| | 1 | //-----------------------------------------------------------------------------\r |
| | 2 | // Merlok - 2012\r |
| | 3 | //\r |
| | 4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or,\r |
| | 5 | // at your option, any later version. See the LICENSE.txt file for the text of\r |
| | 6 | // the license.\r |
| | 7 | //-----------------------------------------------------------------------------\r |
| | 8 | // Routines to support mifare classic sniffer.\r |
| | 9 | //-----------------------------------------------------------------------------\r |
| | 10 | \r |
| | 11 | #include "mifaresniff.h"\r |
| | 12 | #include "apps.h"\r |
| | 13 | \r |
| | 14 | static int sniffState = SNF_INIT;\r |
| | 15 | static uint8_t sniffUIDType;\r |
| | 16 | static uint8_t sniffUID[8] = {0x00};\r |
| | 17 | static uint8_t sniffATQA[2] = {0x00};\r |
| | 18 | static uint8_t sniffSAK;\r |
| | 19 | static uint8_t sniffBuf[16] = {0x00};\r |
| | 20 | static uint32_t timerData = 0;\r |
| | 21 | \r |
| | 22 | \r |
| | 23 | bool MfSniffInit(void){\r |
| | 24 | memset(sniffUID, 0x00, 8);\r |
| | 25 | memset(sniffATQA, 0x00, 2);\r |
| | 26 | sniffSAK = 0;\r |
| | 27 | sniffUIDType = SNF_UID_4;\r |
| | 28 | \r |
| | 29 | return FALSE;\r |
| | 30 | }\r |
| | 31 | \r |
| | 32 | bool MfSniffEnd(void){\r |
| | 33 | LED_B_ON();\r |
| | 34 | cmd_send(CMD_ACK,0,0,0,0,0);\r |
| | 35 | LED_B_OFF();\r |
| | 36 | \r |
| | 37 | return FALSE;\r |
| | 38 | }\r |
| | 39 | \r |
| | 40 | bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint8_t *parity, uint16_t bitCnt, bool reader) {\r |
| | 41 | \r |
| | 42 | if (reader && (len == 1) && (bitCnt == 7)) { // reset on 7-Bit commands from reader\r |
| | 43 | sniffState = SNF_INIT;\r |
| | 44 | }\r |
| | 45 | \r |
| | 46 | switch (sniffState) {\r |
| | 47 | case SNF_INIT:{\r |
| | 48 | if ((len == 1) && (reader) && (bitCnt == 7) ) { // REQA or WUPA from reader\r |
| | 49 | sniffUIDType = SNF_UID_4;\r |
| | 50 | memset(sniffUID, 0x00, 8);\r |
| | 51 | memset(sniffATQA, 0x00, 2);\r |
| | 52 | sniffSAK = 0;\r |
| | 53 | sniffState = SNF_WUPREQ;\r |
| | 54 | }\r |
| | 55 | break;\r |
| | 56 | }\r |
| | 57 | case SNF_WUPREQ:{\r |
| | 58 | if ((!reader) && (len == 2)) { // ATQA from tag\r |
| | 59 | memcpy(sniffATQA, data, 2);\r |
| | 60 | sniffState = SNF_ATQA;\r |
| | 61 | }\r |
| | 62 | break;\r |
| | 63 | }\r |
| | 64 | case SNF_ATQA:{\r |
| | 65 | if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20)) { // Select ALL from reader\r |
| | 66 | sniffState = SNF_ANTICOL1;\r |
| | 67 | }\r |
| | 68 | break;\r |
| | 69 | }\r |
| | 70 | case SNF_ANTICOL1:{\r |
| | 71 | if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // UID from tag (CL1) \r |
| | 72 | memcpy(sniffUID + 3, data, 4);\r |
| | 73 | sniffState = SNF_UID1;\r |
| | 74 | }\r |
| | 75 | break;\r |
| | 76 | }\r |
| | 77 | case SNF_UID1:{\r |
| | 78 | if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 4 Byte UID from reader\r |
| | 79 | sniffState = SNF_SAK;\r |
| | 80 | }\r |
| | 81 | break;\r |
| | 82 | }\r |
| | 83 | case SNF_SAK:{\r |
| | 84 | if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card?\r |
| | 85 | sniffSAK = data[0];\r |
| | 86 | if (sniffUID[3] == 0x88) { // CL2 UID part to be expected\r |
| | 87 | sniffState = SNF_ANTICOL2;\r |
| | 88 | } else { // select completed\r |
| | 89 | sniffState = SNF_CARD_IDLE;\r |
| | 90 | }\r |
| | 91 | }\r |
| | 92 | break;\r |
| | 93 | }\r |
| | 94 | case SNF_ANTICOL2:{\r |
| | 95 | if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // CL2 UID \r |
| | 96 | memcpy(sniffUID, sniffUID+4, 3);\r |
| | 97 | memcpy(sniffUID+3, data, 4);\r |
| | 98 | sniffUIDType = SNF_UID_7;\r |
| | 99 | sniffState = SNF_UID2;\r |
| | 100 | }\r |
| | 101 | break;\r |
| | 102 | }\r |
| | 103 | case SNF_UID2:{\r |
| | 104 | if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 2nd part of 7 Byte UID\r |
| | 105 | sniffState = SNF_SAK;\r |
| | 106 | }\r |
| | 107 | break;\r |
| | 108 | }\r |
| | 109 | case SNF_CARD_IDLE:{ // trace the card select sequence\r |
| | 110 | sniffBuf[0] = 0xFF;\r |
| | 111 | sniffBuf[1] = 0xFF;\r |
| | 112 | memcpy(sniffBuf + 2, sniffUID, 7);\r |
| | 113 | memcpy(sniffBuf + 9, sniffATQA, 2);\r |
| | 114 | sniffBuf[11] = sniffSAK;\r |
| | 115 | sniffBuf[12] = 0xFF;\r |
| | 116 | sniffBuf[13] = 0xFF;\r |
| | 117 | LogTrace(sniffBuf, 14, 0, 0, NULL, TRUE);\r |
| | 118 | } // intentionally no break;\r |
| | 119 | case SNF_CARD_CMD:{ \r |
| | 120 | LogTrace(data, len, 0, 0, NULL, TRUE);\r |
| | 121 | sniffState = SNF_CARD_RESP;\r |
| | 122 | timerData = GetTickCount();\r |
| | 123 | break;\r |
| | 124 | }\r |
| | 125 | case SNF_CARD_RESP:{\r |
| | 126 | LogTrace(data, len, 0, 0, NULL, FALSE);\r |
| | 127 | sniffState = SNF_CARD_CMD;\r |
| | 128 | timerData = GetTickCount();\r |
| | 129 | break;\r |
| | 130 | }\r |
| | 131 | \r |
| | 132 | default:\r |
| | 133 | sniffState = SNF_INIT;\r |
| | 134 | break;\r |
| | 135 | }\r |
| | 136 | \r |
| | 137 | \r |
| | 138 | return FALSE;\r |
| | 139 | }\r |
| | 140 | \r |
| | 141 | bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) {\r |
| | 142 | if (BigBuf_get_traceLen() && (GetTickCount() > timerData + maxTimeoutMs)) {\r |
| | 143 | return intMfSniffSend();\r |
| | 144 | }\r |
| | 145 | return FALSE;\r |
| | 146 | }\r |
| | 147 | \r |
| | 148 | // internal sending function. not a RAMFUNC.\r |
| | 149 | bool intMfSniffSend() {\r |
| | 150 | \r |
| | 151 | int pckSize = 0;\r |
| | 152 | int pckLen = BigBuf_get_traceLen();\r |
| | 153 | int pckNum = 0;\r |
| | 154 | uint8_t *trace = BigBuf_get_addr();\r |
| | 155 | \r |
| | 156 | FpgaDisableSscDma();\r |
| | 157 | while (pckLen > 0) {\r |
| | 158 | pckSize = MIN(USB_CMD_DATA_SIZE, pckLen);\r |
| | 159 | LED_B_ON();\r |
| | 160 | cmd_send(CMD_ACK, 1, BigBuf_get_traceLen(), pckSize, trace + BigBuf_get_traceLen() - pckLen, pckSize);\r |
| | 161 | LED_B_OFF();\r |
| | 162 | \r |
| | 163 | pckLen -= pckSize;\r |
| | 164 | pckNum++;\r |
| | 165 | }\r |
| | 166 | \r |
| | 167 | LED_B_ON();\r |
| | 168 | cmd_send(CMD_ACK,2,0,0,0,0);\r |
| | 169 | LED_B_OFF();\r |
| | 170 | \r |
| | 171 | clear_trace();\r |
| | 172 | \r |
| | 173 | return TRUE;\r |
| | 174 | }\r |
projects / proxmark3-svn / blame_incremental