git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifaresniff.c

   1 //-----------------------------------------------------------------------------
   2 // Merlok - 2012
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // Routines to support mifare classic sniffer.
   9 //-----------------------------------------------------------------------------
  10
  11 #include "mifaresniff.h"
  12 #include "apps.h"
  13
  14
  15 static int sniffState = SNF_INIT;
  16 static uint8_t sniffUIDType;
  17 static uint8_t sniffUID[8];
  18 static uint8_t sniffATQA[2];
  19 static uint8_t sniffSAK;
  20 static uint8_t sniffBuf[16];
  21 static uint32_t timerData = 0;
  22
  23
  24 bool MfSniffInit(void){
  25         memset(sniffUID, 0x00, 8);
  26         memset(sniffATQA, 0x00, 2);
  27         sniffSAK = 0;
  28         sniffUIDType = SNF_UID_4;
  29
  30         return FALSE;
  31 }
  32
  33 bool MfSniffEnd(void){
  34         LED_B_ON();
  35         cmd_send(CMD_ACK,0,0,0,0,0);
  36         LED_B_OFF();
  37
  38         return FALSE;
  39 }
  40
  41 bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint8_t *parity, uint16_t bitCnt, bool reader) {
  42
  43         if (reader && (len == 1) && (bitCnt == 7)) {            // reset on 7-Bit commands from reader
  44                 sniffState = SNF_INIT;
  45         }
  46
  47         switch (sniffState) {
  48                 case SNF_INIT:{
  49                         if ((len == 1) && (reader) && (bitCnt == 7) ) {  // REQA or WUPA from reader
  50                                 sniffUIDType = SNF_UID_4;
  51                                 memset(sniffUID, 0x00, 8);
  52                                 memset(sniffATQA, 0x00, 2);
  53                                 sniffSAK = 0;
  54                                 sniffState = SNF_WUPREQ;
  55                         }
  56                         break;
  57                 }
  58                 case SNF_WUPREQ:{
  59                         if ((!reader) && (len == 2)) {          // ATQA from tag
  60                                 memcpy(sniffATQA, data, 2);
  61                                 sniffState = SNF_ATQA;
  62                         }
  63                         break;
  64                 }
  65                 case SNF_ATQA:{
  66                         if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20)) { // Select ALL from reader
  67                                 sniffState = SNF_ANTICOL1;
  68                         }
  69                         break;
  70                 }
  71                 case SNF_ANTICOL1:{
  72                         if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) {  // UID from tag (CL1)
  73                                 memcpy(sniffUID + 3, data, 4);
  74                                 sniffState = SNF_UID1;
  75                         }
  76                         break;
  77                 }
  78                 case SNF_UID1:{
  79                         if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) {   // Select 4 Byte UID from reader
  80                                 sniffState = SNF_SAK;
  81                         }
  82                         break;
  83                 }
  84                 case SNF_SAK:{
  85                         if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card?
  86                                 sniffSAK = data[0];
  87                                 if (sniffUID[3] == 0x88) {                      // CL2 UID part to be expected
  88                                         sniffState = SNF_ANTICOL2;
  89                                 } else {                                                        // select completed
  90                                         sniffState = SNF_CARD_IDLE;
  91                                 }
  92                         }
  93                         break;
  94                 }
  95                 case SNF_ANTICOL2:{
  96                         if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // CL2 UID
  97                                 memcpy(sniffUID, sniffUID+4, 3);
  98                                 memcpy(sniffUID+3, data, 4);
  99                                 sniffUIDType = SNF_UID_7;
 100                                 sniffState = SNF_UID2;
 101                         }
 102                         break;
 103                 }
 104                 case SNF_UID2:{
 105                         if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) {        // Select 2nd part of 7 Byte UID
 106                                 sniffState = SNF_SAK;
 107                         }
 108                         break;
 109                 }
 110                 case SNF_CARD_IDLE:{    // trace the card select sequence
 111                         sniffBuf[0] = 0xFF;
 112                         sniffBuf[1] = 0xFF;
 113                         memcpy(sniffBuf + 2, sniffUID, 7);
 114                         memcpy(sniffBuf + 9, sniffATQA, 2);
 115                         sniffBuf[11] = sniffSAK;
 116                         sniffBuf[12] = 0xFF;
 117                         sniffBuf[13] = 0xFF;
 118                         LogTrace(sniffBuf, 14, 0, 0, NULL, TRUE);
 119                 }       // intentionally no break;
 120                 case SNF_CARD_CMD:{
 121                         LogTrace(data, len, 0, 0, NULL, TRUE);
 122                         sniffState = SNF_CARD_RESP;
 123                         timerData = GetTickCount();
 124                         break;
 125                 }
 126                 case SNF_CARD_RESP:{
 127                         LogTrace(data, len, 0, 0, NULL, FALSE);
 128                         sniffState = SNF_CARD_CMD;
 129                         timerData = GetTickCount();
 130                         break;
 131                 }
 132
 133                 default:
 134                         sniffState = SNF_INIT;
 135                 break;
 136         }
 137
 138
 139         return FALSE;
 140 }
 141
 142 bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) {
 143         if (traceLen && (GetTickCount() > timerData + maxTimeoutMs)) {
 144                 return intMfSniffSend();
 145         }
 146         return FALSE;
 147 }
 148
 149 // internal sending function. not a RAMFUNC.
 150 bool intMfSniffSend() {
 151
 152         int pckSize = 0;
 153         int pckLen = traceLen;
 154         int pckNum = 0;
 155
 156         FpgaDisableSscDma();
 157         while (pckLen > 0) {
 158                 pckSize = MIN(USB_CMD_DATA_SIZE, pckLen);
 159                 LED_B_ON();
 160                 cmd_send(CMD_ACK, 1, pckSize, pckNum, trace + traceLen - pckLen, pckSize);
 161                 LED_B_OFF();
 162
 163                 pckLen -= pckSize;
 164                 pckNum++;
 165         }
 166
 167         LED_B_ON();
 168         cmd_send(CMD_ACK,2,0,0,0,0);
 169         LED_B_OFF();
 170
 171         iso14a_clear_trace();
 172
 173         return TRUE;
 174 }