mifare_ultralight.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291
  1. #include "mifare_ultralight.h"
  2. bool mf_ul_check_card_type(uint8_t ATQA0, uint8_t ATQA1, uint8_t SAK) {
  3. if((ATQA0 == 0x44) && (ATQA1 == 0x00) && (SAK == 0x00)) {
  4. return true;
  5. }
  6. return false;
  7. }
  8. uint16_t mf_ul_prepare_get_version(uint8_t* dest) {
  9. dest[0] = MF_UL_GET_VERSION_CMD;
  10. return 1;
  11. }
  12. void mf_ul_parse_get_version_response(uint8_t* buff, MifareUlDevice* mf_ul_read) {
  13. MfUltralightVersion* version = (MfUltralightVersion*) buff;
  14. memcpy(&mf_ul_read->data.version, version, sizeof(MfUltralightVersion));
  15. if(version->storage_size == 0x0B || version->storage_size == 0x00) {
  16. mf_ul_read->type = MfUltralightTypeUL11;
  17. mf_ul_read->pages_to_read = 20;
  18. mf_ul_read->support_fast_read = true;
  19. } else if(version->storage_size == 0x0E) {
  20. mf_ul_read->type = MfUltralightTypeUL21;
  21. mf_ul_read->pages_to_read = 41;
  22. mf_ul_read->support_fast_read = true;
  23. } else if(version->storage_size == 0x0F) {
  24. mf_ul_read->type = MfUltralightTypeNTAG213;
  25. mf_ul_read->pages_to_read = 45;
  26. mf_ul_read->support_fast_read = false;
  27. } else if(version->storage_size == 0x11) {
  28. mf_ul_read->type = MfUltralightTypeNTAG215;
  29. mf_ul_read->pages_to_read = 135;
  30. mf_ul_read->support_fast_read = false;
  31. } else if(version->storage_size == 0x13) {
  32. mf_ul_read->type = MfUltralightTypeNTAG216;
  33. mf_ul_read->pages_to_read = 231;
  34. mf_ul_read->support_fast_read = false;
  35. } else {
  36. mf_ul_set_default_version(mf_ul_read);
  37. }
  38. }
  39. void mf_ul_set_default_version(MifareUlDevice* mf_ul_read) {
  40. mf_ul_read->type = MfUltralightTypeUnknown;
  41. mf_ul_read->pages_to_read = 16;
  42. mf_ul_read->support_fast_read = false;
  43. }
  44. uint16_t mf_ul_prepare_read(uint8_t* dest, uint8_t start_page) {
  45. dest[0] = MF_UL_READ_CMD;
  46. dest[1] = start_page;
  47. return 2;
  48. }
  49. void mf_ul_parse_read_response(uint8_t* buff, uint16_t page_addr, MifareUlDevice* mf_ul_read) {
  50. uint8_t pages_read = 4;
  51. uint8_t page_read_count = mf_ul_read->pages_readed + pages_read;
  52. if(page_read_count > mf_ul_read->pages_to_read) {
  53. pages_read -= page_read_count - mf_ul_read->pages_to_read;
  54. }
  55. mf_ul_read->pages_readed += pages_read;
  56. mf_ul_read->data.data_size = mf_ul_read->pages_readed * 4;
  57. memcpy(&mf_ul_read->data.data[page_addr * 4], buff, pages_read * 4);
  58. }
  59. uint16_t mf_ul_prepare_fast_read(uint8_t* dest, uint8_t start_page, uint8_t end_page) {
  60. dest[0] = MF_UL_FAST_READ_CMD;
  61. dest[1] = start_page;
  62. dest[2] = end_page;
  63. return 3;
  64. }
  65. void mf_ul_parse_fast_read_response(uint8_t* buff, uint8_t start_page, uint8_t end_page, MifareUlDevice* mf_ul_read) {
  66. mf_ul_read->pages_readed = end_page - start_page + 1;
  67. mf_ul_read->data.data_size = mf_ul_read->pages_readed * 4;
  68. memcpy(mf_ul_read->data.data, buff, mf_ul_read->data.data_size);
  69. }
  70. uint16_t mf_ul_prepare_read_signature(uint8_t* dest) {
  71. dest[0] = MF_UL_READ_SIG;
  72. dest[1] = 0;
  73. return 2;
  74. }
  75. void mf_ul_parse_read_signature_response(uint8_t* buff, MifareUlDevice* mf_ul_read) {
  76. memcpy(mf_ul_read->data.signature, buff, sizeof(mf_ul_read->data.signature));
  77. }
  78. uint16_t mf_ul_prepare_read_cnt(uint8_t* dest, uint8_t cnt_index) {
  79. if(cnt_index > 2) {
  80. return 0;
  81. }
  82. dest[0] = MF_UL_READ_CNT;
  83. dest[1] = cnt_index;
  84. return 2;
  85. }
  86. void mf_ul_parse_read_cnt_response(uint8_t* buff, uint8_t cnt_index, MifareUlDevice* mf_ul_read) {
  87. // Reverse LSB sequence
  88. if(cnt_index < 3) {
  89. mf_ul_read->data.counter[cnt_index] = (buff[2] << 16) | (buff[1] << 8) | (buff[0]);
  90. }
  91. }
  92. uint16_t mf_ul_prepare_inc_cnt(uint8_t* dest, uint8_t cnt_index, uint32_t value) {
  93. if(cnt_index > 2) {
  94. return 0;
  95. }
  96. dest[0] = MF_UL_INC_CNT;
  97. dest[1] = cnt_index;
  98. dest[2] = (uint8_t) value;
  99. dest[3] = (uint8_t) (value >> 8);
  100. dest[4] = (uint8_t) (value >> 16);
  101. dest[5] = 0;
  102. return 6;
  103. }
  104. uint16_t mf_ul_prepare_check_tearing(uint8_t* dest, uint8_t cnt_index) {
  105. if(cnt_index > 2) {
  106. return 0;
  107. }
  108. dest[0] = MF_UL_CHECK_TEARING;
  109. dest[1] = cnt_index;
  110. return 2;
  111. }
  112. void mf_ul_parse_check_tearing_response(uint8_t* buff, uint8_t cnt_index, MifareUlDevice* mf_ul_read) {
  113. if(cnt_index < 2) {
  114. mf_ul_read->data.tearing[cnt_index] = buff[0];
  115. }
  116. }
  117. uint16_t mf_ul_prepare_write(uint8_t* dest, uint16_t page_addr, uint32_t data) {
  118. if(page_addr < 2) {
  119. return 0;
  120. }
  121. dest[0] = MF_UL_WRITE;
  122. dest[1] = page_addr;
  123. dest[2] = (uint8_t) (data >> 24);
  124. dest[3] = (uint8_t) (data >> 16);
  125. dest[4] = (uint8_t) (data >> 8);
  126. dest[5] = (uint8_t) data;
  127. return 6;
  128. }
  129. void mf_ul_prepare_emulation(MifareUlDevice* mf_ul_emulate, MifareUlData* data) {
  130. mf_ul_emulate->data = *data;
  131. mf_ul_emulate->auth_data = NULL;
  132. mf_ul_emulate->data_changed = false;
  133. if(data->version.storage_size == 0) {
  134. mf_ul_emulate->type = MfUltralightTypeUnknown;
  135. mf_ul_emulate->support_fast_read = false;
  136. } else if(data->version.storage_size == 0x0B) {
  137. mf_ul_emulate->type = MfUltralightTypeUL11;
  138. mf_ul_emulate->support_fast_read = true;
  139. } else if(data->version.storage_size == 0x0E) {
  140. mf_ul_emulate->type = MfUltralightTypeUL21;
  141. mf_ul_emulate->support_fast_read = true;
  142. } else if(data->version.storage_size == 0x0F) {
  143. mf_ul_emulate->type = MfUltralightTypeNTAG213;
  144. mf_ul_emulate->support_fast_read = true;
  145. } else if(data->version.storage_size == 0x11) {
  146. mf_ul_emulate->type = MfUltralightTypeNTAG215;
  147. mf_ul_emulate->support_fast_read = true;
  148. } else if(data->version.storage_size == 0x13) {
  149. mf_ul_emulate->type = MfUltralightTypeNTAG216;
  150. mf_ul_emulate->support_fast_read = true;
  151. }
  152. if(mf_ul_emulate->type >= MfUltralightTypeNTAG213) {
  153. uint16_t pwd_page = (data->data_size / 4) - 2;
  154. mf_ul_emulate->auth_data = (MifareUlAuthData*)&data->data[pwd_page * 4];
  155. }
  156. }
  157. void mf_ul_protect_auth_data_on_read_command(
  158. uint8_t* tx_buff,
  159. uint8_t start_page,
  160. uint8_t end_page,
  161. MifareUlDevice* mf_ul_emulate) {
  162. if(mf_ul_emulate->type >= MfUltralightTypeNTAG213) {
  163. uint8_t pwd_page = (mf_ul_emulate->data.data_size / 4) - 2;
  164. uint8_t pack_page = pwd_page + 1;
  165. if((start_page <= pwd_page) && (end_page >= pwd_page)) {
  166. memset(&tx_buff[(pwd_page - start_page) * 4], 0, 4);
  167. }
  168. if((start_page <= pack_page) && (end_page >= pack_page)) {
  169. memset(&tx_buff[(pack_page - start_page) * 4], 0, 2);
  170. }
  171. }
  172. }
  173. uint16_t mf_ul_prepare_emulation_response(uint8_t* buff_rx, uint16_t len_rx, uint8_t* buff_tx, MifareUlDevice* mf_ul_emulate) {
  174. uint8_t cmd = buff_rx[0];
  175. uint16_t page_num = mf_ul_emulate->data.data_size / 4;
  176. uint16_t tx_len = 0;
  177. if(cmd == MF_UL_GET_VERSION_CMD) {
  178. if(mf_ul_emulate->type != MfUltralightTypeUnknown) {
  179. tx_len = sizeof(mf_ul_emulate->data.version);
  180. memcpy(buff_tx, &mf_ul_emulate->data.version, tx_len);
  181. }
  182. } else if(cmd == MF_UL_READ_CMD) {
  183. uint8_t start_page = buff_rx[1];
  184. if(start_page < page_num) {
  185. tx_len = 16;
  186. if(start_page + 4 > page_num) {
  187. // Handle roll-over mechanism
  188. uint8_t end_pages_num = page_num - start_page;
  189. memcpy(buff_tx, &mf_ul_emulate->data.data[start_page * 4], end_pages_num * 4);
  190. memcpy(&buff_tx[end_pages_num * 4], mf_ul_emulate->data.data, (4 - end_pages_num) * 4);
  191. } else {
  192. memcpy(buff_tx, &mf_ul_emulate->data.data[start_page * 4], tx_len);
  193. }
  194. mf_ul_protect_auth_data_on_read_command(
  195. buff_tx, start_page, (start_page + 4), mf_ul_emulate);
  196. }
  197. } else if(cmd == MF_UL_FAST_READ_CMD) {
  198. if(mf_ul_emulate->support_fast_read) {
  199. uint8_t start_page = buff_rx[1];
  200. uint8_t end_page = buff_rx[2];
  201. if((start_page < page_num) &&
  202. (end_page < page_num) && (start_page < (end_page + 1))) {
  203. tx_len = ((end_page + 1) - start_page) * 4;
  204. memcpy(buff_tx, &mf_ul_emulate->data.data[start_page * 4], tx_len);
  205. mf_ul_protect_auth_data_on_read_command(
  206. buff_tx, start_page, end_page, mf_ul_emulate);
  207. } else {
  208. // TODO make 4-bit NAK
  209. buff_tx[0] = 0x0;
  210. tx_len = 1;
  211. }
  212. }
  213. } else if(cmd == MF_UL_WRITE) {
  214. uint8_t write_page = buff_rx[1];
  215. if((write_page > 1) && (write_page < page_num - 2)) {
  216. memcpy(&mf_ul_emulate->data.data[write_page * 4], &buff_rx[2], 4);
  217. mf_ul_emulate->data_changed = true;
  218. // TODO make 4-bit ACK
  219. buff_tx[0] = 0x0A;
  220. tx_len = 1;
  221. }
  222. } else if(cmd == MF_UL_READ_CNT) {
  223. uint8_t cnt_num = buff_rx[1];
  224. if(cnt_num < 3) {
  225. buff_tx[0] = mf_ul_emulate->data.counter[cnt_num] >> 16;
  226. buff_tx[1] = mf_ul_emulate->data.counter[cnt_num] >> 8;
  227. buff_tx[2] = mf_ul_emulate->data.counter[cnt_num];
  228. tx_len = 3;
  229. }
  230. } else if(cmd == MF_UL_INC_CNT) {
  231. uint8_t cnt_num = buff_rx[1];
  232. uint32_t inc = (buff_rx[2] | (buff_rx[3] << 8) | (buff_rx[4] << 16));
  233. if((cnt_num < 3) && (mf_ul_emulate->data.counter[cnt_num] + inc < 0x00FFFFFF)) {
  234. mf_ul_emulate->data.counter[cnt_num] += inc;
  235. mf_ul_emulate->data_changed = true;
  236. // TODO make 4-bit ACK
  237. buff_tx[0] = 0x0A;
  238. tx_len = 1;
  239. }
  240. } else if(cmd == MF_UL_AUTH) {
  241. if(mf_ul_emulate->type >= MfUltralightTypeNTAG213) {
  242. if(memcmp(&buff_rx[1], mf_ul_emulate->auth_data->pwd, 4) == 0) {
  243. buff_tx[0] = mf_ul_emulate->auth_data->pack.raw[0];
  244. buff_tx[1] = mf_ul_emulate->auth_data->pack.raw[1];
  245. tx_len = 2;
  246. } else if(!mf_ul_emulate->auth_data->pack.value) {
  247. buff_tx[0] = 0x80;
  248. buff_tx[1] = 0x80;
  249. tx_len = 2;
  250. } else {
  251. // TODO make 4-bit NAK
  252. buff_tx[0] = 0x0;
  253. tx_len = 1;
  254. }
  255. }
  256. } else if(cmd == MF_UL_READ_SIG) {
  257. // Check 2nd byte = 0x00 - RFU
  258. if(buff_rx[1] == 0x00) {
  259. tx_len = sizeof(mf_ul_emulate->data.signature);
  260. memcpy(buff_tx, mf_ul_emulate->data.signature, tx_len);
  261. }
  262. } else if(cmd == MF_UL_CHECK_TEARING) {
  263. uint8_t cnt_num = buff_rx[1];
  264. if(cnt_num < 3) {
  265. buff_tx[0] = mf_ul_emulate->data.tearing[cnt_num];
  266. tx_len = 1;
  267. }
  268. }
  269. return tx_len;
  270. }