]> git.zerfleddert.de Git - proxmark3-svn/blame - armsrc/mifaresniff.c
CHG: moved out some usage_methods for help texts.
[proxmark3-svn] / armsrc / mifaresniff.c
CommitLineData
b62a5a84
M
1//-----------------------------------------------------------------------------\r
2// Merlok - 2012\r
3//\r
4// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
5// at your option, any later version. See the LICENSE.txt file for the text of\r
6// the license.\r
7//-----------------------------------------------------------------------------\r
8// Routines to support mifare classic sniffer.\r
9//-----------------------------------------------------------------------------\r
10\r
11#include "mifaresniff.h"\r
12#include "apps.h"\r
13\r
39864b0b 14static int sniffState = SNF_INIT;\r
13fc2e9c 15static uint8_t sniffUIDType = 0;\r
16static uint8_t sniffUID[10] = {0,0,0,0,0,0,0,0,0,0};\r
17static uint8_t sniffATQA[2] = {0,0};\r
18static uint8_t sniffSAK = 0;\r
c01d8e21 19static uint8_t sniffBuf[17];\r
13fc2e9c 20static uint32_t timerData = 0;\r
21\r
13fc2e9c 22void MfSniffInit(void){\r
23 memset(sniffUID, 0x00, sizeof(sniffUID));\r
24 memset(sniffATQA, 0x00, sizeof(sniffATQA));\r
25 memset(sniffBuf, 0x00, sizeof(sniffBuf));\r
39864b0b
M
26 sniffSAK = 0;\r
27 sniffUIDType = SNF_UID_4;\r
39864b0b
M
28}\r
29\r
13fc2e9c 30void MfSniffEnd(void){\r
39864b0b 31 LED_B_ON();\r
7bc95e2e 32 cmd_send(CMD_ACK,0,0,0,0,0);\r
39864b0b 33 LED_B_OFF();\r
39864b0b
M
34}\r
35\r
6a1f2d82 36bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint8_t *parity, uint16_t bitCnt, bool reader) {\r
39864b0b 37\r
13fc2e9c 38 // reset on 7-Bit commands from reader\r
39 if (reader && (len == 1) && (bitCnt == 7)) { \r
39864b0b
M
40 sniffState = SNF_INIT;\r
41 }\r
42\r
43 switch (sniffState) {\r
44 case SNF_INIT:{\r
13fc2e9c 45 // REQA or WUPA from reader\r
46 if ((len == 1) && (reader) && (bitCnt == 7) ) {\r
47 MfSniffInit();\r
39864b0b
M
48 sniffState = SNF_WUPREQ;\r
49 }\r
50 break;\r
51 }\r
52 case SNF_WUPREQ:{\r
13fc2e9c 53 // ATQA from tag\r
54 if ((!reader) && (len == 2)) {\r
55 sniffATQA[0] = data[0];\r
56 sniffATQA[1] = data[1];\r
39864b0b
M
57 sniffState = SNF_ATQA;\r
58 }\r
59 break;\r
60 }\r
61 case SNF_ATQA:{\r
13fc2e9c 62 // Select ALL from reader\r
c01d8e21 63 if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20))\r
39864b0b 64 sniffState = SNF_ANTICOL1;\r
39864b0b
M
65 break;\r
66 }\r
67 case SNF_ANTICOL1:{\r
13fc2e9c 68 // UID from tag (CL1) \r
69 if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) {\r
c01d8e21 70 memcpy(sniffUID, data, 4);\r
39864b0b
M
71 sniffState = SNF_UID1;\r
72 }\r
73 break;\r
74 }\r
75 case SNF_UID1:{\r
13fc2e9c 76 // Select 4 Byte UID from reader\r
c01d8e21 77 if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9)))\r
39864b0b 78 sniffState = SNF_SAK;\r
39864b0b
M
79 break;\r
80 }\r
81 case SNF_SAK:{\r
7bc95e2e 82 if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card?\r
39864b0b 83 sniffSAK = data[0];\r
c01d8e21 84 if (sniffUID[0] == 0x88) // CL2/3 UID part to be expected \r
85 sniffState = (sniffState == SNF_ANTICOL2 ) ? SNF_ANTICOL3 : SNF_ANTICOL2;\r
86 else // select completed\r
39864b0b 87 sniffState = SNF_CARD_IDLE;\r
39864b0b
M
88 }\r
89 break;\r
90 }\r
91 case SNF_ANTICOL2:{\r
13fc2e9c 92 // CL2 UID \r
93 if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) {\r
c01d8e21 94 sniffUID[0] = sniffUID[1];\r
95 sniffUID[1] = sniffUID[2];\r
96 sniffUID[2] = sniffUID[3];\r
d714d3ef 97 memcpy(sniffUID+3, data, 4);\r
39864b0b 98 sniffUIDType = SNF_UID_7;\r
39864b0b 99 sniffState = SNF_UID2;\r
7bc95e2e 100 }\r
39864b0b
M
101 break;\r
102 }\r
103 case SNF_UID2:{\r
13fc2e9c 104 // Select 2nd part of 7 Byte UID\r
c01d8e21 105 if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9)))\r
13fc2e9c 106 sniffState = SNF_SAK;\r
13fc2e9c 107 break;\r
108 }\r
109 case SNF_ANTICOL3:{\r
110 // CL3 UID \r
111 if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { \r
c01d8e21 112 // 3+3+4 = 10.\r
113 sniffUID[3] = sniffUID[4];\r
114 sniffUID[4] = sniffUID[5];\r
115 sniffUID[5] = sniffUID[6];\r
116 memcpy(sniffUID+6, data, 4);\r
13fc2e9c 117 sniffUIDType = SNF_UID_10;\r
118 sniffState = SNF_UID3;\r
119 }\r
120 break;\r
121 }\r
122 case SNF_UID3:{\r
123 // Select 3nd part of 10 Byte UID\r
c01d8e21 124 if ((reader) && (len == 9) && (data[0] == 0x97) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9)))\r
39864b0b 125 sniffState = SNF_SAK;\r
39864b0b
M
126 break;\r
127 }\r
7bc95e2e 128 case SNF_CARD_IDLE:{ // trace the card select sequence\r
39864b0b
M
129 sniffBuf[0] = 0xFF;\r
130 sniffBuf[1] = 0xFF;\r
13fc2e9c 131 memcpy(sniffBuf + 2, sniffUID, sizeof(sniffUID));\r
c01d8e21 132 memcpy(sniffBuf + 12, sniffATQA, sizeof(sniffATQA));\r
13fc2e9c 133 sniffBuf[14] = sniffSAK;\r
134 sniffBuf[15] = 0xFF;\r
135 sniffBuf[16] = 0xFF;\r
136 LogTrace(sniffBuf, sizeof(sniffBuf), 0, 0, NULL, TRUE);\r
7bc95e2e 137 } // intentionally no break;\r
138 case SNF_CARD_CMD:{ \r
6a1f2d82 139 LogTrace(data, len, 0, 0, NULL, TRUE);\r
39864b0b
M
140 sniffState = SNF_CARD_RESP;\r
141 timerData = GetTickCount();\r
142 break;\r
143 }\r
144 case SNF_CARD_RESP:{\r
6a1f2d82 145 LogTrace(data, len, 0, 0, NULL, FALSE);\r
39864b0b
M
146 sniffState = SNF_CARD_CMD;\r
147 timerData = GetTickCount();\r
148 break;\r
149 }\r
39864b0b
M
150 default:\r
151 sniffState = SNF_INIT;\r
152 break;\r
153 }\r
7bc95e2e 154 return FALSE;\r
39864b0b
M
155}\r
156\r
7bc95e2e 157bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) {\r
3000dc4e 158 if (BigBuf_get_traceLen() && (GetTickCount() > timerData + maxTimeoutMs)) {\r
39864b0b
M
159 return intMfSniffSend();\r
160 }\r
7bc95e2e 161 return FALSE;\r
39864b0b
M
162}\r
163\r
7bc95e2e 164// internal sending function. not a RAMFUNC.\r
165bool intMfSniffSend() {\r
166\r
39864b0b 167 int pckSize = 0;\r
3000dc4e 168 int pckLen = BigBuf_get_traceLen();\r
39864b0b 169 int pckNum = 0;\r
c01d8e21 170 uint8_t *data = BigBuf_get_addr();\r
117d9ec2 171 \r
55acbb2a 172 FpgaDisableSscDma();\r
39864b0b 173 while (pckLen > 0) {\r
7bc95e2e 174 pckSize = MIN(USB_CMD_DATA_SIZE, pckLen);\r
39864b0b 175 LED_B_ON();\r
c01d8e21 176 cmd_send(CMD_ACK, 1, BigBuf_get_traceLen(), pckSize, data + BigBuf_get_traceLen() - pckLen, pckSize);\r
39864b0b 177 LED_B_OFF();\r
39864b0b
M
178 pckLen -= pckSize;\r
179 pckNum++;\r
180 }\r
181\r
39864b0b 182 LED_B_ON();\r
c01d8e21 183 cmd_send(CMD_ACK,2,0,0,0,0); // 2 == data transfer is finished.\r
39864b0b
M
184 LED_B_OFF();\r
185\r
3000dc4e 186 clear_trace();\r
7bc95e2e 187 return TRUE;\r
39864b0b 188}\r
Impressum, Datenschutz