FIX: tnp3sim, now can insert keys if the dumpfile is blank. Like the ,,,lander dumps...

[proxmark3-svn] / armsrc / iso14443a.c

diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index 862594e9c483293a7824184cd6385d8921f49788..06b6d32f46a78291c0fe540868f53f7336ad2ae4 100644 (file)
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -718,6 +718,8 @@ void RAMFUNC SniffIso14443a(uint8_t param) {
 
        Dbprintf("maxDataLen=%d, Uart.state=%x, Uart.len=%d", maxDataLen, Uart.state, Uart.len);
        Dbprintf("traceLen=%d, Uart.output[0]=%08x", BigBuf_get_traceLen(), (uint32_t)Uart.output[0]);
 
        Dbprintf("maxDataLen=%d, Uart.state=%x, Uart.len=%d", maxDataLen, Uart.state, Uart.len);
        Dbprintf("traceLen=%d, Uart.output[0]=%08x", BigBuf_get_traceLen(), (uint32_t)Uart.output[0]);

+       
+       set_tracing(FALSE);     

 }
 
 //-----------------------------------------------------------------------------
 }
 
 //-----------------------------------------------------------------------------


@@ -937,7 +939,6 @@ bool prepare_allocated_tag_modulation(tag_response_info_t* response_info) {
 //-----------------------------------------------------------------------------
 void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
 {
 //-----------------------------------------------------------------------------
 void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
 {

-

        //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
        // This can be used in a reader-only attack.
        // (it can also be retrieved via 'hf 14a list', but hey...
        //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
        // This can be used in a reader-only attack.
        // (it can also be retrieved via 'hf 14a list', but hey...


@@ -947,10 +948,10 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
        uint8_t sak;
                                        
        // PACK response to PWD AUTH for EV1/NTAG
        uint8_t sak;
                                        
        // PACK response to PWD AUTH for EV1/NTAG

-       uint8_t response8[4];
+       uint8_t response8[4] =  {0,0,0,0};

        
        // The first response contains the ATQA (note: bytes are transmitted in reverse order).
        
        // The first response contains the ATQA (note: bytes are transmitted in reverse order).

-       uint8_t response1[2];
+       uint8_t response1[2] =  {0,0};

        
        switch (tagType) {
                case 1: { // MIFARE Classic
        
        switch (tagType) {
                case 1: { // MIFARE Classic


@@ -1047,7 +1048,7 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
        response3a[0] = sak & 0xFB;
        ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
 
        response3a[0] = sak & 0xFB;
        ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
 

-       uint8_t response5[] = { 0x01, 0x01, 0x01, 0x01 }; // Very random tag nonce
+       uint8_t response5[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce

        uint8_t response6[] = { 0x04, 0x58, 0x80, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS: 
        // Format byte = 0x58: FSCI=0x08 (FSC=256), TA(1) and TC(1) present, 
        // TA(1) = 0x80: different divisors not supported, DR = 1, DS = 1
        uint8_t response6[] = { 0x04, 0x58, 0x80, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS: 
        // Format byte = 0x58: FSCI=0x08 (FSC=256), TA(1) and TC(1) present, 
        // TA(1) = 0x80: different divisors not supported, DR = 1, DS = 1


@@ -1151,9 +1152,9 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
                } else if(receivedCmd[0] == 0x30) {     // Received a (plain) READ
                        uint8_t block = receivedCmd[1];
                        if ( tagType == 7 ) {
                } else if(receivedCmd[0] == 0x30) {     // Received a (plain) READ
                        uint8_t block = receivedCmd[1];
                        if ( tagType == 7 ) {

-                               uint8_t start = 4 * block;
+                               uint16_t start = 4 * block;

                                
                                

-                               if ( block < 4 ) {
+                               /*if ( block < 4 ) {

                                    //NTAG 215
                                        uint8_t blockdata[50] = {
                                        data[0],data[1],data[2], 0x88 ^ data[0] ^ data[1] ^ data[2],
                                    //NTAG 215
                                        uint8_t blockdata[50] = {
                                        data[0],data[1],data[2], 0x88 ^ data[0] ^ data[1] ^ data[2],


@@ -1167,12 +1168,12 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
                                        0x00,0x00};
                                        AppendCrc14443a(blockdata+start, 16);
                                        EmSendCmdEx( blockdata+start, MAX_MIFARE_FRAME_SIZE, false);
                                        0x00,0x00};
                                        AppendCrc14443a(blockdata+start, 16);
                                        EmSendCmdEx( blockdata+start, MAX_MIFARE_FRAME_SIZE, false);

-                               } else {        
+                               } else {*/      

                                        uint8_t emdata[MAX_MIFARE_FRAME_SIZE];
                                        emlGetMemBt( emdata, start, 16);
                                        AppendCrc14443a(emdata, 16);
                                        EmSendCmdEx(emdata, sizeof(emdata), false);                             
                                        uint8_t emdata[MAX_MIFARE_FRAME_SIZE];
                                        emlGetMemBt( emdata, start, 16);
                                        AppendCrc14443a(emdata, 16);
                                        EmSendCmdEx(emdata, sizeof(emdata), false);                             

-                               }
+                               //}

                                p_response = NULL;
                                
                        } else {                        
                                p_response = NULL;
                                
                        } else {                        


@@ -1299,7 +1300,8 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
                        if ( tagType == 7 ) {
                                p_response =  &responses[8]; // PACK response
                                uint32_t pwd = bytes_to_num(receivedCmd+1,4);
                        if ( tagType == 7 ) {
                                p_response =  &responses[8]; // PACK response
                                uint32_t pwd = bytes_to_num(receivedCmd+1,4);

-                               Dbprintf("Auth attempt: %08x", pwd);    
+                               
+                               if ( MF_DBGLEVEL >= 3)  Dbprintf("Auth attempt: %08x", pwd);    

                        }
                }
                else {
                        }
                }
                else {


@@ -1414,12 +1416,15 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
        }
 
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        }
 
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

+       set_tracing(FALSE);

        BigBuf_free_keep_EM();
        LED_A_OFF();
        
        BigBuf_free_keep_EM();
        LED_A_OFF();
        

-       Dbprintf("-[ Wake ups after halt [%d]", happened);
-       Dbprintf("-[ Messages after halt [%d]", happened2);
-       Dbprintf("-[ Num of received cmd [%d]", cmdsRecvd);
+       if (MF_DBGLEVEL >= 4){
+               Dbprintf("-[ Wake ups after halt [%d]", happened);
+               Dbprintf("-[ Messages after halt [%d]", happened2);
+               Dbprintf("-[ Num of received cmd [%d]", cmdsRecvd);
+       }

 }
 
 
 }
 
 


@@ -1430,7 +1435,7 @@ void PrepareDelayedTransfer(uint16_t delay)
        uint8_t bitmask = 0;
        uint8_t bits_to_shift = 0;
        uint8_t bits_shifted = 0;
        uint8_t bitmask = 0;
        uint8_t bits_to_shift = 0;
        uint8_t bits_shifted = 0;

-       
+

        delay &= 0x07;
        if (delay) {
                for (uint16_t i = 0; i < delay; i++) {
        delay &= 0x07;
        if (delay) {
                for (uint16_t i = 0; i < delay; i++) {


@@ -2177,6 +2182,7 @@ void ReaderIso14443a(UsbCommand *c)
        }
 
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        }
 
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

+       set_tracing(FALSE);

        LEDsoff();
 }
 
        LEDsoff();
 }
 


@@ -2194,7 +2200,7 @@ int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
        nttmp1 = nt1;
        nttmp2 = nt2;
        
        nttmp1 = nt1;
        nttmp2 = nt2;
        

-       for (i = 1; i < 32768; i++) {
+       for (i = 1; i < 0xFFFF; i++) {

                nttmp1 = prng_successor(nttmp1, 1);
                if (nttmp1 == nt2) return i;
                nttmp2 = prng_successor(nttmp2, 1);
                nttmp1 = prng_successor(nttmp1, 1);
                if (nttmp1 == nt2) return i;
                nttmp2 = prng_successor(nttmp2, 1);


@@ -2244,19 +2250,20 @@ void ReaderMifare(bool first_try)
        byte_t par_list[8] = {0x00};
        byte_t ks_list[8] = {0x00};
 
        byte_t par_list[8] = {0x00};
        byte_t ks_list[8] = {0x00};
 

+   #define PRNG_SEQUENCE_LENGTH  (1 << 16);

        static uint32_t sync_time = 0;
        static uint32_t sync_time = 0;

-       static uint32_t sync_cycles = 0;
+       static int32_t sync_cycles = 0;

        int catch_up_cycles = 0;
        int last_catch_up = 0;
        int catch_up_cycles = 0;
        int last_catch_up = 0;

+       uint16_t elapsed_prng_sequences;

        uint16_t consecutive_resyncs = 0;
        int isOK = 0;
 
        if (first_try) { 
                mf_nr_ar3 = 0;
                sync_time = GetCountSspClk() & 0xfffffff8;
        uint16_t consecutive_resyncs = 0;
        int isOK = 0;
 
        if (first_try) { 
                mf_nr_ar3 = 0;
                sync_time = GetCountSspClk() & 0xfffffff8;

-               sync_cycles = 65536;                                                                    // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
+               sync_cycles = PRNG_SEQUENCE_LENGTH; //65536;    //0x10000                       // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).

                nt_attacked = 0;
                nt_attacked = 0;

-               nt = 0;

                par[0] = 0;
        }
        else {
                par[0] = 0;
        }
        else {


@@ -2271,8 +2278,17 @@ void ReaderMifare(bool first_try)
        LED_C_OFF();
        
 
        LED_C_OFF();
        
 

-       #define DARKSIDE_MAX_TRIES      32              // number of tries to sync on PRNG cycle. Then give up.
-       uint16_t unsuccessfull_tries = 0;
+       #define MAX_UNEXPECTED_RANDOM   4               // maximum number of unexpected (i.e. real) random numbers when trying to sync. Then give up.
+       #define MAX_SYNC_TRIES                  32
+       #define NUM_DEBUG_INFOS                 8               // per strategy
+       #define MAX_STRATEGY                    3
+       uint16_t unexpected_random = 0;
+       uint16_t sync_tries = 0;
+       int16_t debug_info_nr = -1;
+       uint16_t strategy = 0;
+       int32_t debug_info[MAX_STRATEGY][NUM_DEBUG_INFOS];
+       uint32_t select_time;
+       uint32_t halt_time;

   
        for(uint16_t i = 0; TRUE; i++) {
                
   
        for(uint16_t i = 0; TRUE; i++) {
                


@@ -2285,21 +2301,60 @@ void ReaderMifare(bool first_try)
                        break;
                }
                
                        break;
                }
                

+               if (strategy == 2) {
+                       // test with additional hlt command
+                       halt_time = 0;
+                       int len = mifare_sendcmd_short(NULL, false, 0x50, 0x00, receivedAnswer, receivedAnswerPar, &halt_time);
+                       if (len && MF_DBGLEVEL >= 3) {
+                               Dbprintf("Unexpected response of %d bytes to hlt command (additional debugging).", len);
+                       }
+               }
+
+               if (strategy == 3) {
+                       // test with FPGA power off/on
+                       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+                       SpinDelay(200);
+                       iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
+                       SpinDelay(100);
+               }
+               

                if(!iso14443a_select_card(uid, NULL, &cuid)) {
                        if (MF_DBGLEVEL >= 1)   Dbprintf("Mifare: Can't select card");
                        continue;
                }
                if(!iso14443a_select_card(uid, NULL, &cuid)) {
                        if (MF_DBGLEVEL >= 1)   Dbprintf("Mifare: Can't select card");
                        continue;
                }

+               select_time = GetCountSspClk();

 
 

-               sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
-               catch_up_cycles = 0;
+               elapsed_prng_sequences = 1;
+               if (debug_info_nr == -1) {
+                       sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
+                       catch_up_cycles = 0;

 
 

-               // if we missed the sync time already, advance to the next nonce repeat
-               while(GetCountSspClk() > sync_time) {
-                       sync_time = (sync_time & 0xfffffff8) + sync_cycles;
-               }
+                       // if we missed the sync time already, advance to the next nonce repeat
+                       while(GetCountSspClk() > sync_time) {
+                               elapsed_prng_sequences++;
+                               sync_time = (sync_time & 0xfffffff8) + sync_cycles;
+                       }

 
 

-               // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked) 
-               ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
+                       // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked) 
+                       ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
+               } else {
+                       // collect some information on tag nonces for debugging:
+                       #define DEBUG_FIXED_SYNC_CYCLES PRNG_SEQUENCE_LENGTH
+                       if (strategy == 0) {
+                               // nonce distances at fixed time after card select:
+                               sync_time = select_time + DEBUG_FIXED_SYNC_CYCLES;
+                       } else if (strategy == 1) {
+                               // nonce distances at fixed time between authentications:
+                               sync_time = sync_time + DEBUG_FIXED_SYNC_CYCLES;
+                       } else if (strategy == 2) {
+                               // nonce distances at fixed time after halt:
+                               sync_time = halt_time + DEBUG_FIXED_SYNC_CYCLES;
+                       } else {
+                               // nonce_distances at fixed time after power on
+                               sync_time = DEBUG_FIXED_SYNC_CYCLES;
+                       }
+                       ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time);
+               }                       

 
                // Receive the (4 Byte) "random" nonce
                if (!ReaderReceive(receivedAnswer, receivedAnswerPar)) {
 
                // Receive the (4 Byte) "random" nonce
                if (!ReaderReceive(receivedAnswer, receivedAnswerPar)) {


@@ -2317,19 +2372,37 @@ void ReaderMifare(bool first_try)
                        int nt_distance = dist_nt(previous_nt, nt);
                        if (nt_distance == 0) {
                                nt_attacked = nt;
                        int nt_distance = dist_nt(previous_nt, nt);
                        if (nt_distance == 0) {
                                nt_attacked = nt;

-                       }
-                       else {
+                       } else {

                                if (nt_distance == -99999) { // invalid nonce received
                                if (nt_distance == -99999) { // invalid nonce received

-                                       unsuccessfull_tries++;
-                                       if (!nt_attacked && unsuccessfull_tries > DARKSIDE_MAX_TRIES) {
+                                       unexpected_random++;
+                                       if (unexpected_random > MAX_UNEXPECTED_RANDOM) {

                                                isOK = -3;              // Card has an unpredictable PRNG. Give up      
                                                break;
                                        } else {
                                                continue;               // continue trying...
                                        }
                                }
                                                isOK = -3;              // Card has an unpredictable PRNG. Give up      
                                                break;
                                        } else {
                                                continue;               // continue trying...
                                        }
                                }

-                               sync_cycles = (sync_cycles - nt_distance);
-                               if (MF_DBGLEVEL >= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);
+                               if (++sync_tries > MAX_SYNC_TRIES) {
+                                       if (strategy > MAX_STRATEGY || MF_DBGLEVEL < 3) {
+                                               isOK = -4;                      // Card's PRNG runs at an unexpected frequency or resets unexpectedly
+                                               break;
+                                       } else {                                // continue for a while, just to collect some debug info
+                                               debug_info[strategy][debug_info_nr] = nt_distance;
+                                               debug_info_nr++;
+                                               if (debug_info_nr == NUM_DEBUG_INFOS) {
+                                                       strategy++;
+                                                       debug_info_nr = 0;
+                                               }
+                                               continue;
+                                       }
+                               }
+                               sync_cycles = (sync_cycles - nt_distance/elapsed_prng_sequences);
+                               if (sync_cycles <= 0) {
+                                       sync_cycles += PRNG_SEQUENCE_LENGTH;
+                               }
+                               if (MF_DBGLEVEL >= 3) {
+                                       Dbprintf("calibrating in cycle %d. nt_distance=%d, elapsed_prng_sequences=%d, new sync_cycles: %d\n", i, nt_distance, elapsed_prng_sequences, sync_cycles);
+                               }

                                continue;
                        }
                }
                                continue;
                        }
                }


@@ -2340,6 +2413,7 @@ void ReaderMifare(bool first_try)
                                catch_up_cycles = 0;
                                continue;
                        }
                                catch_up_cycles = 0;
                                continue;
                        }

+                       catch_up_cycles /= elapsed_prng_sequences;

                        if (catch_up_cycles == last_catch_up) {
                                consecutive_resyncs++;
                        }
                        if (catch_up_cycles == last_catch_up) {
                                consecutive_resyncs++;
                        }


@@ -2353,6 +2427,9 @@ void ReaderMifare(bool first_try)
                        else {  
                                sync_cycles = sync_cycles + catch_up_cycles;
                                if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i, -catch_up_cycles, sync_cycles);
                        else {  
                                sync_cycles = sync_cycles + catch_up_cycles;
                                if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i, -catch_up_cycles, sync_cycles);

+                               last_catch_up = 0;
+                               catch_up_cycles = 0;
+                               consecutive_resyncs = 0;

                        }
                        continue;
                }
                        }
                        continue;
                }


@@ -2360,12 +2437,10 @@ void ReaderMifare(bool first_try)
                consecutive_resyncs = 0;
                
                // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding
                consecutive_resyncs = 0;
                
                // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding

-               if (ReaderReceive(receivedAnswer, receivedAnswerPar))
-               {
+               if (ReaderReceive(receivedAnswer, receivedAnswerPar)) {

                        catch_up_cycles = 8;    // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
        
                        catch_up_cycles = 8;    // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
        

-                       if (nt_diff == 0)
-                       {
+                       if (nt_diff == 0) {

                                par_low = par[0] & 0xE0; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
                        }
 
                                par_low = par[0] & 0xE0; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
                        }
 


@@ -2401,8 +2476,17 @@ void ReaderMifare(bool first_try)
 
        mf_nr_ar[3] &= 0x1F;
        
 
        mf_nr_ar[3] &= 0x1F;
        

-       byte_t buf[28] = {0x00};
+       if (isOK == -4) {
+               if (MF_DBGLEVEL >= 3) {
+                       for (uint16_t i = 0; i <= MAX_STRATEGY; i++) {
+                               for(uint16_t j = 0; j < NUM_DEBUG_INFOS; j++) {
+                                       Dbprintf("collected debug info[%d][%d] = %d", i, j, debug_info[i][j]);
+                               }
+                       }
+               }
+       }

        
        

+       byte_t buf[28];

        memcpy(buf + 0,  uid, 4);
        num_to_bytes(nt, 4, buf + 4);
        memcpy(buf + 8,  par_list, 8);
        memcpy(buf + 0,  uid, 4);
        num_to_bytes(nt, 4, buf + 4);
        memcpy(buf + 8,  par_list, 8);


@@ -2418,8 +2502,7 @@ void ReaderMifare(bool first_try)
        set_tracing(FALSE);
 }
 
        set_tracing(FALSE);
 }
 

-
- /*
+/**

   *MIFARE 1K simulate.
   *
   *@param flags :
   *MIFARE 1K simulate.
   *
   *@param flags :


@@ -2949,6 +3032,8 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                }
        }
        if (MF_DBGLEVEL >= 1)   Dbprintf("Emulator stopped. Tracing: %d  trace length: %d ", tracing, BigBuf_get_traceLen());
                }
        }
        if (MF_DBGLEVEL >= 1)   Dbprintf("Emulator stopped. Tracing: %d  trace length: %d ", tracing, BigBuf_get_traceLen());

+       
+       set_tracing(FALSE);

 }
 
 
 }
 
 


@@ -3107,4 +3192,5 @@ void RAMFUNC SniffMifare(uint8_t param) {
        MfSniffEnd();
        LEDsoff();
        Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen, Uart.state, Uart.len);
        MfSniffEnd();
        LEDsoff();
        Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.len=%x", maxDataLen, Uart.state, Uart.len);

+       set_tracing(FALSE);

 }
 }