+ else if(simType == 2)
+ {
+
+ uint8_t mac_responses[USB_CMD_DATA_SIZE] = { 0 };
+ Dbprintf("Going into attack mode, %d CSNS sent", numberOfCSNS);
+ // In this mode, a number of csns are within datain. We'll simulate each one, one at a time
+ // in order to collect MAC's from the reader. This can later be used in an offlne-attack
+ // in order to obtain the keys, as in the "dismantling iclass"-paper.
+ int i = 0;
+ for( ; i < numberOfCSNS && i*8+8 < USB_CMD_DATA_SIZE; i++)
+ {
+ // The usb data is 512 bytes, fitting 65 8-byte CSNs in there.
+
+ memcpy(emulator, datain+(i*8), 8);
+ if(doIClassSimulation(MODE_EXIT_AFTER_MAC,mac_responses+i*8))
+ {
+ cmd_send(CMD_ACK,CMD_SIMULATE_TAG_ICLASS,i,0,mac_responses,i*8);
+ return; // Button pressed
+ }
+ }
+ cmd_send(CMD_ACK,CMD_SIMULATE_TAG_ICLASS,i,0,mac_responses,i*8);
+
+ }else if(simType == 3){
+ //This is 'full sim' mode, where we use the emulator storage for data.
+ doIClassSimulation(MODE_FULLSIM, NULL);
+ }
+ else{
+ // We may want a mode here where we hardcode the csns to use (from proxclone).
+ // That will speed things up a little, but not required just yet.
+ Dbprintf("The mode is not implemented, reserved for future use");
+ }
+ Dbprintf("Done...");
+
+}
+void AppendCrc(uint8_t* data, int len)
+{
+ ComputeCrc14443(CRC_ICLASS,data,len,data+len,data+len+1);
+}
+
+/**
+ * @brief Does the actual simulation
+ * @param csn - csn to use
+ * @param breakAfterMacReceived if true, returns after reader MAC has been received.
+ */
+int doIClassSimulation( int simulationMode, uint8_t *reader_mac_buf)
+{
+ // free eventually allocated BigBuf memory
+ BigBuf_free_keep_EM();
+
+ State cipher_state;
+// State cipher_state_reserve;
+ uint8_t *csn = BigBuf_get_EM_addr();
+ uint8_t *emulator = csn;
+ uint8_t sof_data[] = { 0x0F} ;
+ // CSN followed by two CRC bytes
+ uint8_t anticoll_data[10] = { 0 };
+ uint8_t csn_data[10] = { 0 };
+ memcpy(csn_data,csn,sizeof(csn_data));
+ Dbprintf("Simulating CSN %02x%02x%02x%02x%02x%02x%02x%02x",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
projects / proxmark3-svn / blobdiff