X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/61fe90736be4400f09fb5f56e2de48d11a0ae0a7..c8387e85e39182527d30317efa127642ddfe5d79:/armsrc/iclass.c

diff --git a/armsrc/iclass.c b/armsrc/iclass.c
index f289d24e..260e6a60 100644
--- a/armsrc/iclass.c
+++ b/armsrc/iclass.c
@@ -1042,6 +1042,10 @@ void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain
 	Dbprintf("Done...");
 
 }
+void AppendCrc(uint8_t* data, int len)
+{
+	ComputeCrc14443(CRC_ICLASS,data,len,data+len,data+len+1);
+}
 
 /**
  * @brief Does the actual simulation
@@ -1071,18 +1075,20 @@ int doIClassSimulation( int simulationMode, uint8_t *reader_mac_buf)
 	ComputeCrc14443(CRC_ICLASS, anticoll_data, 8, &anticoll_data[8], &anticoll_data[9]);
 	ComputeCrc14443(CRC_ICLASS, csn_data, 8, &csn_data[8], &csn_data[9]);
 
-	//The diversified key should be stored on block 3
 	uint8_t diversified_key[8] = { 0 };
-	//Get the diversified key from emulator memory
-	memcpy(diversified_key, emulator+(8*3),8);
 	// e-Purse
 	uint8_t card_challenge_data[8] = { 0x00 };
 	if(simulationMode == MODE_FULLSIM)
 	{
+		//The diversified key should be stored on block 3
+		//Get the diversified key from emulator memory
+		memcpy(diversified_key, emulator+(8*3),8);
+
 		//Card challenge, a.k.a e-purse is on block 2
 		memcpy(card_challenge_data,emulator + (8 * 2) , 8);
 		//Precalculate the cipher state, feeding it the CC
-		opt_doTagMAC_1(card_challenge_data,diversified_key);
+		cipher_state = opt_doTagMAC_1(card_challenge_data,diversified_key);
+
 	}
 
 	int exitLoop = 0;
@@ -1142,9 +1148,11 @@ int doIClassSimulation( int simulationMode, uint8_t *reader_mac_buf)
 	memcpy(resp_cc, ToSend, ToSendMax); resp_cc_len = ToSendMax;
 
 	//This is used for responding to READ-block commands or other data which is dynamically generated
-	uint8_t *data_response = BigBuf_malloc(8 * 2 + 2);
-	//This is used for responding to READ-block commands or other data which is dynamically generated
-	uint8_t *data_generic_trace = BigBuf_malloc(8 * 2 + 2);
+	//First the 'trace'-data, not encoded for FPGA
+	uint8_t *data_generic_trace = BigBuf_malloc(8 + 2);//8 bytes data + 2byte CRC is max tag answer
+	//Then storage for the modulated data
+	//Each bit is doubled when modulated for FPGA, and we also have SOF and EOF (2 bytes)
+	uint8_t *data_response = BigBuf_malloc( (8+2) * 2 + 2);
 
 	// Start from off (no field generated)
 	//FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
@@ -1164,9 +1172,9 @@ int doIClassSimulation( int simulationMode, uint8_t *reader_mac_buf)
 
 	LED_A_ON();
 	bool buttonPressed = false;
-
+	uint8_t response_delay = 1;
 	while(!exitLoop) {
-
+		response_delay = 1;
 		LED_B_OFF();
 		//Signal tracer
 		// Can be used to get a trigger for an oscilloscope..
@@ -1218,6 +1226,7 @@ int doIClassSimulation( int simulationMode, uint8_t *reader_mac_buf)
 				memcpy(data_response, ToSend, ToSendMax);
 				modulated_response = data_response;
 				modulated_response_size = ToSendMax;
+				response_delay = 0;//We need to hurry here...
 				//exitLoop = true;
 			}else
 			{	//Not fullsim, we don't respond
@@ -1249,8 +1258,28 @@ int doIClassSimulation( int simulationMode, uint8_t *reader_mac_buf)
 		} else if(simulationMode == MODE_FULLSIM && receivedCmd[0] == ICLASS_CMD_READ_OR_IDENTIFY && len == 4){
 			//Read block
 			uint16_t blk = receivedCmd[1];
-			trace_data = emulator+(blk << 3);
-			trace_data_size = 8;
+			//Take the data...
+			memcpy(data_generic_trace, emulator+(blk << 3),8);
+			//Add crc
+			AppendCrc(data_generic_trace, 8);
+			trace_data = data_generic_trace;
+			trace_data_size = 10;
+			CodeIClassTagAnswer(trace_data , trace_data_size);
+			memcpy(data_response, ToSend, ToSendMax);
+			modulated_response = data_response;
+			modulated_response_size = ToSendMax;
+		}else if(receivedCmd[0] == ICLASS_CMD_UPDATE && simulationMode == MODE_FULLSIM)
+		{//Probably the reader wants to update the nonce. Let's just ignore that for now.
+			// OBS! If this is implemented, don't forget to regenerate the cipher_state
+			//We're expected to respond with the data+crc, exactly what's already in the receivedcmd
+			//receivedcmd is now UPDATE 1b | ADDRESS 1b| DATA 8b| Signature 4b or CRC 2b|
+
+			//Take the data...
+			memcpy(data_generic_trace, receivedCmd+2,8);
+			//Add crc
+			AppendCrc(data_generic_trace, 8);
+			trace_data = data_generic_trace;
+			trace_data_size = 10;
 			CodeIClassTagAnswer(trace_data , trace_data_size);
 			memcpy(data_response, ToSend, ToSendMax);
 			modulated_response = data_response;
@@ -1288,7 +1317,7 @@ int doIClassSimulation( int simulationMode, uint8_t *reader_mac_buf)
 		A legit tag has about 380us delay between reader EOT and tag SOF.
 		**/
 		if(modulated_response_size > 0) {
-			SendIClassAnswer(modulated_response, modulated_response_size, 1);
+			SendIClassAnswer(modulated_response, modulated_response_size, response_delay);
 			t2r_time = GetCountSspClk();
 		}