]> git.zerfleddert.de Git - proxmark3-svn/blobdiff - armsrc/iclass.c
FIX: fixed a little bug I introduced from last commit in fskdemod
[proxmark3-svn] / armsrc / iclass.c
index f71607d2bedee62fbcefc33fc9ccf5fc2fee84ec..74705b4935acb63832d653e45b13b33ab33fefe0 100644 (file)
@@ -47,6 +47,7 @@
 // different initial value (CRC_ICLASS)
 #include "../common/iso14443crc.h"
 #include "../common/iso15693tools.h"
+#include "iso15693tools.h"
 
 
 static int timeout = 4096;
@@ -72,14 +73,13 @@ static struct {
     int     nOutOfCnt;
     int     OutOfCnt;
     int     syncBit;
-    int     parityBits;
     int     samples;
     int     highCnt;
     int     swapper;
     int     counter;
     int     bitBuffer;
     int     dropPosition;
-    uint8_t   *output;
+    uint8_t *output;
 } Uart;
 
 static RAMFUNC int OutOfNDecoding(int bit)
@@ -138,11 +138,8 @@ static RAMFUNC int OutOfNDecoding(int bit)
                                        if(Uart.byteCnt == 0) {
                                                // Its not straightforward to show single EOFs
                                                // So just leave it and do not return TRUE
-                                               Uart.output[Uart.byteCnt] = 0xf0;
+                                               Uart.output[0] = 0xf0;
                                                Uart.byteCnt++;
-
-                                               // Calculate the parity bit for the client...
-                                               Uart.parityBits = 1;
                                        }
                                        else {
                                                return TRUE;
@@ -224,11 +221,6 @@ static RAMFUNC int OutOfNDecoding(int bit)
                                                if(Uart.bitCnt == 8) {
                                                        Uart.output[Uart.byteCnt] = (Uart.shiftReg & 0xff);
                                                        Uart.byteCnt++;
-
-                                                       // Calculate the parity bit for the client...
-                                                       Uart.parityBits <<= 1;
-                                                       Uart.parityBits ^= OddByteParity[(Uart.shiftReg & 0xff)];
-
                                                        Uart.bitCnt = 0;
                                                        Uart.shiftReg = 0;
                                                }
@@ -247,11 +239,6 @@ static RAMFUNC int OutOfNDecoding(int bit)
                                        Uart.dropPosition--;
                                        Uart.output[Uart.byteCnt] = (Uart.dropPosition & 0xff);
                                        Uart.byteCnt++;
-
-                                       // Calculate the parity bit for the client...
-                                       Uart.parityBits <<= 1;
-                                       Uart.parityBits ^= OddByteParity[(Uart.dropPosition & 0xff)];
-
                                        Uart.bitCnt = 0;
                                        Uart.shiftReg = 0;
                                        Uart.nOutOfCnt = 0;
@@ -312,7 +299,6 @@ static RAMFUNC int OutOfNDecoding(int bit)
                                Uart.state = STATE_START_OF_COMMUNICATION;
                                Uart.bitCnt = 0;
                                Uart.byteCnt = 0;
-                               Uart.parityBits = 0;
                                Uart.nOutOfCnt = 0;
                                Uart.OutOfCnt = 4; // Start at 1/4, could switch to 1/256
                                Uart.dropPosition = 0;
@@ -354,7 +340,6 @@ static struct {
     int     bitCount;
     int     posCount;
        int     syncBit;
-       int     parityBits;
     uint16_t    shiftReg;
        int     buffer;
        int     buffer2;
@@ -421,7 +406,6 @@ static RAMFUNC int ManchesterDecoding(int v)
                        Demod.sub = SUB_FIRST_HALF;
                        Demod.bitCount = 0;
                        Demod.shiftReg = 0;
-                       Demod.parityBits = 0;
                        Demod.samples = 0;
                        if(Demod.posCount) {
                                //if(trigger) LED_A_OFF();  // Not useful in this case...
@@ -451,8 +435,7 @@ static RAMFUNC int ManchesterDecoding(int v)
        else {
                modulation = bit & Demod.syncBit;
                modulation |= ((bit << 1) ^ ((Demod.buffer & 0x08) >> 3)) & Demod.syncBit;
-               //modulation = ((bit << 1) ^ ((Demod.buffer & 0x08) >> 3)) & Demod.syncBit;
-
+       
                Demod.samples += 4;
 
                if(Demod.posCount==0) {
@@ -486,8 +469,6 @@ static RAMFUNC int ManchesterDecoding(int v)
                                if(Demod.state == DEMOD_SOF_COMPLETE) {
                                        Demod.output[Demod.len] = 0x0f;
                                        Demod.len++;
-                                       Demod.parityBits <<= 1;
-                                       Demod.parityBits ^= OddByteParity[0x0f];
                                        Demod.state = DEMOD_UNSYNCD;
 //                                     error = 0x0f;
                                        return TRUE;
@@ -568,11 +549,9 @@ static RAMFUNC int ManchesterDecoding(int v)
                                        // Tag response does not need to be a complete byte!
                                        if(Demod.len > 0 || Demod.bitCount > 0) {
                                                if(Demod.bitCount > 1) {  // was > 0, do not interpret last closing bit, is part of EOF
-                                                       Demod.shiftReg >>= (9 - Demod.bitCount);
+                                                       Demod.shiftReg >>= (9 - Demod.bitCount);        // right align data
                                                        Demod.output[Demod.len] = Demod.shiftReg & 0xff;
                                                        Demod.len++;
-                                                       // No parity bit, so just shift a 0
-                                                       Demod.parityBits <<= 1;
                                                }
 
                                                Demod.state = DEMOD_UNSYNCD;
@@ -609,11 +588,6 @@ static RAMFUNC int ManchesterDecoding(int v)
                                Demod.shiftReg >>= 1;
                                Demod.output[Demod.len] = (Demod.shiftReg & 0xff);
                                Demod.len++;
-
-                               // FOR ISO15639 PARITY NOT SEND OTA, JUST CALCULATE IT FOR THE CLIENT
-                               Demod.parityBits <<= 1;
-                               Demod.parityBits ^= OddByteParity[(Demod.shiftReg & 0xff)];
-
                                Demod.bitCount = 0;
                                Demod.shiftReg = 0;
                        }
@@ -670,7 +644,7 @@ void RAMFUNC SnoopIClass(void)
        // So 32 should be enough!
        uint8_t *readerToTagCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
     // The response (tag -> reader) that we're receiving.
-       uint8_t *tagToReaderResponse = (((uint8_t *)BigBuf) + RECV_RES_OFFSET);
+       uint8_t *tagToReaderResponse = (((uint8_t *)BigBuf) + RECV_RESP_OFFSET);
 
     FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
  
@@ -770,10 +744,10 @@ void RAMFUNC SnoopIClass(void)
 
                        //if(!LogTrace(Uart.output,Uart.byteCnt, rsamples, Uart.parityBits,TRUE)) break;
                        //if(!LogTrace(NULL, 0, Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER, 0, TRUE)) break;
-                       if(tracing)
-                       {
-                               LogTrace(Uart.output,Uart.byteCnt, (GetCountSspClk()-time_0) << 4, Uart.parityBits,TRUE);
-                               LogTrace(NULL, 0, (GetCountSspClk()-time_0) << 4, 0, TRUE);
+                       if(tracing) {
+                               uint8_t parity[MAX_PARITY_SIZE];
+                               GetParity(Uart.output, Uart.byteCnt, parity);
+                               LogTrace(Uart.output,Uart.byteCnt, (GetCountSspClk()-time_0) << 4, (GetCountSspClk()-time_0) << 4, parity, TRUE);
                        }
 
 
@@ -794,10 +768,10 @@ void RAMFUNC SnoopIClass(void)
                    rsamples = samples - Demod.samples;
                    LED_B_ON();
 
-                       if(tracing)
-                       {
-                               LogTrace(Demod.output,Demod.len, (GetCountSspClk()-time_0) << 4 , Demod.parityBits,FALSE);
-                               LogTrace(NULL, 0, (GetCountSspClk()-time_0) << 4, 0, FALSE);
+                       if(tracing) {
+                               uint8_t parity[MAX_PARITY_SIZE];
+                               GetParity(Demod.output, Demod.len, parity);
+                               LogTrace(Demod.output, Demod.len, (GetCountSspClk()-time_0) << 4, (GetCountSspClk()-time_0) << 4, parity, FALSE);
                        }
 
 
@@ -869,10 +843,7 @@ static int GetIClassCommandFromReader(uint8_t *received, int *len, int maxLen)
         }
         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
             uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
-                       /*if(OutOfNDecoding((b & 0xf0) >> 4)) {
-                               *len = Uart.byteCnt;
-                               return TRUE;
-                       }*/
+
                        if(OutOfNDecoding(b & 0x0f)) {
                                *len = Uart.byteCnt;
                                return TRUE;
@@ -995,7 +966,7 @@ void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain
        {
 
                uint8_t mac_responses[64] = { 0 };
-               Dbprintf("Going into attack mode");
+               Dbprintf("Going into attack mode, %d CSNS sent", numberOfCSNS);
                // In this mode, a number of csns are within datain. We'll simulate each one, one at a time
                // in order to collect MAC's from the reader. This can later be used in an offlne-attack
                // in order to obtain the keys, as in the "dismantling iclass"-paper.
@@ -1005,7 +976,7 @@ void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain
                        // The usb data is 512 bytes, fitting 65 8-byte CSNs in there.
 
                        memcpy(csn_crc, datain+(i*8), 8);
-                       if(doIClassSimulation(csn_crc,1,mac_responses))
+                       if(doIClassSimulation(csn_crc,1,mac_responses+i*8))
                        {
                                return; // Button pressed
                        }
@@ -1028,8 +999,6 @@ void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain
  */
 int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived, uint8_t *reader_mac_buf)
 {
-
-
        // CSN followed by two CRC bytes
        uint8_t response2[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
        uint8_t response3[] = { 0,0,0,0,0,0,0,0,0,0};
@@ -1080,7 +1049,7 @@ int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived, uint8_t *reader
 
        // + 1720..
        uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
-       memset(receivedCmd, 0x44, RECV_CMD_SIZE);
+       memset(receivedCmd, 0x44, MAX_FRAME_SIZE);
        int len;
 
        // Prepare card messages
@@ -1176,9 +1145,10 @@ int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived, uint8_t *reader
                        respsize = 0;
                        if (breakAfterMacReceived){
                                // dbprintf:ing ...
-                               Dbprintf("CSN: %02x %02x %02x %02x %02x %02x %02x %02x",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
+                               Dbprintf("CSN: %02x %02x %02x %02x %02x %02x %02x %02x"
+                                                  ,csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
                                Dbprintf("RDR:  (len=%02d): %02x %02x %02x %02x %02x %02x %02x %02x %02x",len,
-                                                receivedCmd[0], receivedCmd[1], receivedCmd[2],
+                                               receivedCmd[0], receivedCmd[1], receivedCmd[2],
                                                receivedCmd[3], receivedCmd[4], receivedCmd[5],
                                                receivedCmd[6], receivedCmd[7], receivedCmd[8]);
                                if (reader_mac_buf != NULL)
@@ -1220,14 +1190,13 @@ int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived, uint8_t *reader
                }
 
                if (tracing) {
-                       LogTrace(receivedCmd,len, (r2t_time-time_0)<< 4, Uart.parityBits,TRUE);
-                       LogTrace(NULL,0, (r2t_time-time_0) << 4, 0,TRUE);
+                       uint8_t parity[MAX_PARITY_SIZE];
+                       GetParity(receivedCmd, len, parity);
+                       LogTrace(receivedCmd,len, (r2t_time-time_0)<< 4, (r2t_time-time_0) << 4, parity, TRUE);
 
                        if (respdata != NULL) {
-                               LogTrace(respdata,respsize, (t2r_time-time_0) << 4,SwapBits(GetParity(respdata,respsize),respsize),FALSE);
-                               LogTrace(NULL,0, (t2r_time-time_0) << 4,0,FALSE);
-
-
+                               GetParity(respdata, respsize, parity);
+                               LogTrace(respdata, respsize, (t2r_time-time_0) << 4, (t2r_time-time_0) << 4, parity, FALSE);
                        }
                        if(!tracing) {
                                DbpString("Trace full");
@@ -1235,7 +1204,7 @@ int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived, uint8_t *reader
                        }
 
                }
-               memset(receivedCmd, 0x44, RECV_CMD_SIZE);
+               memset(receivedCmd, 0x44, MAX_FRAME_SIZE);
        }
 
        //Dbprintf("%x", cmdsRecvd);
@@ -1296,8 +1265,8 @@ static void TransmitIClassCommand(const uint8_t *cmd, int len, int *samples, int
   FpgaSetupSsc();
 
    if (wait)
-    if(*wait < 10)
-      *wait = 10;
+   {
+     if(*wait < 10) *wait = 10;
 
   for(c = 0; c < *wait;) {
     if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
@@ -1311,6 +1280,9 @@ static void TransmitIClassCommand(const uint8_t *cmd, int len, int *samples, int
     WDT_HIT();
   }
 
+   }
+
+
   uint8_t sendbyte;
   bool firstpart = TRUE;
   c = 0;
@@ -1391,10 +1363,8 @@ void ReaderTransmitIClass(uint8_t* frame, int len)
 {
   int wait = 0;
   int samples = 0;
-  int par = 0;
 
   // This is tied to other size changes
-  //   uint8_t* frame_addr = ((uint8_t*)BigBuf) + 2024;
   CodeIClassCommand(frame,len);
 
   // Select the card
@@ -1403,7 +1373,11 @@ void ReaderTransmitIClass(uint8_t* frame, int len)
        LED_A_ON();
 
   // Store reader command in buffer
-  if (tracing) LogTrace(frame,len,rsamples,par,TRUE);
+  if (tracing) {
+               uint8_t par[MAX_PARITY_SIZE];
+               GetParity(frame, len, par);
+               LogTrace(frame, len, rsamples, rsamples, par, TRUE);
+       }
 }
 
 //-----------------------------------------------------------------------------
@@ -1434,7 +1408,7 @@ static int GetIClassAnswer(uint8_t *receivedResponse, int maxLen, int *samples,
        for(;;) {
                WDT_HIT();
 
-               if(BUTTON_PRESS()) return FALSE;
+           if(BUTTON_PRESS()) return FALSE;
 
                if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
                        AT91C_BASE_SSC->SSC_THR = 0x00;  // To make use of exact timing of next command from reader!!
@@ -1445,10 +1419,7 @@ static int GetIClassAnswer(uint8_t *receivedResponse, int maxLen, int *samples,
                        b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
                        skip = !skip;
                        if(skip) continue;
-                       /*if(ManchesterDecoding((b>>4) & 0xf)) {
-                               *samples = ((c - 1) << 3) + 4;
-                               return TRUE;
-                       }*/
+               
                        if(ManchesterDecoding(b & 0x0f)) {
                                *samples = c << 3;
                                return  TRUE;
@@ -1462,7 +1433,11 @@ int ReaderReceiveIClass(uint8_t* receivedAnswer)
   int samples = 0;
   if (!GetIClassAnswer(receivedAnswer,160,&samples,0)) return FALSE;
   rsamples += samples;
-  if (tracing) LogTrace(receivedAnswer,Demod.len,rsamples,Demod.parityBits,FALSE);
+  if (tracing){
+               uint8_t parity[MAX_PARITY_SIZE];
+               GetParity(receivedAnswer, Demod.len, parity);
+               LogTrace(receivedAnswer,Demod.len,rsamples,rsamples,parity,FALSE);
+  }
   if(samples == 0) return FALSE;
   return Demod.len;
 }
@@ -1502,7 +1477,7 @@ void ReaderIClass(uint8_t arg0) {
     uint8_t card_data[24]={0};
     uint8_t last_csn[8]={0};
 
-       uint8_t* resp = (((uint8_t *)BigBuf) + 3560);   // was 3560 - tied to other size changes
+       uint8_t *resp = (((uint8_t *)BigBuf) + RECV_RESP_OFFSET);
 
     int read_status= 0;
     bool abort_after_read = arg0 & FLAG_ICLASS_READER_ONLY_ONCE;
@@ -1514,23 +1489,23 @@ void ReaderIClass(uint8_t arg0) {
     {
         WDT_HIT();
 
-               // Send act_all
-               ReaderTransmitIClass(act_all, 1);
-               // Card present?
-               if(ReaderReceiveIClass(resp)) {
+        // Send act_all
+        ReaderTransmitIClass(act_all, 1);
+        // Card present?
+        if(ReaderReceiveIClass(resp)) {
 
-                       ReaderTransmitIClass(identify, 1);
+            ReaderTransmitIClass(identify, 1);
 
-                       if(ReaderReceiveIClass(resp) == 10) {
+            if(ReaderReceiveIClass(resp) == 10) {
                 //Copy the Anti-collision CSN to our select-packet
-                               memcpy(&select[1],resp,8);
+                memcpy(&select[1],resp,8);
                 //Dbprintf("Anti-collision CSN: %02x %02x %02x %02x %02x %02x %02x %02x",resp[0], resp[1], resp[2],
                 //        resp[3], resp[4], resp[5],
                 //        resp[6], resp[7]);
                 //Select the card
-                               ReaderTransmitIClass(select, sizeof(select));
+                ReaderTransmitIClass(select, sizeof(select));
 
-                               if(ReaderReceiveIClass(resp) == 10) {
+                if(ReaderReceiveIClass(resp) == 10) {
                     //Save CSN in response data
                     memcpy(card_data,resp,8);
                     datasize += 8;
@@ -1569,7 +1544,7 @@ void ReaderIClass(uint8_t arg0) {
             break;
         }
     }
-       LED_A_OFF();
+    LED_A_OFF();
 }
 
 void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
@@ -1580,7 +1555,7 @@ void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
        uint8_t check[]       = { 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
        uint8_t read[]        = { 0x0c, 0x00, 0x00, 0x00 };
        
-        uint16_t crc = 0;
+    uint16_t crc = 0;
        uint8_t cardsize=0;
        bool read_success=false;
        uint8_t mem=0;
@@ -1593,7 +1568,7 @@ void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
          int keyaccess;
        } memory;
        
-       uint8_t* resp = (((uint8_t *)BigBuf) + 3560);   // was 3560 - tied to other size changes
+       uint8_t* resp = (((uint8_t *)BigBuf) + RECV_RESP_OFFSET);
 
     setupIclassReader();
 
@@ -1712,7 +1687,7 @@ void IClass_iso14443A_write(uint8_t arg0, uint8_t blockNo, uint8_t *data, uint8_
        
     uint16_t crc = 0;
        
-       uint8_t* resp = (((uint8_t *)BigBuf) + 3560);   // was 3560 - tied to other size changes
+       uint8_t* resp = (((uint8_t *)BigBuf) + RECV_RESP_OFFSET);
 
        // Reset trace buffer
        memset(trace, 0x44, RECV_CMD_OFFSET);
@@ -1814,7 +1789,7 @@ void IClass_iso14443A_write(uint8_t arg0, uint8_t blockNo, uint8_t *data, uint8_
                                memcpy(write+10,mac,4);
                                while(!send_success){
                                  ReaderTransmitIClass(write, sizeof(write));
-                                     if(ReaderReceiveIClass(resp) == 10) {
+                                 if(ReaderReceiveIClass(resp) == 10) {
                                    write_success=true;
                                }
                        }//
Impressum, Datenschutz