]>
Commit | Line | Data |
---|---|---|
b62a5a84 M |
1 | //-----------------------------------------------------------------------------\r |
2 | // Merlok - 2012\r | |
3 | //\r | |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or,\r | |
5 | // at your option, any later version. See the LICENSE.txt file for the text of\r | |
6 | // the license.\r | |
7 | //-----------------------------------------------------------------------------\r | |
8 | // Routines to support mifare classic sniffer.\r | |
9 | //-----------------------------------------------------------------------------\r | |
10 | \r | |
11 | #include "mifaresniff.h"\r | |
12 | #include "apps.h"\r | |
13 | \r | |
39864b0b M |
14 | static int sniffState = SNF_INIT;\r |
15 | static uint8_t sniffUIDType;\r | |
c8b6da22 | 16 | static uint8_t sniffUID[8] = {0x00};\r |
17 | static uint8_t sniffATQA[2] = {0x00};\r | |
39864b0b | 18 | static uint8_t sniffSAK;\r |
c8b6da22 | 19 | static uint8_t sniffBuf[16] = {0x00};\r |
7bc95e2e | 20 | static uint32_t timerData = 0;\r |
b62a5a84 M |
21 | \r |
22 | \r | |
7bc95e2e | 23 | bool MfSniffInit(void){\r |
39864b0b M |
24 | memset(sniffUID, 0x00, 8);\r |
25 | memset(sniffATQA, 0x00, 2);\r | |
26 | sniffSAK = 0;\r | |
27 | sniffUIDType = SNF_UID_4;\r | |
28 | \r | |
7bc95e2e | 29 | return FALSE;\r |
39864b0b M |
30 | }\r |
31 | \r | |
7bc95e2e | 32 | bool MfSniffEnd(void){\r |
39864b0b | 33 | LED_B_ON();\r |
7bc95e2e | 34 | cmd_send(CMD_ACK,0,0,0,0,0);\r |
39864b0b M |
35 | LED_B_OFF();\r |
36 | \r | |
7bc95e2e | 37 | return FALSE;\r |
39864b0b M |
38 | }\r |
39 | \r | |
6a1f2d82 | 40 | bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint8_t *parity, uint16_t bitCnt, bool reader) {\r |
39864b0b | 41 | \r |
7bc95e2e | 42 | if (reader && (len == 1) && (bitCnt == 7)) { // reset on 7-Bit commands from reader\r |
39864b0b M |
43 | sniffState = SNF_INIT;\r |
44 | }\r | |
45 | \r | |
46 | switch (sniffState) {\r | |
47 | case SNF_INIT:{\r | |
7bc95e2e | 48 | if ((len == 1) && (reader) && (bitCnt == 7) ) { // REQA or WUPA from reader\r |
39864b0b M |
49 | sniffUIDType = SNF_UID_4;\r |
50 | memset(sniffUID, 0x00, 8);\r | |
51 | memset(sniffATQA, 0x00, 2);\r | |
52 | sniffSAK = 0;\r | |
39864b0b M |
53 | sniffState = SNF_WUPREQ;\r |
54 | }\r | |
55 | break;\r | |
56 | }\r | |
57 | case SNF_WUPREQ:{\r | |
7bc95e2e | 58 | if ((!reader) && (len == 2)) { // ATQA from tag\r |
39864b0b | 59 | memcpy(sniffATQA, data, 2);\r |
39864b0b M |
60 | sniffState = SNF_ATQA;\r |
61 | }\r | |
62 | break;\r | |
63 | }\r | |
64 | case SNF_ATQA:{\r | |
7bc95e2e | 65 | if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20)) { // Select ALL from reader\r |
39864b0b M |
66 | sniffState = SNF_ANTICOL1;\r |
67 | }\r | |
68 | break;\r | |
69 | }\r | |
70 | case SNF_ANTICOL1:{\r | |
7bc95e2e | 71 | if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // UID from tag (CL1) \r |
39864b0b | 72 | memcpy(sniffUID + 3, data, 4);\r |
39864b0b M |
73 | sniffState = SNF_UID1;\r |
74 | }\r | |
75 | break;\r | |
76 | }\r | |
77 | case SNF_UID1:{\r | |
7bc95e2e | 78 | if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 4 Byte UID from reader\r |
39864b0b M |
79 | sniffState = SNF_SAK;\r |
80 | }\r | |
81 | break;\r | |
82 | }\r | |
83 | case SNF_SAK:{\r | |
7bc95e2e | 84 | if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card?\r |
39864b0b | 85 | sniffSAK = data[0];\r |
7bc95e2e | 86 | if (sniffUID[3] == 0x88) { // CL2 UID part to be expected\r |
39864b0b | 87 | sniffState = SNF_ANTICOL2;\r |
7bc95e2e | 88 | } else { // select completed\r |
39864b0b M |
89 | sniffState = SNF_CARD_IDLE;\r |
90 | }\r | |
91 | }\r | |
92 | break;\r | |
93 | }\r | |
94 | case SNF_ANTICOL2:{\r | |
7bc95e2e | 95 | if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // CL2 UID \r |
d714d3ef | 96 | memcpy(sniffUID, sniffUID+4, 3);\r |
97 | memcpy(sniffUID+3, data, 4);\r | |
39864b0b | 98 | sniffUIDType = SNF_UID_7;\r |
39864b0b | 99 | sniffState = SNF_UID2;\r |
7bc95e2e | 100 | }\r |
39864b0b M |
101 | break;\r |
102 | }\r | |
103 | case SNF_UID2:{\r | |
7bc95e2e | 104 | if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 2nd part of 7 Byte UID\r |
39864b0b | 105 | sniffState = SNF_SAK;\r |
39864b0b M |
106 | }\r |
107 | break;\r | |
108 | }\r | |
7bc95e2e | 109 | case SNF_CARD_IDLE:{ // trace the card select sequence\r |
39864b0b M |
110 | sniffBuf[0] = 0xFF;\r |
111 | sniffBuf[1] = 0xFF;\r | |
112 | memcpy(sniffBuf + 2, sniffUID, 7);\r | |
113 | memcpy(sniffBuf + 9, sniffATQA, 2);\r | |
114 | sniffBuf[11] = sniffSAK;\r | |
115 | sniffBuf[12] = 0xFF;\r | |
116 | sniffBuf[13] = 0xFF;\r | |
6a1f2d82 | 117 | LogTrace(sniffBuf, 14, 0, 0, NULL, TRUE);\r |
7bc95e2e | 118 | } // intentionally no break;\r |
119 | case SNF_CARD_CMD:{ \r | |
6a1f2d82 | 120 | LogTrace(data, len, 0, 0, NULL, TRUE);\r |
39864b0b M |
121 | sniffState = SNF_CARD_RESP;\r |
122 | timerData = GetTickCount();\r | |
123 | break;\r | |
124 | }\r | |
125 | case SNF_CARD_RESP:{\r | |
6a1f2d82 | 126 | LogTrace(data, len, 0, 0, NULL, FALSE);\r |
39864b0b M |
127 | sniffState = SNF_CARD_CMD;\r |
128 | timerData = GetTickCount();\r | |
129 | break;\r | |
130 | }\r | |
131 | \r | |
132 | default:\r | |
133 | sniffState = SNF_INIT;\r | |
134 | break;\r | |
135 | }\r | |
136 | \r | |
7bc95e2e | 137 | \r |
138 | return FALSE;\r | |
39864b0b M |
139 | }\r |
140 | \r | |
7bc95e2e | 141 | bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) {\r |
3000dc4e | 142 | if (BigBuf_get_traceLen() && (GetTickCount() > timerData + maxTimeoutMs)) {\r |
39864b0b M |
143 | return intMfSniffSend();\r |
144 | }\r | |
7bc95e2e | 145 | return FALSE;\r |
39864b0b M |
146 | }\r |
147 | \r | |
7bc95e2e | 148 | // internal sending function. not a RAMFUNC.\r |
149 | bool intMfSniffSend() {\r | |
150 | \r | |
39864b0b | 151 | int pckSize = 0;\r |
3000dc4e | 152 | int pckLen = BigBuf_get_traceLen();\r |
39864b0b | 153 | int pckNum = 0;\r |
117d9ec2 | 154 | uint8_t *trace = BigBuf_get_addr();\r |
155 | \r | |
55acbb2a | 156 | FpgaDisableSscDma();\r |
39864b0b | 157 | while (pckLen > 0) {\r |
7bc95e2e | 158 | pckSize = MIN(USB_CMD_DATA_SIZE, pckLen);\r |
39864b0b | 159 | LED_B_ON();\r |
3000dc4e | 160 | cmd_send(CMD_ACK, 1, BigBuf_get_traceLen(), pckSize, trace + BigBuf_get_traceLen() - pckLen, pckSize);\r |
39864b0b M |
161 | LED_B_OFF();\r |
162 | \r | |
163 | pckLen -= pckSize;\r | |
164 | pckNum++;\r | |
165 | }\r | |
166 | \r | |
39864b0b | 167 | LED_B_ON();\r |
7bc95e2e | 168 | cmd_send(CMD_ACK,2,0,0,0,0);\r |
39864b0b M |
169 | LED_B_OFF();\r |
170 | \r | |
3000dc4e | 171 | clear_trace();\r |
39864b0b | 172 | \r |
7bc95e2e | 173 | return TRUE;\r |
39864b0b | 174 | }\r |