]>
Commit | Line | Data |
---|---|---|
3544b997 | 1 | //----------------------------------------------------------------------------- |
2 | // Merlok - 2012 | |
3 | // | |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
5 | // at your option, any later version. See the LICENSE.txt file for the text of | |
6 | // the license. | |
7 | //----------------------------------------------------------------------------- | |
8 | // Routines to support mifare classic sniffer. | |
9 | //----------------------------------------------------------------------------- | |
10 | ||
11 | #include "mifaresniff.h" | |
12 | #include "apps.h" | |
13 | #include "proxmark3.h" | |
14 | #include "util.h" | |
15 | #include "string.h" | |
16 | #include "iso14443crc.h" | |
17 | #include "iso14443a.h" | |
18 | #include "crapto1/crapto1.h" | |
19 | #include "mifareutil.h" | |
20 | #include "common.h" | |
21 | ||
22 | ||
23 | static int sniffState = SNF_INIT; | |
24 | static uint8_t sniffUIDType; | |
25 | static uint8_t sniffUID[8] = {0x00}; | |
26 | static uint8_t sniffATQA[2] = {0x00}; | |
27 | static uint8_t sniffSAK; | |
28 | static uint8_t sniffBuf[16] = {0x00}; | |
29 | static uint32_t timerData = 0; | |
30 | ||
31 | ||
32 | bool MfSniffInit(void){ | |
33 | memset(sniffUID, 0x00, 8); | |
34 | memset(sniffATQA, 0x00, 2); | |
35 | sniffSAK = 0; | |
36 | sniffUIDType = SNF_UID_4; | |
37 | ||
38 | return FALSE; | |
39 | } | |
40 | ||
41 | bool MfSniffEnd(void){ | |
42 | LED_B_ON(); | |
43 | cmd_send(CMD_ACK,0,0,0,0,0); | |
44 | LED_B_OFF(); | |
45 | ||
46 | return FALSE; | |
47 | } | |
48 | ||
49 | bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint8_t *parity, uint16_t bitCnt, bool reader) { | |
50 | ||
51 | if (reader && (len == 1) && (bitCnt == 7)) { // reset on 7-Bit commands from reader | |
52 | sniffState = SNF_INIT; | |
53 | } | |
54 | ||
55 | switch (sniffState) { | |
56 | case SNF_INIT:{ | |
57 | if ((len == 1) && (reader) && (bitCnt == 7) ) { // REQA or WUPA from reader | |
58 | sniffUIDType = SNF_UID_4; | |
59 | memset(sniffUID, 0x00, 8); | |
60 | memset(sniffATQA, 0x00, 2); | |
61 | sniffSAK = 0; | |
543a6ed3 | 62 | sniffState = SNF_ATQA; |
3544b997 | 63 | } |
64 | break; | |
65 | } | |
543a6ed3 | 66 | case SNF_ATQA:{ |
3544b997 | 67 | if ((!reader) && (len == 2)) { // ATQA from tag |
68 | memcpy(sniffATQA, data, 2); | |
543a6ed3 | 69 | sniffState = SNF_UID1; |
3544b997 | 70 | } |
71 | break; | |
72 | } | |
39864b0b | 73 | case SNF_UID1:{\r |
3544b997 | 74 | if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20)) { // Select ALL from reader |
75 | sniffState = SNF_ANTICOL1; | |
76 | }\r | |
77 | \r | |
7bc95e2e | 78 | if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 4 Byte UID from reader\r |
3544b997 | 79 | memcpy(sniffUID + 3, &data[2], 4);\r |
39864b0b M |
80 | sniffState = SNF_SAK;\r |
81 | }\r | |
3544b997 | 82 | break; |
39864b0b | 83 | }\r |
3544b997 | 84 | case SNF_ANTICOL1:{ |
85 | if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // UID from tag (CL1) | |
3544b997 | 86 | sniffState = SNF_UID1; |
87 | } | |
88 | break; | |
89 | } | |
90 | case SNF_SAK:{ | |
91 | if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card? | |
92 | sniffSAK = data[0]; | |
93 | if ((sniffUID[3] == 0x88) && (sniffUIDType == SNF_UID_4)) { // CL2 UID part to be expected | |
94 | sniffUIDType = SNF_UID_7;\r | |
95 | memcpy(sniffUID, sniffUID + 4, 3);\r | |
96 | sniffState = SNF_UID2; | |
97 | } else { // select completed | |
98 | sniffState = SNF_CARD_IDLE; | |
99 | } | |
100 | } | |
101 | break; | |
102 | } | |
103 | case SNF_ANTICOL2:{ | |
104 | if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // CL2 UID | |
3544b997 | 105 | sniffState = SNF_UID2; |
106 | } | |
107 | break; | |
108 | } | |
39864b0b | 109 | case SNF_UID2:{\r |
3544b997 | 110 | if ((reader) && (len == 2) && (data[0] == 0x95) && (data[1] == 0x20)) {\r |
111 | sniffState = SNF_ANTICOL2;\r | |
112 | }\r | |
113 | \r | |
114 | if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) {\r | |
115 | memcpy(sniffUID + 3, &data[2], 4);\r | |
39864b0b | 116 | sniffState = SNF_SAK;\r |
39864b0b M |
117 | }\r |
118 | break;\r | |
119 | }\r | |
3544b997 | 120 | case SNF_CARD_IDLE:{ // trace the card select sequence |
121 | sniffBuf[0] = 0xFF; | |
122 | sniffBuf[1] = 0xFF; | |
123 | memcpy(sniffBuf + 2, sniffUID, 7); | |
124 | memcpy(sniffBuf + 9, sniffATQA, 2); | |
125 | sniffBuf[11] = sniffSAK; | |
126 | sniffBuf[12] = 0xFF; | |
127 | sniffBuf[13] = 0xFF; | |
128 | LogTrace(sniffBuf, 14, 0, 0, NULL, TRUE); | |
129 | sniffState = SNF_CARD_CMD; | |
130 | } // intentionally no break; | |
131 | case SNF_CARD_CMD:{ | |
132 | LogTrace(data, len, 0, 0, NULL, reader); | |
133 | timerData = GetTickCount(); | |
134 | break; | |
135 | } | |
136 | ||
137 | default: | |
138 | sniffState = SNF_INIT; | |
139 | break; | |
140 | } | |
141 | ||
142 | ||
143 | return FALSE; | |
144 | } | |
145 | ||
146 | bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) { | |
147 | if (BigBuf_get_traceLen() && (GetTickCount() > timerData + maxTimeoutMs)) { | |
148 | return intMfSniffSend(); | |
149 | } | |
150 | return FALSE; | |
151 | } | |
152 | ||
153 | // internal sending function. not a RAMFUNC. | |
154 | bool intMfSniffSend() { | |
155 | ||
156 | int pckSize = 0; | |
157 | int pckLen = BigBuf_get_traceLen(); | |
158 | int pckNum = 0; | |
159 | uint8_t *trace = BigBuf_get_addr(); | |
160 | ||
161 | FpgaDisableSscDma(); | |
162 | while (pckLen > 0) { | |
163 | pckSize = MIN(USB_CMD_DATA_SIZE, pckLen); | |
164 | LED_B_ON(); | |
165 | cmd_send(CMD_ACK, 1, BigBuf_get_traceLen(), pckSize, trace + BigBuf_get_traceLen() - pckLen, pckSize); | |
166 | LED_B_OFF(); | |
167 | ||
168 | pckLen -= pckSize; | |
169 | pckNum++; | |
170 | } | |
171 | ||
172 | LED_B_ON(); | |
173 | cmd_send(CMD_ACK,2,0,0,0,0); | |
174 | LED_B_OFF(); | |
175 | ||
176 | clear_trace(); | |
177 | ||
178 | return TRUE; | |
179 | } |