]> git.zerfleddert.de Git - proxmark3-svn/blame - armsrc/mifaresniff.c
Added Unique Code to EM41x
[proxmark3-svn] / armsrc / mifaresniff.c
CommitLineData
b62a5a84
M
1//-----------------------------------------------------------------------------\r
2// Merlok - 2012\r
3//\r
4// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
5// at your option, any later version. See the LICENSE.txt file for the text of\r
6// the license.\r
7//-----------------------------------------------------------------------------\r
8// Routines to support mifare classic sniffer.\r
9//-----------------------------------------------------------------------------\r
10\r
11#include "mifaresniff.h"\r
12#include "apps.h"\r
13\r
39864b0b
M
14static int sniffState = SNF_INIT;\r
15static uint8_t sniffUIDType;\r
16static uint8_t sniffUID[8];\r
17static uint8_t sniffATQA[2];\r
18static uint8_t sniffSAK;\r
19static uint8_t sniffBuf[16];\r
7bc95e2e 20static uint32_t timerData = 0;\r
b62a5a84
M
21\r
22\r
7bc95e2e 23bool MfSniffInit(void){\r
39864b0b
M
24 memset(sniffUID, 0x00, 8);\r
25 memset(sniffATQA, 0x00, 2);\r
26 sniffSAK = 0;\r
27 sniffUIDType = SNF_UID_4;\r
28\r
7bc95e2e 29 return FALSE;\r
39864b0b
M
30}\r
31\r
7bc95e2e 32bool MfSniffEnd(void){\r
39864b0b 33 LED_B_ON();\r
7bc95e2e 34 cmd_send(CMD_ACK,0,0,0,0,0);\r
39864b0b
M
35 LED_B_OFF();\r
36\r
7bc95e2e 37 return FALSE;\r
39864b0b
M
38}\r
39\r
7bc95e2e 40bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint32_t parity, uint16_t bitCnt, bool reader) {\r
39864b0b 41\r
7bc95e2e 42 if (reader && (len == 1) && (bitCnt == 7)) { // reset on 7-Bit commands from reader\r
39864b0b
M
43 sniffState = SNF_INIT;\r
44 }\r
45\r
46 switch (sniffState) {\r
47 case SNF_INIT:{\r
7bc95e2e 48 if ((len == 1) && (reader) && (bitCnt == 7) ) { // REQA or WUPA from reader\r
39864b0b
M
49 sniffUIDType = SNF_UID_4;\r
50 memset(sniffUID, 0x00, 8);\r
51 memset(sniffATQA, 0x00, 2);\r
52 sniffSAK = 0;\r
39864b0b
M
53 sniffState = SNF_WUPREQ;\r
54 }\r
55 break;\r
56 }\r
57 case SNF_WUPREQ:{\r
7bc95e2e 58 if ((!reader) && (len == 2)) { // ATQA from tag\r
39864b0b 59 memcpy(sniffATQA, data, 2);\r
39864b0b
M
60 sniffState = SNF_ATQA;\r
61 }\r
62 break;\r
63 }\r
64 case SNF_ATQA:{\r
7bc95e2e 65 if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20)) { // Select ALL from reader\r
39864b0b
M
66 sniffState = SNF_ANTICOL1;\r
67 }\r
68 break;\r
69 }\r
70 case SNF_ANTICOL1:{\r
7bc95e2e 71 if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // UID from tag (CL1) \r
39864b0b 72 memcpy(sniffUID + 3, data, 4);\r
39864b0b
M
73 sniffState = SNF_UID1;\r
74 }\r
75 break;\r
76 }\r
77 case SNF_UID1:{\r
7bc95e2e 78 if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 4 Byte UID from reader\r
39864b0b
M
79 sniffState = SNF_SAK;\r
80 }\r
81 break;\r
82 }\r
83 case SNF_SAK:{\r
7bc95e2e 84 if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card?\r
39864b0b 85 sniffSAK = data[0];\r
7bc95e2e 86 if (sniffUID[3] == 0x88) { // CL2 UID part to be expected\r
39864b0b 87 sniffState = SNF_ANTICOL2;\r
7bc95e2e 88 } else { // select completed\r
39864b0b
M
89 sniffState = SNF_CARD_IDLE;\r
90 }\r
91 }\r
92 break;\r
93 }\r
94 case SNF_ANTICOL2:{\r
7bc95e2e 95 if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // CL2 UID \r
39864b0b
M
96 memcpy(sniffUID, data, 4);\r
97 sniffUIDType = SNF_UID_7;\r
39864b0b 98 sniffState = SNF_UID2;\r
7bc95e2e 99 }\r
39864b0b
M
100 break;\r
101 }\r
102 case SNF_UID2:{\r
7bc95e2e 103 if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 2nd part of 7 Byte UID\r
39864b0b 104 sniffState = SNF_SAK;\r
39864b0b
M
105 }\r
106 break;\r
107 }\r
7bc95e2e 108 case SNF_CARD_IDLE:{ // trace the card select sequence\r
39864b0b
M
109 sniffBuf[0] = 0xFF;\r
110 sniffBuf[1] = 0xFF;\r
111 memcpy(sniffBuf + 2, sniffUID, 7);\r
112 memcpy(sniffBuf + 9, sniffATQA, 2);\r
113 sniffBuf[11] = sniffSAK;\r
114 sniffBuf[12] = 0xFF;\r
115 sniffBuf[13] = 0xFF;\r
71d90e54 116 LogTrace(sniffBuf, 14, 0, parity, true);\r
7bc95e2e 117 } // intentionally no break;\r
118 case SNF_CARD_CMD:{ \r
71d90e54 119 LogTrace(data, len, 0, parity, true);\r
39864b0b
M
120 sniffState = SNF_CARD_RESP;\r
121 timerData = GetTickCount();\r
122 break;\r
123 }\r
124 case SNF_CARD_RESP:{\r
71d90e54 125 LogTrace(data, len, 0, parity, false);\r
39864b0b
M
126 sniffState = SNF_CARD_CMD;\r
127 timerData = GetTickCount();\r
128 break;\r
129 }\r
130 \r
131 default:\r
132 sniffState = SNF_INIT;\r
133 break;\r
134 }\r
135\r
7bc95e2e 136\r
137 return FALSE;\r
39864b0b
M
138}\r
139\r
7bc95e2e 140bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) {\r
141 if (traceLen && (GetTickCount() > timerData + maxTimeoutMs)) {\r
39864b0b
M
142 return intMfSniffSend();\r
143 }\r
7bc95e2e 144 return FALSE;\r
39864b0b
M
145}\r
146\r
7bc95e2e 147// internal sending function. not a RAMFUNC.\r
148bool intMfSniffSend() {\r
149\r
39864b0b
M
150 int pckSize = 0;\r
151 int pckLen = traceLen;\r
152 int pckNum = 0;\r
39864b0b 153\r
55acbb2a 154 FpgaDisableSscDma();\r
39864b0b 155 while (pckLen > 0) {\r
7bc95e2e 156 pckSize = MIN(USB_CMD_DATA_SIZE, pckLen);\r
39864b0b 157 LED_B_ON();\r
7bc95e2e 158 cmd_send(CMD_ACK, 1, pckSize, pckNum, trace + traceLen - pckLen, pckSize);\r
39864b0b
M
159 LED_B_OFF();\r
160\r
161 pckLen -= pckSize;\r
162 pckNum++;\r
163 }\r
164\r
39864b0b 165 LED_B_ON();\r
7bc95e2e 166 cmd_send(CMD_ACK,2,0,0,0,0);\r
39864b0b
M
167 LED_B_OFF();\r
168\r
7bc95e2e 169 iso14a_clear_trace();\r
39864b0b 170 \r
7bc95e2e 171 return TRUE;\r
39864b0b 172}\r
Impressum, Datenschutz