From 6d31653c440538916811b957769a89f24eb39d63 Mon Sep 17 00:00:00 2001
From: merlokk <olegmsn@gmail.com>
Date: Tue, 11 Sep 2018 12:21:29 +0300
Subject: [PATCH 01/28] move `hf emv search` to argtable

---
 client/emv/cmdemv.c | 59 +++++++++++++++------------------------------
 1 file changed, 19 insertions(+), 40 deletions(-)

diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index c53b02af..784c5943 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -11,6 +11,7 @@
 #include <ctype.h>
 #include "cmdemv.h"
 #include "test/cryptotest.h"
+#include "cliparser/cliparser.h"
 
 int UsageCmdHFEMVSelect(void) {
 	PrintAndLog("HELP :  Executes select applet command:\n");
@@ -125,49 +126,27 @@ int UsageCmdHFEMVSearch(void) {
 
 int CmdHFEMVSearch(const char *cmd) {
 
-	bool activateField = false;
-	bool leaveSignalON = false;
-	bool decodeTLV = false;
+	CLIParserInit("hf 14a select", 
+		"Tries to select all applets from applet list:\n", 
+		"Usage:\n\thf emv search -s -> select card and search\n\thf emv search -s -t -> select card, search and show result in TLV\n");
 
-	if (strlen(cmd) < 1) {
-		UsageCmdHFEMVSearch();
-		return 0;
-	}
+	void* argtable[] = {
+		arg_param_begin,
+		arg_lit0("sS",  "select",  "activate field and select card"),
+		arg_lit0("kK",  "keep",    "keep field ON for next command"),
+		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
+		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, true);
 	
-	SetAPDULogging(false);
+	bool activateField = arg_get_lit(1);
+	bool leaveSignalON = arg_get_lit(2);
+	bool APDULogging = arg_get_lit(3);
+	bool decodeTLV = arg_get_lit(4);
+	
+	SetAPDULogging(APDULogging);
 	
-	int cmdp = 0;
-	while(param_getchar(cmd, cmdp) != 0x00) {
-		char c = param_getchar(cmd, cmdp);
-		if ((c == '-') && (param_getlength(cmd, cmdp) == 2))
-			switch (param_getchar_indx(cmd, 1, cmdp)) {
-				case 'h':
-				case 'H':
-					UsageCmdHFEMVSearch();
-					return 0;
-				case 's':
-				case 'S':
-					activateField = true;
-					break;
-				case 'k':
-				case 'K':
-					leaveSignalON = true;
-					break;
-				case 'a':
-				case 'A':
-					SetAPDULogging(true);
-					break;
-				case 't':
-				case 'T':
-					decodeTLV = true;
-					break;
-				default:
-					PrintAndLog("Unknown parameter '%c'", param_getchar_indx(cmd, 1, cmdp));
-					return 1;
-		}
-		cmdp++;
-	}
-
 	struct tlvdb *t = NULL;
 	const char *al = "Applets list";
 	t = tlvdb_fixed(1, strlen(al), (const unsigned char *)al);

From 3668df05ec90178e7b10efe9790e7aed49099519 Mon Sep 17 00:00:00 2001
From: merlokk <olegmsn@gmail.com>
Date: Tue, 11 Sep 2018 14:49:50 +0300
Subject: [PATCH 02/28] `hf emv select`

---
 client/cliparser/cliparser.h |  1 +
 client/emv/cmdemv.c          | 96 +++++++++---------------------------
 2 files changed, 25 insertions(+), 72 deletions(-)

diff --git a/client/cliparser/cliparser.h b/client/cliparser/cliparser.h
index 3f4fa4cc..9d83a95f 100644
--- a/client/cliparser/cliparser.h
+++ b/client/cliparser/cliparser.h
@@ -19,6 +19,7 @@
 #define arg_get_lit(n)(((struct arg_lit*)argtable[n])->count)
 #define arg_get_int(n)(((struct arg_int*)argtable[n])->ival[0])
 #define arg_get_str(n)((struct arg_str*)argtable[n])
+#define arg_get_str_len(n)(strlen(((struct arg_int*)argtable[n])->ival[0]))
 
 #define CLIExecWithReturn(cmd, atbl, ifempty) if (CLIParserParseString(cmd, atbl, arg_getsize(atbl), ifempty)){CLIParserFree();return 0;}
 #define CLIGetStrBLessWithReturn(paramnum, data, datalen, delta) if (CLIParamHexToBuf(arg_get_str(paramnum), data, sizeof(data) - (delta), datalen)) {CLIParserFree();return 1;}
diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index 784c5943..c40a9a69 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -30,67 +30,32 @@ int UsageCmdHFEMVSelect(void) {
 int CmdHFEMVSelect(const char *cmd) {
 	uint8_t data[APDU_AID_LEN] = {0};
 	int datalen = 0;
-	bool activateField = false;
-	bool leaveSignalON = false;
-	bool decodeTLV = false;
 
-	if (strlen(cmd) < 1) {
-		UsageCmdHFEMVSelect();
-		return 0;
-	}
+
+	CLIParserInit("hf 14a select", 
+		"Executes select applet command", 
+		"Usage:\n\thf emv select -s a00000000101 -> select card, select applet\n\thf emv select -s -t a00000000101 -> select card, select applet, show result in TLV\n");
+
+	void* argtable[] = {
+		arg_param_begin,
+		arg_lit0("sS",  "select",  "activate field and select card"),
+		arg_lit0("kK",  "keep",    "keep field for next command"),
+		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
+		arg_lit0("tT",  "tlv",     "TLV decode results"),
+		arg_str0(NULL,  NULL,      "<HEX applet AID>", NULL),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, true);
 	
-	SetAPDULogging(false);
+	bool activateField = arg_get_lit(1);
+	bool leaveSignalON = arg_get_lit(2);
+	bool APDULogging = arg_get_lit(3);
+	bool decodeTLV = arg_get_lit(4);
+	if (arg_get_str_len(5))
+		CLIGetStrBLessWithReturn(5, data, &datalen, 0);
+	CLIParserFree();
 	
-	int cmdp = 0;
-	while(param_getchar(cmd, cmdp) != 0x00) {
-		char c = param_getchar(cmd, cmdp);
-		if ((c == '-') && (param_getlength(cmd, cmdp) == 2))
-			switch (param_getchar_indx(cmd, 1, cmdp)) {
-				case 'h':
-				case 'H':
-					UsageCmdHFEMVSelect();
-					return 0;
-				case 's':
-				case 'S':
-					activateField = true;
-					break;
-				case 'k':
-				case 'K':
-					leaveSignalON = true;
-					break;
-				case 'a':
-				case 'A':
-					SetAPDULogging(true);
-					break;
-				case 't':
-				case 'T':
-					decodeTLV = true;
-					break;
-				default:
-					PrintAndLog("Unknown parameter '%c'", param_getchar_indx(cmd, 1, cmdp));
-					return 1;
-		}
-
-		if (isxdigit((unsigned char)c)) {
-			switch(param_gethex_to_eol(cmd, cmdp, data, sizeof(data), &datalen)) {
-			case 1:
-				PrintAndLog("Invalid HEX value.");
-				return 1;
-			case 2:
-				PrintAndLog("AID too large.");
-				return 1;
-			case 3:
-				PrintAndLog("Hex must have even number of digits.");
-				return 1;
-			}
-			
-			// we get all the hex to end of line with spaces
-			break;
-		}
-
-
-		cmdp++;
-	}
+	SetAPDULogging(APDULogging);
 	
 	// exec
 	uint8_t buf[APDU_RES_LEN] = {0};
@@ -110,20 +75,6 @@ int CmdHFEMVSelect(const char *cmd) {
 	return 0;
 }
 
-int UsageCmdHFEMVSearch(void) {
-	PrintAndLog("HELP :  Tries to select all applets from applet list:\n");
-	PrintAndLog("Usage:  hf emv search [-s][-k][-a][-t]\n");
-	PrintAndLog("  Options:");
-	PrintAndLog("  -s       : select card");
-	PrintAndLog("  -k       : keep field for next command");
-	PrintAndLog("  -a       : show APDU reqests and responses\n");
-	PrintAndLog("  -t       : TLV decode results of selected applets\n");
-	PrintAndLog("Samples:");
-	PrintAndLog(" hf emv search -s -> select card and search");
-	PrintAndLog(" hf emv search -s -t -> select card, search and show result in TLV");
-	return 0;
-}
-
 int CmdHFEMVSearch(const char *cmd) {
 
 	CLIParserInit("hf 14a select", 
@@ -144,6 +95,7 @@ int CmdHFEMVSearch(const char *cmd) {
 	bool leaveSignalON = arg_get_lit(2);
 	bool APDULogging = arg_get_lit(3);
 	bool decodeTLV = arg_get_lit(4);
+	CLIParserFree();
 	
 	SetAPDULogging(APDULogging);
 	

From 7d4ba60e8e1b169822ff64a870b9f976585cb97c Mon Sep 17 00:00:00 2001
From: merlokk <olegmsn@gmail.com>
Date: Tue, 11 Sep 2018 14:56:33 +0300
Subject: [PATCH 03/28] `hf emv select` some refactoring

---
 client/cliparser/cliparser.c | 4 ++++
 client/emv/cmdemv.c          | 3 +--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/client/cliparser/cliparser.c b/client/cliparser/cliparser.c
index 0e70a630..87427db0 100644
--- a/client/cliparser/cliparser.c
+++ b/client/cliparser/cliparser.c
@@ -148,6 +148,10 @@ void CLIParserFree() {
 
 // convertors
 int CLIParamHexToBuf(struct arg_str *argstr, uint8_t *data, int maxdatalen, int *datalen) {
+	*datalen = 0;
+	if (!strlen(argstr->sval[0]))
+		return 0;
+	
 	switch(param_gethex_to_eol(argstr->sval[0], 0, data, maxdatalen, datalen)) {
 	case 1:
 		printf("Parameter error: Invalid HEX value.\n");
diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index c40a9a69..33a519b1 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -51,8 +51,7 @@ int CmdHFEMVSelect(const char *cmd) {
 	bool leaveSignalON = arg_get_lit(2);
 	bool APDULogging = arg_get_lit(3);
 	bool decodeTLV = arg_get_lit(4);
-	if (arg_get_str_len(5))
-		CLIGetStrBLessWithReturn(5, data, &datalen, 0);
+	CLIGetStrBLessWithReturn(5, data, &datalen, 0);
 	CLIParserFree();
 	
 	SetAPDULogging(APDULogging);

From 24e0d538d1cc9b71a20184ec9d1c97bed4ce2cc6 Mon Sep 17 00:00:00 2001
From: merlokk <olegmsn@gmail.com>
Date: Tue, 11 Sep 2018 14:58:15 +0300
Subject: [PATCH 04/28] delete old help

---
 client/emv/cmdemv.c | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index 33a519b1..65a1639a 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -13,20 +13,6 @@
 #include "test/cryptotest.h"
 #include "cliparser/cliparser.h"
 
-int UsageCmdHFEMVSelect(void) {
-	PrintAndLog("HELP :  Executes select applet command:\n");
-	PrintAndLog("Usage:  hf emv select [-s][-k][-a][-t] <HEX applet AID>\n");
-	PrintAndLog("  Options:");
-	PrintAndLog("  -s       : select card");
-	PrintAndLog("  -k       : keep field for next command");
-	PrintAndLog("  -a       : show APDU reqests and responses\n");
-	PrintAndLog("  -t       : TLV decode results\n");
-	PrintAndLog("Samples:");
-	PrintAndLog(" hf emv select -s a00000000101 -> select card, select applet");
-	PrintAndLog(" hf emv select -s -t a00000000101 -> select card, select applet, show result in TLV");
-	return 0;
-}
-
 int CmdHFEMVSelect(const char *cmd) {
 	uint8_t data[APDU_AID_LEN] = {0};
 	int datalen = 0;

From a4662ca9f9e8de6fb1e4dd07b59a9bba15731087 Mon Sep 17 00:00:00 2001
From: merlokk <olegmsn@gmail.com>
Date: Tue, 11 Sep 2018 16:11:58 +0300
Subject: [PATCH 05/28] `hf emv pse` and sketch for the other commands

---
 client/emv/cmdemv.c | 117 +++++++++++++++++++-------------------------
 1 file changed, 50 insertions(+), 67 deletions(-)

diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index 65a1639a..e621038e 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -20,7 +20,7 @@ int CmdHFEMVSelect(const char *cmd) {
 
 	CLIParserInit("hf 14a select", 
 		"Executes select applet command", 
-		"Usage:\n\thf emv select -s a00000000101 -> select card, select applet\n\thf emv select -s -t a00000000101 -> select card, select applet, show result in TLV\n");
+		"Usage:\n\thf emv select -s a00000000101 -> select card, select applet\n\thf emv select -st a00000000101 -> select card, select applet, show result in TLV\n");
 
 	void* argtable[] = {
 		arg_param_begin,
@@ -64,7 +64,7 @@ int CmdHFEMVSearch(const char *cmd) {
 
 	CLIParserInit("hf 14a select", 
 		"Tries to select all applets from applet list:\n", 
-		"Usage:\n\thf emv search -s -> select card and search\n\thf emv search -s -t -> select card, search and show result in TLV\n");
+		"Usage:\n\thf emv search -s -> select card and search\n\thf emv search -st -> select card, search and show result in TLV\n");
 
 	void* argtable[] = {
 		arg_param_begin,
@@ -105,74 +105,37 @@ int CmdHFEMVSearch(const char *cmd) {
 	return 0;
 }
 
-int UsageCmdHFEMVPPSE(void) {
-	PrintAndLog("HELP :  Executes PSE/PPSE select command. It returns list of applet on the card:\n");
-	PrintAndLog("Usage:  hf emv pse [-s][-k][-1][-2][-a][-t]\n");
-	PrintAndLog("  Options:");
-	PrintAndLog("  -s       : select card");
-	PrintAndLog("  -k       : keep field for next command");
-	PrintAndLog("  -1       : ppse (1PAY.SYS.DDF01)");
-	PrintAndLog("  -2       : pse (2PAY.SYS.DDF01)");
-	PrintAndLog("  -a       : show APDU reqests and responses\n");
-	PrintAndLog("  -t       : TLV decode results\n");
-	PrintAndLog("Samples:");
-	PrintAndLog(" hf emv pse -s -1 -> select, get pse");
-	PrintAndLog(" hf emv pse -s -k -2 -> select, get ppse, keep field");
-	PrintAndLog(" hf emv pse -s -t -2 -> select, get ppse, show result in TLV");
-	return 0;
-}
-
 int CmdHFEMVPPSE(const char *cmd) {
 	
-	uint8_t PSENum = 2;
-	bool activateField = false;
-	bool leaveSignalON = false;
-	bool decodeTLV = false;
-
-	if (strlen(cmd) < 1) {
-		UsageCmdHFEMVPPSE();
-		return 0;
-	}
-
-	SetAPDULogging(false);
 	
-	int cmdp = 0;
-	while(param_getchar(cmd, cmdp) != 0x00) {
-		char c = param_getchar(cmd, cmdp);
-		if ((c == '-') && (param_getlength(cmd, cmdp) == 2))
-			switch (param_getchar_indx(cmd, 1, cmdp)) {
-				case 'h':
-				case 'H':
-					UsageCmdHFEMVPPSE();
-					return 0;
-				case 's':
-				case 'S':
-					activateField = true;
-					break;
-				case 'k':
-				case 'K':
-					leaveSignalON = true;
-					break;
-				case 'a':
-				case 'A':
-					SetAPDULogging(true);
-					break;
-				case 't':
-				case 'T':
-					decodeTLV = true;
-					break;
-				case '1':
-					PSENum = 1;
-					break;
-				case '2':
-					PSENum = 2;
-					break;
-				default:
-					PrintAndLog("Unknown parameter '%c'", param_getchar_indx(cmd, 1, cmdp));
-					return 1;
-		}
-		cmdp++;
-	}
+	CLIParserInit("hf 14a pse", 
+		"Executes PSE/PPSE select command. It returns list of applet on the card:\n", 
+		"Usage:\n\thf emv pse -s1 -> select, get pse\n\thf emv pse -st2 -> select, get ppse, show result in TLV\n");
+
+	void* argtable[] = {
+		arg_param_begin,
+		arg_lit0("sS",  "select",  "activate field and select card"),
+		arg_lit0("kK",  "keep",    "keep field ON for next command"),
+		arg_lit0("1",   "pse",     "pse (1PAY.SYS.DDF01) mode"),
+		arg_lit0("2",   "ppse",    "ppse (2PAY.SYS.DDF01) mode (default mode)"),
+		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
+		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, true);
+	
+	bool activateField = arg_get_lit(1);
+	bool leaveSignalON = arg_get_lit(2);
+	uint8_t PSENum = 2;
+	if (arg_get_lit(3))
+		PSENum = 1;
+	if (arg_get_lit(4))
+		PSENum = 2;
+	bool APDULogging = arg_get_lit(5);
+	bool decodeTLV = arg_get_lit(6);
+	CLIParserFree();	
+	
+	SetAPDULogging(APDULogging);
 	
 	// exec
 	uint8_t buf[APDU_RES_LEN] = {0};
@@ -193,6 +156,26 @@ int CmdHFEMVPPSE(const char *cmd) {
 	return 0;
 }
 
+int CmdHFEMVGPO(const char *cmd) {
+
+}
+
+int CmdHFEMVReadRecord(const char *cmd) {
+
+}
+
+int CmdHFEMVAC(const char *cmd) {
+
+}
+
+int CmdHFEMVGenerateChallenge(const char *cmd) {
+
+}
+
+int CmdHFEMVInternalAuthenticate(const char *cmd) {
+
+}
+
 int UsageCmdHFEMVExec(void) {
 	PrintAndLog("HELP :  Executes EMV contactless transaction:\n");
 	PrintAndLog("Usage:  hf emv exec [-s][-a][-t][-f][-v][-c][-x][-g]\n");

From 626e650fbfba3cf2fb8adfa0a256466f9a2fd479 Mon Sep 17 00:00:00 2001
From: merlokk <olegmsn@gmail.com>
Date: Tue, 11 Sep 2018 17:02:22 +0300
Subject: [PATCH 06/28] added new functions to `hf emv`

---
 client/emv/cmdemv.c | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index e621038e..a4018649 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -158,22 +158,27 @@ int CmdHFEMVPPSE(const char *cmd) {
 
 int CmdHFEMVGPO(const char *cmd) {
 
+	return 0;
 }
 
 int CmdHFEMVReadRecord(const char *cmd) {
 
+	return 0;
 }
 
 int CmdHFEMVAC(const char *cmd) {
 
+	return 0;
 }
 
 int CmdHFEMVGenerateChallenge(const char *cmd) {
 
+	return 0;
 }
 
 int CmdHFEMVInternalAuthenticate(const char *cmd) {
 
+	return 0;
 }
 
 int UsageCmdHFEMVExec(void) {
@@ -733,12 +738,17 @@ int CmdHFEMVTest(const char *cmd) {
 
 int CmdHelp(const char *Cmd);
 static command_t CommandTable[] =  {
-	{"help",	CmdHelp,		1,	"This help"},
-	{"exec",	CmdHFEMVExec,	0,	"Executes EMV contactless transaction."},
-	{"pse",		CmdHFEMVPPSE,	0,	"Execute PPSE. It selects 2PAY.SYS.DDF01 or 1PAY.SYS.DDF01 directory."},
-	{"search",	CmdHFEMVSearch,	0,	"Try to select all applets from applets list and print installed applets."},
-	{"select",	CmdHFEMVSelect,	0,	"Select applet."},
-	{"test",	CmdHFEMVTest,	0,	"Crypto logic test."},
+	{"help",		CmdHelp,						1,	"This help"},
+	{"exec",		CmdHFEMVExec,					0,	"Executes EMV contactless transaction."},
+	{"pse",			CmdHFEMVPPSE,					0,	"Execute PPSE. It selects 2PAY.SYS.DDF01 or 1PAY.SYS.DDF01 directory."},
+	{"search",		CmdHFEMVSearch,					0,	"Try to select all applets from applets list and print installed applets."},
+	{"select",		CmdHFEMVSelect,					0,	"Select applet."},
+	{"gpo",			CmdHFEMVGPO,					0,	"Execute GetProcessingOptions."},
+	{"readrec",		CmdHFEMVReadRecord,				0,	"Read files from card."},
+	{"genac",		CmdHFEMVAC,						0,	"Generate ApplicationCryptogram."},
+	{"challenge",	CmdHFEMVGenerateChallenge,		0,	"Generate challenge."},
+	{"intauth",		CmdHFEMVInternalAuthenticate,	0,	"Internal authentication."},
+	{"test",		CmdHFEMVTest,	0,	"Crypto logic test."},
 	{NULL, NULL, 0, NULL}
 };
 

From cd2f1acd1b4e1458422462f9584a06900f8f3719 Mon Sep 17 00:00:00 2001
From: merlokk <olegmsn@gmail.com>
Date: Wed, 12 Sep 2018 19:51:20 +0300
Subject: [PATCH 07/28] `hf emv gpo` works

---
 client/emv/cmdemv.c | 130 +++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 128 insertions(+), 2 deletions(-)

diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index a4018649..496b3cb8 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -37,7 +37,7 @@ int CmdHFEMVSelect(const char *cmd) {
 	bool leaveSignalON = arg_get_lit(2);
 	bool APDULogging = arg_get_lit(3);
 	bool decodeTLV = arg_get_lit(4);
-	CLIGetStrBLessWithReturn(5, data, &datalen, 0);
+	CLIGetStrWithReturn(5, data, &datalen);
 	CLIParserFree();
 	
 	SetAPDULogging(APDULogging);
@@ -107,7 +107,6 @@ int CmdHFEMVSearch(const char *cmd) {
 
 int CmdHFEMVPPSE(const char *cmd) {
 	
-	
 	CLIParserInit("hf 14a pse", 
 		"Executes PSE/PPSE select command. It returns list of applet on the card:\n", 
 		"Usage:\n\thf emv pse -s1 -> select, get pse\n\thf emv pse -st2 -> select, get ppse, show result in TLV\n");
@@ -157,11 +156,138 @@ int CmdHFEMVPPSE(const char *cmd) {
 }
 
 int CmdHFEMVGPO(const char *cmd) {
+	uint8_t data[APDU_RES_LEN] = {0};
+	int datalen = 0;
+
+	CLIParserInit("hf 14a gpo", 
+		"Executes Get Processing Options command. It returns data in TLV format (0x77 - format2) or plain (0x80 - format1) formats.\nNeeds a bank applet to be selected.\n", 
+		"Usage:\n\thf emv gpo -k -> select, execute GPO\n\thf emv gpo -st 01020304 -> select, execute GPO with 4-byte PDOL data, show result in TLV\n");
+
+	void* argtable[] = {
+		arg_param_begin,
+		arg_lit0("kK",  "keep",    "keep field ON for next command"),
+		arg_lit0("pP",  "params",  "load parameters for PDOL making from `emv/defparams.json` file (by default uses default parameters) (NOT WORK!!!)"),
+		arg_lit0("mM",  "make",    "make PDOLdata from PDOL (tag 9F38) and parameters (NOT WORK!!!)"),
+		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
+		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
+		arg_str0(NULL,  NULL,      "<HEX PDOLdata/PDOL>", NULL),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, true);
+	
+	bool leaveSignalON = arg_get_lit(1);
+	bool paramsLoadFromFile = arg_get_lit(2);
+	bool dataMakeFromPDOL = arg_get_lit(3);
+	bool APDULogging = arg_get_lit(4);
+	bool decodeTLV = arg_get_lit(5);
+	CLIGetStrWithReturn(6, data, &datalen);
+	CLIParserFree();	
+	
+	SetAPDULogging(APDULogging);
+	
+	// Init TLV tree
+	const char *alr = "Root terminal TLV tree";
+	struct tlvdb *tlvRoot = tlvdb_fixed(1, strlen(alr), (const unsigned char *)alr);
+	
+	// calc PDOL
+	struct tlv *pdol_data_tlv = NULL;
+	struct tlv data_tlv = {
+		.tag = 0x83,  //was 01
+		.len = datalen,
+		.value = (uint8_t *)data,
+	};
+	if (dataMakeFromPDOL) {
+		// TODO
+		PrintAndLog("Make PDOL data not implemented!");
+		if (paramsLoadFromFile) {
+		};
+/*		pdol_data_tlv = dol_process(tlvdb_get(tlvRoot, 0x9f38, NULL), tlvRoot, 0x83);
+		if (!pdol_data_tlv){
+			PrintAndLog("ERROR: can't create PDOL TLV.");
+			tlvdb_free(tlvRoot);
+			return 4;
+		}*/
+		return 0;
+	} else {
+		pdol_data_tlv = &data_tlv;
+	}
+
+	size_t pdol_data_tlv_data_len = 0;
+	unsigned char *pdol_data_tlv_data = tlv_encode(pdol_data_tlv, &pdol_data_tlv_data_len);
+	if (!pdol_data_tlv_data) {
+		PrintAndLog("ERROR: can't create PDOL data.");
+		tlvdb_free(tlvRoot);
+		return 4;
+	}
+	PrintAndLog("PDOL data[%d]: %s", pdol_data_tlv_data_len, sprint_hex(pdol_data_tlv_data, pdol_data_tlv_data_len));
+	
+	// exec
+	uint8_t buf[APDU_RES_LEN] = {0};
+	size_t len = 0;
+	uint16_t sw = 0;
+	int res = EMVGPO(leaveSignalON, pdol_data_tlv_data, pdol_data_tlv_data_len, buf, sizeof(buf), &len, &sw, tlvRoot);
+	
+	free(pdol_data_tlv_data);
+	tlvdb_free(tlvRoot);
+	
+	if (sw)
+		PrintAndLog("APDU response status: %04x - %s", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); 
+
+	if (res)
+		return res;
+	
+	if (decodeTLV)
+		TLVPrintFromBuffer(buf, len);
 
 	return 0;
 }
 
 int CmdHFEMVReadRecord(const char *cmd) {
+	uint8_t data[APDU_RES_LEN] = {0};
+	int datalen = 0;
+
+	CLIParserInit("hf 14a readrec", 
+		"Executes Read Record command. It returns data in TLV format.\nNeeds a bank applet to be selected and sometimes needs GPO to be executed.\n", 
+		"Usage:\n\thf emv readrec -k -> select, get pse\n\thf emv readrec -st2 -> select, get ppse, show result in TLV\n");
+
+	void* argtable[] = {
+		arg_param_begin,
+		arg_lit0("kK",  "keep",    "keep field ON for next command"),
+		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
+		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
+		arg_str0(NULL,  NULL,      "<SFI 1byte HEX><SFIrec 1byte HEX>", NULL),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, true);
+	
+	bool leaveSignalON = arg_get_lit(1);
+	bool APDULogging = arg_get_lit(2);
+	bool decodeTLV = arg_get_lit(3);
+	CLIGetStrWithReturn(4, data, &datalen);
+	CLIParserFree();
+	
+	if (datalen != 2) {
+		PrintAndLog("ERROR: Command needs to have 2 bytes of data");
+		return 1;
+	}
+	
+	SetAPDULogging(APDULogging);
+		
+	// exec
+	uint8_t buf[APDU_RES_LEN] = {0};
+	size_t len = 0;
+	uint16_t sw = 0;
+	int res = EMVReadRecord(leaveSignalON, data[0], data[1], buf, sizeof(buf), &len, &sw, NULL);
+	
+	if (sw)
+		PrintAndLog("APDU response status: %04x - %s", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); 
+
+	if (res)
+		return res;
+	
+	
+	if (decodeTLV)
+		TLVPrintFromBuffer(buf, len);
 
 	return 0;
 }

From ab2d91f86dbe81405a9a2e8600f326ebcaa9b0f8 Mon Sep 17 00:00:00 2001
From: merlokk <olegmsn@gmail.com>
Date: Wed, 12 Sep 2018 20:08:16 +0300
Subject: [PATCH 08/28] `hf emv readrec` works and some changes in help

---
 client/emv/cmdemv.c | 33 +++++++++++++++++++++++++++------
 1 file changed, 27 insertions(+), 6 deletions(-)

diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index 496b3cb8..030eaa0b 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -155,13 +155,16 @@ int CmdHFEMVPPSE(const char *cmd) {
 	return 0;
 }
 
+#define TLV_ADD(tag, value)( tlvdb_add(tlvRoot, tlvdb_fixed(tag, sizeof(value) - 1, (const unsigned char *)value)) )
+
 int CmdHFEMVGPO(const char *cmd) {
 	uint8_t data[APDU_RES_LEN] = {0};
 	int datalen = 0;
 
 	CLIParserInit("hf 14a gpo", 
-		"Executes Get Processing Options command. It returns data in TLV format (0x77 - format2) or plain (0x80 - format1) formats.\nNeeds a bank applet to be selected.\n", 
-		"Usage:\n\thf emv gpo -k -> select, execute GPO\n\thf emv gpo -st 01020304 -> select, execute GPO with 4-byte PDOL data, show result in TLV\n");
+		"Executes Get Processing Options command. It returns data in TLV format (0x77 - format2) or plain format (0x80 - format1).\nNeeds a EMV applet to be selected.", 
+		"Usage:\n\thf emv gpo -k -> execute GPO\n\thf emv gpo -st 01020304 -> execute GPO with 4-byte PDOL data, show result in TLV\n"); 
+		// here need to add load params from file and gen pdol
 
 	void* argtable[] = {
 		arg_param_begin,
@@ -199,6 +202,25 @@ int CmdHFEMVGPO(const char *cmd) {
 	if (dataMakeFromPDOL) {
 		// TODO
 		PrintAndLog("Make PDOL data not implemented!");
+
+		//9F02:(Amount, authorized (Numeric)) len:6
+		TLV_ADD(0x9F02, "\x00\x00\x00\x00\x01\x00");
+		//9F1A:(Terminal Country Code) len:2
+		TLV_ADD(0x9F1A, "ru");
+		//5F2A:(Transaction Currency Code) len:2
+		// USD 840, EUR 978, RUR 810, RUB 643, RUR 810(old), UAH 980, AZN 031, n/a 999
+		TLV_ADD(0x5F2A, "\x09\x80");
+		//9A:(Transaction Date) len:3
+		TLV_ADD(0x9A,   "\x00\x00\x00");
+		//9C:(Transaction Type) len:1   |  00 => Goods and service #01 => Cash
+		TLV_ADD(0x9C,   "\x00");
+		// 9F37 Unpredictable Number len:4
+		TLV_ADD(0x9F37, "\x01\x02\x03\x04");
+		// 9F6A Unpredictable Number (MSD for UDOL) len:4
+		TLV_ADD(0x9F6A, "\x01\x02\x03\x04");
+		//9F66:(Terminal Transaction Qualifiers (TTQ)) len:4
+		TLV_ADD(0x9F66, "\x26\x00\x00\x00"); // qVSDC
+
 		if (paramsLoadFromFile) {
 		};
 /*		pdol_data_tlv = dol_process(tlvdb_get(tlvRoot, 0x9f38, NULL), tlvRoot, 0x83);
@@ -247,15 +269,15 @@ int CmdHFEMVReadRecord(const char *cmd) {
 	int datalen = 0;
 
 	CLIParserInit("hf 14a readrec", 
-		"Executes Read Record command. It returns data in TLV format.\nNeeds a bank applet to be selected and sometimes needs GPO to be executed.\n", 
-		"Usage:\n\thf emv readrec -k -> select, get pse\n\thf emv readrec -st2 -> select, get ppse, show result in TLV\n");
+		"Executes Read Record command. It returns data in TLV format.\nNeeds a bank applet to be selected and sometimes needs GPO to be executed.", 
+		"Usage:\n\thf emv readrec -k 0101 -> read file SFI=01, SFIrec=01\n\thf emv readrec -kt 0201-> read file 0201 and show result in TLV\n");
 
 	void* argtable[] = {
 		arg_param_begin,
 		arg_lit0("kK",  "keep",    "keep field ON for next command"),
 		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
 		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
-		arg_str0(NULL,  NULL,      "<SFI 1byte HEX><SFIrec 1byte HEX>", NULL),
+		arg_str1(NULL,  NULL,      "<SFI 1byte HEX><SFIrec 1byte HEX>", NULL),
 		arg_param_end
 	};
 	CLIExecWithReturn(cmd, argtable, true);
@@ -326,7 +348,6 @@ int UsageCmdHFEMVExec(void) {
 	return 0;
 }
 
-#define TLV_ADD(tag, value)( tlvdb_add(tlvRoot, tlvdb_fixed(tag, sizeof(value) - 1, (const unsigned char *)value)) )
 #define dreturn(n) {free(pdol_data_tlv);tlvdb_free(tlvSelect);tlvdb_free(tlvRoot);DropField();return n;}
 
 int CmdHFEMVExec(const char *cmd) {

From 8ffdccffa0e7ec45c785495116b77b3f0b85bd49 Mon Sep 17 00:00:00 2001
From: merlokk <olegmsn@gmail.com>
Date: Wed, 12 Sep 2018 20:20:27 +0300
Subject: [PATCH 09/28] `hf emv challenge` works

---
 client/emv/cmdemv.c | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index 030eaa0b..3114c46a 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -321,6 +321,41 @@ int CmdHFEMVAC(const char *cmd) {
 
 int CmdHFEMVGenerateChallenge(const char *cmd) {
 
+	CLIParserInit("hf 14a challenge", 
+		"Executes Generate Challenge command. It returns 4-byte random number from card:\n", 
+		"Usage:\n\thf emv challenge -> get challenge\n\thf emv challenge -k -> get challenge, keep fileld ON\n");
+
+	void* argtable[] = {
+		arg_param_begin,
+		arg_lit0("kK",  "keep",    "keep field ON for next command"),
+		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, true);
+	
+	bool leaveSignalON = arg_get_lit(1);
+	bool APDULogging = arg_get_lit(2);
+	CLIParserFree();	
+	
+	SetAPDULogging(APDULogging);
+	
+	// exec
+	uint8_t buf[APDU_RES_LEN] = {0};
+	size_t len = 0;
+	uint16_t sw = 0;
+	int res = EMVGenerateChallenge(leaveSignalON, buf, sizeof(buf), &len, &sw, NULL);
+	
+	if (sw)
+		PrintAndLog("APDU response status: %04x - %s", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); 
+
+	if (res)
+		return res;
+
+	PrintAndLog("Challenge: %s", sprint_hex(buf, len));
+	
+	if (len != 4 && len != 8)
+		PrintAndLog("WARNING: length of challenge must be 4 or 8, but it %d", len);
+	
 	return 0;
 }
 

From ad23886a6f1c5088d4be2eeb97a029ca8db81b70 Mon Sep 17 00:00:00 2001
From: merlokk <olegmsn@gmail.com>
Date: Wed, 12 Sep 2018 20:22:24 +0300
Subject: [PATCH 10/28] small fix

---
 client/emv/cmdemv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index 3114c46a..eafea2c5 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -322,7 +322,7 @@ int CmdHFEMVAC(const char *cmd) {
 int CmdHFEMVGenerateChallenge(const char *cmd) {
 
 	CLIParserInit("hf 14a challenge", 
-		"Executes Generate Challenge command. It returns 4-byte random number from card:\n", 
+		"Executes Generate Challenge command. It returns 4 or 8-byte random number from card:\n", 
 		"Usage:\n\thf emv challenge -> get challenge\n\thf emv challenge -k -> get challenge, keep fileld ON\n");
 
 	void* argtable[] = {

From 11a78e048cf57efefe1ef504af347e34a54a0490 Mon Sep 17 00:00:00 2001
From: merlokk <olegmsn@gmail.com>
Date: Thu, 13 Sep 2018 18:38:03 +0300
Subject: [PATCH 11/28] added `intauth` and `genac` commands. works.

---
 client/emv/cmdemv.c | 112 ++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 107 insertions(+), 5 deletions(-)

diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index eafea2c5..1d30fc83 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -1,5 +1,5 @@
 //-----------------------------------------------------------------------------
-// Copyright (C) 2017 Merlok
+// Copyright (C) 2017, 2018 Merlok
 //
 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
 // at your option, any later version. See the LICENSE.txt file for the text of
@@ -195,7 +195,7 @@ int CmdHFEMVGPO(const char *cmd) {
 	// calc PDOL
 	struct tlv *pdol_data_tlv = NULL;
 	struct tlv data_tlv = {
-		.tag = 0x83,  //was 01
+		.tag = 0x01,
 		.len = datalen,
 		.value = (uint8_t *)data,
 	};
@@ -315,8 +315,67 @@ int CmdHFEMVReadRecord(const char *cmd) {
 }
 
 int CmdHFEMVAC(const char *cmd) {
+	uint8_t data[APDU_RES_LEN] = {0};
+	int datalen = 0;
 
-	return 0;
+	CLIParserInit("hf 14a genac", 
+		"Generate Application Cryptogram command. It returns data in TLV format .\nNeeds a EMV applet to be selected and GPO to be executed.", 
+		"Usage:\n\thf emv genac -k 0102-> execute GPO with 2-byte CDOLdata and keep field ON after command\n\thf emv genac -t 01020304 -> execute GPO with 4-byte CDOL data, show result in TLV\n"); 
+
+	void* argtable[] = {
+		arg_param_begin,
+		arg_lit0("kK",  "keep",    "keep field ON for next command"),
+		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
+		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
+		arg_str1(NULL,  NULL,      "<HEX CDOLdata>", NULL),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, false);
+	
+	bool leaveSignalON = arg_get_lit(1);
+	bool APDULogging = arg_get_lit(2);
+	bool decodeTLV = arg_get_lit(3);
+	CLIGetStrWithReturn(4, data, &datalen);
+	CLIParserFree();	
+	
+	SetAPDULogging(APDULogging);
+	
+	// Init TLV tree
+	const char *alr = "Root terminal TLV tree";
+	struct tlvdb *tlvRoot = tlvdb_fixed(1, strlen(alr), (const unsigned char *)alr);
+	
+	// calc CDOL
+	struct tlv *cdol_data_tlv = NULL;
+//	struct tlv *cdol_data_tlv = dol_process(tlvdb_get(tlvRoot, 0x8c, NULL), tlvRoot, 0x01); // 0x01 - dummy tag
+	struct tlv data_tlv = {
+		.tag = 0x01,
+		.len = datalen,
+		.value = (uint8_t *)data,
+	};	
+	cdol_data_tlv = &data_tlv;
+	PrintAndLog("CDOL data[%d]: %s", cdol_data_tlv->len, sprint_hex(cdol_data_tlv->value, cdol_data_tlv->len));
+	
+	// exec
+	uint8_t buf[APDU_RES_LEN] = {0};
+	size_t len = 0;
+	uint16_t sw = 0;
+// EMVAC_TC + EMVAC_CDAREQ --- to get SDAD
+//	res = EMVAC(true, (TrType == TT_CDA) ? EMVAC_TC + EMVAC_CDAREQ : EMVAC_TC, (uint8_t *)cdol_data_tlv->value, cdol_data_tlv->len, buf, sizeof(buf), &len, &sw, tlvRoot);
+	int res = EMVAC(leaveSignalON, EMVAC_TC, (uint8_t *)cdol_data_tlv->value, cdol_data_tlv->len, buf, sizeof(buf), &len, &sw, tlvRoot);
+	
+//	free(cdol_data_tlv);
+	tlvdb_free(tlvRoot);
+	
+	if (sw)
+		PrintAndLog("APDU response status: %04x - %s", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); 
+
+	if (res)
+		return res;
+	
+	if (decodeTLV)
+		TLVPrintFromBuffer(buf, len);
+
+	return 0;	
 }
 
 int CmdHFEMVGenerateChallenge(const char *cmd) {
@@ -360,8 +419,51 @@ int CmdHFEMVGenerateChallenge(const char *cmd) {
 }
 
 int CmdHFEMVInternalAuthenticate(const char *cmd) {
+	uint8_t data[APDU_RES_LEN] = {0};
+	int datalen = 0;
 
-	return 0;
+	CLIParserInit("hf 14a intauth", 
+		"Generate Internal Authenticate command. Usually needs 4-byte random number. It returns data in TLV format .\nNeeds a EMV applet to be selected and GPO to be executed.", 
+		"Usage:\n\thf emv intauth -k 01020304 -> execute Internal Authenticate with 4-byte DDOLdata and keep field ON after command\n"
+			"\thf emv intauth -t 01020304 -> execute Internal Authenticate with 4-byte DDOL data, show result in TLV\n"); 
+
+	void* argtable[] = {
+		arg_param_begin,
+		arg_lit0("kK",  "keep",    "keep field ON for next command"),
+		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
+		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
+		arg_str1(NULL,  NULL,      "<HEX DDOLdata>", NULL),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, false);
+	
+	bool leaveSignalON = arg_get_lit(1);
+	bool APDULogging = arg_get_lit(2);
+	bool decodeTLV = arg_get_lit(3);
+	CLIGetStrWithReturn(4, data, &datalen);
+	CLIParserFree();	
+	
+	SetAPDULogging(APDULogging);
+	
+	// DDOL
+	PrintAndLog("DDOL data[%d]: %s", datalen, sprint_hex(data, datalen));
+	
+	// exec
+	uint8_t buf[APDU_RES_LEN] = {0};
+	size_t len = 0;
+	uint16_t sw = 0;
+	int res = EMVInternalAuthenticate(leaveSignalON, data, datalen, buf, sizeof(buf), &len, &sw, NULL);
+	
+	if (sw)
+		PrintAndLog("APDU response status: %04x - %s", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); 
+
+	if (res)
+		return res;
+	
+	if (decodeTLV)
+		TLVPrintFromBuffer(buf, len);
+
+	return 0;	
 }
 
 int UsageCmdHFEMVExec(void) {
@@ -930,7 +1032,7 @@ static command_t CommandTable[] =  {
 	{"genac",		CmdHFEMVAC,						0,	"Generate ApplicationCryptogram."},
 	{"challenge",	CmdHFEMVGenerateChallenge,		0,	"Generate challenge."},
 	{"intauth",		CmdHFEMVInternalAuthenticate,	0,	"Internal authentication."},
-	{"test",		CmdHFEMVTest,	0,	"Crypto logic test."},
+	{"test",		CmdHFEMVTest,					0,	"Crypto logic test."},
 	{NULL, NULL, 0, NULL}
 };
 

From 48c32f043677bfb614f368617a3255ee976d161d Mon Sep 17 00:00:00 2001
From: merlokk <olegmsn@gmail.com>
Date: Thu, 13 Sep 2018 18:44:20 +0300
Subject: [PATCH 12/28] added CDA transaction to `hf emv genac`

---
 client/emv/cmdemv.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index 1d30fc83..bc908574 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -320,11 +320,13 @@ int CmdHFEMVAC(const char *cmd) {
 
 	CLIParserInit("hf 14a genac", 
 		"Generate Application Cryptogram command. It returns data in TLV format .\nNeeds a EMV applet to be selected and GPO to be executed.", 
-		"Usage:\n\thf emv genac -k 0102-> execute GPO with 2-byte CDOLdata and keep field ON after command\n\thf emv genac -t 01020304 -> execute GPO with 4-byte CDOL data, show result in TLV\n"); 
+		"Usage:\n\thf emv genac -k 0102 -> execute GPO with 2-byte CDOLdata and keep field ON after command\n"
+			"\thf emv genac -t 01020304 -> execute GPO with 4-byte CDOL data, show result in TLV\n"); 
 
 	void* argtable[] = {
 		arg_param_begin,
 		arg_lit0("kK",  "keep",    "keep field ON for next command"),
+		arg_lit0("cC",  "cda",     "executes CDA transaction. Needs to get SDAD in results."),
 		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
 		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
 		arg_str1(NULL,  NULL,      "<HEX CDOLdata>", NULL),
@@ -333,9 +335,10 @@ int CmdHFEMVAC(const char *cmd) {
 	CLIExecWithReturn(cmd, argtable, false);
 	
 	bool leaveSignalON = arg_get_lit(1);
-	bool APDULogging = arg_get_lit(2);
-	bool decodeTLV = arg_get_lit(3);
-	CLIGetStrWithReturn(4, data, &datalen);
+	bool trTypeCDA = arg_get_lit(2);
+	bool APDULogging = arg_get_lit(3);
+	bool decodeTLV = arg_get_lit(4);
+	CLIGetStrWithReturn(5, data, &datalen);
 	CLIParserFree();	
 	
 	SetAPDULogging(APDULogging);
@@ -359,9 +362,7 @@ int CmdHFEMVAC(const char *cmd) {
 	uint8_t buf[APDU_RES_LEN] = {0};
 	size_t len = 0;
 	uint16_t sw = 0;
-// EMVAC_TC + EMVAC_CDAREQ --- to get SDAD
-//	res = EMVAC(true, (TrType == TT_CDA) ? EMVAC_TC + EMVAC_CDAREQ : EMVAC_TC, (uint8_t *)cdol_data_tlv->value, cdol_data_tlv->len, buf, sizeof(buf), &len, &sw, tlvRoot);
-	int res = EMVAC(leaveSignalON, EMVAC_TC, (uint8_t *)cdol_data_tlv->value, cdol_data_tlv->len, buf, sizeof(buf), &len, &sw, tlvRoot);
+	int res = EMVAC(leaveSignalON, (trTypeCDA) ? EMVAC_TC + EMVAC_CDAREQ : EMVAC_TC, (uint8_t *)cdol_data_tlv->value, cdol_data_tlv->len, buf, sizeof(buf), &len, &sw, tlvRoot);
 	
 //	free(cdol_data_tlv);
 	tlvdb_free(tlvRoot);

From 02ab5afa8701ecc9434e7d8c30850d0d4ec5903f Mon Sep 17 00:00:00 2001
From: merlokk <olegmsn@gmail.com>
Date: Thu, 13 Sep 2018 19:53:14 +0300
Subject: [PATCH 13/28] add terminal decision to `genac` and small fixes

---
 client/cliparser/cliparser.h |  2 +-
 client/emv/cmdemv.c          | 58 ++++++++++++++++++++++++------------
 2 files changed, 40 insertions(+), 20 deletions(-)

diff --git a/client/cliparser/cliparser.h b/client/cliparser/cliparser.h
index 9d83a95f..169f102e 100644
--- a/client/cliparser/cliparser.h
+++ b/client/cliparser/cliparser.h
@@ -19,7 +19,7 @@
 #define arg_get_lit(n)(((struct arg_lit*)argtable[n])->count)
 #define arg_get_int(n)(((struct arg_int*)argtable[n])->ival[0])
 #define arg_get_str(n)((struct arg_str*)argtable[n])
-#define arg_get_str_len(n)(strlen(((struct arg_int*)argtable[n])->ival[0]))
+#define arg_get_str_len(n)(strlen(((struct arg_str*)argtable[n])->sval[0]))
 
 #define CLIExecWithReturn(cmd, atbl, ifempty) if (CLIParserParseString(cmd, atbl, arg_getsize(atbl), ifempty)){CLIParserFree();return 0;}
 #define CLIGetStrBLessWithReturn(paramnum, data, datalen, delta) if (CLIParamHexToBuf(arg_get_str(paramnum), data, sizeof(data) - (delta), datalen)) {CLIParserFree();return 1;}
diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index bc908574..571e1880 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -18,7 +18,7 @@ int CmdHFEMVSelect(const char *cmd) {
 	int datalen = 0;
 
 
-	CLIParserInit("hf 14a select", 
+	CLIParserInit("hf emv select", 
 		"Executes select applet command", 
 		"Usage:\n\thf emv select -s a00000000101 -> select card, select applet\n\thf emv select -st a00000000101 -> select card, select applet, show result in TLV\n");
 
@@ -62,7 +62,7 @@ int CmdHFEMVSelect(const char *cmd) {
 
 int CmdHFEMVSearch(const char *cmd) {
 
-	CLIParserInit("hf 14a select", 
+	CLIParserInit("hf emv search", 
 		"Tries to select all applets from applet list:\n", 
 		"Usage:\n\thf emv search -s -> select card and search\n\thf emv search -st -> select card, search and show result in TLV\n");
 
@@ -107,7 +107,7 @@ int CmdHFEMVSearch(const char *cmd) {
 
 int CmdHFEMVPPSE(const char *cmd) {
 	
-	CLIParserInit("hf 14a pse", 
+	CLIParserInit("hf emv pse", 
 		"Executes PSE/PPSE select command. It returns list of applet on the card:\n", 
 		"Usage:\n\thf emv pse -s1 -> select, get pse\n\thf emv pse -st2 -> select, get ppse, show result in TLV\n");
 
@@ -161,7 +161,7 @@ int CmdHFEMVGPO(const char *cmd) {
 	uint8_t data[APDU_RES_LEN] = {0};
 	int datalen = 0;
 
-	CLIParserInit("hf 14a gpo", 
+	CLIParserInit("hf emv gpo", 
 		"Executes Get Processing Options command. It returns data in TLV format (0x77 - format2) or plain format (0x80 - format1).\nNeeds a EMV applet to be selected.", 
 		"Usage:\n\thf emv gpo -k -> execute GPO\n\thf emv gpo -st 01020304 -> execute GPO with 4-byte PDOL data, show result in TLV\n"); 
 		// here need to add load params from file and gen pdol
@@ -268,7 +268,7 @@ int CmdHFEMVReadRecord(const char *cmd) {
 	uint8_t data[APDU_RES_LEN] = {0};
 	int datalen = 0;
 
-	CLIParserInit("hf 14a readrec", 
+	CLIParserInit("hf emv readrec", 
 		"Executes Read Record command. It returns data in TLV format.\nNeeds a bank applet to be selected and sometimes needs GPO to be executed.", 
 		"Usage:\n\thf emv readrec -k 0101 -> read file SFI=01, SFIrec=01\n\thf emv readrec -kt 0201-> read file 0201 and show result in TLV\n");
 
@@ -318,27 +318,47 @@ int CmdHFEMVAC(const char *cmd) {
 	uint8_t data[APDU_RES_LEN] = {0};
 	int datalen = 0;
 
-	CLIParserInit("hf 14a genac", 
+	CLIParserInit("hf emv genac", 
 		"Generate Application Cryptogram command. It returns data in TLV format .\nNeeds a EMV applet to be selected and GPO to be executed.", 
-		"Usage:\n\thf emv genac -k 0102 -> execute GPO with 2-byte CDOLdata and keep field ON after command\n"
-			"\thf emv genac -t 01020304 -> execute GPO with 4-byte CDOL data, show result in TLV\n"); 
+		"Usage:\n\thf emv genac -k 0102 -> generate AC with 2-byte CDOLdata and keep field ON after command\n"
+			"\thf emv genac -t 01020304 -> generate AC with 4-byte CDOL data, show result in TLV\n"
+			"\thf emv genac -Daac 01020304 -> generate AC with 4-byte CDOL data and terminal decision 'declined'\n"); 
 
 	void* argtable[] = {
 		arg_param_begin,
-		arg_lit0("kK",  "keep",    "keep field ON for next command"),
-		arg_lit0("cC",  "cda",     "executes CDA transaction. Needs to get SDAD in results."),
-		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
-		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
-		arg_str1(NULL,  NULL,      "<HEX CDOLdata>", NULL),
+		arg_lit0("kK",  "keep",     "keep field ON for next command"),
+		arg_lit0("cC",  "cda",      "executes CDA transaction. Needs to get SDAD in results."),
+		arg_str0("dD",  "decision", "<aac|tc|arqc>", "Terminal decision. aac - declined, tc - approved, arqc - online authorisation requested"),
+		arg_lit0("aA",  "apdu",     "show APDU reqests and responses"),
+		arg_lit0("tT",  "tlv",      "TLV decode results of selected applets"),
+		arg_str1(NULL,  NULL,       "<HEX CDOLdata>", NULL),
 		arg_param_end
 	};
 	CLIExecWithReturn(cmd, argtable, false);
 	
 	bool leaveSignalON = arg_get_lit(1);
 	bool trTypeCDA = arg_get_lit(2);
-	bool APDULogging = arg_get_lit(3);
-	bool decodeTLV = arg_get_lit(4);
-	CLIGetStrWithReturn(5, data, &datalen);
+	uint8_t termDecision = 0xff;
+	if (arg_get_str_len(3)) {
+		if (!strncmp(arg_get_str(3)->sval[0], "aac", 4))
+			termDecision = EMVAC_AAC;
+		if (!strncmp(arg_get_str(3)->sval[0], "tc", 4))
+			termDecision = EMVAC_TC;
+		if (!strncmp(arg_get_str(3)->sval[0], "arqc", 4))
+			termDecision = EMVAC_ARQC;
+
+		if (termDecision == 0xff) {
+			PrintAndLog("ERROR: can't find terminal decision '%s'", arg_get_str(3)->sval[0]);
+			return 1;
+		}
+	} else {
+		termDecision = EMVAC_TC;
+	}
+	if (trTypeCDA)
+		termDecision = termDecision | EMVAC_CDAREQ;
+	bool APDULogging = arg_get_lit(4);
+	bool decodeTLV = arg_get_lit(5);
+	CLIGetStrWithReturn(6, data, &datalen);
 	CLIParserFree();	
 	
 	SetAPDULogging(APDULogging);
@@ -362,7 +382,7 @@ int CmdHFEMVAC(const char *cmd) {
 	uint8_t buf[APDU_RES_LEN] = {0};
 	size_t len = 0;
 	uint16_t sw = 0;
-	int res = EMVAC(leaveSignalON, (trTypeCDA) ? EMVAC_TC + EMVAC_CDAREQ : EMVAC_TC, (uint8_t *)cdol_data_tlv->value, cdol_data_tlv->len, buf, sizeof(buf), &len, &sw, tlvRoot);
+	int res = EMVAC(leaveSignalON, termDecision, (uint8_t *)cdol_data_tlv->value, cdol_data_tlv->len, buf, sizeof(buf), &len, &sw, tlvRoot);
 	
 //	free(cdol_data_tlv);
 	tlvdb_free(tlvRoot);
@@ -381,7 +401,7 @@ int CmdHFEMVAC(const char *cmd) {
 
 int CmdHFEMVGenerateChallenge(const char *cmd) {
 
-	CLIParserInit("hf 14a challenge", 
+	CLIParserInit("hf emv challenge", 
 		"Executes Generate Challenge command. It returns 4 or 8-byte random number from card:\n", 
 		"Usage:\n\thf emv challenge -> get challenge\n\thf emv challenge -k -> get challenge, keep fileld ON\n");
 
@@ -423,7 +443,7 @@ int CmdHFEMVInternalAuthenticate(const char *cmd) {
 	uint8_t data[APDU_RES_LEN] = {0};
 	int datalen = 0;
 
-	CLIParserInit("hf 14a intauth", 
+	CLIParserInit("hf emv intauth", 
 		"Generate Internal Authenticate command. Usually needs 4-byte random number. It returns data in TLV format .\nNeeds a EMV applet to be selected and GPO to be executed.", 
 		"Usage:\n\thf emv intauth -k 01020304 -> execute Internal Authenticate with 4-byte DDOLdata and keep field ON after command\n"
 			"\thf emv intauth -t 01020304 -> execute Internal Authenticate with 4-byte DDOL data, show result in TLV\n"); 

From 0c4750c3ba006eebb8862ed5ae5a4a42983056d7 Mon Sep 17 00:00:00 2001
From: merlokk <olegmsn@gmail.com>
Date: Thu, 13 Sep 2018 19:58:26 +0300
Subject: [PATCH 14/28] small fixes in helps

---
 client/emv/cmdemv.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index 571e1880..d1ae2d45 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -163,8 +163,9 @@ int CmdHFEMVGPO(const char *cmd) {
 
 	CLIParserInit("hf emv gpo", 
 		"Executes Get Processing Options command. It returns data in TLV format (0x77 - format2) or plain format (0x80 - format1).\nNeeds a EMV applet to be selected.", 
-		"Usage:\n\thf emv gpo -k -> execute GPO\n\thf emv gpo -st 01020304 -> execute GPO with 4-byte PDOL data, show result in TLV\n"); 
-		// here need to add load params from file and gen pdol
+		"Usage:\n\thf emv gpo -k -> execute GPO\n"
+			"\thf emv gpo -st 01020304 -> execute GPO with 4-byte PDOL data, show result in TLV\n"); 
+			// here need to add load params from file and gen pdol
 
 	void* argtable[] = {
 		arg_param_begin,
@@ -402,7 +403,7 @@ int CmdHFEMVAC(const char *cmd) {
 int CmdHFEMVGenerateChallenge(const char *cmd) {
 
 	CLIParserInit("hf emv challenge", 
-		"Executes Generate Challenge command. It returns 4 or 8-byte random number from card:\n", 
+		"Executes Generate Challenge command. It returns 4 or 8-byte random number from card.\nNeeds a EMV applet to be selected and GPO to be executed.", 
 		"Usage:\n\thf emv challenge -> get challenge\n\thf emv challenge -k -> get challenge, keep fileld ON\n");
 
 	void* argtable[] = {

From 8c2ae2176d35e3896f18b8dfe17257d1529116d5 Mon Sep 17 00:00:00 2001
From: merlokk <olegmsn@gmail.com>
Date: Thu, 13 Sep 2018 20:03:10 +0300
Subject: [PATCH 15/28] added changelog

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ca13dc85..edabfe00 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,6 +23,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
 ### Fixed
 - Changed start sequence in Qt mode (fix: short commands hangs main Qt thread) (Merlok)
 - Changed driver file proxmark3.inf to support both old and new Product/Vendor IDs (piwi)
+- Changed all command line parsers in `hf emv` commands to argtable (Merlok)
 
 ### Added
 - Added `sc` smartcard (contact card) commands - reader, info, raw, upgrade, setclock, list (hardware version RDV4.0 only) must turn option on in makefile options (Willok, Iceman, marshmellow)
@@ -53,6 +54,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
 - Added to `hf emv exec` SDA, DDA, fast DDA, CDA calculations for VISA and Mastercard and some other compatible EMV cards (Merlok)
 - Added `hf emv test` - crypto tests for DES, AES, SHA, RSA, SDA, DDA, CDA and some other crypto functions (Merlok)
 - Added `hf list mf` - deciphers crypto1 stream and works with first authentication and weak nested authentications (Merlok)
+- Added to `hf emv` commands: `gpo`, `readrec`, `genac`, `challenge`, `intauth` - commands working with EMV cards (Merlok)
 
 ## [3.0.1][2017-06-08]
 

From 61ad070f56bfbd29e1a1c928812c3d3634c6bac7 Mon Sep 17 00:00:00 2001
From: merlokk <olegmsn@gmail.com>
Date: Tue, 18 Sep 2018 18:36:03 +0300
Subject: [PATCH 16/28] delete unused procedure after merge

---
 client/emv/cmdemv.c | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index dceade79..84630ea7 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -14,20 +14,6 @@
 #include "cliparser/cliparser.h"
 #include <jansson.h>
 
-int UsageCmdHFEMVSelect(void) {
-	PrintAndLog("HELP :  Executes select applet command:\n");
-	PrintAndLog("Usage:  hf emv select [-s][-k][-a][-t] <HEX applet AID>\n");
-	PrintAndLog("  Options:");
-	PrintAndLog("  -s       : select card");
-	PrintAndLog("  -k       : keep field for next command");
-	PrintAndLog("  -a       : show APDU reqests and responses\n");
-	PrintAndLog("  -t       : TLV decode results\n");
-	PrintAndLog("Samples:");
-	PrintAndLog(" hf emv select -s a00000000101 -> select card, select applet");
-	PrintAndLog(" hf emv select -s -t a00000000101 -> select card, select applet, show result in TLV");
-	return 0;
-}
-
 int CmdHFEMVSelect(const char *cmd) {
 	uint8_t data[APDU_AID_LEN] = {0};
 	int datalen = 0;

From 57548f275a2d1400cac8b30d235a015bee652213 Mon Sep 17 00:00:00 2001
From: merlokk <olegmsn@gmail.com>
Date: Tue, 18 Sep 2018 19:06:59 +0300
Subject: [PATCH 17/28] `hf emv exec` works with argtable

---
 client/emv/cmdemv.c | 184 +++++++++++++++-----------------------------
 1 file changed, 60 insertions(+), 124 deletions(-)

diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index 84630ea7..93635f85 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -14,11 +14,31 @@
 #include "cliparser/cliparser.h"
 #include <jansson.h>
 
+#define TLV_ADD(tag, value)( tlvdb_change_or_add_node(tlvRoot, tag, sizeof(value) - 1, (const unsigned char *)value) )
+void ParamLoadDefaults(struct tlvdb *tlvRoot) {
+	//9F02:(Amount, authorized (Numeric)) len:6
+	TLV_ADD(0x9F02, "\x00\x00\x00\x00\x01\x00");
+	//9F1A:(Terminal Country Code) len:2
+	TLV_ADD(0x9F1A, "ru");
+	//5F2A:(Transaction Currency Code) len:2
+	// USD 840, EUR 978, RUR 810, RUB 643, RUR 810(old), UAH 980, AZN 031, n/a 999
+	TLV_ADD(0x5F2A, "\x09\x80");
+	//9A:(Transaction Date) len:3
+	TLV_ADD(0x9A,   "\x00\x00\x00");
+	//9C:(Transaction Type) len:1   |  00 => Goods and service #01 => Cash
+	TLV_ADD(0x9C,   "\x00");
+	// 9F37 Unpredictable Number len:4
+	TLV_ADD(0x9F37, "\x01\x02\x03\x04");
+	// 9F6A Unpredictable Number (MSD for UDOL) len:4
+	TLV_ADD(0x9F6A, "\x01\x02\x03\x04");
+	//9F66:(Terminal Transaction Qualifiers (TTQ)) len:4
+	TLV_ADD(0x9F66, "\x26\x00\x00\x00"); // qVSDC
+}
+
 int CmdHFEMVSelect(const char *cmd) {
 	uint8_t data[APDU_AID_LEN] = {0};
 	int datalen = 0;
 
-
 	CLIParserInit("hf emv select", 
 		"Executes select applet command", 
 		"Usage:\n\thf emv select -s a00000000101 -> select card, select applet\n\thf emv select -st a00000000101 -> select card, select applet, show result in TLV\n");
@@ -156,8 +176,6 @@ int CmdHFEMVPPSE(const char *cmd) {
 	return 0;
 }
 
-#define TLV_ADD(tag, value)( tlvdb_change_or_add_node(tlvRoot, tag, sizeof(value) - 1, (const unsigned char *)value) )
-
 int CmdHFEMVGPO(const char *cmd) {
 	uint8_t data[APDU_RES_LEN] = {0};
 	int datalen = 0;
@@ -205,23 +223,7 @@ int CmdHFEMVGPO(const char *cmd) {
 		// TODO
 		PrintAndLog("Make PDOL data not implemented!");
 
-		//9F02:(Amount, authorized (Numeric)) len:6
-		TLV_ADD(0x9F02, "\x00\x00\x00\x00\x01\x00");
-		//9F1A:(Terminal Country Code) len:2
-		TLV_ADD(0x9F1A, "ru");
-		//5F2A:(Transaction Currency Code) len:2
-		// USD 840, EUR 978, RUR 810, RUB 643, RUR 810(old), UAH 980, AZN 031, n/a 999
-		TLV_ADD(0x5F2A, "\x09\x80");
-		//9A:(Transaction Date) len:3
-		TLV_ADD(0x9A,   "\x00\x00\x00");
-		//9C:(Transaction Type) len:1   |  00 => Goods and service #01 => Cash
-		TLV_ADD(0x9C,   "\x00");
-		// 9F37 Unpredictable Number len:4
-		TLV_ADD(0x9F37, "\x01\x02\x03\x04");
-		// 9F6A Unpredictable Number (MSD for UDOL) len:4
-		TLV_ADD(0x9F6A, "\x01\x02\x03\x04");
-		//9F66:(Terminal Transaction Qualifiers (TTQ)) len:4
-		TLV_ADD(0x9F66, "\x26\x00\x00\x00"); // qVSDC
+		ParamLoadDefaults(tlvRoot);
 
 		if (paramsLoadFromFile) {
 		};
@@ -489,26 +491,6 @@ int CmdHFEMVInternalAuthenticate(const char *cmd) {
 	return 0;	
 }
 
-int UsageCmdHFEMVExec(void) {
-	PrintAndLog("HELP :  Executes EMV contactless transaction:\n");
-	PrintAndLog("Usage:  hf emv exec [-s][-a][-t][-j][-f][-v][-c][-x][-g]\n");
-	PrintAndLog("  Options:");
-	PrintAndLog("  -s       : select card");
-	PrintAndLog("  -a       : show APDU reqests and responses\n");
-	PrintAndLog("  -t       : TLV decode results\n");
-	PrintAndLog("  -j       : load transaction parameters from `emv/defparams.json` file\n");
-	PrintAndLog("  -f       : force search AID. Search AID instead of execute PPSE.\n");
-	PrintAndLog("  -v       : transaction type - qVSDC or M/Chip.\n");
-	PrintAndLog("  -c       : transaction type - qVSDC or M/Chip plus CDA (SDAD generation).\n");
-	PrintAndLog("  -x       : transaction type - VSDC. For test only. Not a standart behavior.\n");
-	PrintAndLog("  -g       : VISA. generate AC from GPO\n");
-	PrintAndLog("By default : transaction type - MSD.\n");
-	PrintAndLog("Samples:");
-	PrintAndLog(" hf emv exec -s -a -t -> execute MSD transaction");
-	PrintAndLog(" hf emv exec -s -a -t -c -> execute CDA transaction");
-	return 0;
-}
-
 #define dreturn(n) {free(pdol_data_tlv);tlvdb_free(tlvSelect);tlvdb_free(tlvRoot);DropField();return n;}
 
 bool HexToBuffer(const char *errormsg, const char *hexvalue, uint8_t * buffer, size_t maxbufferlen, size_t *bufferlen) {
@@ -641,35 +623,7 @@ bool ParamLoadFromJson(struct tlvdb *tlv) {
 	return true;
 }
 
-void ParamLoadDefaults(struct tlvdb *tlvRoot) {
-	//9F02:(Amount, authorized (Numeric)) len:6
-	TLV_ADD(0x9F02, "\x00\x00\x00\x00\x01\x00");
-	//9F1A:(Terminal Country Code) len:2
-	TLV_ADD(0x9F1A, "ru");
-	//5F2A:(Transaction Currency Code) len:2
-	// USD 840, EUR 978, RUR 810, RUB 643, RUR 810(old), UAH 980, AZN 031, n/a 999
-	TLV_ADD(0x5F2A, "\x09\x80");
-	//9A:(Transaction Date) len:3
-	TLV_ADD(0x9A,   "\x00\x00\x00");
-	//9C:(Transaction Type) len:1   |  00 => Goods and service #01 => Cash
-	TLV_ADD(0x9C,   "\x00");
-	// 9F37 Unpredictable Number len:4
-	TLV_ADD(0x9F37, "\x01\x02\x03\x04");
-	// 9F6A Unpredictable Number (MSD for UDOL) len:4
-	TLV_ADD(0x9F6A, "\x01\x02\x03\x04");
-	//9F66:(Terminal Transaction Qualifiers (TTQ)) len:4
-	TLV_ADD(0x9F66, "\x26\x00\x00\x00"); // qVSDC
-}
-
 int CmdHFEMVExec(const char *cmd) {
-	bool activateField = false;
-	bool showAPDU = false;
-	bool decodeTLV = false;
-	bool forceSearch = false;
-	enum TransactionType TrType = TT_MSD;
-	bool GenACGPO = false;
-	bool paramLoadJSON = false;
-
 	uint8_t buf[APDU_RES_LEN] = {0};
 	size_t len = 0;
 	uint16_t sw = 0;
@@ -684,63 +638,45 @@ int CmdHFEMVExec(const char *cmd) {
 	struct tlvdb *tlvRoot = NULL;
 	struct tlv *pdol_data_tlv = NULL;
 
-	if (strlen(cmd) < 1) {
-		UsageCmdHFEMVExec();
-		return 0;
-	}
-	
-	int cmdp = 0;
-	while(param_getchar(cmd, cmdp) != 0x00) {
-		char c = param_getchar(cmd, cmdp);
-		if ((c == '-') && (param_getlength(cmd, cmdp) == 2))
-			switch (param_getchar_indx(cmd, 1, cmdp)) {
-				case 'h':
-				case 'H':
-					UsageCmdHFEMVExec();
-					return 0;
-				case 's':
-				case 'S':
-					activateField = true;
-					break;
-				case 'a':
-				case 'A':
-					showAPDU = true;
-					break;
-				case 't':
-				case 'T':
-					decodeTLV = true;
-					break;
-				case 'f':
-				case 'F':
-					forceSearch = true;
-					break;
-				case 'x':
-				case 'X':
-					TrType = TT_VSDC;
-					break;
-				case 'v':
-				case 'V':
-					TrType = TT_QVSDCMCHIP;
-					break;
-				case 'c':
-				case 'C':
-					TrType = TT_CDA;
-					break;
-				case 'g':
-				case 'G':
-					GenACGPO = true;
-					break;
-				case 'j':
-				case 'J':
-					paramLoadJSON = true;
-					break;
-				default:
-					PrintAndLog("Unknown parameter '%c'", param_getchar_indx(cmd, 1, cmdp));
-					return 1;
-		}
-		cmdp++;
-	}
+	CLIParserInit("hf emv exec", 
+		"Executes EMV contactless transaction", 
+		"Usage:\n\thf emv exec -sat -> select card, execute MSD transaction, show APDU and TLV\n"
+			"\thf emv exec -satc -> select card, execute CDA transaction, show APDU and TLV\n");
 
+	void* argtable[] = {
+		arg_param_begin,
+		arg_lit0("sS",  "select",   "activate field and select card."),
+		arg_lit0("aA",  "apdu",     "show APDU reqests and responses."),
+		arg_lit0("tT",  "tlv",      "TLV decode results."),
+		arg_lit0("jJ",  "jload",    "Load transaction parameters from `emv/defparams.json` file."),
+		arg_lit0("fF",  "forceaid", "Force search AID. Search AID instead of execute PPSE."),
+		arg_rem("By default:",      "Transaction type - MSD"),
+		arg_lit0("vV",  "qvsdc",    "Transaction type - qVSDC or M/Chip."),
+		arg_lit0("cC",  "qvsdccda", "Transaction type - qVSDC or M/Chip plus CDA (SDAD generation)."),
+		arg_lit0("xX",  "vsdc",     "Transaction type - VSDC. For test only. Not a standart behavior."),
+		arg_lit0("gG",  "acgpo",    "VISA. generate AC from GPO."),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, true);
+	
+	bool activateField = arg_get_lit(1);
+	bool showAPDU = arg_get_lit(2);
+	bool decodeTLV = arg_get_lit(3);
+	bool paramLoadJSON = arg_get_lit(4);
+	bool forceSearch = arg_get_lit(5);
+
+	enum TransactionType TrType = TT_MSD;
+	if (arg_get_lit(6))
+		TrType = TT_QVSDCMCHIP;
+	if (arg_get_lit(7))
+		TrType = TT_CDA;
+	if (arg_get_lit(8))
+		TrType = TT_VSDC;
+
+	bool GenACGPO = arg_get_lit(9);
+	CLIParserFree();
+	
+	SetAPDULogging(showAPDU);
 	
 	// init applets list tree
 	const char *al = "Applets list";

From f23565c38b5a77ec3f5b02fc9f8368b77730b3ab Mon Sep 17 00:00:00 2001
From: Oleg Moiseenko <olegmsn@gmail.com>
Date: Fri, 28 Sep 2018 19:03:21 +0300
Subject: [PATCH 18/28] Added to `hf emv` commands: `gpo`, `readrec`, `genac`,
 `challenge`, `intauth` (#671)

* move `hf emv search` to argtable
* `hf emv select`
* delete old help
* `hf emv pse` and sketch for the other commands
* `hf emv gpo`
* `hf emv readrec`
* `hf emv challenge` works
* added `intauth` and `genac` commands.
* added CDA transaction to `hf emv genac`
* add terminal decision to `genac`
* added changelog
---
 CHANGELOG.md                 |   2 +
 client/cliparser/cliparser.c |   4 +
 client/cliparser/cliparser.h |   1 +
 client/emv/cmdemv.c          | 745 +++++++++++++++++++++--------------
 4 files changed, 455 insertions(+), 297 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3c9f29d9..73306b1f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
 ### Fixed
 - Changed start sequence in Qt mode (fix: short commands hangs main Qt thread) (Merlok)
 - Changed driver file proxmark3.inf to support both old and new Product/Vendor IDs (piwi)
+- Changed all command line parsers in `hf emv` commands to argtable (Merlok)
 
 ### Added
 - Added `sc` smartcard (contact card) commands - reader, info, raw, upgrade, setclock, list (hardware version RDV4.0 only) must turn option on in makefile options (Willok, Iceman, marshmellow)
@@ -55,6 +56,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
 - Added to `hf emv exec` SDA, DDA, fast DDA, CDA calculations for VISA and Mastercard and some other compatible EMV cards (Merlok)
 - Added `hf emv test` - crypto tests for DES, AES, SHA, RSA, SDA, DDA, CDA and some other crypto functions (Merlok)
 - Added `hf list mf` - deciphers crypto1 stream and works with first authentication and weak nested authentications (Merlok)
+- Added to `hf emv` commands: `gpo`, `readrec`, `genac`, `challenge`, `intauth` - commands working with EMV cards (Merlok)
 - Added `lf hid encode` and `lf hid decode` commands to translate printed HID card data to and from the packed data transmitted by a prox tag (grauerfuchs)
 - Added `lf hid write` command, which operates as a macro for encode followed by clone operations (grauerfuchs)
 
diff --git a/client/cliparser/cliparser.c b/client/cliparser/cliparser.c
index 0e70a630..87427db0 100644
--- a/client/cliparser/cliparser.c
+++ b/client/cliparser/cliparser.c
@@ -148,6 +148,10 @@ void CLIParserFree() {
 
 // convertors
 int CLIParamHexToBuf(struct arg_str *argstr, uint8_t *data, int maxdatalen, int *datalen) {
+	*datalen = 0;
+	if (!strlen(argstr->sval[0]))
+		return 0;
+	
 	switch(param_gethex_to_eol(argstr->sval[0], 0, data, maxdatalen, datalen)) {
 	case 1:
 		printf("Parameter error: Invalid HEX value.\n");
diff --git a/client/cliparser/cliparser.h b/client/cliparser/cliparser.h
index 3f4fa4cc..169f102e 100644
--- a/client/cliparser/cliparser.h
+++ b/client/cliparser/cliparser.h
@@ -19,6 +19,7 @@
 #define arg_get_lit(n)(((struct arg_lit*)argtable[n])->count)
 #define arg_get_int(n)(((struct arg_int*)argtable[n])->ival[0])
 #define arg_get_str(n)((struct arg_str*)argtable[n])
+#define arg_get_str_len(n)(strlen(((struct arg_str*)argtable[n])->sval[0]))
 
 #define CLIExecWithReturn(cmd, atbl, ifempty) if (CLIParserParseString(cmd, atbl, arg_getsize(atbl), ifempty)){CLIParserFree();return 0;}
 #define CLIGetStrBLessWithReturn(paramnum, data, datalen, delta) if (CLIParamHexToBuf(arg_get_str(paramnum), data, sizeof(data) - (delta), datalen)) {CLIParserFree();return 1;}
diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index 541f505a..93635f85 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -1,5 +1,5 @@
 //-----------------------------------------------------------------------------
-// Copyright (C) 2017 Merlok
+// Copyright (C) 2017, 2018 Merlok
 //
 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
 // at your option, any later version. See the LICENSE.txt file for the text of
@@ -11,86 +11,57 @@
 #include <ctype.h>
 #include "cmdemv.h"
 #include "test/cryptotest.h"
+#include "cliparser/cliparser.h"
 #include <jansson.h>
 
-int UsageCmdHFEMVSelect(void) {
-	PrintAndLog("HELP :  Executes select applet command:\n");
-	PrintAndLog("Usage:  hf emv select [-s][-k][-a][-t] <HEX applet AID>\n");
-	PrintAndLog("  Options:");
-	PrintAndLog("  -s       : select card");
-	PrintAndLog("  -k       : keep field for next command");
-	PrintAndLog("  -a       : show APDU reqests and responses\n");
-	PrintAndLog("  -t       : TLV decode results\n");
-	PrintAndLog("Samples:");
-	PrintAndLog(" hf emv select -s a00000000101 -> select card, select applet");
-	PrintAndLog(" hf emv select -s -t a00000000101 -> select card, select applet, show result in TLV");
-	return 0;
+#define TLV_ADD(tag, value)( tlvdb_change_or_add_node(tlvRoot, tag, sizeof(value) - 1, (const unsigned char *)value) )
+void ParamLoadDefaults(struct tlvdb *tlvRoot) {
+	//9F02:(Amount, authorized (Numeric)) len:6
+	TLV_ADD(0x9F02, "\x00\x00\x00\x00\x01\x00");
+	//9F1A:(Terminal Country Code) len:2
+	TLV_ADD(0x9F1A, "ru");
+	//5F2A:(Transaction Currency Code) len:2
+	// USD 840, EUR 978, RUR 810, RUB 643, RUR 810(old), UAH 980, AZN 031, n/a 999
+	TLV_ADD(0x5F2A, "\x09\x80");
+	//9A:(Transaction Date) len:3
+	TLV_ADD(0x9A,   "\x00\x00\x00");
+	//9C:(Transaction Type) len:1   |  00 => Goods and service #01 => Cash
+	TLV_ADD(0x9C,   "\x00");
+	// 9F37 Unpredictable Number len:4
+	TLV_ADD(0x9F37, "\x01\x02\x03\x04");
+	// 9F6A Unpredictable Number (MSD for UDOL) len:4
+	TLV_ADD(0x9F6A, "\x01\x02\x03\x04");
+	//9F66:(Terminal Transaction Qualifiers (TTQ)) len:4
+	TLV_ADD(0x9F66, "\x26\x00\x00\x00"); // qVSDC
 }
 
 int CmdHFEMVSelect(const char *cmd) {
 	uint8_t data[APDU_AID_LEN] = {0};
 	int datalen = 0;
-	bool activateField = false;
-	bool leaveSignalON = false;
-	bool decodeTLV = false;
 
-	if (strlen(cmd) < 1) {
-		UsageCmdHFEMVSelect();
-		return 0;
-	}
+	CLIParserInit("hf emv select", 
+		"Executes select applet command", 
+		"Usage:\n\thf emv select -s a00000000101 -> select card, select applet\n\thf emv select -st a00000000101 -> select card, select applet, show result in TLV\n");
+
+	void* argtable[] = {
+		arg_param_begin,
+		arg_lit0("sS",  "select",  "activate field and select card"),
+		arg_lit0("kK",  "keep",    "keep field for next command"),
+		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
+		arg_lit0("tT",  "tlv",     "TLV decode results"),
+		arg_str0(NULL,  NULL,      "<HEX applet AID>", NULL),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, true);
 	
-	SetAPDULogging(false);
+	bool activateField = arg_get_lit(1);
+	bool leaveSignalON = arg_get_lit(2);
+	bool APDULogging = arg_get_lit(3);
+	bool decodeTLV = arg_get_lit(4);
+	CLIGetStrWithReturn(5, data, &datalen);
+	CLIParserFree();
 	
-	int cmdp = 0;
-	while(param_getchar(cmd, cmdp) != 0x00) {
-		char c = param_getchar(cmd, cmdp);
-		if ((c == '-') && (param_getlength(cmd, cmdp) == 2))
-			switch (param_getchar_indx(cmd, 1, cmdp)) {
-				case 'h':
-				case 'H':
-					UsageCmdHFEMVSelect();
-					return 0;
-				case 's':
-				case 'S':
-					activateField = true;
-					break;
-				case 'k':
-				case 'K':
-					leaveSignalON = true;
-					break;
-				case 'a':
-				case 'A':
-					SetAPDULogging(true);
-					break;
-				case 't':
-				case 'T':
-					decodeTLV = true;
-					break;
-				default:
-					PrintAndLog("Unknown parameter '%c'", param_getchar_indx(cmd, 1, cmdp));
-					return 1;
-		}
-
-		if (isxdigit((unsigned char)c)) {
-			switch(param_gethex_to_eol(cmd, cmdp, data, sizeof(data), &datalen)) {
-			case 1:
-				PrintAndLog("Invalid HEX value.");
-				return 1;
-			case 2:
-				PrintAndLog("AID too large.");
-				return 1;
-			case 3:
-				PrintAndLog("Hex must have even number of digits.");
-				return 1;
-			}
-			
-			// we get all the hex to end of line with spaces
-			break;
-		}
-
-
-		cmdp++;
-	}
+	SetAPDULogging(APDULogging);
 	
 	// exec
 	uint8_t buf[APDU_RES_LEN] = {0};
@@ -110,65 +81,30 @@ int CmdHFEMVSelect(const char *cmd) {
 	return 0;
 }
 
-int UsageCmdHFEMVSearch(void) {
-	PrintAndLog("HELP :  Tries to select all applets from applet list:\n");
-	PrintAndLog("Usage:  hf emv search [-s][-k][-a][-t]\n");
-	PrintAndLog("  Options:");
-	PrintAndLog("  -s       : select card");
-	PrintAndLog("  -k       : keep field for next command");
-	PrintAndLog("  -a       : show APDU reqests and responses\n");
-	PrintAndLog("  -t       : TLV decode results of selected applets\n");
-	PrintAndLog("Samples:");
-	PrintAndLog(" hf emv search -s -> select card and search");
-	PrintAndLog(" hf emv search -s -t -> select card, search and show result in TLV");
-	return 0;
-}
-
 int CmdHFEMVSearch(const char *cmd) {
 
-	bool activateField = false;
-	bool leaveSignalON = false;
-	bool decodeTLV = false;
+	CLIParserInit("hf emv search", 
+		"Tries to select all applets from applet list:\n", 
+		"Usage:\n\thf emv search -s -> select card and search\n\thf emv search -st -> select card, search and show result in TLV\n");
 
-	if (strlen(cmd) < 1) {
-		UsageCmdHFEMVSearch();
-		return 0;
-	}
+	void* argtable[] = {
+		arg_param_begin,
+		arg_lit0("sS",  "select",  "activate field and select card"),
+		arg_lit0("kK",  "keep",    "keep field ON for next command"),
+		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
+		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, true);
 	
-	SetAPDULogging(false);
+	bool activateField = arg_get_lit(1);
+	bool leaveSignalON = arg_get_lit(2);
+	bool APDULogging = arg_get_lit(3);
+	bool decodeTLV = arg_get_lit(4);
+	CLIParserFree();
+	
+	SetAPDULogging(APDULogging);
 	
-	int cmdp = 0;
-	while(param_getchar(cmd, cmdp) != 0x00) {
-		char c = param_getchar(cmd, cmdp);
-		if ((c == '-') && (param_getlength(cmd, cmdp) == 2))
-			switch (param_getchar_indx(cmd, 1, cmdp)) {
-				case 'h':
-				case 'H':
-					UsageCmdHFEMVSearch();
-					return 0;
-				case 's':
-				case 'S':
-					activateField = true;
-					break;
-				case 'k':
-				case 'K':
-					leaveSignalON = true;
-					break;
-				case 'a':
-				case 'A':
-					SetAPDULogging(true);
-					break;
-				case 't':
-				case 'T':
-					decodeTLV = true;
-					break;
-				default:
-					PrintAndLog("Unknown parameter '%c'", param_getchar_indx(cmd, 1, cmdp));
-					return 1;
-		}
-		cmdp++;
-	}
-
 	struct tlvdb *t = NULL;
 	const char *al = "Applets list";
 	t = tlvdb_fixed(1, strlen(al), (const unsigned char *)al);
@@ -190,74 +126,36 @@ int CmdHFEMVSearch(const char *cmd) {
 	return 0;
 }
 
-int UsageCmdHFEMVPPSE(void) {
-	PrintAndLog("HELP :  Executes PSE/PPSE select command. It returns list of applet on the card:\n");
-	PrintAndLog("Usage:  hf emv pse [-s][-k][-1][-2][-a][-t]\n");
-	PrintAndLog("  Options:");
-	PrintAndLog("  -s       : select card");
-	PrintAndLog("  -k       : keep field for next command");
-	PrintAndLog("  -1       : ppse (1PAY.SYS.DDF01)");
-	PrintAndLog("  -2       : pse (2PAY.SYS.DDF01)");
-	PrintAndLog("  -a       : show APDU reqests and responses\n");
-	PrintAndLog("  -t       : TLV decode results\n");
-	PrintAndLog("Samples:");
-	PrintAndLog(" hf emv pse -s -1 -> select, get pse");
-	PrintAndLog(" hf emv pse -s -k -2 -> select, get ppse, keep field");
-	PrintAndLog(" hf emv pse -s -t -2 -> select, get ppse, show result in TLV");
-	return 0;
-}
-
 int CmdHFEMVPPSE(const char *cmd) {
 	
-	uint8_t PSENum = 2;
-	bool activateField = false;
-	bool leaveSignalON = false;
-	bool decodeTLV = false;
+	CLIParserInit("hf emv pse", 
+		"Executes PSE/PPSE select command. It returns list of applet on the card:\n", 
+		"Usage:\n\thf emv pse -s1 -> select, get pse\n\thf emv pse -st2 -> select, get ppse, show result in TLV\n");
 
-	if (strlen(cmd) < 1) {
-		UsageCmdHFEMVPPSE();
-		return 0;
-	}
-
-	SetAPDULogging(false);
+	void* argtable[] = {
+		arg_param_begin,
+		arg_lit0("sS",  "select",  "activate field and select card"),
+		arg_lit0("kK",  "keep",    "keep field ON for next command"),
+		arg_lit0("1",   "pse",     "pse (1PAY.SYS.DDF01) mode"),
+		arg_lit0("2",   "ppse",    "ppse (2PAY.SYS.DDF01) mode (default mode)"),
+		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
+		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, true);
 	
-	int cmdp = 0;
-	while(param_getchar(cmd, cmdp) != 0x00) {
-		char c = param_getchar(cmd, cmdp);
-		if ((c == '-') && (param_getlength(cmd, cmdp) == 2))
-			switch (param_getchar_indx(cmd, 1, cmdp)) {
-				case 'h':
-				case 'H':
-					UsageCmdHFEMVPPSE();
-					return 0;
-				case 's':
-				case 'S':
-					activateField = true;
-					break;
-				case 'k':
-				case 'K':
-					leaveSignalON = true;
-					break;
-				case 'a':
-				case 'A':
-					SetAPDULogging(true);
-					break;
-				case 't':
-				case 'T':
-					decodeTLV = true;
-					break;
-				case '1':
-					PSENum = 1;
-					break;
-				case '2':
-					PSENum = 2;
-					break;
-				default:
-					PrintAndLog("Unknown parameter '%c'", param_getchar_indx(cmd, 1, cmdp));
-					return 1;
-		}
-		cmdp++;
-	}
+	bool activateField = arg_get_lit(1);
+	bool leaveSignalON = arg_get_lit(2);
+	uint8_t PSENum = 2;
+	if (arg_get_lit(3))
+		PSENum = 1;
+	if (arg_get_lit(4))
+		PSENum = 2;
+	bool APDULogging = arg_get_lit(5);
+	bool decodeTLV = arg_get_lit(6);
+	CLIParserFree();	
+	
+	SetAPDULogging(APDULogging);
 	
 	// exec
 	uint8_t buf[APDU_RES_LEN] = {0};
@@ -278,27 +176,321 @@ int CmdHFEMVPPSE(const char *cmd) {
 	return 0;
 }
 
-int UsageCmdHFEMVExec(void) {
-	PrintAndLog("HELP :  Executes EMV contactless transaction:\n");
-	PrintAndLog("Usage:  hf emv exec [-s][-a][-t][-j][-f][-v][-c][-x][-g]\n");
-	PrintAndLog("  Options:");
-	PrintAndLog("  -s       : select card");
-	PrintAndLog("  -a       : show APDU reqests and responses\n");
-	PrintAndLog("  -t       : TLV decode results\n");
-	PrintAndLog("  -j       : load transaction parameters from `emv/defparams.json` file\n");
-	PrintAndLog("  -f       : force search AID. Search AID instead of execute PPSE.\n");
-	PrintAndLog("  -v       : transaction type - qVSDC or M/Chip.\n");
-	PrintAndLog("  -c       : transaction type - qVSDC or M/Chip plus CDA (SDAD generation).\n");
-	PrintAndLog("  -x       : transaction type - VSDC. For test only. Not a standart behavior.\n");
-	PrintAndLog("  -g       : VISA. generate AC from GPO\n");
-	PrintAndLog("By default : transaction type - MSD.\n");
-	PrintAndLog("Samples:");
-	PrintAndLog(" hf emv exec -s -a -t -> execute MSD transaction");
-	PrintAndLog(" hf emv exec -s -a -t -c -> execute CDA transaction");
+int CmdHFEMVGPO(const char *cmd) {
+	uint8_t data[APDU_RES_LEN] = {0};
+	int datalen = 0;
+
+	CLIParserInit("hf emv gpo", 
+		"Executes Get Processing Options command. It returns data in TLV format (0x77 - format2) or plain format (0x80 - format1).\nNeeds a EMV applet to be selected.", 
+		"Usage:\n\thf emv gpo -k -> execute GPO\n"
+			"\thf emv gpo -st 01020304 -> execute GPO with 4-byte PDOL data, show result in TLV\n"); 
+			// here need to add load params from file and gen pdol
+
+	void* argtable[] = {
+		arg_param_begin,
+		arg_lit0("kK",  "keep",    "keep field ON for next command"),
+		arg_lit0("pP",  "params",  "load parameters for PDOL making from `emv/defparams.json` file (by default uses default parameters) (NOT WORK!!!)"),
+		arg_lit0("mM",  "make",    "make PDOLdata from PDOL (tag 9F38) and parameters (NOT WORK!!!)"),
+		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
+		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
+		arg_str0(NULL,  NULL,      "<HEX PDOLdata/PDOL>", NULL),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, true);
+	
+	bool leaveSignalON = arg_get_lit(1);
+	bool paramsLoadFromFile = arg_get_lit(2);
+	bool dataMakeFromPDOL = arg_get_lit(3);
+	bool APDULogging = arg_get_lit(4);
+	bool decodeTLV = arg_get_lit(5);
+	CLIGetStrWithReturn(6, data, &datalen);
+	CLIParserFree();	
+	
+	SetAPDULogging(APDULogging);
+	
+	// Init TLV tree
+	const char *alr = "Root terminal TLV tree";
+	struct tlvdb *tlvRoot = tlvdb_fixed(1, strlen(alr), (const unsigned char *)alr);
+	
+	// calc PDOL
+	struct tlv *pdol_data_tlv = NULL;
+	struct tlv data_tlv = {
+		.tag = 0x01,
+		.len = datalen,
+		.value = (uint8_t *)data,
+	};
+	if (dataMakeFromPDOL) {
+		// TODO
+		PrintAndLog("Make PDOL data not implemented!");
+
+		ParamLoadDefaults(tlvRoot);
+
+		if (paramsLoadFromFile) {
+		};
+/*		pdol_data_tlv = dol_process(tlvdb_get(tlvRoot, 0x9f38, NULL), tlvRoot, 0x83);
+		if (!pdol_data_tlv){
+			PrintAndLog("ERROR: can't create PDOL TLV.");
+			tlvdb_free(tlvRoot);
+			return 4;
+		}*/
+		return 0;
+	} else {
+		pdol_data_tlv = &data_tlv;
+	}
+
+	size_t pdol_data_tlv_data_len = 0;
+	unsigned char *pdol_data_tlv_data = tlv_encode(pdol_data_tlv, &pdol_data_tlv_data_len);
+	if (!pdol_data_tlv_data) {
+		PrintAndLog("ERROR: can't create PDOL data.");
+		tlvdb_free(tlvRoot);
+		return 4;
+	}
+	PrintAndLog("PDOL data[%d]: %s", pdol_data_tlv_data_len, sprint_hex(pdol_data_tlv_data, pdol_data_tlv_data_len));
+	
+	// exec
+	uint8_t buf[APDU_RES_LEN] = {0};
+	size_t len = 0;
+	uint16_t sw = 0;
+	int res = EMVGPO(leaveSignalON, pdol_data_tlv_data, pdol_data_tlv_data_len, buf, sizeof(buf), &len, &sw, tlvRoot);
+	
+	free(pdol_data_tlv_data);
+	tlvdb_free(tlvRoot);
+	
+	if (sw)
+		PrintAndLog("APDU response status: %04x - %s", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); 
+
+	if (res)
+		return res;
+	
+	if (decodeTLV)
+		TLVPrintFromBuffer(buf, len);
+
 	return 0;
 }
 
-#define TLV_ADD(tag, value)( tlvdb_change_or_add_node(tlvRoot, tag, sizeof(value) - 1, (const unsigned char *)value) )
+int CmdHFEMVReadRecord(const char *cmd) {
+	uint8_t data[APDU_RES_LEN] = {0};
+	int datalen = 0;
+
+	CLIParserInit("hf emv readrec", 
+		"Executes Read Record command. It returns data in TLV format.\nNeeds a bank applet to be selected and sometimes needs GPO to be executed.", 
+		"Usage:\n\thf emv readrec -k 0101 -> read file SFI=01, SFIrec=01\n\thf emv readrec -kt 0201-> read file 0201 and show result in TLV\n");
+
+	void* argtable[] = {
+		arg_param_begin,
+		arg_lit0("kK",  "keep",    "keep field ON for next command"),
+		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
+		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
+		arg_str1(NULL,  NULL,      "<SFI 1byte HEX><SFIrec 1byte HEX>", NULL),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, true);
+	
+	bool leaveSignalON = arg_get_lit(1);
+	bool APDULogging = arg_get_lit(2);
+	bool decodeTLV = arg_get_lit(3);
+	CLIGetStrWithReturn(4, data, &datalen);
+	CLIParserFree();
+	
+	if (datalen != 2) {
+		PrintAndLog("ERROR: Command needs to have 2 bytes of data");
+		return 1;
+	}
+	
+	SetAPDULogging(APDULogging);
+		
+	// exec
+	uint8_t buf[APDU_RES_LEN] = {0};
+	size_t len = 0;
+	uint16_t sw = 0;
+	int res = EMVReadRecord(leaveSignalON, data[0], data[1], buf, sizeof(buf), &len, &sw, NULL);
+	
+	if (sw)
+		PrintAndLog("APDU response status: %04x - %s", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); 
+
+	if (res)
+		return res;
+	
+	
+	if (decodeTLV)
+		TLVPrintFromBuffer(buf, len);
+
+	return 0;
+}
+
+int CmdHFEMVAC(const char *cmd) {
+	uint8_t data[APDU_RES_LEN] = {0};
+	int datalen = 0;
+
+	CLIParserInit("hf emv genac", 
+		"Generate Application Cryptogram command. It returns data in TLV format .\nNeeds a EMV applet to be selected and GPO to be executed.", 
+		"Usage:\n\thf emv genac -k 0102 -> generate AC with 2-byte CDOLdata and keep field ON after command\n"
+			"\thf emv genac -t 01020304 -> generate AC with 4-byte CDOL data, show result in TLV\n"
+			"\thf emv genac -Daac 01020304 -> generate AC with 4-byte CDOL data and terminal decision 'declined'\n"); 
+
+	void* argtable[] = {
+		arg_param_begin,
+		arg_lit0("kK",  "keep",     "keep field ON for next command"),
+		arg_lit0("cC",  "cda",      "executes CDA transaction. Needs to get SDAD in results."),
+		arg_str0("dD",  "decision", "<aac|tc|arqc>", "Terminal decision. aac - declined, tc - approved, arqc - online authorisation requested"),
+		arg_lit0("aA",  "apdu",     "show APDU reqests and responses"),
+		arg_lit0("tT",  "tlv",      "TLV decode results of selected applets"),
+		arg_str1(NULL,  NULL,       "<HEX CDOLdata>", NULL),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, false);
+	
+	bool leaveSignalON = arg_get_lit(1);
+	bool trTypeCDA = arg_get_lit(2);
+	uint8_t termDecision = 0xff;
+	if (arg_get_str_len(3)) {
+		if (!strncmp(arg_get_str(3)->sval[0], "aac", 4))
+			termDecision = EMVAC_AAC;
+		if (!strncmp(arg_get_str(3)->sval[0], "tc", 4))
+			termDecision = EMVAC_TC;
+		if (!strncmp(arg_get_str(3)->sval[0], "arqc", 4))
+			termDecision = EMVAC_ARQC;
+
+		if (termDecision == 0xff) {
+			PrintAndLog("ERROR: can't find terminal decision '%s'", arg_get_str(3)->sval[0]);
+			return 1;
+		}
+	} else {
+		termDecision = EMVAC_TC;
+	}
+	if (trTypeCDA)
+		termDecision = termDecision | EMVAC_CDAREQ;
+	bool APDULogging = arg_get_lit(4);
+	bool decodeTLV = arg_get_lit(5);
+	CLIGetStrWithReturn(6, data, &datalen);
+	CLIParserFree();	
+	
+	SetAPDULogging(APDULogging);
+	
+	// Init TLV tree
+	const char *alr = "Root terminal TLV tree";
+	struct tlvdb *tlvRoot = tlvdb_fixed(1, strlen(alr), (const unsigned char *)alr);
+	
+	// calc CDOL
+	struct tlv *cdol_data_tlv = NULL;
+//	struct tlv *cdol_data_tlv = dol_process(tlvdb_get(tlvRoot, 0x8c, NULL), tlvRoot, 0x01); // 0x01 - dummy tag
+	struct tlv data_tlv = {
+		.tag = 0x01,
+		.len = datalen,
+		.value = (uint8_t *)data,
+	};	
+	cdol_data_tlv = &data_tlv;
+	PrintAndLog("CDOL data[%d]: %s", cdol_data_tlv->len, sprint_hex(cdol_data_tlv->value, cdol_data_tlv->len));
+	
+	// exec
+	uint8_t buf[APDU_RES_LEN] = {0};
+	size_t len = 0;
+	uint16_t sw = 0;
+	int res = EMVAC(leaveSignalON, termDecision, (uint8_t *)cdol_data_tlv->value, cdol_data_tlv->len, buf, sizeof(buf), &len, &sw, tlvRoot);
+	
+//	free(cdol_data_tlv);
+	tlvdb_free(tlvRoot);
+	
+	if (sw)
+		PrintAndLog("APDU response status: %04x - %s", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); 
+
+	if (res)
+		return res;
+	
+	if (decodeTLV)
+		TLVPrintFromBuffer(buf, len);
+
+	return 0;	
+}
+
+int CmdHFEMVGenerateChallenge(const char *cmd) {
+
+	CLIParserInit("hf emv challenge", 
+		"Executes Generate Challenge command. It returns 4 or 8-byte random number from card.\nNeeds a EMV applet to be selected and GPO to be executed.", 
+		"Usage:\n\thf emv challenge -> get challenge\n\thf emv challenge -k -> get challenge, keep fileld ON\n");
+
+	void* argtable[] = {
+		arg_param_begin,
+		arg_lit0("kK",  "keep",    "keep field ON for next command"),
+		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, true);
+	
+	bool leaveSignalON = arg_get_lit(1);
+	bool APDULogging = arg_get_lit(2);
+	CLIParserFree();	
+	
+	SetAPDULogging(APDULogging);
+	
+	// exec
+	uint8_t buf[APDU_RES_LEN] = {0};
+	size_t len = 0;
+	uint16_t sw = 0;
+	int res = EMVGenerateChallenge(leaveSignalON, buf, sizeof(buf), &len, &sw, NULL);
+	
+	if (sw)
+		PrintAndLog("APDU response status: %04x - %s", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); 
+
+	if (res)
+		return res;
+
+	PrintAndLog("Challenge: %s", sprint_hex(buf, len));
+	
+	if (len != 4 && len != 8)
+		PrintAndLog("WARNING: length of challenge must be 4 or 8, but it %d", len);
+	
+	return 0;
+}
+
+int CmdHFEMVInternalAuthenticate(const char *cmd) {
+	uint8_t data[APDU_RES_LEN] = {0};
+	int datalen = 0;
+
+	CLIParserInit("hf emv intauth", 
+		"Generate Internal Authenticate command. Usually needs 4-byte random number. It returns data in TLV format .\nNeeds a EMV applet to be selected and GPO to be executed.", 
+		"Usage:\n\thf emv intauth -k 01020304 -> execute Internal Authenticate with 4-byte DDOLdata and keep field ON after command\n"
+			"\thf emv intauth -t 01020304 -> execute Internal Authenticate with 4-byte DDOL data, show result in TLV\n"); 
+
+	void* argtable[] = {
+		arg_param_begin,
+		arg_lit0("kK",  "keep",    "keep field ON for next command"),
+		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
+		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
+		arg_str1(NULL,  NULL,      "<HEX DDOLdata>", NULL),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, false);
+	
+	bool leaveSignalON = arg_get_lit(1);
+	bool APDULogging = arg_get_lit(2);
+	bool decodeTLV = arg_get_lit(3);
+	CLIGetStrWithReturn(4, data, &datalen);
+	CLIParserFree();	
+	
+	SetAPDULogging(APDULogging);
+	
+	// DDOL
+	PrintAndLog("DDOL data[%d]: %s", datalen, sprint_hex(data, datalen));
+	
+	// exec
+	uint8_t buf[APDU_RES_LEN] = {0};
+	size_t len = 0;
+	uint16_t sw = 0;
+	int res = EMVInternalAuthenticate(leaveSignalON, data, datalen, buf, sizeof(buf), &len, &sw, NULL);
+	
+	if (sw)
+		PrintAndLog("APDU response status: %04x - %s", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); 
+
+	if (res)
+		return res;
+	
+	if (decodeTLV)
+		TLVPrintFromBuffer(buf, len);
+
+	return 0;	
+}
+
 #define dreturn(n) {free(pdol_data_tlv);tlvdb_free(tlvSelect);tlvdb_free(tlvRoot);DropField();return n;}
 
 bool HexToBuffer(const char *errormsg, const char *hexvalue, uint8_t * buffer, size_t maxbufferlen, size_t *bufferlen) {
@@ -431,35 +623,7 @@ bool ParamLoadFromJson(struct tlvdb *tlv) {
 	return true;
 }
 
-void ParamLoadDefaults(struct tlvdb *tlvRoot) {
-	//9F02:(Amount, authorized (Numeric)) len:6
-	TLV_ADD(0x9F02, "\x00\x00\x00\x00\x01\x00");
-	//9F1A:(Terminal Country Code) len:2
-	TLV_ADD(0x9F1A, "ru");
-	//5F2A:(Transaction Currency Code) len:2
-	// USD 840, EUR 978, RUR 810, RUB 643, RUR 810(old), UAH 980, AZN 031, n/a 999
-	TLV_ADD(0x5F2A, "\x09\x80");
-	//9A:(Transaction Date) len:3
-	TLV_ADD(0x9A,   "\x00\x00\x00");
-	//9C:(Transaction Type) len:1   |  00 => Goods and service #01 => Cash
-	TLV_ADD(0x9C,   "\x00");
-	// 9F37 Unpredictable Number len:4
-	TLV_ADD(0x9F37, "\x01\x02\x03\x04");
-	// 9F6A Unpredictable Number (MSD for UDOL) len:4
-	TLV_ADD(0x9F6A, "\x01\x02\x03\x04");
-	//9F66:(Terminal Transaction Qualifiers (TTQ)) len:4
-	TLV_ADD(0x9F66, "\x26\x00\x00\x00"); // qVSDC
-}
-
 int CmdHFEMVExec(const char *cmd) {
-	bool activateField = false;
-	bool showAPDU = false;
-	bool decodeTLV = false;
-	bool forceSearch = false;
-	enum TransactionType TrType = TT_MSD;
-	bool GenACGPO = false;
-	bool paramLoadJSON = false;
-
 	uint8_t buf[APDU_RES_LEN] = {0};
 	size_t len = 0;
 	uint16_t sw = 0;
@@ -474,63 +638,45 @@ int CmdHFEMVExec(const char *cmd) {
 	struct tlvdb *tlvRoot = NULL;
 	struct tlv *pdol_data_tlv = NULL;
 
-	if (strlen(cmd) < 1) {
-		UsageCmdHFEMVExec();
-		return 0;
-	}
-	
-	int cmdp = 0;
-	while(param_getchar(cmd, cmdp) != 0x00) {
-		char c = param_getchar(cmd, cmdp);
-		if ((c == '-') && (param_getlength(cmd, cmdp) == 2))
-			switch (param_getchar_indx(cmd, 1, cmdp)) {
-				case 'h':
-				case 'H':
-					UsageCmdHFEMVExec();
-					return 0;
-				case 's':
-				case 'S':
-					activateField = true;
-					break;
-				case 'a':
-				case 'A':
-					showAPDU = true;
-					break;
-				case 't':
-				case 'T':
-					decodeTLV = true;
-					break;
-				case 'f':
-				case 'F':
-					forceSearch = true;
-					break;
-				case 'x':
-				case 'X':
-					TrType = TT_VSDC;
-					break;
-				case 'v':
-				case 'V':
-					TrType = TT_QVSDCMCHIP;
-					break;
-				case 'c':
-				case 'C':
-					TrType = TT_CDA;
-					break;
-				case 'g':
-				case 'G':
-					GenACGPO = true;
-					break;
-				case 'j':
-				case 'J':
-					paramLoadJSON = true;
-					break;
-				default:
-					PrintAndLog("Unknown parameter '%c'", param_getchar_indx(cmd, 1, cmdp));
-					return 1;
-		}
-		cmdp++;
-	}
+	CLIParserInit("hf emv exec", 
+		"Executes EMV contactless transaction", 
+		"Usage:\n\thf emv exec -sat -> select card, execute MSD transaction, show APDU and TLV\n"
+			"\thf emv exec -satc -> select card, execute CDA transaction, show APDU and TLV\n");
 
+	void* argtable[] = {
+		arg_param_begin,
+		arg_lit0("sS",  "select",   "activate field and select card."),
+		arg_lit0("aA",  "apdu",     "show APDU reqests and responses."),
+		arg_lit0("tT",  "tlv",      "TLV decode results."),
+		arg_lit0("jJ",  "jload",    "Load transaction parameters from `emv/defparams.json` file."),
+		arg_lit0("fF",  "forceaid", "Force search AID. Search AID instead of execute PPSE."),
+		arg_rem("By default:",      "Transaction type - MSD"),
+		arg_lit0("vV",  "qvsdc",    "Transaction type - qVSDC or M/Chip."),
+		arg_lit0("cC",  "qvsdccda", "Transaction type - qVSDC or M/Chip plus CDA (SDAD generation)."),
+		arg_lit0("xX",  "vsdc",     "Transaction type - VSDC. For test only. Not a standart behavior."),
+		arg_lit0("gG",  "acgpo",    "VISA. generate AC from GPO."),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, true);
+	
+	bool activateField = arg_get_lit(1);
+	bool showAPDU = arg_get_lit(2);
+	bool decodeTLV = arg_get_lit(3);
+	bool paramLoadJSON = arg_get_lit(4);
+	bool forceSearch = arg_get_lit(5);
+
+	enum TransactionType TrType = TT_MSD;
+	if (arg_get_lit(6))
+		TrType = TT_QVSDCMCHIP;
+	if (arg_get_lit(7))
+		TrType = TT_CDA;
+	if (arg_get_lit(8))
+		TrType = TT_VSDC;
+
+	bool GenACGPO = arg_get_lit(9);
+	CLIParserFree();
+	
+	SetAPDULogging(showAPDU);
 	
 	// init applets list tree
 	const char *al = "Applets list";
@@ -1005,13 +1151,18 @@ int CmdHFEMVTest(const char *cmd) {
 
 int CmdHelp(const char *Cmd);
 static command_t CommandTable[] =  {
-	{"help",	CmdHelp,		1,	"This help"},
-	{"exec",	CmdHFEMVExec,	0,	"Executes EMV contactless transaction."},
-	{"pse",		CmdHFEMVPPSE,	0,	"Execute PPSE. It selects 2PAY.SYS.DDF01 or 1PAY.SYS.DDF01 directory."},
-	{"search",	CmdHFEMVSearch,	0,	"Try to select all applets from applets list and print installed applets."},
-	{"select",	CmdHFEMVSelect,	0,	"Select applet."},
+	{"help",		CmdHelp,						1,	"This help"},
+	{"exec",		CmdHFEMVExec,					0,	"Executes EMV contactless transaction."},
+	{"pse",			CmdHFEMVPPSE,					0,	"Execute PPSE. It selects 2PAY.SYS.DDF01 or 1PAY.SYS.DDF01 directory."},
+	{"search",		CmdHFEMVSearch,					0,	"Try to select all applets from applets list and print installed applets."},
+	{"select",		CmdHFEMVSelect,					0,	"Select applet."},
+	{"gpo",			CmdHFEMVGPO,					0,	"Execute GetProcessingOptions."},
+	{"readrec",		CmdHFEMVReadRecord,				0,	"Read files from card."},
+	{"genac",		CmdHFEMVAC,						0,	"Generate ApplicationCryptogram."},
+	{"challenge",	CmdHFEMVGenerateChallenge,		0,	"Generate challenge."},
+	{"intauth",		CmdHFEMVInternalAuthenticate,	0,	"Internal authentication."},
 //	{"scan",	CmdHFEMVScan,	0,	"Scan EMV card and save it contents to json file for emulator."},
-	{"test",	CmdHFEMVTest,	0,	"Crypto logic test."},
+	{"test",		CmdHFEMVTest,					0,	"Crypto logic test."},
 	{NULL, NULL, 0, NULL}
 };
 

From 11146fc1e1722ad8780d0589fc2f6a66fa198108 Mon Sep 17 00:00:00 2001
From: Oleg Moiseenko <olegmsn@gmail.com>
Date: Mon, 1 Oct 2018 21:12:14 +0300
Subject: [PATCH 19/28] modify argtable parser to parse ints with spaces (#683)

* modify argtable parser to parse ints with spaces
* added arg_strx1 and arg_strx0 for x str arguments in one
* added option to clue data in arg parser
* add new argtable logic to emv commands and small fix
* small fix in GPO help
* small GPO fix
---
 client/cliparser/cliparser.c | 23 ++++++++++++++++++++---
 client/cliparser/cliparser.h |  4 ++++
 client/cmdhf14a.c            |  4 ++--
 client/emv/cmdemv.c          | 14 +++++++-------
 4 files changed, 33 insertions(+), 12 deletions(-)

diff --git a/client/cliparser/cliparser.c b/client/cliparser/cliparser.c
index 87427db0..56be2ca6 100644
--- a/client/cliparser/cliparser.c
+++ b/client/cliparser/cliparser.c
@@ -80,6 +80,10 @@ enum ParserState {
 #define isSpace(c)(c == ' ' || c == '\t')
 
 int CLIParserParseString(const char* str, void* vargtable[], size_t vargtableLen, bool allowEmptyExec) {
+	return CLIParserParseStringEx(str, vargtable, vargtableLen, allowEmptyExec, false);
+}
+
+int CLIParserParseStringEx(const char* str, void* vargtable[], size_t vargtableLen, bool allowEmptyExec, bool clueData) {
 	int argc = 0;
 	char *argv[200] = {NULL};
 	
@@ -99,7 +103,7 @@ int CLIParserParseString(const char* str, void* vargtable[], size_t vargtableLen
 	for (int i = 0; i < len; i++) {
 		switch(state){
 			case PS_FIRST: // first char
-				if (str[i] == '-'){ // first char before space is '-' - next element - option
+				if (!clueData || str[i] == '-'){ // first char before space is '-' - next element - option OR not "clueData" for not-option fields
 					state = PS_OPTION;
 
 					if (spaceptr) {
@@ -149,10 +153,23 @@ void CLIParserFree() {
 // convertors
 int CLIParamHexToBuf(struct arg_str *argstr, uint8_t *data, int maxdatalen, int *datalen) {
 	*datalen = 0;
-	if (!strlen(argstr->sval[0]))
+	if (!argstr->count)
 		return 0;
 	
-	switch(param_gethex_to_eol(argstr->sval[0], 0, data, maxdatalen, datalen)) {
+	char buf[256] = {0};
+	int ibuf = 0;
+	
+	for (int i = 0; i < argstr->count; i++) {
+		int len = strlen(argstr->sval[i]);
+		memcpy(&buf[ibuf], argstr->sval[i], len);
+		ibuf += len;
+	}
+	buf[ibuf] = 0;
+  
+	if (!ibuf)
+		return 0;
+	
+	switch(param_gethex_to_eol(buf, 0, data, maxdatalen, datalen)) {
 	case 1:
 		printf("Parameter error: Invalid HEX value.\n");
 		return 1;
diff --git a/client/cliparser/cliparser.h b/client/cliparser/cliparser.h
index 169f102e..7c1ced20 100644
--- a/client/cliparser/cliparser.h
+++ b/client/cliparser/cliparser.h
@@ -21,12 +21,16 @@
 #define arg_get_str(n)((struct arg_str*)argtable[n])
 #define arg_get_str_len(n)(strlen(((struct arg_str*)argtable[n])->sval[0]))
 
+#define arg_strx1(shortopts, longopts, datatype, glossary) (arg_strn((shortopts), (longopts), (datatype), 1, 250, (glossary)))
+#define arg_strx0(shortopts, longopts, datatype, glossary) (arg_strn((shortopts), (longopts), (datatype), 0, 250, (glossary)))
+
 #define CLIExecWithReturn(cmd, atbl, ifempty) if (CLIParserParseString(cmd, atbl, arg_getsize(atbl), ifempty)){CLIParserFree();return 0;}
 #define CLIGetStrBLessWithReturn(paramnum, data, datalen, delta) if (CLIParamHexToBuf(arg_get_str(paramnum), data, sizeof(data) - (delta), datalen)) {CLIParserFree();return 1;}
 #define CLIGetStrWithReturn(paramnum, data, datalen) if (CLIParamHexToBuf(arg_get_str(paramnum), data, sizeof(data), datalen)) {CLIParserFree();return 1;}
 
 extern int CLIParserInit(char *vprogramName, char *vprogramHint, char *vprogramHelp);
 extern int CLIParserParseString(const char* str, void* argtable[], size_t vargtableLen, bool allowEmptyExec);
+extern int CLIParserParseStringEx(const char* str, void* vargtable[], size_t vargtableLen, bool allowEmptyExec, bool clueData);
 extern int CLIParserParseArg(int argc, char **argv, void* argtable[], size_t vargtableLen, bool allowEmptyExec);
 extern void CLIParserFree();
 
diff --git a/client/cmdhf14a.c b/client/cmdhf14a.c
index 2d76f109..94eb8ff3 100644
--- a/client/cmdhf14a.c
+++ b/client/cmdhf14a.c
@@ -742,7 +742,7 @@ int CmdHF14AAPDU(const char *cmd) {
 		arg_lit0("sS",  "select",  "activate field and select card"),
 		arg_lit0("kK",  "keep",    "leave the signal field ON after receive response"),
 		arg_lit0("tT",  "tlv",     "executes TLV decoder if it possible"),
-		arg_str1(NULL,  NULL,      "<APDU (hex)>", NULL),
+		arg_strx1(NULL, NULL,      "<APDU (hex)>", NULL),
 		arg_param_end
 	};
 	CLIExecWithReturn(cmd, argtable, false);
@@ -807,7 +807,7 @@ int CmdHF14ACmdRaw(const char *cmd) {
 		arg_int0("t",   "timeout", NULL, "timeout in ms"),
 		arg_lit0("T",   "topaz",   "use Topaz protocol to send command"),
 		arg_lit0("3",   NULL,      "ISO14443-3 select only (skip RATS)"),
-		arg_str1(NULL,  NULL,      "<data (hex)>", NULL),
+		arg_strx1(NULL, NULL,      "<data (hex)>", NULL),
 		arg_param_end
 	};
 	// defaults
diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index 93635f85..544632ef 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -49,7 +49,7 @@ int CmdHFEMVSelect(const char *cmd) {
 		arg_lit0("kK",  "keep",    "keep field for next command"),
 		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
 		arg_lit0("tT",  "tlv",     "TLV decode results"),
-		arg_str0(NULL,  NULL,      "<HEX applet AID>", NULL),
+		arg_strx0(NULL,  NULL,     "<HEX applet AID>", NULL),
 		arg_param_end
 	};
 	CLIExecWithReturn(cmd, argtable, true);
@@ -183,7 +183,7 @@ int CmdHFEMVGPO(const char *cmd) {
 	CLIParserInit("hf emv gpo", 
 		"Executes Get Processing Options command. It returns data in TLV format (0x77 - format2) or plain format (0x80 - format1).\nNeeds a EMV applet to be selected.", 
 		"Usage:\n\thf emv gpo -k -> execute GPO\n"
-			"\thf emv gpo -st 01020304 -> execute GPO with 4-byte PDOL data, show result in TLV\n"); 
+			"\thf emv gpo -t 01020304 -> execute GPO with 4-byte PDOL data, show result in TLV\n"); 
 			// here need to add load params from file and gen pdol
 
 	void* argtable[] = {
@@ -193,7 +193,7 @@ int CmdHFEMVGPO(const char *cmd) {
 		arg_lit0("mM",  "make",    "make PDOLdata from PDOL (tag 9F38) and parameters (NOT WORK!!!)"),
 		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
 		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
-		arg_str0(NULL,  NULL,      "<HEX PDOLdata/PDOL>", NULL),
+		arg_strx0(NULL,  NULL,     "<HEX PDOLdata/PDOL>", NULL),
 		arg_param_end
 	};
 	CLIExecWithReturn(cmd, argtable, true);
@@ -215,7 +215,7 @@ int CmdHFEMVGPO(const char *cmd) {
 	// calc PDOL
 	struct tlv *pdol_data_tlv = NULL;
 	struct tlv data_tlv = {
-		.tag = 0x01,
+		.tag = 0x83,
 		.len = datalen,
 		.value = (uint8_t *)data,
 	};
@@ -281,7 +281,7 @@ int CmdHFEMVReadRecord(const char *cmd) {
 		arg_lit0("kK",  "keep",    "keep field ON for next command"),
 		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
 		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
-		arg_str1(NULL,  NULL,      "<SFI 1byte HEX><SFIrec 1byte HEX>", NULL),
+		arg_strx1(NULL,  NULL,     "<SFI 1byte HEX><SFIrec 1byte HEX>", NULL),
 		arg_param_end
 	};
 	CLIExecWithReturn(cmd, argtable, true);
@@ -335,7 +335,7 @@ int CmdHFEMVAC(const char *cmd) {
 		arg_str0("dD",  "decision", "<aac|tc|arqc>", "Terminal decision. aac - declined, tc - approved, arqc - online authorisation requested"),
 		arg_lit0("aA",  "apdu",     "show APDU reqests and responses"),
 		arg_lit0("tT",  "tlv",      "TLV decode results of selected applets"),
-		arg_str1(NULL,  NULL,       "<HEX CDOLdata>", NULL),
+		arg_strx1(NULL,  NULL,      "<HEX CDOLdata>", NULL),
 		arg_param_end
 	};
 	CLIExecWithReturn(cmd, argtable, false);
@@ -457,7 +457,7 @@ int CmdHFEMVInternalAuthenticate(const char *cmd) {
 		arg_lit0("kK",  "keep",    "keep field ON for next command"),
 		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
 		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
-		arg_str1(NULL,  NULL,      "<HEX DDOLdata>", NULL),
+		arg_strx1(NULL,  NULL,     "<HEX DDOLdata>", NULL),
 		arg_param_end
 	};
 	CLIExecWithReturn(cmd, argtable, false);

From 7b2cd970ec5f158a24c5ab20db80fbfa3cb88dda Mon Sep 17 00:00:00 2001
From: Michael Farrell <micolous+gh@gmail.com>
Date: Sun, 7 Oct 2018 01:33:44 +1000
Subject: [PATCH 20/28] FIX: crash on Bionic libc if CloseProxmark is called
 twice. (#672)

In Android O and later, if an invalid pthread_t is passed to pthread_join,
it calls fatal().

https://github.com/aosp-mirror/platform_bionic/blob/ed16b344e75f422fb36fbfd91fb30de339475880/libc/bionic/pthread_internal.cpp#L116-L128

This patch addresses it by:

1. Always memset(0) on USB_communications_thread at the end of
   CloseProxmark.

2. On Bionic, only call pthread_join on USB_communications_thread if it is
   not equal to 0.
---
 client/comms.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/client/comms.c b/client/comms.c
index 2030f8f3..86dca3ed 100644
--- a/client/comms.c
+++ b/client/comms.c
@@ -333,7 +333,20 @@ bool OpenProxmark(void *port, bool wait_for_port, int timeout, bool flash_mode)
 
 void CloseProxmark(void) {
 	conn.run = false;
+
+#ifdef __BIONIC__
+	// In Android O and later, if an invalid pthread_t is passed to pthread_join, it calls fatal().
+	// https://github.com/aosp-mirror/platform_bionic/blob/ed16b344e75f422fb36fbfd91fb30de339475880/libc/bionic/pthread_internal.cpp#L116-L128
+	//
+	// In Bionic libc, pthread_t is an integer.
+
+	if (USB_communication_thread != 0) {
+		pthread_join(USB_communication_thread, NULL);
+	}
+#else
+	// pthread_t is a struct on other libc, treat as an opaque memory reference
 	pthread_join(USB_communication_thread, NULL);
+#endif
 
 	if (sp) {
 		uart_close(sp);
@@ -351,6 +364,7 @@ void CloseProxmark(void) {
 	// Clean up our state
 	sp = NULL;
 	serial_port_name = NULL;
+	memset(&USB_communication_thread, 0, sizeof(pthread_t));
 }
 
 

From eed83b910ca8687f7928b5d3743ab9bcd7ede705 Mon Sep 17 00:00:00 2001
From: pwpiwi <pwpiwi@users.noreply.github.com>
Date: Sat, 6 Oct 2018 17:48:43 +0200
Subject: [PATCH 21/28] Add another #ifdef for the __BIONIC__ fix (the effect
 of setting p_thread to 0 is undefined for other libs)

---
 client/comms.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/client/comms.c b/client/comms.c
index 86dca3ed..0c4efa73 100644
--- a/client/comms.c
+++ b/client/comms.c
@@ -364,7 +364,9 @@ void CloseProxmark(void) {
 	// Clean up our state
 	sp = NULL;
 	serial_port_name = NULL;
+#ifdef __BIONIC__
 	memset(&USB_communication_thread, 0, sizeof(pthread_t));
+#endif
 }
 
 

From 351d6d17b3fa82a82b2205c69dcc024884d0b146 Mon Sep 17 00:00:00 2001
From: AntiCat <contiki@anticat.ch>
Date: Sun, 7 Oct 2018 17:30:47 +0200
Subject: [PATCH 22/28] Fix: ControlWidget placement (#690)

* ui: code cleanup
* ui: move control widget below plot
---
 client/proxguiqt.cpp | 21 +++++++--------------
 1 file changed, 7 insertions(+), 14 deletions(-)

diff --git a/client/proxguiqt.cpp b/client/proxguiqt.cpp
index ab0976cc..8fc1f990 100644
--- a/client/proxguiqt.cpp
+++ b/client/proxguiqt.cpp
@@ -181,8 +181,7 @@ ProxWidget::ProxWidget(QWidget *parent, ProxGuiQT *master) : QWidget(parent)
 	this->master = master;
 	resize(800,500);
 
-	/** Setup the controller widget **/
-
+	// Setup the controller widget
 	controlWidget = new QWidget();
 	opsController = new Ui::Form();
 	opsController->setupUi(controlWidget);
@@ -204,23 +203,17 @@ ProxWidget::ProxWidget(QWidget *parent, ProxGuiQT *master) : QWidget(parent)
 	QObject::connect(opsController->horizontalSlider_dirthr_down, SIGNAL(valueChanged(int)), this, SLOT(vchange_dthr_down(int)));
 	QObject::connect(opsController->horizontalSlider_askedge, SIGNAL(valueChanged(int)), this, SLOT(vchange_askedge(int)));
 
-	controlWidget->show();
-
 	// Set up the plot widget, which does the actual plotting
-
 	plot = new Plot(this);
-	/*
-	QSlider* slider = new QSlider(Qt::Horizontal);
-	slider->setFocusPolicy(Qt::StrongFocus);
-	slider->setTickPosition(QSlider::TicksBothSides);
-	slider->setTickInterval(10);
-	slider->setSingleStep(1);
-	*/
 	QVBoxLayout *layout = new QVBoxLayout;
-	//layout->addWidget(slider);
 	layout->addWidget(plot);
 	setLayout(layout);
-	//printf("Proxwidget Constructor just set layout\r\n");
+	show(); // places the window on the screen.
+
+	// Move controller widget below plot
+	controlWidget->move(x(),y()+frameSize().height());
+	controlWidget->resize(size().width(), controlWidget->size().height());
+	controlWidget->show();
 }
 
 // not 100% sure what i need in this block

From 70b2fc0abdb9efe03c3eb29c8b9d661ba4c3c90e Mon Sep 17 00:00:00 2001
From: pwpiwi <pwpiwi@users.noreply.github.com>
Date: Sun, 7 Oct 2018 17:32:03 +0200
Subject: [PATCH 23/28] start fixing hf 15: (#684)

* implement a real time Decoder for tag responses (will be required for sniffing)
* switch off field after each command (protect rdv40)
* correctly signal field status with LED D
---
 armsrc/iso15693.c | 664 ++++++++++++++++++++++++++--------------------
 client/cmdhf15.c  |  11 +-
 2 files changed, 386 insertions(+), 289 deletions(-)

diff --git a/armsrc/iso15693.c b/armsrc/iso15693.c
index c092b383..9b0ab29e 100644
--- a/armsrc/iso15693.c
+++ b/armsrc/iso15693.c
@@ -67,6 +67,8 @@
 
 #define arraylen(x) (sizeof(x)/sizeof((x)[0]))
 
+static int DEBUG = 0;
+
 ///////////////////////////////////////////////////////////////////////
 // ISO 15693 Part 2 - Air Interface
 // This section basicly contains transmission and receiving of bits
@@ -82,10 +84,10 @@
 #define sprintUID(target,uid)	Iso15693sprintUID(target,uid)
 
 // approximate amplitude=sqrt(ci^2+cq^2) 
-#define AMPLITUDE(ci, cq) (MAX(ABS(ci), ABS(cq)) + (MIN(ABS(ci), ABS(cq))>>1))
-
-static int DEBUG = 0;
+#define AMPLITUDE(ci, cq) (MAX(ABS(ci), ABS(cq)) + MIN(ABS(ci), ABS(cq))/2)
 
+// DMA buffer
+#define ISO15693_DMA_BUFFER_SIZE 128
 
 // ---------------------------
 // Signal Processing 
@@ -168,13 +170,15 @@ static void CodeIso15693AsReader(uint8_t *cmd, int n)
 	ToSendStuffBit(0);
 	ToSendStuffBit(1);
 
-	// And slack at the end, too.
-	for(i = 0; i < 24; i++) {
+	// Fill remainder of last byte with 1
+	for(i = 0; i < 4; i++) {
 		ToSendStuffBit(1);
 	}
+	
+	ToSendMax++;
 }
 
-// encode data using "1 out of 256" sheme
+// encode data using "1 out of 256" scheme
 // data rate is 1,66 kbit/s (fc/8192) 
 // is designed for more robust communication over longer distances
 static void CodeIso15693AsReader256(uint8_t *cmd, int n)
@@ -222,224 +226,349 @@ static void CodeIso15693AsReader256(uint8_t *cmd, int n)
 }
 
 
-// Transmit the command (to the tag) that was placed in ToSend[].
-static void TransmitTo15693Tag(const uint8_t *cmd, int len, int *samples, int *wait)
+// Transmit the command (to the tag) that was placed in cmd[].
+static void TransmitTo15693Tag(const uint8_t *cmd, int len)
 {
-    int c;
-
 	FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX);
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
-	if(*wait < 10) { *wait = 10; }
 
-    c = 0;
-    for(;;) {
+	LED_B_ON();
+    for(int c = 0; c < len; ) {
         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
             AT91C_BASE_SSC->SSC_THR = ~cmd[c];
             c++;
-            if(c >= len) {
-                break;
-            }
-        }
-        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-            volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
-            (void)r;
         }
         WDT_HIT();
     }
-	*samples = (c + *wait) << 3;
+	LED_B_OFF();
 }
 
 //-----------------------------------------------------------------------------
-// Transmit the command (to the reader) that was placed in ToSend[].
+// Transmit the command (to the reader) that was placed in cmd[].
 //-----------------------------------------------------------------------------
-static void TransmitTo15693Reader(const uint8_t *cmd, int len, int *samples, int *wait)
+static void TransmitTo15693Reader(const uint8_t *cmd, int len)
 {
-    int c = 0;
-	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR|FPGA_HF_SIMULATOR_MODULATE_424K);
-	if(*wait < 10) { *wait = 10; }
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR | FPGA_HF_SIMULATOR_MODULATE_424K);
 
-    for(;;) {
+	LED_C_ON();
+    for(int c = 0; c < len; ) {
         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
             AT91C_BASE_SSC->SSC_THR = cmd[c];
             c++;
-            if(c >= len) {
-                break;
-            }
-        }
-        if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-            volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
-            (void)r;
         }
         WDT_HIT();
     }
-	*samples = (c + *wait) << 3;
+	LED_C_OFF();
 }
 
 
-// Read from Tag
-// Parameters:
-//		receivedResponse
-//		maxLen
-//		samples
-//		elapsed
-// returns: 
-//		number of decoded bytes
-static int GetIso15693AnswerFromTag(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
+//=============================================================================
+// An ISO 15693 demodulator (one subcarrier only). Uses cross correlation to 
+// identify the SOF, each bit, and EOF.
+// This function is called 8 times per bit (every 2 subcarrier cycles).
+// Subcarrier frequency fs is 424kHz, 1/fs = 2,36us, 
+// i.e. function is called every 4,72us
+// LED handling:
+//    LED C -> ON once we have received the SOF and are expecting the rest.
+//    LED C -> OFF once we have received EOF or are unsynced
+//
+// Returns: true if we received a EOF
+//          false if we are still waiting for some more
+//=============================================================================
+
+#define SUBCARRIER_DETECT_THRESHOLD	2
+#define SOF_CORRELATOR_LEN (1<<5)
+
+typedef struct Demod {
+	enum {
+		DEMOD_UNSYNCD,
+		DEMOD_AWAIT_SOF_1,
+		DEMOD_AWAIT_SOF_2,
+		DEMOD_RECEIVING_DATA,
+		DEMOD_AWAIT_EOF
+	}         state;
+	int       bitCount;
+	int       posCount;
+	enum {
+		LOGIC0,
+		LOGIC1,
+		SOF_PART1,
+		SOF_PART2
+	}         lastBit;
+	uint16_t  shiftReg;
+	uint8_t   *output;
+	int       len;
+	int       sum1, sum2;
+	uint8_t   SOF_low;
+	uint8_t   SOF_high;
+	uint8_t   SOF_last;
+	int32_t   SOF_corr;
+	int32_t   SOF_corr_prev;
+	uint8_t   SOF_correlator[SOF_CORRELATOR_LEN];
+} Demod_t;
+
+static RAMFUNC int Handle15693SamplesDemod(int8_t ci, int8_t cq, Demod_t *Demod)
 {
-	int c = 0;
-	uint8_t *dest = BigBuf_get_addr();
-
-// NOW READ RESPONSE
-	FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
-	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
-	c = 0;
-	for(;;) {
-		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-			uint16_t iq = AT91C_BASE_SSC->SSC_RHR;
-			// The samples are correlations against I and Q versions of the
-			// tone that the tag AM-modulates. We just want power. 
-			int8_t i = iq >> 8;
-			int8_t q = iq;
-			uint8_t r = AMPLITUDE(i, q);
-
-			dest[c++] = r;
+	switch(Demod->state) {
+		case DEMOD_UNSYNCD:
+			// initialize SOF correlator. We are looking for 12 samples low and 12 samples high.
+			Demod->SOF_low = 0;
+			Demod->SOF_high = 12;
+			Demod->SOF_last = 23;
+			memset(Demod->SOF_correlator, 0x00, Demod->SOF_last + 1);
+			Demod->SOF_correlator[Demod->SOF_last] = AMPLITUDE(ci,cq);
+			Demod->SOF_corr = Demod->SOF_correlator[Demod->SOF_last];
+			Demod->SOF_corr_prev = Demod->SOF_corr;
+			// initialize Demodulator
+			Demod->posCount = 0;
+			Demod->bitCount = 0;
+			Demod->len = 0;
+			Demod->state = DEMOD_AWAIT_SOF_1;
+			break;
 			
-			if(c >= 4000) {
-				break;
-			}
-		}
-	}
+		case DEMOD_AWAIT_SOF_1:
+			// calculate the correlation in real time. Look at differences only.
+			Demod->SOF_corr += Demod->SOF_correlator[Demod->SOF_low++];
+			Demod->SOF_corr -= 2*Demod->SOF_correlator[Demod->SOF_high++];
+			Demod->SOF_last++;
+			Demod->SOF_low &= (SOF_CORRELATOR_LEN-1);
+			Demod->SOF_high &= (SOF_CORRELATOR_LEN-1);
+			Demod->SOF_last &= (SOF_CORRELATOR_LEN-1);
+			Demod->SOF_correlator[Demod->SOF_last] = AMPLITUDE(ci,cq);
+			Demod->SOF_corr += Demod->SOF_correlator[Demod->SOF_last];
 
-	//////////////////////////////////////////
-	/////////// DEMODULATE ///////////////////
-	//////////////////////////////////////////
-
-	int i, j;
-	int max = 0, maxPos=0;
-
-	int skip = 2;
-
-	// First, correlate for SOF
-	for(i = 0; i < 200; i++) {  // usually, SOF is found around i = 60
-		int corr = 0;
-		for(j = 0; j < arraylen(FrameSOF); j += skip) {
-			corr += FrameSOF[j]*dest[i+(j/skip)];
-		}
-		if(corr > max) {
-			max = corr;
-			maxPos = i;
-		}
-	}
-	if (DEBUG) Dbprintf("SOF at %d, correlation %d", maxPos, max/(arraylen(FrameSOF)/skip));
-
-	int k = 0; // this will be our return value
-
-	// greg - If correlation is less than 1 then there's little point in continuing
-	if ((max/(arraylen(FrameSOF)/skip)) >= 1)
-	{
-
-		i = maxPos + arraylen(FrameSOF)/skip;
-	
-		uint8_t outBuf[20];
-		memset(outBuf, 0, sizeof(outBuf));
-		uint8_t mask = 0x01;
-		for(;;) {
-			int corr0 = 0, corr00 = 0, corr01 = 0, corr1 = 0, corrEOF = 0;
-			for(j = 0; j < arraylen(Logic0); j += skip) {
-				corr0 += Logic0[j]*dest[i+(j/skip)];
-			}
-			corr01 = corr00 = corr0;
-			for(j = 0; j < arraylen(Logic0); j += skip) {
-				corr00 += Logic0[j]*dest[i+arraylen(Logic0)/skip+(j/skip)];
-				corr01 += Logic1[j]*dest[i+arraylen(Logic0)/skip+(j/skip)];
-			}
-			for(j = 0; j < arraylen(Logic1); j += skip) {
-				corr1 += Logic1[j]*dest[i+(j/skip)];
-			}
-			for(j = 0; j < arraylen(FrameEOF); j += skip) {
-				corrEOF += FrameEOF[j]*dest[i+(j/skip)];
-			}
-			// Even things out by the length of the target waveform.
-			corr00 *= 2;
-			corr01 *= 2;
-			corr0 *= 4;
-			corr1 *= 4;
-	
-			if(corrEOF > corr1 && corrEOF > corr00 && corrEOF > corr01) {
-				if (DEBUG) Dbprintf("EOF at %d, correlation %d (corr01: %d, corr00: %d, corr1: %d, corr0: %d)", 
-					i, corrEOF, corr01, corr00, corr1, corr0);
-				break;
-			} else if(corr1 > corr0) {
-				i += arraylen(Logic1)/skip;
-				outBuf[k] |= mask;
+			// if correlation increases for 10 consecutive samples, we are close to maximum correlation
+			if (Demod->SOF_corr > Demod->SOF_corr_prev + SUBCARRIER_DETECT_THRESHOLD) {
+				Demod->posCount++;
 			} else {
-				i += arraylen(Logic0)/skip;
+				Demod->posCount = 0;
 			}
-			mask <<= 1;
-			if(mask == 0) {
-				k++;
-				mask = 0x01;
-			}
-			if((i+(int)arraylen(FrameEOF)/skip) >= 4000) {
-				DbpString("ran off end!");
-				break;
-			}
-		}
-		if(mask != 0x01) { // this happens, when we miss the EOF
-			// TODO: for some reason this happens quite often
-			if (DEBUG) Dbprintf("error, uneven octet! (extra bits!) mask=%02x", mask);
-			if (mask<0x08) k--; // discard the last uneven octet;
-			// 0x08 is an assumption - but works quite often
-		}
-	//	uint8_t str1 [8];
-	//	itoa(k,str1);
-	//	strncat(str1," octets read",8);
-	
-	//	DbpString(  str1);    // DbpString("%d octets", k);
-	
-	//	for(i = 0; i < k; i+=3) {
-	//		//DbpString("# %2d: %02x ", i, outBuf[i]);
-	//		DbpIntegers(outBuf[i],outBuf[i+1],outBuf[i+2]);
-	//	}
-	
-		for(i = 0; i < k; i++) {
-			receivedResponse[i] = outBuf[i];
-		}
-	} // "end if correlation > 0" 	(max/(arraylen(FrameSOF)/skip))
-	return k; // return the number of bytes demodulated
 
-///	DbpString("CRC=%04x", Iso15693Crc(outBuf, k-2));
+			if (Demod->posCount == 10) {	// correlation increased 10 times
+				Demod->state = DEMOD_AWAIT_SOF_2;
+			}
+				
+			Demod->SOF_corr_prev = Demod->SOF_corr;
+				
+			break;
 
+		case DEMOD_AWAIT_SOF_2:
+			// calculate the correlation in real time. Look at differences only.
+			Demod->SOF_corr += Demod->SOF_correlator[Demod->SOF_low++];
+			Demod->SOF_corr -= 2*Demod->SOF_correlator[Demod->SOF_high++];
+			Demod->SOF_last++;
+			Demod->SOF_low &= (SOF_CORRELATOR_LEN-1);
+			Demod->SOF_high &= (SOF_CORRELATOR_LEN-1);
+			Demod->SOF_last &= (SOF_CORRELATOR_LEN-1);
+			Demod->SOF_correlator[Demod->SOF_last] = AMPLITUDE(ci,cq);
+			Demod->SOF_corr += Demod->SOF_correlator[Demod->SOF_last];
+
+			if (Demod->SOF_corr >= Demod->SOF_corr_prev) { // we are looking for the maximum correlation
+				Demod->SOF_corr_prev = Demod->SOF_corr;
+			} else {
+				Demod->lastBit = SOF_PART1;  // detected 1st part of SOF
+				Demod->sum1 = Demod->SOF_correlator[Demod->SOF_last];
+				Demod->sum2 = 0;
+				Demod->posCount = 2;
+				Demod->state = DEMOD_RECEIVING_DATA;
+				LED_C_ON();
+			}
+			
+			break;
+
+		case DEMOD_RECEIVING_DATA:
+			if (Demod->posCount == 1) {
+				Demod->sum1 = 0;
+				Demod->sum2 = 0;
+			}
+
+			if (Demod->posCount <= 4) {
+				Demod->sum1 += AMPLITUDE(ci, cq);
+			} else {
+				Demod->sum2 += AMPLITUDE(ci, cq);
+			}
+
+			if (Demod->posCount == 8) {
+				int16_t corr_1 = (Demod->sum2 - Demod->sum1) / 4;
+				int16_t corr_0 = (Demod->sum1 - Demod->sum2) / 4;
+				int16_t corr_EOF = (Demod->sum1 + Demod->sum2) / 8;
+				if (corr_EOF > corr_0 && corr_EOF > corr_1) {
+					Demod->state = DEMOD_AWAIT_EOF;
+				} else if (corr_1 > corr_0) {
+					// logic 1
+					if (Demod->lastBit == SOF_PART1) { // still part of SOF
+						Demod->lastBit = SOF_PART2;
+					} else {
+						Demod->lastBit = LOGIC1;
+						Demod->shiftReg >>= 1;
+						Demod->shiftReg |= 0x80;
+						Demod->bitCount++;
+						if (Demod->bitCount == 8) {
+							Demod->output[Demod->len] = Demod->shiftReg;
+							Demod->len++;
+							Demod->bitCount = 0;
+							Demod->shiftReg = 0;
+						}
+					}
+				} else {
+					// logic 0
+					if (Demod->lastBit == SOF_PART1) { // incomplete SOF
+						Demod->state = DEMOD_UNSYNCD;
+						LED_C_OFF();
+					} else {
+						Demod->lastBit = LOGIC0;
+						Demod->shiftReg >>= 1;
+						Demod->bitCount++;
+						if (Demod->bitCount == 8) {
+							Demod->output[Demod->len] = Demod->shiftReg;
+							Demod->len++;
+							Demod->bitCount = 0;
+							Demod->shiftReg = 0;
+						}
+					}
+				}
+				Demod->posCount = 0;
+			}
+			Demod->posCount++;
+			break;
+		
+		case DEMOD_AWAIT_EOF:
+			if (Demod->lastBit == LOGIC0) {  // this was already part of EOF 
+				LED_C_OFF();
+				return true;
+			} else {
+				Demod->state = DEMOD_UNSYNCD;
+				LED_C_OFF();
+			}
+			break;
+
+		default:
+			Demod->state = DEMOD_UNSYNCD;
+			LED_C_OFF();
+			break;
+	}
+
+	return false;
+}
+
+
+static void DemodInit(Demod_t* Demod, uint8_t* data)
+{
+	Demod->output = data;
+	Demod->state = DEMOD_UNSYNCD;
+}
+
+
+/*
+ *  Demodulate the samples we received from the tag, also log to tracebuffer
+ */
+static int GetIso15693AnswerFromTag(uint8_t* response, int timeout)
+{
+	int maxBehindBy = 0;
+	int lastRxCounter, samples = 0;
+	int8_t ci, cq;
+	bool gotFrame = false;
+	
+	// Allocate memory from BigBuf for some buffers
+	// free all previous allocations first
+	BigBuf_free();
+
+	// The DMA buffer, used to stream samples from the FPGA
+	uint16_t* dmaBuf = (uint16_t*) BigBuf_malloc(ISO15693_DMA_BUFFER_SIZE * sizeof(uint16_t));
+
+	// the Demodulatur data structure
+	Demod_t* Demod = (Demod_t*) BigBuf_malloc(sizeof(Demod_t));
+	
+	// Set up the demodulator for tag -> reader responses.
+	DemodInit(Demod, response);
+
+	// wait for last transfer to complete
+	while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXEMPTY));
+
+	// And put the FPGA in the appropriate mode
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
+
+	// Setup and start DMA.
+	FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
+	FpgaSetupSscDma((uint8_t*) dmaBuf, ISO15693_DMA_BUFFER_SIZE);
+
+	uint16_t *upTo = dmaBuf;
+	lastRxCounter = ISO15693_DMA_BUFFER_SIZE;
+
+	for(;;) {
+		int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) & (ISO15693_DMA_BUFFER_SIZE-1);
+		if(behindBy > maxBehindBy) {
+			maxBehindBy = behindBy;
+		}
+
+		if (behindBy < 1) continue;
+		
+		ci = (int8_t)(*upTo >> 8);
+		cq = (int8_t)(*upTo & 0xff);
+
+		upTo++;
+		lastRxCounter--;
+		if(upTo >= dmaBuf + ISO15693_DMA_BUFFER_SIZE) {                // we have read all of the DMA buffer content.
+			upTo = dmaBuf;                                             // start reading the circular buffer from the beginning
+			lastRxCounter += ISO15693_DMA_BUFFER_SIZE;
+		}
+		if (AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_ENDRX)) {              // DMA Counter Register had reached 0, already rotated.
+			AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) dmaBuf;          // refresh the DMA Next Buffer and
+			AT91C_BASE_PDC_SSC->PDC_RNCR = ISO15693_DMA_BUFFER_SIZE;   // DMA Next Counter registers
+		}
+		samples++;
+
+		if (Handle15693SamplesDemod(ci, cq, Demod)) {
+			gotFrame = true;
+			break;
+		}
+
+		if(samples > timeout && Demod->state < DEMOD_RECEIVING_DATA) {
+			Demod->len = 0;
+			break;
+		}
+	}
+
+	FpgaDisableSscDma();
+
+	if (DEBUG) Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.state = %d, Demod.len = %d, Demod.bitCount = %d, Demod.posCount = %d", 
+	                    maxBehindBy, samples, gotFrame, Demod->state, Demod->len, Demod->bitCount, Demod->posCount);
+
+	if (tracing && Demod->len > 0) {
+		uint8_t parity[MAX_PARITY_SIZE];
+		LogTrace(Demod->output, Demod->len, 0, 0, parity, false);
+	}
+
+	return Demod->len;
 }
 
 
 // Now the GetISO15693 message from sniffing command
+// TODO: fix it. This cannot work for several reasons: 
+//   1. Carrier is switched on during sniffing?
+//   2. We most probable miss the next reader command when demodulating
 static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed)
 {
-	int c = 0;
 	uint8_t *dest = BigBuf_get_addr();
 
 // NOW READ RESPONSE
+	LED_D_ON();
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 	//spindelay(60);	// greg - experiment to get rid of some of the 0 byte/failed reads
-	c = 0;
-	for(;;) {
+	for(int c = 0; c < BIGBUF_SIZE; ) {
 		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 			uint16_t iq = AT91C_BASE_SSC->SSC_RHR;
 			// The samples are correlations against I and Q versions of the
 			// tone that the tag AM-modulates. We just want power, 
 			// so abs(I) + abs(Q) is close to what we want.
-			int8_t i = iq >> 8;
-			int8_t q = iq;
+			int8_t i = (int8_t)(iq >> 8);
+			int8_t q = (int8_t)(iq & 0xff);
 			uint8_t r = AMPLITUDE(i, q);
-
 			dest[c++] = r;
-
-			if(c >= BIGBUF_SIZE) {
-				break;
-			}
 		}
 	}
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	LED_D_OFF();
 
 	//////////////////////////////////////////
 	/////////// DEMODULATE ///////////////////
@@ -461,6 +590,7 @@ static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int
 			maxPos = i;
 		}
 	}
+
 	if (DEBUG) Dbprintf("SOF at %d, correlation %d", maxPos,max/(arraylen(FrameSOF)/skip));
 
 	int k = 0; // this will be our return value
@@ -498,7 +628,7 @@ static int GetIso15693AnswerFromSniff(uint8_t *receivedResponse, int maxLen, int
 	
 			if(corrEOF > corr1 && corrEOF > corr00 && corrEOF > corr01) {
 				if (DEBUG) Dbprintf("EOF at %d, correlation %d (corr01: %d, corr00: %d, corr1: %d, corr0: %d)", 
-					i, corrEOF, corr01, corr00, corr1, corr0);
+				         i, corrEOF, corr01, corr00, corr1, corr0);
 				break;
 			} else if(corr1 > corr0) {
 				i += arraylen(Logic1)/skip;
@@ -549,16 +679,18 @@ static void BuildIdentifyRequest(void);
 //-----------------------------------------------------------------------------
 void AcquireRawAdcSamplesIso15693(void)
 {
+	LEDsoff();
+	LED_A_ON();
+	
 	uint8_t *dest = BigBuf_get_addr();
 
-	int c = 0;
-
 	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 	BuildIdentifyRequest();
 
 	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
 
 	// Give the tags time to energize
+	LED_D_ON();
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 	SpinDelay(100);
 
@@ -566,48 +698,51 @@ void AcquireRawAdcSamplesIso15693(void)
 	FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_TX);
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX);
 
-	c = 0;
-	for(;;) {
+	LED_B_ON();
+	for(int c = 0; c < ToSendMax; ) {
 		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
 			AT91C_BASE_SSC->SSC_THR = ~ToSend[c];
 			c++;
-			if(c == ToSendMax+3) {
-				break;
-			}
 		}
 		WDT_HIT();
 	}
+	LED_B_OFF();
+
+	// wait for last transfer to complete
+	while (!(AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXEMPTY));
 
 	FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 
-	c = 0;
-	for(;;) {
+	for(int c = 0; c < 4000; ) {
 		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 			uint16_t iq = AT91C_BASE_SSC->SSC_RHR;
 			// The samples are correlations against I and Q versions of the
 			// tone that the tag AM-modulates. We just want power, 
 			// so abs(I) + abs(Q) is close to what we want.
-			int8_t i = iq >> 8;
-			int8_t q = iq;
+			int8_t i = (int8_t)(iq >> 8);
+			int8_t q = (int8_t)(iq & 0xff);
 			uint8_t r = AMPLITUDE(i, q);
-
 			dest[c++] = r;
-
-			if(c >= 4000) {
-				break;
-			}
 		}
 	}
+
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	LEDsoff();
 }
 
 
+// TODO: there is no trigger condition. The 14000 samples represent a time frame of 66ms. 
+// It is unlikely that we get something meaningful.
+// TODO: Currently we only record tag answers. Add tracing of reader commands.
+// TODO: would we get something at all? The carrier is switched on...
 void RecordRawAdcSamplesIso15693(void)
 {
+	LEDsoff();
+	LED_A_ON();
+	
 	uint8_t *dest = BigBuf_get_addr();
 
-	int c = 0;
-
 	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 	// Setup SSC
 	FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
@@ -620,43 +755,38 @@ void RecordRawAdcSamplesIso15693(void)
 
 	SpinDelay(100);
 
+	LED_D_ON();
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 
-	c = 0;
-	for(;;) {
+	for(int c = 0; c < 14000;) {
 		if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
 			uint16_t iq = AT91C_BASE_SSC->SSC_RHR;
 			// The samples are correlations against I and Q versions of the
 			// tone that the tag AM-modulates. We just want power, 
 			// so abs(I) + abs(Q) is close to what we want.
-			int8_t i = iq >> 8;
-			int8_t q = iq;
+			int8_t i = (int8_t)(iq >> 8);
+			int8_t q = (int8_t)(iq & 0xff);
 			uint8_t r = AMPLITUDE(i, q);
-
 			dest[c++] = r;
-
-			if(c >= 14000) {
-				break;
-			}
 		}
 	}
+
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	LED_D_OFF();
 	Dbprintf("finished recording");
+	LED_A_OFF();
 }
 
 
 // Initialize the proxmark as iso15k reader 
 // (this might produces glitches that confuse some tags
-void Iso15693InitReader() {
-	LED_A_ON();
-	LED_B_ON();
-	LED_C_OFF();
-	LED_D_OFF();
-	
+static void Iso15693InitReader() {
 	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 	// Setup SSC
 	// FpgaSetupSsc();
 
 	// Start from off (no field generated)
+	LED_D_OFF();
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	SpinDelay(10);
 
@@ -664,18 +794,14 @@ void Iso15693InitReader() {
 	FpgaSetupSsc(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 
 	// Give the tags time to energize
+	LED_D_ON();
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 	SpinDelay(250);
-
-	LED_A_ON();
-	LED_B_OFF();
-	LED_C_OFF();
-	LED_D_OFF();
 }
 
 ///////////////////////////////////////////////////////////////////////
 // ISO 15693 Part 3 - Air Interface
-// This section basicly contains transmission and receiving of bits
+// This section basically contains transmission and receiving of bits
 ///////////////////////////////////////////////////////////////////////
 
 // Encode (into the ToSend buffers) an identify request, which is the first
@@ -732,8 +858,9 @@ static void BuildReadBlockRequest(uint8_t *uid, uint8_t blockNumber )
 	CodeIso15693AsReader(cmd, sizeof(cmd));
 }
 
+
 // Now the VICC>VCD responses when we are simulating a tag
- static void BuildInventoryResponse( uint8_t *uid)
+static void BuildInventoryResponse( uint8_t *uid)
 {
 	uint8_t cmd[12];
 
@@ -766,17 +893,11 @@ static void BuildReadBlockRequest(uint8_t *uid, uint8_t blockNumber )
 // 	**recv will return you a pointer to the received data
 // 	If you do not need the answer use NULL for *recv[] 
 //	return: lenght of received data
-int SendDataTag(uint8_t *send, int sendlen, int init, int speed, uint8_t **recv) {
+int SendDataTag(uint8_t *send, int sendlen, bool init, int speed, uint8_t **recv) {
 
-	int samples = 0;
-	int tsamples = 0;
-	int wait = 0;
-	int elapsed = 0;
-	
 	LED_A_ON();
-	LED_B_ON();
+	LED_B_OFF();
 	LED_C_OFF();
-	LED_D_OFF();
 	
 	if (init) Iso15693InitReader();
 
@@ -792,22 +913,14 @@ int SendDataTag(uint8_t *send, int sendlen, int init, int speed, uint8_t **recv)
 		CodeIso15693AsReader(send, sendlen);
 	}
 	
-	LED_A_ON();
-	LED_B_OFF();
-	
-	TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);	
+	TransmitTo15693Tag(ToSend,ToSendMax);	
 	// Now wait for a response
 	if (recv!=NULL) {
-		LED_A_OFF();
-		LED_B_ON();
-		answerLen = GetIso15693AnswerFromTag(answer, 100, &samples, &elapsed) ;	
+		answerLen = GetIso15693AnswerFromTag(answer, 100);	
 		*recv=answer;
 	}
 
 	LED_A_OFF();
-	LED_B_OFF();
-	LED_C_OFF();
-	LED_D_OFF();
 	
 	return answerLen;
 }
@@ -887,35 +1000,21 @@ void SetDebugIso15693(uint32_t debug) {
 	return;
 }
 
-
-
 //-----------------------------------------------------------------------------
 // Simulate an ISO15693 reader, perform anti-collision and then attempt to read a sector
 // all demodulation performed in arm rather than host. - greg
 //-----------------------------------------------------------------------------
 void ReaderIso15693(uint32_t parameter)
 {
+	LEDsoff();
 	LED_A_ON();
-	LED_B_ON();
-	LED_C_OFF();
-	LED_D_OFF();
 
 	int answerLen1 = 0;
-	int answerLen2 = 0;
-	// int answerLen3 = 0;
-	int i = 0;
-	int samples = 0;
-	int tsamples = 0;
-	int wait = 0;
-	int elapsed = 0;
 	uint8_t TagUID[8] = {0x00};
 
 	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 
 	uint8_t *answer1 = BigBuf_get_addr() + 4000;
-	uint8_t *answer2 = BigBuf_get_addr() + 4100;
-	// uint8_t *answer3 = BigBuf_get_addr() + 4200;
-	// Blank arrays
 	memset(answer1, 0x00, 200);
 
 	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
@@ -927,24 +1026,20 @@ void ReaderIso15693(uint32_t parameter)
    	SpinDelay(200);
 
 	// Give the tags time to energize
+	LED_D_ON();
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR);
 	SpinDelay(200);
 
-	LED_A_ON();
-	LED_B_OFF();
-	LED_C_OFF();
-	LED_D_OFF();
-
 	// FIRST WE RUN AN INVENTORY TO GET THE TAG UID
 	// THIS MEANS WE CAN PRE-BUILD REQUESTS TO SAVE CPU TIME
 
 	// Now send the IDENTIFY command
 	BuildIdentifyRequest();
 	
-	TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);
+	TransmitTo15693Tag(ToSend,ToSendMax);
 	
 	// Now wait for a response
-	answerLen1 = GetIso15693AnswerFromTag(answer1, 100, &samples, &elapsed) ;
+	answerLen1 = GetIso15693AnswerFromTag(answer1, 100) ;
 
 	if (answerLen1 >=12) // we should do a better check than this
 	{
@@ -964,7 +1059,7 @@ void ReaderIso15693(uint32_t parameter)
 	Dbhexdump(answerLen1,answer1,true);
 
 	// UID is reverse
-	if (answerLen1>=12) 
+	if (answerLen1 >= 12) 
 		Dbprintf("UID = %02hX%02hX%02hX%02hX%02hX%02hX%02hX%02hX",
 			TagUID[7],TagUID[6],TagUID[5],TagUID[4],
 			TagUID[3],TagUID[2],TagUID[1],TagUID[0]);
@@ -979,12 +1074,13 @@ void ReaderIso15693(uint32_t parameter)
 	// Dbhexdump(answerLen3,answer3,true);
 
 	// read all pages
-	if (answerLen1>=12 && DEBUG) {
-		i=0;			
+	if (answerLen1 >= 12 && DEBUG) {
+		uint8_t *answer2 = BigBuf_get_addr() + 4100;
+		int i=0;			
 		while (i<32) {  // sanity check, assume max 32 pages
 			BuildReadBlockRequest(TagUID,i);
-			TransmitTo15693Tag(ToSend,ToSendMax,&tsamples, &wait);  
-			answerLen2 = GetIso15693AnswerFromTag(answer2, 100, &samples, &elapsed);
+			TransmitTo15693Tag(ToSend,ToSendMax);  
+			int answerLen2 = GetIso15693AnswerFromTag(answer2, 100);
 			if (answerLen2>0) {
 				Dbprintf("READ SINGLE BLOCK %d returned %d octets:",i,answerLen2);
 				DbdecodeIso15693Answer(answerLen2,answer2);
@@ -995,25 +1091,23 @@ void ReaderIso15693(uint32_t parameter)
 		} 
 	}
 
-	LED_A_OFF();
-	LED_B_OFF();
-	LED_C_OFF();
+	// for the time being, switch field off to protect rdv4.0 
+	// note: this prevents using hf 15 cmd with s option - which isn't implemented yet anyway
+   	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	LED_D_OFF();
+	
+	LED_A_OFF();
 }
 
 // Simulate an ISO15693 TAG, perform anti-collision and then print any reader commands
 // all demodulation performed in arm rather than host. - greg
 void SimTagIso15693(uint32_t parameter, uint8_t *uid)
 {
+	LEDsoff();
 	LED_A_ON();
-	LED_B_ON();
-	LED_C_OFF();
-	LED_D_OFF();
 
 	int answerLen1 = 0;
 	int samples = 0;
-	int tsamples = 0;
-	int wait = 0;
 	int elapsed = 0;
 
 	FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
@@ -1028,11 +1122,6 @@ void SimTagIso15693(uint32_t parameter, uint8_t *uid)
    	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	SpinDelay(200);
 
-	LED_A_OFF();
-	LED_B_OFF();
-	LED_C_ON();
-	LED_D_OFF();
-
 	// Listen to reader
 	answerLen1 = GetIso15693AnswerFromSniff(buf, 100, &samples, &elapsed) ;
 
@@ -1043,7 +1132,7 @@ void SimTagIso15693(uint32_t parameter, uint8_t *uid)
 		
 		BuildInventoryResponse(uid);
 	
-		TransmitTo15693Reader(ToSend,ToSendMax, &tsamples, &wait);
+		TransmitTo15693Reader(ToSend,ToSendMax);
 	}
 
 	Dbprintf("%d octets read from reader command: %x %x %x %x %x %x %x %x %x", answerLen1,
@@ -1054,10 +1143,7 @@ void SimTagIso15693(uint32_t parameter, uint8_t *uid)
 		uid[0], uid[1], uid[2],	uid[3],
 		uid[4], uid[5],	uid[6], uid[7]);
 
-	LED_A_OFF();
-	LED_B_OFF();
-	LED_C_OFF();
-	LED_D_OFF();
+	LEDsoff();
 }
 
 
@@ -1065,6 +1151,9 @@ void SimTagIso15693(uint32_t parameter, uint8_t *uid)
 // (some manufactures offer a way to read the AFI, though)
 void BruteforceIso15693Afi(uint32_t speed) 
 {	
+	LEDsoff();
+	LED_A_ON();
+	
 	uint8_t data[20];
 	uint8_t *recv=data;
 	int datalen=0, recvlen=0;
@@ -1079,7 +1168,7 @@ void BruteforceIso15693Afi(uint32_t speed)
 	data[1]=ISO15_CMD_INVENTORY;
 	data[2]=0; // mask length
 	datalen=AddCrc(data,3);
-	recvlen=SendDataTag(data,datalen,0,speed,&recv);
+	recvlen=SendDataTag(data, datalen, false, speed, &recv);
 	WDT_HIT();
 	if (recvlen>=12) {
 		Dbprintf("NoAFI UID=%s",sprintUID(NULL,&recv[2]));
@@ -1096,7 +1185,7 @@ void BruteforceIso15693Afi(uint32_t speed)
 	for (int i=0;i<256;i++) {
 		data[2]=i & 0xFF;
 		datalen=AddCrc(data,4);
-		recvlen=SendDataTag(data,datalen,0,speed,&recv);
+		recvlen=SendDataTag(data, datalen, false, speed, &recv);
 		WDT_HIT();
 		if (recvlen>=12) {
 			Dbprintf("AFI=%i UID=%s",i,sprintUID(NULL,&recv[2]));
@@ -1104,26 +1193,27 @@ void BruteforceIso15693Afi(uint32_t speed)
 	}	
 	Dbprintf("AFI Bruteforcing done.");
 	
+   	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	LEDsoff();
 }
 
 // Allows to directly send commands to the tag via the client
-void DirectTag15693Command(uint32_t datalen,uint32_t speed, uint32_t recv, uint8_t data[]) {
+void DirectTag15693Command(uint32_t datalen, uint32_t speed, uint32_t recv, uint8_t data[]) {
 
 	int recvlen=0;
 	uint8_t *recvbuf = BigBuf_get_addr();
-//	UsbCommand n;
+	
+	LED_A_ON();
 	
 	if (DEBUG) {
 		Dbprintf("SEND");
 		Dbhexdump(datalen,data,true);
 	}
 	
-	recvlen=SendDataTag(data,datalen,1,speed,(recv?&recvbuf:NULL));
+	recvlen = SendDataTag(data, datalen, true, speed, (recv?&recvbuf:NULL));
 
 	if (recv) { 
-		LED_B_ON();
-		cmd_send(CMD_ACK,recvlen>48?48:recvlen,0,0,recvbuf,48);
-		LED_B_OFF();	
+		cmd_send(CMD_ACK, recvlen>48?48:recvlen, 0, 0, recvbuf, 48);
 		
 		if (DEBUG) {
 			Dbprintf("RECV");
@@ -1132,6 +1222,12 @@ void DirectTag15693Command(uint32_t datalen,uint32_t speed, uint32_t recv, uint8
 		}
 	}
 
+	// for the time being, switch field off to protect rdv4.0 
+	// note: this prevents using hf 15 cmd with s option - which isn't implemented yet anyway
+   	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	LED_D_OFF();
+	
+	LED_A_OFF();
 }
 
 
diff --git a/client/cmdhf15.c b/client/cmdhf15.c
index b6a84c1c..c116b001 100644
--- a/client/cmdhf15.c
+++ b/client/cmdhf15.c
@@ -373,7 +373,8 @@ int CmdHF15Read(const char *Cmd)
 	return 0;
 }
 
-// Record Activity without enabeling carrier
+// Record Activity without enabling carrier
+// TODO: currently it DOES enable the carrier
 int CmdHF15Record(const char *Cmd)
 {
 	UsbCommand c = {CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693};
@@ -519,7 +520,7 @@ static command_t CommandTable15[] =
 	{"cmd",     CmdHF15Cmd,     0, "Send direct commands to ISO15693 tag"},
 	{"findafi", CmdHF15Afi,     0, "Brute force AFI of an ISO15693 tag"},
 	{"dumpmemory", CmdHF15DumpMem,     0, "Read all memory pages of an ISO15693 tag"},
-		{NULL, NULL, 0, NULL}
+	{NULL, NULL, 0, NULL}
 };
 
 int CmdHF15(const char *Cmd)
@@ -572,9 +573,9 @@ int CmdHF15CmdInquiry(const char *Cmd)
 
 // Turns debugging on(1)/off(0)
 int CmdHF15CmdDebug( const char *cmd) {
-	int debug=atoi(cmd);
-	if (strlen(cmd)<1) {
-		PrintAndLog("Usage: hf 15 cmd debug  <0|1>");
+	int debug = atoi(cmd);
+	if (strlen(cmd) < 1) {
+		PrintAndLog("Usage: hf 15 debug <0|1>");
 		PrintAndLog("	0 no debugging");
 		PrintAndLog("	1 turn debugging on");	
 		return 0;

From 2a537311063d3e49479ff4cc8b94287a10c37266 Mon Sep 17 00:00:00 2001
From: AntiCat <contiki@anticat.ch>
Date: Mon, 8 Oct 2018 07:15:29 +0200
Subject: [PATCH 24/28] osx: disable app-nap during serial comm (#687)

Apple introduced app-nap with OS X 10.10. This feature
saves power by throttling apps running in background.
However, it also less accurate timers in systemcalls. In
our case a 30ms select timeout would take up to 10s.

This patch uses an API also added with 10.10 to disable
app-nap as long as the serial port is polled.
---
 CHANGELOG.md         |  1 +
 client/Makefile      | 18 +++++++++++++-----
 client/comms.c       |  9 +++++++++
 client/util_darwin.h | 17 +++++++++++++++++
 client/util_darwin.m | 40 ++++++++++++++++++++++++++++++++++++++++
 5 files changed, 80 insertions(+), 5 deletions(-)
 create mode 100644 client/util_darwin.h
 create mode 100644 client/util_darwin.m

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 73306b1f..993dd636 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,6 +26,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
 - Changed start sequence in Qt mode (fix: short commands hangs main Qt thread) (Merlok)
 - Changed driver file proxmark3.inf to support both old and new Product/Vendor IDs (piwi)
 - Changed all command line parsers in `hf emv` commands to argtable (Merlok)
+- Implemented AppNap API, fixing #283 and #627 OSX USB comm issues (AntiCat)
 
 ### Added
 - Added `sc` smartcard (contact card) commands - reader, info, raw, upgrade, setclock, list (hardware version RDV4.0 only) must turn option on in makefile options (Willok, Iceman, marshmellow)
diff --git a/client/Makefile b/client/Makefile
index 90b16830..96f610cd 100644
--- a/client/Makefile
+++ b/client/Makefile
@@ -37,10 +37,12 @@ endif
 LUAPLATFORM = generic
 platform = $(shell uname)
 ifneq (,$(findstring MINGW,$(platform)))
-    LUAPLATFORM = mingw
+		LUAPLATFORM = mingw
 else
 	ifeq ($(platform),Darwin)
 		LUAPLATFORM = macosx
+		OBJCSRCS = util_darwin.m
+		LDFLAGS += -framework Foundation
 	else
 		LUALIB +=  -ldl
 		LDLIBS +=  -ltermcap -lncurses
@@ -210,6 +212,7 @@ QTGUISRCS = proxgui.cpp proxguiqt.cpp proxguiqt.moc.cpp guidummy.cpp
 
 COREOBJS = $(CORESRCS:%.c=$(OBJDIR)/%.o)
 CMDOBJS = $(CMDSRCS:%.c=$(OBJDIR)/%.o)
+OBJCOBJS = $(OBJCSRCS:%.m=$(OBJDIR)/%.o)
 ZLIBOBJS = $(ZLIBSRCS:%.c=$(OBJDIR)/%.o)
 MULTIARCHOBJS = $(MULTIARCHSRCS:%.c=$(OBJDIR)/%_NOSIMD.o) \
 			$(MULTIARCHSRCS:%.c=$(OBJDIR)/%_MMX.o) \
@@ -235,7 +238,7 @@ endif
 			
 BINS = proxmark3 flasher fpga_compress
 WINBINS = $(patsubst %, %.exe, $(BINS))
-CLEAN = $(BINS) $(WINBINS) $(COREOBJS) $(CMDOBJS) $(ZLIBOBJS) $(QTGUIOBJS) $(MULTIARCHOBJS) $(OBJDIR)/*.o *.moc.cpp ui/ui_overlays.h
+CLEAN = $(BINS) $(WINBINS) $(COREOBJS) $(CMDOBJS) $(OBJCOBJS) $(ZLIBOBJS) $(QTGUIOBJS) $(MULTIARCHOBJS) $(OBJDIR)/*.o *.moc.cpp ui/ui_overlays.h
 
 # need to assign dependancies to build these first...
 all: lua_build jansson_build $(BINS)
@@ -244,10 +247,10 @@ all-static: LDLIBS:=-static $(LDLIBS)
 all-static: proxmark3 flasher fpga_compress
 
 proxmark3: LDLIBS+=$(LUALIB) $(JANSSONLIB) $(QTLDLIBS)
-proxmark3: $(OBJDIR)/proxmark3.o $(COREOBJS) $(CMDOBJS) $(QTGUIOBJS) $(MULTIARCHOBJS) $(ZLIBOBJS) lualibs/usb_cmd.lua
-	$(LD) $(LDFLAGS) $(OBJDIR)/proxmark3.o $(COREOBJS) $(CMDOBJS) $(QTGUIOBJS) $(MULTIARCHOBJS) $(ZLIBOBJS) $(LDLIBS) -o $@
+proxmark3: $(OBJDIR)/proxmark3.o $(COREOBJS) $(CMDOBJS) $(OBJCOBJS) $(QTGUIOBJS) $(MULTIARCHOBJS) $(ZLIBOBJS) lualibs/usb_cmd.lua
+	$(LD) $(LDFLAGS) $(OBJDIR)/proxmark3.o $(COREOBJS) $(CMDOBJS) $(OBJCOBJS) $(QTGUIOBJS) $(MULTIARCHOBJS) $(ZLIBOBJS) $(LDLIBS) -o $@
 
-flasher: $(OBJDIR)/flash.o $(OBJDIR)/flasher.o $(COREOBJS)
+flasher: $(OBJDIR)/flash.o $(OBJDIR)/flasher.o $(COREOBJS) $(OBJCOBJS)
 	$(LD) $(LDFLAGS) $^ $(LDLIBS) -o $@
 
 fpga_compress: $(OBJDIR)/fpga_compress.o $(ZLIBOBJS)
@@ -310,6 +313,10 @@ $(OBJDIR)/%.o : %.cpp $(OBJDIR)/%.d
 	$(CXX) $(DEPFLAGS) $(CXXFLAGS) $(QTINCLUDES) -c -o $@ $<
 	$(POSTCOMPILE)
 
+%.o: %.m
+$(OBJDIR)/%.o : %.m $(OBJDIR)/%.d
+	$(CC) $(DEPFLAGS) $(CFLAGS) -c -o $@ $<
+	$(POSTCOMPILE)
 
 #$(CMDOBJS) $(COREOBJS): $(notdir $(%.c)) %.d
 #	$(CC) $(DEPFLAGS) $(CFLAGS) -c -o $@ $<
@@ -325,6 +332,7 @@ $(OBJDIR)/%.o : %.cpp $(OBJDIR)/%.d
 
 DEPENDENCY_FILES = $(patsubst %.c, $(OBJDIR)/%.d, $(CORESRCS) $(CMDSRCS) $(ZLIBSRCS) $(MULTIARCHSRCS)) \
 	$(patsubst %.cpp, $(OBJDIR)/%.d, $(QTGUISRCS)) \
+	$(patsubst %.m, $(OBJDIR)/%.d, $(OBJCSRCS)) \
 	$(OBJDIR)/proxmark3.d $(OBJDIR)/flash.d $(OBJDIR)/flasher.d $(OBJDIR)/fpga_compress.d
 
 $(DEPENDENCY_FILES): ;
diff --git a/client/comms.c b/client/comms.c
index 0c4efa73..190b9110 100644
--- a/client/comms.c
+++ b/client/comms.c
@@ -18,6 +18,7 @@
 #include "uart.h"
 #include "ui.h"
 #include "common.h"
+#include "util_darwin.h"
 #include "util_posix.h"
 
 
@@ -198,6 +199,10 @@ __attribute__((force_align_arg_pointer))
 	UsbCommand rx;
 	UsbCommand *prx = &rx;
 
+#if defined(__MACH__) && defined(__APPLE__)
+	disableAppNap("Proxmark3 polling UART");
+#endif
+
 	while (conn->run) {
 		rxlen = 0;
 		bool ACK_received = false;
@@ -236,6 +241,10 @@ __attribute__((force_align_arg_pointer))
 		pthread_mutex_unlock(&txBufferMutex);
 	}
 
+#if defined(__MACH__) && defined(__APPLE__)
+	enableAppNap();
+#endif
+
 	pthread_exit(NULL);
 	return NULL;
 }
diff --git a/client/util_darwin.h b/client/util_darwin.h
new file mode 100644
index 00000000..923a4dfc
--- /dev/null
+++ b/client/util_darwin.h
@@ -0,0 +1,17 @@
+//-----------------------------------------------------------------------------
+// (c) 2018 AntiCat
+//
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// macOS framework bindings
+//-----------------------------------------------------------------------------
+
+#ifndef UTIL_DARWIN_H__
+#define UTIL_DARWIN_H__
+
+void disableAppNap(const char* reason);
+void enableAppNap();
+
+#endif
\ No newline at end of file
diff --git a/client/util_darwin.m b/client/util_darwin.m
new file mode 100644
index 00000000..d07ebebc
--- /dev/null
+++ b/client/util_darwin.m
@@ -0,0 +1,40 @@
+//-----------------------------------------------------------------------------
+// (c) 2018 AntiCat
+//
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// macOS framework bindings
+//-----------------------------------------------------------------------------
+
+#import "util_darwin.h"
+
+#import <Foundation/NSString.h>
+#import <Foundation/NSProcessInfo.h>
+
+static id activity = nil;
+
+//OS X Version 10.10 is defined in OS X 10.10 and later
+#if defined(MAC_OS_X_VERSION_10_10)
+void disableAppNap(const char* reason) {
+	if(activity == nil) {
+		//NSLog(@"disableAppNap: %@", @(reason));
+		activity = [[NSProcessInfo processInfo] beginActivityWithOptions:NSActivityBackground reason:@(reason)];
+		[activity retain];
+	}
+}
+
+void enableAppNap() {
+	if(activity != nil) {
+		//NSLog(@"enableAppNap");
+		[[NSProcessInfo processInfo] endActivity:activity];
+		[activity release];
+		activity = nil;
+	}
+}
+
+#else
+void disableAppNap(const char* reason) { }
+void enableAppNap() { }
+#endif

From b742ab8cc3fa259990551f2d4265c09681ba705f Mon Sep 17 00:00:00 2001
From: AntiCat <contiki@anticat.ch>
Date: Mon, 8 Oct 2018 07:20:21 +0200
Subject: [PATCH 25/28] osx: fix annoying focus behaviour (#689)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

OS X has a global menu bar and a per app dock icon. Therefore, all
GUI applications launched from a terminal will become focused - even
if they don’t show any windows. Thereby the terminal loses focus.

Since is it very annoying to re-focus the terminal after each proxmark
client launch, this change makes the client unfocusable during launch
and restores the regular behaviour when a window is created.
---
 client/Makefile      |  2 +-
 client/proxguiqt.cpp | 14 ++++++++++++++
 client/util_darwin.h |  3 +++
 client/util_darwin.m | 15 +++++++++++++++
 4 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/client/Makefile b/client/Makefile
index 96f610cd..9e5bde30 100644
--- a/client/Makefile
+++ b/client/Makefile
@@ -42,7 +42,7 @@ else
 	ifeq ($(platform),Darwin)
 		LUAPLATFORM = macosx
 		OBJCSRCS = util_darwin.m
-		LDFLAGS += -framework Foundation
+		LDFLAGS += -framework Foundation -framework AppKit
 	else
 		LUALIB +=  -ldl
 		LDLIBS +=  -ltermcap -lncurses
diff --git a/client/proxguiqt.cpp b/client/proxguiqt.cpp
index 8fc1f990..30e4c8de 100644
--- a/client/proxguiqt.cpp
+++ b/client/proxguiqt.cpp
@@ -26,6 +26,10 @@
 #include <string.h>
 #include "proxgui.h"
 #include <QtGui>
+
+extern "C" {
+#include "util_darwin.h"
+}
 //#include <ctime>
 
 bool g_useOverlays = false;
@@ -60,7 +64,12 @@ void ProxGuiQT::_ShowGraphWindow(void)
 		return;
 
 	if (!plotwidget)
+	{
+#if defined(__MACH__) && defined(__APPLE__)
+		makeFocusable();
+#endif
 		plotwidget = new ProxWidget();
+	}
 
 	plotwidget->show();
 }
@@ -108,6 +117,11 @@ void ProxGuiQT::MainLoop()
 	//start proxmark thread after starting event loop
 	QTimer::singleShot(200, this, SLOT(_StartProxmarkThread()));
 
+#if defined(__MACH__) && defined(__APPLE__)
+	//Prevent the terminal from loosing focus during launch by making the client unfocusable
+	makeUnfocusable();
+#endif
+
 	plotapp->exec();
 }
 
diff --git a/client/util_darwin.h b/client/util_darwin.h
index 923a4dfc..dd159ec5 100644
--- a/client/util_darwin.h
+++ b/client/util_darwin.h
@@ -14,4 +14,7 @@
 void disableAppNap(const char* reason);
 void enableAppNap();
 
+void makeUnfocusable();
+void makeFocusable();
+
 #endif
\ No newline at end of file
diff --git a/client/util_darwin.m b/client/util_darwin.m
index d07ebebc..c0f69aa9 100644
--- a/client/util_darwin.m
+++ b/client/util_darwin.m
@@ -12,6 +12,7 @@
 
 #import <Foundation/NSString.h>
 #import <Foundation/NSProcessInfo.h>
+#import <AppKit/NSApplication.h>
 
 static id activity = nil;
 
@@ -38,3 +39,17 @@ void enableAppNap() {
 void disableAppNap(const char* reason) { }
 void enableAppNap() { }
 #endif
+
+//OS X Version 10.6 is defined in OS X 10.6 and later
+#if defined(MAC_OS_X_VERSION_10_6)
+void makeUnfocusable() {
+	[NSApp setActivationPolicy:NSApplicationActivationPolicyProhibited];
+}
+
+void makeFocusable() {
+	[NSApp setActivationPolicy:NSApplicationActivationPolicyRegular];
+}
+#else
+void makeUnfocusable() { }
+void makeFocusable() { }
+#endif

From 92479429c2e3526fce39a09d19ca0856bb041a09 Mon Sep 17 00:00:00 2001
From: Oleg Moiseenko <olegmsn@gmail.com>
Date: Mon, 8 Oct 2018 08:48:37 +0300
Subject: [PATCH 26/28] Added loading parameters from json to several emv
 commands  (#686)

* added loading params from GPO
* `hf emv pdol` added help and warning
* started `hf emv ac`
* dol calculation implemented in genac and intauth
* help fix
---
 client/emv/cmdemv.c | 386 ++++++++++++++++++++++++++------------------
 1 file changed, 228 insertions(+), 158 deletions(-)

diff --git a/client/emv/cmdemv.c b/client/emv/cmdemv.c
index 544632ef..6bac90d6 100644
--- a/client/emv/cmdemv.c
+++ b/client/emv/cmdemv.c
@@ -14,6 +14,31 @@
 #include "cliparser/cliparser.h"
 #include <jansson.h>
 
+bool HexToBuffer(const char *errormsg, const char *hexvalue, uint8_t * buffer, size_t maxbufferlen, size_t *bufferlen) {
+	int buflen = 0;	
+	
+	switch(param_gethex_to_eol(hexvalue, 0, buffer, maxbufferlen, &buflen)) {
+	case 1:
+		PrintAndLog("%s Invalid HEX value.", errormsg);
+		return false;
+	case 2:
+		PrintAndLog("%s Hex value too large.", errormsg);
+		return false;
+	case 3:
+		PrintAndLog("%s Hex value must have even number of digits.", errormsg);
+		return false;
+	}
+	
+	if (buflen > maxbufferlen) {
+		PrintAndLog("%s HEX length (%d) more than %d", errormsg, *bufferlen, maxbufferlen);
+		return false;
+	}
+	
+	*bufferlen = buflen;
+	
+	return true;
+}
+
 #define TLV_ADD(tag, value)( tlvdb_change_or_add_node(tlvRoot, tag, sizeof(value) - 1, (const unsigned char *)value) )
 void ParamLoadDefaults(struct tlvdb *tlvRoot) {
 	//9F02:(Amount, authorized (Numeric)) len:6
@@ -35,6 +60,111 @@ void ParamLoadDefaults(struct tlvdb *tlvRoot) {
 	TLV_ADD(0x9F66, "\x26\x00\x00\x00"); // qVSDC
 }
 
+bool ParamLoadFromJson(struct tlvdb *tlv) {
+	json_t *root;
+	json_error_t error;
+
+	if (!tlv) {
+		PrintAndLog("ERROR load params: tlv tree is NULL.");
+		return false; 
+	}
+
+	// current path + file name
+	const char *relfname = "emv/defparams.json"; 
+	char fname[strlen(get_my_executable_directory()) + strlen(relfname) + 1];
+	strcpy(fname, get_my_executable_directory());
+	strcat(fname, relfname);
+
+	root = json_load_file(fname, 0, &error);
+	if (!root) {
+		PrintAndLog("Load params: json error on line %d: %s", error.line, error.text);
+		return false; 
+	}
+	
+	if (!json_is_array(root)) {
+		PrintAndLog("Load params: Invalid json format. root must be array.");
+		return false; 
+	}
+	
+	PrintAndLog("Load params: json OK");
+	
+	for(int i = 0; i < json_array_size(root); i++) {
+		json_t *data, *jtype, *jlength, *jvalue;
+
+		data = json_array_get(root, i);
+		if(!json_is_object(data))
+		{
+			PrintAndLog("Load params: data [%d] is not an object", i + 1);
+			json_decref(root);
+			return false;
+		}
+		
+		jtype = json_object_get(data, "type");
+		if(!json_is_string(jtype))
+		{
+			PrintAndLog("Load params: data [%d] type is not a string", i + 1);
+			json_decref(root);
+			return false;
+		}
+		const char *tlvType = json_string_value(jtype);
+
+		jvalue = json_object_get(data, "value");
+		if(!json_is_string(jvalue))
+		{
+			PrintAndLog("Load params: data [%d] value is not a string", i + 1);
+			json_decref(root);
+			return false;
+		}
+		const char *tlvValue = json_string_value(jvalue);
+
+		jlength = json_object_get(data, "length");
+		if(!json_is_number(jlength))
+		{
+			PrintAndLog("Load params: data [%d] length is not a number", i + 1);
+			json_decref(root);
+			return false;
+		}
+		
+		int tlvLength = json_integer_value(jlength);
+		if (tlvLength > 250) {
+			PrintAndLog("Load params: data [%d] length more than 250", i + 1);
+			json_decref(root);
+			return false;
+		}
+		
+		PrintAndLog("TLV param: %s[%d]=%s", tlvType, tlvLength, tlvValue);
+		uint8_t buf[251] = {0};
+		size_t buflen = 0;
+		
+		// here max length must be 4, but now tlv_tag_t is 2-byte var. so let it be 2 by now...  TODO: needs refactoring tlv_tag_t...
+		if (!HexToBuffer("TLV Error type:", tlvType, buf, 2, &buflen)) { 
+			json_decref(root);
+			return false;
+		}
+		tlv_tag_t tag = 0;
+		for (int i = 0; i < buflen; i++) {
+			tag = (tag << 8) + buf[i];
+		}	
+		
+		if (!HexToBuffer("TLV Error value:", tlvValue, buf, sizeof(buf) - 1, &buflen)) {
+			json_decref(root);
+			return false;
+		}
+		
+		if (buflen != tlvLength) {
+			PrintAndLog("Load params: data [%d] length of HEX must(%d) be identical to length in TLV param(%d)", i + 1, buflen, tlvLength);
+			json_decref(root);
+			return false;
+		}
+		
+		tlvdb_change_or_add_node(tlv, tag, tlvLength, (const unsigned char *)buf);		
+	}
+
+	json_decref(root);
+
+	return true;
+}
+
 int CmdHFEMVSelect(const char *cmd) {
 	uint8_t data[APDU_AID_LEN] = {0};
 	int datalen = 0;
@@ -183,14 +313,14 @@ int CmdHFEMVGPO(const char *cmd) {
 	CLIParserInit("hf emv gpo", 
 		"Executes Get Processing Options command. It returns data in TLV format (0x77 - format2) or plain format (0x80 - format1).\nNeeds a EMV applet to be selected.", 
 		"Usage:\n\thf emv gpo -k -> execute GPO\n"
-			"\thf emv gpo -t 01020304 -> execute GPO with 4-byte PDOL data, show result in TLV\n"); 
-			// here need to add load params from file and gen pdol
+			"\thf emv gpo -t 01020304 -> execute GPO with 4-byte PDOL data, show result in TLV\n"
+			"\thf emv gpo -pmt 9F 37 04 -> load params from file, make PDOL data from PDOL, execute GPO with PDOL, show result in TLV\n"); 
 
 	void* argtable[] = {
 		arg_param_begin,
 		arg_lit0("kK",  "keep",    "keep field ON for next command"),
-		arg_lit0("pP",  "params",  "load parameters for PDOL making from `emv/defparams.json` file (by default uses default parameters) (NOT WORK!!!)"),
-		arg_lit0("mM",  "make",    "make PDOLdata from PDOL (tag 9F38) and parameters (NOT WORK!!!)"),
+		arg_lit0("pP",  "params",  "load parameters from `emv/defparams.json` file for PDOLdata making from PDOL and parameters"),
+		arg_lit0("mM",  "make",    "make PDOLdata from PDOL (tag 9F38) and parameters (by default uses default parameters)"),
 		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
 		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
 		arg_strx0(NULL,  NULL,     "<HEX PDOLdata/PDOL>", NULL),
@@ -220,21 +350,23 @@ int CmdHFEMVGPO(const char *cmd) {
 		.value = (uint8_t *)data,
 	};
 	if (dataMakeFromPDOL) {
-		// TODO
-		PrintAndLog("Make PDOL data not implemented!");
-
 		ParamLoadDefaults(tlvRoot);
 
 		if (paramsLoadFromFile) {
+			PrintAndLog("Params loading from file...");
+			ParamLoadFromJson(tlvRoot);
 		};
-/*		pdol_data_tlv = dol_process(tlvdb_get(tlvRoot, 0x9f38, NULL), tlvRoot, 0x83);
+		
+		pdol_data_tlv = dol_process((const struct tlv *)tlvdb_external(0x9f38, datalen, data), tlvRoot, 0x83);
 		if (!pdol_data_tlv){
 			PrintAndLog("ERROR: can't create PDOL TLV.");
 			tlvdb_free(tlvRoot);
 			return 4;
-		}*/
-		return 0;
+		}
 	} else {
+		if (paramsLoadFromFile) {
+			PrintAndLog("WARNING: don't need to load parameters. Sending plain PDOL data...");
+		}
 		pdol_data_tlv = &data_tlv;
 	}
 
@@ -253,7 +385,8 @@ int CmdHFEMVGPO(const char *cmd) {
 	uint16_t sw = 0;
 	int res = EMVGPO(leaveSignalON, pdol_data_tlv_data, pdol_data_tlv_data_len, buf, sizeof(buf), &len, &sw, tlvRoot);
 	
-	free(pdol_data_tlv_data);
+	if (pdol_data_tlv != &data_tlv)
+		free(pdol_data_tlv);
 	tlvdb_free(tlvRoot);
 	
 	if (sw)
@@ -326,16 +459,19 @@ int CmdHFEMVAC(const char *cmd) {
 		"Generate Application Cryptogram command. It returns data in TLV format .\nNeeds a EMV applet to be selected and GPO to be executed.", 
 		"Usage:\n\thf emv genac -k 0102 -> generate AC with 2-byte CDOLdata and keep field ON after command\n"
 			"\thf emv genac -t 01020304 -> generate AC with 4-byte CDOL data, show result in TLV\n"
-			"\thf emv genac -Daac 01020304 -> generate AC with 4-byte CDOL data and terminal decision 'declined'\n"); 
+			"\thf emv genac -Daac 01020304 -> generate AC with 4-byte CDOL data and terminal decision 'declined'\n"
+			"\thf emv genac -pmt 9F 37 04 -> load params from file, make CDOL data from CDOL, generate AC with CDOL, show result in TLV"); 
 
 	void* argtable[] = {
 		arg_param_begin,
 		arg_lit0("kK",  "keep",     "keep field ON for next command"),
 		arg_lit0("cC",  "cda",      "executes CDA transaction. Needs to get SDAD in results."),
 		arg_str0("dD",  "decision", "<aac|tc|arqc>", "Terminal decision. aac - declined, tc - approved, arqc - online authorisation requested"),
+		arg_lit0("pP",  "params",   "load parameters from `emv/defparams.json` file for CDOLdata making from CDOL and parameters"),
+		arg_lit0("mM",  "make",     "make CDOLdata from CDOL (tag 8C and 8D) and parameters (by default uses default parameters)"),
 		arg_lit0("aA",  "apdu",     "show APDU reqests and responses"),
 		arg_lit0("tT",  "tlv",      "TLV decode results of selected applets"),
-		arg_strx1(NULL,  NULL,      "<HEX CDOLdata>", NULL),
+		arg_strx1(NULL,  NULL,      "<HEX CDOLdata/CDOL>", NULL),
 		arg_param_end
 	};
 	CLIExecWithReturn(cmd, argtable, false);
@@ -360,9 +496,11 @@ int CmdHFEMVAC(const char *cmd) {
 	}
 	if (trTypeCDA)
 		termDecision = termDecision | EMVAC_CDAREQ;
-	bool APDULogging = arg_get_lit(4);
-	bool decodeTLV = arg_get_lit(5);
-	CLIGetStrWithReturn(6, data, &datalen);
+	bool paramsLoadFromFile = arg_get_lit(4);
+	bool dataMakeFromCDOL = arg_get_lit(5);
+	bool APDULogging = arg_get_lit(6);
+	bool decodeTLV = arg_get_lit(7);
+	CLIGetStrWithReturn(8, data, &datalen);
 	CLIParserFree();	
 	
 	SetAPDULogging(APDULogging);
@@ -373,22 +511,43 @@ int CmdHFEMVAC(const char *cmd) {
 	
 	// calc CDOL
 	struct tlv *cdol_data_tlv = NULL;
-//	struct tlv *cdol_data_tlv = dol_process(tlvdb_get(tlvRoot, 0x8c, NULL), tlvRoot, 0x01); // 0x01 - dummy tag
 	struct tlv data_tlv = {
 		.tag = 0x01,
 		.len = datalen,
 		.value = (uint8_t *)data,
-	};	
-	cdol_data_tlv = &data_tlv;
-	PrintAndLog("CDOL data[%d]: %s", cdol_data_tlv->len, sprint_hex(cdol_data_tlv->value, cdol_data_tlv->len));
+	};
 	
+	if (dataMakeFromCDOL) {
+		ParamLoadDefaults(tlvRoot);
+
+		if (paramsLoadFromFile) {
+			PrintAndLog("Params loading from file...");
+			ParamLoadFromJson(tlvRoot);
+		};
+		
+		cdol_data_tlv = dol_process((const struct tlv *)tlvdb_external(0x8c, datalen, data), tlvRoot, 0x01); // 0x01 - dummy tag
+		if (!cdol_data_tlv){
+			PrintAndLog("ERROR: can't create CDOL TLV.");
+			tlvdb_free(tlvRoot);
+			return 4;
+		}
+	} else {
+		if (paramsLoadFromFile) {
+			PrintAndLog("WARNING: don't need to load parameters. Sending plain CDOL data...");
+		}
+		cdol_data_tlv = &data_tlv;
+	}
+	
+	PrintAndLog("CDOL data[%d]: %s", cdol_data_tlv->len, sprint_hex(cdol_data_tlv->value, cdol_data_tlv->len));
+
 	// exec
 	uint8_t buf[APDU_RES_LEN] = {0};
 	size_t len = 0;
 	uint16_t sw = 0;
 	int res = EMVAC(leaveSignalON, termDecision, (uint8_t *)cdol_data_tlv->value, cdol_data_tlv->len, buf, sizeof(buf), &len, &sw, tlvRoot);
 	
-//	free(cdol_data_tlv);
+	if (cdol_data_tlv != &data_tlv)
+		free(cdol_data_tlv);
 	tlvdb_free(tlvRoot);
 	
 	if (sw)
@@ -450,28 +609,65 @@ int CmdHFEMVInternalAuthenticate(const char *cmd) {
 	CLIParserInit("hf emv intauth", 
 		"Generate Internal Authenticate command. Usually needs 4-byte random number. It returns data in TLV format .\nNeeds a EMV applet to be selected and GPO to be executed.", 
 		"Usage:\n\thf emv intauth -k 01020304 -> execute Internal Authenticate with 4-byte DDOLdata and keep field ON after command\n"
-			"\thf emv intauth -t 01020304 -> execute Internal Authenticate with 4-byte DDOL data, show result in TLV\n"); 
+			"\thf emv intauth -t 01020304 -> execute Internal Authenticate with 4-byte DDOL data, show result in TLV\n"
+			"\thf emv intauth -pmt 9F 37 04 -> load params from file, make DDOL data from DDOL, Internal Authenticate with DDOL, show result in TLV"); 
 
 	void* argtable[] = {
 		arg_param_begin,
 		arg_lit0("kK",  "keep",    "keep field ON for next command"),
+		arg_lit0("pP",  "params",  "load parameters from `emv/defparams.json` file for DDOLdata making from DDOL and parameters"),
+		arg_lit0("mM",  "make",    "make DDOLdata from DDOL (tag 9F49) and parameters (by default uses default parameters)"),
 		arg_lit0("aA",  "apdu",    "show APDU reqests and responses"),
 		arg_lit0("tT",  "tlv",     "TLV decode results of selected applets"),
-		arg_strx1(NULL,  NULL,     "<HEX DDOLdata>", NULL),
+		arg_strx1(NULL,  NULL,     "<HEX DDOLdata/DDOL>", NULL),
 		arg_param_end
 	};
 	CLIExecWithReturn(cmd, argtable, false);
 	
 	bool leaveSignalON = arg_get_lit(1);
-	bool APDULogging = arg_get_lit(2);
-	bool decodeTLV = arg_get_lit(3);
-	CLIGetStrWithReturn(4, data, &datalen);
+	bool paramsLoadFromFile = arg_get_lit(2);
+	bool dataMakeFromDDOL = arg_get_lit(3);
+	bool APDULogging = arg_get_lit(4);
+	bool decodeTLV = arg_get_lit(5);
+	CLIGetStrWithReturn(6, data, &datalen);
 	CLIParserFree();	
 	
 	SetAPDULogging(APDULogging);
+
+	// Init TLV tree
+	const char *alr = "Root terminal TLV tree";
+	struct tlvdb *tlvRoot = tlvdb_fixed(1, strlen(alr), (const unsigned char *)alr);
 	
-	// DDOL
-	PrintAndLog("DDOL data[%d]: %s", datalen, sprint_hex(data, datalen));
+	// calc DDOL
+	struct tlv *ddol_data_tlv = NULL;
+	struct tlv data_tlv = {
+		.tag = 0x01,
+		.len = datalen,
+		.value = (uint8_t *)data,
+	};
+	
+	if (dataMakeFromDDOL) {
+		ParamLoadDefaults(tlvRoot);
+
+		if (paramsLoadFromFile) {
+			PrintAndLog("Params loading from file...");
+			ParamLoadFromJson(tlvRoot);
+		};
+		
+		ddol_data_tlv = dol_process((const struct tlv *)tlvdb_external(0x9f49, datalen, data), tlvRoot, 0x01); // 0x01 - dummy tag
+		if (!ddol_data_tlv){
+			PrintAndLog("ERROR: can't create DDOL TLV.");
+			tlvdb_free(tlvRoot);
+			return 4;
+		}
+	} else {
+		if (paramsLoadFromFile) {
+			PrintAndLog("WARNING: don't need to load parameters. Sending plain DDOL data...");
+		}
+		ddol_data_tlv = &data_tlv;
+	}
+	
+	PrintAndLog("DDOL data[%d]: %s", ddol_data_tlv->len, sprint_hex(ddol_data_tlv->value, ddol_data_tlv->len));
 	
 	// exec
 	uint8_t buf[APDU_RES_LEN] = {0};
@@ -479,6 +675,10 @@ int CmdHFEMVInternalAuthenticate(const char *cmd) {
 	uint16_t sw = 0;
 	int res = EMVInternalAuthenticate(leaveSignalON, data, datalen, buf, sizeof(buf), &len, &sw, NULL);
 	
+	if (ddol_data_tlv != &data_tlv)
+		free(ddol_data_tlv);
+	tlvdb_free(tlvRoot);	
+	
 	if (sw)
 		PrintAndLog("APDU response status: %04x - %s", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); 
 
@@ -493,136 +693,6 @@ int CmdHFEMVInternalAuthenticate(const char *cmd) {
 
 #define dreturn(n) {free(pdol_data_tlv);tlvdb_free(tlvSelect);tlvdb_free(tlvRoot);DropField();return n;}
 
-bool HexToBuffer(const char *errormsg, const char *hexvalue, uint8_t * buffer, size_t maxbufferlen, size_t *bufferlen) {
-	int buflen = 0;	
-	
-	switch(param_gethex_to_eol(hexvalue, 0, buffer, maxbufferlen, &buflen)) {
-	case 1:
-		PrintAndLog("%s Invalid HEX value.", errormsg);
-		return false;
-	case 2:
-		PrintAndLog("%s Hex value too large.", errormsg);
-		return false;
-	case 3:
-		PrintAndLog("%s Hex value must have even number of digits.", errormsg);
-		return false;
-	}
-	
-	if (buflen > maxbufferlen) {
-		PrintAndLog("%s HEX length (%d) more than %d", errormsg, *bufferlen, maxbufferlen);
-		return false;
-	}
-	
-	*bufferlen = buflen;
-	
-	return true;
-}
-
-bool ParamLoadFromJson(struct tlvdb *tlv) {
-	json_t *root;
-	json_error_t error;
-
-	if (!tlv) {
-		PrintAndLog("ERROR load params: tlv tree is NULL.");
-		return false; 
-	}
-
-	// current path + file name
-	const char *relfname = "emv/defparams.json"; 
-	char fname[strlen(get_my_executable_directory()) + strlen(relfname) + 1];
-	strcpy(fname, get_my_executable_directory());
-	strcat(fname, relfname);
-
-	root = json_load_file(fname, 0, &error);
-	if (!root) {
-		PrintAndLog("Load params: json error on line %d: %s", error.line, error.text);
-		return false; 
-	}
-	
-	if (!json_is_array(root)) {
-		PrintAndLog("Load params: Invalid json format. root must be array.");
-		return false; 
-	}
-	
-	PrintAndLog("Load params: json OK");
-	
-	for(int i = 0; i < json_array_size(root); i++) {
-		json_t *data, *jtype, *jlength, *jvalue;
-
-		data = json_array_get(root, i);
-		if(!json_is_object(data))
-		{
-			PrintAndLog("Load params: data [%d] is not an object", i + 1);
-			json_decref(root);
-			return false;
-		}
-		
-		jtype = json_object_get(data, "type");
-		if(!json_is_string(jtype))
-		{
-			PrintAndLog("Load params: data [%d] type is not a string", i + 1);
-			json_decref(root);
-			return false;
-		}
-		const char *tlvType = json_string_value(jtype);
-
-		jvalue = json_object_get(data, "value");
-		if(!json_is_string(jvalue))
-		{
-			PrintAndLog("Load params: data [%d] value is not a string", i + 1);
-			json_decref(root);
-			return false;
-		}
-		const char *tlvValue = json_string_value(jvalue);
-
-		jlength = json_object_get(data, "length");
-		if(!json_is_number(jlength))
-		{
-			PrintAndLog("Load params: data [%d] length is not a number", i + 1);
-			json_decref(root);
-			return false;
-		}
-		
-		int tlvLength = json_integer_value(jlength);
-		if (tlvLength > 250) {
-			PrintAndLog("Load params: data [%d] length more than 250", i + 1);
-			json_decref(root);
-			return false;
-		}
-		
-		PrintAndLog("TLV param: %s[%d]=%s", tlvType, tlvLength, tlvValue);
-		uint8_t buf[251] = {0};
-		size_t buflen = 0;
-		
-		// here max length must be 4, but now tlv_tag_t is 2-byte var. so let it be 2 by now...  TODO: needs refactoring tlv_tag_t...
-		if (!HexToBuffer("TLV Error type:", tlvType, buf, 2, &buflen)) { 
-			json_decref(root);
-			return false;
-		}
-		tlv_tag_t tag = 0;
-		for (int i = 0; i < buflen; i++) {
-			tag = (tag << 8) + buf[i];
-		}	
-		
-		if (!HexToBuffer("TLV Error value:", tlvValue, buf, sizeof(buf) - 1, &buflen)) {
-			json_decref(root);
-			return false;
-		}
-		
-		if (buflen != tlvLength) {
-			PrintAndLog("Load params: data [%d] length of HEX must(%d) be identical to length in TLV param(%d)", i + 1, buflen, tlvLength);
-			json_decref(root);
-			return false;
-		}
-		
-		tlvdb_change_or_add_node(tlv, tag, tlvLength, (const unsigned char *)buf);		
-	}
-
-	json_decref(root);
-
-	return true;
-}
-
 int CmdHFEMVExec(const char *cmd) {
 	uint8_t buf[APDU_RES_LEN] = {0};
 	size_t len = 0;

From 9f3839139568c064633102c3da240be65d8c6205 Mon Sep 17 00:00:00 2001
From: pwpiwi <pwpiwi@users.noreply.github.com>
Date: Wed, 10 Oct 2018 08:13:40 +0200
Subject: [PATCH 27/28] Update CHANGELOG for 3.1.0 release

---
 CHANGELOG.md | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 993dd636..fbc40cda 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,19 +2,26 @@
 All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
-
 ## [unreleased][unreleased]
 
+### Changed
+
+### Fixed
+
+### Added
+
+## [v3.1.0][2018-10-10]
+
 ### Changed
 - Adjusted `lf cmdread` to respond to client when complete and the client will then automatically call `data samples`
-- Improved backdoor detection missbehaving magic s50/1k tag (Fl0-0)
+- Improved backdoor detection misbehaving magic s50/1k tag (Fl0-0)
 - Deleted wipe functionality from `hf mf csetuid` (Merlok)
 - Changed `hf mf nested` logic (Merlok)
 - Added `hf mf nested` mode: autosearch keys for attack (from well known keys) (Merlok)
 - `hf mf nested` Check keys after they have found (Merlok)
 - `hf mf chk` Move main cycle to arm (Merlok)
 - Changed proxmark command line parameter `flush` to `-f` or `-flush` (Merlok)
-- Changed `hf 14a reader` to just reqest-anticilission-select sequence (Merlok)
+- Changed `hf 14a reader` to just request-anticolission-select sequence (Merlok)
 - Changed `hf 14a raw` - works with LED's and some exchange logic (Merlok)
 - Changed TLV parser messages to more convenient (Merlok)
 - Rewritten Legic Prime reader (`hf legic reader`, `write` and `fill`) - it is using xcorrelation now (AntiCat)
@@ -33,14 +40,14 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
 - Added a bitbang mode to `lf cmdread` if delay is 0 the cmd bits turn off and on the antenna with 0 and 1 respectively (marshmellow)
 - Added PAC/Stanley detection to lf search (marshmellow)
 - Added lf pac demod and lf pac read - extracts the raw blocks from a PAC/Stanley tag (marshmellow)
-- Added hf mf c* commands compatibity for 4k and gen1b backdoor (Fl0-0)
+- Added hf mf c* commands compatibility for 4k and gen1b backdoor (Fl0-0)
 - Added backdoor detection for gen1b magic s70/4k tag (Fl0-0)
 - Added data fsktonrz, a fsk cleaning/demodulating routine for weak fsk signal. Note: follow this up with a `data rawdemod nr` to finish demoding your signal. (marshmellow)
 - Added lf em 410xbrute, LF EM410x reader bruteforce attack by simulating UIDs from a file (Fl0-0)
 - Added `hf mf cwipe` command. It wipes "magic Chinese" card. For 1a generation it uses card's "wipe" command. For gen1a and gen1b it uses a write command. (Merlok)
 - Added to `hf mf nested` source key check before attack (Merlok)
 - Added to `hf mf nested` after attack it checks all found keys on non-open sectors (Merlok)
-- `hf mf chk` Added setings to set iso14443a operations timeout. default timeout set to 500us (Merlok)
+- `hf mf chk` Added settings to set iso14443a operations timeout. default timeout set to 500us (Merlok)
 - Added to `hf mf nested` parameters `s` and `ss` for checking slow cards (Merlok)
 - Added to proxmark command line parameters `w` - wait 20s for serial port (Merlok)
 - Added to proxmark command line parameters `c` and `l` - execute command and lua script from command line (Merlok)

From 7dadcc959fb7009b6e8bbde4a644aa2f7f1b7a98 Mon Sep 17 00:00:00 2001
From: Oleg Moiseenko <olegmsn@gmail.com>
Date: Wed, 10 Oct 2018 23:34:04 +0300
Subject: [PATCH 28/28] auth 14443-4 (#692)

* AES authentication
---
 client/cmdhf14a.c |  89 ++++++++++++++++++++++++++++
 client/cmdhf14a.h |   1 +
 client/cmdhfmf.c  | 147 ++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 237 insertions(+)

diff --git a/client/cmdhf14a.c b/client/cmdhf14a.c
index 94eb8ff3..a5de2e2a 100644
--- a/client/cmdhf14a.c
+++ b/client/cmdhf14a.c
@@ -648,6 +648,95 @@ void DropField() {
 	SendCommand(&c);
 }
 
+int ExchangeRAW14a(uint8_t *datain, int datainlen, bool activateField, bool leaveSignalON, uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
+	uint16_t cmdc = 0;
+	*dataoutlen = 0;
+	
+	if (activateField) {
+		UsbCommand resp;
+
+		// Anticollision + SELECT card
+		UsbCommand ca = {CMD_READER_ISO_14443a, {ISO14A_CONNECT | ISO14A_NO_DISCONNECT | ISO14A_CLEAR_TRACE, 0, 0}};
+		SendCommand(&ca);
+		if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
+			PrintAndLog("14aRAW ERROR: Proxmark connection timeout.");
+			return 1;
+		}
+
+		// check result
+		if (resp.arg[0] == 0) {
+			PrintAndLog("14aRAW ERROR: No card in field.");
+			return 1;
+		}
+
+		if (resp.arg[0] != 1 && resp.arg[0] != 2) {
+			PrintAndLog("14aRAW ERROR: card not in iso14443-4. res=%d.", resp.arg[0]);
+			return 1;
+		}
+
+		if (resp.arg[0] == 2) {		// 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS, 3: proprietary Anticollision
+			// get ATS 
+			UsbCommand cr = {CMD_READER_ISO_14443a, {ISO14A_RAW | ISO14A_APPEND_CRC | ISO14A_NO_DISCONNECT, 2, 0}}; 
+			uint8_t rats[] = { 0xE0, 0x80 }; // FSDI=8 (FSD=256), CID=0
+			memcpy(cr.d.asBytes, rats, 2);
+			SendCommand(&cr);
+			if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
+				PrintAndLog("14aRAW ERROR: Proxmark connection timeout.");
+				return 1;
+			}
+			
+			if (resp.arg[0] <= 0) { // ats_len
+				PrintAndLog("14aRAW ERROR: Can't get ATS.");
+				return 1;
+			}
+		}
+	}
+	
+	if (leaveSignalON)
+		cmdc |= ISO14A_NO_DISCONNECT;
+
+	UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_RAW | ISO14A_APPEND_CRC | cmdc, (datainlen & 0xFFFF), 0}}; 
+	memcpy(c.d.asBytes, datain, datainlen);
+	SendCommand(&c);
+	
+    uint8_t *recv;
+    UsbCommand resp;
+
+    if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
+        recv = resp.d.asBytes;
+        int iLen = resp.arg[0];
+		
+		*dataoutlen = iLen - 2;
+		if (*dataoutlen < 0)
+			*dataoutlen = 0;
+		
+		if (maxdataoutlen && *dataoutlen > maxdataoutlen) {
+			PrintAndLog("14aRAW ERROR: Buffer too small(%d). Needs %d bytes", *dataoutlen, maxdataoutlen);
+			return 2;
+		}
+		
+		memcpy(dataout, recv, *dataoutlen);
+		
+        if(!iLen) {
+			PrintAndLog("14aRAW ERROR: No card response.");
+            return 1;
+		}
+
+		// CRC Check
+		if (iLen == -1) {
+			PrintAndLog("14aRAW ERROR: ISO 14443A CRC error.");
+			return 3;
+		}
+
+
+    } else {
+        PrintAndLog("14aRAW ERROR: Reply timeout.");
+		return 4;
+    }
+	
+	return 0;
+}
+
 int ExchangeAPDU14a(uint8_t *datain, int datainlen, bool activateField, bool leaveSignalON, uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
 	uint16_t cmdc = 0;
 	
diff --git a/client/cmdhf14a.h b/client/cmdhf14a.h
index 71007f95..bbfd9b29 100644
--- a/client/cmdhf14a.h
+++ b/client/cmdhf14a.h
@@ -25,6 +25,7 @@ int CmdHF14ASnoop(const char *Cmd);
 char* getTagInfo(uint8_t uid);
 
 extern void DropField();
+extern int ExchangeRAW14a(uint8_t *datain, int datainlen, bool activateField, bool leaveSignalON, uint8_t *dataout, int maxdataoutlen, int *dataoutlen);
 extern int ExchangeAPDU14a(uint8_t *datain, int datainlen, bool activateField, bool leaveSignalON, uint8_t *dataout, int maxdataoutlen, int *dataoutlen);
 
 #endif
diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index e2a4ba1e..028bbf7a 100644
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -27,6 +27,9 @@
 #include "mifare.h"
 #include "mfkey.h"
 #include "hardnested/hardnested_bf_core.h"
+#include "cliparser/cliparser.h"
+#include "cmdhf14a.h"
+#include <polarssl/aes.h>
 
 #define NESTED_SECTOR_RETRY     10			// how often we try mfested() until we give up
 
@@ -2634,6 +2637,149 @@ int CmdDecryptTraceCmds(const char *Cmd){
 	return tryDecryptWord(param_get32ex(Cmd,0,0,16),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16),data,len/2);
 }
 
+int aes_encode(uint8_t *iv, uint8_t *key, uint8_t *input, uint8_t *output, int length){
+	uint8_t iiv[16] = {0};
+	if (iv)
+		memcpy(iiv, iv, 16);
+	
+	aes_context aes;
+	aes_init(&aes);
+	if (aes_setkey_enc(&aes, key, 128))
+		return 1;
+	if (aes_crypt_cbc(&aes, AES_ENCRYPT, length, iiv, input, output))
+		return 2;
+	aes_free(&aes);
+
+	return 0;
+}
+
+int aes_decode(uint8_t *iv, uint8_t *key, uint8_t *input, uint8_t *output, int length){
+	uint8_t iiv[16] = {0};
+	if (iv)
+		memcpy(iiv, iv, 16);
+	
+	aes_context aes;
+	aes_init(&aes);
+	if (aes_setkey_dec(&aes, key, 128))
+		return 1;
+	if (aes_crypt_cbc(&aes, AES_DECRYPT, length, iiv, input, output))
+		return 2;
+	aes_free(&aes);
+
+	return 0;
+}
+
+int CmdHF14AMfAuth4(const char *cmd) {
+	uint8_t keyn[20] = {0};
+	int keynlen = 0;
+	uint8_t key[16] = {0};
+	int keylen = 0;
+	uint8_t data[257] = {0};
+	int datalen = 0;
+	
+	uint8_t Rnd1[17] = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x00};
+	uint8_t Rnd2[17] = {0};
+	
+	
+	CLIParserInit("hf mf auth4", 
+		"Executes AES authentication command in ISO14443-4", 
+		"Usage:\n\thf mf auth4 4000 000102030405060708090a0b0c0d0e0f -> executes authentication\n"
+			"\thf mf auth4 9003 FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF -> executes authentication\n");
+
+	void* argtable[] = {
+		arg_param_begin,
+		arg_str1(NULL,  NULL,     "<Key Num (HEX 2 bytes)>", NULL),
+		arg_str1(NULL,  NULL,     "<Key Value (HEX 16 bytes)>", NULL),
+		arg_param_end
+	};
+	CLIExecWithReturn(cmd, argtable, true);
+	
+	CLIGetStrWithReturn(1, keyn, &keynlen);
+	CLIGetStrWithReturn(2, key, &keylen);
+	CLIParserFree();
+	
+	if (keynlen != 2) {
+		PrintAndLog("ERROR: <Key Num> must be 2 bytes long instead of: %d", keynlen);
+		return 1;
+	}
+	
+	if (keylen != 16) {
+		PrintAndLog("ERROR: <Key Value> must be 16 bytes long instead of: %d", keylen);
+		return 1;
+	}
+
+	uint8_t cmd1[] = {0x0a, 0x00, 0x70, keyn[1], keyn[0], 0x00};
+	int res = ExchangeRAW14a(cmd1, sizeof(cmd1), true, true, data, sizeof(data), &datalen);
+	if (res) {
+		PrintAndLog("ERROR exchande raw error: %d", res);
+		return 2;
+	}
+	
+	PrintAndLog("<phase1: %s", sprint_hex(data, datalen));
+		
+	if (datalen < 3) {
+		PrintAndLog("ERROR: card response length: %d", datalen);
+		return 3;
+	}
+	
+	if (data[0] != 0x0a || data[1] != 0x00) {
+		PrintAndLog("ERROR: card response. Framing error. :%s", sprint_hex(data, 2));
+		return 3;
+	}
+
+	if (data[2] != 0x90) {
+		PrintAndLog("ERROR: card response error: %02x", data[2]);
+		return 3;
+	}
+
+	if (datalen != 19) {
+		PrintAndLog("ERROR: card response must be 16 bytes long instead of: %d", datalen);
+		return 3;
+	}
+	
+    aes_decode(NULL, key, &data[3], Rnd2, 16);
+	Rnd2[16] = Rnd2[0];
+	PrintAndLog("Rnd2: %s", sprint_hex(Rnd2, 16));
+
+	uint8_t cmd2[35] = {0};
+	cmd2[0] = 0x0b;
+	cmd2[1] = 0x00;
+	cmd2[2] = 0x72;
+
+	uint8_t raw[32] = {0};
+	memmove(raw, Rnd1, 16);
+	memmove(&raw[16], &Rnd2[1], 16);
+
+    aes_encode(NULL, key, raw, &cmd2[3], 32);
+	PrintAndLog(">phase2: %s", sprint_hex(cmd2, 35));
+	
+	res = ExchangeRAW14a(cmd2, sizeof(cmd2), false, false, data, sizeof(data), &datalen);
+	if (res) {
+		PrintAndLog("ERROR exchande raw error: %d", res);
+		DropField();
+		return 4;
+	}
+	
+	PrintAndLog("<phase2: %s", sprint_hex(data, datalen));
+
+    aes_decode(NULL, key, &data[3], raw, 32);
+	PrintAndLog("res: %s", sprint_hex(raw, 32));
+	
+	PrintAndLog("Rnd1`: %s", sprint_hex(&raw[4], 16));
+	if (memcmp(&raw[4], &Rnd1[1], 16)) {
+		PrintAndLog("\nERROR: Authentication FAILED. rnd not equal");
+		PrintAndLog("rnd1 reader: %s", sprint_hex(&Rnd1[1], 16));
+		PrintAndLog("rnd1   card: %s", sprint_hex(&raw[4], 16));
+		DropField();
+		return 5;
+	}
+
+	DropField();
+	PrintAndLog("\nAuthentication OK");
+	
+	return 0;
+}
+
 static command_t CommandTable[] =
 {
   {"help",             CmdHelp,                 1, "This help"},
@@ -2643,6 +2789,7 @@ static command_t CommandTable[] =
   {"dump",             CmdHF14AMfDump,          0, "Dump MIFARE classic tag to binary file"},
   {"restore",  	       CmdHF14AMfRestore,       0, "Restore MIFARE classic binary file to BLANK tag"},
   {"wrbl",             CmdHF14AMfWrBl,          0, "Write MIFARE classic block"},
+  {"auth4",            CmdHF14AMfAuth4,         0, "ISO14443-4 AES authentication"},
   {"chk",              CmdHF14AMfChk,           0, "Test block keys"},
   {"mifare",           CmdHF14AMifare,          0, "Read parity error messages."},
   {"hardnested",       CmdHF14AMfNestedHard,    0, "Nested attack for hardened Mifare cards"},