X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/5f6d6c900397b1c5cd6c31577480577f1c0d5cda..e481bc32992b13b6fbbc31dffa9a8d63b393a952:/armsrc/iso14443a.c diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c index 33a94605..b3316ef0 100644 --- a/armsrc/iso14443a.c +++ b/armsrc/iso14443a.c @@ -775,48 +775,48 @@ static void CodeIso14443aAsTag(const uint8_t *cmd, int len){ CodeIso14443aAsTagPar(cmd, len, GetParity(cmd, len)); } -//----------------------------------------------------------------------------- -// This is to send a NACK kind of answer, its only 3 bits, I know it should be 4 -//----------------------------------------------------------------------------- -static void CodeStrangeAnswerAsTag() -{ - int i; - - ToSendReset(); - - // Correction bit, might be removed when not needed - ToSendStuffBit(0); - ToSendStuffBit(0); - ToSendStuffBit(0); - ToSendStuffBit(0); - ToSendStuffBit(1); // 1 - ToSendStuffBit(0); - ToSendStuffBit(0); - ToSendStuffBit(0); - - // Send startbit - ToSend[++ToSendMax] = SEC_D; - - // 0 - ToSend[++ToSendMax] = SEC_E; - - // 0 - ToSend[++ToSendMax] = SEC_E; - - // 1 - ToSend[++ToSendMax] = SEC_D; - - // Send stopbit - ToSend[++ToSendMax] = SEC_F; - - // Flush the buffer in FPGA!! - for(i = 0; i < 5; i++) { - ToSend[++ToSendMax] = SEC_F; - } - - // Convert from last byte pos to length - ToSendMax++; -} +////----------------------------------------------------------------------------- +//// This is to send a NACK kind of answer, its only 3 bits, I know it should be 4 +////----------------------------------------------------------------------------- +//static void CodeStrangeAnswerAsTag() +//{ +// int i; +// +// ToSendReset(); +// +// // Correction bit, might be removed when not needed +// ToSendStuffBit(0); +// ToSendStuffBit(0); +// ToSendStuffBit(0); +// ToSendStuffBit(0); +// ToSendStuffBit(1); // 1 +// ToSendStuffBit(0); +// ToSendStuffBit(0); +// ToSendStuffBit(0); +// +// // Send startbit +// ToSend[++ToSendMax] = SEC_D; +// +// // 0 +// ToSend[++ToSendMax] = SEC_E; +// +// // 0 +// ToSend[++ToSendMax] = SEC_E; +// +// // 1 +// ToSend[++ToSendMax] = SEC_D; +// +// // Send stopbit +// ToSend[++ToSendMax] = SEC_F; +// +// // Flush the buffer in FPGA!! +// for(i = 0; i < 5; i++) { +// ToSend[++ToSendMax] = SEC_F; +// } +// +// // Convert from last byte pos to length +// ToSendMax++; +//} static void Code4bitAnswerAsTag(uint8_t cmd) { @@ -908,6 +908,67 @@ int EmSendCmdEx(uint8_t *resp, int respLen, int correctionNeeded); int EmSendCmd(uint8_t *resp, int respLen); int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par); +static uint8_t* free_buffer_pointer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); + +typedef struct { + uint8_t* response; + size_t response_n; + uint8_t* modulation; + size_t modulation_n; +} tag_response_info_t; + +void reset_free_buffer() { + free_buffer_pointer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); +} + +bool prepare_tag_modulation(tag_response_info_t* response_info, size_t max_buffer_size) { + // Exmaple response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes + // This will need the following byte array for a modulation sequence + // 144 data bits (18 * 8) + // 18 parity bits + // 2 Start and stop + // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA) + // 1 just for the case + // ----------- + + // 166 bytes, since every bit that needs to be send costs us a byte + // + + // Prepare the tag modulation bits from the message + CodeIso14443aAsTag(response_info->response,response_info->response_n); + + // Make sure we do not exceed the free buffer space + if (ToSendMax > max_buffer_size) { + Dbprintf("Out of memory, when modulating bits for tag answer:"); + Dbhexdump(response_info->response_n,response_info->response,false); + return false; + } + + // Copy the byte array, used for this modulation to the buffer position + memcpy(response_info->modulation,ToSend,ToSendMax); + + // Store the number of bytes that were used for encoding/modulation + response_info->modulation_n = ToSendMax; + + return true; +} + +bool prepare_allocated_tag_modulation(tag_response_info_t* response_info) { + // Retrieve and store the current buffer index + response_info->modulation = free_buffer_pointer; + + // Determine the maximum size we can use from our buffer + size_t max_buffer_size = (((uint8_t *)BigBuf)+FREE_BUFFER_OFFSET+FREE_BUFFER_SIZE)-free_buffer_pointer; + + // Forward the prepare tag modulation function to the inner function + if (prepare_tag_modulation(response_info,max_buffer_size)) { + // Update the free buffer offset + free_buffer_pointer += ToSendMax; + return true; + } else { + return false; + } +} + //----------------------------------------------------------------------------- // Main loop of simulated tag: receive commands from reader, decide what // response to send, and send it. @@ -990,57 +1051,41 @@ void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data) ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]); uint8_t response5[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce - uint8_t response6[] = { 0x03, 0x3B, 0x00, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS - ComputeCrc14443(CRC_14443_A, response6, 3, &response6[3], &response6[4]); - - uint8_t *resp = NULL; - int respLen; - - // Longest possible response will be 16 bytes + 2 CRC = 18 bytes - // This will need - // 144 data bits (18 * 8) - // 18 parity bits - // 2 Start and stop - // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA) - // 1 just for the case - // ----------- + - // 166 - // - // 166 bytes, since every bit that needs to be send costs us a byte - // - - // Respond with card type - uint8_t *resp1 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); - int resp1Len; - - // Anticollision cascade1 - respond with uid - uint8_t *resp2 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + 166); - int resp2Len; - - // Anticollision cascade2 - respond with 2nd half of uid if asked - // we're only going to be asked if we set the 1st byte of the UID (during cascade1) to 0x88 - uint8_t *resp2a = (((uint8_t *)BigBuf) + 1140); - int resp2aLen; - - // Acknowledge select - cascade 1 - uint8_t *resp3 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + (166*2)); - int resp3Len; - - // Acknowledge select - cascade 2 - uint8_t *resp3a = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + (166*3)); - int resp3aLen; - - // Response to a read request - not implemented atm - uint8_t *resp4 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + (166*4)); -// int resp4Len; - - // Authenticate response - nonce - uint8_t *resp5 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + (166*5)); - int resp5Len; - - // Authenticate response - nonce - uint8_t *resp6 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + (166*6)); - int resp6Len; + uint8_t response6[] = { 0x04, 0x58, 0x00, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS + ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]); + + #define TAG_RESPONSE_COUNT 7 + tag_response_info_t responses[TAG_RESPONSE_COUNT] = { + { .response = response1, .response_n = sizeof(response1) }, // Answer to request - respond with card type + { .response = response2, .response_n = sizeof(response2) }, // Anticollision cascade1 - respond with uid + { .response = response2a, .response_n = sizeof(response2a) }, // Anticollision cascade2 - respond with 2nd half of uid if asked + { .response = response3, .response_n = sizeof(response3) }, // Acknowledge select - cascade 1 + { .response = response3a, .response_n = sizeof(response3a) }, // Acknowledge select - cascade 2 + { .response = response5, .response_n = sizeof(response5) }, // Authentication answer (random nonce) + { .response = response6, .response_n = sizeof(response6) }, // dummy ATS (pseudo-ATR), answer to RATS + }; + + // Allocate 512 bytes for the dynamic modulation, created when the reader querries for it + // Such a response is less time critical, so we can prepare them on the fly + #define DYNAMIC_RESPONSE_BUFFER_SIZE 64 + #define DYNAMIC_MODULATION_BUFFER_SIZE 512 + uint8_t dynamic_response_buffer[DYNAMIC_RESPONSE_BUFFER_SIZE]; + uint8_t dynamic_modulation_buffer[DYNAMIC_MODULATION_BUFFER_SIZE]; + tag_response_info_t dynamic_response_info = { + .response = dynamic_response_buffer, + .response_n = 0, + .modulation = dynamic_modulation_buffer, + .modulation_n = 0 + }; + + // Reset the offset pointer of the free buffer + reset_free_buffer(); + + // Prepare the responses of the anticollision phase + // there will be not enough time to do this at the moment the reader sends it REQA + for (size_t i=0; i 0) { + // Copy the CID from the reader query + dynamic_response_info.response[1] = receivedCmd[1]; + + // Add CRC bytes, always used in ISO 14443A-4 compliant cards + AppendCrc14443a(dynamic_response_info.response,dynamic_response_info.response_n); + dynamic_response_info.response_n += 2; + + if (prepare_tag_modulation(&dynamic_response_info,DYNAMIC_MODULATION_BUFFER_SIZE) == false) { + Dbprintf("Error preparing tag response"); + break; + } + p_response = &dynamic_response_info; } - // Do not respond - resp = resp1; respLen = 0; order = 0; - respdata = NULL; - respsize = 0; } // Count number of wakeups received after a halt @@ -1193,25 +1229,19 @@ void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data) if(cmdsRecvd > 999) { DbpString("1000 commands later..."); break; - } else { - cmdsRecvd++; } + cmdsRecvd++; - if(respLen > 0) { - EmSendCmd14443aRaw(resp, respLen, receivedCmd[0] == 0x52); - } - - if (tracing) { - if (respdata != NULL) { - LogTrace(respdata,respsize, 0, SwapBits(GetParity(respdata,respsize),respsize), FALSE); - } - if(traceLen > TRACE_SIZE) { - DbpString("Trace full"); - break; - } - } - - memset(receivedCmd, 0x44, RECV_CMD_SIZE); + if (p_response != NULL) { + EmSendCmd14443aRaw(p_response->modulation, p_response->modulation_n, receivedCmd[0] == 0x52); + if (tracing) { + LogTrace(p_response->response,p_response->response_n,0,SwapBits(GetParity(p_response->response,p_response->response_n),p_response->response_n),FALSE); + if(traceLen > TRACE_SIZE) { + DbpString("Trace full"); +// break; + } + } + } } Dbprintf("%x %x %x", happened, happened2, cmdsRecvd); @@ -1242,9 +1272,6 @@ void PrepareDelayedTransfer(uint16_t delay) } } - - - //----------------------------------------------------------------------------- // Transmit the command (to the tag) that was placed in ToSend[]. // Parameter timing: