3 #include "cscrypt/bn.h"
4 #include "reader-common.h"
5 #include "cscrypt/des.h"
7 static int32_t CWPK_CNX(struct s_reader
*reader
,uint8_t *msg
)
34 des_ecb3_decrypt(CWp1
,reader
->cwpk_mod
);
35 des_ecb3_decrypt(CWp2
,reader
->cwpk_mod
);
55 if(((CWs1
[0] + CWs1
[1] + CWs1
[2]) & 0xFF) != CWs1
[3])
58 rdr_log(reader
, "CW0 checksum error [0]");
60 if(((CWs1
[4] + CWs1
[5] + CWs1
[6]) & 0xFF) != CWs1
[7])
63 rdr_log(reader
, "CW0 checksum error [1]");
65 if(((CWs2
[0] + CWs2
[1] + CWs2
[2]) & 0xFF) != CWs2
[3])
68 rdr_log(reader
, "CW1 checksum error [0]");
70 if(((CWs2
[4] + CWs2
[5] + CWs2
[6]) & 0xFF) != CWs2
[7])
73 rdr_log(reader
, "CW1 checksum error [1]");
78 memcpy(&msg
[7],CWs1
,0x08);
79 memcpy(&msg
[22],CWs2
,0x08);
91 static int32_t RSA_CNX(struct s_reader
*reader
, uint8_t *msg
, uint8_t *mod
, uint8_t *exp
, uint32_t cta_lr
, uint32_t modbytes
, uint32_t expbytes
)
94 uint32_t n
= 0, pre_size
= 0, size
= 0;
96 BIGNUM
*bn_mod
, *bn_exp
, *bn_data
, *bn_res
;
100 pre_size
= 2 + 4 + msg
[5];
102 /*size of data to decryption*/
103 if(msg
[1] > (pre_size
- 2))
104 { size
= msg
[1] - pre_size
+ 2; }
106 if(cta_lr
> (pre_size
+ size
) && size
>= modbytes
&& size
< 128)
112 rdr_log_dbg(reader
, D_READER
, "RSA Error in RSA_CNX");
116 bn_mod
= BN_CTX_get(ctx
);
117 bn_exp
= BN_CTX_get(ctx
);
118 bn_data
= BN_CTX_get(ctx
);
119 bn_res
= BN_CTX_get(ctx
);
122 BN_bin2bn(mod
, modbytes
, bn_mod
); // rsa modulus
123 BN_bin2bn(exp
, expbytes
, bn_exp
); // exponent
124 BN_bin2bn(msg
+ pre_size
, modbytes
, bn_data
);
125 BN_mod_exp(bn_res
, bn_data
, bn_exp
, bn_mod
, ctx
);
127 n
= BN_bn2bin(bn_res
, data
);
129 size
-= modbytes
; // 3
130 pre_size
+= modbytes
;
132 /*Check if second round is needed*/
135 /*check if length of data from first RSA round will be enough to padding rest of data*/
136 if((n
+ size
) >= modbytes
)
139 /*move the remaining data at the beginning of the buffer*/
140 memcpy(msg
, msg
+ pre_size
, size
);
141 /*padding buffer with data from first round*/
142 memcpy(msg
+ size
, data
+ (n
- (modbytes
- size
)), modbytes
- size
);
144 BN_bin2bn(msg
, modbytes
, bn_data
);
145 BN_mod_exp(bn_res
, bn_data
, bn_exp
, bn_mod
, ctx
);
146 n
= BN_bn2bin(bn_res
, data
);
148 { ret
= -1; } /*RSA key is probably wrong*/
151 { ret
= -3; } /*wrong size of data for second round*/
155 { memcpy(msg
, data
, n
); }
161 { ret
= -2; } /*wrong size of data*/
166 static time_t chid_date(const uint8_t *ptr
, char *buf
, int32_t l
)
170 memset(&timeinfo
, 0, sizeof(struct tm
));
174 timeinfo
.tm_year
= 90 + (ptr
[1] >> 4) + (((ptr
[0] >> 5) & 7) * 10);
175 timeinfo
.tm_mon
= (ptr
[1] & 0xf) - 1;
176 timeinfo
.tm_mday
= ptr
[0] & 0x1f;
177 timeinfo
.tm_isdst
= -1;
178 rc
= mktime(&timeinfo
);
179 strftime(buf
, l
, "%Y/%m/%d", &timeinfo
);
184 static int32_t read_record(struct s_reader
*reader
, const uint8_t *cmd
, const uint8_t *data
, uint8_t *cta_res
)
187 uint8_t insCA
[] = { 0xDD, 0xCA, 0x00, 0x00, 0x00 };
189 write_cmd(cmd
, data
); // select record
190 if(cta_res
[0] != 0x98)
193 insCA
[4] = cta_res
[1]; // get len
194 write_cmd(insCA
, NULL
); // read record
196 if((cta_res
[cta_lr
- 2] != 0x90) || (cta_res
[cta_lr
- 1]))
202 static int32_t check_pairing(struct s_reader
*reader
, const uint8_t *cmd
, const uint8_t *data
, uint8_t *cta_res
)
206 if(reader
->cwpk_mod_length
)
208 write_cmd(cmd
, data
);
209 rdr_log(reader
, "CWPK Pairing is active");
211 else if(reader
->rsa_mod_length
)
213 rdr_log(reader
, "RSA Pairing is active");
217 rdr_log(reader
, "Pairing is not active");
222 static uint8_t PairingECMRotation(struct s_reader
*reader
, const ECM_REQUEST
*er
, int32_t n
)
224 uint8_t cta_res
[CTA_RES_LEN
] = { 0x00 };
225 uint8_t ins26
[] = { 0xDD, 0x26, 0x00, 0x00, 0x03, 0x10, 0x01, 0x00 };
226 uint8_t cnxcurrecm
= 0;
228 if(0x0 != reader
->rsa_mod
[0] && n
> 3 &&
229 0x54 == er
->ecm
[n
- 3] &&
230 0x02 == er
->ecm
[n
- 2] &&
231 0x00 == er
->ecm
[n
- 1])
236 if((0 == reader
->cnxlastecm
) != (0 == cnxcurrecm
))
238 if(0 == cnxcurrecm
) // not paired
243 if(read_record(reader
, ins26
, ins26
+ 5, cta_res
) <= 0)
244 { rdr_log(reader
, "PairingECMRotation - ERROR"); }
246 reader
->cnxlastecm
= cnxcurrecm
;
250 static int32_t conax_card_init(struct s_reader
*reader
, ATR
*newatr
)
252 uint8_t cta_res
[CTA_RES_LEN
];
254 static const uint8_t ins26
[] = { 0xDD, 0x26, 0x00, 0x00, 0x03, 0x10, 0x01, 0x40 };
255 static const uint8_t inscp
[] = { 0xDD, 0x26, 0x00, 0x00, 0x04, 0x6C, 0x02, 0x10,0x00 };
256 uint8_t ins82
[] = { 0xDD, 0x82, 0x00, 0x00, 0x11, 0x11, 0x0f, 0x01, 0xb0, 0x0f, 0xff,
257 0xff, 0xfb, 0x00, 0x00, 0x09, 0x04, 0x0b, 0x00, 0xe0, 0x30, 0x2b };
262 if((hist_size
< 4) || (memcmp(hist
, "0B00", 4)))
265 reader
->caid
= 0xB00;
267 if((n
= read_record(reader
, ins26
, ins26
+ 5, cta_res
)) <= 0) { return ERROR
; } // read caid, card-version
269 for(i
= 0; i
< n
; i
+= cta_res
[i
+ 1] + 2)
274 cardver
= cta_res
[i
+ 2];
278 reader
->caid
= (cta_res
[i
+ 2] << 8) | cta_res
[i
+ 3];
282 // Ins82 command needs to use the correct CAID reported in nano 0x28
283 ins82
[17] = (reader
->caid
>> 8) & 0xFF;
284 ins82
[18] = (reader
->caid
) & 0xFF;
286 if((n
= read_record(reader
, ins82
, ins82
+ 5, cta_res
)) <= 0) { return ERROR
; } // read serial
290 for(j
= 0, i
= 2; i
< n
; i
+= cta_res
[i
+ 1] + 2)
295 if(cta_res
[i
+ 5] != 0x00)
297 memcpy(reader
->hexserial
, &cta_res
[i
+ 3], 6);
301 memcpy(reader
->sa
[j
], &cta_res
[i
+ 5], 4);
309 memset(reader
->prid
, 0x00, sizeof(reader
->prid
));
311 rdr_log_sensitive(reader
, "type: Conax, caid: %04X, serial: {%llu}, hex serial: {%02x%02x%02x%02x}, card: v%d",
312 reader
->caid
, (unsigned long long) b2ll(6, reader
->hexserial
), reader
->hexserial
[2],
313 reader
->hexserial
[3], reader
->hexserial
[4], reader
->hexserial
[5], cardver
);
315 rdr_log(reader
, "Providers: %d", reader
->nprov
);
317 for(j
= 0; j
< reader
->nprov
; j
++)
319 rdr_log(reader
, "Provider: %d Provider-Id: %06X", j
+ 1, b2i(4, reader
->prid
[j
]));
320 rdr_log_sensitive(reader
, "Provider: %d SharedAddress: {%08X}", j
+ 1, b2i(4, reader
->sa
[j
]));
322 check_pairing(reader
, inscp
, inscp
+ 5, cta_res
);
327 static int32_t conax_send_pin(struct s_reader
*reader
)
330 uint8_t insPIN
[] = { 0xDD, 0xC8, 0x00, 0x00, 0x07, 0x1D, 0x05, 0x01, 0x00, 0x00, 0x00, 0x00 }; // Last four are the Pin-Code
331 memcpy(insPIN
+ 8, reader
->pincode
, 4);
333 write_cmd(insPIN
, insPIN
+ 5);
334 rdr_log_dbg(reader
, D_READER
, "Sent pincode to card.");
339 static int32_t conax_do_ecm(struct s_reader
*reader
, const ECM_REQUEST
*er
, struct s_ecm_answer
*ea
)
342 int32_t i
, j
, n
, num_dw
= 0, rc
= 0;
343 uint8_t insA2
[] = { 0xDD, 0xA2, 0x00, 0x00, 0x00 };
344 uint8_t insCA
[] = { 0xDD, 0xCA, 0x00, 0x00, 0x00 };
346 uint8_t exp
[] = { 0x01, 0x00, 0x01 };
351 if((n
= check_sct_len(er
->ecm
, 3)) < 0)
357 if(reader
->cwpk_mod_length
)
362 else if(0x0 != reader
->rsa_mod
[0])
364 if(0x0 != PairingECMRotation(reader
, er
, n
))
381 memcpy(buf
+ 3, er
->ecm
, n
);
384 write_cmd(insA2
, buf
); // write Header + ECM
386 while((cta_res
[cta_lr
- 2] == 0x98) && // Antwort
387 ((insCA
[4] = cta_res
[cta_lr
- 1]) > 0) && (insCA
[4] != 0xFF))
389 write_cmd(insCA
, NULL
); // Codeword auslesen
391 if((cta_res
[cta_lr
- 2] == 0x98) || ((cta_res
[cta_lr
- 2] == 0x90)))
393 /*checks if answer is encrypted with RSA algo and decrypts it if needed*/
394 if(0x81 == cta_res
[0] && 2 == cta_res
[2] >> 5 && 0x03 == ppp
) /*81 XX 5X*/
396 if(0x00 == cta_res
[cta_lr
- 1])
397 { rc
= RSA_CNX(reader
, cta_res
, reader
->rsa_mod
, exp
, cta_lr
, 64u, 3u); }
399 { rc
= -4; } /*card has no right to decode this channel*/
403 if(0x00 == cta_res
[cta_lr
- 1])
405 /*trying to decode using CWPK*/
406 rc
= CWPK_CNX(reader
, cta_res
); /*enabled when no loging needed*/
416 for(i
= 0; i
< cta_lr
- 2 && num_dw
< 2; i
+= cta_res
[i
+ 1] + 2)
421 if((cta_res
[i
+ 1] >= 0xD) && !((n
= cta_res
[i
+ 4]) & 0xFE))
424 memcpy(ea
->cw
+ (n
<< 3), cta_res
+ i
+ 7, 8);
430 if((cta_res
[i
+ 1] == 0x02 && cta_res
[i
+ 2] == 0x00 && cta_res
[i
+ 3] == 0x00) || \
431 (cta_res
[i
+ 1] == 0x02 && cta_res
[i
+ 2] == 0x40 && cta_res
[i
+ 3] == 0x00))
433 else if(strcmp(reader
->pincode
, "none"))
435 conax_send_pin(reader
);
436 write_cmd(insA2
, buf
); // write Header + ECM
438 while((cta_res
[cta_lr
- 2] == 0x98) && // Antwort
439 ((insCA
[4] = cta_res
[cta_lr
- 1]) > 0) && (insCA
[4] != 0xFF))
441 write_cmd(insCA
, NULL
); // Codeword auslesen
443 if((cta_res
[cta_lr
- 2] == 0x98) ||
444 ((cta_res
[cta_lr
- 2] == 0x90) && (!cta_res
[cta_lr
- 1])))
446 for(j
= 0; j
< cta_lr
- 2; j
+= cta_res
[j
+ 1] + 2)
448 if((cta_res
[j
] == 0x25) && // access: is cw
449 (cta_res
[j
+ 1] >= 0xD) && // 0xD: 5 header + 8 cw
450 !((n
= cta_res
[j
+ 4]) & 0xFE)) // cw idx must be 0 or 1
453 memcpy(ea
->cw
+ (n
<< 3), cta_res
+ j
+ 7, 8);
470 rdr_log(reader
, "conax decode ECM problem - RSA key is probably faulty");
474 rdr_log(reader
, "conax RSA pairing - wrong size of data");
478 rdr_log(reader
, "conax RSA pairing- wrong size of data for second round");
482 rdr_log(reader
, "card has no right to decode this channel");
486 rdr_log(reader
, "CWPK is faulty");
490 /* answer 9011 - conax smart card need reset */
491 if(2 <= cta_lr
&& 0x90 == cta_res
[cta_lr
- 2] && 0x11 == cta_res
[cta_lr
- 1])
493 rdr_log(reader
, "conax card hangs - reset is required");
494 reader
->card_status
= UNKNOWN
;
503 static int32_t conax_get_emm_type(EMM_PACKET
*ep
, struct s_reader
*rdr
)
508 rdr_log_dbg(rdr
, D_EMM
, "Entered conax_get_emm_type ep->emm[2]=%02x", ep
->emm
[2]);
510 for(i
= 0; i
< rdr
->nprov
; i
++)
512 ok
= (!memcmp(&ep
->emm
[6], rdr
->sa
[i
], 4));
519 memset(ep
->hexserial
, 0, 8);
520 memcpy(ep
->hexserial
, &ep
->emm
[6], 4);
521 rdr_log_dbg_sensitive(rdr
, D_EMM
, "SHARED, ep->hexserial = {%s}",
522 cs_hexdump(1, ep
->hexserial
, 8, tmp_dbg
, sizeof(tmp_dbg
)));
527 if(!memcmp(&ep
->emm
[6], rdr
->hexserial
+ 2, 4))
530 memset(ep
->hexserial
, 0, 8);
531 memcpy(ep
->hexserial
+ 2, &ep
->emm
[6], 4);
532 rdr_log_dbg_sensitive(rdr
, D_EMM
, "UNIQUE, ep->hexserial = {%s}",
533 cs_hexdump(1, ep
->hexserial
, 8, tmp_dbg
, sizeof(tmp_dbg
)));
539 rdr_log_dbg(rdr
, D_EMM
, "GLOBAL");
540 memset(ep
->hexserial
, 0, 8);
546 static int32_t conax_get_emm_filter(struct s_reader
*rdr
, struct s_csystem_emm_filter
**emm_filters
, unsigned int *filter_count
)
548 if(*emm_filters
== NULL
)
550 const unsigned int max_filter_count
= 2 + rdr
->nprov
;
551 if(!cs_malloc(emm_filters
, max_filter_count
* sizeof(struct s_csystem_emm_filter
)))
554 struct s_csystem_emm_filter
*filters
= *emm_filters
;
559 filters
[idx
].type
= EMM_GLOBAL
;
560 filters
[idx
].enabled
= 0; // FIXME: dont see any conax global EMM yet
561 filters
[idx
].filter
[0] = 0x82;
562 filters
[idx
].mask
[0] = 0xFF;
563 filters
[idx
].filter
[8] = 0x70;
564 filters
[idx
].mask
[8] = 0xFF;
567 for(prov
= 0; prov
< rdr
->nprov
; prov
++)
569 filters
[idx
].type
= EMM_SHARED
;
570 filters
[idx
].enabled
= 1;
571 filters
[idx
].filter
[0] = 0x82;
572 filters
[idx
].mask
[0] = 0xFF;
573 memcpy(&filters
[idx
].filter
[4], rdr
->sa
[prov
], 4);
574 memset(&filters
[idx
].mask
[4], 0xFF, 4);
578 filters
[idx
].type
= EMM_UNIQUE
;
579 filters
[idx
].enabled
= 1;
580 filters
[idx
].filter
[0] = 0x82;
581 filters
[idx
].mask
[0] = 0xFF;
582 memcpy(&filters
[idx
].filter
[4], rdr
->hexserial
+ 2, 4);
583 memset(&filters
[idx
].mask
[4], 0xFF, 4);
592 static int32_t conax_do_emm(struct s_reader
*reader
, EMM_PACKET
*ep
)
595 uint8_t insCA
[] = { 0xDD, 0xCA, 0x00, 0x00, 0x00 };
596 uint8_t insEMM
[] = { 0xDD, 0x84, 0x00, 0x00, 0x00 };
600 const int32_t l
= ep
->emm
[2];
605 memcpy(buf
+ 2, ep
->emm
, buf
[1]);
606 write_cmd(insEMM
, buf
);
608 if(cta_res
[0] == 0x98)
610 insCA
[4] = cta_res
[1];
611 write_cmd(insCA
, NULL
);
614 rc
= ((cta_res
[0] == 0x90) && (cta_res
[1] == 0x00));
622 static int32_t conax_card_info(struct s_reader
*reader
)
625 int32_t type
, i
, j
, k
= 0, n
= 0, l
;
627 char provname
[32], pdate
[32], chid
[32];
628 static const uint8_t insC6
[] = { 0xDD, 0xC6, 0x00, 0x00, 0x03, 0x1C, 0x01, 0x00 };
629 static const uint8_t ins26
[] = { 0xDD, 0x26, 0x00, 0x00, 0x03, 0x1C, 0x01, 0x01 };
630 uint8_t insCA
[] = { 0xDD, 0xCA, 0x00, 0x00, 0x00 };
631 char *txt
[] = { "Package", "PPV-Event" };
632 static const uint8_t *cmd
[] = { insC6
, ins26
};
633 time_t start_t
= 0, end_t
= 0;
634 uint32_t cxclass
= 0;
636 cs_clear_entitlement(reader
); // reset the entitlements
638 for(type
= 0; type
< 2; type
++)
641 write_cmd(cmd
[type
], cmd
[type
] + 5);
642 while(cta_res
[cta_lr
- 2] == 0x98)
644 insCA
[4] = cta_res
[cta_lr
- 1]; // get len
645 write_cmd(insCA
, NULL
); // read
647 if((cta_res
[cta_lr
- 2] == 0x90) || (cta_res
[cta_lr
- 2] == 0x98))
649 for(j
= 0; j
< cta_lr
- 2; j
+= cta_res
[j
+ 1] + 2)
651 provid
= (cta_res
[j
+ 2 + type
] << 8) | cta_res
[j
+ 3 + type
];
654 for(k
= 0, i
= j
+ 4 + type
; (i
< j
+ cta_res
[j
+ 1]); i
+= cta_res
[i
+ 1] + 2)
659 l
= (cta_res
[i
+ 1] < (sizeof(provname
) - 1)) ? cta_res
[i
+ 1] : sizeof(provname
) - 1;
660 memcpy(provname
, cta_res
+ i
+ 2, l
);
667 rdr_log(reader
, "%s: %d, id: %04X%s, date: %s - %s, name: %s",
668 txt
[type
], ++n
, provid
, chid
, pdate
, pdate
+ 16, trim(provname
));
670 // add entitlements to list
671 cs_add_entitlement(reader
, reader
->caid
, b2ll(4, reader
->prid
[0]),
672 provid
, cxclass
, start_t
, end_t
, type
+ 1, 1);
677 if(k
== 0) { start_t
= chid_date(cta_res
+ i
+ 2, pdate
, 15); }
678 else { end_t
= chid_date(cta_res
+ i
+ 2, pdate
+ 16, 15) /* add 23:59:59 here: */ + 0x1517F; }
682 case 0x20: // Provider classes
683 case 0x90: // (?) not sure what this is, saw it once in log
684 snprintf(chid
, sizeof(chid
), ", classes: %02X%02X%02X%02X",
685 cta_res
[i
+ 2], cta_res
[i
+ 3], cta_res
[i
+ 4] , cta_res
[i
+ 5]);
686 cxclass
= b2ll(4, &cta_res
[i
+ 2]);
690 rdr_log(reader
, "%s: %d, id: %04X%s, date: %s - %s, name: %s",
691 txt
[type
], ++n
, provid
, chid
, pdate
, pdate
+ 16, trim(provname
));
693 // add entitlements to list
694 cs_add_entitlement(reader
, reader
->caid
, b2ll(4, reader
->prid
[0]),
695 provid
, cxclass
, start_t
, end_t
, type
+ 1, 1);
700 rdr_log(reader
, "ready for requests");
704 const struct s_cardsystem reader_conax
=
707 .caids
= (uint16_t[]){ 0x0B, 0 },
708 .do_emm
= conax_do_emm
,
709 .do_ecm
= conax_do_ecm
,
710 .card_info
= conax_card_info
,
711 .card_init
= conax_card_init
,
712 .get_emm_type
= conax_get_emm_type
,
713 .get_emm_filter
= conax_get_emm_filter
,