1 //-----------------------------------------------------------------------------
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Routines to support mifare classic sniffer.
9 //-----------------------------------------------------------------------------
11 #include "mifaresniff.h"
13 #include "proxmark3.h"
16 #include "iso14443crc.h"
17 #include "iso14443a.h"
18 #include "crapto1/crapto1.h"
19 #include "mifareutil.h"
23 static int sniffState
= SNF_INIT
;
24 static uint8_t sniffUIDType
;
25 static uint8_t sniffUID
[8] = {0x00};
26 static uint8_t sniffATQA
[2] = {0x00};
27 static uint8_t sniffSAK
;
28 static uint8_t sniffBuf
[16] = {0x00};
29 static uint32_t timerData
= 0;
32 bool MfSniffInit(void){
33 memset(sniffUID
, 0x00, 8);
34 memset(sniffATQA
, 0x00, 2);
36 sniffUIDType
= SNF_UID_4
;
41 bool MfSniffEnd(void){
43 cmd_send(CMD_ACK
,0,0,0,0,0);
49 bool RAMFUNC
MfSniffLogic(const uint8_t *data
, uint16_t len
, uint8_t *parity
, uint16_t bitCnt
, bool reader
) {
51 if (reader
&& (len
== 1) && (bitCnt
== 7)) { // reset on 7-Bit commands from reader
52 sniffState
= SNF_INIT
;
57 if ((len
== 1) && (reader
) && (bitCnt
== 7) ) { // REQA or WUPA from reader
58 sniffUIDType
= SNF_UID_4
;
59 memset(sniffUID
, 0x00, 8);
60 memset(sniffATQA
, 0x00, 2);
62 sniffState
= SNF_WUPREQ
;
67 if ((!reader
) && (len
== 2)) { // ATQA from tag
68 memcpy(sniffATQA
, data
, 2);
69 sniffState
= SNF_ATQA
;
74 if ((reader
) && (len
== 2) && (data
[0] == 0x93) && (data
[1] == 0x20)) { // Select ALL from reader
75 sniffState
= SNF_ANTICOL1
;
80 if ((!reader
) && (len
== 5) && ((data
[0] ^ data
[1] ^ data
[2] ^ data
[3]) == data
[4])) { // UID from tag (CL1)
81 memcpy(sniffUID
+ 3, data
, 4);
82 sniffState
= SNF_UID1
;
87 if ((reader
) && (len
== 9) && (data
[0] == 0x93) && (data
[1] == 0x70) && (CheckCrc14443(CRC_14443_A
, data
, 9))) { // Select 4 Byte UID from reader
93 if ((!reader
) && (len
== 3) && (CheckCrc14443(CRC_14443_A
, data
, 3))) { // SAK from card?
95 if (sniffUID
[3] == 0x88) { // CL2 UID part to be expected
96 sniffState
= SNF_ANTICOL2
;
97 } else { // select completed
98 sniffState
= SNF_CARD_IDLE
;
104 if ((!reader
) && (len
== 5) && ((data
[0] ^ data
[1] ^ data
[2] ^ data
[3]) == data
[4])) { // CL2 UID
105 memcpy(sniffUID
, sniffUID
+4, 3);
106 memcpy(sniffUID
+3, data
, 4);
107 sniffUIDType
= SNF_UID_7
;
108 sniffState
= SNF_UID2
;
113 if ((reader
) && (len
== 9) && (data
[0] == 0x95) && (data
[1] == 0x70) && (CheckCrc14443(CRC_14443_A
, data
, 9))) { // Select 2nd part of 7 Byte UID
114 sniffState
= SNF_SAK
;
118 case SNF_CARD_IDLE
:{ // trace the card select sequence
121 memcpy(sniffBuf
+ 2, sniffUID
, 7);
122 memcpy(sniffBuf
+ 9, sniffATQA
, 2);
123 sniffBuf
[11] = sniffSAK
;
126 LogTrace(sniffBuf
, 14, 0, 0, NULL
, TRUE
);
127 } // intentionally no break;
129 LogTrace(data
, len
, 0, 0, NULL
, TRUE
);
130 sniffState
= SNF_CARD_RESP
;
131 timerData
= GetTickCount();
135 LogTrace(data
, len
, 0, 0, NULL
, FALSE
);
136 sniffState
= SNF_CARD_CMD
;
137 timerData
= GetTickCount();
142 sniffState
= SNF_INIT
;
150 bool RAMFUNC
MfSniffSend(uint16_t maxTimeoutMs
) {
151 if (BigBuf_get_traceLen() && (GetTickCount() > timerData
+ maxTimeoutMs
)) {
152 return intMfSniffSend();
157 // internal sending function. not a RAMFUNC.
158 bool intMfSniffSend() {
161 int pckLen
= BigBuf_get_traceLen();
163 uint8_t *trace
= BigBuf_get_addr();
167 pckSize
= MIN(USB_CMD_DATA_SIZE
, pckLen
);
169 cmd_send(CMD_ACK
, 1, BigBuf_get_traceLen(), pckSize
, trace
+ BigBuf_get_traceLen() - pckLen
, pckSize
);
177 cmd_send(CMD_ACK
,2,0,0,0,0);