X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/6a18e46fa6ab446f719111b54267d50956bcf0b0..57e1e31dce70a58da1736b9579a869c1df313a13:/armsrc/mifarecmd.c diff --git a/armsrc/mifarecmd.c b/armsrc/mifarecmd.c index 4c1fe1b6..4bb01a4c 100644 --- a/armsrc/mifarecmd.c +++ b/armsrc/mifarecmd.c @@ -4,7 +4,7 @@ // Hagen Fritsch - June 2010 // Midnitesnake - Dec 2013 // Andy Davies - Apr 2014 -// Iceman - May 2014 +// Iceman - May 2014,2015,2016 // // This code is licensed to you under the terms of the GNU GPL, version 2 or, // at your option, any later version. See the LICENSE.txt file for the text of @@ -14,11 +14,6 @@ //----------------------------------------------------------------------------- #include "mifarecmd.h" -#include "apps.h" -#include "util.h" -#include "crc.h" -#include "protocols.h" -#include "parity.h" //----------------------------------------------------------------------------- // Select, Authenticate, Read a MIFARE tag. @@ -75,7 +70,6 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) break; } - // ----------------------------- crypto1 destroy crypto1_destroy(pcs); if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED"); @@ -235,18 +229,17 @@ void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) if (MF_DBGLEVEL >= 1) Dbprintf("Halt error"); } - // ----------------------------- crypto1 destroy - crypto1_destroy(pcs); - if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED"); + crypto1_destroy(pcs); + LED_B_ON(); cmd_send(CMD_ACK,isOK,0,0,dataoutbuf,16*NumBlocksPerSector(sectorNo)); LED_B_OFF(); - // Thats it... FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); LEDsoff(); + set_tracing(FALSE); } // arg0 = blockNo (start) @@ -260,7 +253,7 @@ void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain) iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); // free eventually allocated BigBuf memory - BigBuf_free(); + BigBuf_free(); BigBuf_Clear_ext(false); clear_trace(); set_tracing(true); @@ -345,6 +338,7 @@ void MifareUReadCard(uint8_t arg0, uint16_t arg1, uint8_t arg2, uint8_t *datain) FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); LEDsoff(); BigBuf_free(); + set_tracing(FALSE); } //----------------------------------------------------------------------------- @@ -380,7 +374,7 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) LED_C_OFF(); while (true) { - if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) { + if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) { if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card"); break; }; @@ -404,19 +398,15 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) break; } - // ----------------------------- crypto1 destroy crypto1_destroy(pcs); if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED"); - LED_B_ON(); cmd_send(CMD_ACK,isOK,0,0,0,0); - LED_B_OFF(); - - // Thats it... FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); LEDsoff(); + set_tracing(FALSE); } /* // Command not needed but left for future testing @@ -527,6 +517,7 @@ void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain) cmd_send(CMD_ACK,1,0,0,0,0); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); LEDsoff(); + set_tracing(FALSE); } void MifareUSetPwd(uint8_t arg0, uint8_t *datain){ @@ -597,6 +588,7 @@ void MifareUSetPwd(uint8_t arg0, uint8_t *datain){ cmd_send(CMD_ACK,1,0,0,0,0); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); LEDsoff(); + set_tracing(FALSE); } // Return 1 if the nonce is invalid else return 0 @@ -613,6 +605,9 @@ int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) { // Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on // Computer and Communications Security, 2015 //----------------------------------------------------------------------------- +#define AUTHENTICATION_TIMEOUT 848 //848 // card times out 1ms after wrong authentication (according to NXP documentation) +#define PRE_AUTHENTICATION_LEADTIME 400 // some (non standard) cards need a pause after select before they are ready for first authentication + void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain) { uint64_t ui64Key = 0; @@ -638,20 +633,20 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, bool slow = flags & 0x0002; bool field_off = flags & 0x0004; - #define AUTHENTICATION_TIMEOUT 848 // card times out 1ms after wrong authentication (according to NXP documentation) - #define PRE_AUTHENTICATION_LEADTIME 400 // some (non standard) cards need a pause after select before they are ready for first authentication - LED_A_ON(); LED_C_OFF(); + BigBuf_free(); BigBuf_Clear_ext(false); + clear_trace(); + set_tracing(FALSE); + if (initialize) { iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); - clear_trace(); - set_tracing(true); } LED_C_ON(); + uint8_t dummy_answer = 0; uint16_t num_nonces = 0; bool have_uid = false; for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE - 9; ) { @@ -702,7 +697,6 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, } // send a dummy byte as reader response in order to trigger the cards authentication timeout - uint8_t dummy_answer = 0; ReaderTransmit(&dummy_answer, 1, NULL); timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT; @@ -711,21 +705,17 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, memcpy(buf+i, receivedAnswer, 4); nt_par_enc = par_enc[0] & 0xf0; } else { - nt_par_enc |= par_enc[0] >> 4; + nt_par_enc |= par_enc[0] >> 4; memcpy(buf+i+4, receivedAnswer, 4); memcpy(buf+i+8, &nt_par_enc, 1); i += 9; } - // wait for the card to become ready again - while(GetCountSspClk() < timeout); - + while(GetCountSspClk() < timeout); } LED_C_OFF(); - - crypto1_destroy(pcs); - + crypto1_destroy(pcs); LED_B_ON(); cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf)); LED_B_OFF(); @@ -735,6 +725,7 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, if (field_off) { FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); LEDsoff(); + set_tracing(FALSE); } } @@ -771,15 +762,15 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = {0x00}; uint32_t auth1_time, auth2_time; - static uint16_t delta_time; + static uint16_t delta_time = 0; LED_A_ON(); LED_C_OFF(); iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); // free eventually allocated BigBuf memory - BigBuf_free(); - + BigBuf_free(); BigBuf_Clear_ext(false); + if (calibrate) clear_trace(); set_tracing(true); @@ -822,12 +813,8 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat rtr--; continue; }; + auth2_time = (delta_time) ? auth1_time + delta_time : 0; - if (delta_time) { - auth2_time = auth1_time + delta_time; - } else { - auth2_time = 0; - } if(mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time)) { if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error"); rtr--; @@ -896,6 +883,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat // nested authentication auth2_time = auth1_time + delta_time; + len = mifare_sendcmd_short(pcs, AUTH_NESTED, 0x60 + (targetKeyType & 0x01), targetBlockNo, receivedAnswer, par, &auth2_time); if (len != 4) { if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error len=%d", len); @@ -906,9 +894,13 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]); // Parity validity check - for (j = 0; j < 4; j++) { - par_array[j] = (oddparity8(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01)); - } +// for (j = 0; j < 4; j++) { +// par_array[j] = (oddparity8(receivedAnswer[j]) != ((par[0] >> (7-j)) & 0x01)); +// } + par_array[0] = (oddparity8(receivedAnswer[0]) != ((par[0] >> (7-0)) & 0x01)); + par_array[1] = (oddparity8(receivedAnswer[1]) != ((par[0] >> (7-1)) & 0x01)); + par_array[2] = (oddparity8(receivedAnswer[2]) != ((par[0] >> (7-2)) & 0x01)); + par_array[3] = (oddparity8(receivedAnswer[3]) != ((par[0] >> (7-3)) & 0x01)); ncount = 0; nttest = prng_successor(nt1, dmin - 1); @@ -939,10 +931,9 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat LED_C_OFF(); - // ----------------------------- crypto1 destroy crypto1_destroy(pcs); - byte_t buf[4 + 4 * 4]; + byte_t buf[4 + 4 * 4] = {0}; memcpy(buf, &cuid, 4); memcpy(buf+4, &target_nt[0], 4); memcpy(buf+8, &target_ks[0], 4); @@ -964,16 +955,21 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat // MIFARE check keys. key count up to 85. // //----------------------------------------------------------------------------- -void MifareChkKeys(uint16_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) -{ - // params - uint8_t blockNo = arg0 & 0xff; - uint8_t keyType = (arg0 >> 8) & 0xff; - bool clearTrace = arg1; +void MifareChkKeys(uint16_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) { +#define STD_SEARCH 1 +#define EXT_SEARCH 2 + + uint8_t blockNo = arg0 & 0xFF; + uint8_t keyType = (arg0 >> 8) & 0xFF; + //uint8_t searchType = (arg1 >> 8 ) & 0xFF; + bool clearTrace = arg1 & 0xFF; uint8_t keyCount = arg2; uint64_t ui64Key = 0; - // variables + bool have_uid = FALSE; + uint8_t cascade_levels = 0; + uint32_t timeout = 0; + int i; byte_t isOK = 0; uint8_t uid[10] = {0x00}; @@ -982,46 +978,80 @@ void MifareChkKeys(uint16_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) struct Crypto1State *pcs; pcs = &mpcs; - // clear debug level + // save old debuglevel, and tempory turn off dbg printing. speedissues. int OLD_MF_DBGLEVEL = MF_DBGLEVEL; MF_DBGLEVEL = MF_DBG_NONE; + LEDsoff(); LED_A_ON(); - LED_B_OFF(); - LED_C_OFF(); + iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); if (clearTrace) clear_trace(); set_tracing(TRUE); - + for (i = 0; i < keyCount; ++i) { - if (mifare_classic_halt(pcs, cuid)) - if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Halt error"); - if (!iso14443a_select_card(uid, NULL, &cuid, true, 0)) { - if (OLD_MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card"); - break; - } + //mifare_classic_halt(pcs, cuid); + // this part is from Piwi's faster nonce collecting part in Hardnested. + if (!have_uid) { // need a full select cycle to get the uid first + iso14a_card_select_t card_info; + if(!iso14443a_select_card(uid, &card_info, &cuid, true, 0)) { + if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card (ALL)"); + break; + } + switch (card_info.uidlen) { + case 4 : cascade_levels = 1; break; + case 7 : cascade_levels = 2; break; + case 10: cascade_levels = 3; break; + default: break; + } + have_uid = TRUE; + } else { // no need for anticollision. We can directly select the card + if(!iso14443a_select_card(uid, NULL, NULL, false, cascade_levels)) { + if (MF_DBGLEVEL >= 1) Dbprintf("ChkKeys: Can't select card (UID)"); + continue; + } + } + ui64Key = bytes_to_num(datain + i * 6, 6); - if (mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) + + if (mifare_classic_auth(pcs, cuid, blockNo, keyType, ui64Key, AUTH_FIRST)) { + + uint8_t dummy_answer = 0; + ReaderTransmit(&dummy_answer, 1, NULL); + timeout = GetCountSspClk() + AUTHENTICATION_TIMEOUT; + + // wait for the card to become ready again + while(GetCountSspClk() < timeout); + continue; + } - isOK = 1; - break; + // found a key. + // + //if ( searchType == EXT_SEARCH) { + + //} + //else { + isOK = 1; + break; + //} } - crypto1_destroy(pcs); LED_B_ON(); - cmd_send(CMD_ACK,isOK,0,0,datain + i * 6,6); + cmd_send(CMD_ACK, isOK, 0, 0, datain + i * 6, 6); + + // restore debug level + MF_DBGLEVEL = OLD_MF_DBGLEVEL; + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); LEDsoff(); set_tracing(FALSE); - - // restore debug level - MF_DBGLEVEL = OLD_MF_DBGLEVEL; + crypto1_destroy(pcs); } //----------------------------------------------------------------------------- @@ -1194,15 +1224,14 @@ void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){ if(!iso14443a_select_card(uid, NULL, &cuid, true, 0)) { if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card"); errormsg = MAGIC_UID; - // break; } - - if ( mifare_classic_halt_ex(NULL) ) break; + mifare_classic_halt_ex(NULL); + break; } // wipe tag, fill it with zeros if (workFlags & MAGIC_WIPE){ - ReaderTransmitBitsPar(wupC1,7,0, NULL); + ReaderTransmitBitsPar(wupC1, 7, NULL, NULL); if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) { if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error"); errormsg = MAGIC_WIPE; @@ -1216,12 +1245,12 @@ void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){ break; } - if ( mifare_classic_halt_ex(NULL) ) break; + mifare_classic_halt_ex(NULL); } // write block if (workFlags & MAGIC_WUPC) { - ReaderTransmitBitsPar(wupC1,7,0, NULL); + ReaderTransmitBitsPar(wupC1, 7, NULL, NULL); if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) { if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error"); errormsg = MAGIC_WUPC; @@ -1253,7 +1282,7 @@ void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){ } if (workFlags & MAGIC_OFF) - if ( mifare_classic_halt_ex(NULL) ) break; + mifare_classic_halt_ex(NULL); isOK = true; break; @@ -1294,7 +1323,7 @@ void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){ //loop doesn't loop just breaks out if error or done while (true) { if (workFlags & MAGIC_WUPC) { - ReaderTransmitBitsPar(wupC1,7,0, NULL); + ReaderTransmitBitsPar(wupC1, 7, NULL, NULL); if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) { if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error"); errormsg = MAGIC_WUPC; @@ -1319,10 +1348,9 @@ void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){ memcpy(data, receivedAnswer, sizeof(data)); // send HALT - if (workFlags & MAGIC_HALT) { + if (workFlags & MAGIC_HALT) mifare_classic_halt_ex(NULL); - break; - } + isOK = true; break; } @@ -1342,25 +1370,53 @@ void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){ } void MifareCIdent(){ - + #define GEN_1A 1 + #define GEN_1B 2 + #define GEN_2 4 // variables - bool isOK = true; - uint8_t receivedAnswer[1] = {0x00}; - uint8_t receivedAnswerPar[1] = {0x00}; - - ReaderTransmitBitsPar(wupC1,7,0, NULL); - if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) { - isOK = false; - } - + uint8_t isGen = 0; + uint8_t rec[1] = {0x00}; + uint8_t recpar[1] = {0x00}; + + // Generation 1 test + ReaderTransmitBitsPar(wupC1, 7, NULL, NULL); + if(!ReaderReceive(rec, recpar) || (rec[0] != 0x0a)) { + goto TEST2; + }; + isGen = GEN_1B; + ReaderTransmit(wupC2, sizeof(wupC2), NULL); - if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) { - isOK = false; - } + if(!ReaderReceive(rec, recpar) || (rec[0] != 0x0a)) { + goto OUT; + }; + isGen = GEN_1A; + goto OUT; +TEST2:; +/* + // Generation 2 test + struct Crypto1State mpcs = {0, 0}; + struct Crypto1State *pcs = &mpcs; + + // halt previous. + mifare_classic_halt(NULL, 0); + + //select + if (!iso14443a_select_card(NULL, NULL, NULL, true, 0)) { + goto OUT; + }; + + // MIFARE_CLASSIC_WRITEBLOCK 0xA0 + // ACK 0x0a + uint16_t len = mifare_sendcmd_short(pcs, 1, 0xA0, 0, rec, recpar, NULL); + if ((len != 1) || (rec[0] != 0x0A)) { + isGen = GEN_2; + }; + */ +OUT:; // removed the if, since some magic tags misbehavies and send an answer to it. mifare_classic_halt(NULL, 0); - cmd_send(CMD_ACK,isOK,0,0,0,0); + cmd_send(CMD_ACK,isGen, 0, 0, 0, 0); } void OnSuccessMagic(){ @@ -1373,16 +1429,10 @@ void OnErrorMagic(uint8_t reason){ cmd_send(CMD_ACK,0,reason,0,0,0); OnSuccessMagic(); } - -void MifareCollectNonces(uint32_t arg0, uint32_t arg1){ -} - // // DESFIRE // - void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){ - byte_t dataout[12] = {0x00}; uint8_t uid[10] = {0x00}; uint32_t cuid = 0; @@ -1405,11 +1455,10 @@ void Mifare_DES_Auth1(uint8_t arg0, uint8_t *datain){ } if (MF_DBGLEVEL >= MF_DBG_EXTENDED) DbpString("AUTH 1 FINISHED"); - cmd_send(CMD_ACK,1,cuid,0,dataout, sizeof(dataout)); + cmd_send(CMD_ACK, 1, cuid, 0, dataout, sizeof(dataout)); } void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){ - uint32_t cuid = arg0; uint8_t key[16] = {0x00}; byte_t dataout[12] = {0x00}; @@ -1430,4 +1479,5 @@ void Mifare_DES_Auth2(uint32_t arg0, uint8_t *datain){ cmd_send(CMD_ACK, isOK, 0, 0, dataout, sizeof(dataout)); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); LEDsoff(); + set_tracing(FALSE); } \ No newline at end of file