| | 1 | //-----------------------------------------------------------------------------\r |
| | 2 | // Merlok - 2012\r |
| | 3 | //\r |
| | 4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or,\r |
| | 5 | // at your option, any later version. See the LICENSE.txt file for the text of\r |
| | 6 | // the license.\r |
| | 7 | //-----------------------------------------------------------------------------\r |
| | 8 | // Routines to support mifare classic sniffer.\r |
| | 9 | //-----------------------------------------------------------------------------\r |
| | 10 | \r |
| | 11 | #include "mifaresniff.h"\r |
| | 12 | #include "apps.h"\r |
| | 13 | \r |
| | 14 | static int sniffState = SNF_INIT;\r |
| | 15 | static uint8_t sniffUIDType;\r |
| | 16 | static uint8_t sniffUID[8];\r |
| | 17 | static uint8_t sniffATQA[2];\r |
| | 18 | static uint8_t sniffSAK;\r |
| | 19 | static uint8_t sniffBuf[16];\r |
| | 20 | static uint32_t timerData = 0;\r |
| | 21 | \r |
| | 22 | \r |
| | 23 | bool MfSniffInit(void){\r |
| | 24 | memset(sniffUID, 0x00, 8);\r |
| | 25 | memset(sniffATQA, 0x00, 2);\r |
| | 26 | sniffSAK = 0;\r |
| | 27 | sniffUIDType = SNF_UID_4;\r |
| | 28 | \r |
| | 29 | return FALSE;\r |
| | 30 | }\r |
| | 31 | \r |
| | 32 | bool MfSniffEnd(void){\r |
| | 33 | LED_B_ON();\r |
| | 34 | cmd_send(CMD_ACK,0,0,0,0,0);\r |
| | 35 | LED_B_OFF();\r |
| | 36 | \r |
| | 37 | return FALSE;\r |
| | 38 | }\r |
| | 39 | \r |
| | 40 | bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint32_t parity, uint16_t bitCnt, bool reader) {\r |
| | 41 | \r |
| | 42 | if (reader && (len == 1) && (bitCnt == 7)) { // reset on 7-Bit commands from reader\r |
| | 43 | sniffState = SNF_INIT;\r |
| | 44 | }\r |
| | 45 | \r |
| | 46 | switch (sniffState) {\r |
| | 47 | case SNF_INIT:{\r |
| | 48 | if ((len == 1) && (reader) && (bitCnt == 7) ) { // REQA or WUPA from reader\r |
| | 49 | sniffUIDType = SNF_UID_4;\r |
| | 50 | memset(sniffUID, 0x00, 8);\r |
| | 51 | memset(sniffATQA, 0x00, 2);\r |
| | 52 | sniffSAK = 0;\r |
| | 53 | sniffState = SNF_WUPREQ;\r |
| | 54 | }\r |
| | 55 | break;\r |
| | 56 | }\r |
| | 57 | case SNF_WUPREQ:{\r |
| | 58 | if ((!reader) && (len == 2)) { // ATQA from tag\r |
| | 59 | memcpy(sniffATQA, data, 2);\r |
| | 60 | sniffState = SNF_ATQA;\r |
| | 61 | }\r |
| | 62 | break;\r |
| | 63 | }\r |
| | 64 | case SNF_ATQA:{\r |
| | 65 | if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20)) { // Select ALL from reader\r |
| | 66 | sniffState = SNF_ANTICOL1;\r |
| | 67 | }\r |
| | 68 | break;\r |
| | 69 | }\r |
| | 70 | case SNF_ANTICOL1:{\r |
| | 71 | if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // UID from tag (CL1) \r |
| | 72 | memcpy(sniffUID + 3, data, 4);\r |
| | 73 | sniffState = SNF_UID1;\r |
| | 74 | }\r |
| | 75 | break;\r |
| | 76 | }\r |
| | 77 | case SNF_UID1:{\r |
| | 78 | if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 4 Byte UID from reader\r |
| | 79 | sniffState = SNF_SAK;\r |
| | 80 | }\r |
| | 81 | break;\r |
| | 82 | }\r |
| | 83 | case SNF_SAK:{\r |
| | 84 | if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card?\r |
| | 85 | sniffSAK = data[0];\r |
| | 86 | if (sniffUID[3] == 0x88) { // CL2 UID part to be expected\r |
| | 87 | sniffState = SNF_ANTICOL2;\r |
| | 88 | } else { // select completed\r |
| | 89 | sniffState = SNF_CARD_IDLE;\r |
| | 90 | }\r |
| | 91 | }\r |
| | 92 | break;\r |
| | 93 | }\r |
| | 94 | case SNF_ANTICOL2:{\r |
| | 95 | if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // CL2 UID \r |
| | 96 | memcpy(sniffUID, data, 4);\r |
| | 97 | sniffUIDType = SNF_UID_7;\r |
| | 98 | sniffState = SNF_UID2;\r |
| | 99 | }\r |
| | 100 | break;\r |
| | 101 | }\r |
| | 102 | case SNF_UID2:{\r |
| | 103 | if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 2nd part of 7 Byte UID\r |
| | 104 | sniffState = SNF_SAK;\r |
| | 105 | }\r |
| | 106 | break;\r |
| | 107 | }\r |
| | 108 | case SNF_CARD_IDLE:{ // trace the card select sequence\r |
| | 109 | sniffBuf[0] = 0xFF;\r |
| | 110 | sniffBuf[1] = 0xFF;\r |
| | 111 | memcpy(sniffBuf + 2, sniffUID, 7);\r |
| | 112 | memcpy(sniffBuf + 9, sniffATQA, 2);\r |
| | 113 | sniffBuf[11] = sniffSAK;\r |
| | 114 | sniffBuf[12] = 0xFF;\r |
| | 115 | sniffBuf[13] = 0xFF;\r |
| | 116 | LogTrace(sniffBuf, 14, 0, parity, true);\r |
| | 117 | } // intentionally no break;\r |
| | 118 | case SNF_CARD_CMD:{ \r |
| | 119 | LogTrace(data, len, 0, parity, true);\r |
| | 120 | sniffState = SNF_CARD_RESP;\r |
| | 121 | timerData = GetTickCount();\r |
| | 122 | break;\r |
| | 123 | }\r |
| | 124 | case SNF_CARD_RESP:{\r |
| | 125 | LogTrace(data, len, 0, parity, false);\r |
| | 126 | sniffState = SNF_CARD_CMD;\r |
| | 127 | timerData = GetTickCount();\r |
| | 128 | break;\r |
| | 129 | }\r |
| | 130 | \r |
| | 131 | default:\r |
| | 132 | sniffState = SNF_INIT;\r |
| | 133 | break;\r |
| | 134 | }\r |
| | 135 | \r |
| | 136 | \r |
| | 137 | return FALSE;\r |
| | 138 | }\r |
| | 139 | \r |
| | 140 | bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) {\r |
| | 141 | if (traceLen && (GetTickCount() > timerData + maxTimeoutMs)) {\r |
| | 142 | return intMfSniffSend();\r |
| | 143 | }\r |
| | 144 | return FALSE;\r |
| | 145 | }\r |
| | 146 | \r |
| | 147 | // internal sending function. not a RAMFUNC.\r |
| | 148 | bool intMfSniffSend() {\r |
| | 149 | \r |
| | 150 | int pckSize = 0;\r |
| | 151 | int pckLen = traceLen;\r |
| | 152 | int pckNum = 0;\r |
| | 153 | \r |
| | 154 | FpgaDisableSscDma();\r |
| | 155 | while (pckLen > 0) {\r |
| | 156 | pckSize = MIN(USB_CMD_DATA_SIZE, pckLen);\r |
| | 157 | LED_B_ON();\r |
| | 158 | cmd_send(CMD_ACK, 1, pckSize, pckNum, trace + traceLen - pckLen, pckSize);\r |
| | 159 | LED_B_OFF();\r |
| | 160 | \r |
| | 161 | pckLen -= pckSize;\r |
| | 162 | pckNum++;\r |
| | 163 | }\r |
| | 164 | \r |
| | 165 | LED_B_ON();\r |
| | 166 | cmd_send(CMD_ACK,2,0,0,0,0);\r |
| | 167 | LED_B_OFF();\r |
| | 168 | \r |
| | 169 | iso14a_clear_trace();\r |
| | 170 | \r |
| | 171 | return TRUE;\r |
| | 172 | }\r |
projects / proxmark3-svn / blame_incremental