X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/645c960f6111f4820c78c76f209479c3f369a8ac..6d3e6c740b763021d66002fabfee95d1595d7ed8:/armsrc/iclass.c

diff --git a/armsrc/iclass.c b/armsrc/iclass.c
index 329e1765..1a375118 100644
--- a/armsrc/iclass.c
+++ b/armsrc/iclass.c
@@ -640,21 +640,25 @@ void RAMFUNC SnoopIClass(void)
     // The command (reader -> tag) that we're receiving.
 	// The length of a received command will in most cases be no more than 18 bytes.
 	// So 32 should be enough!
-	uint8_t *readerToTagCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
+	#define ICLASS_BUFFER_SIZE 32
+	uint8_t readerToTagCmd[ICLASS_BUFFER_SIZE];
     // The response (tag -> reader) that we're receiving.
-	uint8_t *tagToReaderResponse = (((uint8_t *)BigBuf) + RECV_RESP_OFFSET);
+	uint8_t tagToReaderResponse[ICLASS_BUFFER_SIZE];
 	
     FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
  
-    // reset traceLen to 0
+ 	// free all BigBuf memory
+	BigBuf_free();
+    // The DMA buffer, used to stream samples from the FPGA
+    uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
+ 
+	// reset traceLen to 0
     iso14a_set_tracing(TRUE);
     iso14a_clear_trace();
     iso14a_set_trigger(FALSE);
 
-    // The DMA buffer, used to stream samples from the FPGA
-    int8_t *dmaBuf = ((int8_t *)BigBuf) + DMA_BUFFER_OFFSET;
-    int lastRxCounter;
-    int8_t *upTo;
+	int lastRxCounter;
+    uint8_t *upTo;
     int smpl;
     int maxBehindBy = 0;
 
@@ -703,7 +707,7 @@ void RAMFUNC SnoopIClass(void)
                                 (DMA_BUFFER_SIZE-1);
         if(behindBy > maxBehindBy) {
             maxBehindBy = behindBy;
-            if(behindBy > 400) {
+            if(behindBy > (9 * DMA_BUFFER_SIZE / 10)) {
                 Dbprintf("blew circular buffer! behindBy=0x%x", behindBy);
                 goto done;
             }
@@ -921,7 +925,7 @@ static void CodeIClassTagAnswer(const uint8_t *cmd, int len)
 	 * - A 1-bit input to the FPGA becomes 8 pulses on 423.5kHz (fc/32) (18.88us).
 	 * - A 0-bit inptu to the FPGA becomes an unmodulated time of 18.88us
 	 *
-	 * In thist mode the SOF can be written as 00011101 = 0x1D
+	 * In this mode the SOF can be written as 00011101 = 0x1D
 	 * The EOF can be written as 10111000 = 0xb8
 	 * A logic 1 is 01
 	 * A logic 0 is 10
@@ -998,7 +1002,7 @@ void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain
 	else if(simType == 2)
 	{
 
-		uint8_t mac_responses[64] = { 0 };
+		uint8_t mac_responses[USB_CMD_DATA_SIZE] = { 0 };
 		Dbprintf("Going into attack mode, %d CSNS sent", numberOfCSNS);
 		// In this mode, a number of csns are within datain. We'll simulate each one, one at a time
 		// in order to collect MAC's from the reader. This can later be used in an offlne-attack
@@ -1064,27 +1068,28 @@ int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived, uint8_t *reader
 	int trace_data_size = 0;
 	//uint8_t sof = 0x0f;
 
+	// free eventually allocated BigBuf memory
+	BigBuf_free();
 	// Respond SOF -- takes 1 bytes
-	uint8_t *resp1 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
+	uint8_t *resp1 = BigBuf_malloc(2);
 	int resp1Len;
 
 	// Anticollision CSN (rotated CSN)
 	// 22: Takes 2 bytes for SOF/EOF and 10 * 2 = 20 bytes (2 bytes/byte)
-	uint8_t *resp2 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + 2);
+	uint8_t *resp2 = BigBuf_malloc(28);
 	int resp2Len;
 
 	// CSN
 	// 22: Takes 2 bytes for SOF/EOF and 10 * 2 = 20 bytes (2 bytes/byte)
-	uint8_t *resp3 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + 30);
+	uint8_t *resp3 = BigBuf_malloc(30);
 	int resp3Len;
 
 	// e-Purse
-	// 18: Takes 2 bytes for SOF/EOF and 8 * 2 = 16 bytes (2 bytes/byte)
-	uint8_t *resp4 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + 60);
+	// 18: Takes 2 bytes for SOF/EOF and 8 * 2 = 16 bytes (2 bytes/bit)
+	uint8_t *resp4 = BigBuf_malloc(20);
 	int resp4Len;
 
-	// + 1720..
-	uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
+	uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
 	memset(receivedCmd, 0x44, MAX_FRAME_SIZE);
 	int len;
 
@@ -1215,12 +1220,7 @@ int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived, uint8_t *reader
 			cmdsRecvd++;
 		}
 		/**
-		After changes to parity calculation
-		Time between reader EOT and pm3 SOF
-		delay	21 -> 480uS
-		delay	10 -> 220us
-		delay	16 -> 388us
-		A legit tag has about 380us.
+		A legit tag has about 380us delay between reader EOT and tag SOF.
 		**/
 		if(modulated_response_size > 0) {
 			SendIClassAnswer(modulated_response, modulated_response_size, 1);
@@ -1248,6 +1248,8 @@ int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived, uint8_t *reader
 	//Dbprintf("%x", cmdsRecvd);
 	LED_A_OFF();
 	LED_B_OFF();
+	LED_C_OFF();
+
 	if(buttonPressed)
 	{
 		DbpString("Button pressed");
@@ -1532,7 +1534,7 @@ uint8_t handshakeIclassTag(uint8_t *card_data)
 	static uint8_t identify[]    = { 0x0c };
 	static uint8_t select[]      = { 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 	static uint8_t readcheck_cc[]= { 0x88, 0x02 };
-	uint8_t *resp = (((uint8_t *)BigBuf) + RECV_RESP_OFFSET);
+	uint8_t resp[ICLASS_BUFFER_SIZE];
 
 	uint8_t read_status = 0;
 
@@ -1590,7 +1592,7 @@ void ReaderIClass(uint8_t arg0) {
     while(!BUTTON_PRESS())
     {
 
-		if(traceLen > TRACE_SIZE) {
+		if(traceLen > BigBuf_max_traceLen()) {
 			DbpString("Trace full");
 			break;
 		}
@@ -1653,7 +1655,7 @@ void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
 	  int keyaccess;
 	} memory;
 	
-	uint8_t* resp = (((uint8_t *)BigBuf) + RECV_RESP_OFFSET);
+	uint8_t resp[ICLASS_BUFFER_SIZE];
 	
     setupIclassReader();
 
@@ -1662,7 +1664,7 @@ void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
 	
 		WDT_HIT();
 
-		if(traceLen > TRACE_SIZE) {
+		if(traceLen > BigBuf_max_traceLen()) {
 			DbpString("Trace full");
 			break;
 		}