X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/51969283ec562f968d997a5581724d86d3e8b1d4..f208c9e281295074e67da04f1527865fae7b2b74:/armsrc/iso14443a.c?ds=sidebyside diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c index e66a64f5..54fbb246 100644 --- a/armsrc/iso14443a.c +++ b/armsrc/iso14443a.c @@ -156,7 +156,7 @@ static struct { static RAMFUNC int MillerDecoding(int bit) { - int error = 0; + //int error = 0; int bitright; if(!Uart.bitBuffer) { @@ -202,7 +202,7 @@ static RAMFUNC int MillerDecoding(int bit) // measured a drop in first and second half // which should not be possible Uart.state = STATE_ERROR_WAIT; - error = 0x01; + //error = 0x01; } Uart.posCnt = 0; @@ -213,7 +213,7 @@ static RAMFUNC int MillerDecoding(int bit) if(Uart.drop == DROP_SECOND_HALF) { // error, should not happen in SOC Uart.state = STATE_ERROR_WAIT; - error = 0x02; + //error = 0x02; } else { // correct SOC @@ -251,7 +251,7 @@ static RAMFUNC int MillerDecoding(int bit) // Would be STATE_MILLER_Z // but Z does not follow X, so error Uart.state = STATE_ERROR_WAIT; - error = 0x03; + //error = 0x03; } if(Uart.drop == DROP_SECOND_HALF) { // We see a '1' and stay in state X @@ -372,7 +372,7 @@ static RAMFUNC int MillerDecoding(int bit) Uart.bitCnt = 0; Uart.byteCnt = 0; Uart.parityBits = 0; - error = 0; + //error = 0; } else { Uart.highCnt = 0; @@ -422,7 +422,7 @@ static RAMFUNC int ManchesterDecoding(int v) { int bit; int modulation; - int error = 0; + //int error = 0; if(!Demod.buff) { Demod.buff = 1; @@ -479,7 +479,7 @@ static RAMFUNC int ManchesterDecoding(int v) case 0x01: Demod.samples = 0; break; } } - error = 0; + //error = 0; } } else { @@ -503,7 +503,7 @@ static RAMFUNC int ManchesterDecoding(int v) if(Demod.state!=DEMOD_ERROR_WAIT) { Demod.state = DEMOD_ERROR_WAIT; Demod.output[Demod.len] = 0xaa; - error = 0x01; + //error = 0x01; } } else if(modulation) { @@ -518,7 +518,7 @@ static RAMFUNC int ManchesterDecoding(int v) else { Demod.output[Demod.len] = 0xab; Demod.state = DEMOD_ERROR_WAIT; - error = 0x02; + //error = 0x02; } break; @@ -556,7 +556,7 @@ static RAMFUNC int ManchesterDecoding(int v) else { Demod.output[Demod.len] = 0xad; Demod.state = DEMOD_ERROR_WAIT; - error = 0x03; + //error = 0x03; } break; @@ -768,13 +768,10 @@ void RAMFUNC SnoopIso14443a(void) DbpString("COMMAND FINISHED"); - Dbprintf("%x %x %x", maxBehindBy, Uart.state, Uart.byteCnt); - Dbprintf("%x %x %x", Uart.byteCntMax, traceLen, (int)Uart.output[0]); - done: AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS; - Dbprintf("%x %x %x", maxBehindBy, Uart.state, Uart.byteCnt); - Dbprintf("%x %x %x", Uart.byteCntMax, traceLen, (int)Uart.output[0]); + Dbprintf("maxBehindBy=%x, Uart.state=%x, Uart.byteCnt=%x", maxBehindBy, Uart.state, Uart.byteCnt); + Dbprintf("Uart.byteCntMax=%x, traceLen=%x, Uart.output[0]=%x", Uart.byteCntMax, traceLen, (int)Uart.output[0]); LED_A_OFF(); LED_B_OFF(); LED_C_OFF(); @@ -787,7 +784,6 @@ done: static void CodeIso14443aAsTagPar(const uint8_t *cmd, int len, uint32_t dwParity) { int i; -// int oddparity; ToSendReset(); @@ -809,9 +805,7 @@ static void CodeIso14443aAsTagPar(const uint8_t *cmd, int len, uint32_t dwParity uint8_t b = cmd[i]; // Data bits -// oddparity = 0x01; for(j = 0; j < 8; j++) { -// oddparity ^= (b & 1); if(b & 1) { ToSend[++ToSendMax] = SEC_D; } else { @@ -820,38 +814,19 @@ static void CodeIso14443aAsTagPar(const uint8_t *cmd, int len, uint32_t dwParity b >>= 1; } - // Get the parity bit + // Get the parity bit if ((dwParity >> i) & 0x01) { ToSend[++ToSendMax] = SEC_D; } else { ToSend[++ToSendMax] = SEC_E; } - - // Parity bit -// if(oddparity) { -// ToSend[++ToSendMax] = SEC_D; -// } else { -// ToSend[++ToSendMax] = SEC_E; -// } - -// if (oddparity != ((dwParity >> i) & 0x01)) -// Dbprintf("par error. i=%d", i); } // Send stopbit ToSend[++ToSendMax] = SEC_F; - // Flush the buffer in FPGA!! - for(i = 0; i < 5; i++) { -// ToSend[++ToSendMax] = SEC_F; - } - // Convert from last byte pos to length ToSendMax++; - - // Add a few more for slop -// ToSend[ToSendMax++] = 0x00; -// ToSend[ToSendMax++] = 0x00; } static void CodeIso14443aAsTag(const uint8_t *cmd, int len){ @@ -1070,9 +1045,9 @@ ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]); uint8_t *receivedCmd = (uint8_t *)BigBuf; int len; - int i; - int u; - uint8_t b; + //int i; + //int u; + //uint8_t b; // To control where we are in the protocol int order = 0; @@ -1084,7 +1059,7 @@ ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]); int cmdsRecvd = 0; - int fdt_indicator; + //int fdt_indicator; memset(receivedCmd, 0x44, 400); @@ -1135,7 +1110,7 @@ ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]); // doob - added loads of debug strings so we can see what the reader is saying to us during the sim as hi14alist is not populated // Okay, look at the command now. lastorder = order; - i = 1; // first byte transmitted + //i = 1; // first byte transmitted if(receivedCmd[0] == 0x26) { // Received a REQUEST resp = resp1; respLen = resp1Len; order = 1; @@ -1216,7 +1191,7 @@ ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]); // Look at last parity bit to determine timing of answer if((Uart.parityBits & 0x01) || receivedCmd[0] == 0x52) { // 1236, so correction bit needed - i = 0; + //i = 0; } memset(receivedCmd, 0x44, 32); @@ -1231,9 +1206,9 @@ ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]); if(respLen <= 0) continue; //---------------------------- - u = 0; - b = 0x00; - fdt_indicator = FALSE; + //u = 0; + //b = 0x00; + //fdt_indicator = FALSE; EmSendCmd14443aRaw(resp, respLen, receivedCmd[0] == 0x52); /* // Modulate Manchester @@ -1895,7 +1870,7 @@ void ReaderMifare(uint32_t parameter) byte_t nt_diff = 0; LED_A_OFF(); byte_t par = 0; - byte_t par_mask = 0xff; + //byte_t par_mask = 0xff; byte_t par_low = 0; int led_on = TRUE; uint8_t uid[8]; @@ -1939,14 +1914,14 @@ void ReaderMifare(uint32_t parameter) { if ( (parameter != 0) && (memcmp(nt, nt_noattack, 4) == 0) ) continue; - isNULL = (nt_attacked[0] = 0) && (nt_attacked[1] = 0) && (nt_attacked[2] = 0) && (nt_attacked[3] = 0); + isNULL = (nt_attacked[0] == 0) && (nt_attacked[1] == 0) && (nt_attacked[2] == 0) && (nt_attacked[3] == 0); if ( (isNULL != 0 ) && (memcmp(nt, nt_attacked, 4) != 0) ) continue; if (nt_diff == 0) { LED_A_ON(); memcpy(nt_attacked, nt, 4); - par_mask = 0xf8; + //par_mask = 0xf8; par_low = par & 0x07; } @@ -2006,7 +1981,7 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) int cardSTATE = MFEMUL_NOFIELD; int _7BUID = 0; int vHf = 0; // in mV - int nextCycleTimeout = 0; + //int nextCycleTimeout = 0; int res; // uint32_t timer = 0; uint32_t selTimer = 0; @@ -2016,11 +1991,13 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) uint8_t cardWRBL = 0; uint8_t cardAUTHSC = 0; uint8_t cardAUTHKEY = 0xff; // no authentication - uint32_t cardRn = 0; + //uint32_t cardRn = 0; uint32_t cardRr = 0; uint32_t cuid = 0; - uint32_t rn_enc = 0; + //uint32_t rn_enc = 0; uint32_t ans = 0; + uint32_t cardINTREG = 0; + uint8_t cardINTBLOCK = 0; struct Crypto1State mpcs = {0, 0}; struct Crypto1State *pcs; pcs = &mpcs; @@ -2036,9 +2013,10 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) static uint8_t rSAK[] = {0x08, 0xb6, 0xdd}; static uint8_t rSAK1[] = {0x04, 0xda, 0x17}; - static uint8_t rAUTH_NT[] = {0x1a, 0xac, 0xff, 0x4f}; + static uint8_t rAUTH_NT[] = {0x01, 0x02, 0x03, 0x04}; +// static uint8_t rAUTH_NT[] = {0x1a, 0xac, 0xff, 0x4f}; static uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00}; - + // clear trace traceLen = 0; tracing = true; @@ -2077,7 +2055,7 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN); SpinDelay(200); - Dbprintf("--> start. 7buid=%d", _7BUID); + if (MF_DBGLEVEL >= 1) Dbprintf("Started. 7buid=%d", _7BUID); // calibrate mkseconds counter GetDeltaCountUS(); while (true) { @@ -2093,7 +2071,7 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) if (cardSTATE == MFEMUL_NOFIELD) { vHf = (33000 * AvgAdc(ADC_CHAN_HF)) >> 10; if (vHf > MF_MINFIELDV) { - cardSTATE = MFEMUL_IDLE; + cardSTATE_TO_IDLE(); LED_A_ON(); } } @@ -2108,7 +2086,7 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) if(res) break; } - nextCycleTimeout = 0; + //nextCycleTimeout = 0; // if (len) Dbprintf("len:%d cmd: %02x %02x %02x %02x", len, receivedCmd[0], receivedCmd[1], receivedCmd[2], receivedCmd[3]); @@ -2141,6 +2119,7 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) // select all if (len == 2 && (receivedCmd[0] == 0x93 && receivedCmd[1] == 0x20)) { EmSendCmd(rUIDBCC1, sizeof(rUIDBCC1)); + break; } // select card @@ -2154,17 +2133,20 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) cuid = bytes_to_num(rUIDBCC1, 4); if (!_7BUID) { cardSTATE = MFEMUL_WORK; + LED_B_ON(); + if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - selTimer); + break; } else { cardSTATE = MFEMUL_SELECT2; break; } - LED_B_ON(); - if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol1 time: %d", GetTickCount() - selTimer); } break; } case MFEMUL_SELECT2:{ + if (!len) break; + if (len == 2 && (receivedCmd[0] == 0x95 && receivedCmd[1] == 0x20)) { EmSendCmd(rUIDBCC2, sizeof(rUIDBCC2)); break; @@ -2178,24 +2160,25 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) cuid = bytes_to_num(rUIDBCC2, 4); cardSTATE = MFEMUL_WORK; LED_B_ON(); - Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer); + if (MF_DBGLEVEL >= 4) Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer); break; } - // TODO: goto work state - i guess there is a command - break; + + // i guess there is a command). go into the work state. + if (len != 4) break; + cardSTATE = MFEMUL_WORK; + goto lbWORK; } case MFEMUL_AUTH1:{ if (len == 8) { // --- crypto - rn_enc = bytes_to_num(receivedCmd, 4); - cardRn = rn_enc ^ crypto1_word(pcs, rn_enc , 1); + //rn_enc = bytes_to_num(receivedCmd, 4); + //cardRn = rn_enc ^ crypto1_word(pcs, rn_enc , 1); cardRr = bytes_to_num(&receivedCmd[4], 4) ^ crypto1_word(pcs, 0, 0); // test if auth OK if (cardRr != prng_successor(nonce, 64)){ - Dbprintf("AUTH FAILED. cardRr=%08x, suc=%08x", cardRr, prng_successor(nonce, 64)); - cardSTATE = MFEMUL_IDLE; - LED_B_OFF(); - LED_C_OFF(); + if (MF_DBGLEVEL >= 4) Dbprintf("AUTH FAILED. cardRr=%08x, succ=%08x", cardRr, prng_successor(nonce, 64)); + cardSTATE_TO_IDLE(); break; } ans = prng_successor(nonce, 96) ^ crypto1_word(pcs, 0, 0); @@ -2204,22 +2187,18 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT)); cardSTATE = MFEMUL_AUTH2; } else { - cardSTATE = MFEMUL_IDLE; - LED_B_OFF(); - LED_C_OFF(); + cardSTATE_TO_IDLE(); } if (cardSTATE != MFEMUL_AUTH2) break; } case MFEMUL_AUTH2:{ - // test auth info here... - LED_C_ON(); cardSTATE = MFEMUL_WORK; - Dbprintf("AUTH COMPLETED. sec=%d, key=%d time=%d", cardAUTHSC, cardAUTHKEY, GetTickCount() - authTimer); + if (MF_DBGLEVEL >= 4) Dbprintf("AUTH COMPLETED. sec=%d, key=%d time=%d", cardAUTHSC, cardAUTHKEY, GetTickCount() - authTimer); break; } case MFEMUL_WORK:{ - if (len == 0) break; +lbWORK: if (len == 0) break; if (cardAUTHKEY == 0xff) { // first authentication @@ -2241,7 +2220,7 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) // LogTrace(NULL, 0, GetDeltaCountUS(), 0, true); cardSTATE = MFEMUL_AUTH1; - nextCycleTimeout = 10; + //nextCycleTimeout = 10; break; } } else { @@ -2263,7 +2242,7 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) // --- crypto cardSTATE = MFEMUL_AUTH1; - nextCycleTimeout = 10; + //nextCycleTimeout = 10; break; } } @@ -2301,18 +2280,56 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) break; } EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK)); - nextCycleTimeout = 50; + //nextCycleTimeout = 50; cardSTATE = MFEMUL_WRITEBL2; cardWRBL = receivedCmd[1]; break; } + // works with cardINTREG + + // increment, decrement, restore + if (len == 4 && (receivedCmd[0] == 0xC0 || receivedCmd[0] == 0xC1 || receivedCmd[0] == 0xC2)) { + if (receivedCmd[1] >= 16 * 4 || + receivedCmd[1] / 4 != cardAUTHSC || + emlCheckValBl(receivedCmd[1])) { + EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA)); + break; + } + EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK)); + if (receivedCmd[0] == 0xC1) + cardSTATE = MFEMUL_INTREG_INC; + if (receivedCmd[0] == 0xC0) + cardSTATE = MFEMUL_INTREG_DEC; + if (receivedCmd[0] == 0xC2) + cardSTATE = MFEMUL_INTREG_REST; + cardWRBL = receivedCmd[1]; + + break; + } + + + // transfer + if (len == 4 && receivedCmd[0] == 0xB0) { + if (receivedCmd[1] >= 16 * 4 || receivedCmd[1] / 4 != cardAUTHSC) { + EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA)); + break; + } + + if (emlSetValBl(cardINTREG, cardINTBLOCK, receivedCmd[1])) + EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA)); + else + EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK)); + + break; + } + // halt if (len == 4 && (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00)) { - cardSTATE = MFEMUL_HALTED; LED_B_OFF(); LED_C_OFF(); - Dbprintf("--> HALTED. Selected time: %d ms", GetTickCount() - selTimer); + cardSTATE = MFEMUL_HALTED; + if (MF_DBGLEVEL >= 4) Dbprintf("--> HALTED. Selected time: %d ms", GetTickCount() - selTimer); break; } @@ -2333,11 +2350,45 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) cardSTATE = MFEMUL_WORK; break; } else { - cardSTATE = MFEMUL_IDLE; - LED_B_OFF(); - LED_C_OFF(); + cardSTATE_TO_IDLE(); + break; + } + break; + } + + case MFEMUL_INTREG_INC:{ + mf_crypto1_decrypt(pcs, receivedCmd, len); + memcpy(&ans, receivedCmd, 4); + if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) { + EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA)); + cardSTATE_TO_IDLE(); break; } + cardINTREG = cardINTREG + ans; + cardSTATE = MFEMUL_WORK; + break; + } + case MFEMUL_INTREG_DEC:{ + mf_crypto1_decrypt(pcs, receivedCmd, len); + memcpy(&ans, receivedCmd, 4); + if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) { + EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA)); + cardSTATE_TO_IDLE(); + break; + } + cardINTREG = cardINTREG - ans; + cardSTATE = MFEMUL_WORK; + break; + } + case MFEMUL_INTREG_REST:{ + mf_crypto1_decrypt(pcs, receivedCmd, len); + memcpy(&ans, receivedCmd, 4); + if (emlGetValBl(&cardINTREG, &cardINTBLOCK, cardWRBL)) { + EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA)); + cardSTATE_TO_IDLE(); + break; + } + cardSTATE = MFEMUL_WORK; break; } @@ -2352,5 +2403,5 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) memset(rAUTH_NT, 0x44, 4); LogTrace(rAUTH_NT, 4, 0, 0, TRUE); - DbpString("Emulator stopped."); + if (MF_DBGLEVEL >= 1) Dbprintf("Emulator stopped. Tracing: %d trace length: %d ", tracing, traceLen); }