]> git.zerfleddert.de Git - proxmark3-svn/blame - armsrc/mifaresniff.c
Fix Tune Samples (broken in commit 12/31 by me)
[proxmark3-svn] / armsrc / mifaresniff.c
CommitLineData
b62a5a84
M
1//-----------------------------------------------------------------------------\r
2// Merlok - 2012\r
3//\r
4// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
5// at your option, any later version. See the LICENSE.txt file for the text of\r
6// the license.\r
7//-----------------------------------------------------------------------------\r
8// Routines to support mifare classic sniffer.\r
9//-----------------------------------------------------------------------------\r
10\r
11#include "mifaresniff.h"\r
12#include "apps.h"\r
13\r
6a1f2d82 14\r
39864b0b
M
15static int sniffState = SNF_INIT;\r
16static uint8_t sniffUIDType;\r
17static uint8_t sniffUID[8];\r
18static uint8_t sniffATQA[2];\r
19static uint8_t sniffSAK;\r
20static uint8_t sniffBuf[16];\r
7bc95e2e 21static uint32_t timerData = 0;\r
b62a5a84
M
22\r
23\r
7bc95e2e 24bool MfSniffInit(void){\r
39864b0b
M
25 memset(sniffUID, 0x00, 8);\r
26 memset(sniffATQA, 0x00, 2);\r
27 sniffSAK = 0;\r
28 sniffUIDType = SNF_UID_4;\r
29\r
7bc95e2e 30 return FALSE;\r
39864b0b
M
31}\r
32\r
7bc95e2e 33bool MfSniffEnd(void){\r
39864b0b 34 LED_B_ON();\r
7bc95e2e 35 cmd_send(CMD_ACK,0,0,0,0,0);\r
39864b0b
M
36 LED_B_OFF();\r
37\r
7bc95e2e 38 return FALSE;\r
39864b0b
M
39}\r
40\r
6a1f2d82 41bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint8_t *parity, uint16_t bitCnt, bool reader) {\r
39864b0b 42\r
7bc95e2e 43 if (reader && (len == 1) && (bitCnt == 7)) { // reset on 7-Bit commands from reader\r
39864b0b
M
44 sniffState = SNF_INIT;\r
45 }\r
46\r
47 switch (sniffState) {\r
48 case SNF_INIT:{\r
7bc95e2e 49 if ((len == 1) && (reader) && (bitCnt == 7) ) { // REQA or WUPA from reader\r
39864b0b
M
50 sniffUIDType = SNF_UID_4;\r
51 memset(sniffUID, 0x00, 8);\r
52 memset(sniffATQA, 0x00, 2);\r
53 sniffSAK = 0;\r
39864b0b
M
54 sniffState = SNF_WUPREQ;\r
55 }\r
56 break;\r
57 }\r
58 case SNF_WUPREQ:{\r
7bc95e2e 59 if ((!reader) && (len == 2)) { // ATQA from tag\r
39864b0b 60 memcpy(sniffATQA, data, 2);\r
39864b0b
M
61 sniffState = SNF_ATQA;\r
62 }\r
63 break;\r
64 }\r
65 case SNF_ATQA:{\r
7bc95e2e 66 if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20)) { // Select ALL from reader\r
39864b0b
M
67 sniffState = SNF_ANTICOL1;\r
68 }\r
69 break;\r
70 }\r
71 case SNF_ANTICOL1:{\r
7bc95e2e 72 if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // UID from tag (CL1) \r
39864b0b 73 memcpy(sniffUID + 3, data, 4);\r
39864b0b
M
74 sniffState = SNF_UID1;\r
75 }\r
76 break;\r
77 }\r
78 case SNF_UID1:{\r
7bc95e2e 79 if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 4 Byte UID from reader\r
39864b0b
M
80 sniffState = SNF_SAK;\r
81 }\r
82 break;\r
83 }\r
84 case SNF_SAK:{\r
7bc95e2e 85 if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card?\r
39864b0b 86 sniffSAK = data[0];\r
7bc95e2e 87 if (sniffUID[3] == 0x88) { // CL2 UID part to be expected\r
39864b0b 88 sniffState = SNF_ANTICOL2;\r
7bc95e2e 89 } else { // select completed\r
39864b0b
M
90 sniffState = SNF_CARD_IDLE;\r
91 }\r
92 }\r
93 break;\r
94 }\r
95 case SNF_ANTICOL2:{\r
7bc95e2e 96 if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // CL2 UID \r
d714d3ef 97 memcpy(sniffUID, sniffUID+4, 3);\r
98 memcpy(sniffUID+3, data, 4);\r
39864b0b 99 sniffUIDType = SNF_UID_7;\r
39864b0b 100 sniffState = SNF_UID2;\r
7bc95e2e 101 }\r
39864b0b
M
102 break;\r
103 }\r
104 case SNF_UID2:{\r
7bc95e2e 105 if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 2nd part of 7 Byte UID\r
39864b0b 106 sniffState = SNF_SAK;\r
39864b0b
M
107 }\r
108 break;\r
109 }\r
7bc95e2e 110 case SNF_CARD_IDLE:{ // trace the card select sequence\r
39864b0b
M
111 sniffBuf[0] = 0xFF;\r
112 sniffBuf[1] = 0xFF;\r
113 memcpy(sniffBuf + 2, sniffUID, 7);\r
114 memcpy(sniffBuf + 9, sniffATQA, 2);\r
115 sniffBuf[11] = sniffSAK;\r
116 sniffBuf[12] = 0xFF;\r
117 sniffBuf[13] = 0xFF;\r
6a1f2d82 118 LogTrace(sniffBuf, 14, 0, 0, NULL, TRUE);\r
7bc95e2e 119 } // intentionally no break;\r
120 case SNF_CARD_CMD:{ \r
6a1f2d82 121 LogTrace(data, len, 0, 0, NULL, TRUE);\r
39864b0b
M
122 sniffState = SNF_CARD_RESP;\r
123 timerData = GetTickCount();\r
124 break;\r
125 }\r
126 case SNF_CARD_RESP:{\r
6a1f2d82 127 LogTrace(data, len, 0, 0, NULL, FALSE);\r
39864b0b
M
128 sniffState = SNF_CARD_CMD;\r
129 timerData = GetTickCount();\r
130 break;\r
131 }\r
132 \r
133 default:\r
134 sniffState = SNF_INIT;\r
135 break;\r
136 }\r
137\r
7bc95e2e 138\r
139 return FALSE;\r
39864b0b
M
140}\r
141\r
7bc95e2e 142bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) {\r
143 if (traceLen && (GetTickCount() > timerData + maxTimeoutMs)) {\r
39864b0b
M
144 return intMfSniffSend();\r
145 }\r
7bc95e2e 146 return FALSE;\r
39864b0b
M
147}\r
148\r
7bc95e2e 149// internal sending function. not a RAMFUNC.\r
150bool intMfSniffSend() {\r
151\r
39864b0b
M
152 int pckSize = 0;\r
153 int pckLen = traceLen;\r
154 int pckNum = 0;\r
39864b0b 155\r
55acbb2a 156 FpgaDisableSscDma();\r
39864b0b 157 while (pckLen > 0) {\r
7bc95e2e 158 pckSize = MIN(USB_CMD_DATA_SIZE, pckLen);\r
39864b0b 159 LED_B_ON();\r
7bc95e2e 160 cmd_send(CMD_ACK, 1, pckSize, pckNum, trace + traceLen - pckLen, pckSize);\r
39864b0b
M
161 LED_B_OFF();\r
162\r
163 pckLen -= pckSize;\r
164 pckNum++;\r
165 }\r
166\r
39864b0b 167 LED_B_ON();\r
7bc95e2e 168 cmd_send(CMD_ACK,2,0,0,0,0);\r
39864b0b
M
169 LED_B_OFF();\r
170\r
7bc95e2e 171 iso14a_clear_trace();\r
39864b0b 172 \r
7bc95e2e 173 return TRUE;\r
39864b0b 174}\r
Impressum, Datenschutz