indx(Cmd, i, cmdp + 1);
-                    if (c == '0')
-                        ng.data[i] = 0;
-                    else if (c == '1')
-                        ng.data[i] = 1;
-                    else {
-                        PrintAndLogEx(ERR, "Unknown bit char '%c'", c);
-                        errors = true;
-                        break;
-                    }
-                }
-                ng.bitlen = n;
-                cmdp += 2;
-                break;
-            }
-            default:
-                PrintAndLogEx(ERR, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
-        }
+    int bin_len = 127;
+    uint8_t bin[128] = {0};
+    CLIGetStrWithReturn(ctx, 1, bin, &bin_len);
+
+    ng.time = arg_get_int_def(ctx, 2, 0);
+    CLIParserFree(ctx);
+
+    if (ng.time == 0 || ng.time > 200000) {
+        PrintAndLogEx(ERR, "Timing off 1..200000 limits, got %i", ng.time);
+        return PM3_EINVARG;
     }
-    if (errors || ng.bitlen == 0 || ng.time == 0) {
-        return usage_t55xx_dangerraw();
+
+    int bs_len = binstring2binarray(ng.data, (char*)bin, bin_len);
+    if (bs_len == 0) {
+        return PM3_EINVARG;
     }
+
+    ng.bitlen = bs_len;
+    
     PacketResponseNG resp;
     clearCommandBuffer();
     SendCommandNG(CMD_LF_T55XX_DANGERRAW, (uint8_t *)&ng, sizeof(ng));
diff --git a/client/src/util.c b/client/src/util.c
index 1dad2cd4b..0f206b9d2 100644
--- a/client/src/util.c
+++ b/client/src/util.c
@@ -806,13 +806,29 @@ int binarraytohex(char *target, const size_t targetlen, char *source, size_t src
 
 // convert binary array to human readable binary
 void binarraytobinstring(char *target, char *source,  int length) {
-    int i;
-
-    for (i = 0 ; i < length ; ++i)
+    for (int i = 0 ; i < length; ++i)
         *(target++) = *(source++) + '0';
     *target = '\0';
 }
 
+int binstring2binarray(uint8_t* target, char *source, int length) {
+    int count = 0;
+    char *start = source;
+    while (length--) {
+        char x = *(source++);
+        // convert from binary value
+        if (x >= '0' && x <= '1')
+            x -= '0';
+        else {
+            PrintAndLogEx(WARNING, "(binstring2binarray) discovered unknown character %c %d at idx %d of %s", x, x, (int16_t)(source - start), start);
+            return 0;
+        }
+        *(target++) = x;
+        count++;
+    }
+    return count;
+}
+
 // return parity bit required to match type
 uint8_t GetParity(uint8_t *bits, uint8_t type, int length) {
     int x;
diff --git a/client/src/util.h b/client/src/util.h
index 573997d61..54a0e8e80 100644
--- a/client/src/util.h
+++ b/client/src/util.h
@@ -83,6 +83,8 @@ int hextobinarray(char *target, char *source);
 int hextobinstring(char *target, char *source);
 int binarraytohex(char *target, const size_t targetlen, char *source, size_t srclen);
 void binarraytobinstring(char *target,  char *source, int length);
+int binstring2binarray(uint8_t* target, char *source, int length);
+
 uint8_t GetParity(uint8_t *bits, uint8_t type, int length);
 void wiegand_add_parity(uint8_t *target, uint8_t *source, uint8_t length);
 void wiegand_add_parity_swapped(uint8_t *target, uint8_t *source, uint8_t length);

From a168e4328f994b224de8227c35d6b960956b15ed Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 5 Feb 2021 16:37:20 +0100
Subject: [PATCH 505/682] rename a fct

---
 client/src/cmdlf.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index 86de80dbd..bfd62c013 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -719,12 +719,12 @@ int CmdLFSniff(const char *Cmd) {
     return ret;
 }
 
-static void ChkBitstream(void) {
+static void lf_chk_bitstream(void) {
     // convert to bitstream if necessary
     for (int i = 0; i < (int)(GraphTraceLen / 2); i++) {
         if (GraphBuffer[i] > 1 || GraphBuffer[i] < 0) {
             CmdGetBitStream("");
-            PrintAndLogEx(INFO, "Converted to bitstream");
+            PrintAndLogEx(INFO, "converted Graphbuffer to bitstream values (0|1)");
             break;
         }
     }
@@ -809,7 +809,7 @@ int CmdLFSim(const char *Cmd) {
     }
 
     // convert to bitstream if necessary
-    ChkBitstream();
+    lf_chk_bitstream();
 
     lfsim_upload_gb();
 

From f6bca6e3aa4e435026dcffce379c6384c79c2402 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 5 Feb 2021 16:38:29 +0100
Subject: [PATCH 506/682] text

---
 doc/cliparser_todo.txt | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 65a0d2448..c52d35d69 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -103,14 +103,11 @@ lf hitag writer
 lf hitag dump
 lf hitag cc
 lf t55xx config
-lf t55xx dangerraw
-lf t55xx detect
 lf t55xx dump
 lf t55xx info
 lf t55xx read
 lf t55xx resetread
 lf t55xx restore
 lf t55xx trace
-lf t55xx wakeup
 lf t55xx write
 script run

From 7947d2efb97341d500842ce0f8775224a7c9c8b6 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 6 Feb 2021 19:11:45 +0300
Subject: [PATCH 507/682] emrtd: Calculate document type from MRZ length

+ Add the German Aufenthaltstitel
---
 client/src/cmdhfemrtd.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 604beb68c..229f84dee 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1338,19 +1338,26 @@ static int emrtd_print_ef_dg1_info(uint8_t *data, size_t datalen) {
 
     // Determine and print the document type
     if (mrz[0] == 'I' && mrz[1] == 'P') {
-        td_variant = 1;
         PrintAndLogEx(SUCCESS, "Document Type.........: " _YELLOW_("Passport Card"));
     } else if (mrz[0] == 'I') {
-        td_variant = 1;
         PrintAndLogEx(SUCCESS, "Document Type.........: " _YELLOW_("ID Card"));
     } else if (mrz[0] == 'P') {
-        td_variant = 3;
         PrintAndLogEx(SUCCESS, "Document Type.........: " _YELLOW_("Passport"));
+    } else if (mrz[0] == 'A') {
+        PrintAndLogEx(SUCCESS, "Document Type.........: " _YELLOW_("German Residency Permit"));
     } else {
-        td_variant = 1;
         PrintAndLogEx(SUCCESS, "Document Type.........: " _YELLOW_("Unknown"));
-        PrintAndLogEx(INFO, "Assuming ID-style MRZ.");
     }
+
+    if (mrzlen == 90) {
+        td_variant = 1;
+    } else if (mrzlen == 88) {
+        td_variant = 3;
+    } else {
+        PrintAndLogEx(ERR, "MRZ length (%zu) is wrong.", mrzlen);
+        return PM3_ESOFT;
+    }
+
     PrintAndLogEx(SUCCESS, "Document Form Factor..: " _YELLOW_("TD%i"), td_variant);
 
     // Print the MRZ

From ed7f623c6fd9d6bae39a44e52178532b3388f1cb Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Sat, 6 Feb 2021 19:59:03 +0100
Subject: [PATCH 508/682] increased timeout -> reliable lf search results

---
 include/em4x50.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/em4x50.h b/include/em4x50.h
index 80210cfc2..45ad04467 100644
--- a/include/em4x50.h
+++ b/include/em4x50.h
@@ -42,7 +42,7 @@
 #define EM4X50_COMMAND_STANDARD_READ        0x02 // virtual command
 
 // misc
-#define TIMEOUT                     2000
+#define TIMEOUT_CMD                 3000
 #define DUMP_FILESIZE               136
 
 #define BYTES2UINT32(x) ((x[0] << 24) | (x[1] << 16) | (x[2] << 8) | (x[3]))
@@ -62,5 +62,6 @@ typedef struct {
 
 extern bool gLogin;
 extern bool gWritePasswordProcess;
+extern uint32_t gPassword;
 
 #endif /* EM4X50_H__ */

From 94ede77573ea7176abe35fec477929f4426189f7 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Sat, 6 Feb 2021 19:59:34 +0100
Subject: [PATCH 509/682] timeout adaption

---
 client/src/cmdlfem4x50.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c
index ae99bd8a6..ea60c84b9 100644
--- a/client/src/cmdlfem4x50.c
+++ b/client/src/cmdlfem4x50.c
@@ -546,7 +546,7 @@ int em4x50_read(em4x50_data_t *etd, em4x50_word_t *out) {
     SendCommandNG(CMD_LF_EM4X50_READ, (uint8_t *)&edata, sizeof(edata));
 
     PacketResponseNG resp;
-    if (!WaitForResponseTimeout(CMD_LF_EM4X50_READ, &resp, TIMEOUT)) {
+    if (!WaitForResponseTimeout(CMD_LF_EM4X50_READ, &resp, TIMEOUT_CMD)) {
         PrintAndLogEx(WARNING, "(em4x50) timeout while waiting for reply.");
         return PM3_ETIMEOUT;
     }
@@ -654,7 +654,7 @@ int CmdEM4x50Info(const char *Cmd) {
     clearCommandBuffer();
     SendCommandNG(CMD_LF_EM4X50_INFO, (uint8_t *)&etd, sizeof(etd));
     PacketResponseNG resp;
-    if (!WaitForResponseTimeout(CMD_LF_EM4X50_INFO, &resp, TIMEOUT)) {
+    if (!WaitForResponseTimeout(CMD_LF_EM4X50_INFO, &resp, TIMEOUT_CMD)) {
         PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
         return PM3_ETIMEOUT;
     }
@@ -767,7 +767,7 @@ int CmdEM4x50Dump(const char *Cmd) {
     clearCommandBuffer();
     SendCommandNG(CMD_LF_EM4X50_INFO, (uint8_t *)&etd, sizeof(etd));
     PacketResponseNG resp;
-    if (!WaitForResponseTimeout(CMD_LF_EM4X50_INFO, &resp, TIMEOUT)) {
+    if (!WaitForResponseTimeout(CMD_LF_EM4X50_INFO, &resp, TIMEOUT_CMD)) {
         PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
         return PM3_ETIMEOUT;
     }
@@ -862,7 +862,7 @@ int CmdEM4x50Write(const char *Cmd) {
     clearCommandBuffer();
     SendCommandNG(CMD_LF_EM4X50_WRITE, (uint8_t *)&etd, sizeof(etd));
     PacketResponseNG resp;
-    if (!WaitForResponseTimeout(CMD_LF_EM4X50_WRITE, &resp, TIMEOUT)) {
+    if (!WaitForResponseTimeout(CMD_LF_EM4X50_WRITE, &resp, TIMEOUT_CMD)) {
         PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
         return PM3_ETIMEOUT;
     }
@@ -933,7 +933,7 @@ int CmdEM4x50WritePwd(const char *Cmd) {
     clearCommandBuffer();
     SendCommandNG(CMD_LF_EM4X50_WRITEPWD, (uint8_t *)&etd, sizeof(etd));
 
-    if (!WaitForResponseTimeout(CMD_LF_EM4X50_WRITEPWD, &resp, TIMEOUT)) {
+    if (!WaitForResponseTimeout(CMD_LF_EM4X50_WRITEPWD, &resp, TIMEOUT_CMD)) {
         PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
         return PM3_ETIMEOUT;
     }
@@ -989,7 +989,7 @@ int CmdEM4x50Wipe(const char *Cmd) {
     PacketResponseNG resp;
     clearCommandBuffer();
     SendCommandNG(CMD_LF_EM4X50_WRITEPWD, (uint8_t *)&etd, sizeof(etd));
-    if (!WaitForResponseTimeout(CMD_LF_EM4X50_WRITEPWD, &resp, TIMEOUT)) {
+    if (!WaitForResponseTimeout(CMD_LF_EM4X50_WRITEPWD, &resp, TIMEOUT_CMD)) {
         PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
         return PM3_ETIMEOUT;
     }
@@ -1015,7 +1015,7 @@ int CmdEM4x50Wipe(const char *Cmd) {
         etd.addresses = i << 8 | i;
         clearCommandBuffer();
         SendCommandNG(CMD_LF_EM4X50_WRITE, (uint8_t *)&etd, sizeof(etd));
-        if (!WaitForResponseTimeout(CMD_LF_EM4X50_WRITE, &resp, TIMEOUT)) {
+        if (!WaitForResponseTimeout(CMD_LF_EM4X50_WRITE, &resp, TIMEOUT_CMD)) {
             PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
             return PM3_ETIMEOUT;
         }
@@ -1110,7 +1110,7 @@ int CmdEM4x50Restore(const char *Cmd) {
         PacketResponseNG resp;
         clearCommandBuffer();
         SendCommandNG(CMD_LF_EM4X50_WRITE, (uint8_t *)&etd, sizeof(etd));
-        if (!WaitForResponseTimeout(CMD_LF_EM4X50_WRITE, &resp, TIMEOUT)) {
+        if (!WaitForResponseTimeout(CMD_LF_EM4X50_WRITE, &resp, TIMEOUT_CMD)) {
             PrintAndLogEx(NORMAL, "");
             PrintAndLogEx(WARNING, "Timeout while waiting for reply.");
             return PM3_ETIMEOUT;

From ed642855d89ec1cca0d36602651443801105bf85 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Sat, 6 Feb 2021 20:00:58 +0100
Subject: [PATCH 510/682] global parameter for standalone mode (catch pwd sent
 by reader)

---
 armsrc/Standalone/lf_tharexde.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/armsrc/Standalone/lf_tharexde.c b/armsrc/Standalone/lf_tharexde.c
index 96e8fb48d..d3c8fddc0 100644
--- a/armsrc/Standalone/lf_tharexde.c
+++ b/armsrc/Standalone/lf_tharexde.c
@@ -13,6 +13,7 @@
 #include "proxmark3_arm.h"
 #include "appmain.h"
 #include "BigBuf.h"
+#include "commonutil.h"
 #include "fpgaloader.h"
 #include "util.h"
 #include "dbprint.h"
@@ -58,10 +59,12 @@
 #define STATE_READ                      1
 #define EM4X50_TAG_WORD                 45
 #define LF_EM4X50_INPUTFILE_SIM         "lf_em4x50_simulate.eml"
+#define LF_EM4X50_LOGFILE_SIM           "lf_em4x50_tag_data.log"
 #define LF_EM4X50_LOGFILE_COLLECT       "lf_em4x50_collect.log"
 
 bool input_exists;
 bool log_exists;
+uint32_t gPassword;
 
 static void LoadDataInstructions(const char *inputfile) {
     Dbprintf("");
@@ -188,6 +191,25 @@ void RunMod(void) {
 
             em4x50_handle_commands(&command, tag);
 
+            // check if new password was found
+            if (gPassword != reflect32(tag[0])) {
+                
+                // save password to tag
+                tag[0] = reflect32(gPassword);
+                Dbprintf("received password: %08"PRIx32"", gPassword);
+                
+                // overwrite inputfile in flash memory
+                memset(entry, 0, sizeof(entry));
+
+                for (int i = 0; i < EM4X50_NO_WORDS; i++) {
+                    sprintf((char *)entry + strlen((char *)entry), "%08"PRIx32"\n", tag[i]);
+                }
+                log_exists = exists_in_spiffs(LF_EM4X50_LOGFILE_SIM);
+                Dbprintf("log_exists = %i", log_exists);
+                //append(LF_EM4X50_LOGFILE_SIM, entry, strlen((char *)entry));
+
+            }
+            
             // stop if key (pm3 button or enter key) has been pressed
             if (command == PM3_EOPABORTED) {
                 break;

From c5ac3c16f5ebb9771c077519f1186dab2e097f7b Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Sat, 6 Feb 2021 20:45:44 +0100
Subject: [PATCH 511/682] - timeout corrections - global parameter for password
 catch (used in standalone mode)

---
 armsrc/em4x50.c | 41 +++++++++++++++++++++++------------------
 1 file changed, 23 insertions(+), 18 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index 0d4df8451..7770a8819 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -61,6 +61,7 @@
 // div
 #define EM4X50_TAG_WORD                     45
 #define EM4X50_TAG_MAX_NO_BYTES             136
+#define EM4X50_TIMEOUT_PULSE_EVAL           2500
 
 int gHigh = 190;
 int gLow = 60;
@@ -72,6 +73,8 @@ bool gLogin = false;
 // compared to operations like read, write, login, so it is necessary to
 // to be able to identfiy it
 bool gWritePasswordProcess = false;
+// if reader sends a different password than "expected" -> save it
+uint32_t gPassword = 0;
 
 // extract and check parities
 // return result of parity check and extracted plain data
@@ -251,7 +254,8 @@ static bool invalid_bit(void) {
 
 static uint32_t get_pulse_length(void) {
 
-    int32_t timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD), tval = 0;
+    //int32_t timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD), tval = 0;
+    int32_t timeout = EM4X50_TIMEOUT_PULSE_EVAL, tval = 0;
 
     // iterates pulse length (low -> high -> low)
 
@@ -260,23 +264,25 @@ static uint32_t get_pulse_length(void) {
     while (sample > gLow && (timeout--))
         sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 
-    if (timeout == 0)
+    if (timeout <= 0)
         return 0;
 
     tval = GetTicks();
-    timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD);
+    //timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD);
+    timeout = EM4X50_TIMEOUT_PULSE_EVAL;
 
     while (sample < gHigh && (timeout--))
         sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 
-    if (timeout == 0)
+    if (timeout <= 0)
         return 0;
 
-    timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD);
+    //timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD);
+    timeout = EM4X50_TIMEOUT_PULSE_EVAL;
     while (sample > gLow && (timeout--))
         sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 
-    if (timeout == 0)
+    if (timeout <= 0)
         return 0;
 
     return GetTicks() - tval;
@@ -857,16 +863,16 @@ void em4x50_read(em4x50_data_t *etd) {
     LED_C_ON();
     if (get_signalproperties() && find_em4x50_tag()) {
 
-        LED_C_OFF();
-        LED_D_ON();
+            LED_C_OFF();
+            LED_D_ON();
 
-        // try to login with given password
-        if (etd->pwd_given)
-            blogin = (login(etd->password1) == PM3_SUCCESS);
+            // try to login with given password
+            if (etd->pwd_given)
+                blogin = (login(etd->password1) == PM3_SUCCESS);
 
-        // only one word has to be read -> first word read = last word read
-        if (blogin)
-            status = selective_read(etd->addresses, words);
+            // only one word has to be read -> first word read = last word read
+            if (blogin)
+                status = selective_read(etd->addresses, words);
     }
 
     LEDsoff();
@@ -1417,8 +1423,6 @@ static void em4x50_sim_send_nak(void) {
 // standard read mode process (simulation mode)
 static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
 
-    int command = 0;
-
     // extract control data
     int fwr = reflect32(tag[EM4X50_CONTROL]) & 0xFF;        // first word read
     int lwr = (reflect32(tag[EM4X50_CONTROL]) >> 8) & 0xFF; // last word read
@@ -1458,8 +1462,6 @@ static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
 // selective read mode process (simulation mode)
 static int em4x50_sim_handle_selective_read_command(uint32_t *tag) {
 
-    int command = 0;
-
     // read password
     uint32_t address = 0;
     bool addr = em4x50_sim_read_word(&address);
@@ -1530,6 +1532,9 @@ static int em4x50_sim_handle_login_command(uint32_t *tag) {
         em4x50_sim_send_nak();
         gLogin = false;
         LED_D_OFF();
+        
+        // save transmitted password for future use (e.g. standalone mode)
+        gPassword = password;
     }
     // continue with standard read mode
     return EM4X50_COMMAND_STANDARD_READ;

From a67c82ff6d526c265498004da5f316d0fcdd8f29 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Sat, 6 Feb 2021 20:48:21 +0100
Subject: [PATCH 512/682] clean up

---
 armsrc/em4x50.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index 7770a8819..91bfdef4f 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -254,7 +254,6 @@ static bool invalid_bit(void) {
 
 static uint32_t get_pulse_length(void) {
 
-    //int32_t timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD), tval = 0;
     int32_t timeout = EM4X50_TIMEOUT_PULSE_EVAL, tval = 0;
 
     // iterates pulse length (low -> high -> low)
@@ -915,7 +914,7 @@ void em4x50_reader(void) {
     int now = 0;
     uint32_t words[EM4X50_NO_WORDS] = {0x0};
 
-    em4x50_setup_read();
+     em4x50_setup_read();
 
     LED_C_ON();
     if (get_signalproperties() && find_em4x50_tag()) {

From 6dbca234873046aaeb4b6c74ac829ba5624df7e9 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 6 Feb 2021 21:39:24 +0100
Subject: [PATCH 513/682] rename hf_mfu_dumptoemulator.lua ->
 data_mfu_bin2eml.lua

---
 .../{hf_mfu_dumptoemulator.lua => data_mfu_bin2eml.lua}           | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename client/luascripts/{hf_mfu_dumptoemulator.lua => data_mfu_bin2eml.lua} (100%)

diff --git a/client/luascripts/hf_mfu_dumptoemulator.lua b/client/luascripts/data_mfu_bin2eml.lua
similarity index 100%
rename from client/luascripts/hf_mfu_dumptoemulator.lua
rename to client/luascripts/data_mfu_bin2eml.lua

From 53b2ee10dfd1ec366168204ec66384f7bf5cdace Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 6 Feb 2021 22:25:51 +0100
Subject: [PATCH 514/682] text

---
 client/luascripts/data_mf_bin2eml.lua  |  6 +++---
 client/luascripts/data_mf_bin2html.lua |  6 +++---
 client/luascripts/data_mf_eml2bin.lua  |  6 +++---
 client/luascripts/data_mf_eml2html.lua |  6 +++---
 client/luascripts/data_mfu_bin2eml.lua | 10 +++++-----
 5 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/client/luascripts/data_mf_bin2eml.lua b/client/luascripts/data_mf_bin2eml.lua
index ef48ead16..8312fc292 100644
--- a/client/luascripts/data_mf_bin2eml.lua
+++ b/client/luascripts/data_mf_bin2eml.lua
@@ -6,7 +6,7 @@ local ansicolors  = require('ansicolors')
 
 copyright = ''
 author = 'Martin Holst Swende'
-version = 'v1.0.2'
+version = 'v1.0.3'
 desc = [[
 This script takes a dumpfile from 'hf mf dump' and converts it to a format that can be used
 by the emulator
@@ -46,7 +46,7 @@ end
 ---
 -- This is only meant to be used when errors occur
 local function oops(err)
-    print('ERROR:', err)
+    print('[!!] ERROR:', err)
     core.clearCommandBuffer()
     return nil, err
 end
@@ -134,7 +134,7 @@ local function main(args)
 
     outfile:write(dumpdata:lower())
     io.close(outfile)
-    print(('Wrote an emulator-dump to the file %s'):format(output))
+    print(('[+] Wrote an emulator-dump to the file %s'):format(output))
 end
 
 
diff --git a/client/luascripts/data_mf_bin2html.lua b/client/luascripts/data_mf_bin2html.lua
index c33b4782b..f412a35e7 100644
--- a/client/luascripts/data_mf_bin2html.lua
+++ b/client/luascripts/data_mf_bin2html.lua
@@ -7,7 +7,7 @@ local ansicolors  = require('ansicolors')
 
 copyright = ''
 author = 'Martin Holst Swende'
-version = 'v1.0.2'
+version = 'v1.0.3'
 desc =[[
 This script takes a dumpfile and produces a html based dump, which is a
 bit more easily analyzed.
@@ -45,7 +45,7 @@ end
 ---
 -- This is only meant to be used when errors occur
 local function oops(err)
-    print('ERROR:', err)
+    print('[!!] ERROR:', err)
     core.clearCommandBuffer()
     return nil, err
 end
@@ -76,7 +76,7 @@ local function main(args)
     local filename, err = dumplib.convert_bin_to_html(input,output, 16)
     if err then return oops(err) end
 
-    print(('Wrote a HTML dump to the file %s'):format(filename))
+    print(('[+] Wrote a HTML dump to the file %s'):format(filename))
 end
 
 --[[
diff --git a/client/luascripts/data_mf_eml2bin.lua b/client/luascripts/data_mf_eml2bin.lua
index d31b58418..4291f13b9 100644
--- a/client/luascripts/data_mf_eml2bin.lua
+++ b/client/luascripts/data_mf_eml2bin.lua
@@ -5,7 +5,7 @@ local ansicolors = require('ansicolors')
 
 copyright = ''
 author = 'Iceman'
-version = 'v1.0.2'
+version = 'v1.0.3'
 desc =[[
 This script takes an dumpfile in EML (ASCII) format and converts it to the PM3 dumpbin file to be used with `hf mf restore`
 ]]
@@ -40,7 +40,7 @@ end
 ---
 -- This is only meant to be used when errors occur
 local function oops(err)
-    print('ERROR:', err)
+    print('[!!] ERROR:', err)
     core.clearCommandBuffer()
     return nil, err
 end
@@ -82,7 +82,7 @@ local function main(args)
     local filename, err = dumplib.convert_eml_to_bin(input,output)
     if err then return oops(err) end
 
-    ExitMsg(('Wrote a BIN dump to the file %s'):format(filename))
+    ExitMsg(('[+] Wrote a BIN dump to the file %s'):format(filename))
 end
 
 main(args)
diff --git a/client/luascripts/data_mf_eml2html.lua b/client/luascripts/data_mf_eml2html.lua
index 9b2edbe87..a77e7a6d3 100644
--- a/client/luascripts/data_mf_eml2html.lua
+++ b/client/luascripts/data_mf_eml2html.lua
@@ -7,7 +7,7 @@ local ansicolors  = require('ansicolors')
 
 copyright = ''
 author = 'Martin Holst Swende'
-version = 'v1.0.2'
+version = 'v1.0.3'
 desc = [[
 This script takes a dumpfile on EML (ASCII) format and produces a html based dump, which is a
 bit more easily analyzed.
@@ -44,7 +44,7 @@ end
 ---
 -- This is only meant to be used when errors occur
 local function oops(err)
-    print('ERROR:', err)
+    print('[!!] ERROR:', err)
     core.clearCommandBuffer()
     return nil, err
 end
@@ -75,7 +75,7 @@ local function main(args)
     local filename, err = dumplib.convert_eml_to_html(input,output)
     if err then return oops(err) end
 
-    print(('Wrote a HTML dump to the file %s'):format(filename))
+    print(('[+] Wrote a HTML dump to the file %s'):format(filename))
 end
 
 --[[
diff --git a/client/luascripts/data_mfu_bin2eml.lua b/client/luascripts/data_mfu_bin2eml.lua
index 47f52e135..eeece3b7c 100644
--- a/client/luascripts/data_mfu_bin2eml.lua
+++ b/client/luascripts/data_mfu_bin2eml.lua
@@ -6,16 +6,16 @@ local ansicolors  = require('ansicolors')
 
 copyright = ''
 author = "Martin Holst Swende \n @Marshmellow \n @iceman"
-version = 'v1.0.2'
+version = 'v1.0.4'
 desc =[[
 This script takes a dumpfile from 'hf mfu dump' and converts it to a format that can be used
 by the emulator
 ]]
 example = [[
-    script run hf_mfu_dumptoemulator -i dumpdata-foobar.bin
+    script run data_mfu_bin2eml -i dumpdata-foobar.bin
 ]]
 usage = [[
-script run hf_mfu_dumptoemulator [-i <file>] [-o <file>]
+script run data_mfu_bin2eml [-i <file>] [-o <file>]
 ]]
 arguments = [[
     -h              This help
@@ -43,7 +43,7 @@ end
 ---
 -- This is only meant to be used when errors occur
 local function oops(err)
-    print('ERROR:', err)
+    print('[!!] ERROR:', err)
     core.clearCommandBuffer()
     return nil, err
 end
@@ -133,7 +133,7 @@ local function main(args)
 
     outfile:write(dumpdata:lower())
     io.close(outfile)
-    print(('Wrote an emulator-dump to the file %s'):format(output))
+    print(('[+] Wrote an emulator-dump to the file %s'):format(output))
 end
 
 --[[

From f96a48242f920d442c352b1329f45bf59e690cc0 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sun, 7 Feb 2021 00:18:21 +0100
Subject: [PATCH 515/682] remake main screen text

---
 client/src/cmdhw.c | 159 ++++++++++++++++++++++-----------------------
 1 file changed, 78 insertions(+), 81 deletions(-)

diff --git a/client/src/cmdhw.c b/client/src/cmdhw.c
index 274dc31b3..519995867 100644
--- a/client/src/cmdhw.c
+++ b/client/src/cmdhw.c
@@ -88,7 +88,8 @@ static void lookupChipID(uint32_t iChipID, uint32_t mem_used) {
             sprintf(asBuff, "AT91SAM7S16 Rev A");
             break;
     }
-    PrintAndLogEx(NORMAL, "  --= uC: %s", asBuff);
+    PrintAndLogEx(NORMAL, "  --= uC: " _YELLOW_("%s"), asBuff);
+
     switch ((iChipID & 0xE0) >> 5) {
         case 1:
             sprintf(asBuff, "ARM946ES");
@@ -104,84 +105,7 @@ static void lookupChipID(uint32_t iChipID, uint32_t mem_used) {
             break;
     }
     PrintAndLogEx(NORMAL, "  --= Embedded Processor: %s", asBuff);
-    switch ((iChipID & 0xF00) >> 8) {
-        case 0:
-            mem_avail = 0;
-            break;
-        case 1:
-            mem_avail = 8;
-            break;
-        case 2:
-            mem_avail = 16;
-            break;
-        case 3:
-            mem_avail = 32;
-            break;
-        case 5:
-            mem_avail = 64;
-            break;
-        case 7:
-            mem_avail = 128;
-            break;
-        case 9:
-            mem_avail = 256;
-            break;
-        case 10:
-            mem_avail = 512;
-            break;
-        case 12:
-            mem_avail = 1024;
-            break;
-        case 14:
-            mem_avail = 2048;
-            break;
-    }
 
-    uint32_t mem_left = 0;
-    if (mem_avail > 0)
-        mem_left = (mem_avail * 1024) - mem_used;
-
-    PrintAndLogEx(NORMAL, "  --= Nonvolatile Program Memory Size: %uK bytes, Used: %u bytes (%2.0f%%) Free: %u bytes (%2.0f%%)",
-                  mem_avail,
-                  mem_used,
-                  mem_avail == 0 ? 0.0f : (float)mem_used / (mem_avail * 1024) * 100,
-                  mem_left,
-                  mem_avail == 0 ? 0.0f : (float)mem_left / (mem_avail * 1024) * 100
-                 );
-
-    switch ((iChipID & 0xF000) >> 12) {
-        case 0:
-            sprintf(asBuff, "None");
-            break;
-        case 1:
-            sprintf(asBuff, "8K bytes");
-            break;
-        case 2:
-            sprintf(asBuff, "16K bytes");
-            break;
-        case 3:
-            sprintf(asBuff, "32K bytes");
-            break;
-        case 5:
-            sprintf(asBuff, "64K bytes");
-            break;
-        case 7:
-            sprintf(asBuff, "128K bytes");
-            break;
-        case 9:
-            sprintf(asBuff, "256K bytes");
-            break;
-        case 10:
-            sprintf(asBuff, "512K bytes");
-            break;
-        case 12:
-            sprintf(asBuff, "1024K bytes");
-            break;
-        case 14:
-            sprintf(asBuff, "2048K bytes");
-            break;
-    }
-    PrintAndLogEx(NORMAL, "  --= Second Nonvolatile Program Memory Size: %s", asBuff);
     switch ((iChipID & 0xF0000) >> 16) {
         case 1:
             sprintf(asBuff, "1K bytes");
@@ -229,7 +153,8 @@ static void lookupChipID(uint32_t iChipID, uint32_t mem_used) {
             sprintf(asBuff, "512K bytes");
             break;
     }
-    PrintAndLogEx(NORMAL, "  --= Internal SRAM Size: %s", asBuff);
+    PrintAndLogEx(NORMAL, "  --= Internal SRAM size: %s", asBuff);
+
     switch ((iChipID & 0xFF00000) >> 20) {
         case 0x19:
             sprintf(asBuff, "AT91SAM9xx Series");
@@ -289,7 +214,8 @@ static void lookupChipID(uint32_t iChipID, uint32_t mem_used) {
             sprintf(asBuff, "AT75Cxx Series");
             break;
     }
-    PrintAndLogEx(NORMAL, "  --= Architecture Identifier: %s", asBuff);
+    PrintAndLogEx(NORMAL, "  --= Architecture identifier: %s", asBuff);
+
     switch ((iChipID & 0x70000000) >> 28) {
         case 0:
             sprintf(asBuff, "ROM");
@@ -307,7 +233,78 @@ static void lookupChipID(uint32_t iChipID, uint32_t mem_used) {
             sprintf(asBuff, "SRAM emulating ROM");
             break;
     }
-    PrintAndLogEx(NORMAL, "  --= Nonvolatile Program Memory Type: %s", asBuff);
+    switch ((iChipID & 0xF00) >> 8) {
+        case 0:
+            mem_avail = 0;
+            break;
+        case 1:
+            mem_avail = 8;
+            break;
+        case 2:
+            mem_avail = 16;
+            break;
+        case 3:
+            mem_avail = 32;
+            break;
+        case 5:
+            mem_avail = 64;
+            break;
+        case 7:
+            mem_avail = 128;
+            break;
+        case 9:
+            mem_avail = 256;
+            break;
+        case 10:
+            mem_avail = 512;
+            break;
+        case 12:
+            mem_avail = 1024;
+            break;
+        case 14:
+            mem_avail = 2048;
+            break;
+    }
+
+    PrintAndLogEx(NORMAL, "  --= Nonvolatile program memory: " _YELLOW_("%uK") " bytes %s ( " _YELLOW_("%2.0f%%") " used )"
+                , mem_avail
+                , asBuff
+                , mem_avail == 0 ? 0.0f : (float)mem_used / (mem_avail * 1024) * 100
+                );
+
+    switch ((iChipID & 0xF000) >> 12) {
+        case 0:
+            sprintf(asBuff, "None");
+            break;
+        case 1:
+            sprintf(asBuff, "8K bytes");
+            break;
+        case 2:
+            sprintf(asBuff, "16K bytes");
+            break;
+        case 3:
+            sprintf(asBuff, "32K bytes");
+            break;
+        case 5:
+            sprintf(asBuff, "64K bytes");
+            break;
+        case 7:
+            sprintf(asBuff, "128K bytes");
+            break;
+        case 9:
+            sprintf(asBuff, "256K bytes");
+            break;
+        case 10:
+            sprintf(asBuff, "512K bytes");
+            break;
+        case 12:
+            sprintf(asBuff, "1024K bytes");
+            break;
+        case 14:
+            sprintf(asBuff, "2048K bytes");
+            break;
+    }
+    PrintAndLogEx(NORMAL, "  --= Second nonvolatile program memory size: %s", asBuff);
 }
 
 static int CmdDbg(const char *Cmd) {

From 2e7d1e299d8dbc27df53c55505db9fb60b1a92b9 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sun, 7 Feb 2021 15:16:15 +0100
Subject: [PATCH 516/682] hf 14a info - bette hint for EMV cards

---
 client/src/cmdhf14a.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index f03dc8687..447bcd4db 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -1641,6 +1641,7 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
     bool isMifarePlus = false;
     bool isMifareUltralight = false;
     bool isST = false;
+    bool isEMV = false;
     int nxptype = MTNONE;
 
     if (card.uidlen <= 4) {
@@ -2055,6 +2056,7 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
 
                         if (verbose) PrintAndLogEx(SUCCESS, "----------------------------------------------------");
                         found = true;
+                        isEMV = true;
                     }
 
                 }
@@ -2104,14 +2106,17 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
     if (isMifareUltralight)
         PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mfu info`"));
 
-    if (isMifarePlus && isMagic == 0)
+    if (isMifarePlus && isMagic == 0 && isEMV == false)
         PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mfp info`"));
 
-    if (isMifareDESFire && isMagic == 0)
+    if (isMifareDESFire && isMagic == 0 && isEMV == false)
         PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mfdes info`"));
 
     if (isST)
         PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf st info`"));
+    
+    if (isEMV)
+        PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`emv search -sk`"));
 
     PrintAndLogEx(NORMAL, "");
     DropField();

From eeb62000818372b573f41cca637b546dbf344504 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 7 Feb 2021 13:30:56 -0500
Subject: [PATCH 517/682] hf mf ice - now use cliparser

---
 client/src/cmdhfmf.c   | 82 ++++++++++++++++++------------------------
 doc/cliparser_todo.txt |  1 -
 2 files changed, 35 insertions(+), 48 deletions(-)

diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index 475c687fb..76d849c05 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -42,18 +42,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_hf14_ice(void) {
-    PrintAndLogEx(NORMAL, "Usage:   hf mf ice [l <limit>] [f <name>]");
-    PrintAndLogEx(NORMAL, "  h            this help");
-    PrintAndLogEx(NORMAL, "  l <limit>    nonces to be collected");
-    PrintAndLogEx(NORMAL, "  f <name>     save nonces to <name> instead of hf-mf-<UID>-nonces.bin");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("         hf mf ice"));
-    PrintAndLogEx(NORMAL, _YELLOW_("         hf mf ice f nonces.bin"));
-    return PM3_SUCCESS;
-}
-
 static int usage_hf14_dump(void) {
     PrintAndLogEx(NORMAL, "Usage:   hf mf dump [card memory] [k <name>] [f <name>]");
     PrintAndLogEx(NORMAL, "  [card memory]: 0 = 320 bytes (MIFARE Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");
@@ -4709,44 +4697,30 @@ static int CmdHf14AMfNack(const char *Cmd) {
 }
 
 static int CmdHF14AMfice(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mf ice",
+                  "Collect MIFARE Classic nonces to file",
+                  "hf mf ice\n"
+                  "hf mf ice -f nonces.bin");
 
-    uint8_t blockNo = 0;
-    uint8_t keyType = 0;
-    uint8_t trgBlockNo = 0;
-    uint8_t trgKeyType = 1;
-    bool slow = false;
-    bool initialize = true;
-    bool acquisition_completed = false;
-    uint8_t cmdp = 0;
-    uint32_t flags = 0;
-    uint32_t total_num_nonces = 0;
-    char ctmp;
-    char filename[FILE_PATH_SIZE], *fptr;
-    FILE *fnonces = NULL;
-    PacketResponseNG resp;
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("f", "file", "<filename>", "filename of nonce dump"),
+        arg_u64_0(NULL, "limit", "<dec>", "nonces to be collected"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
 
-    uint32_t part_limit = 3000;
-    uint32_t limit = 50000;
+    int fnlen = 0;
+    char filename[FILE_PATH_SIZE] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
 
-    while ((ctmp = param_getchar(Cmd, cmdp))) {
-        switch (tolower(ctmp)) {
-            case 'h':
-                return usage_hf14_ice();
-            case 'f':
-                param_getstr(Cmd, cmdp + 1, filename, FILE_PATH_SIZE);
-                cmdp++;
-                break;
-            case 'l':
-                limit = param_get32ex(Cmd, cmdp + 1, 50000, 10);
-                cmdp++;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'\n", ctmp);
-                usage_hf14_ice();
-                return PM3_ESOFT;
-        }
-        cmdp++;
-    }
+    uint32_t limit = arg_get_u32_def(ctx, 2, 50000);
+
+    CLIParserFree(ctx);
+
+    // Validations
+    char *fptr;
 
     if (filename[0] == '\0') {
         fptr = GenerateFilename("hf-mf-", "-nonces.bin");
@@ -4756,6 +4730,20 @@ static int CmdHF14AMfice(const char *Cmd) {
         free(fptr);
     }
 
+    uint8_t blockNo = 0;
+    uint8_t keyType = 0;
+    uint8_t trgBlockNo = 0;
+    uint8_t trgKeyType = 1;
+    bool slow = false;
+    bool initialize = true;
+    bool acquisition_completed = false;
+    uint32_t flags = 0;
+    uint32_t total_num_nonces = 0;
+    FILE *fnonces = NULL;
+    PacketResponseNG resp;
+
+    uint32_t part_limit = 3000;
+    
     PrintAndLogEx(NORMAL, "Collecting "_YELLOW_("%u")" nonces \n", limit);
 
     if ((fnonces = fopen(filename, "wb")) == NULL) {
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index c52d35d69..a672d87a9 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -92,7 +92,6 @@ hf mf cview
 hf mf gen3uid
 hf mf gen3blk
 hf mf gen3freeze
-hf mf ice
 lf em 410x
 lf em 4x05
 lf em 4x50

From feb44951244680cb4f8147f11db67a8bbf51bc41 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 7 Feb 2021 15:06:10 -0500
Subject: [PATCH 518/682] hf mf dump - now uses cliparser

---
 client/luascripts/hf_mf_autopwn.lua |  2 +-
 client/src/cmdhfmf.c                | 95 ++++++++++++++++-------------
 doc/cheatsheet.md                   | 19 +++---
 doc/cliparser_todo.txt              |  1 -
 4 files changed, 64 insertions(+), 53 deletions(-)

diff --git a/client/luascripts/hf_mf_autopwn.lua b/client/luascripts/hf_mf_autopwn.lua
index f7ea2a832..78a701488 100644
--- a/client/luascripts/hf_mf_autopwn.lua
+++ b/client/luascripts/hf_mf_autopwn.lua
@@ -123,7 +123,7 @@ local function dump_tag(uid, numsectors)
 
         local dumpfile = 'hf-mf-'..uid..'-dump'
 
-        local dmp = ('hf mf dump %s f %s'):format(typ, dumpfile)
+        local dmp = ('hf mf dump -t %s -f %s'):format(typ, dumpfile)
         core.console(dmp)
 
         -- Save the global args, those are *our* arguments
diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index 76d849c05..b0648b3f3 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -42,18 +42,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_hf14_dump(void) {
-    PrintAndLogEx(NORMAL, "Usage:   hf mf dump [card memory] [k <name>] [f <name>]");
-    PrintAndLogEx(NORMAL, "  [card memory]: 0 = 320 bytes (MIFARE Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");
-    PrintAndLogEx(NORMAL, "  k <name>     : key filename, if no <name> given, UID will be used as filename");
-    PrintAndLogEx(NORMAL, "  f <name>     : data filename, if no <name> given, UID will be used as filename");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("         hf mf dump"));
-    PrintAndLogEx(NORMAL, _YELLOW_("         hf mf dump 4"));
-    return PM3_SUCCESS;
-}
-
 static int usage_hf14_mifare(void) {
     PrintAndLogEx(NORMAL, "Usage:  hf mf darkside <block number> <A|B>");
     PrintAndLogEx(NORMAL, "Options:");
@@ -650,6 +638,21 @@ static uint8_t NumOfSectors(char card) {
     }
 }
 
+static uint8_t NewNumOfSectors(uint8_t card) {
+    switch (card) {
+        case 0 :
+            return MIFARE_MINI_MAXSECTOR;
+        case 1 :
+            return MIFARE_1K_MAXSECTOR;
+        case 2 :
+            return MIFARE_2K_MAXSECTOR;
+        case 4 :
+            return MIFARE_4K_MAXSECTOR;
+        default  :
+            return 0;
+    }
+}
+
 static uint8_t FirstBlockOfSector(uint8_t sectorNo) {
     if (sectorNo < 32) {
         return sectorNo * 4;
@@ -942,6 +945,36 @@ static int FastDumpWithEcFill(uint8_t numsectors) {
 
 static int CmdHF14AMfDump(const char *Cmd) {
 
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mf dump",
+                  "Dump MIFARE Classic tag to binary file\n"
+                  "If no <name> given, UID will be used as filename",
+                  "hf mf dump -t 0                     -> MIFARE Mini\n"
+                  "hf mf dump -t 1                     -> MIFARE Classic 1k (default)\n"
+                  "hf mf dump -t 2                     -> MIFARE 2k\n"
+                  "hf mf dump -t 4                     -> MIFARE 4k\n");
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_int0("t", "type", "<0-4> ", "MIFARE Classic type"),
+        arg_str0("f", "file", "<filename>", "filename of dump"),
+        arg_str0("k", "keys", "<filename>", "filename of keys"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    uint8_t numSectors = NewNumOfSectors(arg_get_u32_def(ctx, 1, 1));
+
+    int datafnlen = 0;
+    char dataFilename[FILE_PATH_SIZE] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 2), (uint8_t *)dataFilename, FILE_PATH_SIZE, &datafnlen);
+
+    int keyfnlen = 0;
+    char keyFilename[FILE_PATH_SIZE] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 3), (uint8_t *)keyFilename, FILE_PATH_SIZE, &keyfnlen);
+
+    CLIParserFree(ctx);
+
     uint64_t t1 = msclock();
 
     uint8_t sectorNo, blockNo;
@@ -949,43 +982,17 @@ static int CmdHF14AMfDump(const char *Cmd) {
     uint8_t keyB[40][6];
     uint8_t rights[40][4];
     uint8_t carddata[256][16];
-    uint8_t numSectors = 16;
-    uint8_t cmdp = 0;
-
-    char keyFilename[FILE_PATH_SIZE] = {0};
-    char dataFilename[FILE_PATH_SIZE];
-    char *fptr;
-
-    memset(keyFilename, 0, sizeof(keyFilename));
-    memset(dataFilename, 0, sizeof(dataFilename));
-
+    
     FILE *f;
     PacketResponseNG resp;
 
-    while (param_getchar(Cmd, cmdp) != 0x00) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_hf14_dump();
-            case 'k':
-                param_getstr(Cmd, cmdp + 1, keyFilename, FILE_PATH_SIZE);
-                cmdp += 2;
-                break;
-            case 'f':
-                param_getstr(Cmd, cmdp + 1, dataFilename, FILE_PATH_SIZE);
-                cmdp += 2;
-                break;
-            default:
-                if (cmdp == 0) {
-                    numSectors = NumOfSectors(param_getchar(Cmd, cmdp));
-                    if (numSectors == 0) return usage_hf14_dump();
-                    cmdp++;
-                } else {
-                    PrintAndLogEx(WARNING, "Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
-                    return usage_hf14_dump();
-                }
-        }
+    if (numSectors == 0) {
+        PrintAndLogEx(ERR, "Invalid MIFARE Classic type");
+        return PM3_EINVARG;
     }
 
+    char *fptr;
+
     if (keyFilename[0] == 0x00) {
         fptr = GenerateFilename("hf-mf-", "-key.bin");
         if (fptr == NULL)
diff --git a/doc/cheatsheet.md b/doc/cheatsheet.md
index 1220bf173..27e893fd3 100644
--- a/doc/cheatsheet.md
+++ b/doc/cheatsheet.md
@@ -244,14 +244,19 @@ pm3 --> hf mf fchk 1 m
 
 Dump MIFARE card contents
 ```
-Options
----
-<card memory> : 0 = 320 bytes (MIFARE Mini), 1 = 1K (default), 2 = 2K, 4 = 4K
-k <name>      : key filename, if no <name> given, UID will be used as filename"
-f <name>      : data filename, if no <name> given, UID will be used as filename
+options:
+    -t, --type <0-4>               MIFARE Classic type
+    -f, --file <filename>          filename of dump
+    -k, --keys <filename>          filename of keys
 
-pm3 --> hf mf dump 1
-pm3 --> hf mf dump 1 k hf-mf-A29558E4-key.bin f hf-mf-A29558E4-dump.bin
+examples/notes:
+    hf mf dump -t 0                          -> MIFARE Mini
+    hf mf dump -t 1                          -> MIFARE Classic 1k (default)
+    hf mf dump -t 2                          -> MIFARE 2k
+    hf mf dump -t 4                          -> MIFARE 4k
+
+pm3 --> hf mf dump -t 1
+pm3 --> hf mf dump -t 1 -k hf-mf-A29558E4-key.bin -f hf-mf-A29558E4-dump.bin
 ```
 
 Convert .bin to .eml
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index a672d87a9..5d974b637 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -66,7 +66,6 @@ hf mf nack
 hf mf chk
 hf mf fchk
 hf mf decrypt
-hf mf dump
 hf mf rdbl
 hf mf rdsc
 hf mf restore

From 23de2777c137a979a8990fa3c680087eb9ee19e8 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 7 Feb 2021 15:20:16 -0500
Subject: [PATCH 519/682] hf mf darkside - now use cliparser

---
 client/src/cmdhfmf.c   | 40 +++++++++++++++++++++-------------------
 doc/cliparser_todo.txt |  1 -
 2 files changed, 21 insertions(+), 20 deletions(-)

diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index b0648b3f3..dfcf7e47e 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -42,18 +42,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_hf14_mifare(void) {
-    PrintAndLogEx(NORMAL, "Usage:  hf mf darkside <block number> <A|B>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h               this help");
-    PrintAndLogEx(NORMAL, "      <block number>  (Optional) target other block");
-    PrintAndLogEx(NORMAL, "      <A|B>           (optional) target key type");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("           hf mf darkside"));
-    PrintAndLogEx(NORMAL, _YELLOW_("           hf mf darkside 16"));
-    PrintAndLogEx(NORMAL, _YELLOW_("           hf mf darkside 16 B"));
-    return PM3_SUCCESS;
-}
 static int usage_hf14_mfsim(void) {
     PrintAndLogEx(NORMAL, "Usage:  hf mf sim [u <uid>] [n <numreads>] [t] [a <ATQA>] [s <SAK>] [i] [x] [e] [v]");
     PrintAndLogEx(NORMAL, "Options:");
@@ -692,17 +680,31 @@ static char GetFormatFromSector(uint8_t sectorNo) {
 }
 
 static int CmdHF14AMfDarkside(const char *Cmd) {
-    uint8_t blockno = 0, key_type = MIFARE_AUTH_KEYA;
-    uint64_t key = 0;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mf darkside",
+                  "Darkside attack",
+                  "hf mf darkside\n"
+                  "hf mf darkside -b 16\n"
+                  "hf mf darkside -b 16 --keyb\n");
 
-    char cmdp = tolower(param_getchar(Cmd, 0));
-    if (cmdp == 'h') return usage_hf14_mifare();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_int0("b", "block", "<dec> ", "Simulation type to use"),
+        arg_lit0(NULL, "keyb", "Target key B instead of default key A"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
 
-    blockno = param_get8(Cmd, 0);
+    uint8_t blockno = arg_get_u32_def(ctx, 1, 0);
 
-    cmdp = tolower(param_getchar(Cmd, 1));
-    if (cmdp == 'b')
+    uint8_t key_type = MIFARE_AUTH_KEYA;
+
+    if (arg_get_lit(ctx, 2)) {
+        PrintAndLogEx(INFO, "Targeting key B");
         key_type = MIFARE_AUTH_KEYB;
+    }
+
+    uint64_t key = 0;
 
     int isOK = mfDarkside(blockno, key_type, &key);
     PrintAndLogEx(NORMAL, "");
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 5d974b637..727802ef2 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -57,7 +57,6 @@ hf felica rqspecver
 hf felica resetmode
 hf felica litesim
 hf felica litedump
-hf mf darkside
 hf mf nested
 hf mf hardnested
 hf mf staticnested

From c04556e69e17ee4b65abcfed7bd0525e53cba54e Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 7 Feb 2021 16:15:22 -0500
Subject: [PATCH 520/682] hf mf sim - now use cliparser

---
 client/gen_pm3mfsim_script.sh        |   2 +-
 client/luascripts/hf_mf_tnp3_sim.lua |   2 +-
 client/src/cmdhfmf.c                 | 252 +++++++++++++--------------
 doc/cheatsheet.md                    |   4 +-
 doc/cliparser_todo.txt               |   1 -
 5 files changed, 121 insertions(+), 140 deletions(-)

diff --git a/client/gen_pm3mfsim_script.sh b/client/gen_pm3mfsim_script.sh
index c3726d69c..14cb37909 100644
--- a/client/gen_pm3mfsim_script.sh
+++ b/client/gen_pm3mfsim_script.sh
@@ -32,4 +32,4 @@ rm $2
 echo "hf mf eclr" >> $2
 echo "hf mf eload" $1 >> $2
 echo "hf mf ekeyprn" >> $2
-echo "hf mf sim u" `cat $1.eml | (read -n 8 uid; echo $uid)` >> $2
\ No newline at end of file
+echo "hf mf sim -u" `cat $1.eml | (read -n 8 uid; echo $uid)` >> $2
\ No newline at end of file
diff --git a/client/luascripts/hf_mf_tnp3_sim.lua b/client/luascripts/hf_mf_tnp3_sim.lua
index dded9327a..33f82b2d4 100644
--- a/client/luascripts/hf_mf_tnp3_sim.lua
+++ b/client/luascripts/hf_mf_tnp3_sim.lua
@@ -496,7 +496,7 @@ local function main(args)
         err = LoadEmulator(uid, blocks)
         if err then return oops(err) end
         core.clearCommandBuffer()
-        print('The simulation is now prepared.\n --> run \"hf mf sim u '..uid..'\" <--')
+        print('The simulation is now prepared.\n --> run \"hf mf sim -u '..uid..'\" <--')
     end
 end
 main(args)
diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index dfcf7e47e..0b40120a1 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -42,30 +42,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_hf14_mfsim(void) {
-    PrintAndLogEx(NORMAL, "Usage:  hf mf sim [u <uid>] [n <numreads>] [t] [a <ATQA>] [s <SAK>] [i] [x] [e] [v]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h    this help");
-    PrintAndLogEx(NORMAL, "      u    (Optional) UID 4,7 or 10bytes. If not specified, the UID 4b/7b from emulator memory will be used");
-    PrintAndLogEx(NORMAL, "      t    (Optional)   Enforce ATQA/SAK:");
-    PrintAndLogEx(NORMAL, "                        0 = MIFARE Mini");
-    PrintAndLogEx(NORMAL, "                        1 = MIFARE Classic 1k (Default)");
-    PrintAndLogEx(NORMAL, "                        2 = MIFARE Classic 2k plus in SL0 mode");
-    PrintAndLogEx(NORMAL, "                        4 = MIFARE Classic 4k");
-    PrintAndLogEx(NORMAL, "      a    (Optional)   Provide explicitly ATQA (2 bytes, override option t)");
-    PrintAndLogEx(NORMAL, "      s    (Optional)   Provide explicitly SAK (1 byte, override option t)");
-    PrintAndLogEx(NORMAL, "      n    (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");
-    PrintAndLogEx(NORMAL, "      i    (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");
-    PrintAndLogEx(NORMAL, "      x    (Optional) Crack, performs the 'reader attack', nr/ar attack against a reader");
-    PrintAndLogEx(NORMAL, "      e    (Optional) Fill simulator keys from found keys");
-    PrintAndLogEx(NORMAL, "      v    (Optional) Verbose");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("           hf mf sim u 0a0a0a0a"));
-    PrintAndLogEx(NORMAL, _YELLOW_("           hf mf sim u 11223344556677"));
-    PrintAndLogEx(NORMAL, _YELLOW_("           hf mf sim u 112233445566778899AA"));
-    PrintAndLogEx(NORMAL, _YELLOW_("           hf mf sim u 11223344 i x"));
-    return PM3_SUCCESS;
-}
 /*
  * static int usage_hf14_sniff(void) {
     PrintAndLogEx(NORMAL, "It continuously gets data from the field and saves it to: log, emulator, emulator file.");
@@ -946,7 +922,6 @@ static int FastDumpWithEcFill(uint8_t numsectors) {
 }
 
 static int CmdHF14AMfDump(const char *Cmd) {
-
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf mf dump",
                   "Dump MIFARE Classic tag to binary file\n"
@@ -3376,125 +3351,132 @@ void readerAttack(sector_t *k_sector, uint8_t k_sectorsCount, nonces_t data, boo
 }
 
 static int CmdHF14AMfSim(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mf sim",
+                  "Simulate MIFARE card",
+                  "hf mf sim -t 0                        -> MIFARE Mini\n"
+                  "hf mf sim -t 1                        -> MIFARE Classic 1k (default)\n"
+                  "hf mf sim -t 1 -u 0a0a0a0a            -> MIFARE Classic 1k with 4b UID\n"
+                  "hf mf sim -t 1 -u 11223344556677      -> MIFARE Classic 1k with 7b UID\n"
+                  "hf mf sim -t 1 -u 11223344 -i --crack -> Perform reader attack in interactive mode\n"
+                  "hf mf sim -t 2                        -> MIFARE 2k\n"
+                  "hf mf sim -t 4                        -> MIFARE 4k");
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("u", "uid", "<hex>", "UID 4,7 or 10bytes. If not specified, the UID 4b/7b from emulator memory will be used"),
+        arg_int0("t", "type", "<0-4> ", "MIFARE Classic type for ATQA/SAK"),
+        arg_str0(NULL, "atqa", "<hex>", "Provide explicit ATQA (2 bytes, overrides option t)"),
+        arg_str0(NULL, "sak", "<hex>", "Provide explicit SAK (1 bytes, overrides option t)"),
+        arg_int0("n", "num", "<dec> ", "Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite"),
+        arg_lit0("i", "interactive", "Console will not be returned until simulation finishes or is aborted"),
+        arg_lit0(NULL, "crack", "Performs the 'reader attack', nr/ar attack against a reader"),
+        arg_lit0("e", "emukeys", "Fill simulator keys from found keys"),
+        arg_lit0("v", "verbose", "verbose output"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
 
-    uint8_t uid[10] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
-    uint8_t atqa[2] = {0, 0};
-    int atqalen = 0;
-    uint8_t sak[1] = {0};
-    int saklen = 0;
-    uint8_t exitAfterNReads = 0;
     uint16_t flags = 0;
-    int uidlen = 0;
-    uint8_t cmdp = 0;
-    bool errors = false, verbose = false, setEmulatorMem = false;
-    nonces_t data[1];
-    char csize[13] = { 0 };
-    char uidsize[8] = { 0 };
-    sector_t *k_sector = NULL;
-    uint8_t k_sectorsCount = 40;
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'e':
-                setEmulatorMem = true;
-                cmdp++;
+    int uidlen = 0;
+    uint8_t uid[10] = {0};
+    CLIGetHexWithReturn(ctx, 1, uid, &uidlen);
+
+    char uidsize[8] = {0};
+    if (uidlen > 0) {
+        switch (uidlen) {
+            case 10:
+                flags |= FLAG_10B_UID_IN_DATA;
+                snprintf(uidsize, sizeof(uidsize), "10 byte");
                 break;
-            case 'h':
-                return usage_hf14_mfsim();
-            case 'i':
-                flags |= FLAG_INTERACTIVE;
-                cmdp++;
+            case 7:
+                flags |= FLAG_7B_UID_IN_DATA;
+                snprintf(uidsize, sizeof(uidsize), "7 byte");
                 break;
-            case 'n':
-                exitAfterNReads = param_get8(Cmd, cmdp + 1);
-                cmdp += 2;
-                break;
-            case 't':
-                switch (param_get8(Cmd, cmdp + 1)) {
-                    case 0:
-                        flags |= FLAG_MF_MINI;
-                        snprintf(csize, sizeof(csize), "MINI");
-                        k_sectorsCount = MIFARE_MINI_MAXSECTOR;
-                        break;
-                    case 1:
-                        flags |= FLAG_MF_1K;
-                        snprintf(csize, sizeof(csize), "1K");
-                        k_sectorsCount = MIFARE_1K_MAXSECTOR;
-                        break;
-                    case 2:
-                        flags |= FLAG_MF_2K;
-                        snprintf(csize, sizeof(csize), "2K with RATS");
-                        k_sectorsCount = MIFARE_2K_MAXSECTOR;
-                        break;
-                    case 4:
-                        flags |= FLAG_MF_4K;
-                        snprintf(csize, sizeof(csize), "4K");
-                        k_sectorsCount = MIFARE_4K_MAXSECTOR;
-                        break;
-                    default:
-                        PrintAndLogEx(WARNING, "Unknown parameter for option t");
-                        errors = true;
-                        break;
-                }
-                cmdp += 2;
-                break;
-            case 'a':
-                param_gethex_ex(Cmd, cmdp + 1, atqa, &atqalen);
-                if (atqalen >> 1 != 2) {
-                    PrintAndLogEx(WARNING, "Wrong ATQA length");
-                    errors = true;
-                    break;
-                }
-                flags |= FLAG_FORCED_ATQA;
-                cmdp += 2;
-                break;
-            case 's':
-                param_gethex_ex(Cmd, cmdp + 1, sak, &saklen);
-                if (saklen >> 1 != 1) {
-                    PrintAndLogEx(WARNING, "Wrong SAK length");
-                    errors = true;
-                    break;
-                }
-                flags |= FLAG_FORCED_SAK;
-                cmdp += 2;
-                break;
-            case 'u':
-                param_gethex_ex(Cmd, cmdp + 1, uid, &uidlen);
-                uidlen >>= 1;
-                switch (uidlen) {
-                    case 10:
-                        flags |= FLAG_10B_UID_IN_DATA;
-                        snprintf(uidsize, sizeof(uidsize), "10 byte");
-                        break;
-                    case 7:
-                        flags |= FLAG_7B_UID_IN_DATA;
-                        snprintf(uidsize, sizeof(uidsize), "7 byte");
-                        break;
-                    case 4:
-                        flags |= FLAG_4B_UID_IN_DATA;
-                        snprintf(uidsize, sizeof(uidsize), "4 byte");
-                        break;
-                    default:
-                        return usage_hf14_mfsim();
-                }
-                cmdp += 2;
-                break;
-            case 'v':
-                verbose = true;
-                cmdp++;
-                break;
-            case 'x':
-                flags |= FLAG_NR_AR_ATTACK;
-                cmdp++;
+            case 4:
+                flags |= FLAG_4B_UID_IN_DATA;
+                snprintf(uidsize, sizeof(uidsize), "4 byte");
                 break;
             default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
+                PrintAndLogEx(WARNING, "Invalid parameter for UID");
+                return PM3_EINVARG;
         }
     }
+
+    uint8_t k_sectorsCount = 40;
+    char csize[13] = { 0 };
+    
+    switch (arg_get_u32_def(ctx, 2, 1)) {
+        case 0:
+            flags |= FLAG_MF_MINI;
+            snprintf(csize, sizeof(csize), "MINI");
+            k_sectorsCount = MIFARE_MINI_MAXSECTOR;
+            break;
+        case 1:
+            flags |= FLAG_MF_1K;
+            snprintf(csize, sizeof(csize), "1K");
+            k_sectorsCount = MIFARE_1K_MAXSECTOR;
+            break;
+        case 2:
+            flags |= FLAG_MF_2K;
+            snprintf(csize, sizeof(csize), "2K with RATS");
+            k_sectorsCount = MIFARE_2K_MAXSECTOR;
+            break;
+        case 4:
+            flags |= FLAG_MF_4K;
+            snprintf(csize, sizeof(csize), "4K");
+            k_sectorsCount = MIFARE_4K_MAXSECTOR;
+            break;
+        default:
+            PrintAndLogEx(WARNING, "Unknown parameter for option t");
+            return PM3_EINVARG;
+    }
+
+    int atqalen = 0;
+    uint8_t atqa[2] = {0};
+    CLIGetHexWithReturn(ctx, 3, atqa, &atqalen);
+
+    int saklen = 0;
+    uint8_t sak[1] = {0};
+    CLIGetHexWithReturn(ctx, 4, sak, &saklen);
+
+    uint8_t exitAfterNReads = arg_get_u32_def(ctx, 5, 0);
+
+    if (arg_get_lit(ctx, 6)) {
+        flags |= FLAG_INTERACTIVE;
+    }
+
+    if (arg_get_lit(ctx, 7)) {
+        flags |= FLAG_NR_AR_ATTACK;
+    }
+
+    bool setEmulatorMem = arg_get_lit(ctx, 8);
+    bool verbose = arg_get_lit(ctx, 9);
+
+    CLIParserFree(ctx);
+    
+    nonces_t data[1];
+ 
+    sector_t *k_sector = NULL;
+
     //Validations
-    if (errors) return usage_hf14_mfsim();
+    if (atqalen > 0) {
+        if (atqalen != 2) {
+            PrintAndLogEx(WARNING, "Wrong ATQA length");
+            return PM3_EINVARG;
+
+        }
+        flags |= FLAG_FORCED_ATQA;
+    }
+    if (saklen > 0) {
+        if (saklen != 1) {
+            PrintAndLogEx(WARNING, "Wrong SAK length");
+            return PM3_EINVARG;
+
+        }
+        flags |= FLAG_FORCED_SAK;
+    }
 
     // Use UID, SAK, ATQA from EMUL, if uid not defined
     if ((flags & (FLAG_4B_UID_IN_DATA | FLAG_7B_UID_IN_DATA | FLAG_10B_UID_IN_DATA)) == 0) {
@@ -3834,7 +3816,7 @@ int CmdHF14AMfELoad(const char *Cmd) {
             return PM3_SUCCESS;
         }
     } else {
-        PrintAndLogEx(HINT, "You are ready to simulate. See " _YELLOW_("`hf mf sim h`"));
+        PrintAndLogEx(HINT, "You are ready to simulate. See " _YELLOW_("`hf mf sim -h`"));
         // MFC
         if ((blockNum != numBlocks)) {
             PrintAndLogEx(WARNING, "Error, file content, Only loaded %d blocks, must be %d blocks into emulator memory", blockNum, numBlocks);
diff --git a/doc/cheatsheet.md b/doc/cheatsheet.md
index 27e893fd3..ef511bd85 100644
--- a/doc/cheatsheet.md
+++ b/doc/cheatsheet.md
@@ -310,7 +310,7 @@ Simulate MIFARE
 ```
 u     : (Optional) UID 4,7 or 10 bytes. If not specified, the UID 4B from emulator memory will be used
 
-pm3 --> hf mf sim u 353c2aa6
+pm3 --> hf mf sim -u 353c2aa6
 ```
 
 Simulate MIFARE Sequence
@@ -319,7 +319,7 @@ pm3 --> hf mf chk *1 ? d mfc_default_keys
 pm3 --> hf mf dump 1
 pm3 --> script run data_mf_bin2eml -i dumpdata.bin
 pm3 --> hf mf eload 353C2AA6
-pm3 --> hf mf sim u 353c2aa6
+pm3 --> hf mf sim -u 353c2aa6
 ```
 
 Clone MIFARE 1K Sequence
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 727802ef2..4bf56ab82 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -70,7 +70,6 @@ hf mf rdsc
 hf mf restore
 hf mf setmod
 hf mf wrbl
-hf mf sim
 hf mf ecfill
 hf mf eclr
 hf mf egetblk

From 535fd2aefffe6f967ab308f057c89f6203e24589 Mon Sep 17 00:00:00 2001
From: Akif Dinc <akif@dinc.org>
Date: Sun, 7 Feb 2021 22:20:47 +0100
Subject: [PATCH 521/682] Fixes error in key size check in 'hf mfu info' for
 EV1/NTAG

---
 client/src/cmdhfmfu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index 9af773420..5ae709a06 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -1102,7 +1102,7 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
     CLIParserFree(ctx);
 
     if (ak_len) {
-        if (ak_len != 16 && ak_len != 8) {
+        if (ak_len != 16 && ak_len != 4) {
             PrintAndLogEx(WARNING, "ERROR: Key is incorrect length\n");
             return PM3_EINVARG;
         }

From a82a71b4c879c367e9a3ce1a251818137f594ba7 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 7 Feb 2021 17:32:25 -0500
Subject: [PATCH 522/682] hf mf nested - now use cliparser

---
 client/luascripts/hf_mf_autopwn.lua   |   2 +-
 client/luascripts/hf_mf_tnp3_dump.lua |   2 +-
 client/src/cmdhfmf.c                  | 129 ++++++++++++++------------
 doc/cliparser_todo.txt                |   1 -
 4 files changed, 71 insertions(+), 63 deletions(-)

diff --git a/client/luascripts/hf_mf_autopwn.lua b/client/luascripts/hf_mf_autopwn.lua
index 78a701488..029d16d7a 100644
--- a/client/luascripts/hf_mf_autopwn.lua
+++ b/client/luascripts/hf_mf_autopwn.lua
@@ -99,7 +99,7 @@ local function nested(key,sak)
     else
         print("I don't know how many sectors there are on this type of card, defaulting to 16")
     end
-    local cmd = string.format('hf mf nested %d 0 A %s d', typ, key)
+    local cmd = string.format('hf mf nested -t %d -b 0 --keya -k %s --dumpkeys', typ, key)
     core.console(cmd)
 end
 
diff --git a/client/luascripts/hf_mf_tnp3_dump.lua b/client/luascripts/hf_mf_tnp3_dump.lua
index ee59046eb..54a19da82 100644
--- a/client/luascripts/hf_mf_tnp3_dump.lua
+++ b/client/luascripts/hf_mf_tnp3_dump.lua
@@ -147,7 +147,7 @@ local function main(args)
 
     --Trying to find the other keys
     if useNested then
-      core.console( ('hf mf nested 1 0 A %s d'):format(keyA) )
+      core.console( ('hf mf nested -t 1 -b 0 --keya -k %s --dumpkeys'):format(keyA) )
     end
 
     core.clearCommandBuffer()
diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index 0b40120a1..0007c44e5 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -57,23 +57,6 @@ static int CmdHelp(const char *Cmd);
     return PM3_SUCCESS;
 }
 */
-static int usage_hf14_nested(void) {
-    PrintAndLogEx(NORMAL, "Usage:");
-    PrintAndLogEx(NORMAL, " all sectors:  hf mf nested  <card memory> <block> <key A/B> <key (12 hex symbols)> [t,d]");
-    PrintAndLogEx(NORMAL, " one sector:   hf mf nested  o <block> <key A/B> <key (12 hex symbols)> <target block> <target key A/B> [t]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h    this help");
-    PrintAndLogEx(NORMAL, "      card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");
-    PrintAndLogEx(NORMAL, "      t    transfer keys into emulator memory");
-    PrintAndLogEx(NORMAL, "      d    write keys to binary file `hf-mf-<UID>-key.bin`");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf nested 1 0 A FFFFFFFFFFFF")"        -- key recovery against 1K, block 0, Key A using key FFFFFFFFFFFF");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf nested 1 0 A FFFFFFFFFFFF t")"      -- and transfer keys into emulator memory");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf nested 1 0 A FFFFFFFFFFFF d")"      -- or write keys to binary file ");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf nested o 0 A FFFFFFFFFFFF 4 A")"    -- one sector key recovery. Use block 0 Key A to find block 4 Key A");
-    return PM3_SUCCESS;
-}
 static int usage_hf14_staticnested(void) {
     PrintAndLogEx(NORMAL, "Usage:");
     PrintAndLogEx(NORMAL, " all sectors:  hf mf staticnested  <card memory> <block> <key A/B> <key (12 hex symbols)> [t,d]");
@@ -680,6 +663,8 @@ static int CmdHF14AMfDarkside(const char *Cmd) {
         key_type = MIFARE_AUTH_KEYB;
     }
 
+    CLIParserFree(ctx);
+
     uint64_t key = 0;
 
     int isOK = mfDarkside(blockno, key_type, &key);
@@ -1294,62 +1279,86 @@ static int CmdHF14AMfRestore(const char *Cmd) {
 }
 
 static int CmdHF14AMfNested(const char *Cmd) {
-    sector_t *e_sector = NULL;
-    uint8_t keyType = 0;
-    uint8_t trgBlockNo = 0;
-    uint8_t trgKeyType = 0;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mf nested",
+                  "Execute Nested attack against MIFARE Classic card for key recovery",
+                  "hf mf nested -t 0 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE Mini\n"
+                  "hf mf nested -t 1 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE Classic 1k\n"
+                  "hf mf nested -t 2 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE 2k\n"
+                  "hf mf nested -t 4 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE 4k\n"
+                  "hf mf nested --single -b 0 --keya FFFFFFFFFFFF --tblock 4 --tkeya -> Single sector key recovery. Use block 0 Key A to find block 4 Key A");
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("k", "key", "<hex>", "Key specified as 12 hex symbols"),
+        arg_int0("t", "type", "<0-4>", "MIFARE Classic type"),
+        arg_int0("b", "block", "<dec>", "Input block number"),
+        arg_lit0(NULL, "keya", "Input key specified is A key (default)"),
+        arg_lit0(NULL, "keyb", "Input key specified is B key"),
+        arg_int0(NULL, "tblock", "<dec>", "Target block number"),
+        arg_lit0(NULL, "tkeya", "Target A key (default)"),
+        arg_lit0(NULL, "tkeyb", "Target B key"),
+        arg_lit0("e", "emukeys", "Fill simulator keys from found keys"),
+        arg_lit0(NULL, "dumpkeys", "Dump found keys to file"),
+        arg_lit0(NULL, "single", "Single sector (defaults to All)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+
+    int keylen = 0;
+    uint8_t key[6] = {0};
+    CLIGetHexWithReturn(ctx, 1, key, &keylen);
+
     uint8_t SectorsCnt = 0;
-    uint8_t key[6] = {0, 0, 0, 0, 0, 0};
-    uint8_t keyBlock[(ARRAYLEN(g_mifare_default_keys) + 1) * 6];
-    uint64_t key64 = 0;
-    bool transferToEml = false;
-    bool createDumpFile = false;
+    SectorsCnt = NewNumOfSectors(arg_get_u32_def(ctx, 2, 1));
 
-    if (strlen(Cmd) < 3) return usage_hf14_nested();
+    uint8_t blockNo = arg_get_u32_def(ctx, 3, 0);
 
-    char cmdp, ctmp;
-    cmdp = tolower(param_getchar(Cmd, 0));
-    uint8_t blockNo = param_get8(Cmd, 1);
-    ctmp = tolower(param_getchar(Cmd, 2));
+    uint8_t keyType = 0;
 
-    if (ctmp != 'a' && ctmp != 'b') {
-        PrintAndLogEx(WARNING, "key type must be A or B");
+    if (arg_get_lit(ctx, 4) && arg_get_lit(ctx, 5)) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(WARNING, "Input key type must be A or B");
         return PM3_EINVARG;
-    }
-
-    if (ctmp != 'a')
+    } else if (arg_get_lit(ctx, 5)) {
         keyType = 1;
-
-    if (param_gethex(Cmd, 3, key, 12)) {
-        PrintAndLogEx(WARNING, "key must include 12 HEX symbols");
-        return PM3_EINVARG;
     }
 
-    if (cmdp == 'o') {
-        trgBlockNo = param_get8(Cmd, 4);
-        ctmp = tolower(param_getchar(Cmd, 5));
-        if (ctmp != 'a' && ctmp != 'b') {
-            PrintAndLogEx(WARNING, "target key type must be A or B");
+    uint8_t trgBlockNo = arg_get_u32_def(ctx, 6, 0);
+
+    uint8_t trgKeyType = 0;
+
+    if (arg_get_lit(ctx, 7) && arg_get_lit(ctx, 8)) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(WARNING, "Target key type must be A or B");
+        return PM3_EINVARG;
+    } else if (arg_get_lit(ctx, 7)) {
+        trgKeyType = 1;
+    }
+
+    bool transferToEml = arg_get_lit(ctx, 9);
+    bool createDumpFile = arg_get_lit(ctx, 10);
+    bool singleSector = arg_get_lit(ctx, 11);
+
+    CLIParserFree(ctx);
+
+    //validations
+    if (singleSector == false) {
+        if (SectorsCnt == 0) {
+            PrintAndLogEx(WARNING, "Invalid MIFARE Type");    
             return PM3_EINVARG;
         }
-        if (ctmp != 'a') {
-            trgKeyType = 1;
-        }
-    } else {
-        SectorsCnt = NumOfSectors(cmdp);
-        if (SectorsCnt == 0) return usage_hf14_nested();
     }
 
-    uint8_t j = 4;
-    while (ctmp != 0x00) {
-
-        ctmp = tolower(param_getchar(Cmd, j));
-        transferToEml |= (ctmp == 't');
-        createDumpFile |= (ctmp == 'd');
-
-        j++;
+    if (keylen != 6) {
+        PrintAndLogEx(WARNING, "Input key must include 12 HEX symbols");
+        return PM3_EINVARG;
     }
 
+    sector_t *e_sector = NULL;
+    uint8_t keyBlock[(ARRAYLEN(g_mifare_default_keys) + 1) * 6];
+    uint64_t key64 = 0;
+
     // check if tag doesn't have static nonce
     if (detect_classic_static_nonce() == NONCE_STATIC) {
         PrintAndLogEx(WARNING, "Static nonce detected. Quitting...");
@@ -1363,7 +1372,7 @@ static int CmdHF14AMfNested(const char *Cmd) {
         return PM3_EOPABORTED;
     }
 
-    if (cmdp == 'o') {
+    if (singleSector) {
         int16_t isOK = mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true);
         switch (isOK) {
             case PM3_ETIMEOUT:
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 4bf56ab82..f3b0d7061 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -57,7 +57,6 @@ hf felica rqspecver
 hf felica resetmode
 hf felica litesim
 hf felica litedump
-hf mf nested
 hf mf hardnested
 hf mf staticnested
 hf mf autopwn

From 9da310bb3640d63569785a6ac57a5df4a5d2f974 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 7 Feb 2021 17:49:45 -0500
Subject: [PATCH 523/682] hf mf staticnested - now use cliparser

---
 client/src/cmdhfmf.c   | 113 +++++++++++++++++++++--------------------
 doc/cliparser_todo.txt |   1 -
 2 files changed, 58 insertions(+), 56 deletions(-)

diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index 0007c44e5..f5ef352b1 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -57,21 +57,6 @@ static int CmdHelp(const char *Cmd);
     return PM3_SUCCESS;
 }
 */
-static int usage_hf14_staticnested(void) {
-    PrintAndLogEx(NORMAL, "Usage:");
-    PrintAndLogEx(NORMAL, " all sectors:  hf mf staticnested  <card memory> <block> <key A/B> <key (12 hex symbols)> [t,d]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h    this help");
-    PrintAndLogEx(NORMAL, "      card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");
-    PrintAndLogEx(NORMAL, "      t    transfer keys into emulator memory");
-    PrintAndLogEx(NORMAL, "      d    write keys to binary file `hf-mf-<UID>-key.bin`");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf staticnested 1 0 A FFFFFFFFFFFF")"        -- key recovery against 1K, block 0, Key A using key FFFFFFFFFFFF");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf staticnested 1 0 A FFFFFFFFFFFF t")"      -- and transfer keys into emulator memory");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf staticnested 1 0 A FFFFFFFFFFFF d")"      -- or write keys to binary file ");
-    return PM3_SUCCESS;
-}
 static int usage_hf14_hardnested(void) {
     PrintAndLogEx(NORMAL, "Usage:");
     PrintAndLogEx(NORMAL, "      hf mf hardnested <block number> <key A|B> <key (12 hex symbols)>");
@@ -1309,8 +1294,7 @@ static int CmdHF14AMfNested(const char *Cmd) {
     uint8_t key[6] = {0};
     CLIGetHexWithReturn(ctx, 1, key, &keylen);
 
-    uint8_t SectorsCnt = 0;
-    SectorsCnt = NewNumOfSectors(arg_get_u32_def(ctx, 2, 1));
+    uint8_t SectorsCnt = NewNumOfSectors(arg_get_u32_def(ctx, 2, 1));
 
     uint8_t blockNo = arg_get_u32_def(ctx, 3, 0);
 
@@ -1568,48 +1552,67 @@ jumptoend:
 }
 
 static int CmdHF14AMfNestedStatic(const char *Cmd) {
-    sector_t *e_sector = NULL;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mf staticnested",
+                  "Execute Nested attack against MIFARE Classic card with static nonce for key recovery",
+                  "hf mf staticnested -t 0 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE Mini\n"
+                  "hf mf staticnested -t 1 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE Classic 1k\n"
+                  "hf mf staticnested -t 2 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE 2k\n"
+                  "hf mf staticnested -t 4 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE 4k\n");
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("k", "key", "<hex>", "Key specified as 12 hex symbols"),
+        arg_int0("t", "type", "<0-4>", "MIFARE Classic type"),
+        arg_int0("b", "block", "<dec>", "Input block number"),
+        arg_lit0(NULL, "keya", "Input key specified is A key (default)"),
+        arg_lit0(NULL, "keyb", "Input key specified is B key"),
+        arg_lit0("e", "emukeys", "Fill simulator keys from found keys"),
+        arg_lit0(NULL, "dumpkeys", "Dump found keys to file"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+
+    int keylen = 0;
+    uint8_t key[6] = {0};
+    CLIGetHexWithReturn(ctx, 1, key, &keylen);
+
+    uint8_t SectorsCnt = NewNumOfSectors(arg_get_u32_def(ctx, 2, 1));
+
+    uint8_t blockNo = arg_get_u32_def(ctx, 3, 0);
+
     uint8_t keyType = 0;
+
+    if (arg_get_lit(ctx, 4) && arg_get_lit(ctx, 5)) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(WARNING, "Input key type must be A or B");
+        return PM3_EINVARG;
+    } else if (arg_get_lit(ctx, 5)) {
+        keyType = 1;
+    }
+
+    bool transferToEml = arg_get_lit(ctx, 6);
+    bool createDumpFile = arg_get_lit(ctx, 7);
+
+    CLIParserFree(ctx);
+
+    //validations
+    if (SectorsCnt == 0) {
+        PrintAndLogEx(WARNING, "Invalid MIFARE Type");    
+        return PM3_EINVARG;
+    }
+
+    if (keylen != 6) {
+        PrintAndLogEx(WARNING, "Input key must include 12 HEX symbols");
+        return PM3_EINVARG;
+    }
+
+    sector_t *e_sector = NULL;
+    
     uint8_t trgKeyType = 0;
-    uint8_t SectorsCnt = 0;
-    uint8_t key[6] = {0, 0, 0, 0, 0, 0};
+    
     uint8_t keyBlock[(ARRAYLEN(g_mifare_default_keys) + 1) * 6];
     uint64_t key64 = 0;
-    bool transferToEml = false;
-    bool createDumpFile = false;
-
-    if (strlen(Cmd) < 3) return usage_hf14_staticnested();
-
-    char cmdp, ctmp;
-    cmdp = tolower(param_getchar(Cmd, 0));
-    uint8_t blockNo = param_get8(Cmd, 1);
-    ctmp = tolower(param_getchar(Cmd, 2));
-
-    if (ctmp != 'a' && ctmp != 'b') {
-        PrintAndLogEx(WARNING, "key type must be A or B");
-        return PM3_EINVARG;
-    }
-
-    if (ctmp != 'a')
-        keyType = 1;
-
-    if (param_gethex(Cmd, 3, key, 12)) {
-        PrintAndLogEx(WARNING, "key must include 12 HEX symbols");
-        return PM3_EINVARG;
-    }
-
-    SectorsCnt = NumOfSectors(cmdp);
-    if (SectorsCnt == 0) return usage_hf14_staticnested();
-
-    uint8_t j = 4;
-    while (ctmp != 0x00) {
-
-        ctmp = tolower(param_getchar(Cmd, j));
-        transferToEml |= (ctmp == 't');
-        createDumpFile |= (ctmp == 'd');
-
-        j++;
-    }
 
     // check if tag have static nonce
     if (detect_classic_static_nonce() != NONCE_STATIC) {
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index f3b0d7061..368afa836 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -58,7 +58,6 @@ hf felica resetmode
 hf felica litesim
 hf felica litedump
 hf mf hardnested
-hf mf staticnested
 hf mf autopwn
 hf mf nack
 hf mf chk

From 99b1093702aaf53a63f5396b97b357f615516d00 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?An=C5=BEe=20Jen=C5=A1terle?= <anze@anze.xyz>
Date: Mon, 8 Feb 2021 01:12:14 +0100
Subject: [PATCH 524/682] Added actual MF DESfire enumeration

---
 client/src/cmdhfmfdes.c | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdhfmfdes.c b/client/src/cmdhfmfdes.c
index f5222fb9a..5c5966cdc 100644
--- a/client/src/cmdhfmfdes.c
+++ b/client/src/cmdhfmfdes.c
@@ -3907,7 +3907,26 @@ static int CmdHF14ADesEnumApplications(const char *Cmd) {
     dfname_t dfnames[255];
     uint8_t dfname_count = 0;
 
-    if (handler_desfire_appids(app_ids, &app_ids_len) != PM3_SUCCESS) {
+    int resAID = handler_desfire_appids(app_ids, &app_ids_len);
+    if (resAID == PM3_EAPDU_FAIL && bruteforce) {
+        PrintAndLogEx(WARNING, "Tag doesn't allow listing AIDs");
+        PrintAndLogEx(INFO, "Enumerating through all AIDs manually, this will take a while!");
+        for (uint32_t id = 0; id <= 0xFFFFFF; id++) {
+            uint8_t appId[3] = {(id & 0xFF), (id >> 8 & 0xFF), (id >> 16 & 0xFF)};
+            sAPDU apdu = {0x90, MFDES_SELECT_APPLICATION, 0x00, 0x00, 0x03, appId}; //0x5a
+            uint16_t sw = 0;
+            uint8_t data[255 * 5]  = {0x00};
+            uint32_t resplen = 0;
+            DESFIRESendApdu(!tag->rf_field_on, true, apdu, data, sizeof(data), &resplen, &sw);
+            if (sw == status(MFDES_S_OPERATION_OK)) {
+                PrintAndLogEx(DEBUG, "Got new APPID 0x%02X%02X%02X\n", appId[2], appId[1], appId[0]);
+                app_ids[app_ids_len] = appId[0];
+                app_ids[app_ids_len+1] = appId[1];
+                app_ids[app_ids_len+2] = appId[2];
+                app_ids_len+=3;
+            }
+        }
+    } else if (resAID != PM3_SUCCESS) {
         PrintAndLogEx(ERR, "Can't get list of applications on tag");
         DropFieldDesfire();
         return PM3_ESOFT;

From 6d10525c09536b0539e1510ea3effcc14221667f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?An=C5=BEe=20Jen=C5=A1terle?= <anze@anze.xyz>
Date: Mon, 8 Feb 2021 03:32:27 +0100
Subject: [PATCH 525/682] fixed missing parameter

---
 client/src/cmdhfmfdes.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/client/src/cmdhfmfdes.c b/client/src/cmdhfmfdes.c
index 5c5966cdc..4fb1721a3 100644
--- a/client/src/cmdhfmfdes.c
+++ b/client/src/cmdhfmfdes.c
@@ -3890,9 +3890,11 @@ static int CmdHF14ADesEnumApplications(const char *Cmd) {
 
     void *argtable[] = {
         arg_param_begin,
+        arg_lit0("b", "bruteforce", "Bruteforce AIDs if tag doesn't allow listing"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
+    bool bruteforce = arg_get_lit(ctx, 1);
     CLIParserFree(ctx);
 
     DropFieldDesfire();

From e22cb088c11fb898794155382b25b646b49ba064 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 8 Feb 2021 23:56:39 +0100
Subject: [PATCH 526/682] fix #1186

---
 client/src/cmdhfmfu.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index 5ae709a06..9ce5809f5 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -2757,11 +2757,6 @@ static int CmdHF14AMfUPwdGen(const char *Cmd) {
     if (selftest)
         return generator_selftest();
 
-    if (u_len != 7) {
-        PrintAndLogEx(WARNING, "Key must be 7 hex bytes");
-        return PM3_EINVARG;
-    }
-
     if (use_tag) {
         // read uid from tag
         clearCommandBuffer();
@@ -2785,6 +2780,11 @@ static int CmdHF14AMfUPwdGen(const char *Cmd) {
             return PM3_ESOFT;
         }
         memcpy(uid, card.uid, sizeof(uid));
+    } else {
+        if (u_len != 7) {
+            PrintAndLogEx(WARNING, "Key must be 7 hex bytes");
+            return PM3_EINVARG;
+        }
     }
 
     PrintAndLogEx(INFO, "---------------------------------");

From 8af1cedf1f2f363859d04252cee75e81360884d9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?An=C5=BEe=20Jen=C5=A1terle?= <anze@anze.xyz>
Date: Tue, 9 Feb 2021 15:17:20 +0100
Subject: [PATCH 527/682] Improved MFDES AID bruteforce

---
 client/src/cmdhfmfdes.c | 87 ++++++++++++++++++++++++++++++-----------
 1 file changed, 65 insertions(+), 22 deletions(-)

diff --git a/client/src/cmdhfmfdes.c b/client/src/cmdhfmfdes.c
index 4fb1721a3..c8a79af4b 100644
--- a/client/src/cmdhfmfdes.c
+++ b/client/src/cmdhfmfdes.c
@@ -3890,11 +3890,9 @@ static int CmdHF14ADesEnumApplications(const char *Cmd) {
 
     void *argtable[] = {
         arg_param_begin,
-        arg_lit0("b", "bruteforce", "Bruteforce AIDs if tag doesn't allow listing"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
-    bool bruteforce = arg_get_lit(ctx, 1);
     CLIParserFree(ctx);
 
     DropFieldDesfire();
@@ -3909,26 +3907,7 @@ static int CmdHF14ADesEnumApplications(const char *Cmd) {
     dfname_t dfnames[255];
     uint8_t dfname_count = 0;
 
-    int resAID = handler_desfire_appids(app_ids, &app_ids_len);
-    if (resAID == PM3_EAPDU_FAIL && bruteforce) {
-        PrintAndLogEx(WARNING, "Tag doesn't allow listing AIDs");
-        PrintAndLogEx(INFO, "Enumerating through all AIDs manually, this will take a while!");
-        for (uint32_t id = 0; id <= 0xFFFFFF; id++) {
-            uint8_t appId[3] = {(id & 0xFF), (id >> 8 & 0xFF), (id >> 16 & 0xFF)};
-            sAPDU apdu = {0x90, MFDES_SELECT_APPLICATION, 0x00, 0x00, 0x03, appId}; //0x5a
-            uint16_t sw = 0;
-            uint8_t data[255 * 5]  = {0x00};
-            uint32_t resplen = 0;
-            DESFIRESendApdu(!tag->rf_field_on, true, apdu, data, sizeof(data), &resplen, &sw);
-            if (sw == status(MFDES_S_OPERATION_OK)) {
-                PrintAndLogEx(DEBUG, "Got new APPID 0x%02X%02X%02X\n", appId[2], appId[1], appId[0]);
-                app_ids[app_ids_len] = appId[0];
-                app_ids[app_ids_len+1] = appId[1];
-                app_ids[app_ids_len+2] = appId[2];
-                app_ids_len+=3;
-            }
-        }
-    } else if (resAID != PM3_SUCCESS) {
+    if (handler_desfire_appids(app_ids, &app_ids_len) != PM3_SUCCESS) {
         PrintAndLogEx(ERR, "Can't get list of applications on tag");
         DropFieldDesfire();
         return PM3_ESOFT;
@@ -4004,6 +3983,69 @@ static int CmdHF14ADesEnumApplications(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
+static int CmdHF14ADesBruteApps(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mfdes bruteaid",
+                  "Recover AIDs by bruteforce.\n"
+                  "WARNING: This command takes a long time",
+                  "hf mfdes bruteaid                    -> Search all apps\n"
+                  "hf mfdes bruteaid -s F0000F -i 16    -> Search MAD range manually");
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_strx0("s",  "start",    "<aid>", "Starting App ID as hex bytes (3 bytes,big endian)"),
+        arg_strx0("e",  "end",      "<aid>", "Last App ID as hex bytes (3 bytes,big endian)"),
+        arg_int0("i",  "step", "<step>", "Increment step when bruteforcing (decimal integer)"),
+        arg_lit0("m", "mad", "Only bruteforce the MAD range"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    uint8_t startAid[3] = {0};
+    uint8_t endAid[3] = {0xFF, 0xFF, 0xFF};
+    int startLen = 0;
+    int endLen = 0;
+    CLIGetHexWithReturn(ctx, 1, startAid, &startLen);
+    CLIGetHexWithReturn(ctx, 2, endAid, &endLen);
+    uint32_t idIncrement = arg_get_int_def(ctx, 3, 1);
+    bool mad = arg_get_lit(ctx, 4);
+    CLIParserFree(ctx);
+    // TODO: We need to check the tag version, EV1 should stop after 26 apps are found
+    
+    // uint8_t app_ids[32*3] = {0}; // we are hoping to find less than 32 apps, this can backfire spectacularly
+    // uint8_t app_ids_len = 0;
+    if (mad) {
+        idIncrement = 0x10;
+        startAid[0] = 0xF0;
+        startAid[1] = 0x00;
+        startAid[2] = 0x0F;
+    }
+    uint32_t idStart = (startAid[0] << 16) + (startAid[1] << 8) + startAid[2];
+    uint32_t idEnd = (endAid[0] << 16) + (endAid[1] << 8) + endAid[2];
+    PrintAndLogEx(INFO, "Enumerating through all AIDs manually, this will take a while!");
+    for (uint32_t id = idStart; id <= idEnd && id >= idStart; id += idIncrement) {
+        if (kbd_enter_pressed()) break;
+        int progress = ((id - idStart)*100) / ((idEnd - idStart));
+        PrintAndLogEx(INPLACE, "Progress: %d %%, current AID: %06X", progress, id);
+        uint8_t appId[3] = {(id & 0xFF), (id >> 8 & 0xFF), (id >> 16 & 0xFF)};
+        sAPDU apdu = {0x90, MFDES_SELECT_APPLICATION, 0x00, 0x00, 0x03, appId}; //0x5a
+        uint16_t sw = 0;
+        uint8_t data[255 * 5]  = {0x00};
+        uint32_t resplen = 0;
+        DESFIRESendApdu(!tag->rf_field_on, true, apdu, data, sizeof(data), &resplen, &sw);
+        if (sw == status(MFDES_S_OPERATION_OK)) {
+            printf("\33[2K\r"); // clear current line before printing
+            PrintAndLogEx(SUCCESS, "Got new APPID %06X", id);
+            // app_ids[app_ids_len] = appId[0];
+            // app_ids[app_ids_len+1] = appId[1];
+            // app_ids[app_ids_len+2] = appId[2];
+            // app_ids_len+=3;
+        }
+    }
+    PrintAndLogEx(SUCCESS, "Done");
+    DropFieldDesfire();
+    return PM3_SUCCESS;
+}
+
 static int CmdHF14ADesChangeKey(const char *Cmd) {
     //DropFieldDesfire();
     // NR  DESC     KEYLENGHT
@@ -4945,6 +4987,7 @@ static command_t CommandTable[] = {
 //    {"ndef",             CmdHF14aDesNDEF,             IfPm3Iso14443a,  "Prints NDEF records from card"},
 //    {"mad",             CmdHF14aDesMAD,             IfPm3Iso14443a,  "Prints MAD records from card"},
     {"-----------",      CmdHelp,                     IfPm3Iso14443a,  "----------------------- " _CYAN_("AID") " -----------------------"},
+    {"bruteaid",         CmdHF14ADesBruteApps,        IfPm3Iso14443a,  "Recover AIDs by bruteforce"},
     {"createaid",        CmdHF14ADesCreateApp,        IfPm3Iso14443a,  "Create Application ID"},
     {"deleteaid",        CmdHF14ADesDeleteApp,        IfPm3Iso14443a,  "Delete Application ID"},
     {"selectaid",        CmdHF14ADesSelectApp,        IfPm3Iso14443a,  "Select Application ID"},

From cf8256979d6c2bd3fa460345884780bb81f6cfd6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?An=C5=BEe=20Jen=C5=A1terle?= <anze@anze.xyz>
Date: Tue, 9 Feb 2021 16:15:52 +0100
Subject: [PATCH 528/682] fix code per comments

---
 client/src/cmdhfmfdes.c | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/client/src/cmdhfmfdes.c b/client/src/cmdhfmfdes.c
index c8a79af4b..4fb4703df 100644
--- a/client/src/cmdhfmfdes.c
+++ b/client/src/cmdhfmfdes.c
@@ -3993,9 +3993,9 @@ static int CmdHF14ADesBruteApps(const char *Cmd) {
 
     void *argtable[] = {
         arg_param_begin,
-        arg_strx0("s",  "start",    "<aid>", "Starting App ID as hex bytes (3 bytes,big endian)"),
-        arg_strx0("e",  "end",      "<aid>", "Last App ID as hex bytes (3 bytes,big endian)"),
-        arg_int0("i",  "step", "<step>", "Increment step when bruteforcing (decimal integer)"),
+        arg_strx0("s",  "start",    "<hex>", "Starting App ID as hex bytes (3 bytes,big endian)"),
+        arg_strx0("e",  "end",      "<hex>", "Last App ID as hex bytes (3 bytes,big endian)"),
+        arg_int0("i",  "step", "<dec>", "Increment step when bruteforcing (decimal integer)"),
         arg_lit0("m", "mad", "Only bruteforce the MAD range"),
         arg_param_end
     };
@@ -4010,23 +4010,21 @@ static int CmdHF14ADesBruteApps(const char *Cmd) {
     bool mad = arg_get_lit(ctx, 4);
     CLIParserFree(ctx);
     // TODO: We need to check the tag version, EV1 should stop after 26 apps are found
-    
-    // uint8_t app_ids[32*3] = {0}; // we are hoping to find less than 32 apps, this can backfire spectacularly
-    // uint8_t app_ids_len = 0;
     if (mad) {
         idIncrement = 0x10;
         startAid[0] = 0xF0;
         startAid[1] = 0x00;
         startAid[2] = 0x0F;
     }
-    uint32_t idStart = (startAid[0] << 16) + (startAid[1] << 8) + startAid[2];
-    uint32_t idEnd = (endAid[0] << 16) + (endAid[1] << 8) + endAid[2];
+    uint32_t idStart = le24toh(startAid);
+    uint32_t idEnd = le24toh(endAid);
     PrintAndLogEx(INFO, "Enumerating through all AIDs manually, this will take a while!");
     for (uint32_t id = idStart; id <= idEnd && id >= idStart; id += idIncrement) {
         if (kbd_enter_pressed()) break;
         int progress = ((id - idStart)*100) / ((idEnd - idStart));
         PrintAndLogEx(INPLACE, "Progress: %d %%, current AID: %06X", progress, id);
-        uint8_t appId[3] = {(id & 0xFF), (id >> 8 & 0xFF), (id >> 16 & 0xFF)};
+        uint8_t appId[3] = {0};
+        htole24(id, appId);
         sAPDU apdu = {0x90, MFDES_SELECT_APPLICATION, 0x00, 0x00, 0x03, appId}; //0x5a
         uint16_t sw = 0;
         uint8_t data[255 * 5]  = {0x00};
@@ -4035,10 +4033,6 @@ static int CmdHF14ADesBruteApps(const char *Cmd) {
         if (sw == status(MFDES_S_OPERATION_OK)) {
             printf("\33[2K\r"); // clear current line before printing
             PrintAndLogEx(SUCCESS, "Got new APPID %06X", id);
-            // app_ids[app_ids_len] = appId[0];
-            // app_ids[app_ids_len+1] = appId[1];
-            // app_ids[app_ids_len+2] = appId[2];
-            // app_ids_len+=3;
         }
     }
     PrintAndLogEx(SUCCESS, "Done");

From 8760068a0304940654f75e54b8ff2895f15fa6a5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?An=C5=BEe=20Jen=C5=A1terle?= <anze@anze.xyz>
Date: Tue, 9 Feb 2021 16:52:48 +0100
Subject: [PATCH 529/682] make style

---
 client/src/cmdhfmfdes.c | 2 +-
 doc/commands.md         | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdhfmfdes.c b/client/src/cmdhfmfdes.c
index 4fb4703df..fa9b29b18 100644
--- a/client/src/cmdhfmfdes.c
+++ b/client/src/cmdhfmfdes.c
@@ -4021,7 +4021,7 @@ static int CmdHF14ADesBruteApps(const char *Cmd) {
     PrintAndLogEx(INFO, "Enumerating through all AIDs manually, this will take a while!");
     for (uint32_t id = idStart; id <= idEnd && id >= idStart; id += idIncrement) {
         if (kbd_enter_pressed()) break;
-        int progress = ((id - idStart)*100) / ((idEnd - idStart));
+        int progress = ((id - idStart) * 100) / ((idEnd - idStart));
         PrintAndLogEx(INPLACE, "Progress: %d %%, current AID: %06X", progress, id);
         uint8_t appId[3] = {0};
         htole24(id, appId);
diff --git a/doc/commands.md b/doc/commands.md
index 3c55c5368..b20dfe64d 100644
--- a/doc/commands.md
+++ b/doc/commands.md
@@ -433,6 +433,7 @@ Check column "offline" for their availability.
 |`hf mfdes getuid        `|N       |`Get random uid`
 |`hf mfdes info          `|N       |`Tag information`
 |`hf mfdes list          `|Y       |`List DESFire (ISO 14443A) history`
+|`hf mfdes bruteaid      `|N       |`Recover AIDs by bruteforce`
 |`hf mfdes createaid     `|N       |`Create Application ID`
 |`hf mfdes deleteaid     `|N       |`Delete Application ID`
 |`hf mfdes selectaid     `|N       |`Select Application ID`

From cd36770c5ef730598ee184fa8c1e158bfe2cf770 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?An=C5=BEe=20Jen=C5=A1terle?= <anze@anze.xyz>
Date: Tue, 9 Feb 2021 16:56:55 +0100
Subject: [PATCH 530/682] make style

---
 armsrc/Standalone/lf_em4100emul.c           |  4 +-
 armsrc/Standalone/lf_em4100rswb.c           |  4 +-
 armsrc/Standalone/lf_em4100rwc.c            |  4 +-
 armsrc/iclass.c                             |  6 +-
 armsrc/mifareutil.c                         |  2 +-
 client/deps/hardnested/hardnested_bf_core.c |  2 +-
 client/src/cmdhf14a.c                       |  2 +-
 client/src/cmdhf14b.c                       |  2 +-
 client/src/cmdhw.c                          |  8 +--
 client/src/cmdlf.c                          | 62 ++++++++++-----------
 client/src/cmdlfem410x.c                    |  4 +-
 client/src/cmdlfindala.c                    |  2 +-
 client/src/cmdlft55xx.c                     | 28 +++++-----
 client/src/cmdtrace.c                       |  2 +-
 client/src/util.c                           |  2 +-
 client/src/util.h                           |  2 +-
 client/src/wiegand_formats.c                | 24 ++++----
 client/src/wiegand_formatutils.c            |  8 +--
 common/generator.c                          | 14 ++---
 common/iso15693tools.c                      |  2 +-
 doc/commands.md                             | 12 ++--
 tools/hitag2crack/crack5opencl/opencl.c     |  2 +-
 22 files changed, 99 insertions(+), 99 deletions(-)

diff --git a/armsrc/Standalone/lf_em4100emul.c b/armsrc/Standalone/lf_em4100emul.c
index e23986ab7..b77f5e2e1 100644
--- a/armsrc/Standalone/lf_em4100emul.c
+++ b/armsrc/Standalone/lf_em4100emul.c
@@ -52,8 +52,8 @@ static void fill_buff(uint8_t bit) {
 static void construct_EM410x_emul(uint64_t id) {
 
     int i, j;
-    int binary[4] = {0,0,0,0};
-    int parity[4] = {0,0,0,0};
+    int binary[4] = {0, 0, 0, 0};
+    int parity[4] = {0, 0, 0, 0};
     buflen = 0;
 
     for (i = 0; i < 9; i++)
diff --git a/armsrc/Standalone/lf_em4100rswb.c b/armsrc/Standalone/lf_em4100rswb.c
index 060795bd1..27e288e23 100644
--- a/armsrc/Standalone/lf_em4100rswb.c
+++ b/armsrc/Standalone/lf_em4100rswb.c
@@ -100,8 +100,8 @@ static void fill_buff(uint8_t bit) {
 
 static void construct_EM410x_emul(uint64_t id) {
     int i, j;
-    int binary[4] = {0,0,0,0};
-    int parity[4] = {0,0,0,0};
+    int binary[4] = {0, 0, 0, 0};
+    int parity[4] = {0, 0, 0, 0};
     buflen = 0;
 
     for (i = 0; i < 9; i++)
diff --git a/armsrc/Standalone/lf_em4100rwc.c b/armsrc/Standalone/lf_em4100rwc.c
index 9240feb47..5df6e1a90 100644
--- a/armsrc/Standalone/lf_em4100rwc.c
+++ b/armsrc/Standalone/lf_em4100rwc.c
@@ -67,8 +67,8 @@ static void fill_buff(uint8_t bit) {
 static void construct_EM410x_emul(uint64_t id) {
 
     int i, j;
-    int binary[4] = {0,0,0,0};
-    int parity[4] = {0,0,0,0};
+    int binary[4] = {0, 0, 0, 0};
+    int parity[4] = {0, 0, 0, 0};
     buflen = 0;
 
     for (i = 0; i < 9; i++)
diff --git a/armsrc/iclass.c b/armsrc/iclass.c
index f31f17204..4d5975324 100644
--- a/armsrc/iclass.c
+++ b/armsrc/iclass.c
@@ -1489,7 +1489,7 @@ bool authenticate_iclass_tag(iclass_auth_req_t *payload, picopass_hdr *hdr, uint
         memcpy(cmd_check + 1, payload->key, 8);
 
     } else {
-        
+
         uint8_t div_key[8] = {0};
         if (payload->use_raw)
             memcpy(div_key, payload->key, 8);
@@ -1885,7 +1885,7 @@ void iClass_WriteBlock(uint8_t *msg) {
             res = false;
             switch_off();
             if (payload->req.send_reply)
-                reply_ng(CMD_HF_ICLASS_WRITEBL, PM3_ETEAROFF, (uint8_t*)&res, sizeof(uint8_t));
+                reply_ng(CMD_HF_ICLASS_WRITEBL, PM3_ETEAROFF, (uint8_t *)&res, sizeof(uint8_t));
             return;
         } else {
 
@@ -1927,7 +1927,7 @@ out:
     switch_off();
 
     if (payload->req.send_reply)
-        reply_ng(CMD_HF_ICLASS_WRITEBL, PM3_SUCCESS, (uint8_t*)&res, sizeof(uint8_t));
+        reply_ng(CMD_HF_ICLASS_WRITEBL, PM3_SUCCESS, (uint8_t *)&res, sizeof(uint8_t));
 }
 
 void iClass_Restore(iclass_restore_req_t *msg) {
diff --git a/armsrc/mifareutil.c b/armsrc/mifareutil.c
index 8fc747a97..e22ab64c7 100644
--- a/armsrc/mifareutil.c
+++ b/armsrc/mifareutil.c
@@ -68,7 +68,7 @@ uint8_t mf_crypto1_encrypt4bit(struct Crypto1State *pcs, uint8_t data) {
 
 // send X byte basic commands
 int mifare_sendcmd(uint8_t cmd, uint8_t *data, uint8_t data_size, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing) {
-    
+
     uint8_t dcmd[data_size + 3];
     dcmd[0] = cmd;
     if (data_size > 0)
diff --git a/client/deps/hardnested/hardnested_bf_core.c b/client/deps/hardnested/hardnested_bf_core.c
index e856d26e1..0f9eb3da8 100644
--- a/client/deps/hardnested/hardnested_bf_core.c
+++ b/client/deps/hardnested/hardnested_bf_core.c
@@ -579,7 +579,7 @@ static SIMDExecInstr GetSIMDInstr(void) {
             instr = SIMD_MMX;
         else
 #endif
-        instr = SIMD_NONE;
+            instr = SIMD_NONE;
 
     return instr;
 }
diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index 447bcd4db..2cbb60d49 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -2114,7 +2114,7 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
 
     if (isST)
         PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf st info`"));
-    
+
     if (isEMV)
         PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`emv search -sk`"));
 
diff --git a/client/src/cmdhf14b.c b/client/src/cmdhf14b.c
index 4de6ddd12..ee73e62b5 100644
--- a/client/src/cmdhf14b.c
+++ b/client/src/cmdhf14b.c
@@ -202,7 +202,7 @@ static bool wait_cmd_14b(bool verbose, bool is_select) {
                               (crc) ? _GREEN_("ok") : _RED_("fail")
                              );
             } else if (len == 0) {
-                    PrintAndLogEx(INFO, "no response from tag");
+                PrintAndLogEx(INFO, "no response from tag");
             } else {
                 PrintAndLogEx(SUCCESS, "%s", sprint_hex(data, len));
             }
diff --git a/client/src/cmdhw.c b/client/src/cmdhw.c
index 519995867..49da91a83 100644
--- a/client/src/cmdhw.c
+++ b/client/src/cmdhw.c
@@ -267,10 +267,10 @@ static void lookupChipID(uint32_t iChipID, uint32_t mem_used) {
     }
 
     PrintAndLogEx(NORMAL, "  --= Nonvolatile program memory: " _YELLOW_("%uK") " bytes %s ( " _YELLOW_("%2.0f%%") " used )"
-                , mem_avail
-                , asBuff
-                , mem_avail == 0 ? 0.0f : (float)mem_used / (mem_avail * 1024) * 100
-                );
+                  , mem_avail
+                  , asBuff
+                  , mem_avail == 0 ? 0.0f : (float)mem_used / (mem_avail * 1024) * 100
+                 );
 
     switch ((iChipID & 0xF000) >> 12) {
         case 0:
diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index bfd62c013..1e14f97eb 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -239,18 +239,18 @@ int CmdLFCommandRead(const char *Cmd) {
 
     int cmd_len = 128;
     char cmd[128] = {0};
-    CLIGetStrWithReturn(ctx, 2, (uint8_t*)cmd, &cmd_len);
+    CLIGetStrWithReturn(ctx, 2, (uint8_t *)cmd, &cmd_len);
 
     int extra_arg_len = 250;
     char extra_arg[250] = {0};
-    CLIGetStrWithReturn(ctx, 3, (uint8_t*)extra_arg, &extra_arg_len);
+    CLIGetStrWithReturn(ctx, 3, (uint8_t *)extra_arg, &extra_arg_len);
 
     uint16_t period_1 = arg_get_u32_def(ctx, 4, 0);
     uint16_t period_0 = arg_get_u32_def(ctx, 5, 0);
     uint32_t samples = arg_get_u32_def(ctx, 6, 0);
     bool verbose = arg_get_lit(ctx, 7);
     bool cm = arg_get_lit(ctx, 8);
-    CLIParserFree(ctx);  
+    CLIParserFree(ctx);
 
     if (session.pm3_present == false)
         return PM3_ENOTTY;
@@ -276,7 +276,7 @@ int CmdLFCommandRead(const char *Cmd) {
     // extra symbol definition
     uint8_t index_extra = 0;
     int i = 0;
-    for (; i < extra_arg_len; ) {
+    for (; i < extra_arg_len;) {
 
         if (index_extra < LF_CMDREAD_MAX_EXTRA_SYMBOLS - 1) {
             payload.symbol_extra[index_extra] = extra_arg[i];
@@ -505,9 +505,9 @@ int CmdLFConfig(const char *Cmd) {
     bool reset = arg_get_lit(ctx, 8);
     int32_t skip = arg_get_int_def(ctx, 9, -1);
     int16_t trigg = arg_get_int_def(ctx, 10, -1);
-    CLIParserFree(ctx);  
+    CLIParserFree(ctx);
 
-    if (session.pm3_present == false) 
+    if (session.pm3_present == false)
         return PM3_ENOTTY;
 
     // if called with no params, just print the device config
@@ -516,7 +516,7 @@ int CmdLFConfig(const char *Cmd) {
     }
 
     if (use_125 + use_134 > 1) {
-        PrintAndLogEx(ERR,"use only one of 125 or 134 params");
+        PrintAndLogEx(ERR, "use only one of 125 or 134 params");
         return PM3_EINVARG;
     }
 
@@ -535,7 +535,7 @@ int CmdLFConfig(const char *Cmd) {
         config.bits_per_sample = 8;
         config.averaging = 1,
         config.divisor = LF_DIVISOR_125;
-        config.samples_to_skip = 0;        
+        config.samples_to_skip = 0;
         config.trigger_threshold = 0;
         g_lf_threshold_set = false;
     }
@@ -555,14 +555,14 @@ int CmdLFConfig(const char *Cmd) {
             config.bits_per_sample = 8;
     }
 
-    if ( dec > -1 ) {
+    if (dec > -1) {
         // decimation is limited to 8
         config.decimation = (dec & 0x0F);
         if (config.decimation > 8)
             config.decimation = 8;
     }
 
-    if ( div > -1 ) {
+    if (div > -1) {
         config.divisor = div;
         if (config.divisor < 19) {
             PrintAndLogEx(ERR, "divisor must be between 19 and 255");
@@ -570,7 +570,7 @@ int CmdLFConfig(const char *Cmd) {
         }
     }
 
-    if (freq > -1 ) {
+    if (freq > -1) {
         config.divisor = LF_FREQ2DIV(freq);
         if (config.divisor < 19) {
             PrintAndLogEx(ERR, "freq must be between 47 and 600");
@@ -795,7 +795,7 @@ int CmdLFSim(const char *Cmd) {
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
     uint16_t gap = arg_get_u32_def(ctx, 1, 0);
-    CLIParserFree(ctx); 
+    CLIParserFree(ctx);
 
     if (session.pm3_present == false) {
         PrintAndLogEx(DEBUG, "DEBUG: no proxmark present");
@@ -821,7 +821,7 @@ int CmdLFSim(const char *Cmd) {
     payload.gap = gap;
 
     clearCommandBuffer();
-    SendCommandNG(CMD_LF_SIMULATE, (uint8_t *)&payload, sizeof(payload));   
+    SendCommandNG(CMD_LF_SIMULATE, (uint8_t *)&payload, sizeof(payload));
     return lfsim_wait_check(CMD_LF_SIMULATE);
 }
 
@@ -848,7 +848,7 @@ int CmdLFfskSim(const char *Cmd) {
         arg_param_begin,
         arg_u64_0("c", "clk", "<dec>", "manually set clock - can autodetect if using DemodBuffer (default 64)"),
         arg_u64_0(NULL, "low", "<dec>", "manually set larger Field Clock"),
-        arg_u64_0(NULL, "high", "<dec>", "manually set smaller Field Clock"),        
+        arg_u64_0(NULL, "high", "<dec>", "manually set smaller Field Clock"),
         arg_lit0(NULL, "stt", "TBD! - STT to enable a gap between playback repetitions (default: no gap)"),
         arg_str0("d", "data", "<hex>", "data to sim - omit to use DemodBuffer"),
         arg_lit0("v", "verbose", "verbose output"),
@@ -862,9 +862,9 @@ int CmdLFfskSim(const char *Cmd) {
 
     int raw_len = 64;
     char raw[64] = {0};
-    CLIGetStrWithReturn(ctx, 5, (uint8_t*)raw, &raw_len);
+    CLIGetStrWithReturn(ctx, 5, (uint8_t *)raw, &raw_len);
     bool verbose = arg_get_lit(ctx, 6);
-    CLIParserFree(ctx); 
+    CLIParserFree(ctx);
 
     // No args
     if (raw_len == 0 && DemodBufferLen == 0) {
@@ -972,9 +972,9 @@ int CmdLFaskSim(const char *Cmd) {
 
     int raw_len = 64;
     char raw[64] = {0};
-    CLIGetStrWithReturn(ctx, 7, (uint8_t*)raw, &raw_len);
+    CLIGetStrWithReturn(ctx, 7, (uint8_t *)raw, &raw_len);
     bool verbose = arg_get_lit(ctx, 8);
-    CLIParserFree(ctx); 
+    CLIParserFree(ctx);
 
     if ((use_bi + use_am + use_ar) > 1) {
         PrintAndLogEx(ERR, "only one encoding can be set");
@@ -995,7 +995,7 @@ int CmdLFaskSim(const char *Cmd) {
 
     uint8_t bs[256] = {0x00};
     int bs_len = hextobinarray((char *)bs, raw);
-    if (bs_len == 0) { 
+    if (bs_len == 0) {
         // Using data from DemodBuffer
         // might be able to autodetect FC and clock from Graphbuffer if using demod buffer
         // will need carrier, clock, and bitstream
@@ -1053,7 +1053,7 @@ int CmdLFaskSim(const char *Cmd) {
 // sim psk data given carrier, clock, invert
 // - allow pull data from DemodBuffer or parameters
 int CmdLFpskSim(const char *Cmd) {
- 
+
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "lf simpsk",
                   "Simulate PSK tag from demodbuffer or input",
@@ -1065,7 +1065,7 @@ int CmdLFpskSim(const char *Cmd) {
         arg_param_begin,
         arg_lit0("1", "psk1", "set PSK1 (default)"),
         arg_lit0("2", "psk2", "set PSK2"),
-        arg_lit0("3", "psk3", "set PSK3"),        
+        arg_lit0("3", "psk3", "set PSK3"),
         arg_lit0("i", "inv", "invert data"),
         arg_u64_0("c", "clk", "<dec>", "manually set clock - can autodetect if using DemodBuffer (default 32)"),
         arg_u64_0(NULL, "fc", "<dec>", "2|4|8 are valid carriers (default 2)"),
@@ -1082,7 +1082,7 @@ int CmdLFpskSim(const char *Cmd) {
     uint8_t carrier = arg_get_u32_def(ctx, 6, 2);
     int raw_len = 64;
     char raw[64] = {0};
-    CLIGetStrWithReturn(ctx, 7, (uint8_t*)raw, &raw_len);
+    CLIGetStrWithReturn(ctx, 7, (uint8_t *)raw, &raw_len);
     bool verbose = arg_get_lit(ctx, 8);
     CLIParserFree(ctx);
 
@@ -1090,7 +1090,7 @@ int CmdLFpskSim(const char *Cmd) {
         PrintAndLogEx(ERR, "only one PSK mode can be set");
         return PM3_EINVARG;
     }
-    
+
     if (carrier != 2 && carrier != 4 && carrier != 8) {
         PrintAndLogEx(ERR, "Wrong carrier given, expected <2|4|8>");
         return PM3_EINVARG;
@@ -1111,7 +1111,7 @@ int CmdLFpskSim(const char *Cmd) {
     uint8_t bs[256] = {0x00};
     int bs_len = hextobinarray((char *)bs, raw);
 
-    if (bs_len == 0) { 
+    if (bs_len == 0) {
         // Using data from DemodBuffer
         // might be able to autodetect FC and clock from Graphbuffer if using demod buffer
         // will need carrier, clock, and bitstream
@@ -1120,7 +1120,7 @@ int CmdLFpskSim(const char *Cmd) {
         int res = 0;
         if (clk == 0) {
             res = GetPskClock("", verbose);
-            if ( res < 1) {
+            if (res < 1) {
                 clk = 32;
             } else {
                 clk = (uint8_t)res;
@@ -1128,12 +1128,12 @@ int CmdLFpskSim(const char *Cmd) {
         }
 
         if (carrier == 0) {
-             res = GetPskCarrier(verbose);
-             if (res < 1 ) {
-                 carrier = 2;
-             } else {
-                 carrier = (uint8_t)res;
-             }
+            res = GetPskCarrier(verbose);
+            if (res < 1) {
+                carrier = 2;
+            } else {
+                carrier = (uint8_t)res;
+            }
         }
 
         PrintAndLogEx(DEBUG, "Detected rf/%u, fc/%u, n %zu ", clk, carrier, DemodBufferLen);
diff --git a/client/src/cmdlfem410x.c b/client/src/cmdlfem410x.c
index 0bd692ddd..1c82aadce 100644
--- a/client/src/cmdlfem410x.c
+++ b/client/src/cmdlfem410x.c
@@ -560,8 +560,8 @@ static int CmdEM410xBrute(const char *Cmd) {
         payload.gap = 0;
 
         clearCommandBuffer();
-        SendCommandNG(CMD_LF_SIMULATE, (uint8_t *)&payload, sizeof(payload));   
-        
+        SendCommandNG(CMD_LF_SIMULATE, (uint8_t *)&payload, sizeof(payload));
+
         PacketResponseNG resp;
         if (WaitForResponseTimeout(CMD_LF_SIMULATE, &resp, delay)) {
             if (resp.status == PM3_EOPABORTED) {
diff --git a/client/src/cmdlfindala.c b/client/src/cmdlfindala.c
index b210116a8..b2719ba1e 100644
--- a/client/src/cmdlfindala.c
+++ b/client/src/cmdlfindala.c
@@ -584,7 +584,7 @@ static int CmdIndalaSim(const char *Cmd) {
     }
 
     // a0 00 00 00 bd 98 9a 11
-    
+
     // indala PSK
     // It has to send either 64bits (8bytes) or 224bits (28bytes).  Zero padding needed if not.
     // lf simpsk 1 c 32 r 2 d 0102030405060708
diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index 6a7a2881d..46ef31744 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -897,7 +897,7 @@ static int CmdT55xxWakeUp(const char *Cmd) {
         return PM3_EINVARG;
     }
 
-    bool verbose = arg_get_lit(ctx, 2);    
+    bool verbose = arg_get_lit(ctx, 2);
     bool r0 = arg_get_lit(ctx, 3);
     bool r1 = arg_get_lit(ctx, 4);
     bool r2 = arg_get_lit(ctx, 5);
@@ -951,7 +951,7 @@ static int CmdT55xxDetect(const char *Cmd) {
 
     // 1 (help) + 2 (two user specified params) + (6 T55XX_DLMODE_ALL)
     void *argtable[3 + 6] = {
-        arg_param_begin,        
+        arg_param_begin,
         arg_lit0("1", NULL, "extract using data from graphbuffer"),
         arg_str0("p", "pwd", "<hex>", "password (4 hex bytes)"),
     };
@@ -1719,13 +1719,13 @@ static int CmdT55xxDangerousRaw(const char *Cmd) {
         return PM3_EINVARG;
     }
 
-    int bs_len = binstring2binarray(ng.data, (char*)bin, bin_len);
+    int bs_len = binstring2binarray(ng.data, (char *)bin, bin_len);
     if (bs_len == 0) {
         return PM3_EINVARG;
     }
 
     ng.bitlen = bs_len;
-    
+
     PacketResponseNG resp;
     clearCommandBuffer();
     SendCommandNG(CMD_LF_T55XX_DANGERRAW, (uint8_t *)&ng, sizeof(ng));
@@ -2963,8 +2963,8 @@ static int CmdT55xxChkPwds(const char *Cmd) {
       start index to call arg_add_t55xx_downloadlink() is 4 (1 + 3) given the above sample
     */
 
-   // 1 (help) + 3 (three user specified params) + (6 T55XX_DLMODE_ALL)
-   void *argtable[4 + 6] = {
+    // 1 (help) + 3 (three user specified params) + (6 T55XX_DLMODE_ALL)
+    void *argtable[4 + 6] = {
         arg_param_begin,
         arg_lit0("m", "fm", "use dictionary from flash memory (RDV4)"),
         arg_str0("f", "file", "<filename>", "file name"),
@@ -2980,7 +2980,7 @@ static int CmdT55xxChkPwds(const char *Cmd) {
     char filename[FILE_PATH_SIZE] = {0};
     CLIParamStrToBuf(arg_get_str(ctx, 2), (uint8_t *)filename, sizeof(filename), &fnlen);
 
-                // White cloner password based on EM4100 ID
+    // White cloner password based on EM4100 ID
     bool use_calc_password = false;
     uint32_t card_password = 0x00;
     uint64_t cardid = 0;
@@ -3087,7 +3087,7 @@ static int CmdT55xxChkPwds(const char *Cmd) {
     }
 
     // to try each downlink mode for each password
-    int dl_mode; 
+    int dl_mode;
 
     // try calculated password
     if (use_calc_password) {
@@ -3180,7 +3180,7 @@ static int CmdT55xxBruteForce(const char *Cmd) {
                   "lf t55xx bruteforce --r2 -s aaaaaa77 -e aaaaaa99\n"
                  );
 
-     // 1 (help) + 2 (two user specified params) + (6 T55XX_DLMODE_ALL)
+    // 1 (help) + 2 (two user specified params) + (6 T55XX_DLMODE_ALL)
     void *argtable[3 + 6] = {
         arg_param_begin,
         arg_str1("s", "start", "<hex>", "search start password (4 hex bytes)"),
@@ -3307,7 +3307,7 @@ static int CmdT55xxRecoverPW(const char *Cmd) {
                   "lf t55xx recoverpw -p 11223344 --r3\n"
                  );
 
-     // 1 (help) + 1 (one user specified params) + (6 T55XX_DLMODE_ALL)
+    // 1 (help) + 1 (one user specified params) + (6 T55XX_DLMODE_ALL)
     void *argtable[2 + 6] = {
         arg_param_begin,
         arg_str0("p", "pwd", "<hex>", "password (4 hex bytes)"),
@@ -3547,7 +3547,7 @@ static int CmdT55xxDetectPage1(const char *Cmd) {
                   "lf t55xx p1detect -p 11223344 --r3\n"
                  );
 
-     // 1 (help) + 2 (two user specified params) + (5 T55XX_DLMODE_SINGLE)
+    // 1 (help) + 2 (two user specified params) + (5 T55XX_DLMODE_SINGLE)
     void *argtable[3 + 5] = {
         arg_param_begin,
         arg_lit0("1", NULL, "extract using data from graphbuffer"),
@@ -3645,7 +3645,7 @@ static int CmdT55xxSetDeviceConfig(const char *Cmd) {
                   "lf t55xx deviceconfig -a 55 -b 14 -c 21 -d 30          -> default EM4305"
                  );
 
-     // 1 (help) + 9 (nine user specified params) + (5 T55XX_DLMODE_SINGLE)
+    // 1 (help) + 9 (nine user specified params) + (5 T55XX_DLMODE_SINGLE)
     void *argtable[10 + 5] = {
         arg_param_begin,
         arg_int0("a", NULL, "<8..255>", "Set start gap"),
@@ -3911,10 +3911,10 @@ static int CmdT55xxSniff(const char *Cmd) {
     uint8_t width1 = 0;
     uint8_t width0 = 0;
 
-    if (opt_width0 > -1) 
+    if (opt_width0 > -1)
         width0 = (uint8_t)opt_width0 & 0xFF;
 
-    if (opt_width1 > -1) 
+    if (opt_width1 > -1)
         width1 = (uint8_t)opt_width1 & 0xFF;
 
 
diff --git a/client/src/cmdtrace.c b/client/src/cmdtrace.c
index c47eff9d3..4369d3a71 100644
--- a/client/src/cmdtrace.c
+++ b/client/src/cmdtrace.c
@@ -133,7 +133,7 @@ static uint16_t printHexLine(uint16_t tracepos, uint16_t traceLen, uint8_t *trac
     return ret;
 }
 
-static uint16_t printTraceLine(uint16_t tracepos, uint16_t traceLen, uint8_t *trace, uint8_t protocol, bool showWaitCycles, bool markCRCBytes, uint32_t *prev_eot, bool use_us, 
+static uint16_t printTraceLine(uint16_t tracepos, uint16_t traceLen, uint8_t *trace, uint8_t protocol, bool showWaitCycles, bool markCRCBytes, uint32_t *prev_eot, bool use_us,
                                const uint64_t *mfDicKeys, uint32_t mfDicKeysCount) {
     // sanity check
     if (is_last_record(tracepos, traceLen)) {
diff --git a/client/src/util.c b/client/src/util.c
index 0f206b9d2..03a1e68f8 100644
--- a/client/src/util.c
+++ b/client/src/util.c
@@ -811,7 +811,7 @@ void binarraytobinstring(char *target, char *source,  int length) {
     *target = '\0';
 }
 
-int binstring2binarray(uint8_t* target, char *source, int length) {
+int binstring2binarray(uint8_t *target, char *source, int length) {
     int count = 0;
     char *start = source;
     while (length--) {
diff --git a/client/src/util.h b/client/src/util.h
index 54a0e8e80..4d86553c2 100644
--- a/client/src/util.h
+++ b/client/src/util.h
@@ -83,7 +83,7 @@ int hextobinarray(char *target, char *source);
 int hextobinstring(char *target, char *source);
 int binarraytohex(char *target, const size_t targetlen, char *source, size_t srclen);
 void binarraytobinstring(char *target,  char *source, int length);
-int binstring2binarray(uint8_t* target, char *source, int length);
+int binstring2binarray(uint8_t *target, char *source, int length);
 
 uint8_t GetParity(uint8_t *bits, uint8_t type, int length);
 void wiegand_add_parity(uint8_t *target, uint8_t *source, uint8_t length);
diff --git a/client/src/wiegand_formats.c b/client/src/wiegand_formats.c
index b2ec25e4c..2dfd39fbd 100644
--- a/client/src/wiegand_formats.c
+++ b/client/src/wiegand_formats.c
@@ -586,22 +586,22 @@ static bool Pack_HGeneric37(wiegand_card_t *card, wiegand_message_t *packed, boo
 
     // even1
     set_bit_by_position(packed,
-        evenparity32(
-            get_nonlinear_field(packed, 8, (uint8_t[]) {4, 8, 12, 16, 20, 24, 28, 32}))
-            , 0
-            );
+                        evenparity32(
+    get_nonlinear_field(packed, 8, (uint8_t[]) {4, 8, 12, 16, 20, 24, 28, 32}))
+    , 0
+                       );
     // odd1
     set_bit_by_position(packed,
-        oddparity32(
-            get_nonlinear_field(packed, 8, (uint8_t[]) {6, 10, 14, 18, 22, 26, 30, 34}))
-            , 2
-            );
+                        oddparity32(
+    get_nonlinear_field(packed, 8, (uint8_t[]) {6, 10, 14, 18, 22, 26, 30, 34}))
+    , 2
+                       );
     // even2
     set_bit_by_position(packed,
-        evenparity32(
-            get_nonlinear_field(packed, 8, (uint8_t[]) {7, 11, 15, 19, 23, 27, 31, 35}))
-            , 3
-            );
+                        evenparity32(
+    get_nonlinear_field(packed, 8, (uint8_t[]) {7, 11, 15, 19, 23, 27, 31, 35}))
+    , 3
+                       );
     if (preamble)
         return add_HID_header(packed);
     return true;
diff --git a/client/src/wiegand_formatutils.c b/client/src/wiegand_formatutils.c
index 212a30151..5e36334bd 100644
--- a/client/src/wiegand_formatutils.c
+++ b/client/src/wiegand_formatutils.c
@@ -121,10 +121,10 @@ bool set_nonlinear_field(wiegand_message_t *data, uint64_t value, uint8_t numBit
 }
 
 static uint8_t get_length_from_header(wiegand_message_t *data) {
-/**
- * detect if message has "preamble" / "sentinel bit"
- * 
- */
+    /**
+     * detect if message has "preamble" / "sentinel bit"
+     *
+     */
 
 
     uint8_t len = 0;
diff --git a/common/generator.c b/common/generator.c
index 8c2927a41..85be456f4 100644
--- a/common/generator.c
+++ b/common/generator.c
@@ -485,13 +485,13 @@ int mfc_algo_touch_one(uint8_t *uid, uint8_t sector, uint8_t keytype, uint64_t *
     if (key == NULL) return PM3_EINVARG;
 
     *key = (
-        (uint64_t)(uid[1] ^ uid[2] ^ uid[3]) << 40 |
-        (uint64_t)uid[1] << 32 |
-        (uint64_t)uid[2] << 24 |
-        (uint64_t)(((uid[0] + uid[1] + uid[2] + uid[3]) % 0x100) ^ uid[3]) << 16 |
-        (uint64_t)0  << 8 |
-        (uint64_t)0 
-    );
+               (uint64_t)(uid[1] ^ uid[2] ^ uid[3]) << 40 |
+               (uint64_t)uid[1] << 32 |
+               (uint64_t)uid[2] << 24 |
+               (uint64_t)(((uid[0] + uid[1] + uid[2] + uid[3]) % 0x100) ^ uid[3]) << 16 |
+               (uint64_t)0  << 8 |
+               (uint64_t)0
+           );
     return PM3_SUCCESS;
 }
 
diff --git a/common/iso15693tools.c b/common/iso15693tools.c
index aa5119533..494242135 100644
--- a/common/iso15693tools.c
+++ b/common/iso15693tools.c
@@ -23,7 +23,7 @@ char *iso15693_sprintUID(char *dest, uint8_t *uid) {
         sprintf(dest, "%02X %02X %02X %02X %02X %02X %02X %02X",
                 uid[7], uid[6], uid[5], uid[4],
                 uid[3], uid[2], uid[1], uid[0]
-                );
+               );
     }
     return dest;
 }
diff --git a/doc/commands.md b/doc/commands.md
index 3c55c5368..bf880c8b9 100644
--- a/doc/commands.md
+++ b/doc/commands.md
@@ -534,13 +534,13 @@ Check column "offline" for their availability.
 |-------                  |------- |-----------
 |`lf help                `|Y       |`This help`
 |`lf config              `|N       |`Get/Set config for LF sampling, bit/sample, decimation, frequency`
-|`lf cmdread             `|N       |`Modulate LF reader field to send command before read (all periods in microseconds)`
+|`lf cmdread             `|N       |`Modulate LF reader field to send command before read`
 |`lf read                `|N       |`Read LF tag`
-|`lf search              `|Y       |`Read and Search for valid known tag (in offline mode it you can load first then search)`
-|`lf sim                 `|N       |`Simulate LF tag from buffer with optional GAP (in microseconds)`
-|`lf simask              `|N       |`Simulate LF ASK tag from demodbuffer or input`
-|`lf simfsk              `|N       |`Simulate LF FSK tag from demodbuffer or input`
-|`lf simpsk              `|N       |`Simulate LF PSK tag from demodbuffer or input`
+|`lf search              `|Y       |`Read and Search for valid known tag`
+|`lf sim                 `|N       |`Simulate LF tag from buffer`
+|`lf simask              `|N       |`Simulate ASK tag`
+|`lf simfsk              `|N       |`Simulate FSK tag`
+|`lf simpsk              `|N       |`Simulate PSK tag`
 |`lf simbidir            `|N       |`Simulate LF tag (with bidirectional data transmission between reader and tag)`
 |`lf sniff               `|N       |`Sniff LF traffic between reader and tag`
 |`lf tune                `|N       |`Continuously measure LF antenna tuning`
diff --git a/tools/hitag2crack/crack5opencl/opencl.c b/tools/hitag2crack/crack5opencl/opencl.c
index 5251a7627..31cad1334 100644
--- a/tools/hitag2crack/crack5opencl/opencl.c
+++ b/tools/hitag2crack/crack5opencl/opencl.c
@@ -254,7 +254,7 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
 
                     if (verbose) printf("%14s: %s\n", "Device Type", (device_type & CL_DEVICE_TYPE_GPU) ? "GPU" : (device_type & CL_DEVICE_TYPE_CPU) ? "CPU" : "Other");
 
-                    if ((*cd_ctx)[platform_idx].selected == false) (*cd_ctx)[platform_idx].device[device_idx].selected = false;
+                    if ((*cd_ctx)[platform_idx].selected == false)(*cd_ctx)[platform_idx].device[device_idx].selected = false;
                     else (*cd_ctx)[platform_idx].device[device_idx].selected = plat_dev_enabled(global_device_id, dev_sel, dev_cnt, (unsigned int) device_type, device_types_selected);
                     global_device_id++;
                     if ((*cd_ctx)[platform_idx].device[device_idx].selected)(*selected_devices_cnt)++;

From b20f5322820560d1ad1356f60dba6451235813f1 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Tue, 9 Feb 2021 23:22:46 +0100
Subject: [PATCH 531/682] - added missing timeout checks - relocated timer
 resets in standalone mode

---
 armsrc/Standalone/lf_tharexde.c | 20 +++++++++++---------
 armsrc/em4x50.c                 | 28 ++++++++++++++++++++--------
 2 files changed, 31 insertions(+), 17 deletions(-)

diff --git a/armsrc/Standalone/lf_tharexde.c b/armsrc/Standalone/lf_tharexde.c
index d3c8fddc0..0d7393e01 100644
--- a/armsrc/Standalone/lf_tharexde.c
+++ b/armsrc/Standalone/lf_tharexde.c
@@ -133,6 +133,7 @@ void RunMod(void) {
 
     rdv40_spiffs_lazy_mount();
     StandAloneMode();
+    FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
     Dbprintf(_YELLOW_("Standalone mode THAREXDE started"));
 
     for (;;) {
@@ -204,10 +205,11 @@ void RunMod(void) {
                 for (int i = 0; i < EM4X50_NO_WORDS; i++) {
                     sprintf((char *)entry + strlen((char *)entry), "%08"PRIx32"\n", tag[i]);
                 }
-                log_exists = exists_in_spiffs(LF_EM4X50_LOGFILE_SIM);
-                Dbprintf("log_exists = %i", log_exists);
-                //append(LF_EM4X50_LOGFILE_SIM, entry, strlen((char *)entry));
 
+                if (exists_in_spiffs(LF_EM4X50_LOGFILE_SIM)) {
+                    rdv40_spiffs_remove(LF_EM4X50_LOGFILE_SIM, RDV40_SPIFFS_SAFETY_SAFE);
+                }
+                rdv40_spiffs_write(LF_EM4X50_LOGFILE_SIM, entry, strlen((char *)entry), RDV40_SPIFFS_SAFETY_SAFE);
             }
             
             // stop if key (pm3 button or enter key) has been pressed
@@ -253,13 +255,13 @@ void RunMod(void) {
                 sprintf((char *)entry + strlen((char *)entry), "\n");
                 append(LF_EM4X50_LOGFILE_COLLECT, entry, strlen((char *)entry));
             }
-
-            // reset timer
-            AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; // re-enable timer and wait for TC0
-            AT91C_BASE_TC0->TC_RC  = 0; // set TIOA (carry bit) on overflow, return to zero
-            AT91C_BASE_TC0->TC_RA  = 1; // clear carry bit on next clock cycle
-            AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; // reset and re-enable timer
         }
+        
+        // reset timer
+        AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; // re-enable timer and wait for TC0
+        AT91C_BASE_TC0->TC_RC  = 0; // set TIOA (carry bit) on overflow, return to zero
+        AT91C_BASE_TC0->TC_RA  = 1; // clear carry bit on next clock cycle
+        AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; // reset and re-enable timer
     }
 
     if (state == STATE_READ) {
diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index 91bfdef4f..17db0cfb1 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -1222,11 +1222,19 @@ static int em4x50_sim_read_bit(void) {
     while (cycles < EM4X50_T_TAG_FULL_PERIOD) {
 
         // wait until reader field disappears
-        while (!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
+        while ((timeout--) && !(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
+        if (timeout <= 0) {
+            return PM3_ETIMEOUT;
+        }
+        timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
 
         // now check until reader switches on carrier field
         tval = GetTicks();
-        while (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
+        while ((timeout--) && (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
+
+            if (timeout <= 0) {
+                return PM3_ETIMEOUT;
+            }
 
             // check if current cycle takes longer than "usual""
             if (GetTicks() - tval > EM4X50_T_ZERO_DETECTION * CYCLES2TICKS) {
@@ -1237,7 +1245,7 @@ static int em4x50_sim_read_bit(void) {
                 if (timeout <= 0) {
                     return PM3_ETIMEOUT;
                 }
-                // timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
+                //timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
 
                 // now we have a reference "position", from here it will take
                 // slightly less than 32 cycles until the end of the bit period
@@ -1248,6 +1256,7 @@ static int em4x50_sim_read_bit(void) {
                 return 0;
             }
         }
+        timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
 
         // no gap detected, i.e. reader field is still up;
         // continue with counting cycles
@@ -1431,11 +1440,14 @@ static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
     // last word read protected
     int lwrp = (reflect32(tag[EM4X50_PROTECTION]) >> 8) & 0xFF;
 
+    int command = PM3_SUCCESS;
+
     while ((BUTTON_PRESS() == false) && (data_available() == false)) {
 
         WDT_HIT();
 
-        int command = em4x50_sim_send_listen_window(tag);
+        command = em4x50_sim_send_listen_window(tag);
+        
         if (command != PM3_SUCCESS) {
             return command;
         }
@@ -1737,19 +1749,19 @@ void em4x50_handle_commands(int *command, uint32_t *tag) {
             break;
 
         case EM4X50_COMMAND_RESET:
-            *command =  em4x50_sim_handle_reset_command(tag);
+            *command = em4x50_sim_handle_reset_command(tag);
             break;
 
         case EM4X50_COMMAND_WRITE:
-            *command =  em4x50_sim_handle_write_command(tag);
+            *command = em4x50_sim_handle_write_command(tag);
             break;
 
         case EM4X50_COMMAND_WRITE_PASSWORD:
-            *command =  em4x50_sim_handle_writepwd_command(tag);
+            *command = em4x50_sim_handle_writepwd_command(tag);
             break;
 
         case EM4X50_COMMAND_SELECTIVE_READ:
-            *command =  em4x50_sim_handle_selective_read_command(tag);
+            *command = em4x50_sim_handle_selective_read_command(tag);
             break;
 
         case EM4X50_COMMAND_STANDARD_READ:

From a4da1476b644add85bd8140c8932cadbe597030b Mon Sep 17 00:00:00 2001
From: DarkMatterMatt <mattmoran2000@gmail.com>
Date: Wed, 10 Feb 2021 15:47:14 +1300
Subject: [PATCH 532/682] Fix Gallagher data decoding & CRC checks

Descramble function was re-scrambling the data
Skip constant magic prefix `7FEA` to get correct data to decode
Fix offsets & bitmasks to correctly decode card and region codes
Fix CRC refin & refout parameters (both now false)
---
 client/src/cmdlfgallagher.c | 44 ++++++++++++++++++++++++++++---------
 common/crc.c                |  4 ++--
 2 files changed, 36 insertions(+), 12 deletions(-)

diff --git a/client/src/cmdlfgallagher.c b/client/src/cmdlfgallagher.c
index 3e13aadf3..c83e5282e 100644
--- a/client/src/cmdlfgallagher.c
+++ b/client/src/cmdlfgallagher.c
@@ -29,8 +29,8 @@
 
 static int CmdHelp(const char *Cmd);
 
-static void descramble(uint8_t *arr, uint8_t len) {
-
+/*
+static void scramble(uint8_t *arr, uint8_t len) {
     uint8_t lut[] = {
         0xa3, 0xb0, 0x80, 0xc6, 0xb2, 0xf4, 0x5c, 0x6c, 0x81, 0xf1, 0xbb, 0xeb, 0x55, 0x67, 0x3c, 0x05,
         0x1a, 0x0e, 0x61, 0xf6, 0x22, 0xce, 0xaa, 0x8f, 0xbd, 0x3b, 0x1f, 0x5e, 0x44, 0x04, 0x51, 0x2e,
@@ -54,6 +54,32 @@ static void descramble(uint8_t *arr, uint8_t len) {
         arr[i] = lut[arr[i]];
     }
 }
+*/
+
+static void descramble(uint8_t *arr, uint8_t len) {
+    uint8_t lut[] = {
+        0x2f, 0x6e, 0xdd, 0xdf, 0x1d, 0x0f, 0xb0, 0x76, 0xad, 0xaf, 0x7f, 0xbb, 0x77, 0x85, 0x11, 0x6d,
+        0xf4, 0xd2, 0x84, 0x42, 0xeb, 0xf7, 0x34, 0x55, 0x4a, 0x3a, 0x10, 0x71, 0xe7, 0xa1, 0x62, 0x1a,
+        0x3e, 0x4c, 0x14, 0xd3, 0x5e, 0xb2, 0x7d, 0x56, 0xbc, 0x27, 0x82, 0x60, 0xe3, 0xae, 0x1f, 0x9b,
+        0xaa, 0x2b, 0x95, 0x49, 0x73, 0xe1, 0x92, 0x79, 0x91, 0x38, 0x6c, 0x19, 0x0e, 0xa9, 0xe2, 0x8d,
+        0x66, 0xc7, 0x5a, 0xf5, 0x1c, 0x80, 0x99, 0xbe, 0x4e, 0x41, 0xf0, 0xe8, 0xa6, 0x20, 0xab, 0x87,
+        0xc8, 0x1e, 0xa0, 0x59, 0x7b, 0x0c, 0xc3, 0x3c, 0x61, 0xcc, 0x40, 0x9e, 0x06, 0x52, 0x1b, 0x32,
+        0x8c, 0x12, 0x93, 0xbf, 0xef, 0x3b, 0x25, 0x0d, 0xc2, 0x88, 0xd1, 0xe0, 0x07, 0x2d, 0x70, 0xc6,
+        0x29, 0x6a, 0x4d, 0x47, 0x26, 0xa3, 0xe4, 0x8b, 0xf6, 0x97, 0x2c, 0x5d, 0x3d, 0xd7, 0x96, 0x28,
+        0x02, 0x08, 0x30, 0xa7, 0x22, 0xc9, 0x65, 0xf8, 0xb7, 0xb4, 0x8a, 0xca, 0xb9, 0xf2, 0xd0, 0x17,
+        0xff, 0x46, 0xfb, 0x9a, 0xba, 0x8f, 0xb6, 0x69, 0x68, 0x8e, 0x21, 0x6f, 0xc4, 0xcb, 0xb3, 0xce,
+        0x51, 0xd4, 0x81, 0x00, 0x2e, 0x9c, 0x74, 0x63, 0x45, 0xd9, 0x16, 0x35, 0x5f, 0xed, 0x78, 0x9f,
+        0x01, 0x48, 0x04, 0xc1, 0x33, 0xd6, 0x4f, 0x94, 0xde, 0x31, 0x9d, 0x0a, 0xac, 0x18, 0x4b, 0xcd,
+        0x98, 0xb8, 0x37, 0xa2, 0x83, 0xec, 0x03, 0xd8, 0xda, 0xe5, 0x7a, 0x6b, 0x53, 0xd5, 0x15, 0xa4,
+        0x43, 0xe9, 0x90, 0x67, 0x58, 0xc0, 0xa5, 0xfa, 0x2a, 0xb1, 0x75, 0x50, 0x39, 0x5c, 0xe6, 0xdc,
+        0x89, 0xfc, 0xcf, 0xfe, 0xf9, 0x57, 0x54, 0x64, 0xa8, 0xee, 0x23, 0x0b, 0xf1, 0xea, 0xfd, 0xdb,
+        0xbd, 0x09, 0xb5, 0x5b, 0x05, 0x86, 0x13, 0xf3, 0x24, 0xc5, 0x3f, 0x44, 0x72, 0x7c, 0x7e, 0x36
+    };
+
+    for (int i = 0; i < len;  i++) {
+        arr[i] = lut[arr[i]];
+    }
+}
 
 //see ASK/MAN Demod for what args are accepted
 int demodGallagher(bool verbose) {
@@ -81,7 +107,7 @@ int demodGallagher(bool verbose) {
     setDemodBuff(DemodBuffer, 96, ans);
     setClockGrid(g_DemodClock, g_DemodStartIdx + (ans * g_DemodClock));
 
-    //got a good demod
+    // got a good demod
     uint32_t raw1 = bytebits_to_byte(DemodBuffer, 32);
     uint32_t raw2 = bytebits_to_byte(DemodBuffer + 32, 32);
     uint32_t raw3 = bytebits_to_byte(DemodBuffer + 64, 32);
@@ -89,14 +115,12 @@ int demodGallagher(bool verbose) {
     // bytes
     uint8_t arr[8] = {0};
     for (int i = 0, pos = 0; i < ARRAYLEN(arr); i++) {
-        pos = (i * 8) + i;
+        pos = 16 + 9*i;
         arr[i] = bytebits_to_byte(DemodBuffer + pos, 8);
-        PrintAndLogEx(NORMAL, "%d -" NOLF, pos);
     }
-    PrintAndLogEx(NORMAL, "");
 
     // crc
-    uint8_t crc = bytebits_to_byte(DemodBuffer + 72, 8);
+    uint8_t crc = bytebits_to_byte(DemodBuffer + 16 + 9*8, 8);
     uint8_t calc_crc =  CRC8Cardx(arr, ARRAYLEN(arr));
 
     PrintAndLogEx(INFO, " Before:  %s", sprint_hex(arr, 8));
@@ -104,19 +128,19 @@ int demodGallagher(bool verbose) {
     PrintAndLogEx(INFO, " After :  %s", sprint_hex(arr, 8));
 
     // 4bit region code
-    uint8_t rc = (arr[3] & 0x0E) >> 1;
+    uint8_t rc = (arr[3] & 0x1E) >> 1;
 
     // 16bit FC
     uint16_t fc = (arr[5] & 0x0F) << 12 | arr[1] << 4 | ((arr[7] >> 4) & 0x0F);
 
     // 24bit CN
-    uint32_t cn = arr[0] << 16 | (arr[4] & 0x1F) << 11 | arr[2] << 3 | (arr[3] & 0xE0) >> 4;
+    uint32_t cn = arr[0] << 16 | (arr[4] & 0x1F) << 11 | arr[2] << 3 | (arr[3] & 0xE0) >> 5;
 
     // 4bit issue level
     uint8_t il = arr[7] & 0x0F;
 
     PrintAndLogEx(SUCCESS, "GALLAGHER - Region: " _GREEN_("%u") " FC: " _GREEN_("%u") " CN: " _GREEN_("%u") " Issue Level: " _GREEN_("%u"), rc, fc, cn, il);
-    PrintAndLogEx(SUCCESS, "   Printed: " _GREEN_("%C%u"), rc + 0x40, fc);
+    PrintAndLogEx(SUCCESS, "   Displayed: " _GREEN_("%C%u"), rc + 'A', fc);
     PrintAndLogEx(SUCCESS, "   Raw: %08X%08X%08X", raw1, raw2, raw3);
     PrintAndLogEx(SUCCESS, "   CRC: %02X - %02X (%s)", crc, calc_crc, (crc == calc_crc) ? "ok" : "fail");
     return PM3_SUCCESS;
diff --git a/common/crc.c b/common/crc.c
index 22bfad035..a922df6e7 100644
--- a/common/crc.c
+++ b/common/crc.c
@@ -126,10 +126,10 @@ uint32_t CRC8Legic(uint8_t *buff, size_t size) {
         crc_update2(&crc, buff[i], 8);
     return reflect8(crc_finish(&crc));
 }
-// width=8  poly=0x107, init=0x2C  refin=true  refout=true  xorout=0x0000  check=0 name="CRC-8/CARDX"
+// width=8  poly=0x7, init=0x2C  refin=false  refout=false  xorout=0x0000  check=0 name="CRC-8/CARDX"
 uint32_t CRC8Cardx(uint8_t *buff, size_t size) {
     crc_t crc;
-    crc_init_ref(&crc, 8, 0x107, 0x2C, 0, true, true);
+    crc_init_ref(&crc, 8, 0x7, 0x2C, 0, false, false);
     for (size_t i = 0; i < size; ++i)
         crc_update2(&crc, buff[i], 8);
     return crc_finish(&crc);

From 59ab2f338703c1fb7c1b9bdffee20c18864b43c2 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Wed, 10 Feb 2021 09:31:08 +0100
Subject: [PATCH 533/682] Added the original VID and PID values

---
 pm3 | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/pm3 b/pm3
index 1ee2ebeb8..0337bcab9 100755
--- a/pm3
+++ b/pm3
@@ -155,6 +155,15 @@ function get_pm3_list_Windows {
             return
         fi
     done
+	
+	# Original SERIAL PORTS (COM)
+    for DEV in $(wmic /locale:ms_409 path Win32_SerialPort Where "PNPDeviceID LIKE '%VID_2D2D&PID_504D%'" Get DeviceID 2>/dev/null | awk -b '/^COM/{print $1}'); do
+        DEV=${DEV/ */}
+        PM3LIST+=("$DEV")
+        if [ ${#PM3LIST[*]} -ge "$N" ]; then
+            return
+        fi
+    done
 
     #white BT dongle SERIAL PORTS (COM)
     if $FINDBTDONGLE; then
@@ -205,6 +214,21 @@ function get_pm3_list_WSL {
             fi
         fi
     done
+	
+	# Original SERIAL PORTS (COM)
+    for DEV in $($PSHEXE -command "Get-CimInstance -ClassName Win32_serialport | Where-Object PNPDeviceID -like '*VID_2D2D&PID_504D*' | Select DeviceID" 2>/dev/null | sed -nr 's#^COM([0-9]+)\b#/dev/ttyS\1#p'); do
+        # ttyS counterpart takes some more time to appear
+        if [ -e "$DEV" ]; then
+            PM3LIST+=("$DEV")
+            if [ ! -w "$DEV" ]; then
+                echo "[!] Let's give users read/write access to $DEV"
+                sudo chmod 666 "$DEV"
+            fi
+            if [ ${#PM3LIST[*]} -ge "$N" ]; then
+                return
+            fi
+        fi
+    done
 
     #white BT dongle SERIAL PORTS (COM)
     if $FINDBTDONGLE; then

From a265888e0831dd2bdd108fd84e520f9fde8da9d6 Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Wed, 10 Feb 2021 10:59:49 +0100
Subject: [PATCH 534/682] Merged VID/PID queries

---
 pm3 | 28 ++--------------------------
 1 file changed, 2 insertions(+), 26 deletions(-)

diff --git a/pm3 b/pm3
index 0337bcab9..d8e21d840 100755
--- a/pm3
+++ b/pm3
@@ -148,16 +148,7 @@ function get_pm3_list_Windows {
     fi
 
     # Normal SERIAL PORTS (COM)
-    for DEV in $(wmic /locale:ms_409 path Win32_SerialPort Where "PNPDeviceID LIKE '%VID_9AC4&PID_4B8F%'" Get DeviceID 2>/dev/null | awk -b '/^COM/{print $1}'); do
-        DEV=${DEV/ */}
-        PM3LIST+=("$DEV")
-        if [ ${#PM3LIST[*]} -ge "$N" ]; then
-            return
-        fi
-    done
-	
-	# Original SERIAL PORTS (COM)
-    for DEV in $(wmic /locale:ms_409 path Win32_SerialPort Where "PNPDeviceID LIKE '%VID_2D2D&PID_504D%'" Get DeviceID 2>/dev/null | awk -b '/^COM/{print $1}'); do
+    for DEV in $(wmic /locale:ms_409 path Win32_SerialPort Where "PNPDeviceID LIKE '%VID_9AC4&PID_4B8F%' Or PNPDeviceID LIKE '%VID_2D2D&PID_504D%'" Get DeviceID 2>/dev/null | awk -b '/^COM/{print $1}'); do
         DEV=${DEV/ */}
         PM3LIST+=("$DEV")
         if [ ${#PM3LIST[*]} -ge "$N" ]; then
@@ -201,22 +192,7 @@ function get_pm3_list_WSL {
     fi
 
     # Normal SERIAL PORTS (COM)
-    for DEV in $($PSHEXE -command "Get-CimInstance -ClassName Win32_serialport | Where-Object PNPDeviceID -like '*VID_9AC4&PID_4B8F*' | Select DeviceID" 2>/dev/null | sed -nr 's#^COM([0-9]+)\b#/dev/ttyS\1#p'); do
-        # ttyS counterpart takes some more time to appear
-        if [ -e "$DEV" ]; then
-            PM3LIST+=("$DEV")
-            if [ ! -w "$DEV" ]; then
-                echo "[!] Let's give users read/write access to $DEV"
-                sudo chmod 666 "$DEV"
-            fi
-            if [ ${#PM3LIST[*]} -ge "$N" ]; then
-                return
-            fi
-        fi
-    done
-	
-	# Original SERIAL PORTS (COM)
-    for DEV in $($PSHEXE -command "Get-CimInstance -ClassName Win32_serialport | Where-Object PNPDeviceID -like '*VID_2D2D&PID_504D*' | Select DeviceID" 2>/dev/null | sed -nr 's#^COM([0-9]+)\b#/dev/ttyS\1#p'); do
+    for DEV in $($PSHEXE -command "Get-CimInstance -ClassName Win32_serialport | Where-Object {$_.PNPDeviceID -like '*VID_9AC4&PID_4B8F*' -or $_.PNPDeviceID -like '*VID_2D2D&PID_504D*'} | Select DeviceID" 2>/dev/null | sed -nr 's#^COM([0-9]+)\b#/dev/ttyS\1#p'); do
         # ttyS counterpart takes some more time to appear
         if [ -e "$DEV" ]; then
             PM3LIST+=("$DEV")

From f655391bd4fb83cd1cd5f5e30cb5ecbb9679ae39 Mon Sep 17 00:00:00 2001
From: DarkMatterMatt <mattmoran2000@gmail.com>
Date: Thu, 11 Feb 2021 00:17:48 +1300
Subject: [PATCH 535/682] Initial implementation of encoding

---
 client/src/cmdlfgallagher.c | 108 +++++++++++++++++++++++++++++++++---
 1 file changed, 100 insertions(+), 8 deletions(-)

diff --git a/client/src/cmdlfgallagher.c b/client/src/cmdlfgallagher.c
index c83e5282e..7d9c3387f 100644
--- a/client/src/cmdlfgallagher.c
+++ b/client/src/cmdlfgallagher.c
@@ -29,7 +29,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-/*
 static void scramble(uint8_t *arr, uint8_t len) {
     uint8_t lut[] = {
         0xa3, 0xb0, 0x80, 0xc6, 0xb2, 0xf4, 0x5c, 0x6c, 0x81, 0xf1, 0xbb, 0xeb, 0x55, 0x67, 0x3c, 0x05,
@@ -54,7 +53,6 @@ static void scramble(uint8_t *arr, uint8_t len) {
         arr[i] = lut[arr[i]];
     }
 }
-*/
 
 static void descramble(uint8_t *arr, uint8_t len) {
     uint8_t lut[] = {
@@ -189,6 +187,45 @@ static int CmdGallagherReader(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
+static void createBlocks(uint32_t *blocks, uint8_t rc, uint16_t fc, uint32_t cn, uint8_t il) {
+    // put data into the correct places (Gallagher obfuscation)
+    uint8_t arr[8] = {0};
+    arr[0] = (cn & 0xffffff) >> 16;
+    arr[1] = (fc & 0xfff) >> 4;
+    arr[2] = (cn & 0x7ff) >> 3;
+    arr[3] = (cn & 0x7) << 5 | (rc & 0xf) << 1;
+    arr[4] = (cn & 0xffff) >> 11;
+    arr[5] = (fc & 0xffff) >> 12;
+    arr[6] = 0;
+    arr[7] = (fc & 0xf) << 4 | (il & 0xf);
+
+    // more obfuscation
+    scramble(arr, ARRAYLEN(arr));
+
+    // every byte has a 9th bit which is the inverse of the last bit
+    uint8_t bonus_bit[8] = {0};
+    for (int i = 0; i < 8; i++) {
+        bonus_bit[i] = !(arr[i] & 0x1);
+    }
+
+    // calculate checksum
+    uint8_t crc = CRC8Cardx(arr, ARRAYLEN(arr));
+
+    // magic prefix, then the 9-bit bytes, then the CRC
+    blocks[0] = (0x7fea << 16)
+            | (arr[0] << 8) | (bonus_bit[0] << 7)
+            | (arr[1] >> 1);
+    blocks[1] = ((arr[1] & 0x1) << 31) | (bonus_bit[1] << 30)
+            | (arr[2] << 22) | (bonus_bit[2] << 21)
+            | (arr[3] << 13) | (bonus_bit[3] << 12)
+            | (arr[4] << 4)  | (bonus_bit[4] << 3)
+            | (arr[5] >> 5);
+    blocks[2] = ((arr[5] & 0x1f) << 27) | (bonus_bit[5] << 26)
+            | (arr[6] << 18) | (bonus_bit[6] << 17)
+            | (arr[7] << 9)  | (bonus_bit[7] << 8)
+            | crc;
+}
+
 static int CmdGallagherClone(const char *Cmd) {
 
     CLIParserContext *ctx;
@@ -196,14 +233,19 @@ static int CmdGallagherClone(const char *Cmd) {
                   "clone a GALLAGHER tag to a T55x7, Q5/T5555 or EM4305/4469 tag.",
                   "lf gallagher clone --raw 0FFD5461A9DA1346B2D1AC32\n"
                   "lf gallagher clone --q5 --raw 0FFD5461A9DA1346B2D1AC32 -> encode for Q5/T5555 tag\n"
-                  "lf gallagher clone --em --raw 0FFD5461A9DA1346B2D1AC32 -> encode for EM4305/4469"
+                  "lf gallagher clone --em --raw 0FFD5461A9DA1346B2D1AC32 -> encode for EM4305/4469\n"
+                  "lf gallagher clone --rc 0 --fc 9876 --cn 1234 --il 1"
                  );
 
     void *argtable[] = {
         arg_param_begin,
-        arg_str1("r", "raw", "<hex>", "raw hex data. 12 bytes max"),
+        arg_str0("r", "raw", "<hex>", "raw hex data. 12 bytes max"),
         arg_lit0(NULL, "q5", "optional - specify writing to Q5/T5555 tag"),
         arg_lit0(NULL, "em", "optional - specify writing to EM4305/4469 tag"),
+        arg_int0(NULL, "rc", "<decimal>", "Region code. 4 bits max"),
+        arg_int0(NULL, "fc", "<decimal>", "Facility code. 2 bytes max"),
+        arg_int0(NULL, "cn", "<decimal>", "Card number. 3 bytes max"),
+        arg_int0(NULL, "il", "<decimal>", "Issue level. 4 bits max"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);
@@ -211,19 +253,68 @@ static int CmdGallagherClone(const char *Cmd) {
     int raw_len = 0;
     // skip first block,  3*4 = 12 bytes left
     uint8_t raw[12] = {0};
-    CLIGetHexWithReturn(ctx, 1, raw, &raw_len);
+    CLIParamHexToBuf(arg_get_str(ctx, 1), raw, sizeof raw, &raw_len);
+    
     bool q5 = arg_get_lit(ctx, 2);
     bool em = arg_get_lit(ctx, 3);
+    int16_t region_code = arg_get_int_def(ctx, 4, -1);
+    int32_t facility_code = arg_get_int_def(ctx, 5, -1);
+    uint64_t card_number = arg_get_int_def(ctx, 6, -1);
+    uint32_t issue_level = arg_get_int_def(ctx, 7, -1);
     CLIParserFree(ctx);
 
+    bool use_raw = raw_len > 0;
+
     if (q5 && em) {
         PrintAndLogEx(FAILED, "Can't specify both Q5 and EM4305 at the same time");
         return PM3_EINVARG;
     }
 
+    if (region_code == -1 && facility_code == -1 && card_number == -1 && issue_level == -1) {
+        if (!use_raw) {
+            PrintAndLogEx(FAILED, "Must specify either raw data to clone, or rc/fc/cn/il");
+            return PM3_EINVARG;
+        }
+    }
+    else {
+        // --raw and --rc/fc/cn/il are mutually exclusive
+        if (use_raw) {
+            PrintAndLogEx(FAILED, "Can't specify both raw and rc/fc/cn/il at the same time");
+            return PM3_EINVARG;
+        }
+        // if one is set, all must be set
+        if (region_code == -1 || facility_code == -1 || card_number == -1 || issue_level == -1) {
+            PrintAndLogEx(FAILED, "If rc/fc/cn/il is specified, all must be set");
+            return PM3_EINVARG;
+        }
+        // validate input
+        if (region_code > 0x0f) {
+            PrintAndLogEx(FAILED, "Region code must be less than 16 (4 bits)");
+            return PM3_EINVARG;
+        }
+        if (facility_code > 0xffff) {
+            PrintAndLogEx(FAILED, "Facility code must be less than 65536 (2 bytes)");
+            return PM3_EINVARG;
+        }
+        if (card_number > 0xffffff) {
+            PrintAndLogEx(FAILED, "Card number must be less than 16777216 (3 bytes)");
+            return PM3_EINVARG;
+        }
+        if (issue_level > 0x0f) {
+            PrintAndLogEx(FAILED, "Issue level must be less than 16 (4 bits)");
+            return PM3_EINVARG;
+        }
+    }
+
     uint32_t blocks[4];
-    for (uint8_t i = 1; i < ARRAYLEN(blocks); i++) {
-        blocks[i] = bytes_to_num(raw + ((i - 1) * 4), sizeof(uint32_t));
+    if (use_raw) {
+        for (uint8_t i = 1; i < ARRAYLEN(blocks); i++) {
+            blocks[i] = bytes_to_num(raw + ((i - 1) * 4), sizeof(uint32_t));
+        }
+    }
+    else {
+        // fill blocks 1 to 3 with Gallagher data
+        createBlocks(blocks + 1, region_code, facility_code, card_number, issue_level);
     }
 
     //Pac - compat mode, NRZ, data rate 40, 3 data blocks
@@ -241,7 +332,8 @@ static int CmdGallagherClone(const char *Cmd) {
         snprintf(cardtype, sizeof(cardtype), "EM4305/4469");
     }
 
-    PrintAndLogEx(INFO, "Preparing to clone Gallagher to " _YELLOW_("%s") " with raw hex", cardtype);
+    PrintAndLogEx(INFO, "Preparing to clone Gallagher to " _YELLOW_("%s") " from %s.",
+            cardtype, use_raw ? "raw hex" : "specified data");
     print_blocks(blocks,  ARRAYLEN(blocks));
 
     int res;

From 028bf22d8b34d82391794ef457faf0df49b7b6db Mon Sep 17 00:00:00 2001
From: gator96100 <jupuerzi@gmx.at>
Date: Wed, 10 Feb 2021 12:21:43 +0100
Subject: [PATCH 536/682] Escape needed for WSL

---
 pm3 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pm3 b/pm3
index d8e21d840..6aadf2eb7 100755
--- a/pm3
+++ b/pm3
@@ -192,7 +192,7 @@ function get_pm3_list_WSL {
     fi
 
     # Normal SERIAL PORTS (COM)
-    for DEV in $($PSHEXE -command "Get-CimInstance -ClassName Win32_serialport | Where-Object {$_.PNPDeviceID -like '*VID_9AC4&PID_4B8F*' -or $_.PNPDeviceID -like '*VID_2D2D&PID_504D*'} | Select DeviceID" 2>/dev/null | sed -nr 's#^COM([0-9]+)\b#/dev/ttyS\1#p'); do
+    for DEV in $($PSHEXE -command "Get-CimInstance -ClassName Win32_serialport | Where-Object {\$_.PNPDeviceID -like '*VID_9AC4&PID_4B8F*' -or \$_.PNPDeviceID -like '*VID_2D2D&PID_504D*'} | Select DeviceID" 2>/dev/null | sed -nr 's#^COM([0-9]+)\b#/dev/ttyS\1#p'); do
         # ttyS counterpart takes some more time to appear
         if [ -e "$DEV" ]; then
             PM3LIST+=("$DEV")

From 62ccbc0a3710b82b4a142a3040fd20b88b0c27a1 Mon Sep 17 00:00:00 2001
From: DarkMatterMatt <mattmoran2000@gmail.com>
Date: Thu, 11 Feb 2021 11:12:45 +1300
Subject: [PATCH 537/682] Fix styles

Run `make style`
---
 client/src/cmdlfgallagher.c | 32 +++++++++++++++-----------------
 1 file changed, 15 insertions(+), 17 deletions(-)

diff --git a/client/src/cmdlfgallagher.c b/client/src/cmdlfgallagher.c
index 7d9c3387f..f27869514 100644
--- a/client/src/cmdlfgallagher.c
+++ b/client/src/cmdlfgallagher.c
@@ -113,12 +113,12 @@ int demodGallagher(bool verbose) {
     // bytes
     uint8_t arr[8] = {0};
     for (int i = 0, pos = 0; i < ARRAYLEN(arr); i++) {
-        pos = 16 + 9*i;
+        pos = 16 + (9 * i);
         arr[i] = bytebits_to_byte(DemodBuffer + pos, 8);
     }
 
     // crc
-    uint8_t crc = bytebits_to_byte(DemodBuffer + 16 + 9*8, 8);
+    uint8_t crc = bytebits_to_byte(DemodBuffer + 16 + (9 * 8), 8);
     uint8_t calc_crc =  CRC8Cardx(arr, ARRAYLEN(arr));
 
     PrintAndLogEx(INFO, " Before:  %s", sprint_hex(arr, 8));
@@ -213,17 +213,17 @@ static void createBlocks(uint32_t *blocks, uint8_t rc, uint16_t fc, uint32_t cn,
 
     // magic prefix, then the 9-bit bytes, then the CRC
     blocks[0] = (0x7fea << 16)
-            | (arr[0] << 8) | (bonus_bit[0] << 7)
-            | (arr[1] >> 1);
+                | (arr[0] << 8) | (bonus_bit[0] << 7)
+                | (arr[1] >> 1);
     blocks[1] = ((arr[1] & 0x1) << 31) | (bonus_bit[1] << 30)
-            | (arr[2] << 22) | (bonus_bit[2] << 21)
-            | (arr[3] << 13) | (bonus_bit[3] << 12)
-            | (arr[4] << 4)  | (bonus_bit[4] << 3)
-            | (arr[5] >> 5);
+                | (arr[2] << 22) | (bonus_bit[2] << 21)
+                | (arr[3] << 13) | (bonus_bit[3] << 12)
+                | (arr[4] << 4)  | (bonus_bit[4] << 3)
+                | (arr[5] >> 5);
     blocks[2] = ((arr[5] & 0x1f) << 27) | (bonus_bit[5] << 26)
-            | (arr[6] << 18) | (bonus_bit[6] << 17)
-            | (arr[7] << 9)  | (bonus_bit[7] << 8)
-            | crc;
+                | (arr[6] << 18) | (bonus_bit[6] << 17)
+                | (arr[7] << 9)  | (bonus_bit[7] << 8)
+                | crc;
 }
 
 static int CmdGallagherClone(const char *Cmd) {
@@ -254,7 +254,7 @@ static int CmdGallagherClone(const char *Cmd) {
     // skip first block,  3*4 = 12 bytes left
     uint8_t raw[12] = {0};
     CLIParamHexToBuf(arg_get_str(ctx, 1), raw, sizeof raw, &raw_len);
-    
+
     bool q5 = arg_get_lit(ctx, 2);
     bool em = arg_get_lit(ctx, 3);
     int16_t region_code = arg_get_int_def(ctx, 4, -1);
@@ -275,8 +275,7 @@ static int CmdGallagherClone(const char *Cmd) {
             PrintAndLogEx(FAILED, "Must specify either raw data to clone, or rc/fc/cn/il");
             return PM3_EINVARG;
         }
-    }
-    else {
+    } else {
         // --raw and --rc/fc/cn/il are mutually exclusive
         if (use_raw) {
             PrintAndLogEx(FAILED, "Can't specify both raw and rc/fc/cn/il at the same time");
@@ -311,8 +310,7 @@ static int CmdGallagherClone(const char *Cmd) {
         for (uint8_t i = 1; i < ARRAYLEN(blocks); i++) {
             blocks[i] = bytes_to_num(raw + ((i - 1) * 4), sizeof(uint32_t));
         }
-    }
-    else {
+    } else {
         // fill blocks 1 to 3 with Gallagher data
         createBlocks(blocks + 1, region_code, facility_code, card_number, issue_level);
     }
@@ -333,7 +331,7 @@ static int CmdGallagherClone(const char *Cmd) {
     }
 
     PrintAndLogEx(INFO, "Preparing to clone Gallagher to " _YELLOW_("%s") " from %s.",
-            cardtype, use_raw ? "raw hex" : "specified data");
+                  cardtype, use_raw ? "raw hex" : "specified data");
     print_blocks(blocks,  ARRAYLEN(blocks));
 
     int res;

From 0fdbdb044f70c030366253db73613b3c60281769 Mon Sep 17 00:00:00 2001
From: DarkMatterMatt <mattmoran2000@gmail.com>
Date: Thu, 11 Feb 2021 11:30:22 +1300
Subject: [PATCH 538/682] Use ARRAYLEN instead of constant length

---
 client/src/cmdlfgallagher.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdlfgallagher.c b/client/src/cmdlfgallagher.c
index f27869514..593e47d2c 100644
--- a/client/src/cmdlfgallagher.c
+++ b/client/src/cmdlfgallagher.c
@@ -204,7 +204,7 @@ static void createBlocks(uint32_t *blocks, uint8_t rc, uint16_t fc, uint32_t cn,
 
     // every byte has a 9th bit which is the inverse of the last bit
     uint8_t bonus_bit[8] = {0};
-    for (int i = 0; i < 8; i++) {
+    for (int i = 0; i < ARRAYLEN(bonus_bit); i++) {
         bonus_bit[i] = !(arr[i] & 0x1);
     }
 

From 03347fcfea179b39a21fe07337e5415ee1a8e167 Mon Sep 17 00:00:00 2001
From: DarkMatterMatt <mattmoran2000@gmail.com>
Date: Thu, 11 Feb 2021 14:07:14 +1300
Subject: [PATCH 539/682] Refactor how blocks are generated to be cleaner

---
 client/src/cmdlfgallagher.c | 35 +++++++++++++++++++++--------------
 1 file changed, 21 insertions(+), 14 deletions(-)

diff --git a/client/src/cmdlfgallagher.c b/client/src/cmdlfgallagher.c
index 593e47d2c..a15d1e4ea 100644
--- a/client/src/cmdlfgallagher.c
+++ b/client/src/cmdlfgallagher.c
@@ -187,6 +187,16 @@ static int CmdGallagherReader(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
+static void setBitsInBlocks(uint32_t *blocks, uint8_t *pos, uint32_t data, uint8_t data_len) {
+    for (int i = data_len - 1; i >= 0; i--) {
+        uint8_t blk = *pos / 32;
+        uint8_t bitPos = 31 - *pos % 32; // fill from left
+        uint8_t bit = (data >> i) & 1;
+        blocks[blk] |= bit << bitPos;
+        (*pos)++;
+    }
+}
+
 static void createBlocks(uint32_t *blocks, uint8_t rc, uint16_t fc, uint32_t cn, uint8_t il) {
     // put data into the correct places (Gallagher obfuscation)
     uint8_t arr[8] = {0};
@@ -202,7 +212,7 @@ static void createBlocks(uint32_t *blocks, uint8_t rc, uint16_t fc, uint32_t cn,
     // more obfuscation
     scramble(arr, ARRAYLEN(arr));
 
-    // every byte has a 9th bit which is the inverse of the last bit
+    // every byte is followed by a bit which is the inverse of the last bit
     uint8_t bonus_bit[8] = {0};
     for (int i = 0; i < ARRAYLEN(bonus_bit); i++) {
         bonus_bit[i] = !(arr[i] & 0x1);
@@ -211,19 +221,16 @@ static void createBlocks(uint32_t *blocks, uint8_t rc, uint16_t fc, uint32_t cn,
     // calculate checksum
     uint8_t crc = CRC8Cardx(arr, ARRAYLEN(arr));
 
-    // magic prefix, then the 9-bit bytes, then the CRC
-    blocks[0] = (0x7fea << 16)
-                | (arr[0] << 8) | (bonus_bit[0] << 7)
-                | (arr[1] >> 1);
-    blocks[1] = ((arr[1] & 0x1) << 31) | (bonus_bit[1] << 30)
-                | (arr[2] << 22) | (bonus_bit[2] << 21)
-                | (arr[3] << 13) | (bonus_bit[3] << 12)
-                | (arr[4] << 4)  | (bonus_bit[4] << 3)
-                | (arr[5] >> 5);
-    blocks[2] = ((arr[5] & 0x1f) << 27) | (bonus_bit[5] << 26)
-                | (arr[6] << 18) | (bonus_bit[6] << 17)
-                | (arr[7] << 9)  | (bonus_bit[7] << 8)
-                | crc;
+    blocks[0] = blocks[1] = blocks[2] = 0;
+    uint8_t pos = 0;
+
+    // magic prefix, then the bytes with their extra bit, then the CRC
+    setBitsInBlocks(blocks, &pos, 0x7fea, 16);
+    for (int i = 0; i < ARRAYLEN(arr); i++) {
+        setBitsInBlocks(blocks, &pos, arr[i], 8);
+        setBitsInBlocks(blocks, &pos, bonus_bit[i], 1);
+    }
+    setBitsInBlocks(blocks, &pos, crc, 8);
 }
 
 static int CmdGallagherClone(const char *Cmd) {

From 73465e51673c1802501be08e0df9541b178b1ecf Mon Sep 17 00:00:00 2001
From: DarkMatterMatt <mattmoran2000@gmail.com>
Date: Thu, 11 Feb 2021 17:36:02 +1300
Subject: [PATCH 540/682] Reorder & simplify code

---
 client/src/cmdlfgallagher.c | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/client/src/cmdlfgallagher.c b/client/src/cmdlfgallagher.c
index a15d1e4ea..0a48563a3 100644
--- a/client/src/cmdlfgallagher.c
+++ b/client/src/cmdlfgallagher.c
@@ -212,24 +212,22 @@ static void createBlocks(uint32_t *blocks, uint8_t rc, uint16_t fc, uint32_t cn,
     // more obfuscation
     scramble(arr, ARRAYLEN(arr));
 
-    // every byte is followed by a bit which is the inverse of the last bit
-    uint8_t bonus_bit[8] = {0};
-    for (int i = 0; i < ARRAYLEN(bonus_bit); i++) {
-        bonus_bit[i] = !(arr[i] & 0x1);
-    }
-
-    // calculate checksum
-    uint8_t crc = CRC8Cardx(arr, ARRAYLEN(arr));
-
     blocks[0] = blocks[1] = blocks[2] = 0;
     uint8_t pos = 0;
 
-    // magic prefix, then the bytes with their extra bit, then the CRC
+    // magic prefix
     setBitsInBlocks(blocks, &pos, 0x7fea, 16);
+
     for (int i = 0; i < ARRAYLEN(arr); i++) {
+        // data byte
         setBitsInBlocks(blocks, &pos, arr[i], 8);
-        setBitsInBlocks(blocks, &pos, bonus_bit[i], 1);
+
+        // every byte is followed by a bit which is the inverse of the last bit
+        setBitsInBlocks(blocks, &pos, !(arr[i] & 0x1), 1);
     }
+
+    // checksum
+    uint8_t crc = CRC8Cardx(arr, ARRAYLEN(arr));
     setBitsInBlocks(blocks, &pos, crc, 8);
 }
 

From 724ac356653f217895fe164881444d5430c2e45f Mon Sep 17 00:00:00 2001
From: Akif Dinc <akif@dinc.org>
Date: Thu, 11 Feb 2021 12:22:40 +0100
Subject: [PATCH 541/682] Typo in hf 14a help

---
 client/src/cmdhf14a.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index 2cbb60d49..87fd7b818 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -2321,7 +2321,7 @@ static command_t CommandTable[] = {
     {"raw",         CmdHF14ACmdRaw,       IfPm3Iso14443a,  "Send raw hex data to tag"},
     {"antifuzz",    CmdHF14AAntiFuzz,     IfPm3Iso14443a,  "Fuzzing the anticollision phase.  Warning! Readers may react strange"},
     {"config",      CmdHf14AConfig,       IfPm3Iso14443a,  "Configure 14a settings (use with caution)"},
-    {"apdufind",    CmdHf14AFindapdu,     IfPm3Iso14443a,  "Enuerate APDUs - CLA/INS/P1P2"},
+    {"apdufind",    CmdHf14AFindapdu,     IfPm3Iso14443a,  "Enumerate APDUs - CLA/INS/P1P2"},
     {NULL, NULL, NULL, NULL}
 };
 

From bd574300588ff63ea6517a83de35783da77555a7 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 11 Feb 2021 15:35:12 +0100
Subject: [PATCH 542/682] ..not recommend _keep field on_

---
 client/src/cmdhf14a.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index 87fd7b818..a2212005f 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -2116,7 +2116,7 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
         PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf st info`"));
 
     if (isEMV)
-        PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`emv search -sk`"));
+        PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`emv search -s`"));
 
     PrintAndLogEx(NORMAL, "");
     DropField();

From 6416aaa52b6138602e61fc3b68fb7b2bd6f28474 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 11 Feb 2021 15:36:56 +0100
Subject: [PATCH 543/682] add simple detection of file based on extension ftc

---
 client/src/fileutils.c | 38 ++++++++++++++++++++++++++++++++++++++
 client/src/fileutils.h |  7 +++++++
 2 files changed, 45 insertions(+)

diff --git a/client/src/fileutils.c b/client/src/fileutils.c
index d68c95563..137d2640b 100644
--- a/client/src/fileutils.c
+++ b/client/src/fileutils.c
@@ -77,6 +77,44 @@ struct wave_info_t {
     } PACKED audio_data;
 } PACKED;
 
+/**
+ * @brief detects if file is of a supported filetype based on extension
+ * @param filename
+ * @return o
+ */
+DumpFileType_t getfiletype(const char *filename) {
+    // assume unknown file is BINARY
+    DumpFileType_t o = BIN;
+    if (filename == NULL) {
+        return o;
+    }
+
+    size_t len = strlen(filename);
+    if (len > 4) { 
+        //  check if valid file extension and attempt to load data
+        char s[FILE_PATH_SIZE];
+        memset(s, 0, sizeof(s));
+        memcpy(s, filename, len);
+        str_lower(s);
+
+        if (str_endswith(s, "bin")) {
+            o = BIN;
+        } else if (str_endswith(s, "eml")) {
+            o = EML;
+        } else if (str_endswith(s, "json")) {
+            o = JSON;
+        } else if (str_endswith(s, "dic")) {
+            o = DICTIONARY;
+        } else {
+            // mfd, trc, trace is binary
+            o = BIN;
+            // log is text
+            // .pm3 is text values of signal data
+        }
+    }
+    return o;
+}
+
 /**
  * @brief checks if a file exists
  * @param filename
diff --git a/client/src/fileutils.h b/client/src/fileutils.h
index 480cb013b..5e5cee664 100644
--- a/client/src/fileutils.h
+++ b/client/src/fileutils.h
@@ -272,4 +272,11 @@ mfu_df_e detect_mfu_dump_format(uint8_t **dump, size_t *dumplen, bool verbose);
 int searchAndList(const char *pm3dir, const char *ext);
 int searchFile(char **foundpath, const char *pm3dir, const char *searchname, const char *suffix, bool silent);
 
+
+/**
+ * @brief detects if file is of a supported filetype based on extension
+ * @param filename
+ * @return 
+ */
+DumpFileType_t getfiletype(const char *filename);
 #endif // FILEUTILS_H

From db29f0a6915882272aca5f70b15fa6deba9aeeb9 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 11 Feb 2021 15:37:35 +0100
Subject: [PATCH 544/682] textual..

---
 client/resources/mad.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/resources/mad.json b/client/resources/mad.json
index c63190cda..aae377af8 100644
--- a/client/resources/mad.json
+++ b/client/resources/mad.json
@@ -4749,14 +4749,14 @@
         "application": "Security and Access Control",
         "company": "PEC (New Zealand) Ltd.",
         "mad": "0x4811",
-        "service_provider": "Cardax",
+        "service_provider": "Cardax / Gallagher",
         "system_integrator": ""
     },
     {
         "application": "Security and Access Control",
         "company": "PEC (New Zealand) Ltd.",
         "mad": "0x4812",
-        "service_provider": "Cardax",
+        "service_provider": "Cardax / Gallagher",
         "system_integrator": ""
     },
     {

From d8e39b19b351a78e6fb3ae77ec234b4a7841e812 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 11 Feb 2021 18:17:21 +0100
Subject: [PATCH 545/682] fix Makefile and use git clone instead

---
 tools/Makefile | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tools/Makefile b/tools/Makefile
index 5640a5598..b0d043ad3 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -21,10 +21,10 @@ get_xorsearch:
 
 # Python impl of NDEF FORUM 1-5 protocol
 get_nfcpy:
-    $(MKDIR) nfcpy
-    $(WGET) https://github.com/nfcpy/nfcpy.git
+	$(MKDIR) nfcpy
+	$(GIT) https://github.com/nfcpy/nfcpy.git
 
 # Python tool to create, modify and print NDEF records
 get_ndeftool:
-    $(MKDIR) ndeftool
-    $(WGET) https://github.com/nfcpy/ndeftool.git
+	$(MKDIR) ndeftool
+	$(GIT) https://github.com/nfcpy/ndeftool.git

From a944ff5927479444f73094cff3243aae9c5f7f5e Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Thu, 11 Feb 2021 19:29:43 +0100
Subject: [PATCH 546/682] - added flash defines (RDV4) - modified LED signals -
 cleanup

---
 armsrc/Standalone/lf_tharexde.c | 73 ++++++++++++++++++---------------
 1 file changed, 41 insertions(+), 32 deletions(-)

diff --git a/armsrc/Standalone/lf_tharexde.c b/armsrc/Standalone/lf_tharexde.c
index 0d7393e01..44dbc8a4f 100644
--- a/armsrc/Standalone/lf_tharexde.c
+++ b/armsrc/Standalone/lf_tharexde.c
@@ -27,21 +27,26 @@
  * It requires RDV4 hardware (for flash and battery).
  *
  * On entering stand-alone mode, this module will start simulating EM4x50 data.
- * Data is read from eml dump file uploaded to flash memory.
+ * Data is read from eml dump file uploaded to flash memory (lf_em4x50_simulate.eml).
+ * If reader sends password different from dump file password, 'new' password
+ * is saved in file lf_em4x50_passwords.log in flash memory.
  *
  * On switching to read/record mode by pressing pm3 button, module will start
  * reading EM4x50 data. Each collected data set will be written/appended to the
- * logfile in flash as a text string.
+ * logfile in flash (lf_em4x50_collect.log) as a text string.
  *
  * LEDs:
  * - LED A: simulating
+ * - LED A blinking: no simulation data or read error
  * - LED B: reading/recording
- * - LED C: writing to flash
  * - LED D: unmounting/sync'ing flash (normally < 100ms)
  *
  * To upload input file (eml format) to flash:
  * - mem spiffs load f <filename> o lf_em4x50_simulate.eml
  *
+ * To retrieve password file from flash:
+ * - mem spiffs dump o lf_em4x50_passwords.log f <filename>
+ *
  * To retrieve log file from flash:
  * - mem spiffs dump o lf_em4x50_collect.log f <filename>
  *
@@ -52,6 +57,9 @@
  * - mem spiffs remove lf_em4x50_simulate.eml
  *
  * To delete the log file from flash:
+ * - mem spiffs remove lf_em4x50_passwords.log
+ *
+ * To delete the log file from flash:
  * - mem spiffs remove lf_em4x50_collect.log
  */
 
@@ -59,11 +67,9 @@
 #define STATE_READ                      1
 #define EM4X50_TAG_WORD                 45
 #define LF_EM4X50_INPUTFILE_SIM         "lf_em4x50_simulate.eml"
-#define LF_EM4X50_LOGFILE_SIM           "lf_em4x50_tag_data.log"
+#define LF_EM4X50_LOGFILE_SIM           "lf_em4x50_passwords.log"
 #define LF_EM4X50_LOGFILE_COLLECT       "lf_em4x50_collect.log"
 
-bool input_exists;
-bool log_exists;
 uint32_t gPassword;
 
 static void LoadDataInstructions(const char *inputfile) {
@@ -86,6 +92,8 @@ static void DownloadLogInstructions(const char *logfile) {
 static bool get_input_data_from_file(uint32_t *tag, char *inputfile) {
 
     size_t now = 0;
+
+#ifdef WITH_FLASH
     if (exists_in_spiffs(inputfile)) {
 
         uint32_t size = size_in_spiffs(inputfile);
@@ -106,18 +114,20 @@ static bool get_input_data_from_file(uint32_t *tag, char *inputfile) {
     }
 
     BigBuf_free();
-
+#endif
+    
     return ((now == EM4X50_NO_WORDS) && (tag[EM4X50_DEVICE_SERIAL] != tag[EM4X50_DEVICE_ID]));
 }
 
 static void append(const char *filename, uint8_t *entry, size_t entry_len) {
 
-    if (log_exists == false) {
-        rdv40_spiffs_write(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
-        log_exists = true;
-    } else {
+#ifdef WITH_FLASH
+    if (exists_in_spiffs(filename)) {
         rdv40_spiffs_append(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
+    } else {
+        rdv40_spiffs_write(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
     }
+#endif
 }
 
 void ModInfo(void) {
@@ -126,14 +136,16 @@ void ModInfo(void) {
 
 void RunMod(void) {
 
-    bool state_change = true;
+    bool state_change = true, read_ok = false;
     int no_words = 0, command = 0;
     uint8_t entry[400], state = STATE_SIM;
     uint32_t tag[EM4X50_NO_WORDS] = {0x0};
 
+#ifdef WITH_FLASH
     rdv40_spiffs_lazy_mount();
+#endif
+    
     StandAloneMode();
-    FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
     Dbprintf(_YELLOW_("Standalone mode THAREXDE started"));
 
     for (;;) {
@@ -174,7 +186,8 @@ void RunMod(void) {
                 Dbprintf("");
                 Dbprintf(_YELLOW_("switched to EM4x50 simulating mode"));
 
-                if (get_input_data_from_file(tag, LF_EM4X50_INPUTFILE_SIM)) {
+                read_ok = get_input_data_from_file(tag, LF_EM4X50_INPUTFILE_SIM);
+                if (read_ok) {
                     Dbprintf(_YELLOW_("tag data ok"));
                 } else {
                     Dbprintf(_RED_("error in tag data"));
@@ -184,39 +197,34 @@ void RunMod(void) {
                 em4x50_setup_sim();
                 gLogin = false;
                 LED_D_OFF();
+                gPassword = reflect32(tag[0]);
                 gWritePasswordProcess = false;
                 command = EM4X50_COMMAND_STANDARD_READ;
 
                 state_change = false;
             }
 
+            // if no data or read error -> blink
+            if (read_ok == false) {
+                LED(LED_A, 200);
+                SpinDelay(200);
+            }
+            
             em4x50_handle_commands(&command, tag);
 
             // check if new password was found
             if (gPassword != reflect32(tag[0])) {
                 
-                // save password to tag
-                tag[0] = reflect32(gPassword);
                 Dbprintf("received password: %08"PRIx32"", gPassword);
                 
-                // overwrite inputfile in flash memory
+                // append password to logfile in flash memory
                 memset(entry, 0, sizeof(entry));
-
-                for (int i = 0; i < EM4X50_NO_WORDS; i++) {
-                    sprintf((char *)entry + strlen((char *)entry), "%08"PRIx32"\n", tag[i]);
-                }
-
-                if (exists_in_spiffs(LF_EM4X50_LOGFILE_SIM)) {
-                    rdv40_spiffs_remove(LF_EM4X50_LOGFILE_SIM, RDV40_SPIFFS_SAFETY_SAFE);
-                }
-                rdv40_spiffs_write(LF_EM4X50_LOGFILE_SIM, entry, strlen((char *)entry), RDV40_SPIFFS_SAFETY_SAFE);
+                sprintf((char *)entry, "%08"PRIx32"\n", gPassword);
+                append(LF_EM4X50_LOGFILE_SIM, entry, strlen((char *)entry));
+                
+                gPassword = reflect32(tag[0]);
             }
             
-            // stop if key (pm3 button or enter key) has been pressed
-            if (command == PM3_EOPABORTED) {
-                break;
-            }
-
             // if timeout (e.g. no reader field) continue with standard read
             // mode and reset former authentication
             if (command == PM3_ETIMEOUT) {
@@ -234,7 +242,6 @@ void RunMod(void) {
                 Dbprintf("");
                 Dbprintf(_YELLOW_("switched to EM4x50 reading mode\n"));
 
-                log_exists = exists_in_spiffs(LF_EM4X50_LOGFILE_COLLECT);
                 em4x50_setup_read();
                 state_change = false;
             }
@@ -264,6 +271,7 @@ void RunMod(void) {
         AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; // reset and re-enable timer
     }
 
+#ifdef WITH_FLASH
     if (state == STATE_READ) {
         DownloadLogInstructions(LF_EM4X50_LOGFILE_COLLECT);
     } else {
@@ -273,6 +281,7 @@ void RunMod(void) {
     LED_D_ON();
     rdv40_spiffs_lazy_unmount();
     LED_D_OFF();
+#endif
 
     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
     LEDsoff();

From c576a0065b805cea162ecb08a62283470a4112fc Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 11 Feb 2021 22:08:51 +0100
Subject: [PATCH 547/682] hf jooki - encode / decode ...

---
 client/CMakeLists.txt   |   1 +
 client/Makefile         |   1 +
 client/src/cmdhf.c      |   2 +
 client/src/cmdhfjooki.c | 357 ++++++++++++++++++++++++++++++++++++++++
 client/src/cmdhfjooki.h |  16 ++
 client/src/cmdhfmfu.c   |  76 ++++++---
 client/src/cmdhfmfu.h   |   1 +
 7 files changed, 433 insertions(+), 21 deletions(-)
 create mode 100644 client/src/cmdhfjooki.c
 create mode 100644 client/src/cmdhfjooki.h

diff --git a/client/CMakeLists.txt b/client/CMakeLists.txt
index ddfd288b2..b7c56f881 100644
--- a/client/CMakeLists.txt
+++ b/client/CMakeLists.txt
@@ -242,6 +242,7 @@ set (TARGET_SOURCES
         ${PM3_ROOT}/client/src/cmdhffelica.c
         ${PM3_ROOT}/client/src/cmdhffido.c
         ${PM3_ROOT}/client/src/cmdhficlass.c
+        ${PM3_ROOT}/client/src/cmdhfjooki.c
         ${PM3_ROOT}/client/src/cmdhflegic.c
         ${PM3_ROOT}/client/src/cmdhflist.c
         ${PM3_ROOT}/client/src/cmdhflto.c
diff --git a/client/Makefile b/client/Makefile
index a756a2ede..ab26f970e 100644
--- a/client/Makefile
+++ b/client/Makefile
@@ -474,6 +474,7 @@ SRCS =  aiddesfire.c \
 		cmdhffido.c \
 		cmdhficlass.c \
 		cmdhflegic.c \
+		cmdhfjooki.c \
 		cmdhflist.c \
 		cmdhflto.c \
 		cmdhfmf.c \
diff --git a/client/src/cmdhf.c b/client/src/cmdhf.c
index 90a3b3ebf..2bc6edbfe 100644
--- a/client/src/cmdhf.c
+++ b/client/src/cmdhf.c
@@ -25,6 +25,7 @@
 #include "cmdhfemrtd.h"     // eMRTD
 #include "cmdhflegic.h"     // LEGIC
 #include "cmdhficlass.h"    // ICLASS
+#include "cmdhfjooki.h"     // MFU based Jooki
 #include "cmdhfmf.h"        // CLASSIC
 #include "cmdhfmfu.h"       // ULTRALIGHT/NTAG etc
 #include "cmdhfmfp.h"       // Mifare Plus
@@ -397,6 +398,7 @@ static command_t CommandTable[] = {
     {"emrtd",       CmdHFeMRTD,       AlwaysAvailable, "{ Machine Readable Travel Document... }"},
     {"felica",      CmdHFFelica,      AlwaysAvailable, "{ ISO18092 / FeliCa RFIDs...          }"},
     {"fido",        CmdHFFido,        AlwaysAvailable, "{ FIDO and FIDO2 authenticators...    }"},
+    {"jooki",       CmdHF_Jooki,      AlwaysAvailable, "{ Jooki RFIDs...                      }"},
     {"iclass",      CmdHFiClass,      AlwaysAvailable, "{ ICLASS RFIDs...                     }"},
     {"legic",       CmdHFLegic,       AlwaysAvailable, "{ LEGIC RFIDs...                      }"},
     {"lto",         CmdHFLTO,         AlwaysAvailable, "{ LTO Cartridge Memory RFIDs...       }"},
diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
new file mode 100644
index 000000000..0baac04ae
--- /dev/null
+++ b/client/src/cmdhfjooki.c
@@ -0,0 +1,357 @@
+//-----------------------------------------------------------------------------
+// Ultralight Code (c) 2021 Iceman
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// High frequency MIFARE ULTRALIGHT / Jooki commands
+//-----------------------------------------------------------------------------
+#include "cmdhfjooki.h"
+#include <ctype.h>
+#include <string.h>       // memset
+#include "commonutil.h"   // ARRAYLEN
+#include "ui.h"           // PrintAndLog
+#include "cmdparser.h"
+#include "generator.h"
+#include "base64.h"
+#include "mifare/ndef.h"  // print decode ndef
+#include "cliparser.h"
+#include "cmdhfmfu.h"
+#include "cmdmain.h"
+
+static int CmdHelp(const char *Cmd);
+
+typedef struct {
+    uint8_t uid[7];
+    const char b64[17];
+    uint8_t tagtype;
+} PACKED jooki_t;
+
+// sample set for selftest.
+jooki_t jooks[] = {
+    { {0x04, 0xDA, 0xB7, 0x6A, 0xE7, 0x4C, 0x80}, "ruxow8lnn88uyeX+", 0x00},
+    { {0x04, 0xf0, 0x22, 0xc2, 0x33, 0x5e, 0x80}, "\0" , 0x00},
+    { {0x04, 0x8C, 0xEC, 0xDA, 0xF0, 0x4A, 0x80}, "ONrsVf7jX6IaSNV6", 0x01},
+    { {0x04, 0x92, 0xA7, 0x6A, 0xE7, 0x4C, 0x81}, "Hjjpcx/mZwuveTF+", 0x02},
+    { {0x04, 0xD0, 0xB0, 0x3A, 0xD3, 0x63, 0x80}, "\0", 0x02},
+    { {0x04, 0x96, 0x42, 0xDA, 0xF0, 0x4A, 0x80}, "vEWy0WO9wZNEzEok", 0x03},
+    { {0x04, 0x33, 0xb5, 0x62, 0x39, 0x4d, 0x80}, "\0", 0x03},
+    { {0x04, 0x17, 0xB7, 0x3A, 0xD3, 0x63, 0x81}, "f0axEma+g2WnLGAm", 0x05},
+    { {0x04, 0x84, 0x27, 0x6A, 0xE7, 0x4C, 0x80}, "VZB/OLBwOiM5Mpnp", 0x05},
+    { {0x04, 0x28, 0xF4, 0xDA, 0xF0, 0x4A, 0x81}, "7WzlgEzqLgwTnWNy", 0x05},
+};
+
+const char *jooks_figures[] = {"Dragon", "Fox", "Ghost", "Knight", "?", "Whale"};
+const uint8_t jooki_secret[] = {0x20, 0x20, 0x20, 0x6D, 0x24, 0x0B, 0xEB, 0x94, 0x2C, 0x80, 0x45, 0x16};
+const uint8_t NFC_SECRET[] = { 0x03, 0x9c, 0x25, 0x6f, 0xb9, 0x2e, 0xe8, 0x08, 0x09, 0x83, 0xd9, 0x33, 0x56};
+
+#define JOOKI_UID_LEN  7
+#define JOOKI_IV_LEN   4
+#define JOOKI_B64_LEN (16 + 1)
+#define JOOKI_PLAIN_LEN 12
+
+static int jooki_encode(uint8_t *iv, uint8_t tagtype, uint8_t *uid, char *out) {
+    if (out == NULL) {
+        PrintAndLogEx(ERR, "(encode jooki) base64ndef param is NULL");
+        return PM3_EINVARG;
+    }    
+
+    out[0] = 0x00;
+    if (iv == NULL || uid == NULL) {
+        PrintAndLogEx(ERR, "(encode jooki) iv or uid param is NULL");
+        return PM3_EINVARG;
+    }
+
+    uint8_t d[JOOKI_PLAIN_LEN] = {iv[0], iv[1],iv[2], iv[3], tagtype, uid[0], uid[1], uid[2], uid[3], uid[4], uid[5], uid[6]};
+    uint8_t enc[JOOKI_PLAIN_LEN] = {0};
+    for (uint8_t i = 0; i < JOOKI_PLAIN_LEN; i++) {
+
+        if (i < 3)
+            enc[i] = d[i] ^ NFC_SECRET[i];
+        else
+            enc[i] = d[i] ^ NFC_SECRET[i] ^ d[i % 3];
+    }
+
+    PrintAndLogEx(DEBUG, "encoded result.... %s", sprint_hex(enc, sizeof(enc)));
+
+    size_t b64len = 0;
+    uint8_t b64[20];
+    memset(b64, 0, 20);
+    mbedtls_base64_encode(b64, sizeof(b64), &b64len, (const unsigned char*)enc, sizeof(enc));
+    memcpy(out, b64, b64len);
+    return PM3_SUCCESS;
+}
+
+static int jooki_decode(uint8_t *b64ndef, uint8_t *result) {
+    size_t nlen = strlen(b64ndef);
+    if (nlen != 16) {
+        PrintAndLogEx(ERR, "Invalid input length expected 16, got %zu", nlen);
+        return PM3_EINVARG;
+    }
+
+    uint8_t ndef[JOOKI_PLAIN_LEN] = {0};
+    size_t outputlen = 0;
+    mbedtls_base64_decode(ndef, sizeof(ndef), &outputlen, (const unsigned char*)b64ndef, strlen(b64ndef));
+
+    PrintAndLogEx(DEBUG, "(decode_jooki) raw encoded... " _GREEN_("%s"), sprint_hex(ndef, sizeof(ndef)));
+
+    for (uint8_t i = 0; i < JOOKI_PLAIN_LEN; i++) {
+        if (i < 3)
+            result[i] = ndef[i] ^ NFC_SECRET[i];
+        else
+            result[i] = ndef[i] ^ NFC_SECRET[i] ^ ndef[i % 3] ^ NFC_SECRET[i % 3];
+    }
+    PrintAndLogEx(DEBUG, "(decode_jooki) plain......... %s", sprint_hex(result, sizeof(ndef)));
+    return PM3_SUCCESS;
+}
+
+static int jooki_create_ndef(uint8_t *b64ndef, uint8_t *ndefrecord) {
+// sample of url:   https://s.jooki.rocks/s/?s=ONrsVf7jX6IaSNV6
+
+    size_t nlen = strlen(b64ndef);
+    if (nlen != 16) {
+        PrintAndLogEx(ERR, "(jooki_create_ndef) Invalid input length expected 16, got %zu", nlen);
+        return PM3_EINVARG;
+    }
+    if (ndefrecord == NULL) {
+        PrintAndLogEx(ERR, "(jooki_create_ndef) ndefrecord param is NULL");
+        return PM3_EINVARG;
+    }
+    memcpy(ndefrecord, 
+        "\x01\x03\xa0\x0c\x34\x03\x29\xd1"
+        "\x01\x25\x55\x04\x73\x2e\x6a\x6f"
+        "\x6f\x6b\x69\x2e\x72\x6f\x63\x6b"
+        "\x73\x2f\x73\x2f\x3f\x73\x3d", 31);
+    memcpy(ndefrecord + 31, b64ndef, 16);
+    memcpy(ndefrecord + 47, "\x0a\xFE\x00\x00\x00", 5);
+    return PM3_SUCCESS;
+}
+
+static void jooki_printEx(uint8_t *b64, uint8_t *iv, uint8_t tt, uint8_t *uid, bool verbose) {
+    PrintAndLogEx(INFO, "Encoded URL.. %s ( %s )", sprint_hex(b64, 12), b64);
+    PrintAndLogEx(INFO, "Figurine..... %02x - " _GREEN_("%s"), tt, jooks_figures[tt]);
+    PrintAndLogEx(INFO, "iv........... %s", sprint_hex(iv, JOOKI_IV_LEN));  
+    PrintAndLogEx(INFO, "uid.......... %s", sprint_hex(uid, JOOKI_UID_LEN));  
+
+    uint8_t ndefmsg[52] = {0};
+    jooki_create_ndef(b64, ndefmsg);
+    PrintAndLogEx(INFO, "NDEF raw..... %s", sprint_hex_inrow(ndefmsg, sizeof(ndefmsg)));
+
+    if (verbose) {
+        int res = NDEFRecordsDecodeAndPrint(ndefmsg, sizeof(ndefmsg));
+        if (res != PM3_SUCCESS) {
+            NDEFDecodeAndPrint(ndefmsg, sizeof(ndefmsg), verbose);
+        }
+    }
+}
+
+static void jooki_print(uint8_t *b64, uint8_t *result, bool verbose) {
+    if (b64 == NULL || result == NULL)
+        return;
+
+    uint8_t iv[JOOKI_IV_LEN] = {0};
+    uint8_t uid[JOOKI_UID_LEN] = {0};
+    memcpy(iv, result, sizeof(iv));
+    uint8_t tt = result[4];
+    memcpy(uid, result + 5, sizeof(uid));
+
+    jooki_printEx(b64, iv, tt, uid, verbose);
+}
+
+/*
+static int jooki_write(void) {
+    return PM3_SUCCESS;
+}
+*/
+
+static int jooki_selftest(void) {
+    
+    PrintAndLogEx(INFO, "======== " _CYAN_("selftest") " ==========================================="); 
+    for (int i = 0; i < ARRAYLEN(jooks); i++) {
+        if (strlen(jooks[i].b64) == 0)
+            continue;
+
+        uint8_t iv[JOOKI_IV_LEN] = {0};
+        uint8_t uid[JOOKI_UID_LEN] = {0};
+        uint8_t result[JOOKI_PLAIN_LEN] = {0};
+        jooki_decode((uint8_t*)jooks[i].b64, result);
+
+        memcpy(iv, result, 4);
+        uint8_t tt = result[4];
+        memcpy(uid, result + 5, sizeof(uid));
+
+        bool tt_ok  = (tt == jooks[i].tagtype); 
+        bool uid_ok = (memcmp(uid, jooks[i].uid, sizeof(uid)) == 0);
+
+        PrintAndLogEx(INFO, "Encoded URL.. %s ( %s )", sprint_hex((const uint8_t*)jooks[i].b64, 12), jooks[i].b64);
+        PrintAndLogEx(INFO, "Figurine..... %02x - " _GREEN_("%s") " ( %s )", tt, jooks_figures[tt], tt_ok ? _GREEN_("ok") : _RED_("fail"));  
+        PrintAndLogEx(INFO, "iv........... %s", sprint_hex(iv, sizeof(iv)));  
+        PrintAndLogEx(INFO, "uid.......... %s ( %s )", sprint_hex(uid, sizeof(uid)), uid_ok ? _GREEN_("ok") : _RED_("fail"));          
+
+        uint8_t b64[JOOKI_B64_LEN] = {0};
+        memset(b64, 0, sizeof(b64));        
+        jooki_encode(iv, tt, uid, b64);
+
+        uint8_t ndefmsg[52] = {0};
+        jooki_create_ndef(b64, ndefmsg);
+        PrintAndLogEx(INFO, "NDEF raw .... %s", sprint_hex(ndefmsg, sizeof(ndefmsg)));
+        
+        int status = NDEFRecordsDecodeAndPrint(ndefmsg, sizeof(ndefmsg));
+        if ( status != PM3_SUCCESS) {
+            status = NDEFDecodeAndPrint(ndefmsg, sizeof(ndefmsg), true);
+        }
+        PrintAndLogEx(INFO, "==================================================================");     
+    }
+    return PM3_SUCCESS;
+}
+
+static int CmdHF14AJookiEncode(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf jooki Encode",
+                  "Encode a Jooki token to base64 NDEF URI format",
+                  "hf jooki encode -t            --> selftest\n"
+                  "hf jooki encode -r --dragon   --> read uid from tag and use for encoding\n"
+                  "hf jooki encode --uid 04010203040506 --dragon"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("u", "uid",  "<hex>", "uid bytes"),
+        arg_lit0("r", NULL, "read uid from tag instead"),
+        arg_lit0("t", NULL, "selftest"),
+        arg_lit0("v", "verbose", "verbose output"),
+        arg_lit0(NULL, "dragon", "tag type"),
+        arg_lit0(NULL, "fox", "tag type"),
+        arg_lit0(NULL, "ghost", "tag type"),
+        arg_lit0(NULL, "knight", "tag type"),
+        arg_lit0(NULL, "whale", "tag type"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+    int ulen = 0;
+    uint8_t uid[JOOKI_UID_LEN] = {0x00};
+    memset(uid, 0x0, sizeof(uid));
+    CLIParamHexToBuf(arg_get_str(ctx, 1), uid, sizeof(uid), &ulen);
+
+    bool use_tag = arg_get_lit(ctx, 2);
+    bool selftest = arg_get_lit(ctx, 3);
+    bool verbose = arg_get_lit(ctx, 4);
+    bool tt_dragon = arg_get_lit(ctx, 5);
+    bool tt_fox = arg_get_lit(ctx, 6);
+    bool tt_ghost = arg_get_lit(ctx, 7);
+    bool tt_knight = arg_get_lit(ctx, 8);
+    bool tt_whale = arg_get_lit(ctx, 9);
+    CLIParserFree(ctx);
+    
+    if (selftest) {
+        return jooki_selftest();
+    }
+
+    if ((tt_dragon + tt_fox + tt_ghost + tt_knight + tt_whale) > 1) {
+        PrintAndLogEx(ERR, "Select one tag type");
+        return PM3_EINVARG;
+    }
+    uint8_t tt = 0;
+    if (tt_fox)
+        tt = 1;
+    if (tt_ghost)
+        tt = 2;
+    if (tt_knight)
+        tt = 3;
+    if (tt_whale)
+        tt = 5;
+    
+    uint8_t iv[JOOKI_IV_LEN] = {0x31, 0x43, 0x33, 0};
+    if (use_tag) {
+        int res = ul_read_uid(uid);
+        if (res != PM3_SUCCESS) {
+            return res;
+        }
+    } else {
+        if (ulen != JOOKI_UID_LEN) {
+            PrintAndLogEx(ERR, "Wrong length of UID, expect %u, got %d", JOOKI_UID_LEN, ulen);
+            return PM3_EINVARG;
+        }
+    }
+
+    uint8_t b64[JOOKI_B64_LEN] = {0};
+    memset(b64, 0, sizeof(b64));        
+    jooki_encode(iv, tt, uid, b64);  
+    jooki_printEx(b64, iv, tt, uid, verbose);
+    return PM3_SUCCESS;
+}
+
+static int CmdHF14AJookiDecode(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf jooki decode",
+                  "Decode a base64-encode Jooki token in NDEF URI format",
+                  "hf jooki decode -d 7WzlgEzqLgwTnWNy"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1("d", "data", "<hex>", "base64 url parameter"),
+        arg_lit0("v", "verbose", "verbose output"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+    int dlen = 16;
+    uint8_t b64[JOOKI_B64_LEN] = {0x00};
+    memset(b64, 0x0, sizeof(b64));
+    CLIGetStrWithReturn(ctx, 1, b64, &dlen);
+    bool verbose = arg_get_lit(ctx, 2);
+    CLIParserFree(ctx);
+
+    uint8_t result[JOOKI_PLAIN_LEN] = {0};
+    int res = jooki_decode(b64, result);
+    if (res == PM3_SUCCESS) {
+        jooki_print(b64, result, verbose);
+    }
+    return PM3_SUCCESS;
+}
+
+static int CmdHF14AJookiWrite(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf jooki write",
+                  "Write a Jooki token to a Ultralight or NTAG tag",
+                  "hf jooki write"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str1("d", "data", "<hex>", "bytes"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    int dlen = 0;
+    uint8_t data[100] = {0x00};
+    memset(data, 0x0, sizeof(data));
+    int res = CLIParamHexToBuf(arg_get_str(ctx, 1), data, sizeof(data), &dlen);
+    if (res) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(FAILED, "Error parsing bytes");
+        return PM3_EINVARG;
+    }
+
+    CLIParserFree(ctx);
+    return PM3_SUCCESS;
+}
+
+static command_t CommandTable[] = {
+    {"help",    CmdHelp,             AlwaysAvailable, "This help"},
+    {"encode", CmdHF14AJookiEncode,  AlwaysAvailable, "Encode Jooki token"},
+    {"decode", CmdHF14AJookiDecode,  AlwaysAvailable, "Decode Jooki token"},
+    {"write",  CmdHF14AJookiWrite,   IfPm3Iso14443a,   "Write a Jooki token"},
+    {NULL, NULL, NULL, NULL}
+};
+
+static int CmdHelp(const char *Cmd) {
+    (void)Cmd; // Cmd is not used so far
+    CmdsHelp(CommandTable);
+    return PM3_SUCCESS;
+}
+
+int CmdHF_Jooki(const char *Cmd) {
+    clearCommandBuffer();
+    return CmdsParse(CommandTable, Cmd);
+}
diff --git a/client/src/cmdhfjooki.h b/client/src/cmdhfjooki.h
new file mode 100644
index 000000000..ac3ecc3af
--- /dev/null
+++ b/client/src/cmdhfjooki.h
@@ -0,0 +1,16 @@
+//-----------------------------------------------------------------------------
+// Copyright (C) 2021 iceman1001
+//
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// High frequency ISO14443A / MFU / Jooki  commands
+//-----------------------------------------------------------------------------
+
+#ifndef CMDHFJOOKI_H__
+#define CMDHFJOOKI_H__
+
+#include "common.h"
+int CmdHF_Jooki(const char *Cmd);
+#endif
diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index 9ce5809f5..68e91fb26 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -115,6 +115,36 @@ static char *getUlev1CardSizeStr(uint8_t fsize) {
     return buf;
 }
 
+int ul_read_uid(uint8_t *uid) {
+    if (uid == NULL) {
+        PrintAndLogEx(WARNING, "NUll parameter UID");
+        return PM3_ESOFT;
+    }
+    // read uid from tag
+    clearCommandBuffer();
+    SendCommandMIX(CMD_HF_ISO14443A_READER, ISO14A_CONNECT | ISO14A_NO_RATS, 0, 0, NULL, 0);
+    PacketResponseNG resp;
+    WaitForResponse(CMD_ACK, &resp);
+    iso14a_card_select_t card;
+    memcpy(&card, (iso14a_card_select_t *)resp.data.asBytes, sizeof(iso14a_card_select_t));
+
+    uint64_t select_status = resp.oldarg[0];
+    // 0: couldn't read
+    // 1: OK with ATS
+    // 2: OK, no ATS
+    // 3: proprietary Anticollision
+    if (select_status == 0) {
+        PrintAndLogEx(WARNING, "iso14443a card select failed");
+        return PM3_ESOFT;
+    }
+    if (card.uidlen != 7) {
+        PrintAndLogEx(WARNING, "Wrong sized UID, expected 7bytes got %d", card.uidlen);
+        return PM3_ESOFT;
+    }
+    memcpy(uid, card.uid, 7);
+    return PM3_SUCCESS;
+}
+
 static void ul_switch_on_field(void) {
     clearCommandBuffer();
     SendCommandMIX(CMD_HF_ISO14443A_READER, ISO14A_CONNECT | ISO14A_NO_DISCONNECT | ISO14A_NO_RATS, 0, 0, NULL, 0);
@@ -2759,27 +2789,11 @@ static int CmdHF14AMfUPwdGen(const char *Cmd) {
 
     if (use_tag) {
         // read uid from tag
-        clearCommandBuffer();
-        SendCommandMIX(CMD_HF_ISO14443A_READER, ISO14A_CONNECT | ISO14A_NO_RATS, 0, 0, NULL, 0);
-        PacketResponseNG resp;
-        WaitForResponse(CMD_ACK, &resp);
-        iso14a_card_select_t card;
-        memcpy(&card, (iso14a_card_select_t *)resp.data.asBytes, sizeof(iso14a_card_select_t));
+        int res = ul_read_uid(uid);
+        if (res != PM3_SUCCESS) {
+            return res;
+        }
 
-        uint64_t select_status = resp.oldarg[0];
-        // 0: couldn't read
-        // 1: OK with ATS
-        // 2: OK, no ATS
-        // 3: proprietary Anticollision
-        if (select_status == 0) {
-            PrintAndLogEx(WARNING, "iso14443a card select failed");
-            return PM3_ESOFT;
-        }
-        if (card.uidlen != 7) {
-            PrintAndLogEx(WARNING, "Wrong sized UID, expected 7bytes got %d", card.uidlen);
-            return PM3_ESOFT;
-        }
-        memcpy(uid, card.uid, sizeof(uid));
     } else {
         if (u_len != 7) {
             PrintAndLogEx(WARNING, "Key must be 7 hex bytes");
@@ -3539,7 +3553,27 @@ static int CmdHF14MfuNDEF(const char *Cmd) {
     }
 
     DropField();
-    status = NDEFDecodeAndPrint(records, (size_t)maxsize, true);
+    status = NDEFRecordsDecodeAndPrint(records, (size_t)maxsize);
+    if ( status != PM3_SUCCESS) {
+        status = NDEFDecodeAndPrint(records, (size_t)maxsize, true);
+    }
+
+    char *jooki = strstr(records, "s.jooki.rocks/s/?s=");
+    if (jooki) {
+        jooki += 17;
+        while(jooki) {
+            if ((*jooki) != '=')
+                jooki++;
+            else  {
+                jooki++;
+                char s[17] = {0};
+                strncpy(s, jooki, 16);
+                PrintAndLogEx(HINT, "Use `" _YELLOW_("hf jooki decode -d %s") "` to decode", s);
+                break;
+            }
+        }
+    }
+
     free(records);
     return status;
 }
diff --git a/client/src/cmdhfmfu.h b/client/src/cmdhfmfu.h
index e3eae9e79..7b120115c 100644
--- a/client/src/cmdhfmfu.h
+++ b/client/src/cmdhfmfu.h
@@ -23,6 +23,7 @@ typedef struct {
 uint32_t GetHF14AMfU_Type(void);
 int ul_print_type(uint32_t tagtype, uint8_t spaces);
 void printMFUdumpEx(mfu_dump_t *card, uint16_t pages, uint8_t startpage);
+int ul_read_uid(uint8_t *uid);
 
 int CmdHFMFUltra(const char *Cmd);
 

From d7a1145945f0934137f43907831bb188ccca41d1 Mon Sep 17 00:00:00 2001
From: DarkMatterMatt <mattmoran2000@gmail.com>
Date: Fri, 12 Feb 2021 10:23:05 +1300
Subject: [PATCH 548/682] Add support for specifying region/facility/card/issue
 numbers to Gallagher simulation

Extract `region_code`/`facility_code`/`card_number`/`issue_level` validation to `isValidGallagherParams` function
Add `--rc/fc/cn/il` parameters to `lf gallagher sim`
---
 client/src/cmdlfgallagher.c | 97 ++++++++++++++++++++++++++++---------
 1 file changed, 75 insertions(+), 22 deletions(-)

diff --git a/client/src/cmdlfgallagher.c b/client/src/cmdlfgallagher.c
index 0a48563a3..90ed274f2 100644
--- a/client/src/cmdlfgallagher.c
+++ b/client/src/cmdlfgallagher.c
@@ -187,6 +187,34 @@ static int CmdGallagherReader(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
+static bool isValidGallagherParams(int8_t rc, int32_t fc, int32_t cn, int8_t il) {
+    bool isValid = true;
+
+    // if one is set, all must be set
+    if (rc < 0 || fc < 0 || cn < 0 || il < 0) {
+        PrintAndLogEx(FAILED, "If rc/fc/cn/il is specified, all must be set");
+        isValid = false;
+    }
+    // validate input
+    if (rc > 0x0f) {
+        PrintAndLogEx(FAILED, "Region code must be less than 16 (4 bits)");
+        isValid = false;
+    }
+    if (fc > 0xffff) {
+        PrintAndLogEx(FAILED, "Facility code must be less than 65536 (2 bytes)");
+        isValid = false;
+    }
+    if (cn > 0xffffff) {
+        PrintAndLogEx(FAILED, "Card number must be less than 16777216 (3 bytes)");
+        isValid = false;
+    }
+    if (il > 0x0f) {
+        PrintAndLogEx(FAILED, "Issue level must be less than 16 (4 bits)");
+        isValid = false;
+    }
+    return isValid;
+}
+
 static void setBitsInBlocks(uint32_t *blocks, uint8_t *pos, uint32_t data, uint8_t data_len) {
     for (int i = data_len - 1; i >= 0; i--) {
         uint8_t blk = *pos / 32;
@@ -286,26 +314,7 @@ static int CmdGallagherClone(const char *Cmd) {
             PrintAndLogEx(FAILED, "Can't specify both raw and rc/fc/cn/il at the same time");
             return PM3_EINVARG;
         }
-        // if one is set, all must be set
-        if (region_code == -1 || facility_code == -1 || card_number == -1 || issue_level == -1) {
-            PrintAndLogEx(FAILED, "If rc/fc/cn/il is specified, all must be set");
-            return PM3_EINVARG;
-        }
-        // validate input
-        if (region_code > 0x0f) {
-            PrintAndLogEx(FAILED, "Region code must be less than 16 (4 bits)");
-            return PM3_EINVARG;
-        }
-        if (facility_code > 0xffff) {
-            PrintAndLogEx(FAILED, "Facility code must be less than 65536 (2 bytes)");
-            return PM3_EINVARG;
-        }
-        if (card_number > 0xffffff) {
-            PrintAndLogEx(FAILED, "Card number must be less than 16777216 (3 bytes)");
-            return PM3_EINVARG;
-        }
-        if (issue_level > 0x0f) {
-            PrintAndLogEx(FAILED, "Issue level must be less than 16 (4 bits)");
+        if (!isValidGallagherParams(region_code, facility_code, card_number, issue_level)) {
             return PM3_EINVARG;
         }
     }
@@ -356,21 +365,65 @@ static int CmdGallagherSim(const char *Cmd) {
     CLIParserInit(&ctx, "lf gallagher sim",
                   "Enables simulation of GALLAGHER card with specified card number.\n"
                   "Simulation runs until the button is pressed or another USB command is issued.\n",
-                  "lf gallagher sim --raw 0FFD5461A9DA1346B2D1AC32"
+                  "lf gallagher sim --raw 0FFD5461A9DA1346B2D1AC32\n"
+                  "lf gallagher sim --rc 0 --fc 9876 --cn 1234 --il 1"
                  );
 
     void *argtable[] = {
         arg_param_begin,
-        arg_str1("r", "raw", "<hex>", "raw hex data. 12 bytes max"),
+        arg_str0("r", "raw", "<hex>", "raw hex data. 12 bytes max"),
+        arg_int0(NULL, "rc", "<decimal>", "Region code. 4 bits max"),
+        arg_int0(NULL, "fc", "<decimal>", "Facility code. 2 bytes max"),
+        arg_int0(NULL, "cn", "<decimal>", "Card number. 3 bytes max"),
+        arg_int0(NULL, "il", "<decimal>", "Issue level. 4 bits max"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);
+
     int raw_len = 0;
     // skip first block,  3*4 = 12 bytes left
     uint8_t raw[12] = {0};
     CLIGetHexWithReturn(ctx, 1, raw, &raw_len);
+    CLIParamHexToBuf(arg_get_str(ctx, 1), raw, sizeof raw, &raw_len);
+
+    int16_t region_code = arg_get_int_def(ctx, 2, -1);
+    int32_t facility_code = arg_get_int_def(ctx, 3, -1);
+    uint64_t card_number = arg_get_int_def(ctx, 4, -1);
+    uint32_t issue_level = arg_get_int_def(ctx, 5, -1);
     CLIParserFree(ctx);
 
+    bool use_raw = raw_len > 0;
+
+    if (region_code == -1 && facility_code == -1 && card_number == -1 && issue_level == -1) {
+        if (!use_raw) {
+            PrintAndLogEx(FAILED, "Must specify either raw data to clone, or rc/fc/cn/il");
+            return PM3_EINVARG;
+        }
+    } else {
+        // --raw and --rc/fc/cn/il are mutually exclusive
+        if (use_raw) {
+            PrintAndLogEx(FAILED, "Can't specify both raw and rc/fc/cn/il at the same time");
+            return PM3_EINVARG;
+        }
+        if (!isValidGallagherParams(region_code, facility_code, card_number, issue_level)) {
+            return PM3_EINVARG;
+        }
+    }
+
+    if (!use_raw) {
+        // generate Gallagher data
+        uint32_t blocks[3];
+        createBlocks(blocks, region_code, facility_code, card_number, issue_level);
+
+        // convert to the normal 'raw' format
+        for (int i = 0; i < ARRAYLEN(blocks); i++) {
+            raw[(4 * i) + 0] = (blocks[i] >> 24) & 0xff;
+            raw[(4 * i) + 1] = (blocks[i] >> 16) & 0xff;
+            raw[(4 * i) + 2] = (blocks[i] >> 8) & 0xff;
+            raw[(4 * i) + 3] = (blocks[i]) & 0xff;
+        }
+    }
+
     // ASK/MAN sim.
     PrintAndLogEx(SUCCESS, "Simulating Gallagher - raw " _YELLOW_("%s"), sprint_hex_inrow(raw, sizeof(raw)));
 

From 05e85cbbe2868b0a0422da6cbd6a72b479341387 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 11 Feb 2021 22:26:15 +0100
Subject: [PATCH 549/682] fixing some type conversions

---
 client/src/cmdhfjooki.c | 20 ++++----------------
 1 file changed, 4 insertions(+), 16 deletions(-)

diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index 0baac04ae..8a5b0772a 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -50,7 +50,7 @@ const uint8_t NFC_SECRET[] = { 0x03, 0x9c, 0x25, 0x6f, 0xb9, 0x2e, 0xe8, 0x08, 0
 #define JOOKI_B64_LEN (16 + 1)
 #define JOOKI_PLAIN_LEN 12
 
-static int jooki_encode(uint8_t *iv, uint8_t tagtype, uint8_t *uid, char *out) {
+static int jooki_encode(uint8_t *iv, uint8_t tagtype, uint8_t *uid, uint8_t *out) {
     if (out == NULL) {
         PrintAndLogEx(ERR, "(encode jooki) base64ndef param is NULL");
         return PM3_EINVARG;
@@ -82,16 +82,10 @@ static int jooki_encode(uint8_t *iv, uint8_t tagtype, uint8_t *uid, char *out) {
     return PM3_SUCCESS;
 }
 
-static int jooki_decode(uint8_t *b64ndef, uint8_t *result) {
-    size_t nlen = strlen(b64ndef);
-    if (nlen != 16) {
-        PrintAndLogEx(ERR, "Invalid input length expected 16, got %zu", nlen);
-        return PM3_EINVARG;
-    }
-
+static int jooki_decode(uint8_t *b64, uint8_t *result) {
     uint8_t ndef[JOOKI_PLAIN_LEN] = {0};
     size_t outputlen = 0;
-    mbedtls_base64_decode(ndef, sizeof(ndef), &outputlen, (const unsigned char*)b64ndef, strlen(b64ndef));
+    mbedtls_base64_decode(ndef, sizeof(ndef), &outputlen, (const unsigned char*)b64, 16);
 
     PrintAndLogEx(DEBUG, "(decode_jooki) raw encoded... " _GREEN_("%s"), sprint_hex(ndef, sizeof(ndef)));
 
@@ -106,13 +100,7 @@ static int jooki_decode(uint8_t *b64ndef, uint8_t *result) {
 }
 
 static int jooki_create_ndef(uint8_t *b64ndef, uint8_t *ndefrecord) {
-// sample of url:   https://s.jooki.rocks/s/?s=ONrsVf7jX6IaSNV6
-
-    size_t nlen = strlen(b64ndef);
-    if (nlen != 16) {
-        PrintAndLogEx(ERR, "(jooki_create_ndef) Invalid input length expected 16, got %zu", nlen);
-        return PM3_EINVARG;
-    }
+    // sample of url:   https://s.jooki.rocks/s/?s=ONrsVf7jX6IaSNV6
     if (ndefrecord == NULL) {
         PrintAndLogEx(ERR, "(jooki_create_ndef) ndefrecord param is NULL");
         return PM3_EINVARG;

From 3ef308120cec26dd148a3285d33bbc77c569aa83 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 11 Feb 2021 22:37:12 +0100
Subject: [PATCH 550/682] fix signedness

---
 client/src/cmdhfmfu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index 68e91fb26..d975e8cb6 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -3558,7 +3558,7 @@ static int CmdHF14MfuNDEF(const char *Cmd) {
         status = NDEFDecodeAndPrint(records, (size_t)maxsize, true);
     }
 
-    char *jooki = strstr(records, "s.jooki.rocks/s/?s=");
+    char *jooki = strstr((char*)records, "s.jooki.rocks/s/?s=");
     if (jooki) {
         jooki += 17;
         while(jooki) {

From 63d2afc2d8406a3385e06d95d7a7ee91e614e9fc Mon Sep 17 00:00:00 2001
From: Matt Moran <mattmoran2000@gmail.com>
Date: Fri, 12 Feb 2021 10:51:14 +1300
Subject: [PATCH 551/682] Update CHANGELOG.md

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 13743da0c..2f3ead0f4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -131,6 +131,8 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
  - Change, use system Whereami library if available (@doegox)
  - Change, use system Zlib library if available (@doegox)
  - Fix release version information (@doegox)
+ - Fix `lf gallagher read` - now correctly decodes card data
+ - Add support to `lf gallagher clone` and `lf gallagher sim` for writing specific card region, facility, card & issue numbers (@DarkMatterMatt)
 
 ## [ice coffee.4.9237][2020-05-21]
  - Updated documentation (@doegox, @iceman1001)

From cdbef43f1a018abb3cf2c40d13d4c79d1be8d219 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 11 Feb 2021 23:09:45 +0100
Subject: [PATCH 552/682] hf jooki write - may work...

---
 CHANGELOG.md            |  1 +
 client/src/cmdhfjooki.c | 46 ++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2f3ead0f4..9547aba77 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+ - Added `hf jooki` commands (@iceman1001)
  - Changed `wiegand encode` - format param is now optional, w/o it will try encode all formats (@iceman1001)
  - Fix cppchecker warnings (@iceman1001)
  - Added `trace list -t mf` - now can use external dictionary keys file
diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index 8a5b0772a..c6bae2e09 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -308,11 +308,12 @@ static int CmdHF14AJookiWrite(const char *Cmd) {
     void *argtable[] = {
         arg_param_begin,
         arg_str1("d", "data", "<hex>", "bytes"),
+        arg_str0("p", "pwd", "<hex>", "password for authentication (EV1/NTAG 4 bytes)"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
     int dlen = 0;
-    uint8_t data[100] = {0x00};
+    uint8_t data[52] = {0x00};
     memset(data, 0x0, sizeof(data));
     int res = CLIParamHexToBuf(arg_get_str(ctx, 1), data, sizeof(data), &dlen);
     if (res) {
@@ -321,7 +322,50 @@ static int CmdHF14AJookiWrite(const char *Cmd) {
         return PM3_EINVARG;
     }
 
+
+    int plen = 0;
+    uint8_t pwd[4] = {0x00};
+    CLIGetHexWithReturn(ctx, 2, pwd, &plen);
+
     CLIParserFree(ctx);
+
+    if (dlen != 52) {
+        PrintAndLogEx(ERR, "Wrong data length. Expected 52 got %d", dlen);
+        return PM3_EINVARG;
+    }
+
+    bool has_pwd = false;
+    if (plen == 4) {
+        has_pwd = true;
+    }
+
+    // 0 - no authentication
+    // 2 - pwd  (4 bytes)
+    uint8_t keytype = 0, blockno = 4, i = 0;
+
+    while ((i * 4) < dlen) {
+
+        uint8_t cmddata[8] = {0};
+        memcpy(cmddata, data + (i * 4), 4);
+        if (has_pwd) {
+            memcpy(cmddata + 4, pwd, 4);
+            keytype = 2;
+        }
+        clearCommandBuffer();
+        SendCommandMIX(CMD_HF_MIFAREU_WRITEBL, blockno, keytype, 0, cmddata, sizeof(cmddata));
+
+        PacketResponseNG resp;
+        if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
+            uint8_t isOK  = resp.oldarg[0] & 0xff;
+            PrintAndLogEx(SUCCESS, "block %d,  data %s  ( %s )", blockno,  sprint_hex_inrow(cmddata, sizeof(cmddata)), isOK ? _GREEN_("ok") : _RED_("fail"));
+        } else {
+            PrintAndLogEx(WARNING, "Command execute timeout");
+        }
+
+        blockno++;
+        i++;
+    }
+
     return PM3_SUCCESS;
 }
 

From f9e1106842572b49df0264e53dbcc5bc713c1b91 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 11 Feb 2021 23:12:13 +0100
Subject: [PATCH 553/682] remove debugs message

---
 client/src/cmdhfjooki.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index c6bae2e09..964008cc8 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -357,7 +357,7 @@ static int CmdHF14AJookiWrite(const char *Cmd) {
         PacketResponseNG resp;
         if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
             uint8_t isOK  = resp.oldarg[0] & 0xff;
-            PrintAndLogEx(SUCCESS, "block %d,  data %s  ( %s )", blockno,  sprint_hex_inrow(cmddata, sizeof(cmddata)), isOK ? _GREEN_("ok") : _RED_("fail"));
+            PrintAndLogEx(SUCCESS, "Write block %d ( %s )", blockno, isOK ? _GREEN_("ok") : _RED_("fail"));
         } else {
             PrintAndLogEx(WARNING, "Command execute timeout");
         }

From 152a2b43c07f14244fe9ed1f28a395a468ffe541 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Thu, 11 Feb 2021 23:18:17 +0100
Subject: [PATCH 554/682] hf jooki encode - fix tagtype..

---
 client/src/cmdhfjooki.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index 964008cc8..329a35476 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -249,7 +249,7 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
     if (tt_whale)
         tt = 5;
     
-    uint8_t iv[JOOKI_IV_LEN] = {0x31, 0x43, 0x33, 0};
+    uint8_t iv[JOOKI_IV_LEN] = {0x80, 0x77, 0x51, 1};
     if (use_tag) {
         int res = ul_read_uid(uid);
         if (res != PM3_SUCCESS) {

From 7a653e7faf4557c747859c6fc08877ef798f260b Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 12 Feb 2021 09:10:55 +0100
Subject: [PATCH 555/682] textual

---
 armsrc/Standalone/hf_aveful.c | 2 +-
 client/src/cmdhfmfu.c         | 5 +++--
 doc/cheatsheet.md             | 4 ++--
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/armsrc/Standalone/hf_aveful.c b/armsrc/Standalone/hf_aveful.c
index c9464e3d1..475aadfec 100644
--- a/armsrc/Standalone/hf_aveful.c
+++ b/armsrc/Standalone/hf_aveful.c
@@ -191,7 +191,7 @@ void RunMod(void) {
                         read_successful = false;
                         break;
                     }
-                    // We're skipping 14 blocks (56 bytes) here, as that "[...] has version/signature/counter data here" according to comments on hf_mfu_dumptoemulator
+                    // We're skipping 14 blocks (56 bytes) here, as that "[...] has version/signature/counter data here" according to comments on data_mfu_bin2eml
                     // When converting a bin, it's almost all 0 other than one 0x0F byte, and functionality seems to be unaffected if that byte is set to 0x00.
                     emlSetMem_xt(dataout, 14 + i, 1, 4);
                     Dbhexdump(4, dataout, 0);
diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index d975e8cb6..bdd74aa92 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -2283,7 +2283,7 @@ static int CmdHF14AMfUeLoad(const char *Cmd) {
     CLIExecWithReturn(ctx, Cmd, argtable, false);
     CLIParserFree(ctx);
 
-    PrintAndLogEx(HINT, "Hint: See " _YELLOW_("`script run hf_mfu_dumptoemulator`") " to convert the .bin to .eml");
+    PrintAndLogEx(HINT, "Hint: See " _YELLOW_("`script run data_mfu_bin2eml`") " to convert the .bin to .eml");
     return CmdHF14AMfELoad(Cmd);
 }
 //
@@ -2294,7 +2294,8 @@ static int CmdHF14AMfUSim(const char *Cmd) {
     CLIParserInit(&ctx, "hf mfu sim",
                   "Simulate MIFARE Ultralight family type based upon\n"
                   "ISO/IEC 14443 type A tag with 4,7 or 10 byte UID\n"
-                  "from emulator memory.  See `hf mfu eload` first",
+                  "from emulator memory.  See `hf mfu eload` first. \n"
+                  "See `hf 14a sim -h` to see available types. You want 2 or 7 usually.",
                   "hf mfu sim -t 2 --uid 1122344556677        -> MIFARE Ultralight\n"
                   "hf mfu sim -t 7 --uid 1122344556677 -n 5   -> AMIIBO (NTAG 215),  pack 0x8080"
                  );
diff --git a/doc/cheatsheet.md b/doc/cheatsheet.md
index 1220bf173..68a8e330e 100644
--- a/doc/cheatsheet.md
+++ b/doc/cheatsheet.md
@@ -332,9 +332,9 @@ pm3 --> hf mfu info
 Clone MIFARE Ultralight EV1 Sequence
 ```
 pm3 --> hf mfu dump -k FFFFFFFF
-pm3 --> script run hf_mfu_dumptoemulator -i hf-mfu-XXXX-dump.bin -o hf-mfu-XXXX-dump.eml
+pm3 --> script run data_mfu_bin2eml -i hf-mfu-XXXX-dump.bin -o hf-mfu-XXXX-dump.eml
 pm3 --> hf mfu eload -u -f hf-mfu-XXXX-dump.eml
-pm3 --> hf mfu sim -t 7 -f hf-mfu-XXXX-dump.eml
+pm3 --> hf mfu sim -t 7
 ```
 
 Bruteforce MIFARE Classic card numbers from 11223344 to 11223346

From 73cd4fb4ff6d168a736612b3ac204982dbe47dd5 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 12 Feb 2021 10:14:54 +0100
Subject: [PATCH 556/682] lf gallagher sim - about w user input. Coverity fixes

---
 client/src/cmdlfgallagher.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/client/src/cmdlfgallagher.c b/client/src/cmdlfgallagher.c
index 90ed274f2..7dad0f7a4 100644
--- a/client/src/cmdlfgallagher.c
+++ b/client/src/cmdlfgallagher.c
@@ -286,7 +286,11 @@ static int CmdGallagherClone(const char *Cmd) {
     int raw_len = 0;
     // skip first block,  3*4 = 12 bytes left
     uint8_t raw[12] = {0};
-    CLIParamHexToBuf(arg_get_str(ctx, 1), raw, sizeof raw, &raw_len);
+    int res = CLIParamHexToBuf(arg_get_str(ctx, 1), raw, sizeof raw, &raw_len);
+    if (res) {
+        CLIParserFree(ctx);
+        return PM3_EINVARG;
+    }
 
     bool q5 = arg_get_lit(ctx, 2);
     bool em = arg_get_lit(ctx, 3);
@@ -348,7 +352,6 @@ static int CmdGallagherClone(const char *Cmd) {
                   cardtype, use_raw ? "raw hex" : "specified data");
     print_blocks(blocks,  ARRAYLEN(blocks));
 
-    int res;
     if (em) {
         res = em4x05_clone_tag(blocks, ARRAYLEN(blocks), 0, false);
     } else {
@@ -384,7 +387,11 @@ static int CmdGallagherSim(const char *Cmd) {
     // skip first block,  3*4 = 12 bytes left
     uint8_t raw[12] = {0};
     CLIGetHexWithReturn(ctx, 1, raw, &raw_len);
-    CLIParamHexToBuf(arg_get_str(ctx, 1), raw, sizeof raw, &raw_len);
+    int res = CLIParamHexToBuf(arg_get_str(ctx, 1), raw, sizeof raw, &raw_len);
+    if (res) {
+        CLIParserFree(ctx);
+        return PM3_EINVARG;
+    }
 
     int16_t region_code = arg_get_int_def(ctx, 2, -1);
     int32_t facility_code = arg_get_int_def(ctx, 3, -1);
@@ -441,14 +448,7 @@ static int CmdGallagherSim(const char *Cmd) {
     SendCommandNG(CMD_LF_ASK_SIMULATE, (uint8_t *)payload,  sizeof(lf_asksim_t) + sizeof(bs));
     free(payload);
 
-    PacketResponseNG resp;
-    WaitForResponse(CMD_LF_ASK_SIMULATE, &resp);
-
-    PrintAndLogEx(INFO, "Done");
-    if (resp.status != PM3_EOPABORTED)
-        return resp.status;
-
-    return PM3_SUCCESS;
+    return lfsim_wait_check(CMD_LF_ASK_SIMULATE);
 }
 
 static command_t CommandTable[] = {

From 46d9ed20e5035b598df9650efba506d8da8ac2ef Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 12 Feb 2021 10:16:24 +0100
Subject: [PATCH 557/682] added "hf jooki sim" command.   Lets see if the
 data_available call every 8000th times doesnt interrupt with simulation
 process too much.

---
 armsrc/iso14443a.c      |  23 ++++---
 client/src/cmdhfjooki.c | 131 ++++++++++++++++++++++++++++++++++++----
 2 files changed, 134 insertions(+), 20 deletions(-)

diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index 759e5e646..69cedeb89 100644
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -916,18 +916,24 @@ bool GetIso14443aCommandFromReader(uint8_t *received, uint8_t *par, int *len) {
     uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
     (void)b;
 
-    uint16_t check = 0;
-
+    uint8_t flip = 0;
+    uint16_t checker = 0;
     for (;;) {
-        if (check == 4000) {
-//            if (BUTTON_PRESS() || data_available())
-            if (BUTTON_PRESS())
+        WDT_HIT();
+        if (flip) {
+            if (data_available())
                 return false;
 
-            check = 0;
-            WDT_HIT();
+            checker = 0;
+            flip = 0;
         }
-        ++check;
+
+        if (checker >= 4000) {
+            if (BUTTON_PRESS())
+                return false;
+            flip = 1;
+        }
+        ++checker;
 
         if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
             b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
@@ -1335,7 +1341,6 @@ void SimulateIso14443aTag(uint8_t tagType, uint8_t flags, uint8_t *data, uint8_t
     LED_A_ON();
 
     // main loop
-    //for (;;) {
     bool finished = false;
     bool button_pushed = BUTTON_PRESS();
     while (!button_pushed && !finished) {
diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index 329a35476..83c05157a 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -15,10 +15,12 @@
 #include "generator.h"
 #include "base64.h"
 #include "mifare/ndef.h"  // print decode ndef
+#include "mifare/mifarehost.h"  // mfemlsetmem_xt
 #include "cliparser.h"
 #include "cmdhfmfu.h"
 #include "cmdmain.h"
 
+
 static int CmdHelp(const char *Cmd);
 
 typedef struct {
@@ -146,12 +148,6 @@ static void jooki_print(uint8_t *b64, uint8_t *result, bool verbose) {
     jooki_printEx(b64, iv, tt, uid, verbose);
 }
 
-/*
-static int jooki_write(void) {
-    return PM3_SUCCESS;
-}
-*/
-
 static int jooki_selftest(void) {
     
     PrintAndLogEx(INFO, "======== " _CYAN_("selftest") " ==========================================="); 
@@ -195,7 +191,7 @@ static int jooki_selftest(void) {
 
 static int CmdHF14AJookiEncode(const char *Cmd) {
     CLIParserContext *ctx;
-    CLIParserInit(&ctx, "hf jooki Encode",
+    CLIParserInit(&ctx, "hf jooki encode",
                   "Encode a Jooki token to base64 NDEF URI format",
                   "hf jooki encode -t            --> selftest\n"
                   "hf jooki encode -r --dragon   --> read uid from tag and use for encoding\n"
@@ -219,7 +215,11 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
     int ulen = 0;
     uint8_t uid[JOOKI_UID_LEN] = {0x00};
     memset(uid, 0x0, sizeof(uid));
-    CLIParamHexToBuf(arg_get_str(ctx, 1), uid, sizeof(uid), &ulen);
+    int res = CLIParamHexToBuf(arg_get_str(ctx, 1), uid, sizeof(uid), &ulen);
+    if (res) {
+        CLIParserFree(ctx);
+        return PM3_EINVARG;
+    }
 
     bool use_tag = arg_get_lit(ctx, 2);
     bool selftest = arg_get_lit(ctx, 3);
@@ -251,7 +251,7 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
     
     uint8_t iv[JOOKI_IV_LEN] = {0x80, 0x77, 0x51, 1};
     if (use_tag) {
-        int res = ul_read_uid(uid);
+        res = ul_read_uid(uid);
         if (res != PM3_SUCCESS) {
             return res;
         }
@@ -298,11 +298,118 @@ static int CmdHF14AJookiDecode(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
+static int CmdHF14AJookiSim(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf jooki sim",
+                  "Simulate a Jooki token.  Either `hf mfu eload` before or use `-d` param",
+                  "hf jooki sim     --> using eload before\n"
+                  "hf jooki sim -d 7WzlgEzqLgwTnWNy"
+                 );
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("d", "data", "<hex>", "base64 url parameter"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+    int dlen = 16;
+    uint8_t b64[JOOKI_B64_LEN] = {0x00};
+    memset(b64, 0x0, sizeof(b64));
+    CLIGetStrWithReturn(ctx, 1, b64, &dlen);
+    CLIParserFree(ctx);
+
+    uint8_t result[JOOKI_PLAIN_LEN] = {0};
+    int res = jooki_decode(b64, result);
+    if (res != PM3_SUCCESS) {
+        return res;
+    }
+
+    jooki_print(b64, result, false);
+
+    // hf mfu sim...
+    uint8_t data[144] = {0};
+
+    // copy UID from base64 url parameter
+    memcpy(data, result + 5, 3);
+    // bbc0
+    data[3] = data[0] ^ data[1] ^ data[2];
+
+    memcpy(data + (1*4), result + 8, 4);
+    // bbc1
+    data[8] = data[4] ^ data[5] ^ data[6] ^ data[7];
+
+    // copy NDEF magic firs, skip BBC1 
+    memcpy(data + (2*4) + 1, "\x48\x1f\x00\xE1\x10\x12\x00", 7);
+
+    // copy raw NDEF
+    jooki_create_ndef(b64, data + (4 * 4));
+
+    // upload to emulator memory
+    PrintAndLogEx(INFO, "Uploading to emulator memory");
+
+    PrintAndLogEx(INFO, "." NOLF);
+    // fast push mode
+    conn.block_after_ACK = true;
+    uint8_t blockwidth = 4, counter = 0, blockno = 0, datalen = sizeof(data);
+    while (datalen) {
+        if (datalen == blockwidth) {
+            // Disable fast mode on last packet
+            conn.block_after_ACK = false;
+        }
+
+        if (mfEmlSetMem_xt(data + counter, blockno, 1, blockwidth) != PM3_SUCCESS) {
+            PrintAndLogEx(FAILED, "Cant set emul block: %3d", blockno);
+            return PM3_ESOFT;
+        }
+        PrintAndLogEx(NORMAL, "." NOLF);
+        fflush(stdout);
+        blockno++;
+        counter += blockwidth;
+        datalen -= blockwidth;
+    }
+    PrintAndLogEx(NORMAL, "\n");
+
+
+    struct {
+        uint8_t tagtype;
+        uint8_t flags;
+        uint8_t uid[10];
+        uint8_t exitAfter;
+    } PACKED payload;
+
+    // MF Ultralight ,  7 byte UID in eloaded data.
+    payload.tagtype = 2;
+    payload.flags = FLAG_7B_UID_IN_DATA;
+    payload.exitAfter = 0;
+
+    clearCommandBuffer();
+    SendCommandNG(CMD_HF_ISO14443A_SIMULATE, (uint8_t *)&payload, sizeof(payload));
+    PacketResponseNG resp;
+
+    PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " or pm3-button to abort simulation");
+    for (;;) {
+        if (kbd_enter_pressed()) {
+            SendCommandNG(CMD_BREAK_LOOP, NULL, 0);
+            PrintAndLogEx(DEBUG, "User aborted");
+            break;
+        }
+
+        if (WaitForResponseTimeout(CMD_HF_MIFARE_SIMULATE, &resp, 1500) == 0)
+            continue;
+
+        if (resp.status != PM3_SUCCESS) 
+            break;
+    }
+    PrintAndLogEx(INFO, "Done");
+    PrintAndLogEx(HINT, "Try `" _YELLOW_("hf 14a list") "` to view trace log" );
+    return PM3_SUCCESS;
+}
+
 static int CmdHF14AJookiWrite(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf jooki write",
                   "Write a Jooki token to a Ultralight or NTAG tag",
-                  "hf jooki write"
+                  "hf jooki write -d  xxxxxxxx   ->  where x is raw NDEF from encode command"
                  );
 
     void *argtable[] = {
@@ -373,7 +480,9 @@ static command_t CommandTable[] = {
     {"help",    CmdHelp,             AlwaysAvailable, "This help"},
     {"encode", CmdHF14AJookiEncode,  AlwaysAvailable, "Encode Jooki token"},
     {"decode", CmdHF14AJookiDecode,  AlwaysAvailable, "Decode Jooki token"},
-    {"write",  CmdHF14AJookiWrite,   IfPm3Iso14443a,   "Write a Jooki token"},
+    {"sim",    CmdHF14AJookiSim,     IfPm3Iso14443a,  "Simulate Jooki token"},
+    {"write",  CmdHF14AJookiWrite,   IfPm3Iso14443a,  "Write a Jooki token"},
+
     {NULL, NULL, NULL, NULL}
 };
 

From 5db0da5a2f905ecebeb7361fce34845d4981dd98 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 12 Feb 2021 10:28:54 +0100
Subject: [PATCH 558/682] added jooki,  keygen tests.  Fixed Gallagher demod
 test

---
 tools/pm3_tests.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/pm3_tests.sh b/tools/pm3_tests.sh
index 0ef81b7c5..1dd575298 100755
--- a/tools/pm3_tests.sh
+++ b/tools/pm3_tests.sh
@@ -343,6 +343,8 @@ while true; do
       if ! CheckExecute "reveng -g test"          "$CLIENTBIN -c 'reveng -g abda202c'" "CRC-16/ISO-IEC-14443-3-A"; then break; fi
       if ! CheckExecute "reveng -w test"          "$CLIENTBIN -c 'reveng -w 8 -s 01020304e3 010204039d'" "CRC-8/SMBUS"; then break; fi
       if ! CheckExecute "mfu pwdgen test"         "$CLIENTBIN -c 'hf mfu pwdgen -t'" "Selftest OK"; then break; fi
+      if ! CheckExecute "mfu keygen test"         "$CLIENTBIN -c 'hf mfu keygen'" "A7 D8 7A 4B 1A 29"; then break; fi
+      if ! CheckExecute "jooki encode test"       "$CLIENTBIN -c 'hf jooki encode -t'" "04 28 F4 DA F0 4A 81  ( ok )"; then break; fi
       if ! CheckExecute "trace load/list 14a"     "$CLIENTBIN -c 'trace load -f traces/hf_14a_mfu.trace; trace list -1 -t 14a;'" "READBLOCK(8)"; then break; fi
       if ! CheckExecute "trace load/list x"       "$CLIENTBIN -c 'trace load -f traces/hf_14a_mfu.trace; trace list -x1 -t 14a;'" "0.0101840425"; then break; fi
 
@@ -382,7 +384,7 @@ while true; do
                                                                      "temperature     95.2 F / 35.1 C"; then break; fi
       if ! CheckExecute slow "lf T55 gallagher test"             "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_gallagher.pm3; lf search -1'" "GALLAGHER ID found"; then break; fi
       if ! CheckExecute slow "lf T55 gallagher test2"            "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_gallagher.pm3; lf gallagher demod'" \
-                                                                     "GALLAGHER - Region: 0 FC: 27865 CN: 682758 Issue Level: 13"; then break; fi
+                                                                     "GALLAGHER - Region: 1 FC: 16640 CN: 201 Issue Level: 1"; then break; fi
       if ! CheckExecute slow "lf T55 gproxii test"               "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_gproxii.pm3; lf search -1'" "Guardall G-Prox II ID found"; then break; fi
       if ! CheckExecute slow "lf T55 gproxii test2"              "$CLIENTBIN -c 'data load -f traces/lf_ATA5577_gproxii.pm3; lf gproxii demod'" \
                                                                      "G-Prox-II - len: 26 FC: 123 Card: 11223, Raw: f98c7038c63356c7ac26398c"; then break; fi

From 69a73675fb094b65598c9cc8fe0b19f5bd8f04a8 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 12 Feb 2021 10:32:07 +0100
Subject: [PATCH 559/682] text

---
 client/src/cmdhfjooki.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index 83c05157a..5f2ba54e0 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -278,7 +278,7 @@ static int CmdHF14AJookiDecode(const char *Cmd) {
 
     void *argtable[] = {
         arg_param_begin,
-        arg_str1("d", "data", "<hex>", "base64 url parameter"),
+        arg_str1("d", "data", "<base64>", "base64 url parameter"),
         arg_lit0("v", "verbose", "verbose output"),
         arg_param_end
     };
@@ -308,7 +308,7 @@ static int CmdHF14AJookiSim(const char *Cmd) {
 
     void *argtable[] = {
         arg_param_begin,
-        arg_str0("d", "data", "<hex>", "base64 url parameter"),
+        arg_str0("d", "data", "<base64>", "base64 url parameter"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);

From 0f40e97b71de12ebfc3b5f903ee0dceb1faa3945 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 12 Feb 2021 10:38:57 +0100
Subject: [PATCH 560/682] lf gallagher demod - remove debug statements

---
 client/src/cmdlfgallagher.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/client/src/cmdlfgallagher.c b/client/src/cmdlfgallagher.c
index 7dad0f7a4..31d2b7d0a 100644
--- a/client/src/cmdlfgallagher.c
+++ b/client/src/cmdlfgallagher.c
@@ -121,9 +121,7 @@ int demodGallagher(bool verbose) {
     uint8_t crc = bytebits_to_byte(DemodBuffer + 16 + (9 * 8), 8);
     uint8_t calc_crc =  CRC8Cardx(arr, ARRAYLEN(arr));
 
-    PrintAndLogEx(INFO, " Before:  %s", sprint_hex(arr, 8));
     descramble(arr, ARRAYLEN(arr));
-    PrintAndLogEx(INFO, " After :  %s", sprint_hex(arr, 8));
 
     // 4bit region code
     uint8_t rc = (arr[3] & 0x1E) >> 1;

From 667e2bb9f817a6b16ebb43cffddcba32156905ed Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 12 Feb 2021 11:10:58 +0100
Subject: [PATCH 561/682] fix pm3test for mfu keygen. UID array was not zero:d

---
 client/src/cmdhfmfu.c | 7 ++++++-
 tools/pm3_tests.sh    | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index bdd74aa92..94fff01ea 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -2629,7 +2629,7 @@ static int CmdHF14AMfUGenDiverseKeys(const char *Cmd) {
 
     void *argtable[] = {
         arg_param_begin,
-        arg_str0("u", "uid", "<hex>", "4|7 hex byte UID"),
+        arg_str0("u", "uid", "<hex>", "<4|7> hex byte UID"),
         arg_lit0("r", NULL, "read UID from tag"),
         arg_param_end
     };
@@ -2667,6 +2667,11 @@ static int CmdHF14AMfUGenDiverseKeys(const char *Cmd) {
         }
         ulen = card.uidlen;
         memcpy(uid, card.uid, card.uidlen);
+    } else {
+        if (ulen != 4 && ulen != 7) {
+            PrintAndLogEx(ERR, "Must supply 4 or 7 hex byte uid");
+            return PM3_EINVARG;
+        }
     }
 
     uint8_t iv[8] = { 0x00 };
diff --git a/tools/pm3_tests.sh b/tools/pm3_tests.sh
index 1dd575298..da5ea56a5 100755
--- a/tools/pm3_tests.sh
+++ b/tools/pm3_tests.sh
@@ -343,7 +343,7 @@ while true; do
       if ! CheckExecute "reveng -g test"          "$CLIENTBIN -c 'reveng -g abda202c'" "CRC-16/ISO-IEC-14443-3-A"; then break; fi
       if ! CheckExecute "reveng -w test"          "$CLIENTBIN -c 'reveng -w 8 -s 01020304e3 010204039d'" "CRC-8/SMBUS"; then break; fi
       if ! CheckExecute "mfu pwdgen test"         "$CLIENTBIN -c 'hf mfu pwdgen -t'" "Selftest OK"; then break; fi
-      if ! CheckExecute "mfu keygen test"         "$CLIENTBIN -c 'hf mfu keygen'" "A7 D8 7A 4B 1A 29"; then break; fi
+      if ! CheckExecute "mfu keygen test"         "$CLIENTBIN -c 'hf mfu keygen --uid 11223344556677'" "80 B1 C2 71 D8 A0"; then break; fi
       if ! CheckExecute "jooki encode test"       "$CLIENTBIN -c 'hf jooki encode -t'" "04 28 F4 DA F0 4A 81  ( ok )"; then break; fi
       if ! CheckExecute "trace load/list 14a"     "$CLIENTBIN -c 'trace load -f traces/hf_14a_mfu.trace; trace list -1 -t 14a;'" "READBLOCK(8)"; then break; fi
       if ! CheckExecute "trace load/list x"       "$CLIENTBIN -c 'trace load -f traces/hf_14a_mfu.trace; trace list -x1 -t 14a;'" "0.0101840425"; then break; fi

From 9f44abe2f4e5098de762d2d79bccf5d542486dda Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 12 Feb 2021 18:47:41 +0100
Subject: [PATCH 562/682] hf jooki sim - fixed a wrong bcc0 calc and forgot to
 convert it to the new dump format..

---
 client/src/cmdhfjooki.c | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index 5f2ba54e0..5a3eea754 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -19,6 +19,7 @@
 #include "cliparser.h"
 #include "cmdhfmfu.h"
 #include "cmdmain.h"
+#include "fileutils.h"    // convert_mfu..
 
 
 static int CmdHelp(const char *Cmd);
@@ -327,12 +328,12 @@ static int CmdHF14AJookiSim(const char *Cmd) {
     jooki_print(b64, result, false);
 
     // hf mfu sim...
-    uint8_t data[144] = {0};
+    uint8_t *data = calloc(144, sizeof(uint8_t));
 
     // copy UID from base64 url parameter
     memcpy(data, result + 5, 3);
     // bbc0
-    data[3] = data[0] ^ data[1] ^ data[2];
+    data[3] = 0x88 ^ data[0] ^ data[1] ^ data[2];
 
     memcpy(data + (1*4), result + 8, 4);
     // bbc1
@@ -344,13 +345,25 @@ static int CmdHF14AJookiSim(const char *Cmd) {
     // copy raw NDEF
     jooki_create_ndef(b64, data + (4 * 4));
 
+    // convert plain or old mfu format to new format
+    size_t datalen = 144;
+    res = convert_mfu_dump_format(&data, &datalen, true);
+    if (res != PM3_SUCCESS) {
+        PrintAndLogEx(FAILED, "Failed convert on load to new Ultralight/NTAG format");
+        free(data);
+        return res;
+    }
+
+    mfu_dump_t *mfu_dump = (mfu_dump_t *)data;
+    printMFUdumpEx(mfu_dump, mfu_dump->pages + 1, 0);
+
     // upload to emulator memory
     PrintAndLogEx(INFO, "Uploading to emulator memory");
 
     PrintAndLogEx(INFO, "." NOLF);
     // fast push mode
     conn.block_after_ACK = true;
-    uint8_t blockwidth = 4, counter = 0, blockno = 0, datalen = sizeof(data);
+    uint8_t blockwidth = 4, counter = 0, blockno = 0;
     while (datalen) {
         if (datalen == blockwidth) {
             // Disable fast mode on last packet
@@ -359,6 +372,7 @@ static int CmdHF14AJookiSim(const char *Cmd) {
 
         if (mfEmlSetMem_xt(data + counter, blockno, 1, blockwidth) != PM3_SUCCESS) {
             PrintAndLogEx(FAILED, "Cant set emul block: %3d", blockno);
+            free(data);
             return PM3_ESOFT;
         }
         PrintAndLogEx(NORMAL, "." NOLF);
@@ -369,7 +383,6 @@ static int CmdHF14AJookiSim(const char *Cmd) {
     }
     PrintAndLogEx(NORMAL, "\n");
 
-
     struct {
         uint8_t tagtype;
         uint8_t flags;
@@ -400,6 +413,7 @@ static int CmdHF14AJookiSim(const char *Cmd) {
         if (resp.status != PM3_SUCCESS) 
             break;
     }
+    free(data);
     PrintAndLogEx(INFO, "Done");
     PrintAndLogEx(HINT, "Try `" _YELLOW_("hf 14a list") "` to view trace log" );
     return PM3_SUCCESS;

From 8ece2ca023c80c170d68db209effd914f9e75e1a Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 12 Feb 2021 19:28:32 +0100
Subject: [PATCH 563/682] hf jooki sim - set type to NTAG215

---
 client/src/cmdhfjooki.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index 5a3eea754..8322625de 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -355,6 +355,11 @@ static int CmdHF14AJookiSim(const char *Cmd) {
     }
 
     mfu_dump_t *mfu_dump = (mfu_dump_t *)data;
+
+    memcpy(mfu_dump->version, "\x00\x04\x04\x02\x01\x00\x11\x03", 8);
+    mfu_dump->counter_tearing[2][3] = 0xBD;
+    mfu_dump->pages = 0x2c;
+
     printMFUdumpEx(mfu_dump, mfu_dump->pages + 1, 0);
 
     // upload to emulator memory
@@ -390,8 +395,8 @@ static int CmdHF14AJookiSim(const char *Cmd) {
         uint8_t exitAfter;
     } PACKED payload;
 
-    // MF Ultralight ,  7 byte UID in eloaded data.
-    payload.tagtype = 2;
+    // NTAG,  7 byte UID in eloaded data.
+    payload.tagtype = 7;
     payload.flags = FLAG_7B_UID_IN_DATA;
     payload.exitAfter = 0;
 

From 29476bb923a481b08e43543429edb4c97de8cf31 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 12 Feb 2021 20:35:26 +0100
Subject: [PATCH 564/682] change from NTAG215 -> NTAG213

---
 client/src/cmdhfjooki.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index 8322625de..744c95704 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -356,7 +356,8 @@ static int CmdHF14AJookiSim(const char *Cmd) {
 
     mfu_dump_t *mfu_dump = (mfu_dump_t *)data;
 
-    memcpy(mfu_dump->version, "\x00\x04\x04\x02\x01\x00\x11\x03", 8);
+
+    memcpy(mfu_dump->version, "\x00\x04\x04\x02\x01\x00\x0F\x03", 8);
     mfu_dump->counter_tearing[2][3] = 0xBD;
     mfu_dump->pages = 0x2c;
 

From 4c7c3643f300b76893dbf853c569b26d0479d5a7 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 12 Feb 2021 20:54:30 +0100
Subject: [PATCH 565/682] hf jooki sim - fix lockbits

---
 client/src/cmdhfjooki.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index 744c95704..352c61ae7 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -340,7 +340,7 @@ static int CmdHF14AJookiSim(const char *Cmd) {
     data[8] = data[4] ^ data[5] ^ data[6] ^ data[7];
 
     // copy NDEF magic firs, skip BBC1 
-    memcpy(data + (2*4) + 1, "\x48\x1f\x00\xE1\x10\x12\x00", 7);
+    memcpy(data + (2*4) + 1, "\x48\x00\x00\xE1\x10\x12\x00", 7);
 
     // copy raw NDEF
     jooki_create_ndef(b64, data + (4 * 4));

From 1ce9053c51fec0e7b86cd615894c4620db5ad75d Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 12 Feb 2021 22:08:10 +0100
Subject: [PATCH 566/682] hf 14a sim -  less button checks and even less
 dataavailable checks

---
 armsrc/iso14443a.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index 69cedeb89..999c5eded 100644
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -920,18 +920,19 @@ bool GetIso14443aCommandFromReader(uint8_t *received, uint8_t *par, int *len) {
     uint16_t checker = 0;
     for (;;) {
         WDT_HIT();
-        if (flip) {
+        if (flip == 2) {
             if (data_available())
                 return false;
 
-            checker = 0;
             flip = 0;
         }
 
         if (checker >= 4000) {
             if (BUTTON_PRESS())
                 return false;
-            flip = 1;
+
+            flip++;
+            checker = 0;
         }
         ++checker;
 

From 4e157aa94a596cbb06dbcab8e85cdafa06472cd5 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 13 Feb 2021 06:40:42 +0100
Subject: [PATCH 567/682] hf jooki sim - copy uid and use correct flag

---
 client/src/cmdhfjooki.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index 352c61ae7..9b1a14b8b 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -327,15 +327,19 @@ static int CmdHF14AJookiSim(const char *Cmd) {
 
     jooki_print(b64, result, false);
 
+    // copy UID from base64 url parameter
+    uint8_t uid[7] = {0};
+    memcpy(uid, result + 5, 7);
+
     // hf mfu sim...
     uint8_t *data = calloc(144, sizeof(uint8_t));
 
-    // copy UID from base64 url parameter
-    memcpy(data, result + 5, 3);
+    memcpy(data, uid, 3);
+    memcpy(data + (1*4), uid + 3, 4);
+
     // bbc0
     data[3] = 0x88 ^ data[0] ^ data[1] ^ data[2];
 
-    memcpy(data + (1*4), result + 8, 4);
     // bbc1
     data[8] = data[4] ^ data[5] ^ data[6] ^ data[7];
 
@@ -398,8 +402,9 @@ static int CmdHF14AJookiSim(const char *Cmd) {
 
     // NTAG,  7 byte UID in eloaded data.
     payload.tagtype = 7;
-    payload.flags = FLAG_7B_UID_IN_DATA;
+    payload.flags = FLAG_UID_IN_EMUL;
     payload.exitAfter = 0;
+    memcpy(payload.uid, uid, sizeof(uid));
 
     clearCommandBuffer();
     SendCommandNG(CMD_HF_ISO14443A_SIMULATE, (uint8_t *)&payload, sizeof(payload));

From a7d3584176a0eebadb6b4928d2aacb3e5d7cd8c1 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 13 Feb 2021 10:28:37 +0100
Subject: [PATCH 568/682] even less dataavailable checks

---
 armsrc/iso14443a.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index 999c5eded..cd07a4007 100644
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -920,14 +920,14 @@ bool GetIso14443aCommandFromReader(uint8_t *received, uint8_t *par, int *len) {
     uint16_t checker = 0;
     for (;;) {
         WDT_HIT();
-        if (flip == 2) {
+        if (flip == 3) {
             if (data_available())
                 return false;
 
             flip = 0;
         }
 
-        if (checker >= 4000) {
+        if (checker >= 3000) {
             if (BUTTON_PRESS())
                 return false;
 

From eec13e8798785ed8b42dcf5a3946b0a01b5efd7b Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 7 Feb 2021 13:30:56 -0500
Subject: [PATCH 569/682] hf mf ice - now use cliparser

---
 client/src/cmdhfmf.c   | 82 ++++++++++++++++++------------------------
 doc/cliparser_todo.txt |  1 -
 2 files changed, 35 insertions(+), 48 deletions(-)

diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index 475c687fb..76d849c05 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -42,18 +42,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_hf14_ice(void) {
-    PrintAndLogEx(NORMAL, "Usage:   hf mf ice [l <limit>] [f <name>]");
-    PrintAndLogEx(NORMAL, "  h            this help");
-    PrintAndLogEx(NORMAL, "  l <limit>    nonces to be collected");
-    PrintAndLogEx(NORMAL, "  f <name>     save nonces to <name> instead of hf-mf-<UID>-nonces.bin");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("         hf mf ice"));
-    PrintAndLogEx(NORMAL, _YELLOW_("         hf mf ice f nonces.bin"));
-    return PM3_SUCCESS;
-}
-
 static int usage_hf14_dump(void) {
     PrintAndLogEx(NORMAL, "Usage:   hf mf dump [card memory] [k <name>] [f <name>]");
     PrintAndLogEx(NORMAL, "  [card memory]: 0 = 320 bytes (MIFARE Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");
@@ -4709,44 +4697,30 @@ static int CmdHf14AMfNack(const char *Cmd) {
 }
 
 static int CmdHF14AMfice(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mf ice",
+                  "Collect MIFARE Classic nonces to file",
+                  "hf mf ice\n"
+                  "hf mf ice -f nonces.bin");
 
-    uint8_t blockNo = 0;
-    uint8_t keyType = 0;
-    uint8_t trgBlockNo = 0;
-    uint8_t trgKeyType = 1;
-    bool slow = false;
-    bool initialize = true;
-    bool acquisition_completed = false;
-    uint8_t cmdp = 0;
-    uint32_t flags = 0;
-    uint32_t total_num_nonces = 0;
-    char ctmp;
-    char filename[FILE_PATH_SIZE], *fptr;
-    FILE *fnonces = NULL;
-    PacketResponseNG resp;
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("f", "file", "<filename>", "filename of nonce dump"),
+        arg_u64_0(NULL, "limit", "<dec>", "nonces to be collected"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
 
-    uint32_t part_limit = 3000;
-    uint32_t limit = 50000;
+    int fnlen = 0;
+    char filename[FILE_PATH_SIZE] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
 
-    while ((ctmp = param_getchar(Cmd, cmdp))) {
-        switch (tolower(ctmp)) {
-            case 'h':
-                return usage_hf14_ice();
-            case 'f':
-                param_getstr(Cmd, cmdp + 1, filename, FILE_PATH_SIZE);
-                cmdp++;
-                break;
-            case 'l':
-                limit = param_get32ex(Cmd, cmdp + 1, 50000, 10);
-                cmdp++;
-                break;
-            default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'\n", ctmp);
-                usage_hf14_ice();
-                return PM3_ESOFT;
-        }
-        cmdp++;
-    }
+    uint32_t limit = arg_get_u32_def(ctx, 2, 50000);
+
+    CLIParserFree(ctx);
+
+    // Validations
+    char *fptr;
 
     if (filename[0] == '\0') {
         fptr = GenerateFilename("hf-mf-", "-nonces.bin");
@@ -4756,6 +4730,20 @@ static int CmdHF14AMfice(const char *Cmd) {
         free(fptr);
     }
 
+    uint8_t blockNo = 0;
+    uint8_t keyType = 0;
+    uint8_t trgBlockNo = 0;
+    uint8_t trgKeyType = 1;
+    bool slow = false;
+    bool initialize = true;
+    bool acquisition_completed = false;
+    uint32_t flags = 0;
+    uint32_t total_num_nonces = 0;
+    FILE *fnonces = NULL;
+    PacketResponseNG resp;
+
+    uint32_t part_limit = 3000;
+    
     PrintAndLogEx(NORMAL, "Collecting "_YELLOW_("%u")" nonces \n", limit);
 
     if ((fnonces = fopen(filename, "wb")) == NULL) {
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index c52d35d69..a672d87a9 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -92,7 +92,6 @@ hf mf cview
 hf mf gen3uid
 hf mf gen3blk
 hf mf gen3freeze
-hf mf ice
 lf em 410x
 lf em 4x05
 lf em 4x50

From 7d37481ce1cfef893fb85004e9bead5c5c08cb5e Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 7 Feb 2021 15:06:10 -0500
Subject: [PATCH 570/682] hf mf dump - now uses cliparser

---
 client/luascripts/hf_mf_autopwn.lua |  2 +-
 client/src/cmdhfmf.c                | 95 ++++++++++++++++-------------
 doc/cheatsheet.md                   | 19 +++---
 doc/cliparser_todo.txt              |  1 -
 4 files changed, 64 insertions(+), 53 deletions(-)

diff --git a/client/luascripts/hf_mf_autopwn.lua b/client/luascripts/hf_mf_autopwn.lua
index f7ea2a832..78a701488 100644
--- a/client/luascripts/hf_mf_autopwn.lua
+++ b/client/luascripts/hf_mf_autopwn.lua
@@ -123,7 +123,7 @@ local function dump_tag(uid, numsectors)
 
         local dumpfile = 'hf-mf-'..uid..'-dump'
 
-        local dmp = ('hf mf dump %s f %s'):format(typ, dumpfile)
+        local dmp = ('hf mf dump -t %s -f %s'):format(typ, dumpfile)
         core.console(dmp)
 
         -- Save the global args, those are *our* arguments
diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index 76d849c05..b0648b3f3 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -42,18 +42,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_hf14_dump(void) {
-    PrintAndLogEx(NORMAL, "Usage:   hf mf dump [card memory] [k <name>] [f <name>]");
-    PrintAndLogEx(NORMAL, "  [card memory]: 0 = 320 bytes (MIFARE Mini), 1 = 1K (default), 2 = 2K, 4 = 4K");
-    PrintAndLogEx(NORMAL, "  k <name>     : key filename, if no <name> given, UID will be used as filename");
-    PrintAndLogEx(NORMAL, "  f <name>     : data filename, if no <name> given, UID will be used as filename");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("         hf mf dump"));
-    PrintAndLogEx(NORMAL, _YELLOW_("         hf mf dump 4"));
-    return PM3_SUCCESS;
-}
-
 static int usage_hf14_mifare(void) {
     PrintAndLogEx(NORMAL, "Usage:  hf mf darkside <block number> <A|B>");
     PrintAndLogEx(NORMAL, "Options:");
@@ -650,6 +638,21 @@ static uint8_t NumOfSectors(char card) {
     }
 }
 
+static uint8_t NewNumOfSectors(uint8_t card) {
+    switch (card) {
+        case 0 :
+            return MIFARE_MINI_MAXSECTOR;
+        case 1 :
+            return MIFARE_1K_MAXSECTOR;
+        case 2 :
+            return MIFARE_2K_MAXSECTOR;
+        case 4 :
+            return MIFARE_4K_MAXSECTOR;
+        default  :
+            return 0;
+    }
+}
+
 static uint8_t FirstBlockOfSector(uint8_t sectorNo) {
     if (sectorNo < 32) {
         return sectorNo * 4;
@@ -942,6 +945,36 @@ static int FastDumpWithEcFill(uint8_t numsectors) {
 
 static int CmdHF14AMfDump(const char *Cmd) {
 
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mf dump",
+                  "Dump MIFARE Classic tag to binary file\n"
+                  "If no <name> given, UID will be used as filename",
+                  "hf mf dump -t 0                     -> MIFARE Mini\n"
+                  "hf mf dump -t 1                     -> MIFARE Classic 1k (default)\n"
+                  "hf mf dump -t 2                     -> MIFARE 2k\n"
+                  "hf mf dump -t 4                     -> MIFARE 4k\n");
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_int0("t", "type", "<0-4> ", "MIFARE Classic type"),
+        arg_str0("f", "file", "<filename>", "filename of dump"),
+        arg_str0("k", "keys", "<filename>", "filename of keys"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
+
+    uint8_t numSectors = NewNumOfSectors(arg_get_u32_def(ctx, 1, 1));
+
+    int datafnlen = 0;
+    char dataFilename[FILE_PATH_SIZE] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 2), (uint8_t *)dataFilename, FILE_PATH_SIZE, &datafnlen);
+
+    int keyfnlen = 0;
+    char keyFilename[FILE_PATH_SIZE] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 3), (uint8_t *)keyFilename, FILE_PATH_SIZE, &keyfnlen);
+
+    CLIParserFree(ctx);
+
     uint64_t t1 = msclock();
 
     uint8_t sectorNo, blockNo;
@@ -949,43 +982,17 @@ static int CmdHF14AMfDump(const char *Cmd) {
     uint8_t keyB[40][6];
     uint8_t rights[40][4];
     uint8_t carddata[256][16];
-    uint8_t numSectors = 16;
-    uint8_t cmdp = 0;
-
-    char keyFilename[FILE_PATH_SIZE] = {0};
-    char dataFilename[FILE_PATH_SIZE];
-    char *fptr;
-
-    memset(keyFilename, 0, sizeof(keyFilename));
-    memset(dataFilename, 0, sizeof(dataFilename));
-
+    
     FILE *f;
     PacketResponseNG resp;
 
-    while (param_getchar(Cmd, cmdp) != 0x00) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'h':
-                return usage_hf14_dump();
-            case 'k':
-                param_getstr(Cmd, cmdp + 1, keyFilename, FILE_PATH_SIZE);
-                cmdp += 2;
-                break;
-            case 'f':
-                param_getstr(Cmd, cmdp + 1, dataFilename, FILE_PATH_SIZE);
-                cmdp += 2;
-                break;
-            default:
-                if (cmdp == 0) {
-                    numSectors = NumOfSectors(param_getchar(Cmd, cmdp));
-                    if (numSectors == 0) return usage_hf14_dump();
-                    cmdp++;
-                } else {
-                    PrintAndLogEx(WARNING, "Unknown parameter '%c'\n", param_getchar(Cmd, cmdp));
-                    return usage_hf14_dump();
-                }
-        }
+    if (numSectors == 0) {
+        PrintAndLogEx(ERR, "Invalid MIFARE Classic type");
+        return PM3_EINVARG;
     }
 
+    char *fptr;
+
     if (keyFilename[0] == 0x00) {
         fptr = GenerateFilename("hf-mf-", "-key.bin");
         if (fptr == NULL)
diff --git a/doc/cheatsheet.md b/doc/cheatsheet.md
index 68a8e330e..ebe858985 100644
--- a/doc/cheatsheet.md
+++ b/doc/cheatsheet.md
@@ -244,14 +244,19 @@ pm3 --> hf mf fchk 1 m
 
 Dump MIFARE card contents
 ```
-Options
----
-<card memory> : 0 = 320 bytes (MIFARE Mini), 1 = 1K (default), 2 = 2K, 4 = 4K
-k <name>      : key filename, if no <name> given, UID will be used as filename"
-f <name>      : data filename, if no <name> given, UID will be used as filename
+options:
+    -t, --type <0-4>               MIFARE Classic type
+    -f, --file <filename>          filename of dump
+    -k, --keys <filename>          filename of keys
 
-pm3 --> hf mf dump 1
-pm3 --> hf mf dump 1 k hf-mf-A29558E4-key.bin f hf-mf-A29558E4-dump.bin
+examples/notes:
+    hf mf dump -t 0                          -> MIFARE Mini
+    hf mf dump -t 1                          -> MIFARE Classic 1k (default)
+    hf mf dump -t 2                          -> MIFARE 2k
+    hf mf dump -t 4                          -> MIFARE 4k
+
+pm3 --> hf mf dump -t 1
+pm3 --> hf mf dump -t 1 -k hf-mf-A29558E4-key.bin -f hf-mf-A29558E4-dump.bin
 ```
 
 Convert .bin to .eml
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index a672d87a9..5d974b637 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -66,7 +66,6 @@ hf mf nack
 hf mf chk
 hf mf fchk
 hf mf decrypt
-hf mf dump
 hf mf rdbl
 hf mf rdsc
 hf mf restore

From 0ade8a55059d536af1ea57b9a50f7efe6cfa8f6c Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 7 Feb 2021 15:20:16 -0500
Subject: [PATCH 571/682] hf mf darkside - now use cliparser

---
 client/src/cmdhfmf.c   | 40 +++++++++++++++++++++-------------------
 doc/cliparser_todo.txt |  1 -
 2 files changed, 21 insertions(+), 20 deletions(-)

diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index b0648b3f3..dfcf7e47e 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -42,18 +42,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_hf14_mifare(void) {
-    PrintAndLogEx(NORMAL, "Usage:  hf mf darkside <block number> <A|B>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h               this help");
-    PrintAndLogEx(NORMAL, "      <block number>  (Optional) target other block");
-    PrintAndLogEx(NORMAL, "      <A|B>           (optional) target key type");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("           hf mf darkside"));
-    PrintAndLogEx(NORMAL, _YELLOW_("           hf mf darkside 16"));
-    PrintAndLogEx(NORMAL, _YELLOW_("           hf mf darkside 16 B"));
-    return PM3_SUCCESS;
-}
 static int usage_hf14_mfsim(void) {
     PrintAndLogEx(NORMAL, "Usage:  hf mf sim [u <uid>] [n <numreads>] [t] [a <ATQA>] [s <SAK>] [i] [x] [e] [v]");
     PrintAndLogEx(NORMAL, "Options:");
@@ -692,17 +680,31 @@ static char GetFormatFromSector(uint8_t sectorNo) {
 }
 
 static int CmdHF14AMfDarkside(const char *Cmd) {
-    uint8_t blockno = 0, key_type = MIFARE_AUTH_KEYA;
-    uint64_t key = 0;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mf darkside",
+                  "Darkside attack",
+                  "hf mf darkside\n"
+                  "hf mf darkside -b 16\n"
+                  "hf mf darkside -b 16 --keyb\n");
 
-    char cmdp = tolower(param_getchar(Cmd, 0));
-    if (cmdp == 'h') return usage_hf14_mifare();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_int0("b", "block", "<dec> ", "Simulation type to use"),
+        arg_lit0(NULL, "keyb", "Target key B instead of default key A"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
 
-    blockno = param_get8(Cmd, 0);
+    uint8_t blockno = arg_get_u32_def(ctx, 1, 0);
 
-    cmdp = tolower(param_getchar(Cmd, 1));
-    if (cmdp == 'b')
+    uint8_t key_type = MIFARE_AUTH_KEYA;
+
+    if (arg_get_lit(ctx, 2)) {
+        PrintAndLogEx(INFO, "Targeting key B");
         key_type = MIFARE_AUTH_KEYB;
+    }
+
+    uint64_t key = 0;
 
     int isOK = mfDarkside(blockno, key_type, &key);
     PrintAndLogEx(NORMAL, "");
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 5d974b637..727802ef2 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -57,7 +57,6 @@ hf felica rqspecver
 hf felica resetmode
 hf felica litesim
 hf felica litedump
-hf mf darkside
 hf mf nested
 hf mf hardnested
 hf mf staticnested

From 006246bf8ca9eaa547ab5ab03da9177abc27273c Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 7 Feb 2021 16:15:22 -0500
Subject: [PATCH 572/682] hf mf sim - now use cliparser

---
 client/gen_pm3mfsim_script.sh        |   2 +-
 client/luascripts/hf_mf_tnp3_sim.lua |   2 +-
 client/src/cmdhfmf.c                 | 252 +++++++++++++--------------
 doc/cheatsheet.md                    |   4 +-
 doc/cliparser_todo.txt               |   1 -
 5 files changed, 121 insertions(+), 140 deletions(-)

diff --git a/client/gen_pm3mfsim_script.sh b/client/gen_pm3mfsim_script.sh
index c3726d69c..14cb37909 100644
--- a/client/gen_pm3mfsim_script.sh
+++ b/client/gen_pm3mfsim_script.sh
@@ -32,4 +32,4 @@ rm $2
 echo "hf mf eclr" >> $2
 echo "hf mf eload" $1 >> $2
 echo "hf mf ekeyprn" >> $2
-echo "hf mf sim u" `cat $1.eml | (read -n 8 uid; echo $uid)` >> $2
\ No newline at end of file
+echo "hf mf sim -u" `cat $1.eml | (read -n 8 uid; echo $uid)` >> $2
\ No newline at end of file
diff --git a/client/luascripts/hf_mf_tnp3_sim.lua b/client/luascripts/hf_mf_tnp3_sim.lua
index dded9327a..33f82b2d4 100644
--- a/client/luascripts/hf_mf_tnp3_sim.lua
+++ b/client/luascripts/hf_mf_tnp3_sim.lua
@@ -496,7 +496,7 @@ local function main(args)
         err = LoadEmulator(uid, blocks)
         if err then return oops(err) end
         core.clearCommandBuffer()
-        print('The simulation is now prepared.\n --> run \"hf mf sim u '..uid..'\" <--')
+        print('The simulation is now prepared.\n --> run \"hf mf sim -u '..uid..'\" <--')
     end
 end
 main(args)
diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index dfcf7e47e..0b40120a1 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -42,30 +42,6 @@
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_hf14_mfsim(void) {
-    PrintAndLogEx(NORMAL, "Usage:  hf mf sim [u <uid>] [n <numreads>] [t] [a <ATQA>] [s <SAK>] [i] [x] [e] [v]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h    this help");
-    PrintAndLogEx(NORMAL, "      u    (Optional) UID 4,7 or 10bytes. If not specified, the UID 4b/7b from emulator memory will be used");
-    PrintAndLogEx(NORMAL, "      t    (Optional)   Enforce ATQA/SAK:");
-    PrintAndLogEx(NORMAL, "                        0 = MIFARE Mini");
-    PrintAndLogEx(NORMAL, "                        1 = MIFARE Classic 1k (Default)");
-    PrintAndLogEx(NORMAL, "                        2 = MIFARE Classic 2k plus in SL0 mode");
-    PrintAndLogEx(NORMAL, "                        4 = MIFARE Classic 4k");
-    PrintAndLogEx(NORMAL, "      a    (Optional)   Provide explicitly ATQA (2 bytes, override option t)");
-    PrintAndLogEx(NORMAL, "      s    (Optional)   Provide explicitly SAK (1 byte, override option t)");
-    PrintAndLogEx(NORMAL, "      n    (Optional) Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite");
-    PrintAndLogEx(NORMAL, "      i    (Optional) Interactive, means that console will not be returned until simulation finishes or is aborted");
-    PrintAndLogEx(NORMAL, "      x    (Optional) Crack, performs the 'reader attack', nr/ar attack against a reader");
-    PrintAndLogEx(NORMAL, "      e    (Optional) Fill simulator keys from found keys");
-    PrintAndLogEx(NORMAL, "      v    (Optional) Verbose");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("           hf mf sim u 0a0a0a0a"));
-    PrintAndLogEx(NORMAL, _YELLOW_("           hf mf sim u 11223344556677"));
-    PrintAndLogEx(NORMAL, _YELLOW_("           hf mf sim u 112233445566778899AA"));
-    PrintAndLogEx(NORMAL, _YELLOW_("           hf mf sim u 11223344 i x"));
-    return PM3_SUCCESS;
-}
 /*
  * static int usage_hf14_sniff(void) {
     PrintAndLogEx(NORMAL, "It continuously gets data from the field and saves it to: log, emulator, emulator file.");
@@ -946,7 +922,6 @@ static int FastDumpWithEcFill(uint8_t numsectors) {
 }
 
 static int CmdHF14AMfDump(const char *Cmd) {
-
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf mf dump",
                   "Dump MIFARE Classic tag to binary file\n"
@@ -3376,125 +3351,132 @@ void readerAttack(sector_t *k_sector, uint8_t k_sectorsCount, nonces_t data, boo
 }
 
 static int CmdHF14AMfSim(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mf sim",
+                  "Simulate MIFARE card",
+                  "hf mf sim -t 0                        -> MIFARE Mini\n"
+                  "hf mf sim -t 1                        -> MIFARE Classic 1k (default)\n"
+                  "hf mf sim -t 1 -u 0a0a0a0a            -> MIFARE Classic 1k with 4b UID\n"
+                  "hf mf sim -t 1 -u 11223344556677      -> MIFARE Classic 1k with 7b UID\n"
+                  "hf mf sim -t 1 -u 11223344 -i --crack -> Perform reader attack in interactive mode\n"
+                  "hf mf sim -t 2                        -> MIFARE 2k\n"
+                  "hf mf sim -t 4                        -> MIFARE 4k");
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("u", "uid", "<hex>", "UID 4,7 or 10bytes. If not specified, the UID 4b/7b from emulator memory will be used"),
+        arg_int0("t", "type", "<0-4> ", "MIFARE Classic type for ATQA/SAK"),
+        arg_str0(NULL, "atqa", "<hex>", "Provide explicit ATQA (2 bytes, overrides option t)"),
+        arg_str0(NULL, "sak", "<hex>", "Provide explicit SAK (1 bytes, overrides option t)"),
+        arg_int0("n", "num", "<dec> ", "Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite"),
+        arg_lit0("i", "interactive", "Console will not be returned until simulation finishes or is aborted"),
+        arg_lit0(NULL, "crack", "Performs the 'reader attack', nr/ar attack against a reader"),
+        arg_lit0("e", "emukeys", "Fill simulator keys from found keys"),
+        arg_lit0("v", "verbose", "verbose output"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
 
-    uint8_t uid[10] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
-    uint8_t atqa[2] = {0, 0};
-    int atqalen = 0;
-    uint8_t sak[1] = {0};
-    int saklen = 0;
-    uint8_t exitAfterNReads = 0;
     uint16_t flags = 0;
-    int uidlen = 0;
-    uint8_t cmdp = 0;
-    bool errors = false, verbose = false, setEmulatorMem = false;
-    nonces_t data[1];
-    char csize[13] = { 0 };
-    char uidsize[8] = { 0 };
-    sector_t *k_sector = NULL;
-    uint8_t k_sectorsCount = 40;
 
-    while (param_getchar(Cmd, cmdp) != 0x00 && !errors) {
-        switch (tolower(param_getchar(Cmd, cmdp))) {
-            case 'e':
-                setEmulatorMem = true;
-                cmdp++;
+    int uidlen = 0;
+    uint8_t uid[10] = {0};
+    CLIGetHexWithReturn(ctx, 1, uid, &uidlen);
+
+    char uidsize[8] = {0};
+    if (uidlen > 0) {
+        switch (uidlen) {
+            case 10:
+                flags |= FLAG_10B_UID_IN_DATA;
+                snprintf(uidsize, sizeof(uidsize), "10 byte");
                 break;
-            case 'h':
-                return usage_hf14_mfsim();
-            case 'i':
-                flags |= FLAG_INTERACTIVE;
-                cmdp++;
+            case 7:
+                flags |= FLAG_7B_UID_IN_DATA;
+                snprintf(uidsize, sizeof(uidsize), "7 byte");
                 break;
-            case 'n':
-                exitAfterNReads = param_get8(Cmd, cmdp + 1);
-                cmdp += 2;
-                break;
-            case 't':
-                switch (param_get8(Cmd, cmdp + 1)) {
-                    case 0:
-                        flags |= FLAG_MF_MINI;
-                        snprintf(csize, sizeof(csize), "MINI");
-                        k_sectorsCount = MIFARE_MINI_MAXSECTOR;
-                        break;
-                    case 1:
-                        flags |= FLAG_MF_1K;
-                        snprintf(csize, sizeof(csize), "1K");
-                        k_sectorsCount = MIFARE_1K_MAXSECTOR;
-                        break;
-                    case 2:
-                        flags |= FLAG_MF_2K;
-                        snprintf(csize, sizeof(csize), "2K with RATS");
-                        k_sectorsCount = MIFARE_2K_MAXSECTOR;
-                        break;
-                    case 4:
-                        flags |= FLAG_MF_4K;
-                        snprintf(csize, sizeof(csize), "4K");
-                        k_sectorsCount = MIFARE_4K_MAXSECTOR;
-                        break;
-                    default:
-                        PrintAndLogEx(WARNING, "Unknown parameter for option t");
-                        errors = true;
-                        break;
-                }
-                cmdp += 2;
-                break;
-            case 'a':
-                param_gethex_ex(Cmd, cmdp + 1, atqa, &atqalen);
-                if (atqalen >> 1 != 2) {
-                    PrintAndLogEx(WARNING, "Wrong ATQA length");
-                    errors = true;
-                    break;
-                }
-                flags |= FLAG_FORCED_ATQA;
-                cmdp += 2;
-                break;
-            case 's':
-                param_gethex_ex(Cmd, cmdp + 1, sak, &saklen);
-                if (saklen >> 1 != 1) {
-                    PrintAndLogEx(WARNING, "Wrong SAK length");
-                    errors = true;
-                    break;
-                }
-                flags |= FLAG_FORCED_SAK;
-                cmdp += 2;
-                break;
-            case 'u':
-                param_gethex_ex(Cmd, cmdp + 1, uid, &uidlen);
-                uidlen >>= 1;
-                switch (uidlen) {
-                    case 10:
-                        flags |= FLAG_10B_UID_IN_DATA;
-                        snprintf(uidsize, sizeof(uidsize), "10 byte");
-                        break;
-                    case 7:
-                        flags |= FLAG_7B_UID_IN_DATA;
-                        snprintf(uidsize, sizeof(uidsize), "7 byte");
-                        break;
-                    case 4:
-                        flags |= FLAG_4B_UID_IN_DATA;
-                        snprintf(uidsize, sizeof(uidsize), "4 byte");
-                        break;
-                    default:
-                        return usage_hf14_mfsim();
-                }
-                cmdp += 2;
-                break;
-            case 'v':
-                verbose = true;
-                cmdp++;
-                break;
-            case 'x':
-                flags |= FLAG_NR_AR_ATTACK;
-                cmdp++;
+            case 4:
+                flags |= FLAG_4B_UID_IN_DATA;
+                snprintf(uidsize, sizeof(uidsize), "4 byte");
                 break;
             default:
-                PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp));
-                errors = true;
-                break;
+                PrintAndLogEx(WARNING, "Invalid parameter for UID");
+                return PM3_EINVARG;
         }
     }
+
+    uint8_t k_sectorsCount = 40;
+    char csize[13] = { 0 };
+    
+    switch (arg_get_u32_def(ctx, 2, 1)) {
+        case 0:
+            flags |= FLAG_MF_MINI;
+            snprintf(csize, sizeof(csize), "MINI");
+            k_sectorsCount = MIFARE_MINI_MAXSECTOR;
+            break;
+        case 1:
+            flags |= FLAG_MF_1K;
+            snprintf(csize, sizeof(csize), "1K");
+            k_sectorsCount = MIFARE_1K_MAXSECTOR;
+            break;
+        case 2:
+            flags |= FLAG_MF_2K;
+            snprintf(csize, sizeof(csize), "2K with RATS");
+            k_sectorsCount = MIFARE_2K_MAXSECTOR;
+            break;
+        case 4:
+            flags |= FLAG_MF_4K;
+            snprintf(csize, sizeof(csize), "4K");
+            k_sectorsCount = MIFARE_4K_MAXSECTOR;
+            break;
+        default:
+            PrintAndLogEx(WARNING, "Unknown parameter for option t");
+            return PM3_EINVARG;
+    }
+
+    int atqalen = 0;
+    uint8_t atqa[2] = {0};
+    CLIGetHexWithReturn(ctx, 3, atqa, &atqalen);
+
+    int saklen = 0;
+    uint8_t sak[1] = {0};
+    CLIGetHexWithReturn(ctx, 4, sak, &saklen);
+
+    uint8_t exitAfterNReads = arg_get_u32_def(ctx, 5, 0);
+
+    if (arg_get_lit(ctx, 6)) {
+        flags |= FLAG_INTERACTIVE;
+    }
+
+    if (arg_get_lit(ctx, 7)) {
+        flags |= FLAG_NR_AR_ATTACK;
+    }
+
+    bool setEmulatorMem = arg_get_lit(ctx, 8);
+    bool verbose = arg_get_lit(ctx, 9);
+
+    CLIParserFree(ctx);
+    
+    nonces_t data[1];
+ 
+    sector_t *k_sector = NULL;
+
     //Validations
-    if (errors) return usage_hf14_mfsim();
+    if (atqalen > 0) {
+        if (atqalen != 2) {
+            PrintAndLogEx(WARNING, "Wrong ATQA length");
+            return PM3_EINVARG;
+
+        }
+        flags |= FLAG_FORCED_ATQA;
+    }
+    if (saklen > 0) {
+        if (saklen != 1) {
+            PrintAndLogEx(WARNING, "Wrong SAK length");
+            return PM3_EINVARG;
+
+        }
+        flags |= FLAG_FORCED_SAK;
+    }
 
     // Use UID, SAK, ATQA from EMUL, if uid not defined
     if ((flags & (FLAG_4B_UID_IN_DATA | FLAG_7B_UID_IN_DATA | FLAG_10B_UID_IN_DATA)) == 0) {
@@ -3834,7 +3816,7 @@ int CmdHF14AMfELoad(const char *Cmd) {
             return PM3_SUCCESS;
         }
     } else {
-        PrintAndLogEx(HINT, "You are ready to simulate. See " _YELLOW_("`hf mf sim h`"));
+        PrintAndLogEx(HINT, "You are ready to simulate. See " _YELLOW_("`hf mf sim -h`"));
         // MFC
         if ((blockNum != numBlocks)) {
             PrintAndLogEx(WARNING, "Error, file content, Only loaded %d blocks, must be %d blocks into emulator memory", blockNum, numBlocks);
diff --git a/doc/cheatsheet.md b/doc/cheatsheet.md
index ebe858985..2c436cbb6 100644
--- a/doc/cheatsheet.md
+++ b/doc/cheatsheet.md
@@ -310,7 +310,7 @@ Simulate MIFARE
 ```
 u     : (Optional) UID 4,7 or 10 bytes. If not specified, the UID 4B from emulator memory will be used
 
-pm3 --> hf mf sim u 353c2aa6
+pm3 --> hf mf sim -u 353c2aa6
 ```
 
 Simulate MIFARE Sequence
@@ -319,7 +319,7 @@ pm3 --> hf mf chk *1 ? d mfc_default_keys
 pm3 --> hf mf dump 1
 pm3 --> script run data_mf_bin2eml -i dumpdata.bin
 pm3 --> hf mf eload 353C2AA6
-pm3 --> hf mf sim u 353c2aa6
+pm3 --> hf mf sim -u 353c2aa6
 ```
 
 Clone MIFARE 1K Sequence
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 727802ef2..4bf56ab82 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -70,7 +70,6 @@ hf mf rdsc
 hf mf restore
 hf mf setmod
 hf mf wrbl
-hf mf sim
 hf mf ecfill
 hf mf eclr
 hf mf egetblk

From 200e2e540ff9897b8125130e057c19325cd1aee3 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 7 Feb 2021 17:32:25 -0500
Subject: [PATCH 573/682] hf mf nested - now use cliparser

---
 client/luascripts/hf_mf_autopwn.lua   |   2 +-
 client/luascripts/hf_mf_tnp3_dump.lua |   2 +-
 client/src/cmdhfmf.c                  | 129 ++++++++++++++------------
 doc/cliparser_todo.txt                |   1 -
 4 files changed, 71 insertions(+), 63 deletions(-)

diff --git a/client/luascripts/hf_mf_autopwn.lua b/client/luascripts/hf_mf_autopwn.lua
index 78a701488..029d16d7a 100644
--- a/client/luascripts/hf_mf_autopwn.lua
+++ b/client/luascripts/hf_mf_autopwn.lua
@@ -99,7 +99,7 @@ local function nested(key,sak)
     else
         print("I don't know how many sectors there are on this type of card, defaulting to 16")
     end
-    local cmd = string.format('hf mf nested %d 0 A %s d', typ, key)
+    local cmd = string.format('hf mf nested -t %d -b 0 --keya -k %s --dumpkeys', typ, key)
     core.console(cmd)
 end
 
diff --git a/client/luascripts/hf_mf_tnp3_dump.lua b/client/luascripts/hf_mf_tnp3_dump.lua
index ee59046eb..54a19da82 100644
--- a/client/luascripts/hf_mf_tnp3_dump.lua
+++ b/client/luascripts/hf_mf_tnp3_dump.lua
@@ -147,7 +147,7 @@ local function main(args)
 
     --Trying to find the other keys
     if useNested then
-      core.console( ('hf mf nested 1 0 A %s d'):format(keyA) )
+      core.console( ('hf mf nested -t 1 -b 0 --keya -k %s --dumpkeys'):format(keyA) )
     end
 
     core.clearCommandBuffer()
diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index 0b40120a1..0007c44e5 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -57,23 +57,6 @@ static int CmdHelp(const char *Cmd);
     return PM3_SUCCESS;
 }
 */
-static int usage_hf14_nested(void) {
-    PrintAndLogEx(NORMAL, "Usage:");
-    PrintAndLogEx(NORMAL, " all sectors:  hf mf nested  <card memory> <block> <key A/B> <key (12 hex symbols)> [t,d]");
-    PrintAndLogEx(NORMAL, " one sector:   hf mf nested  o <block> <key A/B> <key (12 hex symbols)> <target block> <target key A/B> [t]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h    this help");
-    PrintAndLogEx(NORMAL, "      card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");
-    PrintAndLogEx(NORMAL, "      t    transfer keys into emulator memory");
-    PrintAndLogEx(NORMAL, "      d    write keys to binary file `hf-mf-<UID>-key.bin`");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf nested 1 0 A FFFFFFFFFFFF")"        -- key recovery against 1K, block 0, Key A using key FFFFFFFFFFFF");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf nested 1 0 A FFFFFFFFFFFF t")"      -- and transfer keys into emulator memory");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf nested 1 0 A FFFFFFFFFFFF d")"      -- or write keys to binary file ");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf nested o 0 A FFFFFFFFFFFF 4 A")"    -- one sector key recovery. Use block 0 Key A to find block 4 Key A");
-    return PM3_SUCCESS;
-}
 static int usage_hf14_staticnested(void) {
     PrintAndLogEx(NORMAL, "Usage:");
     PrintAndLogEx(NORMAL, " all sectors:  hf mf staticnested  <card memory> <block> <key A/B> <key (12 hex symbols)> [t,d]");
@@ -680,6 +663,8 @@ static int CmdHF14AMfDarkside(const char *Cmd) {
         key_type = MIFARE_AUTH_KEYB;
     }
 
+    CLIParserFree(ctx);
+
     uint64_t key = 0;
 
     int isOK = mfDarkside(blockno, key_type, &key);
@@ -1294,62 +1279,86 @@ static int CmdHF14AMfRestore(const char *Cmd) {
 }
 
 static int CmdHF14AMfNested(const char *Cmd) {
-    sector_t *e_sector = NULL;
-    uint8_t keyType = 0;
-    uint8_t trgBlockNo = 0;
-    uint8_t trgKeyType = 0;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mf nested",
+                  "Execute Nested attack against MIFARE Classic card for key recovery",
+                  "hf mf nested -t 0 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE Mini\n"
+                  "hf mf nested -t 1 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE Classic 1k\n"
+                  "hf mf nested -t 2 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE 2k\n"
+                  "hf mf nested -t 4 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE 4k\n"
+                  "hf mf nested --single -b 0 --keya FFFFFFFFFFFF --tblock 4 --tkeya -> Single sector key recovery. Use block 0 Key A to find block 4 Key A");
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("k", "key", "<hex>", "Key specified as 12 hex symbols"),
+        arg_int0("t", "type", "<0-4>", "MIFARE Classic type"),
+        arg_int0("b", "block", "<dec>", "Input block number"),
+        arg_lit0(NULL, "keya", "Input key specified is A key (default)"),
+        arg_lit0(NULL, "keyb", "Input key specified is B key"),
+        arg_int0(NULL, "tblock", "<dec>", "Target block number"),
+        arg_lit0(NULL, "tkeya", "Target A key (default)"),
+        arg_lit0(NULL, "tkeyb", "Target B key"),
+        arg_lit0("e", "emukeys", "Fill simulator keys from found keys"),
+        arg_lit0(NULL, "dumpkeys", "Dump found keys to file"),
+        arg_lit0(NULL, "single", "Single sector (defaults to All)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+
+    int keylen = 0;
+    uint8_t key[6] = {0};
+    CLIGetHexWithReturn(ctx, 1, key, &keylen);
+
     uint8_t SectorsCnt = 0;
-    uint8_t key[6] = {0, 0, 0, 0, 0, 0};
-    uint8_t keyBlock[(ARRAYLEN(g_mifare_default_keys) + 1) * 6];
-    uint64_t key64 = 0;
-    bool transferToEml = false;
-    bool createDumpFile = false;
+    SectorsCnt = NewNumOfSectors(arg_get_u32_def(ctx, 2, 1));
 
-    if (strlen(Cmd) < 3) return usage_hf14_nested();
+    uint8_t blockNo = arg_get_u32_def(ctx, 3, 0);
 
-    char cmdp, ctmp;
-    cmdp = tolower(param_getchar(Cmd, 0));
-    uint8_t blockNo = param_get8(Cmd, 1);
-    ctmp = tolower(param_getchar(Cmd, 2));
+    uint8_t keyType = 0;
 
-    if (ctmp != 'a' && ctmp != 'b') {
-        PrintAndLogEx(WARNING, "key type must be A or B");
+    if (arg_get_lit(ctx, 4) && arg_get_lit(ctx, 5)) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(WARNING, "Input key type must be A or B");
         return PM3_EINVARG;
-    }
-
-    if (ctmp != 'a')
+    } else if (arg_get_lit(ctx, 5)) {
         keyType = 1;
-
-    if (param_gethex(Cmd, 3, key, 12)) {
-        PrintAndLogEx(WARNING, "key must include 12 HEX symbols");
-        return PM3_EINVARG;
     }
 
-    if (cmdp == 'o') {
-        trgBlockNo = param_get8(Cmd, 4);
-        ctmp = tolower(param_getchar(Cmd, 5));
-        if (ctmp != 'a' && ctmp != 'b') {
-            PrintAndLogEx(WARNING, "target key type must be A or B");
+    uint8_t trgBlockNo = arg_get_u32_def(ctx, 6, 0);
+
+    uint8_t trgKeyType = 0;
+
+    if (arg_get_lit(ctx, 7) && arg_get_lit(ctx, 8)) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(WARNING, "Target key type must be A or B");
+        return PM3_EINVARG;
+    } else if (arg_get_lit(ctx, 7)) {
+        trgKeyType = 1;
+    }
+
+    bool transferToEml = arg_get_lit(ctx, 9);
+    bool createDumpFile = arg_get_lit(ctx, 10);
+    bool singleSector = arg_get_lit(ctx, 11);
+
+    CLIParserFree(ctx);
+
+    //validations
+    if (singleSector == false) {
+        if (SectorsCnt == 0) {
+            PrintAndLogEx(WARNING, "Invalid MIFARE Type");    
             return PM3_EINVARG;
         }
-        if (ctmp != 'a') {
-            trgKeyType = 1;
-        }
-    } else {
-        SectorsCnt = NumOfSectors(cmdp);
-        if (SectorsCnt == 0) return usage_hf14_nested();
     }
 
-    uint8_t j = 4;
-    while (ctmp != 0x00) {
-
-        ctmp = tolower(param_getchar(Cmd, j));
-        transferToEml |= (ctmp == 't');
-        createDumpFile |= (ctmp == 'd');
-
-        j++;
+    if (keylen != 6) {
+        PrintAndLogEx(WARNING, "Input key must include 12 HEX symbols");
+        return PM3_EINVARG;
     }
 
+    sector_t *e_sector = NULL;
+    uint8_t keyBlock[(ARRAYLEN(g_mifare_default_keys) + 1) * 6];
+    uint64_t key64 = 0;
+
     // check if tag doesn't have static nonce
     if (detect_classic_static_nonce() == NONCE_STATIC) {
         PrintAndLogEx(WARNING, "Static nonce detected. Quitting...");
@@ -1363,7 +1372,7 @@ static int CmdHF14AMfNested(const char *Cmd) {
         return PM3_EOPABORTED;
     }
 
-    if (cmdp == 'o') {
+    if (singleSector) {
         int16_t isOK = mfnested(blockNo, keyType, key, trgBlockNo, trgKeyType, keyBlock, true);
         switch (isOK) {
             case PM3_ETIMEOUT:
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 4bf56ab82..f3b0d7061 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -57,7 +57,6 @@ hf felica rqspecver
 hf felica resetmode
 hf felica litesim
 hf felica litedump
-hf mf nested
 hf mf hardnested
 hf mf staticnested
 hf mf autopwn

From b7b0830194eb7c4ce8019fa44e18f25e730dd3b7 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sun, 7 Feb 2021 17:49:45 -0500
Subject: [PATCH 574/682] hf mf staticnested - now use cliparser

---
 client/src/cmdhfmf.c   | 113 +++++++++++++++++++++--------------------
 doc/cliparser_todo.txt |   1 -
 2 files changed, 58 insertions(+), 56 deletions(-)

diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index 0007c44e5..f5ef352b1 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -57,21 +57,6 @@ static int CmdHelp(const char *Cmd);
     return PM3_SUCCESS;
 }
 */
-static int usage_hf14_staticnested(void) {
-    PrintAndLogEx(NORMAL, "Usage:");
-    PrintAndLogEx(NORMAL, " all sectors:  hf mf staticnested  <card memory> <block> <key A/B> <key (12 hex symbols)> [t,d]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h    this help");
-    PrintAndLogEx(NORMAL, "      card memory - 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K, <other> - 1K");
-    PrintAndLogEx(NORMAL, "      t    transfer keys into emulator memory");
-    PrintAndLogEx(NORMAL, "      d    write keys to binary file `hf-mf-<UID>-key.bin`");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf staticnested 1 0 A FFFFFFFFFFFF")"        -- key recovery against 1K, block 0, Key A using key FFFFFFFFFFFF");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf staticnested 1 0 A FFFFFFFFFFFF t")"      -- and transfer keys into emulator memory");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf staticnested 1 0 A FFFFFFFFFFFF d")"      -- or write keys to binary file ");
-    return PM3_SUCCESS;
-}
 static int usage_hf14_hardnested(void) {
     PrintAndLogEx(NORMAL, "Usage:");
     PrintAndLogEx(NORMAL, "      hf mf hardnested <block number> <key A|B> <key (12 hex symbols)>");
@@ -1309,8 +1294,7 @@ static int CmdHF14AMfNested(const char *Cmd) {
     uint8_t key[6] = {0};
     CLIGetHexWithReturn(ctx, 1, key, &keylen);
 
-    uint8_t SectorsCnt = 0;
-    SectorsCnt = NewNumOfSectors(arg_get_u32_def(ctx, 2, 1));
+    uint8_t SectorsCnt = NewNumOfSectors(arg_get_u32_def(ctx, 2, 1));
 
     uint8_t blockNo = arg_get_u32_def(ctx, 3, 0);
 
@@ -1568,48 +1552,67 @@ jumptoend:
 }
 
 static int CmdHF14AMfNestedStatic(const char *Cmd) {
-    sector_t *e_sector = NULL;
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mf staticnested",
+                  "Execute Nested attack against MIFARE Classic card with static nonce for key recovery",
+                  "hf mf staticnested -t 0 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE Mini\n"
+                  "hf mf staticnested -t 1 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE Classic 1k\n"
+                  "hf mf staticnested -t 2 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE 2k\n"
+                  "hf mf staticnested -t 4 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE 4k\n");
+
+    void *argtable[] = {
+        arg_param_begin,
+        arg_str0("k", "key", "<hex>", "Key specified as 12 hex symbols"),
+        arg_int0("t", "type", "<0-4>", "MIFARE Classic type"),
+        arg_int0("b", "block", "<dec>", "Input block number"),
+        arg_lit0(NULL, "keya", "Input key specified is A key (default)"),
+        arg_lit0(NULL, "keyb", "Input key specified is B key"),
+        arg_lit0("e", "emukeys", "Fill simulator keys from found keys"),
+        arg_lit0(NULL, "dumpkeys", "Dump found keys to file"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+
+    int keylen = 0;
+    uint8_t key[6] = {0};
+    CLIGetHexWithReturn(ctx, 1, key, &keylen);
+
+    uint8_t SectorsCnt = NewNumOfSectors(arg_get_u32_def(ctx, 2, 1));
+
+    uint8_t blockNo = arg_get_u32_def(ctx, 3, 0);
+
     uint8_t keyType = 0;
+
+    if (arg_get_lit(ctx, 4) && arg_get_lit(ctx, 5)) {
+        CLIParserFree(ctx);
+        PrintAndLogEx(WARNING, "Input key type must be A or B");
+        return PM3_EINVARG;
+    } else if (arg_get_lit(ctx, 5)) {
+        keyType = 1;
+    }
+
+    bool transferToEml = arg_get_lit(ctx, 6);
+    bool createDumpFile = arg_get_lit(ctx, 7);
+
+    CLIParserFree(ctx);
+
+    //validations
+    if (SectorsCnt == 0) {
+        PrintAndLogEx(WARNING, "Invalid MIFARE Type");    
+        return PM3_EINVARG;
+    }
+
+    if (keylen != 6) {
+        PrintAndLogEx(WARNING, "Input key must include 12 HEX symbols");
+        return PM3_EINVARG;
+    }
+
+    sector_t *e_sector = NULL;
+    
     uint8_t trgKeyType = 0;
-    uint8_t SectorsCnt = 0;
-    uint8_t key[6] = {0, 0, 0, 0, 0, 0};
+    
     uint8_t keyBlock[(ARRAYLEN(g_mifare_default_keys) + 1) * 6];
     uint64_t key64 = 0;
-    bool transferToEml = false;
-    bool createDumpFile = false;
-
-    if (strlen(Cmd) < 3) return usage_hf14_staticnested();
-
-    char cmdp, ctmp;
-    cmdp = tolower(param_getchar(Cmd, 0));
-    uint8_t blockNo = param_get8(Cmd, 1);
-    ctmp = tolower(param_getchar(Cmd, 2));
-
-    if (ctmp != 'a' && ctmp != 'b') {
-        PrintAndLogEx(WARNING, "key type must be A or B");
-        return PM3_EINVARG;
-    }
-
-    if (ctmp != 'a')
-        keyType = 1;
-
-    if (param_gethex(Cmd, 3, key, 12)) {
-        PrintAndLogEx(WARNING, "key must include 12 HEX symbols");
-        return PM3_EINVARG;
-    }
-
-    SectorsCnt = NumOfSectors(cmdp);
-    if (SectorsCnt == 0) return usage_hf14_staticnested();
-
-    uint8_t j = 4;
-    while (ctmp != 0x00) {
-
-        ctmp = tolower(param_getchar(Cmd, j));
-        transferToEml |= (ctmp == 't');
-        createDumpFile |= (ctmp == 'd');
-
-        j++;
-    }
 
     // check if tag have static nonce
     if (detect_classic_static_nonce() != NONCE_STATIC) {
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index f3b0d7061..368afa836 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -58,7 +58,6 @@ hf felica resetmode
 hf felica litesim
 hf felica litedump
 hf mf hardnested
-hf mf staticnested
 hf mf autopwn
 hf mf nack
 hf mf chk

From 9cca51f61ea18655e58cbb7a4edb390ad188a81e Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sat, 13 Feb 2021 14:37:47 -0500
Subject: [PATCH 575/682] hf mf chk - now use cliparser

---
 client/src/cmdhfmf.c   | 281 ++++++++++++++++++++++-------------------
 client/src/proxmark3.c |   2 +-
 doc/cheatsheet.md      |  24 +++-
 doc/cliparser_todo.txt |   1 -
 4 files changed, 168 insertions(+), 140 deletions(-)

diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index f5ef352b1..2c22e1451 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -136,25 +136,6 @@ static int usage_hf14_autopwn(void) {
     PrintAndLogEx(NORMAL, _YELLOW_("      hf mf autopwn k 0 A FFFFFFFFFFFF * 1 f mfc_default_keys")"   -- this command combines the two above (reduce the need for nested / hardnested attacks, by using a dictionary)");
     return PM3_SUCCESS;
 }
-static int usage_hf14_chk(void) {
-    PrintAndLogEx(NORMAL, "Usage:  hf mf chk [h] <block number>|<*card memory> <key type (A/B/?)> [t|d] [<key (12 hex symbols)>] [<dic (*.dic)>]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h    this help");
-    PrintAndLogEx(NORMAL, "      *    all sectors based on card memory, other values then below defaults to 1k");
-    PrintAndLogEx(NORMAL, "                0 - MINI(320 bytes)");
-    PrintAndLogEx(NORMAL, "                1 - 1K");
-    PrintAndLogEx(NORMAL, "                2 - 2K");
-    PrintAndLogEx(NORMAL, "                4 - 4K");
-    PrintAndLogEx(NORMAL, "      d    write keys to binary file");
-    PrintAndLogEx(NORMAL, "      t    write keys to emulator memory\n");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf chk 0 A 1234567890ab")"          -- target block 0, Key A using key 1234567890ab");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf chk 0 A mfc_default_keys.dic")"  -- target block 0, Key A using default dictionary file");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf chk *1 ? t")"                    -- target all blocks, all keys, 1K, write to emulator memory");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf chk *1 ? d")"                    -- target all blocks, all keys, 1K, write to file");
-    return PM3_SUCCESS;
-}
 static int usage_hf14_chk_fast(void) {
     PrintAndLogEx(NORMAL, "This is a improved checkkeys method speedwise. It checks MIFARE Classic tags sector keys against a dictionary file with keys");
     PrintAndLogEx(NORMAL, "Usage:  hf mf fchk [h] <card memory> [t|d|f] [<key (12 hex symbols)>] [<dic (*.dic)>]");
@@ -3000,55 +2981,95 @@ out:
 }
 
 static int CmdHF14AMfChk(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mf chk",
+                  "Check keys on MIFARE Classic card",
+                  "hf mf chk -* --mini --all -k FFFFFFFFFFFF              --> Key recovery against MIFARE Mini\n"
+                  "hf mf chk -* --1k --all -k FFFFFFFFFFFF                --> Key recovery against MIFARE Classic 1k\n"
+                  "hf mf chk -* --2k --all -k FFFFFFFFFFFF                --> Key recovery against MIFARE 2k\n"
+                  "hf mf chk -* --4k --all -k FFFFFFFFFFFF                --> Key recovery against MIFARE 4k\n"
+                  "hf mf chk -* --1k --all --emu                          --> Check all sectors, all keys, 1K, and write to emulator memory\n"
+                  "hf mf chk -* --1k --all --dump                         --> Check all sectors, all keys, 1K, and write to file\n"
+                  "hf mf chk -a --blk 0 -f mfc_default_keys.dic           --> Check dictionary against block 0 key A");
 
-    char ctmp = tolower(param_getchar(Cmd, 0));
-    if (strlen(Cmd) < 3 || ctmp == 'h') return usage_hf14_chk();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_strx0("k", "key", "<hex>", "Key specified as 12 hex symbols"),
+        arg_int0(NULL, "blk", "<dec>", "Input block number"),
+        arg_lit0("*", NULL, "Target all blocks"),
+        arg_lit0("a", NULL, "Input key specified is A key (default)"),
+        arg_lit0("b", NULL, "Input key specified is B key"),
+        arg_lit0(NULL, "all", "Target all keys"),
+        arg_lit0(NULL, "mini", "MIFARE Classic Mini / S20"),
+        arg_lit0(NULL, "1k", "MIFARE Classic 1k / S50"),
+        arg_lit0(NULL, "2k", "MIFARE Classic/Plus 2k"),
+        arg_lit0(NULL, "4k", "MIFARE Classic 4k / S70"),
+        arg_lit0(NULL, "emu", "Fill simulator keys from found keys"),
+        arg_lit0(NULL, "dump", "Dump found keys to file"),
+        arg_str0("f", "file", "<filename>", "filename of dictionary"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
 
-    FILE *f;
-    char filename[FILE_PATH_SIZE] = {0};
-    char buf[13];
-    uint8_t *keyBlock, *p;
-    sector_t *e_sector = NULL;
+    int keylen = 0;
+    uint8_t key[255 * 6] = {0};
+    CLIGetHexWithReturn(ctx, 1, key, &keylen);
+
+    uint8_t blockNo = arg_get_u32_def(ctx, 2, 0);
+
+    bool allBlocks = arg_get_lit(ctx, 3);
 
-    uint8_t blockNo = 0;
-    uint8_t SectorsCnt = 1;
     uint8_t keyType = 0;
-    uint32_t keyitems = ARRAYLEN(g_mifare_default_keys);
-    uint64_t key64 = 0;
-    int clen = 0;
-    int transferToEml = 0;
-    int createDumpFile = 0;
-    int i, keycnt = 0;
 
-    if (param_getchar(Cmd, 0) == '*') {
-        blockNo = 3;
-        SectorsCnt = NumOfSectors(param_getchar(Cmd + 1, 0));
+    if ((arg_get_lit(ctx, 4) && arg_get_lit(ctx, 5)) || arg_get_lit(ctx, 6)) {
+        keyType = 2;
+    } else if (arg_get_lit(ctx, 5)) {
+        keyType = 1;
+    } 
+    bool m0 = arg_get_lit(ctx, 7);
+    bool m1 = arg_get_lit(ctx, 8);
+    bool m2 = arg_get_lit(ctx, 9);
+    bool m4 = arg_get_lit(ctx, 10);
+
+    bool transferToEml = arg_get_lit(ctx, 11);
+    bool createDumpFile = arg_get_lit(ctx, 12);
+
+    int fnlen = 0;
+    char filename[FILE_PATH_SIZE] = {0};
+    CLIParamStrToBuf(arg_get_str(ctx, 13), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
+
+    CLIParserFree(ctx);
+
+    //validations
+
+    if ((m0 + m1 + m2 + m4) > 1) {
+        PrintAndLogEx(WARNING, "Only specify one MIFARE Type");    
+        return PM3_EINVARG;
+    }
+
+    uint8_t SectorsCnt = 1;
+    if (m0) {
+        SectorsCnt = MIFARE_MINI_MAXSECTOR;
+    } else if (m1) {
+        SectorsCnt = MIFARE_1K_MAXSECTOR;
+    } else if (m2) {
+        SectorsCnt = MIFARE_2K_MAXSECTOR;
+    } else if (m4) {
+        SectorsCnt = MIFARE_4K_MAXSECTOR;
+    }
+
+    if (allBlocks) {
         if (SectorsCnt == 0) {
-            return usage_hf14_chk();
+            PrintAndLogEx(WARNING, "Invalid MIFARE Type");    
+            return PM3_EINVARG;
         }
-    } else {
-        blockNo = param_get8(Cmd, 0);
-    }
-
-    ctmp = tolower(param_getchar(Cmd, 1));
-    clen = param_getlength(Cmd, 1);
-    if (clen == 1) {
-        switch (ctmp) {
-            case 'a':
-                keyType = 0;
-                break;
-            case 'b':
-                keyType = 1;
-                break;
-            case '?':
-                keyType = 2;
-                break;
-            default:
-                PrintAndLogEx(FAILED, "Key type must be A , B or ?");
-                return PM3_ESOFT;
-        };
+        blockNo = 3;
     }
 
+    // Handle Keys
+    int keycnt = 0;
+    uint32_t keyitems = ARRAYLEN(g_mifare_default_keys);
+    uint8_t *keyBlock, *p;
     // Allocate memory for keys to be tested
     keyBlock = calloc(ARRAYLEN(g_mifare_default_keys), 6);
     if (keyBlock == NULL) return PM3_EMALLOC;
@@ -3057,93 +3078,90 @@ static int CmdHF14AMfChk(const char *Cmd) {
     for (int cnt = 0; cnt < ARRAYLEN(g_mifare_default_keys); cnt++)
         num_to_bytes(g_mifare_default_keys[cnt], 6, (uint8_t *)(keyBlock + cnt * 6));
 
-    for (i = 2; param_getchar(Cmd, i); i++) {
+    // Handle user supplied key
+    if (keylen > 6) {
+        // if (keylen != 6) {
+        //     PrintAndLogEx(WARNING, "Input key must include 12 HEX symbols");
+        //     return PM3_EINVARG;
+        // }
+        int numKeys = keylen / 6;
 
-        ctmp = tolower(param_getchar(Cmd, i));
-        clen = param_getlength(Cmd, i);
+        
+        
+        p = realloc(keyBlock, 6 * (keyitems + numKeys));
+        if (!p) {
+            PrintAndLogEx(FAILED, "cannot allocate memory for Keys");
+            free(keyBlock);
+            return PM3_EMALLOC;
+        }
+        keyBlock = p;
+        
+        memcpy(keyBlock + 6 * keycnt, key, 6 * numKeys);
+        
+        for (int i = 0; i < numKeys; i++) {
+            PrintAndLogEx(NORMAL, "[%2d] key %s", keycnt, sprint_hex((keyBlock + 6 * keycnt), 6));
+            keycnt++;
+        }        
 
-        if (clen == 12) {
+    }
 
-            if (param_gethex(Cmd, i, keyBlock + 6 * keycnt, 12)) {
-                PrintAndLogEx(FAILED, "not hex, skipping");
+    // Handle user supplied dictionary file
+    FILE *f;
+    char buf[13];
+    if (fnlen > 0) {
+        char *dict_path;
+        int res = searchFile(&dict_path, DICTIONARIES_SUBDIR, filename, ".dic", false);
+        if (res != PM3_SUCCESS) {
+            free(keyBlock);
+            return PM3_EFILE;
+        }
+        f = fopen(dict_path, "r");
+        if (!f) {
+            PrintAndLogEx(FAILED, "File: " _YELLOW_("%s") ": not found or locked.", dict_path);
+            free(dict_path);
+            free(keyBlock);
+            return PM3_EFILE;
+        }
+        free(dict_path);
+        // load keys from dictionary file
+        while (fgets(buf, sizeof(buf), f)) {
+            if (strlen(buf) < 12 || buf[11] == '\n')
+                continue;
+
+            while (fgetc(f) != '\n' && !feof(f)) ;  //goto next line
+
+            if (buf[0] == '#') continue; //The line start with # is comment, skip
+
+            // codesmell, only checks first char?
+            if (!isxdigit(buf[0])) {
+                PrintAndLogEx(FAILED, "File content error. '" _YELLOW_("%s")"' must include 12 HEX symbols", buf);
                 continue;
             }
 
+            buf[12] = 0;
+
             if (keyitems - keycnt < 2) {
                 p = realloc(keyBlock, 6 * (keyitems += 64));
                 if (!p) {
-                    PrintAndLogEx(FAILED, "cannot allocate memory for Keys");
+                    PrintAndLogEx(FAILED, "Cannot allocate memory for defKeys");
                     free(keyBlock);
+                    fclose(f);
                     return PM3_EMALLOC;
                 }
                 keyBlock = p;
             }
-            PrintAndLogEx(NORMAL, "[%2d] key %s", keycnt, sprint_hex((keyBlock + 6 * keycnt), 6));
+            memset(keyBlock + 6 * keycnt, 0, 6);
+            num_to_bytes(strtoll(buf, NULL, 16), 6, keyBlock + 6 * keycnt);
+            //PrintAndLogEx(NORMAL, "check key[%2d] %012" PRIx64, keycnt, bytes_to_num(keyBlock + 6*keycnt, 6));
             keycnt++;
-        } else if (clen == 1) {
-            if (ctmp == 't') { transferToEml = 1; continue; }
-            if (ctmp == 'd') { createDumpFile = 1; continue; }
-        } else {
-            // May be a dic file
-            if (param_getstr(Cmd, i, filename, sizeof(filename)) >= FILE_PATH_SIZE) {
-                PrintAndLogEx(FAILED, "File name too long");
-                free(keyBlock);
-                return PM3_EINVARG;
-            }
-
-            char *dict_path;
-            int res = searchFile(&dict_path, DICTIONARIES_SUBDIR, filename, ".dic", false);
-            if (res != PM3_SUCCESS) {
-                free(keyBlock);
-                return PM3_EFILE;
-            }
-            f = fopen(dict_path, "r");
-            if (!f) {
-                PrintAndLogEx(FAILED, "File: " _YELLOW_("%s") ": not found or locked.", dict_path);
-                free(dict_path);
-                free(keyBlock);
-                return PM3_EFILE;
-            }
-            free(dict_path);
-
-            // load keys from dictionary file
-            while (fgets(buf, sizeof(buf), f)) {
-                if (strlen(buf) < 12 || buf[11] == '\n')
-                    continue;
-
-                while (fgetc(f) != '\n' && !feof(f)) ;  //goto next line
-
-                if (buf[0] == '#') continue; //The line start with # is comment, skip
-
-                // codesmell, only checks first char?
-                if (!isxdigit(buf[0])) {
-                    PrintAndLogEx(FAILED, "File content error. '" _YELLOW_("%s")"' must include 12 HEX symbols", buf);
-                    continue;
-                }
-
-                buf[12] = 0;
-
-                if (keyitems - keycnt < 2) {
-                    p = realloc(keyBlock, 6 * (keyitems += 64));
-                    if (!p) {
-                        PrintAndLogEx(FAILED, "Cannot allocate memory for defKeys");
-                        free(keyBlock);
-                        fclose(f);
-                        return PM3_EMALLOC;
-                    }
-                    keyBlock = p;
-                }
-                memset(keyBlock + 6 * keycnt, 0, 6);
-                num_to_bytes(strtoll(buf, NULL, 16), 6, keyBlock + 6 * keycnt);
-                //PrintAndLogEx(NORMAL, "check key[%2d] %012" PRIx64, keycnt, bytes_to_num(keyBlock + 6*keycnt, 6));
-                keycnt++;
-                memset(buf, 0, sizeof(buf));
-            }
-            fclose(f);
-            PrintAndLogEx(SUCCESS, "Loaded %2d keys from " _YELLOW_("%s"), keycnt, filename);
+            memset(buf, 0, sizeof(buf));
         }
+        fclose(f);
+        PrintAndLogEx(SUCCESS, "Loaded %2d keys from " _YELLOW_("%s"), keycnt, filename);
     }
 
+    uint64_t key64 = 0;
+
     if (keycnt == 0) {
         PrintAndLogEx(INFO, "No key specified, trying default keys");
         for (; keycnt < ARRAYLEN(g_mifare_default_keys); keycnt++)
@@ -3158,6 +3176,7 @@ static int CmdHF14AMfChk(const char *Cmd) {
     }
 
     // create/initialize key storage structure
+    sector_t *e_sector = NULL;
     int32_t res = initSectorTable(&e_sector, SectorsCnt);
     if (res != SectorsCnt) {
         free(keyBlock);
@@ -3181,7 +3200,7 @@ static int CmdHF14AMfChk(const char *Cmd) {
 
         // loop sectors but block is used as to keep track of from which blocks to test
         int b = blockNo;
-        for (i = 0; i < SectorsCnt; ++i) {
+        for (int i = 0; i < SectorsCnt; ++i) {
 
             // skip already found keys.
             if (e_sector[i].foundKey[trgKeyType]) continue;
@@ -3218,7 +3237,7 @@ static int CmdHF14AMfChk(const char *Cmd) {
 
         // loop sectors but block is used as to keep track of from which blocks to test
         int b = blockNo;
-        for (i = 0; i < SectorsCnt; i++) {
+        for (int i = 0; i < SectorsCnt; i++) {
 
             // KEY A but not KEY B
             if (e_sector[i].foundKey[0] && !e_sector[i].foundKey[1]) {
@@ -3269,7 +3288,7 @@ out:
         // fast push mode
         conn.block_after_ACK = true;
         uint8_t block[16] = {0x00};
-        for (i = 0; i < SectorsCnt; ++i) {
+        for (int i = 0; i < SectorsCnt; ++i) {
             uint8_t blockno = FirstBlockOfSector(i) + NumBlocksPerSector(i) - 1;
             mfEmlGetMem(block, blockno, 1);
 
diff --git a/client/src/proxmark3.c b/client/src/proxmark3.c
index 0019b6f2b..d52517f0a 100644
--- a/client/src/proxmark3.c
+++ b/client/src/proxmark3.c
@@ -586,7 +586,7 @@ static void show_help(bool showFullHelp, char *exec_name) {
         PrintAndLogEx(NORMAL, "      %s "SERIAL_PORT_EXAMPLE_H" -w                    -- wait for serial port", exec_name);
         PrintAndLogEx(NORMAL, "      %s                                    -- runs the pm3 client in OFFLINE mode", exec_name);
         PrintAndLogEx(NORMAL, "\n  to execute different commands from terminal:\n");
-        PrintAndLogEx(NORMAL, "      %s "SERIAL_PORT_EXAMPLE_H" -c \"hf mf chk 1* ?\"   -- execute cmd and quit client", exec_name);
+        PrintAndLogEx(NORMAL, "      %s "SERIAL_PORT_EXAMPLE_H" -c \"hf mf chk --1k -* --all\"   -- execute cmd and quit client", exec_name);
         PrintAndLogEx(NORMAL, "      %s "SERIAL_PORT_EXAMPLE_H" -l hf_read            -- execute lua script " _YELLOW_("`hf_read`")" and quit client", exec_name);
         PrintAndLogEx(NORMAL, "      %s "SERIAL_PORT_EXAMPLE_H" -s mycmds.txt         -- execute each pm3 cmd in file and quit client", exec_name);
         PrintAndLogEx(NORMAL, "\n  to flash fullimage and bootloader:\n");
diff --git a/doc/cheatsheet.md b/doc/cheatsheet.md
index 2c436cbb6..471f20132 100644
--- a/doc/cheatsheet.md
+++ b/doc/cheatsheet.md
@@ -224,12 +224,22 @@ Check for default keys
 ```
 Options
 ---
-<*card memory> <key type (A/B/?)> [t|d|s|ss] <dic (*.dic)>
-*              : all sectors
-card memory    : 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K
-d              : write keys to binary file
+    -h, --help                     This help
+    -k, --key <hex>                Key specified as 12 hex symbols
+    --blk <dec>                    Input block number
+    -*                             Target all blocks
+    -a                             Input key specified is A key (default)
+    -b                             Input key specified is B key
+    --all                          Target all keys
+    --mini                         MIFARE Classic Mini / S20
+    --1k                           MIFARE Classic 1k / S50
+    --2k                           MIFARE Classic/Plus 2k
+    --4k                           MIFARE Classic 4k / S70
+    --emu                          Fill simulator keys from found keys
+    --dump                         Dump found keys to file
+    -f, --file <filename>          filename of dictionary
 
-pm3 --> hf mf chk *1 ? d mfc_default_keys
+pm3 --> hf mf chk -* --1k --all -f mfc_default_keys
 ```
 
 Check for default keys from local memory
@@ -315,7 +325,7 @@ pm3 --> hf mf sim -u 353c2aa6
 
 Simulate MIFARE Sequence
 ```
-pm3 --> hf mf chk *1 ? d mfc_default_keys
+pm3 --> hf mf chk -* --1k --all -f mfc_default_keys
 pm3 --> hf mf dump 1
 pm3 --> script run data_mf_bin2eml -i dumpdata.bin
 pm3 --> hf mf eload 353C2AA6
@@ -324,7 +334,7 @@ pm3 --> hf mf sim -u 353c2aa6
 
 Clone MIFARE 1K Sequence
 ```
-pm3 --> hf mf chk *1 ? d mfc_default_keys
+pm3 --> hf mf chk -* --1k --all -f mfc_default_keys
 pm3 --> hf mf dump
 pm3 --> hf mf restore 1 u 4A6CE843 k hf-mf-A29558E4-key.bin f hf-mf-A29558E4-dump.bin
 ```
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 368afa836..9811a7414 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -60,7 +60,6 @@ hf felica litedump
 hf mf hardnested
 hf mf autopwn
 hf mf nack
-hf mf chk
 hf mf fchk
 hf mf decrypt
 hf mf rdbl

From d793a601da396d2ac9f3cd186319ef562b713c87 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sat, 13 Feb 2021 14:38:51 -0500
Subject: [PATCH 576/682] make style

---
 client/src/cmdhfmf.c | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index 2c22e1451..e7fe46538 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -910,7 +910,7 @@ static int CmdHF14AMfDump(const char *Cmd) {
     uint8_t keyB[40][6];
     uint8_t rights[40][4];
     uint8_t carddata[256][16];
-    
+
     FILE *f;
     PacketResponseNG resp;
 
@@ -1310,7 +1310,7 @@ static int CmdHF14AMfNested(const char *Cmd) {
     //validations
     if (singleSector == false) {
         if (SectorsCnt == 0) {
-            PrintAndLogEx(WARNING, "Invalid MIFARE Type");    
+            PrintAndLogEx(WARNING, "Invalid MIFARE Type");
             return PM3_EINVARG;
         }
     }
@@ -1579,7 +1579,7 @@ static int CmdHF14AMfNestedStatic(const char *Cmd) {
 
     //validations
     if (SectorsCnt == 0) {
-        PrintAndLogEx(WARNING, "Invalid MIFARE Type");    
+        PrintAndLogEx(WARNING, "Invalid MIFARE Type");
         return PM3_EINVARG;
     }
 
@@ -1589,9 +1589,9 @@ static int CmdHF14AMfNestedStatic(const char *Cmd) {
     }
 
     sector_t *e_sector = NULL;
-    
+
     uint8_t trgKeyType = 0;
-    
+
     uint8_t keyBlock[(ARRAYLEN(g_mifare_default_keys) + 1) * 6];
     uint64_t key64 = 0;
 
@@ -3025,7 +3025,7 @@ static int CmdHF14AMfChk(const char *Cmd) {
         keyType = 2;
     } else if (arg_get_lit(ctx, 5)) {
         keyType = 1;
-    } 
+    }
     bool m0 = arg_get_lit(ctx, 7);
     bool m1 = arg_get_lit(ctx, 8);
     bool m2 = arg_get_lit(ctx, 9);
@@ -3043,7 +3043,7 @@ static int CmdHF14AMfChk(const char *Cmd) {
     //validations
 
     if ((m0 + m1 + m2 + m4) > 1) {
-        PrintAndLogEx(WARNING, "Only specify one MIFARE Type");    
+        PrintAndLogEx(WARNING, "Only specify one MIFARE Type");
         return PM3_EINVARG;
     }
 
@@ -3060,7 +3060,7 @@ static int CmdHF14AMfChk(const char *Cmd) {
 
     if (allBlocks) {
         if (SectorsCnt == 0) {
-            PrintAndLogEx(WARNING, "Invalid MIFARE Type");    
+            PrintAndLogEx(WARNING, "Invalid MIFARE Type");
             return PM3_EINVARG;
         }
         blockNo = 3;
@@ -3086,8 +3086,8 @@ static int CmdHF14AMfChk(const char *Cmd) {
         // }
         int numKeys = keylen / 6;
 
-        
-        
+
+
         p = realloc(keyBlock, 6 * (keyitems + numKeys));
         if (!p) {
             PrintAndLogEx(FAILED, "cannot allocate memory for Keys");
@@ -3095,13 +3095,13 @@ static int CmdHF14AMfChk(const char *Cmd) {
             return PM3_EMALLOC;
         }
         keyBlock = p;
-        
+
         memcpy(keyBlock + 6 * keycnt, key, 6 * numKeys);
-        
+
         for (int i = 0; i < numKeys; i++) {
             PrintAndLogEx(NORMAL, "[%2d] key %s", keycnt, sprint_hex((keyBlock + 6 * keycnt), 6));
             keycnt++;
-        }        
+        }
 
     }
 
@@ -3437,7 +3437,7 @@ static int CmdHF14AMfSim(const char *Cmd) {
 
     uint8_t k_sectorsCount = 40;
     char csize[13] = { 0 };
-    
+
     switch (arg_get_u32_def(ctx, 2, 1)) {
         case 0:
             flags |= FLAG_MF_MINI;
@@ -3486,9 +3486,9 @@ static int CmdHF14AMfSim(const char *Cmd) {
     bool verbose = arg_get_lit(ctx, 9);
 
     CLIParserFree(ctx);
-    
+
     nonces_t data[1];
- 
+
     sector_t *k_sector = NULL;
 
     //Validations
@@ -4765,7 +4765,7 @@ static int CmdHF14AMfice(const char *Cmd) {
     PacketResponseNG resp;
 
     uint32_t part_limit = 3000;
-    
+
     PrintAndLogEx(NORMAL, "Collecting "_YELLOW_("%u")" nonces \n", limit);
 
     if ((fnonces = fopen(filename, "wb")) == NULL) {

From dc1e2df64937a67a36578eed382883fd95cd1ad9 Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sat, 13 Feb 2021 14:48:44 -0500
Subject: [PATCH 577/682] make style - again

---
 client/src/cmdhfmf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index ebe8168b5..e7fe46538 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -1581,7 +1581,7 @@ static int CmdHF14AMfNestedStatic(const char *Cmd) {
     if (SectorsCnt == 0) {
         PrintAndLogEx(WARNING, "Invalid MIFARE Type");
         return PM3_EINVARG;
-    } 
+    }
 
     if (keylen != 6) {
         PrintAndLogEx(WARNING, "Input key must include 12 HEX symbols");

From 7830c0f8eab060f5769bf6b2970905a64a5759fa Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sat, 13 Feb 2021 15:41:10 -0500
Subject: [PATCH 578/682] update type to lits

---
 client/src/cmdhfmf.c | 283 ++++++++++++++++++++++++++-----------------
 1 file changed, 170 insertions(+), 113 deletions(-)

diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index e7fe46538..7f01fd096 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -551,21 +551,6 @@ static uint8_t NumOfSectors(char card) {
     }
 }
 
-static uint8_t NewNumOfSectors(uint8_t card) {
-    switch (card) {
-        case 0 :
-            return MIFARE_MINI_MAXSECTOR;
-        case 1 :
-            return MIFARE_1K_MAXSECTOR;
-        case 2 :
-            return MIFARE_2K_MAXSECTOR;
-        case 4 :
-            return MIFARE_4K_MAXSECTOR;
-        default  :
-            return 0;
-    }
-}
-
 static uint8_t FirstBlockOfSector(uint8_t sectorNo) {
     if (sectorNo < 32) {
         return sectorNo * 4;
@@ -609,13 +594,13 @@ static int CmdHF14AMfDarkside(const char *Cmd) {
     CLIParserInit(&ctx, "hf mf darkside",
                   "Darkside attack",
                   "hf mf darkside\n"
-                  "hf mf darkside -b 16\n"
-                  "hf mf darkside -b 16 --keyb\n");
+                  "hf mf darkside --blk 16\n"
+                  "hf mf darkside --blk 16 -b\n");
 
     void *argtable[] = {
         arg_param_begin,
-        arg_int0("b", "block", "<dec> ", "Simulation type to use"),
-        arg_lit0(NULL, "keyb", "Target key B instead of default key A"),
+        arg_int0(NULL, "blk", "<dec> ", "Simulation type to use"),
+        arg_lit0("b", NULL, "Target key B instead of default key A"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
@@ -877,29 +862,35 @@ static int CmdHF14AMfDump(const char *Cmd) {
     CLIParserInit(&ctx, "hf mf dump",
                   "Dump MIFARE Classic tag to binary file\n"
                   "If no <name> given, UID will be used as filename",
-                  "hf mf dump -t 0                     -> MIFARE Mini\n"
-                  "hf mf dump -t 1                     -> MIFARE Classic 1k (default)\n"
-                  "hf mf dump -t 2                     -> MIFARE 2k\n"
-                  "hf mf dump -t 4                     -> MIFARE 4k\n");
+                  "hf mf dump --mini                   --> MIFARE Mini\n"
+                  "hf mf dump --1k                     --> MIFARE Classic 1k\n"
+                  "hf mf dump --2k                     --> MIFARE 2k\n"
+                  "hf mf dump --4k                     --> MIFARE 4k\n");
 
     void *argtable[] = {
         arg_param_begin,
-        arg_int0("t", "type", "<0-4> ", "MIFARE Classic type"),
         arg_str0("f", "file", "<filename>", "filename of dump"),
         arg_str0("k", "keys", "<filename>", "filename of keys"),
+        arg_lit0(NULL, "mini", "MIFARE Classic Mini / S20"),
+        arg_lit0(NULL, "1k", "MIFARE Classic 1k / S50"),
+        arg_lit0(NULL, "2k", "MIFARE Classic/Plus 2k"),
+        arg_lit0(NULL, "4k", "MIFARE Classic 4k / S70"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);
 
-    uint8_t numSectors = NewNumOfSectors(arg_get_u32_def(ctx, 1, 1));
-
     int datafnlen = 0;
     char dataFilename[FILE_PATH_SIZE] = {0};
-    CLIParamStrToBuf(arg_get_str(ctx, 2), (uint8_t *)dataFilename, FILE_PATH_SIZE, &datafnlen);
+    CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)dataFilename, FILE_PATH_SIZE, &datafnlen);
 
     int keyfnlen = 0;
     char keyFilename[FILE_PATH_SIZE] = {0};
-    CLIParamStrToBuf(arg_get_str(ctx, 3), (uint8_t *)keyFilename, FILE_PATH_SIZE, &keyfnlen);
+    CLIParamStrToBuf(arg_get_str(ctx, 2), (uint8_t *)keyFilename, FILE_PATH_SIZE, &keyfnlen);
+
+    bool m0 = arg_get_lit(ctx, 3);
+    bool m1 = arg_get_lit(ctx, 4);
+    bool m2 = arg_get_lit(ctx, 5);
+    bool m4 = arg_get_lit(ctx, 6);
 
     CLIParserFree(ctx);
 
@@ -914,8 +905,24 @@ static int CmdHF14AMfDump(const char *Cmd) {
     FILE *f;
     PacketResponseNG resp;
 
-    if (numSectors == 0) {
-        PrintAndLogEx(ERR, "Invalid MIFARE Classic type");
+    // validations
+    if ((m0 + m1 + m2 + m4) > 1) {
+        PrintAndLogEx(WARNING, "Only specify one MIFARE Type");
+        return PM3_EINVARG;
+    }
+
+    uint8_t numSectors = 1;
+
+    if (m0) {
+        numSectors = MIFARE_MINI_MAXSECTOR;
+    } else if (m1) {
+        numSectors = MIFARE_1K_MAXSECTOR;
+    } else if (m2) {
+        numSectors = MIFARE_2K_MAXSECTOR;
+    } else if (m4) {
+        numSectors = MIFARE_4K_MAXSECTOR;
+    } else {
+        PrintAndLogEx(WARNING, "Please specify a MIFARE Type");
         return PM3_EINVARG;
     }
 
@@ -1248,24 +1255,27 @@ static int CmdHF14AMfNested(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf mf nested",
                   "Execute Nested attack against MIFARE Classic card for key recovery",
-                  "hf mf nested -t 0 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE Mini\n"
-                  "hf mf nested -t 1 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE Classic 1k\n"
-                  "hf mf nested -t 2 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE 2k\n"
-                  "hf mf nested -t 4 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE 4k\n"
-                  "hf mf nested --single -b 0 --keya FFFFFFFFFFFF --tblock 4 --tkeya -> Single sector key recovery. Use block 0 Key A to find block 4 Key A");
+                  "hf mf nested --single --blk 0 -a FFFFFFFFFFFF --tblk 4 --tkeya     --> Single sector key recovery. Use block 0 Key A to find block 4 Key A\n"
+                  "hf mf nested --mini --blk 0 -a -k FFFFFFFFFFFF                     --> Key recovery against MIFARE Mini\n"
+                  "hf mf nested --1k --blk 0 -a -k FFFFFFFFFFFF                       --> Key recovery against MIFARE Classic 1k\n"
+                  "hf mf nested --2k --blk 0 -a -k FFFFFFFFFFFF                       --> Key recovery against MIFARE 2k\n"
+                  "hf mf nested --4k --blk 0 -a -k FFFFFFFFFFFF                       --> Key recovery against MIFARE 4k");
 
     void *argtable[] = {
         arg_param_begin,
         arg_str0("k", "key", "<hex>", "Key specified as 12 hex symbols"),
-        arg_int0("t", "type", "<0-4>", "MIFARE Classic type"),
-        arg_int0("b", "block", "<dec>", "Input block number"),
-        arg_lit0(NULL, "keya", "Input key specified is A key (default)"),
-        arg_lit0(NULL, "keyb", "Input key specified is B key"),
-        arg_int0(NULL, "tblock", "<dec>", "Target block number"),
+        arg_lit0(NULL, "mini", "MIFARE Classic Mini / S20"),
+        arg_lit0(NULL, "1k", "MIFARE Classic 1k / S50"),
+        arg_lit0(NULL, "2k", "MIFARE Classic/Plus 2k"),
+        arg_lit0(NULL, "4k", "MIFARE Classic 4k / S70"),
+        arg_int0(NULL, "blk", "<dec>", "Input block number"),
+        arg_lit0("a", NULL, "Input key specified is A key (default)"),
+        arg_lit0("b", NULL, "Input key specified is B key"),
+        arg_int0(NULL, "tblk", "<dec>", "Target block number"),
         arg_lit0(NULL, "tkeya", "Target A key (default)"),
         arg_lit0(NULL, "tkeyb", "Target B key"),
-        arg_lit0("e", "emukeys", "Fill simulator keys from found keys"),
-        arg_lit0(NULL, "dumpkeys", "Dump found keys to file"),
+        arg_lit0(NULL, "emu", "Fill simulator keys from found keys"),
+        arg_lit0(NULL, "dump", "Dump found keys to file"),
         arg_lit0(NULL, "single", "Single sector (defaults to All)"),
         arg_param_end
     };
@@ -1275,39 +1285,58 @@ static int CmdHF14AMfNested(const char *Cmd) {
     uint8_t key[6] = {0};
     CLIGetHexWithReturn(ctx, 1, key, &keylen);
 
-    uint8_t SectorsCnt = NewNumOfSectors(arg_get_u32_def(ctx, 2, 1));
+    bool m0 = arg_get_lit(ctx, 2);
+    bool m1 = arg_get_lit(ctx, 3);
+    bool m2 = arg_get_lit(ctx, 4);
+    bool m4 = arg_get_lit(ctx, 5);
 
-    uint8_t blockNo = arg_get_u32_def(ctx, 3, 0);
+    uint8_t blockNo = arg_get_u32_def(ctx, 6, 0);
 
     uint8_t keyType = 0;
 
-    if (arg_get_lit(ctx, 4) && arg_get_lit(ctx, 5)) {
+    if (arg_get_lit(ctx, 7) && arg_get_lit(ctx, 8)) {
         CLIParserFree(ctx);
         PrintAndLogEx(WARNING, "Input key type must be A or B");
         return PM3_EINVARG;
-    } else if (arg_get_lit(ctx, 5)) {
+    } else if (arg_get_lit(ctx, 8)) {
         keyType = 1;
     }
 
-    uint8_t trgBlockNo = arg_get_u32_def(ctx, 6, 0);
+    uint8_t trgBlockNo = arg_get_u32_def(ctx, 9, 0);
 
     uint8_t trgKeyType = 0;
 
-    if (arg_get_lit(ctx, 7) && arg_get_lit(ctx, 8)) {
+    if (arg_get_lit(ctx, 10) && arg_get_lit(ctx, 11)) {
         CLIParserFree(ctx);
         PrintAndLogEx(WARNING, "Target key type must be A or B");
         return PM3_EINVARG;
-    } else if (arg_get_lit(ctx, 7)) {
+    } else if (arg_get_lit(ctx, 11)) {
         trgKeyType = 1;
     }
 
-    bool transferToEml = arg_get_lit(ctx, 9);
-    bool createDumpFile = arg_get_lit(ctx, 10);
-    bool singleSector = arg_get_lit(ctx, 11);
+    bool transferToEml = arg_get_lit(ctx, 12);
+    bool createDumpFile = arg_get_lit(ctx, 13);
+    bool singleSector = arg_get_lit(ctx, 14);
 
     CLIParserFree(ctx);
 
     //validations
+    if ((m0 + m1 + m2 + m4) > 1) {
+        PrintAndLogEx(WARNING, "Only specify one MIFARE Type");
+        return PM3_EINVARG;
+    }
+
+    uint8_t SectorsCnt = 1;
+    if (m0) {
+        SectorsCnt = MIFARE_MINI_MAXSECTOR;
+    } else if (m1) {
+        SectorsCnt = MIFARE_1K_MAXSECTOR;
+    } else if (m2) {
+        SectorsCnt = MIFARE_2K_MAXSECTOR;
+    } else if (m4) {
+        SectorsCnt = MIFARE_4K_MAXSECTOR;
+    }
+
     if (singleSector == false) {
         if (SectorsCnt == 0) {
             PrintAndLogEx(WARNING, "Invalid MIFARE Type");
@@ -1536,18 +1565,21 @@ static int CmdHF14AMfNestedStatic(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf mf staticnested",
                   "Execute Nested attack against MIFARE Classic card with static nonce for key recovery",
-                  "hf mf staticnested -t 0 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE Mini\n"
-                  "hf mf staticnested -t 1 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE Classic 1k\n"
-                  "hf mf staticnested -t 2 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE 2k\n"
-                  "hf mf staticnested -t 4 -b 0 --keya -k FFFFFFFFFFFF                     -> Key recovery against MIFARE 4k\n");
+                  "hf mf staticnested --mini --blk 0 -a -k FFFFFFFFFFFF                   --> Key recovery against MIFARE Mini\n"
+                  "hf mf staticnested --1k --blk 0 -a -k FFFFFFFFFFFF                     --> Key recovery against MIFARE Classic 1k\n"
+                  "hf mf staticnested --2k --blk 0 -a -k FFFFFFFFFFFF                     --> Key recovery against MIFARE 2k\n"
+                  "hf mf staticnested --4k --blk 0 -a -k FFFFFFFFFFFF                     --> Key recovery against MIFARE 4k\n");
 
     void *argtable[] = {
         arg_param_begin,
         arg_str0("k", "key", "<hex>", "Key specified as 12 hex symbols"),
-        arg_int0("t", "type", "<0-4>", "MIFARE Classic type"),
-        arg_int0("b", "block", "<dec>", "Input block number"),
-        arg_lit0(NULL, "keya", "Input key specified is A key (default)"),
-        arg_lit0(NULL, "keyb", "Input key specified is B key"),
+        arg_lit0(NULL, "mini", "MIFARE Classic Mini / S20"),
+        arg_lit0(NULL, "1k", "MIFARE Classic 1k / S50"),
+        arg_lit0(NULL, "2k", "MIFARE Classic/Plus 2k"),
+        arg_lit0(NULL, "4k", "MIFARE Classic 4k / S70"),        
+        arg_int0(NULL, "blk", "<dec>", "Input block number"),
+        arg_lit0("a", NULL, "Input key specified is A key (default)"),
+        arg_lit0("b", NULL, "Input key specified is B key"),
         arg_lit0("e", "emukeys", "Fill simulator keys from found keys"),
         arg_lit0(NULL, "dumpkeys", "Dump found keys to file"),
         arg_param_end
@@ -1558,31 +1590,48 @@ static int CmdHF14AMfNestedStatic(const char *Cmd) {
     uint8_t key[6] = {0};
     CLIGetHexWithReturn(ctx, 1, key, &keylen);
 
-    uint8_t SectorsCnt = NewNumOfSectors(arg_get_u32_def(ctx, 2, 1));
+    bool m0 = arg_get_lit(ctx, 2);
+    bool m1 = arg_get_lit(ctx, 3);
+    bool m2 = arg_get_lit(ctx, 4);
+    bool m4 = arg_get_lit(ctx, 5);
 
-    uint8_t blockNo = arg_get_u32_def(ctx, 3, 0);
+    uint8_t blockNo = arg_get_u32_def(ctx, 6, 0);
 
     uint8_t keyType = 0;
 
-    if (arg_get_lit(ctx, 4) && arg_get_lit(ctx, 5)) {
+    if (arg_get_lit(ctx, 7) && arg_get_lit(ctx, 8)) {
         CLIParserFree(ctx);
         PrintAndLogEx(WARNING, "Input key type must be A or B");
         return PM3_EINVARG;
-    } else if (arg_get_lit(ctx, 5)) {
+    } else if (arg_get_lit(ctx, 8)) {
         keyType = 1;
     }
 
-    bool transferToEml = arg_get_lit(ctx, 6);
-    bool createDumpFile = arg_get_lit(ctx, 7);
+    bool transferToEml = arg_get_lit(ctx, 9);
+    bool createDumpFile = arg_get_lit(ctx, 10);
 
     CLIParserFree(ctx);
 
     //validations
-    if (SectorsCnt == 0) {
-        PrintAndLogEx(WARNING, "Invalid MIFARE Type");
+    if ((m0 + m1 + m2 + m4) > 1) {
+        PrintAndLogEx(WARNING, "Only specify one MIFARE Type");
         return PM3_EINVARG;
     }
 
+    uint8_t SectorsCnt = 1;
+    if (m0) {
+        SectorsCnt = MIFARE_MINI_MAXSECTOR;
+    } else if (m1) {
+        SectorsCnt = MIFARE_1K_MAXSECTOR;
+    } else if (m2) {
+        SectorsCnt = MIFARE_2K_MAXSECTOR;
+    } else if (m4) {
+        SectorsCnt = MIFARE_4K_MAXSECTOR;
+    } else {
+        PrintAndLogEx(WARNING, "Please specify a MIFARE Type");
+        return PM3_EINVARG;        
+    }
+
     if (keylen != 6) {
         PrintAndLogEx(WARNING, "Input key must include 12 HEX symbols");
         return PM3_EINVARG;
@@ -3385,18 +3434,21 @@ static int CmdHF14AMfSim(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf mf sim",
                   "Simulate MIFARE card",
-                  "hf mf sim -t 0                        -> MIFARE Mini\n"
-                  "hf mf sim -t 1                        -> MIFARE Classic 1k (default)\n"
-                  "hf mf sim -t 1 -u 0a0a0a0a            -> MIFARE Classic 1k with 4b UID\n"
-                  "hf mf sim -t 1 -u 11223344556677      -> MIFARE Classic 1k with 7b UID\n"
-                  "hf mf sim -t 1 -u 11223344 -i --crack -> Perform reader attack in interactive mode\n"
-                  "hf mf sim -t 2                        -> MIFARE 2k\n"
-                  "hf mf sim -t 4                        -> MIFARE 4k");
+                  "hf mf sim --mini                         --> MIFARE Mini\n"
+                  "hf mf sim --1k                           --> MIFARE Classic 1k (default)\n"
+                  "hf mf sim --1k -u 0a0a0a0a               --> MIFARE Classic 1k with 4b UID\n"
+                  "hf mf sim --1k -u 11223344556677         --> MIFARE Classic 1k with 7b UID\n"
+                  "hf mf sim --1k -u 11223344 -i --crack    --> Perform reader attack in interactive mode\n"
+                  "hf mf sim --2k                           --> MIFARE 2k\n"
+                  "hf mf sim --4k                           --> MIFARE 4k");
 
     void *argtable[] = {
         arg_param_begin,
         arg_str0("u", "uid", "<hex>", "UID 4,7 or 10bytes. If not specified, the UID 4b/7b from emulator memory will be used"),
-        arg_int0("t", "type", "<0-4> ", "MIFARE Classic type for ATQA/SAK"),
+        arg_lit0(NULL, "mini", "MIFARE Classic Mini / S20"),
+        arg_lit0(NULL, "1k", "MIFARE Classic 1k / S50"),
+        arg_lit0(NULL, "2k", "MIFARE Classic/Plus 2k"),
+        arg_lit0(NULL, "4k", "MIFARE Classic 4k / S70"),
         arg_str0(NULL, "atqa", "<hex>", "Provide explicit ATQA (2 bytes, overrides option t)"),
         arg_str0(NULL, "sak", "<hex>", "Provide explicit SAK (1 bytes, overrides option t)"),
         arg_int0("n", "num", "<dec> ", "Automatically exit simulation after <numreads> blocks have been read by reader. 0 = infinite"),
@@ -3435,55 +3487,31 @@ static int CmdHF14AMfSim(const char *Cmd) {
         }
     }
 
-    uint8_t k_sectorsCount = 40;
-    char csize[13] = { 0 };
-
-    switch (arg_get_u32_def(ctx, 2, 1)) {
-        case 0:
-            flags |= FLAG_MF_MINI;
-            snprintf(csize, sizeof(csize), "MINI");
-            k_sectorsCount = MIFARE_MINI_MAXSECTOR;
-            break;
-        case 1:
-            flags |= FLAG_MF_1K;
-            snprintf(csize, sizeof(csize), "1K");
-            k_sectorsCount = MIFARE_1K_MAXSECTOR;
-            break;
-        case 2:
-            flags |= FLAG_MF_2K;
-            snprintf(csize, sizeof(csize), "2K with RATS");
-            k_sectorsCount = MIFARE_2K_MAXSECTOR;
-            break;
-        case 4:
-            flags |= FLAG_MF_4K;
-            snprintf(csize, sizeof(csize), "4K");
-            k_sectorsCount = MIFARE_4K_MAXSECTOR;
-            break;
-        default:
-            PrintAndLogEx(WARNING, "Unknown parameter for option t");
-            return PM3_EINVARG;
-    }
+    bool m0 = arg_get_lit(ctx, 2);
+    bool m1 = arg_get_lit(ctx, 3);
+    bool m2 = arg_get_lit(ctx, 4);
+    bool m4 = arg_get_lit(ctx, 5);    
 
     int atqalen = 0;
     uint8_t atqa[2] = {0};
-    CLIGetHexWithReturn(ctx, 3, atqa, &atqalen);
+    CLIGetHexWithReturn(ctx, 6, atqa, &atqalen);
 
     int saklen = 0;
     uint8_t sak[1] = {0};
-    CLIGetHexWithReturn(ctx, 4, sak, &saklen);
+    CLIGetHexWithReturn(ctx, 7, sak, &saklen);
 
-    uint8_t exitAfterNReads = arg_get_u32_def(ctx, 5, 0);
+    uint8_t exitAfterNReads = arg_get_u32_def(ctx, 8, 0);
 
-    if (arg_get_lit(ctx, 6)) {
+    if (arg_get_lit(ctx, 9)) {
         flags |= FLAG_INTERACTIVE;
     }
 
-    if (arg_get_lit(ctx, 7)) {
+    if (arg_get_lit(ctx, 10)) {
         flags |= FLAG_NR_AR_ATTACK;
     }
 
-    bool setEmulatorMem = arg_get_lit(ctx, 8);
-    bool verbose = arg_get_lit(ctx, 9);
+    bool setEmulatorMem = arg_get_lit(ctx, 11);
+    bool verbose = arg_get_lit(ctx, 12);
 
     CLIParserFree(ctx);
 
@@ -3514,6 +3542,35 @@ static int CmdHF14AMfSim(const char *Cmd) {
         flags |= FLAG_UID_IN_EMUL;
     }
 
+    uint8_t k_sectorsCount = 40;
+    char csize[13] = { 0 };
+
+    if ((m0 + m1 + m2 + m4) > 1) {
+        PrintAndLogEx(WARNING, "Only specify one MIFARE Type");
+        return PM3_EINVARG;
+    }
+
+    if (m0) {
+        flags |= FLAG_MF_MINI;
+        snprintf(csize, sizeof(csize), "MINI");
+        k_sectorsCount = MIFARE_MINI_MAXSECTOR;
+    } else if (m1) {
+        flags |= FLAG_MF_1K;
+        snprintf(csize, sizeof(csize), "1K");
+        k_sectorsCount = MIFARE_1K_MAXSECTOR;
+    } else if (m2) {
+        flags |= FLAG_MF_2K;
+        snprintf(csize, sizeof(csize), "2K with RATS");
+        k_sectorsCount = MIFARE_2K_MAXSECTOR;
+    } else if (m4) {
+        flags |= FLAG_MF_4K;
+        snprintf(csize, sizeof(csize), "4K");
+        k_sectorsCount = MIFARE_4K_MAXSECTOR;
+    } else {
+        PrintAndLogEx(WARNING, "Please specify a MIFARE Type");
+        return PM3_EINVARG;        
+    }
+
     PrintAndLogEx(INFO, _YELLOW_("MIFARE %s") " | %s UID  " _YELLOW_("%s") ""
                   , csize
                   , uidsize
@@ -4151,8 +4208,8 @@ static int CmdHF14AMfCWipe(const char *cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf mf cwipe",
                   "Wipe gen1 magic chinese card. Set UID/ATQA/SAK/Data/Keys/Access to default values.",
-                  "hf mf cwipe -> wipe card\n"
-                  "hf mf cwipe -u 09080706 -a 0004 -s 18 -> set UID, ATQA and SAK and wipe card");
+                  "hf mf cwipe                           --> wipe card\n"
+                  "hf mf cwipe -u 09080706 -a 0004 -s 18 --> set UID, ATQA and SAK and wipe card");
 
     void *argtable[] = {
         arg_param_begin,

From 282dc099b647d600a3f7a733a4122f4e953f385c Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sat, 13 Feb 2021 21:03:57 -0500
Subject: [PATCH 579/682] rework hf mf chk and cliparser for hf mf fchk

---
 client/gen_pm3mfsim_script.sh |   2 +-
 client/src/cmdhfmf.c          | 343 ++++++++++++++++++----------------
 client/src/proxmark3.c        |   2 +-
 doc/cheatsheet.md             |  45 +++--
 doc/cliparser_todo.txt        |   1 -
 5 files changed, 207 insertions(+), 186 deletions(-)

diff --git a/client/gen_pm3mfsim_script.sh b/client/gen_pm3mfsim_script.sh
index 14cb37909..6947c9bda 100644
--- a/client/gen_pm3mfsim_script.sh
+++ b/client/gen_pm3mfsim_script.sh
@@ -32,4 +32,4 @@ rm $2
 echo "hf mf eclr" >> $2
 echo "hf mf eload" $1 >> $2
 echo "hf mf ekeyprn" >> $2
-echo "hf mf sim -u" `cat $1.eml | (read -n 8 uid; echo $uid)` >> $2
\ No newline at end of file
+echo "hf mf sim -u" `cat $1.eml | (read -n 8 uid; echo $uid)` >> $2
diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index 7f01fd096..de5031652 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -136,29 +136,7 @@ static int usage_hf14_autopwn(void) {
     PrintAndLogEx(NORMAL, _YELLOW_("      hf mf autopwn k 0 A FFFFFFFFFFFF * 1 f mfc_default_keys")"   -- this command combines the two above (reduce the need for nested / hardnested attacks, by using a dictionary)");
     return PM3_SUCCESS;
 }
-static int usage_hf14_chk_fast(void) {
-    PrintAndLogEx(NORMAL, "This is a improved checkkeys method speedwise. It checks MIFARE Classic tags sector keys against a dictionary file with keys");
-    PrintAndLogEx(NORMAL, "Usage:  hf mf fchk [h] <card memory> [t|d|f] [<key (12 hex symbols)>] [<dic (*.dic)>]");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "      h    this help");
-    PrintAndLogEx(NORMAL, "      <cardmem> all sectors based on card memory, other values than below defaults to 1k");
-    PrintAndLogEx(NORMAL, "                 0 - MINI(320 bytes)");
-    PrintAndLogEx(NORMAL, "                 1 - 1K   <default>");
-    PrintAndLogEx(NORMAL, "                 2 - 2K");
-    PrintAndLogEx(NORMAL, "                 4 - 4K");
-    PrintAndLogEx(NORMAL, "      d    write keys to binary file");
-    PrintAndLogEx(NORMAL, "      t    write keys to emulator memory");
-    PrintAndLogEx(NORMAL, "      m    use dictionary from flashmemory\n");
-    PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "Examples:");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf fchk 1 1234567890ab")"          -- target 1K using key 1234567890ab");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf fchk 1 mfc_default_keys.dic")"  -- target 1K using default dictionary file");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf fchk 1 t")"                     -- target 1K, write to emulator memory");
-    PrintAndLogEx(NORMAL, _YELLOW_("      hf mf fchk 1 d")"                     -- target 1K, write to file");
-    if (IfPm3Flash())
-        PrintAndLogEx(NORMAL, _YELLOW_("      hf mf fchk 1 m")"                     -- target 1K, use dictionary from flashmemory");
-    return PM3_SUCCESS;
-}
+
 /*
 static int usage_hf14_keybrute(void) {
     PrintAndLogEx(NORMAL, "J_Run's 2nd phase of multiple sector nested authentication key recovery");
@@ -862,17 +840,18 @@ static int CmdHF14AMfDump(const char *Cmd) {
     CLIParserInit(&ctx, "hf mf dump",
                   "Dump MIFARE Classic tag to binary file\n"
                   "If no <name> given, UID will be used as filename",
-                  "hf mf dump --mini                   --> MIFARE Mini\n"
-                  "hf mf dump --1k                     --> MIFARE Classic 1k\n"
-                  "hf mf dump --2k                     --> MIFARE 2k\n"
-                  "hf mf dump --4k                     --> MIFARE 4k\n");
+                  "hf mf dump --mini                      --> MIFARE Mini\n"
+                  "hf mf dump --1k                        --> MIFARE Classic 1k\n"
+                  "hf mf dump --2k                        --> MIFARE 2k\n"
+                  "hf mf dump --4k                        --> MIFARE 4k\n"
+                  "hf mf dump -f hf-mf-066C8B78-key-5.bin --> MIFARE 1k with keys from specified file\n");
 
     void *argtable[] = {
         arg_param_begin,
         arg_str0("f", "file", "<filename>", "filename of dump"),
         arg_str0("k", "keys", "<filename>", "filename of keys"),
         arg_lit0(NULL, "mini", "MIFARE Classic Mini / S20"),
-        arg_lit0(NULL, "1k", "MIFARE Classic 1k / S50"),
+        arg_lit0(NULL, "1k", "MIFARE Classic 1k / S50 (default)"),
         arg_lit0(NULL, "2k", "MIFARE Classic/Plus 2k"),
         arg_lit0(NULL, "4k", "MIFARE Classic 4k / S70"),
         arg_param_end
@@ -909,6 +888,8 @@ static int CmdHF14AMfDump(const char *Cmd) {
     if ((m0 + m1 + m2 + m4) > 1) {
         PrintAndLogEx(WARNING, "Only specify one MIFARE Type");
         return PM3_EINVARG;
+    } else if ((m0 + m1 + m2 + m4) == 0) {
+        m1 = true;
     }
 
     uint8_t numSectors = 1;
@@ -1576,7 +1557,7 @@ static int CmdHF14AMfNestedStatic(const char *Cmd) {
         arg_lit0(NULL, "mini", "MIFARE Classic Mini / S20"),
         arg_lit0(NULL, "1k", "MIFARE Classic 1k / S50"),
         arg_lit0(NULL, "2k", "MIFARE Classic/Plus 2k"),
-        arg_lit0(NULL, "4k", "MIFARE Classic 4k / S70"),        
+        arg_lit0(NULL, "4k", "MIFARE Classic 4k / S70"),
         arg_int0(NULL, "blk", "<dec>", "Input block number"),
         arg_lit0("a", NULL, "Input key specified is A key (default)"),
         arg_lit0("b", NULL, "Input key specified is B key"),
@@ -1629,7 +1610,7 @@ static int CmdHF14AMfNestedStatic(const char *Cmd) {
         SectorsCnt = MIFARE_4K_MAXSECTOR;
     } else {
         PrintAndLogEx(WARNING, "Please specify a MIFARE Type");
-        return PM3_EINVARG;        
+        return PM3_EINVARG;
     }
 
     if (keylen != 6) {
@@ -2770,132 +2751,161 @@ static void shuffle(uint8_t *array, uint16_t len) {
 */
 
 static int CmdHF14AMfChk_fast(const char *Cmd) {
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf mf fchk",
+                  "This is a improved checkkeys method speedwise. It checks MIFARE Classic tags sector keys against a dictionary file with keys",
+                  "hf mf fchk --mini -k FFFFFFFFFFFF              --> Key recovery against MIFARE Mini\n"
+                  "hf mf fchk --1k -k FFFFFFFFFFFF                --> Key recovery against MIFARE Classic 1k\n"
+                  "hf mf fchk --2k -k FFFFFFFFFFFF                --> Key recovery against MIFARE 2k\n"
+                  "hf mf fchk --4k -k FFFFFFFFFFFF                --> Key recovery against MIFARE 4k\n"
+                  "hf mf fchk --1k -f mfc_default_keys.dic        --> Target 1K using default dictionary file\n"
+                  "hf mf fchk --1k --emu                          --> Target 1K, write to emulator memory\n"
+                  "hf mf fchk --1k --dump                         --> Target 1K, write to file\n"
+                  "hf mf fchk --1k --mem                          --> Target 1K, use dictionary from flashmemory");
 
-    char ctmp = 0x00;
-    ctmp = tolower(param_getchar(Cmd, 0));
-    if (strlen(Cmd) < 1 || ctmp == 'h') return usage_hf14_chk_fast();
+    void *argtable[] = {
+        arg_param_begin,
+        arg_strx0("k", "key", "<hex>", "Key specified as 12 hex symbols"),
+        arg_lit0(NULL, "mini", "MIFARE Classic Mini / S20"),
+        arg_lit0(NULL, "1k", "MIFARE Classic 1k / S50 (default)"),
+        arg_lit0(NULL, "2k", "MIFARE Classic/Plus 2k"),
+        arg_lit0(NULL, "4k", "MIFARE Classic 4k / S70"),
+        arg_lit0(NULL, "emu", "Fill simulator keys from found keys"),
+        arg_lit0(NULL, "dump", "Dump found keys to binary file"),
+        arg_lit0(NULL, "mem", "Use dictionary from flashmemory"),
+        arg_str0("f", "file", "<filename>", "filename of dictionary"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
 
-    FILE *f;
+    int keylen = 0;
+    uint8_t key[255 * 6] = {0};
+    CLIGetHexWithReturn(ctx, 1, key, &keylen);
+
+    bool m0 = arg_get_lit(ctx, 2);
+    bool m1 = arg_get_lit(ctx, 3);
+    bool m2 = arg_get_lit(ctx, 4);
+    bool m4 = arg_get_lit(ctx, 5);
+
+    bool transferToEml = arg_get_lit(ctx, 6);
+    bool createDumpFile = arg_get_lit(ctx, 7);
+    bool use_flashmemory = arg_get_lit(ctx, 8);
+
+    int fnlen = 0;
     char filename[FILE_PATH_SIZE] = {0};
-    char buf[13];
-    uint8_t *keyBlock, *p;
+    CLIParamStrToBuf(arg_get_str(ctx, 14), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
+
+    CLIParserFree(ctx);
+
+    //validations
+
+    if ((m0 + m1 + m2 + m4) > 1) {
+        PrintAndLogEx(WARNING, "Only specify one MIFARE Type");
+        return PM3_EINVARG;
+    } else if ((m0 + m1 + m2 + m4) == 0) {
+        m1 = true;
+    }
+
     uint8_t sectorsCnt = 1;
-    int i, keycnt = 0;
-    int clen = 0;
-    int transferToEml = 0, createDumpFile = 0;
+    if (m0) {
+        sectorsCnt = MIFARE_MINI_MAXSECTOR;
+    } else if (m1) {
+        sectorsCnt = MIFARE_1K_MAXSECTOR;
+    } else if (m2) {
+        sectorsCnt = MIFARE_2K_MAXSECTOR;
+    } else if (m4) {
+        sectorsCnt = MIFARE_4K_MAXSECTOR;
+    } else {
+        PrintAndLogEx(WARNING, "Please specify a MIFARE Type");
+        return PM3_EINVARG;
+    }
+
+    // Handle Keys
+    int keycnt = 0;
     uint32_t keyitems = ARRAYLEN(g_mifare_default_keys);
-    bool use_flashmemory = false;
-
-    sector_t *e_sector = NULL;
-
+    uint8_t *keyBlock, *p;
+    // Allocate memory for keys to be tested
     keyBlock = calloc(ARRAYLEN(g_mifare_default_keys), 6);
     if (keyBlock == NULL) return PM3_EMALLOC;
 
+    // Copy default keys to list
     for (int cnt = 0; cnt < ARRAYLEN(g_mifare_default_keys); cnt++)
-        num_to_bytes(g_mifare_default_keys[cnt], 6, keyBlock + cnt * 6);
+        num_to_bytes(g_mifare_default_keys[cnt], 6, (uint8_t *)(keyBlock + cnt * 6));
+
+    // Handle user supplied key
+    if (keylen >= 6) {
+        int numKeys = keylen / 6;
+
+        p = realloc(keyBlock, 6 * (keyitems + numKeys));
+        if (!p) {
+            PrintAndLogEx(FAILED, "cannot allocate memory for Keys");
+            free(keyBlock);
+            return PM3_EMALLOC;
+        }
+        keyBlock = p;
+
+        memcpy(keyBlock + 6 * keycnt, key, 6 * numKeys);
+
+        for (int i = 0; i < numKeys; i++) {
+            PrintAndLogEx(NORMAL, "[%2d] key %s", keycnt, sprint_hex((keyBlock + 6 * keycnt), 6));
+            keycnt++;
+        }
 
-    // sectors
-    switch (ctmp) {
-        case '0':
-            sectorsCnt =  MIFARE_MINI_MAXSECTOR;
-            break;
-        case '1':
-            sectorsCnt = MIFARE_1K_MAXSECTOR;
-            break;
-        case '2':
-            sectorsCnt = MIFARE_2K_MAXSECTOR;
-            break;
-        case '4':
-            sectorsCnt = MIFARE_4K_MAXSECTOR;
-            break;
-        default:
-            sectorsCnt = MIFARE_1K_MAXSECTOR;
     }
 
-    for (i = 1; param_getchar(Cmd, i); i++) {
+    // Handle user supplied dictionary file
+    FILE *f;
+    char buf[13];
+    if (fnlen > 0) {
+        char *dict_path;
+        int res = searchFile(&dict_path, DICTIONARIES_SUBDIR, filename, ".dic", false);
+        if (res != PM3_SUCCESS) {
+            free(keyBlock);
+            return PM3_EFILE;
+        }
+        f = fopen(dict_path, "r");
+        if (!f) {
+            PrintAndLogEx(FAILED, "File: " _YELLOW_("%s") ": not found or locked.", dict_path);
+            free(dict_path);
+            free(keyBlock);
+            return PM3_EFILE;
+        }
+        free(dict_path);
+        // load keys from dictionary file
+        while (fgets(buf, sizeof(buf), f)) {
+            if (strlen(buf) < 12 || buf[11] == '\n')
+                continue;
 
-        ctmp = tolower(param_getchar(Cmd, i));
-        clen = param_getlength(Cmd, i);
+            while (fgetc(f) != '\n' && !feof(f)) ;  //goto next line
 
-        if (clen == 12) {
+            if (buf[0] == '#') continue; //The line start with # is comment, skip
 
-            if (param_gethex(Cmd, i, keyBlock + 6 * keycnt, 12)) {
-                PrintAndLogEx(FAILED, "not hex, skipping");
+            // codesmell, only checks first char?
+            if (!isxdigit(buf[0])) {
+                PrintAndLogEx(FAILED, "File content error. '" _YELLOW_("%s")"' must include 12 HEX symbols", buf);
                 continue;
             }
 
+            buf[12] = 0;
+
             if (keyitems - keycnt < 2) {
                 p = realloc(keyBlock, 6 * (keyitems += 64));
                 if (!p) {
-                    PrintAndLogEx(FAILED, "Cannot allocate memory for Keys");
+                    PrintAndLogEx(FAILED, "Cannot allocate memory for defKeys");
                     free(keyBlock);
+                    fclose(f);
                     return PM3_EMALLOC;
                 }
                 keyBlock = p;
             }
-            PrintAndLogEx(NORMAL, "[%2d] key %s", keycnt, sprint_hex((keyBlock + 6 * keycnt), 6));
+            memset(keyBlock + 6 * keycnt, 0, 6);
+            num_to_bytes(strtoll(buf, NULL, 16), 6, keyBlock + 6 * keycnt);
+            //PrintAndLogEx(NORMAL, "check key[%2d] %012" PRIx64, keycnt, bytes_to_num(keyBlock + 6*keycnt, 6));
             keycnt++;
-        } else if (clen == 1) {
-            if (ctmp == 't') { transferToEml = 1; continue; }
-            if (ctmp == 'd') { createDumpFile = 1; continue; }
-            if ((ctmp == 'm') && (IfPm3Flash())) { use_flashmemory = true; continue; }
-        } else {
-            // May be a dic file
-            if (param_getstr(Cmd, i, filename, FILE_PATH_SIZE) >= FILE_PATH_SIZE) {
-                PrintAndLogEx(FAILED, "Filename too long");
-                free(keyBlock);
-                return PM3_EINVARG;
-            }
-
-            char *dict_path;
-            int res = searchFile(&dict_path, DICTIONARIES_SUBDIR, filename, ".dic", false);
-            if (res != PM3_SUCCESS) {
-                free(keyBlock);
-                return res;
-            }
-            f = fopen(dict_path, "r");
-            if (!f) {
-                PrintAndLogEx(FAILED, "File: " _YELLOW_("%s") ": not found or locked.", dict_path);
-                free(dict_path);
-                free(keyBlock);
-                return PM3_EFILE;
-            }
-            free(dict_path);
-
-            // read file
-            while (fgets(buf, sizeof(buf), f)) {
-                if (strlen(buf) < 12 || buf[11] == '\n')
-                    continue;
-
-                while (fgetc(f) != '\n' && !feof(f)) ;  //goto next line
-
-                if (buf[0] == '#') continue; //The line start with # is comment, skip
-
-                if (!isxdigit(buf[0])) {
-                    PrintAndLogEx(FAILED, "File content error. '" _YELLOW_("%s")"' must include 12 HEX symbols", buf);
-                    continue;
-                }
-
-                buf[12] = 0;
-                if (keyitems - keycnt < 2) {
-                    p = realloc(keyBlock, 6 * (keyitems += 64));
-                    if (!p) {
-                        PrintAndLogEx(FAILED, "Cannot allocate memory for default keys");
-                        free(keyBlock);
-                        fclose(f);
-                        return PM3_EMALLOC;
-                    }
-                    keyBlock = p;
-                }
-                int pos = 6 * keycnt;
-                memset(keyBlock + pos, 0, 6);
-                num_to_bytes(strtoll(buf, NULL, 16), 6, keyBlock + pos);
-                keycnt++;
-                memset(buf, 0, sizeof(buf));
-            }
-            fclose(f);
-            PrintAndLogEx(SUCCESS, "Loaded %2d keys from " _YELLOW_("%s"), keycnt, filename);
+            memset(buf, 0, sizeof(buf));
         }
+        fclose(f);
+        PrintAndLogEx(SUCCESS, "Loaded %2d keys from " _YELLOW_("%s"), keycnt, filename);
     }
 
     if (keycnt == 0 && !use_flashmemory) {
@@ -2907,15 +2917,18 @@ static int CmdHF14AMfChk_fast(const char *Cmd) {
     }
 
     // create/initialize key storage structure
+    sector_t *e_sector = NULL;
     int32_t res = initSectorTable(&e_sector, sectorsCnt);
     if (res != sectorsCnt) {
         free(keyBlock);
         return PM3_EMALLOC;
     }
 
+
     uint32_t chunksize = keycnt > (PM3_CMD_DATA_SIZE / 6) ? (PM3_CMD_DATA_SIZE / 6) : keycnt;
     bool firstChunk = true, lastChunk = false;
 
+    int i = 0;
     // time
     uint64_t t1 = msclock();
 
@@ -3033,59 +3046,59 @@ static int CmdHF14AMfChk(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf mf chk",
                   "Check keys on MIFARE Classic card",
-                  "hf mf chk -* --mini --all -k FFFFFFFFFFFF              --> Key recovery against MIFARE Mini\n"
-                  "hf mf chk -* --1k --all -k FFFFFFFFFFFF                --> Key recovery against MIFARE Classic 1k\n"
-                  "hf mf chk -* --2k --all -k FFFFFFFFFFFF                --> Key recovery against MIFARE 2k\n"
-                  "hf mf chk -* --4k --all -k FFFFFFFFFFFF                --> Key recovery against MIFARE 4k\n"
-                  "hf mf chk -* --1k --all --emu                          --> Check all sectors, all keys, 1K, and write to emulator memory\n"
-                  "hf mf chk -* --1k --all --dump                         --> Check all sectors, all keys, 1K, and write to file\n"
-                  "hf mf chk -a --blk 0 -f mfc_default_keys.dic           --> Check dictionary against block 0 key A");
+                  "hf mf chk --mini -k FFFFFFFFFFFF              --> Check all sectors, all keys against MIFARE Mini\n"
+                  "hf mf chk --1k -k FFFFFFFFFFFF                --> Check all sectors, all keys against MIFARE Classic 1k\n"
+                  "hf mf chk --2k -k FFFFFFFFFFFF                --> Check all sectors, all keys against MIFARE 2k\n"
+                  "hf mf chk --4k -k FFFFFFFFFFFF                --> Check all sectors, all keys against MIFARE 4k\n"
+                  "hf mf chk --1k --emu                          --> Check all sectors, all keys, 1K, and write to emulator memory\n"
+                  "hf mf chk --1k --dump                         --> Check all sectors, all keys, 1K, and write to file\n"
+                  "hf mf chk -a --blk 0 -f mfc_default_keys.dic  --> Check dictionary against block 0, key A");
 
     void *argtable[] = {
         arg_param_begin,
         arg_strx0("k", "key", "<hex>", "Key specified as 12 hex symbols"),
         arg_int0(NULL, "blk", "<dec>", "Input block number"),
-        arg_lit0("*", NULL, "Target all blocks"),
-        arg_lit0("a", NULL, "Input key specified is A key (default)"),
-        arg_lit0("b", NULL, "Input key specified is B key"),
-        arg_lit0(NULL, "all", "Target all keys"),
+        arg_lit0("a", NULL, "Target Key A, if found also check Key B for duplicate"),
+        arg_lit0("b", NULL, "Target Key B"),
+        arg_lit0("*", "all", "Target both key A & B (default)"),
         arg_lit0(NULL, "mini", "MIFARE Classic Mini / S20"),
-        arg_lit0(NULL, "1k", "MIFARE Classic 1k / S50"),
+        arg_lit0(NULL, "1k", "MIFARE Classic 1k / S50 (default)"),
         arg_lit0(NULL, "2k", "MIFARE Classic/Plus 2k"),
         arg_lit0(NULL, "4k", "MIFARE Classic 4k / S70"),
         arg_lit0(NULL, "emu", "Fill simulator keys from found keys"),
-        arg_lit0(NULL, "dump", "Dump found keys to file"),
+        arg_lit0(NULL, "dump", "Dump found keys to binary file"),
         arg_str0("f", "file", "<filename>", "filename of dictionary"),
         arg_param_end
     };
-    CLIExecWithReturn(ctx, Cmd, argtable, false);
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
 
     int keylen = 0;
     uint8_t key[255 * 6] = {0};
     CLIGetHexWithReturn(ctx, 1, key, &keylen);
 
-    uint8_t blockNo = arg_get_u32_def(ctx, 2, 0);
+    int blockNo = arg_get_int_def(ctx, 2, -1);
 
-    bool allBlocks = arg_get_lit(ctx, 3);
+    uint8_t keyType = 2;
 
-    uint8_t keyType = 0;
-
-    if ((arg_get_lit(ctx, 4) && arg_get_lit(ctx, 5)) || arg_get_lit(ctx, 6)) {
+    if ((arg_get_lit(ctx, 3) && arg_get_lit(ctx, 4)) || arg_get_lit(ctx, 5)) {
         keyType = 2;
-    } else if (arg_get_lit(ctx, 5)) {
+    } else if (arg_get_lit(ctx, 3)) {
+        keyType = 0;
+    } else if (arg_get_lit(ctx, 4)) {
         keyType = 1;
     }
-    bool m0 = arg_get_lit(ctx, 7);
-    bool m1 = arg_get_lit(ctx, 8);
-    bool m2 = arg_get_lit(ctx, 9);
-    bool m4 = arg_get_lit(ctx, 10);
 
-    bool transferToEml = arg_get_lit(ctx, 11);
-    bool createDumpFile = arg_get_lit(ctx, 12);
+    bool m0 = arg_get_lit(ctx, 6);
+    bool m1 = arg_get_lit(ctx, 7);
+    bool m2 = arg_get_lit(ctx, 8);
+    bool m4 = arg_get_lit(ctx, 9);
+
+    bool transferToEml = arg_get_lit(ctx, 10);
+    bool createDumpFile = arg_get_lit(ctx, 11);
 
     int fnlen = 0;
     char filename[FILE_PATH_SIZE] = {0};
-    CLIParamStrToBuf(arg_get_str(ctx, 13), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
+    CLIParamStrToBuf(arg_get_str(ctx, 12), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
 
     CLIParserFree(ctx);
 
@@ -3107,11 +3120,17 @@ static int CmdHF14AMfChk(const char *Cmd) {
         SectorsCnt = MIFARE_4K_MAXSECTOR;
     }
 
-    if (allBlocks) {
+    if ((blockNo == -1) && (SectorsCnt == 1)) {
+        // Default to 1K if block number not specified
+        SectorsCnt = MIFARE_1K_MAXSECTOR;
+    }
+
+    if (blockNo > -1) {
         if (SectorsCnt == 0) {
             PrintAndLogEx(WARNING, "Invalid MIFARE Type");
             return PM3_EINVARG;
         }
+    } else {
         blockNo = 3;
     }
 
@@ -3128,15 +3147,9 @@ static int CmdHF14AMfChk(const char *Cmd) {
         num_to_bytes(g_mifare_default_keys[cnt], 6, (uint8_t *)(keyBlock + cnt * 6));
 
     // Handle user supplied key
-    if (keylen > 6) {
-        // if (keylen != 6) {
-        //     PrintAndLogEx(WARNING, "Input key must include 12 HEX symbols");
-        //     return PM3_EINVARG;
-        // }
+    if (keylen >= 6) {
         int numKeys = keylen / 6;
 
-
-
         p = realloc(keyBlock, 6 * (keyitems + numKeys));
         if (!p) {
             PrintAndLogEx(FAILED, "cannot allocate memory for Keys");
@@ -3490,7 +3503,7 @@ static int CmdHF14AMfSim(const char *Cmd) {
     bool m0 = arg_get_lit(ctx, 2);
     bool m1 = arg_get_lit(ctx, 3);
     bool m2 = arg_get_lit(ctx, 4);
-    bool m4 = arg_get_lit(ctx, 5);    
+    bool m4 = arg_get_lit(ctx, 5);
 
     int atqalen = 0;
     uint8_t atqa[2] = {0};
@@ -3568,7 +3581,7 @@ static int CmdHF14AMfSim(const char *Cmd) {
         k_sectorsCount = MIFARE_4K_MAXSECTOR;
     } else {
         PrintAndLogEx(WARNING, "Please specify a MIFARE Type");
-        return PM3_EINVARG;        
+        return PM3_EINVARG;
     }
 
     PrintAndLogEx(INFO, _YELLOW_("MIFARE %s") " | %s UID  " _YELLOW_("%s") ""
diff --git a/client/src/proxmark3.c b/client/src/proxmark3.c
index d52517f0a..a1e4761c7 100644
--- a/client/src/proxmark3.c
+++ b/client/src/proxmark3.c
@@ -586,7 +586,7 @@ static void show_help(bool showFullHelp, char *exec_name) {
         PrintAndLogEx(NORMAL, "      %s "SERIAL_PORT_EXAMPLE_H" -w                    -- wait for serial port", exec_name);
         PrintAndLogEx(NORMAL, "      %s                                    -- runs the pm3 client in OFFLINE mode", exec_name);
         PrintAndLogEx(NORMAL, "\n  to execute different commands from terminal:\n");
-        PrintAndLogEx(NORMAL, "      %s "SERIAL_PORT_EXAMPLE_H" -c \"hf mf chk --1k -* --all\"   -- execute cmd and quit client", exec_name);
+        PrintAndLogEx(NORMAL, "      %s "SERIAL_PORT_EXAMPLE_H" -c \"hf mf chk --1k\"   -- execute cmd and quit client", exec_name);
         PrintAndLogEx(NORMAL, "      %s "SERIAL_PORT_EXAMPLE_H" -l hf_read            -- execute lua script " _YELLOW_("`hf_read`")" and quit client", exec_name);
         PrintAndLogEx(NORMAL, "      %s "SERIAL_PORT_EXAMPLE_H" -s mycmds.txt         -- execute each pm3 cmd in file and quit client", exec_name);
         PrintAndLogEx(NORMAL, "\n  to flash fullimage and bootloader:\n");
diff --git a/doc/cheatsheet.md b/doc/cheatsheet.md
index 471f20132..1358c8f3d 100644
--- a/doc/cheatsheet.md
+++ b/doc/cheatsheet.md
@@ -224,49 +224,58 @@ Check for default keys
 ```
 Options
 ---
-    -h, --help                     This help
     -k, --key <hex>                Key specified as 12 hex symbols
     --blk <dec>                    Input block number
-    -*                             Target all blocks
-    -a                             Input key specified is A key (default)
-    -b                             Input key specified is B key
-    --all                          Target all keys
+    -a                             Target Key A, if found also check Key B for duplicate
+    -b                             Target Key B
+    -*, --all                      Target both key A & B (default)
     --mini                         MIFARE Classic Mini / S20
-    --1k                           MIFARE Classic 1k / S50
+    --1k                           MIFARE Classic 1k / S50 (default)
     --2k                           MIFARE Classic/Plus 2k
     --4k                           MIFARE Classic 4k / S70
     --emu                          Fill simulator keys from found keys
-    --dump                         Dump found keys to file
+    --dump                         Dump found keys to binary file
     -f, --file <filename>          filename of dictionary
 
-pm3 --> hf mf chk -* --1k --all -f mfc_default_keys
+pm3 --> hf mf chk --1k -f mfc_default_keys
 ```
 
 Check for default keys from local memory
 ```
 Options
 ---
-card memory   : 0 - MINI(320 bytes), 1 - 1K, 2 - 2K, 4 - 4K
-m             : use dictionary from flashmemory
+    -k, --key <hex>                Key specified as 12 hex symbols
+    --mini                         MIFARE Classic Mini / S20
+    --1k                           MIFARE Classic 1k / S50 (default)
+    --2k                           MIFARE Classic/Plus 2k
+    --4k                           MIFARE Classic 4k / S70
+    --emu                          Fill simulator keys from found keys
+    --dump                         Dump found keys to binary file
+    --mem                          Use dictionary from flashmemory
+    -f, --file <filename>          filename of dictionary
 
-pm3 --> hf mf fchk 1 m
+pm3 --> hf mf fchk --1k --mem
 ```
 
 Dump MIFARE card contents
 ```
 options:
-    -t, --type <0-4>               MIFARE Classic type
     -f, --file <filename>          filename of dump
     -k, --keys <filename>          filename of keys
+    --mini                         MIFARE Classic Mini / S20
+    --1k                           MIFARE Classic 1k / S50 (default)
+    --2k                           MIFARE Classic/Plus 2k
+    --4k                           MIFARE Classic 4k / S70
 
 examples/notes:
-    hf mf dump -t 0                          -> MIFARE Mini
-    hf mf dump -t 1                          -> MIFARE Classic 1k (default)
-    hf mf dump -t 2                          -> MIFARE 2k
-    hf mf dump -t 4                          -> MIFARE 4k
+    hf mf dump --mini                            -> MIFARE Mini
+    hf mf dump --1k                              -> MIFARE Classic 1k
+    hf mf dump --2k                              -> MIFARE 2k
+    hf mf dump --4k                              -> MIFARE 4k
+    hf mf dump -f hf-mf-066C8B78-key-5.bin       -> MIFARE 1k with keys from specified file
 
-pm3 --> hf mf dump -t 1
-pm3 --> hf mf dump -t 1 -k hf-mf-A29558E4-key.bin -f hf-mf-A29558E4-dump.bin
+pm3 --> hf mf dump
+pm3 --> hf mf dump --1k -k hf-mf-A29558E4-key.bin -f hf-mf-A29558E4-dump.bin
 ```
 
 Convert .bin to .eml
diff --git a/doc/cliparser_todo.txt b/doc/cliparser_todo.txt
index 9811a7414..44f0bac7d 100644
--- a/doc/cliparser_todo.txt
+++ b/doc/cliparser_todo.txt
@@ -60,7 +60,6 @@ hf felica litedump
 hf mf hardnested
 hf mf autopwn
 hf mf nack
-hf mf fchk
 hf mf decrypt
 hf mf rdbl
 hf mf rdsc

From 987f95cca91521802e61e5f554100c6bb26c4e6c Mon Sep 17 00:00:00 2001
From: tcprst <nick.draffen@gmail.com>
Date: Sat, 13 Feb 2021 23:29:58 -0500
Subject: [PATCH 580/682] bugfix

---
 client/src/cmdhfmf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index de5031652..b8671c4b1 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -2793,7 +2793,7 @@ static int CmdHF14AMfChk_fast(const char *Cmd) {
 
     int fnlen = 0;
     char filename[FILE_PATH_SIZE] = {0};
-    CLIParamStrToBuf(arg_get_str(ctx, 14), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
+    CLIParamStrToBuf(arg_get_str(ctx, 9), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
 
     CLIParserFree(ctx);
 

From 9a96157e824cb573b3b615b7751dc339ec64eb47 Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Sun, 14 Feb 2021 12:20:18 +0100
Subject: [PATCH 581/682] initial implementation of em4x50 standalone mode

---
 armsrc/Standalone/lf_tharexde.c | 57 +++++++++++++++------------------
 armsrc/em4x50.c                 | 30 ++++++++---------
 armsrc/iso14443a.c              |  4 +--
 client/src/cmdhfjooki.c         | 13 +++++---
 4 files changed, 49 insertions(+), 55 deletions(-)

diff --git a/armsrc/Standalone/lf_tharexde.c b/armsrc/Standalone/lf_tharexde.c
index 44dbc8a4f..c88437f4f 100644
--- a/armsrc/Standalone/lf_tharexde.c
+++ b/armsrc/Standalone/lf_tharexde.c
@@ -28,8 +28,8 @@
  *
  * On entering stand-alone mode, this module will start simulating EM4x50 data.
  * Data is read from eml dump file uploaded to flash memory (lf_em4x50_simulate.eml).
- * If reader sends password different from dump file password, 'new' password
- * is saved in file lf_em4x50_passwords.log in flash memory.
+ * If reader sends password different from dump file password, it is saved in
+ * file lf_em4x50_passwords.log in flash memory.
  *
  * On switching to read/record mode by pressing pm3 button, module will start
  * reading EM4x50 data. Each collected data set will be written/appended to the
@@ -65,7 +65,6 @@
 
 #define STATE_SIM                       0
 #define STATE_READ                      1
-#define EM4X50_TAG_WORD                 45
 #define LF_EM4X50_INPUTFILE_SIM         "lf_em4x50_simulate.eml"
 #define LF_EM4X50_LOGFILE_SIM           "lf_em4x50_passwords.log"
 #define LF_EM4X50_LOGFILE_COLLECT       "lf_em4x50_collect.log"
@@ -75,25 +74,24 @@ uint32_t gPassword;
 static void LoadDataInstructions(const char *inputfile) {
     Dbprintf("");
     Dbprintf("To load datafile to flash and display it:");
-    Dbprintf(_YELLOW_("1.") " edit input file %s", inputfile);
-    Dbprintf(_YELLOW_("2.") " start proxmark3 client");
-    Dbprintf(_YELLOW_("3.") " mem spiffs load f <filename> o %s", inputfile);
-    Dbprintf(_YELLOW_("4.") " start standalone mode");
+    Dbprintf("1. edit input file %s", inputfile);
+    Dbprintf("2. start proxmark3 client");
+    Dbprintf("3. mem spiffs load f <filename> o %s", inputfile);
+    Dbprintf("4. start standalone mode");
 }
 
 static void DownloadLogInstructions(const char *logfile) {
     Dbprintf("");
     Dbprintf("To get the logfile from flash and display it:");
-    Dbprintf(_YELLOW_("1.") " mem spiffs dump o %s f <filename>", logfile);
-    Dbprintf(_YELLOW_("2.") " exit proxmark3 client");
-    Dbprintf(_YELLOW_("3.") " cat <filename>");
+    Dbprintf("1. mem spiffs dump o %s f <filename>", logfile);
+    Dbprintf("2. exit proxmark3 client");
+    Dbprintf("3. cat <filename>");
 }
 
 static bool get_input_data_from_file(uint32_t *tag, char *inputfile) {
 
     size_t now = 0;
 
-#ifdef WITH_FLASH
     if (exists_in_spiffs(inputfile)) {
 
         uint32_t size = size_in_spiffs(inputfile);
@@ -111,23 +109,21 @@ static bool get_input_data_from_file(uint32_t *tag, char *inputfile) {
         }
 
         Dbprintf(_YELLOW_("read tag data from input file"));
+    } else {
+        Dbprintf(_RED_("no input file %s"), inputfile);
     }
 
     BigBuf_free();
-#endif
-    
+
     return ((now == EM4X50_NO_WORDS) && (tag[EM4X50_DEVICE_SERIAL] != tag[EM4X50_DEVICE_ID]));
 }
 
 static void append(const char *filename, uint8_t *entry, size_t entry_len) {
-
-#ifdef WITH_FLASH
     if (exists_in_spiffs(filename)) {
         rdv40_spiffs_append(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
     } else {
         rdv40_spiffs_write(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
     }
-#endif
 }
 
 void ModInfo(void) {
@@ -141,10 +137,8 @@ void RunMod(void) {
     uint8_t entry[400], state = STATE_SIM;
     uint32_t tag[EM4X50_NO_WORDS] = {0x0};
 
-#ifdef WITH_FLASH
     rdv40_spiffs_lazy_mount();
-#endif
-    
+
     StandAloneMode();
     Dbprintf(_YELLOW_("Standalone mode THAREXDE started"));
 
@@ -191,8 +185,9 @@ void RunMod(void) {
                     Dbprintf(_YELLOW_("tag data ok"));
                 } else {
                     Dbprintf(_RED_("error in tag data"));
+                    LoadDataInstructions(LF_EM4X50_INPUTFILE_SIM);
                 }
-                
+
                 // init; start with command = standard read mode
                 em4x50_setup_sim();
                 gLogin = false;
@@ -209,22 +204,22 @@ void RunMod(void) {
                 LED(LED_A, 200);
                 SpinDelay(200);
             }
-            
+
             em4x50_handle_commands(&command, tag);
 
             // check if new password was found
-            if (gPassword != reflect32(tag[0])) {
-                
+            if (gPassword != reflect32(tag[EM4X50_DEVICE_PASSWORD])) {
+
                 Dbprintf("received password: %08"PRIx32"", gPassword);
-                
+
                 // append password to logfile in flash memory
                 memset(entry, 0, sizeof(entry));
                 sprintf((char *)entry, "%08"PRIx32"\n", gPassword);
                 append(LF_EM4X50_LOGFILE_SIM, entry, strlen((char *)entry));
-                
-                gPassword = reflect32(tag[0]);
+
+                gPassword = reflect32(tag[EM4X50_DEVICE_PASSWORD]);
             }
-            
+
             // if timeout (e.g. no reader field) continue with standard read
             // mode and reset former authentication
             if (command == PM3_ETIMEOUT) {
@@ -232,7 +227,7 @@ void RunMod(void) {
                 gLogin = false;
                 LED_D_OFF();
             }
-            
+
         } else if (state == STATE_READ) {
 
             if (state_change) {
@@ -263,7 +258,7 @@ void RunMod(void) {
                 append(LF_EM4X50_LOGFILE_COLLECT, entry, strlen((char *)entry));
             }
         }
-        
+
         // reset timer
         AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; // re-enable timer and wait for TC0
         AT91C_BASE_TC0->TC_RC  = 0; // set TIOA (carry bit) on overflow, return to zero
@@ -271,17 +266,15 @@ void RunMod(void) {
         AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; // reset and re-enable timer
     }
 
-#ifdef WITH_FLASH
     if (state == STATE_READ) {
         DownloadLogInstructions(LF_EM4X50_LOGFILE_COLLECT);
     } else {
-        LoadDataInstructions(LF_EM4X50_INPUTFILE_SIM);
+        DownloadLogInstructions(LF_EM4X50_LOGFILE_SIM);
     }
 
     LED_D_ON();
     rdv40_spiffs_lazy_unmount();
     LED_D_OFF();
-#endif
 
     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
     LEDsoff();
diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index 17db0cfb1..6c5f9c2d2 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -256,7 +256,7 @@ static uint32_t get_pulse_length(void) {
 
     int32_t timeout = EM4X50_TIMEOUT_PULSE_EVAL, tval = 0;
 
-    // iterates pulse length (low -> high -> low)
+    // iterates pulse lengths (low -> high -> low)
 
     volatile uint8_t sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 
@@ -267,7 +267,6 @@ static uint32_t get_pulse_length(void) {
         return 0;
 
     tval = GetTicks();
-    //timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD);
     timeout = EM4X50_TIMEOUT_PULSE_EVAL;
 
     while (sample < gHigh && (timeout--))
@@ -276,7 +275,6 @@ static uint32_t get_pulse_length(void) {
     if (timeout <= 0)
         return 0;
 
-    //timeout = (T0 * 3 * EM4X50_T_TAG_FULL_PERIOD);
     timeout = EM4X50_TIMEOUT_PULSE_EVAL;
     while (sample > gLow && (timeout--))
         sample = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
@@ -305,7 +303,6 @@ static void em4x50_reader_send_bit(int bit) {
         // disable modulation (activate the field) for 7 cycles of carrier
         // period (Opt64)
         LOW(GPIO_SSC_DOUT);
-        //while (AT91C_BASE_TC0->TC_CV < T0 * 7);
         while (GetTicks() - tval < 7 * CYCLES2TICKS);
 
         // enable modulation (drop the field) for remaining first
@@ -862,16 +859,16 @@ void em4x50_read(em4x50_data_t *etd) {
     LED_C_ON();
     if (get_signalproperties() && find_em4x50_tag()) {
 
-            LED_C_OFF();
-            LED_D_ON();
+        LED_C_OFF();
+        LED_D_ON();
 
-            // try to login with given password
-            if (etd->pwd_given)
-                blogin = (login(etd->password1) == PM3_SUCCESS);
+        // try to login with given password
+        if (etd->pwd_given)
+            blogin = (login(etd->password1) == PM3_SUCCESS);
 
-            // only one word has to be read -> first word read = last word read
-            if (blogin)
-                status = selective_read(etd->addresses, words);
+        // only one word has to be read -> first word read = last word read
+        if (blogin)
+            status = selective_read(etd->addresses, words);
     }
 
     LEDsoff();
@@ -914,7 +911,7 @@ void em4x50_reader(void) {
     int now = 0;
     uint32_t words[EM4X50_NO_WORDS] = {0x0};
 
-     em4x50_setup_read();
+    em4x50_setup_read();
 
     LED_C_ON();
     if (get_signalproperties() && find_em4x50_tag()) {
@@ -1245,7 +1242,6 @@ static int em4x50_sim_read_bit(void) {
                 if (timeout <= 0) {
                     return PM3_ETIMEOUT;
                 }
-                //timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
 
                 // now we have a reference "position", from here it will take
                 // slightly less than 32 cycles until the end of the bit period
@@ -1447,7 +1443,7 @@ static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
         WDT_HIT();
 
         command = em4x50_sim_send_listen_window(tag);
-        
+
         if (command != PM3_SUCCESS) {
             return command;
         }
@@ -1543,7 +1539,7 @@ static int em4x50_sim_handle_login_command(uint32_t *tag) {
         em4x50_sim_send_nak();
         gLogin = false;
         LED_D_OFF();
-        
+
         // save transmitted password for future use (e.g. standalone mode)
         gPassword = password;
     }
@@ -1782,7 +1778,7 @@ void em4x50_handle_commands(int *command, uint32_t *tag) {
 // LED D -> operations that require authentication are possible
 void em4x50_sim(uint32_t *password) {
 
-    int command = 0;
+    int command = PM3_ENODATA;
 
     uint8_t *em4x50_mem = BigBuf_get_EM_addr();
     uint32_t tag[EM4X50_NO_WORDS] = {0x0};
diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index 999c5eded..cd07a4007 100644
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -920,14 +920,14 @@ bool GetIso14443aCommandFromReader(uint8_t *received, uint8_t *par, int *len) {
     uint16_t checker = 0;
     for (;;) {
         WDT_HIT();
-        if (flip == 2) {
+        if (flip == 3) {
             if (data_available())
                 return false;
 
             flip = 0;
         }
 
-        if (checker >= 4000) {
+        if (checker >= 3000) {
             if (BUTTON_PRESS())
                 return false;
 
diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index 352c61ae7..9b1a14b8b 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -327,15 +327,19 @@ static int CmdHF14AJookiSim(const char *Cmd) {
 
     jooki_print(b64, result, false);
 
+    // copy UID from base64 url parameter
+    uint8_t uid[7] = {0};
+    memcpy(uid, result + 5, 7);
+
     // hf mfu sim...
     uint8_t *data = calloc(144, sizeof(uint8_t));
 
-    // copy UID from base64 url parameter
-    memcpy(data, result + 5, 3);
+    memcpy(data, uid, 3);
+    memcpy(data + (1*4), uid + 3, 4);
+
     // bbc0
     data[3] = 0x88 ^ data[0] ^ data[1] ^ data[2];
 
-    memcpy(data + (1*4), result + 8, 4);
     // bbc1
     data[8] = data[4] ^ data[5] ^ data[6] ^ data[7];
 
@@ -398,8 +402,9 @@ static int CmdHF14AJookiSim(const char *Cmd) {
 
     // NTAG,  7 byte UID in eloaded data.
     payload.tagtype = 7;
-    payload.flags = FLAG_7B_UID_IN_DATA;
+    payload.flags = FLAG_UID_IN_EMUL;
     payload.exitAfter = 0;
+    memcpy(payload.uid, uid, sizeof(uid));
 
     clearCommandBuffer();
     SendCommandNG(CMD_HF_ISO14443A_SIMULATE, (uint8_t *)&payload, sizeof(payload));

From 3ba8dffe7541360f3e855d465913419ee4cf4434 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 15 Feb 2021 02:59:14 +0100
Subject: [PATCH 582/682] rename "hf jooki write -> clone", adapted tid/fid

---
 client/src/cmdhfjooki.c | 265 +++++++++++++++++++++++++++++-----------
 1 file changed, 192 insertions(+), 73 deletions(-)

diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index 9b1a14b8b..6541fd68c 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -21,39 +21,108 @@
 #include "cmdmain.h"
 #include "fileutils.h"    // convert_mfu..
 
-
 static int CmdHelp(const char *Cmd);
 
+typedef struct {
+    uint8_t typeid;
+    uint8_t figureid;
+    const char figdesc[40];
+    const char typedesc[12];
+} PACKED jooki_figure_t;
+
 typedef struct {
     uint8_t uid[7];
     const char b64[17];
-    uint8_t tagtype;
-} PACKED jooki_t;
+    uint8_t typeid;
+    uint8_t figureid;
+} PACKED jooki_test_t;
 
 // sample set for selftest.
-jooki_t jooks[] = {
-    { {0x04, 0xDA, 0xB7, 0x6A, 0xE7, 0x4C, 0x80}, "ruxow8lnn88uyeX+", 0x00},
-    { {0x04, 0xf0, 0x22, 0xc2, 0x33, 0x5e, 0x80}, "\0" , 0x00},
-    { {0x04, 0x8C, 0xEC, 0xDA, 0xF0, 0x4A, 0x80}, "ONrsVf7jX6IaSNV6", 0x01},
-    { {0x04, 0x92, 0xA7, 0x6A, 0xE7, 0x4C, 0x81}, "Hjjpcx/mZwuveTF+", 0x02},
-    { {0x04, 0xD0, 0xB0, 0x3A, 0xD3, 0x63, 0x80}, "\0", 0x02},
-    { {0x04, 0x96, 0x42, 0xDA, 0xF0, 0x4A, 0x80}, "vEWy0WO9wZNEzEok", 0x03},
-    { {0x04, 0x33, 0xb5, 0x62, 0x39, 0x4d, 0x80}, "\0", 0x03},
-    { {0x04, 0x17, 0xB7, 0x3A, 0xD3, 0x63, 0x81}, "f0axEma+g2WnLGAm", 0x05},
-    { {0x04, 0x84, 0x27, 0x6A, 0xE7, 0x4C, 0x80}, "VZB/OLBwOiM5Mpnp", 0x05},
-    { {0x04, 0x28, 0xF4, 0xDA, 0xF0, 0x4A, 0x81}, "7WzlgEzqLgwTnWNy", 0x05},
+jooki_test_t jooks[] = {
+    { {0x04, 0xDA, 0xB7, 0x6A, 0xE7, 0x4C, 0x80}, "ruxow8lnn88uyeX+", 0x01, 0x00},
+    { {0x04, 0xf0, 0x22, 0xc2, 0x33, 0x5e, 0x80}, "\0", 0x01 , 0x00},
+    { {0x04, 0x8C, 0xEC, 0xDA, 0xF0, 0x4A, 0x80}, "ONrsVf7jX6IaSNV6", 0x01, 0x01},
+    { {0x04, 0x92, 0xA7, 0x6A, 0xE7, 0x4C, 0x81}, "Hjjpcx/mZwuveTF+", 0x01, 0x02},
+    { {0x04, 0xD0, 0xB0, 0x3A, 0xD3, 0x63, 0x80}, "\0", 0x01, 0x02},
+    { {0x04, 0x96, 0x42, 0xDA, 0xF0, 0x4A, 0x80}, "vEWy0WO9wZNEzEok", 0x01, 0x03},
+    { {0x04, 0x33, 0xb5, 0x62, 0x39, 0x4d, 0x80}, "\0", 0x01, 0x03},
+    { {0x04, 0x17, 0xB7, 0x3A, 0xD3, 0x63, 0x81}, "f0axEma+g2WnLGAm", 0x01, 0x05},
+    { {0x04, 0x84, 0x27, 0x6A, 0xE7, 0x4C, 0x80}, "VZB/OLBwOiM5Mpnp", 0x01, 0x05},
+    { {0x04, 0x28, 0xF4, 0xDA, 0xF0, 0x4A, 0x81}, "7WzlgEzqLgwTnWNy", 0x01, 0x05},
 };
 
-const char *jooks_figures[] = {"Dragon", "Fox", "Ghost", "Knight", "?", "Whale"};
+jooki_figure_t jooks_figures[] = {
+    {0x01, 0x00, "龙 Dragon", "Figurine"},
+    {0x01, 0x01, "狐狸 Fox", "Figurine"},
+    {0x01, 0x02, "鬼 Ghost", "Figurine"},
+    {0x01, 0x03, "骑士 Knight", "Figurine"},
+    {0x01, 0x04, "ThankYou", "Figurine"},
+    {0x01, 0x05, "鲸 Whale", "Figurine"},
+    {0x01, 0x06, "Black Dragon", "Figurine"},
+    {0x01, 0x07, "Black Fox", "Figurine"}, 
+    {0x01, 0x08, "Black Knight", "Figurine"},
+    {0x01, 0x09, "Black Whale", "Figurine"},
+    {0x01, 0x0A, "White Dragon", "Figurine"},
+    {0x01, 0x0B, "White Fox", "Figurine"}, 
+    {0x01, 0x0C, "White Knight", "Figurine"},
+    {0x01, 0x0D, "White Whale", "Figurine"},
+
+    {0x02, 0x01, "圆盘 Generic Flat", "Stone"},
+
+    {0x03, 0x00, "record", "Sys"},
+    {0x03, 0x01, "factory_mode_on", "Sys"},
+    {0x03, 0x02, "factory_mode_off", "Sys"},
+    {0x03, 0x03, "airplane_mode_on", "Sys"},
+    {0x03, 0x04, "airplane_mode_off", "Sys"},
+    {0x03, 0x05, "toy_safe_on", "Sys"},
+    {0x03, 0x06, "toy_safe_off", "Sys"},
+    {0x03, 0x07, "wifi_on", "Sys"},
+    {0x03, 0x08, "bt_on", "Sys"},
+    {0x03, 0x0a, "bt_off", "Sys"},
+    {0x03, 0x0b, "production_finished", "Sys"},
+
+    {0x04, 0x00, "test.0", "Test"},
+    {0x04, 0x01, "test.1", "Test"},
+    {0x04, 0x02, "test.2", "Test"},
+    {0x04, 0x03, "test.3", "Test"},
+    {0x04, 0x04, "test.4", "Test"},
+    {0x04, 0x05, "test.5", "Test"},
+    {0x04, 0x06, "test.6", "Test"},
+    {0x04, 0x07, "test.7", "Test"},
+    {0x04, 0x08, "test.8", "Test"},
+    {0x04, 0x09, "test.9", "Test"},
+    {0x04, 0x10, "test.10", "Test"},
+    {0x04, 0x11, "test.11", "Test"},
+    {0x04, 0x12, "test.12", "Test"},
+    {0x04, 0x13, "test.13", "Test"},
+    {0x04, 0x14, "test.14", "Test"},
+    {0x04, 0x15, "test.15", "Test"},
+    {0x04, 0x16, "test.16", "Test"},
+    {0x04, 0x17, "test.17", "Test"},
+    {0x04, 0x18, "test.18", "Test"},
+    {0x04, 0x19, "test.19", "Test"},
+    {0x04, 0x20, "test.20", "Test"},
+};
+
+static int jooki_lookup(uint8_t tid, uint8_t fid) {
+    for (int i=0; i < ARRAYLEN(jooks_figures); i++) {
+        jooki_figure_t tmp = jooks_figures[i];
+        if (tmp.typeid == tid && tmp.figureid == fid) {
+            return i;
+        }
+    }
+    return -1;
+}
+
 const uint8_t jooki_secret[] = {0x20, 0x20, 0x20, 0x6D, 0x24, 0x0B, 0xEB, 0x94, 0x2C, 0x80, 0x45, 0x16};
 const uint8_t NFC_SECRET[] = { 0x03, 0x9c, 0x25, 0x6f, 0xb9, 0x2e, 0xe8, 0x08, 0x09, 0x83, 0xd9, 0x33, 0x56};
 
 #define JOOKI_UID_LEN  7
-#define JOOKI_IV_LEN   4
+#define JOOKI_IV_LEN   3
 #define JOOKI_B64_LEN (16 + 1)
 #define JOOKI_PLAIN_LEN 12
 
-static int jooki_encode(uint8_t *iv, uint8_t tagtype, uint8_t *uid, uint8_t *out) {
+static int jooki_encode(uint8_t *iv, uint8_t tid, uint8_t fid, uint8_t *uid, uint8_t *out) {
     if (out == NULL) {
         PrintAndLogEx(ERR, "(encode jooki) base64ndef param is NULL");
         return PM3_EINVARG;
@@ -65,7 +134,7 @@ static int jooki_encode(uint8_t *iv, uint8_t tagtype, uint8_t *uid, uint8_t *out
         return PM3_EINVARG;
     }
 
-    uint8_t d[JOOKI_PLAIN_LEN] = {iv[0], iv[1],iv[2], iv[3], tagtype, uid[0], uid[1], uid[2], uid[3], uid[4], uid[5], uid[6]};
+    uint8_t d[JOOKI_PLAIN_LEN] = {iv[0], iv[1],iv[2], tid, fid, uid[0], uid[1], uid[2], uid[3], uid[4], uid[5], uid[6]};
     uint8_t enc[JOOKI_PLAIN_LEN] = {0};
     for (uint8_t i = 0; i < JOOKI_PLAIN_LEN; i++) {
 
@@ -118,9 +187,16 @@ static int jooki_create_ndef(uint8_t *b64ndef, uint8_t *ndefrecord) {
     return PM3_SUCCESS;
 }
 
-static void jooki_printEx(uint8_t *b64, uint8_t *iv, uint8_t tt, uint8_t *uid, bool verbose) {
+static void jooki_printEx(uint8_t *b64, uint8_t *iv, uint8_t tid, uint8_t fid, uint8_t *uid, bool verbose) {
+    int idx = jooki_lookup(tid, fid);
+
     PrintAndLogEx(INFO, "Encoded URL.. %s ( %s )", sprint_hex(b64, 12), b64);
-    PrintAndLogEx(INFO, "Figurine..... %02x - " _GREEN_("%s"), tt, jooks_figures[tt]);
+    PrintAndLogEx(INFO, "Figurine..... %02x %02x - " _GREEN_("%s, %s")
+        , tid
+        , fid
+        , (idx != -1) ?  jooks_figures[idx].typedesc : "n/a" 
+        , (idx != -1) ?  jooks_figures[idx].figdesc : "n/a"
+        );
     PrintAndLogEx(INFO, "iv........... %s", sprint_hex(iv, JOOKI_IV_LEN));  
     PrintAndLogEx(INFO, "uid.......... %s", sprint_hex(uid, JOOKI_UID_LEN));  
 
@@ -142,11 +218,12 @@ static void jooki_print(uint8_t *b64, uint8_t *result, bool verbose) {
 
     uint8_t iv[JOOKI_IV_LEN] = {0};
     uint8_t uid[JOOKI_UID_LEN] = {0};
-    memcpy(iv, result, sizeof(iv));
-    uint8_t tt = result[4];
-    memcpy(uid, result + 5, sizeof(uid));
+    memcpy(iv, result, JOOKI_IV_LEN);
+    uint8_t tid = result[3];
+    uint8_t fid = result[4];
+    memcpy(uid, result + 5, JOOKI_UID_LEN);
 
-    jooki_printEx(b64, iv, tt, uid, verbose);
+    jooki_printEx(b64, iv, tid, fid, uid, verbose);
 }
 
 static int jooki_selftest(void) {
@@ -161,21 +238,26 @@ static int jooki_selftest(void) {
         uint8_t result[JOOKI_PLAIN_LEN] = {0};
         jooki_decode((uint8_t*)jooks[i].b64, result);
 
-        memcpy(iv, result, 4);
-        uint8_t tt = result[4];
+        memcpy(iv, result, JOOKI_IV_LEN);
+        uint8_t tid = result[3];
+        uint8_t fid = result[4];
         memcpy(uid, result + 5, sizeof(uid));
 
-        bool tt_ok  = (tt == jooks[i].tagtype); 
+        bool tid_ok = (tid == jooks[i].typeid); 
+        bool fid_ok = (fid == jooks[i].figureid); 
         bool uid_ok = (memcmp(uid, jooks[i].uid, sizeof(uid)) == 0);
 
+        int idx = jooki_lookup(tid, fid);
+
         PrintAndLogEx(INFO, "Encoded URL.. %s ( %s )", sprint_hex((const uint8_t*)jooks[i].b64, 12), jooks[i].b64);
-        PrintAndLogEx(INFO, "Figurine..... %02x - " _GREEN_("%s") " ( %s )", tt, jooks_figures[tt], tt_ok ? _GREEN_("ok") : _RED_("fail"));  
+        PrintAndLogEx(INFO, "Type......... %02x - " _GREEN_("%s") " ( %s )", tid, (idx != -1) ? jooks_figures[idx].typedesc : "n/a", tid_ok ? _GREEN_("ok") : _RED_("fail"));  
+        PrintAndLogEx(INFO, "Figurine..... %02x - " _GREEN_("%s") " ( %s )", fid, (idx != -1) ? jooks_figures[idx].figdesc : "n/a", fid_ok ? _GREEN_("ok") : _RED_("fail"));  
         PrintAndLogEx(INFO, "iv........... %s", sprint_hex(iv, sizeof(iv)));  
         PrintAndLogEx(INFO, "uid.......... %s ( %s )", sprint_hex(uid, sizeof(uid)), uid_ok ? _GREEN_("ok") : _RED_("fail"));          
 
         uint8_t b64[JOOKI_B64_LEN] = {0};
         memset(b64, 0, sizeof(b64));        
-        jooki_encode(iv, tt, uid, b64);
+        jooki_encode(iv, tid, fid, uid, b64);
 
         uint8_t ndefmsg[52] = {0};
         jooki_create_ndef(b64, ndefmsg);
@@ -205,11 +287,19 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
         arg_lit0("r", NULL, "read uid from tag instead"),
         arg_lit0("t", NULL, "selftest"),
         arg_lit0("v", "verbose", "verbose output"),
-        arg_lit0(NULL, "dragon", "tag type"),
-        arg_lit0(NULL, "fox", "tag type"),
-        arg_lit0(NULL, "ghost", "tag type"),
-        arg_lit0(NULL, "knight", "tag type"),
-        arg_lit0(NULL, "whale", "tag type"),
+        arg_lit0(NULL, "dragon", "figurine type"),
+        arg_lit0(NULL, "fox", "figurine type"),
+        arg_lit0(NULL, "ghost", "figurine type"),
+        arg_lit0(NULL, "knight", "figurine type"),
+        arg_lit0(NULL, "whale", "figurine type"),
+        arg_lit0(NULL, "blackdragon", "figurine type"),
+        arg_lit0(NULL, "blackfox", "figurine type"),
+        arg_lit0(NULL, "blackknight", "figurine type"),
+        arg_lit0(NULL, "blackwhale", "figurine type"),
+        arg_lit0(NULL, "whitedragon", "figurine type"),
+        arg_lit0(NULL, "whitefox", "figurine type"),
+        arg_lit0(NULL, "whiteknight", "figurine type"),
+        arg_lit0(NULL, "whitewhale", "figurine type"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);
@@ -225,32 +315,57 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
     bool use_tag = arg_get_lit(ctx, 2);
     bool selftest = arg_get_lit(ctx, 3);
     bool verbose = arg_get_lit(ctx, 4);
-    bool tt_dragon = arg_get_lit(ctx, 5);
-    bool tt_fox = arg_get_lit(ctx, 6);
-    bool tt_ghost = arg_get_lit(ctx, 7);
-    bool tt_knight = arg_get_lit(ctx, 8);
-    bool tt_whale = arg_get_lit(ctx, 9);
+    bool t0 = arg_get_lit(ctx, 5);
+    bool t1 = arg_get_lit(ctx, 6);
+    bool t2 = arg_get_lit(ctx, 7);
+    bool t3 = arg_get_lit(ctx, 8);
+    bool t5 = arg_get_lit(ctx, 9);
+    bool t6 = arg_get_lit(ctx, 10);
+    bool t7 = arg_get_lit(ctx, 11);
+    bool t8 = arg_get_lit(ctx, 12);
+    bool t9 = arg_get_lit(ctx, 13);
+    bool ta = arg_get_lit(ctx, 14);
+    bool tb = arg_get_lit(ctx, 15);
+    bool tc = arg_get_lit(ctx, 16);
+    bool td = arg_get_lit(ctx, 17);
     CLIParserFree(ctx);
     
     if (selftest) {
         return jooki_selftest();
     }
 
-    if ((tt_dragon + tt_fox + tt_ghost + tt_knight + tt_whale) > 1) {
+    if ((t0 + t1 + t2 + t3 + t5 + t6 + t7 + t8 + t9 + ta + tb + tc + td) > 1) {
         PrintAndLogEx(ERR, "Select one tag type");
         return PM3_EINVARG;
     }
-    uint8_t tt = 0;
-    if (tt_fox)
-        tt = 1;
-    if (tt_ghost)
-        tt = 2;
-    if (tt_knight)
-        tt = 3;
-    if (tt_whale)
-        tt = 5;
-    
-    uint8_t iv[JOOKI_IV_LEN] = {0x80, 0x77, 0x51, 1};
+    uint8_t tid = 0x01;
+    uint8_t fid = 0x00;
+    if (t1)
+        fid = 0x01;
+    if (t2)
+        fid = 0x02;
+    if (t3)
+        fid = 0x03;
+    if (t5)
+        fid = 0x05;
+    if (t6)
+        fid = 0x06;
+    if (t7)
+        fid = 0x07;
+    if (t8)
+        fid = 0x08;
+    if (t9)
+        fid = 0x09;
+    if (ta)
+        fid = 0x0a;
+    if (tb)
+        fid = 0x0b;
+    if (tc)
+        fid = 0x0c;
+    if (td)
+        fid = 0x0d;
+
+    uint8_t iv[JOOKI_IV_LEN] = {0x80, 0x77, 0x51};
     if (use_tag) {
         res = ul_read_uid(uid);
         if (res != PM3_SUCCESS) {
@@ -265,8 +380,8 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
 
     uint8_t b64[JOOKI_B64_LEN] = {0};
     memset(b64, 0, sizeof(b64));        
-    jooki_encode(iv, tt, uid, b64);  
-    jooki_printEx(b64, iv, tt, uid, verbose);
+    jooki_encode(iv, tid, fid, uid, b64);  
+    jooki_printEx(b64, iv, tid, fid, uid, verbose);
     return PM3_SUCCESS;
 }
 
@@ -303,16 +418,16 @@ static int CmdHF14AJookiSim(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf jooki sim",
                   "Simulate a Jooki token.  Either `hf mfu eload` before or use `-d` param",
-                  "hf jooki sim     --> using eload before\n"
-                  "hf jooki sim -d 7WzlgEzqLgwTnWNy"
+                  "hf jooki sim                      --> use token in emulator memory\n"
+                  "hf jooki sim -b 7WzlgEzqLgwTnWNy  --> using base64 url parameter"
                  );
 
     void *argtable[] = {
         arg_param_begin,
-        arg_str0("d", "data", "<base64>", "base64 url parameter"),
+        arg_str0("b", "b64", "<base64>", "base64 url parameter"),
         arg_param_end
     };
-    CLIExecWithReturn(ctx, Cmd, argtable, false);
+    CLIExecWithReturn(ctx, Cmd, argtable, true);
     int dlen = 16;
     uint8_t b64[JOOKI_B64_LEN] = {0x00};
     memset(b64, 0x0, sizeof(b64));
@@ -359,8 +474,6 @@ static int CmdHF14AJookiSim(const char *Cmd) {
     }
 
     mfu_dump_t *mfu_dump = (mfu_dump_t *)data;
-
-
     memcpy(mfu_dump->version, "\x00\x04\x04\x02\x01\x00\x0F\x03", 8);
     mfu_dump->counter_tearing[2][3] = 0xBD;
     mfu_dump->pages = 0x2c;
@@ -430,35 +543,40 @@ static int CmdHF14AJookiSim(const char *Cmd) {
     return PM3_SUCCESS;
 }
 
-static int CmdHF14AJookiWrite(const char *Cmd) {
+static int CmdHF14AJookiClone(const char *Cmd) {
     CLIParserContext *ctx;
-    CLIParserInit(&ctx, "hf jooki write",
+    CLIParserInit(&ctx, "hf jooki clone",
                   "Write a Jooki token to a Ultralight or NTAG tag",
-                  "hf jooki write -d  xxxxxxxx   ->  where x is raw NDEF from encode command"
+                  "hf jooki clone -d <hex bytes>         --> where hex is raw NDEF"
+                  "hf jooki clone --b64 7WzlgEzqLgwTnWNy --> using base64 url parameter"
                  );
 
     void *argtable[] = {
         arg_param_begin,
-        arg_str1("d", "data", "<hex>", "bytes"),
-        arg_str0("p", "pwd", "<hex>", "password for authentication (EV1/NTAG 4 bytes)"),
+        arg_str0("b", "b64",  "<base64>", "base64 url parameter"),
+        arg_str0("d", "data", "<hex>",    "raw NDEF bytes"),
+        arg_str0("p", "pwd",  "<hex>",    "password for authentication (EV1/NTAG 4 bytes)"),
         arg_param_end
     };
-    CLIExecWithReturn(ctx, Cmd, argtable, true);
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+    int blen = 16;
+    uint8_t b64[JOOKI_B64_LEN] = {0x00};
+    memset(b64, 0x0, sizeof(b64));
+    CLIGetStrWithReturn(ctx, 1, b64, &blen);
+
     int dlen = 0;
     uint8_t data[52] = {0x00};
     memset(data, 0x0, sizeof(data));
-    int res = CLIParamHexToBuf(arg_get_str(ctx, 1), data, sizeof(data), &dlen);
+    int res = CLIParamHexToBuf(arg_get_str(ctx, 2), data, sizeof(data), &dlen);
     if (res) {
         CLIParserFree(ctx);
         PrintAndLogEx(FAILED, "Error parsing bytes");
         return PM3_EINVARG;
     }
 
-
     int plen = 0;
     uint8_t pwd[4] = {0x00};
-    CLIGetHexWithReturn(ctx, 2, pwd, &plen);
-
+    CLIGetHexWithReturn(ctx, 3, pwd, &plen);
     CLIParserFree(ctx);
 
     if (dlen != 52) {
@@ -498,16 +616,17 @@ static int CmdHF14AJookiWrite(const char *Cmd) {
         i++;
     }
 
+    PrintAndLogEx(INFO, "Done");
+    PrintAndLogEx(HINT, "Try `" _YELLOW_("hf mfu ndef") "` to view" );
     return PM3_SUCCESS;
 }
 
 static command_t CommandTable[] = {
-    {"help",    CmdHelp,             AlwaysAvailable, "This help"},
-    {"encode", CmdHF14AJookiEncode,  AlwaysAvailable, "Encode Jooki token"},
+    {"help",   CmdHelp,              AlwaysAvailable, "This help"},
+    {"clone",  CmdHF14AJookiClone,   IfPm3Iso14443a,  "Write a Jooki token"},
     {"decode", CmdHF14AJookiDecode,  AlwaysAvailable, "Decode Jooki token"},
+    {"encode", CmdHF14AJookiEncode,  AlwaysAvailable, "Encode Jooki token"},
     {"sim",    CmdHF14AJookiSim,     IfPm3Iso14443a,  "Simulate Jooki token"},
-    {"write",  CmdHF14AJookiWrite,   IfPm3Iso14443a,  "Write a Jooki token"},
-
     {NULL, NULL, NULL, NULL}
 };
 

From 8c7bcd42c7728da66cb2794368694e49ea48d346 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 15 Feb 2021 11:01:01 +0100
Subject: [PATCH 583/682] textual

---
 client/src/cmdlf.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index 1e14f97eb..2e8838f92 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -1456,27 +1456,27 @@ int CmdLFfind(const char *Cmd) {
         //fsk
         if (GetFskClock("", false)) {
             if (FSKrawDemod(0, 0, 0, 0, true) == PM3_SUCCESS) {
-                PrintAndLogEx(NORMAL, "\nUnknown FSK Modulated Tag found!");
+                PrintAndLogEx(INFO, "Unknown FSK Modulated Tag found!");
                 goto out;
             }
         }
 
         bool st = true;
         if (ASKDemod_ext(0, 0, 0, 0, false, true, false, 1, &st) == PM3_SUCCESS) {
-            PrintAndLogEx(NORMAL, "\nUnknown ASK Modulated and Manchester encoded Tag found!");
-            PrintAndLogEx(NORMAL, "if it does not look right it could instead be ASK/Biphase - try " _YELLOW_("'data rawdemod ab'"));
+            PrintAndLogEx(INFO, "Unknown ASK Modulated and Manchester encoded Tag found!");
+            PrintAndLogEx(INFO, "if it does not look right it could instead be ASK/Biphase - try " _YELLOW_("'data rawdemod ab'"));
             goto out;
         }
 
         if (CmdPSK1rawDemod("") == PM3_SUCCESS) {
-            PrintAndLogEx(NORMAL, "Possible unknown PSK1 Modulated Tag found above!");
-            PrintAndLogEx(NORMAL, "    Could also be PSK2 - try " _YELLOW_("'data rawdemod p2'"));
-            PrintAndLogEx(NORMAL, "    Could also be PSK3 - [currently not supported]");
-            PrintAndLogEx(NORMAL, "    Could also be  NRZ - try " _YELLOW_("'data rawdemod nr"));
+            PrintAndLogEx(INFO, "Possible unknown PSK1 Modulated Tag found above!");
+            PrintAndLogEx(INFO, "    Could also be PSK2 - try " _YELLOW_("'data rawdemod p2'"));
+            PrintAndLogEx(INFO, "    Could also be PSK3 - [currently not supported]");
+            PrintAndLogEx(INFO, "    Could also be  NRZ - try " _YELLOW_("'data rawdemod nr"));
             goto out;
         }
 
-        PrintAndLogEx(FAILED, _RED_("\nNo data found!"));
+        PrintAndLogEx(FAILED, _RED_("No data found!"));
     }
 
     retval = PM3_ESOFT;

From db4bd209a4201ace46e7bd37a964f721c500f5b3 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 15 Feb 2021 17:04:35 +0100
Subject: [PATCH 584/682] no unicode..

---
 client/src/cmdhfjooki.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index 6541fd68c..82e3787e6 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -52,12 +52,12 @@ jooki_test_t jooks[] = {
 };
 
 jooki_figure_t jooks_figures[] = {
-    {0x01, 0x00, "龙 Dragon", "Figurine"},
-    {0x01, 0x01, "狐狸 Fox", "Figurine"},
-    {0x01, 0x02, "鬼 Ghost", "Figurine"},
-    {0x01, 0x03, "骑士 Knight", "Figurine"},
+    {0x01, 0x00, "Dragon", "Figurine"},
+    {0x01, 0x01, "Fox", "Figurine"},
+    {0x01, 0x02, "Ghost", "Figurine"},
+    {0x01, 0x03, "Knight", "Figurine"},
     {0x01, 0x04, "ThankYou", "Figurine"},
-    {0x01, 0x05, "鲸 Whale", "Figurine"},
+    {0x01, 0x05, "Whale", "Figurine"},
     {0x01, 0x06, "Black Dragon", "Figurine"},
     {0x01, 0x07, "Black Fox", "Figurine"}, 
     {0x01, 0x08, "Black Knight", "Figurine"},
@@ -67,7 +67,7 @@ jooki_figure_t jooks_figures[] = {
     {0x01, 0x0C, "White Knight", "Figurine"},
     {0x01, 0x0D, "White Whale", "Figurine"},
 
-    {0x02, 0x01, "圆盘 Generic Flat", "Stone"},
+    {0x02, 0x01, "Generic Flat", "Stone"},
 
     {0x03, 0x00, "record", "Sys"},
     {0x03, 0x01, "factory_mode_on", "Sys"},

From a78fecad07fbd5b0a9d73f1659eaebc6cfff88ea Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Mon, 15 Feb 2021 21:26:16 +0100
Subject: [PATCH 585/682] revert changes (PR follows)

---
 CHANGELOG.md                                  |   1 -
 armsrc/Standalone/Makefile.hal                |   7 +-
 armsrc/Standalone/Makefile.inc                |   4 -
 armsrc/Standalone/lf_tharexde.c               | 283 ------------------
 .../4_Advanced-compilation-parameters.md      |   1 -
 5 files changed, 2 insertions(+), 294 deletions(-)
 delete mode 100644 armsrc/Standalone/lf_tharexde.c

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b730df269..9547aba77 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,7 +3,6 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
- - Added `LF_THAREXDE` standalone mode which simulates and reads EM4x50 cards (@tharexde)
  - Added `hf jooki` commands (@iceman1001)
  - Changed `wiegand encode` - format param is now optional, w/o it will try encode all formats (@iceman1001)
  - Fix cppchecker warnings (@iceman1001)
diff --git a/armsrc/Standalone/Makefile.hal b/armsrc/Standalone/Makefile.hal
index 552267611..d5414f661 100644
--- a/armsrc/Standalone/Makefile.hal
+++ b/armsrc/Standalone/Makefile.hal
@@ -35,9 +35,6 @@ define KNOWN_STANDALONE_DEFINITIONS
 | LF_SAMYRUN      | HID26 read/clone/sim                   |
 |                 | - Samy Kamkar                          |
 +----------------------------------------------------------+
-| LF_THAREXDE     | Simulate/read EM4x50 tags              |
-| (RDV4 only)     | storing in flashmem                    |
-+----------------------------------------------------------+
 | HF_14ASNIFF     | 14a sniff to flashmem                  |
 | (RDV4 only)     |                                        |
 +----------------------------------------------------------+
@@ -70,10 +67,10 @@ define KNOWN_STANDALONE_DEFINITIONS
 +----------------------------------------------------------+
 endef
 
-STANDALONE_MODES := LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RWC LF_HIDBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN LF_THAREXDE
+STANDALONE_MODES := LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RWC LF_HIDBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN
 STANDALONE_MODES += HF_14ASNIFF HF_AVEFUL HF_BOG HF_COLIN HF_ICECLASS HF_LEGIC HF_MATTYRUN HF_MSDSAL HF_TCPRST HF_YOUNG
 STANDALONE_MODES_REQ_SMARTCARD :=
-STANDALONE_MODES_REQ_FLASH := LF_ICEHID LF_THAREXDE HF_14ASNIFF HF_BOG HF_COLIN HF_ICECLASS
+STANDALONE_MODES_REQ_FLASH := LF_ICEHID HF_14ASNIFF HF_BOG HF_COLIN HF_ICECLASS
 ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES)),)
     STANDALONE_PLATFORM_DEFS += -DWITH_STANDALONE_$(STANDALONE)
     ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES_REQ_SMARTCARD)),)
diff --git a/armsrc/Standalone/Makefile.inc b/armsrc/Standalone/Makefile.inc
index 519dc2087..087a4d927 100644
--- a/armsrc/Standalone/Makefile.inc
+++ b/armsrc/Standalone/Makefile.inc
@@ -73,7 +73,3 @@ endif
 ifneq (,$(findstring WITH_STANDALONE_HF_ICECLASS,$(APP_CFLAGS)))
     SRC_STANDALONE = hf_iceclass.c
 endif
-# WITH_STANDALONE_LF_THAREXDE
-ifneq (,$(findstring WITH_STANDALONE_LF_THAREXDE,$(APP_CFLAGS)))
-    SRC_STANDALONE = lf_tharexde.c
-endif
diff --git a/armsrc/Standalone/lf_tharexde.c b/armsrc/Standalone/lf_tharexde.c
deleted file mode 100644
index c88437f4f..000000000
--- a/armsrc/Standalone/lf_tharexde.c
+++ /dev/null
@@ -1,283 +0,0 @@
-//-----------------------------------------------------------------------------
-// tharexde, 2021
-//
-// This code is licensed to you under the terms of the GNU GPL, version 2 or,
-// at your option, any later version. See the LICENSE.txt file for the text of
-// the license.
-//-----------------------------------------------------------------------------
-// main code for EM4x50 simulator and collector aka THAREXDE
-//-----------------------------------------------------------------------------
-#include <inttypes.h>
-#include "ticks.h"
-#include "standalone.h"
-#include "proxmark3_arm.h"
-#include "appmain.h"
-#include "BigBuf.h"
-#include "commonutil.h"
-#include "fpgaloader.h"
-#include "util.h"
-#include "dbprint.h"
-#include "spiffs.h"
-#include "../em4x50.h"
-
-/*
- * `lf_tharexde` simulates EM4x50 dumps uploaded to flash, reads words
- * transmitted by EM4x50 tags in standard read mode and stores them in
- * internal flash.
- * It requires RDV4 hardware (for flash and battery).
- *
- * On entering stand-alone mode, this module will start simulating EM4x50 data.
- * Data is read from eml dump file uploaded to flash memory (lf_em4x50_simulate.eml).
- * If reader sends password different from dump file password, it is saved in
- * file lf_em4x50_passwords.log in flash memory.
- *
- * On switching to read/record mode by pressing pm3 button, module will start
- * reading EM4x50 data. Each collected data set will be written/appended to the
- * logfile in flash (lf_em4x50_collect.log) as a text string.
- *
- * LEDs:
- * - LED A: simulating
- * - LED A blinking: no simulation data or read error
- * - LED B: reading/recording
- * - LED D: unmounting/sync'ing flash (normally < 100ms)
- *
- * To upload input file (eml format) to flash:
- * - mem spiffs load f <filename> o lf_em4x50_simulate.eml
- *
- * To retrieve password file from flash:
- * - mem spiffs dump o lf_em4x50_passwords.log f <filename>
- *
- * To retrieve log file from flash:
- * - mem spiffs dump o lf_em4x50_collect.log f <filename>
- *
- * This module emits debug strings during normal operation -- so try it out in
- * the lab connected to PM3 client before taking it into the field.
- *
- * To delete the input file from flash:
- * - mem spiffs remove lf_em4x50_simulate.eml
- *
- * To delete the log file from flash:
- * - mem spiffs remove lf_em4x50_passwords.log
- *
- * To delete the log file from flash:
- * - mem spiffs remove lf_em4x50_collect.log
- */
-
-#define STATE_SIM                       0
-#define STATE_READ                      1
-#define LF_EM4X50_INPUTFILE_SIM         "lf_em4x50_simulate.eml"
-#define LF_EM4X50_LOGFILE_SIM           "lf_em4x50_passwords.log"
-#define LF_EM4X50_LOGFILE_COLLECT       "lf_em4x50_collect.log"
-
-uint32_t gPassword;
-
-static void LoadDataInstructions(const char *inputfile) {
-    Dbprintf("");
-    Dbprintf("To load datafile to flash and display it:");
-    Dbprintf("1. edit input file %s", inputfile);
-    Dbprintf("2. start proxmark3 client");
-    Dbprintf("3. mem spiffs load f <filename> o %s", inputfile);
-    Dbprintf("4. start standalone mode");
-}
-
-static void DownloadLogInstructions(const char *logfile) {
-    Dbprintf("");
-    Dbprintf("To get the logfile from flash and display it:");
-    Dbprintf("1. mem spiffs dump o %s f <filename>", logfile);
-    Dbprintf("2. exit proxmark3 client");
-    Dbprintf("3. cat <filename>");
-}
-
-static bool get_input_data_from_file(uint32_t *tag, char *inputfile) {
-
-    size_t now = 0;
-
-    if (exists_in_spiffs(inputfile)) {
-
-        uint32_t size = size_in_spiffs(inputfile);
-        uint8_t *mem = BigBuf_malloc(size);
-
-        Dbprintf(_YELLOW_("found input file %s"), inputfile);
-
-        rdv40_spiffs_read_as_filetype(inputfile, mem, size, RDV40_SPIFFS_SAFETY_SAFE);
-
-        now = size / 9;
-        for (int i = 0; i < now; i++) {
-            for (int j = 0; j < 4; j++) {
-                tag[i] |= (hex2int(mem[2 * j + 9 * i]) << 4 | hex2int(mem[2 * j + 1 + 9 * i])) << ((3 - j) * 8);
-            }
-        }
-
-        Dbprintf(_YELLOW_("read tag data from input file"));
-    } else {
-        Dbprintf(_RED_("no input file %s"), inputfile);
-    }
-
-    BigBuf_free();
-
-    return ((now == EM4X50_NO_WORDS) && (tag[EM4X50_DEVICE_SERIAL] != tag[EM4X50_DEVICE_ID]));
-}
-
-static void append(const char *filename, uint8_t *entry, size_t entry_len) {
-    if (exists_in_spiffs(filename)) {
-        rdv40_spiffs_append(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
-    } else {
-        rdv40_spiffs_write(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
-    }
-}
-
-void ModInfo(void) {
-    DbpString(_YELLOW_("  LF EM4x50 sim/collector mode") " - a.k.a tharexde");
-}
-
-void RunMod(void) {
-
-    bool state_change = true, read_ok = false;
-    int no_words = 0, command = 0;
-    uint8_t entry[400], state = STATE_SIM;
-    uint32_t tag[EM4X50_NO_WORDS] = {0x0};
-
-    rdv40_spiffs_lazy_mount();
-
-    StandAloneMode();
-    Dbprintf(_YELLOW_("Standalone mode THAREXDE started"));
-
-    for (;;) {
-
-        WDT_HIT();
-        if (data_available()) {
-            break;
-        }
-
-        // press button - toggle between SIM and READ
-        // hold button - exit
-        int button_pressed = BUTTON_CLICKED(1000);
-        if (button_pressed == BUTTON_SINGLE_CLICK) {
-
-            switch (state) {
-                case STATE_SIM:
-                    state = STATE_READ;
-                    break;
-                case STATE_READ:
-                    state = STATE_SIM;
-                    break;
-                default:
-                    break;
-            }
-
-            state_change = true;
-
-        } else if (button_pressed == BUTTON_HOLD) {
-            break;
-        }
-
-        if (state == STATE_SIM) {
-
-            if (state_change) {
-
-                LEDsoff();
-                LED_A_ON();
-                Dbprintf("");
-                Dbprintf(_YELLOW_("switched to EM4x50 simulating mode"));
-
-                read_ok = get_input_data_from_file(tag, LF_EM4X50_INPUTFILE_SIM);
-                if (read_ok) {
-                    Dbprintf(_YELLOW_("tag data ok"));
-                } else {
-                    Dbprintf(_RED_("error in tag data"));
-                    LoadDataInstructions(LF_EM4X50_INPUTFILE_SIM);
-                }
-
-                // init; start with command = standard read mode
-                em4x50_setup_sim();
-                gLogin = false;
-                LED_D_OFF();
-                gPassword = reflect32(tag[0]);
-                gWritePasswordProcess = false;
-                command = EM4X50_COMMAND_STANDARD_READ;
-
-                state_change = false;
-            }
-
-            // if no data or read error -> blink
-            if (read_ok == false) {
-                LED(LED_A, 200);
-                SpinDelay(200);
-            }
-
-            em4x50_handle_commands(&command, tag);
-
-            // check if new password was found
-            if (gPassword != reflect32(tag[EM4X50_DEVICE_PASSWORD])) {
-
-                Dbprintf("received password: %08"PRIx32"", gPassword);
-
-                // append password to logfile in flash memory
-                memset(entry, 0, sizeof(entry));
-                sprintf((char *)entry, "%08"PRIx32"\n", gPassword);
-                append(LF_EM4X50_LOGFILE_SIM, entry, strlen((char *)entry));
-
-                gPassword = reflect32(tag[EM4X50_DEVICE_PASSWORD]);
-            }
-
-            // if timeout (e.g. no reader field) continue with standard read
-            // mode and reset former authentication
-            if (command == PM3_ETIMEOUT) {
-                command = EM4X50_COMMAND_STANDARD_READ;
-                gLogin = false;
-                LED_D_OFF();
-            }
-
-        } else if (state == STATE_READ) {
-
-            if (state_change) {
-
-                LEDsoff();
-                LED_B_ON();
-                Dbprintf("");
-                Dbprintf(_YELLOW_("switched to EM4x50 reading mode\n"));
-
-                em4x50_setup_read();
-                state_change = false;
-            }
-
-            no_words = 0;
-            memset(tag, 0, sizeof(tag));
-            standard_read(&no_words, tag);
-
-            if (no_words > 0) {
-
-                memset(entry, 0, sizeof(entry));
-
-                sprintf((char *)entry, "found EM4x50 tag:\n");
-                for (int i = 0; i < no_words; i++) {
-                    sprintf((char *)entry + strlen((char *)entry), "%08"PRIx32"\n", tag[i]);
-                }
-                Dbprintf("%s", entry);
-                sprintf((char *)entry + strlen((char *)entry), "\n");
-                append(LF_EM4X50_LOGFILE_COLLECT, entry, strlen((char *)entry));
-            }
-        }
-
-        // reset timer
-        AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; // re-enable timer and wait for TC0
-        AT91C_BASE_TC0->TC_RC  = 0; // set TIOA (carry bit) on overflow, return to zero
-        AT91C_BASE_TC0->TC_RA  = 1; // clear carry bit on next clock cycle
-        AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; // reset and re-enable timer
-    }
-
-    if (state == STATE_READ) {
-        DownloadLogInstructions(LF_EM4X50_LOGFILE_COLLECT);
-    } else {
-        DownloadLogInstructions(LF_EM4X50_LOGFILE_SIM);
-    }
-
-    LED_D_ON();
-    rdv40_spiffs_lazy_unmount();
-    LED_D_OFF();
-
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-    LEDsoff();
-    Dbprintf("");
-    Dbprintf(_YELLOW_("[=] Standalone mode THAREXDE stopped"));
-}
diff --git a/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md b/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
index 2ba6aeaba..6dbe54d49 100644
--- a/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
+++ b/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
@@ -79,7 +79,6 @@ Here are the supported values you can assign to `STANDALONE` in `Makefile.platfo
 |-----------------|----------------------------------------|
 |                 | No standalone mode
 | LF_SKELETON     | standalone mode skeleton - Iceman1001
-| LF_THAREXDE     | LF EM4x50 simulator/read standalone mode - tharexde
 | LF_EM4100EMUL   | LF EM4100 simulator standalone mode - temskiy
 | LF_EM4100RSWB   | LF EM4100 read/write/clone/brute mode - Monster1024
 | LF_EM4100RWC    | LF EM4100 read/write/clone mode - temskiy

From db679608ecab0dc646a887cc6ee430588978c9ca Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Mon, 15 Feb 2021 22:44:17 +0100
Subject: [PATCH 586/682] initial implementation of em4x50 standalone mode
 (lf_tharexde)

---
 CHANGELOG.md                                  |   1 +
 armsrc/Standalone/Makefile.hal                |   7 +-
 armsrc/Standalone/Makefile.inc                |   4 +
 armsrc/Standalone/lf_tharexde.c               | 283 ++++++++++++++++++
 .../4_Advanced-compilation-parameters.md      |   1 +
 5 files changed, 294 insertions(+), 2 deletions(-)
 create mode 100644 armsrc/Standalone/lf_tharexde.c

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9547aba77..b730df269 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+ - Added `LF_THAREXDE` standalone mode which simulates and reads EM4x50 cards (@tharexde)
  - Added `hf jooki` commands (@iceman1001)
  - Changed `wiegand encode` - format param is now optional, w/o it will try encode all formats (@iceman1001)
  - Fix cppchecker warnings (@iceman1001)
diff --git a/armsrc/Standalone/Makefile.hal b/armsrc/Standalone/Makefile.hal
index d5414f661..552267611 100644
--- a/armsrc/Standalone/Makefile.hal
+++ b/armsrc/Standalone/Makefile.hal
@@ -35,6 +35,9 @@ define KNOWN_STANDALONE_DEFINITIONS
 | LF_SAMYRUN      | HID26 read/clone/sim                   |
 |                 | - Samy Kamkar                          |
 +----------------------------------------------------------+
+| LF_THAREXDE     | Simulate/read EM4x50 tags              |
+| (RDV4 only)     | storing in flashmem                    |
++----------------------------------------------------------+
 | HF_14ASNIFF     | 14a sniff to flashmem                  |
 | (RDV4 only)     |                                        |
 +----------------------------------------------------------+
@@ -67,10 +70,10 @@ define KNOWN_STANDALONE_DEFINITIONS
 +----------------------------------------------------------+
 endef
 
-STANDALONE_MODES := LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RWC LF_HIDBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN
+STANDALONE_MODES := LF_SKELETON LF_EM4100EMUL LF_EM4100RSWB LF_EM4100RWC LF_HIDBRUTE LF_ICEHID LF_PROXBRUTE LF_SAMYRUN LF_THAREXDE
 STANDALONE_MODES += HF_14ASNIFF HF_AVEFUL HF_BOG HF_COLIN HF_ICECLASS HF_LEGIC HF_MATTYRUN HF_MSDSAL HF_TCPRST HF_YOUNG
 STANDALONE_MODES_REQ_SMARTCARD :=
-STANDALONE_MODES_REQ_FLASH := LF_ICEHID HF_14ASNIFF HF_BOG HF_COLIN HF_ICECLASS
+STANDALONE_MODES_REQ_FLASH := LF_ICEHID LF_THAREXDE HF_14ASNIFF HF_BOG HF_COLIN HF_ICECLASS
 ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES)),)
     STANDALONE_PLATFORM_DEFS += -DWITH_STANDALONE_$(STANDALONE)
     ifneq ($(filter $(STANDALONE),$(STANDALONE_MODES_REQ_SMARTCARD)),)
diff --git a/armsrc/Standalone/Makefile.inc b/armsrc/Standalone/Makefile.inc
index 087a4d927..519dc2087 100644
--- a/armsrc/Standalone/Makefile.inc
+++ b/armsrc/Standalone/Makefile.inc
@@ -73,3 +73,7 @@ endif
 ifneq (,$(findstring WITH_STANDALONE_HF_ICECLASS,$(APP_CFLAGS)))
     SRC_STANDALONE = hf_iceclass.c
 endif
+# WITH_STANDALONE_LF_THAREXDE
+ifneq (,$(findstring WITH_STANDALONE_LF_THAREXDE,$(APP_CFLAGS)))
+    SRC_STANDALONE = lf_tharexde.c
+endif
diff --git a/armsrc/Standalone/lf_tharexde.c b/armsrc/Standalone/lf_tharexde.c
new file mode 100644
index 000000000..c88437f4f
--- /dev/null
+++ b/armsrc/Standalone/lf_tharexde.c
@@ -0,0 +1,283 @@
+//-----------------------------------------------------------------------------
+// tharexde, 2021
+//
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// main code for EM4x50 simulator and collector aka THAREXDE
+//-----------------------------------------------------------------------------
+#include <inttypes.h>
+#include "ticks.h"
+#include "standalone.h"
+#include "proxmark3_arm.h"
+#include "appmain.h"
+#include "BigBuf.h"
+#include "commonutil.h"
+#include "fpgaloader.h"
+#include "util.h"
+#include "dbprint.h"
+#include "spiffs.h"
+#include "../em4x50.h"
+
+/*
+ * `lf_tharexde` simulates EM4x50 dumps uploaded to flash, reads words
+ * transmitted by EM4x50 tags in standard read mode and stores them in
+ * internal flash.
+ * It requires RDV4 hardware (for flash and battery).
+ *
+ * On entering stand-alone mode, this module will start simulating EM4x50 data.
+ * Data is read from eml dump file uploaded to flash memory (lf_em4x50_simulate.eml).
+ * If reader sends password different from dump file password, it is saved in
+ * file lf_em4x50_passwords.log in flash memory.
+ *
+ * On switching to read/record mode by pressing pm3 button, module will start
+ * reading EM4x50 data. Each collected data set will be written/appended to the
+ * logfile in flash (lf_em4x50_collect.log) as a text string.
+ *
+ * LEDs:
+ * - LED A: simulating
+ * - LED A blinking: no simulation data or read error
+ * - LED B: reading/recording
+ * - LED D: unmounting/sync'ing flash (normally < 100ms)
+ *
+ * To upload input file (eml format) to flash:
+ * - mem spiffs load f <filename> o lf_em4x50_simulate.eml
+ *
+ * To retrieve password file from flash:
+ * - mem spiffs dump o lf_em4x50_passwords.log f <filename>
+ *
+ * To retrieve log file from flash:
+ * - mem spiffs dump o lf_em4x50_collect.log f <filename>
+ *
+ * This module emits debug strings during normal operation -- so try it out in
+ * the lab connected to PM3 client before taking it into the field.
+ *
+ * To delete the input file from flash:
+ * - mem spiffs remove lf_em4x50_simulate.eml
+ *
+ * To delete the log file from flash:
+ * - mem spiffs remove lf_em4x50_passwords.log
+ *
+ * To delete the log file from flash:
+ * - mem spiffs remove lf_em4x50_collect.log
+ */
+
+#define STATE_SIM                       0
+#define STATE_READ                      1
+#define LF_EM4X50_INPUTFILE_SIM         "lf_em4x50_simulate.eml"
+#define LF_EM4X50_LOGFILE_SIM           "lf_em4x50_passwords.log"
+#define LF_EM4X50_LOGFILE_COLLECT       "lf_em4x50_collect.log"
+
+uint32_t gPassword;
+
+static void LoadDataInstructions(const char *inputfile) {
+    Dbprintf("");
+    Dbprintf("To load datafile to flash and display it:");
+    Dbprintf("1. edit input file %s", inputfile);
+    Dbprintf("2. start proxmark3 client");
+    Dbprintf("3. mem spiffs load f <filename> o %s", inputfile);
+    Dbprintf("4. start standalone mode");
+}
+
+static void DownloadLogInstructions(const char *logfile) {
+    Dbprintf("");
+    Dbprintf("To get the logfile from flash and display it:");
+    Dbprintf("1. mem spiffs dump o %s f <filename>", logfile);
+    Dbprintf("2. exit proxmark3 client");
+    Dbprintf("3. cat <filename>");
+}
+
+static bool get_input_data_from_file(uint32_t *tag, char *inputfile) {
+
+    size_t now = 0;
+
+    if (exists_in_spiffs(inputfile)) {
+
+        uint32_t size = size_in_spiffs(inputfile);
+        uint8_t *mem = BigBuf_malloc(size);
+
+        Dbprintf(_YELLOW_("found input file %s"), inputfile);
+
+        rdv40_spiffs_read_as_filetype(inputfile, mem, size, RDV40_SPIFFS_SAFETY_SAFE);
+
+        now = size / 9;
+        for (int i = 0; i < now; i++) {
+            for (int j = 0; j < 4; j++) {
+                tag[i] |= (hex2int(mem[2 * j + 9 * i]) << 4 | hex2int(mem[2 * j + 1 + 9 * i])) << ((3 - j) * 8);
+            }
+        }
+
+        Dbprintf(_YELLOW_("read tag data from input file"));
+    } else {
+        Dbprintf(_RED_("no input file %s"), inputfile);
+    }
+
+    BigBuf_free();
+
+    return ((now == EM4X50_NO_WORDS) && (tag[EM4X50_DEVICE_SERIAL] != tag[EM4X50_DEVICE_ID]));
+}
+
+static void append(const char *filename, uint8_t *entry, size_t entry_len) {
+    if (exists_in_spiffs(filename)) {
+        rdv40_spiffs_append(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
+    } else {
+        rdv40_spiffs_write(filename, entry, entry_len, RDV40_SPIFFS_SAFETY_SAFE);
+    }
+}
+
+void ModInfo(void) {
+    DbpString(_YELLOW_("  LF EM4x50 sim/collector mode") " - a.k.a tharexde");
+}
+
+void RunMod(void) {
+
+    bool state_change = true, read_ok = false;
+    int no_words = 0, command = 0;
+    uint8_t entry[400], state = STATE_SIM;
+    uint32_t tag[EM4X50_NO_WORDS] = {0x0};
+
+    rdv40_spiffs_lazy_mount();
+
+    StandAloneMode();
+    Dbprintf(_YELLOW_("Standalone mode THAREXDE started"));
+
+    for (;;) {
+
+        WDT_HIT();
+        if (data_available()) {
+            break;
+        }
+
+        // press button - toggle between SIM and READ
+        // hold button - exit
+        int button_pressed = BUTTON_CLICKED(1000);
+        if (button_pressed == BUTTON_SINGLE_CLICK) {
+
+            switch (state) {
+                case STATE_SIM:
+                    state = STATE_READ;
+                    break;
+                case STATE_READ:
+                    state = STATE_SIM;
+                    break;
+                default:
+                    break;
+            }
+
+            state_change = true;
+
+        } else if (button_pressed == BUTTON_HOLD) {
+            break;
+        }
+
+        if (state == STATE_SIM) {
+
+            if (state_change) {
+
+                LEDsoff();
+                LED_A_ON();
+                Dbprintf("");
+                Dbprintf(_YELLOW_("switched to EM4x50 simulating mode"));
+
+                read_ok = get_input_data_from_file(tag, LF_EM4X50_INPUTFILE_SIM);
+                if (read_ok) {
+                    Dbprintf(_YELLOW_("tag data ok"));
+                } else {
+                    Dbprintf(_RED_("error in tag data"));
+                    LoadDataInstructions(LF_EM4X50_INPUTFILE_SIM);
+                }
+
+                // init; start with command = standard read mode
+                em4x50_setup_sim();
+                gLogin = false;
+                LED_D_OFF();
+                gPassword = reflect32(tag[0]);
+                gWritePasswordProcess = false;
+                command = EM4X50_COMMAND_STANDARD_READ;
+
+                state_change = false;
+            }
+
+            // if no data or read error -> blink
+            if (read_ok == false) {
+                LED(LED_A, 200);
+                SpinDelay(200);
+            }
+
+            em4x50_handle_commands(&command, tag);
+
+            // check if new password was found
+            if (gPassword != reflect32(tag[EM4X50_DEVICE_PASSWORD])) {
+
+                Dbprintf("received password: %08"PRIx32"", gPassword);
+
+                // append password to logfile in flash memory
+                memset(entry, 0, sizeof(entry));
+                sprintf((char *)entry, "%08"PRIx32"\n", gPassword);
+                append(LF_EM4X50_LOGFILE_SIM, entry, strlen((char *)entry));
+
+                gPassword = reflect32(tag[EM4X50_DEVICE_PASSWORD]);
+            }
+
+            // if timeout (e.g. no reader field) continue with standard read
+            // mode and reset former authentication
+            if (command == PM3_ETIMEOUT) {
+                command = EM4X50_COMMAND_STANDARD_READ;
+                gLogin = false;
+                LED_D_OFF();
+            }
+
+        } else if (state == STATE_READ) {
+
+            if (state_change) {
+
+                LEDsoff();
+                LED_B_ON();
+                Dbprintf("");
+                Dbprintf(_YELLOW_("switched to EM4x50 reading mode\n"));
+
+                em4x50_setup_read();
+                state_change = false;
+            }
+
+            no_words = 0;
+            memset(tag, 0, sizeof(tag));
+            standard_read(&no_words, tag);
+
+            if (no_words > 0) {
+
+                memset(entry, 0, sizeof(entry));
+
+                sprintf((char *)entry, "found EM4x50 tag:\n");
+                for (int i = 0; i < no_words; i++) {
+                    sprintf((char *)entry + strlen((char *)entry), "%08"PRIx32"\n", tag[i]);
+                }
+                Dbprintf("%s", entry);
+                sprintf((char *)entry + strlen((char *)entry), "\n");
+                append(LF_EM4X50_LOGFILE_COLLECT, entry, strlen((char *)entry));
+            }
+        }
+
+        // reset timer
+        AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; // re-enable timer and wait for TC0
+        AT91C_BASE_TC0->TC_RC  = 0; // set TIOA (carry bit) on overflow, return to zero
+        AT91C_BASE_TC0->TC_RA  = 1; // clear carry bit on next clock cycle
+        AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG; // reset and re-enable timer
+    }
+
+    if (state == STATE_READ) {
+        DownloadLogInstructions(LF_EM4X50_LOGFILE_COLLECT);
+    } else {
+        DownloadLogInstructions(LF_EM4X50_LOGFILE_SIM);
+    }
+
+    LED_D_ON();
+    rdv40_spiffs_lazy_unmount();
+    LED_D_OFF();
+
+    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+    LEDsoff();
+    Dbprintf("");
+    Dbprintf(_YELLOW_("[=] Standalone mode THAREXDE stopped"));
+}
diff --git a/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md b/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
index 6dbe54d49..2ba6aeaba 100644
--- a/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
+++ b/doc/md/Use_of_Proxmark/4_Advanced-compilation-parameters.md
@@ -79,6 +79,7 @@ Here are the supported values you can assign to `STANDALONE` in `Makefile.platfo
 |-----------------|----------------------------------------|
 |                 | No standalone mode
 | LF_SKELETON     | standalone mode skeleton - Iceman1001
+| LF_THAREXDE     | LF EM4x50 simulator/read standalone mode - tharexde
 | LF_EM4100EMUL   | LF EM4100 simulator standalone mode - temskiy
 | LF_EM4100RSWB   | LF EM4100 read/write/clone/brute mode - Monster1024
 | LF_EM4100RWC    | LF EM4100 read/write/clone mode - temskiy

From 9593dd05adc31a013a6089f03bf660b6882f0db6 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 16 Feb 2021 15:36:39 +0100
Subject: [PATCH 587/682] lf search - rearrange checks to minimize number of
 false positives of indala

---
 client/src/cmdlf.c | 39 ++++++++++++++++++++++++---------------
 1 file changed, 24 insertions(+), 15 deletions(-)

diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index 2e8838f92..5696cdfad 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -1413,28 +1413,37 @@ int CmdLFfind(const char *Cmd) {
 
     int retval = PM3_SUCCESS;
 
-    if (demodVisa2k(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Visa2000 ID") " found!"); goto out;}
+    // ask / man
+    if (demodEM410x(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("EM410x ID") " found!"); goto out;}
     if (demodDestron(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("FDX-A FECAVA Destron ID") " found!"); goto out;} // to do before HID
+    if (demodGallagher(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("GALLAGHER ID") " found!"); goto out;}
+    if (demodNoralsy(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Noralsy ID") " found!"); goto out;}
+    if (demodPresco(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Presco ID") " found!"); goto out;}
+    if (demodSecurakey(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Securakey ID") " found!"); goto out;}
+    if (demodViking(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Viking ID") " found!"); goto out;}
+    if (demodVisa2k(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Visa2000 ID") " found!"); goto out;}
+
+    // ask / bi
+    if (demodFDXB(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("FDX-B ID") " found!"); goto out;}
+    if (demodJablotron(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Jablotron ID") " found!"); goto out;}
+    if (demodGuard(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Guardall G-Prox II ID") " found!"); goto out; }
+    if (demodNedap(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("NEDAP ID") " found!"); goto out;}
+
+    // nrz
+    if (demodPac(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("PAC/Stanley ID") " found!"); goto out;}
+
+    // fsk
     if (demodHID(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("HID Prox ID") " found!"); goto out;}
     if (demodAWID(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("AWID ID") " found!"); goto out;}
     if (demodIOProx(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("IO Prox ID") " found!"); goto out;}
+    if (demodPyramid(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Pyramid ID") " found!"); goto out;}
     if (demodParadox(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Paradox ID") " found!"); goto out;}
+    
+    // psk
+    if (demodIdteck(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Idteck ID") " found!"); goto out;}
+    if (demodKeri(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("KERI ID") " found!"); goto out;}
     if (demodNexWatch(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("NexWatch ID") " found!"); goto out;}
     if (demodIndala(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Indala ID") " found!");  goto out;}
-    if (demodEM410x(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("EM410x ID") " found!"); goto out;}
-    if (demodFDXB(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("FDX-B ID") " found!"); goto out;}
-    if (demodGuard(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Guardall G-Prox II ID") " found!"); goto out; }
-    if (demodIdteck(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Idteck ID") " found!"); goto out;}
-    if (demodJablotron(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Jablotron ID") " found!"); goto out;}
-    if (demodNedap(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("NEDAP ID") " found!"); goto out;}
-    if (demodNoralsy(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Noralsy ID") " found!"); goto out;}
-    if (demodKeri(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("KERI ID") " found!"); goto out;}
-    if (demodPac(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("PAC/Stanley ID") " found!"); goto out;}
-    if (demodPresco(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Presco ID") " found!"); goto out;}
-    if (demodPyramid(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Pyramid ID") " found!"); goto out;}
-    if (demodSecurakey(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Securakey ID") " found!"); goto out;}
-    if (demodViking(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Viking ID") " found!"); goto out;}
-    if (demodGallagher(true) == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("GALLAGHER ID") " found!"); goto out;}
 
 //    if (demodTI() == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Texas Instrument ID") " found!"); goto out;}
 //    if (demodFermax() == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "\nValid " _GREEN_("Fermax ID") " found!"); goto out;}

From be25db28048d06b58b9851d8915a69a24eeb8402 Mon Sep 17 00:00:00 2001
From: Akif Dinc <akif@dinc.org>
Date: Tue, 16 Feb 2021 20:53:53 +0100
Subject: [PATCH 588/682] Adding Figurine Type ID and Figurine ID parameters
 for hf jooki

---
 client/src/cmdhfjooki.c | 39 +++++++++++++++++++++++++++++++++------
 1 file changed, 33 insertions(+), 6 deletions(-)

diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index 82e3787e6..5144a90a7 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -278,7 +278,8 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
                   "Encode a Jooki token to base64 NDEF URI format",
                   "hf jooki encode -t            --> selftest\n"
                   "hf jooki encode -r --dragon   --> read uid from tag and use for encoding\n"
-                  "hf jooki encode --uid 04010203040506 --dragon"
+                  "hf jooki encode --uid 04010203040506 --dragon\n"
+						"hf jooki encode --uid 04010203040506 -y 1 -f 1"
                  );
 
     void *argtable[] = {
@@ -300,6 +301,8 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
         arg_lit0(NULL, "whitefox", "figurine type"),
         arg_lit0(NULL, "whiteknight", "figurine type"),
         arg_lit0(NULL, "whitewhale", "figurine type"),
+		  arg_u64_0("y", "tid", "<dec>", "figurine type id"),
+		  arg_u64_0("f", "fid", "<dec>", "figurine id"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);
@@ -328,18 +331,42 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
     bool tb = arg_get_lit(ctx, 15);
     bool tc = arg_get_lit(ctx, 16);
     bool td = arg_get_lit(ctx, 17);
+
+	 bool figure_abbr = true;
+
+	 uint8_t ftid = arg_get_u32_def(ctx, 18, 0);
+	 uint8_t ffid = arg_get_u32_def(ctx, 19, 0); //default 0 ist schlecht
+
     CLIParserFree(ctx);
     
     if (selftest) {
         return jooki_selftest();
     }
 
-    if ((t0 + t1 + t2 + t3 + t5 + t6 + t7 + t8 + t9 + ta + tb + tc + td) > 1) {
-        PrintAndLogEx(ERR, "Select one tag type");
+	 uint8_t tid, fid;
+
+	 if( ftid && ffid ) {
+		 figure_abbr = true;
+		 tid = 0x01;
+		 fid = 0x00;
+	 }
+
+	 if ( ftid > 0x04 || ffid > 0x20 ) {
+        PrintAndLogEx(ERR, "Use a valid Figure Type ID and Figure ID");
         return PM3_EINVARG;
-    }
-    uint8_t tid = 0x01;
-    uint8_t fid = 0x00;
+    } else {
+		 figure_abbr = false;
+	 }
+
+    if ((t0 + t1 + t2 + t3 + t5 + t6 + t7 + t8 + t9 + ta + tb + tc + td) > 1 && !figure_abbr) {
+        PrintAndLogEx(ERR, "Select one tag type or use figurine type id and figurine id");
+        return PM3_EINVARG;
+    } else {
+    	tid = ftid;
+    	fid = ffid;
+	 }
+
+	 PrintAndLogEx(INFO, "Figurine Type ID %u and Figurine ID %u ", ftid, ffid);
     if (t1)
         fid = 0x01;
     if (t2)

From 5c385e8f2fc3ab389889d6d80dbff9021dc6dcff Mon Sep 17 00:00:00 2001
From: Akif Dinc <akif@dinc.org>
Date: Tue, 16 Feb 2021 20:55:48 +0100
Subject: [PATCH 589/682] Changes to Jooki command codes

---
 client/src/cmdhfjooki.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index 5144a90a7..d31218b08 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -67,7 +67,7 @@ jooki_figure_t jooks_figures[] = {
     {0x01, 0x0C, "White Knight", "Figurine"},
     {0x01, 0x0D, "White Whale", "Figurine"},
 
-    {0x02, 0x01, "Generic Flat", "Stone"},
+    {0x02, 0x00, "Generic Flat", "Stone"},
 
     {0x03, 0x00, "record", "Sys"},
     {0x03, 0x01, "factory_mode_on", "Sys"},
@@ -77,9 +77,10 @@ jooki_figure_t jooks_figures[] = {
     {0x03, 0x05, "toy_safe_on", "Sys"},
     {0x03, 0x06, "toy_safe_off", "Sys"},
     {0x03, 0x07, "wifi_on", "Sys"},
-    {0x03, 0x08, "bt_on", "Sys"},
-    {0x03, 0x0a, "bt_off", "Sys"},
-    {0x03, 0x0b, "production_finished", "Sys"},
+    {0x03, 0x08, "wifi_off", "Sys"},
+    {0x03, 0x09, "bt_on", "Sys"},
+    {0x03, 0x0A, "bt_off", "Sys"},
+    {0x03, 0x0B, "production_finished", "Sys"},
 
     {0x04, 0x00, "test.0", "Test"},
     {0x04, 0x01, "test.1", "Test"},

From 76b73b26d360330b03eccd9f032d399522d35f96 Mon Sep 17 00:00:00 2001
From: Akif Dinc <akif@dinc.org>
Date: Tue, 16 Feb 2021 22:34:39 +0100
Subject: [PATCH 590/682] Fixing short commands for figurine names

---
 client/src/cmdhfjooki.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index d31218b08..df7cba428 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -348,8 +348,6 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
 
 	 if( ftid && ffid ) {
 		 figure_abbr = true;
-		 tid = 0x01;
-		 fid = 0x00;
 	 }
 
 	 if ( ftid > 0x04 || ffid > 0x20 ) {
@@ -363,7 +361,7 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
         PrintAndLogEx(ERR, "Select one tag type or use figurine type id and figurine id");
         return PM3_EINVARG;
     } else {
-    	tid = ftid;
+    	tid = 0x01;
     	fid = ffid;
 	 }
 

From 23be1158c6dc8818b1343a02acb8dba69545e8c2 Mon Sep 17 00:00:00 2001
From: Akif Dinc <akif@dinc.org>
Date: Tue, 16 Feb 2021 22:37:17 +0100
Subject: [PATCH 591/682] Remove useless comment

---
 client/src/cmdhfjooki.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index df7cba428..c6b14914f 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -336,7 +336,7 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
 	 bool figure_abbr = true;
 
 	 uint8_t ftid = arg_get_u32_def(ctx, 18, 0);
-	 uint8_t ffid = arg_get_u32_def(ctx, 19, 0); //default 0 ist schlecht
+	 uint8_t ffid = arg_get_u32_def(ctx, 19, 0); 
 
     CLIParserFree(ctx);
     

From bb823762fa7c2f700bd6532bf460410e68708d25 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 16 Feb 2021 22:40:54 +0100
Subject: [PATCH 592/682] textual

---
 client/src/cmdhfmfu.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index 94fff01ea..926642e1d 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -1385,17 +1385,17 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
             }
             if (len < 1) {
                 PrintAndLogEx(WARNING, _YELLOW_("password not known"));
-                PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mfu pwdgen r`") " to get see known pwd gen algo suggestions");
+                PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mfu pwdgen -r`") " to get see known pwd gen algo suggestions");
             }
         } else {
-            PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mfu pwdgen r`") " to get see known pwd gen algo suggestions");
+            PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mfu pwdgen -r`") " to get see known pwd gen algo suggestions");
         }
     }
 out:
     DropField();
     if (locked) {
         PrintAndLogEx(INFO, "\nTag appears to be locked, try using a key to get more info");
-        PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mfu pwdgen r`") " to get see known pwd gen algo suggestions");
+        PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mfu pwdgen -r`") " to get see known pwd gen algo suggestions");
     }
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;

From f7359bcc656041db5da3e30167ce897678375a48 Mon Sep 17 00:00:00 2001
From: Akif Dinc <akif@dinc.org>
Date: Tue, 16 Feb 2021 23:30:40 +0100
Subject: [PATCH 593/682] Fixing bug in tid selection

---
 client/src/cmdhfjooki.c | 40 ++++++++++++++++++++++++----------------
 1 file changed, 24 insertions(+), 16 deletions(-)

diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index c6b14914f..7c2d9aa08 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -280,7 +280,7 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
                   "hf jooki encode -t            --> selftest\n"
                   "hf jooki encode -r --dragon   --> read uid from tag and use for encoding\n"
                   "hf jooki encode --uid 04010203040506 --dragon\n"
-						"hf jooki encode --uid 04010203040506 -y 1 -f 1"
+						"hf jooki encode --uid 04010203040506 --tid 1 --fid 1"
                  );
 
     void *argtable[] = {
@@ -302,8 +302,8 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
         arg_lit0(NULL, "whitefox", "figurine type"),
         arg_lit0(NULL, "whiteknight", "figurine type"),
         arg_lit0(NULL, "whitewhale", "figurine type"),
-		  arg_u64_0("y", "tid", "<dec>", "figurine type id"),
-		  arg_u64_0("f", "fid", "<dec>", "figurine id"),
+		  arg_u64_0(NULL, "tid", "<dec>", "figurine type id"),
+		  arg_u64_0(NULL, "fid", "<dec>", "figurine id"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);
@@ -333,11 +333,11 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
     bool tc = arg_get_lit(ctx, 16);
     bool td = arg_get_lit(ctx, 17);
 
-	 bool figure_abbr = true;
-
 	 uint8_t ftid = arg_get_u32_def(ctx, 18, 0);
 	 uint8_t ffid = arg_get_u32_def(ctx, 19, 0); 
 
+	 bool figure_abbr = true;
+
     CLIParserFree(ctx);
     
     if (selftest) {
@@ -346,26 +346,34 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
 
 	 uint8_t tid, fid;
 
-	 if( ftid && ffid ) {
-		 figure_abbr = true;
+	 if( ftid || ffid ) {
+		 figure_abbr = false;
 	 }
 
 	 if ( ftid > 0x04 || ffid > 0x20 ) {
         PrintAndLogEx(ERR, "Use a valid Figure Type ID and Figure ID");
         return PM3_EINVARG;
-    } else {
-		 figure_abbr = false;
-	 }
+    } 
+	 
+	 uint8_t figure_abbr_val = t0 + t1 + t2 + t3 + t5 + t6 + t7 + t8 + t9 + ta + tb + tc + td;
 
-    if ((t0 + t1 + t2 + t3 + t5 + t6 + t7 + t8 + t9 + ta + tb + tc + td) > 1 && !figure_abbr) {
+    if (figure_abbr_val > 1) {
         PrintAndLogEx(ERR, "Select one tag type or use figurine type id and figurine id");
         return PM3_EINVARG;
-    } else {
-    	tid = 0x01;
-    	fid = ffid;
-	 }
+	 } 
+
+	 if (figure_abbr_val == 1 && !figure_abbr) {
+        PrintAndLogEx(ERR, "Use either --tid and --fid or one of the figurine types");
+        return PM3_EINVARG;
+    } 
+
+	 if (figure_abbr) {
+		  tid = 0x01;
+	 } else {
+		  tid = ftid;
+	 }
+	 fid = ffid;
 
-	 PrintAndLogEx(INFO, "Figurine Type ID %u and Figurine ID %u ", ftid, ffid);
     if (t1)
         fid = 0x01;
     if (t2)

From 45fea410844bd5ab3429693adccbd633c2876839 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 17 Feb 2021 07:32:38 +0100
Subject: [PATCH 594/682] text

---
 client/src/cmdwiegand.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdwiegand.c b/client/src/cmdwiegand.c
index 55e4d6e9c..3cdeb66b3 100644
--- a/client/src/cmdwiegand.c
+++ b/client/src/cmdwiegand.c
@@ -60,7 +60,7 @@ int CmdWiegandEncode(const char *Cmd) {
         arg_u64_0(NULL, "issue", "<dec>", "issue level"),
         arg_u64_0(NULL, "oem", "<dec>", "OEM code"),
         arg_str0("w", "wiegand", "<format>", "see `wiegand list` for available formats"),
-        arg_lit0(NULL, "pre", "add HID preamble to wiegand"),
+        arg_lit0(NULL, "pre", "add HID ProxII preamble to wiegand output"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, true);

From b979ed3e17b5427c11c2dad603acc3ad5f09803a Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 17 Feb 2021 07:33:29 +0100
Subject: [PATCH 595/682] style

---
 client/src/cmdhfjooki.c | 132 ++++++++++++++++++++--------------------
 1 file changed, 66 insertions(+), 66 deletions(-)

diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index 7c2d9aa08..a513109a0 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -40,7 +40,7 @@ typedef struct {
 // sample set for selftest.
 jooki_test_t jooks[] = {
     { {0x04, 0xDA, 0xB7, 0x6A, 0xE7, 0x4C, 0x80}, "ruxow8lnn88uyeX+", 0x01, 0x00},
-    { {0x04, 0xf0, 0x22, 0xc2, 0x33, 0x5e, 0x80}, "\0", 0x01 , 0x00},
+    { {0x04, 0xf0, 0x22, 0xc2, 0x33, 0x5e, 0x80}, "\0", 0x01, 0x00},
     { {0x04, 0x8C, 0xEC, 0xDA, 0xF0, 0x4A, 0x80}, "ONrsVf7jX6IaSNV6", 0x01, 0x01},
     { {0x04, 0x92, 0xA7, 0x6A, 0xE7, 0x4C, 0x81}, "Hjjpcx/mZwuveTF+", 0x01, 0x02},
     { {0x04, 0xD0, 0xB0, 0x3A, 0xD3, 0x63, 0x80}, "\0", 0x01, 0x02},
@@ -59,11 +59,11 @@ jooki_figure_t jooks_figures[] = {
     {0x01, 0x04, "ThankYou", "Figurine"},
     {0x01, 0x05, "Whale", "Figurine"},
     {0x01, 0x06, "Black Dragon", "Figurine"},
-    {0x01, 0x07, "Black Fox", "Figurine"}, 
+    {0x01, 0x07, "Black Fox", "Figurine"},
     {0x01, 0x08, "Black Knight", "Figurine"},
     {0x01, 0x09, "Black Whale", "Figurine"},
     {0x01, 0x0A, "White Dragon", "Figurine"},
-    {0x01, 0x0B, "White Fox", "Figurine"}, 
+    {0x01, 0x0B, "White Fox", "Figurine"},
     {0x01, 0x0C, "White Knight", "Figurine"},
     {0x01, 0x0D, "White Whale", "Figurine"},
 
@@ -106,7 +106,7 @@ jooki_figure_t jooks_figures[] = {
 };
 
 static int jooki_lookup(uint8_t tid, uint8_t fid) {
-    for (int i=0; i < ARRAYLEN(jooks_figures); i++) {
+    for (int i = 0; i < ARRAYLEN(jooks_figures); i++) {
         jooki_figure_t tmp = jooks_figures[i];
         if (tmp.typeid == tid && tmp.figureid == fid) {
             return i;
@@ -127,7 +127,7 @@ static int jooki_encode(uint8_t *iv, uint8_t tid, uint8_t fid, uint8_t *uid, uin
     if (out == NULL) {
         PrintAndLogEx(ERR, "(encode jooki) base64ndef param is NULL");
         return PM3_EINVARG;
-    }    
+    }
 
     out[0] = 0x00;
     if (iv == NULL || uid == NULL) {
@@ -135,7 +135,7 @@ static int jooki_encode(uint8_t *iv, uint8_t tid, uint8_t fid, uint8_t *uid, uin
         return PM3_EINVARG;
     }
 
-    uint8_t d[JOOKI_PLAIN_LEN] = {iv[0], iv[1],iv[2], tid, fid, uid[0], uid[1], uid[2], uid[3], uid[4], uid[5], uid[6]};
+    uint8_t d[JOOKI_PLAIN_LEN] = {iv[0], iv[1], iv[2], tid, fid, uid[0], uid[1], uid[2], uid[3], uid[4], uid[5], uid[6]};
     uint8_t enc[JOOKI_PLAIN_LEN] = {0};
     for (uint8_t i = 0; i < JOOKI_PLAIN_LEN; i++) {
 
@@ -150,7 +150,7 @@ static int jooki_encode(uint8_t *iv, uint8_t tid, uint8_t fid, uint8_t *uid, uin
     size_t b64len = 0;
     uint8_t b64[20];
     memset(b64, 0, 20);
-    mbedtls_base64_encode(b64, sizeof(b64), &b64len, (const unsigned char*)enc, sizeof(enc));
+    mbedtls_base64_encode(b64, sizeof(b64), &b64len, (const unsigned char *)enc, sizeof(enc));
     memcpy(out, b64, b64len);
     return PM3_SUCCESS;
 }
@@ -158,7 +158,7 @@ static int jooki_encode(uint8_t *iv, uint8_t tid, uint8_t fid, uint8_t *uid, uin
 static int jooki_decode(uint8_t *b64, uint8_t *result) {
     uint8_t ndef[JOOKI_PLAIN_LEN] = {0};
     size_t outputlen = 0;
-    mbedtls_base64_decode(ndef, sizeof(ndef), &outputlen, (const unsigned char*)b64, 16);
+    mbedtls_base64_decode(ndef, sizeof(ndef), &outputlen, (const unsigned char *)b64, 16);
 
     PrintAndLogEx(DEBUG, "(decode_jooki) raw encoded... " _GREEN_("%s"), sprint_hex(ndef, sizeof(ndef)));
 
@@ -178,11 +178,11 @@ static int jooki_create_ndef(uint8_t *b64ndef, uint8_t *ndefrecord) {
         PrintAndLogEx(ERR, "(jooki_create_ndef) ndefrecord param is NULL");
         return PM3_EINVARG;
     }
-    memcpy(ndefrecord, 
-        "\x01\x03\xa0\x0c\x34\x03\x29\xd1"
-        "\x01\x25\x55\x04\x73\x2e\x6a\x6f"
-        "\x6f\x6b\x69\x2e\x72\x6f\x63\x6b"
-        "\x73\x2f\x73\x2f\x3f\x73\x3d", 31);
+    memcpy(ndefrecord,
+           "\x01\x03\xa0\x0c\x34\x03\x29\xd1"
+           "\x01\x25\x55\x04\x73\x2e\x6a\x6f"
+           "\x6f\x6b\x69\x2e\x72\x6f\x63\x6b"
+           "\x73\x2f\x73\x2f\x3f\x73\x3d", 31);
     memcpy(ndefrecord + 31, b64ndef, 16);
     memcpy(ndefrecord + 47, "\x0a\xFE\x00\x00\x00", 5);
     return PM3_SUCCESS;
@@ -193,13 +193,13 @@ static void jooki_printEx(uint8_t *b64, uint8_t *iv, uint8_t tid, uint8_t fid, u
 
     PrintAndLogEx(INFO, "Encoded URL.. %s ( %s )", sprint_hex(b64, 12), b64);
     PrintAndLogEx(INFO, "Figurine..... %02x %02x - " _GREEN_("%s, %s")
-        , tid
-        , fid
-        , (idx != -1) ?  jooks_figures[idx].typedesc : "n/a" 
-        , (idx != -1) ?  jooks_figures[idx].figdesc : "n/a"
-        );
-    PrintAndLogEx(INFO, "iv........... %s", sprint_hex(iv, JOOKI_IV_LEN));  
-    PrintAndLogEx(INFO, "uid.......... %s", sprint_hex(uid, JOOKI_UID_LEN));  
+                  , tid
+                  , fid
+                  , (idx != -1) ?  jooks_figures[idx].typedesc : "n/a"
+                  , (idx != -1) ?  jooks_figures[idx].figdesc : "n/a"
+                 );
+    PrintAndLogEx(INFO, "iv........... %s", sprint_hex(iv, JOOKI_IV_LEN));
+    PrintAndLogEx(INFO, "uid.......... %s", sprint_hex(uid, JOOKI_UID_LEN));
 
     uint8_t ndefmsg[52] = {0};
     jooki_create_ndef(b64, ndefmsg);
@@ -228,8 +228,8 @@ static void jooki_print(uint8_t *b64, uint8_t *result, bool verbose) {
 }
 
 static int jooki_selftest(void) {
-    
-    PrintAndLogEx(INFO, "======== " _CYAN_("selftest") " ==========================================="); 
+
+    PrintAndLogEx(INFO, "======== " _CYAN_("selftest") " ===========================================");
     for (int i = 0; i < ARRAYLEN(jooks); i++) {
         if (strlen(jooks[i].b64) == 0)
             continue;
@@ -237,38 +237,38 @@ static int jooki_selftest(void) {
         uint8_t iv[JOOKI_IV_LEN] = {0};
         uint8_t uid[JOOKI_UID_LEN] = {0};
         uint8_t result[JOOKI_PLAIN_LEN] = {0};
-        jooki_decode((uint8_t*)jooks[i].b64, result);
+        jooki_decode((uint8_t *)jooks[i].b64, result);
 
         memcpy(iv, result, JOOKI_IV_LEN);
         uint8_t tid = result[3];
         uint8_t fid = result[4];
         memcpy(uid, result + 5, sizeof(uid));
 
-        bool tid_ok = (tid == jooks[i].typeid); 
-        bool fid_ok = (fid == jooks[i].figureid); 
+        bool tid_ok = (tid == jooks[i].typeid);
+        bool fid_ok = (fid == jooks[i].figureid);
         bool uid_ok = (memcmp(uid, jooks[i].uid, sizeof(uid)) == 0);
 
         int idx = jooki_lookup(tid, fid);
 
-        PrintAndLogEx(INFO, "Encoded URL.. %s ( %s )", sprint_hex((const uint8_t*)jooks[i].b64, 12), jooks[i].b64);
-        PrintAndLogEx(INFO, "Type......... %02x - " _GREEN_("%s") " ( %s )", tid, (idx != -1) ? jooks_figures[idx].typedesc : "n/a", tid_ok ? _GREEN_("ok") : _RED_("fail"));  
-        PrintAndLogEx(INFO, "Figurine..... %02x - " _GREEN_("%s") " ( %s )", fid, (idx != -1) ? jooks_figures[idx].figdesc : "n/a", fid_ok ? _GREEN_("ok") : _RED_("fail"));  
-        PrintAndLogEx(INFO, "iv........... %s", sprint_hex(iv, sizeof(iv)));  
-        PrintAndLogEx(INFO, "uid.......... %s ( %s )", sprint_hex(uid, sizeof(uid)), uid_ok ? _GREEN_("ok") : _RED_("fail"));          
+        PrintAndLogEx(INFO, "Encoded URL.. %s ( %s )", sprint_hex((const uint8_t *)jooks[i].b64, 12), jooks[i].b64);
+        PrintAndLogEx(INFO, "Type......... %02x - " _GREEN_("%s") " ( %s )", tid, (idx != -1) ? jooks_figures[idx].typedesc : "n/a", tid_ok ? _GREEN_("ok") : _RED_("fail"));
+        PrintAndLogEx(INFO, "Figurine..... %02x - " _GREEN_("%s") " ( %s )", fid, (idx != -1) ? jooks_figures[idx].figdesc : "n/a", fid_ok ? _GREEN_("ok") : _RED_("fail"));
+        PrintAndLogEx(INFO, "iv........... %s", sprint_hex(iv, sizeof(iv)));
+        PrintAndLogEx(INFO, "uid.......... %s ( %s )", sprint_hex(uid, sizeof(uid)), uid_ok ? _GREEN_("ok") : _RED_("fail"));
 
         uint8_t b64[JOOKI_B64_LEN] = {0};
-        memset(b64, 0, sizeof(b64));        
+        memset(b64, 0, sizeof(b64));
         jooki_encode(iv, tid, fid, uid, b64);
 
         uint8_t ndefmsg[52] = {0};
         jooki_create_ndef(b64, ndefmsg);
         PrintAndLogEx(INFO, "NDEF raw .... %s", sprint_hex(ndefmsg, sizeof(ndefmsg)));
-        
+
         int status = NDEFRecordsDecodeAndPrint(ndefmsg, sizeof(ndefmsg));
-        if ( status != PM3_SUCCESS) {
+        if (status != PM3_SUCCESS) {
             status = NDEFDecodeAndPrint(ndefmsg, sizeof(ndefmsg), true);
         }
-        PrintAndLogEx(INFO, "==================================================================");     
+        PrintAndLogEx(INFO, "==================================================================");
     }
     return PM3_SUCCESS;
 }
@@ -280,7 +280,7 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
                   "hf jooki encode -t            --> selftest\n"
                   "hf jooki encode -r --dragon   --> read uid from tag and use for encoding\n"
                   "hf jooki encode --uid 04010203040506 --dragon\n"
-						"hf jooki encode --uid 04010203040506 --tid 1 --fid 1"
+                  "hf jooki encode --uid 04010203040506 --tid 1 --fid 1"
                  );
 
     void *argtable[] = {
@@ -302,8 +302,8 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
         arg_lit0(NULL, "whitefox", "figurine type"),
         arg_lit0(NULL, "whiteknight", "figurine type"),
         arg_lit0(NULL, "whitewhale", "figurine type"),
-		  arg_u64_0(NULL, "tid", "<dec>", "figurine type id"),
-		  arg_u64_0(NULL, "fid", "<dec>", "figurine id"),
+        arg_u64_0(NULL, "tid", "<dec>", "figurine type id"),
+        arg_u64_0(NULL, "fid", "<dec>", "figurine id"),
         arg_param_end
     };
     CLIExecWithReturn(ctx, Cmd, argtable, false);
@@ -333,46 +333,46 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
     bool tc = arg_get_lit(ctx, 16);
     bool td = arg_get_lit(ctx, 17);
 
-	 uint8_t ftid = arg_get_u32_def(ctx, 18, 0);
-	 uint8_t ffid = arg_get_u32_def(ctx, 19, 0); 
+    uint8_t ftid = arg_get_u32_def(ctx, 18, 0);
+    uint8_t ffid = arg_get_u32_def(ctx, 19, 0);
 
-	 bool figure_abbr = true;
+    bool figure_abbr = true;
 
     CLIParserFree(ctx);
-    
+
     if (selftest) {
         return jooki_selftest();
     }
 
-	 uint8_t tid, fid;
+    uint8_t tid, fid;
 
-	 if( ftid || ffid ) {
-		 figure_abbr = false;
-	 }
+    if (ftid || ffid) {
+        figure_abbr = false;
+    }
 
-	 if ( ftid > 0x04 || ffid > 0x20 ) {
+    if (ftid > 0x04 || ffid > 0x20) {
         PrintAndLogEx(ERR, "Use a valid Figure Type ID and Figure ID");
         return PM3_EINVARG;
-    } 
-	 
-	 uint8_t figure_abbr_val = t0 + t1 + t2 + t3 + t5 + t6 + t7 + t8 + t9 + ta + tb + tc + td;
+    }
+
+    uint8_t figure_abbr_val = t0 + t1 + t2 + t3 + t5 + t6 + t7 + t8 + t9 + ta + tb + tc + td;
 
     if (figure_abbr_val > 1) {
         PrintAndLogEx(ERR, "Select one tag type or use figurine type id and figurine id");
         return PM3_EINVARG;
-	 } 
+    }
 
-	 if (figure_abbr_val == 1 && !figure_abbr) {
+    if (figure_abbr_val == 1 && !figure_abbr) {
         PrintAndLogEx(ERR, "Use either --tid and --fid or one of the figurine types");
         return PM3_EINVARG;
-    } 
+    }
 
-	 if (figure_abbr) {
-		  tid = 0x01;
-	 } else {
-		  tid = ftid;
-	 }
-	 fid = ffid;
+    if (figure_abbr) {
+        tid = 0x01;
+    } else {
+        tid = ftid;
+    }
+    fid = ffid;
 
     if (t1)
         fid = 0x01;
@@ -413,8 +413,8 @@ static int CmdHF14AJookiEncode(const char *Cmd) {
     }
 
     uint8_t b64[JOOKI_B64_LEN] = {0};
-    memset(b64, 0, sizeof(b64));        
-    jooki_encode(iv, tid, fid, uid, b64);  
+    memset(b64, 0, sizeof(b64));
+    jooki_encode(iv, tid, fid, uid, b64);
     jooki_printEx(b64, iv, tid, fid, uid, verbose);
     return PM3_SUCCESS;
 }
@@ -484,7 +484,7 @@ static int CmdHF14AJookiSim(const char *Cmd) {
     uint8_t *data = calloc(144, sizeof(uint8_t));
 
     memcpy(data, uid, 3);
-    memcpy(data + (1*4), uid + 3, 4);
+    memcpy(data + (1 * 4), uid + 3, 4);
 
     // bbc0
     data[3] = 0x88 ^ data[0] ^ data[1] ^ data[2];
@@ -492,8 +492,8 @@ static int CmdHF14AJookiSim(const char *Cmd) {
     // bbc1
     data[8] = data[4] ^ data[5] ^ data[6] ^ data[7];
 
-    // copy NDEF magic firs, skip BBC1 
-    memcpy(data + (2*4) + 1, "\x48\x00\x00\xE1\x10\x12\x00", 7);
+    // copy NDEF magic firs, skip BBC1
+    memcpy(data + (2 * 4) + 1, "\x48\x00\x00\xE1\x10\x12\x00", 7);
 
     // copy raw NDEF
     jooki_create_ndef(b64, data + (4 * 4));
@@ -568,12 +568,12 @@ static int CmdHF14AJookiSim(const char *Cmd) {
         if (WaitForResponseTimeout(CMD_HF_MIFARE_SIMULATE, &resp, 1500) == 0)
             continue;
 
-        if (resp.status != PM3_SUCCESS) 
+        if (resp.status != PM3_SUCCESS)
             break;
     }
     free(data);
     PrintAndLogEx(INFO, "Done");
-    PrintAndLogEx(HINT, "Try `" _YELLOW_("hf 14a list") "` to view trace log" );
+    PrintAndLogEx(HINT, "Try `" _YELLOW_("hf 14a list") "` to view trace log");
     return PM3_SUCCESS;
 }
 
@@ -651,7 +651,7 @@ static int CmdHF14AJookiClone(const char *Cmd) {
     }
 
     PrintAndLogEx(INFO, "Done");
-    PrintAndLogEx(HINT, "Try `" _YELLOW_("hf mfu ndef") "` to view" );
+    PrintAndLogEx(HINT, "Try `" _YELLOW_("hf mfu ndef") "` to view");
     return PM3_SUCCESS;
 }
 

From 563f703d6a4628ce2e02e00fdf34e85f4a119455 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 17 Feb 2021 08:56:42 +0100
Subject: [PATCH 596/682] lf hid clone - hooked up the binary input

---
 client/src/cmdlfhid.c | 13 ++++++++++---
 client/src/util.c     | 30 +++++++++++++++++++++++++++---
 client/src/util.h     |  1 +
 3 files changed, 38 insertions(+), 6 deletions(-)

diff --git a/client/src/cmdlfhid.c b/client/src/cmdlfhid.c
index 47eeca45b..319fbc9e6 100644
--- a/client/src/cmdlfhid.c
+++ b/client/src/cmdlfhid.c
@@ -356,11 +356,9 @@ static int CmdHIDClone(const char *Cmd) {
     bool q5 = arg_get_lit(ctx, 7);
     bool em = arg_get_lit(ctx, 8);
 
-
     int bin_len = 63;
     uint8_t bin[70] = {0};
     CLIGetStrWithReturn(ctx, 9, bin, &bin_len);
-
     CLIParserFree(ctx);
 
     if (q5 && em) {
@@ -383,12 +381,21 @@ static int CmdHIDClone(const char *Cmd) {
         return PM3_EINVARG;
     }
 
+    uint32_t top = 0, mid = 0, bot = 0;
     if (raw_len) {
-        uint32_t top = 0, mid = 0, bot = 0;
         hexstring_to_u96(&top, &mid, &bot, raw);
         packed.Top = top;
         packed.Mid = mid;
         packed.Bot = bot;
+    } else if (bin_len) {
+        int res = binstring_to_u96(&top, &mid, &bot, bin);
+        if (res != bin_len) {
+            PrintAndLogEx(ERR, "Binary string contains none <0|1> chars");
+            return PM3_EINVARG;
+        }
+        packed.Top = top;
+        packed.Mid = mid;
+        packed.Bot = bot;
     } else {
         if (HIDPack(format_idx, &card, &packed, true) == false) {
             PrintAndLogEx(WARNING, "The card data could not be encoded in the selected format.");
diff --git a/client/src/util.c b/client/src/util.c
index 03a1e68f8..53825f28b 100644
--- a/client/src/util.c
+++ b/client/src/util.c
@@ -951,13 +951,13 @@ char *str_ndup(const char *src, size_t len) {
 }
 
 /**
- * Converts a hex string to component "hi2", "hi" and "lo" 32-bit integers, one nibble
- * at a time.
+ * Converts a hex string to component "hi2", "hi" and "lo" 32-bit integers
+ * one nibble at a time.
  *
  * Returns the number of nibbles (4 bits) entered.
  */
 int hexstring_to_u96(uint32_t *hi2, uint32_t *hi, uint32_t *lo, const char *str) {
-    unsigned int n = 0, i = 0;
+    uint32_t n = 0, i = 0;
 
     while (sscanf(&str[i++], "%1x", &n) == 1) {
         *hi2 = (*hi2 << 4) | (*hi >> 28);
@@ -967,6 +967,30 @@ int hexstring_to_u96(uint32_t *hi2, uint32_t *hi, uint32_t *lo, const char *str)
     return i - 1;
 }
 
+/**
+ * Converts a binary string to component "hi2", "hi" and "lo" 32-bit integers,
+ * one bit at a time.
+ *
+ * Returns the number of bits entered.
+ */
+int binstring_to_u96(uint32_t *hi2, uint32_t *hi, uint32_t *lo, const char *str) {
+    uint32_t n = 0, i = 0;
+
+    for(;;) {
+
+        int res = sscanf(&str[i], "%1u", &n);
+        if ((res != 1) || (n > 1))
+            break;
+
+        *hi2 = (*hi2 << 1) | (*hi >> 31);
+        *hi = (*hi << 1) | (*lo >> 31);
+        *lo = (*lo << 1) | (n & 0x1);
+
+        i++;
+    }
+    return i;
+}
+
 inline uint32_t bitcount32(uint32_t a) {
 #if defined __GNUC__
     return __builtin_popcountl(a);
diff --git a/client/src/util.h b/client/src/util.h
index 4d86553c2..7577c216e 100644
--- a/client/src/util.h
+++ b/client/src/util.h
@@ -105,6 +105,7 @@ void strcreplace(char *buf, size_t len, char from, char to);
 char *str_dup(const char *src);
 char *str_ndup(const char *src, size_t len);
 int hexstring_to_u96(uint32_t *hi2, uint32_t *hi, uint32_t *lo, const char *str);
+int binstring_to_u96(uint32_t *hi2, uint32_t *hi, uint32_t *lo, const char *str);
 
 uint32_t bitcount32(uint32_t a);
 uint64_t bitcount64(uint64_t a);

From 0a405ca21ea9be6ae71255670f86e492353c1bef Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 17 Feb 2021 08:57:22 +0100
Subject: [PATCH 597/682] text

---
 doc/commands.md | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/doc/commands.md b/doc/commands.md
index c6411b58c..1c9938d16 100644
--- a/doc/commands.md
+++ b/doc/commands.md
@@ -143,7 +143,7 @@ Check column "offline" for their availability.
 |`hf 14a raw             `|N       |`Send raw hex data to tag`
 |`hf 14a antifuzz        `|N       |`Fuzzing the anticollision phase.  Warning! Readers may react strange`
 |`hf 14a config          `|N       |`Configure 14a settings (use with caution)`
-|`hf 14a apdufind        `|N       |`Enuerate APDUs - CLA/INS/P1P2`
+|`hf 14a apdufind        `|N       |`Enumerate APDUs - CLA/INS/P1P2`
 
 
 ### hf 14b
@@ -255,6 +255,19 @@ Check column "offline" for their availability.
 |`hf fido assert         `|N       |`FIDO2 GetAssertion command.`
 
 
+### hf jooki
+
+ { Jooki RFIDs...                      }
+
+|command                  |offline |description
+|-------                  |------- |-----------
+|`hf jooki help          `|Y       |`This help`
+|`hf jooki clone         `|N       |`Write a Jooki token`
+|`hf jooki decode        `|Y       |`Decode Jooki token`
+|`hf jooki encode        `|Y       |`Encode Jooki token`
+|`hf jooki sim           `|N       |`Simulate Jooki token`
+
+
 ### hf iclass
 
  { ICLASS RFIDs...                     }

From b3064c48881176f940917cbc73fd6cf4099961ea Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 17 Feb 2021 08:59:20 +0100
Subject: [PATCH 598/682] style

---
 client/src/cmdhfmfu.c  | 6 +++---
 client/src/fileutils.c | 2 +-
 client/src/fileutils.h | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index 926642e1d..5a74149a5 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -3560,14 +3560,14 @@ static int CmdHF14MfuNDEF(const char *Cmd) {
 
     DropField();
     status = NDEFRecordsDecodeAndPrint(records, (size_t)maxsize);
-    if ( status != PM3_SUCCESS) {
+    if (status != PM3_SUCCESS) {
         status = NDEFDecodeAndPrint(records, (size_t)maxsize, true);
     }
 
-    char *jooki = strstr((char*)records, "s.jooki.rocks/s/?s=");
+    char *jooki = strstr((char *)records, "s.jooki.rocks/s/?s=");
     if (jooki) {
         jooki += 17;
-        while(jooki) {
+        while (jooki) {
             if ((*jooki) != '=')
                 jooki++;
             else  {
diff --git a/client/src/fileutils.c b/client/src/fileutils.c
index 137d2640b..dc7ac530a 100644
--- a/client/src/fileutils.c
+++ b/client/src/fileutils.c
@@ -90,7 +90,7 @@ DumpFileType_t getfiletype(const char *filename) {
     }
 
     size_t len = strlen(filename);
-    if (len > 4) { 
+    if (len > 4) {
         //  check if valid file extension and attempt to load data
         char s[FILE_PATH_SIZE];
         memset(s, 0, sizeof(s));
diff --git a/client/src/fileutils.h b/client/src/fileutils.h
index 5e5cee664..bc06bd061 100644
--- a/client/src/fileutils.h
+++ b/client/src/fileutils.h
@@ -276,7 +276,7 @@ int searchFile(char **foundpath, const char *pm3dir, const char *searchname, con
 /**
  * @brief detects if file is of a supported filetype based on extension
  * @param filename
- * @return 
+ * @return
  */
 DumpFileType_t getfiletype(const char *filename);
 #endif // FILEUTILS_H

From e129244a6638c89933e31347e6a4d5f3be6d9579 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 17 Feb 2021 10:46:58 +0100
Subject: [PATCH 599/682] ..types

---
 client/src/cmdlfhid.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdlfhid.c b/client/src/cmdlfhid.c
index 319fbc9e6..02ccd5801 100644
--- a/client/src/cmdlfhid.c
+++ b/client/src/cmdlfhid.c
@@ -388,7 +388,7 @@ static int CmdHIDClone(const char *Cmd) {
         packed.Mid = mid;
         packed.Bot = bot;
     } else if (bin_len) {
-        int res = binstring_to_u96(&top, &mid, &bot, bin);
+        int res = binstring_to_u96(&top, &mid, &bot, (const char*)bin);
         if (res != bin_len) {
             PrintAndLogEx(ERR, "Binary string contains none <0|1> chars");
             return PM3_EINVARG;

From 88d95b639f2826b754c233a65d5b789db3cad708 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 17 Feb 2021 11:42:37 +0100
Subject: [PATCH 600/682] text

---
 client/src/cmdhfjooki.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhfjooki.c b/client/src/cmdhfjooki.c
index a513109a0..39a4d4286 100644
--- a/client/src/cmdhfjooki.c
+++ b/client/src/cmdhfjooki.c
@@ -581,7 +581,7 @@ static int CmdHF14AJookiClone(const char *Cmd) {
     CLIParserContext *ctx;
     CLIParserInit(&ctx, "hf jooki clone",
                   "Write a Jooki token to a Ultralight or NTAG tag",
-                  "hf jooki clone -d <hex bytes>         --> where hex is raw NDEF"
+                  "hf jooki clone -d <hex bytes>         --> where hex is raw NDEF\n"
                   "hf jooki clone --b64 7WzlgEzqLgwTnWNy --> using base64 url parameter"
                  );
 

From e5b879cbe9770896a627b8195d059bb8f0d57a67 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 17 Feb 2021 11:52:23 +0100
Subject: [PATCH 601/682] rdv4 device detection added

---
 client/src/cmdflashmem.c | 272 ++++++++++++++++++++++-----------------
 client/src/cmdflashmem.h |   4 +-
 client/src/cmdhw.c       |  26 +++-
 3 files changed, 179 insertions(+), 123 deletions(-)

diff --git a/client/src/cmdflashmem.c b/client/src/cmdflashmem.c
index 7f663c45b..23acad47d 100644
--- a/client/src/cmdflashmem.c
+++ b/client/src/cmdflashmem.c
@@ -11,7 +11,7 @@
 #include <ctype.h>
 #include "cmdparser.h"         // command_t
 #include "cliparser.h"
-#include "pmflash.h"
+#include "pmflash.h"           // rdv40validation_t
 #include "fileutils.h"         // saveFile
 #include "comms.h"             // getfromdevice
 #include "cmdflashmemspiffs.h" // spiffs commands
@@ -26,6 +26,123 @@
 
 static int CmdHelp(const char *Cmd);
 
+//-------------------------------------------------------------------------------------
+// RRG Public RSA Key
+#define RRG_RSA_KEY_LEN 128
+
+// public key Exponent E
+#define RRG_RSA_E "010001"
+
+// public key modulus N
+#define RRG_RSA_N "E28D809BF323171D11D1ACA4C32A5B7E0A8974FD171E75AD120D60E9B76968FF" \
+                  "4B0A6364AE50583F9555B8EE1A725F279E949246DF0EFCE4C02B9F3ACDCC623F" \
+                  "9337F21C0C066FFB703D8BFCB5067F309E056772096642C2B1A8F50305D5EC33" \
+                  "DB7FB5A3C8AC42EB635AE3C148C910750ABAA280CE82DC2F180F49F30A1393B5"
+
+// Following example RSA-1024 keypair, for test purposes  (from common/polarssl/rsa.c)
+// private key - Exponent D
+#define RSA_D   "24BF6185468786FDD303083D25E64EFC" \
+    "66CA472BC44D253102F8B4A9D3BFA750" \
+    "91386C0077937FE33FA3252D28855837" \
+    "AE1B484A8A9A45F7EE8C0C634F99E8CD" \
+    "DF79C5CE07EE72C7F123142198164234" \
+    "CABB724CF78B8173B9F880FC86322407" \
+    "AF1FEDFDDE2BEB674CA15F3E81A1521E" \
+    "071513A1E85B5DFA031F21ECAE91A34D"
+
+// prime P
+#define RSA_P   "C36D0EB7FCD285223CFB5AABA5BDA3D8" \
+    "2C01CAD19EA484A87EA4377637E75500" \
+    "FCB2005C5C7DD6EC4AC023CDA285D796" \
+    "C3D9E75E1EFC42488BB4F1D13AC30A57"
+
+// prime Q
+#define RSA_Q   "C000DF51A7C77AE8D7C7370C1FF55B69" \
+    "E211C2B9E5DB1ED0BF61D0D9899620F4" \
+    "910E4168387E3C30AA1E00C339A79508" \
+    "8452DD96A9A5EA5D9DCA68DA636032AF"
+
+#define RSA_DP  "C1ACF567564274FB07A0BBAD5D26E298" \
+    "3C94D22288ACD763FD8E5600ED4A702D" \
+    "F84198A5F06C2E72236AE490C93F07F8" \
+    "3CC559CD27BC2D1CA488811730BB5725"
+
+#define RSA_DQ  "4959CBF6F8FEF750AEE6977C155579C7" \
+    "D8AAEA56749EA28623272E4F7D0592AF" \
+    "7C1F1313CAC9471B5C523BFE592F517B" \
+    "407A1BD76C164B93DA2D32A383E58357"
+
+#define RSA_QP  "9AE7FBC99546432DF71896FC239EADAE" \
+    "F38D18D2B2F0E2DD275AA977E2BF4411" \
+    "F5A3B2A5D33605AEBBCCBA7FEB9F2D2F" \
+    "A74206CEC169D74BF5A8C50D6F48EA08"
+
+int rdv4_get_signature(rdv40_validation_t *out) {
+    if (out == NULL) {        
+        return PM3_EINVARG;
+    }
+
+    clearCommandBuffer();
+    SendCommandNG(CMD_FLASHMEM_INFO, NULL, 0);
+    PacketResponseNG resp;
+    if (WaitForResponseTimeout(CMD_ACK, &resp, 2500) == false) {
+        PrintAndLogEx(WARNING, "timeout while waiting for reply");
+        return PM3_ETIMEOUT;
+    }
+
+    uint8_t isok = resp.oldarg[0] & 0xFF;
+    if (isok == false) {
+        PrintAndLogEx(FAILED, "fail reading from flashmemory");
+        return PM3_EFLASH;
+    }
+
+    //rdv40_validation_t mem;
+    memcpy(out, (rdv40_validation_t *)resp.data.asBytes, sizeof(rdv40_validation_t));
+    return PM3_SUCCESS;
+}
+
+// validate signature
+int rdv4_validate(rdv40_validation_t *mem) {
+
+    // Flash ID hash (sha1)
+    uint8_t sha_hash[20] = {0};
+    mbedtls_sha1(mem->flashid, sizeof(mem->flashid), sha_hash);
+
+    // set up RSA
+    mbedtls_rsa_context rsa;
+    mbedtls_rsa_init(&rsa, MBEDTLS_RSA_PKCS_V15, 0);
+    rsa.len = RRG_RSA_KEY_LEN;
+    mbedtls_mpi_read_string(&rsa.N, 16, RRG_RSA_N);
+    mbedtls_mpi_read_string(&rsa.E, 16, RRG_RSA_E);
+
+    // Verify (public key)
+    int is_verified = mbedtls_rsa_pkcs1_verify(&rsa, NULL, NULL, MBEDTLS_RSA_PUBLIC, MBEDTLS_MD_SHA1, 20, sha_hash, mem->signature);
+    mbedtls_rsa_free(&rsa);
+
+    if (is_verified == 0) {
+        return PM3_SUCCESS;
+    }
+    return PM3_EFAILED;
+}
+
+static int rdv4_sign_write(uint8_t *signature, uint8_t slen){
+    // save to mem
+    clearCommandBuffer();
+    PacketResponseNG resp;
+    SendCommandOLD(CMD_FLASHMEM_WRITE, FLASH_MEM_SIGNATURE_OFFSET, FLASH_MEM_SIGNATURE_LEN, 0, signature, slen);
+    if (!WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
+        PrintAndLogEx(WARNING, "timeout while waiting for reply.");
+    } else {
+        if (!resp.oldarg[0]) {
+            PrintAndLogEx(FAILED, "Writing signature ( "_RED_("fail") ")");
+        } else {
+            PrintAndLogEx(SUCCESS, "Writing signature ( "_GREEN_("ok") " ) at offset %u", FLASH_MEM_SIGNATURE_OFFSET);
+            return PM3_SUCCESS;
+        }
+    }
+    return PM3_EFAILED;
+}
+
 static int CmdFlashmemSpiBaudrate(const char *Cmd) {
 
     CLIParserContext *ctx;
@@ -344,23 +461,14 @@ static int CmdFlashMemInfo(const char *Cmd) {
 //    shall_write = arg_get_lit(ctx, 2);
     CLIParserFree(ctx);
 
-    clearCommandBuffer();
-    SendCommandNG(CMD_FLASHMEM_INFO, NULL, 0);
-    PacketResponseNG resp;
-    if (WaitForResponseTimeout(CMD_ACK, &resp, 2500) == false) {
-        PrintAndLogEx(WARNING, "timeout while waiting for reply");
-        return PM3_ETIMEOUT;
-    }
-
-    uint8_t isok = resp.oldarg[0] & 0xFF;
-    if (isok == false) {
-        PrintAndLogEx(FAILED, "failed");
-        return PM3_EFLASH;
-    }
-
-    // validate signature here
+    // validate signature data
     rdv40_validation_t mem;
-    memcpy(&mem, (rdv40_validation_t *)resp.data.asBytes, sizeof(rdv40_validation_t));
+    int res = rdv4_get_signature(&mem);
+    if (res != PM3_SUCCESS) {        
+        return res;
+    }
+
+    res = rdv4_validate(&mem);
 
     // Flash ID hash (sha1)
     uint8_t sha_hash[20] = {0};
@@ -369,7 +477,6 @@ static int CmdFlashMemInfo(const char *Cmd) {
     // print header
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "--- " _CYAN_("Flash memory Information") " ---------");
-//    PrintAndLogEx(INFO, "-----------------------------------------------------------------");
     PrintAndLogEx(INFO, "ID................... %s", sprint_hex_inrow(mem.flashid, sizeof(mem.flashid)));
     PrintAndLogEx(INFO, "SHA1................. %s", sprint_hex_inrow(sha_hash, sizeof(sha_hash)));
     PrintAndLogEx(NORMAL, "");
@@ -378,69 +485,16 @@ static int CmdFlashMemInfo(const char *Cmd) {
         PrintAndLogEx(INFO, " %s", sprint_hex_inrow(mem.signature + (i * 32), 32));
     }
 
-//-------------------------------------------------------------------------------
-// RRG Public RSA Key
-//
-
-// public key Exponent E
-#define RSA_E "010001"
-
-// public key modulus N
-#define RSA_N "E28D809BF323171D11D1ACA4C32A5B7E0A8974FD171E75AD120D60E9B76968FF" \
-              "4B0A6364AE50583F9555B8EE1A725F279E949246DF0EFCE4C02B9F3ACDCC623F" \
-              "9337F21C0C066FFB703D8BFCB5067F309E056772096642C2B1A8F50305D5EC33" \
-              "DB7FB5A3C8AC42EB635AE3C148C910750ABAA280CE82DC2F180F49F30A1393B5"
-
-//-------------------------------------------------------------------------------
-// Example RSA-1024 keypair, for test purposes  (from common/polarssl/rsa.c)
-//
-
-// private key  Exponent D
-#define RSA_D   "24BF6185468786FDD303083D25E64EFC" \
-    "66CA472BC44D253102F8B4A9D3BFA750" \
-    "91386C0077937FE33FA3252D28855837" \
-    "AE1B484A8A9A45F7EE8C0C634F99E8CD" \
-    "DF79C5CE07EE72C7F123142198164234" \
-    "CABB724CF78B8173B9F880FC86322407" \
-    "AF1FEDFDDE2BEB674CA15F3E81A1521E" \
-    "071513A1E85B5DFA031F21ECAE91A34D"
-
-// prime P
-#define RSA_P   "C36D0EB7FCD285223CFB5AABA5BDA3D8" \
-    "2C01CAD19EA484A87EA4377637E75500" \
-    "FCB2005C5C7DD6EC4AC023CDA285D796" \
-    "C3D9E75E1EFC42488BB4F1D13AC30A57"
-
-// prime Q
-#define RSA_Q   "C000DF51A7C77AE8D7C7370C1FF55B69" \
-    "E211C2B9E5DB1ED0BF61D0D9899620F4" \
-    "910E4168387E3C30AA1E00C339A79508" \
-    "8452DD96A9A5EA5D9DCA68DA636032AF"
-
-#define RSA_DP  "C1ACF567564274FB07A0BBAD5D26E298" \
-    "3C94D22288ACD763FD8E5600ED4A702D" \
-    "F84198A5F06C2E72236AE490C93F07F8" \
-    "3CC559CD27BC2D1CA488811730BB5725"
-
-#define RSA_DQ  "4959CBF6F8FEF750AEE6977C155579C7" \
-    "D8AAEA56749EA28623272E4F7D0592AF" \
-    "7C1F1313CAC9471B5C523BFE592F517B" \
-    "407A1BD76C164B93DA2D32A383E58357"
-
-#define RSA_QP  "9AE7FBC99546432DF71896FC239EADAE" \
-    "F38D18D2B2F0E2DD275AA977E2BF4411" \
-    "F5A3B2A5D33605AEBBCCBA7FEB9F2D2F" \
-    "A74206CEC169D74BF5A8C50D6F48EA08"
-
-#define KEY_LEN 128
-
     mbedtls_rsa_context rsa;
     mbedtls_rsa_init(&rsa, MBEDTLS_RSA_PKCS_V15, 0);
 
-    rsa.len = KEY_LEN;
+    rsa.len = RRG_RSA_KEY_LEN;
 
-    mbedtls_mpi_read_string(&rsa.N, 16, RSA_N);
-    mbedtls_mpi_read_string(&rsa.E, 16, RSA_E);
+    // add public key 
+    mbedtls_mpi_read_string(&rsa.N, 16, RRG_RSA_N);
+    mbedtls_mpi_read_string(&rsa.E, 16, RRG_RSA_E);
+
+    // add private key
     mbedtls_mpi_read_string(&rsa.D, 16, RSA_D);
     mbedtls_mpi_read_string(&rsa.P, 16, RSA_P);
     mbedtls_mpi_read_string(&rsa.Q, 16, RSA_Q);
@@ -448,8 +502,6 @@ static int CmdFlashMemInfo(const char *Cmd) {
     mbedtls_mpi_read_string(&rsa.DQ, 16, RSA_DQ);
     mbedtls_mpi_read_string(&rsa.QP, 16, RSA_QP);
 
-    bool is_keyok = (mbedtls_rsa_check_pubkey(&rsa) == 0 || mbedtls_rsa_check_privkey(&rsa) == 0);
-
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "--- " _CYAN_("RDV4 RSA Public key") " --------------");
 
@@ -466,48 +518,35 @@ static int CmdFlashMemInfo(const char *Cmd) {
     PrintAndLogEx(INFO, " %.64s", str_pk + 64);
     PrintAndLogEx(INFO, " %.64s", str_pk + 128);
     PrintAndLogEx(INFO, " %.64s", str_pk + 192);
-
     PrintAndLogEx(NORMAL, "");
-    const char *msgkey = "RSA key validation... ";
-    if (is_keyok)
-        PrintAndLogEx(SUCCESS, "%s( " _GREEN_("ok") " )", msgkey);
-    else
-        PrintAndLogEx(FAILED, "%s( " _RED_("failed") " )", msgkey);
 
-    //
-    uint8_t from_device[KEY_LEN];
-    uint8_t sign[KEY_LEN];
+    bool is_keyok = (mbedtls_rsa_check_pubkey(&rsa) == 0 || mbedtls_rsa_check_privkey(&rsa) == 0);
+    PrintAndLogEx(
+        (is_keyok) ? SUCCESS : FAILED,
+        "RSA key validation...  ( %s )",
+        (is_keyok) ?  _GREEN_("ok") : _RED_("fail")
+    );
 
     // to be verified
-    memcpy(from_device, mem.signature, KEY_LEN);
+    uint8_t from_device[RRG_RSA_KEY_LEN];
+    memcpy(from_device, mem.signature, RRG_RSA_KEY_LEN);
 
-    // to be signed (all zeros
-    memset(sign, 0, KEY_LEN);
+    // to be signed
+    uint8_t sign[RRG_RSA_KEY_LEN];
+    memset(sign, 0, RRG_RSA_KEY_LEN);
 
     // Signing (private key)
     if (shall_sign) {
 
         int is_signed = mbedtls_rsa_pkcs1_sign(&rsa, NULL, NULL, MBEDTLS_RSA_PRIVATE, MBEDTLS_MD_SHA1, 20, sha_hash, sign);
-        const char *msgsign = "RSA signing.......... ";
-        if (is_signed == 0)
-            PrintAndLogEx(SUCCESS, "%s( " _GREEN_("ok") " )", msgsign);
-        else
-            PrintAndLogEx(FAILED, "%s( " _RED_("failed") " )", msgsign);
-
+        PrintAndLogEx(
+            (is_signed == 0) ? SUCCESS : FAILED,
+            "RSA signing.......... ( %s )",
+            (is_signed == 0) ?  _GREEN_("ok") : _RED_("fail")
+        );
+        
         if (shall_write) {
-            // save to mem
-            clearCommandBuffer();
-            SendCommandOLD(CMD_FLASHMEM_WRITE, FLASH_MEM_SIGNATURE_OFFSET, FLASH_MEM_SIGNATURE_LEN, 0, sign, sizeof(sign));
-            if (!WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
-                PrintAndLogEx(WARNING, "timeout while waiting for reply.");
-            } else {
-
-                if (!resp.oldarg[0])
-                    PrintAndLogEx(FAILED, "Writing signature failed");
-                else
-                    PrintAndLogEx(SUCCESS, "Writing signature ok [offset: %u]", FLASH_MEM_SIGNATURE_OFFSET);
-
-            }
+            rdv4_sign_write(sign, RRG_RSA_KEY_LEN);
         }
         PrintAndLogEx(INFO, "Signed");
         for (int i = 0; i < (sizeof(sign) / 32); i++) {
@@ -517,14 +556,15 @@ static int CmdFlashMemInfo(const char *Cmd) {
 
     // Verify (public key)
     int is_verified = mbedtls_rsa_pkcs1_verify(&rsa, NULL, NULL, MBEDTLS_RSA_PUBLIC, MBEDTLS_MD_SHA1, 20, sha_hash, from_device);
-    const char *msgverify = "RSA verification..... ";
-    if (is_verified == 0)
-        PrintAndLogEx(SUCCESS, "%s( " _GREEN_("ok") " )", msgverify);
-    else
-        PrintAndLogEx(FAILED, "%s( " _RED_("failed") " )", msgverify);
+    mbedtls_rsa_free(&rsa);
+
+    PrintAndLogEx(
+        (is_verified == 0) ? SUCCESS : FAILED,
+        "RSA verification.....  ( %s )",
+        (is_verified == 0) ?  _GREEN_("ok") : _RED_("fail")
+    );
 
     PrintAndLogEx(NORMAL, "");
-    mbedtls_rsa_free(&rsa);
     return PM3_SUCCESS;
 }
 
diff --git a/client/src/cmdflashmem.h b/client/src/cmdflashmem.h
index 011b57a14..5a8f6eebc 100644
--- a/client/src/cmdflashmem.h
+++ b/client/src/cmdflashmem.h
@@ -12,6 +12,7 @@
 #define CMDFLASHMEM_H__
 
 #include "common.h"
+#include "pmflash.h"           // rdv40validation_t
 
 typedef enum {
     DICTIONARY_NONE = 0,
@@ -21,5 +22,6 @@ typedef enum {
 } Dictionary_t;
 
 int CmdFlashMem(const char *Cmd);
-
+int rdv4_get_signature(rdv40_validation_t *out);
+int rdv4_validate(rdv40_validation_t *mem);
 #endif
diff --git a/client/src/cmdhw.c b/client/src/cmdhw.c
index 49da91a83..24c292bbe 100644
--- a/client/src/cmdhw.c
+++ b/client/src/cmdhw.c
@@ -23,6 +23,8 @@
 #include "cmddata.h"
 #include "commonutil.h"
 #include "pm3_cmd.h"
+#include "pmflash.h"      // rdv40validation_t
+#include "cmdflashmem.h"  // get_signature..
 
 static int CmdHelp(const char *Cmd);
 
@@ -959,17 +961,29 @@ void pm3_version(bool verbose, bool oneliner) {
         PrintAndLogEx(NORMAL, "  compiled with " PM3CLIENTCOMPILER __VERSION__ PM3HOSTOS PM3HOSTARCH);
 
         PrintAndLogEx(NORMAL, "\n [ " _YELLOW_("PROXMARK3") " ]");
-        if (IfPm3Rdv4Fw() == false) {
-            PrintAndLogEx(NORMAL, "  firmware.................. %s", _YELLOW_("PM3GENERIC"));
-            if (IfPm3FpcUsartHost()) {
-                PrintAndLogEx(NORMAL, "  FPC USART for BT add-on... %s", _GREEN_("present"));
+        if (IfPm3Rdv4Fw()) {
+
+            bool is_genuine_rdv4 = false;
+            // validate signature data
+            rdv40_validation_t mem;
+            if (rdv4_get_signature(&mem) == PM3_SUCCESS) {
+                if (rdv4_validate(&mem) == PM3_SUCCESS) {
+                    is_genuine_rdv4 = true;
+                }
             }
-        } else {
-            PrintAndLogEx(NORMAL, "  firmware.................. %s", _YELLOW_("PM3RDV4"));
+
+            PrintAndLogEx(NORMAL, "  device.................... %s", (is_genuine_rdv4) ? _GREEN_("RDV4") : _RED_("device / fw mismatch"));
+            PrintAndLogEx(NORMAL, "  firmware.................. %s", _YELLOW_("RDV4"));
             PrintAndLogEx(NORMAL, "  external flash............ %s", IfPm3Flash() ? _GREEN_("present") : _YELLOW_("absent"));
             PrintAndLogEx(NORMAL, "  smartcard reader.......... %s", IfPm3Smartcard() ? _GREEN_("present") : _YELLOW_("absent"));
             PrintAndLogEx(NORMAL, "  FPC USART for BT add-on... %s", IfPm3FpcUsartHost() ? _GREEN_("present") : _YELLOW_("absent"));
+        } else {
+            PrintAndLogEx(NORMAL, "  firmware.................. %s", _YELLOW_("PM3 GENERIC"));
+            if (IfPm3FpcUsartHost()) {
+                PrintAndLogEx(NORMAL, "  FPC USART for BT add-on... %s", _GREEN_("present"));
+            }
         }
+
         if (IfPm3FpcUsartDevFromUsb()) {
             PrintAndLogEx(NORMAL, "  FPC USART for developer... %s", _GREEN_("present"));
         }

From a1f9a03823ad43db9be9ce6e8ead05ef0cd2e060 Mon Sep 17 00:00:00 2001
From: Akif Dinc <akif@dinc.org>
Date: Wed, 17 Feb 2021 13:31:44 +0100
Subject: [PATCH 602/682] Adding Jooki documentation

---
 doc/jooki_notes.md | 148 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 148 insertions(+)
 create mode 100644 doc/jooki_notes.md

diff --git a/doc/jooki_notes.md b/doc/jooki_notes.md
new file mode 100644
index 000000000..1e1cd5552
--- /dev/null
+++ b/doc/jooki_notes.md
@@ -0,0 +1,148 @@
+# Jooki Figurine Notes
+- NTAG213 (Should be tested if other NTAG2xx work)
+- A single NDEF record of type URL
+- Physical figurines are Fox, Dragon, Knight, Ghost, Whale, Generic Flat. Than there are variations of those figures with different colors.
+
+## Jooki proxmark commands
+You can `encode`, `decode` a NDEF record, write with `clone` a record to a card or simulate with`sim`.
+
+### Decoding NDEF URL parameter
+`hf jooki decode -d g+t07s57aX1bB6tk`
+
+### Encoding NDEF record
+You can either use figurine abbreviation arguments:
+```
+    --dragon 
+    --fox   
+    --ghost
+    --knight 
+    --whale   
+    --blackdragon   
+    --blackfox     
+    --blackknight 
+    --blackwhale 
+    --whitedragon 
+    --whitefox    
+    --whiteknight 
+    --whitewhale 
+```
+Or pass directly the figurine type id `--tid` and figurine id `--fid`
+
+Example encoding NDEF record for UID `04010203040506`
+
+`hf jooki encode --uid 04010203040506 --tid 1 --fid 1`
+
+or use `--dragon` parameter to achieve the same:
+
+
+`hf jooki encode --uid 04010203040506 --dragon`
+
+Output:
+```
+[=] Encoded URL.. 67 2B 74 30 37 73 35 37 61 58 31 62  ( g+t07s57aX1bB6tk )
+[=] Figurine..... 01 00 - Figurine, Dragon
+[=] iv........... 80 77 51 
+[=] uid.......... 04 01 02 03 04 05 06 
+[=] NDEF raw..... 0103A00C340329D101255504732E6A6F6F6B692E726F636B732F732F3F733D672B743037733537615831624236746B0AFE000000
+```
+
+Use `-r` parameter to read UID directly from tag.
+
+### Simulation
+To simulate the above figurine use the encoded URL parameter given in `encode` output and type following command into your proxmark:
+ 
+`hf jooki sim -b g+t07s57aX1bB6tk`
+
+If no parameter is given to the simulation command, last loaded dump is used.
+
+### Cloning to a NTAG213 tag
+```
+    hf jooki clone [-h] [-b <base64>] [-d <hex>] [-p <hex>]
+
+options:
+    -h, --help                     This help
+    -b, --b64 <base64>             base64 url parameter
+    -d, --data <hex>               raw NDEF bytes
+    -p, --pwd <hex>                password for authentication (EV1/NTAG 4 bytes)
+
+examples/notes:
+    hf jooki clone -d <hex bytes>  -> where hex is raw NDEFhf jooki clone --b64 7WzlgEzqLgwTnWNy --> using base64 url parameter
+```
+
+Use either the above NDEF raw output from `encode` to write a new record to a tag:
+
+`hf jooki clone -d 0103A00C340329D101255504732E6A6F6F6B692E726F636B732F732F3F733D672B743037733537615831624236746B0AFE000000`
+
+or use the base64 encoded parameter to clone:
+
+`hf jooki clone -b A5wlbrkq6QoKh9w1
+
+
+Note: Jooki doesn't like more than one NDEF record, so make sure you just have one. Check with `hf mfu ndef`
+
+### List of known figurine types
+`Value`|`Figurine Type`|
+|------|---------------|
+**01** | Stones |
+**02** | Generic Flat |			
+**03** | System Commands | 			
+**04** | Tests |
+
+| `Figurine Type` | `Figurine ID` | `Figurine`           |
+|---------------|-------------|--------------------------|
+| 01            | 00          | 狐狸 Fox                 |
+| 01            | 01          | 龙 Dragon                |
+| 01            | 02          | 骑士 Knight              |
+| 01            | 03          | 鬼 Ghost                 |
+| 01            | 04          | 鲸 Whale                 |
+| 01            | 05          | ThankYou                 |
+| 01            | 06          | Black.Fox                |
+| 01            | 07          | Black.Dragon             |
+| 01            | 08          | Black.Whale              |
+| 01            | 09          | Black.Knight             |
+| 01            | 0a          | White.Fox                |
+| 01            | 0b          | White.Dragon             |
+| 01            | 0c          | White.Whale              |
+| 01            | 0d          | White.Knight             |
+|               |             |                          |
+|     `02`      |             |      `Generic Flat`      |
+| 02            | 00          | 圆盘 Generic Flat        |
+| 02            | 01          | unknown_0201             |
+|               |             |                          |
+|     `03`      |             |    `System Commands`     |
+| 03            | 00          | sys.record               |
+| 03            | 01          | sys.factory_mode_on      |
+| 03            | 02          | sys.factory_mode_off     |
+| 03            | 03          | sys.airplane_mode_on     |
+| 03            | 04          | sys.airplane_mode_off    |
+| 03            | 05          | sys.toy_safe_on          |
+| 03            | 06          | sys.toy_safe_off         |
+| 03            | 07          | sys.wifi_on              |
+| 03            | 08          | sys.wifi_off             |
+| 03            | 09          | sys.bt_on                |
+| 03            | 0a          | sys.bt_off               |
+| 03            | 0b          | sys.production_finished  |
+|               |             |                          |
+|     `04`      |             |         `Tests`          |
+| 04            | 00          | Hello test.0             |
+| 04            | 01          | Hello test.1             |
+| 04            | 02          | Hello test.2             |
+| 04            | 03          | Hello test.3             |
+| 04            | 04          | Hello test.4             |
+| 04            | 05          | Hello test.5             |
+| 04            | 06          | Hello test.6             |
+| 04            | 07          | Hello test.7             |
+| 04            | 08          | Hello test.8             |
+| 04            | 09          | Hello test.9             |
+| 04            | 0a          | Hello unknown_040A       |
+| 04            | 10          | Hello test.10            |
+| 04            | 11          | Hello test.11            |
+| 04            | 12          | Hello test.12            |
+| 04            | 13          | Hello test.13            |
+| 04            | 14          | Hello test.14            |
+| 04            | 15          | Hello test.15            |
+| 04            | 16          | Hello test.16            |
+| 04            | 17          | Hello test.17            |
+| 04            | 18          | Hello test.18            |
+| 04            | 19          | Hello test.19            |
+

From 8d4d1cc3a6ae1ca5faa806216378a888c1e00a65 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 17 Feb 2021 17:31:08 +0100
Subject: [PATCH 603/682] text

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index b2581d98c..cf8ad802b 100644
--- a/README.md
+++ b/README.md
@@ -77,7 +77,7 @@ quite a lot, see the [Changelog file](CHANGELOG.md) which we try to keep updated
 
 This repo compiles nicely on 
    - Proxspace v3.x
-     - [latest release v3.7.2](https://github.com/Gator96100/ProxSpace/releases)
+     - [latest release v3.7.3](https://github.com/Gator96100/ProxSpace/releases)
    - Windows/mingw environment with Qt5.6.1 & GCC 4.9
    - Ubuntu 16.04 -> 20.04
    - ParrotOS, Gentoo, Pentoo, Kali, Nethunter, Archlinux, Fedora, Debian

From 84ab8e904f47be46e68c1cb510a8d125fa61f272 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C4=B0lteri=C5=9F=20Ero=C4=9Flu?= <ilteris@asenkron.com.tr>
Date: Fri, 19 Feb 2021 02:40:40 +0300
Subject: [PATCH 604/682] Add another sig sample for MFC EV1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: İlteriş Yağıztegin Eroğlu <ilteris@asenkron.com.tr>
---
 tools/recover_pk.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/recover_pk.py b/tools/recover_pk.py
index 9c393a2d2..a268181f9 100755
--- a/tools/recover_pk.py
+++ b/tools/recover_pk.py
@@ -471,7 +471,8 @@ def selftests():
         {'name': "Mifare Classic EV1",
          'samples': ["0433619AB35780", "B9FAE369EC21C980650D87ED9AE9B1610E859131B4B8699C647548AB68D249BB",
                      "524374E2",       "F8758CE30A58553A9985C458FB9C7D340FCFB04847B928A0667939272BC58B5E",
-                     "53424B8A",       "B4F533E8C06C021E242EFE8558C1672ED7022E5AE4E7AA2D46113B0AB6928AFC"],
+                     "53424B8A",       "B4F533E8C06C021E242EFE8558C1672ED7022E5AE4E7AA2D46113B0AB6928AFC",
+                     "BD2A4146",       "19505576ED327D8F8870C86B1ED00898BFEDFFF27CC82FC515BA2EEC26050873"],
          'pk': "044F6D3F294DEA5737F0F46FFEE88A356EED95695DD7E0C27A591E6F6F65962BAF" },
         {'name': "DESFire Light",
          'samples': ["0439556ACB6480", "D5BD0978106E1E38B513642335966AB21E9F950DCFCFAB45FF13D0DC3CA4C2AE7E0D671DF1240937D040DAC4601C5F66ED62C546EE03ED08",

From 9293a25e3e6556354e4138ab674dd53c58190239 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 19 Feb 2021 13:39:35 +0100
Subject: [PATCH 605/682] hf 14a info - add MFC EV1 signature checks

---
 .../amiitool => resources}/key_retail.bin     | Bin
 client/src/cmdhf14a.c                         |  10 +-
 client/src/cmdhfmf.c                          | 120 ++++++++++--------
 client/src/cmdhfmf.h                          |   2 +
 client/src/crypto/libpcrypto.c                |   7 +-
 client/src/mifare/mifarehost.c                |  42 +++++-
 client/src/mifare/mifarehost.h                |   3 +
 7 files changed, 126 insertions(+), 58 deletions(-)
 rename client/{deps/amiitool => resources}/key_retail.bin (100%)

diff --git a/client/deps/amiitool/key_retail.bin b/client/resources/key_retail.bin
similarity index 100%
rename from client/deps/amiitool/key_retail.bin
rename to client/resources/key_retail.bin
diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c
index a2212005f..2b1631963 100644
--- a/client/src/cmdhf14a.c
+++ b/client/src/cmdhf14a.c
@@ -1658,7 +1658,7 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
     } else {
 
         // Double & triple sized UID, can be mapped to a manufacturer.
-        PrintAndLogEx(SUCCESS, "MANUFACTURER:    " _YELLOW_("%s"), getTagInfo(card.uid[0]));
+        PrintAndLogEx(SUCCESS, "MANUFACTURER: " _YELLOW_("%s"), getTagInfo(card.uid[0]));
 
         switch (card.uid[0]) {
             case 0x02: // ST
@@ -2101,6 +2101,14 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) {
             if (do_nack_test)
                 detect_classic_nackbug(false);
         }
+
+        uint8_t signature[32] = {0};
+        res = detect_mfc_ev1_signature(signature);
+        if (res == PM3_SUCCESS) {
+            mfc_ev1_print_signature(card.uid, card.uidlen, signature, sizeof(signature));            
+        }
+
+        PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mf`") " commands");
     }
 
     if (isMifareUltralight)
diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index b8671c4b1..7b877658b 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -27,6 +27,7 @@
 #include "des.h"                // des ecb
 #include "crapto1/crapto1.h"    // prng_successor
 #include "cmdhf14a.h"           // exchange APDU
+#include "crypto/libpcrypto.h"
 
 #define MFBLOCK_SIZE 16
 
@@ -425,6 +426,46 @@ static int usage_hf14_gen3freeze(void) {
     return PM3_SUCCESS;
 }
 
+int mfc_ev1_print_signature(uint8_t *uid, uint8_t uidlen, uint8_t *signature, int signature_len) {
+
+    // ref:  MIFARE Classic EV1 Originality Signature Validation
+#define PUBLIC_MFCEV1_ECDA_KEYLEN 33
+    const ecdsa_publickey_t nxp_mfc_public_keys[] = {
+        {"NXP Mifare Classic MFC1C14_x", "044F6D3F294DEA5737F0F46FFEE88A356EED95695DD7E0C27A591E6F6F65962BAF"},
+    };
+
+    uint8_t i;
+    bool is_valid = false;
+
+    for (i = 0; i < ARRAYLEN(nxp_mfc_public_keys); i++) {
+
+        int dl = 0;
+        uint8_t key[PUBLIC_MFCEV1_ECDA_KEYLEN];
+        param_gethex_to_eol(nxp_mfc_public_keys[i].value, 0, key, PUBLIC_MFCEV1_ECDA_KEYLEN, &dl);
+
+        int res = ecdsa_signature_r_s_verify(MBEDTLS_ECP_DP_SECP128R1, key, uid, uidlen, signature, signature_len, false);
+        is_valid = (res == 0);
+        if (is_valid)
+            break;
+    }
+
+    PrintAndLogEx(INFO, "");
+    PrintAndLogEx(INFO, "--- " _CYAN_("Tag Signature"));
+    if (is_valid == false || i == ARRAYLEN(nxp_mfc_public_keys)) {
+        PrintAndLogEx(INFO, "    Elliptic curve parameters: NID_secp128r1");
+        PrintAndLogEx(INFO, "             TAG IC Signature: %s", sprint_hex_inrow(signature, 32));
+        PrintAndLogEx(SUCCESS, "       Signature verification: " _RED_("failed"));
+        return PM3_ESOFT;
+    }
+
+    PrintAndLogEx(INFO, " IC signature public key name: %s", nxp_mfc_public_keys[i].desc);
+    PrintAndLogEx(INFO, "IC signature public key value: %s", nxp_mfc_public_keys[i].value);
+    PrintAndLogEx(INFO, "    Elliptic curve parameters: NID_secp128r1");
+    PrintAndLogEx(INFO, "             TAG IC Signature: %s", sprint_hex_inrow(signature, 32));
+    PrintAndLogEx(SUCCESS, "       Signature verification: " _GREEN_("successful"));
+    return PM3_SUCCESS;
+}
+
 static int GetHFMF14AUID(uint8_t *uid, int *uidlen) {
     clearCommandBuffer();
     SendCommandMIX(CMD_HF_ISO14443A_READER, ISO14A_CONNECT, 0, 0, NULL, 0);
@@ -634,14 +675,14 @@ static int CmdHF14AMfWrBl(const char *Cmd) {
         PrintAndLogEx(NORMAL, "Usage:  hf mf wrbl    <block number> <key A/B> <key (12 hex symbols)> <block data (32 hex symbols)>");
         PrintAndLogEx(NORMAL, "Examples:");
         PrintAndLogEx(NORMAL, "        hf mf wrbl 1 A FFFFFFFFFFFF 000102030405060708090A0B0C0D0E0F");
-        return 0;
+        return PM3_SUCCESS;
     }
 
     blockNo = param_get8(Cmd, 0);
     cmdp = tolower(param_getchar(Cmd, 1));
     if (cmdp == 0x00) {
         PrintAndLogEx(NORMAL, "Key type must be A or B");
-        return 1;
+        return PM3_EINVARG;
     }
 
     if (cmdp != 'a')
@@ -649,12 +690,12 @@ static int CmdHF14AMfWrBl(const char *Cmd) {
 
     if (param_gethex(Cmd, 2, key, 12)) {
         PrintAndLogEx(NORMAL, "Key must include 12 HEX symbols");
-        return 1;
+        return PM3_EINVARG;
     }
 
     if (param_gethex(Cmd, 3, bldata, 32)) {
         PrintAndLogEx(NORMAL, "Block data must include 32 HEX symbols");
-        return 1;
+        return PM3_EINVARG;
     }
 
     PrintAndLogEx(NORMAL, "--block no %d, key %c - %s", blockNo, keyType ? 'B' : 'A', sprint_hex(key, 6));
@@ -674,7 +715,7 @@ static int CmdHF14AMfWrBl(const char *Cmd) {
         PrintAndLogEx(NORMAL, "Command execute timeout");
     }
 
-    return 0;
+    return PM3_SUCCESS;
 }
 
 static int CmdHF14AMfRdBl(const char *Cmd) {
@@ -706,34 +747,15 @@ static int CmdHF14AMfRdBl(const char *Cmd) {
     }
     PrintAndLogEx(NORMAL, "--block no %d, key %c - %s", blockNo, keyType ? 'B' : 'A', sprint_hex(key, 6));
 
-    mf_readblock_t payload;
-    payload.blockno = blockNo;
-    payload.keytype = keyType;
-    memcpy(payload.key, key, sizeof(payload.key));
-
-    clearCommandBuffer();
-    SendCommandNG(CMD_HF_MIFARE_READBL, (uint8_t *)&payload, sizeof(mf_readblock_t));
-
-    PacketResponseNG resp;
-    if (WaitForResponseTimeout(CMD_HF_MIFARE_READBL, &resp, 1500)) {
-        uint8_t *data = resp.data.asBytes;
-
-        if (resp.status == PM3_SUCCESS) {
-            PrintAndLogEx(NORMAL, "data: %s", sprint_hex(data, 16));
-        } else {
-            PrintAndLogEx(FAILED, "failed reading block");
-            return PM3_ESOFT;
-        }
-
+    uint8_t data[16] = {0};
+    int res =  mfReadBlock(blockNo, keyType, key, data);
+    if (res == PM3_SUCCESS) {
+        PrintAndLogEx(SUCCESS, "data: %s", sprint_hex(data, 16));
         if ((data[6] || data[7] || data[8])) {
             decode_print_st(blockNo, data);
         }
-    } else {
-        PrintAndLogEx(WARNING, "Command execute timeout");
-        return PM3_ETIMEOUT;
     }
-
-    return 0;
+    return PM3_SUCCESS;
 }
 
 static int CmdHF14AMfRdSc(const char *Cmd) {
@@ -769,30 +791,26 @@ static int CmdHF14AMfRdSc(const char *Cmd) {
     }
     PrintAndLogEx(NORMAL, "--sector no %d, key %c - %s ", sectorNo, keyType ? 'B' : 'A', sprint_hex(key, 6));
 
-    clearCommandBuffer();
-    SendCommandMIX(CMD_HF_MIFARE_READSC, sectorNo, keyType, 0, key, 6);
-    PrintAndLogEx(NORMAL, "");
-
-    PacketResponseNG resp;
-    if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
-        uint8_t isOK  = resp.oldarg[0] & 0xff;
-        uint8_t *data  = resp.data.asBytes;
-
-        PrintAndLogEx(NORMAL, "isOk:%02x", isOK);
-        if (isOK) {
-
-            uint8_t blocks = NumBlocksPerSector(sectorNo);
-            uint8_t start = FirstBlockOfSector(sectorNo);
-
-            for (int i = 0; i < blocks; i++) {
-                PrintAndLogEx(NORMAL, "%3d | %s", start + i, sprint_hex(data + (i * 16), 16));
-            }
-            decode_print_st(start + blocks - 1, data + ((blocks - 1) * 16));
-        }
-    } else {
-        PrintAndLogEx(WARNING, "Command execute timeout");
+    uint8_t sc_size = mfNumBlocksPerSector(sectorNo) * 16;
+    uint8_t *data = calloc(sc_size, sizeof(uint8_t));
+    if (data == NULL) {
+        PrintAndLogEx(ERR, "failed to allocate memory");
+        return PM3_EMALLOC;
     }
 
+    int res =  mfReadSector(sectorNo, keyType, key, data);
+    if (res == PM3_SUCCESS) {
+
+        uint8_t blocks = NumBlocksPerSector(sectorNo);
+        uint8_t start = FirstBlockOfSector(sectorNo);
+
+        for (int i = 0; i < blocks; i++) {
+            PrintAndLogEx(NORMAL, "%3d | %s", start + i, sprint_hex(data + (i * 16), 16));
+        }
+        decode_print_st(start + blocks - 1, data + ((blocks - 1) * 16));
+
+    }
+    free(data);
     return PM3_SUCCESS;
 }
 
diff --git a/client/src/cmdhfmf.h b/client/src/cmdhfmf.h
index 5325a7956..a4258bc67 100644
--- a/client/src/cmdhfmf.h
+++ b/client/src/cmdhfmf.h
@@ -24,4 +24,6 @@ void readerAttack(sector_t *k_sector, uint8_t k_sectorsCount, nonces_t data, boo
 void printKeyTable(uint8_t sectorscnt, sector_t *e_sector);
 void printKeyTableEx(uint8_t sectorscnt, sector_t *e_sector, uint8_t start_sector);
 void printKeyTable_fast(uint8_t sectorscnt, icesector_t *e_sector, uint64_t bar, uint64_t foo);
+
+int mfc_ev1_print_signature(uint8_t *uid, uint8_t uidlen, uint8_t *signature, int signature_len);
 #endif
diff --git a/client/src/crypto/libpcrypto.c b/client/src/crypto/libpcrypto.c
index 5c5455bf6..723753d5f 100644
--- a/client/src/crypto/libpcrypto.c
+++ b/client/src/crypto/libpcrypto.c
@@ -384,9 +384,8 @@ int ecdsa_signature_verify(mbedtls_ecp_group_id curveid, uint8_t *key_xy, uint8_
 
 // take signature bytes,  converts to ASN1 signature and tries to verify
 int ecdsa_signature_r_s_verify(mbedtls_ecp_group_id curveid, uint8_t *key_xy, uint8_t *input, int length, uint8_t *r_s, size_t r_s_len, bool hash) {
-    int res;
-    uint8_t signature[MBEDTLS_ECDSA_MAX_LEN];
-    size_t signature_len;
+    uint8_t signature[MBEDTLS_ECDSA_MAX_LEN] = {0};
+    size_t signature_len = 0;
 
     // convert r & s to ASN.1 signature
     mbedtls_mpi r, s;
@@ -395,7 +394,7 @@ int ecdsa_signature_r_s_verify(mbedtls_ecp_group_id curveid, uint8_t *key_xy, ui
     mbedtls_mpi_read_binary(&r, r_s, r_s_len / 2);
     mbedtls_mpi_read_binary(&s, r_s + r_s_len / 2, r_s_len / 2);
 
-    res = ecdsa_signature_to_asn1(&r, &s, signature, &signature_len);
+    int res = ecdsa_signature_to_asn1(&r, &s, signature, &signature_len);
     if (res < 0) {
         return res;
     }
diff --git a/client/src/mifare/mifarehost.c b/client/src/mifare/mifarehost.c
index 3df2e295c..c6e02013e 100644
--- a/client/src/mifare/mifarehost.c
+++ b/client/src/mifare/mifarehost.c
@@ -748,7 +748,6 @@ int mfReadSector(uint8_t sectorNo, uint8_t keyType, uint8_t *key, uint8_t *data)
 
     clearCommandBuffer();
     SendCommandMIX(CMD_HF_MIFARE_READSC, sectorNo, keyType, 0, key, 6);
-
     PacketResponseNG resp;
     if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
         uint8_t isOK  = resp.oldarg[0] & 0xff;
@@ -760,10 +759,33 @@ int mfReadSector(uint8_t sectorNo, uint8_t keyType, uint8_t *key, uint8_t *data)
             return PM3_EUNDEF;
         }
     } else {
-        PrintAndLogEx(ERR, "Command execute timeout");
+        PrintAndLogEx(DEBUG, "Command execute timeout");
         return PM3_ETIMEOUT;
     }
+    return PM3_SUCCESS;
+}
 
+int mfReadBlock(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t *data) {
+    mf_readblock_t payload = {
+        .blockno = blockNo,
+        .keytype = keyType
+    };   
+    memcpy(payload.key, key, sizeof(payload.key));
+
+    clearCommandBuffer();
+    SendCommandNG(CMD_HF_MIFARE_READBL, (uint8_t *)&payload, sizeof(mf_readblock_t));
+    PacketResponseNG resp;
+    if (WaitForResponseTimeout(CMD_HF_MIFARE_READBL, &resp, 1500)) {
+        memcpy(data, resp.data.asBytes, 16);
+
+        if (resp.status != PM3_SUCCESS) {
+            PrintAndLogEx(DEBUG, "failed reading block");
+            return PM3_ESOFT;
+        }
+    } else {
+        PrintAndLogEx(DEBUG, "Command execute timeout");
+        return PM3_ETIMEOUT;
+    }
     return PM3_SUCCESS;
 }
 
@@ -1196,3 +1218,19 @@ int detect_mf_magic(bool is_mfc) {
     }
     return isGeneration;
 }
+
+int detect_mfc_ev1_signature(uint8_t *signature) {
+    if (signature == NULL) {
+        return PM3_EINVARG;
+    }
+    uint8_t sign[32] = {0};
+    uint8_t key[] = {0x4b, 0x79, 0x1b, 0xea, 0x7b, 0xcc};    
+    int res = mfReadBlock(69, 1, key, sign);
+    if ( res == PM3_SUCCESS) {
+        res = mfReadBlock(70, 1, key, sign + 16);
+        if (res ==  PM3_SUCCESS) {
+            memcpy(signature, sign, sizeof(sign));
+        }
+    }
+    return res;
+}
\ No newline at end of file
diff --git a/client/src/mifare/mifarehost.h b/client/src/mifare/mifarehost.h
index 7a3535257..c4c65737a 100644
--- a/client/src/mifare/mifarehost.h
+++ b/client/src/mifare/mifarehost.h
@@ -70,6 +70,7 @@ int mfCheckKeys_file(uint8_t *destfn, uint64_t *key);
 int mfKeyBrute(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint64_t *resultkey);
 
 int mfReadSector(uint8_t sectorNo, uint8_t keyType, uint8_t *key, uint8_t *data);
+int mfReadBlock(uint8_t blockNo, uint8_t keyType, uint8_t *key, uint8_t *data);
 
 int mfEmlGetMem(uint8_t *data, int blockNum, int blocksCount);
 int mfEmlSetMem(uint8_t *data, int blockNum, int blocksCount);
@@ -90,5 +91,7 @@ int detect_classic_prng(void);
 int detect_classic_nackbug(bool verbose);
 int detect_mf_magic(bool is_mfc);
 int detect_classic_static_nonce(void);
+int detect_mfc_ev1_signature(uint8_t *signature);
+
 void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len, bool isEncrypted);
 #endif

From bb0d3093040905677b2b8035b095bac2a3e3fe1f Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 19 Feb 2021 13:41:28 +0100
Subject: [PATCH 606/682] amii tool now using fileutils

---
 client/deps/amiitool/Makefile   |  2 +-
 client/deps/amiitool/amiibo.c   | 25 ++++++++++++++++---------
 client/deps/amiitool/amiibo.h   |  2 +-
 client/deps/amiitool/amiitool.c |  9 ---------
 4 files changed, 18 insertions(+), 20 deletions(-)

diff --git a/client/deps/amiitool/Makefile b/client/deps/amiitool/Makefile
index dd064227e..f72a675d8 100644
--- a/client/deps/amiitool/Makefile
+++ b/client/deps/amiitool/Makefile
@@ -1,5 +1,5 @@
 MYSRCPATHS =
-MYINCLUDES = -I. -I.. -I../jansson -I../../../common -I../../../common/mbedtls -I../../../include
+MYINCLUDES = -I. -I.. -I../../../common -I../../../common/mbedtls -I../../../include -I../../src -I../../../include -I../jansson
 MYCFLAGS =
 MYDEFS =
 MYSRCS = \
diff --git a/client/deps/amiitool/amiibo.c b/client/deps/amiitool/amiibo.c
index cbe3a0ba0..d41a291fa 100644
--- a/client/deps/amiitool/amiibo.c
+++ b/client/deps/amiitool/amiibo.c
@@ -9,7 +9,9 @@
 #include "md.h"
 #include "aes.h"
 #include "commonutil.h"
+#include "../src/fileutils.h"
 
+#pragma endregion
 #define HMAC_POS_DATA 0x008
 #define HMAC_POS_TAG 0x1B4
 
@@ -131,24 +133,29 @@ void nfc3d_amiibo_pack(const nfc3d_amiibo_keys *amiiboKeys, const uint8_t *plain
     nfc3d_amiibo_internal_to_tag(cipher, tag);
 }
 
-bool nfc3d_amiibo_load_keys(nfc3d_amiibo_keys *amiiboKeys, const char *path) {
-    FILE *f = fopen(path, "rb");
-    if (!f) {
+bool nfc3d_amiibo_load_keys(nfc3d_amiibo_keys *amiiboKeys) {
+
+#define amiboo_key_fn "key_retail.bin"
+
+    uint8_t *dump = NULL;
+    size_t bytes_read = 0;
+    if (loadFile_safe(amiboo_key_fn, "", (void **)&dump, &bytes_read) != PM3_SUCCESS) {
+        PrintAndLogEx(FAILED, "File: " _YELLOW_("%s") ": not found or locked.", amiboo_key_fn);
         return false;
     }
 
-    size_t len = fread(amiiboKeys, sizeof(*amiiboKeys), 1, f);
-    fclose(f);
-
-    if (len != sizeof(*amiiboKeys)) {
+    if (bytes_read != sizeof(*amiiboKeys)) {
+        free(dump);
         return false;
     }
 
-    if ((amiiboKeys->data.magicBytesSize > 16) ||
-            (amiiboKeys->tag.magicBytesSize > 16)) {
+    if ((amiiboKeys->data.magicBytesSize > 16) ||  (amiiboKeys->tag.magicBytesSize > 16)) {
+        free(dump);
         return false;
     }
 
+    memcpy(amiiboKeys, dump, bytes_read);
+    free(dump);
     return true;
 }
 
diff --git a/client/deps/amiitool/amiibo.h b/client/deps/amiitool/amiibo.h
index 47d544875..4ba0db7cd 100644
--- a/client/deps/amiitool/amiibo.h
+++ b/client/deps/amiitool/amiibo.h
@@ -25,7 +25,7 @@ typedef struct {
 
 bool nfc3d_amiibo_unpack(const nfc3d_amiibo_keys *amiiboKeys, const uint8_t *tag, uint8_t *plain);
 void nfc3d_amiibo_pack(const nfc3d_amiibo_keys *amiiboKeys, const uint8_t *plain, uint8_t *tag);
-bool nfc3d_amiibo_load_keys(nfc3d_amiibo_keys *amiiboKeys, const char *path);
+bool nfc3d_amiibo_load_keys(nfc3d_amiibo_keys *amiiboKeys);
 void nfc3d_amiibo_copy_app_data(const uint8_t *src, uint8_t *dst);
 
 #endif
diff --git a/client/deps/amiitool/amiitool.c b/client/deps/amiitool/amiitool.c
index d7cd08351..61f4abd81 100644
--- a/client/deps/amiitool/amiitool.c
+++ b/client/deps/amiitool/amiitool.c
@@ -33,15 +33,6 @@ void amiitool_usage(void) {
            );
 }
 
-static bool LoadAmiikey(nfc3d_amiibo_keys keys, char *keyfile) {
-
-    if (!nfc3d_amiibo_load_keys(&keys, keyfile)) {
-        PrintAndLogEx(ERR, "Could not load keys from '%s'", keyfile);
-        return false;
-    }
-    return true;
-}
-
 int main(int argc, char **argv) {
     self = argv[0];
 

From 17bce5fb5a66831b2c8fb5563ec81f0be27089c7 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 19 Feb 2021 13:42:15 +0100
Subject: [PATCH 607/682] stack warning fix,  dont like to fiddle with mbedtls
 but all our tests works..

---
 common/mbedtls/ecdsa.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/common/mbedtls/ecdsa.c b/common/mbedtls/ecdsa.c
index 1d087f386..a7d7bb720 100644
--- a/common/mbedtls/ecdsa.c
+++ b/common/mbedtls/ecdsa.c
@@ -289,20 +289,18 @@ cleanup:
 int ecdsa_signature_to_asn1(const mbedtls_mpi *r, const mbedtls_mpi *s,
                             unsigned char *sig, size_t *slen) {
     int ret;
-    unsigned char buf[MBEDTLS_ECDSA_MAX_LEN];
-    unsigned char *p = buf + sizeof(buf);
+    unsigned char buf[MBEDTLS_ECDSA_MAX_LEN] = {0};
+    unsigned char *p = buf + sizeof(buf) - 1;
     size_t len = 0;
 
     MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_mpi(&p, buf, s));
     MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_mpi(&p, buf, r));
 
     MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(&p, buf, len));
-    MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_tag(&p, buf,
-                                                     MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE));
+    MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_tag(&p, buf, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE));
 
     memcpy(sig, p, len);
     *slen = len;
-
     return (0);
 }
 

From 0bfb6cd625f20195b3f1f1b9973bbe546edab85a Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 19 Feb 2021 14:20:04 +0100
Subject: [PATCH 608/682] fix NIL

---
 client/luascripts/data_mf_bin2eml.lua | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/client/luascripts/data_mf_bin2eml.lua b/client/luascripts/data_mf_bin2eml.lua
index 8312fc292..5f9354e55 100644
--- a/client/luascripts/data_mf_bin2eml.lua
+++ b/client/luascripts/data_mf_bin2eml.lua
@@ -115,8 +115,7 @@ local function main(args)
 
    local dumpdata = readdump(infile)
     -- The hex-data is now in ascii-format,
-   if dumpdata == NIL then return oops('Dumpfle not loaded') end
-
+   if dumpdata == nil then return oops('Dumpfle not loaded') end
 
     -- But first, check the uid
     local uid = string.sub(dumpdata, 1, 8)
@@ -124,8 +123,7 @@ local function main(args)
 
     -- Format some linebreaks
     dumpdata = convert_to_emulform(dumpdata)
-   if dumpdata == NIL then return oops('Dumpfle not loaded') end
-
+   if dumpdata == nil then return oops('Dumpfle not loaded') end
 
     local outfile = io.open(output, 'w')
     if outfile == nil then

From aa65426e563a712d1207d0a1a9f91a361f910fd3 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 19 Feb 2021 14:30:36 +0100
Subject: [PATCH 609/682] fix compilation

---
 client/deps/amiitool/amiibo.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/client/deps/amiitool/amiibo.c b/client/deps/amiitool/amiibo.c
index d41a291fa..edf7eb45f 100644
--- a/client/deps/amiitool/amiibo.c
+++ b/client/deps/amiitool/amiibo.c
@@ -11,7 +11,6 @@
 #include "commonutil.h"
 #include "../src/fileutils.h"
 
-#pragma endregion
 #define HMAC_POS_DATA 0x008
 #define HMAC_POS_TAG 0x1B4
 

From f6b1cfd64c282cc3232ef850168f5d033f15b8fd Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 19 Feb 2021 16:56:22 +0100
Subject: [PATCH 610/682] maur pk

---
 client/src/cmdhfmfdes.c | 9 +++++----
 client/src/cmdhfmfp.c   | 3 ++-
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhfmfdes.c b/client/src/cmdhfmfdes.c
index fa9b29b18..fc55a2c26 100644
--- a/client/src/cmdhfmfdes.c
+++ b/client/src/cmdhfmfdes.c
@@ -1306,11 +1306,12 @@ static int desfire_print_signature(uint8_t *uid, uint8_t uidlen, uint8_t *signat
     const ecdsa_publickey_t nxp_desfire_public_keys[] = {
         {"NTAG424DNA, DESFire EV2", "048A9B380AF2EE1B98DC417FECC263F8449C7625CECE82D9B916C992DA209D68422B81EC20B65A66B5102A61596AF3379200599316A00A1410"},
         {"NTAG413DNA, DESFire EV1", "04BB5D514F7050025C7D0F397310360EEC91EAF792E96FC7E0F496CB4E669D414F877B7B27901FE67C2E3B33CD39D1C797715189AC951C2ADD"},
-        {"DESFire EV2",             "04B304DC4C615F5326FE9383DDEC9AA892DF3A57FA7FFB3276192BC0EAA252ED45A865E3B093A3D0DCE5BE29E92F1392CE7DE321E3E5C52B3A"},
-        {"DESFire EV3",             "041DB46C145D0A36539C6544BD6D9B0AA62FF91EC48CBC6ABAE36E0089A46F0D08C8A715EA40A63313B92E90DDC1730230E0458A33276FB743"},
+        {"DESFire EV2", "04B304DC4C615F5326FE9383DDEC9AA892DF3A57FA7FFB3276192BC0EAA252ED45A865E3B093A3D0DCE5BE29E92F1392CE7DE321E3E5C52B3A"},
+        {"DESFire EV3", "041DB46C145D0A36539C6544BD6D9B0AA62FF91EC48CBC6ABAE36E0089A46F0D08C8A715EA40A63313B92E90DDC1730230E0458A33276FB743"},
         {"NTAG424DNA, NTAG424DNATT, DESFire Light EV2", "04B304DC4C615F5326FE9383DDEC9AA892DF3A57FA7FFB3276192BC0EAA252ED45A865E3B093A3D0DCE5BE29E92F1392CE7DE321E3E5C52B3B"},
-        {"DESFire Light",       "040E98E117AAA36457F43173DC920A8757267F44CE4EC5ADD3C54075571AEBBF7B942A9774A1D94AD02572427E5AE0A2DD36591B1FB34FCF3D"},
-        {"MIFARE Plus EV1",         "044409ADC42F91A8394066BA83D872FB1D16803734E911170412DDF8BAD1A4DADFD0416291AFE1C748253925DA39A5F39A1C557FFACD34C62E"}
+        {"DESFire Light", "040E98E117AAA36457F43173DC920A8757267F44CE4EC5ADD3C54075571AEBBF7B942A9774A1D94AD02572427E5AE0A2DD36591B1FB34FCF3D"},
+        {"MIFARE Plus EV1", "044409ADC42F91A8394066BA83D872FB1D16803734E911170412DDF8BAD1A4DADFD0416291AFE1C748253925DA39A5F39A1C557FFACD34C62E"}
+        {"MIFARE Pluc Evx", "04BB49AE4447E6B1B6D21C098C1538B594A11A4A1DBF3D5E673DEACDEB3CC512D1C08AFA1A2768CE20A200BACD2DC7804CD7523A0131ABF607"},
     };
 
 
diff --git a/client/src/cmdhfmfp.c b/client/src/cmdhfmfp.c
index ab41bcf41..411c96bbf 100644
--- a/client/src/cmdhfmfp.c
+++ b/client/src/cmdhfmfp.c
@@ -163,7 +163,8 @@ static int plus_print_signature(uint8_t *uid, uint8_t uidlen, uint8_t *signature
     // ref:  MIFARE Plus EV1 Originality Signature Validation
 #define PUBLIC_PLUS_ECDA_KEYLEN 57
     const ecdsa_publickey_t nxp_plus_public_keys[] = {
-        {"Mifare Plus EV1",             "044409ADC42F91A8394066BA83D872FB1D16803734E911170412DDF8BAD1A4DADFD0416291AFE1C748253925DA39A5F39A1C557FFACD34C62E"}
+        {"MIFARE Plus EV1",  "044409ADC42F91A8394066BA83D872FB1D16803734E911170412DDF8BAD1A4DADFD0416291AFE1C748253925DA39A5F39A1C557FFACD34C62E"},
+        {"MIFARE Pluc Ev_x", "04BB49AE4447E6B1B6D21C098C1538B594A11A4A1DBF3D5E673DEACDEB3CC512D1C08AFA1A2768CE20A200BACD2DC7804CD7523A0131ABF607"}
     };
 
     uint8_t i;

From bf62e4757584736bdcd76eac89c91f1c28a78321 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 19 Feb 2021 17:37:41 +0100
Subject: [PATCH 611/682] fix....

---
 client/src/cmdhfmfdes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhfmfdes.c b/client/src/cmdhfmfdes.c
index fc55a2c26..c208367bc 100644
--- a/client/src/cmdhfmfdes.c
+++ b/client/src/cmdhfmfdes.c
@@ -1310,7 +1310,7 @@ static int desfire_print_signature(uint8_t *uid, uint8_t uidlen, uint8_t *signat
         {"DESFire EV3", "041DB46C145D0A36539C6544BD6D9B0AA62FF91EC48CBC6ABAE36E0089A46F0D08C8A715EA40A63313B92E90DDC1730230E0458A33276FB743"},
         {"NTAG424DNA, NTAG424DNATT, DESFire Light EV2", "04B304DC4C615F5326FE9383DDEC9AA892DF3A57FA7FFB3276192BC0EAA252ED45A865E3B093A3D0DCE5BE29E92F1392CE7DE321E3E5C52B3B"},
         {"DESFire Light", "040E98E117AAA36457F43173DC920A8757267F44CE4EC5ADD3C54075571AEBBF7B942A9774A1D94AD02572427E5AE0A2DD36591B1FB34FCF3D"},
-        {"MIFARE Plus EV1", "044409ADC42F91A8394066BA83D872FB1D16803734E911170412DDF8BAD1A4DADFD0416291AFE1C748253925DA39A5F39A1C557FFACD34C62E"}
+        {"MIFARE Plus EV1", "044409ADC42F91A8394066BA83D872FB1D16803734E911170412DDF8BAD1A4DADFD0416291AFE1C748253925DA39A5F39A1C557FFACD34C62E"},
         {"MIFARE Pluc Evx", "04BB49AE4447E6B1B6D21C098C1538B594A11A4A1DBF3D5E673DEACDEB3CC512D1C08AFA1A2768CE20A200BACD2DC7804CD7523A0131ABF607"},
     };
 

From 937e754830ca2a2713ccfa3cd755e41e10c8629d Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 19 Feb 2021 19:10:21 +0100
Subject: [PATCH 612/682] sort out amiitool linking to pm3 client in cmake

---
 client/deps/amiibo.cmake | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/client/deps/amiibo.cmake b/client/deps/amiibo.cmake
index 491d90d60..c946c0682 100644
--- a/client/deps/amiibo.cmake
+++ b/client/deps/amiibo.cmake
@@ -14,10 +14,18 @@ add_library(pm3rrg_rdv4_amiibo STATIC
 if (NOT TARGET pm3rrg_rdv4_mbedtls)
   include(mbedtls.cmake)
 endif()
+
 target_link_libraries(pm3rrg_rdv4_amiibo PRIVATE
         m
         pm3rrg_rdv4_mbedtls)
-target_include_directories(pm3rrg_rdv4_amiibo PRIVATE ../../include ../../common)
-target_include_directories(pm3rrg_rdv4_amiibo INTERFACE amiitool)
+
 target_compile_options(pm3rrg_rdv4_amiibo PRIVATE -Wall -Werror -O3)
 set_property(TARGET pm3rrg_rdv4_amiibo PROPERTY POSITION_INDEPENDENT_CODE ON)
+
+target_include_directories(pm3rrg_rdv4_amiibo PRIVATE amiitool
+            ../../common
+            ../../include
+            ../src
+            jansson)
+
+target_include_directories(pm3rrg_rdv4_amiibo INTERFACE amiitool)
\ No newline at end of file

From c954180399dc9853630122ad38dc3ad0188eb5db Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 19 Feb 2021 19:32:50 +0100
Subject: [PATCH 613/682] text

---
 CHANGELOG.md | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b730df269..ab629c19e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,11 +3,19 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+ - Change, numerous commands more uses cliparser (@tcprst, @iceman1001)
+ - Added more originality public keys (@anon)
+ - Added `hf 14a info` - now also verify MFC Ev1 signatures (@iceman1001)
  - Added `LF_THAREXDE` standalone mode which simulates and reads EM4x50 cards (@tharexde)
  - Added `hf jooki` commands (@iceman1001)
+ - Changed `lf hid clone` - also accepts binary wiegand (@iceman1001)
  - Changed `wiegand encode` - format param is now optional, w/o it will try encode all formats (@iceman1001)
  - Fix cppchecker warnings (@iceman1001)
- - Added `trace list -t mf` - now can use external dictionary keys file
+ - Added `trace list -t mf` - now can use external dictionary keys file (@McEloff)
+ - Fix `lf gallagher read` - now correctly decodes card data
+ - Add support to `lf gallagher clone` and `lf gallagher sim` for writing specific card region, facility, card & issue numbers (@DarkMatterMatt)
+ - Added support for older vid/pid detection (@Gator96100)
+ - Added `hf mfdes bruteaid` - proper bruteforce of DESFire AID when no reading of files is possible (@craftbyte)
  - Added support for bidirectional communication for `lf em 4x50 sim` (@tharexde)
  - Change `PLATFORM=PM3OTHER` to `PLATFORM=PM3GENERIC` (@iceman1001)
  - Added `tools/hitag2crack/crack5opencl`, an optimized version of `crack5gpu` (@matrix)
@@ -133,8 +141,6 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
  - Change, use system Whereami library if available (@doegox)
  - Change, use system Zlib library if available (@doegox)
  - Fix release version information (@doegox)
- - Fix `lf gallagher read` - now correctly decodes card data
- - Add support to `lf gallagher clone` and `lf gallagher sim` for writing specific card region, facility, card & issue numbers (@DarkMatterMatt)
 
 ## [ice coffee.4.9237][2020-05-21]
  - Updated documentation (@doegox, @iceman1001)

From 292bbe5738372302f6387e258951ce05a710699a Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 19 Feb 2021 20:14:11 +0100
Subject: [PATCH 614/682] Added new bulk enrolling lua script for EM4100 for
 Amal

---
 client/luascripts/lf_em4100_bulk.lua | 168 +++++++++++++++++++++++++++
 1 file changed, 168 insertions(+)
 create mode 100644 client/luascripts/lf_em4100_bulk.lua

diff --git a/client/luascripts/lf_em4100_bulk.lua b/client/luascripts/lf_em4100_bulk.lua
new file mode 100644
index 000000000..30aaa98fc
--- /dev/null
+++ b/client/luascripts/lf_em4100_bulk.lua
@@ -0,0 +1,168 @@
+local getopt = require('getopt')
+local utils = require('utils')
+local ac = require('ansicolors')
+
+copyright = ''
+author = "Christian Herrmann"
+version = 'v1.0.0'
+desc = [[
+Perform bulk EM410x enrollment of T5577 RFID tags.  It keeps track of last card id used.
+If called with -s,  this value resets "session".
+
+if press <enter>  it defaults to Y,  which writes a ID.
+Any other input char will exit the script.
+
+]]
+example = [[
+    -- resets and start enrolling EM410x id 11CC334455    
+    script run lf_em4100_bulk.lua -s 11CC334455
+
+    -- continue enrolling from where last iteration
+    script run lf_em4100_bulk.lua -c
+]]
+usage = [[
+script run lf_en4100_bulk.lua [-h] [-c] [-s <start cn>]
+]]
+arguments = [[
+    -h      : this help
+    -c      : continue from last card number used
+    -s      : starting card number
+    ]]
+
+    -- Some globals
+local DEBUG = false
+local ENROLL_STATUS_FN = 'lf_em4100_status.txt'
+---
+-- A debug printout-function
+local function dbg(args)
+    if not DEBUG then return end
+    if type(args) == 'table' then
+        local i = 1
+        while args[i] do
+            dbg(args[i])
+            i = i+1
+        end
+    else
+        print('###', args)
+    end
+end
+---
+-- This is only meant to be used when errors occur
+local function oops(err)
+    print('ERROR:', err)
+    core.clearCommandBuffer()
+    return nil, errr
+end
+---
+-- Usage help
+local function help()
+    print(copyright)
+    print(author)
+    print(version)
+    print(desc)
+    print(ac.cyan..'Usage'..ac.reset)
+    print(usage)
+    print(ac.cyan..'Arguments'..ac.reset)
+    print(arguments)
+    print(ac.cyan..'Example usage'..ac.reset)
+    print(example)
+end
+---
+-- Exit message
+local function exitMsg(msg)
+    print( string.rep('--',20) )
+    print( string.rep('--',20) )
+    print(msg)
+    print()
+end
+---
+--
+local function readfile()
+    local f = io.open(ENROLL_STATUS_FN, "r")
+    if f == nil then
+        return nil, string.format("Could not read file %s", ENROLL_STATUS_FN)
+    end
+    local t = f:read("*all")
+    f:close()
+    local cn = tonumber(t, 16)
+    print(('Using EM4100 ID '..ac.green..'%010X'..ac.reset..' from `'..ac.yellow..'%s'..ac.reset..'`'):format(cn, ENROLL_STATUS_FN))
+    return cn
+end
+---
+--
+local function writefile(cn)
+    local f = io.open(ENROLL_STATUS_FN, "w")
+    if f == nil then
+        return nil, string.format("Could not write to file %s", ENROLL_STATUS_FN)
+    end
+    f:write(("%010X\n"):format(cn))
+    f:close()
+    print(('Wrote EM4100 ID '..ac.green..'%010X'..ac.reset..' to `'..ac.yellow..'%s'..ac.reset..'`'):format(cn, ENROLL_STATUS_FN))
+    return true, 'Ok'
+end
+
+---
+-- main
+local function main(args)
+
+    print( string.rep('--',20) )
+    print( string.rep('--',20) )
+    print()
+
+    if #args == 0 then return help() end
+
+    local shall_continue = false
+    local startid = ''
+
+    for o, a in getopt.getopt(args, 'cs:h') do
+        if o == 'h' then return help() end
+        if o == 'c' then
+            shall_continue = true
+        end
+        if o == 's' then startid = a end
+    end
+
+    -- if reset/start over, check -s
+    if not shall_continue then 
+        if startid == nil then return oops('empty card number string') end
+        if #startid == 0 then return oops('empty card number string') end
+        if #startid ~= 10 then return oops('card number wrong length. Should be 5 hex bytes') end
+    end
+
+    core.console('clear')
+    print(ac.red..'disable hints for less output'..ac.reset)
+    core.console('pref set hint --off')
+    print('')
+    
+    local sid = tonumber(startid, 16)    
+    if shall_continue then
+        print('Continue enrolling from last save')
+        sid = readfile()
+    else
+        print('reset & starting enrolling from refresh')
+    end
+   
+    local template = 'EM4100 ID '..ac.green..'%010X'..ac.reset
+    local curr = sid
+    for i = sid, sid + 10000, 1 do
+        curr = i
+
+        print('')
+        print( string.rep('--',20) )
+        local msg = (template):format(curr)
+        local ans = utils.input(msg, 'y'):lower()
+        if ans == 'y' then
+            core.console( ('lf em 410x clone --id %010X'):format(curr) )
+            --        print ( ('lf em 410x clone --id %010X'):format(curr) )
+        else
+            print(ac.red..'User aborted'..ac.reset)
+            break
+        end
+    end
+    writefile(curr)
+
+    print('enabling hints again')
+    core.console('pref set hint --on')
+end
+
+main(args)

From bee970721c2543a6b2ef71c94236cfa7a4df0e7f Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 19 Feb 2021 20:38:53 +0100
Subject: [PATCH 615/682] text

---
 doc/md/Use_of_Proxmark/1_Validation.md | 38 ++++++++++++--------------
 1 file changed, 18 insertions(+), 20 deletions(-)

diff --git a/doc/md/Use_of_Proxmark/1_Validation.md b/doc/md/Use_of_Proxmark/1_Validation.md
index 9bb93c453..6f644d206 100644
--- a/doc/md/Use_of_Proxmark/1_Validation.md
+++ b/doc/md/Use_of_Proxmark/1_Validation.md
@@ -4,7 +4,6 @@ If all went well you should get some information about the firmware and memory u
 
 ```
 [=] Session log /home/iceman/.proxmark3/log_20200521.txt
-[=] Loading Preferences...
 [+] loaded from JSON file /home/iceman/.proxmark3/preferences.json
 [=] Using UART port /dev/ttyS7
 [=] Communicating with PM3 over USB-CDC
@@ -13,10 +12,11 @@ If all went well you should get some information about the firmware and memory u
 ██████╗ ███╗   ███╗ ████╗  
 ██╔══██╗████╗ ████║   ══█║ 
 ██████╔╝██╔████╔██║ ████╔╝ 
-██╔═══╝ ██║╚██╔╝██║   ══█║    iceman@icesql.net
-██║     ██║ ╚═╝ ██║ ████╔╝    https://github.com/rfidresearchgroup/proxmark3/
-╚═╝     ╚═╝     ╚═╝ ╚═══╝  Release v4.9237 - Ice Coffee
-
+██╔═══╝ ██║╚██╔╝██║   ══█║ 
+██║     ██║ ╚═╝ ██║ ████╔╝     Iceman ☕
+╚═╝     ╚═╝     ╚═╝ ╚═══╝  ❄️ bleeding edge
+ 
+ https://github.com/rfidresearchgroup/proxmark3/
 
  [ Proxmark3 RFID instrument ] 
 
@@ -25,30 +25,28 @@ If all went well you should get some information about the firmware and memory u
   compiled with GCC 9.3.0 OS:Linux ARCH:x86_64
  
  [ PROXMARK RDV4 ]
-  external flash:                  present 
-  smartcard reader:                present 
-
- [ PROXMARK RDV4 Extras ]
-  FPC USART for BT add-on support: absent 
+  device.................... RDV4
+  firmware.................. RDV4
+  external flash............ present
+  smartcard reader.......... present
+  FPC USART for BT add-on... absent
 
  [ ARM ]
  bootrom: RRG/Iceman/master/v4.9237-2-g2cb19874 2020-05-21 22:00:10
       os: RRG/Iceman/master/v4.9237-2-g2cb19874 2019-05-21 22:00:26
- compiled with GCC 8.3.1 20190703 (release) [gcc-8-branch revision 273027]
+ compiled with GCC 9.2.1 20191025 (release) [ARM/arm-9-branch revision 277599]
 
  [ FPGA ]
- LF image built for 2s30vq100 on 2020/02/22 at 12:51:14
- HF image built for 2s30vq100 on 2020/01/12 at 15:31:16
+  LF image built for 2s30vq100 on 2020-07-08 at 23: 8: 7
+  HF image built for 2s30vq100 on 2020-07-08 at 23: 8:19
+  HF FeliCa image built for 2s30vq100 on 2020-07-08 at 23: 8:30
 
  [ Hardware ] 
-  --= uC: AT91SAM7S512 Rev B
+  --= uC: AT91SAM7S512 Rev A
   --= Embedded Processor: ARM7TDMI
-  --= Nonvolatile Program Memory Size: 512K bytes, Used: 291382 bytes (56%) Free: 232906 bytes (44%)
-  --= Second Nonvolatile Program Memory Size: None
-  --= Internal SRAM Size: 64K bytes
-  --= Architecture Identifier: AT91SAM7Sxx Series
-  --= Nonvolatile Program Memory Type: Embedded Flash Memory
-
+  --= Internal SRAM size: 64K bytes
+  --= Architecture identifier: AT91SAM7Sxx Series
+  --= Embedded flash memory 512K bytes ( 59% used )
 
 [usb] pm3 --> 
 ```

From e729d1804da83a6bfab16db08610cca67532bf84 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 19 Feb 2021 20:40:00 +0100
Subject: [PATCH 616/682] text

---
 client/src/cmdhw.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhw.c b/client/src/cmdhw.c
index 24c292bbe..fb560b2ee 100644
--- a/client/src/cmdhw.c
+++ b/client/src/cmdhw.c
@@ -226,10 +226,10 @@ static void lookupChipID(uint32_t iChipID, uint32_t mem_used) {
             sprintf(asBuff, "ROMless or on-chip Flash");
             break;
         case 2:
-            sprintf(asBuff, "Embedded Flash Memory");
+            sprintf(asBuff, "Embedded flash memory");
             break;
         case 3:
-            sprintf(asBuff, "ROM and Embedded Flash Memory\nNVPSIZ is ROM size\nNVPSIZ2 is Flash size");
+            sprintf(asBuff, "ROM and Embedded flash memory\nNVPSIZ is ROM size\nNVPSIZ2 is Flash size");
             break;
         case 4:
             sprintf(asBuff, "SRAM emulating ROM");
@@ -268,12 +268,13 @@ static void lookupChipID(uint32_t iChipID, uint32_t mem_used) {
             break;
     }
 
-    PrintAndLogEx(NORMAL, "  --= Nonvolatile program memory: " _YELLOW_("%uK") " bytes %s ( " _YELLOW_("%2.0f%%") " used )"
-                  , mem_avail
+    PrintAndLogEx(NORMAL, "  --= %s " _YELLOW_("%uK") " bytes ( " _YELLOW_("%2.0f%%") " used )"
                   , asBuff
+                  , mem_avail
                   , mem_avail == 0 ? 0.0f : (float)mem_used / (mem_avail * 1024) * 100
                  );
 
+    /*
     switch ((iChipID & 0xF000) >> 12) {
         case 0:
             sprintf(asBuff, "None");
@@ -307,6 +308,7 @@ static void lookupChipID(uint32_t iChipID, uint32_t mem_used) {
             break;
     }
     PrintAndLogEx(NORMAL, "  --= Second nonvolatile program memory size: %s", asBuff);
+    */
 }
 
 static int CmdDbg(const char *Cmd) {
@@ -1003,5 +1005,5 @@ void pm3_version(bool verbose, bool oneliner) {
 
         lookupChipID(payload->id, payload->section_size);
     }
-    PrintAndLogEx(NORMAL, "\n");
+    PrintAndLogEx(NORMAL, "");
 }

From f00c00c150bc28e9d244dc8e95e487d214245b6c Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Fri, 19 Feb 2021 20:41:32 +0100
Subject: [PATCH 617/682] hf mfu info - start in identify system of a mfu/ntag
 tag

---
 client/src/cmdhfmfu.c | 280 +++++++++++++++++++++++++++++++++++++++---
 1 file changed, 264 insertions(+), 16 deletions(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index 5a74149a5..3c974e743 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -745,13 +745,13 @@ static int ulev1_print_signature(TagTypeUL_t tagtype, uint8_t *uid, uint8_t *sig
     // ref: AN11350 NTAG 21x Originality Signature Validation
     // ref: AN11341 MIFARE Ultralight EV1 Originality Signature Validation
     const ecdsa_publickey_t nxp_mfu_public_keys[] = {
-        {"NXP Mifare Classic MFC1C14_x", "044F6D3F294DEA5737F0F46FFEE88A356EED95695DD7E0C27A591E6F6F65962BAF"},
-        {"Manufacturer Mifare Classic MFC1C14_x", "046F70AC557F5461CE5052C8E4A7838C11C7A236797E8A0730A101837C004039C2"},
-        {"NXP ICODE DNA, ICODE SLIX2", "048878A2A2D3EEC336B4F261A082BD71F9BE11C4E2E896648B32EFA59CEA6E59F0"},
-        {"NXP Public key", "04A748B6A632FBEE2C0897702B33BEA1C074998E17B84ACA04FF267E5D2C91F6DC"},
-        {"NXP Ultralight Ev1", "0490933BDCD6E99B4E255E3DA55389A827564E11718E017292FAF23226A96614B8"},
-        {"NXP NTAG21x (2013)", "04494E1A386D3D3CFE3DC10E5DE68A499B1C202DB5B132393E89ED19FE5BE8BC61"},
-        {"MIKRON Public key", "04f971eda742a4a80d32dcf6a814a707cc3dc396d35902f72929fdcd698b3468f2"},
+        {"NXP MIFARE Classic MFC1C14_x",          "044F6D3F294DEA5737F0F46FFEE88A356EED95695DD7E0C27A591E6F6F65962BAF"},
+        {"Manufacturer MIFARE Classic MFC1C14_x", "046F70AC557F5461CE5052C8E4A7838C11C7A236797E8A0730A101837C004039C2"},
+        {"NXP ICODE DNA, ICODE SLIX2",            "048878A2A2D3EEC336B4F261A082BD71F9BE11C4E2E896648B32EFA59CEA6E59F0"},
+        {"NXP Public key",                        "04A748B6A632FBEE2C0897702B33BEA1C074998E17B84ACA04FF267E5D2C91F6DC"},
+        {"NXP Ultralight Ev1",                    "0490933BDCD6E99B4E255E3DA55389A827564E11718E017292FAF23226A96614B8"},
+        {"NXP NTAG21x (2013)",                    "04494E1A386D3D3CFE3DC10E5DE68A499B1C202DB5B132393E89ED19FE5BE8BC61"},
+        {"MIKRON Public key",                     "04f971eda742a4a80d32dcf6a814a707cc3dc396d35902f72929fdcd698b3468f2"},
     };
 
     /*
@@ -805,7 +805,7 @@ static int ulev1_print_signature(TagTypeUL_t tagtype, uint8_t *uid, uint8_t *sig
     for (i = 0; i < ARRAYLEN(nxp_mfu_public_keys); i++) {
 
         int dl = 0;
-        uint8_t key[PUBLIC_ECDA_KEYLEN];
+        uint8_t key[PUBLIC_ECDA_KEYLEN] = {0};
         param_gethex_to_eol(nxp_mfu_public_keys[i].value, 0, key, PUBLIC_ECDA_KEYLEN, &dl);
 
         int res = ecdsa_signature_r_s_verify(MBEDTLS_ECP_DP_SECP128R1, key, uid, 7, signature, signature_len, false);
@@ -941,6 +941,249 @@ static char *GenerateFilename(const char *prefix, const char *suffix) {
     return fptr;
 }
 
+//------------------------------------
+/*
+static int mfu_decrypt_amiibo(uint8_t *encrypted, uint16_t elen, uint8_t *decrypted, uint16_t *dlen) {
+
+    if (elen < NFC3D_AMIIBO_SIZE / 4) {
+        PrintAndLogEx(ERR, "ERR,  data wrong length, got %zu , expected %zu", elen,  (NFC3D_AMIIBO_SIZE / 4));
+        return PM3_ESOFT;        
+    }
+
+    nfc3d_amiibo_keys amiibo_keys = {0};
+    if (nfc3d_amiibo_load_keys(&amiibo_keys) == false) {
+        return PM3_ESOFT;
+    }
+
+    if (nfc3d_amiibo_unpack(&amiibo_keys, encrypted, decrypted) == false) {
+        PrintAndLogEx(ERR, "WARNING, Tag signature was NOT valid");
+    }
+
+    *dlen = NFC3D_AMIIBO_SIZE;    
+    return PM3_SUCCESS;
+}
+static int mfu_dump_tag(uint16_t pages, void **pdata, uint16_t *len) {
+
+    int res = PM3_SUCCESS;
+    uint16_t maxbytes = (pages * 4);
+
+    *pdata = calloc(maxbytes, sizeof(uint8_t));
+    if (*pdata == NULL) {
+        PrintAndLogEx(FAILED, "error, cannot allocate memory");
+        res = PM3_EMALLOC;
+        goto out;
+    }
+
+    clearCommandBuffer();
+    SendCommandMIX(CMD_HF_MIFAREU_READCARD, 0, pages, 0, NULL, 0);
+    PacketResponseNG resp;
+    if (WaitForResponseTimeout(CMD_ACK, &resp, 2500) == false) {
+        PrintAndLogEx(WARNING, "Command execute time-out");
+        free(*pdata);
+        res = PM3_ETIMEOUT;
+        goto out;
+    }
+
+    if (resp.oldarg[0] != 1) {
+        PrintAndLogEx(WARNING, "Failed reading card");
+        free(*pdata);
+        res = PM3_ESOFT;
+        goto out;
+    }
+
+    // read all memory
+    uint32_t startindex = resp.oldarg[2];
+    uint32_t buffer_size = resp.oldarg[1];
+    if (buffer_size > maxbytes) {
+        PrintAndLogEx(FAILED, "Data exceeded buffer size!");
+        buffer_size = maxbytes;
+    }
+
+    if (!GetFromDevice(BIG_BUF, *pdata, buffer_size, startindex, NULL, 0, NULL, 2500, false)) {
+        PrintAndLogEx(WARNING, "command execution time out");
+        free(*pdata);
+        res = PM3_ETIMEOUT;
+        goto out;
+    }
+
+    if (len)
+        *len = buffer_size;
+
+out:
+    return res;
+}
+*/
+/*
+Lego Dimensions, 
+  Version: 00 04 04 02 01 00 0F 03
+  
+  matching bytes: 
+  index 12  ( 3 * 4 )
+   E1 10 12 00 01 03 A0 0C 34 03 13 D1 01 0F 54 02 65 6E
+*/
+
+typedef struct {
+    const char *desc;
+    const char *version;
+    uint8_t mpos;
+    uint8_t mlen;
+    const char *match;
+    uint32_t (*Pwd)(uint8_t *uid);
+    uint16_t (*Pack)(uint8_t *uid);
+    const char *hint;
+} PACKED mfu_identify_t;
+
+static mfu_identify_t mfu_ident_table[] = {
+    {
+        "Jooki", "0004040201000F03",
+        12, 32, "E11012000103A00C340329D101255504732E6A6F6F6B692E726F636B732F732F",
+        NULL, NULL,
+        "hf jooki decode -r"
+    },
+    {
+        "Lego Dimensions", "0004040201000F03",
+        12, 18, "E11012000103A00C340313D1010F5402656E",
+        ul_ev1_pwdgenC, ul_ev1_packgenC,
+        "hf mfu dump -k %08x"
+    },
+    {
+        "Amiibo", "0004040201001103",
+        9, 9, "480FE0F110FFEEA500",
+        ul_ev1_pwdgenB, ul_ev1_packgenB,
+        "hf mfu dump -k %08x"
+    },
+    {NULL, NULL, 0, 0, NULL, NULL, NULL, NULL}
+};
+
+static mfu_identify_t* mfu_match_fingerprint(uint8_t *version, uint8_t *data) {
+    uint8_t i = 0;
+    do {
+
+        int vl = 0;
+        uint8_t vtmp[10] = {0};
+        param_gethex_to_eol(mfu_ident_table[i].version, 0, vtmp, sizeof(vtmp), &vl);
+
+        bool m1 = (memcmp(vtmp, version, vl) == 0);
+        if (m1 == false) {
+            PrintAndLogEx(DEBUG, "(fingerprint) wrong version");
+            continue;
+        }
+
+        int ml = 0;
+        uint8_t mtmp[40] = {0};
+        param_gethex_to_eol(mfu_ident_table[i].match, 0, mtmp, sizeof(mtmp), &ml);
+
+        bool m2 = (memcmp(mtmp, data + mfu_ident_table[i].mpos, mfu_ident_table[i].mlen) == 0);
+        if (m2) {
+            PrintAndLogEx(DEBUG, "(fingerprint) found %s", mfu_ident_table[i].desc);
+            return &mfu_ident_table[i];
+        }
+    } while (mfu_ident_table[++i].desc);
+    return NULL;
+}
+
+static uint8_t mfu_max_len(void) {
+    uint8_t n = 0, i = 0;
+    do {
+        uint8_t tmp = mfu_ident_table[i].mpos + mfu_ident_table[i].mlen;
+        if (tmp > n) {
+            n = tmp;
+        }
+    } while (mfu_ident_table[++i].desc);
+    return n;
+}
+
+static int mfu_get_version_uid(uint8_t *version, uint8_t *uid) {
+    iso14a_card_select_t card;
+    if (ul_select(&card) == false)
+        return PM3_ESOFT;
+
+    uint8_t v[10] = {0x00};
+    int len  = ulev1_getVersion(v, sizeof(v));
+    DropField();
+    if (len != sizeof(v))
+        return PM3_ESOFT;
+
+    memcpy(version, v, 8);
+    memcpy(uid, card.uid, 7);
+    return PM3_SUCCESS;
+}
+
+static int mfu_fingerprint(void) {
+
+    uint8_t *data = NULL;
+    int res = PM3_SUCCESS;
+    PrintAndLogEx(INFO, "------------------------ " _CYAN_("Fingerprint") " -----------------------");
+    uint8_t maxbytes = mfu_max_len();
+    if (maxbytes == 0) {
+        PrintAndLogEx(ERR, "fingerprint table wrong");
+        res = PM3_ESOFT;
+        goto out;
+    }
+    
+    maxbytes = ((maxbytes / 4) + 1) * 4;
+    data = calloc(maxbytes, sizeof(uint8_t));
+    if (data == NULL) {
+        PrintAndLogEx(ERR, "failed to allocate memory");
+        res = PM3_EMALLOC;
+        goto out;
+    }
+
+    uint8_t pages = (maxbytes / 4);
+    PrintAndLogEx(INFO, "Reading tag memory...");
+
+    clearCommandBuffer();
+    SendCommandMIX(CMD_HF_MIFAREU_READCARD, 0, pages, 0, NULL, 0);
+    PacketResponseNG resp;
+    if (!WaitForResponseTimeout(CMD_ACK, &resp, 2500)) {
+        PrintAndLogEx(WARNING, "Command execute time-out");
+        res = PM3_ETIMEOUT;
+        goto out;
+    }
+
+    if (resp.oldarg[0] != 1) {
+        PrintAndLogEx(WARNING, "Failed reading card");
+        res = PM3_ESOFT;
+        goto out;
+    }
+
+    // read all memory
+    uint32_t startindex = resp.oldarg[2];
+    uint32_t buffer_size = resp.oldarg[1];
+    if (buffer_size > maxbytes) {
+        PrintAndLogEx(FAILED, "Data exceeded buffer size!");
+        buffer_size = maxbytes;
+    }
+
+    if (!GetFromDevice(BIG_BUF, data, buffer_size, startindex, NULL, 0, NULL, 2500, false)) {
+        PrintAndLogEx(WARNING, "command execution time out");
+        res = PM3_ETIMEOUT;
+        goto out;
+    }
+
+    uint8_t version[8] = {0};
+    uint8_t uid[7] = {0};
+    if (mfu_get_version_uid(version, uid) == PM3_SUCCESS) {
+        mfu_identify_t* item = mfu_match_fingerprint(version, data);
+        if (item) {
+            PrintAndLogEx(SUCCESS, "Found " _GREEN_("%s"), item->desc);
+
+            if (item->Pwd) {
+                char s[40] = {0};
+                sprintf(s, item->hint, item->Pwd(uid));
+                PrintAndLogEx(HINT, "Use `" _YELLOW_("%s") "`", s);
+            } else {
+                PrintAndLogEx(HINT, "Use `" _YELLOW_("%s") "`", item->hint);
+            }
+        }
+    }
+
+out:
+    free(data);
+    PrintAndLogEx(INFO, "------------------------------------------------------------");
+    return res;
+}
+
 uint32_t GetHF14AMfU_Type(void) {
 
     TagTypeUL_t tagtype = UNKNOWN;
@@ -1391,6 +1634,9 @@ static int CmdHF14AMfUInfo(const char *Cmd) {
             PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`hf mfu pwdgen -r`") " to get see known pwd gen algo suggestions");
         }
     }
+
+    mfu_fingerprint();
+
 out:
     DropField();
     if (locked) {
@@ -2223,6 +2469,7 @@ static int CmdHF14AMfURestore(const char *Cmd) {
     }
 
     PrintAndLogEx(INFO, "Restoring data blocks.");
+    PrintAndLogEx(INFO, "." NOLF);
     // write all other data
     // Skip block 0,1,2,3 (only magic tags can write to them)
     // Skip last 5 blocks usually is configuration
@@ -2234,6 +2481,7 @@ static int CmdHF14AMfURestore(const char *Cmd) {
         SendCommandMIX(CMD_HF_MIFAREU_WRITEBL, b, keytype, 0, data, sizeof(data));
         wait4response(b);
         PrintAndLogEx(NORMAL, "." NOLF);
+        fflush(stdout);
     }
     PrintAndLogEx(NORMAL, "");
 
@@ -2810,15 +3058,15 @@ static int CmdHF14AMfUPwdGen(const char *Cmd) {
     PrintAndLogEx(INFO, "---------------------------------");
     PrintAndLogEx(INFO, " Using UID : %s", sprint_hex(uid, 7));
     PrintAndLogEx(INFO, "---------------------------------");
-    PrintAndLogEx(INFO, " algo | pwd      | pack");
-    PrintAndLogEx(INFO, "------+----------+-----");
-    PrintAndLogEx(INFO, " EV1  | %08X | %04X", ul_ev1_pwdgenA(uid), ul_ev1_packgenA(uid));
-    PrintAndLogEx(INFO, " Ami  | %08X | %04X", ul_ev1_pwdgenB(uid), ul_ev1_packgenB(uid));
-    PrintAndLogEx(INFO, " LD   | %08X | %04X", ul_ev1_pwdgenC(uid), ul_ev1_packgenC(uid));
-    PrintAndLogEx(INFO, " XYZ  | %08X | %04X", ul_ev1_pwdgenD(uid), ul_ev1_packgenD(uid));
-    PrintAndLogEx(INFO, "------+----------+-----");
+    PrintAndLogEx(INFO, " algo           | pwd      | pack");
+    PrintAndLogEx(INFO, "----------------+----------+-----");
+    PrintAndLogEx(INFO, " EV1            | %08X | %04X", ul_ev1_pwdgenA(uid), ul_ev1_packgenA(uid));
+    PrintAndLogEx(INFO, " Amiibo         | %08X | %04X", ul_ev1_pwdgenB(uid), ul_ev1_packgenB(uid));
+    PrintAndLogEx(INFO, " Lego Dimension | %08X | %04X", ul_ev1_pwdgenC(uid), ul_ev1_packgenC(uid));
+    PrintAndLogEx(INFO, " XYZ 3D printer | %08X | %04X", ul_ev1_pwdgenD(uid), ul_ev1_packgenD(uid));
+    PrintAndLogEx(INFO, "----------------+----------+-----");
     PrintAndLogEx(INFO, " Vingcard algo");
-    PrintAndLogEx(INFO, "--------------------");
+    PrintAndLogEx(INFO, "---------------------------------");
     return PM3_SUCCESS;
 }
 

From c299b102ee410261eb212277b16fcadcf1c6d454 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Sat, 20 Feb 2021 00:30:27 +0100
Subject: [PATCH 618/682] recover_pk: flake8

---
 tools/recover_pk.py | 112 +++++++++++++++++++++++---------------------
 1 file changed, 59 insertions(+), 53 deletions(-)

diff --git a/tools/recover_pk.py b/tools/recover_pk.py
index a268181f9..0310b4750 100755
--- a/tools/recover_pk.py
+++ b/tools/recover_pk.py
@@ -4,6 +4,7 @@
 
 import binascii
 import sys
+import hashlib
 
 debug = False
 
@@ -15,9 +16,11 @@ debug = False
 # code snippets we needed:
 #######################################################################
 # code snippets from JacobianCurve:
-# This code is public domain. Everyone has the right to do whatever they want with it for any purpose.
+# This code is public domain. Everyone has the right to do whatever
+# they want with it for any purpose.
 # Copyright (c) 2013 Vitalik Buterin
 
+
 class JacobianCurve:
     def __init__(self, p, n, a, b, g):
         self.p = p
@@ -27,11 +30,9 @@ class JacobianCurve:
         self.g = g
         self.n_length = len(bin(self.n).replace("0b", ""))
 
-
     def to_jacobian(self, p):
         return p[0], p[1], 1
 
-
     def jacobian_double(self, p):
         if not p[1]:
             return 0, 0, 0
@@ -43,7 +44,6 @@ class JacobianCurve:
         nz = (2 * p[1] * p[2]) % self.p
         return nx, ny, nz
 
-
     def jacobian_add(self, p, q):
         if not p[1]:
             return q
@@ -67,12 +67,10 @@ class JacobianCurve:
         nz = (h * p[2] * q[2]) % self.p
         return (nx, ny, nz)
 
-
     def from_jacobian(self, p):
         z = inverse(p[2], self.p)
         return (p[0] * z ** 2) % self.p, (p[1] * z ** 3) % self.p
 
-
     def jacobian_shamir(self, a, n, b, m):
         ab = self.jacobian_add(a, b)
         if n < 0 or n >= self.n:
@@ -97,17 +95,15 @@ class JacobianCurve:
         return res
 
     def fast_shamir(self, a, n, b, m):
-        return self.from_jacobian(self.jacobian_shamir(self.to_jacobian(a), n, self.to_jacobian(b), m))
+        return self.from_jacobian(
+            self.jacobian_shamir(
+                self.to_jacobian(a), n, self.to_jacobian(b), m))
 
 #######################################################################
 # code snippets from sslcrypto
 # MIT License
 # Copyright (c) 2019 Ivan Machugovskiy
 
-import hmac
-import os
-import hashlib
-import struct
 
 def int_to_bytes(raw, length):
     data = []
@@ -123,6 +119,7 @@ def bytes_to_int(data):
         raw = raw * 256 + byte
     return raw
 
+
 def legendre(a, p):
     res = pow(a, (p - 1) // 2, p)
     if res == p - 1:
@@ -130,6 +127,7 @@ def legendre(a, p):
     else:
         return res
 
+
 def inverse(a, n):
     if a == 0:
         return 0
@@ -141,6 +139,7 @@ def inverse(a, n):
         lm, low, hm, high = nm, new, lm, low
     return lm % n
 
+
 def square_root_mod_prime(n, p):
     if n == 0:
         return 0
@@ -186,8 +185,9 @@ def square_root_mod_prime(n, p):
         r = r * b % p
     return r
 
-# name: (nid, p, n, a, b, (Gx, Gy)),
+
 CURVES = {
+    # name: (nid, p, n, a, b, (Gx, Gy)),
     "secp128r1": (
         706,
         0xFFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFF,
@@ -199,7 +199,6 @@ CURVES = {
             0xCF5AC8395BAFEB13C02DA292DDED7A83
         )
     ),
-    # ! h=4, how to handle that?
     "secp128r2": (
         707,
         0xFFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFF,
@@ -305,13 +304,14 @@ CURVES = {
     )
 }
 
+
 def get_curve(name):
     if name not in CURVES:
         raise ValueError("Unknown curve {}".format(name))
     nid, p, n, a, b, g = CURVES[name]
-    params = {"p": p, "n": n, "a": a, "b": b, "g": g}
     return EllipticCurve(nid, p, n, a, b, g)
 
+
 class EllipticCurve:
     def __init__(self, nid, p, n, a, b, g):
         self.p, self.n, self.a, self.b, self.g = p, n, a, b, g
@@ -319,15 +319,12 @@ class EllipticCurve:
         self.public_key_length = (len(bin(p).replace("0b", "")) + 7) // 8
         self.order_bitlength = len(bin(n).replace("0b", ""))
 
-
     def _int_to_bytes(self, raw, len=None):
         return int_to_bytes(raw, len or self.public_key_length)
 
-
     def _subject_to_int(self, subject):
         return bytes_to_int(subject[:(self.order_bitlength + 7) // 8])
 
-
     def recover(self, signature, data, hash="sha256"):
         # Sanity check: is this signature recoverable?
         if len(signature) != 1 + 2 * self.public_key_length:
@@ -395,24 +392,26 @@ class EllipticCurve:
 
 #######################################################################
 
+
 def guess_curvename(signature):
-    l = (len(signature) // 2) & 0xfe
-    if   l == 32 :
-        curves = [ "secp128r1", "secp128r2" ]
-    elif l == 48:
-        curves = [ "secp192k1", "secp192r1" ]
-    elif l == 56:
-        curves = [ "secp224k1", "secp224r1" ]
-    elif l == 64:
-        curves = [ "secp256k1", "secp256r1" ]
-    elif l == 96:
-        curves = [ "secp384r1" ]
-    elif l == 132:
-        curves = [ "secp521r1" ]
+    siglen = (len(signature) // 2) & 0xfe
+    if siglen == 32:
+        curves = ["secp128r1", "secp128r2"]
+    elif siglen == 48:
+        curves = ["secp192k1", "secp192r1"]
+    elif siglen == 56:
+        curves = ["secp224k1", "secp224r1"]
+    elif siglen == 64:
+        curves = ["secp256k1", "secp256r1"]
+    elif siglen == 96:
+        curves = ["secp384r1"]
+    elif siglen == 132:
+        curves = ["secp521r1"]
     else:
         raise ValueError("Unsupported signature size %i" % len(signature))
     return curves
 
+
 def recover(data, signature, curvename, alghash=None):
     recovered = set()
     curve = get_curve(curvename)
@@ -423,7 +422,7 @@ def recover(data, signature, curvename, alghash=None):
             recovered.add(pk)
             if debug:
                 print("Possible Pk:    ", binascii.hexlify(pk))
-        except:
+        except ValueError:
             pass
     else:
         for i in range(2):
@@ -434,20 +433,23 @@ def recover(data, signature, curvename, alghash=None):
                 recovered.add(pk)
                 if debug:
                     print("Possible Pk:    ", binascii.hexlify(pk))
-            except:
+            except ValueError:
                 pass
     return recovered
 
+
 def recover_multiple(uids, sigs, curvename, alghash=None):
     recovered = set()
     assert len(uids) == len(sigs)
     for i in range(len(uids)):
         data = binascii.unhexlify(uids[i])
         if debug:
-            print("UID       (%2i): " %  len(data), binascii.hexlify(data))
+            print("UID       (%2i): " %
+                  len(data), binascii.hexlify(data))
         signature = binascii.unhexlify(sigs[i])
         if debug:
-            print("Signature (%2i): " % len(signature), binascii.hexlify(signature))
+            print("Signature (%2i): " %
+                  len(signature), binascii.hexlify(signature))
         recovered_tmp = recover(data, signature, curvename, alghash)
         if i == 0:
             if recovered_tmp == set():
@@ -458,60 +460,63 @@ def recover_multiple(uids, sigs, curvename, alghash=None):
             recovered &= recovered_tmp
     return recovered
 
+
 def selftests():
     tests = [
         {'name': "Mifare Ultralight EV1",
          'samples': ["04C1285A373080", "CEA2EB0B3C95D0844A95B824A7553703B3702378033BF0987899DB70151A19E7",
                      "04C2285A373080", "A561506723D422D29ED9F93E60D20B9ED1E05CC1BF81DA19FE500CA0B81CC0ED"],
-         'pk': "0490933BDCD6E99B4E255E3DA55389A827564E11718E017292FAF23226A96614B8" },
+         'pk': "0490933BDCD6E99B4E255E3DA55389A827564E11718E017292FAF23226A96614B8"},
         {'name': "NTAG21x",
          'samples': ["04E10CDA993C80", "8B76052EE42F5567BEB53238B3E3F9950707C0DCC956B5C5EFCFDB709B2D82B3",
                      "04DB0BDA993C80", "6048EFD9417CD10F6B7F1818D471A7FE5B46868D2EABDC6307A1E0AAE139D8D0"],
-         'pk': "04494E1A386D3D3CFE3DC10E5DE68A499B1C202DB5B132393E89ED19FE5BE8BC61" },
+         'pk': "04494E1A386D3D3CFE3DC10E5DE68A499B1C202DB5B132393E89ED19FE5BE8BC61"},
         {'name': "Mifare Classic EV1",
          'samples': ["0433619AB35780", "B9FAE369EC21C980650D87ED9AE9B1610E859131B4B8699C647548AB68D249BB",
                      "524374E2",       "F8758CE30A58553A9985C458FB9C7D340FCFB04847B928A0667939272BC58B5E",
                      "53424B8A",       "B4F533E8C06C021E242EFE8558C1672ED7022E5AE4E7AA2D46113B0AB6928AFC",
                      "BD2A4146",       "19505576ED327D8F8870C86B1ED00898BFEDFFF27CC82FC515BA2EEC26050873"],
-         'pk': "044F6D3F294DEA5737F0F46FFEE88A356EED95695DD7E0C27A591E6F6F65962BAF" },
+         'pk': "044F6D3F294DEA5737F0F46FFEE88A356EED95695DD7E0C27A591E6F6F65962BAF"},
         {'name': "DESFire Light",
          'samples': ["0439556ACB6480", "D5BD0978106E1E38B513642335966AB21E9F950DCFCFAB45FF13D0DC3CA4C2AE7E0D671DF1240937D040DAC4601C5F66ED62C546EE03ED08",
                      "043B156ACB6480", "76B46932BF2FCF4931A24C755F5CB1686B914F1856177686B864BDAD58EFA6A7493E5C2232F3ADDAA434EA4647BFD1D385BDA6115E77D74C"],
-         'pk': "040E98E117AAA36457F43173DC920A8757267F44CE4EC5ADD3C54075571AEBBF7B942A9774A1D94AD02572427E5AE0A2DD36591B1FB34FCF3D" },
+         'pk': "040E98E117AAA36457F43173DC920A8757267F44CE4EC5ADD3C54075571AEBBF7B942A9774A1D94AD02572427E5AE0A2DD36591B1FB34FCF3D"},
         {'name': "DESFire EV2",
          'samples': ["042A41CAE45380", "B2769F8DDB575AEA2A680ADCA8FFED4FAB81A1E9908E2B82FE0FABB697BBD9B23835C416970E75768F12902ACA491349E94E6589EAF4F508",
                      "045640CAE45380", "D34B53A8C2C100D700DEA1C4C0D0DE4409F3A418CD8D57C4F41F146E42AD9A55F014199ABBF5CA259C7799DB0AE20D5E77D4950AC7E95D33"],
-         'pk': "04B304DC4C615F5326FE9383DDEC9AA892DF3A57FA7FFB3276192BC0EAA252ED45A865E3B093A3D0DCE5BE29E92F1392CE7DE321E3E5C52B3A" },
+         'pk': "04B304DC4C615F5326FE9383DDEC9AA892DF3A57FA7FFB3276192BC0EAA252ED45A865E3B093A3D0DCE5BE29E92F1392CE7DE321E3E5C52B3A"},
         {'name': "DESFire EV3",
          'samples': ["04448BD2DB6B80", "5CBB5632795C8F15263FEFB095B51C7B541AFD914A1AE44EF6FB8AF605EDF13DBFEE6C3A2DB372245E671DFE0D42CB1F0D0B8FE67A89D2F6",
                      "04445DD2DB6B80", "166BFD9F9BFAA451172566101580DF9894F582C4A4E258C15037AD2F35A475CF1D7FB817618623A6569F991931AFB2766984E21A18512A6D"],
-         'pk': "041DB46C145D0A36539C6544BD6D9B0AA62FF91EC48CBC6ABAE36E0089A46F0D08C8A715EA40A63313B92E90DDC1730230E0458A33276FB743" },
-# TODO one more Mifare Plus EV1...
+         'pk': "041DB46C145D0A36539C6544BD6D9B0AA62FF91EC48CBC6ABAE36E0089A46F0D08C8A715EA40A63313B92E90DDC1730230E0458A33276FB743"},
         {'name': "Mifare Plus EV1",
+         # TODO one more Mifare Plus EV1...
          'samples': ["042A2B221C5080", "BAC40CD88E9193C58ADA5055350C4F648EB5A7AEC4FCF9BD4CDD7B1C558DE5F59C6636F26286ED48622AAA2331D4DF1CEE23B57B94BDA631"],
-         'pk': "044409ADC42F91A8394066BA83D872FB1D16803734E911170412DDF8BAD1A4DADFD0416291AFE1C748253925DA39A5F39A1C557FFACD34C62E" },
+         'pk': "044409ADC42F91A8394066BA83D872FB1D16803734E911170412DDF8BAD1A4DADFD0416291AFE1C748253925DA39A5F39A1C557FFACD34C62E"},
         {'name': "NTAG413DNA",
          'samples': ["042468222F5C80", "B9211E320F321BD1D0E158E10FF15109B389638BAE15D9909D7725BF1250ED236D66F1AF75C94D60330E4E92535F5E6997675281A5687173",
                      "042938222F5C80", "18B642797D1FD71806146A7A6EC778D3FDD04F39C4A3B36A592BD1A114DC44E5528380FA766C0B7EA32B284AFBE84300B620369F0686D8CC"],
-         'pk': "04bb5d514f7050025c7d0f397310360eec91eaf792e96fc7e0f496cb4e669d414f877b7b27901fe67c2e3b33cd39d1c797715189ac951c2add" },
+         'pk': "04bb5d514f7050025c7d0f397310360eec91eaf792e96fc7e0f496cb4e669d414f877b7b27901fe67c2e3b33cd39d1c797715189ac951c2add"},
         {'name': "NTAG424DNA",
          'samples': ["0463474AA26A80", "27E9A50E6CA4BA9037C02F7D20A80D0284D0C1D83C67F5A5AC1D8A4EF86C9508417E4E9C6F85AA7920F0ABDED984CAF20467D66EA54BBF08",
                      "04C46C222A6380", "344A806EBF704C05C19215D2F840529CE365AAD2D08A469A95896D75D477D9FAB02A0C827E9F215BD8EB0E56A3A9A008FB75D706AABBD4DA"],
-         'pk': "048A9B380AF2EE1B98DC417FECC263F8449C7625CECE82D9B916C992DA209D68422B81EC20B65A66B5102A61596AF3379200599316A00A1410" },
+         'pk': "048A9B380AF2EE1B98DC417FECC263F8449C7625CECE82D9B916C992DA209D68422B81EC20B65A66B5102A61596AF3379200599316A00A1410"},
         {'name': "Vivokey Spark1",
-# ! tag signature bytes output by pm3 must be read right to left: echo $sig |sed 's/\(..\)/\1\n/g'|tac|tr -d '\n'  (and it uses a SHA256)
+         # ! tag signature bytes output by pm3 must be read right to left:
+         # echo $sig |sed 's/\(..\)/\1\n/g'|tac|tr -d '\n'
+         # (and it uses a SHA256)
          'samples': ["E0040118009C870C", "4B4E03E1211952EF6A5F9D84AB218CD4D7549D0CDF8CA8779F9AD16C9A9CBF3B",
                      "E0040118009B4D62", "25CF13747C3389EC7889DE916E3747584978511CC78B51CFB1883B494CBED7AB"],
-         'pk': "04d64bb732c0d214e7ec580736acf847284b502c25c0f7f2fa86aace1dada4387a" },
-# ! tag UID is considered inversed: E0040118009B5FEE => EE5F9B00180104E0
-# TODO one more ICODE-DNA...
+         'pk': "04d64bb732c0d214e7ec580736acf847284b502c25c0f7f2fa86aace1dada4387a"},
         {'name': "ICODE DNA, ICODE SLIX2",
+         # ! tag UID is considered inverted: E0040118009B5FEE => EE5F9B00180104E0
+         # TODO one more ICODE-DNA...
          'samples': ["EE5F9B00180104E0", "32D9E7579CD77E6F1FA11419231E874826984C5F189FDE1421684563A9663377"],
-         'pk': "048878A2A2D3EEC336B4F261A082BD71F9BE11C4E2E896648B32EFA59CEA6E59F0" },
-#  uses secp256r1?, SHA-256,
-#        {'name': "Minecraft Earth",
-#         'samples': ["aa", "DF0E506DFF8FCFC4B7B979D917644445F1230D2C7CDC342AFA842CA240C210BE7275F62073A9670F2DCEFC602CBEE771C2B4CD4A04F3D1EA11F49ABDF7E8B721"],
-#         'pk': "" },
+         'pk': "048878A2A2D3EEC336B4F261A082BD71F9BE11C4E2E896648B32EFA59CEA6E59F0"},
+        # {'name': "Minecraft Earth",
+        #  # uses secp256r1?, SHA-256,
+        #  'samples': ["aa", "DF0E506DFF8FCFC4B7B979D917644445F1230D2C7CDC342AFA842CA240C210BE7275F62073A9670F2DCEFC602CBEE771C2B4CD4A04F3D1EA11F49ABDF7E8B721"],
+        #  'pk': ""},
     ]
     succeeded = True
     for t in tests:
@@ -541,6 +546,7 @@ def selftests():
             print("[FAIL]")
     print("Tests:                           [%s]" % ["FAIL", "OK"][succeeded])
 
+
 if __name__ == "__main__":
     if len(sys.argv) == 2 and sys.argv[1] == "selftests":
         selftests()

From e13108023a2b5c3c1bb6c764d8bff83eaf0c606f Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 20 Feb 2021 08:36:33 +0100
Subject: [PATCH 619/682] adapt lua script to handle PS odd 32b limit,  my best
 guess the WIN32 macro is set.

---
 client/luascripts/lf_em4100_bulk.lua | 37 ++++++++++++++--------------
 1 file changed, 19 insertions(+), 18 deletions(-)

diff --git a/client/luascripts/lf_em4100_bulk.lua b/client/luascripts/lf_em4100_bulk.lua
index 30aaa98fc..d1f4aa845 100644
--- a/client/luascripts/lf_em4100_bulk.lua
+++ b/client/luascripts/lf_em4100_bulk.lua
@@ -4,7 +4,7 @@ local ac = require('ansicolors')
 
 copyright = ''
 author = "Christian Herrmann"
-version = 'v1.0.0'
+version = 'v1.0.1'
 desc = [[
 Perform bulk EM410x enrollment of T5577 RFID tags.  It keeps track of last card id used.
 If called with -s,  this value resets "session".
@@ -84,20 +84,21 @@ local function readfile()
     end
     local t = f:read("*all")
     f:close()
-    local cn = tonumber(t, 16)
-    print(('Using EM4100 ID '..ac.green..'%010X'..ac.reset..' from `'..ac.yellow..'%s'..ac.reset..'`'):format(cn, ENROLL_STATUS_FN))
-    return cn
+    local cn_hi  = tonumber(t:sub(1, 2), 16)
+    local cn_low = tonumber(t:sub(3, 10), 16)
+    print(('Using EM4100 ID '..ac.green..'%02X%08X'..ac.reset..' from `'..ac.yellow..'%s'..ac.reset..'`'):format(cn_hi, cn_low, ENROLL_STATUS_FN))
+    return cn_hi, cn_low
 end
 ---
 --
-local function writefile(cn)
+local function writefile(cn_hi, cn_low)
     local f = io.open(ENROLL_STATUS_FN, "w")
     if f == nil then
         return nil, string.format("Could not write to file %s", ENROLL_STATUS_FN)
     end
-    f:write(("%010X\n"):format(cn))
+    f:write(("%02X%08X\n"):format(cn_hi, cn_low))
     f:close()
-    print(('Wrote EM4100 ID '..ac.green..'%010X'..ac.reset..' to `'..ac.yellow..'%s'..ac.reset..'`'):format(cn, ENROLL_STATUS_FN))
+    print(('Wrote EM4100 ID '..ac.green..'%02X%08X'..ac.reset..' to `'..ac.yellow..'%s'..ac.reset..'`'):format(cn_hi, cn_low, ENROLL_STATUS_FN))
     return true, 'Ok'
 end
 
@@ -134,32 +135,32 @@ local function main(args)
     core.console('pref set hint --off')
     print('')
     
-    local sid = tonumber(startid, 16)    
+    local hi  = tonumber(startid:sub(1, 2), 16)
+    local low = tonumber(startid:sub(3, 10), 16)
+    
     if shall_continue then
         print('Continue enrolling from last save')
-        sid = readfile()
+        hi, low = readfile()
     else
         print('reset & starting enrolling from refresh')
     end
    
-    local template = 'EM4100 ID '..ac.green..'%010X'..ac.reset
-    local curr = sid
-    for i = sid, sid + 10000, 1 do
-        curr = i
-
+    local template = 'EM4100 ID '..ac.green..'%02X%08X'..ac.reset
+    for i = low, low + 10000, 1 do
         print('')
         print( string.rep('--',20) )
-        local msg = (template):format(curr)
+        local msg = (template):format(hi, i)
         local ans = utils.input(msg, 'y'):lower()
         if ans == 'y' then
-            core.console( ('lf em 410x clone --id %010X'):format(curr) )
-            --        print ( ('lf em 410x clone --id %010X'):format(curr) )
+            core.console( ('lf em 410x clone --id %02X%08X'):format(hi, i) )
+            --        print ( ('lf em 410x clone --id %02X%08X'):format(hi, i) )
         else
             print(ac.red..'User aborted'..ac.reset)
+            low = i
             break
         end
     end
-    writefile(curr)
+    writefile(hi, low)
 
     print('enabling hints again')
     core.console('pref set hint --on')

From 602c9d15425447d854f9154de89d7b3a6fc99629 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 20 Feb 2021 13:04:58 +0100
Subject: [PATCH 620/682] added some default generators

---
 common/generator.c | 7 +++++++
 common/generator.h | 2 ++
 2 files changed, 9 insertions(+)

diff --git a/common/generator.c b/common/generator.c
index 85be456f4..5918ce7c8 100644
--- a/common/generator.c
+++ b/common/generator.c
@@ -182,6 +182,13 @@ uint16_t ul_ev1_packgenD(uint8_t *uid) {
     return BSWAP_16(p & 0xFFFF);
 }
 
+uint32_t ul_ev1_pwdgen_def(uint8_t *uid) {
+    return 0xFFFFFFFF;
+}
+uint16_t ul_ev1_packgen_def(uint8_t *uid) {
+    return 0x0000;
+}
+
 //------------------------------------
 // MFC key generation stuff
 // Each algo implementation should offer two key generation functions.
diff --git a/common/generator.h b/common/generator.h
index e0c045426..5467ed470 100644
--- a/common/generator.h
+++ b/common/generator.h
@@ -13,11 +13,13 @@
 
 #include "common.h"
 
+uint32_t ul_ev1_pwdgen_def(uint8_t *uid);
 uint32_t ul_ev1_pwdgenA(uint8_t *uid);
 uint32_t ul_ev1_pwdgenB(uint8_t *uid);
 uint32_t ul_ev1_pwdgenC(uint8_t *uid);
 uint32_t ul_ev1_pwdgenD(uint8_t *uid);
 
+uint16_t ul_ev1_packgen_def(uint8_t *uid);
 uint16_t ul_ev1_packgenA(uint8_t *uid);
 uint16_t ul_ev1_packgenB(uint8_t *uid);
 uint16_t ul_ev1_packgenC(uint8_t *uid);

From de42d3c55ecca91e5c4722ac20f53ad798e7e7a5 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 20 Feb 2021 13:06:01 +0100
Subject: [PATCH 621/682] hf mfu info - adapted the fingerprinting

---
 client/src/cmdhfmfu.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index 3c974e743..8227a55c0 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -1037,7 +1037,7 @@ static mfu_identify_t mfu_ident_table[] = {
     {
         "Jooki", "0004040201000F03",
         12, 32, "E11012000103A00C340329D101255504732E6A6F6F6B692E726F636B732F732F",
-        NULL, NULL,
+        ul_ev1_pwdgen_def, ul_ev1_packgen_def,
         "hf jooki decode -r"
     },
     {
@@ -1046,6 +1046,24 @@ static mfu_identify_t mfu_ident_table[] = {
         ul_ev1_pwdgenC, ul_ev1_packgenC,
         "hf mfu dump -k %08x"
     },
+    {
+        "Hotwheels", "0004040201000F03",
+        9, 9, "E110120F",
+        ul_ev1_pwdgen_def, ul_ev1_packgen_def,
+        "hf mfu dump -k %08x"
+    },
+    {
+        "Minecraft Earth", "0004040201000F03",
+        9, 26, "48F6FFE1101200037C91012C55027069642E6D617474656C2F4167",
+        ul_ev1_pwdgen_def, ul_ev1_packgen_def,
+        "hf mfu dump -k %08x"
+    },
+    {
+        "Snackworld", "0004040101000B03",
+        9, 7, "483000E1100600",
+        NULL, NULL,
+        "hf mfu dump -k %08x"
+    },
     {
         "Amiibo", "0004040201001103",
         9, 9, "480FE0F110FFEEA500",

From 71b73cad0fc6ae426a31d9c04b374c5d689dba6e Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 20 Feb 2021 22:28:03 +0300
Subject: [PATCH 622/682] emrtd: add a PACE display to hf emrtd info

Also reword things so that they don't misuse BAC in place of any form of
passive authentication
---
 client/src/cmdhfemrtd.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 229f84dee..882d43bae 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -992,7 +992,7 @@ static bool emrtd_do_auth(char *documentnumber, char *dob, char *expiry, bool BA
     // Select EF_COM
     if (emrtd_select_file(EMRTD_P1_SELECT_BY_EF, dg_table[EF_COM].fileid, *use_14b) == false) {
         *BAC = true;
-        PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt external authentication.");
+        PrintAndLogEx(INFO, "Authentication is enforced. Will attempt external authentication.");
     } else {
         *BAC = false;
         // Select EF_DG1
@@ -1000,7 +1000,7 @@ static bool emrtd_do_auth(char *documentnumber, char *dob, char *expiry, bool BA
 
         if (emrtd_read_file(response, &resplen, NULL, NULL, NULL, false, *use_14b) == false) {
             *BAC = true;
-            PrintAndLogEx(INFO, "Basic Access Control is enforced. Will attempt external authentication.");
+            PrintAndLogEx(INFO, "Authentication is enforced. Will attempt external authentication.");
         } else {
             *BAC = false;
         }
@@ -1010,7 +1010,7 @@ static bool emrtd_do_auth(char *documentnumber, char *dob, char *expiry, bool BA
     if (*BAC) {
         // If BAC isn't available, exit out and warn user.
         if (!BAC_available) {
-            PrintAndLogEx(ERR, "This eMRTD enforces Basic Access Control, but you didn't supply MRZ data. Cannot proceed.");
+            PrintAndLogEx(ERR, "This eMRTD enforces authentication, but you didn't supply MRZ data. Cannot proceed.");
             PrintAndLogEx(HINT, "Check out hf emrtd info/dump --help, supply data with -n -d and -e.");
             return false;
         }
@@ -1733,6 +1733,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     uint8_t ks_enc[16] = { 0x00 };
     uint8_t ks_mac[16] = { 0x00 };
     bool BAC = false;
+    bool PACE_available = true;
     bool use_14b = false;
 
     // Select the eMRTD
@@ -1741,13 +1742,20 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         return PM3_ESOFT;
     }
 
+    // Read EF_CardAccess
+    if (!emrtd_select_and_read(response, &resplen, dg_table[EF_CardAccess].fileid, ks_enc, ks_mac, ssc, BAC, use_14b)) {
+        PACE_available = false;
+        PrintAndLogEx(HINT, "The error above this is normal. It just means that your eMRTD lacks PACE.");
+    }
+
     // Select and authenticate with the eMRTD
     bool auth_result = emrtd_do_auth(documentnumber, dob, expiry, BAC_available, &BAC, ssc, ks_enc, ks_mac, &use_14b);
 
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "------------------ " _CYAN_("Basic Info") " ------------------");
     PrintAndLogEx(SUCCESS, "Communication standard: %s", use_14b ? _YELLOW_("ISO/IEC 14443(B)") : _YELLOW_("ISO/IEC 14443(A)"));
-    PrintAndLogEx(SUCCESS, "BAC...................: %s", BAC ? _GREEN_("Enforced") : _RED_("Not enforced"));
+    PrintAndLogEx(SUCCESS, "Authentication........: %s", BAC ? _GREEN_("Enforced") : _RED_("Not enforced"));
+    PrintAndLogEx(SUCCESS, "PACE..................: %s", PACE_available ? _GREEN_("Available") : _YELLOW_("Not available"));
     PrintAndLogEx(SUCCESS, "Authentication result.: %s", auth_result ? _GREEN_("Successful") : _RED_("Failed"));
 
     if (!auth_result) {
@@ -1755,6 +1763,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         return PM3_ESOFT;
     }
 
+    // Read EF_COM to get file list
     if (!emrtd_select_and_read(response, &resplen, dg_table[EF_COM].fileid, ks_enc, ks_mac, ssc, BAC, use_14b)) {
         PrintAndLogEx(ERR, "Failed to read EF_COM.");
         DropField();
@@ -1776,7 +1785,7 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
         return PM3_ESOFT;
     }
 
-    // Grab the hash list
+    // Grab the hash list from EF_SOD
     uint8_t dg_hashes_sod[17][64] = { { 0 } };
     uint8_t dg_hashes_calc[17][64] = { { 0 } };
     int hash_algo = 0;

From 4a738963b3e97103186d83b312773305fb045938 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sat, 20 Feb 2021 22:35:31 +0000
Subject: [PATCH 623/682] lf t55: Fix typos

---
 client/src/cmdlft55xx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdlft55xx.c b/client/src/cmdlft55xx.c
index 46ef31744..1c3993454 100644
--- a/client/src/cmdlft55xx.c
+++ b/client/src/cmdlft55xx.c
@@ -3869,8 +3869,8 @@ static int CmdT55xxSniff(const char *Cmd) {
                   "Sniff LF t55xx based trafic and decode possible cmd / blocks.\n"
                   "Lower tolerance means tighter pulses. ",
                   "lf t55xx sniff\n"
-                  "lf t55xx sniff -1 -t 2               -> use buffer with tolernace of 2\n"
-                  "lf t55xx sniff -1 --zero 7 --one 14  -> use buffer, zero pulse width 7,  one pulse width 15"
+                  "lf t55xx sniff -1 -t 2               -> use buffer with tolerance of 2\n"
+                  "lf t55xx sniff -1 --zero 7 --one 14  -> use buffer, zero pulse width 7, one pulse width 15"
                  );
 
     void *argtable[] = {

From 0f1ba33b6931d051a987c2b47c399aa89c0414e5 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sun, 21 Feb 2021 01:43:59 +0300
Subject: [PATCH 624/682] emrtd: Add PACE algo detection

---
 client/src/cmdhfemrtd.c | 99 ++++++++++++++++++++++++++++++++---------
 client/src/cmdhfemrtd.h |  6 +++
 2 files changed, 84 insertions(+), 21 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 882d43bae..4621a3b39 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -58,6 +58,7 @@ static int emrtd_print_ef_com_info(uint8_t *data, size_t datalen);
 static int emrtd_print_ef_dg1_info(uint8_t *data, size_t datalen);
 static int emrtd_print_ef_dg11_info(uint8_t *data, size_t datalen);
 static int emrtd_print_ef_dg12_info(uint8_t *data, size_t datalen);
+static int emrtd_print_ef_cardaccess_info(uint8_t *data, size_t datalen);
 
 typedef enum  { // list must match dg_table
     EF_COM = 0,
@@ -83,27 +84,27 @@ typedef enum  { // list must match dg_table
 } emrtd_dg_enum;
 
 static emrtd_dg_t dg_table[] = {
-//  tag    dg# fileid  filename           desc                                                  pace   eac    req    fast   parser                    dumper
-    {0x60, 0,  "011E", "EF_COM",          "Header and Data Group Presence Information",         false, false, true,  true,  emrtd_print_ef_com_info,  NULL},
-    {0x61, 1,  "0101", "EF_DG1",          "Details recorded in MRZ",                            false, false, true,  true,  emrtd_print_ef_dg1_info,  NULL},
-    {0x75, 2,  "0102", "EF_DG2",          "Encoded Face",                                       false, false, true,  false, NULL,                     emrtd_dump_ef_dg2},
-    {0x63, 3,  "0103", "EF_DG3",          "Encoded Finger(s)",                                  false, true,  false, false, NULL,                     NULL},
-    {0x76, 4,  "0104", "EF_DG4",          "Encoded Eye(s)",                                     false, true,  false, false, NULL,                     NULL},
-    {0x65, 5,  "0105", "EF_DG5",          "Displayed Portrait",                                 false, false, false, false, NULL,                     emrtd_dump_ef_dg5},
-    {0x66, 6,  "0106", "EF_DG6",          "Reserved for Future Use",                            false, false, false, false, NULL,                     NULL},
-    {0x67, 7,  "0107", "EF_DG7",          "Displayed Signature or Usual Mark",                  false, false, false, false, NULL,                     emrtd_dump_ef_dg7},
-    {0x68, 8,  "0108", "EF_DG8",          "Data Feature(s)",                                    false, false, false, true,  NULL,                     NULL},
-    {0x69, 9,  "0109", "EF_DG9",          "Structure Feature(s)",                               false, false, false, true,  NULL,                     NULL},
-    {0x6a, 10, "010A", "EF_DG10",         "Substance Feature(s)",                               false, false, false, true,  NULL,                     NULL},
-    {0x6b, 11, "010B", "EF_DG11",         "Additional Personal Detail(s)",                      false, false, false, true,  emrtd_print_ef_dg11_info, NULL},
-    {0x6c, 12, "010C", "EF_DG12",         "Additional Document Detail(s)",                      false, false, false, true,  emrtd_print_ef_dg12_info, NULL},
-    {0x6d, 13, "010D", "EF_DG13",         "Optional Detail(s)",                                 false, false, false, true,  NULL,                     NULL},
-    {0x6e, 14, "010E", "EF_DG14",         "Security Options",                                   false, false, false, true,  NULL,                     NULL},
-    {0x6f, 15, "010F", "EF_DG15",         "Active Authentication Public Key Info",              false, false, false, true,  NULL,                     NULL},
-    {0x70, 16, "0110", "EF_DG16",         "Person(s) to Notify",                                false, false, false, true,  NULL,                     NULL},
-    {0x77, 0,  "011D", "EF_SOD",          "Document Security Object",                           false, false, false, false, NULL,                     emrtd_dump_ef_sod},
-    {0xff, 0,  "011C", "EF_CardAccess",   "PACE SecurityInfos",                                 true,  false, true,  true,  NULL,                     NULL},
-    {0xff, 0,  "011D", "EF_CardSecurity", "PACE SecurityInfos for Chip Authentication Mapping", true,  false, false, true,  NULL,                     NULL},
+//  tag    dg# fileid  filename           desc                                                  pace   eac    req    fast   parser                          dumper
+    {0x60, 0,  "011E", "EF_COM",          "Header and Data Group Presence Information",         false, false, true,  true,  emrtd_print_ef_com_info,        NULL},
+    {0x61, 1,  "0101", "EF_DG1",          "Details recorded in MRZ",                            false, false, true,  true,  emrtd_print_ef_dg1_info,        NULL},
+    {0x75, 2,  "0102", "EF_DG2",          "Encoded Face",                                       false, false, true,  false, NULL,                           emrtd_dump_ef_dg2},
+    {0x63, 3,  "0103", "EF_DG3",          "Encoded Finger(s)",                                  false, true,  false, false, NULL,                           NULL},
+    {0x76, 4,  "0104", "EF_DG4",          "Encoded Eye(s)",                                     false, true,  false, false, NULL,                           NULL},
+    {0x65, 5,  "0105", "EF_DG5",          "Displayed Portrait",                                 false, false, false, false, NULL,                           emrtd_dump_ef_dg5},
+    {0x66, 6,  "0106", "EF_DG6",          "Reserved for Future Use",                            false, false, false, false, NULL,                           NULL},
+    {0x67, 7,  "0107", "EF_DG7",          "Displayed Signature or Usual Mark",                  false, false, false, false, NULL,                           emrtd_dump_ef_dg7},
+    {0x68, 8,  "0108", "EF_DG8",          "Data Feature(s)",                                    false, false, false, true,  NULL,                           NULL},
+    {0x69, 9,  "0109", "EF_DG9",          "Structure Feature(s)",                               false, false, false, true,  NULL,                           NULL},
+    {0x6a, 10, "010A", "EF_DG10",         "Substance Feature(s)",                               false, false, false, true,  NULL,                           NULL},
+    {0x6b, 11, "010B", "EF_DG11",         "Additional Personal Detail(s)",                      false, false, false, true,  emrtd_print_ef_dg11_info,       NULL},
+    {0x6c, 12, "010C", "EF_DG12",         "Additional Document Detail(s)",                      false, false, false, true,  emrtd_print_ef_dg12_info,       NULL},
+    {0x6d, 13, "010D", "EF_DG13",         "Optional Detail(s)",                                 false, false, false, true,  NULL,                           NULL},
+    {0x6e, 14, "010E", "EF_DG14",         "Security Options",                                   false, false, false, true,  NULL,                           NULL},
+    {0x6f, 15, "010F", "EF_DG15",         "Active Authentication Public Key Info",              false, false, false, true,  NULL,                           NULL},
+    {0x70, 16, "0110", "EF_DG16",         "Person(s) to Notify",                                false, false, false, true,  NULL,                           NULL},
+    {0x77, 0,  "011D", "EF_SOD",          "Document Security Object",                           false, false, false, false, NULL,                           emrtd_dump_ef_sod},
+    {0xff, 0,  "011C", "EF_CardAccess",   "PACE SecurityInfos",                                 true,  false, true,  true,  emrtd_print_ef_cardaccess_info, NULL},
+    {0xff, 0,  "011D", "EF_CardSecurity", "PACE SecurityInfos for Chip Authentication Mapping", true,  false, false, true,  NULL,                           NULL},
     {0x00, 0,  NULL, NULL, NULL, false, false, false, false, NULL, NULL}
 };
 
@@ -117,6 +118,27 @@ static emrtd_hashalg_t hashalg_table[] = {
     {NULL,      NULL,       0,  0,  {}}
 };
 
+static emrtd_pacealg_t pacealg_table[] = {
+//  name                                       keygen descriptor
+    {"DH, Generic Mapping, 3DES-CBC-CBC",      NULL, {0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x01, 0x01}},
+    {"DH, Generic Mapping, AES-CMAC-128",      NULL, {0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x01, 0x02}},
+    {"DH, Generic Mapping, AES-CMAC-192",      NULL, {0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x01, 0x03}},
+    {"DH, Generic Mapping, AES-CMAC-256",      NULL, {0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x01, 0x04}},
+    {"ECDH, Generic Mapping, 3DES-CBC-CBC",    NULL, {0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x02, 0x01}},
+    {"ECDH, Generic Mapping, AES-CMAC-128",    NULL, {0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x02, 0x02}},
+    {"ECDH, Generic Mapping, AES-CMAC-192",    NULL, {0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x02, 0x03}},
+    {"ECDH, Generic Mapping, AES-CMAC-256",    NULL, {0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x02, 0x04}},
+    {"DH, Integrated Mapping, 3DES-CBC-CBC",   NULL, {0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x03, 0x01}},
+    {"DH, Integrated Mapping, AES-CMAC-128",   NULL, {0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x03, 0x02}},
+    {"DH, Integrated Mapping, AES-CMAC-192",   NULL, {0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x03, 0x03}},
+    {"DH, Integrated Mapping, AES-CMAC-256",   NULL, {0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x03, 0x04}},
+    {"ECDH, Integrated Mapping, 3DES-CBC-CBC", NULL, {0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x04, 0x01}},
+    {"ECDH, Integrated Mapping, AES-CMAC-128", NULL, {0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x04, 0x02}},
+    {"ECDH, Integrated Mapping, AES-CMAC-192", NULL, {0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x04, 0x03}},
+    {"ECDH, Integrated Mapping, AES-CMAC-256", NULL, {0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x04, 0x04}},
+    {NULL, NULL, {}}
+};
+
 static emrtd_dg_t *emrtd_tag_to_dg(uint8_t tag) {
     for (int dgi = 0; dg_table[dgi].filename != NULL; dgi++) {
         if (dg_table[dgi].tag == tag) {
@@ -1726,6 +1748,37 @@ static int emrtd_print_ef_sod_info(uint8_t *dg_hashes_calc, uint8_t *dg_hashes_s
     return PM3_SUCCESS;
 }
 
+static int emrtd_print_ef_cardaccess_info(uint8_t *data, size_t datalen) {
+    uint8_t dataset[100] = { 0x00 };
+    size_t datasetlen = 0;
+    uint8_t pacealgorithm[100] = { 0x00 };
+    size_t pacealgorithmlen = 0;
+
+    PrintAndLogEx(NORMAL, "");
+    PrintAndLogEx(INFO, "----------------- " _CYAN_("EF_CardAccess") " ----------------");
+
+    if (!emrtd_lds_get_data_by_tag(data, datalen, dataset, &datasetlen, 0x30, 0x00, false, true, 0)) {
+        PrintAndLogEx(ERR, "Failed to read set from EF_CardAccess.");
+        return PM3_ESOFT;
+    }
+
+    if (!emrtd_lds_get_data_by_tag(dataset, datasetlen, pacealgorithm, &pacealgorithmlen, 0x06, 0x00, false, false, 0)) {
+        PrintAndLogEx(ERR, "Failed to read PACE algorithm from EF_CardAccess.");
+        return PM3_ESOFT;
+    }
+
+    for (int pacei = 0; pacealg_table[pacei].name != NULL; pacei++) {
+        PrintAndLogEx(DEBUG, "Trying: %s", hashalg_table[pacei].name);
+
+        if (memcmp(pacealg_table[pacei].descriptor, pacealgorithm, pacealgorithmlen) == 0) {
+            PrintAndLogEx(SUCCESS, "PACE algorithm........: " _YELLOW_("%s"), pacealg_table[pacei].name);
+            return PM3_SUCCESS;
+        }
+    }
+
+    return PM3_SUCCESS;
+}
+
 int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available) {
     uint8_t response[EMRTD_MAX_FILE_SIZE] = { 0x00 };
     int resplen = 0;
@@ -1758,6 +1811,10 @@ int infoHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_availab
     PrintAndLogEx(SUCCESS, "PACE..................: %s", PACE_available ? _GREEN_("Available") : _YELLOW_("Not available"));
     PrintAndLogEx(SUCCESS, "Authentication result.: %s", auth_result ? _GREEN_("Successful") : _RED_("Failed"));
 
+    if (PACE_available) {
+        emrtd_print_ef_cardaccess_info(response, resplen);
+    }
+
     if (!auth_result) {
         DropField();
         return PM3_ESOFT;
diff --git a/client/src/cmdhfemrtd.h b/client/src/cmdhfemrtd.h
index bb32fb53d..afa814f0a 100644
--- a/client/src/cmdhfemrtd.h
+++ b/client/src/cmdhfemrtd.h
@@ -35,6 +35,12 @@ typedef struct emrtd_hashalg_s {
     const uint8_t descriptor[15];
 } emrtd_hashalg_t;
 
+typedef struct emrtd_pacealg_s {
+    const char *name;
+    int (*keygenerator)(uint8_t *datain, int datainlen, uint8_t *dataout);
+    const uint8_t descriptor[10];
+} emrtd_pacealg_t;
+
 int CmdHFeMRTD(const char *Cmd);
 
 int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available, const char *path);

From dd62a9f8dd1ca0eca6d1aee25cbb0906af425a05 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sun, 21 Feb 2021 02:18:10 +0300
Subject: [PATCH 625/682] emrtd: Parse some other parts of EF_CardAccess

---
 client/src/cmdhfemrtd.c | 56 +++++++++++++++++++++++++++++++++++++----
 client/src/cmdhfemrtd.h |  7 ++++++
 2 files changed, 58 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 4621a3b39..18040bc2e 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -139,6 +139,25 @@ static emrtd_pacealg_t pacealg_table[] = {
     {NULL, NULL, {}}
 };
 
+static emrtd_pacesdp_t pacesdp_table[] = {
+//   id  name                                                     size
+    {0,  "1024-bit MODP Group with 160-bit Prime Order Subgroup", 1024},
+    {1,  "2048-bit MODP Group with 224-bit Prime Order Subgroup", 2048},
+    {2,  "2048-bit MODP Group with 256-bit Prime Order Subgroup", 2048},
+    {8,  "NIST P-192 (secp192r1)",                                192},
+    {10, "NIST P-224 (secp224r1)",                                224},
+    {12, "NIST P-256 (secp256r1)",                                256},
+    {15, "NIST P-384 (secp384r1)",                                384},
+    {18, "NIST P-521 (secp521r1)",                                521},
+    {9,  "BrainpoolP192r1",                                       192},
+    {11, "BrainpoolP224r1",                                       224},
+    {13, "BrainpoolP256r1",                                       256},
+    {14, "BrainpoolP320r1",                                       320},
+    {16, "BrainpoolP384r1",                                       384},
+    {17, "BrainpoolP521r1",                                       521},
+    {32, NULL, 0}
+};
+
 static emrtd_dg_t *emrtd_tag_to_dg(uint8_t tag) {
     for (int dgi = 0; dg_table[dgi].filename != NULL; dgi++) {
         if (dg_table[dgi].tag == tag) {
@@ -1751,8 +1770,9 @@ static int emrtd_print_ef_sod_info(uint8_t *dg_hashes_calc, uint8_t *dg_hashes_s
 static int emrtd_print_ef_cardaccess_info(uint8_t *data, size_t datalen) {
     uint8_t dataset[100] = { 0x00 };
     size_t datasetlen = 0;
-    uint8_t pacealgorithm[100] = { 0x00 };
-    size_t pacealgorithmlen = 0;
+    uint8_t datafromtag[100] = { 0x00 };
+    size_t datafromtaglen = 0;
+    uint8_t parsednum = 0;
 
     PrintAndLogEx(NORMAL, "");
     PrintAndLogEx(INFO, "----------------- " _CYAN_("EF_CardAccess") " ----------------");
@@ -1762,7 +1782,17 @@ static int emrtd_print_ef_cardaccess_info(uint8_t *data, size_t datalen) {
         return PM3_ESOFT;
     }
 
-    if (!emrtd_lds_get_data_by_tag(dataset, datasetlen, pacealgorithm, &pacealgorithmlen, 0x06, 0x00, false, false, 0)) {
+    // Get PACE version
+    if (!emrtd_lds_get_data_by_tag(dataset, datasetlen, datafromtag, &datafromtaglen, 0x02, 0x00, false, false, 0)) {
+        PrintAndLogEx(ERR, "Failed to read PACE version from EF_CardAccess.");
+        return PM3_ESOFT;
+    }
+    // TODO: hack!!!
+    memcpy(&parsednum, datafromtag, datafromtaglen);
+    PrintAndLogEx(SUCCESS, "PACE version..........: " _YELLOW_("%i"), parsednum);
+
+    // Get PACE algorithm
+    if (!emrtd_lds_get_data_by_tag(dataset, datasetlen, datafromtag, &datafromtaglen, 0x06, 0x00, false, false, 0)) {
         PrintAndLogEx(ERR, "Failed to read PACE algorithm from EF_CardAccess.");
         return PM3_ESOFT;
     }
@@ -1770,12 +1800,28 @@ static int emrtd_print_ef_cardaccess_info(uint8_t *data, size_t datalen) {
     for (int pacei = 0; pacealg_table[pacei].name != NULL; pacei++) {
         PrintAndLogEx(DEBUG, "Trying: %s", hashalg_table[pacei].name);
 
-        if (memcmp(pacealg_table[pacei].descriptor, pacealgorithm, pacealgorithmlen) == 0) {
+        if (memcmp(pacealg_table[pacei].descriptor, datafromtag, datafromtaglen) == 0) {
             PrintAndLogEx(SUCCESS, "PACE algorithm........: " _YELLOW_("%s"), pacealg_table[pacei].name);
-            return PM3_SUCCESS;
         }
     }
 
+    // Get PACE parameter ID
+    if (!emrtd_lds_get_data_by_tag(dataset, datasetlen, datafromtag, &datafromtaglen, 0x02, 0x00, false, false, 1)) {
+        PrintAndLogEx(ERR, "Failed to read PACE parameter ID from EF_CardAccess.");
+        return PM3_ESOFT;
+    }
+
+    // TODO: hack!!!
+    memcpy(&parsednum, datafromtag, datafromtaglen);
+    for (int pacepari = 0; pacesdp_table[pacepari].id != 32; pacepari++) {
+        PrintAndLogEx(DEBUG, "Trying: %s", hashalg_table[pacepari].name);
+
+        if (pacesdp_table[pacepari].id == parsednum) {
+            PrintAndLogEx(SUCCESS, "PACE parameter........: " _YELLOW_("%s"), pacesdp_table[pacepari].name);
+        }
+        // TODO: account for RFU
+    }
+
     return PM3_SUCCESS;
 }
 
diff --git a/client/src/cmdhfemrtd.h b/client/src/cmdhfemrtd.h
index afa814f0a..35429a568 100644
--- a/client/src/cmdhfemrtd.h
+++ b/client/src/cmdhfemrtd.h
@@ -41,6 +41,13 @@ typedef struct emrtd_pacealg_s {
     const uint8_t descriptor[10];
 } emrtd_pacealg_t;
 
+// Standardized Domain Parameters
+typedef struct emrtd_pacesdp_s {
+    uint8_t id;
+    const char *name;
+    size_t size;
+} emrtd_pacesdp_t;
+
 int CmdHFeMRTD(const char *Cmd);
 
 int dumpHF_EMRTD(char *documentnumber, char *dob, char *expiry, bool BAC_available, const char *path);

From 9cefece2a7342d7ee606e9710102ba05e8129a7e Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sun, 21 Feb 2021 00:42:52 +0100
Subject: [PATCH 626/682] defaults

---
 client/dictionaries/t55xx_default_pwds.dic | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/client/dictionaries/t55xx_default_pwds.dic b/client/dictionaries/t55xx_default_pwds.dic
index 348c79e0d..eaff04048 100644
--- a/client/dictionaries/t55xx_default_pwds.dic
+++ b/client/dictionaries/t55xx_default_pwds.dic
@@ -27,6 +27,8 @@ A5B4C3D2
 00434343
 44B44CAE
 88661858
+# MKF fobs
+E9920427
 # paxton bullit?
 575F4F4B
 #

From 8904162d7a04d18d872c6ca9b32841e16063736c Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sun, 21 Feb 2021 03:15:26 +0300
Subject: [PATCH 627/682] emrtd: Add EF_CardAccess parsing to offline info

---
 client/src/cmdhfemrtd.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 18040bc2e..4b4a895eb 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1972,6 +1972,16 @@ int infoHF_EMRTD_offline(const char *path) {
     uint8_t dg_hashes_calc[17][64] = { { 0 } };
     int hash_algo = 0;
 
+    strcpy(filepath, path);
+    strncat(filepath, PATHSEP, 2);
+    strcat(filepath, dg_table[EF_CardAccess].filename);
+
+    if (loadFile_safeEx(filepath, ".BIN", (void **)&data, (size_t *)&datalen, false) == PM3_SUCCESS) {
+        emrtd_print_ef_cardaccess_info(data, datalen);
+    } else {
+        PrintAndLogEx(HINT, "The error above this is normal. It just means that your eMRTD lacks PACE.");
+    }
+
     strcpy(filepath, path);
     strncat(filepath, PATHSEP, 2);
     strcat(filepath, dg_table[EF_SOD].filename);

From 3a6c06e998568801d747a78f64094b317749bf45 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sun, 21 Feb 2021 00:27:18 +0000
Subject: [PATCH 628/682] changelog: Add hf emrtd info changes

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ab629c19e..c05e5a084 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+ - Added parsing of EF_CardAccess to display PACE algorithm, version and parameter in `hf emrtd info` (@aveao)
  - Change, numerous commands more uses cliparser (@tcprst, @iceman1001)
  - Added more originality public keys (@anon)
  - Added `hf 14a info` - now also verify MFC Ev1 signatures (@iceman1001)

From 0073fc1a71105078547b29bb78e7c0ed771d61ca Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sun, 21 Feb 2021 10:46:39 +0100
Subject: [PATCH 629/682] Modified the flashing feedback text to include
 suggest steps

---
 client/src/flash.c     | 11 +++++++++++
 client/src/proxmark3.c |  4 +++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/client/src/flash.c b/client/src/flash.c
index 1541b8d17..9693d8803 100644
--- a/client/src/flash.c
+++ b/client/src/flash.c
@@ -403,9 +403,19 @@ static int wait_for_ack(PacketResponseNG *ack) {
     return PM3_SUCCESS;
 }
 
+static bool g_printed_msg = false;
 static void flash_suggest_update_bootloader(void) {
+    if (g_printed_msg)
+        return;
+
     PrintAndLogEx(ERR, _RED_("It is recommended that you first" _YELLOW_(" update your bootloader") _RED_(" alone,")));
     PrintAndLogEx(ERR, _RED_("reboot the Proxmark3 then only update the main firmware") "\n");
+    PrintAndLogEx(ERR, "Follow these steps :");
+    PrintAndLogEx(ERR, " 1)   ./pm3-flash-bootrom");
+    PrintAndLogEx(ERR, " 2)   ./pm3-flash-flash-all");
+    PrintAndLogEx(ERR, " 3)   ./pm3");
+    PrintAndLogEx(INFO, "--------------------------------------------------------");
+    g_printed_msg = true;
 }
 
 static void flash_suggest_update_flasher(void) {
@@ -532,6 +542,7 @@ const char ice[] =
     "        !!: :!!      !!:      !!:     !!: !!:  !!! !!:  !!!\n        :    :: :: : : :: :::  :      :    :   : : ::    : \n"
     _RED_("        .    .. .. . . .. ...  .      .    .   . . ..    . ")
     "\n...................................................................\n"
+    "...................................................................\n"
     ;
 
 // Write a file's segments to Flash
diff --git a/client/src/proxmark3.c b/client/src/proxmark3.c
index a1e4761c7..3d92b8d00 100644
--- a/client/src/proxmark3.c
+++ b/client/src/proxmark3.c
@@ -673,6 +673,8 @@ static int flash_pm3(char *serial_port_name, uint8_t num_files, char *filenames[
     }
 
 finish:
+    if (ret != PM3_SUCCESS)
+        PrintAndLogEx(INFO, "The flashing procedure failed, follow the suggested steps!");
     ret = flash_stop_flashing();
     CloseProxmark(session.current_device);
 finish2:
@@ -684,7 +686,7 @@ finish2:
         PrintAndLogEx(SUCCESS, _CYAN_("All done"));
     else
         PrintAndLogEx(ERR, "Aborted on error");
-    PrintAndLogEx(NORMAL, "\nHave a nice day!");
+    PrintAndLogEx(INFO, "\nHave a nice day!");
     return ret;
 }
 #endif //LIBPM3

From fad29cb7553b949084e38c48639973faba038a86 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sun, 21 Feb 2021 11:04:15 +0100
Subject: [PATCH 630/682] only look if no key is applied

---
 client/src/cmdhficlass.c | 55 ++++++++++++++++++++++++----------------
 1 file changed, 33 insertions(+), 22 deletions(-)

diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c
index 45268b4da..716e03436 100644
--- a/client/src/cmdhficlass.c
+++ b/client/src/cmdhficlass.c
@@ -940,22 +940,27 @@ static int CmdHFiClassDecrypt(const char *Cmd) {
     }
 
     bool verbose = arg_get_lit(clictx, 4);
-
     CLIParserFree(clictx);
 
-    size_t keylen = 0;
     uint8_t dec_data[8] = {0};
-
-    bool use_sc = IsCryptoHelperPresent(verbose);
-
-    if (have_key == false && use_sc == false) {
-        int res = loadFile_safe(ICLASS_DECRYPTION_BIN, "", (void **)&keyptr, &keylen);
-        if (res != PM3_SUCCESS) {
-            PrintAndLogEx(INFO, "Couldn't find any decryption methods");
-            return PM3_EINVARG;
+    bool use_sc = false;
+    if (have_key == false) {
+        use_sc = IsCryptoHelperPresent(verbose);
+        if (use_sc == false) {
+            size_t keylen = 0;
+            int res = loadFile_safe(ICLASS_DECRYPTION_BIN, "", (void **)&keyptr, &keylen);
+            if (res != PM3_SUCCESS) {
+                PrintAndLogEx(INFO, "Couldn't find any decryption methods");
+                return PM3_EINVARG;
+            }
+    
+            if (keylen != 16) {
+                PrintAndLogEx(ERR, "Failed to load transport key from file");
+                return PM3_EINVARG;
+            }
+            memcpy(key, keyptr, sizeof(key));
+            free(keyptr);
         }
-        memcpy(key, keyptr, sizeof(key));
-        free(keyptr);
     }
 
     // tripledes
@@ -1157,18 +1162,24 @@ static int CmdHFiClassEncryptBlk(const char *Cmd) {
 
     CLIParserFree(clictx);
 
-    bool use_sc = IsCryptoHelperPresent(verbose);
+    bool use_sc = false;
+    if (have_key == false) {
+        use_sc = IsCryptoHelperPresent(verbose);
+        if (use_sc == false) {
+            size_t keylen = 0;
+            int res = loadFile_safe(ICLASS_DECRYPTION_BIN, "", (void **)&keyptr, &keylen);
+            if (res != PM3_SUCCESS) {
+                PrintAndLogEx(ERR, "Failed to find any encryption methods");
+                return PM3_EINVARG;
+            }
 
-    if (have_key == false && use_sc == false) {
-        size_t keylen = 0;
-        int res = loadFile_safe(ICLASS_DECRYPTION_BIN, "", (void **)&keyptr, &keylen);
-        if (res != PM3_SUCCESS) {
-            PrintAndLogEx(ERR, "Failed to find the transport key");
-            return PM3_EINVARG;
+            if (keylen != 16) {
+                PrintAndLogEx(ERR, "Failed to load transport key from file");
+                return PM3_EINVARG;
+            }
+            memcpy(key, keyptr, sizeof(key));
+            free(keyptr);
         }
-
-        memcpy(key, keyptr, sizeof(key));
-        free(keyptr);
     }
 
     if (use_sc) {

From b41be82a6c4547de4570e4984909f5b5d8e6fe1f Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 22 Feb 2021 13:12:37 +0100
Subject: [PATCH 631/682] hf 15 - prepcmd beyond array boundery fix

---
 client/src/cmdhf15.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhf15.c b/client/src/cmdhf15.c
index 04ffbae45..6cb4dfe53 100644
--- a/client/src/cmdhf15.c
+++ b/client/src/cmdhf15.c
@@ -575,6 +575,10 @@ bool readHF15Uid(bool loop, bool verbose) {
  *  **cmd   command line
  */
 static bool prepareHF15Cmd(char **cmd, uint16_t *reqlen, uint8_t *arg1, uint8_t *req, uint8_t iso15cmd) { // reqlen arg0
+
+    if (*cmd == NULL || strlen(*cmd) == 0)
+        return false;
+
     int temp;
     uint8_t uid[8] = {0x00};
     uint32_t tmpreqlen = 0;
@@ -598,13 +602,12 @@ static bool prepareHF15Cmd(char **cmd, uint16_t *reqlen, uint8_t *arg1, uint8_t
     // strip
     while (**cmd == ' ' || **cmd == '\t')(*cmd)++;
 
-    switch (**cmd) {
+    char c = tolower(**cmd);
+    switch (c) {
         case 0:
             PrintAndLogEx(WARNING, "missing addr");
             return false;
-            break;
         case 'u':
-        case 'U':
             // unaddressed mode may not be supported by all vendors
             req[tmpreqlen++] |= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | ISO15_REQ_NONINVENTORY;
             req[tmpreqlen++] = iso15cmd;
@@ -637,9 +640,9 @@ static bool prepareHF15Cmd(char **cmd, uint16_t *reqlen, uint8_t *arg1, uint8_t
             break;
     }
     // skip to next space
-    while (**cmd != ' ' && **cmd != '\t')(*cmd)++;
+    while (**cmd != NULL && **cmd != ' ' && **cmd != '\t')(*cmd)++;
     // skip over the space
-    while (**cmd == ' ' || **cmd == '\t')(*cmd)++;
+    while (**cmd != NULL && **cmd == ' ' || **cmd == '\t')(*cmd)++;
 
     *reqlen = tmpreqlen;
     return true;

From 954ad74bc0ec5d0cc23dd863693f276d7ac2a71d Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 22 Feb 2021 13:48:58 +0100
Subject: [PATCH 632/682] ... this time fix out bounds loop..  and some nice
 outputs

---
 client/src/cmdhf15.c | 31 ++++++++++++++++++-------------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/client/src/cmdhf15.c b/client/src/cmdhf15.c
index 6cb4dfe53..1fd1fb034 100644
--- a/client/src/cmdhf15.c
+++ b/client/src/cmdhf15.c
@@ -640,9 +640,9 @@ static bool prepareHF15Cmd(char **cmd, uint16_t *reqlen, uint8_t *arg1, uint8_t
             break;
     }
     // skip to next space
-    while (**cmd != NULL && **cmd != ' ' && **cmd != '\t')(*cmd)++;
+    while (**cmd != '\0' && **cmd != ' ' && **cmd != '\t')(*cmd)++;
     // skip over the space
-    while (**cmd != NULL && **cmd == ' ' || **cmd == '\t')(*cmd)++;
+    while (**cmd != '\0' && (**cmd == ' ' || **cmd == '\t'))(*cmd)++;
 
     *reqlen = tmpreqlen;
     return true;
@@ -1355,7 +1355,8 @@ static int CmdHF15Dump(const char *Cmd) {
 
     // copy uid to read command
     memcpy(req + 2, uid, sizeof(uid));
-
+    
+    PrintAndLogEx(INFO, "." NOLF);
     for (int retry = 0; retry < 5; retry++) {
 
         req[10] = blocknum;
@@ -1371,6 +1372,7 @@ static int CmdHF15Dump(const char *Cmd) {
                 continue;
             }
             if (len < 2) {
+                PrintAndLogEx(NORMAL, "");
                 PrintAndLogEx(FAILED, "iso15693 command failed");
                 continue;
             }
@@ -1378,11 +1380,13 @@ static int CmdHF15Dump(const char *Cmd) {
             recv = resp.data.asBytes;
 
             if (CheckCrc15(recv, len) == false) {
+                PrintAndLogEx(NORMAL, "");
                 PrintAndLogEx(FAILED, "crc (" _RED_("fail") ")");
                 continue;
             }
 
             if ((recv[0] & ISO15_RES_ERROR) == ISO15_RES_ERROR) {
+                PrintAndLogEx(NORMAL, "");
                 PrintAndLogEx(FAILED, "Tag returned Error %i: %s", recv[1], TagErrorStr(recv[1]));
                 break;
             }
@@ -1402,12 +1406,12 @@ static int CmdHF15Dump(const char *Cmd) {
     DropField();
 
     PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "block#   | data         |lck| ascii");
-    PrintAndLogEx(NORMAL, "---------+--------------+---+----------");
+    PrintAndLogEx(INFO, "block#   | data         |lck| ascii");
+    PrintAndLogEx(INFO, "---------+--------------+---+----------");
     for (int i = 0; i < blocknum; i++) {
-        PrintAndLogEx(NORMAL, "%3d/0x%02X | %s | %d | %s", i, i, sprint_hex(mem[i].block, 4), mem[i].lock, sprint_ascii(mem[i].block, 4));
+        PrintAndLogEx(INFO, "%3d/0x%02X | %s | %d | %s", i, i, sprint_hex(mem[i].block, 4), mem[i].lock, sprint_ascii(mem[i].block, 4));
     }
-    PrintAndLogEx(NORMAL, "\n");
+    PrintAndLogEx(NORMAL, "");
 
     size_t datalen = blocknum * 4;
     saveFile(filename, ".bin", data, datalen);
@@ -1598,14 +1602,15 @@ static int CmdHF15Readmulti(const char *Cmd) {
 
 
     PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "block#   | data         |lck| ascii");
-    PrintAndLogEx(NORMAL, "---------+--------------+---+----------");
+    PrintAndLogEx(INFO, "block#   | data         |lck| ascii");
+    PrintAndLogEx(INFO, "---------+--------------+---+----------");
 
     for (int i = start; i < stop; i += 5) {
-        PrintAndLogEx(NORMAL, "%3d/0x%02X | %s | %d | %s", currblock, currblock, sprint_hex(data + i + 1, 4), data[i], sprint_ascii(data + i + 1, 4));
+        PrintAndLogEx(INFO, "%3d/0x%02X | %s | %d | %s", currblock, currblock, sprint_hex(data + i + 1, 4), data[i], sprint_ascii(data + i + 1, 4));
         currblock++;
     }
 
+    PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }
 
@@ -1679,9 +1684,9 @@ static int CmdHF15Read(const char *Cmd) {
 
     // print response
     PrintAndLogEx(NORMAL, "");
-    PrintAndLogEx(NORMAL, "block #%3d  |lck| ascii", blocknum);
-    PrintAndLogEx(NORMAL, "------------+---+------");
-    PrintAndLogEx(NORMAL, "%s| %d | %s", sprint_hex(data + 2, status - 4), data[1], sprint_ascii(data + 2, status - 4));
+    PrintAndLogEx(INFO, "block #%3d  |lck| ascii", blocknum);
+    PrintAndLogEx(INFO, "------------+---+------");
+    PrintAndLogEx(INFO, "%s| %d | %s", sprint_hex(data + 2, status - 4), data[1], sprint_ascii(data + 2, status - 4));
     PrintAndLogEx(NORMAL, "");
     return PM3_SUCCESS;
 }

From 226b82536ad6a4eda7d7afdacc7e838e79298d5a Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 22 Feb 2021 21:25:25 +0100
Subject: [PATCH 633/682] color and text, which introduced a new dependency..

---
 tools/recover_pk.py | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/tools/recover_pk.py b/tools/recover_pk.py
index 0310b4750..c46180d41 100755
--- a/tools/recover_pk.py
+++ b/tools/recover_pk.py
@@ -5,6 +5,9 @@
 import binascii
 import sys
 import hashlib
+from colors import *
+
+# pip3 install ansicolors
 
 debug = False
 
@@ -460,7 +463,6 @@ def recover_multiple(uids, sigs, curvename, alghash=None):
             recovered &= recovered_tmp
     return recovered
 
-
 def selftests():
     tests = [
         {'name': "Mifare Ultralight EV1",
@@ -556,14 +558,17 @@ if __name__ == "__main__":
         print("Example: \n%s 04ee45daa34084 ebb6102bff74b087d18a57a54bc375159a04ea9bc61080b7f4a85afe1587d73b" % sys.argv[0])
         exit(1)
     uids, sigs = sys.argv[1:][::2], sys.argv[1:][1::2]
+    once = True
     curvenames = guess_curvename(sigs[0])
     for c in curvenames:
-        print("\nAssuming curve=%s" % c)
-        print("========================")
         for h in [None, "md5", "sha1", "sha256", "sha512"]:
-            print("Assuming hash=%s" % h)
             recovered = recover_multiple(uids, sigs, c, alghash=h)
             if recovered:
+                if once:
+                    print(color('curve=%s', fg='yellow') % c)
+                    once = False
+                print(color('hash=%s', fg='yellow') % h)
                 print("Possible uncompressed Pk(s):")
                 for pk in list(recovered):
                     print(binascii.hexlify(pk).decode('utf8'))
+        once = True

From da9d041301f05a08df0bccfd2b7bd191b0172209 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 22 Feb 2021 21:58:09 +0100
Subject: [PATCH 634/682] added the possibility to protect and manually verify
 the write

---
 client/luascripts/lf_em4100_bulk.lua | 61 ++++++++++++++++++++++++----
 1 file changed, 52 insertions(+), 9 deletions(-)

diff --git a/client/luascripts/lf_em4100_bulk.lua b/client/luascripts/lf_em4100_bulk.lua
index d1f4aa845..d4cdfdd8d 100644
--- a/client/luascripts/lf_em4100_bulk.lua
+++ b/client/luascripts/lf_em4100_bulk.lua
@@ -4,7 +4,7 @@ local ac = require('ansicolors')
 
 copyright = ''
 author = "Christian Herrmann"
-version = 'v1.0.1'
+version = 'v1.0.2'
 desc = [[
 Perform bulk EM410x enrollment of T5577 RFID tags.  It keeps track of last card id used.
 If called with -s,  this value resets "session".
@@ -12,6 +12,11 @@ If called with -s,  this value resets "session".
 if press <enter>  it defaults to Y,  which writes a ID.
 Any other input char will exit the script.
 
+You can supply a password, which will set the config block / block 7 on the T5577.
+
+The verify option will issue a 'lf em 410x reader' command,  so you can manually verify 
+that the write worked.
+
 ]]
 example = [[
     -- resets and start enrolling EM410x id 11CC334455    
@@ -19,14 +24,21 @@ example = [[
 
     -- continue enrolling from where last iteration
     script run lf_em4100_bulk.lua -c
+
+    -- reset and start enrolling from 11223344,
+    -- protecting the tag with password 010203
+    -- and verify the em id write.
+    script run lf_em4100_bulk.lua -s 1122334455 -p 01020304 -v  
 ]]
 usage = [[
-script run lf_en4100_bulk.lua [-h] [-c] [-s <start cn>]
+script run lf_en4100_bulk.lua [-h] [-c] [-p password] [-s <start cn>] [-v]
 ]]
 arguments = [[
     -h      : this help
     -c      : continue from last card number used
+    -p      : Password protecting the T5577.
     -s      : starting card number
+    -v      : verify write by executing a `lf em 410x reader`
     ]]
 
     -- Some globals
@@ -112,22 +124,35 @@ local function main(args)
 
     if #args == 0 then return help() end
 
+    local shall_verify = false
     local shall_continue = false
+    local got_pwd = false
     local startid = ''
+    local ipwd = ''
 
-    for o, a in getopt.getopt(args, 'cs:h') do
+
+    for o, a in getopt.getopt(args, 'cp:s:hv') do
         if o == 'h' then return help() end
-        if o == 'c' then
-            shall_continue = true
-        end
+        if o == 'c' then shall_continue = true end
         if o == 's' then startid = a end
+        if o == 'p' then
+            ipwd = a
+            got_pwd = true
+        end
+        if o == 'v' then shall_verify = true end
     end
 
     -- if reset/start over, check -s
     if not shall_continue then 
         if startid == nil then return oops('empty card number string') end
         if #startid == 0 then return oops('empty card number string') end
-        if #startid ~= 10 then return oops('card number wrong length. Should be 5 hex bytes') end
+        if #startid ~= 10 then return oops('card number wrong length. Must be 5 hex bytes') end
+    end
+
+    if got_pwd then
+        if ipwd == nil then return oops('empty password') end
+        if #ipwd == 0 then return oops('empty password') end
+        if #ipwd ~= 8 then return oops('password wrong length. Must be 4 hex bytes') end
     end
 
     core.console('clear')
@@ -137,7 +162,16 @@ local function main(args)
     
     local hi  = tonumber(startid:sub(1, 2), 16)
     local low = tonumber(startid:sub(3, 10), 16)
-    
+    local pwd = tonumber(ipwd, 16)
+
+    if got_pwd then
+        print(('Will protect T5577 with password '..ac.green..'%08X'..ac.reset):format(pwd))
+    end
+
+    if shall_verify then
+        print('Will verify write afterwards')
+    end
+
     if shall_continue then
         print('Continue enrolling from last save')
         hi, low = readfile()
@@ -152,8 +186,17 @@ local function main(args)
         local msg = (template):format(hi, i)
         local ans = utils.input(msg, 'y'):lower()
         if ans == 'y' then
-            core.console( ('lf em 410x clone --id %02X%08X'):format(hi, i) )
+            core.console( ('lf em 410x clone --id %02X%08X'):format(hi, i) )            
             --        print ( ('lf em 410x clone --id %02X%08X'):format(hi, i) )
+
+            if got_pwd then
+                core.console('lf t55 detect')
+                core.console(('lf t55 protect -n %08x'):format(pwd))
+            end
+
+            if shall_verify then
+                core.console('lf em 410x reader')
+            end
         else
             print(ac.red..'User aborted'..ac.reset)
             low = i

From 8b09f7aa71e68186e80cd47fa8752895bdd4e5c2 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 22 Feb 2021 22:17:28 +0100
Subject: [PATCH 635/682] add python pip dependencies

---
 .github/workflows/ubuntu.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index 57a6caa1d..d3143196c 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -15,6 +15,12 @@ jobs:
       - name: Install dependencies
         run: sudo apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
 
+      - name: Install Python dependencies
+        run: |
+        python -m pip install --upgrade pip
+        python -m pip install ansicolors
+        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+
       - name: make clean
         run: make clean
 
@@ -40,6 +46,12 @@ jobs:
       - name: Install dependencies
         run: sudo apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
 
+      - name: Install Python dependencies
+        run: |
+        python -m pip install --upgrade pip
+        python -m pip install ansicolors
+        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+
       - name: make clean
         run: make clean
 
@@ -66,6 +78,12 @@ jobs:
       - name: Install dependencies
         run: sudo apt-get install -yqq make autoconf build-essential ca-certificates pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev qtbase5-dev libbz2-dev libbluetooth-dev libpython3-dev python3 python3-dev libpython3-all-dev liblua5.2-dev liblua5.2-0-dbg liblua5.2-0 lua5.2 sed
 
+      - name: Install Python dependencies
+        run: |
+        python -m pip install --upgrade pip
+        python -m pip install ansicolors
+        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+
       - name: Prepare Build Folders
         run: mkdir -p client/build
 

From 6a6a444a573c2b507e6e1499ca842bbdb05b7849 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 22 Feb 2021 22:21:31 +0100
Subject: [PATCH 636/682] fixes workflow

---
 .github/workflows/ubuntu.yml | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index d3143196c..4b5965bc7 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -17,9 +17,9 @@ jobs:
 
       - name: Install Python dependencies
         run: |
-        python -m pip install --upgrade pip
-        python -m pip install ansicolors
-        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+          python -m pip install --upgrade pip
+          pip install ansicolors
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
 
       - name: make clean
         run: make clean
@@ -48,9 +48,9 @@ jobs:
 
       - name: Install Python dependencies
         run: |
-        python -m pip install --upgrade pip
-        python -m pip install ansicolors
-        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+          python -m pip install --upgrade pip
+          pip install ansicolors
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
 
       - name: make clean
         run: make clean
@@ -80,9 +80,9 @@ jobs:
 
       - name: Install Python dependencies
         run: |
-        python -m pip install --upgrade pip
-        python -m pip install ansicolors
-        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+          python -m pip install --upgrade pip
+          pip install ansicolors
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
 
       - name: Prepare Build Folders
         run: mkdir -p client/build

From c069bf2653ef2bbdeef6211785166f66f6c89a82 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 22 Feb 2021 22:27:36 +0100
Subject: [PATCH 637/682] fixes workflow

---
 .github/workflows/ubuntu.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index 4b5965bc7..d594a4d06 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -18,8 +18,8 @@ jobs:
       - name: Install Python dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install ansicolors
-          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+          python -m pip install ansicolors
+          if [ -f requirements.txt ]; then python -m pip install -r requirements.txt; fi
 
       - name: make clean
         run: make clean
@@ -49,8 +49,8 @@ jobs:
       - name: Install Python dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install ansicolors
-          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+          python -m pip install ansicolors
+          if [ -f requirements.txt ]; then python -m pip install -r requirements.txt; fi
 
       - name: make clean
         run: make clean
@@ -81,8 +81,8 @@ jobs:
       - name: Install Python dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install ansicolors
-          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+          python -m pip install ansicolors
+          if [ -f requirements.txt ]; then python -m pip install -r requirements.txt; fi
 
       - name: Prepare Build Folders
         run: mkdir -p client/build

From 655e5a8ffa36b14a88cd88e327771a9ab5631a93 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 22 Feb 2021 22:28:40 +0100
Subject: [PATCH 638/682] maybe python3

---
 .github/workflows/ubuntu.yml | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index d594a4d06..9601893c0 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -17,9 +17,9 @@ jobs:
 
       - name: Install Python dependencies
         run: |
-          python -m pip install --upgrade pip
-          python -m pip install ansicolors
-          if [ -f requirements.txt ]; then python -m pip install -r requirements.txt; fi
+          python3 -m pip install --upgrade pip
+          python3 -m pip install ansicolors
+          if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: make clean
         run: make clean
@@ -48,9 +48,9 @@ jobs:
 
       - name: Install Python dependencies
         run: |
-          python -m pip install --upgrade pip
-          python -m pip install ansicolors
-          if [ -f requirements.txt ]; then python -m pip install -r requirements.txt; fi
+          python3 -m pip install --upgrade pip
+          python3 -m pip install ansicolors
+          if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: make clean
         run: make clean
@@ -80,9 +80,9 @@ jobs:
 
       - name: Install Python dependencies
         run: |
-          python -m pip install --upgrade pip
-          python -m pip install ansicolors
-          if [ -f requirements.txt ]; then python -m pip install -r requirements.txt; fi
+          python3 -m pip install --upgrade pip
+          python3 -m pip install ansicolors
+          if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: Prepare Build Folders
         run: mkdir -p client/build

From a9e3c2779e51c052d642cfc594c1e14859384952 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Mon, 22 Feb 2021 22:33:47 +0100
Subject: [PATCH 639/682] adapt workflow for macos and python dependencies

---
 .github/workflows/macos.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index c476fbefe..9f3ec3023 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -25,6 +25,12 @@ jobs:
       - name: Install dependencies
         run: brew install readline qt5 RfidResearchGroup/proxmark3/arm-none-eabi-gcc
 
+      - name: Install Python dependencies
+        run: |
+          python3 -m pip install --upgrade pip
+          python3 -m pip install ansicolors
+          if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
+
       - name: make clean
         run: make clean
 
@@ -60,6 +66,12 @@ jobs:
       - name: Install dependencies
         run: brew install readline qt5 RfidResearchGroup/proxmark3/arm-none-eabi-gcc
 
+      - name: Install Python dependencies
+        run: |
+          python3 -m pip install --upgrade pip
+          python3 -m pip install ansicolors
+          if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
+
       - name: make clean
         run: make clean
 
@@ -96,6 +108,12 @@ jobs:
       - name: Install dependencies
         run: brew install readline qt5 RfidResearchGroup/proxmark3/arm-none-eabi-gcc
 
+      - name: Install Python dependencies
+        run: |
+          python3 -m pip install --upgrade pip
+          python3 -m pip install ansicolors
+          if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
+
       - name: Prepare Build Folders
         run: mkdir -p client/build
 

From 6d329a0462eb7d1f26702285b893547c6812e081 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 23 Feb 2021 18:23:53 +0100
Subject: [PATCH 640/682] coverity fixes

---
 client/src/cmdhficlass.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c
index 716e03436..2fda649b8 100644
--- a/client/src/cmdhficlass.c
+++ b/client/src/cmdhficlass.c
@@ -956,6 +956,7 @@ static int CmdHFiClassDecrypt(const char *Cmd) {
     
             if (keylen != 16) {
                 PrintAndLogEx(ERR, "Failed to load transport key from file");
+                free(keyptr);
                 return PM3_EINVARG;
             }
             memcpy(key, keyptr, sizeof(key));
@@ -1175,6 +1176,7 @@ static int CmdHFiClassEncryptBlk(const char *Cmd) {
 
             if (keylen != 16) {
                 PrintAndLogEx(ERR, "Failed to load transport key from file");
+                free(keyptr);
                 return PM3_EINVARG;
             }
             memcpy(key, keyptr, sizeof(key));

From eade85b3f564b8ac8519866e909d293bcfbb6531 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Tue, 23 Feb 2021 18:24:23 +0100
Subject: [PATCH 641/682] so, let's use sslcrypto...

---
 .github/workflows/macos.yml  |   6 +-
 .github/workflows/ubuntu.yml |   6 +-
 tools/recover_pk.py          | 395 +----------------------------------
 3 files changed, 12 insertions(+), 395 deletions(-)

diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 9f3ec3023..74e6854b7 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -28,7 +28,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansicolors
+          python3 -m pip install ansicolors sslcrypto
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: make clean
@@ -69,7 +69,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansicolors
+          python3 -m pip install ansicolors sslcrypto
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: make clean
@@ -111,7 +111,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansicolors
+          python3 -m pip install ansicolors sslcrypto
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: Prepare Build Folders
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index 9601893c0..417c06aca 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -18,7 +18,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansicolors
+          python3 -m pip install ansicolors sslcrypto
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: make clean
@@ -49,7 +49,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansicolors
+          python3 -m pip install ansicolors sslcrypto
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: make clean
@@ -81,7 +81,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansicolors
+          python3 -m pip install ansicolors sslcrypto
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: Prepare Build Folders
diff --git a/tools/recover_pk.py b/tools/recover_pk.py
index c46180d41..c71064cf3 100755
--- a/tools/recover_pk.py
+++ b/tools/recover_pk.py
@@ -2,399 +2,16 @@
 # MIT License
 # Copyright (c) 2020 @doegox
 
+# Requirements:
+# python3 -m pip install ansicolors sslcrypto
+
 import binascii
 import sys
-import hashlib
-from colors import *
-
-# pip3 install ansicolors
+import sslcrypto
+from colors import color
 
 debug = False
 
-#######################################################################
-# Using external sslcrypto library:
-# import sslcrypto
-# ... sslcrypto.ecc.get_curve()
-# But to get this script autonomous, i.e. for CI, we embedded the
-# code snippets we needed:
-#######################################################################
-# code snippets from JacobianCurve:
-# This code is public domain. Everyone has the right to do whatever
-# they want with it for any purpose.
-# Copyright (c) 2013 Vitalik Buterin
-
-
-class JacobianCurve:
-    def __init__(self, p, n, a, b, g):
-        self.p = p
-        self.n = n
-        self.a = a
-        self.b = b
-        self.g = g
-        self.n_length = len(bin(self.n).replace("0b", ""))
-
-    def to_jacobian(self, p):
-        return p[0], p[1], 1
-
-    def jacobian_double(self, p):
-        if not p[1]:
-            return 0, 0, 0
-        ysq = (p[1] ** 2) % self.p
-        s = (4 * p[0] * ysq) % self.p
-        m = (3 * p[0] ** 2 + self.a * p[2] ** 4) % self.p
-        nx = (m ** 2 - 2 * s) % self.p
-        ny = (m * (s - nx) - 8 * ysq ** 2) % self.p
-        nz = (2 * p[1] * p[2]) % self.p
-        return nx, ny, nz
-
-    def jacobian_add(self, p, q):
-        if not p[1]:
-            return q
-        if not q[1]:
-            return p
-        u1 = (p[0] * q[2] ** 2) % self.p
-        u2 = (q[0] * p[2] ** 2) % self.p
-        s1 = (p[1] * q[2] ** 3) % self.p
-        s2 = (q[1] * p[2] ** 3) % self.p
-        if u1 == u2:
-            if s1 != s2:
-                return (0, 0, 1)
-            return self.jacobian_double(p)
-        h = u2 - u1
-        r = s2 - s1
-        h2 = (h * h) % self.p
-        h3 = (h * h2) % self.p
-        u1h2 = (u1 * h2) % self.p
-        nx = (r ** 2 - h3 - 2 * u1h2) % self.p
-        ny = (r * (u1h2 - nx) - s1 * h3) % self.p
-        nz = (h * p[2] * q[2]) % self.p
-        return (nx, ny, nz)
-
-    def from_jacobian(self, p):
-        z = inverse(p[2], self.p)
-        return (p[0] * z ** 2) % self.p, (p[1] * z ** 3) % self.p
-
-    def jacobian_shamir(self, a, n, b, m):
-        ab = self.jacobian_add(a, b)
-        if n < 0 or n >= self.n:
-            n %= self.n
-        if m < 0 or m >= self.n:
-            m %= self.n
-        res = 0, 0, 1  # point on infinity
-        for i in range(self.n_length - 1, -1, -1):
-            res = self.jacobian_double(res)
-            has_n = n & (1 << i)
-            has_m = m & (1 << i)
-            if has_n:
-                if has_m == 0:
-                    res = self.jacobian_add(res, a)
-                if has_m != 0:
-                    res = self.jacobian_add(res, ab)
-            else:
-                if has_m == 0:
-                    res = self.jacobian_add(res, (0, 0, 1))  # Try not to leak
-                if has_m != 0:
-                    res = self.jacobian_add(res, b)
-        return res
-
-    def fast_shamir(self, a, n, b, m):
-        return self.from_jacobian(
-            self.jacobian_shamir(
-                self.to_jacobian(a), n, self.to_jacobian(b), m))
-
-#######################################################################
-# code snippets from sslcrypto
-# MIT License
-# Copyright (c) 2019 Ivan Machugovskiy
-
-
-def int_to_bytes(raw, length):
-    data = []
-    for _ in range(length):
-        data.append(raw % 256)
-        raw //= 256
-    return bytes(data[::-1])
-
-
-def bytes_to_int(data):
-    raw = 0
-    for byte in data:
-        raw = raw * 256 + byte
-    return raw
-
-
-def legendre(a, p):
-    res = pow(a, (p - 1) // 2, p)
-    if res == p - 1:
-        return -1
-    else:
-        return res
-
-
-def inverse(a, n):
-    if a == 0:
-        return 0
-    lm, hm = 1, 0
-    low, high = a % n, n
-    while low > 1:
-        r = high // low
-        nm, new = hm - lm * r, high - low * r
-        lm, low, hm, high = nm, new, lm, low
-    return lm % n
-
-
-def square_root_mod_prime(n, p):
-    if n == 0:
-        return 0
-    if p == 2:
-        return n  # We should never get here but it might be useful
-    if legendre(n, p) != 1:
-        raise ValueError("No square root")
-    # Optimizations
-    if p % 4 == 3:
-        return pow(n, (p + 1) // 4, p)
-    # 1. By factoring out powers of 2, find Q and S such that p - 1 =
-    # Q * 2 ** S with Q odd
-    q = p - 1
-    s = 0
-    while q % 2 == 0:
-        q //= 2
-        s += 1
-    # 2. Search for z in Z/pZ which is a quadratic non-residue
-    z = 1
-    while legendre(z, p) != -1:
-        z += 1
-    m, c, t, r = s, pow(z, q, p), pow(n, q, p), pow(n, (q + 1) // 2, p)
-    while True:
-        if t == 0:
-            return 0
-        elif t == 1:
-            return r
-        # Use repeated squaring to find the least i, 0 < i < M, such
-        # that t ** (2 ** i) = 1
-        t_sq = t
-        i = 0
-        for i in range(1, m):
-            t_sq = t_sq * t_sq % p
-            if t_sq == 1:
-                break
-        else:
-            raise ValueError("Should never get here")
-        # Let b = c ** (2 ** (m - i - 1))
-        b = pow(c, 2 ** (m - i - 1), p)
-        m = i
-        c = b * b % p
-        t = t * b * b % p
-        r = r * b % p
-    return r
-
-
-CURVES = {
-    # name: (nid, p, n, a, b, (Gx, Gy)),
-    "secp128r1": (
-        706,
-        0xFFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFF,
-        0xFFFFFFFE0000000075A30D1B9038A115,
-        0xFFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFC,
-        0xE87579C11079F43DD824993C2CEE5ED3,
-        (
-            0x161FF7528B899B2D0C28607CA52C5B86,
-            0xCF5AC8395BAFEB13C02DA292DDED7A83
-        )
-    ),
-    "secp128r2": (
-        707,
-        0xFFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFF,
-        0x3FFFFFFF7FFFFFFFBE0024720613B5A3,
-        0xD6031998D1B3BBFEBF59CC9BBFF9AEE1,
-        0x5EEEFCA380D02919DC2C6558BB6D8A5D,
-        (
-            0x7B6AA5D85E572983E6FB32A7CDEBC140,
-            0x27B6916A894D3AEE7106FE805FC34B44
-        )
-    ),
-    "secp192k1": (
-        711,
-        0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFEE37,
-        0xFFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8D,
-        0x000000000000000000000000000000000000000000000000,
-        0x000000000000000000000000000000000000000000000003,
-        (
-            0xDB4FF10EC057E9AE26B07D0280B7F4341DA5D1B1EAE06C7D,
-            0x9B2F2F6D9C5628A7844163D015BE86344082AA88D95E2F9D
-        )
-    ),
-    # p192
-    "secp192r1": (
-        409,
-        0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF,
-        0xFFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831,
-        0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC,
-        0x64210519E59C80E70FA7E9AB72243049FEB8DEECC146B9B1,
-        (
-            0x188DA80EB03090F67CBF20EB43A18800F4FF0AFD82FF1012,
-            0x07192B95FFC8DA78631011ED6B24CDD573F977A11E794811
-        )
-    ),
-    "secp224k1": (
-        712,
-        0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFE56D,
-        0x10000000000000000000000000001DCE8D2EC6184CAF0A971769FB1F7,
-        0x00000000000000000000000000000000000000000000000000000000,
-        0x00000000000000000000000000000000000000000000000000000005,
-        (
-            0xA1455B334DF099DF30FC28A169A467E9E47075A90F7E650EB6B7A45C,
-            0x7E089FED7FBA344282CAFBD6F7E319F7C0B0BD59E2CA4BDB556D61A5
-        )
-    ),
-    # p224
-    "secp224r1": (
-        713,
-        0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001,
-        0xFFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D,
-        0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE,
-        0xB4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4,
-        (
-            0xB70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21,
-            0xBD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34
-        )
-    ),
-    "secp256k1": (
-        714,
-        0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F,
-        0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141,
-        0x0000000000000000000000000000000000000000000000000000000000000000,
-        0x0000000000000000000000000000000000000000000000000000000000000007,
-        (
-            0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798,
-            0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8
-        )
-    ),
-    # p256, openssl uses the name: prime256v1.
-    "secp256r1": (
-        415,
-        0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF,
-        0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551,
-        0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC,
-        0x5AC635D8AA3A93E7B3EbBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B,
-        (
-            0x6B17D1F2E12c4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296,
-            0x4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5
-        )
-    ),
-    # p384
-    "secp384r1": (
-        715,
-        0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF,
-        0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973,
-        0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFC,
-        0xB3312FA7E23EE7E4988E056BE3F82D19181D9C6EFE8141120314088F5013875AC656398D8A2ED19D2A85C8EDD3EC2AEF,
-        (
-            0xAA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B9859F741E082542A385502F25DBF55296C3A545E3872760AB7,
-            0x3617DE4A96262C6F5D9E98BF9292DC29F8F41DBD289A147CE9DA3113B5F0B8C00A60B1CE1D7E819D7A431D7C90EA0E5F
-        )
-    ),
-    "secp521r1": (
-        716,
-        0x01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF,
-        0x01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409,
-        0x01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC,
-        0x0051953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00,
-        (
-            0x00C6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66,
-            0x011839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650
-        )
-    )
-}
-
-
-def get_curve(name):
-    if name not in CURVES:
-        raise ValueError("Unknown curve {}".format(name))
-    nid, p, n, a, b, g = CURVES[name]
-    return EllipticCurve(nid, p, n, a, b, g)
-
-
-class EllipticCurve:
-    def __init__(self, nid, p, n, a, b, g):
-        self.p, self.n, self.a, self.b, self.g = p, n, a, b, g
-        self.jacobian = JacobianCurve(self.p, self.n, self.a, self.b, self.g)
-        self.public_key_length = (len(bin(p).replace("0b", "")) + 7) // 8
-        self.order_bitlength = len(bin(n).replace("0b", ""))
-
-    def _int_to_bytes(self, raw, len=None):
-        return int_to_bytes(raw, len or self.public_key_length)
-
-    def _subject_to_int(self, subject):
-        return bytes_to_int(subject[:(self.order_bitlength + 7) // 8])
-
-    def recover(self, signature, data, hash="sha256"):
-        # Sanity check: is this signature recoverable?
-        if len(signature) != 1 + 2 * self.public_key_length:
-            raise ValueError("Cannot recover an unrecoverable signature")
-        subject = self._digest(data, hash)
-        z = self._subject_to_int(subject)
-
-        recid = signature[0] - 27 if signature[0] < 31 else signature[0] - 31
-        r = bytes_to_int(signature[1:self.public_key_length + 1])
-        s = bytes_to_int(signature[self.public_key_length + 1:])
-
-        # Verify bounds
-        if not 0 <= recid < 2 * (self.p // self.n + 1):
-            raise ValueError("Invalid recovery ID")
-        if r >= self.n:
-            raise ValueError("r is out of bounds")
-        if s >= self.n:
-            raise ValueError("s is out of bounds")
-
-        rinv = inverse(r, self.n)
-        u1 = (-z * rinv) % self.n
-        u2 = (s * rinv) % self.n
-
-        # Recover R
-        rx = r + (recid // 2) * self.n
-        if rx >= self.p:
-            raise ValueError("Rx is out of bounds")
-
-        # Almost copied from decompress_point
-        ry_square = (pow(rx, 3, self.p) + self.a * rx + self.b) % self.p
-        try:
-            ry = square_root_mod_prime(ry_square, self.p)
-        except Exception:
-            raise ValueError("Invalid recovered public key") from None
-
-        # Ensure the point is correct
-        if ry % 2 != recid % 2:
-            # Fix Ry sign
-            ry = self.p - ry
-
-        x, y = self.jacobian.fast_shamir(self.g, u1, (rx, ry), u2)
-        x, y = self._int_to_bytes(x), self._int_to_bytes(y)
-
-        is_compressed = signature[0] >= 31
-        if is_compressed:
-            return bytes([0x02 + (y[-1] % 2)]) + x
-        else:
-            return bytes([0x04]) + x + y
-
-    def _digest(self, data, hash):
-        if hash is None:
-            return data
-        elif callable(hash):
-            return hash(data)
-        elif hash == "md5":
-            return hashlib.md5(data).digest()
-        elif hash == "sha1":
-            return hashlib.sha1(data).digest()
-        elif hash == "sha256":
-            return hashlib.sha256(data).digest()
-        elif hash == "sha512":
-            return hashlib.sha512(data).digest()
-        else:
-            raise ValueError("Unknown hash/derivation method")
-
-#######################################################################
-
 
 def guess_curvename(signature):
     siglen = (len(signature) // 2) & 0xfe
@@ -417,7 +34,7 @@ def guess_curvename(signature):
 
 def recover(data, signature, curvename, alghash=None):
     recovered = set()
-    curve = get_curve(curvename)
+    curve = sslcrypto.ecc.get_curve(curvename)
     recoverable = len(signature) % 1 == 1
     if (recoverable):
         try:

From c8d38340ab0e9c5ffbd81066ede349fa3fe1c092 Mon Sep 17 00:00:00 2001
From: Philippe Teuwen <phil@teuwen.org>
Date: Tue, 23 Feb 2021 18:38:10 +0100
Subject: [PATCH 642/682] fixes workflow

---
 .github/workflows/macos.yml  | 6 +++---
 .github/workflows/ubuntu.yml | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 74e6854b7..ca45ac8da 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -28,7 +28,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansicolors sslcrypto
+          python3 -m pip install ansicolors sslcrypto setuptools
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: make clean
@@ -69,7 +69,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansicolors sslcrypto
+          python3 -m pip install ansicolors sslcrypto setuptools
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: make clean
@@ -111,7 +111,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansicolors sslcrypto
+          python3 -m pip install ansicolors sslcrypto setuptools
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: Prepare Build Folders
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index 417c06aca..d7bc06b2c 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -18,7 +18,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansicolors sslcrypto
+          python3 -m pip install ansicolors sslcrypto setuptools
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: make clean
@@ -49,7 +49,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansicolors sslcrypto
+          python3 -m pip install ansicolors sslcrypto setuptools
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: make clean
@@ -81,7 +81,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansicolors sslcrypto
+          python3 -m pip install ansicolors sslcrypto setuptools
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: Prepare Build Folders

From 18984f63d78ddd029b84d13c5db7d9da24eb4d76 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 23 Feb 2021 18:46:56 +0100
Subject: [PATCH 643/682] test

---
 .github/workflows/macos.yml  | 6 +++---
 .github/workflows/ubuntu.yml | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index ca45ac8da..27e53d9a5 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -28,7 +28,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansicolors sslcrypto setuptools
+          python3 -m pip install setuptools ansicolors sslcrypto
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: make clean
@@ -69,7 +69,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansicolors sslcrypto setuptools
+          python3 -m pip install setuptools ansicolors sslcrypto
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: make clean
@@ -111,7 +111,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansicolors sslcrypto setuptools
+          python3 -m pip install setuptools ansicolors sslcrypto
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: Prepare Build Folders
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index d7bc06b2c..613aaa3f4 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -18,7 +18,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansicolors sslcrypto setuptools
+          python3 -m pip install setuptools ansicolors sslcrypto
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: make clean
@@ -49,7 +49,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansicolors sslcrypto setuptools
+          python3 -m pip install setuptools ansicolors sslcrypto
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: make clean
@@ -81,7 +81,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install ansicolors sslcrypto setuptools
+          python3 -m pip install setuptools ansicolors sslcrypto
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: Prepare Build Folders

From 811ed8040a5ee4d46619a6ac889cdc780a996097 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 23 Feb 2021 19:00:18 +0100
Subject: [PATCH 644/682] test

---
 .github/workflows/ubuntu.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index 613aaa3f4..2d2b461e3 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -18,7 +18,8 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install setuptools ansicolors sslcrypto
+          python3 -m pip install setuptools
+          python3 -m pip install ansicolors sslcrypto
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: make clean
@@ -49,7 +50,8 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install setuptools ansicolors sslcrypto
+          python3 -m pip install setuptools
+          python3 -m pip install ansicolors sslcrypto
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: make clean
@@ -81,7 +83,8 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip
-          python3 -m pip install setuptools ansicolors sslcrypto
+          python3 -m pip install setuptools
+          python3 -m pip install ansicolors sslcrypto
           if [ -f requirements.txt ]; then python3 -m pip install -r requirements.txt; fi
 
       - name: Prepare Build Folders

From 603e288c4f2b8c138b6a46e9bf74eaa69d7956ba Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 23 Feb 2021 21:53:31 +0100
Subject: [PATCH 645/682] path updates

---
 tools/pm3_amii_bin2eml.pl | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/pm3_amii_bin2eml.pl b/tools/pm3_amii_bin2eml.pl
index c8e8d4f46..f15b0de75 100755
--- a/tools/pm3_amii_bin2eml.pl
+++ b/tools/pm3_amii_bin2eml.pl
@@ -14,8 +14,8 @@
 
 my $UIDLOC = -540; # UID is 540 bytes from the end
 my $BLOCKSIZE = 4; # in bytes
-my $AMIITOOL = '../client/amiitool/amiitool'; # path to amiitool (unless in $PATH)
-my $KEYFILE = '../client/amiitool/key_retail.bin'; # path to retail key file
+my $AMIITOOL = '../client/deps/amiitool/amiitool'; # path to amiitool (unless in $PATH)
+my $KEYFILE = '../client/resources/key_retail.bin'; # path to retail key file
 my $ADDHDR = 1; # add 56 byte header?
 my $FIXPWD = 1; # recalculate PWD if dump value is 0
 my $FIXACK = 1; # set ACK if dump value is 0

From 91cf7e3f60f214f03cad25854eaf28602e767f7b Mon Sep 17 00:00:00 2001
From: tharexde <joerg.classen@bowsky.de>
Date: Tue, 23 Feb 2021 22:25:07 +0100
Subject: [PATCH 646/682] Dbprintf and sprintf destroyed timing for "write
 password" function in standalon sim mode-> fixed

---
 armsrc/Standalone/lf_tharexde.c | 47 ++++++++++------
 armsrc/em4x50.c                 | 95 ++++++++++++++++-----------------
 2 files changed, 78 insertions(+), 64 deletions(-)

diff --git a/armsrc/Standalone/lf_tharexde.c b/armsrc/Standalone/lf_tharexde.c
index c88437f4f..2a7a686fb 100644
--- a/armsrc/Standalone/lf_tharexde.c
+++ b/armsrc/Standalone/lf_tharexde.c
@@ -68,6 +68,7 @@
 #define LF_EM4X50_INPUTFILE_SIM         "lf_em4x50_simulate.eml"
 #define LF_EM4X50_LOGFILE_SIM           "lf_em4x50_passwords.log"
 #define LF_EM4X50_LOGFILE_COLLECT       "lf_em4x50_collect.log"
+#define MAX_NO_PWDS_TO_SAVE             50
 
 uint32_t gPassword;
 
@@ -126,6 +127,19 @@ static void append(const char *filename, uint8_t *entry, size_t entry_len) {
     }
 }
 
+static void save_pwds(uint32_t *pwdlist, size_t no_pwd) {
+    uint8_t entry[10] = {0};
+
+    if (no_pwd > 0) {
+        Dbprintf("");
+        for (int i = 0; i < no_pwd; i++) {
+            sprintf((char *)entry, "%08"PRIx32"\n", pwdlist[i]);
+            append(LF_EM4X50_LOGFILE_SIM, entry, strlen((char *)entry));
+            Dbprintf("received password: %08"PRIx32"", pwdlist[i]);
+        }
+    }
+}
+
 void ModInfo(void) {
     DbpString(_YELLOW_("  LF EM4x50 sim/collector mode") " - a.k.a tharexde");
 }
@@ -133,12 +147,11 @@ void ModInfo(void) {
 void RunMod(void) {
 
     bool state_change = true, read_ok = false;
-    int no_words = 0, command = 0;
+    int no_words = 0, command = 0, no_pwd = 0;
     uint8_t entry[400], state = STATE_SIM;
-    uint32_t tag[EM4X50_NO_WORDS] = {0x0};
+    uint32_t tag[EM4X50_NO_WORDS] = {0x0}, pwdlist[MAX_NO_PWDS_TO_SAVE];
 
     rdv40_spiffs_lazy_mount();
-
     StandAloneMode();
     Dbprintf(_YELLOW_("Standalone mode THAREXDE started"));
 
@@ -156,6 +169,8 @@ void RunMod(void) {
 
             switch (state) {
                 case STATE_SIM:
+                    // save and display passwords
+                    save_pwds(pwdlist, no_pwd);
                     state = STATE_READ;
                     break;
                 case STATE_READ:
@@ -175,6 +190,7 @@ void RunMod(void) {
 
             if (state_change) {
 
+                // initialize simulation mode
                 LEDsoff();
                 LED_A_ON();
                 Dbprintf("");
@@ -188,14 +204,15 @@ void RunMod(void) {
                     LoadDataInstructions(LF_EM4X50_INPUTFILE_SIM);
                 }
 
-                // init; start with command = standard read mode
-                em4x50_setup_sim();
-                gLogin = false;
                 LED_D_OFF();
+                gLogin = false;
                 gPassword = reflect32(tag[0]);
                 gWritePasswordProcess = false;
                 command = EM4X50_COMMAND_STANDARD_READ;
+                no_pwd = 0;
+                memset(pwdlist, 0, sizeof(pwdlist));
 
+                em4x50_setup_sim();
                 state_change = false;
             }
 
@@ -209,14 +226,10 @@ void RunMod(void) {
 
             // check if new password was found
             if (gPassword != reflect32(tag[EM4X50_DEVICE_PASSWORD])) {
-
-                Dbprintf("received password: %08"PRIx32"", gPassword);
-
-                // append password to logfile in flash memory
-                memset(entry, 0, sizeof(entry));
-                sprintf((char *)entry, "%08"PRIx32"\n", gPassword);
-                append(LF_EM4X50_LOGFILE_SIM, entry, strlen((char *)entry));
-
+                if (no_pwd < MAX_NO_PWDS_TO_SAVE) {
+                    pwdlist[no_pwd] = gPassword;
+                    no_pwd++;
+                }
                 gPassword = reflect32(tag[EM4X50_DEVICE_PASSWORD]);
             }
 
@@ -232,10 +245,11 @@ void RunMod(void) {
 
             if (state_change) {
 
+                // initialize read mode
                 LEDsoff();
                 LED_B_ON();
                 Dbprintf("");
-                Dbprintf(_YELLOW_("switched to EM4x50 reading mode\n"));
+                Dbprintf(_YELLOW_("switched to EM4x50 reading mode"));
 
                 em4x50_setup_read();
                 state_change = false;
@@ -269,6 +283,8 @@ void RunMod(void) {
     if (state == STATE_READ) {
         DownloadLogInstructions(LF_EM4X50_LOGFILE_COLLECT);
     } else {
+        // save and display passwords
+        save_pwds(pwdlist, no_pwd);
         DownloadLogInstructions(LF_EM4X50_LOGFILE_SIM);
     }
 
@@ -277,6 +293,7 @@ void RunMod(void) {
     LED_D_OFF();
 
     FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+
     LEDsoff();
     Dbprintf("");
     Dbprintf(_YELLOW_("[=] Standalone mode THAREXDE stopped"));
diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index 6c5f9c2d2..a46d14221 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -1540,7 +1540,7 @@ static int em4x50_sim_handle_login_command(uint32_t *tag) {
         gLogin = false;
         LED_D_OFF();
 
-        // save transmitted password for future use (e.g. standalone mode)
+        // save transmitted password (to be used in standalone mode)
         gPassword = password;
     }
     // continue with standard read mode
@@ -1676,64 +1676,61 @@ static int em4x50_sim_handle_writepwd_command(uint32_t *tag) {
 
     bool pwd = false;
 
-    if (gWritePasswordProcess == false) {
+    gWritePasswordProcess = true;
 
-        gWritePasswordProcess = true;
+    // read password
+    uint32_t act_password = 0;
+    pwd = em4x50_sim_read_word(&act_password);
 
-        // read password
-        uint32_t act_password = 0;
-        pwd = em4x50_sim_read_word(&act_password);
-
-        // processing pause time (corresponds to a "1" bit)
-        em4x50_sim_send_bit(1);
-
-        if (pwd && (act_password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
-            em4x50_sim_send_ack();
-            gLogin = true;
-        } else {
-            em4x50_sim_send_nak();
-            gLogin = false;
-            return EM4X50_COMMAND_STANDARD_READ;
-        }
-
-        int command = em4x50_sim_send_listen_window(tag);
-        if (command != PM3_SUCCESS) {
-            return command;
-        }
+    // processing pause time tpp (corresponds to a "1" bit)
+    em4x50_sim_send_bit(1);
 
+    if (pwd && (act_password == reflect32(tag[EM4X50_DEVICE_PASSWORD]))) {
+        em4x50_sim_send_ack();
+        gLogin = true;
     } else {
-
+        em4x50_sim_send_nak();
+        gLogin = false;
         gWritePasswordProcess = false;
 
-        // read new password
-        uint32_t new_password = 0;
-        pwd = em4x50_sim_read_word(&new_password);
+        // save transmitted password (to be used in standalone mode)
+        gPassword = act_password;
 
-        // write access time
-        wait_cycles(EM4X50_T_TAG_TWA);
-
-        if (pwd) {
-            em4x50_sim_send_ack();
-            tag[EM4X50_DEVICE_PASSWORD] = reflect32(new_password);
-        } else {
-            em4x50_sim_send_ack();
-            return EM4X50_COMMAND_STANDARD_READ;
-        }
-
-        // EEPROM write time
-        // strange: need some sort of 'waveform correction', otherwise ack signal
-        // will not be detected; sending a single "1" as last part of Twee
-        // seems to solve the problem
-        wait_cycles(EM4X50_T_TAG_TWEE - EM4X50_T_TAG_FULL_PERIOD);
-        em4x50_sim_send_bit(1);
-        em4x50_sim_send_ack();
-
-        // continue with standard read mode
         return EM4X50_COMMAND_STANDARD_READ;
     }
 
-    // call writepwd function again for else branch
-    return EM4X50_COMMAND_WRITE_PASSWORD;
+    int command = em4x50_sim_send_listen_window(tag);
+    gWritePasswordProcess = false;
+    if (command != EM4X50_COMMAND_WRITE_PASSWORD) {
+        return command;
+    }
+
+    // read new password
+    uint32_t new_password = 0;
+    pwd = em4x50_sim_read_word(&new_password);
+
+    // write access time twa
+    wait_cycles(EM4X50_T_TAG_TWA);
+
+    if (pwd) {
+        em4x50_sim_send_ack();
+        tag[EM4X50_DEVICE_PASSWORD] = reflect32(new_password);
+        gPassword = new_password;
+    } else {
+        em4x50_sim_send_nak();
+        return EM4X50_COMMAND_STANDARD_READ;
+    }
+
+    // EEPROM write time
+    // strange: need some sort of 'waveform correction', otherwise ack signal
+    // will not be detected; sending a single "1" as last part of Twee
+    // seems to solve the problem
+    wait_cycles(EM4X50_T_TAG_TWEE - EM4X50_T_TAG_FULL_PERIOD);
+    em4x50_sim_send_bit(1);
+    em4x50_sim_send_ack();
+
+    // continue with standard read mode
+    return EM4X50_COMMAND_STANDARD_READ;
 }
 
 void em4x50_handle_commands(int *command, uint32_t *tag) {

From 4620c0b21ef3d17684de5d14ba9569355d43bf82 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 23 Feb 2021 23:00:29 +0100
Subject: [PATCH 647/682] cppchecker fixes

---
 armsrc/Standalone/lf_em4100rswb.c |  4 ++--
 client/src/cmdlfkeri.c            | 37 +++++++++++++++----------------
 client/src/wiegand_formats.c      | 22 +++++++++---------
 client/src/wiegand_formatutils.c  | 10 ++++-----
 client/src/wiegand_formatutils.h  |  2 +-
 common/parity.h                   | 12 ++++------
 6 files changed, 41 insertions(+), 46 deletions(-)

diff --git a/armsrc/Standalone/lf_em4100rswb.c b/armsrc/Standalone/lf_em4100rswb.c
index 27e288e23..aaf82b5b5 100644
--- a/armsrc/Standalone/lf_em4100rswb.c
+++ b/armsrc/Standalone/lf_em4100rswb.c
@@ -193,8 +193,8 @@ static uint64_t PackEmID(uint64_t original, int newCardNum) {
         buf &= ~(1 << i);
     }
     buf |= (newCardNum & 0xFFFF) << 1;
-    buf |= oddparity32((buf >> 1) & 0xFFF) & 1;
-    buf |= (evenparity32((buf >> 13) & 0xFFF) & 1) << 25;
+    buf |= oddparity32((buf >> 1) & 0xFFF);
+    buf |= (evenparity32((buf >> 13) & 0xFFF)) << 25;
 
     uint32_t cardnumNew = (buf >> 1) & 0xFFFF;
     uint32_t fcNew = (buf >> 17) & 0xFF;
diff --git a/client/src/cmdlfkeri.c b/client/src/cmdlfkeri.c
index 82fc04a22..d241e8f66 100644
--- a/client/src/cmdlfkeri.c
+++ b/client/src/cmdlfkeri.c
@@ -37,22 +37,21 @@ static int CmdKeriMSScramble(KeriMSScramble_t Action, uint32_t *FC, uint32_t *ID
                             255, 255,  2, 255, 255, 255,  3, 255,  4, 255, 255, 255, 255, 255,  1, 255
                           };
 
-    uint8_t CardIdx; // 0 - 31
-    bool BitState;
+    uint8_t card_idx; // 0 - 31
 
     if (Action == Descramble) {
         *FC = 0;
         *ID = 0;
-        for (CardIdx = 0; CardIdx < 32; CardIdx++) {
+        for (card_idx = 0; card_idx < 32; card_idx++) {
             // Get Bit State
-            BitState = (*CardID >> CardIdx) & 1;
+            bool BitState = (*CardID >> card_idx) & 1;
             // Card ID
-            if (CardToID[CardIdx] < 32) {
-                *ID = *ID | (BitState << CardToID[CardIdx]);
+            if (CardToID[card_idx] < 32) {
+                *ID = *ID | (BitState << CardToID[card_idx]);
             }
             // Card FC
-            if (CardToFC[CardIdx] < 32) {
-                *FC = *FC | (BitState << CardToFC[CardIdx]);
+            if (CardToFC[card_idx] < 32) {
+                *FC = *FC | (BitState << CardToFC[card_idx]);
             }
         }
     }
@@ -60,16 +59,16 @@ static int CmdKeriMSScramble(KeriMSScramble_t Action, uint32_t *FC, uint32_t *ID
     if (Action == Scramble) {
         *CardID = 0; // set to 0
 
-        for (CardIdx = 0; CardIdx < 32; CardIdx++) {
+        for (card_idx = 0; card_idx < 32; card_idx++) {
             // Card ID
-            if (CardToID[CardIdx] < 32) {
-                if ((*ID & (1 << CardToID[CardIdx])) > 0)
-                    *CardID |= (1 << CardIdx);
+            if (CardToID[card_idx] < 32) {
+                if ((*ID & (1U << CardToID[card_idx])) > 0)
+                    *CardID |= (1U << card_idx);
             }
             // Card FC
-            if (CardToFC[CardIdx] < 32) {
-                if ((*FC & (1 << CardToFC[CardIdx])) > 0)
-                    *CardID |= (1 << CardIdx);
+            if (CardToFC[card_idx] < 32) {
+                if ((*FC & (1U << CardToFC[card_idx])) > 0)
+                    *CardID |= (1U << card_idx);
             }
         }
 
@@ -83,11 +82,11 @@ static int CmdKeriMSScramble(KeriMSScramble_t Action, uint32_t *FC, uint32_t *ID
         *CardID |= (1 <<  3);
 
         // Check/Parity Bits
-        int Parity = 1;
-        for (CardIdx = 4; CardIdx <= 31; CardIdx += 2) {
-            Parity = Parity ^ ((*CardID >> CardIdx) & 11);
+        int parity = 1;
+        for (card_idx = 4; card_idx <= 31; card_idx += 2) {
+            parity ^= ((*CardID >> card_idx) & 11);
         }
-        *CardID = *CardID | Parity;
+        *CardID = *CardID | parity;
 
         // Bit 31 was fixed but not in check/parity bits
         *CardID |= 1UL << 31;
diff --git a/client/src/wiegand_formats.c b/client/src/wiegand_formats.c
index 2dfd39fbd..d39d648cd 100644
--- a/client/src/wiegand_formats.c
+++ b/client/src/wiegand_formats.c
@@ -23,8 +23,8 @@ static bool Pack_H10301(wiegand_card_t *card, wiegand_message_t *packed, bool pr
     packed->Length = 26; // Set number of bits
     packed->Bot |= (card->CardNumber & 0xFFFF) << 1;
     packed->Bot |= (card->FacilityCode & 0xFF) << 17;
-    packed->Bot |= oddparity32((packed->Bot >> 1) & 0xFFF) & 1;
-    packed->Bot |= (evenparity32((packed->Bot >> 13) & 0xFFF) & 1) << 25;
+    packed->Bot |= oddparity32((packed->Bot >> 1) & 0xFFF);
+    packed->Bot |= (evenparity32((packed->Bot >> 13) & 0xFFF)) << 25;
     if (preamble)
         return add_HID_header(packed);
     return true;
@@ -38,7 +38,7 @@ static bool Unpack_H10301(wiegand_message_t *packed, wiegand_card_t *card) {
     card->FacilityCode = (packed->Bot >> 17) & 0xFF;
     card->ParityValid =
         (oddparity32((packed->Bot >> 1) & 0xFFF) == (packed->Bot & 1)) &&
-        ((evenparity32((packed->Bot >> 13) & 0xFFF) & 1) == ((packed->Bot >> 25) & 1));
+        ((evenparity32((packed->Bot >> 13) & 0xFFF)) == ((packed->Bot >> 25) & 1));
     return true;
 }
 
@@ -271,8 +271,8 @@ static bool Pack_H10306(wiegand_card_t *card, wiegand_message_t *packed, bool pr
     packed->Bot |= (card->CardNumber & 0xFFFF) << 1;
     packed->Bot |= (card->FacilityCode & 0x7FFF) << 17;
     packed->Mid |= (card->FacilityCode & 0x8000) >> 15;
-    packed->Mid |= (evenparity32((packed->Mid & 0x00000001) ^ (packed->Bot & 0xFFFE0000)) & 1) << 1;
-    packed->Bot |= (oddparity32(packed->Bot & 0x0001FFFE) & 1);
+    packed->Mid |= (evenparity32((packed->Mid & 0x00000001) ^ (packed->Bot & 0xFFFE0000))) << 1;
+    packed->Bot |= (oddparity32(packed->Bot & 0x0001FFFE));
     if (preamble)
         return add_HID_header(packed);
     return true;
@@ -331,9 +331,9 @@ static bool Pack_C1k35s(wiegand_card_t *card, wiegand_message_t *packed, bool pr
     packed->Bot |= (card->CardNumber & 0x000FFFFF) << 1;
     packed->Bot |= (card->FacilityCode & 0x000007FF) << 21;
     packed->Mid |= (card->FacilityCode & 0x00000800) >> 11;
-    packed->Mid |= (evenparity32((packed->Mid & 0x00000001) ^ (packed->Bot & 0xB6DB6DB6)) & 1) << 1;
-    packed->Bot |= (oddparity32((packed->Mid & 0x00000003) ^ (packed->Bot & 0x6DB6DB6C)) & 1);
-    packed->Mid |= (oddparity32((packed->Mid & 0x00000003) ^ (packed->Bot & 0xFFFFFFFF)) & 1) << 2;
+    packed->Mid |= (evenparity32((packed->Mid & 0x00000001) ^ (packed->Bot & 0xB6DB6DB6))) << 1;
+    packed->Bot |= (oddparity32((packed->Mid & 0x00000003) ^ (packed->Bot & 0x6DB6DB6C)));
+    packed->Mid |= (oddparity32((packed->Mid & 0x00000003) ^ (packed->Bot & 0xFFFFFFFF))) << 2;
     if (preamble)
         return add_HID_header(packed);
     return true;
@@ -711,9 +711,9 @@ static bool Pack_C1k48s(wiegand_card_t *card, wiegand_message_t *packed, bool pr
     packed->Bot |= (card->CardNumber & 0x007FFFFF) << 1;
     packed->Bot |= (card->FacilityCode & 0x000000FF) << 24;
     packed->Mid |= (card->FacilityCode & 0x003FFF00) >> 8;
-    packed->Mid |= (evenparity32((packed->Mid & 0x00001B6D) ^ (packed->Bot & 0xB6DB6DB6)) & 1) << 14;
-    packed->Bot |= (oddparity32((packed->Mid & 0x000036DB) ^ (packed->Bot & 0x6DB6DB6C)) & 1);
-    packed->Mid |= (oddparity32((packed->Mid & 0x00007FFF) ^ (packed->Bot & 0xFFFFFFFF)) & 1) << 15;
+    packed->Mid |= (evenparity32((packed->Mid & 0x00001B6D) ^ (packed->Bot & 0xB6DB6DB6))) << 14;
+    packed->Bot |= (oddparity32((packed->Mid & 0x000036DB) ^ (packed->Bot & 0x6DB6DB6C)));
+    packed->Mid |= (oddparity32((packed->Mid & 0x00007FFF) ^ (packed->Bot & 0xFFFFFFFF))) << 15;
     if (preamble)
         return add_HID_header(packed);
     return true;
diff --git a/client/src/wiegand_formatutils.c b/client/src/wiegand_formatutils.c
index 5e36334bd..b4ca8065f 100644
--- a/client/src/wiegand_formatutils.c
+++ b/client/src/wiegand_formatutils.c
@@ -15,12 +15,12 @@
 #include "wiegand_formatutils.h"
 #include "ui.h"
 
-bool get_bit_by_position(wiegand_message_t *data, uint8_t pos) {
+uint8_t get_bit_by_position(wiegand_message_t *data, uint8_t pos) {
     if (pos >= data->Length) return false;
     pos = (data->Length - pos) - 1; // invert ordering; Indexing goes from 0 to 1. Subtract 1 for weight of bit.
-    bool result = false;
+    uint8_t result = 0;
     if (pos > 95)
-        result = false;
+        result = 0;
     else if (pos > 63)
         result = (data->Top >> (pos - 64)) & 1;
     else if (pos > 31)
@@ -80,7 +80,7 @@ static void message_datacopy(wiegand_message_t *src, wiegand_message_t *dest) {
 uint64_t get_linear_field(wiegand_message_t *data, uint8_t firstBit, uint8_t length) {
     uint64_t result = 0;
     for (uint8_t i = 0; i < length; i++) {
-        result = (result << 1) | (get_bit_by_position(data, firstBit + i));
+        result = (result << 1) | get_bit_by_position(data, firstBit + i);
     }
     return result;
 }
@@ -100,7 +100,7 @@ bool set_linear_field(wiegand_message_t *data, uint64_t value, uint8_t firstBit,
 uint64_t get_nonlinear_field(wiegand_message_t *data, uint8_t numBits, uint8_t *bits) {
     uint64_t result = 0;
     for (int i = 0; i < numBits; i++) {
-        result = (result << 1) | (get_bit_by_position(data, *(bits + i)) & 1);
+        result = (result << 1) | get_bit_by_position(data, *(bits + i));
     }
     return result;
 }
diff --git a/client/src/wiegand_formatutils.h b/client/src/wiegand_formatutils.h
index 534bea4f3..4631b602d 100644
--- a/client/src/wiegand_formatutils.h
+++ b/client/src/wiegand_formatutils.h
@@ -33,7 +33,7 @@ typedef struct {
     bool ParityValid; // Only valid for responses
 } wiegand_card_t;
 
-bool get_bit_by_position(wiegand_message_t *data, uint8_t pos);
+uint8_t get_bit_by_position(wiegand_message_t *data, uint8_t pos);
 bool set_bit_by_position(wiegand_message_t *data, bool value, uint8_t pos);
 
 uint64_t get_linear_field(wiegand_message_t *data, uint8_t firstBit, uint8_t length);
diff --git a/common/parity.h b/common/parity.h
index a768f51fb..dad768524 100644
--- a/common/parity.h
+++ b/common/parity.h
@@ -15,18 +15,15 @@
 
 extern const uint8_t OddByteParity[256];
 
-
-static inline bool oddparity8(const uint8_t x) {
+static inline uint8_t oddparity8(const uint8_t x) {
     return OddByteParity[x];
 }
 
-
-static inline bool evenparity8(const uint8_t x) {
+static inline uint8_t evenparity8(const uint8_t x) {
     return !OddByteParity[x];
 }
 
-
-static inline bool evenparity32(uint32_t x) {
+static inline uint8_t evenparity32(uint32_t x) {
 #if !defined __GNUC__
     x ^= x >> 16;
     x ^= x >> 8;
@@ -36,8 +33,7 @@ static inline bool evenparity32(uint32_t x) {
 #endif
 }
 
-
-static inline bool oddparity32(uint32_t x) {
+static inline uint8_t oddparity32(uint32_t x) {
 #if !defined __GNUC__
     x ^= x >> 16;
     x ^= x >> 8;

From 99dcb8122ac77c6c3566b425e46499ecca5cc4e7 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 23 Feb 2021 23:04:43 +0100
Subject: [PATCH 648/682] cppchecker

---
 client/src/cmdhfmfhard.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfmfhard.c b/client/src/cmdhfmfhard.c
index 58bd00671..5f7f04681 100644
--- a/client/src/cmdhfmfhard.c
+++ b/client/src/cmdhfmfhard.c
@@ -1145,7 +1145,7 @@ __attribute__((force_align_arg_pointer))
         // for (uint16_t bitflip = 0x001; bitflip < 0x200; bitflip++) {
         for (uint16_t bitflip_idx = 0; bitflip_idx < num_1st_byte_effective_bitflips; bitflip_idx++) {
             uint16_t bitflip = all_effective_bitflip[bitflip_idx];
-            if (time_budget & timeout()) {
+            if (time_budget && timeout()) {
 #if defined (DEBUG_REDUCTION)
                 PrintAndLogEx(NORMAL, "break at bitflip_idx %d...", bitflip_idx);
 #endif
@@ -1187,7 +1187,7 @@ __attribute__((force_align_arg_pointer))
     if (hardnested_stage & CHECK_2ND_BYTES) {
         for (uint16_t bitflip_idx = num_1st_byte_effective_bitflips; bitflip_idx < num_all_effective_bitflips; bitflip_idx++) {
             uint16_t bitflip = all_effective_bitflip[bitflip_idx];
-            if (time_budget & timeout()) {
+            if (time_budget && timeout()) {
 #if defined (DEBUG_REDUCTION)
                 PrintAndLogEx(NORMAL, "break at bitflip_idx %d...", bitflip_idx);
 #endif

From 59cd54e17800f10993c1285205b154f6d866c6e7 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 23 Feb 2021 23:04:47 +0100
Subject: [PATCH 649/682] cppchecker

---
 client/src/cmdhfmfhard.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfmfhard.c b/client/src/cmdhfmfhard.c
index 5f7f04681..fc9e00476 100644
--- a/client/src/cmdhfmfhard.c
+++ b/client/src/cmdhfmfhard.c
@@ -660,10 +660,14 @@ static double p_hypergeometric(uint16_t i_K, uint16_t n, uint16_t k) {
         if (n - k == N - K) { // special case. The published recursion below would fail with a divide by zero exception
             double log_result = 0.0;
             for (int16_t i = k + 1; i <= n; i++) {
-                log_result += log(i);
+                if (i) {
+                    log_result += log(i);
+                }
             }
             for (int16_t i = K + 1; i <= N; i++) {
-                log_result -= log(i);
+                if (i) {
+                    log_result -= log(i);
+                }
             }
             return exp(log_result);
         } else {          // recursion

From 0cad19b462c3b45523b8107d2d1e506e6225b0cf Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 23 Feb 2021 23:17:22 +0100
Subject: [PATCH 650/682] cppchecker

---
 tools/hitag2crack/crack5opencl/opencl.c | 4 ++--
 tools/hitag2crack/crack5opencl/opencl.h | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/hitag2crack/crack5opencl/opencl.c b/tools/hitag2crack/crack5opencl/opencl.c
index 31cad1334..ebd14fd7b 100644
--- a/tools/hitag2crack/crack5opencl/opencl.c
+++ b/tools/hitag2crack/crack5opencl/opencl.c
@@ -106,7 +106,7 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
     cl_device_info ocl_devices_info[8] = { CL_DEVICE_TYPE, CL_DEVICE_NAME, CL_DEVICE_VERSION, CL_DRIVER_VERSION, CL_DEVICE_VENDOR, CL_DEVICE_LOCAL_MEM_TYPE, CL_DEVICE_MAX_WORK_ITEM_SIZES, CL_DEVICE_MAX_COMPUTE_UNITS };
     unsigned int ocl_devices_info_cnt = sizeof(ocl_devices_info) / sizeof(cl_device_info);
 
-    unsigned int info_idx = 0;
+    unsigned int info_idx;
     size_t tmp_len = 0;
     char *tmp_buf = NULL;
 
@@ -120,7 +120,7 @@ int discoverDevices(unsigned int profile_selected, uint32_t device_types_selecte
 
         if ((*cd_ctx)[platform_idx].selected)(*selected_platforms_cnt)++;
 
-        if (verbose) printf("\n-- Platform ID: %d\n", platform_idx + 1);
+        if (verbose) printf("\n-- Platform ID: %u\n", platform_idx + 1);
 
         for (info_idx = 0; info_idx < ocl_platforms_info_cnt; info_idx++) {
             cl_platform_info ocl_info = ocl_platforms_info[info_idx];
diff --git a/tools/hitag2crack/crack5opencl/opencl.h b/tools/hitag2crack/crack5opencl/opencl.h
index 76e9857bc..03ae9a990 100644
--- a/tools/hitag2crack/crack5opencl/opencl.h
+++ b/tools/hitag2crack/crack5opencl/opencl.h
@@ -123,7 +123,7 @@ typedef struct opencl_ctx {
 
 bool plat_dev_enabled(unsigned int id, unsigned int *sel, unsigned int cnt, unsigned int cur_type, unsigned int allow_type);
 unsigned int get_smallest_profile(compute_platform_ctx_t *cd_ctx, size_t ocl_platform_cnt);
-int discoverDevices(unsigned int profile_selected, uint32_t device_types_selected, cl_uint *ocl_platform_cnt, size_t *selected_platforms_cnt, size_t *selected_devices_cnt, compute_platform_ctx_t **cd_ctx, unsigned int *plat_sel, unsigned int plat_cnt, unsigned int *dev_sel, unsigned int dev_cnt, bool verbose, bool show);
+int discoverDevices(unsigned int profile_selected, uint32_t device_types_selected, cl_uint *platform_detected_cnt, size_t *selected_platforms_cnt, size_t *selected_devices_cnt, compute_platform_ctx_t **cd_ctx, unsigned int *plat_sel, unsigned int plat_cnt, unsigned int *dev_sel, unsigned int dev_cnt, bool verbose, bool show);
 int runKernel(opencl_ctx_t *ctx, uint32_t cand_base, uint64_t *matches, uint32_t *matches_found, size_t id);
 
 #endif // OPENCL_H

From 50b1591d0f46c67cd4960f4c43d0e2135d16dd6e Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 23 Feb 2021 23:18:47 +0100
Subject: [PATCH 651/682] cppchecker

---
 tools/hitag2crack/crack5opencl/threads.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/hitag2crack/crack5opencl/threads.h b/tools/hitag2crack/crack5opencl/threads.h
index 15874a5a1..0442a8f8c 100644
--- a/tools/hitag2crack/crack5opencl/threads.h
+++ b/tools/hitag2crack/crack5opencl/threads.h
@@ -123,7 +123,7 @@ typedef struct thread_arg {
 } thread_args_t;
 
 int thread_init(thread_ctx_t *ctx, short type, size_t thread_count);
-int thread_start(thread_ctx_t *ctx, thread_args_t *args);
+int thread_start(thread_ctx_t *ctx, thread_args_t *t_arg);
 int thread_stop(thread_ctx_t *ctx);
 int thread_start_scheduler(thread_ctx_t *ctx, thread_args_t *t_arg, wu_queue_ctx_t *queue_ctx);
 bool thread_setEnd(thread_ctx_t *ctx, thread_args_t *t_arg);

From 673f087db9b22084b70af6c98e4c48269c5fd351 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 23 Feb 2021 23:52:17 +0100
Subject: [PATCH 652/682] cppchecker

---
 tools/hitag2crack/common/ht2crackutils.c | 48 +++++++-----------------
 1 file changed, 14 insertions(+), 34 deletions(-)

diff --git a/tools/hitag2crack/common/ht2crackutils.c b/tools/hitag2crack/common/ht2crackutils.c
index ac492ffa0..15592dc64 100644
--- a/tools/hitag2crack/common/ht2crackutils.c
+++ b/tools/hitag2crack/common/ht2crackutils.c
@@ -3,16 +3,12 @@
 #include "ht2crackutils.h"
 
 // writes a value into a buffer as a series of bytes
-void writebuf(unsigned char *buf, uint64_t val, unsigned int len) {
-    int i;
-    char c;
-
-    for (i = len - 1; i >= 0; i--) {
-        c = val & 0xff;
+void writebuf(unsigned char *buf, uint64_t val, uint16_t len) {
+    for (int i = len - 1; i >= 0; i--) {
+        char c = val & 0xff;
         buf[i] = c;
-        val = val >> 8;
+        val >>= 8;
     }
-
 }
 
 
@@ -39,17 +35,13 @@ void shexdump(unsigned char *data, int data_len) {
 
 
 void printbin(unsigned char *c) {
-    int i, j;
-    unsigned char x;
-
     if (!c) {
         printf("printbin: invalid params\n");
         return;
     }
-
-    for (i = 0; i < 6; i++) {
-        x = c[i];
-        for (j = 0; j < 8; j++) {
+    for (int i = 0; i < 6; i++) {
+        unsigned char x = c[i];
+        for (int j = 0; j < 8; j++) {
             printf("%d", (x & 0x80) >> 7);
             x = x << 1;
         }
@@ -57,33 +49,27 @@ void printbin(unsigned char *c) {
     printf("\n");
 }
 
-
 void printbin2(uint64_t val, unsigned int size) {
-    int i;
-    uint64_t mask = 1;
 
+    uint64_t mask = 1;
     mask = mask << (size - 1);
 
-    for (i = 0; i < size; i++) {
+    for (int i = 0; i < size; i++) {
         if (val & mask) {
             printf("1");
         } else {
             printf("0");
         }
-        val = val << 1;
+        val <<= 1;
     }
 }
 
-
 void printstate(Hitag_State *hstate) {
     printf("shiftreg =\t");
     printbin2(hstate->shiftreg, 48);
     printf("\n");
 }
 
-
-
-
 // convert hex char to binary
 unsigned char hex2bin(unsigned char c) {
     if ((c >= '0') && (c <= '9')) {
@@ -100,7 +86,6 @@ unsigned char hex2bin(unsigned char c) {
 // return a single bit from a value
 int bitn(uint64_t x, int bit) {
     uint64_t bitmask = 1;
-
     bitmask = bitmask << bit;
 
     if (x & bitmask) {
@@ -121,15 +106,11 @@ int fnR(uint64_t x) {
 
 // the rollback function that lets us go backwards in time
 void rollback(Hitag_State *hstate, unsigned int steps) {
-    int i;
-
-    for (i = 0; i < steps; i++) {
+    for (int i = 0; i < steps; i++) {
         hstate->shiftreg = ((hstate->shiftreg << 1) & 0xffffffffffff) | fnR(hstate->shiftreg);
     }
-
 }
 
-
 // the three filter sub-functions that feed fnf
 int fa(unsigned int i) {
     return bitn(0x2C79, i);
@@ -161,9 +142,7 @@ int fnf(uint64_t s) {
 // builds the lfsr for the prng (quick calcs for hitag2_nstep())
 void buildlfsr(Hitag_State *hstate) {
     uint64_t state = hstate->shiftreg;
-    uint64_t temp;
-
-    temp = state ^ (state >> 1);
+    uint64_t temp = state ^ (state >> 1);
     hstate->lfsr = state ^ (state >>  6) ^ (state >> 16)
                    ^ (state >> 26) ^ (state >> 30) ^ (state >> 41)
                    ^ (temp >>  2) ^ (temp >>  7) ^ (temp >> 22)
@@ -180,8 +159,9 @@ unsigned long hexreversetoulong(char *hex) {
         return 0L;
 
     for (i = 0 ; i < 4 ; ++i) {
-        if (sscanf(hex, "%2X", &x) != 1)
+        if (sscanf(hex, "%2X", &x) != 1) {
             return 0L;
+        }
         ret += ((unsigned long) x) << i * 8;
         hex += 2;
     }

From d9195effc7a9e03bb34f55145acd325084534c0a Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 23 Feb 2021 23:53:08 +0100
Subject: [PATCH 653/682] cppchecker

---
 armsrc/mifarecmd.c | 15 +++++++++------
 armsrc/mifarecmd.h |  2 +-
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/armsrc/mifarecmd.c b/armsrc/mifarecmd.c
index 4880d01e9..2ea7aa1b8 100644
--- a/armsrc/mifarecmd.c
+++ b/armsrc/mifarecmd.c
@@ -662,9 +662,11 @@ void MifareUSetPwd(uint8_t arg0, uint8_t *datain) {
 
 // Return 1 if the nonce is invalid else return 0
 static int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
-    return ((oddparity8((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity8((NtEnc >> 24) & 0xFF) ^ BIT(Ks1, 16))) & \
-            (oddparity8((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity8((NtEnc >> 16) & 0xFF) ^ BIT(Ks1, 8))) & \
-            (oddparity8((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity8((NtEnc >> 8) & 0xFF) ^ BIT(Ks1, 0)))) ? 1 : 0;
+    return (
+        (oddparity8((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity8((NtEnc >> 24) & 0xFF) ^ BIT(Ks1, 16))) && \
+        (oddparity8((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity8((NtEnc >> 16) & 0xFF) ^ BIT(Ks1, 8))) && \
+        (oddparity8((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity8((NtEnc >> 8) & 0xFF) ^ BIT(Ks1, 0)))
+        ) ? 1 : 0;
 }
 
 void MifareAcquireNonces(uint32_t arg0, uint32_t flags) {
@@ -1011,7 +1013,8 @@ void MifareNested(uint8_t blockNo, uint8_t keyType, uint8_t targetBlockNo, uint8
             }
         }
 
-        davg = (davg + (rtr - 1) / 2) / (rtr - 1);
+        if (rtr > 1)
+            davg = (davg + (rtr - 1) / 2) / (rtr - 1);
 
         if (DBGLEVEL >= DBG_DEBUG) Dbprintf("rtr=%d isOK=%d min=%d max=%d avg=%d, delta_time=%d", rtr, isOK, dmin, dmax, davg, delta_time);
 
@@ -2710,8 +2713,8 @@ void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain) {
 //
 // Tear-off attack against MFU.
 // - Moebius et al
-void MifareU_Otp_Tearoff(uint8_t arg0, uint32_t tearoff_time, uint8_t *datain) {
-    uint8_t blockNo = arg0;
+void MifareU_Otp_Tearoff(uint8_t blno, uint32_t tearoff_time, uint8_t *datain) {
+    uint8_t blockNo = blno;
     uint8_t data_fullwrite[4] = {0x00};
     uint8_t data_testwrite[4] = {0x00};
     memcpy(data_fullwrite, datain, 4);
diff --git a/armsrc/mifarecmd.h b/armsrc/mifarecmd.h
index 92defcaf5..757a5efbb 100644
--- a/armsrc/mifarecmd.h
+++ b/armsrc/mifarecmd.h
@@ -63,6 +63,6 @@ void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain);
 void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain);
 
 // Tear-off test for MFU
-void MifareU_Otp_Tearoff(uint8_t arg0, uint32_t arg1, uint8_t *datain);
+void MifareU_Otp_Tearoff(uint8_t blno, uint32_t tearoff_time, uint8_t *datain);
 void MifareU_Counter_Tearoff(uint8_t counter, uint32_t tearoff_time, uint8_t *datain);
 #endif

From 232a172ac5b2c69915e0d4a657cab68c83edab06 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 23 Feb 2021 23:54:02 +0100
Subject: [PATCH 654/682] rename

---
 armsrc/usart.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/armsrc/usart.c b/armsrc/usart.c
index b3ed42978..75b005b6d 100644
--- a/armsrc/usart.c
+++ b/armsrc/usart.c
@@ -121,7 +121,7 @@ uint16_t usart_rxdata_available(void) {
 
 uint32_t usart_read_ng(uint8_t *data, size_t len) {
     if (len == 0) return 0;
-    uint32_t nbBytesRcv = 0;
+    uint32_t bytes_rcv = 0;
     uint32_t try = 0;
 //    uint32_t highest_observed_try = 0;
     // Empirical max try observed: 3000000 / USART_BAUD_RATE
@@ -146,7 +146,7 @@ uint32_t usart_read_ng(uint8_t *data, size_t len) {
         }
         len -= packetSize;
         while (packetSize--) {
-            data[nbBytesRcv++] = us_rxfifo[us_rxfifo_low++];
+            data[bytes_rcv++] = us_rxfifo[us_rxfifo_low++];
             if (us_rxfifo_low == sizeof(us_rxfifo))
                 us_rxfifo_low = 0;
         }
@@ -157,7 +157,7 @@ uint32_t usart_read_ng(uint8_t *data, size_t len) {
     }
 //    highest_observed_try = MAX(highest_observed_try, try);
 //    Dbprintf_usb("Dbg USART max observed try %i", highest_observed_try);
-    return nbBytesRcv;
+    return bytes_rcv;
 }
 
 // transfer from device to client

From f5aa78e668913218a98131577bd2f658ca9efc76 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 24 Feb 2021 00:02:59 +0100
Subject: [PATCH 655/682] cppchecker shadow

---
 client/src/mifare/desfire_crypto.c | 11 +++++------
 client/src/mifare/desfire_crypto.h |  2 +-
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/client/src/mifare/desfire_crypto.c b/client/src/mifare/desfire_crypto.c
index 3e87236ea..d8fb62aaa 100644
--- a/client/src/mifare/desfire_crypto.c
+++ b/client/src/mifare/desfire_crypto.c
@@ -241,7 +241,6 @@ void Desfire_session_key_new(const uint8_t rnda[], const uint8_t rndb[], desfire
     }
 }
 
-static void xor(const uint8_t *ivect, uint8_t *data, const size_t len);
 static size_t key_macing_length(desfirekey_t key);
 
 // iceman,  see memxor inside string.c, dest/src swapped..
@@ -263,20 +262,20 @@ void cmac_generate_subkeys(desfirekey_t key, MifareCryptoDirection direction) {
 
     mifare_cypher_blocks_chained(NULL, key, ivect, l, kbs, direction, MCO_ENCYPHER);
 
-    bool xor = false;
+    bool txor = false;
 
     // Used to compute CMAC on complete blocks
     memcpy(key->cmac_sk1, l, kbs);
-    xor = l[0] & 0x80;
+    txor = l[0] & 0x80;
     lsl(key->cmac_sk1, kbs);
-    if (xor)
+    if (txor)
         key->cmac_sk1[kbs - 1] ^= R;
 
     // Used to compute CMAC on the last block if non-complete
     memcpy(key->cmac_sk2, key->cmac_sk1, kbs);
-    xor = key->cmac_sk1[0] & 0x80;
+    txor = key->cmac_sk1[0] & 0x80;
     lsl(key->cmac_sk2, kbs);
-    if (xor)
+    if (txor)
         key->cmac_sk2[kbs - 1] ^= R;
 }
 
diff --git a/client/src/mifare/desfire_crypto.h b/client/src/mifare/desfire_crypto.h
index e7219eaf0..ecc6fc4a5 100644
--- a/client/src/mifare/desfire_crypto.h
+++ b/client/src/mifare/desfire_crypto.h
@@ -130,7 +130,7 @@ size_t enciphered_data_length(const desfiretag_t tag, const size_t nbytes, int c
 void cmac_generate_subkeys(desfirekey_t key, MifareCryptoDirection direction);
 void cmac(const desfirekey_t  key, uint8_t *ivect, const uint8_t *data, size_t len, uint8_t *cmac);
 
-void mifare_kdf_an10922(const desfirekey_t key, const uint8_t *data, size_t dataLen);
+void mifare_kdf_an10922(const desfirekey_t key, const uint8_t *data, size_t len);
 
 void desfire_crc32(const uint8_t *data, const size_t len, uint8_t *crc);
 void desfire_crc32_append(uint8_t *data, const size_t len);

From 3cd282ce873383ecd29b00f96cfce2ba81c04de6 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 24 Feb 2021 00:10:13 +0100
Subject: [PATCH 656/682] cppchecker

---
 client/src/cmdlf.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c
index 5696cdfad..2096c6eb0 100644
--- a/client/src/cmdlf.c
+++ b/client/src/cmdlf.c
@@ -500,7 +500,7 @@ int CmdLFConfig(const char *Cmd) {
     int8_t avg = arg_get_int_def(ctx, 3, 0);
     int8_t bps = arg_get_int_def(ctx, 4, -1);
     int8_t dec = arg_get_int_def(ctx, 5, -1);
-    int16_t div = arg_get_int_def(ctx, 6, -1);
+    int16_t divisor = arg_get_int_def(ctx, 6, -1);
     int16_t freq = arg_get_int_def(ctx, 7, -1);
     bool reset = arg_get_lit(ctx, 8);
     int32_t skip = arg_get_int_def(ctx, 9, -1);
@@ -562,8 +562,8 @@ int CmdLFConfig(const char *Cmd) {
             config.decimation = 8;
     }
 
-    if (div > -1) {
-        config.divisor = div;
+    if (divisor> -1) {
+        config.divisor = divisor;
         if (config.divisor < 19) {
             PrintAndLogEx(ERR, "divisor must be between 19 and 255");
             return PM3_EINVARG;
@@ -1001,9 +1001,8 @@ int CmdLFaskSim(const char *Cmd) {
         // will need carrier, clock, and bitstream
         PrintAndLogEx(INFO, "No user supplied data, using Demodbuffer...");
 
-        int res = 0;
         if (clk == 0) {
-            res = GetAskClock("0", verbose);
+            int res = GetAskClock("0", verbose);
             if (res < 1) {
                 clk = 64;
             } else {
@@ -1117,7 +1116,7 @@ int CmdLFpskSim(const char *Cmd) {
         // will need carrier, clock, and bitstream
         PrintAndLogEx(INFO, "No user supplied data, using Demodbuffer...");
 
-        int res = 0;
+        int res;
         if (clk == 0) {
             res = GetPskClock("", verbose);
             if (res < 1) {
@@ -1152,7 +1151,6 @@ int CmdLFpskSim(const char *Cmd) {
         psk2TOpsk1(DemodBuffer, DemodBufferLen);
     } else if (psk_type == 3) {
         PrintAndLogEx(INFO, "PSK3 not yet available. Falling back to PSK1");
-        psk_type = 1;
     }
 
     size_t size = DemodBufferLen;

From b6965425bc072a1e8862ebe3b2df507867472c25 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 24 Feb 2021 00:17:30 +0100
Subject: [PATCH 657/682] textual, cppchecker

---
 client/src/cmdhfmf.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index 7b877658b..b4572f979 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -967,6 +967,7 @@ static int CmdHF14AMfDump(const char *Cmd) {
     fclose(f);
 
     PrintAndLogEx(INFO, "Reading sector access bits...");
+    PrintAndLogEx(INFO, "." NOLF);
 
     uint8_t tries;
     mf_readblock_t payload;
@@ -2297,6 +2298,7 @@ static int CmdHF14AMfAutoPWN(const char *Cmd) {
     if (verbose) PrintAndLogEx(INFO, "======================= " _YELLOW_("START DICTIONARY ATTACK") " =======================");
 
     if (legacy_mfchk) {
+        PrintAndLogEx(INFO, "." NOLF);
         // Check all the sectors
         for (int i = 0; i < sectors_cnt; i++) {
             for (int j = 0; j < 2; j++) {
@@ -3266,8 +3268,8 @@ static int CmdHF14AMfChk(const char *Cmd) {
     uint8_t trgKeyType = 0;
     uint16_t max_keys = keycnt > KEYS_IN_BLOCK ? KEYS_IN_BLOCK : keycnt;
 
-    // time
-    uint64_t t1 = msclock();
+    PrintAndLogEx(INFO, "Start check for keys...");
+    PrintAndLogEx(INFO, "." NOLF);
 
     // fast push mode
     conn.block_after_ACK = true;
@@ -3275,6 +3277,9 @@ static int CmdHF14AMfChk(const char *Cmd) {
     // clear trace log by first check keys call only
     bool clearLog = true;
 
+    // time
+    uint64_t t1 = msclock();
+
     // check keys.
     for (trgKeyType = (keyType == 2) ? 0 : keyType; trgKeyType < 2; (keyType == 2) ? (++trgKeyType) : (trgKeyType = 2)) {
 
@@ -3896,12 +3901,11 @@ int CmdHF14AMfELoad(const char *Cmd) {
         printMFUdumpEx(mfu_dump, mfu_dump->pages + 1, 0);
 
         // update expected blocks to match converted data.
-        if (numBlocks != datalen / 4) {
-            numBlocks = datalen / 4;
-        }
+        numBlocks = datalen / 4;
     }
 
     PrintAndLogEx(INFO, "Uploading to emulator memory");
+    PrintAndLogEx(INFO, "." NOLF);
 
     // fast push mode
     conn.block_after_ACK = true;
@@ -4326,6 +4330,10 @@ static int CmdHF14AMfCLoad(const char *Cmd) {
 
 
     if (fillFromEmulator) {
+
+        PrintAndLogEx(INFO, "Start upload to emulator memory");
+        PrintAndLogEx(INFO, "." NOLF);
+
         for (int blockNum = 0; blockNum < 16 * 4; blockNum += 1) {
             int flags = 0;
             uint8_t buf8[16] = {0x00};
@@ -4381,6 +4389,7 @@ static int CmdHF14AMfCLoad(const char *Cmd) {
     }
 
     PrintAndLogEx(INFO, "Copying to magic card");
+    PrintAndLogEx(INFO, "." NOLF);
 
     int blockNum = 0;
     int flags = 0;
@@ -4594,6 +4603,7 @@ static int CmdHF14AMfCSave(const char *Cmd) {
 
     if (fillEmulator) {
         PrintAndLogEx(INFO, "uploading to emulator memory");
+        PrintAndLogEx(INFO, "." NOLF);
         // fast push mode
         conn.block_after_ACK = true;
         for (i = 0; i < numblocks; i += 5) {
@@ -4650,6 +4660,7 @@ static int CmdHF14AMfCView(const char *Cmd) {
     if (errors) return usage_hf14_cview();
 
     PrintAndLogEx(SUCCESS, "View magic MIFARE " _GREEN_("%cK"), ctmp);
+    PrintAndLogEx(INFO, "." NOLF);
 
     uint8_t *dump = calloc(bytes, sizeof(uint8_t));
     if (!dump) {

From 9395f8c8ac1a6949a7f241c9a04a23a3264868b1 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 24 Feb 2021 00:29:50 +0100
Subject: [PATCH 658/682] cppchecker

---
 armsrc/em4x70.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/armsrc/em4x70.c b/armsrc/em4x70.c
index bc9d467cc..0ea6392d1 100644
--- a/armsrc/em4x70.c
+++ b/armsrc/em4x70.c
@@ -200,7 +200,7 @@ static uint32_t get_pulse_length(edge_detection_t edge) {
 
 static bool check_pulse_length(uint32_t pl, uint32_t length) {
     // check if pulse length <pl> corresponds to given length <length>
-    return ((pl >= (length - EM4X70_T_TAG_TOLERANCE)) & (pl <= (length + EM4X70_T_TAG_TOLERANCE)));
+    return ((pl >= (length - EM4X70_T_TAG_TOLERANCE)) && (pl <= (length + EM4X70_T_TAG_TOLERANCE)));
 }
 
 static void em4x70_send_bit(bool bit) {

From bb6ea597b4ba00dffa99c67e613db6525fc4f6e0 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 24 Feb 2021 14:17:23 +0100
Subject: [PATCH 659/682] cppchecker shadow

---
 armsrc/desfire_crypto.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/armsrc/desfire_crypto.c b/armsrc/desfire_crypto.c
index cafa98de1..d414835c0 100644
--- a/armsrc/desfire_crypto.c
+++ b/armsrc/desfire_crypto.c
@@ -242,7 +242,6 @@ void Desfire_session_key_new(const uint8_t rnda[], const uint8_t rndb[], desfire
     }
 }
 
-static void xor(const uint8_t *ivect, uint8_t *data, const size_t len);
 static size_t key_macing_length(desfirekey_t key);
 
 // iceman,  see memxor inside string.c, dest/src swapped..
@@ -264,20 +263,20 @@ void cmac_generate_subkeys(desfirekey_t key) {
 
     mifare_cypher_blocks_chained(NULL, key, ivect, l, kbs, MCD_RECEIVE, MCO_ENCYPHER);
 
-    bool xor = false;
+    bool txor = false;
 
     // Used to compute CMAC on complete blocks
     memcpy(key->cmac_sk1, l, kbs);
-    xor = l[0] & 0x80;
+    txor = l[0] & 0x80;
     lsl(key->cmac_sk1, kbs);
-    if (xor)
+    if (txor)
         key->cmac_sk1[kbs - 1] ^= R;
 
     // Used to compute CMAC on the last block if non-complete
     memcpy(key->cmac_sk2, key->cmac_sk1, kbs);
-    xor = key->cmac_sk1[0] & 0x80;
+    txor = key->cmac_sk1[0] & 0x80;
     lsl(key->cmac_sk2, kbs);
-    if (xor)
+    if (txor)
         key->cmac_sk2[kbs - 1] ^= R;
 }
 

From 2184b0dde814c5661abcda28be9bcea097b11efa Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 24 Feb 2021 14:26:21 +0100
Subject: [PATCH 660/682] cppchecker

---
 armsrc/em4x50.c | 41 +++++++++++++++++++----------------------
 1 file changed, 19 insertions(+), 22 deletions(-)

diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c
index a46d14221..eae16059f 100644
--- a/armsrc/em4x50.c
+++ b/armsrc/em4x50.c
@@ -182,7 +182,6 @@ static bool get_signalproperties(void) {
     uint8_t sample_max_mean = 0;
     uint8_t sample_max[no_periods];
     uint32_t sample_max_sum = 0;
-    uint32_t tval = 0;
     memset(sample_max, 0x00, sizeof(sample_max));
 
     // wait until signal/noise > 1 (max. 32 periods)
@@ -208,7 +207,7 @@ static bool get_signalproperties(void) {
     // 3 single "full periods" to eliminate the influence of a listen window
     for (int i = 0; i < no_periods; i++) {
 
-        tval = GetTicks();
+        uint32_t tval = GetTicks();
         while (GetTicks() - tval < 12 * 3 * EM4X50_T_TAG_FULL_PERIOD) {
 
             if (BUTTON_PRESS()) return false;
@@ -331,10 +330,10 @@ static void em4x50_reader_send_byte(uint8_t byte) {
 
 // send byte followed by its (even) parity bit
 static void em4x50_reader_send_byte_with_parity(uint8_t byte) {
-    int parity = 0, bit = 0;
+    int parity = 0;
 
     for (int i = 0; i < 8; i++) {
-        bit = (byte >> (7 - i)) & 1;
+        int bit = (byte >> (7 - i)) & 1;
         em4x50_reader_send_bit(bit);
         parity ^= bit;
     }
@@ -849,7 +848,6 @@ static int selective_read(uint32_t addresses, uint32_t *words) {
 
 // reads by using "selective read mode" -> bidirectional communication
 void em4x50_read(em4x50_data_t *etd) {
-    bool blogin = true;
     int status = PM3_EFAILED;
     uint32_t words[EM4X50_NO_WORDS] = {0x0};
 
@@ -862,6 +860,8 @@ void em4x50_read(em4x50_data_t *etd) {
         LED_C_OFF();
         LED_D_ON();
 
+        bool blogin = true;
+
         // try to login with given password
         if (etd->pwd_given)
             blogin = (login(etd->password1) == PM3_SUCCESS);
@@ -879,10 +879,7 @@ void em4x50_read(em4x50_data_t *etd) {
 
 // collects as much information as possible via selective read mode
 void em4x50_info(em4x50_data_t *etd) {
-
-    bool blogin = true;
     int status = PM3_EFAILED;
-    uint32_t addresses = 0x00002100; // read from fwr = 0 to lwr = 33 (0x21)
     uint32_t words[EM4X50_NO_WORDS] = {0x0};
 
     em4x50_setup_read();
@@ -892,12 +889,15 @@ void em4x50_info(em4x50_data_t *etd) {
         LED_C_OFF();
         LED_D_ON();
 
+        bool blogin = true;
         // login with given password
         if (etd->pwd_given)
             blogin = (login(etd->password1) == PM3_SUCCESS);
 
-        if (blogin)
-            status = selective_read(addresses, words);
+        if (blogin) {
+            // read addresses from fwr = 0 to lwr = 33 (0x21)
+            status = selective_read(0x00002100, words);
+        }
     }
 
     LEDsoff();
@@ -1117,7 +1117,7 @@ static void em4x50_sim_send_bit(uint8_t bit) {
         // used as a simple detection of a reader field?
         while ((timeout--) && !(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
 
-        if (timeout <= 0) {
+        if (timeout == 0) {
             return;
         }
         timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
@@ -1129,7 +1129,7 @@ static void em4x50_sim_send_bit(uint8_t bit) {
 
         //wait until SSC_CLK goes LOW
         while ((timeout--) && (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK));
-        if (timeout <= 0) {
+        if (timeout == 0) {
             return;
         }
         timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
@@ -1214,7 +1214,6 @@ static int em4x50_sim_read_bit(void) {
 
     int cycles = 0;
     int timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
-    uint32_t tval = 0;
 
     while (cycles < EM4X50_T_TAG_FULL_PERIOD) {
 
@@ -1226,7 +1225,7 @@ static int em4x50_sim_read_bit(void) {
         timeout = EM4X50_T_SIMULATION_TIMEOUT_READ;
 
         // now check until reader switches on carrier field
-        tval = GetTicks();
+        uint32_t tval = GetTicks();
         while ((timeout--) && (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
 
             if (timeout <= 0) {
@@ -1436,23 +1435,21 @@ static int em4x50_sim_handle_standard_read_command(uint32_t *tag) {
     // last word read protected
     int lwrp = (reflect32(tag[EM4X50_PROTECTION]) >> 8) & 0xFF;
 
-    int command = PM3_SUCCESS;
-
     while ((BUTTON_PRESS() == false) && (data_available() == false)) {
 
         WDT_HIT();
 
-        command = em4x50_sim_send_listen_window(tag);
+        int res = em4x50_sim_send_listen_window(tag);
 
-        if (command != PM3_SUCCESS) {
-            return command;
+        if (res != PM3_SUCCESS) {
+            return res;
         }
 
         for (int i = fwr; i <= lwr; i++) {
 
-            command = em4x50_sim_send_listen_window(tag);
-            if (command != PM3_SUCCESS) {
-                return command;
+            res = em4x50_sim_send_listen_window(tag);
+            if (res != PM3_SUCCESS) {
+                return res;
             }
 
             if ((gLogin == false) && (i >= fwrp) && (i <= lwrp)) {

From a769752aafffd3cb0073fc2c559e68d8a8ccc88b Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 24 Feb 2021 17:41:12 +0100
Subject: [PATCH 661/682] cppchecker invalid-printf

---
 client/deps/hardnested/hardnested_tables.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/client/deps/hardnested/hardnested_tables.c b/client/deps/hardnested/hardnested_tables.c
index d3c620fe5..f0155946f 100644
--- a/client/deps/hardnested/hardnested_tables.c
+++ b/client/deps/hardnested/hardnested_tables.c
@@ -372,10 +372,11 @@ static void precalculate_bit0_bitflip_bitarrays(uint8_t const bitflip, uint16_t
     for (odd_even_t odd_even = EVEN_STATE; odd_even <= ODD_STATE; odd_even++) {
         count[odd_even] = count_states(test_bitarray[odd_even]);
         if (count[odd_even] != 1 << 24) {
-            printf("Writing %u possible %s states for bitflip property %03x (%d (%1.2f%%) states eliminated)\n",
+            printf("Writing %u possible %s states for bitflip property %03x (%u (%1.2f%%) states eliminated)\n",
                    count[odd_even],
                    odd_even == EVEN_STATE ? "even" : "odd",
-                   bitflip, (1 << 24) - count[odd_even],
+                   bitflip,
+                    (1 << 24) - count[odd_even],
                    (float)((1 << 24) - count[odd_even]) / (1 << 24) * 100.0);
 #ifndef TEST_RUN
             write_bitflips_file(odd_even, bitflip, sum_a0, test_bitarray[odd_even], count[odd_even]);
@@ -399,10 +400,11 @@ static void precalculate_bit0_bitflip_bitarrays(uint8_t const bitflip, uint16_t
             }
             count[odd_even] = count_states(test_bitarray_2nd);
             if (count[odd_even] != 1 << 24) {
-                printf("Writing %u possible %s states for bitflip property %03x (%d (%1.2f%%) states eliminated)\n",
+                printf("Writing %u possible %s states for bitflip property %03x (%u (%1.2f%%) states eliminated)\n",
                        count[odd_even],
                        odd_even == EVEN_STATE ? "even" : "odd",
-                       bitflip | BITFLIP_2ND_BYTE, (1 << 24) - count[odd_even],
+                       bitflip | BITFLIP_2ND_BYTE,
+                        (1 << 24) - count[odd_even],
                        (float)((1 << 24) - count[odd_even]) / (1 << 24) * 100.0);
 #ifndef TEST_RUN
                 write_bitflips_file(odd_even, bitflip | BITFLIP_2ND_BYTE, sum_a0, test_bitarray_2nd, count[odd_even]);
@@ -484,10 +486,11 @@ static void precalculate_bit0_bitflip_bitarrays(uint8_t const bitflip, uint16_t
     for (odd_even_t odd_even = EVEN_STATE; odd_even <= ODD_STATE; odd_even++) {
         count[odd_even] = count_states(test_not_bitarray[odd_even]);
         if (count[odd_even] != 1 << 24) {
-            printf("Writing %u possible %s states for bitflip property %03x (%d (%1.2f%%) states eliminated)\n",
+            printf("Writing %u possible %s states for bitflip property %03x (%u (%1.2f%%) states eliminated)\n",
                    count[odd_even],
                    odd_even == EVEN_STATE ? "even" : "odd",
-                   bitflip | 0x100, (1 << 24) - count[odd_even],
+                   bitflip | 0x100,
+                    (1 << 24) - count[odd_even],
                    (float)((1 << 24) - count[odd_even]) / (1 << 24) * 100.0);
 #ifndef TEST_RUN
             write_bitflips_file(odd_even, bitflip | 0x100, sum_a0, test_not_bitarray[odd_even], count[odd_even]);
@@ -511,10 +514,11 @@ static void precalculate_bit0_bitflip_bitarrays(uint8_t const bitflip, uint16_t
             }
             count[odd_even] = count_states(test_bitarray_2nd);
             if (count[odd_even] != 1 << 24) {
-                printf("Writing %u possible %s states for bitflip property %03x (%d (%1.2f%%) states eliminated)\n",
+                printf("Writing %u possible %s states for bitflip property %03x (%u (%1.2f%%) states eliminated)\n",
                        count[odd_even],
                        odd_even == EVEN_STATE ? "even" : "odd",
-                       bitflip | 0x100 | BITFLIP_2ND_BYTE, (1 << 24) - count[odd_even],
+                       bitflip | 0x100 | BITFLIP_2ND_BYTE, 
+                       (1 << 24) - count[odd_even],
                        (float)((1 << 24) - count[odd_even]) / (1 << 24) * 100.0);
 #ifndef TEST_RUN
                 write_bitflips_file(odd_even, bitflip | 0x100 | BITFLIP_2ND_BYTE, sum_a0, test_bitarray_2nd, count[odd_even]);
@@ -532,7 +536,6 @@ static void precalculate_bit0_bitflip_bitarrays(uint8_t const bitflip, uint16_t
     free_bitarray(test_not_bitarray[EVEN_STATE]);
     free_bitarray(test_bitarray[ODD_STATE]);
     free_bitarray(test_bitarray[EVEN_STATE]);
-
     exit(0);
 }
 

From 3fd8a640c1f45f3bd4a676222015a39c5e331e3f Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 24 Feb 2021 18:00:38 +0100
Subject: [PATCH 662/682] cppchecker - integeroverflow

---
 client/src/cmdhf14b.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhf14b.c b/client/src/cmdhf14b.c
index ee73e62b5..ac3b1e982 100644
--- a/client/src/cmdhf14b.c
+++ b/client/src/cmdhf14b.c
@@ -26,7 +26,7 @@
 #include "mifare/ndef.h"   // NDEFRecordsDecodeAndPrint
 #include "aidsearch.h"
 
-#define MAX_14B_TIMEOUT    (uint32_t)40542464 // = (2^32-1) * (8*16) / 13560000Hz * 1000ms/s
+#define MAX_14B_TIMEOUT    40542464U // = (2^32-1) * (8*16) / 13560000Hz * 1000ms/s
 #define TIMEOUT 2000
 #define APDU_TIMEOUT 2000
 
@@ -343,17 +343,20 @@ static int CmdHF14BCmdRaw(const char *Cmd) {
     }
     CLIParserFree(ctx);
 
+
     uint32_t time_wait = 0;
     if (user_timeout > 0) {
 
         flags |= ISO14B_SET_TIMEOUT;
-        if (user_timeout > MAX_14B_TIMEOUT) {
-            user_timeout = MAX_14B_TIMEOUT;
+
+        uint32_t max_timeout = user_timeout;
+        if (max_timeout > MAX_14B_TIMEOUT) {
+            max_timeout = MAX_14B_TIMEOUT;
             PrintAndLogEx(INFO, "set timeout to 40542 seconds (11.26 hours). The max we can wait for response");
         }
-        time_wait = (uint32_t)((13560000 / 1000 / (8 * 16)) * user_timeout); // timeout in ETUs (time to transfer 1 bit, approx. 9.4 us)
+        time_wait = ((13560000 / 1000 / (8 * 16)) * max_timeout); // timeout in ETUs (time to transfer 1 bit, approx. 9.4 us)
         if (verbose)
-            PrintAndLogEx(INFO, "using timeout %u", user_timeout);
+            PrintAndLogEx(INFO, "using timeout %u", max_timeout);
     }
 
     if (keep_field_on == 0)

From 1fbb838d3aa4bda965ebc4da0e08d17b61ba7bd7 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 24 Feb 2021 20:46:06 +0100
Subject: [PATCH 663/682] cppchecker

---
 armsrc/Standalone/hf_aveful.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/armsrc/Standalone/hf_aveful.c b/armsrc/Standalone/hf_aveful.c
index 475aadfec..dc481fc47 100644
--- a/armsrc/Standalone/hf_aveful.c
+++ b/armsrc/Standalone/hf_aveful.c
@@ -68,11 +68,11 @@ uint16_t get_ev1_version(iso14a_card_select_t card, uint8_t *version) {
     return mifare_sendcmd(MIFARE_ULEV1_VERSION, NULL, 0, version, NULL, NULL);
 }
 
-uint16_t get_ev1_signature(iso14a_card_select_t card, uint8_t *response) {
+uint16_t get_ev1_signature(iso14a_card_select_t card, uint8_t *signature) {
     uint8_t cmd[4] = {MIFARE_ULEV1_READSIG, 0x00, 0x00, 0x00};
     AddCrc14A(cmd, 2);
     ReaderTransmit(cmd, sizeof(cmd), NULL);
-    return ReaderReceive(response, NULL);
+    return ReaderReceive(signature, NULL);
 }
 
 uint16_t get_ev1_counter(iso14a_card_select_t card, uint8_t counter, uint8_t *response) {
@@ -114,7 +114,6 @@ int get_block_count(iso14a_card_select_t card, uint8_t version[], uint16_t versi
             else if (memcmp(version, "\x00\x04\x03\x01\x01\x00\x0E", 7) == 0) { block_count = MAX_ULEV1b_BLOCKS; }
             else if (memcmp(version, "\x00\x04\x03\x02\x01\x00\x0E", 7) == 0) { block_count = MAX_ULEV1b_BLOCKS; }
             else if (memcmp(version, "\x00\x34\x21\x01\x01\x00\x0E", 7) == 0) { block_count = MAX_ULEV1b_BLOCKS; } // Mikron JSC Russia EV1 41 pages tag
-            else if (memcmp(version, "\x00\x34\x21\x01\x01\x00\x0E", 7) == 0) { block_count = MAX_UL_BLOCKS; }
             else if (version[2] == 0x03) { block_count = MAX_ULEV1a_BLOCKS; }
         }
     }

From eb4becfdb481e329c09a9e5016ffe616420e6ec2 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 24 Feb 2021 21:14:30 +0100
Subject: [PATCH 664/682] fix appveyor for python3 dependencies

---
 appveyor.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/appveyor.yml b/appveyor.yml
index 44e6b6040..4d9edffde 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -66,6 +66,10 @@ clone_script:
         WSLExec "WSL cleanup..." "sudo apt-get auto-remove -y 1>/dev/null" 
         WSLExec "WSL install..." "sudo apt-get -y install --reinstall --no-install-recommends git ca-certificates build-essential pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev libbz2-dev qtbase5-dev cmake 1>/dev/null" 
         WSLExec "WSL QT fix..." "sudo strip --remove-section=.note.ABI-tag /usr/lib/x86_64-linux-gnu/libQt5Core.so.5"
+        WSLExec "WSL install python dependencies..." "python3 -m pip install --upgrade pip 1>/dev/null"
+        WSLExec "WSL install pip..." "python3 -m pip install setuptools 1>/dev/null"
+        WSLExec "WSL install pip continue..." "python3 -m pip install ansicolors sslcrypto 1>/dev/null"
+
         Add-AppveyorMessage -Message "WSL setup took $(([System.Environment]::TickCount-$WSLInstallTime) / 1000) sec" -Category Information
         New-Item -ItemType "file" -Path "C:\WSL-Finished.txt" -Force | Out-Null
     }

From 6d27b2172a21538e12a938b90a58f076a1772f9c Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 24 Feb 2021 21:39:51 +0100
Subject: [PATCH 665/682] fix appveyor for python3

---
 appveyor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/appveyor.yml b/appveyor.yml
index 4d9edffde..e455e6f8c 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -64,7 +64,7 @@ clone_script:
         WSLExec "WSL update..." "sudo apt-get update 1>/dev/null"
         WSLExec "WSL upgrade..." "sudo apt-get upgrade -y 1>/dev/null" 
         WSLExec "WSL cleanup..." "sudo apt-get auto-remove -y 1>/dev/null" 
-        WSLExec "WSL install..." "sudo apt-get -y install --reinstall --no-install-recommends git ca-certificates build-essential pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev libbz2-dev qtbase5-dev cmake 1>/dev/null" 
+        WSLExec "WSL install..." "sudo apt-get -y install --reinstall --no-install-recommends git ca-certificates build-essential pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev libbz2-dev qtbase5-dev cmake libpython3-dev python3 python3-dev libpython3-all-dev 1>/dev/null" 
         WSLExec "WSL QT fix..." "sudo strip --remove-section=.note.ABI-tag /usr/lib/x86_64-linux-gnu/libQt5Core.so.5"
         WSLExec "WSL install python dependencies..." "python3 -m pip install --upgrade pip 1>/dev/null"
         WSLExec "WSL install pip..." "python3 -m pip install setuptools 1>/dev/null"

From aebcd1623fb1c3844d4bd9b5d2ba8ad83ed92f0d Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 24 Feb 2021 22:11:35 +0100
Subject: [PATCH 666/682] fix appveyor sudo needed?

---
 appveyor.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/appveyor.yml b/appveyor.yml
index e455e6f8c..46a6cf57e 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -66,9 +66,9 @@ clone_script:
         WSLExec "WSL cleanup..." "sudo apt-get auto-remove -y 1>/dev/null" 
         WSLExec "WSL install..." "sudo apt-get -y install --reinstall --no-install-recommends git ca-certificates build-essential pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev libbz2-dev qtbase5-dev cmake libpython3-dev python3 python3-dev libpython3-all-dev 1>/dev/null" 
         WSLExec "WSL QT fix..." "sudo strip --remove-section=.note.ABI-tag /usr/lib/x86_64-linux-gnu/libQt5Core.so.5"
-        WSLExec "WSL install python dependencies..." "python3 -m pip install --upgrade pip 1>/dev/null"
-        WSLExec "WSL install pip..." "python3 -m pip install setuptools 1>/dev/null"
-        WSLExec "WSL install pip continue..." "python3 -m pip install ansicolors sslcrypto 1>/dev/null"
+        WSLExec "WSL install python dependencies..." "sudo python3 -m pip install --upgrade pip 1>/dev/null"
+        WSLExec "WSL install pip..." "sudo python3 -m pip install setuptools 1>/dev/null"
+        WSLExec "WSL install pip continue..." "sudo python3 -m pip install ansicolors sslcrypto 1>/dev/null"
 
         Add-AppveyorMessage -Message "WSL setup took $(([System.Environment]::TickCount-$WSLInstallTime) / 1000) sec" -Category Information
         New-Item -ItemType "file" -Path "C:\WSL-Finished.txt" -Force | Out-Null

From 8e6e7e9bc294b631b1a13f002f36c75cfe0bd6f4 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 24 Feb 2021 22:53:38 +0100
Subject: [PATCH 667/682] ...ps also needs pip part1

---
 appveyor.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/appveyor.yml b/appveyor.yml
index 46a6cf57e..64f3798a5 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -283,6 +283,9 @@ build_script:
     cd $env:proxspace_path
     
     ./runme64.bat -c "yes | pacman -Sc > /dev/null 2>&1"
+
+    ./runme64.bat -c "yes | pacman -S mingw-w64-x86_64-python-pip > /dev/null 2>&1"
+    ./runme64.bat -c "yes | pacman -S mingw-w64-x86_64-python-setuptools > /dev/null 2>&1"
     
     Remove-Item -Recurse -Force -Path "$env:proxspace_cache_path" -ErrorAction SilentlyContinue
     

From f62ea543a162c820410e4bd9f33b59c18cbd6b0b Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 24 Feb 2021 23:10:24 +0100
Subject: [PATCH 668/682] ...ps pip installing part2

---
 appveyor.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/appveyor.yml b/appveyor.yml
index 64f3798a5..3b4abfa80 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -285,8 +285,11 @@ build_script:
     ./runme64.bat -c "yes | pacman -Sc > /dev/null 2>&1"
 
     ./runme64.bat -c "yes | pacman -S mingw-w64-x86_64-python-pip > /dev/null 2>&1"
+
     ./runme64.bat -c "yes | pacman -S mingw-w64-x86_64-python-setuptools > /dev/null 2>&1"
     
+    ./runme64.bat -c "yes | python3 -m pip ansicolors sslcrypto > /dev/null 2>&1"
+
     Remove-Item -Recurse -Force -Path "$env:proxspace_cache_path" -ErrorAction SilentlyContinue
     
     Move-Item -Path "$env:proxspace_path\msys2\var\cache" -Destination "$env:proxspace_cache_path" -Force

From 7fcda9cbfc0a6573ffd7b5c3703ad53d3e385a09 Mon Sep 17 00:00:00 2001
From: Gator96100 <jupuerzi@gmx.at>
Date: Thu, 25 Feb 2021 00:42:56 +0100
Subject: [PATCH 669/682] Appveyor WSL fix

---
 appveyor.yml | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/appveyor.yml b/appveyor.yml
index 3b4abfa80..899202bf1 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -64,7 +64,7 @@ clone_script:
         WSLExec "WSL update..." "sudo apt-get update 1>/dev/null"
         WSLExec "WSL upgrade..." "sudo apt-get upgrade -y 1>/dev/null" 
         WSLExec "WSL cleanup..." "sudo apt-get auto-remove -y 1>/dev/null" 
-        WSLExec "WSL install..." "sudo apt-get -y install --reinstall --no-install-recommends git ca-certificates build-essential pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev libbz2-dev qtbase5-dev cmake libpython3-dev python3 python3-dev libpython3-all-dev 1>/dev/null" 
+        WSLExec "WSL install..." "sudo apt-get -y install --reinstall --no-install-recommends git ca-certificates build-essential pkg-config libreadline-dev gcc-arm-none-eabi libnewlib-dev libbz2-dev qtbase5-dev cmake libpython3-dev python3 python3-pip python3-dev libpython3-all-dev 1>/dev/null" 
         WSLExec "WSL QT fix..." "sudo strip --remove-section=.note.ABI-tag /usr/lib/x86_64-linux-gnu/libQt5Core.so.5"
         WSLExec "WSL install python dependencies..." "sudo python3 -m pip install --upgrade pip 1>/dev/null"
         WSLExec "WSL install pip..." "sudo python3 -m pip install setuptools 1>/dev/null"
@@ -284,12 +284,6 @@ build_script:
     
     ./runme64.bat -c "yes | pacman -Sc > /dev/null 2>&1"
 
-    ./runme64.bat -c "yes | pacman -S mingw-w64-x86_64-python-pip > /dev/null 2>&1"
-
-    ./runme64.bat -c "yes | pacman -S mingw-w64-x86_64-python-setuptools > /dev/null 2>&1"
-    
-    ./runme64.bat -c "yes | python3 -m pip ansicolors sslcrypto > /dev/null 2>&1"
-
     Remove-Item -Recurse -Force -Path "$env:proxspace_cache_path" -ErrorAction SilentlyContinue
     
     Move-Item -Path "$env:proxspace_path\msys2\var\cache" -Destination "$env:proxspace_cache_path" -Force

From 23f831d6a92d3e8aef79a933a8664b34660731a1 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Thu, 25 Feb 2021 20:21:10 +0300
Subject: [PATCH 670/682] emrtd: fix segfaults when debug print is enabled

---
 client/src/cmdhfemrtd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhfemrtd.c b/client/src/cmdhfemrtd.c
index 4b4a895eb..feb8806e7 100644
--- a/client/src/cmdhfemrtd.c
+++ b/client/src/cmdhfemrtd.c
@@ -1798,7 +1798,7 @@ static int emrtd_print_ef_cardaccess_info(uint8_t *data, size_t datalen) {
     }
 
     for (int pacei = 0; pacealg_table[pacei].name != NULL; pacei++) {
-        PrintAndLogEx(DEBUG, "Trying: %s", hashalg_table[pacei].name);
+        PrintAndLogEx(DEBUG, "Trying: %s", pacealg_table[pacei].name);
 
         if (memcmp(pacealg_table[pacei].descriptor, datafromtag, datafromtaglen) == 0) {
             PrintAndLogEx(SUCCESS, "PACE algorithm........: " _YELLOW_("%s"), pacealg_table[pacei].name);
@@ -1814,7 +1814,7 @@ static int emrtd_print_ef_cardaccess_info(uint8_t *data, size_t datalen) {
     // TODO: hack!!!
     memcpy(&parsednum, datafromtag, datafromtaglen);
     for (int pacepari = 0; pacesdp_table[pacepari].id != 32; pacepari++) {
-        PrintAndLogEx(DEBUG, "Trying: %s", hashalg_table[pacepari].name);
+        PrintAndLogEx(DEBUG, "Trying: %s", pacesdp_table[pacepari].name);
 
         if (pacesdp_table[pacepari].id == parsednum) {
             PrintAndLogEx(SUCCESS, "PACE parameter........: " _YELLOW_("%s"), pacesdp_table[pacepari].name);

From a85b011e7e959148245b8804539ce4119f452e3c Mon Sep 17 00:00:00 2001
From: Gator96100 <jupuerzi@gmx.at>
Date: Sat, 27 Feb 2021 03:43:24 +0100
Subject: [PATCH 671/682] Github actions for Windows

---
 .github/workflows/windows.yml | 152 ++++++++++++++++++++++++++++++++++
 1 file changed, 152 insertions(+)
 create mode 100644 .github/workflows/windows.yml

diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
new file mode 100644
index 000000000..78ee6c3cf
--- /dev/null
+++ b/.github/workflows/windows.yml
@@ -0,0 +1,152 @@
+name: Windows Build and Test
+
+on: [push, pull_request]
+
+jobs:
+  proxspace:
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: pwsh
+    env:
+      PATH: C:/ProxSpace/msys2/mingw64/bin;C:/ProxSpace/msys2/usr/local/bin;C:/ProxSpace/msys2/usr/bin;C:/ProxSpace/msys2/bin
+      MSYSTEM: MINGW64
+
+    steps:
+      - name: ProxSpace download
+        run: Invoke-WebRequest "https://github.com/Gator96100/ProxSpace/archive/master.zip" -outfile "C:\proxspace.zip" -Passthru
+
+      - name: ProxSpace extract
+        run: Expand-Archive -LiteralPath "C:\proxspace.zip" -DestinationPath "C:\"
+
+      - name: ProxSpace delete zip
+        run: Remove-Item "C:\proxspace.zip"
+
+      - name: ProxSpace rename folder
+        run: Get-ChildItem -Path "C:\ProxSpace-*" | Rename-Item -NewName (Split-Path C:\ProxSpace -Leaf)
+
+      - name: ProxSpace version
+        run: |
+          $psversion = (Select-String -Pattern 'PSVERSION=' -SimpleMatch -Path "C:\ProxSpace\msys2\ps\09-proxspace_setup.post").Line.Split("""")[1]
+          Write-Host "ProxSpace version: $psversion"
+
+      - name: ProxSpace initial startup
+        working-directory: C:\ProxSpace
+        run: ./runme64.bat -c "exit"
+
+      - uses: actions/checkout@v2
+
+      - name: make clean
+        run: make clean
+
+      - name: Build
+        run: make V=1
+
+      - name: Test
+        run: make check
+
+      - name: make clean
+        run: make clean
+
+      - name: Build btaddon
+        run: make V=1 PLATFORM_EXTRAS=BTADDON
+
+      - name: Test btaddon
+        run: make check
+
+      - name: make clean
+        run: make clean
+
+      - name: Prepare cmake build folders
+        run: mkdir -p client/build
+
+      - name: Initiate cmake environment
+        run: cmake -G"MSYS Makefiles" ..
+        working-directory: client/build/
+
+      - name: Build cmake
+        run: make VERBOSE=1
+        working-directory: client/build/
+
+      - name: Test cmake
+        run: make client/check CHECKARGS="--clientbin ./client/build/proxmark3"
+
+  wsl:
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: wsl-bash {0}
+
+    steps:
+      - name: WSL setup
+        uses: Vampire/setup-wsl@v1
+        with:
+          distribution: Ubuntu-20.04
+          update: "true"
+          additional-packages: git
+            ca-certificates
+            build-essential
+            pkg-config
+            libreadline-dev
+            gcc-arm-none-eabi
+            libnewlib-dev
+            libbz2-dev
+            qtbase5-dev
+            cmake
+            libpython3-dev
+            python3
+            python3-pip
+            python3-dev
+            libpython3-all-dev
+
+      - name: Install Python dependencies
+        run: |
+          python3 -m pip install --upgrade pip
+          python3 -m pip install setuptools
+          python3 -m pip install ansicolors sslcrypto
+
+      - name: WSL QT fix
+        run: sudo strip --remove-section=.note.ABI-tag /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
+
+      - name: Set git to use LF
+        shell: bash
+        run: |
+          git config --global core.autocrlf false
+          git config --global core.eol lf
+
+      - uses: actions/checkout@v2
+
+      - name: make clean
+        run: make clean
+
+      - name: Build
+        run: make V=1
+
+      - name: Test
+        run: make check
+
+      - name: make clean
+        run: make clean
+
+      - name: Build btaddon
+        run: make V=1 PLATFORM_EXTRAS=BTADDON
+
+      - name: Test btaddon
+        run: make check
+
+      - name: make clean
+        run: make clean
+
+      - name: Prepare cmake build folders
+        run: mkdir -p client/build
+
+      - name: Initiate cmake environment
+        run: cmake ..
+        working-directory: client/build/
+
+      - name: Build cmake
+        run: make VERBOSE=1
+        working-directory: client/build/
+
+      - name: Test cmake
+        run: make client/check CHECKARGS="--clientbin ./client/build/proxmark3"

From 159a12e3577deb14e36934edd0a639cade69d109 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 27 Feb 2021 18:50:12 +0100
Subject: [PATCH 672/682] hf 14b sriwrite - now uses cliparser

---
 client/src/cmdhf14b.c | 103 ++++++++++++++++++++++--------------------
 1 file changed, 55 insertions(+), 48 deletions(-)

diff --git a/client/src/cmdhf14b.c b/client/src/cmdhf14b.c
index ac3b1e982..a9524abb4 100644
--- a/client/src/cmdhf14b.c
+++ b/client/src/cmdhf14b.c
@@ -37,21 +37,6 @@ bool apdu_in_framing_enable = true;
 
 static int CmdHelp(const char *Cmd);
 
-static int usage_hf_14b_write_srx(void) {
-    PrintAndLogEx(NORMAL, "Usage:  hf 14b [h] sriwrite <1|2> <block> <data>");
-    PrintAndLogEx(NORMAL, "Options:");
-    PrintAndLogEx(NORMAL, "       h        this help");
-    PrintAndLogEx(NORMAL, "       <1|2>    1 = SRIX4K , 2 = SRI512");
-    PrintAndLogEx(NORMAL, "       <block>  (hex) block number depends on tag, special block == FF");
-    PrintAndLogEx(NORMAL, "       <data>   hex bytes of data to be written");
-    PrintAndLogEx(NORMAL, "Example:");
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf 14b sriwrite 1 7F 11223344"));
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf 14b sriwrite 1 FF 11223344"));
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf 14b sriwrite 2 15 11223344"));
-    PrintAndLogEx(NORMAL, _YELLOW_("       hf 14b sriwrite 2 FF 11223344"));
-    return PM3_SUCCESS;
-}
-
 static int switch_off_field_14b(void) {
     clearCommandBuffer();
     SendCommandMIX(CMD_HF_ISO14443B_COMMAND, ISO14B_DISCONNECT, 0, 0, NULL, 0);
@@ -1138,56 +1123,78 @@ static int CmdHF14BWriteSri(const char *Cmd) {
      * Special block FF =  otp_lock_reg block.
      * Data len 4 bytes-
      */
-    char cmdp = tolower(param_getchar(Cmd, 0));
-    uint8_t blockno = -1;
-    uint8_t data[4] = {0x00};
-    bool isSrix4k = true;
-    char str[30];
-    memset(str, 0x00, sizeof(str));
 
-    if (strlen(Cmd) < 1 || cmdp == 'h') return usage_hf_14b_write_srx();
+    CLIParserContext *ctx;
+    CLIParserInit(&ctx, "hf 14b sriwrite",
+                  "Write data to a SRI512 | SRIX4K block",
+                  "hf 14b sriwrite --4k -b 100 -d 11223344\n"
+                  "hf 14b sriwrite --4k --sb -d 11223344    --> special block write\n"
+                  "hf 14b sriwrite --512 -b 15 -d 11223344\n"
+                  "hf 14b sriwrite --512 --sb -d 11223344    --> special block write\n"
+                 );
 
-    if (cmdp == '2')
-        isSrix4k = false;
-
-    //blockno = param_get8(Cmd, 1);
-
-    if (param_gethex(Cmd, 1, &blockno, 2)) {
-        PrintAndLogEx(WARNING, "block number must include 2 HEX symbols");
-        return 0;
+    void *argtable[] = {
+        arg_param_begin,
+        arg_int0("b", "block",  "<dec>", "block number"),
+        arg_str1("d", "data",  "<hex>", "4 hex bytes"),
+        arg_lit0(NULL, "512", "target SRI 512 tag"),
+        arg_lit0(NULL, "4k", "target SRIX 4k tag"),
+        arg_lit0(NULL, "sb", "special block write at end of memory (0xFF)"),
+        arg_param_end
+    };
+    CLIExecWithReturn(ctx, Cmd, argtable, false);
+    int blockno = arg_get_int_def(ctx, 1, -1);
+    int dlen = 0;
+    uint8_t data[4] = {0,0,0,0};
+    int res = CLIParamHexToBuf(arg_get_str(ctx, 2), data, sizeof(data), &dlen);
+    if (res) {
+        CLIParserFree(ctx);
+        return PM3_EINVARG;
     }
 
-    if (isSrix4k) {
-        if (blockno > 0x7f && blockno != 0xff) {
-            PrintAndLogEx(FAILED, "block number out of range");
-            return PM3_ESOFT;
-        }
-    } else {
-        if (blockno > 0x0f && blockno != 0xff) {
-            PrintAndLogEx(FAILED, "block number out of range");
-            return PM3_ESOFT;
-        }
+    bool use_sri512 = arg_get_lit(ctx, 3);
+    bool use_srix4k = arg_get_lit(ctx, 4);
+    bool special = arg_get_lit(ctx, 5);
+    CLIParserFree(ctx);
+
+    if (dlen != sizeof(data)) {
+        PrintAndLogEx(FAILED, "data must be 4 hex bytes,  got %d", dlen);
+        return PM3_EINVARG;
     }
 
-    if (param_gethex(Cmd, 2, data, 8)) {
-        PrintAndLogEx(WARNING, "data must include 8 HEX symbols");
-        return PM3_ESOFT;
+    if (use_sri512 + use_srix4k > 1) {
+        PrintAndLogEx(FAILED, "Select only one card type");
+        return PM3_EINVARG;        
     }
 
-    if (blockno == 0xff) {
+    if (use_srix4k && blockno > 0x7F) {
+        PrintAndLogEx(FAILED, "block number out of range, max 127 (0x7F)");
+        return PM3_EINVARG;
+    }
+
+    if (use_sri512 && blockno > 0x0F) {
+        PrintAndLogEx(FAILED, "block number out of range, max 15 (0x0F)");
+        return PM3_EINVARG;
+    }
+
+    // special block at end of memory
+    if (special) {
+        blockno = 0xFF;
         PrintAndLogEx(SUCCESS, "[%s] Write special block %02X [ " _YELLOW_("%s")" ]",
-                      (isSrix4k) ? "SRIX4K" : "SRI512",
+                      (use_srix4k) ? "SRIX4K" : "SRI512",
                       blockno,
-                      sprint_hex(data, 4)
+                      sprint_hex(data, sizeof(data))
                      );
     } else {
         PrintAndLogEx(SUCCESS, "[%s] Write block %02X [ " _YELLOW_("%s")" ]",
-                      (isSrix4k) ? "SRIX4K" : "SRI512",
+                      (use_srix4k) ? "SRIX4K" : "SRI512",
                       blockno,
-                      sprint_hex(data, 4)
+                      sprint_hex(data, sizeof(data))
                      );
     }
 
+    char str[36];
+    memset(str, 0x00, sizeof(str));
     sprintf(str, "--sr -c --data %02x%02x%02x%02x%02x%02x", ISO14443B_WRITE_BLK, blockno, data[0], data[1], data[2], data[3]);
     return CmdHF14BCmdRaw(str);
 }

From 404161d8b0b2dccdeccaf4239dbef89f8ddafda1 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 27 Feb 2021 19:08:35 +0100
Subject: [PATCH 673/682] cppchecker

---
 client/src/cmdhflist.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/client/src/cmdhflist.c b/client/src/cmdhflist.c
index dbe80ef5a..360ed50b1 100644
--- a/client/src/cmdhflist.c
+++ b/client/src/cmdhflist.c
@@ -58,10 +58,11 @@ void ClearAuthData(void) {
 uint8_t iso14443A_CRC_check(bool isResponse, uint8_t *d, uint8_t n) {
     if (n < 3) return 2;
     if (isResponse && (n < 6)) return 2;
-    if (n > 2 && d[1] == 0x50 &&
-            d[0] >= ISO14443A_CMD_ANTICOLL_OR_SELECT &&
-            d[0] <= ISO14443A_CMD_ANTICOLL_OR_SELECT_3)
+    if (d[1] == 0x50 &&
+        d[0] >= ISO14443A_CMD_ANTICOLL_OR_SELECT &&
+        d[0] <= ISO14443A_CMD_ANTICOLL_OR_SELECT_3) {
         return 2;
+    }
     return check_crc(CRC_14443_A, d, n);
 }
 

From eef2a6308138b08bbf04f529957dd9da8b0fb6a8 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 27 Feb 2021 19:09:57 +0100
Subject: [PATCH 674/682] cppchecker

---
 client/src/cmdhfmf.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index b4572f979..606a8d0aa 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -4376,8 +4376,7 @@ static int CmdHF14AMfCLoad(const char *Cmd) {
     }
 
     if (res) {
-        if (data)
-            free(data);
+        free(data);
         return PM3_EFILE;
     }
 

From 3ee657c0f70ce1c390c7540febe9cb23991ffd57 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 27 Feb 2021 19:12:03 +0100
Subject: [PATCH 675/682] cppchecker

---
 client/src/cmdhfmf.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c
index 606a8d0aa..cb338826b 100644
--- a/client/src/cmdhfmf.c
+++ b/client/src/cmdhfmf.c
@@ -4857,15 +4857,14 @@ static int CmdHF14AMfice(const char *Cmd) {
     bool slow = false;
     bool initialize = true;
     bool acquisition_completed = false;
-    uint32_t flags = 0;
     uint32_t total_num_nonces = 0;
-    FILE *fnonces = NULL;
     PacketResponseNG resp;
 
     uint32_t part_limit = 3000;
 
     PrintAndLogEx(NORMAL, "Collecting "_YELLOW_("%u")" nonces \n", limit);
 
+    FILE *fnonces = NULL;
     if ((fnonces = fopen(filename, "wb")) == NULL) {
         PrintAndLogEx(WARNING, "Could not create file " _YELLOW_("%s"), filename);
         return PM3_EFILE;
@@ -4881,7 +4880,7 @@ static int CmdHF14AMfice(const char *Cmd) {
             break;
         }
 
-        flags = 0;
+        uint32_t flags = 0;
         flags |= initialize ? 0x0001 : 0;
         flags |= slow ? 0x0002 : 0;
         clearCommandBuffer();

From 4ab382065a06a1a0750130e4c6945f94fe9584f5 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 27 Feb 2021 19:13:19 +0100
Subject: [PATCH 676/682] cppchecker

---
 client/src/cmdhfmfp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/cmdhfmfp.c b/client/src/cmdhfmfp.c
index 411c96bbf..33991bb27 100644
--- a/client/src/cmdhfmfp.c
+++ b/client/src/cmdhfmfp.c
@@ -1158,7 +1158,7 @@ static int CmdHFMFPChk(const char *Cmd) {
     int vpatternlen = 0;
     CLIGetHexWithReturn(ctx, 9, vpattern, &vpatternlen);
     if (vpatternlen > 0) {
-        if (vpatternlen > 0 && vpatternlen <= 2) {
+        if (vpatternlen <= 2) {
             startPattern = (vpattern[0] << 8) + vpattern[1];
         } else {
             PrintAndLogEx(ERR, "Pattern must be 2-byte length.");

From 72ff81c80f7a2a803554640f49487e80e63e38c8 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sat, 27 Feb 2021 19:35:19 +0100
Subject: [PATCH 677/682] cppchecker

---
 tools/cryptorf/sma.cpp       | 38 ++++++++++++++----------------------
 tools/cryptorf/sma_multi.cpp | 17 +++++++---------
 2 files changed, 22 insertions(+), 33 deletions(-)

diff --git a/tools/cryptorf/sma.cpp b/tools/cryptorf/sma.cpp
index a51281ad8..c7f7f74b2 100644
--- a/tools/cryptorf/sma.cpp
+++ b/tools/cryptorf/sma.cpp
@@ -186,16 +186,13 @@ static lookup_entry lookup_right[0x8000];
 static uint8_t left_addition[0x100000];
 
 static inline void init_lookup_left() {
-    uint8_t b3, b6, temp;
-    int i, index;
-
-    for (i = 0; i < 0x400; i++) {
-        b6 = i & 0x1f;
-        b3 = (i >> 5) & 0x1f;
-        index = (b3 << 15) | b6;
+    for (int i = 0; i < 0x400; i++) {
+        int b6 = i & 0x1f;
+        int b3 = (i >> 5) & 0x1f;
+        int index = (b3 << 15) | b6;
         b6 = bit_rotate_l(b6, 5);
 
-        temp = mod(b3 + b6, 0x1f);
+        int temp = mod(b3 + b6, 0x1f);
         left_addition[index] = temp;
         lookup_left[index].addition = temp;
         lookup_left[index].out = ((temp ^ b3) & 0x0f);
@@ -203,15 +200,12 @@ static inline void init_lookup_left() {
 }
 
 static inline void init_lookup_right() {
-    uint8_t b16, b18, temp;
-    int i, index;
+    for (int i = 0; i < 0x400; i++) {
+        int b18 = i & 0x1f;
+        int b16 = (i >> 5) & 0x1f;
+        int index = (b16 << 10) | b18;
 
-    for (i = 0; i < 0x400; i++) {
-        b18 = i & 0x1f;
-        b16 = (i >> 5) & 0x1f;
-        index = (b16 << 10) | b18;
-
-        temp = mod(b18 + b16, 0x1f);
+        int temp = mod(b18 + b16, 0x1f);
         lookup_right[index].addition = temp;
         lookup_right[index].out = ((temp ^ b16) & 0x0f);
     }
@@ -422,7 +416,7 @@ static inline void previous_all_input(vector<cs_t> *pcstates, uint32_t gc_byte_i
     uint8_t btGc, in;
     vector<cs_t> ncstates;
     vector<cs_t> prev_ncstates;
-    vector<cs_t>::iterator it, itnew;
+    vector<cs_t>::iterator itnew;
 
     // Loop through the complete entryphy of 5 bits for each candidate
     // We ignore zero (xor 0x00) to avoid duplicates
@@ -707,13 +701,11 @@ void combine_valid_left_right_states(vector<cs_t> *plcstates, vector<cs_t> *prcs
 int main(int argc, const char *argv[]) {
     size_t pos;
     crypto_state_t ostate;
-    uint64_t rstate_before_gc, rstate_after_gc;
-    uint64_t lstate_before_gc;
-    vector<uint64_t> rstates, lstates_after_gc, pgc_candidates;
+    uint64_t rstate_before_gc, lstate_before_gc;
+    vector<uint64_t> rstates, pgc_candidates;
     vector<uint64_t>::iterator itrstates, itgc;
     vector<cs_t> crstates;
-    vector<cs_t> clcandidates, clstates;
-    vector<cs_t>::iterator it;
+    vector<cs_t> clstates;
     uint32_t rbits;
 
 //  uint8_t   Gc[ 8] = {0x4f,0x79,0x4a,0x46,0x3f,0xf8,0x1d,0x81};
@@ -822,7 +814,7 @@ int main(int argc, const char *argv[]) {
     }
 
     for (itrstates = rstates.begin(); itrstates != rstates.end(); ++itrstates) {
-        rstate_after_gc = *itrstates;
+        uint64_t rstate_after_gc = *itrstates;
         sm_left_mask(ks, mask, rstate_after_gc);
         printf("Using the state from the top-right bin: " _YELLOW_("0x%07" PRIx64)"\n", rstate_after_gc);
 
diff --git a/tools/cryptorf/sma_multi.cpp b/tools/cryptorf/sma_multi.cpp
index bb1676aad..1c8195529 100644
--- a/tools/cryptorf/sma_multi.cpp
+++ b/tools/cryptorf/sma_multi.cpp
@@ -660,7 +660,7 @@ static inline void previous_all_input(vector<cs_t> *pcstates, uint32_t gc_byte_i
     uint8_t btGc, in;
     vector<cs_t> ncstates;
     vector<cs_t> prev_ncstates;
-    vector<cs_t>::iterator it, itnew;
+    vector<cs_t>::iterator itnew;
 
     // Loop through the complete entryphy of 5 bits for each candidate
     // We ignore zero (xor 0x00) to avoid duplicates
@@ -967,13 +967,10 @@ static void ice_compare(
 int main(int argc, const char *argv[]) {
     size_t pos;
     crypto_state_t ostate;
-    uint64_t rstate_before_gc, rstate_after_gc;
-    uint64_t lstate_before_gc;
-    vector<uint64_t> rstates, lstates_after_gc, pgc_candidates;
-    vector<uint64_t>::iterator itrstates, itgc;
-    vector<cs_t> crstates;
-    vector<cs_t> clcandidates, clstates;
-    vector<cs_t>::iterator it;
+    uint64_t rstate_before_gc, lstate_before_gc;
+    vector<uint64_t> rstates, pgc_candidates;
+    vector<uint64_t>::iterator itrstates;
+    vector<cs_t> crstates, clstates;
     uint32_t rbits;
 
     //  uint8_t   Gc[ 8] = {0x4f,0x79,0x4a,0x46,0x3f,0xf8,0x1d,0x81};
@@ -1081,14 +1078,14 @@ int main(int argc, const char *argv[]) {
     rbits = ice_sm_right(ks, mask, &rstates);
 
     printf("Top-bin for the right state contains " _GREEN_("%u")" correct bits\n", rbits);
-    printf("Total count of right bins: " _YELLOW_("%zu") "\n", (unsigned long)rstates.size());
+    printf("Total count of right bins: " _YELLOW_("%zu") "\n", rstates.size());
 
     if (rbits < 96) {
         printf(_RED_("\n  WARNING!!! Better find another trace, the right top-bin is < 96 bits\n\n"));
     }
 
     for (itrstates = rstates.begin(); itrstates != rstates.end(); ++itrstates) {
-        rstate_after_gc = *itrstates;
+        uint64_t rstate_after_gc = *itrstates;
         sm_left_mask(ks, mask, rstate_after_gc);
         printf("Using the state from the top-right bin: " _YELLOW_("0x%07" PRIx64)"\n", rstate_after_gc);
 

From cb97b67cc5f217f380da590088d9542f8f975a0b Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sun, 28 Feb 2021 10:29:40 +0100
Subject: [PATCH 678/682] spelling

---
 client/src/cmdhflist.c | 2 +-
 include/protocols.h    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/cmdhflist.c b/client/src/cmdhflist.c
index 360ed50b1..6e292ad6f 100644
--- a/client/src/cmdhflist.c
+++ b/client/src/cmdhflist.c
@@ -311,7 +311,7 @@ int applyIso14443a(char *exp, size_t size, uint8_t *cmd, uint8_t cmdsize) {
         case MIFARE_ULNANO_WRITESIG:
             snprintf(exp, size, "WRITE SIG");
             break;
-        case MIFARE_ULNANO_LOCKSIF: {
+        case MIFARE_ULNANO_LOCKSIG: {
             if (cmd[1] == 0)
                 snprintf(exp, size, "UNLOCK SIG");
             else if (cmd[1] == 2)
diff --git a/include/protocols.h b/include/protocols.h
index dafce0024..f5848eca7 100644
--- a/include/protocols.h
+++ b/include/protocols.h
@@ -188,7 +188,7 @@ ISO 7816-4 Basic interindustry commands. For command APDU's.
 
 // New Mifare UL Nano commands.  Ref:: (https://www.nxp.com/docs/en/data-sheet/MF0UN_H_00.pdf)
 #define MIFARE_ULNANO_WRITESIG      0xA9
-#define MIFARE_ULNANO_LOCKSIF       0xAC
+#define MIFARE_ULNANO_LOCKSIG       0xAC
 
 // mifare 4bit card answers
 #define CARD_ACK      0x0A  // 1010 - ACK

From 7f87b2dfa7b98bee5fa2886c749a7dd624bc4963 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sun, 28 Feb 2021 10:44:21 +0100
Subject: [PATCH 679/682] warnings

---
 tools/cryptorf/sma.cpp       | 4 +++-
 tools/cryptorf/sma_multi.cpp | 3 +--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/tools/cryptorf/sma.cpp b/tools/cryptorf/sma.cpp
index c7f7f74b2..fc6c74041 100644
--- a/tools/cryptorf/sma.cpp
+++ b/tools/cryptorf/sma.cpp
@@ -102,7 +102,6 @@ Ci+1: de c2 ee 1b 1c 92 76 e9
   7c90849f8 (77)
   7cc847482 (87)
 
-*/
 
 const uint64_t left_candidates[43] = {
     0x6221539d9ull, 0x1ddeac626ull, 0x7cc847482ull, 0x0337b8b7dull,
@@ -117,6 +116,7 @@ const uint64_t left_candidates[43] = {
     0x0f78aac5bull, 0x3770cdaf3ull, 0x205078bbaull, 0x04445c715ull,
     0x004df8a64ull, 0x6f696e09eull, 0x109691f61ull
 };
+*/
 
 typedef struct {
     uint64_t l;
@@ -305,6 +305,7 @@ static inline uint8_t next_left_fast(uint8_t in, uint64_t *left) {
     return lookup->out;
 }
 
+/*
 static inline uint8_t next_left_ksbyte(uint64_t *left) {
     lookup_entry *lookup;
     uint8_t bt;
@@ -319,6 +320,7 @@ static inline uint8_t next_left_ksbyte(uint64_t *left) {
     bt |= lookup->out;
     return bt;
 }
+*/
 
 static inline uint8_t next_right_fast(uint8_t in, uint64_t *right) {
     if (in) *right ^= ((in & 0xf8) << 12);
diff --git a/tools/cryptorf/sma_multi.cpp b/tools/cryptorf/sma_multi.cpp
index 1c8195529..5e38c9b0b 100644
--- a/tools/cryptorf/sma_multi.cpp
+++ b/tools/cryptorf/sma_multi.cpp
@@ -105,8 +105,6 @@ Ci+1: de c2 ee 1b 1c 92 76 e9
   7c90849f8 (77)
   7cc847482 (87)
 
-*/
-
 const uint64_t left_candidates[43] = {
     0x6221539d9ull, 0x1ddeac626ull, 0x7cc847482ull, 0x0337b8b7dull,
     0x159d1687eull, 0x7bade8a41ull, 0x4c51c6463ull, 0x4e3d88bf9ull,
@@ -120,6 +118,7 @@ const uint64_t left_candidates[43] = {
     0x0f78aac5bull, 0x3770cdaf3ull, 0x205078bbaull, 0x04445c715ull,
     0x004df8a64ull, 0x6f696e09eull, 0x109691f61ull
 };
+*/
 
 typedef struct {
     uint64_t l;

From 278ba103ce2336bf36ebdaed17329311a5d58294 Mon Sep 17 00:00:00 2001
From: Ave <ave@ave.zone>
Date: Sun, 28 Feb 2021 12:55:33 +0300
Subject: [PATCH 680/682] ntag_getsig: Introduce ntag_getsig

---
 .gitignore                        |   1 +
 CHANGELOG.md                      |   1 +
 client/luascripts/ntag_getsig.lua | 104 ++++++++++++++++++++++++++++++
 3 files changed, 106 insertions(+)
 create mode 100644 client/luascripts/ntag_getsig.lua

diff --git a/.gitignore b/.gitignore
index 430ae2cad..543624a4f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -33,6 +33,7 @@ version.c
 *.json.bak
 *.pyc
 *.bmp
+originalitysig.csv
 
 # new build file for add-ons.
 Makefile.platform
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c05e5a084..bced7ef1a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+ - Added a script to dump originality signatures from MFU EV1s and NTAGs (@aveao)
  - Added parsing of EF_CardAccess to display PACE algorithm, version and parameter in `hf emrtd info` (@aveao)
  - Change, numerous commands more uses cliparser (@tcprst, @iceman1001)
  - Added more originality public keys (@anon)
diff --git a/client/luascripts/ntag_getsig.lua b/client/luascripts/ntag_getsig.lua
new file mode 100644
index 000000000..a70cb8623
--- /dev/null
+++ b/client/luascripts/ntag_getsig.lua
@@ -0,0 +1,104 @@
+local getopt = require('getopt')
+local lib14a = require('read14a')
+local cmds = require('commands')
+local ansicolors = require('ansicolors')
+
+copyright = 'Copyright 2021 A. Ozkal, released under GPLv2+.'
+author = 'Ave'
+version = 'v1.0.0'
+desc = [[
+This script attempts to grab signatures from an NTAG or MFULEV1 card and print it in a machine parsable way
+ ]]
+example = [[
+    script run ntag_getsig
+]]
+usage = [[
+    script run ntag_getsig [-h]
+]]
+arguments = [[
+    -h                   : This help
+]]
+
+local function help()
+    print(author)
+    print(version)
+    print(desc)
+    print(ansicolors.cyan..'Usage'..ansicolors.reset)
+    print(usage)
+    print(ansicolors.cyan..'Arguments'..ansicolors.reset)
+    print(arguments)
+    print(ansicolors.cyan..'Example usage'..ansicolors.reset)
+    print(example)
+end
+
+-- Used to send raw data to the firmware to subsequently forward the data to the card.
+-- from mifareplus.lua
+local function sendRaw(rawdata, crc, power)
+    -- print(("<sent>:       %s"):format(rawdata))
+
+    local flags = lib14a.ISO14A_COMMAND.ISO14A_RAW
+    if crc then
+        flags = flags + lib14a.ISO14A_COMMAND.ISO14A_APPEND_CRC
+    end
+    if power then
+        flags = flags + lib14a.ISO14A_COMMAND.ISO14A_NO_DISCONNECT
+    end
+
+    local command = Command:newMIX{cmd = cmds.CMD_HF_ISO14443A_READER,
+                                arg1 = flags, -- Send raw
+                                arg2 = string.len(rawdata) / 2, -- arg2 contains the length, which is half the length of the ASCII-string rawdata
+                                data = rawdata
+                                }
+    local ignore_response = false
+    local result, err = command:sendMIX(ignore_response)
+    if result then
+        --unpack the first 4 parts of the result as longs, and the last as an extremely long string to later be cut down based on arg1, the number of bytes returned
+        local count,cmd,arg1,arg2,arg3,data = bin.unpack('LLLLH512',result)
+
+        returned_bytes = string.sub(data, 1, arg1 * 2)
+        if #returned_bytes > 0 then
+            -- print(("<recvd>: %s"):format(returned_bytes)) -- need to multiply by 2 because the hex digits are actually two bytes when they are strings
+            return returned_bytes
+        else
+            return nil
+        end
+    else
+        print("Error sending the card raw data.")
+        return nil
+    end
+end
+
+---
+-- The main entry point
+function main(args)
+    -- Read the parameters
+    for o, a in getopt.getopt(args, 'h') do
+        if o == 'h' then return help() end
+    end
+
+    local tag, err = lib14a.read(true, false)
+
+    if not err then
+        local sig = sendRaw("3C00", true, true)
+        local ver = sendRaw("60", true, false)
+        if sig and ver then  -- if false, that's a fail right there
+            sig = string.sub(sig, 0, -5)
+            ver = string.sub(ver, 0, -5)
+            local text = tag.name..","..ver..","..tag.uid..","..sig
+            print(text)
+
+            local filename = "originalitysig.csv"
+            local outfile = io.open(filename, "a")
+            if outfile ~= nil then
+                outfile:write(text.."\n")
+                io.close(outfile)
+            else
+                print(ansicolors.red.."Couldn't open file originalitysig.csv."..ansicolors.reset)
+            end
+        else
+            print(ansicolors.red.."Read FAILED."..ansicolors.reset)
+        end
+    end
+end
+
+main(args)

From 7910464a8537714cec4393c10a35ccc5954d2f4f Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Sun, 28 Feb 2021 19:01:38 +0100
Subject: [PATCH 681/682] cppchecker

---
 armsrc/iso14443a.h | 2 +-
 armsrc/iso15693.c  | 5 ++---
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/armsrc/iso14443a.h b/armsrc/iso14443a.h
index 325eed056..54764d223 100644
--- a/armsrc/iso14443a.h
+++ b/armsrc/iso14443a.h
@@ -129,7 +129,7 @@ RAMFUNC bool MillerDecoding(uint8_t bit, uint32_t non_real_time);
 RAMFUNC int ManchesterDecoding(uint8_t bit, uint16_t offset, uint32_t non_real_time);
 
 void RAMFUNC SniffIso14443a(uint8_t param);
-void SimulateIso14443aTag(uint8_t tagType, uint8_t flags, uint8_t *data, uint8_t numReads);
+void SimulateIso14443aTag(uint8_t tagType, uint8_t flags, uint8_t *data, uint8_t exitAfterNReads);
 bool SimulateIso14443aInit(int tagType, int flags, uint8_t *data, tag_response_info_t **responses, uint32_t *cuid, uint32_t counters[3], uint8_t tearings[3], uint8_t *pages);
 bool GetIso14443aCommandFromReader(uint8_t *received, uint8_t *par, int *len);
 void iso14443a_antifuzz(uint32_t flags);
diff --git a/armsrc/iso15693.c b/armsrc/iso15693.c
index 5050fc117..de7a409bd 100644
--- a/armsrc/iso15693.c
+++ b/armsrc/iso15693.c
@@ -1602,7 +1602,7 @@ void ReaderIso15693(uint32_t parameter) {
         reply_mix(CMD_ACK, recvlen, 0, 0, NULL, 0);
     } else {
 
-        start_time = eof_time + DELAY_ISO15693_VICC_TO_VCD_READER;
+        //start_time = eof_time + DELAY_ISO15693_VICC_TO_VCD_READER;
 
         // we should do a better check than this
         if (recvlen >= 12) {
@@ -1686,7 +1686,7 @@ void SimTagIso15693(uint8_t *uid) {
     enum { NO_FIELD, IDLE, ACTIVATED, SELECTED, HALTED } chip_state = NO_FIELD;
 
     bool button_pressed = false;
-    int vHf = 0; // in mV
+    int vHf; // in mV
 
     bool exit_loop = false;
     while (exit_loop == false) {
@@ -1719,7 +1719,6 @@ void SimTagIso15693(uint8_t *uid) {
         int cmd_len = GetIso15693CommandFromReader(cmd, sizeof(cmd), &reader_eof_time);
         if (cmd_len < 0) {
             button_pressed = true;
-            exit_loop = true;
             break;
         }
 

From 5657e392f49b1ba63e3c7c0faa0771350bb6cc92 Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Tue, 2 Mar 2021 13:32:55 +0100
Subject: [PATCH 682/682] text

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index cf8ad802b..224e822af 100644
--- a/README.md
+++ b/README.md
@@ -77,7 +77,7 @@ quite a lot, see the [Changelog file](CHANGELOG.md) which we try to keep updated
 
 This repo compiles nicely on 
    - Proxspace v3.x
-     - [latest release v3.7.3](https://github.com/Gator96100/ProxSpace/releases)
+     - [latest release v3.8](https://github.com/Gator96100/ProxSpace/releases)
    - Windows/mingw environment with Qt5.6.1 & GCC 4.9
    - Ubuntu 16.04 -> 20.04
    - ParrotOS, Gentoo, Pentoo, Kali, Nethunter, Archlinux, Fedora, Debian