X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/4b78d6b317923ae9fc7b4739c4c12edb48cb71da..7fa7e812fc913e391ada3008db059bb4393b4804:/armsrc/iso14443a.c?ds=inline

diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index c7fc06ec..29d70dfc 100644
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -17,6 +17,7 @@
 #include "cmd.h"
 #include "iso14443crc.h"
 #include "iso14443a.h"
+#include "iso14443b.h"
 #include "crapto1.h"
 #include "mifareutil.h"
 #include "BigBuf.h"
@@ -187,12 +188,6 @@ void AppendCrc14443a(uint8_t* data, int len)
 	ComputeCrc14443(CRC_14443_A,data,len,data+len,data+len+1);
 }
 
-void AppendCrc14443b(uint8_t* data, int len)
-{
-	ComputeCrc14443(CRC_14443_B,data,len,data+len,data+len+1);
-}
-
-
 //=============================================================================
 // ISO 14443 Type A - Miller decoder
 //=============================================================================
@@ -546,7 +541,7 @@ void RAMFUNC SniffIso14443a(uint8_t param) {
 	
 	// Allocate memory from BigBuf for some buffers
 	// free all previous allocations first
-	BigBuf_free();
+	BigBuf_free(); BigBuf_Clear_ext(false);
 	
 	// init trace buffer
 	clear_trace();
@@ -745,13 +740,12 @@ static void CodeIso14443aAsTagPar(const uint8_t *cmd, uint16_t len, uint8_t *par
 	ToSend[++ToSendMax] = SEC_F;
 
 	// Convert from last byte pos to length
-	ToSendMax++;
+	++ToSendMax;
 }
 
 static void CodeIso14443aAsTag(const uint8_t *cmd, uint16_t len)
 {
-	uint8_t par[MAX_PARITY_SIZE];
-	
+	uint8_t par[MAX_PARITY_SIZE] = {0};
 	GetParity(cmd, len, par);
 	CodeIso14443aAsTagPar(cmd, len, par);
 }
@@ -1167,20 +1161,12 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
 				p_response = NULL;
 				
 		} else if(receivedCmd[0] == 0x3C && tagType == 7) {	// Received a READ SIGNATURE -- 
-				// ECC data,  taken from a NTAG215 amiibo token. might work. LEN: 32, + 2 crc
 				//first 12 blocks of emu are [getversion answer - check tearing - pack - 0x00 - signature]
 				uint16_t start = 4 * 4;
 				uint8_t emdata[34];
 				emlGetMemBt( emdata, start, 32);
 				AppendCrc14443a(emdata, 32);
 				EmSendCmdEx(emdata, sizeof(emdata), false);
-				//uint8_t data[] = {0x56,0x06,0xa6,0x4f,0x43,0x32,0x53,0x6f,
-				//				  0x43,0xda,0x45,0xd6,0x61,0x38,0xaa,0x1e,
-				//				  0xcf,0xd3,0x61,0x36,0xca,0x5f,0xbb,0x05,
-				//				  0xce,0x21,0x24,0x5b,0xa6,0x7a,0x79,0x07,
-				//				  0x00,0x00};
-				//AppendCrc14443a(data, sizeof(data)-2);
-				//EmSendCmdEx(data,sizeof(data),false);
 				p_response = NULL;					
 		} else if (receivedCmd[0] == 0x39 && tagType == 7) {	// Received a READ COUNTER -- 
 			uint8_t index = receivedCmd[1];
@@ -1210,9 +1196,7 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
 			emlGetMemBt( emdata, 10+counter, 1);
 			AppendCrc14443a(emdata, sizeof(emdata)-2);
 			EmSendCmdEx(emdata, sizeof(emdata), false);	
-			p_response = NULL;
-			//p_response = &responses[9];				
-		
+			p_response = NULL;		
 		} else if(receivedCmd[0] == 0x50) {	// Received a HALT
 			LogTrace(receivedCmd, Uart.len, Uart.startTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.endTime*16 - DELAY_AIR2ARM_AS_TAG, Uart.parity, TRUE);
 			p_response = NULL;
@@ -1224,7 +1208,6 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
 				AppendCrc14443a(emdata, sizeof(emdata)-2);
 				EmSendCmdEx(emdata, sizeof(emdata), false);	
 				p_response = NULL;
-				//p_response = &responses[7];
 			} else {
 				p_response = &responses[5]; order = 7;
 			}
@@ -1299,7 +1282,6 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
 				AppendCrc14443a(emdata, 2);
 				EmSendCmdEx(emdata, sizeof(emdata), false);
 				p_response = NULL;
-				//p_response =  &responses[8]; // PACK response
 				uint32_t pwd = bytes_to_num(receivedCmd+1,4);
 				
 				if ( MF_DBGLEVEL >= 3)  Dbprintf("Auth attempt: %08x", pwd);	
@@ -1428,24 +1410,26 @@ void SimulateIso14443aTag(int tagType, int flags, byte_t* data)
 // of bits specified in the delay parameter.
 void PrepareDelayedTransfer(uint16_t delay)
 {
+	delay &= 0x07;
+	if (!delay) return;
+
 	uint8_t bitmask = 0;
 	uint8_t bits_to_shift = 0;
 	uint8_t bits_shifted = 0;
+	uint16_t i = 0;
 
-	delay &= 0x07;
-	if (delay) {
-		for (uint16_t i = 0; i < delay; i++) {
-			bitmask |= (1 << i);
-		}
-		ToSend[++ToSendMax] = 0x00;
-		for (uint16_t i = 0; i < ToSendMax; i++) {
+	for (i = 0; i < delay; ++i)
+		bitmask |= (0x01 << i);
+
+	ToSend[++ToSendMax] = 0x00;
+
+	for (i = 0; i < ToSendMax; ++i) {
 			bits_to_shift = ToSend[i] & bitmask;
 			ToSend[i] = ToSend[i] >> delay;
 			ToSend[i] = ToSend[i] | (bits_shifted << (8 - delay));
 			bits_shifted = bits_to_shift;
 		}
 	}
-}
 
 
 //-------------------------------------------------------------------------------------
@@ -1463,18 +1447,27 @@ static void TransmitFor14443a(const uint8_t *cmd, uint16_t len, uint32_t *timing
 	uint32_t ThisTransferTime = 0;
 
 	if (timing) {
-		if(*timing == 0) {										// Measure time
+
+		if (*timing != 0)
+			// Delay transfer (fine tuning - up to 7 MF clock ticks)
+			PrepareDelayedTransfer(*timing & 0x00000007);	
+		else
+			// Measure time
 			*timing = (GetCountSspClk() + 8) & 0xfffffff8;
-		} else {
-			PrepareDelayedTransfer(*timing & 0x00000007);		// Delay transfer (fine tuning - up to 7 MF clock ticks)
-		}
-		if(MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing");
+
+		
+		if (MF_DBGLEVEL >= 4 && GetCountSspClk() >= (*timing & 0xfffffff8)) 
+			Dbprintf("TransmitFor14443a: Missed timing");
 		
-		while(GetCountSspClk() < (*timing & 0xfffffff8));		// Delay transfer (multiple of 8 MF clock ticks)
+		// Delay transfer (multiple of 8 MF clock ticks)
+		while (GetCountSspClk() < (*timing & 0xfffffff8));	
+
 		LastTimeProxToAirStart = *timing;
 	} else {
 		ThisTransferTime = ((MAX(NextTransferTime, GetCountSspClk()) & 0xfffffff8) + 8);
+
 		while(GetCountSspClk() < ThisTransferTime);
+
 		LastTimeProxToAirStart = ThisTransferTime;
 	}
 	
@@ -2053,20 +2046,22 @@ void iso14443a_setup(uint8_t fpga_minor_mode) {
 
 	// Signal field is on with the appropriate LED
 	if (fpga_minor_mode == FPGA_HF_ISO14443A_READER_MOD
-		|| fpga_minor_mode == FPGA_HF_ISO14443A_READER_LISTEN) {
+		|| fpga_minor_mode == FPGA_HF_ISO14443A_READER_LISTEN)
 		LED_D_ON();
-	} else {
+	else
 		LED_D_OFF();
-	}
+
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | fpga_minor_mode);
 
-	// Start the timer
-	StartCountSspClk();
-	
 	DemodReset();
 	UartReset();
-	NextTransferTime = 2*DELAY_ARM2AIR_AS_READER;
+
 	iso14a_set_timeout(10*106); // 10ms default
+	
+	// Start the timer
+	StartCountSspClk();
+
+	NextTransferTime = 2*DELAY_ARM2AIR_AS_READER;
 }
 
 int iso14_apdu(uint8_t *cmd, uint16_t cmd_len, void *data) {
@@ -2120,13 +2115,14 @@ void ReaderIso14443a(UsbCommand *c)
 	if (param & ISO14A_REQUEST_TRIGGER)
 		iso14a_set_trigger(TRUE);
 
-
 	if (param & ISO14A_CONNECT) {
 		iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
 		if(!(param & ISO14A_NO_SELECT)) {
 			iso14a_card_select_t *card = (iso14a_card_select_t*)buf;
 			arg0 = iso14443a_select_card(NULL,card,NULL, true, 0);
 			cmd_send(CMD_ACK,arg0,card->uidlen,0,buf,sizeof(iso14a_card_select_t));
+			// if it fails,  the cmdhf14a.c client quites.. however this one still executes.
+			if ( arg0 == 0 ) return;
 		}
 	}
 
@@ -2197,33 +2193,56 @@ int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
 
 	if (nt1 == nt2) return 0;
 
+	uint16_t i;
 	uint32_t nttmp1 = nt1;
 	uint32_t nttmp2 = nt2;
 	
-	for (uint16_t i = 1; i < 0xFFFF; i += 8) {
-		nttmp1 = prng_successor(nttmp1, 1);	if (nttmp1 == nt2) return i;
-		nttmp2 = prng_successor(nttmp2, 1);	if (nttmp2 == nt1) return -i;
-		
-		nttmp1 = prng_successor(nttmp1, 2);	if (nttmp1 == nt2) return i+1;
-		nttmp2 = prng_successor(nttmp2, 2);	if (nttmp2 == nt1) return -i-1;
-		
-		nttmp1 = prng_successor(nttmp1, 3);	if (nttmp1 == nt2) return i+2;
-		nttmp2 = prng_successor(nttmp2, 3);	if (nttmp2 == nt1) return -i-2;
-		
-		nttmp1 = prng_successor(nttmp1, 4);	if (nttmp1 == nt2) return i+3;
-		nttmp2 = prng_successor(nttmp2, 4);	if (nttmp2 == nt1) return -i-3;
+	for (i = 1; i < 0xFFFF; i += 8) {
+		nttmp1 = prng_successor_one(nttmp1); if (nttmp1 == nt2) return i;
+		nttmp2 = prng_successor_one(nttmp2); if (nttmp2 == nt1) return -i;
 
-		nttmp1 = prng_successor(nttmp1, 5);	if (nttmp1 == nt2) return i+4;
-		nttmp2 = prng_successor(nttmp2, 5);	if (nttmp2 == nt1) return -i-4;
-		
-		nttmp1 = prng_successor(nttmp1, 6);	if (nttmp1 == nt2) return i+5;
-		nttmp2 = prng_successor(nttmp2, 6);	if (nttmp2 == nt1) return -i-5;
-		
-		nttmp1 = prng_successor(nttmp1, 7);	if (nttmp1 == nt2) return i+6;
-		nttmp2 = prng_successor(nttmp2, 7);	if (nttmp2 == nt1) return -i-6;
-		
-		nttmp1 = prng_successor(nttmp1, 8);	if (nttmp1 == nt2) return i+7;
-		nttmp2 = prng_successor(nttmp2, 8);	if (nttmp2 == nt1) return -i-7;
+		nttmp1 = prng_successor_one(nttmp1); if (nttmp1 == nt2) return i+1;
+		nttmp2 = prng_successor_one(nttmp2); if (nttmp2 == nt1) return -i-1;
+
+		nttmp1 = prng_successor_one(nttmp1); if (nttmp1 == nt2) return i+2;
+		nttmp2 = prng_successor_one(nttmp2); if (nttmp2 == nt1) return -i-2;
+
+		nttmp1 = prng_successor_one(nttmp1); if (nttmp1 == nt2) return i+3;
+		nttmp2 = prng_successor_one(nttmp2); if (nttmp2 == nt1) return -i-3;
+
+		nttmp1 = prng_successor_one(nttmp1); if (nttmp1 == nt2) return i+4;
+		nttmp2 = prng_successor_one(nttmp2); if (nttmp2 == nt1) return -i-4;
+
+		nttmp1 = prng_successor_one(nttmp1); if (nttmp1 == nt2) return i+5;
+		nttmp2 = prng_successor_one(nttmp2); if (nttmp2 == nt1) return -i-5;
+
+		nttmp1 = prng_successor_one(nttmp1); if (nttmp1 == nt2) return i+6;
+		nttmp2 = prng_successor_one(nttmp2); if (nttmp2 == nt1) return -i-6;
+
+		nttmp1 = prng_successor_one(nttmp1); if (nttmp1 == nt2) return i+7;
+		nttmp2 = prng_successor_one(nttmp2); if (nttmp2 == nt1) return -i-7;
+/*
+		if ( prng_successor(nttmp1, i) == nt2) return i;
+		if ( prng_successor(nttmp2, i) == nt1) return -i;
+
+		if ( prng_successor(nttmp1, i+2) == nt2) return i+2;
+		if ( prng_successor(nttmp2, i+2) == nt1) return -(i+2);
+
+		if ( prng_successor(nttmp1, i+3) == nt2) return i+3;
+		if ( prng_successor(nttmp2, i+3) == nt1) return -(i+3);
+
+		if ( prng_successor(nttmp1, i+4) == nt2) return i+4;
+		if ( prng_successor(nttmp2, i+4) == nt1) return -(i+4);
+
+		if ( prng_successor(nttmp1, i+5) == nt2) return i+5;
+		if ( prng_successor(nttmp2, i+5) == nt1) return -(i+5);
+
+		if ( prng_successor(nttmp1, i+6) == nt2) return i+6;
+		if ( prng_successor(nttmp2, i+6) == nt1) return -(i+6);
+
+		if ( prng_successor(nttmp1, i+7) == nt2) return i+7;
+		if ( prng_successor(nttmp2, i+7) == nt1) return -(i+7);
+*/
 	}
 	
 	return(-99999); // either nt1 or nt2 are invalid nonces
@@ -2241,73 +2260,72 @@ void ReaderMifare(bool first_try, uint8_t block )
 	// Mifare AUTH
 	//uint8_t mf_auth[]    = { 0x60,0x00,0xf5,0x7b };
 	//uint8_t mf_auth[]    = { 0x60,0x05, 0x58, 0x2c };
-	uint8_t mf_auth[]    = { 0x60,0x00, 0x00, 0x00 };
-	uint8_t mf_nr_ar[]   = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
-	static uint8_t mf_nr_ar3 = 0;
-
-	mf_auth[1] = block;
-	AppendCrc14443a(mf_auth, 2);
-	
+	uint8_t mf_auth[] 	= { 0x60,0x00, 0x00, 0x00 };
+	uint8_t mf_nr_ar[]	= { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
+	uint8_t uid[10]		= {0,0,0,0,0,0,0,0,0,0};
+	uint8_t par_list[8]	= {0,0,0,0,0,0,0,0};
+	uint8_t ks_list[8]	= {0,0,0,0,0,0,0,0};
 	uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00};
 	uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = {0x00};
+	uint8_t par[1] = {0};	// maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
+	
+	mf_auth[1] = block;
+	AppendCrc14443a(mf_auth, 2);
 
 	byte_t nt_diff = 0;
-	uint8_t par[1] = {0};	// maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
-	static byte_t par_low = 0;
-	uint8_t uid[10] = {0};
-	//uint32_t cuid = 0;
 
 	uint32_t nt = 0;
-	uint32_t previous_nt = 0;
-	static uint32_t nt_attacked = 0;
-	byte_t par_list[8] = {0x00};
-	byte_t ks_list[8] = {0x00};
-
-	static uint32_t sync_time = 0;
-	static int32_t sync_cycles = 0;
+	uint32_t previous_nt = 0;	
+	uint32_t halt_time = 0;
+	uint32_t cuid = 0;
+	
 	int catch_up_cycles = 0;
 	int last_catch_up = 0;
+	int isOK = 0;
+	
 	uint16_t elapsed_prng_sequences = 1;
 	uint16_t consecutive_resyncs = 0;
-	int isOK = 0;
-
-	#define PRNG_SEQUENCE_LENGTH  (1 << 16);
-	#define MAX_UNEXPECTED_RANDOM	4		// maximum number of unexpected (i.e. real) random numbers when trying to sync. Then give up.
-	#define MAX_SYNC_TRIES			32
-	#define NUM_DEBUG_INFOS			8		// per strategy
-	#define MAX_STRATEGY			3
-
 	uint16_t unexpected_random = 0;
 	uint16_t sync_tries = 0;
 	uint16_t strategy = 0;
-	uint32_t halt_time = 0;
 
+	static uint32_t nt_attacked = 0;
+	static uint32_t sync_time = 0;
+	static int32_t sync_cycles = 0;
+	static uint8_t par_low = 0;
+	static uint8_t mf_nr_ar3 = 0;
+
+	#define PRNG_SEQUENCE_LENGTH	(1 << 16)
+	#define MAX_UNEXPECTED_RANDOM	4		// maximum number of unexpected (i.e. real) random numbers when trying to sync. Then give up.
+	#define MAX_SYNC_TRIES		32
+	#define MAX_STRATEGY		3
+
+	// free eventually allocated BigBuf memory
+	BigBuf_free(); BigBuf_Clear_ext(false);
+	
 	clear_trace();
 	set_tracing(TRUE);
 	
 	LED_A_ON();
-	LED_B_OFF();
-	LED_C_OFF();
 	
 	if (first_try)
 		iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
-	
-	// free eventually allocated BigBuf memory. We want all for tracing.
-	BigBuf_free();
 
 	if (first_try) { 
 		sync_time = GetCountSspClk() & 0xfffffff8;
-		sync_cycles = PRNG_SEQUENCE_LENGTH; //65536;	//0x10000			// theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
+		sync_cycles = PRNG_SEQUENCE_LENGTH + 1100; //65536;	//0x10000			// theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
 		mf_nr_ar3 = 0;			
 		nt_attacked = 0;
-		par[0] = 0;
+
 	} else {
-		// we were unsuccessful on a previous call. Try another READER nonce (first 3 parity bits remain the same)
-		mf_nr_ar3++;
+		// we were unsuccessful on a previous call. 
+		// Try another READER nonce (first 3 parity bits remain the same)
+		++mf_nr_ar3;
 		mf_nr_ar[3] = mf_nr_ar3;
 		par[0] = par_low;
 	}
 		
+		LED_A_ON();
 	LED_C_ON(); 
 	for(uint16_t i = 0; TRUE; ++i) {
 
@@ -2338,13 +2356,17 @@ void ReaderMifare(bool first_try, uint8_t block )
 			WDT_HIT();
 		}
 		
-		if (!iso14443a_select_card(uid, NULL, NULL, true, 0)) {
-			if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Can't select card\n");
+		if (!iso14443a_select_card(uid, NULL,  &cuid, true, 0)) {
+			if (MF_DBGLEVEL >= 2) Dbprintf("Mifare: Can't select card\n");
 			continue;
 		}
+
+		// Sending timeslot of ISO14443a frame
 		
 		sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles;
 		catch_up_cycles = 0;
+		
+		//catch_up_cycles = 0;
 								
 		// if we missed the sync time already, advance to the next nonce repeat
 		while(GetCountSspClk() > sync_time) {
@@ -2385,7 +2407,7 @@ void ReaderMifare(bool first_try, uint8_t block )
 						break;
 					} else {
 						continue;
-					}
+				}
 				}
 				
 				sync_cycles = (sync_cycles - nt_distance)/elapsed_prng_sequences;
@@ -2454,6 +2476,7 @@ void ReaderMifare(bool first_try, uint8_t block )
 			par[0] = par_low;
 			
 		} else {
+			// No NACK.	
 			if (nt_diff == 0 && first_try) {
 				par[0]++;
 				if (par[0] == 0x00) {	// tried all 256 possible parities without success. Card doesn't send NACK.
@@ -2461,6 +2484,7 @@ void ReaderMifare(bool first_try, uint8_t block )
 					break;
 				}
 			} else {
+				// Why this?
 				par[0] = ((par[0] & 0x1F) + 1) | par_low;
 			}
 		}
@@ -2481,8 +2505,8 @@ void ReaderMifare(bool first_try, uint8_t block )
 		par[0] = 0;
 	}
 	
-	byte_t buf[28] = {0x00};
-	memcpy(buf + 0,  uid, 4);
+	uint8_t buf[28] = {0x00};
+	num_to_bytes(cuid, 4, buf);
 	num_to_bytes(nt, 4, buf + 4);
 	memcpy(buf + 8,  par_list, 8);
 	memcpy(buf + 16, ks_list, 8);
@@ -3041,6 +3065,9 @@ void RAMFUNC SniffMifare(uint8_t param) {
 	// bit 1 - trigger from first reader 7-bit request
 	LEDsoff();
 
+	// free eventually allocated BigBuf memory
+	BigBuf_free(); BigBuf_Clear_ext(false);
+	
 	// init trace buffer
 	clear_trace();
 	set_tracing(TRUE);
@@ -3057,9 +3084,6 @@ void RAMFUNC SniffMifare(uint8_t param) {
 
 	iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
 
-	// free eventually allocated BigBuf memory
-	BigBuf_free();
-	
 	// allocate the DMA buffer, used to stream samples from the FPGA
 	uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
 	uint8_t *data = dmaBuf;