]> git.zerfleddert.de Git - proxmark3-svn/blame - armsrc/mifaresniff.c
Merge pull request #16 from alexgrin/iceman_master
[proxmark3-svn] / armsrc / mifaresniff.c
CommitLineData
b62a5a84
M
1//-----------------------------------------------------------------------------\r
2// Merlok - 2012\r
3//\r
4// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
5// at your option, any later version. See the LICENSE.txt file for the text of\r
6// the license.\r
7//-----------------------------------------------------------------------------\r
8// Routines to support mifare classic sniffer.\r
9//-----------------------------------------------------------------------------\r
10\r
11#include "mifaresniff.h"\r
b62a5a84 12\r
39864b0b 13static int sniffState = SNF_INIT;\r
13fc2e9c 14static uint8_t sniffUIDType = 0;\r
15static uint8_t sniffUID[10] = {0,0,0,0,0,0,0,0,0,0};\r
16static uint8_t sniffATQA[2] = {0,0};\r
17static uint8_t sniffSAK = 0;\r
c01d8e21 18static uint8_t sniffBuf[17];\r
13fc2e9c 19static uint32_t timerData = 0;\r
20\r
13fc2e9c 21void MfSniffInit(void){\r
22 memset(sniffUID, 0x00, sizeof(sniffUID));\r
23 memset(sniffATQA, 0x00, sizeof(sniffATQA));\r
24 memset(sniffBuf, 0x00, sizeof(sniffBuf));\r
39864b0b
M
25 sniffSAK = 0;\r
26 sniffUIDType = SNF_UID_4;\r
39864b0b
M
27}\r
28\r
13fc2e9c 29void MfSniffEnd(void){\r
39864b0b 30 LED_B_ON();\r
7bc95e2e 31 cmd_send(CMD_ACK,0,0,0,0,0);\r
39864b0b 32 LED_B_OFF();\r
39864b0b
M
33}\r
34\r
6a1f2d82 35bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint8_t *parity, uint16_t bitCnt, bool reader) {\r
39864b0b 36\r
13fc2e9c 37 // reset on 7-Bit commands from reader\r
38 if (reader && (len == 1) && (bitCnt == 7)) { \r
39864b0b
M
39 sniffState = SNF_INIT;\r
40 }\r
41\r
42 switch (sniffState) {\r
43 case SNF_INIT:{\r
13fc2e9c 44 // REQA or WUPA from reader\r
45 if ((len == 1) && (reader) && (bitCnt == 7) ) {\r
46 MfSniffInit();\r
39864b0b
M
47 sniffState = SNF_WUPREQ;\r
48 }\r
49 break;\r
50 }\r
51 case SNF_WUPREQ:{\r
13fc2e9c 52 // ATQA from tag\r
53 if ((!reader) && (len == 2)) {\r
54 sniffATQA[0] = data[0];\r
55 sniffATQA[1] = data[1];\r
39864b0b
M
56 sniffState = SNF_ATQA;\r
57 }\r
58 break;\r
59 }\r
60 case SNF_ATQA:{\r
13fc2e9c 61 // Select ALL from reader\r
c01d8e21 62 if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20))\r
39864b0b 63 sniffState = SNF_ANTICOL1;\r
39864b0b
M
64 break;\r
65 }\r
66 case SNF_ANTICOL1:{\r
13fc2e9c 67 // UID from tag (CL1) \r
68 if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) {\r
c01d8e21 69 memcpy(sniffUID, data, 4);\r
39864b0b
M
70 sniffState = SNF_UID1;\r
71 }\r
72 break;\r
73 }\r
74 case SNF_UID1:{\r
13fc2e9c 75 // Select 4 Byte UID from reader\r
c01d8e21 76 if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9)))\r
39864b0b 77 sniffState = SNF_SAK;\r
39864b0b
M
78 break;\r
79 }\r
80 case SNF_SAK:{\r
7bc95e2e 81 if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card?\r
39864b0b 82 sniffSAK = data[0];\r
c01d8e21 83 if (sniffUID[0] == 0x88) // CL2/3 UID part to be expected \r
84 sniffState = (sniffState == SNF_ANTICOL2 ) ? SNF_ANTICOL3 : SNF_ANTICOL2;\r
85 else // select completed\r
39864b0b 86 sniffState = SNF_CARD_IDLE;\r
39864b0b
M
87 }\r
88 break;\r
89 }\r
90 case SNF_ANTICOL2:{\r
13fc2e9c 91 // CL2 UID \r
92 if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) {\r
c01d8e21 93 sniffUID[0] = sniffUID[1];\r
94 sniffUID[1] = sniffUID[2];\r
95 sniffUID[2] = sniffUID[3];\r
d714d3ef 96 memcpy(sniffUID+3, data, 4);\r
39864b0b 97 sniffUIDType = SNF_UID_7;\r
39864b0b 98 sniffState = SNF_UID2;\r
7bc95e2e 99 }\r
39864b0b
M
100 break;\r
101 }\r
102 case SNF_UID2:{\r
13fc2e9c 103 // Select 2nd part of 7 Byte UID\r
c01d8e21 104 if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9)))\r
13fc2e9c 105 sniffState = SNF_SAK;\r
13fc2e9c 106 break;\r
107 }\r
108 case SNF_ANTICOL3:{\r
109 // CL3 UID \r
110 if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { \r
c01d8e21 111 // 3+3+4 = 10.\r
112 sniffUID[3] = sniffUID[4];\r
113 sniffUID[4] = sniffUID[5];\r
114 sniffUID[5] = sniffUID[6];\r
115 memcpy(sniffUID+6, data, 4);\r
13fc2e9c 116 sniffUIDType = SNF_UID_10;\r
117 sniffState = SNF_UID3;\r
118 }\r
119 break;\r
120 }\r
121 case SNF_UID3:{\r
122 // Select 3nd part of 10 Byte UID\r
c01d8e21 123 if ((reader) && (len == 9) && (data[0] == 0x97) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9)))\r
39864b0b 124 sniffState = SNF_SAK;\r
39864b0b
M
125 break;\r
126 }\r
7bc95e2e 127 case SNF_CARD_IDLE:{ // trace the card select sequence\r
39864b0b
M
128 sniffBuf[0] = 0xFF;\r
129 sniffBuf[1] = 0xFF;\r
13fc2e9c 130 memcpy(sniffBuf + 2, sniffUID, sizeof(sniffUID));\r
c01d8e21 131 memcpy(sniffBuf + 12, sniffATQA, sizeof(sniffATQA));\r
13fc2e9c 132 sniffBuf[14] = sniffSAK;\r
133 sniffBuf[15] = 0xFF;\r
134 sniffBuf[16] = 0xFF;\r
135 LogTrace(sniffBuf, sizeof(sniffBuf), 0, 0, NULL, TRUE);\r
7bc95e2e 136 } // intentionally no break;\r
137 case SNF_CARD_CMD:{ \r
6a1f2d82 138 LogTrace(data, len, 0, 0, NULL, TRUE);\r
39864b0b
M
139 sniffState = SNF_CARD_RESP;\r
140 timerData = GetTickCount();\r
141 break;\r
142 }\r
143 case SNF_CARD_RESP:{\r
6a1f2d82 144 LogTrace(data, len, 0, 0, NULL, FALSE);\r
39864b0b
M
145 sniffState = SNF_CARD_CMD;\r
146 timerData = GetTickCount();\r
147 break;\r
148 }\r
39864b0b
M
149 default:\r
150 sniffState = SNF_INIT;\r
151 break;\r
152 }\r
7bc95e2e 153 return FALSE;\r
39864b0b
M
154}\r
155\r
7bc95e2e 156bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) {\r
3000dc4e 157 if (BigBuf_get_traceLen() && (GetTickCount() > timerData + maxTimeoutMs)) {\r
39864b0b
M
158 return intMfSniffSend();\r
159 }\r
7bc95e2e 160 return FALSE;\r
39864b0b
M
161}\r
162\r
7bc95e2e 163// internal sending function. not a RAMFUNC.\r
164bool intMfSniffSend() {\r
165\r
39864b0b 166 int pckSize = 0;\r
3000dc4e 167 int pckLen = BigBuf_get_traceLen();\r
39864b0b 168 int pckNum = 0;\r
c01d8e21 169 uint8_t *data = BigBuf_get_addr();\r
117d9ec2 170 \r
55acbb2a 171 FpgaDisableSscDma();\r
39864b0b 172 while (pckLen > 0) {\r
7bc95e2e 173 pckSize = MIN(USB_CMD_DATA_SIZE, pckLen);\r
39864b0b 174 LED_B_ON();\r
c01d8e21 175 cmd_send(CMD_ACK, 1, BigBuf_get_traceLen(), pckSize, data + BigBuf_get_traceLen() - pckLen, pckSize);\r
39864b0b 176 LED_B_OFF();\r
39864b0b
M
177 pckLen -= pckSize;\r
178 pckNum++;\r
179 }\r
180\r
39864b0b 181 LED_B_ON();\r
c01d8e21 182 cmd_send(CMD_ACK,2,0,0,0,0); // 2 == data transfer is finished.\r
39864b0b
M
183 LED_B_OFF();\r
184\r
3000dc4e 185 clear_trace();\r
7bc95e2e 186 return TRUE;\r
39864b0b 187}\r
Impressum, Datenschutz