Merge branch 'master' of https://github.com/Proxmark/proxmark3

Conflicts:
	README.txt
	armsrc/appmain.c
	armsrc/apps.h
	armsrc/des.c
	armsrc/iclass.c
	armsrc/mifarecmd.c
	armsrc/mifareutil.c
	armsrc/mifareutil.h
	client/cmddata.c
	client/cmdhf.c
	client/cmdhf14a.c
	client/cmdhficlass.c
	client/cmdhfmfu.c
	client/cmdhfmfu.h
	client/cmdscript.c
	client/lualibs/commands.lua
	client/lualibs/html_dumplib.lua
	client/scripting.c
	client/util.c
	common/protocols.h
	include/usb_cmd.h

README.txt

@@ -36,7 +36,7 @@ For people with linux you will need to patch some source code and some small cha
 
 Common errors linux/macOS finds
 Error:
-	* loclass/fileutils.c:15:2: warning: implicit declaration of function ‘_stat’ [-Wimplicit-function-declaration]
+	* loclass/fileutils.c:15:2: warning: implicit declaration of function ‘_stat’ [-Wimplicit-function-declaration]
 Solution:
 	* Remove the "unscore" sign.   In linux you use without underscore, in windows you need a underscore. 
 	
@@ -62,6 +62,8 @@ Solution
 
 An old Qt4 version makefile is found here: http://www.icesql.se/proxmark3/code/linuxmakefile.txt  but this one doesn't have all new files in it. So I don't recommend it.
 
+The Proxmark 3 is available for purchase (assembled and tested) from the
+following locations:
 
 
 January 2015, Sweden

armsrc/appmain.c

@@ -736,7 +736,7 @@ void UsbPacketReceived(uint8_t *packet, int len)
 			ReaderHitag((hitag_function)c->arg[0],(hitag_data*)c->d.asBytes);
 			break;
 #endif
-            
+
 #ifdef WITH_ISO15693
 		case CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693:
 			AcquireRawAdcSamplesIso15693();
@@ -833,7 +833,7 @@ void UsbPacketReceived(uint8_t *packet, int len)
 			break;
 		case CMD_MIFAREU_READCARD:
 			MifareUReadCard(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
-			break;		
+			break;
 		case CMD_MIFAREUC_SETPWD: 
 			MifareUSetPwd(c->arg[0], c->d.asBytes);
 			break;
@@ -845,8 +845,9 @@ void UsbPacketReceived(uint8_t *packet, int len)
 			break;
 		case CMD_MIFAREU_WRITEBL_COMPAT:
 			MifareUWriteBlock(c->arg[0], c->d.asBytes);
-            break;
+			break;
 		case CMD_MIFAREU_WRITEBL:
+			MifareUWriteBlock_Special(c->arg[0], c->d.asBytes);
 			MifareUWriteBlock_Special(c->arg[0], c->arg[1], c->d.asBytes);
 			break;
 		case CMD_MIFARE_NESTED:

armsrc/des.h

@@ -100,6 +100,9 @@ void tdes_enc(void* out, const void* in, const void* key);
  void tdes_2key_enc(void* out, const void* in, size_t length, const void* key, unsigned char iv[8]);
  void tdes_2key_dec(void* out, const void* in, size_t length, const void* key, unsigned char iv[8]);
 
+ void tdes_2key_enc(void* out, const void* in, size_t length, const void* key, unsigned char iv[8]);
+ void tdes_2key_dec(void* out, const void* in, size_t length, const void* key, unsigned char iv[8]);
+
 #endif /*DES_H_*/
 
 // Copied from des.h in desfire imp.

armsrc/iso14443a.c

@@ -2960,4 +2960,4 @@ void RAMFUNC SniffMifare(uint8_t param) {
 	
 	Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen, Uart.state, Uart.len);
 	LEDsoff();
-}
+}

armsrc/lfops.c

@@ -651,7 +651,7 @@ void CmdASKsimTag(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *BitStream)
 	int ledcontrol = 1;
 	int n=0, i=0;
 	uint8_t clk = (arg1 >> 8) & 0xFF;
-	uint8_t encoding = arg1 & 1;
+	uint8_t encoding = arg1 & 0xFF;
 	uint8_t separator = arg2 & 1;
 	uint8_t invert = (arg2 >> 8) & 1;
 

armsrc/mifarecmd.c

@@ -19,6 +19,12 @@
 
 #include "crc.h"
 
+// the block number for the ISO14443-4 PCB
+uint8_t pcb_blocknum = 0;
+// Deselect card by sending a s-block. the crc is precalced for speed
+static  uint8_t deselect_cmd[] = {0xc2,0xe0,0xb4};
+
+
 //-----------------------------------------------------------------------------
 // Select, Authenticate, Read a MIFARE tag. 
 // read block
@@ -86,7 +92,6 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 	LEDsoff();
 }
 
-
 void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){
 
 	bool turnOffField = (arg0 == 1);
@@ -106,17 +111,19 @@ void MifareUC_Auth(uint8_t arg0, uint8_t *keybytes){
 		OnError(1);
 		return;
 	}
-    
+
 	if (turnOffField) {
 		FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 		LEDsoff();
+	}
+	cmd_send(CMD_ACK,1,0,0,0,0);
 	}	
 	cmd_send(CMD_ACK,1,0,0,0,0);
 }
 
 // Arg0 = BlockNo,
 // Arg1 = UsePwd bool
-// datain = PWD bytes,  
+// datain = PWD bytes,
 void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 {
 	uint8_t blockNo = arg0;
@@ -124,52 +131,52 @@ void MifareUReadBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 	bool useKey = (arg1 == 1); //UL_C
 	bool usePwd = (arg1 == 2); //UL_EV1/NTAG
 
-	LEDsoff();	
-	LED_A_ON();    
+	LEDsoff();
+	LED_A_ON();
 	clear_trace();
 	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
-    
+
 	int len = iso14443a_select_card(NULL, NULL, NULL);
 	if(!len) {
 		if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card (RC:%02X)",len);
 		OnError(1);
 		return;
 	}
-       
+
 	// UL-C authentication
 	if ( useKey ) {
-		uint8_t key[16] = {0x00};	
+		uint8_t key[16] = {0x00};
 		memcpy(key, datain, sizeof(key) );
 
 		if ( !mifare_ultra_auth(key) ) {
 			OnError(1);
-			return;			
+			return;
 		}
 	}
-	
+
 	// UL-EV1 / NTAG authentication
-	if (usePwd) { 
+	if ( usePwd ) {
 		uint8_t pwd[4] = {0x00};
 		memcpy(pwd, datain, 4);
 		uint8_t pack[4] = {0,0,0,0};
 		if (!mifare_ul_ev1_auth(pwd, pack)) {
 			OnError(1);
-			return;			
+			return;
 		}
-	}
-		
+	}	
+
 	if( mifare_ultra_readblock(blockNo, dataout) ) {
 		if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block error");
 		OnError(2);
 		return;
 	}
-        
+
 	if( mifare_ultra_halt() ) {
 		if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 		OnError(3);
 		return;
 	}
-		
+
     cmd_send(CMD_ACK,1,0,0,dataout,16);
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	LEDsoff();
@@ -268,7 +275,7 @@ void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
 	}
 
 	LEDsoff();
-	LED_A_ON(); 
+	LED_A_ON();
 	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 
 	int len = iso14443a_select_card(NULL, NULL, NULL);
@@ -277,6 +284,35 @@ void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
 		OnError(1);
 		return;
 	}
+
+	// UL-C authentication
+	if ( useKey ) {
+		uint8_t key[16] = {0x00};
+		memcpy(key, datain, sizeof(key) );
+
+		if ( !mifare_ultra_auth(key) ) {
+			OnError(1);
+			return;
+		}
+	}
+
+	// UL-EV1 / NTAG authentication
+	if (usePwd) {
+		uint8_t pwd[4] = {0x00};
+		memcpy(pwd, datain, sizeof(pwd));
+		uint8_t pack[4] = {0,0,0,0};
+
+		if (!mifare_ul_ev1_auth(pwd, pack)){
+			OnError(1);
+			return;			
+		}
+	}
+
+	for (int i = 0; i < blocks; i++){
+		if ((i*4) + 4 > CARD_MEMORY_SIZE) {
+			Dbprintf("Data exceeds buffer!!");
+			break;
+		}
 	
 	 // UL-C authentication
 	if ( useKey ) {
@@ -313,7 +349,7 @@ void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
 			if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Read block %d error",i);
 			// if no blocks read - error out
 			if (i==0){
-			OnError(2);
+				OnError(2);
 			return;
 			} else {
 				//stop at last successful read block and return what we got
@@ -323,14 +359,14 @@ void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain)
 			countblocks++;
 		}
 	}
-		
+
 	len = mifare_ultra_halt();
 	if (len) {
 		if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Halt error");
 		OnError(3);
 		return;
 	}
-	
+
 	if (MF_DBGLEVEL >= MF_DBG_EXTENDED) Dbprintf("Blocks read %d", countblocks);
 
 	countblocks *= 4;
@@ -413,15 +449,15 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
 
 void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
 {
-    uint8_t blockNo = arg0;
+	uint8_t blockNo = arg0;
 	byte_t blockdata[16] = {0x00};
 
-    memcpy(blockdata, datain, 16);
-        
+	memcpy(blockdata, datain, 16);
+
 	uint8_t uid[10] = {0x00};
 
 	LED_A_ON(); LED_B_OFF(); LED_C_OFF();
-		
+
 	clear_trace();
 	iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 
@@ -441,7 +477,7 @@ void MifareUWriteBlock(uint8_t arg0, uint8_t *datain)
 		OnError(0);
 		return;
 	};
-		
+
 	if (MF_DBGLEVEL >= 2)   DbpString("WRITE BLOCK FINISHED");
 
 	cmd_send(CMD_ACK,1,0,0,0,0);
@@ -461,8 +497,8 @@ void MifareUWriteBlock_Special(uint8_t arg0, uint8_t arg1, uint8_t *datain)
 	bool useKey = (arg1 == 1); //UL_C
 	bool usePwd = (arg1 == 2); //UL_EV1/NTAG
 	byte_t blockdata[4] = {0x00};
-	
-	memcpy(blockdata, datain, 4);
+
+	memcpy(blockdata, datain,4);
 	
 	LEDsoff();
 	LED_A_ON();
@@ -1338,3 +1374,18 @@ void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	LEDsoff();
 }
+
+void OnSuccess(){
+	pcb_blocknum = 0;
+	ReaderTransmit(deselect_cmd, 3 , NULL);
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	LEDsoff();
+}
+
+void OnError(uint8_t reason){
+	pcb_blocknum = 0;
+	ReaderTransmit(deselect_cmd, 3 , NULL);
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	cmd_send(CMD_ACK,0,reason,0,0,0);
+	LEDsoff();
+}

armsrc/mifareutil.c

@@ -315,34 +315,35 @@ int mifare_ul_ev1_auth(uint8_t *keybytes, uint8_t *pack){
 	uint16_t len;
 	uint8_t resp[4];
 	uint8_t respPar[1];
-	uint8_t key[4] = {0x00};	
+	uint8_t key[4] = {0x00};
 	memcpy(key, keybytes, 4);
-	
+
 	Dbprintf("EV1 Auth : %02x%02x%02x%02x",	key[0], key[1], key[2], key[3]);
 	len = mifare_sendcmd_short_mfuev1auth(NULL, 0, 0x1B, key, resp, respPar, NULL);
 	if (len != 4) {
 		if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x %u", resp[0], len);
 		return 0;
 	}
-	
+
 	if (MF_DBGLEVEL >= MF_DBG_EXTENDED)
-		Dbprintf("Auth Resp: %02x%02x%02x%02x",	resp[0],resp[1],resp[2],resp[3]);
-	
+		Dbprintf("Auth Resp: %02x%02x%02x%02x", resp[0],resp[1],resp[2],resp[3]);
+
 	memcpy(pack, resp, 4);
 	return 1;
 }
 
 int mifare_ultra_auth(uint8_t *keybytes){
 
-	// 3des2k
+	/// 3des2k
+
 	uint8_t random_a[8] = {1,1,1,1,1,1,1,1};
 	uint8_t random_b[8] = {0x00};
 	uint8_t enc_random_b[8] = {0x00};
 	uint8_t rnd_ab[16] = {0x00};
 	uint8_t IV[8] = {0x00};
-	uint8_t key[16] = {0x00};	
+	uint8_t key[16] = {0x00};
 	memcpy(key, keybytes, 16);
-	
+
 	uint16_t len;
 	uint8_t resp[19] = {0x00};
 	uint8_t respPar[3] = {0,0,0};
@@ -362,21 +363,41 @@ int mifare_ultra_auth(uint8_t *keybytes){
 	rol(random_b,8);
 	memcpy(rnd_ab  ,random_a,8);
 	memcpy(rnd_ab+8,random_b,8);
-	
+
 	if (MF_DBGLEVEL >= MF_DBG_EXTENDED) {
 		Dbprintf("enc_B: %02x %02x %02x %02x %02x %02x %02x %02x",
 			enc_random_b[0],enc_random_b[1],enc_random_b[2],enc_random_b[3],enc_random_b[4],enc_random_b[5],enc_random_b[6],enc_random_b[7]);
-			
+
 		Dbprintf("    B: %02x %02x %02x %02x %02x %02x %02x %02x",
 			random_b[0],random_b[1],random_b[2],random_b[3],random_b[4],random_b[5],random_b[6],random_b[7]);
 
 		Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
 				rnd_ab[0],rnd_ab[1],rnd_ab[2],rnd_ab[3],rnd_ab[4],rnd_ab[5],rnd_ab[6],rnd_ab[7]);
-				
+
 		Dbprintf("rnd_ab: %02x %02x %02x %02x %02x %02x %02x %02x",
 				rnd_ab[8],rnd_ab[9],rnd_ab[10],rnd_ab[11],rnd_ab[12],rnd_ab[13],rnd_ab[14],rnd_ab[15] );
 	}
-	
+
+	// encrypt    out, in, length, key, iv
+	tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);
+
+	len = mifare_sendcmd_short_mfucauth(NULL, 1, 0xAF, rnd_ab, resp, respPar, NULL);
+	if (len != 11) {
+		if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Cmd Error: %02x", resp[0]);
+		return 0;
+	}
+
+	uint8_t enc_resp[8] = { 0,0,0,0,0,0,0,0 };
+	uint8_t resp_random_a[8] = { 0,0,0,0,0,0,0,0 };
+	memcpy(enc_resp, resp+1, 8);
+
+	// decrypt    out, in, length, key, iv 
+	tdes_2key_dec(resp_random_a, enc_resp, 8, key, enc_random_b);
+	if ( memcmp(resp_random_a, random_a, 8) != 0 ) {
+		if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("failed authentication");
+		return 0;
+	}
+
 	// encrypt    out, in, length, key, iv
 	tdes_2key_enc(rnd_ab, rnd_ab, sizeof(rnd_ab), key, enc_random_b);
 
@@ -409,7 +430,7 @@ int mifare_ultra_auth(uint8_t *keybytes){
 		Dbprintf("a: %02x %02x %02x %02x %02x %02x %02x %02x",
 				random_a[0],random_a[1],random_a[2],random_a[3],
 				random_a[4],random_a[5],random_a[6],random_a[7]);
-				
+
 		Dbprintf("b: %02x %02x %02x %02x %02x %02x %02x %02x",
 				resp_random_a[0],resp_random_a[1],resp_random_a[2],resp_random_a[3],
 				resp_random_a[4],resp_random_a[5],resp_random_a[6],resp_random_a[7]);
@@ -494,18 +515,18 @@ int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t bl
 
 int mifare_ultra_writeblock(uint8_t blockNo, uint8_t *blockData) 
 {
-    uint16_t len;     
+	uint16_t len;
     uint8_t par[3] = {0};  // enough for 18 parity bits
 	uint8_t d_block[18] = {0x00};
 	uint8_t receivedAnswer[MAX_FRAME_SIZE];
 	uint8_t receivedAnswerPar[MAX_PARITY_SIZE];
-        
+
     // command MIFARE_CLASSIC_WRITEBLOCK
     len = mifare_sendcmd_short(NULL, true, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL);
 
     if ((len != 1) || (receivedAnswer[0] != 0x0A)) {   //  0x0a - ACK
 		if (MF_DBGLEVEL >= MF_DBG_ERROR)
-			Dbprintf("Cmd Addr Error: %02x", receivedAnswer[0]);  
+			Dbprintf("Cmd Addr Error: %02x", receivedAnswer[0]);
         return 1;
     }
 
@@ -514,15 +535,15 @@ int mifare_ultra_writeblock(uint8_t blockNo, uint8_t *blockData)
 
 	ReaderTransmitPar(d_block, sizeof(d_block), par, NULL);
 
-    len = ReaderReceive(receivedAnswer, receivedAnswerPar);    
+	len = ReaderReceive(receivedAnswer, receivedAnswerPar);
 
 	if ((len != 1) || (receivedAnswer[0] != 0x0A)) {   //  0x0a - ACK
 		if (MF_DBGLEVEL >= MF_DBG_ERROR)
 			Dbprintf("Cmd Data Error: %02x %d", receivedAnswer[0],len);
         return 2;
-    }        
+	}
     return 0;
-} 
+}
 
 int mifare_ultra_special_writeblock(uint8_t blockNo, uint8_t *blockData)
 {

armsrc/mifareutil.h

@@ -62,10 +62,10 @@ int mifare_sendcmd_shortex(struct Crypto1State *pcs, uint8_t crypted, uint8_t cm
 
 int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested);
 int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t * ntptr, uint32_t *timing);
-int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData); 
+int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);
 int mifare_ul_ev1_auth(uint8_t *key, uint8_t *pack);
 int mifare_ultra_auth(uint8_t *key);
-int mifare_ultra_readblock(uint8_t blockNo, uint8_t *blockData);
+int mifare_ultra_readblock(uint8_t blockNo, uint8_t *blockData);
 int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);
 int mifare_ultra_writeblock(uint8_t blockNo, uint8_t *blockData);
 int mifare_ultra_special_writeblock(uint8_t blockNo, uint8_t *blockData);

client/cmddata.c

@@ -1892,8 +1892,7 @@ int getSamples(const char *Cmd, bool silent)
 		PrintAndLog("Unpacking...");
 		BitstreamOut bout = { got, bits_per_sample * n,  0};
 		int j =0;
-		//for (j = 0; j * bits_per_sample < n * 8 && j < sizeof(GraphBuffer); j++) {
-			for (j = 0; j * bits_per_sample < n * 8 && j < n; j++) {
+		for (j = 0; j * bits_per_sample < n * 8 && j < n; j++) {
 			uint8_t sample = getByte(bits_per_sample, &bout);
 			GraphBuffer[j] = ((int) sample )- 128;
 		}

client/cmdhf.c

@@ -677,7 +677,7 @@ int CmdHFSearch(const char *Cmd){
 
 	//14b has issues currently...
 	//ans = CmdHF14BRead(Cmd);
-	//if (ans > 0) return ans;	
+	//if (ans > 0) return ans;
 
 	return 0;
 }
@@ -692,11 +692,11 @@ static command_t CommandTable[] =
   {"legic",       CmdHFLegic,       0, "{ LEGIC RFIDs... }"},
   {"iclass",      CmdHFiClass,      1, "{ ICLASS RFIDs... }"},
   {"mf",      		CmdHFMF,		1, "{ MIFARE RFIDs... }"},
-  {"mfu",			CmdHFMFUltra,	1, "{ MIFARE Ultralight RFIDs... }"},
+  {"mfu",         CmdHFMFUltra,     1, "{ MIFARE Ultralight RFIDs... }"},
   {"mfdes",			CmdHFMFDes,		1, "{ MIFARE Desfire RFIDs... }"},
   {"topaz",			CmdHFTopaz,		1, "{ TOPAZ (NFC Type 1) RFIDs... }"},
   {"tune",			CmdHFTune,      0, "Continuously measure HF antenna tuning"},
-  {"list",			CmdHFList,      1, "List protocol data in trace buffer"},
+  {"list",        CmdHFList,        1, "List protocol data in trace buffer"},
   {"search",      CmdHFSearch,      1, "Search for known HF tags [preliminary]"},
 	{NULL, NULL, 0, NULL}
 };

client/cmdhficlass.c

@@ -174,9 +174,9 @@ int HFiClassReader(const char *Cmd, bool loop, bool verbose)
 	SendCommand(&c);
 	UsbCommand resp;
 	while(!ukbhit()){
-		if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
+		if (WaitForResponseTimeout(CMD_ACK,&resp, 4500)) {
 			uint8_t readStatus    = resp.arg[0] & 0xff;
-			uint8_t * data  = resp.d.asBytes;
+			uint8_t *data = resp.d.asBytes;
 
 			if (verbose)
 			PrintAndLog("Readstatus:%02x", readStatus);

client/cmdhfmf.c

@@ -1592,6 +1592,7 @@ int CmdHF14AMfCLoad(const char *Cmd)
 			memset(buf, 0, sizeof(buf));
 			
 			if (fgets(buf, sizeof(buf), f) == NULL) {
+				fclose(f);
 				PrintAndLog("File reading error.");
 				fclose(f);
 				return 2;

client/cmdhfmfu.h

@@ -32,9 +32,9 @@ typedef enum TAGTYPE_UL {
 	UL_EV1_48     = 0x000004,
 	UL_EV1_128    = 0x000008,
 	NTAG          = 0x000010,
-	NTAG_203	  = 0x000020,
-	NTAG_210	  = 0x000040,
-	NTAG_212	  = 0x000080,
+	NTAG_203      = 0x000020,
+	NTAG_210      = 0x000040,
+	NTAG_212      = 0x000080,
 	NTAG_213      = 0x000100,
 	NTAG_215      = 0x000200,
 	NTAG_216      = 0x000400,
@@ -42,8 +42,8 @@ typedef enum TAGTYPE_UL {
 	MY_D_NFC      = 0x001000,
 	MY_D_MOVE     = 0x002000,
 	MY_D_MOVE_NFC = 0x004000,
-	NTAG_I2C_1K	  = 0x008000,
-	NTAG_I2C_2K	  = 0x010000,
+	NTAG_I2C_1K   = 0x008000,
+	NTAG_I2C_2K   = 0x010000,
 	MAGIC         = 0x020000,
 	UL_MAGIC      = UL | MAGIC,
 	UL_C_MAGIC    = UL_C | MAGIC,

client/cmdscript.c

@@ -83,7 +83,7 @@ int CmdList(const char *Cmd)
     {
         while ((ep = readdir (dp)) != NULL)
         {
-            if( str_ends_with(ep->d_name, ".lua"))
+            if(str_ends_with(ep->d_name, ".lua"))
                 PrintAndLog("%-16s %s", ep->d_name, "A script file");
         }
         (void) closedir (dp);

client/lualibs/html_dumplib.lua

@@ -192,7 +192,7 @@ end
 return {
 	convert_bin_to_html = convert_bin_to_html,
 	convert_eml_to_html = convert_eml_to_html,
-    convert_eml_to_bin = convert_eml_to_bin,
+	convert_eml_to_bin = convert_eml_to_bin,
     SaveAsBinary = save_BIN,
 	SaveAsText = save_TEXT,
     SaveAsBinary = save_BIN,

client/nonce2key/crapto1.c

@@ -251,7 +251,6 @@ struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in)
 			}
 		}
 
-
 	// initialize statelists: add all possible states which would result into the rightmost 2 bits of the keystream
 	for(i = 1 << 20; i >= 0; --i) {
 		if(filter(i) == (oks & 1))
@@ -272,9 +271,7 @@ struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in)
 
 	in = (in >> 16 & 0xff) | (in << 16) | (in & 0xff00);		// Byte swapping
 
-	recover(odd_head, odd_tail, oks,
-		even_head, even_tail, eks, 11, statelist, in << 1, bucket);
-
+	recover(odd_head, odd_tail, oks, even_head, even_tail, eks, 11, statelist, in << 1, bucket);
 
 out:
 	free(odd_head);
@@ -536,8 +533,7 @@ brute_top(uint32_t prefix, uint32_t rresp, unsigned char parities[8][8],
  * It returns a zero terminated list of possible cipher states after the
  * tag nonce was fed in
  */
-struct Crypto1State*
-lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8], uint8_t no_par)
+struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8], uint8_t no_par)
 {
 	struct Crypto1State *statelist, *s;
 	uint32_t *odd, *even, *o, *e, top;
@@ -548,10 +544,10 @@ lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8],
 	statelist = malloc((sizeof *statelist) << 21);	//how large should be?
 	if(!statelist || !odd || !even)
 	{
-				free(statelist);
-				free(odd);
-				free(even);
-				return 0;
+		free(statelist);
+		free(odd);
+		free(even);
+		return 0;
 	}
 
 	s = statelist;
@@ -571,3 +567,66 @@ lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8],
 
 	return statelist;
 }
+
+/*
+struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8], uint8_t no_par, uint32_t nt, uint32_t uid)
+{
+    long long int amount = 0;
+    struct Crypto1State *statelist, *s;
+    uint32_t *odd, *even, *o, *e, top;
+
+    odd = lfsr_prefix_ks(ks, 1);
+    even = lfsr_prefix_ks(ks, 0);
+
+    s = statelist = malloc((sizeof *statelist) << 20);
+    if(!s || !odd || !even) {
+		free(odd);
+		free(even);
+		free(statelist);
+		return 0;
+    }
+
+    char filename[50] = "archivo.txt";
+    sprintf(filename, "logs/%x.txt", nt);
+    PrintAndLog("Name: %s\n", filename);
+    FILE *file = fopen(filename,"w+");
+	if ( !file ) {
+		s->odd = s->even = 0;
+		free(odd);
+		free(even);
+		PrintAndLog("Failed to create file");
+		return 0;
+	}
+    PrintAndLog("Creating file... ");
+	uint32_t xored = uid^nt;
+	
+    int lastOdd = 0;
+    for(o = odd; *o + 1; ++o)
+        for(e = even; *e + 1; ++e)
+            for(top = 0; top < 64; ++top) {
+                *o += 1 << 21;
+                *e += (!(top & 7) + 1) << 21;
+
+                //added by MG
+                if(lastOdd != statelist->odd){
+					// Here I create a temporal crypto1 state, 
+					// where I load the odd and even state and work with it,
+					// in order not to interfere with regular mechanism, This is what I save to file
+					struct Crypto1State *state;
+                    lastOdd = state->odd = statelist->odd; state->even = statelist->even;
+                    lfsr_rollback_word(state,xored,0);
+                    fprintf(file,"%x %x \n",state->odd,state->even);
+                    amount++;
+                }
+                //s = check_pfx_parity(pfx, rr, par, *o, *e, s); //This is not useful at all when attacking chineese cards
+				s = brute_top(pfx, rr, par, *o, *e, s, no_par); 
+            }
+
+	PrintAndLog("File created, amount %u\n",amount);
+	fclose(file);
+	s->odd = s->even = 0;
+	free(odd);
+	free(even);
+    return statelist;
+}
+ */

client/scripting.c

@@ -153,7 +153,7 @@ static int l_nonce2key(lua_State *L){
 
     //Push the retval on the stack
     lua_pushinteger(L,retval);
-  
+
     //Push the key onto the stack
     uint8_t dest_key[8];
     num_to_bytes(key,sizeof(dest_key),dest_key);
@@ -180,10 +180,10 @@ static int l_foobar(lua_State *L)
     printf("foobar called with %d arguments" , n);
     lua_settop(L, 0);
     printf("Arguments discarded, stack now contains %d elements", lua_gettop(L));
-  
+
     // todo: this is not used, where was it intended for?
     // UsbCommand response =  {CMD_MIFARE_READBL, {1337, 1338, 1339}};
-  
+
     printf("Now returning a uint64_t as a string");
     uint64_t x = 0xDEADBEEF;
     uint8_t destination[8];
@@ -240,12 +240,13 @@ static int l_aes128decrypt(lua_State *L)
     if(size != 32)  return returnToLuaWithError(L,"Wrong size of key, got %d bytes, expected 32", (int) size);
 
     const char *p_encTxt = luaL_checklstring(L, 2, &size);
-    
+
 	unsigned char indata[16] = {0x00};
 	unsigned char outdata[16] = {0x00};
     unsigned char aes_key[16] = {0x00};
 	unsigned char iv[16] = {0x00};
 
+	// convert key to bytearray and convert input to bytearray
 	for (i = 0; i < 32; i += 2) {
 		sscanf(&p_encTxt[i], "%02x", (unsigned int *)&indata[i / 2]);
 		sscanf(&p_key[i], "%02x", (unsigned int *)&aes_key[i / 2]);
@@ -282,9 +283,9 @@ static int l_aes128encrypt(lua_State *L)
 
     aes_context ctx;
     aes_init(&ctx);
-    aes_setkey_enc(&ctx, aes_key, 128);
+	aes_setkey_enc(&ctx, aes_key, 128);
 	aes_crypt_cbc(&ctx, AES_ENCRYPT, sizeof(indata), iv, indata, outdata );
-    //Push encrypted array as a string
+	//Push encrypted array as a string
 	lua_pushlstring(L,(const char *)&outdata, sizeof(outdata));
 	return 1;// return 1 to signal one return value
 }
@@ -293,7 +294,7 @@ static int l_crc16(lua_State *L)
 {
 	size_t size;
 	const char *p_str = luaL_checklstring(L, 1, &size);
-		
+
 	uint16_t retval = crc16_ccitt( (uint8_t*) p_str, size);
     lua_pushinteger(L, (int) retval);
     return 1;
@@ -306,7 +307,7 @@ static int l_crc64(lua_State *L)
 	unsigned char outdata[8] = {0x00};
 
 	const char *p_str = luaL_checklstring(L, 1, &size);
-	
+
 	crc64( (uint8_t*) p_str, size, &crc);
 
 	outdata[0] = (uint8_t)(crc >> 56) & 0xff;
@@ -318,7 +319,7 @@ static int l_crc64(lua_State *L)
 	outdata[6] = (uint8_t)(crc >> 8) & 0xff;
 	outdata[7] = crc & 0xff;
 	lua_pushlstring(L,(const char *)&outdata, sizeof(outdata));
-    return 1;
+	return 1;
 }
 
 /**
@@ -341,7 +342,7 @@ int setLuaPath( lua_State* L, const char* path )
     lua_pushstring( L, buf ); // push the new one
     lua_setfield( L, -2, "path" ); // set the field "path" in table at -2 with value at top of stack
     lua_pop( L, 1 ); // get rid of package table from top of stack
-    free(buf);
+	free(buf);
 	return 0; // all done!
 }
 
@@ -357,12 +358,12 @@ int set_pm3_libraries(lua_State *L)
         {"foobar",                      l_foobar},
         {"ukbhit",                      l_ukbhit},
         {"clearCommandBuffer",          l_clearCommandBuffer},
-        {"console",                     l_CmdConsole},
-        {"iso15693_crc",                l_iso15693_crc},
+		{"console",                     l_CmdConsole},
+		{"iso15693_crc",                l_iso15693_crc},
 		{"aes128_decrypt",              l_aes128decrypt},
 		{"aes128_encrypt",              l_aes128encrypt},
 		{"crc16",                       l_crc16},
-		{"crc64",						l_crc64},
+		{"crc64",                       l_crc64},
         {NULL, NULL}
     };
 

client/util.c

@@ -113,7 +113,7 @@ char *sprint_hex(const uint8_t *data, const size_t len) {
 	int maxLen = ( len > 1024/3) ? 1024/3 : len;
 	static char buf[1024];
 	memset(buf, 0x00, 1024);
-	char *tmp = buf;
+	char * tmp = buf;
 	size_t i;
 
 	for (i=0; i < maxLen; ++i, tmp += 3)

common/protocols.h

@@ -123,8 +123,8 @@ NXP/Philips CUSTOM COMMANDS
 #define MIFARE_CMD_RESTORE      0xC2
 #define MIFARE_CMD_TRANSFER     0xB0
 
-#define MIFARE_ULC_WRITE		0xA2
-//#define MIFARE_ULC_COMP_WRITE 0xA0
+#define MIFARE_ULC_WRITE        0xA2
+//#define MIFARE_ULC__COMP_WRITE  0xA0
 #define MIFARE_ULC_AUTH_1       0x1A
 #define MIFARE_ULC_AUTH_2       0xAF