Merge pull request #548 from merlokk/mfsniff_fix

`hf mf sniff` not a small fix

diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index 7d589f0e64f6354227db678b703d379ba71b4909..6703cc65c7286cd041e19fda40b29e02604e16a2 100644 (file)
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -2539,7 +2539,9 @@ void RAMFUNC SniffMifare(uint8_t param) {
                        if(!TagIsActive) {              // no need to try decoding tag data if the reader is sending
                                uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
                                if(MillerDecoding(readerdata, (sniffCounter-1)*4)) {
-                                       LED_C_INV();
+                                       LED_B_ON();
+                                       LED_C_OFF();
+
                                        if (MfSniffLogic(receivedCmd, Uart.len, Uart.parity, Uart.bitCount, true)) break;
 
                                        /* And ready to receive another command. */
@@ -2554,7 +2556,8 @@ void RAMFUNC SniffMifare(uint8_t param) {
                        if(!ReaderIsActive) {           // no need to try decoding tag data if the reader is sending
                                uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
                                if(ManchesterDecoding(tagdata, 0, (sniffCounter-1)*4)) {
-                                       LED_C_INV();
+                                       LED_B_OFF();
+                                       LED_C_ON();
 
                                        if (MfSniffLogic(receivedResponse, Demod.len, Demod.parity, Demod.bitCount, false)) break;
 

diff --git a/armsrc/mifaresniff.c b/armsrc/mifaresniff.c
index 7f94b0fe7c01ecdbce7a036a1fb94e00cfb1cbb2..4e573be7dc9c630b6f6ec7c3b7ef21c351eafc3e 100644 (file)
--- a/armsrc/mifaresniff.c
+++ b/armsrc/mifaresniff.c
@@ -1,183 +1,166 @@
-//-----------------------------------------------------------------------------\r
-// Merlok - 2012\r
-//\r
-// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
-// at your option, any later version. See the LICENSE.txt file for the text of\r
-// the license.\r
-//-----------------------------------------------------------------------------\r
-// Routines to support mifare classic sniffer.\r
-//-----------------------------------------------------------------------------\r
-\r
-#include "mifaresniff.h"\r
-#include "apps.h"\r
-#include "proxmark3.h"\r
-#include "util.h"\r
-#include "string.h"\r
-#include "iso14443crc.h"\r
-#include "iso14443a.h"\r
-#include "crapto1/crapto1.h"\r
-#include "mifareutil.h"\r
-#include "common.h"\r
-\r
-\r
-static int sniffState = SNF_INIT;\r
-static uint8_t sniffUIDType;\r
-static uint8_t sniffUID[8] = {0x00};\r
-static uint8_t sniffATQA[2] = {0x00};\r
-static uint8_t sniffSAK;\r
-static uint8_t sniffBuf[16] = {0x00};\r
-static uint32_t timerData = 0;\r
-\r
-\r
-bool MfSniffInit(void){\r
-       memset(sniffUID, 0x00, 8);\r
-       memset(sniffATQA, 0x00, 2);\r
-       sniffSAK = 0;\r
-       sniffUIDType = SNF_UID_4;\r
-\r
-       return FALSE;\r
-}\r
-\r
-bool MfSniffEnd(void){\r
-       LED_B_ON();\r
-       cmd_send(CMD_ACK,0,0,0,0,0);\r
-       LED_B_OFF();\r
-\r
-       return FALSE;\r
-}\r
-\r
-bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint8_t *parity, uint16_t bitCnt, bool reader) {\r
-\r
-       if (reader && (len == 1) && (bitCnt == 7)) {            // reset on 7-Bit commands from reader\r
-               sniffState = SNF_INIT;\r
-       }\r
-\r
-       switch (sniffState) {\r
-               case SNF_INIT:{\r
-                       if ((len == 1) && (reader) && (bitCnt == 7) ) {  // REQA or WUPA from reader\r
-                               sniffUIDType = SNF_UID_4;\r
-                               memset(sniffUID, 0x00, 8);\r
-                               memset(sniffATQA, 0x00, 2);\r
-                               sniffSAK = 0;\r
-                               sniffState = SNF_WUPREQ;\r
-                       }\r
-                       break;\r
-               }\r
-               case SNF_WUPREQ:{\r
-                       if ((!reader) && (len == 2)) {          // ATQA from tag\r
-                               memcpy(sniffATQA, data, 2);\r
-                               sniffState = SNF_ATQA;\r
-                       }\r
-                       break;\r
-               }\r
-               case SNF_ATQA:{\r
-                       if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20)) { // Select ALL from reader\r
-                               sniffState = SNF_ANTICOL1;\r
-                       }\r
-                       break;\r
-               }\r
-               case SNF_ANTICOL1:{\r
-                       if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) {  // UID from tag (CL1) \r
-                               memcpy(sniffUID + 3, data, 4);\r
-                               sniffState = SNF_UID1;\r
-                       }\r
-                       break;\r
-               }\r
+//-----------------------------------------------------------------------------
+// Merlok - 2012
+//
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// Routines to support mifare classic sniffer.
+//-----------------------------------------------------------------------------
+
+#include "mifaresniff.h"
+#include "apps.h"
+#include "proxmark3.h"
+#include "util.h"
+#include "string.h"
+#include "iso14443crc.h"
+#include "iso14443a.h"
+#include "crapto1/crapto1.h"
+#include "mifareutil.h"
+#include "common.h"
+
+
+static int sniffState = SNF_INIT;
+static uint8_t sniffUIDType;
+static uint8_t sniffUID[8] = {0x00};
+static uint8_t sniffATQA[2] = {0x00};
+static uint8_t sniffSAK;
+static uint8_t sniffBuf[16] = {0x00};
+static uint32_t timerData = 0;
+
+
+bool MfSniffInit(void){
+       memset(sniffUID, 0x00, 8);
+       memset(sniffATQA, 0x00, 2);
+       sniffSAK = 0;
+       sniffUIDType = SNF_UID_4;
+
+       return FALSE;
+}
+
+bool MfSniffEnd(void){
+       LED_B_ON();
+       cmd_send(CMD_ACK,0,0,0,0,0);
+       LED_B_OFF();
+
+       return FALSE;
+}
+
+bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint8_t *parity, uint16_t bitCnt, bool reader) {
+
+       if (reader && (len == 1) && (bitCnt == 7)) {            // reset on 7-Bit commands from reader
+               sniffState = SNF_INIT;
+       }
+
+       switch (sniffState) {
+               case SNF_INIT:{
+                       if ((len == 1) && (reader) && (bitCnt == 7) ) {  // REQA or WUPA from reader
+                               sniffUIDType = SNF_UID_4;
+                               memset(sniffUID, 0x00, 8);
+                               memset(sniffATQA, 0x00, 2);
+                               sniffSAK = 0;
+                               sniffState = SNF_ATQA;
+                               if (data[0] == 0x40) 
+                                       sniffState = SNF_MAGIC_WUPC2;
+                       }
+                       break;
+               }
+               case SNF_MAGIC_WUPC2:
+                       if ((len == 1) && (reader) && (data[0] == 0x43) ) {  
+                               sniffState = SNF_CARD_IDLE;
+                       }
+                       break;
+               case SNF_ATQA:{
+                       if ((!reader) && (len == 2)) {          // ATQA from tag
+                               memcpy(sniffATQA, data, 2);
+                               sniffState = SNF_UID1;
+                       }
+                       break;
+               }
                case SNF_UID1:{\r
                        if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) {   // Select 4 Byte UID from reader\r
+                               memcpy(sniffUID + 3, &data[2], 4);\r
                                sniffState = SNF_SAK;\r
                        }\r
-                       break;\r
-               }\r
-               case SNF_SAK:{\r
-                       if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card?\r
-                               sniffSAK = data[0];\r
-                               if (sniffUID[3] == 0x88) {                      // CL2 UID part to be expected\r
-                                       sniffState = SNF_ANTICOL2;\r
-                               } else {                                                        // select completed\r
-                                       sniffState = SNF_CARD_IDLE;\r
-                               }\r
-                       }\r
-                       break;\r
-               }\r
-               case SNF_ANTICOL2:{\r
-                       if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // CL2 UID \r
-                               memcpy(sniffUID, sniffUID+4, 3);\r
-                               memcpy(sniffUID+3, data, 4);\r
-                               sniffUIDType = SNF_UID_7;\r
-                               sniffState = SNF_UID2;\r
-                       }\r
-                       break;\r
+                       break;
                }\r
+               case SNF_SAK:{
+                       if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card?
+                               sniffSAK = data[0];
+                               if ((sniffUID[3] == 0x88) && (sniffUIDType == SNF_UID_4)) {                     // CL2 UID part to be expected
+                                       sniffUIDType = SNF_UID_7;\r
+                                       memcpy(sniffUID, sniffUID + 4, 3);\r
+                                       sniffState = SNF_UID2;
+                               } else {                                                                                                                        // select completed
+                                       sniffState = SNF_CARD_IDLE;
+                               }
+                       }
+                       break;
+               }
                case SNF_UID2:{\r
-                       if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) {        // Select 2nd part of 7 Byte UID\r
+                       if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) {\r
+                               memcpy(sniffUID + 3, &data[2], 4);\r
                                sniffState = SNF_SAK;\r
                        }\r
                        break;\r
                }\r
-               case SNF_CARD_IDLE:{    // trace the card select sequence\r
-                       sniffBuf[0] = 0xFF;\r
-                       sniffBuf[1] = 0xFF;\r
-                       memcpy(sniffBuf + 2, sniffUID, 7);\r
-                       memcpy(sniffBuf + 9, sniffATQA, 2);\r
-                       sniffBuf[11] = sniffSAK;\r
-                       sniffBuf[12] = 0xFF;\r
-                       sniffBuf[13] = 0xFF;\r
-                       LogTrace(sniffBuf, 14, 0, 0, NULL, TRUE);\r
-               }       // intentionally no break;\r
-               case SNF_CARD_CMD:{             \r
-                       LogTrace(data, len, 0, 0, NULL, TRUE);\r
-                       sniffState = SNF_CARD_RESP;\r
-                       timerData = GetTickCount();\r
-                       break;\r
-               }\r
-               case SNF_CARD_RESP:{\r
-                       LogTrace(data, len, 0, 0, NULL, FALSE);\r
-                       sniffState = SNF_CARD_CMD;\r
-                       timerData = GetTickCount();\r
-                       break;\r
-               }\r
-       \r
-               default:\r
-                       sniffState = SNF_INIT;\r
-               break;\r
-       }\r
-\r
-\r
-       return FALSE;\r
-}\r
-\r
-bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) {\r
-       if (BigBuf_get_traceLen() && (GetTickCount() > timerData + maxTimeoutMs)) {\r
-               return intMfSniffSend();\r
-       }\r
-       return FALSE;\r
-}\r
-\r
-// internal sending function. not a RAMFUNC.\r
-bool intMfSniffSend() {\r
-\r
-       int pckSize = 0;\r
-       int pckLen = BigBuf_get_traceLen();\r
-       int pckNum = 0;\r
-       uint8_t *trace = BigBuf_get_addr();\r
-       \r
-       FpgaDisableSscDma();\r
-       while (pckLen > 0) {\r
-               pckSize = MIN(USB_CMD_DATA_SIZE, pckLen);\r
-               LED_B_ON();\r
-               cmd_send(CMD_ACK, 1, BigBuf_get_traceLen(), pckSize, trace + BigBuf_get_traceLen() - pckLen, pckSize);\r
-               LED_B_OFF();\r
-\r
-               pckLen -= pckSize;\r
-               pckNum++;\r
-       }\r
-\r
-       LED_B_ON();\r
-       cmd_send(CMD_ACK,2,0,0,0,0);\r
-       LED_B_OFF();\r
-\r
-       clear_trace();\r
-       \r
-       return TRUE;\r
-}\r
+               case SNF_CARD_IDLE:{    // trace the card select sequence
+                       sniffBuf[0] = 0xFF;
+                       sniffBuf[1] = 0xFF;
+                       memcpy(sniffBuf + 2, sniffUID, 7);
+                       memcpy(sniffBuf + 9, sniffATQA, 2);
+                       sniffBuf[11] = sniffSAK;
+                       sniffBuf[12] = 0xFF;
+                       sniffBuf[13] = 0xFF;
+                       LogTrace(sniffBuf, 14, 0, 0, NULL, TRUE);
+                       sniffState = SNF_CARD_CMD;
+               }       // intentionally no break;
+               case SNF_CARD_CMD:{     
+                       LogTrace(data, len, 0, 0, NULL, reader);
+                       timerData = GetTickCount();
+                       break;
+               }
+       
+               default:
+                       sniffState = SNF_INIT;
+               break;
+       }
+
+
+       return FALSE;
+}
+
+bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) {
+       if (BigBuf_get_traceLen() && (GetTickCount() > timerData + maxTimeoutMs)) {
+               return intMfSniffSend();
+       }
+       return FALSE;
+}
+
+// internal sending function. not a RAMFUNC.
+bool intMfSniffSend() {
+
+       int pckSize = 0;
+       int pckLen = BigBuf_get_traceLen();
+       int pckNum = 0;
+       uint8_t *trace = BigBuf_get_addr();
+       
+       FpgaDisableSscDma();
+       while (pckLen > 0) {
+               pckSize = MIN(USB_CMD_DATA_SIZE, pckLen);
+               LED_B_ON();
+               cmd_send(CMD_ACK, 1, BigBuf_get_traceLen(), pckSize, trace + BigBuf_get_traceLen() - pckLen, pckSize);
+               LED_B_OFF();
+
+               pckLen -= pckSize;
+               pckNum++;
+       }
+
+       LED_B_ON();
+       cmd_send(CMD_ACK,2,0,0,0,0);
+       LED_B_OFF();
+
+       clear_trace();
+       
+       return TRUE;
+}

diff --git a/armsrc/mifaresniff.h b/armsrc/mifaresniff.h
index 8a8e31a9e70503ab775e567b5877f93301ea9feb..b181f982c6f58b43a10877e061a46b40ddb3f725 100644 (file)
--- a/armsrc/mifaresniff.h
+++ b/armsrc/mifaresniff.h
@@ -27,6 +27,7 @@
 #define SNF_CARD_IDLE                  9\r
 #define SNF_CARD_CMD                   10\r
 #define SNF_CARD_RESP                  11\r
+#define SNF_MAGIC_WUPC2                        12\r
 \r
 #define SNF_UID_4                              0\r
 #define SNF_UID_7                              0\r

diff --git a/client/mifarehost.c b/client/mifarehost.c
index 67277b5904aa3c0f58cf1974808944a869d9cf79..d204bf12c87e9a3358eba16c392e05a80ae980dc 100644 (file)
--- a/client/mifarehost.c
+++ b/client/mifarehost.c
@@ -609,7 +609,8 @@ int saveTraceCard(void) {
        for (int i = 0; i < 64; i++) {  // blocks\r
                for (int j = 0; j < 16; j++)  // bytes\r
                        fprintf(f, "%02x", *(traceCard + i * 16 + j));\r
-               fprintf(f,"\n");\r
+               if (i < 63)\r
+                       fprintf(f,"\n");\r
        }\r
        fclose(f);\r
        return 0;\r
@@ -826,20 +827,30 @@ int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) {
                if (len ==4) {\r
                        traceState = TRACE_IDLE;\r
 \r
-                       at_enc = bytes_to_num(data, 4);\r
-\r
-                       //  decode key here)\r
-                       ks2 = ar_enc ^ prng_successor(nt, 64);\r
-                       ks3 = at_enc ^ prng_successor(nt, 96);\r
-                       revstate = lfsr_recovery64(ks2, ks3);\r
-                       lfsr_rollback_word(revstate, 0, 0);\r
-                       lfsr_rollback_word(revstate, 0, 0);\r
-                       lfsr_rollback_word(revstate, nr_enc, 1);\r
-                       lfsr_rollback_word(revstate, uid ^ nt, 0);\r
+                       if (!traceCrypto1) {\r
+                               at_enc = bytes_to_num(data, 4);\r
+\r
+                               //  decode key here)\r
+                               ks2 = ar_enc ^ prng_successor(nt, 64);\r
+                               ks3 = at_enc ^ prng_successor(nt, 96);\r
+                               revstate = lfsr_recovery64(ks2, ks3);\r
+                               lfsr_rollback_word(revstate, 0, 0);\r
+                               lfsr_rollback_word(revstate, 0, 0);\r
+                               lfsr_rollback_word(revstate, nr_enc, 1);\r
+                               lfsr_rollback_word(revstate, uid ^ nt, 0);\r
+\r
+                               crypto1_get_lfsr(revstate, &lfsr);\r
+                               printf("key> %x%x\n", (unsigned int)((lfsr & 0xFFFFFFFF00000000) >> 32), (unsigned int)(lfsr & 0xFFFFFFFF));\r
+                               AddLogUint64(logHexFileName, "key> ", lfsr);\r
+                       } else {\r
+                               printf("key> nested not implemented!\n");\r
+                               at_enc = bytes_to_num(data, 4);\r
+                               \r
+                               crypto1_destroy(traceCrypto1);\r
 \r
-                       crypto1_get_lfsr(revstate, &lfsr);\r
-                       printf("key> %x%x\n", (unsigned int)((lfsr & 0xFFFFFFFF00000000) >> 32), (unsigned int)(lfsr & 0xFFFFFFFF));\r
-                       AddLogUint64(logHexFileName, "key> ", lfsr);\r
+                               // not implemented\r
+                               traceState = TRACE_ERROR;\r
+                       }\r
 \r
                        int blockShift = ((traceCurBlock & 0xFC) + 3) * 16;\r
                        if (isBlockEmpty((traceCurBlock & 0xFC) + 3)) memcpy(traceCard + blockShift + 6, trailerAccessBytes, 4);\r
@@ -857,15 +868,6 @@ int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) {
 \r
                        // set cryptosystem state\r
                        traceCrypto1 = lfsr_recovery64(ks2, ks3);\r
-\r
-//     nt = crypto1_word(traceCrypto1, nt ^ uid, 1) ^ nt;\r
-\r
-       /*      traceCrypto1 = crypto1_create(lfsr); // key in lfsr\r
-               crypto1_word(traceCrypto1, nt ^ uid, 0);\r
-               crypto1_word(traceCrypto1, ar, 1);\r
-               crypto1_word(traceCrypto1, 0, 0);\r
-               crypto1_word(traceCrypto1, 0, 0);*/\r
-\r
                        return 0;\r
                } else {\r
                        traceState = TRACE_ERROR;\r