]>
Commit | Line | Data |
---|---|---|
1 | //----------------------------------------------------------------------------- | |
2 | // Merlok - 2012 | |
3 | // | |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
5 | // at your option, any later version. See the LICENSE.txt file for the text of | |
6 | // the license. | |
7 | //----------------------------------------------------------------------------- | |
8 | // Routines to support mifare classic sniffer. | |
9 | //----------------------------------------------------------------------------- | |
10 | ||
11 | #include "mifaresniff.h" | |
12 | #include "apps.h" | |
13 | #include "proxmark3.h" | |
14 | #include "util.h" | |
15 | #include "string.h" | |
16 | #include "iso14443crc.h" | |
17 | #include "iso14443a.h" | |
18 | #include "crapto1/crapto1.h" | |
19 | #include "mifareutil.h" | |
20 | #include "common.h" | |
21 | ||
22 | ||
23 | static int sniffState = SNF_INIT; | |
24 | static uint8_t sniffUIDType; | |
25 | static uint8_t sniffUID[8] = {0x00}; | |
26 | static uint8_t sniffATQA[2] = {0x00}; | |
27 | static uint8_t sniffSAK; | |
28 | static uint8_t sniffBuf[16] = {0x00}; | |
29 | static uint32_t timerData = 0; | |
30 | ||
31 | ||
32 | bool MfSniffInit(void){ | |
33 | memset(sniffUID, 0x00, 8); | |
34 | memset(sniffATQA, 0x00, 2); | |
35 | sniffSAK = 0; | |
36 | sniffUIDType = SNF_UID_4; | |
37 | ||
38 | return FALSE; | |
39 | } | |
40 | ||
41 | bool MfSniffEnd(void){ | |
42 | LED_B_ON(); | |
43 | cmd_send(CMD_ACK,0,0,0,0,0); | |
44 | LED_B_OFF(); | |
45 | ||
46 | return FALSE; | |
47 | } | |
48 | ||
49 | bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint8_t *parity, uint16_t bitCnt, bool reader) { | |
50 | ||
51 | if (reader && (len == 1) && (bitCnt == 7)) { // reset on 7-Bit commands from reader | |
52 | sniffState = SNF_INIT; | |
53 | } | |
54 | ||
55 | switch (sniffState) { | |
56 | case SNF_INIT:{ | |
57 | if ((len == 1) && (reader) && (bitCnt == 7) ) { // REQA or WUPA from reader | |
58 | sniffUIDType = SNF_UID_4; | |
59 | memset(sniffUID, 0x00, 8); | |
60 | memset(sniffATQA, 0x00, 2); | |
61 | sniffSAK = 0; | |
62 | sniffState = SNF_WUPREQ; | |
63 | } | |
64 | break; | |
65 | } | |
66 | case SNF_WUPREQ:{ | |
67 | if ((!reader) && (len == 2)) { // ATQA from tag | |
68 | memcpy(sniffATQA, data, 2); | |
69 | sniffState = SNF_ATQA; | |
70 | } | |
71 | break; | |
72 | } | |
73 | case SNF_ATQA: | |
74 | case SNF_UID1:{\r | |
75 | // SNF_ATQA\r | |
76 | if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20)) { // Select ALL from reader | |
77 | sniffState = SNF_ANTICOL1; | |
78 | }\r | |
79 | \r | |
80 | // SNF_UID1 | |
81 | if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 4 Byte UID from reader\r | |
82 | memcpy(sniffUID + 3, &data[2], 4);\r | |
83 | sniffState = SNF_SAK;\r | |
84 | }\r | |
85 | break; | |
86 | }\r | |
87 | case SNF_ANTICOL1:{ | |
88 | if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // UID from tag (CL1) | |
89 | memcpy(sniffUID + 3, data, 4); | |
90 | sniffState = SNF_UID1; | |
91 | } | |
92 | break; | |
93 | } | |
94 | case SNF_SAK:{ | |
95 | if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card? | |
96 | sniffSAK = data[0]; | |
97 | if ((sniffUID[3] == 0x88) && (sniffUIDType == SNF_UID_4)) { // CL2 UID part to be expected | |
98 | sniffUIDType = SNF_UID_7;\r | |
99 | memcpy(sniffUID, sniffUID + 4, 3);\r | |
100 | sniffState = SNF_UID2; | |
101 | } else { // select completed | |
102 | sniffState = SNF_CARD_IDLE; | |
103 | } | |
104 | } | |
105 | break; | |
106 | } | |
107 | case SNF_ANTICOL2:{ | |
108 | if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // CL2 UID | |
109 | memcpy(sniffUID + 3, data, 4);\r | |
110 | sniffState = SNF_UID2; | |
111 | } | |
112 | break; | |
113 | } | |
114 | case SNF_UID2:{\r | |
115 | if ((reader) && (len == 2) && (data[0] == 0x95) && (data[1] == 0x20)) {\r | |
116 | sniffState = SNF_ANTICOL2;\r | |
117 | }\r | |
118 | \r | |
119 | if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) {\r | |
120 | memcpy(sniffUID + 3, &data[2], 4);\r | |
121 | sniffState = SNF_SAK;\r | |
122 | }\r | |
123 | break;\r | |
124 | }\r | |
125 | case SNF_CARD_IDLE:{ // trace the card select sequence | |
126 | sniffBuf[0] = 0xFF; | |
127 | sniffBuf[1] = 0xFF; | |
128 | memcpy(sniffBuf + 2, sniffUID, 7); | |
129 | memcpy(sniffBuf + 9, sniffATQA, 2); | |
130 | sniffBuf[11] = sniffSAK; | |
131 | sniffBuf[12] = 0xFF; | |
132 | sniffBuf[13] = 0xFF; | |
133 | LogTrace(sniffBuf, 14, 0, 0, NULL, TRUE); | |
134 | sniffState = SNF_CARD_CMD; | |
135 | } // intentionally no break; | |
136 | case SNF_CARD_CMD:{ | |
137 | LogTrace(data, len, 0, 0, NULL, reader); | |
138 | timerData = GetTickCount(); | |
139 | break; | |
140 | } | |
141 | ||
142 | default: | |
143 | sniffState = SNF_INIT; | |
144 | break; | |
145 | } | |
146 | ||
147 | ||
148 | return FALSE; | |
149 | } | |
150 | ||
151 | bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) { | |
152 | if (BigBuf_get_traceLen() && (GetTickCount() > timerData + maxTimeoutMs)) { | |
153 | return intMfSniffSend(); | |
154 | } | |
155 | return FALSE; | |
156 | } | |
157 | ||
158 | // internal sending function. not a RAMFUNC. | |
159 | bool intMfSniffSend() { | |
160 | ||
161 | int pckSize = 0; | |
162 | int pckLen = BigBuf_get_traceLen(); | |
163 | int pckNum = 0; | |
164 | uint8_t *trace = BigBuf_get_addr(); | |
165 | ||
166 | FpgaDisableSscDma(); | |
167 | while (pckLen > 0) { | |
168 | pckSize = MIN(USB_CMD_DATA_SIZE, pckLen); | |
169 | LED_B_ON(); | |
170 | cmd_send(CMD_ACK, 1, BigBuf_get_traceLen(), pckSize, trace + BigBuf_get_traceLen() - pckLen, pckSize); | |
171 | LED_B_OFF(); | |
172 | ||
173 | pckLen -= pckSize; | |
174 | pckNum++; | |
175 | } | |
176 | ||
177 | LED_B_ON(); | |
178 | cmd_send(CMD_ACK,2,0,0,0,0); | |
179 | LED_B_OFF(); | |
180 | ||
181 | clear_trace(); | |
182 | ||
183 | return TRUE; | |
184 | } |