X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/f53020e729d583f7975095ca7b4b467741d99edb..f445df401eef592968a87247137930b3c3bf52fa:/armsrc/iso14443a.c

diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index 9f2b6d94..9b7efaf6 100644
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -568,11 +568,8 @@ void RAMFUNC SniffIso14443a(uint8_t param) {
 	
 	LEDsoff();
 
-	// We won't start recording the frames that we acquire until we trigger;
-	// a good trigger condition to get started is probably when we see a
-	// response from the tag.
-	// triggered == FALSE -- to wait first for card
-	bool triggered = !(param & 0x03); 
+
+	iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
 	
 	// Allocate memory from BigBuf for some buffers
 	// free all previous allocations first
@@ -600,8 +597,6 @@ void RAMFUNC SniffIso14443a(uint8_t param) {
 	bool TagIsActive = FALSE;
 	bool ReaderIsActive = FALSE;
 	
-	iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
-
 	// Set up the demodulator for tag -> reader responses.
 	DemodInit(receivedResponse, receivedResponsePar);
 	
@@ -611,6 +606,12 @@ void RAMFUNC SniffIso14443a(uint8_t param) {
 	// Setup and start DMA.
 	FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
 	
+	// We won't start recording the frames that we acquire until we trigger;
+	// a good trigger condition to get started is probably when we see a
+	// response from the tag.
+	// triggered == FALSE -- to wait first for card
+	bool triggered = !(param & 0x03); 
+	
 	// And now we loop, receiving samples.
 	for(uint32_t rsamples = 0; TRUE; ) {
 
@@ -673,7 +674,6 @@ void RAMFUNC SniffIso14443a(uint8_t param) {
 					}
 					/* And ready to receive another command. */
 					UartReset();
-					//UartInit(receivedCmd, receivedCmdPar);
 					/* And also reset the demod code, which might have been */
 					/* false-triggered by the commands from the reader. */
 					DemodReset();
@@ -1092,6 +1092,9 @@ void SimulateIso14443aTag(int tagType, int flags, int uid_2nd, byte_t* data)
 		.modulation_n = 0
 	};
   
+	// We need to listen to the high-frequency, peak-detected path.
+	iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
+
 	BigBuf_free_keep_EM();
 
 	// allocate buffers:
@@ -1120,9 +1123,6 @@ void SimulateIso14443aTag(int tagType, int flags, int uid_2nd, byte_t* data)
 	int happened2 = 0;
 	int cmdsRecvd = 0;
 
-	// We need to listen to the high-frequency, peak-detected path.
-	iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
-
 	cmdsRecvd = 0;
 	tag_response_info_t* p_response;
 
@@ -1685,9 +1685,7 @@ static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen, bool correctionNe
 			FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
 		}
 	
-		if(BUTTON_PRESS()) {
-			break;
-		}
+		if(BUTTON_PRESS()) break;
 	}
 
 	// Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
@@ -2177,11 +2175,13 @@ void ReaderIso14443a(UsbCommand *c)
 // Therefore try in alternating directions.
 int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
 
+	uint16_t i;
+	uint32_t nttmp1, nttmp2;
+
 	if (nt1 == nt2) return 0;
 
-	uint16_t i;
-	uint32_t nttmp1 = nt1;
-	uint32_t nttmp2 = nt2;
+	nttmp1 = nt1;
+	nttmp2 = nt2;
 	
 	for (i = 1; i < 32768; i++) {
 		nttmp1 = prng_successor(nttmp1, 1);
@@ -2200,27 +2200,32 @@ int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
 // Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
 // (article by Nicolas T. Courtois, 2009)
 //-----------------------------------------------------------------------------
-void ReaderMifare(bool first_try) {
+void ReaderMifare(bool first_try)
+{
+	// Mifare AUTH
+	uint8_t mf_auth[]    = { 0x60,0x00,0xf5,0x7b };
+	uint8_t mf_nr_ar[]   = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
+	static uint8_t mf_nr_ar3;
+
+	uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
+	uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
+
+	if (first_try) { 
+		iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
+	}
+	
 	// free eventually allocated BigBuf memory. We want all for tracing.
 	BigBuf_free();
 	
 	clear_trace();
 	set_tracing(TRUE);
 
-	// Mifare AUTH
-	uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
-	uint8_t mf_nr_ar[8] = { 0x00 }; //{ 0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01 };
-	static uint8_t mf_nr_ar3 = 0;
-
-	uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = { 0x00 };
-	uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = { 0x00 };
-
 	byte_t nt_diff = 0;
 	uint8_t par[1] = {0};	// maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
 	static byte_t par_low = 0;
 	bool led_on = TRUE;
-	uint8_t uid[10] = {0x00};
-	//uint32_t cuid = 0x00;
+	uint8_t uid[10]  ={0};
+	uint32_t cuid;
 
 	uint32_t nt = 0;
 	uint32_t previous_nt = 0;
@@ -2235,11 +2240,8 @@ void ReaderMifare(bool first_try) {
 	uint16_t consecutive_resyncs = 0;
 	int isOK = 0;
 
-	int numWrongDistance = 0;
-	
 	if (first_try) { 
 		mf_nr_ar3 = 0;
-		iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
 		sync_time = GetCountSspClk() & 0xfffffff8;
 		sync_cycles = 65536;									// theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
 		nt_attacked = 0;
@@ -2256,22 +2258,23 @@ void ReaderMifare(bool first_try) {
 	LED_A_ON();
 	LED_B_OFF();
 	LED_C_OFF();
-	LED_C_ON();	
+	
+
+	#define DARKSIDE_MAX_TRIES	32		// number of tries to sync on PRNG cycle. Then give up.
+	uint16_t unsuccessfull_tries = 0;
   
 	for(uint16_t i = 0; TRUE; i++) {
 		
+		LED_C_ON();
 		WDT_HIT();
 
 		// Test if the action was cancelled
-		if(BUTTON_PRESS()) break;
-		
-		if (numWrongDistance > 1000) {
-			isOK = 0;
+		if(BUTTON_PRESS()) {
+			isOK = -1;
 			break;
 		}
 		
-		//if(!iso14443a_select_card(uid, NULL, &cuid)) {
-		if(!iso14443a_select_card(uid, NULL, NULL)) {
+		if(!iso14443a_select_card(uid, NULL, &cuid)) {
 			if (MF_DBGLEVEL >= 1)	Dbprintf("Mifare: Can't select card");
 			continue;
 		}
@@ -2305,14 +2308,15 @@ void ReaderMifare(bool first_try) {
 				nt_attacked = nt;
 			}
 			else {
-				
-				// invalid nonce received, try again
-				if (nt_distance == -99999) { 
-					numWrongDistance++;
-					if (MF_DBGLEVEL >= 3) Dbprintf("The two nonces has invalid distance, tag could have good PRNG\n");
-					continue;
+				if (nt_distance == -99999) { // invalid nonce received
+					unsuccessfull_tries++;
+					if (!nt_attacked && unsuccessfull_tries > DARKSIDE_MAX_TRIES) {
+						isOK = -3;		// Card has an unpredictable PRNG. Give up	
+						break;
+					} else {
+						continue;		// continue trying...
+					}
 				}
-				
 				sync_cycles = (sync_cycles - nt_distance);
 				if (MF_DBGLEVEL >= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);
 				continue;
@@ -2321,7 +2325,7 @@ void ReaderMifare(bool first_try) {
 
 		if ((nt != nt_attacked) && nt_attacked) { 	// we somehow lost sync. Try to catch up again...
 			catch_up_cycles = -dist_nt(nt_attacked, nt);
-			if (catch_up_cycles >= 99999) {			// invalid nonce received. Don't resync on that one.
+			if (catch_up_cycles == 99999) {			// invalid nonce received. Don't resync on that one.
 				catch_up_cycles = 0;
 				continue;
 			}
@@ -2373,12 +2377,17 @@ void ReaderMifare(bool first_try) {
 			if (nt_diff == 0 && first_try)
 			{
 				par[0]++;
+				if (par[0] == 0x00) {		// tried all 256 possible parities without success. Card doesn't send NACK.
+					isOK = -2;
+					break;
+				}
 			} else {
 				par[0] = ((par[0] & 0x1F) + 1) | par_low;
 			}
 		}
 	}
 
+
 	mf_nr_ar[3] &= 0x1F;
 	
 	byte_t buf[28] = {0x00};
@@ -2391,9 +2400,11 @@ void ReaderMifare(bool first_try) {
 		
 	cmd_send(CMD_ACK,isOK,0,0,buf,28);
 
-	set_tracing(FALSE);
+	// Thats it...
 	FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
 	LEDsoff();
+
+	set_tracing(FALSE);
 }
 
 
@@ -2450,13 +2461,6 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 	uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
 	uint8_t ar_nr_collected = 0;
 
-	// free eventually allocated BigBuf memory but keep Emulator Memory
-	BigBuf_free_keep_EM();
-
-	// clear trace
-	clear_trace();
-	set_tracing(TRUE);
-
 	// Authenticate response - nonce
 	uint32_t nonce = bytes_to_num(rAUTH_NT, 4);
 	
@@ -2503,10 +2507,6 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 		rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];
 	}
 
-	// We need to listen to the high-frequency, peak-detected path.
-	iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
-
-
 	if (MF_DBGLEVEL >= 1)	{
 		if (!_7BUID) {
 			Dbprintf("4B UID: %02x%02x%02x%02x", 
@@ -2518,6 +2518,17 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
 		}
 	}
 
+	// We need to listen to the high-frequency, peak-detected path.
+	iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
+
+	// free eventually allocated BigBuf memory but keep Emulator Memory
+	BigBuf_free_keep_EM();
+
+	// clear trace
+	clear_trace();
+	set_tracing(TRUE);
+
+
 	bool finished = FALSE;
 	while (!BUTTON_PRESS() && !finished) {
 		WDT_HIT();
@@ -2929,9 +2940,6 @@ void RAMFUNC SniffMifare(uint8_t param) {
 	// bit 0 - trigger from first card answer
 	// bit 1 - trigger from first reader 7-bit request
 
-	// free eventually allocated BigBuf memory
-	BigBuf_free();
-	
 	// C(red) A(yellow) B(green)
 	LEDsoff();
 	// init trace buffer
@@ -2947,6 +2955,10 @@ void RAMFUNC SniffMifare(uint8_t param) {
 	uint8_t receivedResponse[MAX_MIFARE_FRAME_SIZE];
 	uint8_t receivedResponsePar[MAX_MIFARE_PARITY_SIZE];
 
+	iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
+
+	// free eventually allocated BigBuf memory
+	BigBuf_free();
 	// allocate the DMA buffer, used to stream samples from the FPGA
 	uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
 	uint8_t *data = dmaBuf;
@@ -2956,8 +2968,6 @@ void RAMFUNC SniffMifare(uint8_t param) {
 	bool ReaderIsActive = FALSE;
 	bool TagIsActive = FALSE;
 
-	iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
-
 	// Set up the demodulator for tag -> reader responses.
 	DemodInit(receivedResponse, receivedResponsePar);
 
@@ -3037,7 +3047,6 @@ void RAMFUNC SniffMifare(uint8_t param) {
 					if (MfSniffLogic(receivedCmd, Uart.len, Uart.parity, Uart.bitCount, TRUE)) break;
 
 					/* And ready to receive another command. */
-					//UartInit(receivedCmd, receivedCmdPar);
 					UartReset();
 					
 					/* And also reset the demod code */