Merge remote-tracking branch 'origin/master' into PenturaLabs-iclass-research

.gitattributes

@@ -0,0 +1,4 @@
+# .gitattributes
+# prevent binary files from CRLF handling, diff and merge:
+fpga/fpga.bit -crlf -diff
+ 

.gitignore

@@ -1,6 +1,8 @@
 # .gitignore
 # don't push these files to the repository
 
+*.log
+*.eml
 *.o
 *.a
 *.d

armsrc/iso14443a.c

@@ -507,6 +507,7 @@ void RAMFUNC SnoopIso14443a(uint8_t param) {
 	LEDsoff();
 	// init trace buffer
 	iso14a_clear_trace();
+	iso14a_set_tracing(TRUE);
 
 	// We won't start recording the frames that we acquire until we trigger;
 	// a good trigger condition to get started is probably when we see a
@@ -1861,10 +1862,9 @@ void ReaderIso14443a(UsbCommand *c)
 		if(param & ISO14A_APPEND_CRC) {
 			AppendCrc14443a(cmd,len);
 			len += 2;
-			lenbits += 16;
+			if (lenbits) lenbits += 16;
 		}
 		if(lenbits>0) {
-
 			ReaderTransmitBitsPar(cmd,lenbits,GetParity(cmd,lenbits/8), NULL);
 		} else {
 			ReaderTransmit(cmd,len, NULL);
@@ -2206,9 +2206,12 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 
 	if (MF_DBGLEVEL >= 1)	{
 		if (!_7BUID) {
-			Dbprintf("4B UID: %02x%02x%02x%02x",rUIDBCC1[0] , rUIDBCC1[1] , rUIDBCC1[2] , rUIDBCC1[3]);
+			Dbprintf("4B UID: %02x%02x%02x%02x", 
+				rUIDBCC1[0], rUIDBCC1[1], rUIDBCC1[2], rUIDBCC1[3]);
 		} else {
-			Dbprintf("7B UID: (%02x)%02x%02x%02x%02x%02x%02x%02x",rUIDBCC1[0] , rUIDBCC1[1] , rUIDBCC1[2] , rUIDBCC1[3],rUIDBCC2[0],rUIDBCC2[1] ,rUIDBCC2[2] , rUIDBCC2[3]);
+			Dbprintf("7B UID: (%02x)%02x%02x%02x%02x%02x%02x%02x",
+				rUIDBCC1[0], rUIDBCC1[1], rUIDBCC1[2], rUIDBCC1[3],
+				rUIDBCC2[0], rUIDBCC2[1] ,rUIDBCC2[2], rUIDBCC2[3]);
 		}
 	}
 
@@ -2276,7 +2279,7 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 				// select card
 				if (len == 9 && 
 						(receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC1, 4) == 0)) {
-					EmSendCmd(_7BUID?rSAK1:rSAK, sizeof(_7BUID?rSAK1:rSAK));
+					EmSendCmd(_7BUID?rSAK1:rSAK, _7BUID?sizeof(rSAK1):sizeof(rSAK));
 					cuid = bytes_to_num(rUIDBCC1, 4);
 					if (!_7BUID) {
 						cardSTATE = MFEMUL_WORK;
@@ -2318,10 +2321,13 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 
 				// test if auth OK
 				if (cardRr != prng_successor(nonce, 64)){
-					if (MF_DBGLEVEL >= 2)	Dbprintf("AUTH FAILED. cardRr=%08x, succ=%08x",cardRr, prng_successor(nonce, 64));
+					if (MF_DBGLEVEL >= 2) Dbprintf("AUTH FAILED for sector %d with key %c. cardRr=%08x, succ=%08x",
+							cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
+							cardRr, prng_successor(nonce, 64));
 					// Shouldn't we respond anything here?
 					// Right now, we don't nack or anything, which causes the
 					// reader to do a WUPA after a while. /Martin
+					// -- which is the correct response. /piwi
 					cardSTATE_TO_IDLE();
 					LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parityBits, TRUE);
 					LogTrace(NULL, 0, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, 0, TRUE);
@@ -2335,7 +2341,9 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 				EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
 				LED_C_ON();
 				cardSTATE = MFEMUL_WORK;
-				if (MF_DBGLEVEL >= 4)	Dbprintf("AUTH COMPLETED. sector=%d, key=%d time=%d", cardAUTHSC, cardAUTHKEY, GetTickCount() - authTimer);
+				if (MF_DBGLEVEL >= 4)	Dbprintf("AUTH COMPLETED for sector %d with key %c. time=%d", 
+					cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
+					GetTickCount() - authTimer);
 				break;
 			}
 			case MFEMUL_SELECT2:{
@@ -2393,12 +2401,12 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 					crypto1_create(pcs, emlGetKey(cardAUTHSC, cardAUTHKEY));
 
 					if (!encrypted_data) { // first authentication
-						if (MF_DBGLEVEL >= 2) Dbprintf("Reader authenticating for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY  );
+						if (MF_DBGLEVEL >= 4) Dbprintf("Reader authenticating for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY  );
 
 						crypto1_word(pcs, cuid ^ nonce, 0);//Update crypto state
 						num_to_bytes(nonce, 4, rAUTH_AT); // Send nonce
 					} else { // nested authentication
-						if (MF_DBGLEVEL >= 2) Dbprintf("Reader doing nested authentication for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
+						if (MF_DBGLEVEL >= 4) Dbprintf("Reader doing nested authentication for block %d (0x%02x) with key %d",receivedCmd[1] ,receivedCmd[1],cardAUTHKEY );
 						ans = nonce ^ crypto1_word(pcs, cuid ^ nonce, 0); 
 						num_to_bytes(ans, 4, rAUTH_AT);
 					}
@@ -2429,9 +2437,9 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 
 				if(receivedCmd[0] == 0x30 // read block
 						|| receivedCmd[0] == 0xA0 // write block
-						|| receivedCmd[0] == 0xC0
+						|| receivedCmd[0] == 0xC0 // inc
-						|| receivedCmd[0] == 0xC1
+						|| receivedCmd[0] == 0xC1 // dec
-						|| receivedCmd[0] == 0xC2 // inc dec restore
+						|| receivedCmd[0] == 0xC2 // restore
 						|| receivedCmd[0] == 0xB0) { // transfer
 					if (receivedCmd[1] >= 16 * 4) {
 						EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
@@ -2447,7 +2455,7 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 				}
 				// read block
 				if (receivedCmd[0] == 0x30) {
-					if (MF_DBGLEVEL >= 2) {
+					if (MF_DBGLEVEL >= 4) {
 						Dbprintf("Reader reading block %d (0x%02x)",receivedCmd[1],receivedCmd[1]);
 					}
 					emlGetMem(response, receivedCmd[1], 1);
@@ -2463,7 +2471,7 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 				}
 				// write block
 				if (receivedCmd[0] == 0xA0) {
-					if (MF_DBGLEVEL >= 2) Dbprintf("RECV 0xA0 write block %d (%02x)",receivedCmd[1],receivedCmd[1]);
+					if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0xA0 write block %d (%02x)",receivedCmd[1],receivedCmd[1]);
 					EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
 					cardSTATE = MFEMUL_WRITEBL2;
 					cardWRBL = receivedCmd[1];
@@ -2471,7 +2479,7 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 				}
 				// increment, decrement, restore
 				if (receivedCmd[0] == 0xC0 || receivedCmd[0] == 0xC1 || receivedCmd[0] == 0xC2) {
-					if (MF_DBGLEVEL >= 2) Dbprintf("RECV 0x%02x inc(0xC1)/dec(0xC0)/restore(0xC2) block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
+					if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x inc(0xC1)/dec(0xC0)/restore(0xC2) block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
 					if (emlCheckValBl(receivedCmd[1])) {
 						if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate on block, but emlCheckValBl failed, nacking");
 						EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
@@ -2489,7 +2497,7 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 				}
 				// transfer
 				if (receivedCmd[0] == 0xB0) {
-					if (MF_DBGLEVEL >= 2) Dbprintf("RECV 0x%02x transfer block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
+					if (MF_DBGLEVEL >= 4) Dbprintf("RECV 0x%02x transfer block %d (%02x)",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
 					if (emlSetValBl(cardINTREG, cardINTBLOCK, receivedCmd[1]))
 						EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
 					else
@@ -2625,6 +2633,7 @@ void RAMFUNC SniffMifare(uint8_t param) {
 	LEDsoff();
 	// init trace buffer
 	iso14a_clear_trace();
+	iso14a_set_tracing(TRUE);
 
 	// The command (reader -> tag) that we're receiving.
 	// The length of a received command will in most cases be no more than 18 bytes.

armsrc/mifarecmd.c

@@ -14,7 +14,7 @@
 #include "apps.h"
 
 //-----------------------------------------------------------------------------
-// Select, Authenticaate, Read an MIFARE tag. 
+// Select, Authenticate, Read a MIFARE tag. 
 // read block
 //-----------------------------------------------------------------------------
 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
@@ -74,19 +74,10 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	
 	if (MF_DBGLEVEL >= 2)	DbpString("READ BLOCK FINISHED");
 
-	// add trace trailer
-	memset(uid, 0x44, 4);
-	LogTrace(uid, 4, 0, 0, TRUE);
-
-//	UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
-//	memcpy(ack.d.asBytes, dataoutbuf, 16);
-	
 	LED_B_ON();
 	cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16);
-//	UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
 	LED_B_OFF();
 
-
 	// Thats it...
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	LEDsoff();
@@ -148,9 +139,10 @@ void MifareUReadBlock(uint8_t arg0,uint8_t *datain)
 	LEDsoff();
 }
 
+
 //-----------------------------------------------------------------------------
-// Select, Authenticaate, Read an MIFARE tag. 
+// Select, Authenticate, Read a MIFARE tag. 
-// read sector (data = 4 x 16 bytes = 64 bytes)
+// read sector (data = 4 x 16 bytes = 64 bytes, or 16 x 16 bytes = 256 bytes)
 //-----------------------------------------------------------------------------
 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 {
@@ -161,8 +153,8 @@ void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	ui64Key = bytes_to_num(datain, 6);
 	
 	// variables
-	byte_t isOK = 0;
+	byte_t isOK;
-	byte_t dataoutbuf[16 * 4];
+	byte_t dataoutbuf[16 * 16];
 	uint8_t uid[10];
 	uint32_t cuid;
 	struct Crypto1State mpcs = {0, 0};
@@ -179,72 +171,47 @@ void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	LED_B_OFF();
 	LED_C_OFF();
 
-	while (true) {
+	isOK = 1;
 	if(!iso14443a_select_card(uid, NULL, &cuid)) {
+		isOK = 0;
 		if (MF_DBGLEVEL >= 1)	Dbprintf("Can't select card");
-			break;
+	}
-		};
 
-		if(mifare_classic_auth(pcs, cuid, sectorNo * 4, keyType, ui64Key, AUTH_FIRST)) {
+	
+	if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
+		isOK = 0;
 		if (MF_DBGLEVEL >= 1)	Dbprintf("Auth error");
-			break;
+	}
-		};
 	
-		if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 0, dataoutbuf + 16 * 0)) {
+	for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
-		if (MF_DBGLEVEL >= 1)	Dbprintf("Read block 0 error");
+		if(mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf + 16 * blockNo)) {
+			isOK = 0;
+			if (MF_DBGLEVEL >= 1)	Dbprintf("Read sector %2d block %2d error", sectorNo, blockNo);
 			break;
-		};
+		}
-		if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 1, dataoutbuf + 16 * 1)) {
+	}
-		if (MF_DBGLEVEL >= 1)	Dbprintf("Read block 1 error");
-			break;
-		};
-		if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 2, dataoutbuf + 16 * 2)) {
-		if (MF_DBGLEVEL >= 1)	Dbprintf("Read block 2 error");
-			break;
-		};
-		if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 3, dataoutbuf + 16 * 3)) {
-		if (MF_DBGLEVEL >= 1)	Dbprintf("Read block 3 error");
-			break;
-		};
 		
 	if(mifare_classic_halt(pcs, cuid)) {
 		if (MF_DBGLEVEL >= 1)	Dbprintf("Halt error");
-			break;
-		};
-
-		isOK = 1;
-		break;
 	}
 
+	
 	//  ----------------------------- crypto1 destroy
 	crypto1_destroy(pcs);
 	
 	if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
 
-	// add trace trailer
-	memset(uid, 0x44, 4);
-	LogTrace(uid, 4, 0, 0, TRUE);
-
-//	UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
-//	memcpy(ack.d.asBytes, dataoutbuf, 16 * 2);
-	
 	LED_B_ON();
-  cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,32);
+	cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo));
-//	UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
-//	SpinDelay(100);
-	
-//	memcpy(ack.d.asBytes, dataoutbuf + 16 * 2, 16 * 2);
-//	UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
-  cmd_send(CMD_ACK,isOK,0,0,dataoutbuf+32, 32);
 	LED_B_OFF();
 
 	// Thats it...
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	LEDsoff();
 //  iso14a_set_tracing(TRUE);
-
 }
 
+
 void MifareUReadCard(uint8_t arg0, uint8_t *datain)
 {
   // params
@@ -288,25 +255,19 @@ void MifareUReadCard(uint8_t arg0, uint8_t *datain)
         
         if (MF_DBGLEVEL >= 2) DbpString("READ CARD FINISHED");
 
-        // add trace trailer
-        memset(uid, 0x44, 4);
-        LogTrace(uid, 4, 0, 0, TRUE);
-        
         LED_B_ON();
 		cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,64);
-  //cmd_send(CMD_ACK,isOK,0,0,dataoutbuf+32, 32);
         LED_B_OFF();
 
         // Thats it...
         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
         LEDsoff();
-//  iso14a_set_tracing(TRUE);
 
 }
 
 
 //-----------------------------------------------------------------------------
-// Select, Authenticaate, Read an MIFARE tag. 
+// Select, Authenticate, Write a MIFARE tag. 
 // read block
 //-----------------------------------------------------------------------------
 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
@@ -368,15 +329,8 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	
 	if (MF_DBGLEVEL >= 2)	DbpString("WRITE BLOCK FINISHED");
 
-	// add trace trailer
-	memset(uid, 0x44, 4);
-	LogTrace(uid, 4, 0, 0, TRUE);
-
-//	UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
-	
 	LED_B_ON();
 	cmd_send(CMD_ACK,isOK,0,0,0,0);
-//	UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
 	LED_B_OFF();
 
 
@@ -387,6 +341,7 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 
 }
 
+
 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
 {
         // params
@@ -433,13 +388,8 @@ void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
         
         if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 
-        // add trace trailer
-        memset(uid, 0x44, 4);
-        LogTrace(uid, 4, 0, 0, TRUE);
-
         LED_B_ON();
 		cmd_send(CMD_ACK,isOK,0,0,0,0);
-//      UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
         LED_B_OFF();
 
 
@@ -447,9 +397,9 @@ void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
         FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
         LEDsoff();
 //  iso14a_set_tracing(TRUE);
-
 }
 
+
 void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
 {
 	// params
@@ -495,13 +445,8 @@ void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
 
 	if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 
-        // add trace trailer
-	memset(uid, 0x44, 4);
-        LogTrace(uid, 4, 0, 0, TRUE);
-
 	LED_B_ON();
 	cmd_send(CMD_ACK,isOK,0,0,0,0);
-//      UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
 	LED_B_OFF();
 
 
@@ -512,6 +457,7 @@ void MifareUWriteBlock_Special(uint8_t arg0, uint8_t *datain)
 
 }
 
+
 // Return 1 if the nonce is invalid else return 0
 int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, byte_t * parity) {
 	return ((oddparity((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity((NtEnc >> 24) & 0xFF) ^ BIT(Ks1,16))) & \
@@ -520,7 +466,6 @@ int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, byte_t * parity) {
 }
 
 
-
 //-----------------------------------------------------------------------------
 // MIFARE nested authentication. 
 // 
@@ -769,18 +714,11 @@ void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	LED_B_OFF();
 	LED_C_OFF();
 
-//	SpinDelay(300);
 	for (i = 0; i < keyCount; i++) {
-//		FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-//		SpinDelay(100);
-//		FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
-		// prepare next select by sending a HALT. There is no need to power down the card.
 		if(mifare_classic_halt(pcs, cuid)) {
 			if (MF_DBGLEVEL >= 1)	Dbprintf("ChkKeys: Halt error");
 		}
 
-		// SpinDelay(50);
-		
 		if(!iso14443a_select_card(uid, NULL, &cuid)) {
 			if (OLD_MF_DBGLEVEL >= 1)	Dbprintf("ChkKeys: Can't select card");
 			break;
@@ -798,10 +736,6 @@ void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	//  ----------------------------- crypto1 destroy
 	crypto1_destroy(pcs);
 	
-	// add trace trailer
-	memset(uid, 0x44, 4);
-	LogTrace(uid, 4, 0, 0, TRUE);
-
 	LED_B_ON();
     cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6);
 	LED_B_OFF();
@@ -823,6 +757,7 @@ void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
 	Dbprintf("Debug level: %d", MF_DBGLEVEL);
 }
 
+
 //-----------------------------------------------------------------------------
 // Work with emulator memory
 // 
@@ -831,29 +766,29 @@ void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain)
 	emlClearMem();
 }
 
+
 void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
 	emlSetMem(datain, arg0, arg1); // data, block num, blocks count
 }
 
+
 void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
-//	UsbCommand ack = {CMD_ACK, {arg0, arg1, 0}};
 
 	byte_t buf[48];
-	emlGetMem(buf, arg0, arg1); // data, block num, blocks count
+	emlGetMem(buf, arg0, arg1); // data, block num, blocks count (max 4)
 
 	LED_B_ON();
 	cmd_send(CMD_ACK,arg0,arg1,0,buf,48);
-//	UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
 	LED_B_OFF();
 }
 
+
 //-----------------------------------------------------------------------------
 // Load a card into the emulator memory
 // 
 //-----------------------------------------------------------------------------
 void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
-	int i;
+	uint8_t numSectors = arg0;
-	uint8_t sectorNo = 0;
 	uint8_t keyType = arg1;
 	uint64_t ui64Key = 0;
 	uint32_t cuid;
@@ -876,64 +811,52 @@ void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
 	LED_B_OFF();
 	LED_C_OFF();
 	
-	while (true) {
+	bool isOK = true;
+
 	if(!iso14443a_select_card(uid, NULL, &cuid)) {
+		isOK = false;
 		if (MF_DBGLEVEL >= 1)	Dbprintf("Can't select card");
-			break;
+	}
-		};
 		
-		for (i = 0; i < 16; i++) {
+	for (uint8_t sectorNo = 0; isOK && sectorNo < numSectors; sectorNo++) {
-			sectorNo = i;
 		ui64Key = emlGetKey(sectorNo, keyType);
-	
+		if (sectorNo == 0){
-			if (!i){
+			if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_FIRST)) {
-				if(mifare_classic_auth(pcs, cuid, sectorNo * 4, keyType, ui64Key, AUTH_FIRST)) {
+				isOK = false;
-					if (MF_DBGLEVEL >= 1)	Dbprintf("Sector[%d]. Auth error", i);
+				if (MF_DBGLEVEL >= 1)	Dbprintf("Sector[%2d]. Auth error", sectorNo);
 				break;
 			}
 		} else {
-				if(mifare_classic_auth(pcs, cuid, sectorNo * 4, keyType, ui64Key, AUTH_NESTED)) {
+			if(isOK && mifare_classic_auth(pcs, cuid, FirstBlockOfSector(sectorNo), keyType, ui64Key, AUTH_NESTED)) {
-					if (MF_DBGLEVEL >= 1)	Dbprintf("Sector[%d]. Auth nested error", i);
+				isOK = false;
+				if (MF_DBGLEVEL >= 1)	Dbprintf("Sector[%2d]. Auth nested error", sectorNo);
 				break;
 			}
 		}
 		
-			if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 0, dataoutbuf)) {
+		for (uint8_t blockNo = 0; isOK && blockNo < NumBlocksPerSector(sectorNo); blockNo++) {
-				if (MF_DBGLEVEL >= 1)	Dbprintf("Read block 0 error");
+			if(isOK && mifare_classic_readblock(pcs, cuid, FirstBlockOfSector(sectorNo) + blockNo, dataoutbuf)) {
+				isOK = false;
+				if (MF_DBGLEVEL >= 1)	Dbprintf("Error reading sector %2d block %2d", sectorNo, blockNo);
 				break;
 			};
-			emlSetMem(dataoutbuf, sectorNo * 4 + 0, 1);
+			if (isOK) {
-			
+				if (blockNo < NumBlocksPerSector(sectorNo) - 1) {
-			if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 1, dataoutbuf)) {
+					emlSetMem(dataoutbuf, FirstBlockOfSector(sectorNo) + blockNo, 1);
-				if (MF_DBGLEVEL >= 1)	Dbprintf("Read block 1 error");
+				} else {	// sector trailer, keep the keys, set only the AC
-				break;
+					emlGetMem(dataoutbuf2, FirstBlockOfSector(sectorNo) + blockNo, 1);
-			};
-			emlSetMem(dataoutbuf, sectorNo * 4 + 1, 1);
-
-			if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 2, dataoutbuf)) {
-				if (MF_DBGLEVEL >= 1)	Dbprintf("Read block 2 error");
-				break;
-			};
-			emlSetMem(dataoutbuf, sectorNo * 4 + 2, 1);
-
-			// get block 3 bytes 6-9
-			if(mifare_classic_readblock(pcs, cuid, sectorNo * 4 + 3, dataoutbuf)) {
-				if (MF_DBGLEVEL >= 1)	Dbprintf("Read block 3 error");
-				break;
-			};
-			emlGetMem(dataoutbuf2, sectorNo * 4 + 3, 1);
 					memcpy(&dataoutbuf2[6], &dataoutbuf[6], 4);
-			emlSetMem(dataoutbuf2,  sectorNo * 4 + 3, 1);
+					emlSetMem(dataoutbuf2,  FirstBlockOfSector(sectorNo) + blockNo, 1);
+				}
+			}
+		}
+
 	}
 
 	if(mifare_classic_halt(pcs, cuid)) {
 		if (MF_DBGLEVEL >= 1)	Dbprintf("Halt error");
-			break;
 	};
 
-		break;
-	}	
-
 	//  ----------------------------- crypto1 destroy
 	crypto1_destroy(pcs);
 
@@ -942,16 +865,8 @@ void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
 	
 	if (MF_DBGLEVEL >= 2) DbpString("EMUL FILL SECTORS FINISHED");
 
-	// add trace trailer
-	memset(uid, 0x44, 4);
-	LogTrace(uid, 4, 0, 0, TRUE);
 }
 
-//-----------------------------------------------------------------------------
-// MIFARE 1k emulator
-// 
-//-----------------------------------------------------------------------------
-
 
 //-----------------------------------------------------------------------------
 // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn)
@@ -1074,22 +989,8 @@ void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
 		break;
 	}
 	
-//	UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
-//	if (isOK) memcpy(ack.d.asBytes, uid, 4);
-	
-	// add trace trailer
-	/**
-	*	Removed by Martin, the uid is overwritten with 0x44, 
-	*	which can 't be intended. 
-	*
-	*	memset(uid, 0x44, 4);
-	*	LogTrace(uid, 4, 0, 0, TRUE);
-	**/
-	
-
 	LED_B_ON();
 	cmd_send(CMD_ACK,isOK,0,0,uid,4);
-//	UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
 	LED_B_OFF();
 
 	if ((workFlags & 0x10) || (!isOK)) {
@@ -1099,6 +1000,7 @@ void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
 	}
 }
 
+
 void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){
   
   // params
@@ -1171,20 +1073,8 @@ void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
 		break;
 	}
 	
-//	UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
-//	if (isOK) memcpy(ack.d.asBytes, data, 18);
-	
-	// add trace trailer
-	/*
-	* Removed by Martin, this piece of overwrites the 'data' variable 
-	* which is sent two lines down, and is obviously not correct. 
-	* 
-	* memset(data, 0x44, 4);
-	* LogTrace(data, 4, 0, 0, TRUE);
-	*/
 	LED_B_ON();
 	cmd_send(CMD_ACK,isOK,0,0,data,18);
-//	UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
 	LED_B_OFF();
 
 	if ((workFlags & 0x10) || (!isOK)) {

armsrc/mifareutil.c

@@ -453,6 +453,27 @@ int mifare_ultra_halt(uint32_t uid)
 	return 0;
 }
 
+
+// Mifare Memory Structure: up to 32 Sectors with 4 blocks each (1k and 2k cards),
+// plus evtl. 8 sectors with 16 blocks each (4k cards)
+uint8_t NumBlocksPerSector(uint8_t sectorNo) 
+{
+	if (sectorNo < 32) 
+		return 4;
+	else
+		return 16;
+}
+
+uint8_t FirstBlockOfSector(uint8_t sectorNo) 
+{
+	if (sectorNo < 32)
+		return sectorNo * 4;
+	else
+		return 32*4 + (sectorNo - 32) * 16;
+		
+}
+
+
 // work with emulator memory
 void emlSetMem(uint8_t *data, int blockNum, int blocksCount) {
 	uint8_t* emCARD = eml_get_bigbufptr_cardmem();
@@ -522,7 +543,7 @@ uint64_t emlGetKey(int sectorNum, int keyType) {
 	uint8_t key[6];
 	uint8_t* emCARD = eml_get_bigbufptr_cardmem();
 	
-	memcpy(key, emCARD + 3 * 16 + sectorNum * 4 * 16 + keyType * 10, 6);
+	memcpy(key, emCARD + 16 * (FirstBlockOfSector(sectorNum) + NumBlocksPerSector(sectorNum) - 1) + keyType * 10, 6);
 	return bytes_to_num(key, 6);
 }
 

armsrc/mifareutil.h

@@ -80,6 +80,10 @@ uint8_t* mifare_get_bigbufptr(void);
 uint8_t* eml_get_bigbufptr_sendbuf(void);
 uint8_t* eml_get_bigbufptr_recbuf(void);
 
+// Mifare memory structure
+uint8_t NumBlocksPerSector(uint8_t sectorNo);
+uint8_t FirstBlockOfSector(uint8_t sectorNo);
+
 // emulator functions
 void emlClearMem(void);
 void emlSetMem(uint8_t *data, int blockNum, int blocksCount);

client/cmdhf14a.c

@@ -183,27 +183,29 @@ void iso14a_set_timeout(uint32_t timeout) {
 
 int CmdHF14AReader(const char *Cmd)
 {
-	UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT, 0, 0}};
+	UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT | ISO14A_NO_DISCONNECT, 0, 0}};
 	SendCommand(&c);
 
 	UsbCommand resp;
 	WaitForResponse(CMD_ACK,&resp);
 	
-	iso14a_card_select_t *card = (iso14a_card_select_t *)resp.d.asBytes;
+	iso14a_card_select_t card;
+	memcpy(&card, (iso14a_card_select_t *)resp.d.asBytes, sizeof(iso14a_card_select_t));
 
-	if(resp.arg[0] == 0) {
+	uint64_t select_status = resp.arg[0];		// 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS
+	
+	if(select_status == 0) {
 		PrintAndLog("iso14443a card select failed");
 		return 0;
 	}
 
-	PrintAndLog("ATQA : %02x %02x", card->atqa[0], card->atqa[1]);
+	PrintAndLog("ATQA : %02x %02x", card.atqa[1], card.atqa[0]);
-	PrintAndLog(" UID : %s", sprint_hex(card->uid, card->uidlen));
+	PrintAndLog(" UID : %s", sprint_hex(card.uid, card.uidlen));
-	PrintAndLog(" SAK : %02x [%d]", card->sak, resp.arg[0]);
+	PrintAndLog(" SAK : %02x [%d]", card.sak, resp.arg[0]);
 
-	switch (card->sak) {
+	switch (card.sak) {
 		case 0x00: PrintAndLog("TYPE : NXP MIFARE Ultralight | Ultralight C"); break;
 		case 0x04: PrintAndLog("TYPE : NXP MIFARE (various !DESFire !DESFire EV1)"); break;
-
 		case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1"); break;
 		case 0x09: PrintAndLog("TYPE : NXP MIFARE Mini 0.3k"); break;
 		case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k SL2"); break;
@@ -217,67 +219,107 @@ int CmdHF14AReader(const char *Cmd)
 		case 0x98: PrintAndLog("TYPE : Gemplus MPCOS"); break;
 		default: ;
 	}
-	if(resp.arg[0] == 1) {
+
+	
+	// try to request ATS even if tag claims not to support it
+	if (select_status == 2) {
+		uint8_t rats[] = { 0xE0, 0x80 }; // FSDI=8 (FSD=256), CID=0
+		c.arg[0] = ISO14A_RAW | ISO14A_APPEND_CRC | ISO14A_NO_DISCONNECT;
+		c.arg[1] = 2;
+		c.arg[2] = 0;
+		memcpy(c.d.asBytes, rats, 2);
+		SendCommand(&c);
+		WaitForResponse(CMD_ACK,&resp);
+		
+	    memcpy(&card.ats, resp.d.asBytes, resp.arg[0]);
+		card.ats_len = resp.arg[0];				// note: ats_len includes CRC Bytes
+	} 
+
+	// disconnect
+	c.arg[0] = 0;
+	c.arg[1] = 0;
+	c.arg[2] = 0;
+	SendCommand(&c);
+
+	
+	if(card.ats_len >= 3) {			// a valid ATS consists of at least the length byte (TL) and 2 CRC bytes
 		bool ta1 = 0, tb1 = 0, tc1 = 0;
 		int pos;
 
-		PrintAndLog(" ATS : %s", sprint_hex(card->ats, card->ats_len));
+		if (select_status == 2) {
-		if (card->ats_len > 0) {
+			PrintAndLog("SAK incorrectly claims that card doesn't support RATS");
-			PrintAndLog("       -  TL : length is %d bytes", card->ats[0]);
 		}
-		if (card->ats_len > 1) {
+		PrintAndLog(" ATS : %s", sprint_hex(card.ats, card.ats_len));
-			ta1 = (card->ats[1] & 0x10) == 0x10;
+		PrintAndLog("       -  TL : length is %d bytes", card.ats[0]);
-			tb1 = (card->ats[1] & 0x20) == 0x20;
+		if (card.ats[0] != card.ats_len - 2) {
-			tc1 = (card->ats[1] & 0x40) == 0x40;
+			PrintAndLog("ATS may be corrupted. Length of ATS (%d bytes incl. 2 Bytes CRC) doesn't match TL", card.ats_len);
+		}
+		
+		if (card.ats[0] > 1) {		// there is a format byte (T0)
+			ta1 = (card.ats[1] & 0x10) == 0x10;
+			tb1 = (card.ats[1] & 0x20) == 0x20;
+			tc1 = (card.ats[1] & 0x40) == 0x40;
+			int16_t fsci = card.ats[1] & 0x0f;
 			PrintAndLog("       -  T0 : TA1 is%s present, TB1 is%s present, "
-					"TC1 is%s present, FSCI is %d",
+					"TC1 is%s present, FSCI is %d (FSC = %ld)",
 				(ta1 ? "" : " NOT"), (tb1 ? "" : " NOT"), (tc1 ? "" : " NOT"),
-				(card->ats[1] & 0x0f));
+				fsci,
+				fsci < 5 ? (fsci - 2) * 8 : 
+					fsci < 8 ? (fsci - 3) * 32 :
+					fsci == 8 ? 256 :
+					-1
+				);
 		}
 		pos = 2;
-		if (ta1 && card->ats_len > pos) {
+		if (ta1) {
 			char dr[16], ds[16];
 			dr[0] = ds[0] = '\0';
-			if (card->ats[pos] & 0x10) strcat(ds, "2, ");
+			if (card.ats[pos] & 0x10) strcat(ds, "2, ");
-			if (card->ats[pos] & 0x20) strcat(ds, "4, ");
+			if (card.ats[pos] & 0x20) strcat(ds, "4, ");
-			if (card->ats[pos] & 0x40) strcat(ds, "8, ");
+			if (card.ats[pos] & 0x40) strcat(ds, "8, ");
-			if (card->ats[pos] & 0x01) strcat(dr, "2, ");
+			if (card.ats[pos] & 0x01) strcat(dr, "2, ");
-			if (card->ats[pos] & 0x02) strcat(dr, "4, ");
+			if (card.ats[pos] & 0x02) strcat(dr, "4, ");
-			if (card->ats[pos] & 0x04) strcat(dr, "8, ");
+			if (card.ats[pos] & 0x04) strcat(dr, "8, ");
 			if (strlen(ds) != 0) ds[strlen(ds) - 2] = '\0';
 			if (strlen(dr) != 0) dr[strlen(dr) - 2] = '\0';
 			PrintAndLog("       - TA1 : different divisors are%s supported, "
 					"DR: [%s], DS: [%s]",
-					(card->ats[pos] & 0x80 ? " NOT" : ""), dr, ds);
+					(card.ats[pos] & 0x80 ? " NOT" : ""), dr, ds);
 			pos++;
 		}
-		if (tb1 && card->ats_len > pos) {
+		if (tb1) {
-			PrintAndLog("       - TB1 : SFGI = %d, FWI = %d",
+			uint32_t sfgi = card.ats[pos] & 0x0F;
-					(card->ats[pos] & 0x08),
+			uint32_t fwi = card.ats[pos] >> 4;
-					(card->ats[pos] & 0x80) >> 4);
+			PrintAndLog("       - TB1 : SFGI = %d (SFGT = %s%ld/fc), FWI = %d (FWT = %ld/fc)",
+					(sfgi),
+					sfgi ? "" : "(not needed) ",
+					sfgi ? (1 << 12) << sfgi : 0,
+					fwi,
+					(1 << 12) << fwi
+					);
 			pos++;
 		}
-		if (tc1 && card->ats_len > pos) {
+		if (tc1) {
 			PrintAndLog("       - TC1 : NAD is%s supported, CID is%s supported",
-					(card->ats[pos] & 0x01) ? "" : " NOT",
+					(card.ats[pos] & 0x01) ? "" : " NOT",
-					(card->ats[pos] & 0x02) ? "" : " NOT");
+					(card.ats[pos] & 0x02) ? "" : " NOT");
 			pos++;
 		}
-		if (card->ats_len > pos) {
+		if (card.ats[0] > pos) {
 			char *tip = "";
-			if (card->ats_len - pos > 7) {
+			if (card.ats[0] - pos >= 7) {
-				if (memcmp(card->ats + pos, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) {
+				if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) {
 					tip = "-> MIFARE Plus X 2K or 4K";
-				} else if (memcmp(card->ats + pos, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) {
+				} else if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) {
 					tip = "-> MIFARE Plus S 2K or 4K";
 				}
 			} 
-			PrintAndLog("       -  HB : %s%s", sprint_hex(card->ats + pos, card->ats_len - pos - 2), tip);
+			PrintAndLog("       -  HB : %s%s", sprint_hex(card.ats + pos, card.ats[0] - pos), tip);
-			if (card->ats[pos] == 0xC1) {
+			if (card.ats[pos] == 0xC1) {
 				PrintAndLog("               c1 -> Mifare or (multiple) virtual cards of various type");
 				PrintAndLog("                  %02x -> Length is %d bytes",
-						card->ats[pos + 1], card->ats[pos + 1]);
+						card.ats[pos + 1], card.ats[pos + 1]);
-				switch (card->ats[pos + 2] & 0xf0) {
+				switch (card.ats[pos + 2] & 0xf0) {
 					case 0x10:
 						PrintAndLog("                     1x -> MIFARE DESFire");
 						break;
@@ -285,7 +327,7 @@ int CmdHF14AReader(const char *Cmd)
 						PrintAndLog("                     2x -> MIFARE Plus");
 						break;
 				}
-				switch (card->ats[pos + 2] & 0x0f) {
+				switch (card.ats[pos + 2] & 0x0f) {
 					case 0x00:
 						PrintAndLog("                     x0 -> <1 kByte");
 						break;
@@ -302,7 +344,7 @@ int CmdHF14AReader(const char *Cmd)
 						PrintAndLog("                     x0 -> 8 kByte");
 						break;
 				}
-				switch (card->ats[pos + 3] & 0xf0) {
+				switch (card.ats[pos + 3] & 0xf0) {
 					case 0x00:
 						PrintAndLog("                        0x -> Engineering sample");
 						break;
@@ -310,7 +352,7 @@ int CmdHF14AReader(const char *Cmd)
 						PrintAndLog("                        2x -> Released");
 						break;
 				}
-				switch (card->ats[pos + 3] & 0x0f) {
+				switch (card.ats[pos + 3] & 0x0f) {
 					case 0x00:
 						PrintAndLog("                        x0 -> Generation 1");
 						break;
@@ -321,7 +363,7 @@ int CmdHF14AReader(const char *Cmd)
 						PrintAndLog("                        x2 -> Generation 3");
 						break;
 				}
-				switch (card->ats[pos + 4] & 0x0f) {
+				switch (card.ats[pos + 4] & 0x0f) {
 					case 0x00:
 						PrintAndLog("                           x0 -> Only VCSL supported");
 						break;
@@ -335,10 +377,10 @@ int CmdHF14AReader(const char *Cmd)
 			}
 		}
 	} else {
-		PrintAndLog("proprietary non iso14443a-4 card found, RATS not supported");
+		PrintAndLog("proprietary non iso14443-4 card found, RATS not supported");
 	}
 
-	return resp.arg[0];
+	return select_status;
 }
 
 // Collect ISO14443 Type A UIDs
@@ -360,20 +402,17 @@ int CmdHF14ACUIDs(const char *Cmd)
 		UsbCommand resp;
 		WaitForResponse(CMD_ACK,&resp);
 
-		uint8_t *uid  = resp.d.asBytes;
+		iso14a_card_select_t *card = (iso14a_card_select_t *) resp.d.asBytes;
-		iso14a_card_select_t *card = (iso14a_card_select_t *)(uid + 12);
 
 		// check if command failed
 		if (resp.arg[0] == 0) {
 			PrintAndLog("Card select failed.");
 		} else {
-			// check if UID is 4 bytes
+			char uid_string[20];
-			if ((card->atqa[1] & 0xC0) == 0) {
+			for (uint16_t i = 0; i < card->uidlen; i++) {
-				PrintAndLog("%02X%02X%02X%02X",
+				sprintf(&uid_string[2*i], "%02X", card->uid[i]);
-				            *uid, *(uid + 1), *(uid + 2), *(uid + 3));
-			} else {
-				PrintAndLog("UID longer than 4 bytes");
 			}
+			PrintAndLog("%s", uid_string);
 		}
 	}
 	PrintAndLog("End: %u", time(NULL));

client/default_keys.dic

@@ -0,0 +1,79 @@
+# Default Keys as already in Proxmark.exe:
+ffffffffffff,//Defaultkey(firstkeyusedbyprogramifnouserdefinedkey)
+000000000000,//Blankkey
+a0a1a2a3a4a5,//NFCForumMADkey
+b0b1b2b3b4b5,
+aabbccddeeff,
+4d3a99c351dd,
+1a982c7e459a,
+d3f7d3f7d3f7,
+714c5c886e97,
+587ee5f9350f,
+a0478cc39091,
+533cb6c723f6,
+8fd0a4f256e9
+# more Keys from mf_default_keys.lua
+000000000001,
+000000000002,
+00000000000a,
+00000000000b,
+00000ffe2488,--VästtrafikenKeyB
+010203040506,
+0123456789ab,
+0297927c0f77,--VästtrafikenKeyA
+100000000000,
+111111111111,
+123456789abc,
+12f2ee3478c1,
+14d446e33363,
+1999a3554a55,
+200000000000,
+222222222222,
+26940b21ff5d,--RKFSLKeyA
+27dd91f1fcf1,
+2BA9621E0A36,--DirectoryandeventlogKeyB
+333333333333,
+33f974b42769,
+34d1df9934c5,
+434f4d4d4f41,--RKFJOJOGROUPKeyA
+434f4d4d4f42,--RKFJOJOGROUPKeyB
+43ab19ef5c31,
+444444444444,
+47524f555041,--RKFJOJOGROUPKeyA
+47524f555042,--RKFJOJOGROUPKeyB
+4AF9D7ADEBE4,--DirectoryandeventlogKeyA
+505249564141,--RKFJOJOPRIVAKeyA
+505249564142,--RKFJOJOPRIVAKeyB
+505249565441,
+505249565442,
+54726176656c,--VästtrafikenKeyA
+555555555555,
+55f5a5dd38c9,
+5c598c9c58b5,--RKFSLKeyB
+666666666666,
+722bfcc5375f,--RKFRejskortDanmarkKeyA
+776974687573,--VästtrafikenKeyB
+777777777777,
+888888888888,
+999999999999,
+99c636334433,
+a00000000000,
+a053a292a4af,
+a64598a77478,--RKFSLKeyA
+a94133013401,
+aaaaaaaaaaaa,
+abcdef123456,--Keyfromladyada.net
+b00000000000,
+b127c6f41436,
+bbbbbbbbbbbb,
+bd493a3962b6,
+c934fe34d934,
+cccccccccccc,
+dddddddddddd,
+e4d2770a89be,--RKFSLKeyB
+ee0042f88840,--VästtrafikenKeyB
+eeeeeeeeeeee,
+f1a97341a9fc,
+f1d83f964314,--RKFRejskortDanmarkKeyB
+fc00018778f7,--VästtrafikenKeyA
+fc0001877bf7,--RKFÖstgötaTrafikenKeyA

client/lualibs/html_dumplib.lua

@@ -8,7 +8,14 @@ bin = require('bin')
 --- 
 -- A debug printout-function
 local function dbg(args)
-	if DEBUG then
+	
+    if type(args) == "table" then
+		local i = 1
+		while args[i] do
+			print("###", args[i])
+			i = i+1
+		end
+	else
 		print("###", args)
 	end	
 end	
@@ -40,20 +47,38 @@ local function save_HTML(javascript, filename)
 
 end
 
+local function save_BIN(data, filename)
+	-- Open the output file
 	
+	local outfile = io.open(filename, "wb")
+	if outfile == nil then 
+		return oops(string.format("Could not write to file %s",tostring(filename)))
+	end
+	
+	-- Write the data into it
+	local i = 1
+	while data[i] do
+		outfile:write(data[i])
+		i = i+1
+	end
+	
+	io.close(outfile)
+	return filename   
+end
 
 local function convert_ascii_dump_to_JS(infile)
 	local t = infile:read("*all")
 	
 	local output = "[";
 	for line in string.gmatch(t, "[^\n]+") do 
+	    if string.byte(line,1) ~= string.byte("+",1) then
                   output = output .. "'"..line.."',\n"
         end
+	end
 	output = output .. "]"
 	return output
 end
 
-
 local function convert_binary_dump_to_JS(infile, blockLen)
 	 local bindata = infile:read("*all")
 	 len = string.len(bindata)
@@ -78,6 +103,21 @@ local function convert_binary_dump_to_JS(infile, blockLen)
 	return js
 end
 
+local function convert_ascii_dump_to_BIN(infile)
+	local t = infile:read("*all")
+	
+	local output = {};
+	for line in string.gmatch(t, "[^\n]+") do 
+		if string.byte(line) ~= string.byte("+") then
+			for c in (line or ''):gmatch('..') do
+				output[#output+1] = string.char( tonumber(c,16) )
+			end
+		end
+	end
+	return output
+end
+
+
 ---
 -- Converts a .eml-file into a HTML/Javascript file. 
 -- @param input the file to convert
@@ -118,7 +158,27 @@ local function convert_bin_to_html(input, output, blockLen)
 	return save_HTML(javascript, output )
 end
 
+--- Converts a eml dump into a binary file
+-- @param input the file containing the eml-dump  (defaults to dumpdata.eml)
+-- @param output the file to write to  ( defaults to dumpdata.bin)
+local function convert_eml_to_bin(input, output)
+	input = input or 'dumpdata.eml'
+	output = output or 'dumpdata.bin'
+
+	local infile = io.open(input, "rb")
+	if infile == nil then 
+		return oops(string.format("Could not read file %s",tostring(input)))
+	end
+	-- Read file, get BIN
+	local data = convert_ascii_dump_to_BIN(infile)
+	io.close(infile)
+
+	return save_BIN(data, output )
+end
+
+
 return {
 	convert_bin_to_html = convert_bin_to_html,
 	convert_eml_to_html = convert_eml_to_html,
+    convert_eml_to_bin = convert_eml_to_bin,	
 }

client/lualibs/mf_default_keys.lua

@@ -126,6 +126,21 @@ local _keys = {
     'eeeeeeeeeeee',
     '0123456789ab',
     '123456789abc',
+	
+	--[[
+    The keys below are taken from from https://github.com/4ZM/mfterm/blob/master/dictionary.txt
+    --]]
+	
+	'abcdef123456', -- Key from ladyada.net
+
+	'000000000001',
+	'000000000002',
+	'00000000000a',
+	'00000000000b',
+	'100000000000',
+	'200000000000',
+	'a00000000000',
+	'b00000000000',	
   }
 
 ---

client/lualibs/utils.lua

@@ -0,0 +1,57 @@
+--[[
+	This may be moved to a separate library at some point (Holiman)
+--]]
+local Utils = 
+{
+	-- Asks the user for Yes or No
+	confirm = function(message, ...)
+		local answer
+		message = message .. " [y/n] ?"
+		repeat
+			io.write(message)
+			io.flush()
+			answer=io.read()
+			if answer == 'Y' or answer == "y" then
+				return true
+			elseif answer == 'N' or answer == 'n' then 
+				return false
+			end
+		until false
+	end,
+	---
+	-- Asks the user for input
+	input = function (message , default)
+		local answer
+		if default ~= nil then
+			message = message .. " (default: ".. default.. " )"
+		end
+		message = message .." \n > "
+		io.write(message)
+		io.flush()
+		answer=io.read()
+		if answer == '' then answer = default end
+
+		return answer
+	end,
+	--
+	-- Converts DECIMAL to HEX
+    ConvertDec2Hex = function(IN)
+		local B,K,OUT,I,D=16,"0123456789ABCDEF","",0
+		while IN>0 do
+			I=I+1
+			IN,D=math.floor(IN/B),math.mod(IN,B)+1
+			OUT=string.sub(K,D,D)..OUT
+		end
+		return OUT
+	end,
+	---
+	-- Convert Byte array to string of hex
+	ConvertBytes2String = function(bytes)
+		s = {}
+		for i = 1, #(bytes) do
+			s[i] =   string.format("%02X",bytes[i]) 
+		end
+		return table.concat(s)
+	end,	
+}
+return Utils

client/scripts/dumptoemul.lua

@@ -13,7 +13,7 @@ by the emulator
 Arguments:
 	-h 				This help
 	-i <file>		Specifies the dump-file (input). If omitted, 'dumpdata.bin' is used	
-	-o <filename>	Speciies the output file. If omitted, <uid>.eml is used. 	
+	-o <filename>	Specifies the output file. If omitted, <uid>.eml is used. 	
 
 ]]
 

client/scripts/emul2dump.lua

@@ -0,0 +1,60 @@
+local getopt = require('getopt')
+local bin = require('bin')
+local dumplib = require('html_dumplib')
+
+example =[[
+	1. script run emul2dump
+	2. script run emul2dump -i myfile.eml
+	3. script run emul2dump -i myfile.eml -o myfile.bin
+]]
+author = "Iceman"
+usage = "script run emul2dump [-i <file>] [-o <file>]"
+desc =[[
+This script takes an dumpfile on EML (ASCII) format and converts it to the PM3 dumpbin file to be used with "hf mf restore"
+
+Arguments:
+	-h              This help
+	-i <filename>	Specifies the dump-file (input). If omitted, 'dumpdata.eml' is used	
+	-o <filename>	Specifies the output file. If omitted, <currdate>.bin is used. 	
+]]
+
+--- 
+-- This is only meant to be used when errors occur
+function oops(err)
+	print("ERROR: ",err)
+end
+--- 
+-- Usage help
+function help()
+	print(desc)
+	print("Example usage")
+	print(example)
+end
+--
+-- Exit message
+function ExitMsg(msg)
+	print( string.rep('--',20) )
+	print( string.rep('--',20) )
+	print(msg)
+	print()
+end
+
+local function main(args)
+	
+	local input = "dumpdata.eml"
+	local output  = os.date("%Y-%m-%d_%H%M%S.bin");
+	
+	-- Arguments for the script
+	for o, a in getopt.getopt(args, 'hi:o:') do
+		if o == "h" then return help() end		
+		if o == "i" then input = a	end
+		if o == "o" then output = a end
+	end
+
+	local filename, err = dumplib.convert_eml_to_bin(input,output)
+	if err then return oops(err) end
+
+	ExitMsg(("Wrote a BIN dump to the file %s"):format(filename))
+end
+
+main(args)

client/scripts/formatMifare.lua

@@ -0,0 +1,196 @@
+local cmds = require('commands')
+local getopt = require('getopt')
+local bin = require('bin')
+local lib14a = require('read14a')
+local utils = require('utils')
+
+example =[[
+	1. script run formatMifare
+	2. script run formatMifare -k aabbccddeeff -n 112233445566 -a FF0780
+]]
+author = "Iceman"
+usage = "script run formatMifare -k <key>"
+desc =[[
+This script will generate 'hf mf wrbl' commands for each block to format a Mifare card.
+
+Alla datablocks gets 0x00
+As default the script sets the keys A/B to 0xFFFFFFFFFFFF
+and the access bytes will become 0x78,0x77,0x88
+The GDB will become 0x00
+
+The script will skip the manufactoring block 0.
+
+Arguments:
+	-h             - this help
+	-k <key>       - the current six byte key with write access
+	-n <key>       - the new key that will be written to the card
+	-a <access>    - the new access bytes that will be written to the card
+]]
+local TIMEOUT = 2000 -- Shouldn't take longer than 2 seconds
+local DEBUG = true -- the debug flag
+local CmdString = 'hf mf wrbl %d B %s %s'
+local numBlocks = 64
+local numSectors = 16
+--- 
+-- A debug printout-function
+function dbg(args)
+	if not DEBUG then
+		return
+	end
+	
+    if type(args) == "table" then
+		local i = 1
+		while result[i] do
+			dbg(result[i])
+			i = i+1
+		end
+	else
+		print("###", args)
+	end	
+end	
+--- 
+-- This is only meant to be used when errors occur
+function oops(err)
+	print("ERROR: ",err)
+end
+--- 
+-- Usage help
+function help()
+	print(desc)
+	print("Example usage")
+	print(example)
+end
+--
+-- Exit message
+function ExitMsg(msg)
+	print( string.rep('--',20) )
+	print( string.rep('--',20) )
+	print(msg)
+	print()
+end
+--
+-- Read information from a card
+function GetCardInfo()
+	result, err = lib14a.read1443a(false)
+	if not result then
+		print(err)
+		return
+	end
+	print(("Found:  %s"):format(result.name))
+
+	core.clearCommandBuffer()
+	
+	if 0x18 == result.sak then --NXP MIFARE Classic 4k | Plus 4k
+		-- IFARE Classic 4K offers 4096 bytes split into forty sectors, 
+		-- of which 32 are same size as in the 1K with eight more that are quadruple size sectors. 
+		numSectors = 40
+	elseif 0x08 == result.sak then -- NXP MIFARE CLASSIC 1k | Plus 2k
+		-- 1K offers 1024 bytes of data storage, split into 16 sector
+		numSectors = 16
+	elseif 0x09 == result.sak then -- NXP MIFARE Mini 0.3k
+		-- MIFARE Classic mini offers 320 bytes split into five sectors.
+		numSectors = 5
+	elseif  0x10 == result.sak then-- "NXP MIFARE Plus 2k"
+		numSectors = 32
+	else
+		print("I don't know how many sectors there are on this type of card, defaulting to 16")
+	end	
+	--[[
+	 The mifare Classic 1k card has 16 sectors of 4 data blocks each. 
+	 The first 32 sectors of a mifare Classic 4k card consists of 4 data blocks and the remaining
+	 8 sectors consist of 16 data blocks. 
+	--]]
+	
+	-- Defaults to 16 * 4 = 64  - 1 = 63
+    numBlocks = numSectors * 4 - 1  
+		
+	if numSectors > 32 then
+		numBlocks = 32*4+ (numSectors-32)*16 -1
+	end
+	
+end
+
+local function main(args)
+
+	print( string.rep('--',20) )
+	print( string.rep('--',20) )
+	print()
+	
+	local OldKey 
+	local NewKey
+	local Accessbytes
+	
+	-- Arguments for the script
+	for o, a in getopt.getopt(args, 'hk:n:a:') do
+		if o == "h" then return help() end		
+		if o == "k" then OldKey = a end
+		if o == "n" then NewKey = a	end
+		if o == "a" then Accessbytes = a end
+	end
+
+	-- validate input args.
+	OldKey =  OldKey or 'FFFFFFFFFFFF'
+	if #(OldKey) ~= 12 then
+		return oops( string.format('Wrong length of write key (was %d) expected 12', #OldKey))
+	end
+	
+	NewKey =  NewKey or 'FFFFFFFFFFFF'
+	if #(NewKey) ~= 12 then
+		return oops( string.format('Wrong length of new key (was %d) expected 12', #NewKey))
+	end
+
+	--Accessbytes =  Accessbytes or '787788'
+	Accessbytes =  Accessbytes or 'FF0780'
+	if #(Accessbytes) ~= 6 then
+		return oops( string.format('Wrong length of accessbytes (was %d) expected 12', #Accessbytes))
+	end
+
+	GetCardInfo()
+	
+	-- Show info
+	print( string.format('Estimating number of blocks: %d', numBlocks))
+	print( string.format('Old key:    %s', OldKey))
+	print( string.format('New key:    %s', NewKey))
+	print( string.format('New Access: %s', Accessbytes))
+	print( string.rep('--',20) )
+
+		-- Set new block data
+	local EMPTY_BL = string.rep('00',16)
+	local EMPTY_SECTORTRAIL = string.format('%s%s%s%s',NewKey,Accessbytes,'00',NewKey)
+	
+	dbg( string.format('New sector-trailer : %s',EMPTY_SECTORTRAIL))
+	dbg( string.format('New emptyblock: %s',EMPTY_BL))
+	dbg('')
+	
+	-- Ask
+	local dialogResult = utils.confirm("Do you want to erase this card")
+	if dialogResult == false then 
+		return ExitMsg('Quiting it is then. Your wish is my command...')
+	end	
+
+	print( string.rep('--',20) )
+	
+	-- main loop
+	for block=0,numBlocks,1 do
+
+		local reminder = (block+1) % 4
+		local cmd
+		if reminder == 0 then
+			cmd = CmdString:format(block, OldKey , EMPTY_SECTORTRAIL)
+		else
+			cmd = CmdString:format(block, OldKey , EMPTY_BL)		
+		end	
+	
+		if block ~= 0 then
+			print(cmd)
+			--core.console(cmd)
+		end
+		
+		if core.ukbhit() then
+			print("aborted by user")
+			break
+		end
+	end
+end
+
+main(args)