git.zerfleddert.de Git - proxmark3-svn/blame_incremental

... / ...

Commit	Line	Data
	1	//-----------------------------------------------------------------------------\r
	2	// Merlok - 2012\r
	3	//\r
	4	// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
	5	// at your option, any later version. See the LICENSE.txt file for the text of\r
	6	// the license.\r
	7	//-----------------------------------------------------------------------------\r
	8	// Routines to support mifare classic sniffer.\r
	9	//-----------------------------------------------------------------------------\r
	10	\r
	11	#include "mifaresniff.h"\r
	12	#include "apps.h"\r
	13	\r
	14	static int sniffState = SNF_INIT;\r
	15	static uint8_t sniffUIDType;\r
	16	static uint8_t sniffUID[8];\r
	17	static uint8_t sniffATQA[2];\r
	18	static uint8_t sniffSAK;\r
	19	static uint8_t sniffBuf[16];\r
	20	static uint32_t timerData;\r
	21	\r
	22	\r
	23	bool MfSniffInit(void){\r
	24	memset(sniffUID, 0x00, 8);\r
	25	memset(sniffATQA, 0x00, 2);\r
	26	sniffSAK = 0;\r
	27	sniffUIDType = SNF_UID_4;\r
	28	\r
	29	return FALSE;\r
	30	}\r
	31	\r
	32	bool MfSniffEnd(void){\r
	33	LED_B_ON();\r
	34	cmd_send(CMD_ACK,0,0,0,0,0);\r
	35	LED_B_OFF();\r
	36	\r
	37	return FALSE;\r
	38	}\r
	39	\r
	40	bool RAMFUNC MfSniffLogic(const uint8_t data, uint16_t len, uint8_t parity, uint16_t bitCnt, bool reader) {\r
	41	\r
	42	if (reader && (len == 1) && (bitCnt == 7)) { // reset on 7-Bit commands from reader\r
	43	sniffState = SNF_INIT;\r
	44	}\r
	45	\r
	46	switch (sniffState) {\r
	47	case SNF_INIT:{\r
	48	if ((len == 1) && (reader) && (bitCnt == 7) ) { // REQA or WUPA from reader\r
	49	sniffUIDType = SNF_UID_4;\r
	50	memset(sniffUID, 0x00, 8);\r
	51	memset(sniffATQA, 0x00, 2);\r
	52	sniffSAK = 0;\r
	53	sniffState = SNF_WUPREQ;\r
	54	}\r
	55	break;\r
	56	}\r
	57	case SNF_WUPREQ:{\r
	58	if ((!reader) && (len == 2)) { // ATQA from tag\r
	59	memcpy(sniffATQA, data, 2);\r
	60	sniffState = SNF_ATQA;\r
	61	}\r
	62	break;\r
	63	}\r
	64	case SNF_ATQA:{\r
	65	if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20)) { // Select ALL from reader\r
	66	sniffState = SNF_ANTICOL1;\r
	67	}\r
	68	break;\r
	69	}\r
	70	case SNF_ANTICOL1:{\r
	71	if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // UID from tag (CL1) \r
	72	memcpy(sniffUID + 3, data, 4);\r
	73	sniffState = SNF_UID1;\r
	74	}\r
	75	break;\r
	76	}\r
	77	case SNF_UID1:{\r
	78	if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 4 Byte UID from reader\r
	79	sniffState = SNF_SAK;\r
	80	}\r
	81	break;\r
	82	}\r
	83	case SNF_SAK:{\r
	84	if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card?\r
	85	sniffSAK = data[0];\r
	86	if (sniffUID[3] == 0x88) { // CL2 UID part to be expected\r
	87	sniffState = SNF_ANTICOL2;\r
	88	} else { // select completed\r
	89	sniffState = SNF_CARD_IDLE;\r
	90	}\r
	91	}\r
	92	break;\r
	93	}\r
	94	case SNF_ANTICOL2:{\r
	95	if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // CL2 UID \r
	96	memcpy(sniffUID, sniffUID+4, 3);\r
	97	memcpy(sniffUID+3, data, 4);\r
	98	sniffUIDType = SNF_UID_7;\r
	99	sniffState = SNF_UID2;\r
	100	}\r
	101	break;\r
	102	}\r
	103	case SNF_UID2:{\r
	104	if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 2nd part of 7 Byte UID\r
	105	sniffState = SNF_SAK;\r
	106	}\r
	107	break;\r
	108	}\r
	109	case SNF_CARD_IDLE:{ // trace the card select sequence\r
	110	sniffBuf[0] = 0xFF;\r
	111	sniffBuf[1] = 0xFF;\r
	112	memcpy(sniffBuf + 2, sniffUID, 7);\r
	113	memcpy(sniffBuf + 9, sniffATQA, 2);\r
	114	sniffBuf[11] = sniffSAK;\r
	115	sniffBuf[12] = 0xFF;\r
	116	sniffBuf[13] = 0xFF;\r
	117	LogTrace(sniffBuf, 14, 0, 0, NULL, TRUE);\r
	118	} // intentionally no break;\r
	119	case SNF_CARD_CMD:{ \r
	120	LogTrace(data, len, 0, 0, NULL, TRUE);\r
	121	sniffState = SNF_CARD_RESP;\r
	122	timerData = GetTickCount();\r
	123	break;\r
	124	}\r
	125	case SNF_CARD_RESP:{\r
	126	LogTrace(data, len, 0, 0, NULL, FALSE);\r
	127	sniffState = SNF_CARD_CMD;\r
	128	timerData = GetTickCount();\r
	129	break;\r
	130	}\r
	131	\r
	132	default:\r
	133	sniffState = SNF_INIT;\r
	134	break;\r
	135	}\r
	136	\r
	137	\r
	138	return FALSE;\r
	139	}\r
	140	\r
	141	bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) {\r
	142	if (BigBuf_get_traceLen() && (GetTickCount() > timerData + maxTimeoutMs)) {\r
	143	return intMfSniffSend();\r
	144	}\r
	145	return FALSE;\r
	146	}\r
	147	\r
	148	// internal sending function. not a RAMFUNC.\r
	149	bool intMfSniffSend() {\r
	150	\r
	151	int pckSize = 0;\r
	152	int pckLen = BigBuf_get_traceLen();\r
	153	int pckNum = 0;\r
	154	uint8_t *trace = BigBuf_get_addr();\r
	155	\r
	156	FpgaDisableSscDma();\r
	157	while (pckLen > 0) {\r
	158	pckSize = MIN(USB_CMD_DATA_SIZE, pckLen);\r
	159	LED_B_ON();\r
	160	cmd_send(CMD_ACK, 1, BigBuf_get_traceLen(), pckSize, trace + BigBuf_get_traceLen() - pckLen, pckSize);\r
	161	LED_B_OFF();\r
	162	\r
	163	pckLen -= pckSize;\r
	164	pckNum++;\r
	165	}\r
	166	\r
	167	LED_B_ON();\r
	168	cmd_send(CMD_ACK,2,0,0,0,0);\r
	169	LED_B_OFF();\r
	170	\r
	171	clear_trace();\r
	172	return TRUE;\r
	173	}\r