git.zerfleddert.de Git - proxmark3-svn/blame_incremental

... / ...

Commit	Line	Data
	1	//-----------------------------------------------------------------------------\r
	2	// Merlok - 2012\r
	3	//\r
	4	// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
	5	// at your option, any later version. See the LICENSE.txt file for the text of\r
	6	// the license.\r
	7	//-----------------------------------------------------------------------------\r
	8	// Routines to support mifare classic sniffer.\r
	9	//-----------------------------------------------------------------------------\r
	10	\r
	11	#include "mifaresniff.h"\r
	12	#include "apps.h"\r
	13	\r
	14	static int sniffState = SNF_INIT;\r
	15	static uint8_t sniffUIDType;\r
	16	static uint8_t sniffUID[8];\r
	17	static uint8_t sniffATQA[2];\r
	18	static uint8_t sniffSAK;\r
	19	static uint8_t sniffBuf[16];\r
	20	static uint32_t timerData;\r
	21	\r
	22	\r
	23	bool MfSniffInit(void){\r
	24	memset(sniffUID, 0x00, 8);\r
	25	memset(sniffATQA, 0x00, 2);\r
	26	sniffSAK = 0;\r
	27	sniffUIDType = SNF_UID_4;\r
	28	return FALSE;\r
	29	}\r
	30	\r
	31	bool MfSniffEnd(void){\r
	32	LED_B_ON();\r
	33	cmd_send(CMD_ACK,0,0,0,0,0);\r
	34	LED_B_OFF();\r
	35	return FALSE;\r
	36	}\r
	37	\r
	38	bool RAMFUNC MfSniffLogic(const uint8_t data, uint16_t len, uint8_t parity, uint16_t bitCnt, bool reader) {\r
	39	\r
	40	if (reader && (len == 1) && (bitCnt == 7)) { // reset on 7-Bit commands from reader\r
	41	sniffState = SNF_INIT;\r
	42	}\r
	43	\r
	44	switch (sniffState) {\r
	45	case SNF_INIT:{\r
	46	if ((len == 1) && (reader) && (bitCnt == 7) ) { // REQA or WUPA from reader\r
	47	sniffUIDType = SNF_UID_4;\r
	48	memset(sniffUID, 0x00, 8);\r
	49	memset(sniffATQA, 0x00, 2);\r
	50	sniffSAK = 0;\r
	51	sniffState = SNF_WUPREQ;\r
	52	}\r
	53	break;\r
	54	}\r
	55	case SNF_WUPREQ:{\r
	56	if ((!reader) && (len == 2)) { // ATQA from tag\r
	57	memcpy(sniffATQA, data, 2);\r
	58	sniffState = SNF_ATQA;\r
	59	}\r
	60	break;\r
	61	}\r
	62	case SNF_ATQA:{\r
	63	if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20)) { // Select ALL from reader\r
	64	sniffState = SNF_ANTICOL1;\r
	65	}\r
	66	break;\r
	67	}\r
	68	case SNF_ANTICOL1:{\r
	69	if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // UID from tag (CL1) \r
	70	memcpy(sniffUID + 3, data, 4);\r
	71	sniffState = SNF_UID1;\r
	72	}\r
	73	break;\r
	74	}\r
	75	case SNF_UID1:{\r
	76	if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 4 Byte UID from reader\r
	77	sniffState = SNF_SAK;\r
	78	}\r
	79	break;\r
	80	}\r
	81	case SNF_SAK:{\r
	82	if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card?\r
	83	sniffSAK = data[0];\r
	84	if (sniffUID[3] == 0x88) { // CL2 UID part to be expected\r
	85	sniffState = SNF_ANTICOL2;\r
	86	} else { // select completed\r
	87	sniffState = SNF_CARD_IDLE;\r
	88	}\r
	89	}\r
	90	break;\r
	91	}\r
	92	case SNF_ANTICOL2:{\r
	93	if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // CL2 UID \r
	94	memcpy(sniffUID, sniffUID+4, 3);\r
	95	memcpy(sniffUID+3, data, 4);\r
	96	sniffUIDType = SNF_UID_7;\r
	97	sniffState = SNF_UID2;\r
	98	}\r
	99	break;\r
	100	}\r
	101	case SNF_UID2:{\r
	102	if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 2nd part of 7 Byte UID\r
	103	sniffState = SNF_SAK;\r
	104	}\r
	105	break;\r
	106	}\r
	107	case SNF_CARD_IDLE:{ // trace the card select sequence\r
	108	sniffBuf[0] = 0xFF;\r
	109	sniffBuf[1] = 0xFF;\r
	110	memcpy(sniffBuf + 2, sniffUID, 7);\r
	111	memcpy(sniffBuf + 9, sniffATQA, 2);\r
	112	sniffBuf[11] = sniffSAK;\r
	113	sniffBuf[12] = 0xFF;\r
	114	sniffBuf[13] = 0xFF;\r
	115	LogTrace(sniffBuf, 14, 0, 0, NULL, TRUE);\r
	116	} // intentionally no break;\r
	117	case SNF_CARD_CMD:{ \r
	118	LogTrace(data, len, 0, 0, NULL, TRUE);\r
	119	sniffState = SNF_CARD_RESP;\r
	120	timerData = GetTickCount();\r
	121	break;\r
	122	}\r
	123	case SNF_CARD_RESP:{\r
	124	LogTrace(data, len, 0, 0, NULL, FALSE);\r
	125	sniffState = SNF_CARD_CMD;\r
	126	timerData = GetTickCount();\r
	127	break;\r
	128	}\r
	129	\r
	130	default:\r
	131	sniffState = SNF_INIT;\r
	132	break;\r
	133	}\r
	134	\r
	135	\r
	136	return FALSE;\r
	137	}\r
	138	\r
	139	bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) {\r
	140	if (BigBuf_get_traceLen() && (GetTickCount() > timerData + maxTimeoutMs)) {\r
	141	return intMfSniffSend();\r
	142	}\r
	143	return FALSE;\r
	144	}\r
	145	\r
	146	// internal sending function. not a RAMFUNC.\r
	147	bool intMfSniffSend() {\r
	148	\r
	149	int pckSize = 0;\r
	150	int pckLen = BigBuf_get_traceLen();\r
	151	int pckNum = 0;\r
	152	uint8_t *trace = BigBuf_get_addr();\r
	153	\r
	154	FpgaDisableSscDma();\r
	155	while (pckLen > 0) {\r
	156	pckSize = MIN(USB_CMD_DATA_SIZE, pckLen);\r
	157	LED_B_ON();\r
	158	cmd_send(CMD_ACK, 1, BigBuf_get_traceLen(), pckSize, trace + BigBuf_get_traceLen() - pckLen, pckSize);\r
	159	LED_B_OFF();\r
	160	\r
	161	pckLen -= pckSize;\r
	162	pckNum++;\r
	163	}\r
	164	\r
	165	LED_B_ON();\r
	166	cmd_send(CMD_ACK,2,0,0,0,0);\r
	167	LED_B_OFF();\r
	168	\r
	169	clear_trace();\r
	170	return TRUE;\r
	171	}\r