]> git.zerfleddert.de Git - proxmark3-svn/blame_incremental - armsrc/mifaresniff.c
CHG: experimenting with 'lf sim' It does send a signal now but...
[proxmark3-svn] / armsrc / mifaresniff.c
... / ...
CommitLineData
1//-----------------------------------------------------------------------------\r
2// Merlok - 2012\r
3//\r
4// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
5// at your option, any later version. See the LICENSE.txt file for the text of\r
6// the license.\r
7//-----------------------------------------------------------------------------\r
8// Routines to support mifare classic sniffer.\r
9//-----------------------------------------------------------------------------\r
10\r
11#include "mifaresniff.h"\r
12\r
13static int sniffState = SNF_INIT;\r
14static uint8_t sniffUIDType = 0;\r
15static uint8_t sniffUID[10] = {0,0,0,0,0,0,0,0,0,0};\r
16static uint8_t sniffATQA[2] = {0,0};\r
17static uint8_t sniffSAK = 0;\r
18static uint8_t sniffBuf[17];\r
19static uint32_t timerData = 0;\r
20\r
21void MfSniffInit(void){\r
22 memset(sniffUID, 0x00, sizeof(sniffUID));\r
23 memset(sniffATQA, 0x00, sizeof(sniffATQA));\r
24 memset(sniffBuf, 0x00, sizeof(sniffBuf));\r
25 sniffSAK = 0;\r
26 sniffUIDType = SNF_UID_4;\r
27}\r
28\r
29void MfSniffEnd(void){\r
30 LED_B_ON();\r
31 cmd_send(CMD_ACK,0,0,0,0,0);\r
32 LED_B_OFF();\r
33}\r
34\r
35bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint8_t *parity, uint16_t bitCnt, bool reader) {\r
36\r
37 // reset on 7-Bit commands from reader\r
38 if (reader && (len == 1) && (bitCnt == 7)) { \r
39 sniffState = SNF_INIT;\r
40 }\r
41\r
42 switch (sniffState) {\r
43 case SNF_INIT:{\r
44 // REQA or WUPA from reader\r
45 if ((len == 1) && (reader) && (bitCnt == 7) ) {\r
46 MfSniffInit();\r
47 sniffState = SNF_WUPREQ;\r
48 }\r
49 break;\r
50 }\r
51 case SNF_WUPREQ:{\r
52 // ATQA from tag\r
53 if ((!reader) && (len == 2)) {\r
54 sniffATQA[0] = data[0];\r
55 sniffATQA[1] = data[1];\r
56 sniffState = SNF_ATQA;\r
57 }\r
58 break;\r
59 }\r
60 case SNF_ATQA:{\r
61 // Select ALL from reader\r
62 if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20))\r
63 sniffState = SNF_ANTICOL1;\r
64 break;\r
65 }\r
66 case SNF_ANTICOL1:{\r
67 // UID from tag (CL1) \r
68 if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) {\r
69 memcpy(sniffUID, data, 4);\r
70 sniffState = SNF_UID1;\r
71 }\r
72 break;\r
73 }\r
74 case SNF_UID1:{\r
75 // Select 4 Byte UID from reader\r
76 if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9)))\r
77 sniffState = SNF_SAK;\r
78 break;\r
79 }\r
80 case SNF_SAK:{\r
81 if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card?\r
82 sniffSAK = data[0];\r
83 if (sniffUID[0] == 0x88) // CL2/3 UID part to be expected \r
84 sniffState = (sniffState == SNF_ANTICOL2 ) ? SNF_ANTICOL3 : SNF_ANTICOL2;\r
85 else // select completed\r
86 sniffState = SNF_CARD_IDLE;\r
87 }\r
88 break;\r
89 }\r
90 case SNF_ANTICOL2:{\r
91 // CL2 UID \r
92 if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) {\r
93 sniffUID[0] = sniffUID[1];\r
94 sniffUID[1] = sniffUID[2];\r
95 sniffUID[2] = sniffUID[3];\r
96 memcpy(sniffUID+3, data, 4);\r
97 sniffUIDType = SNF_UID_7;\r
98 sniffState = SNF_UID2;\r
99 }\r
100 break;\r
101 }\r
102 case SNF_UID2:{\r
103 // Select 2nd part of 7 Byte UID\r
104 if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9)))\r
105 sniffState = SNF_SAK;\r
106 break;\r
107 }\r
108 case SNF_ANTICOL3:{\r
109 // CL3 UID \r
110 if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { \r
111 // 3+3+4 = 10.\r
112 sniffUID[3] = sniffUID[4];\r
113 sniffUID[4] = sniffUID[5];\r
114 sniffUID[5] = sniffUID[6];\r
115 memcpy(sniffUID+6, data, 4);\r
116 sniffUIDType = SNF_UID_10;\r
117 sniffState = SNF_UID3;\r
118 }\r
119 break;\r
120 }\r
121 case SNF_UID3:{\r
122 // Select 3nd part of 10 Byte UID\r
123 if ((reader) && (len == 9) && (data[0] == 0x97) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9)))\r
124 sniffState = SNF_SAK;\r
125 break;\r
126 }\r
127 case SNF_CARD_IDLE:{ // trace the card select sequence\r
128 sniffBuf[0] = 0xFF;\r
129 sniffBuf[1] = 0xFF;\r
130 memcpy(sniffBuf + 2, sniffUID, sizeof(sniffUID));\r
131 memcpy(sniffBuf + 12, sniffATQA, sizeof(sniffATQA));\r
132 sniffBuf[14] = sniffSAK;\r
133 sniffBuf[15] = 0xFF;\r
134 sniffBuf[16] = 0xFF;\r
135 LogTrace(sniffBuf, sizeof(sniffBuf), 0, 0, NULL, TRUE);\r
136 } // intentionally no break;\r
137 case SNF_CARD_CMD:{ \r
138 LogTrace(data, len, 0, 0, NULL, TRUE);\r
139 sniffState = SNF_CARD_RESP;\r
140 timerData = GetTickCount();\r
141 break;\r
142 }\r
143 case SNF_CARD_RESP:{\r
144 LogTrace(data, len, 0, 0, NULL, FALSE);\r
145 sniffState = SNF_CARD_CMD;\r
146 timerData = GetTickCount();\r
147 break;\r
148 }\r
149 default:\r
150 sniffState = SNF_INIT;\r
151 break;\r
152 }\r
153 return FALSE;\r
154}\r
155\r
156bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) {\r
157 if (BigBuf_get_traceLen() && (GetTickCount() > timerData + maxTimeoutMs)) {\r
158 return intMfSniffSend();\r
159 }\r
160 return FALSE;\r
161}\r
162\r
163// internal sending function. not a RAMFUNC.\r
164bool intMfSniffSend() {\r
165\r
166 int pckSize = 0;\r
167 int pckLen = BigBuf_get_traceLen();\r
168 int pckNum = 0;\r
169 uint8_t *data = BigBuf_get_addr();\r
170 \r
171 FpgaDisableSscDma();\r
172 while (pckLen > 0) {\r
173 pckSize = MIN(USB_CMD_DATA_SIZE, pckLen);\r
174 LED_B_ON();\r
175 cmd_send(CMD_ACK, 1, BigBuf_get_traceLen(), pckSize, data + BigBuf_get_traceLen() - pckLen, pckSize);\r
176 LED_B_OFF();\r
177 pckLen -= pckSize;\r
178 pckNum++;\r
179 }\r
180\r
181 LED_B_ON();\r
182 cmd_send(CMD_ACK,2,0,0,0,0); // 2 == data transfer is finished.\r
183 LED_B_OFF();\r
184\r
185 clear_trace();\r
186 return TRUE;\r
187}\r
Impressum, Datenschutz