X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/5cd9ec01e0d6594f7f0f5869f116d8816047d4cb..7dd1908b241b3a9e5764112bd822472f80287073:/armsrc/iso14443a.c?ds=inline diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c index 4bdbb810..d2ebb0c6 100644 --- a/armsrc/iso14443a.c +++ b/armsrc/iso14443a.c @@ -14,6 +14,7 @@ #include "apps.h" #include "util.h" #include "string.h" +#include "cmd.h" #include "iso14443crc.h" #include "iso14443a.h" @@ -21,11 +22,13 @@ #include "mifareutil.h" static uint32_t iso14a_timeout; -uint8_t *trace = (uint8_t *) BigBuf; +uint8_t *trace = (uint8_t *) BigBuf+TRACE_OFFSET; int traceLen = 0; int rsamples = 0; int tracing = TRUE; uint8_t trigger = 0; +// the block number for the ISO14443-4 PCB +static uint8_t iso14_pcb_blocknum = 0; // CARD TO READER - manchester // Sequence D: 11110000 modulation with subcarrier during first half @@ -62,17 +65,23 @@ const uint8_t OddByteParity[256] = { }; -void iso14a_set_trigger(int enable) { +void iso14a_set_trigger(bool enable) { trigger = enable; } -void iso14a_clear_tracelen(void) { +void iso14a_clear_trace() { + memset(trace, 0x44, TRACE_SIZE); traceLen = 0; } -void iso14a_set_tracing(int enable) { + +void iso14a_set_tracing(bool enable) { tracing = enable; } +void iso14a_set_timeout(uint32_t timeout) { + iso14a_timeout = timeout; +} + //----------------------------------------------------------------------------- // Generate the parity value for a byte sequence // @@ -575,8 +584,7 @@ void RAMFUNC SnoopIso14443a(uint8_t param) { LEDsoff(); // init trace buffer - traceLen = 0; - memset(trace, 0x44, TRACE_SIZE); + iso14a_clear_trace(); // We won't start recording the frames that we acquire until we trigger; // a good trigger condition to get started is probably when we see a @@ -656,7 +664,6 @@ void RAMFUNC SnoopIso14443a(uint8_t param) { if (!AT91C_BASE_PDC_SSC->PDC_RCR) { AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf; AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE; - Dbprintf("RxEmpty ERROR!!! %d", dataLen); // temporary } // secondary buffer sets as primary, secondary buffer was stopped if (!AT91C_BASE_PDC_SSC->PDC_RNCR) { @@ -901,8 +908,7 @@ void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd) { // Enable and clear the trace tracing = TRUE; - traceLen = 0; - memset(trace, 0x44, TRACE_SIZE); + iso14a_clear_trace(); // This function contains the tag emulation uint8_t sak; @@ -1636,7 +1642,7 @@ int iso14443a_select_card(uint8_t * uid_ptr, iso14a_card_select_t * resp_data, u uint8_t sel_uid[] = { 0x93,0x70,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }; uint8_t rats[] = { 0xE0,0x80,0x00,0x00 }; // FSD=256, FSDI=8, CID=0 - uint8_t* resp = (((uint8_t *)BigBuf) + 3560); // was 3560 - tied to other size changes + uint8_t* resp = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); // was 3560 - tied to other size changes uint8_t sak = 0x04; // cascade uid int cascade_level = 0; @@ -1644,13 +1650,14 @@ int iso14443a_select_card(uint8_t * uid_ptr, iso14a_card_select_t * resp_data, u int len; // clear uid - memset(uid_ptr, 0, 8); + memset(uid_ptr, 0, 12); // Broadcast for a card, WUPA (0x52) will force response from all cards in the field ReaderTransmitShort(wupa); // Receive the ATQA if(!ReaderReceive(resp)) return 0; - +// Dbprintf("atqa: %02x %02x",resp[0],resp[1]); + if(resp_data) memcpy(resp_data->atqa, resp, 2); @@ -1665,6 +1672,8 @@ int iso14443a_select_card(uint8_t * uid_ptr, iso14a_card_select_t * resp_data, u // SELECT_ALL ReaderTransmit(sel_all,sizeof(sel_all)); if (!ReaderReceive(resp)) return 0; +// Dbprintf("uid: %02x %02x %02x %02x",resp[0],resp[1],resp[2],resp[3]); + if(uid_ptr) memcpy(uid_ptr + cascade_level*4, resp, 4); // calculate crypto UID @@ -1703,17 +1712,20 @@ int iso14443a_select_card(uint8_t * uid_ptr, iso14a_card_select_t * resp_data, u resp_data->ats_len = len; } + // reset the PCB block number + iso14_pcb_blocknum = 0; + return 1; } void iso14443a_setup() { - // Setup SSC - FpgaSetupSsc(); + // Set up the synchronous serial port + FpgaSetupSsc(); // Start from off (no field generated) // Signal field is off with the appropriate LED LED_D_OFF(); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); - SpinDelay(200); + SpinDelay(50); SetAdcMuxFor(GPIO_MUXSEL_HIPKD); @@ -1721,7 +1733,7 @@ void iso14443a_setup() { // Signal field is on with the appropriate LED LED_D_ON(); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD); - SpinDelay(200); + SpinDelay(50); iso14a_timeout = 2048; //default } @@ -1729,35 +1741,52 @@ void iso14443a_setup() { int iso14_apdu(uint8_t * cmd, size_t cmd_len, void * data) { uint8_t real_cmd[cmd_len+4]; real_cmd[0] = 0x0a; //I-Block + // put block number into the PCB + real_cmd[0] |= iso14_pcb_blocknum; real_cmd[1] = 0x00; //CID: 0 //FIXME: allow multiple selected cards memcpy(real_cmd+2, cmd, cmd_len); AppendCrc14443a(real_cmd,cmd_len+2); ReaderTransmit(real_cmd, cmd_len+4); size_t len = ReaderReceive(data); - if(!len) - return -1; //DATA LINK ERROR - + uint8_t * data_bytes = (uint8_t *) data; + if (!len) + return 0; //DATA LINK ERROR + // if we received an I- or R(ACK)-Block with a block number equal to the + // current block number, toggle the current block number + else if (len >= 4 // PCB+CID+CRC = 4 bytes + && ((data_bytes[0] & 0xC0) == 0 // I-Block + || (data_bytes[0] & 0xD0) == 0x80) // R-Block with ACK bit set to 0 + && (data_bytes[0] & 0x01) == iso14_pcb_blocknum) // equal block numbers + { + iso14_pcb_blocknum ^= 1; + } + return len; } - //----------------------------------------------------------------------------- // Read an ISO 14443a tag. Send out commands and store answers. // //----------------------------------------------------------------------------- -void ReaderIso14443a(UsbCommand * c, UsbCommand * ack) +void ReaderIso14443a(UsbCommand * c) { iso14a_command_t param = c->arg[0]; uint8_t * cmd = c->d.asBytes; size_t len = c->arg[1]; + uint32_t arg0; + byte_t buf[48]; + + iso14a_clear_trace(); + iso14a_set_tracing(true); if(param & ISO14A_REQUEST_TRIGGER) iso14a_set_trigger(1); if(param & ISO14A_CONNECT) { iso14443a_setup(); - ack->arg[0] = iso14443a_select_card(ack->d.asBytes, (iso14a_card_select_t *) (ack->d.asBytes+12), NULL); - UsbSendPacket((void *)ack, sizeof(UsbCommand)); + arg0 = iso14443a_select_card(buf, (iso14a_card_select_t *)(buf+12), NULL); + cmd_send(CMD_ACK,arg0,0,0,buf,48); +// UsbSendPacket((void *)ack, sizeof(UsbCommand)); } if(param & ISO14A_SET_TIMEOUT) { @@ -1769,8 +1798,9 @@ void ReaderIso14443a(UsbCommand * c, UsbCommand * ack) } if(param & ISO14A_APDU) { - ack->arg[0] = iso14_apdu(cmd, len, ack->d.asBytes); - UsbSendPacket((void *)ack, sizeof(UsbCommand)); + arg0 = iso14_apdu(cmd, len, buf); + cmd_send(CMD_ACK,arg0,0,0,buf,48); +// UsbSendPacket((void *)ack, sizeof(UsbCommand)); } if(param & ISO14A_RAW) { @@ -1779,8 +1809,9 @@ void ReaderIso14443a(UsbCommand * c, UsbCommand * ack) len += 2; } ReaderTransmit(cmd,len); - ack->arg[0] = ReaderReceive(ack->d.asBytes); - UsbSendPacket((void *)ack, sizeof(UsbCommand)); + arg0 = ReaderReceive(buf); +// UsbSendPacket((void *)ack, sizeof(UsbCommand)); + cmd_send(CMD_ACK,arg0,0,0,buf,48); } if(param & ISO14A_REQUEST_TRIGGER) iso14a_set_trigger(0); @@ -1791,6 +1822,7 @@ void ReaderIso14443a(UsbCommand * c, UsbCommand * ack) FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); LEDsoff(); } + //----------------------------------------------------------------------------- // Read an ISO 14443a tag. Send out commands and store answers. // @@ -1801,7 +1833,7 @@ void ReaderMifare(uint32_t parameter) uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b }; uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }; - uint8_t* receivedAnswer = (((uint8_t *)BigBuf) + 3560); // was 3560 - tied to other size changes + uint8_t* receivedAnswer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); // was 3560 - tied to other size changes traceLen = 0; tracing = false; @@ -1830,11 +1862,12 @@ void ReaderMifare(uint32_t parameter) while(TRUE) { - LED_C_ON(); + LED_C_OFF(); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); - SpinDelay(200); + SpinDelay(50); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD); - LED_C_OFF(); + LED_C_ON(); + SpinDelay(2); // Test if the action was cancelled if(BUTTON_PRESS()) { @@ -1897,14 +1930,16 @@ void ReaderMifare(uint32_t parameter) LogTrace(par_list, 8, 0, GetParity(par_list, 8), TRUE); LogTrace(ks_list, 8, 0, GetParity(ks_list, 8), TRUE); - UsbCommand ack = {CMD_ACK, {isOK, 0, 0}}; - memcpy(ack.d.asBytes + 0, uid, 4); - memcpy(ack.d.asBytes + 4, nt, 4); - memcpy(ack.d.asBytes + 8, par_list, 8); - memcpy(ack.d.asBytes + 16, ks_list, 8); + byte_t buf[48]; +// UsbCommand ack = {CMD_ACK, {isOK, 0, 0}}; + memcpy(buf + 0, uid, 4); + memcpy(buf + 4, nt, 4); + memcpy(buf + 8, par_list, 8); + memcpy(buf + 16, ks_list, 8); LED_B_ON(); - UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand)); + cmd_send(CMD_ACK,isOK,0,0,buf,48); +// UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand)); LED_B_OFF(); // Thats it... @@ -2356,11 +2391,11 @@ void RAMFUNC SniffMifare(uint8_t param) { // param: // bit 0 - trigger from first card answer // bit 1 - trigger from first reader 7-bit request - + + // C(red) A(yellow) B(green) LEDsoff(); // init trace buffer - traceLen = 0; - memset(trace, 0x44, TRACE_SIZE); + iso14a_clear_trace(); // The command (reader -> tag) that we're receiving. // The length of a received command will in most cases be no more than 18 bytes. @@ -2378,7 +2413,6 @@ void RAMFUNC SniffMifare(uint8_t param) { int8_t *data = dmaBuf; int maxDataLen = 0; int dataLen = 0; -// data = dmaBuf; // Set up the demodulator for tag -> reader responses. Demod.output = receivedResponse; @@ -2400,10 +2434,11 @@ void RAMFUNC SniffMifare(uint8_t param) { LED_D_OFF(); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_SNIFFER); SetAdcMuxFor(GPIO_MUXSEL_HIPKD); + + // init sniffer + MfSniffInit(); + int sniffCounter = 0; - // Count of samples received so far, so that we can include timing - // information in the trace buffer. - rsamples = 0; // And now we loop, receiving samples. while(true) { if(BUTTON_PRESS()) { @@ -2413,6 +2448,13 @@ void RAMFUNC SniffMifare(uint8_t param) { LED_A_ON(); WDT_HIT(); + + if (++sniffCounter > 65) { + if (MfSniffSend(2000)) { + FpgaEnableSscDma(); + } + sniffCounter = 0; + } int register readBufDataP = data - dmaBuf; int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR; @@ -2435,7 +2477,7 @@ void RAMFUNC SniffMifare(uint8_t param) { if (!AT91C_BASE_PDC_SSC->PDC_RCR) { AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t) dmaBuf; AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE; - Dbprintf("RxEmpty ERROR!!! %d", dataLen); // temporary + Dbprintf("RxEmpty ERROR!!! data length:%d", dataLen); // temporary } // secondary buffer sets as primary, secondary buffer was stopped if (!AT91C_BASE_PDC_SSC->PDC_RNCR) { @@ -2445,33 +2487,30 @@ void RAMFUNC SniffMifare(uint8_t param) { LED_A_OFF(); - rsamples += 4; if(MillerDecoding((data[0] & 0xF0) >> 4)) { - LED_C_ON(); + LED_C_INV(); // check - if there is a short 7bit request from reader - if ((Uart.byteCnt == 1) && (Uart.bitCnt = 9)) { - - } - if (!LogTrace(receivedCmd, Uart.byteCnt, 0 - Uart.samples, Uart.parityBits, TRUE)) break; + if (MfSniffLogic(receivedCmd, Uart.byteCnt, Uart.parityBits, Uart.bitCnt, TRUE)) break; /* And ready to receive another command. */ Uart.state = STATE_UNSYNCD; - /* And also reset the demod code, which might have been */ - /* false-triggered by the commands from the reader. */ + + /* And also reset the demod code */ Demod.state = DEMOD_UNSYNCD; - LED_B_OFF(); } if(ManchesterDecoding(data[0] & 0x0F)) { - LED_B_ON(); + LED_C_INV(); - if (!LogTrace(receivedResponse, Demod.len, 0 - Demod.samples, Demod.parityBits, FALSE)) break; + if (MfSniffLogic(receivedResponse, Demod.len, Demod.parityBits, Demod.bitCount, FALSE)) break; // And ready to receive another response. memset(&Demod, 0, sizeof(Demod)); Demod.output = receivedResponse; Demod.state = DEMOD_UNSYNCD; - LED_C_OFF(); + + /* And also reset the uart code */ + Uart.state = STATE_UNSYNCD; } data++; @@ -2483,8 +2522,9 @@ void RAMFUNC SniffMifare(uint8_t param) { DbpString("COMMAND FINISHED"); done: - AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS; - Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.byteCnt=%x", maxDataLen, Uart.state, Uart.byteCnt); - Dbprintf("Uart.byteCntMax=%x, traceLen=%x, Uart.output[0]=%x", Uart.byteCntMax, traceLen, (int)Uart.output[0]); + FpgaDisableSscDma(); + MfSniffEnd(); + + Dbprintf("maxDataLen=%x, Uart.state=%x, Uart.byteCnt=%x Uart.byteCntMax=%x", maxDataLen, Uart.state, Uart.byteCnt, Uart.byteCntMax); LEDsoff(); } \ No newline at end of file