#include "string.h"
#include "common.h"
#include "cmd.h"
+#include "iso14443a.h"
// Needed for CRC in emulation mode;
// same construction as in ISO 14443;
// different initial value (CRC_ICLASS)
#include "iso15693tools.h"
#include "protocols.h"
#include "optimized_cipher.h"
+#include "usb_cdc.h" // for usb_poll_validate_length
static int timeout = 4096;
if(!Uart.bitBuffer) {
Uart.bitBuffer = bit ^ 0xFF0;
- return FALSE;
+ return false;
}
else {
Uart.bitBuffer <<= 4;
Uart.output[Uart.byteCnt] = Uart.bitBuffer & 0xFF;
Uart.byteCnt++;
Uart.swapper = 0;
- if(Uart.byteCnt > 15) { return TRUE; }
+ if(Uart.byteCnt > 15) { return true; }
}
else {
Uart.swapper = 1;
Uart.highCnt = 0;
if(Uart.byteCnt == 0) {
// Its not straightforward to show single EOFs
- // So just leave it and do not return TRUE
+ // So just leave it and do not return true
Uart.output[0] = 0xf0;
Uart.byteCnt++;
}
else {
- return TRUE;
+ return true;
}
}
else if(Uart.state != STATE_START_OF_COMMUNICATION) {
Uart.byteCnt++;
Uart.output[Uart.byteCnt] = 0xAA;
Uart.byteCnt++;
- return TRUE;
+ return true;
}*/
}
}
}
- return FALSE;
+ return false;
}
//=============================================================================
if(Demod.buff < 3) {
Demod.buff++;
- return FALSE;
+ return false;
}
if(Demod.state==DEMOD_UNSYNCD) {
Demod.len++;
Demod.state = DEMOD_UNSYNCD;
// error = 0x0f;
- return TRUE;
+ return true;
}
else {
Demod.state = DEMOD_ERROR_WAIT;
}
Demod.state = DEMOD_UNSYNCD;
- return TRUE;
+ return true;
}
else {
Demod.output[Demod.len] = 0xad;
Demod.len++;
Demod.output[Demod.len] = 0xBB;
Demod.len++;
- return TRUE;
+ return true;
}
}
} // end (state != UNSYNCED)
- return FALSE;
+ return false;
}
//=============================================================================
// We won't start recording the frames that we acquire until we trigger;
// a good trigger condition to get started is probably when we see a
// response from the tag.
- //int triggered = FALSE; // FALSE to wait first for card
+ //int triggered = false; // false to wait first for card
// The command (reader -> tag) that we're receiving.
// The length of a received command will in most cases be no more than 18 bytes.
// The DMA buffer, used to stream samples from the FPGA
uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
- set_tracing(TRUE);
+ set_tracing(true);
clear_trace();
- iso14a_set_trigger(FALSE);
+ iso14a_set_trigger(false);
int lastRxCounter;
uint8_t *upTo;
Demod.state = DEMOD_UNSYNCD;
// Setup for the DMA.
- FpgaSetupSsc();
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_ISO14443A);
upTo = dmaBuf;
lastRxCounter = DMA_BUFFER_SIZE;
FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
time_stop = (GetCountSspClk()-time_0) << 4;
LED_C_ON();
- //if(!LogTrace(Uart.output,Uart.byteCnt, rsamples, Uart.parityBits,TRUE)) break;
- //if(!LogTrace(NULL, 0, Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER, 0, TRUE)) break;
- if(tracing) {
- uint8_t parity[MAX_PARITY_SIZE];
- GetParity(Uart.output, Uart.byteCnt, parity);
- LogTrace(Uart.output,Uart.byteCnt, time_start, time_stop, parity, TRUE);
- }
-
+ //if(!LogTrace(Uart.output,Uart.byteCnt, rsamples, Uart.parityBits,true)) break;
+ //if(!LogTrace(NULL, 0, Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER, 0, true)) break;
+ uint8_t parity[MAX_PARITY_SIZE];
+ GetParity(Uart.output, Uart.byteCnt, parity);
+ LogTrace(Uart.output,Uart.byteCnt, time_start, time_stop, parity, true);
/* And ready to receive another command. */
Uart.state = STATE_UNSYNCD;
rsamples = samples - Demod.samples;
LED_B_ON();
- if(tracing) {
- uint8_t parity[MAX_PARITY_SIZE];
- GetParity(Demod.output, Demod.len, parity);
- LogTrace(Demod.output, Demod.len, time_start, time_stop, parity, FALSE);
- }
+ uint8_t parity[MAX_PARITY_SIZE];
+ GetParity(Demod.output, Demod.len, parity);
+ LogTrace(Demod.output, Demod.len, time_start, time_stop, parity, false);
// And ready to receive another response.
memset(&Demod, 0, sizeof(Demod));
//-----------------------------------------------------------------------------
// Wait for commands from reader
// Stop when button is pressed
-// Or return TRUE when command is captured
+// Or return true when command is captured
//-----------------------------------------------------------------------------
static int GetIClassCommandFromReader(uint8_t *received, int *len, int maxLen)
{
for(;;) {
WDT_HIT();
- if(BUTTON_PRESS()) return FALSE;
+ if(BUTTON_PRESS()) return false;
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
AT91C_BASE_SSC->SSC_THR = 0x00;
if(OutOfNDecoding(b & 0x0f)) {
*len = Uart.byteCnt;
- return TRUE;
+ return true;
}
}
}
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
// Enable and clear the trace
- set_tracing(TRUE);
+ set_tracing(true);
clear_trace();
//Use the emulator memory for SIM
uint8_t *emulator = BigBuf_get_EM_addr();
StartCountSspClk();
// We need to listen to the high-frequency, peak-detected path.
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
- FpgaSetupSsc();
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_ISO14443A);
// To control where we are in the protocol
int cmdsRecvd = 0;
t2r_time = GetCountSspClk();
}
- if (tracing) {
- uint8_t parity[MAX_PARITY_SIZE];
- GetParity(receivedCmd, len, parity);
- LogTrace(receivedCmd,len, (r2t_time-time_0)<< 4, (r2t_time-time_0) << 4, parity, TRUE);
-
- if (trace_data != NULL) {
- GetParity(trace_data, trace_data_size, parity);
- LogTrace(trace_data, trace_data_size, (t2r_time-time_0) << 4, (t2r_time-time_0) << 4, parity, FALSE);
- }
- if(!tracing) {
- DbpString("Trace full");
- //break;
- }
+ uint8_t parity[MAX_PARITY_SIZE];
+ GetParity(receivedCmd, len, parity);
+ LogTrace(receivedCmd,len, (r2t_time-time_0)<< 4, (r2t_time-time_0) << 4, parity, true);
+ if (trace_data != NULL) {
+ GetParity(trace_data, trace_data_size, parity);
+ LogTrace(trace_data, trace_data_size, (t2r_time-time_0) << 4, (t2r_time-time_0) << 4, parity, false);
+ }
+ if(!get_tracing()) {
+ DbpString("Trace full");
+ //break;
}
}
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR|FPGA_HF_SIMULATOR_MODULATE_424K_8BIT);
AT91C_BASE_SSC->SSC_THR = 0x00;
- FpgaSetupSsc();
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);
while(!BUTTON_PRESS()) {
if((AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY)){
b = AT91C_BASE_SSC->SSC_RHR; (void) b;
int c;
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
AT91C_BASE_SSC->SSC_THR = 0x00;
- FpgaSetupSsc();
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_ISO14443A);
if (wait)
{
uint8_t sendbyte;
- bool firstpart = TRUE;
+ bool firstpart = true;
c = 0;
for(;;) {
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
for(j = 0; j < 4; j++) {
for(k = 0; k < 4; k++) {
if(k == (b & 3)) {
- ToSend[++ToSendMax] = 0x0f;
+ ToSend[++ToSendMax] = 0xf0;
}
else {
ToSend[++ToSendMax] = 0x00;
LED_A_ON();
// Store reader command in buffer
- if (tracing) {
- uint8_t par[MAX_PARITY_SIZE];
- GetParity(frame, len, par);
- LogTrace(frame, len, rsamples, rsamples, par, TRUE);
- }
+ uint8_t par[MAX_PARITY_SIZE];
+ GetParity(frame, len, par);
+ LogTrace(frame, len, rsamples, rsamples, par, true);
}
//-----------------------------------------------------------------------------
// Wait a certain time for tag response
-// If a response is captured return TRUE
-// If it takes too long return FALSE
+// If a response is captured return true
+// If it takes too long return false
//-----------------------------------------------------------------------------
static int GetIClassAnswer(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed) //uint8_t *buffer
{
uint8_t b;
if (elapsed) *elapsed = 0;
- bool skip = FALSE;
+ bool skip = false;
c = 0;
for(;;) {
WDT_HIT();
- if(BUTTON_PRESS()) return FALSE;
+ if(BUTTON_PRESS()) return false;
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
AT91C_BASE_SSC->SSC_THR = 0x00; // To make use of exact timing of next command from reader!!
if (elapsed) (*elapsed)++;
}
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
- if(c < timeout) { c++; } else { return FALSE; }
+ if(c < timeout) { c++; } else { return false; }
b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
skip = !skip;
if(skip) continue;
if(ManchesterDecoding(b & 0x0f)) {
*samples = c << 3;
- return TRUE;
+ return true;
}
}
}
int ReaderReceiveIClass(uint8_t* receivedAnswer)
{
int samples = 0;
- if (!GetIClassAnswer(receivedAnswer,160,&samples,0)) return FALSE;
+ if (!GetIClassAnswer(receivedAnswer,160,&samples,0)) return false;
rsamples += samples;
- if (tracing) {
- uint8_t parity[MAX_PARITY_SIZE];
- GetParity(receivedAnswer, Demod.len, parity);
- LogTrace(receivedAnswer,Demod.len,rsamples,rsamples,parity,FALSE);
- }
- if(samples == 0) return FALSE;
+ uint8_t parity[MAX_PARITY_SIZE];
+ GetParity(receivedAnswer, Demod.len, parity);
+ LogTrace(receivedAnswer,Demod.len,rsamples,rsamples,parity,false);
+ if(samples == 0) return false;
return Demod.len;
}
{
FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
// Reset trace buffer
- set_tracing(TRUE);
- clear_trace();
+ set_tracing(true);
+ clear_trace();
// Setup SSC
- FpgaSetupSsc();
+ FpgaSetupSsc(FPGA_MAJOR_MODE_HF_ISO14443A);
// Start from off (no field generated)
// Signal field is off with the appropriate LED
LED_D_OFF();
//Flag that we got to at least stage 1, read CSN
read_status = 1;
- // Card selected, now read e-purse (cc)
+ // Card selected, now read e-purse (cc) (only 8 bytes no CRC)
ReaderTransmitIClass(readcheck_cc, sizeof(readcheck_cc));
if(ReaderReceiveIClass(resp) == 8) {
//Save CC (e-purse) in response data
return read_status;
}
-uint8_t handshakeIclassTag(uint8_t *card_data){
+uint8_t handshakeIclassTag(uint8_t *card_data) {
return handshakeIclassTag_ext(card_data, false);
}
uint8_t card_data[6 * 8]={0};
memset(card_data, 0xFF, sizeof(card_data));
- uint8_t last_csn[8]={0};
-
+ uint8_t last_csn[8]={0,0,0,0,0,0,0,0};
+ uint8_t resp[ICLASS_BUFFER_SIZE];
+ memset(resp, 0xFF, sizeof(resp));
//Read conf block CRC(0x01) => 0xfa 0x22
uint8_t readConf[] = { ICLASS_CMD_READ_OR_IDENTIFY,0x01, 0xfa, 0x22};
- //Read conf block CRC(0x05) => 0xde 0x64
+ //Read App Issuer Area block CRC(0x05) => 0xde 0x64
uint8_t readAA[] = { ICLASS_CMD_READ_OR_IDENTIFY,0x05, 0xde, 0x64};
-
int read_status= 0;
uint8_t result_status = 0;
+ // flag to read until one tag is found successfully
bool abort_after_read = arg0 & FLAG_ICLASS_READER_ONLY_ONCE;
+ // flag to only try 5 times to find one tag then return
bool try_once = arg0 & FLAG_ICLASS_READER_ONE_TRY;
- bool use_credit_key = false;
- if (arg0 & FLAG_ICLASS_READER_CEDITKEY)
- use_credit_key = true;
- set_tracing(TRUE);
+ // if neither abort_after_read nor try_once then continue reading until button pressed.
+
+ bool use_credit_key = arg0 & FLAG_ICLASS_READER_CEDITKEY;
+ // test flags for what blocks to be sure to read
+ uint8_t flagReadConfig = arg0 & FLAG_ICLASS_READER_CONF;
+ uint8_t flagReadCC = arg0 & FLAG_ICLASS_READER_CC;
+ uint8_t flagReadAA = arg0 & FLAG_ICLASS_READER_AA;
+
+ set_tracing(true);
setupIclassReader();
uint16_t tryCnt=0;
- while(!BUTTON_PRESS())
+ bool userCancelled = BUTTON_PRESS() || usb_poll_validate_length();
+ while(!userCancelled)
{
- if (try_once && tryCnt > 5) break;
+ // if only looking for one card try 2 times if we missed it the first time
+ if (try_once && tryCnt > 2) break;
tryCnt++;
- if(!tracing) {
+ if(!get_tracing()) {
DbpString("Trace full");
break;
}
// moving CC forward 8 bytes
memcpy(card_data+16,card_data+8, 8);
//Read block 1, config
- if(arg0 & FLAG_ICLASS_READER_CONF)
- {
- if(sendCmdGetResponseWithRetries(readConf, sizeof(readConf),card_data+8, 10, 10))
+ if(flagReadConfig) {
+ if(sendCmdGetResponseWithRetries(readConf, sizeof(readConf), resp, 10, 10))
{
result_status |= FLAG_ICLASS_READER_CONF;
+ memcpy(card_data+8, resp, 8);
} else {
Dbprintf("Failed to dump config block");
}
}
//Read block 5, AA
- if(arg0 & FLAG_ICLASS_READER_AA){
- if(sendCmdGetResponseWithRetries(readAA, sizeof(readAA),card_data+(8*4), 10, 10))
+ if(flagReadAA) {
+ if(sendCmdGetResponseWithRetries(readAA, sizeof(readAA), resp, 10, 10))
{
result_status |= FLAG_ICLASS_READER_AA;
+ memcpy(card_data+(8*5), resp, 8);
} else {
//Dbprintf("Failed to dump AA block");
}
// (3,4 write-only, kc and kd)
// 5 Application issuer area
//
- //Then we can 'ship' back the 8 * 5 bytes of data,
+ //Then we can 'ship' back the 8 * 6 bytes of data,
// with 0xFF:s in block 3 and 4.
LED_B_ON();
- //Send back to client, but don't bother if we already sent this
+ //Send back to client, but don't bother if we already sent this -
+ // only useful if looping in arm (not try_once && not abort_after_read)
if(memcmp(last_csn, card_data, 8) != 0)
{
- // If caller requires that we get CC, continue until we got it
- if( (arg0 & read_status & FLAG_ICLASS_READER_CC) || !(arg0 & FLAG_ICLASS_READER_CC))
- {
+ // If caller requires that we get Conf, CC, AA, continue until we got it
+ if( (result_status ^ FLAG_ICLASS_READER_CSN ^ flagReadConfig ^ flagReadCC ^ flagReadAA) == 0) {
cmd_send(CMD_ACK,result_status,0,0,card_data,sizeof(card_data));
if(abort_after_read) {
LED_A_OFF();
+ LED_B_OFF();
return;
}
//Save that we already sent this....
}
LED_B_OFF();
+ userCancelled = BUTTON_PRESS() || usb_poll_validate_length();
+ }
+ if (userCancelled) {
+ cmd_send(CMD_ACK,0xFF,0,0,card_data, 0);
+ } else {
+ cmd_send(CMD_ACK,0,0,0,card_data, 0);
}
- cmd_send(CMD_ACK,0,0,0,card_data, 0);
LED_A_OFF();
}
uint8_t resp[ICLASS_BUFFER_SIZE];
setupIclassReader();
- set_tracing(TRUE);
+ set_tracing(true);
while(!BUTTON_PRESS()) {
WDT_HIT();
- if(!tracing) {
+ if(!get_tracing()) {
DbpString("Trace full");
break;
}
}
bool iClass_WriteBlock_ext(uint8_t blockNo, uint8_t *data) {
- uint8_t write[] = { ICLASS_CMD_UPDATE, blockNo, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+ uint8_t write[] = { ICLASS_CMD_UPDATE, blockNo, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
//uint8_t readblockdata[10];
//write[1] = blockNo;
memcpy(write+2, data, 12); // data + mac
+ char *wrCmd = (char *)(write+1);
+ uint16_t wrCrc = iclass_crc16(wrCmd, 13);
+ write[14] = wrCrc >> 8;
+ write[15] = wrCrc & 0xff;
uint8_t resp[] = {0,0,0,0,0,0,0,0,0,0};
- bool isOK;
+ bool isOK = false;
+
isOK = sendCmdGetResponseWithRetries(write,sizeof(write),resp,sizeof(resp),10);
- if (isOK) {
+ if (isOK) { //if reader responded correctly
//Dbprintf("WriteResp: %02X%02X%02X%02X%02X%02X%02X%02X%02X%02X",resp[0],resp[1],resp[2],resp[3],resp[4],resp[5],resp[6],resp[7],resp[8],resp[9]);
- if (memcmp(write+2,resp,8)) {
- //error try again
- isOK = sendCmdGetResponseWithRetries(write,sizeof(write),resp,sizeof(resp),10);
+ if (memcmp(write+2,resp,8)) { //if response is not equal to write values
+ if (blockNo != 3 && blockNo != 4) { //if not programming key areas (note key blocks don't get programmed with actual key data it is xor data)
+ //error try again
+ isOK = sendCmdGetResponseWithRetries(write,sizeof(write),resp,sizeof(resp),10);
+ }
+
}
}
return isOK;
projects / proxmark3-svn / blobdiff