response8[0] = 0x80;
response8[1] = 0x80;
ComputeCrc14443(CRC_14443_A, response8, 2, &response8[2], &response8[3]);
+ // uid not supplied then get from emulator memory
+ if (data[0]==0) {
+ uint16_t start = 4 * (0+12);
+ uint8_t emdata[8];
+ emlGetMemBt( emdata, start, sizeof(emdata));
+ memcpy(data, emdata, 3); //uid bytes 0-2
+ memcpy(data+3, emdata+4, 4); //uid bytes 3-7
+ flags |= FLAG_7B_UID_IN_DATA;
+ }
} break;
default: {
Dbprintf("Error: unkown tagtype (%d)",tagType);
// TC(1) = 0x02: CID supported, NAD not supported
ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]);
- // Prepare GET_VERSION (different for EV-1 / NTAG)
+ // Prepare GET_VERSION (different for UL EV-1 / NTAG)
//uint8_t response7_EV1[] = {0x00, 0x04, 0x03, 0x01, 0x01, 0x00, 0x0b, 0x03, 0xfd, 0xf7}; //EV1 48bytes VERSION.
- uint8_t response7_NTAG[] = {0x00, 0x04, 0x04, 0x02, 0x01, 0x00, 0x11, 0x03, 0x01, 0x9e}; //NTAG 215
+ //uint8_t response7_NTAG[] = {0x00, 0x04, 0x04, 0x02, 0x01, 0x00, 0x11, 0x03, 0x01, 0x9e}; //NTAG 215
// Prepare CHK_TEARING
- uint8_t response9[] = {0xBD,0x90,0x3f};
+ //uint8_t response9[] = {0xBD,0x90,0x3f};
#define TAG_RESPONSE_COUNT 10
tag_response_info_t responses[TAG_RESPONSE_COUNT] = {
{ .response = response3a, .response_n = sizeof(response3a) }, // Acknowledge select - cascade 2
{ .response = response5, .response_n = sizeof(response5) }, // Authentication answer (random nonce)
{ .response = response6, .response_n = sizeof(response6) }, // dummy ATS (pseudo-ATR), answer to RATS
- { .response = response7_NTAG, .response_n = sizeof(response7_NTAG) }, // EV1/NTAG GET_VERSION response
- { .response = response8, .response_n = sizeof(response8) }, // EV1/NTAG PACK response
- { .response = response9, .response_n = sizeof(response9) } // EV1/NTAG CHK_TEAR response
+ //{ .response = response7_NTAG, .response_n = sizeof(response7_NTAG)}, // EV1/NTAG GET_VERSION response
+ { .response = response8, .response_n = sizeof(response8) } // EV1/NTAG PACK response
+ //{ .response = response9, .response_n = sizeof(response9) } // EV1/NTAG CHK_TEAR response
};
// Allocate 512 bytes for the dynamic modulation, created when the reader queries for it
// Prepare the responses of the anticollision phase
// there will be not enough time to do this at the moment the reader sends it REQA
- for (size_t i=0; i<TAG_RESPONSE_COUNT; i++) {
+ for (size_t i=0; i<TAG_RESPONSE_COUNT; i++)
prepare_allocated_tag_modulation(&responses[i]);
- }
int len = 0;
LED_A_ON();
for(;;) {
// Clean receive command buffer
-
if(!GetIso14443aCommandFromReader(receivedCmd, receivedCmdPar, &len)) {
DbpString("Button press");
break;
p_response = &responses[4]; order = 30;
} else if(receivedCmd[0] == 0x30) { // Received a (plain) READ
uint8_t block = receivedCmd[1];
- if ( tagType == 7 ) {
- uint16_t start = 4 * block;
-
- /*if ( block < 4 ) {
- //NTAG 215
- uint8_t blockdata[50] = {
- data[0],data[1],data[2], 0x88 ^ data[0] ^ data[1] ^ data[2],
- data[3],data[4],data[5],data[6],
- data[3] ^ data[4] ^ data[5] ^ data[6],0x48,0x0f,0xe0,
- 0xe1,0x10,0x12,0x00,
- 0x03,0x00,0xfe,0x00,
- 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
- 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
- 0x00,0x00,0x00,0x00,
- 0x00,0x00};
- AppendCrc14443a(blockdata+start, 16);
- EmSendCmdEx( blockdata+start, MAX_MIFARE_FRAME_SIZE, false);
- } else {*/
+ // if Ultralight or NTAG (4 byte blocks)
+ if ( tagType == 7 || tagType == 2 ) {
+ //first 12 blocks of emu are [getversion answer - check tearing - pack - 0x00 - signature]
+ uint16_t start = 4 * (block+12);
uint8_t emdata[MAX_MIFARE_FRAME_SIZE];
emlGetMemBt( emdata, start, 16);
AppendCrc14443a(emdata, 16);
EmSendCmdEx(emdata, sizeof(emdata), false);
- //}
+ // We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
p_response = NULL;
-
- } else {
- EmSendCmdEx(data+(4*block),16,false);
+ } else { // all other tags (16 byte block tags)
+ EmSendCmdEx(data+(4*receivedCmd[1]),16,false);
// Dbprintf("Read request from reader: %x %x",receivedCmd[0],receivedCmd[1]);
// We already responded, do not send anything with the EmSendCmd14443aRaw() that is called below
p_response = NULL;
} else if(receivedCmd[0] == 0x3A) { // Received a FAST READ (ranged read)
uint8_t emdata[MAX_FRAME_SIZE];
- int start = receivedCmd[1] * 4;
+ //first 12 blocks of emu are [getversion answer - check tearing - pack - 0x00 - signature]
+ int start = (receivedCmd[1]+12) * 4;
int len = (receivedCmd[2] - receivedCmd[1] + 1) * 4;
emlGetMemBt( emdata, start, len);
AppendCrc14443a(emdata, len);
} else if(receivedCmd[0] == 0x3C && tagType == 7) { // Received a READ SIGNATURE --
// ECC data, taken from a NTAG215 amiibo token. might work. LEN: 32, + 2 crc
- uint8_t data[] = {0x56,0x06,0xa6,0x4f,0x43,0x32,0x53,0x6f,
- 0x43,0xda,0x45,0xd6,0x61,0x38,0xaa,0x1e,
- 0xcf,0xd3,0x61,0x36,0xca,0x5f,0xbb,0x05,
- 0xce,0x21,0x24,0x5b,0xa6,0x7a,0x79,0x07,
- 0x00,0x00};
- AppendCrc14443a(data, sizeof(data)-2);
- EmSendCmdEx(data,sizeof(data),false);
+ //first 12 blocks of emu are [getversion answer - check tearing - pack - 0x00 - signature]
+ uint16_t start = 4 * 4;
+ uint8_t emdata[34];
+ emlGetMemBt( emdata, start, 32);
+ AppendCrc14443a(emdata, 32);
+ EmSendCmdEx(emdata, sizeof(emdata), false);
+ //uint8_t data[] = {0x56,0x06,0xa6,0x4f,0x43,0x32,0x53,0x6f,
+ // 0x43,0xda,0x45,0xd6,0x61,0x38,0xaa,0x1e,
+ // 0xcf,0xd3,0x61,0x36,0xca,0x5f,0xbb,0x05,
+ // 0xce,0x21,0x24,0x5b,0xa6,0x7a,0x79,0x07,
+ // 0x00,0x00};
+ //AppendCrc14443a(data, sizeof(data)-2);
+ //EmSendCmdEx(data,sizeof(data),false);
p_response = NULL;
} else if (receivedCmd[0] == 0x39 && tagType == 7) { // Received a READ COUNTER --
uint8_t index = receivedCmd[1];
p_response = NULL;
} else if(receivedCmd[0] == 0x3E && tagType == 7) { // Received a CHECK_TEARING_EVENT --
- p_response = &responses[9];
+ //first 12 blocks of emu are [getversion answer - check tearing - pack - 0x00 - signature]
+ uint8_t emdata[3];
+ uint8_t counter=0;
+ if (receivedCmd[1]<3) counter = receivedCmd[1];
+ emlGetMemBt( emdata, 10+counter, 1);
+ AppendCrc14443a(emdata, sizeof(emdata)-2);
+ EmSendCmdEx(emdata, sizeof(emdata), false);
+ p_response = NULL;
+ //p_response = &responses[9];
+
} else if(receivedCmd[0] == 0x50) { // Received a HALT
if (tracing) {
} else if(receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61) { // Received an authentication request
if ( tagType == 7 ) { // IF NTAG /EV1 0x60 == GET_VERSION, not a authentication request.
- p_response = &responses[7];
+ uint8_t emdata[10];
+ emlGetMemBt( emdata, 0, 8 );
+ AppendCrc14443a(emdata, sizeof(emdata)-2);
+ EmSendCmdEx(emdata, sizeof(emdata), false);
+ p_response = NULL;
+ //p_response = &responses[7];
} else {
p_response = &responses[5]; order = 7;
}
else if (receivedCmd[0] == 0x1b) // NTAG / EV-1 authentication
{
if ( tagType == 7 ) {
- p_response = &responses[8]; // PACK response
+ uint16_t start = 13; //first 4 blocks of emu are [getversion answer - check tearing - pack - 0x00]
+ uint8_t emdata[4];
+ emlGetMemBt( emdata, start, 2);
+ AppendCrc14443a(emdata, 2);
+ EmSendCmdEx(emdata, sizeof(emdata), false);
+ p_response = NULL;
+ //p_response = &responses[8]; // PACK response
uint32_t pwd = bytes_to_num(receivedCmd+1,4);
if ( MF_DBGLEVEL >= 3) Dbprintf("Auth attempt: %08x", pwd);
}
- }
- else {
+ } else {
// Check for ISO 14443A-4 compliant commands, look at left nibble
switch (receivedCmd[0]) {
case 0x02:
uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
static uint8_t mf_nr_ar3;
- uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
- uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
+ uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
+ uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};
- if (first_try) {
+ if (first_try)
iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
- }
// free eventually allocated BigBuf memory. We want all for tracing.
BigBuf_free();
-
clear_trace();
set_tracing(TRUE);
uint8_t par[1] = {0}; // maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
static byte_t par_low = 0;
bool led_on = TRUE;
- uint8_t uid[10] ={0};
+ uint8_t uid[10] = {0};
uint32_t cuid;
uint32_t nt = 0;
byte_t par_list[8] = {0x00};
byte_t ks_list[8] = {0x00};
- #define PRNG_SEQUENCE_LENGTH (1 << 16);
+ #define PRNG_SEQUENCE_LENGTH (1 << 16);
static uint32_t sync_time = 0;
static int32_t sync_cycles = 0;
int catch_up_cycles = 0;
uint32_t select_time;
uint32_t halt_time;
- for(uint16_t i = 0; TRUE; i++) {
+ for(uint16_t i = 0; TRUE; ++i) {
LED_C_ON();
WDT_HIT();
if (ReaderReceive(receivedAnswer, receivedAnswerPar)) {
catch_up_cycles = 8; // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer
- if (nt_diff == 0) {
+ if (nt_diff == 0)
par_low = par[0] & 0xE0; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
- }
led_on = !led_on;
if(led_on) LED_B_ON(); else LED_B_OFF();
mf_nr_ar[3] = (mf_nr_ar[3] & 0x1F) | (nt_diff << 5);
par[0] = par_low;
} else {
- if (nt_diff == 0 && first_try)
- {
+ if (nt_diff == 0 && first_try) {
par[0]++;
if (par[0] == 0x00) { // tried all 256 possible parities without success. Card doesn't send NACK.
isOK = -2;
}
}
- byte_t buf[28];
+ byte_t buf[28] = {0x00};
memcpy(buf + 0, uid, 4);
num_to_bytes(nt, 4, buf + 4);
memcpy(buf + 8, par_list, 8);
//uint8_t rSAK[] = {0x09, 0x3f, 0xcc }; // Mifare Mini
uint8_t rSAK1[] = {0x04, 0xda, 0x17};
- uint8_t rAUTH_NT[] = {0x01, 0x01, 0x01, 0x01};
+ //uint8_t rAUTH_NT[] = {0x01, 0x01, 0x01, 0x01};
+ uint8_t rAUTH_NT[] = {0x55, 0x41, 0x49, 0x92};
uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
- //Here, we collect UID,NT,AR,NR,UID2,NT2,AR2,NR2
+ //Here, we collect UID1,UID2,NT,AR,NR,0,0,NT2,AR2,NR2
// This can be used in a reader-only attack.
// (it can also be retrieved via 'hf 14a list', but hey...
uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
bool finished = FALSE;
- while (!BUTTON_PRESS() && !finished) {
+ while (!BUTTON_PRESS() && !finished && !usb_poll_validate_length()) {
WDT_HIT();
// find reader field
break;
}
case MFEMUL_AUTH1:{
- if( len != 8)
- {
+ if( len != 8) {
cardSTATE_TO_IDLE();
LogTrace(Uart.output, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
break;
//Collect AR/NR
//if(ar_nr_collected < 2 && cardAUTHSC == 2){
- if(ar_nr_collected < 2){
- if(ar_nr_responses[2] != ar)
- {// Avoid duplicates... probably not necessary, ar should vary.
+ if(ar_nr_collected < 2) {
+ if(ar_nr_responses[2] != ar) {
+ // Avoid duplicates... probably not necessary, ar should vary.
//ar_nr_responses[ar_nr_collected*5] = 0;
//ar_nr_responses[ar_nr_collected*5+1] = 0;
ar_nr_responses[ar_nr_collected*5+2] = nonce;
}
// Interactive mode flag, means we need to send ACK
if(flags & FLAG_INTERACTIVE && ar_nr_collected == 2)
- {
finished = true;
- }
}
// --- crypto
EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
LED_C_ON();
cardSTATE = MFEMUL_WORK;
- if (MF_DBGLEVEL >= 4) Dbprintf("AUTH COMPLETED for sector %d with key %c. time=%d",
- cardAUTHSC, cardAUTHKEY == 0 ? 'A' : 'B',
- GetTickCount() - authTimer);
+ if (MF_DBGLEVEL >= 4) {
+ Dbprintf("AUTH COMPLETED for sector %d with key %c. time=%d",
+ cardAUTHSC,
+ cardAUTHKEY == 0 ? 'A' : 'B',
+ GetTickCount() - authTimer
+ );
+ }
break;
}
case MFEMUL_SELECT2:{
// select 2 card
if (len == 9 &&
- (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x70 && memcmp(&receivedCmd[2], rUIDBCC2, 4) == 0)) {
+ (receivedCmd[0] == 0x95 &&
+ receivedCmd[1] == 0x70 &&
+ memcmp(&receivedCmd[2], rUIDBCC2, 4) == 0) ) {
EmSendCmd(rSAK, sizeof(rSAK));
cuid = bytes_to_num(rUIDBCC2, 4);
cardSTATE = MFEMUL_WORK;
bool encrypted_data = (cardAUTHKEY != 0xFF) ;
- if(encrypted_data) {
- // decrypt seqence
+ // decrypt seqence
+ if(encrypted_data)
mf_crypto1_decrypt(pcs, receivedCmd, len);
- }
if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
authTimer = GetTickCount();
}
// read block
if (receivedCmd[0] == 0x30) {
- if (MF_DBGLEVEL >= 4) {
- Dbprintf("Reader reading block %d (0x%02x)",receivedCmd[1],receivedCmd[1]);
- }
+ if (MF_DBGLEVEL >= 4) Dbprintf("Reader reading block %d (0x%02x)",receivedCmd[1],receivedCmd[1]);
+
emlGetMem(response, receivedCmd[1], 1);
AppendCrc14443a(response, 16);
mf_crypto1_encrypt(pcs, response, 18, response_par);
break;
}
case MFEMUL_WRITEBL2:{
- if (len == 18){
+ if (len == 18) {
mf_crypto1_decrypt(pcs, receivedCmd, len);
emlSetMem(receivedCmd, cardWRBL, 1);
EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
} else {
Dbprintf("Failed to obtain two AR/NR pairs!");
if(ar_nr_collected > 0 ) {
- Dbprintf("Only got these: UID=%07x%08x, nonce=%08x, AR1=%08x, NR1=%08x",
+ Dbprintf("Only got these: UID=%06x%08x, nonce=%08x, AR1=%08x, NR1=%08x",
ar_nr_responses[0], // UID1
ar_nr_responses[1], // UID2
ar_nr_responses[2], // NT
// The command (reader -> tag) that we're receiving.
// The length of a received command will in most cases be no more than 18 bytes.
// So 32 should be enough!
- uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE];
- uint8_t receivedCmdPar[MAX_MIFARE_PARITY_SIZE];
+ uint8_t receivedCmd[MAX_MIFARE_FRAME_SIZE] = {0x00};
+ uint8_t receivedCmdPar[MAX_MIFARE_PARITY_SIZE] = {0x00};
// The response (tag -> reader) that we're receiving.
- uint8_t receivedResponse[MAX_MIFARE_FRAME_SIZE];
- uint8_t receivedResponsePar[MAX_MIFARE_PARITY_SIZE];
+ uint8_t receivedResponse[MAX_MIFARE_FRAME_SIZE] = {0x00};
+ uint8_t receivedResponsePar[MAX_MIFARE_PARITY_SIZE] = {0x00};
iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
int register readBufDataP = data - dmaBuf; // number of bytes we have processed so far
int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR; // number of bytes already transferred
- if (readBufDataP <= dmaBufDataP){ // we are processing the same block of data which is currently being transferred
+
+ if (readBufDataP <= dmaBufDataP) // we are processing the same block of data which is currently being transferred
dataLen = dmaBufDataP - readBufDataP; // number of bytes still to be processed
- } else {
+ else
dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP; // number of bytes still to be processed
- }
+
// test for length of buffer
if(dataLen > maxDataLen) { // we are more behind than ever...
maxDataLen = dataLen;
if (sniffCounter & 0x01) {
- if(!TagIsActive) { // no need to try decoding tag data if the reader is sending
+ // no need to try decoding tag data if the reader is sending
+ if(!TagIsActive) {
uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
if(MillerDecoding(readerdata, (sniffCounter-1)*4)) {
LED_C_INV();
+
if (MfSniffLogic(receivedCmd, Uart.len, Uart.parity, Uart.bitCount, TRUE)) break;
/* And ready to receive another command. */
ReaderIsActive = (Uart.state != STATE_UNSYNCD);
}
- if(!ReaderIsActive) { // no need to try decoding tag data if the reader is sending
+ // no need to try decoding tag data if the reader is sending
+ if(!ReaderIsActive) {
uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
if(ManchesterDecoding(tagdata, 0, (sniffCounter-1)*4)) {
LED_C_INV();
// And ready to receive another response.
DemodReset();
+
// And reset the Miller decoder including its (now outdated) input buffer
UartInit(receivedCmd, receivedCmdPar);
}
previous_data = *data;
sniffCounter++;
data++;
- if(data == dmaBuf + DMA_BUFFER_SIZE) {
+
+ if(data == dmaBuf + DMA_BUFFER_SIZE)
data = dmaBuf;
- }
} // main cycle
projects / proxmark3-svn / blobdiff