X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/28ae37b74612436cc2e5fee4dbcc3e42cc9aaf03..852ecedc16ee8220c8208828c55d14a668e69c30:/armsrc/iclass.c?ds=sidebyside

diff --git a/armsrc/iclass.c b/armsrc/iclass.c
index 9f5bc7ce..afe1a607 100644
--- a/armsrc/iclass.c
+++ b/armsrc/iclass.c
@@ -24,7 +24,7 @@
 #include "string.h"
 #include "printf.h"
 #include "common.h"
-#include "cmd.h"
+#include "usb_cdc.h"
 #include "iso14443a.h"
 #include "iso15693.h"
 // Needed for CRC in emulation mode;
@@ -34,7 +34,6 @@
 #include "iso15693tools.h"
 #include "protocols.h"
 #include "optimized_cipher.h"
-#include "usb_cdc.h" // for usb_poll_validate_length
 #include "fpgaloader.h"
 
 // iCLASS has a slightly different timing compared to ISO15693. According to the picopass data sheet the tag response is expected 330us after
@@ -646,8 +645,8 @@ static void ReaderTransmitIClass(uint8_t *frame, int len, uint32_t *start_time)
 
 
 static bool sendCmdGetResponseWithRetries(uint8_t* command, size_t cmdsize, uint8_t* resp, size_t max_resp_size,
-										  uint8_t expected_size, uint8_t retries, uint32_t start_time, uint32_t timeout, uint32_t *eof_time) {
-	while (retries-- > 0) {
+										  uint8_t expected_size, uint8_t tries, uint32_t start_time, uint32_t timeout, uint32_t *eof_time) {
+	while (tries-- > 0) {
 		ReaderTransmitIClass(command, cmdsize, &start_time);
 		if (expected_size == GetIso15693AnswerFromTag(resp, max_resp_size, timeout, eof_time)) {
 			return true;
@@ -675,14 +674,14 @@ static bool selectIclassTag(uint8_t *card_data, uint32_t *eof_time) {
 	// Send act_all
 	ReaderTransmitIClass(act_all, 1, &start_time);
 	// Card present?
-	if (GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_ACTALL, eof_time) < 0) return false;//Fail
+	if (GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_ACTALL, eof_time) < 0) return false; //Fail
 
 	//Send Identify
 	start_time = *eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
 	ReaderTransmitIClass(identify, 1, &start_time);
 	//We expect a 10-byte response here, 8 byte anticollision-CSN and 2 byte CRC
 	uint8_t len = GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_OTHERS, eof_time);
-	if (len != 10) return false;//Fail
+	if (len != 10) return false; //Fail
 
 	//Copy the Anti-collision CSN to our select-packet
 	memcpy(&select[1], resp, 8);
@@ -691,7 +690,7 @@ static bool selectIclassTag(uint8_t *card_data, uint32_t *eof_time) {
 	ReaderTransmitIClass(select, sizeof(select), &start_time);
 	//We expect a 10-byte response here, 8 byte CSN and 2 byte CRC
 	len = GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_OTHERS, eof_time);
-	if (len != 10) return false;//Fail
+	if (len != 10) return false; //Fail
 
 	//Success - we got CSN
 	//Save CSN in response data
@@ -734,42 +733,42 @@ void ReaderIClass(uint8_t flags) {
 	if (selectIclassTag(resp, &eof_time)) {
 		result_status = FLAG_ICLASS_READER_CSN;
 		memcpy(card_data, resp, 8);
-	}
 
-	start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
+		start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
 
-	//Read block 1, config
-	if (flags & FLAG_ICLASS_READER_CONF) {
-		if (sendCmdGetResponseWithRetries(readConf, sizeof(readConf), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
-			result_status |= FLAG_ICLASS_READER_CONF;
-			memcpy(card_data+8, resp, 8);
-		} else {
-			Dbprintf("Failed to read config block");
+		//Read block 1, config
+		if (flags & FLAG_ICLASS_READER_CONF) {
+			if (sendCmdGetResponseWithRetries(readConf, sizeof(readConf), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
+				result_status |= FLAG_ICLASS_READER_CONF;
+				memcpy(card_data+8, resp, 8);
+			} else {
+				Dbprintf("Failed to read config block");
+			}
+			start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
 		}
-		start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
-	}
 
-	//Read block 2, e-purse
-	if (flags & FLAG_ICLASS_READER_CC) {
-		if (sendCmdGetResponseWithRetries(readEpurse, sizeof(readEpurse), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
-			result_status |= FLAG_ICLASS_READER_CC;
-			memcpy(card_data + (8*2), resp, 8);
-		} else {
-			Dbprintf("Failed to read e-purse");
+		//Read block 2, e-purse
+		if (flags & FLAG_ICLASS_READER_CC) {
+			if (sendCmdGetResponseWithRetries(readEpurse, sizeof(readEpurse), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
+				result_status |= FLAG_ICLASS_READER_CC;
+				memcpy(card_data + (8*2), resp, 8);
+			} else {
+				Dbprintf("Failed to read e-purse");
+			}
+			start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
 		}
-		start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
-	}
 
-	//Read block 5, AA
-	if (flags & FLAG_ICLASS_READER_AA) {
-		if (sendCmdGetResponseWithRetries(readAA, sizeof(readAA), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
-			result_status |= FLAG_ICLASS_READER_AA;
-			memcpy(card_data + (8*5), resp, 8);
-		} else {
-			Dbprintf("Failed to read AA block");
+		//Read block 5, AA
+		if (flags & FLAG_ICLASS_READER_AA) {
+			if (sendCmdGetResponseWithRetries(readAA, sizeof(readAA), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time)) {
+				result_status |= FLAG_ICLASS_READER_AA;
+				memcpy(card_data + (8*5), resp, 8);
+			} else {
+				Dbprintf("Failed to read AA block");
+			}
 		}
 	}
-
+	
 	cmd_send(CMD_ACK, result_status, 0, 0, card_data, sizeof(card_data));
 
 	LED_A_OFF();
@@ -781,7 +780,7 @@ void iClass_Check(uint8_t *NRMAC) {
 	uint8_t resp[4];
 	memcpy(check+1, NRMAC, 8);
 	uint32_t eof_time;
-	bool isOK = sendCmdGetResponseWithRetries(check, sizeof(check), resp, sizeof(resp), 4, 6, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
+	bool isOK = sendCmdGetResponseWithRetries(check, sizeof(check), resp, sizeof(resp), 4, 3, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
 	cmd_send(CMD_ACK, isOK, 0, 0, resp, sizeof(resp));
 }
 
@@ -793,7 +792,7 @@ void iClass_Readcheck(uint8_t block, bool use_credit_key) {
 	}
 	uint8_t resp[8];
 	uint32_t eof_time;
-	bool isOK = sendCmdGetResponseWithRetries(readcheck, sizeof(readcheck), resp, sizeof(resp), 8, 6, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
+	bool isOK = sendCmdGetResponseWithRetries(readcheck, sizeof(readcheck), resp, sizeof(resp), 8, 3, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
 	cmd_send(CMD_ACK, isOK, 0, 0, resp, sizeof(resp));
 }
 
@@ -820,9 +819,9 @@ void iClass_ReadBlk(uint8_t blockno) {
 
 	uint8_t readblockdata[10];
 	bool isOK = iClass_ReadBlock(blockno, readblockdata);
-	cmd_send(CMD_ACK, isOK, 0, 0, readblockdata, 8);
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	LED_D_OFF();
+	cmd_send(CMD_ACK, isOK, 0, 0, readblockdata, 8);
 
 	LED_A_OFF();
 }
@@ -848,6 +847,9 @@ void iClass_Dump(uint8_t startblock, uint8_t numblks) {
 		}
 	}
 
+	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+	LED_D_OFF();
+
 	cmd_send(CMD_ACK, isOK, blkCnt, 0, readblockdata, blkCnt*8);
 
 	LED_A_OFF();
@@ -863,12 +865,27 @@ static bool iClass_WriteBlock_ext(uint8_t blockNo, uint8_t *data) {
 	bool isOK = false;
 	uint32_t eof_time = 0;
 
-	isOK = sendCmdGetResponseWithRetries(write, sizeof(write), resp, sizeof(resp), 10, 10, 0, ICLASS_READER_TIMEOUT_UPDATE, &eof_time);
-	if (isOK && blockNo != 3 && blockNo != 4 && memcmp(write+2, resp, 8)) { // check response
-		isOK = false;
+	isOK = sendCmdGetResponseWithRetries(write, sizeof(write), resp, sizeof(resp), 10, 3, 0, ICLASS_READER_TIMEOUT_UPDATE, &eof_time);
+	if (!isOK) {
+		return false;
+	}
+	
+	uint8_t all_ff[8] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+	if (blockNo == 2) {
+		if (memcmp(data+4, resp, 4) || memcmp(data, resp+4, 4)) { // check response. e-purse update swaps first and second half
+			return false;
+		}
+	} else if (blockNo == 3 || blockNo == 4) {
+		if (memcmp(all_ff, resp, 8)) { // check response. Key updates always return 0xffffffffffffffff
+			return false;
+		}
+	} else {
+		if (memcmp(data, resp, 8)) { // check response. All other updates return unchanged data
+			return false;
+		}
 	}
 
-	return isOK;
+	return true;
 }
 
 
@@ -882,40 +899,39 @@ void iClass_WriteBlock(uint8_t blockNo, uint8_t *data) {
 	} else {
 		Dbprintf("Write block [%02x] failed", blockNo);
 	}
-	cmd_send(CMD_ACK, isOK, 0, 0, 0, 0);
-
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	LED_D_OFF();
 
+	cmd_send(CMD_ACK, isOK, 0, 0, 0, 0);
 	LED_A_OFF();
 }
 
 
 void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data) {
-	int i;
+
+	LED_A_ON();
+
 	int written = 0;
-	int total_block = (endblock - startblock) + 1;
-	for (i = 0; i < total_block; i++) {
+	int total_blocks = (endblock - startblock) + 1;
+
+	for (uint8_t block = startblock; block <= endblock; block++) {
 		// block number
-		if (iClass_WriteBlock_ext(i+startblock, data + (i*12))){
-			Dbprintf("Write block [%02x] successful", i + startblock);
+		if (iClass_WriteBlock_ext(block, data + (block-startblock)*12)) {
+			Dbprintf("Write block [%02x] successful", block);
 			written++;
 		} else {
-			if (iClass_WriteBlock_ext(i+startblock, data + (i*12))){
-				Dbprintf("Write block [%02x] successful", i + startblock);
-				written++;
-			} else {
-				Dbprintf("Write block [%02x] failed", i + startblock);
-			}
+			Dbprintf("Write block [%02x] failed", block);
 		}
 	}
-	if (written == total_block)
+
+	if (written == total_blocks)
 		Dbprintf("Clone complete");
 	else
 		Dbprintf("Clone incomplete");
 
-	cmd_send(CMD_ACK, 1, 0, 0, 0, 0);
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	LED_D_OFF();
+
+	cmd_send(CMD_ACK, 1, 0, 0, 0, 0);
 	LED_A_OFF();
 }