From b10a759fefc33673745dd65a6b4ba11af7cf8025 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sun, 12 Jul 2015 22:58:16 +0200 Subject: [PATCH] @PM3 master merges, Piwi fix for mfnested @Marshmellow42 's fix for FDB --- armsrc/BigBuf.h | 14 +-- armsrc/apps.h | 2 +- armsrc/iso14443b.c | 123 ++++++++++++++------- armsrc/mifarecmd.c | 14 +-- client/cmddata.c | 9 +- client/cmdhf14b.c | 206 +++++++++++++++++++++++++++++++---- client/cmdhfmf.c | 22 +--- client/mifarehost.c | 6 +- client/mifarehost.h | 2 +- client/nonce2key/nonce2key.c | 2 +- 10 files changed, 299 insertions(+), 101 deletions(-) diff --git a/armsrc/BigBuf.h b/armsrc/BigBuf.h index b44a1263..0e2f1744 100644 --- a/armsrc/BigBuf.h +++ b/armsrc/BigBuf.h @@ -24,15 +24,15 @@ extern uint8_t *BigBuf_get_addr(void); extern uint8_t *BigBuf_get_EM_addr(void); extern uint16_t BigBuf_max_traceLen(void); -void BigBuf_Clear(void); +extern void BigBuf_Clear(void); extern uint8_t *BigBuf_malloc(uint16_t); extern void BigBuf_free(void); extern void BigBuf_free_keep_EM(void); -uint16_t BigBuf_get_traceLen(void); -void clear_trace(); -void set_tracing(bool enable); -bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t iLen, uint32_t timestamp_start, uint32_t timestamp_end, uint8_t *parity, bool readerToTag); -int LogTraceHitag(const uint8_t * btBytes, int iBits, int iSamples, uint32_t dwParity, int bReader); -uint8_t emlSet(uint8_t *data, uint32_t offset, uint32_t length); +extern uint16_t BigBuf_get_traceLen(void); +extern void clear_trace(); +extern void set_tracing(bool enable); +extern bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t iLen, uint32_t timestamp_start, uint32_t timestamp_end, uint8_t *parity, bool readerToTag); +extern int LogTraceHitag(const uint8_t * btBytes, int iBits, int iSamples, uint32_t dwParity, int bReader); +extern uint8_t emlSet(uint8_t *data, uint32_t offset, uint32_t length); #endif /* __BIGBUF_H */ diff --git a/armsrc/apps.h b/armsrc/apps.h index 5d0f7821..386489df 100644 --- a/armsrc/apps.h +++ b/armsrc/apps.h @@ -130,7 +130,7 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) //void MifareUWriteBlockCompat(uint8_t arg0,uint8_t *datain); void MifareUWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t *datain); void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); -void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain); +void MifareChkKeys(uint16_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain); void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain); void MifareSetDbgLvl(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); diff --git a/armsrc/iso14443b.c b/armsrc/iso14443b.c index ee7f18f2..db7f7539 100644 --- a/armsrc/iso14443b.c +++ b/armsrc/iso14443b.c @@ -16,9 +16,10 @@ #include "iso14443crc.h" -#define RECEIVE_SAMPLES_TIMEOUT 2000 -#define ISO14443B_DMA_BUFFER_SIZE 256 +#define RECEIVE_SAMPLES_TIMEOUT 200000 +#define ISO14443B_DMA_BUFFER_SIZE 512 +uint8_t PowerOn = TRUE; //============================================================================= // An ISO 14443 Type B tag. We listen for commands from the reader, using // a UART kind of thing that's implemented in software. When we get a @@ -266,6 +267,7 @@ static void UartReset() Uart.state = STATE_UNSYNCD; Uart.byteCnt = 0; Uart.bitCnt = 0; + memset(Uart.output, 0x00, MAX_FRAME_SIZE); } @@ -321,10 +323,14 @@ static int GetIso14443bCommandFromReader(uint8_t *received, uint16_t *len) //----------------------------------------------------------------------------- void SimulateIso14443bTag(void) { - // the only commands we understand is REQB, AFI=0, Select All, N=0: - static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 }; - // ... and REQB, AFI=0, Normal Request, N=0: - static const uint8_t cmd2[] = { 0x05, 0x00, 0x00, 0x71, 0xFF }; + // the only commands we understand is WUPB, AFI=0, Select All, N=1: + static const uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 }; // WUPB + // ... and REQB, AFI=0, Normal Request, N=1: + static const uint8_t cmd2[] = { 0x05, 0x00, 0x00, 0x71, 0xFF }; // REQB + // ... and HLTB + static const uint8_t cmd3[] = { 0x50, 0xff, 0xff, 0xff, 0xff }; // HLTB + // ... and ATTRIB + static const uint8_t cmd4[] = { 0x1D, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; // ATTRIB // ... and we always respond with ATQB, PUPI = 820de174, Application Data = 0x20381922, // supports only 106kBit/s in both directions, max frame size = 32Bytes, @@ -333,6 +339,8 @@ void SimulateIso14443bTag(void) 0x50, 0x82, 0x0d, 0xe1, 0x74, 0x20, 0x38, 0x19, 0x22, 0x00, 0x21, 0x85, 0x5e, 0xd7 }; + // response to HLTB and ATTRIB + static const uint8_t response2[] = {0x00, 0x78, 0xF0}; uint8_t parity[MAX_PARITY_SIZE]; @@ -358,6 +366,12 @@ void SimulateIso14443bTag(void) memcpy(resp1Code, ToSend, ToSendMax); uint16_t resp1CodeLen = ToSendMax; + // prepare the (other) tag answer: + CodeIso14443bAsTag(response2, sizeof(response2)); + uint8_t *resp2Code = BigBuf_malloc(ToSendMax); + memcpy(resp2Code, ToSend, ToSendMax); + uint16_t resp2CodeLen = ToSendMax; + // We need to listen to the high-frequency, peak-detected path. SetAdcMuxFor(GPIO_MUXSEL_HIPKD); FpgaSetupSsc(); @@ -382,18 +396,33 @@ void SimulateIso14443bTag(void) respLen = sizeof(response1); respCode = resp1Code; respCodeLen = resp1CodeLen; + } else if ( (len == sizeof(cmd3) && receivedCmd[0] == cmd3[0]) + || (len == sizeof(cmd4) && receivedCmd[0] == cmd4[0]) ) { + resp = response2; + respLen = sizeof(response2); + respCode = resp2Code; + respCodeLen = resp2CodeLen; } else { Dbprintf("new cmd from reader: len=%d, cmdsRecvd=%d", len, cmdsRecvd); // And print whether the CRC fails, just for good measure uint8_t b1, b2; + if (len >= 3){ // if crc exists ComputeCrc14443(CRC_14443_B, receivedCmd, len-2, &b1, &b2); if(b1 != receivedCmd[len-2] || b2 != receivedCmd[len-1]) { // Not so good, try again. DbpString("+++CRC fail"); + } else { DbpString("CRC passes"); } - break; + } + //get rid of compiler warning + respCodeLen = 0; + resp = response1; + respLen = 0; + respCode = resp1Code; + //don't crash at new command just wait and see if reader will send other new cmds. + //break; } cmdsRecvd++; @@ -446,7 +475,7 @@ void SimulateIso14443bTag(void) // trace the response: if (tracing) LogTrace(resp, respLen, 0, 0, parity, FALSE); } - //FpgaDisableSscDma(); + FpgaDisableSscDma(); } //============================================================================= @@ -570,19 +599,19 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq) break; case DEMOD_PHASE_REF_TRAINING: - if(Demod.posCount < 8) { + if(Demod.posCount < 10*2) { CHECK_FOR_SUBCARRIER(); if (v > SUBCARRIER_DETECT_THRESHOLD) { // set the reference phase (will code a logic '1') by averaging over 32 1/fs. // note: synchronization time > 80 1/fs - Demod.sumI += ci; - Demod.sumQ += cq; + Demod.sumI += ci; + Demod.sumQ += cq; Demod.posCount++; } else { // subcarrier lost - Demod.state = DEMOD_UNSYNCD; + Demod.state = DEMOD_UNSYNCD; } } else { - Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF; + Demod.state = DEMOD_AWAITING_FALLING_EDGE_OF_SOF; } break; @@ -592,7 +621,8 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq) Demod.state = DEMOD_GOT_FALLING_EDGE_OF_SOF; Demod.posCount = 0; // start of SOF sequence } else { - if(Demod.posCount > 200/4) { // maximum length of TR1 = 200 1/fs + //if(Demod.posCount > 200/4) { // maximum length of TR1 = 200 1/fs + if(Demod.posCount > 25*2) { // maximum length of TR1 = 200 1/fs Demod.state = DEMOD_UNSYNCD; } } @@ -603,10 +633,9 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq) Demod.posCount++; MAKE_SOFT_DECISION(); if(v > 0) { - if(Demod.posCount < 9*2) { // low phase of SOF too short (< 9 etu). Note: spec is >= 10, but FPGA tends to "smear" edges + if(Demod.posCount < 10*2) { // low phase of SOF too short (< 9 etu). Note: spec is >= 10, but FPGA tends to "smear" edges Demod.state = DEMOD_UNSYNCD; } else { - LED_C_ON(); // Got SOF Demod.state = DEMOD_AWAITING_START_BIT; Demod.posCount = 0; Demod.len = 0; @@ -616,7 +645,7 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq) */ } } else { - if(Demod.posCount > 12*2) { // low phase of SOF too long (> 12 etu) + if(Demod.posCount > 13*2) { // low phase of SOF too long (> 12 etu) Demod.state = DEMOD_UNSYNCD; LED_C_OFF(); } @@ -664,6 +693,7 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq) Demod.bitCount++; if(Demod.bitCount == 10) { + LED_C_ON(); uint16_t s = Demod.shiftReg; if((s & 0x200) && !(s & 0x001)) { // stop bit == '1', start bit == '0' uint8_t b = (s >> 1); @@ -675,7 +705,7 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq) LED_C_OFF(); if(s == 0x000) { // This is EOF (start, stop and all data bits == '0' - return TRUE; + return TRUE; } } } @@ -688,7 +718,6 @@ static RAMFUNC int Handle14443bSamplesDemod(int ci, int cq) LED_C_OFF(); break; } - return FALSE; } @@ -723,28 +752,30 @@ static void GetSamplesFor14443bDemod(int n, bool quiet) // Allocate memory from BigBuf for some buffers // free all previous allocations first BigBuf_free(); - + + // And put the FPGA in the appropriate mode + FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ); + // The response (tag -> reader) that we're receiving. uint8_t *resp = BigBuf_malloc(MAX_FRAME_SIZE); - - // The DMA buffer, used to stream samples from the FPGA - int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE); // Set up the demodulator for tag -> reader responses. DemodInit(resp); + + // The DMA buffer, used to stream samples from the FPGA + int8_t *dmaBuf = (int8_t*) BigBuf_malloc(ISO14443B_DMA_BUFFER_SIZE); - // Setup and start DMA. - FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE); int8_t *upTo = dmaBuf; lastRxCounter = ISO14443B_DMA_BUFFER_SIZE; // Signal field is ON with the appropriate LED: LED_D_ON(); - // And put the FPGA in the appropriate mode - FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ); - SpinDelayUs(151); // T0 time between reader send, tag answer. 151us. + // Setup and start DMA. + FpgaSetupSscDma((uint8_t*) dmaBuf, ISO14443B_DMA_BUFFER_SIZE); + + for(;;) { int behindBy = lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR; if(behindBy > max) max = behindBy; @@ -778,7 +809,17 @@ static void GetSamplesFor14443bDemod(int n, bool quiet) AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS; - if (!quiet) Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d", max, samples, gotFrame, Demod.len, Demod.sumI, Demod.sumQ); + if (!quiet) { + Dbprintf("max behindby = %d, samples = %d, gotFrame = %d, Demod.len = %d, Demod.sumI = %d, Demod.sumQ = %d", + max, + samples, + gotFrame, + Demod.len, + Demod.sumI, + Demod.sumQ + ); + } + //Tracing if (tracing && Demod.len > 0) { uint8_t parity[MAX_PARITY_SIZE]; @@ -805,7 +846,9 @@ static void TransmitFor14443b(void) // Signal we are transmitting with the Green LED LED_B_ON(); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_READER_TX | FPGA_HF_READER_TX_SHALLOW_MOD); - + if ( !PowerOn ) + SpinDelay(200); + for(c = 0; c < 10;) { if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { AT91C_BASE_SSC->SSC_THR = 0xff; @@ -849,11 +892,11 @@ static void CodeIso14443bAsReader(const uint8_t *cmd, int len) ToSendReset(); // Establish initial reference level - for(i = 0; i < 40; i++) { + for(i = 0; i < 80; i++) { ToSendStuffBit(1); } // Send SOF - for(i = 0; i < 10; i++) { + for(i = 0; i < 11; i++) { ToSendStuffBit(0); } @@ -876,7 +919,7 @@ static void CodeIso14443bAsReader(const uint8_t *cmd, int len) } // Send EOF ToSendStuffBit(1); - for(i = 0; i < 10; i++) { + for(i = 0; i < 11; i++) { ToSendStuffBit(0); } for(i = 0; i < 8; i++) { @@ -885,7 +928,7 @@ static void CodeIso14443bAsReader(const uint8_t *cmd, int len) // And then a little more, to make sure that the last character makes // it out before we switch to rx mode. - for(i = 0; i < 24; i++) { + for(i = 0; i < 10; i++) { ToSendStuffBit(1); } @@ -1212,8 +1255,10 @@ void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, u FpgaDownloadAndGo(FPGA_BITSTREAM_HF); BigBuf_free(); SetAdcMuxFor(GPIO_MUXSEL_HIPKD); - FpgaSetupSsc(); - + if ( !PowerOn ){ + FpgaSetupSsc(); + } + if ( datalen == 0 && recv == 0 && powerfield == 0){ clear_trace(); } else { @@ -1222,16 +1267,16 @@ void SendRawCommand14443B(uint32_t datalen, uint32_t recv, uint8_t powerfield, u } if(recv) { - GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, TRUE); + GetSamplesFor14443bDemod(RECEIVE_SAMPLES_TIMEOUT, FALSE); uint16_t iLen = MIN(Demod.len, USB_CMD_DATA_SIZE); cmd_send(CMD_ACK, iLen, 0, 0, Demod.output, iLen); } if(!powerfield) { FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + FpgaDisableSscDma(); LED_D_OFF(); + PowerOn = 0; } - - FpgaDisableSscDma(); } diff --git a/armsrc/mifarecmd.c b/armsrc/mifarecmd.c index 102887e4..73fb8a5a 100644 --- a/armsrc/mifarecmd.c +++ b/armsrc/mifarecmd.c @@ -637,8 +637,8 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat // free eventually allocated BigBuf memory BigBuf_free(); - clear_trace(); - set_tracing(false); + if (calibrate) clear_trace(); + set_tracing(true); // statistics on nonce distance int16_t isOK = 0; @@ -815,18 +815,18 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); LEDsoff(); - set_tracing(TRUE); } //----------------------------------------------------------------------------- // MIFARE check keys. key count up to 85. // //----------------------------------------------------------------------------- -void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) +void MifareChkKeys(uint16_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) { // params - uint8_t blockNo = arg0; - uint8_t keyType = arg1; + uint8_t blockNo = arg0 & 0xff; + uint8_t keyType = (arg0 >> 8) & 0xff; + bool clearTrace = arg1; uint8_t keyCount = arg2; uint64_t ui64Key = 0; @@ -848,7 +848,7 @@ void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain) LED_C_OFF(); iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); - clear_trace(); + if (clearTrace) clear_trace(); set_tracing(TRUE); for (i = 0; i < keyCount; i++) { diff --git a/client/cmddata.c b/client/cmddata.c index 4eca030d..f3644304 100644 --- a/client/cmddata.c +++ b/client/cmddata.c @@ -26,8 +26,8 @@ #include "crc16.h" uint8_t DemodBuffer[MAX_DEMOD_BUF_LEN]; -uint8_t g_debugMode; -size_t DemodBufferLen; +uint8_t g_debugMode=0; +size_t DemodBufferLen=0; static int CmdHelp(const char *Cmd); //set the demod buffer with given array of binary (one bit per byte) @@ -503,6 +503,7 @@ int ASKbiphaseDemod(const char *Cmd, bool verbose) uint8_t BitStream[MAX_DEMOD_BUF_LEN]; size_t size = getFromGraphBuf(BitStream); + //invert here inverts the ask raw demoded bits which has no effect on the demod, but we need the pointer int errCnt = askdemod(BitStream, &size, &clk, &invert, maxErr, 0, 0); if ( errCnt < 0 || errCnt > maxErr ) { if (g_debugMode) PrintAndLog("DEBUG: no data or error found %d, clock: %d", errCnt, clk); @@ -1501,9 +1502,9 @@ int CmdFDXBdemodBI(const char *Cmd){ setDemodBuf(BitStream, 128, preambleIndex); - // remove but don't verify parity. (pType = 2) + // remove marker bits (1's every 9th digit after preamble) (pType = 2) size = removeParity(BitStream, preambleIndex + 11, 9, 2, 117); - if ( size <= 103 ) { + if ( size != 104 ) { if (g_debugMode) PrintAndLog("Error removeParity:: %d", size); return 0; } diff --git a/client/cmdhf14b.c b/client/cmdhf14b.c index 71c640fe..d1eb9917 100644 --- a/client/cmdhf14b.c +++ b/client/cmdhf14b.c @@ -104,7 +104,8 @@ int HF14BCmdRaw(bool reply, bool *crc, bool power, uint8_t *data, uint8_t *datal } *datalen = resp.arg[0]; - if ( *datalen < 3 ) return 0; + if (verbose) PrintAndLog("received %u octets", *datalen); + if(*datalen<3) return 0; memcpy(data, resp.d.asBytes, *datalen); @@ -128,16 +129,20 @@ int CmdHF14BCmdRaw (const char *Cmd) { bool reply = true; bool crc = false; bool power = false; + bool select = false; + bool SRx = false; char buf[5]=""; uint8_t data[USB_CMD_DATA_SIZE] = {0x00}; uint8_t datalen = 0; unsigned int temp; int i = 0; if (strlen(Cmd)<3) { - PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] <0A 0B 0C ... hex>"); + PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] [-s || -ss] <0A 0B 0C ... hex>"); PrintAndLog(" -r do not read response"); PrintAndLog(" -c calculate and append CRC"); PrintAndLog(" -p leave the field on after receive"); + PrintAndLog(" -s active signal field ON with select"); + PrintAndLog(" -ss active signal field ON with select for SRx ST Microelectronics tags"); return 0; } @@ -160,6 +165,14 @@ int CmdHF14BCmdRaw (const char *Cmd) { case 'P': power = true; break; + case 's': + case 'S': + select = true; + if (Cmd[i+2]=='s' || Cmd[i+2]=='S') { + SRx = true; + i++; + } + break; default: PrintAndLog("Invalid option"); return 0; @@ -178,11 +191,12 @@ int CmdHF14BCmdRaw (const char *Cmd) { sscanf(buf,"%x",&temp); data[datalen++]=(uint8_t)(temp & 0xff); *buf=0; + memset(buf, 0x00, sizeof(buf)); } continue; } PrintAndLog("Invalid char on input"); - return 1; + return 0; } if (datalen == 0) { @@ -190,12 +204,65 @@ int CmdHF14BCmdRaw (const char *Cmd) { return 0; } + if (select){ //auto select 14b tag + uint8_t cmd2[16]; + bool crc2 = true; + uint8_t cmdLen; + + if (SRx) { + // REQ SRx + cmdLen = 2; + cmd2[0] = 0x06; + cmd2[1] = 0x00; + } else { + // REQB + cmdLen = 3; + cmd2[0] = 0x05; + cmd2[1] = 0x00; + cmd2[2] = 0x08; + } + + // REQB + if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose(); + + PrintAndLog("REQB : %s", sprint_hex(cmd2, 9)); + + if ( SRx && (cmdLen != 3 || !crc2) ) return rawClose(); + else if (cmd2[0] != 0x50 || cmdLen != 14 || !crc2) return rawClose(); + + uint8_t chipID = 0; + if (SRx) { + // select + chipID = cmd2[0]; + cmd2[0] = 0x0E; + cmd2[1] = chipID; + cmdLen = 2; + } else { + // attrib + cmd2[0] = 0x1D; + // UID from cmd2[1 - 4] + cmd2[5] = 0x00; + cmd2[6] = 0x08; + cmd2[7] = 0x01; + cmd2[8] = 0x00; + cmdLen = 9; + } + // wait + + // attrib + if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose(); + PrintAndLog("ATTRIB : %s", sprint_hex(cmd2, 3)); + + if (cmdLen != 3 || !crc2) return rawClose(); + if (SRx && cmd2[0] != chipID) return rawClose(); + + } return HF14BCmdRaw(reply, &crc, power, data, &datalen, true); } // print full atqb info static void print_atqb_resp(uint8_t *data){ - PrintAndLog (" UID: %s", sprint_hex(data+1,4)); + //PrintAndLog (" UID: %s", sprint_hex(data+1,4)); PrintAndLog (" App Data: %s", sprint_hex(data+5,4)); PrintAndLog (" Protocol: %s", sprint_hex(data+9,3)); uint8_t BitRate = data[9]; @@ -216,14 +283,15 @@ static void print_atqb_resp(uint8_t *data){ else if (maxFrame == 8) maxFrame = 256; else maxFrame = 257; - PrintAndLog ("Max Frame Size: %d%s", maxFrame, (maxFrame == 257) ? "+ RFU" : ""); + PrintAndLog ("Max Frame Size: %u%s",maxFrame, (maxFrame == 257) ? "+ RFU" : ""); uint8_t protocolT = data[10] & 0xF; PrintAndLog (" Protocol Type: Protocol is %scompliant with ISO/IEC 14443-4",(protocolT) ? "" : "not " ); - PrintAndLog ("Frame Wait Int: %d", data[11]>>4); + PrintAndLog ("Frame Wait Int: %u", data[11]>>4); PrintAndLog (" App Data Code: Application is %s",(data[11]&4) ? "Standard" : "Proprietary"); PrintAndLog (" Frame Options: NAD is %ssupported",(data[11]&2) ? "" : "not "); PrintAndLog (" Frame Options: CID is %ssupported",(data[11]&1) ? "" : "not "); + PrintAndLog ("Max Buf Length: %u (MBLI) %s",data[14]>>4, (data[14] & 0xF0) ? "" : "not supported"); return; } @@ -247,6 +315,71 @@ char *get_ST_Chip_Model(uint8_t data){ return retStr; } +int print_ST_Lock_info(uint8_t model){ + //assume connection open and tag selected... + uint8_t data[16] = {0x00}; + uint8_t datalen = 2; + bool crc = true; + uint8_t resplen; + uint8_t blk1; + data[0] = 0x08; + + if (model == 0x2) { //SR176 has special command: + data[1] = 0xf; + resplen = 4; + } else { + data[1] = 0xff; + resplen = 6; + } + + //std read cmd + if (HF14BCmdRaw(true, &crc, true, data, &datalen, false)==0) return rawClose(); + + if (datalen != resplen || !crc) return rawClose(); + + PrintAndLog("Chip Write Protection Bits:"); + // now interpret the data + switch (model){ + case 0x0: //fall through (SRIX4K special) + case 0x3: //fall through (SRIx4K) + case 0x7: // (SRI4K) + //only need data[3] + blk1 = 9; + PrintAndLog(" raw: %s",printBits(1,data+3)); + PrintAndLog(" 07/08:%slocked", (data[3] & 1) ? " not " : " " ); + for (uint8_t i = 1; i<8; i++){ + PrintAndLog(" %02u:%slocked", blk1, (data[3] & (1 << i)) ? " not " : " " ); + blk1++; + } + break; + case 0x4: //fall through (SRIX512) + case 0x6: //fall through (SRI512) + case 0xC: // (SRT512) + //need data[2] and data[3] + blk1 = 0; + PrintAndLog(" raw: %s",printBits(2,data+2)); + for (uint8_t b=2; b<4; b++){ + for (uint8_t i=0; i<8; i++){ + PrintAndLog(" %02u:%slocked", blk1, (data[b] & (1 << i)) ? " not " : " " ); + blk1++; + } + } + break; + case 0x2: // (SR176) + //need data[2] + blk1 = 0; + PrintAndLog(" raw: %s",printBits(1,data+2)); + for (uint8_t i = 0; i<8; i++){ + PrintAndLog(" %02u/%02u:%slocked", blk1, blk1+1, (data[2] & (1 << i)) ? " " : " not " ); + blk1+=2; + } + break; + default: + return rawClose(); + } + return 1; +} + // print UID info from SRx chips (ST Microelectronics) static void print_st_general_info(uint8_t *data){ //uid = first 8 bytes in data @@ -259,9 +392,9 @@ static void print_st_general_info(uint8_t *data){ // 14b get and print UID only (general info) int HF14BStdReader(uint8_t *data, uint8_t *datalen){ //05 00 00 = find one tag in field - //1d xx xx xx xx 20 00 08 01 00 = attrib xx=crc - //a3 = ? (resp 03 e2 c2) - //02 = ? (resp 02 6a d3) + //1d xx xx xx xx 00 08 01 00 = attrib xx=UID (resp 10 [f9 e0]) + //a3 = ? (resp 03 [e2 c2]) + //02 = ? (resp 02 [6a d3]) // 022b (resp 02 67 00 [29 5b]) // 0200a40400 (resp 02 67 00 [29 5b]) // 0200a4040c07a0000002480300 (resp 02 67 00 [29 5b]) @@ -274,6 +407,7 @@ int HF14BStdReader(uint8_t *data, uint8_t *datalen){ //03 = ? (resp 03 [e3 c2]) //c2 = ? (resp c2 [66 15]) //b2 = ? (resp a3 [e9 67]) + //a2 = ? (resp 02 [6a d3]) bool crc = true; *datalen = 3; //std read cmd @@ -281,14 +415,36 @@ int HF14BStdReader(uint8_t *data, uint8_t *datalen){ data[1] = 0x00; data[2] = 0x08; - // response, crc, powerfield, data, len, verbose - if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return 0; + if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose(); - if (data[0] != 0x50 || *datalen != 14 || !crc) return 0; + if (data[0] != 0x50 || *datalen != 14 || !crc) return rawClose(); PrintAndLog ("\n14443-3b tag found:"); PrintAndLog (" UID: %s", sprint_hex(data+1,4)); + uint8_t cmd2[16]; + uint8_t cmdLen = 3; + bool crc2 = true; + + cmd2[0] = 0x1D; + // UID from data[1 - 4] + cmd2[1] = data[1]; + cmd2[2] = data[2]; + cmd2[3] = data[3]; + cmd2[4] = data[4]; + cmd2[5] = 0x00; + cmd2[6] = 0x08; + cmd2[7] = 0x01; + cmd2[8] = 0x00; + cmdLen = 9; + + // attrib + if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose(); + + if (cmdLen != 3 || !crc2) return rawClose(); + // add attrib responce to data + data[14] = cmd2[0]; + rawClose(); return 1; } @@ -299,11 +455,12 @@ int HF14BStdInfo(uint8_t *data, uint8_t *datalen){ //add more info here print_atqb_resp(data); + return 1; } // SRx get and print general info about SRx chip from UID -int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen){ +int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen, bool closeCon){ bool crc = true; *datalen = 2; //wake cmd @@ -323,7 +480,6 @@ int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen){ *datalen = 2; //leave power on - // verbose on for now for testing - turn off when functional if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose(); if (*datalen != 3 || !crc || data[0] != chipID) return rawClose(); @@ -332,11 +488,13 @@ int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen){ data[0] = 0x0B; *datalen = 1; - //power off - // verbose on for now for testing - turn off when functional - if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return 0; - rawClose(); - if (*datalen != 10 || !crc) return 0; + //leave power on + if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose(); + + if (*datalen != 10 || !crc) return rawClose(); + + //power off ? + if (closeCon) rawClose(); PrintAndLog("\n14443-3b ST tag found:"); print_st_general_info(data); @@ -345,10 +503,11 @@ int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen){ // SRx get and print full info (needs more info...) int HF14B_ST_Info(uint8_t *data, uint8_t *datalen){ - if (!HF14B_ST_Reader(data, datalen)) return 0; + if (!HF14B_ST_Reader(data, datalen, false)) return 0; //add locking bit information here. - + if (print_ST_Lock_info(data[5]>>2)) + rawClose(); return 1; } @@ -368,6 +527,7 @@ int HF14B_Other_Reader(uint8_t *data, uint8_t *datalen){ PrintAndLog ("\n14443-3b tag found:"); PrintAndLog ("Unknown tag type answered to a 0x000b3f80 command ans:"); PrintAndLog ("%s",sprint_hex(data,*datalen)); + rawClose(); return 1; } } @@ -381,6 +541,7 @@ int HF14B_Other_Reader(uint8_t *data, uint8_t *datalen){ PrintAndLog ("\n14443-3b tag found:"); PrintAndLog ("Unknown tag type answered to a 0x0A command ans:"); PrintAndLog ("%s",sprint_hex(data,*datalen)); + rawClose(); return 1; } } @@ -394,6 +555,7 @@ int HF14B_Other_Reader(uint8_t *data, uint8_t *datalen){ PrintAndLog ("\n14443-3b tag found:"); PrintAndLog ("Unknown tag type answered to a 0x0C command ans:"); PrintAndLog ("%s",sprint_hex(data,*datalen)); + rawClose(); return 1; } } @@ -434,7 +596,7 @@ int HF14BReader(bool verbose){ if (HF14BStdReader(data, &datalen)) return 1; // try st 14b - if (HF14B_ST_Reader(data, &datalen)) return 1; + if (HF14B_ST_Reader(data, &datalen, true)) return 1; // try unknown 14b read commands (to be identified later) // could be read of calypso, CEPAS, moneo, or pico pass. diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c index 58d2061a..83310a54 100644 --- a/client/cmdhfmf.c +++ b/client/cmdhfmf.c @@ -19,7 +19,6 @@ int CmdHF14AMifare(const char *Cmd) uint32_t nt = 0, nr = 0; uint64_t par_list = 0, ks_list = 0, r_key = 0; int16_t isOK = 0; - uint8_t keyBlock[8] = {0}; UsbCommand c = {CMD_READER_MIFARE, {true, 0, 0}}; @@ -75,22 +74,13 @@ start: if (nonce2key(uid, nt, nr, par_list, ks_list, &r_key)) { isOK = 2; PrintAndLog("Key not found (lfsr_common_prefix list is null). Nt=%08x", nt); - } else { - printf("------------------------------------------------------------------\n"); - PrintAndLog("Key found:%012"llx" \n", r_key); - - num_to_bytes(r_key, 6, keyBlock); - isOK = mfCheckKeys(0, 0, 1, keyBlock, &r_key); - } - - if (!isOK) - PrintAndLog("Found valid key:%012"llx, r_key); - else - { - if (isOK != 2) PrintAndLog("Found invalid key. "); PrintAndLog("Failing is expected to happen in 25%% of all cases. Trying again with a different reader nonce..."); c.arg[0] = false; goto start; + } else { + isOK = 0; + printf("------------------------------------------------------------------\n"); + PrintAndLog("Found valid key:%012"llx" \n", r_key); } PrintAndLog(""); @@ -690,7 +680,7 @@ int CmdHF14AMfNested(const char *Cmd) for (j = 0; j < 2; j++) { if (e_sector[i].foundKey[j]) continue; - res = mfCheckKeys(FirstBlockOfSector(i), j, 6, keyBlock, &key64); + res = mfCheckKeys(FirstBlockOfSector(i), j, true, 6, keyBlock, &key64); if (!res) { e_sector[i].Key[j] = key64; @@ -974,7 +964,7 @@ int CmdHF14AMfChk(const char *Cmd) uint32_t max_keys = keycnt>USB_CMD_DATA_SIZE/6?USB_CMD_DATA_SIZE/6:keycnt; for (uint32_t c = 0; c < keycnt; c+=max_keys) { uint32_t size = keycnt-c>max_keys?max_keys:keycnt-c; - res = mfCheckKeys(b, t, size, &keyBlock[6*c], &key64); + res = mfCheckKeys(b, t, true, size, &keyBlock[6*c], &key64); if (res != 1) { if (!res) { PrintAndLog("Found valid key:[%012"llx"]",key64); diff --git a/client/mifarehost.c b/client/mifarehost.c index b18450cf..6acd22f8 100644 --- a/client/mifarehost.c +++ b/client/mifarehost.c @@ -183,7 +183,7 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo crypto1_get_lfsr(statelists[0].head.slhead + i, &key64); num_to_bytes(key64, 6, keyBlock); key64 = 0; - if (!mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, 1, keyBlock, &key64)) { + if (!mfCheckKeys(statelists[0].blockNo, statelists[0].keyType, false, 1, keyBlock, &key64)) { num_to_bytes(key64, 6, resultKey); break; } @@ -195,11 +195,11 @@ int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo return 0; } -int mfCheckKeys (uint8_t blockNo, uint8_t keyType, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key){ +int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key){ *key = 0; - UsbCommand c = {CMD_MIFARE_CHKKEYS, {blockNo, keyType, keycnt}}; + UsbCommand c = {CMD_MIFARE_CHKKEYS, {((blockNo & 0xff) | ((keyType&0xff)<<8)), clear_trace, keycnt}}; memcpy(c.d.asBytes, keyBlock, 6 * keycnt); SendCommand(&c); diff --git a/client/mifarehost.h b/client/mifarehost.h index a11f11d5..f6ffab3f 100644 --- a/client/mifarehost.h +++ b/client/mifarehost.h @@ -50,7 +50,7 @@ typedef struct { extern char logHexFileName[FILE_PATH_SIZE]; int mfnested(uint8_t blockNo, uint8_t keyType, uint8_t * key, uint8_t trgBlockNo, uint8_t trgKeyType, uint8_t * ResultKeys, bool calibrate); -int mfCheckKeys (uint8_t blockNo, uint8_t keyType, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key); +int mfCheckKeys (uint8_t blockNo, uint8_t keyType, bool clear_trace, uint8_t keycnt, uint8_t * keyBlock, uint64_t * key); int mfEmlGetMem(uint8_t *data, int blockNum, int blocksCount); int mfEmlSetMem(uint8_t *data, int blockNum, int blocksCount); diff --git a/client/nonce2key/nonce2key.c b/client/nonce2key/nonce2key.c index 54cb0d2a..5ec95437 100644 --- a/client/nonce2key/nonce2key.c +++ b/client/nonce2key/nonce2key.c @@ -133,7 +133,7 @@ int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_ key64 = *(last_keylist + i); num_to_bytes(key64, 6, keyBlock); key64 = 0; - if (!mfCheckKeys(0, 0, 1, keyBlock, &key64)) { + if (!mfCheckKeys(0, 0, false, 1, keyBlock, &key64)) { *key = key64; free(last_keylist); last_keylist = NULL; -- 2.39.2