From: Martin Holst Swende <martin@swende.se>
Date: Sat, 21 Feb 2015 19:47:40 +0000 (+0100)
Subject: Fixed minor bugs in iclass fullsim, does not work yet though
X-Git-Tag: v2.0.0-rc1~7
X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/commitdiff_plain/b19caaefc277335ed623e0a3b6c80be31fce439c?hp=1defcf606f59d93d80fe45dc91d28cc552db0c51

Fixed minor bugs in iclass fullsim, does not work yet though
---

diff --git a/armsrc/iclass.c b/armsrc/iclass.c
index a976217d..81ecd01b 100644
--- a/armsrc/iclass.c
+++ b/armsrc/iclass.c
@@ -1085,7 +1085,7 @@ int doIClassSimulation( int simulationMode, uint8_t *reader_mac_buf)
 	// Tag    CSN
 
 	uint8_t *modulated_response;
-	int modulated_response_size;
+	int modulated_response_size = 0;
 	uint8_t* trace_data = NULL;
 	int trace_data_size = 0;
 
@@ -1132,8 +1132,10 @@ int doIClassSimulation( int simulationMode, uint8_t *reader_mac_buf)
 	CodeIClassTagAnswer(card_challenge_data, sizeof(card_challenge_data));
 	memcpy(resp_cc, ToSend, ToSendMax); resp_cc_len = ToSendMax;
 
-	//This is used for responding to READ-block commands
+	//This is used for responding to READ-block commands or other data which is dynamically generated
 	uint8_t *data_response = BigBuf_malloc(8 * 2 + 2);
+	//This is used for responding to READ-block commands or other data which is dynamically generated
+	uint8_t *data_generic_trace = BigBuf_malloc(8 * 2 + 2);
 
 	// Start from off (no field generated)
 	//FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
@@ -1201,7 +1203,8 @@ int doIClassSimulation( int simulationMode, uint8_t *reader_mac_buf)
 				//Reader just sent us NR and MAC(k,cc * nr)
 				//The diversified key should be stored on block 3
 				//However, from a typical dump, the key will not be there
-				uint8_t *diversified_key = { 0 };
+				uint8_t diversified_key[8] = { 0 };
+
 				//Get the diversified key from emulator memory
 				memcpy(diversified_key, emulator+(8*3),8);
 				uint8_t ccnr[12] = { 0 };
@@ -1210,7 +1213,8 @@ int doIClassSimulation( int simulationMode, uint8_t *reader_mac_buf)
 				//Put nr there
 				memcpy(ccnr+8, receivedCmd+1,4);
 				//Now, calc MAC
-				doMAC(ccnr,diversified_key, trace_data);
+				doMAC(ccnr,diversified_key, data_generic_trace);
+				trace_data = data_generic_trace;
 				trace_data_size = 4;
 				CodeIClassTagAnswer(trace_data , trace_data_size);
 				memcpy(data_response, ToSend, ToSendMax);
@@ -1253,6 +1257,13 @@ int doIClassSimulation( int simulationMode, uint8_t *reader_mac_buf)
 			modulated_response = data_response;
 			modulated_response_size = ToSendMax;
 		}
+		else if(receivedCmd[0] == ICLASS_CMD_PAGESEL)
+		{//Pagesel
+			//Pagesel enables to select a page in the selected chip memory and return its configuration block
+			//Chips with a single page will not answer to this command
+			// It appears we're fine ignoring this.
+			//Otherwise, we should answer 8bytes (block) + 2bytes CRC
+		}
 		else {
 			//#db# Unknown command received from reader (len=5): 26 1 0 f6 a 44 44 44 44
 			// Never seen this command before