libnfc  1.7.0-rc7
nfc-mfclassic.c
Go to the documentation of this file.
1 /*-
2  * Free/Libre Near Field Communication (NFC) library
3  *
4  * Libnfc historical contributors:
5  * Copyright (C) 2009 Roel Verdult
6  * Copyright (C) 2009-2013 Romuald Conty
7  * Copyright (C) 2010-2012 Romain Tartière
8  * Copyright (C) 2010-2013 Philippe Teuwen
9  * Copyright (C) 2012-2013 Ludovic Rousseau
10  * Additional contributors of this file:
11  * Copyright (C) 2011 Adam Laurie
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions are met:
15  * 1) Redistributions of source code must retain the above copyright notice,
16  * this list of conditions and the following disclaimer.
17  * 2 )Redistributions in binary form must reproduce the above copyright
18  * notice, this list of conditions and the following disclaimer in the
19  * documentation and/or other materials provided with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
22  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
25  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31  * POSSIBILITY OF SUCH DAMAGE.
32  *
33  * Note that this license only applies on the examples, NFC library itself is under LGPL
34  *
35  */
36 
42 #ifdef HAVE_CONFIG_H
43 # include "config.h"
44 #endif // HAVE_CONFIG_H
45 
46 #include <stdio.h>
47 #include <stdlib.h>
48 #include <stdint.h>
49 #include <stddef.h>
50 #include <stdbool.h>
51 
52 #include <string.h>
53 #include <ctype.h>
54 
55 #include <nfc/nfc.h>
56 
57 #include "mifare.h"
58 #include "nfc-utils.h"
59 
60 static nfc_context *context;
61 static nfc_device *pnd;
62 static nfc_target nt;
63 static mifare_param mp;
64 static mifare_classic_tag mtKeys;
65 static mifare_classic_tag mtDump;
66 static bool bUseKeyA;
67 static bool bUseKeyFile;
68 static bool bForceKeyFile;
69 static bool bTolerateFailures;
70 static bool magic2 = false;
71 static uint8_t uiBlocks;
72 static uint8_t keys[] = {
73  0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
74  0xd3, 0xf7, 0xd3, 0xf7, 0xd3, 0xf7,
75  0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5,
76  0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5,
77  0x4d, 0x3a, 0x99, 0xc3, 0x51, 0xdd,
78  0x1a, 0x98, 0x2c, 0x7e, 0x45, 0x9a,
79  0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
80  0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
81  0xab, 0xcd, 0xef, 0x12, 0x34, 0x56
82 };
83 
84 static const nfc_modulation nmMifare = {
85  .nmt = NMT_ISO14443A,
86  .nbr = NBR_106,
87 };
88 
89 static size_t num_keys = sizeof(keys) / 6;
90 
91 #define MAX_FRAME_LEN 264
92 
93 static uint8_t abtRx[MAX_FRAME_LEN];
94 static int szRxBits;
95 
96 uint8_t abtHalt[4] = { 0x50, 0x00, 0x00, 0x00 };
97 
98 // special unlock command
99 uint8_t abtUnlock1[1] = { 0x40 };
100 uint8_t abtUnlock2[1] = { 0x43 };
101 
102 static bool
103 transmit_bits(const uint8_t *pbtTx, const size_t szTxBits)
104 {
105  // Show transmitted command
106  printf("Sent bits: ");
107  print_hex_bits(pbtTx, szTxBits);
108  // Transmit the bit frame command, we don't use the arbitrary parity feature
109  if ((szRxBits = nfc_initiator_transceive_bits(pnd, pbtTx, szTxBits, NULL, abtRx, sizeof(abtRx), NULL)) < 0)
110  return false;
111 
112  // Show received answer
113  printf("Received bits: ");
114  print_hex_bits(abtRx, szRxBits);
115  // Succesful transfer
116  return true;
117 }
118 
119 
120 static bool
121 transmit_bytes(const uint8_t *pbtTx, const size_t szTx)
122 {
123  // Show transmitted command
124  printf("Sent bits: ");
125  print_hex(pbtTx, szTx);
126  // Transmit the command bytes
127  int res;
128  if ((res = nfc_initiator_transceive_bytes(pnd, pbtTx, szTx, abtRx, sizeof(abtRx), 0)) < 0)
129  return false;
130 
131  // Show received answer
132  printf("Received bits: ");
133  print_hex(abtRx, res);
134  // Succesful transfer
135  return true;
136 }
137 
138 static void
139 print_success_or_failure(bool bFailure, uint32_t *uiBlockCounter)
140 {
141  printf("%c", (bFailure) ? 'x' : '.');
142  if (uiBlockCounter && !bFailure)
143  *uiBlockCounter += 1;
144 }
145 
146 static bool
147 is_first_block(uint32_t uiBlock)
148 {
149  // Test if we are in the small or big sectors
150  if (uiBlock < 128)
151  return ((uiBlock) % 4 == 0);
152  else
153  return ((uiBlock) % 16 == 0);
154 }
155 
156 static bool
157 is_trailer_block(uint32_t uiBlock)
158 {
159  // Test if we are in the small or big sectors
160  if (uiBlock < 128)
161  return ((uiBlock + 1) % 4 == 0);
162  else
163  return ((uiBlock + 1) % 16 == 0);
164 }
165 
166 static uint32_t
167 get_trailer_block(uint32_t uiFirstBlock)
168 {
169  // Test if we are in the small or big sectors
170  uint32_t trailer_block = 0;
171  if (uiFirstBlock < 128) {
172  trailer_block = uiFirstBlock + (3 - (uiFirstBlock % 4));
173  } else {
174  trailer_block = uiFirstBlock + (15 - (uiFirstBlock % 16));
175  }
176  return trailer_block;
177 }
178 
179 static bool
180 authenticate(uint32_t uiBlock)
181 {
182  mifare_cmd mc;
183  uint32_t uiTrailerBlock;
184 
185  // Set the authentication information (uid)
186  memcpy(mp.mpa.abtAuthUid, nt.nti.nai.abtUid + nt.nti.nai.szUidLen - 4, 4);
187 
188  // Should we use key A or B?
189  mc = (bUseKeyA) ? MC_AUTH_A : MC_AUTH_B;
190 
191  // Key file authentication.
192  if (bUseKeyFile) {
193 
194  // Locate the trailer (with the keys) used for this sector
195  uiTrailerBlock = get_trailer_block(uiBlock);
196 
197  // Extract the right key from dump file
198  if (bUseKeyA)
199  memcpy(mp.mpa.abtKey, mtKeys.amb[uiTrailerBlock].mbt.abtKeyA, 6);
200  else
201  memcpy(mp.mpa.abtKey, mtKeys.amb[uiTrailerBlock].mbt.abtKeyB, 6);
202 
203  // Try to authenticate for the current sector
204  if (nfc_initiator_mifare_cmd(pnd, mc, uiBlock, &mp))
205  return true;
206  } else {
207  // Try to guess the right key
208  for (size_t key_index = 0; key_index < num_keys; key_index++) {
209  memcpy(mp.mpa.abtKey, keys + (key_index * 6), 6);
210  if (nfc_initiator_mifare_cmd(pnd, mc, uiBlock, &mp)) {
211  if (bUseKeyA)
212  memcpy(mtKeys.amb[uiBlock].mbt.abtKeyA, &mp.mpa.abtKey, 6);
213  else
214  memcpy(mtKeys.amb[uiBlock].mbt.abtKeyB, &mp.mpa.abtKey, 6);
215  return true;
216  }
217  nfc_initiator_select_passive_target(pnd, nmMifare, nt.nti.nai.abtUid, nt.nti.nai.szUidLen, NULL);
218  }
219  }
220 
221  return false;
222 }
223 
224 static bool
225 unlock_card(void)
226 {
227  if (magic2) {
228  printf("Don't use R/W with this card, this is not required!\n");
229  return false;
230  }
231 
232  // Configure the CRC
233  if (nfc_device_set_property_bool(pnd, NP_HANDLE_CRC, false) < 0) {
234  nfc_perror(pnd, "nfc_configure");
235  return false;
236  }
237  // Use raw send/receive methods
238  if (nfc_device_set_property_bool(pnd, NP_EASY_FRAMING, false) < 0) {
239  nfc_perror(pnd, "nfc_configure");
240  return false;
241  }
242 
243  iso14443a_crc_append(abtHalt, 2);
244  transmit_bytes(abtHalt, 4);
245  // now send unlock
246  if (!transmit_bits(abtUnlock1, 7)) {
247  printf("unlock failure!\n");
248  return false;
249  }
250  if (!transmit_bytes(abtUnlock2, 1)) {
251  printf("unlock failure!\n");
252  return false;
253  }
254 
255  // reset reader
256  // Configure the CRC
257  if (nfc_device_set_property_bool(pnd, NP_HANDLE_CRC, true) < 0) {
258  nfc_perror(pnd, "nfc_device_set_property_bool");
259  return false;
260  }
261  // Switch off raw send/receive methods
262  if (nfc_device_set_property_bool(pnd, NP_EASY_FRAMING, true) < 0) {
263  nfc_perror(pnd, "nfc_device_set_property_bool");
264  return false;
265  }
266  return true;
267 }
268 
269 static int
270 get_rats(void)
271 {
272  int res;
273  uint8_t abtRats[2] = { 0xe0, 0x50};
274  // Use raw send/receive methods
275  if (nfc_device_set_property_bool(pnd, NP_EASY_FRAMING, false) < 0) {
276  nfc_perror(pnd, "nfc_configure");
277  return -1;
278  }
279  res = nfc_initiator_transceive_bytes(pnd, abtRats, sizeof(abtRats), abtRx, sizeof(abtRx), 0);
280  if (res > 0) {
281  // ISO14443-4 card, turn RF field off/on to access ISO14443-3 again
284  }
285  // Reselect tag
286  if (nfc_initiator_select_passive_target(pnd, nmMifare, NULL, 0, &nt) <= 0) {
287  printf("Error: tag disappeared\n");
288  nfc_close(pnd);
289  nfc_exit(context);
290  exit(EXIT_FAILURE);
291  }
292  return res;
293 }
294 
295 static bool
296 read_card(int read_unlocked)
297 {
298  int32_t iBlock;
299  bool bFailure = false;
300  uint32_t uiReadBlocks = 0;
301 
302  if (read_unlocked)
303  if (!unlock_card())
304  return false;
305 
306  printf("Reading out %d blocks |", uiBlocks + 1);
307  // Read the card from end to begin
308  for (iBlock = uiBlocks; iBlock >= 0; iBlock--) {
309  // Authenticate everytime we reach a trailer block
310  if (is_trailer_block(iBlock)) {
311  if (bFailure) {
312  // When a failure occured we need to redo the anti-collision
313  if (nfc_initiator_select_passive_target(pnd, nmMifare, NULL, 0, &nt) <= 0) {
314  printf("!\nError: tag was removed\n");
315  return false;
316  }
317  bFailure = false;
318  }
319 
320  fflush(stdout);
321 
322  // Try to authenticate for the current sector
323  if (!read_unlocked && !authenticate(iBlock)) {
324  printf("!\nError: authentication failed for block 0x%02x\n", iBlock);
325  return false;
326  }
327  // Try to read out the trailer
328  if (nfc_initiator_mifare_cmd(pnd, MC_READ, iBlock, &mp)) {
329  if (read_unlocked) {
330  memcpy(mtDump.amb[iBlock].mbd.abtData, mp.mpd.abtData, 16);
331  } else {
332  // Copy the keys over from our key dump and store the retrieved access bits
333  memcpy(mtDump.amb[iBlock].mbt.abtKeyA, mtKeys.amb[iBlock].mbt.abtKeyA, 6);
334  memcpy(mtDump.amb[iBlock].mbt.abtAccessBits, mp.mpd.abtData + 6, 4);
335  memcpy(mtDump.amb[iBlock].mbt.abtKeyB, mtKeys.amb[iBlock].mbt.abtKeyB, 6);
336  }
337  } else {
338  printf("!\nfailed to read trailer block 0x%02x\n", iBlock);
339  bFailure = true;
340  }
341  } else {
342  // Make sure a earlier readout did not fail
343  if (!bFailure) {
344  // Try to read out the data block
345  if (nfc_initiator_mifare_cmd(pnd, MC_READ, iBlock, &mp)) {
346  memcpy(mtDump.amb[iBlock].mbd.abtData, mp.mpd.abtData, 16);
347  } else {
348  printf("!\nError: unable to read block 0x%02x\n", iBlock);
349  bFailure = true;
350  }
351  }
352  }
353  // Show if the readout went well for each block
354  print_success_or_failure(bFailure, &uiReadBlocks);
355  if ((! bTolerateFailures) && bFailure)
356  return false;
357  }
358  printf("|\n");
359  printf("Done, %d of %d blocks read.\n", uiReadBlocks, uiBlocks + 1);
360  fflush(stdout);
361 
362  return true;
363 }
364 
365 static bool
366 write_card(int write_block_zero)
367 {
368  uint32_t uiBlock;
369  bool bFailure = false;
370  uint32_t uiWriteBlocks = 0;
371 
372  if (write_block_zero)
373  if (!unlock_card())
374  return false;
375 
376  printf("Writing %d blocks |", uiBlocks + 1);
377  // Write the card from begin to end;
378  for (uiBlock = 0; uiBlock <= uiBlocks; uiBlock++) {
379  // Authenticate everytime we reach the first sector of a new block
380  if (is_first_block(uiBlock)) {
381  if (bFailure) {
382  // When a failure occured we need to redo the anti-collision
383  if (nfc_initiator_select_passive_target(pnd, nmMifare, NULL, 0, &nt) <= 0) {
384  printf("!\nError: tag was removed\n");
385  return false;
386  }
387  bFailure = false;
388  }
389 
390  fflush(stdout);
391 
392  // Try to authenticate for the current sector
393  if (!write_block_zero && !authenticate(uiBlock)) {
394  printf("!\nError: authentication failed for block %02x\n", uiBlock);
395  return false;
396  }
397  }
398 
399  if (is_trailer_block(uiBlock)) {
400  // Copy the keys over from our key dump and store the retrieved access bits
401  memcpy(mp.mpd.abtData, mtDump.amb[uiBlock].mbt.abtKeyA, 6);
402  memcpy(mp.mpd.abtData + 6, mtDump.amb[uiBlock].mbt.abtAccessBits, 4);
403  memcpy(mp.mpd.abtData + 10, mtDump.amb[uiBlock].mbt.abtKeyB, 6);
404 
405  // Try to write the trailer
406  if (nfc_initiator_mifare_cmd(pnd, MC_WRITE, uiBlock, &mp) == false) {
407  printf("failed to write trailer block %d \n", uiBlock);
408  bFailure = true;
409  }
410  } else {
411  // The first block 0x00 is read only, skip this
412  if (uiBlock == 0 && ! write_block_zero && ! magic2)
413  continue;
414 
415 
416  // Make sure a earlier write did not fail
417  if (!bFailure) {
418  // Try to write the data block
419  memcpy(mp.mpd.abtData, mtDump.amb[uiBlock].mbd.abtData, 16);
420  // do not write a block 0 with incorrect BCC - card will be made invalid!
421  if (uiBlock == 0) {
422  if ((mp.mpd.abtData[0] ^ mp.mpd.abtData[1] ^ mp.mpd.abtData[2] ^ mp.mpd.abtData[3] ^ mp.mpd.abtData[4]) != 0x00 && !magic2) {
423  printf("!\nError: incorrect BCC in MFD file!\n");
424  printf("Expecting BCC=%02X\n", mp.mpd.abtData[0] ^ mp.mpd.abtData[1] ^ mp.mpd.abtData[2] ^ mp.mpd.abtData[3]);
425  return false;
426  }
427  }
428  if (!nfc_initiator_mifare_cmd(pnd, MC_WRITE, uiBlock, &mp))
429  bFailure = true;
430  }
431  }
432  // Show if the write went well for each block
433  print_success_or_failure(bFailure, &uiWriteBlocks);
434  if ((! bTolerateFailures) && bFailure)
435  return false;
436  }
437  printf("|\n");
438  printf("Done, %d of %d blocks written.\n", uiWriteBlocks, uiBlocks + 1);
439  fflush(stdout);
440 
441  return true;
442 }
443 
444 typedef enum {
445  ACTION_READ,
446  ACTION_WRITE,
447  ACTION_USAGE
448 } action_t;
449 
450 static void
451 print_usage(const char *pcProgramName)
452 {
453  printf("Usage: ");
454  printf("%s r|R|w|W a|b <dump.mfd> [<keys.mfd> [f]]\n", pcProgramName);
455  printf(" r|R|w|W - Perform read from (r) or unlocked read from (R) or write to (w) or unlocked write to (W) card\n");
456  printf(" *** note that unlocked write will attempt to overwrite block 0 including UID\n");
457  printf(" *** unlocked read does not require authentication and will reveal A and B keys\n");
458  printf(" *** unlocking only works with special Mifare 1K cards (Chinese clones)\n");
459  printf(" a|A|b|B - Use A or B keys for action; Halt on errors (a|b) or tolerate errors (A|B)\n");
460  printf(" <dump.mfd> - MiFare Dump (MFD) used to write (card to MFD) or (MFD to card)\n");
461  printf(" <keys.mfd> - MiFare Dump (MFD) that contain the keys (optional)\n");
462  printf(" f - Force using the keyfile even if UID does not match (optional)\n");
463 }
464 
465 int
466 main(int argc, const char *argv[])
467 {
468  action_t atAction = ACTION_USAGE;
469  uint8_t *pbtUID;
470  int unlock = 0;
471 
472  if (argc < 2) {
473  print_usage(argv[0]);
474  exit(EXIT_FAILURE);
475  }
476  const char *command = argv[1];
477 
478  if (strcmp(command, "r") == 0 || strcmp(command, "R") == 0) {
479  if (argc < 4) {
480  print_usage(argv[0]);
481  exit(EXIT_FAILURE);
482  }
483  atAction = ACTION_READ;
484  if (strcmp(command, "R") == 0)
485  unlock = 1;
486  bUseKeyA = tolower((int)((unsigned char) * (argv[2]))) == 'a';
487  bTolerateFailures = tolower((int)((unsigned char) * (argv[2]))) != (int)((unsigned char) * (argv[2]));
488  bUseKeyFile = (argc > 4);
489  } else if (strcmp(command, "w") == 0 || strcmp(command, "W") == 0) {
490  if (argc < 4) {
491  print_usage(argv[0]);
492  exit(EXIT_FAILURE);
493  }
494  atAction = ACTION_WRITE;
495  if (strcmp(command, "W") == 0)
496  unlock = 1;
497  bUseKeyA = tolower((int)((unsigned char) * (argv[2]))) == 'a';
498  bTolerateFailures = tolower((int)((unsigned char) * (argv[2]))) != (int)((unsigned char) * (argv[2]));
499  bUseKeyFile = (argc > 4);
500  bForceKeyFile = ((argc > 5) && (strcmp((char *)argv[5], "f") == 0));
501  }
502 
503  if (atAction == ACTION_USAGE) {
504  print_usage(argv[0]);
505  exit(EXIT_FAILURE);
506  }
507  // We don't know yet the card size so let's read only the UID from the keyfile for the moment
508  if (bUseKeyFile) {
509  FILE *pfKeys = fopen(argv[4], "rb");
510  if (pfKeys == NULL) {
511  printf("Could not open keys file: %s\n", argv[4]);
512  exit(EXIT_FAILURE);
513  }
514  if (fread(&mtKeys, 1, 4, pfKeys) != 4) {
515  printf("Could not read UID from key file: %s\n", argv[4]);
516  fclose(pfKeys);
517  exit(EXIT_FAILURE);
518  }
519  fclose(pfKeys);
520  }
521  nfc_init(&context);
522  if (context == NULL) {
523  ERR("Unable to init libnfc (malloc)");
524  exit(EXIT_FAILURE);
525  }
526 
527 // Try to open the NFC reader
528  pnd = nfc_open(context, NULL);
529  if (pnd == NULL) {
530  ERR("Error opening NFC reader");
531  nfc_exit(context);
532  exit(EXIT_FAILURE);
533  }
534 
535  if (nfc_initiator_init(pnd) < 0) {
536  nfc_perror(pnd, "nfc_initiator_init");
537  nfc_close(pnd);
538  nfc_exit(context);
539  exit(EXIT_FAILURE);
540  };
541 
542 // Let the reader only try once to find a tag
543  if (nfc_device_set_property_bool(pnd, NP_INFINITE_SELECT, false) < 0) {
544  nfc_perror(pnd, "nfc_device_set_property_bool");
545  nfc_close(pnd);
546  nfc_exit(context);
547  exit(EXIT_FAILURE);
548  }
549 // Disable ISO14443-4 switching in order to read devices that emulate Mifare Classic with ISO14443-4 compliance.
551 
552  printf("NFC reader: %s opened\n", nfc_device_get_name(pnd));
553 
554 // Try to find a MIFARE Classic tag
555  if (nfc_initiator_select_passive_target(pnd, nmMifare, NULL, 0, &nt) <= 0) {
556  printf("Error: no tag was found\n");
557  nfc_close(pnd);
558  nfc_exit(context);
559  exit(EXIT_FAILURE);
560  }
561 // Test if we are dealing with a MIFARE compatible tag
562  if ((nt.nti.nai.btSak & 0x08) == 0) {
563  printf("Warning: tag is probably not a MFC!\n");
564  }
565 
566 // Get the info from the current tag
567  pbtUID = nt.nti.nai.abtUid;
568 
569  if (bUseKeyFile) {
570  uint8_t fileUid[4];
571  memcpy(fileUid, mtKeys.amb[0].mbm.abtUID, 4);
572 // Compare if key dump UID is the same as the current tag UID, at least for the first 4 bytes
573  if (memcmp(pbtUID, fileUid, 4) != 0) {
574  printf("Expected MIFARE Classic card with UID starting as: %02x%02x%02x%02x\n",
575  fileUid[0], fileUid[1], fileUid[2], fileUid[3]);
576  printf("Got card with UID starting as: %02x%02x%02x%02x\n",
577  pbtUID[0], pbtUID[1], pbtUID[2], pbtUID[3]);
578  if (! bForceKeyFile) {
579  printf("Aborting!\n");
580  nfc_close(pnd);
581  nfc_exit(context);
582  exit(EXIT_FAILURE);
583  }
584  }
585  }
586  printf("Found MIFARE Classic card:\n");
587  print_nfc_target(&nt, false);
588 
589 // Guessing size
590  if ((nt.nti.nai.abtAtqa[1] & 0x02) == 0x02)
591 // 4K
592  uiBlocks = 0xff;
593  else if ((nt.nti.nai.btSak & 0x01) == 0x01)
594 // 320b
595  uiBlocks = 0x13;
596  else
597 // 1K/2K, checked through RATS
598  uiBlocks = 0x3f;
599 // Testing RATS
600  int res;
601  if ((res = get_rats()) > 0) {
602  if ((res >= 10) && (abtRx[5] == 0xc1) && (abtRx[6] == 0x05)
603  && (abtRx[7] == 0x2f) && (abtRx[8] == 0x2f)
604  && ((nt.nti.nai.abtAtqa[1] & 0x02) == 0x00)) {
605  // MIFARE Plus 2K
606  uiBlocks = 0x7f;
607  }
608  // Chinese magic emulation card, ATS=0978009102:dabc1910
609  if ((res == 9) && (abtRx[5] == 0xda) && (abtRx[6] == 0xbc)
610  && (abtRx[7] == 0x19) && (abtRx[8] == 0x10)) {
611  magic2 = true;
612  }
613  }
614  printf("Guessing size: seems to be a %i-byte card\n", (uiBlocks + 1) * 16);
615 
616  if (bUseKeyFile) {
617  FILE *pfKeys = fopen(argv[4], "rb");
618  if (pfKeys == NULL) {
619  printf("Could not open keys file: %s\n", argv[4]);
620  exit(EXIT_FAILURE);
621  }
622  if (fread(&mtKeys, 1, (uiBlocks + 1) * sizeof(mifare_classic_block), pfKeys) != (uiBlocks + 1) * sizeof(mifare_classic_block)) {
623  printf("Could not read keys file: %s\n", argv[4]);
624  fclose(pfKeys);
625  exit(EXIT_FAILURE);
626  }
627  fclose(pfKeys);
628  }
629 
630  if (atAction == ACTION_READ) {
631  memset(&mtDump, 0x00, sizeof(mtDump));
632  } else {
633  FILE *pfDump = fopen(argv[3], "rb");
634 
635  if (pfDump == NULL) {
636  printf("Could not open dump file: %s\n", argv[3]);
637  exit(EXIT_FAILURE);
638 
639  }
640 
641  if (fread(&mtDump, 1, (uiBlocks + 1) * sizeof(mifare_classic_block), pfDump) != (uiBlocks + 1) * sizeof(mifare_classic_block)) {
642  printf("Could not read dump file: %s\n", argv[3]);
643  fclose(pfDump);
644  exit(EXIT_FAILURE);
645  }
646  fclose(pfDump);
647  }
648 // printf("Successfully opened required files\n");
649 
650  if (atAction == ACTION_READ) {
651  if (read_card(unlock)) {
652  printf("Writing data to file: %s ...", argv[3]);
653  fflush(stdout);
654  FILE *pfDump = fopen(argv[3], "wb");
655  if (pfDump == NULL) {
656  printf("Could not open dump file: %s\n", argv[3]);
657  nfc_close(pnd);
658  nfc_exit(context);
659  exit(EXIT_FAILURE);
660  }
661  if (fwrite(&mtDump, 1, (uiBlocks + 1) * sizeof(mifare_classic_block), pfDump) != ((uiBlocks + 1) * sizeof(mifare_classic_block))) {
662  printf("\nCould not write to file: %s\n", argv[3]);
663  fclose(pfDump);
664  nfc_close(pnd);
665  nfc_exit(context);
666  exit(EXIT_FAILURE);
667  }
668  printf("Done.\n");
669  fclose(pfDump);
670  }
671  } else if (atAction == ACTION_WRITE) {
672  write_card(unlock);
673  }
674 
675  nfc_close(pnd);
676  nfc_exit(context);
677  exit(EXIT_SUCCESS);
678 }