+//simulate a emvcard card
+//input is a structure containing values to simulate
+//clones an EMV card
+void emvsnoop() {
+ //states
+ int cardSTATE = EMVEMUL_NOFIELD;
+ int vHf = 0;
+ int res;
+ uint16_t len = 0;
+ uint8_t* receivedCmd = BigBuf_malloc(MAX_MIFARE_FRAME_SIZE);
+ uint8_t par[MAX_MIFARE_PARITY_SIZE] = {0x00};
+ uint8_t rATQA[] = {0x04,0x00};
+ uint8_t rUIDBCC[] = {0x8F,0x2F,0x27,0xE1, 0x66};
+ uint8_t rSAK[] = {0x28, 0xB4, 0xFC};
+
+ iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
+ bool finished = FALSE;
+
+ while (!BUTTON_PRESS() && !finished){
+ WDT_HIT();
+ //find reader field
+ if(cardSTATE == EMVEMUL_NOFIELD){
+ vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10;
+ if(vHf > EMV_MINFIELDV){
+ cardSTATE_TO_IDLE();
+ LED_A_ON();
+ }
+ }
+ if(cardSTATE == EMVEMUL_NOFIELD) continue;
+
+ //get data
+
+ res = EmGetCmd(receivedCmd, &len, par);
+ if(res == 2) { //field is off
+ cardSTATE = EMVEMUL_NOFIELD;
+ LEDsoff();
+ continue;
+ }
+ else if(res==1){
+ break; // button press
+ }
+
+ if(len==1 && ((receivedCmd[0] == 0x26 && cardSTATE != EMVEMUL_HALTED) || receivedCmd[0] == 0x52)){
+ EmSendCmd(rATQA, sizeof(rATQA));
+ cardSTATE = EMVEMUL_SELECT1;
+ continue;
+ }
+ switch(cardSTATE){
+ case EMVEMUL_NOFIELD:
+ case EMVEMUL_HALTED:
+ case EMVEMUL_IDLE:{
+ break;
+ }
+ case EMVEMUL_SELECT1:{
+ //select all
+ if(len==2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x20)) {
+ EmSendCmd(rUIDBCC, sizeof(rUIDBCC));
+ break;
+ }
+ if(len==2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC, 4) == 0)) {
+ EmSendCmd(rSAK, sizeof(rSAK));
+ break;
+ }
+ }
+ }
+ }
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+ LEDsoff();
+}
projects / proxmark3-svn / blobdiff