Authentication with Mifare Classic using libnfc (Page 2 of 2)

#include <stdio.h>
#include <stdlib.h>
#include <stddef.h>
#include <stdint.h>
#include <stdbool.h>
#include <Windows.h>
#include "libnfc.h"
#include "crapto1.h"

#define SAK_FLAG_ATS_SUPPORTED 0x20

static byte_t abtRx[MAX_FRAME_LEN];
static uint32_t uiRxBits;
static uint32_t uiRxLen;
static byte_t abtUid[10];
static uint32_t uiUidLen = 4;
static dev_info* pdi;

// ISO14443A Anti-Collision Commands
byte_t abtReqa      [1] = { 0x26 };
byte_t abtSelectAll [2] = { 0x93,0x20 };
byte_t abtSelectTag [9] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
byte_t abtRats      [4] = { 0xe0,0x50,0xbc,0xa5 };
byte_t abtHalt      [4] = { 0x50,0x00,0x57,0xcd };

bool transmit_bits(const byte_t* pbtTx, const uint32_t uiTxBits)
{
  // Show transmitted command
  printf(" R: "); print_hex_bits(pbtTx,uiTxBits);

  // Transmit the bit frame command, we don't use the arbitrary parity feature
  if (!nfc_initiator_transceive_bits(pdi,pbtTx,uiTxBits,NULL,abtRx,&uiRxBits,NULL)) return false;

  // Show received answer
  printf(" T: "); print_hex_bits(abtRx,uiRxBits);

  // Succesful transfer
  return true;
}


bool transmit_bytes(const byte_t* pbtTx, const uint32_t uiTxLen)
{
  // Show transmitted command
  printf(" R: "); print_hex(pbtTx,uiTxLen);

  // Transmit the command bytes
  if (!nfc_initiator_transceive_bytes(pdi,pbtTx,uiTxLen,abtRx,&uiRxLen)) return false;

  // Show received answer
  printf(" T: "); print_hex(abtRx,uiRxLen);

  // Succesful transfer
  return true;
}

int main(int argc, const char* argv[])
{

    uint64_t ui64Key;
    uint32_t uiBlock1, uiBlock2, uiTimes, times;
    uint32_t SleepTime;

    char * KeyTyp1;
    char * KeyTyp2;


  if (argc < 6)
  {
    printf(" How to use:\n");
    printf(" nfc-multi-auth <KeyA1/KeyB1> <Key> <block1> <KeyA2/KeyB2> <block2> <times>\n\n");
    printf(" example nfc-multi-auth a ffffffffffff 3 b 3 3\n");
    printf(" desc: login to block 0x03 with KeyA: 0xffffffffffff\n");
    printf(" after successfull login send authentication request for KeyB and block 0x03\n");
    printf(" do this 3 times\n\n");
    printf(" If no times is defined the authentication will be done once\n");
    return 1;
  }

  KeyTyp1 = argv[1];
  sscanf(argv[2],"%012llx",&ui64Key);
  sscanf(argv[3],"%x",&uiBlock1);

  KeyTyp2 = argv[4];
  sscanf(argv[5],"%x",&uiBlock2);

  if (argc == 6)
  {
      uiTimes = 1;
  } else {
      sscanf(argv[6],"%x",&uiTimes);
  }

  //start loop * uiTimes:
  for (times=0; times<uiTimes; times++)
  {
  printf("\n-------------------------------------------------------------------");
  printf("\nStarting loop %d", times);
  SleepTime = rand() % 500 + 50;
  printf("\n rand delay: %dms\n", SleepTime); 

          // Try to open the NFC reader
          pdi = nfc_connect();
          
          if (!pdi)
          {
            printf(" Error connecting NFC reader\n");
            return 1;
          }
          nfc_initiator_init(pdi);

          // Drop the field for a while
          nfc_configure(pdi,DCO_ACTIVATE_FIELD,false);

          // Configure the CRC and Parity settings
          nfc_configure(pdi,DCO_HANDLE_CRC,false);
          nfc_configure(pdi,DCO_HANDLE_PARITY,true);

          // Enable field so more power consuming cards can power themselves up
          nfc_configure(pdi,DCO_ACTIVATE_FIELD,true);
          
          printf("\n Connected to NFC reader: %s\n\n",pdi->acName);

          // Send the 7 bits request command specified in ISO 14443A (0x26)
          if (!transmit_bits(abtReqa,7))
          {
            printf(" Error: No tag available\n");
            nfc_disconnect(pdi);
            return 1;
          }

          // Anti-collision
          transmit_bytes(abtSelectAll,2);
          
          // Save the UID
          memcpy(abtUid,abtRx,4);
          memcpy(abtSelectTag+2,abtRx,5);
          append_iso14443a_crc(abtSelectTag,7);
          transmit_bytes(abtSelectTag,9);


          // Test if we are dealing with a 4 bytes uid
          if (abtUid[0]!= 0x88)
          {
            uiUidLen = 4;
          } else {


            // We have to do the anti-collision for cascade level 2
            abtSelectAll[0] = 0x95;
            abtSelectTag[0] = 0x95;


            // Anti-collision
            transmit_bytes(abtSelectAll,2);
            
            // Save the UID
            memcpy(abtUid+4,abtRx,4);
            memcpy(abtSelectTag+2,abtRx,5);
            append_iso14443a_crc(abtSelectTag,7);
            transmit_bytes(abtSelectTag,9);
            uiUidLen = 7;
          }
          
          // Request ATS, this only applies to tags that support ISO 14443A-4
          if (abtRx[0] & SAK_FLAG_ATS_SUPPORTED) transmit_bytes(abtRats,4);
         
          printf("\n Found tag with UID: ");
          if (uiUidLen == 4)
          {
            printf("%08x\n",swap_endian32(abtUid));
          } else {
            printf("%014llx\n",swap_endian64(abtUid)&0x00ffffffffffffffull);
          }

          //random sleep for generating different tag nounces:
          Sleep(SleepTime);
            mifare_multisector_auth(pdi,abtUid,KeyTyp1,ui64Key,uiBlock1,KeyTyp2,uiBlock2);


          // Done, halt the tag now
          //transmit_bytes(abtHalt,4);

          nfc_disconnect(pdi);
  }

  return 0;
}

bool mifare_multisector_auth(dev_info* pdi, byte_t* pbtUid, char * KeyTyp1, uint64_t ui64Key, uint32_t uiBlock1, char * KeyTyp2, uint32_t uiBlock2)
{
  uint32_t pos, nt;
  struct Crypto1State* pcs;
  byte_t abtAuth[4]        = { 0x00,0x00,0x00,0x00 };
  byte_t at[4]              = { 0x00,0x00,0x00,0x00 };
  byte_t abtAuth2[4]        = { 0x00,0x00,0x00,0x00 };
  byte_t abtArEnc2[4]       = { 0x00,0x00,0x00,0x00 };
  byte_t abtArEncPar2[4]    = { 0x00,0x00,0x00,0x00 };
  byte_t abtArEnc[8]       = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
  byte_t abtArEncPar[8]    = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
  byte_t abtRx[MAX_FRAME_LEN];
  byte_t abtRxPar[MAX_FRAME_LEN];
  uint32_t uiRxLen;
  byte_t nr[4]        = { 0xef,0xea,0x1c,0xda };


  //configure if KeyA or KeyB:
  if (*KeyTyp1 == 'a' || *KeyTyp1 == 'A')
  {
    abtAuth[0] = 0x60;
  } else {
    abtAuth[0] = 0x61;
  }
  
  // Configure the authentication frame using the supplied block 
  abtAuth[1] = uiBlock1;
  append_iso14443a_crc(abtAuth,2);

  //print Auth Block:
  printf(" Auth: ");
  print_hex(abtAuth,4);

  // Now we take over, first we need full control over the CRC
  nfc_configure(pdi,DCO_HANDLE_CRC,false);


  // Request plain tag-nonce
  printf(" Nt: ");
  if (!nfc_initiator_transceive_bytes(pdi,abtAuth,4,abtRx,&uiRxLen)) return false;
  print_hex(abtRx,4);
  
  // Save the tag nonce (nt)
  nt = swap_endian32(abtRx);

  // Init cipher with key
  pcs = crypto1_create(ui64Key);

  // Load (plain) uid^nt into the cipher
  for (pos=0; pos<4; pos++)
  {
    // Update the cipher with the tag-initialization 
    crypto1_byte(pcs,pbtUid[pos]^abtRx[pos],0);
  }


  // Generate (encrypted) nr+parity by loading it into the cipher
  for (pos=0; pos<4; pos++)
  {
    // Load in, and encrypt, the reader nonce (plain nr=0x00000000)
    abtArEnc[pos] = crypto1_byte(pcs,0x00,0) ^ 0x00;
    // Encrypt the parity bits for the 4 plaintext bytes of nr
    abtArEncPar[pos] = filter(pcs->odd) ^ oddparity(0x00);
  }
  
  // Skip 32 bits in pseudo random generator
  nt = prng_successor(nt,32);
  
  // Generate reader-answer from tag-nonce
  for (pos=4; pos<8; pos++)
  {
    // Get the next random byte for verify the reader to the tag 
    nt = prng_successor(nt,8);

    // Encrypt the reader-answer (nt' = suc2(nt))
    abtArEnc[pos] = crypto1_byte(pcs,0x00,0) ^ (nt&0xff);
    // Encrypt the parity bits for the 4 plaintext bytes of nt'
    abtArEncPar[pos] = filter(pcs->odd) ^ oddparity(nt&0xff);
  }

  // Finally we want to send arbitrary parity bits
  nfc_configure(pdi,DCO_HANDLE_PARITY,false);

  // Transmit reader-answer
  printf(" [Nr + Nt']: ");
  print_hex_par(abtArEnc,64,abtArEncPar);
  if (!nfc_initiator_transceive_bits(pdi,abtArEnc,64,abtArEncPar,abtRx,&uiRxLen,abtRxPar)) return false;
  printf(" [Nt'']: "); 
  print_hex_par(abtRx,uiRxLen,abtRxPar);

  //decrypt tag answer:
  for (pos=0; pos<4; pos++)
  {  
    at[pos] = crypto1_byte(pcs,0x00,0) ^ abtRx[pos];
  }
  printf(" Nt'': ");
  print_hex(at,4);


  //---------------------------------------------------------------------------------------------------
  //do encrypted second auth

  //configure if KeyA or KeyB:
  if (*KeyTyp2 == 'a' || *KeyTyp2 == 'A')
  {
    abtAuth2[0] = 0x60;
  } else {
    abtAuth2[0] = 0x61;
  }
  
  // Configure the authentication frame using the supplied block 
  abtAuth2[1] = uiBlock2;
  append_iso14443a_crc(abtAuth2,2);

  //encrypt second request:
  for (pos=0; pos<4; pos++)
  {
    abtArEnc2[pos] = crypto1_byte(pcs,0x00,0) ^ abtAuth2[pos];
    abtArEncPar2[pos] = filter(pcs->odd) ^ oddparity(abtAuth2[pos]);
  }

  //print Auth Block:
  printf("\n Second auth: ");
  print_hex(abtAuth2,4);

  printf(" [Second auth]: "); 
  print_hex_par(abtArEnc2,32,abtArEncPar2);

  // Request enc tag-nonce
  printf(" [Nt]: ");
  if (!nfc_initiator_transceive_bits(pdi,abtArEnc2,32,abtArEncPar2,abtRx,&uiRxLen,abtRxPar)) return false; 
  print_hex_par(abtRx,32,abtRxPar);

  crypto1_destroy(pcs);

  return true;
}

guepardo crapto1 # gcc -o crypto1test crypto1test.c crypto1.c crapto1.h -I/usr/local/include/libnfc -L/usr/local/lib/ -lnfc
crypto1test.c: In function ‘main’:
crypto1test.c:101: error: too many arguments to function ‘nfc_connect’
guepardo crapto1 #