]> cvs.zerfleddert.de Git - proxmark3-svn/blame_incremental - armsrc/iclass.c
projects / proxmark3-svn / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
minor change
[proxmark3-svn] / armsrc / iclass.c
... / ...
CommitLineData
1//-----------------------------------------------------------------------------
2// Gerhard de Koning Gans - May 2008
3// Hagen Fritsch - June 2010
4// Gerhard de Koning Gans - May 2011
5// Gerhard de Koning Gans - June 2012 - Added iClass card and reader emulation
6//
7// This code is licensed to you under the terms of the GNU GPL, version 2 or,
8// at your option, any later version. See the LICENSE.txt file for the text of
9// the license.
10//-----------------------------------------------------------------------------
11// Routines to support iClass.
12//-----------------------------------------------------------------------------
13// Based on ISO14443a implementation. Still in experimental phase.
14// Contribution made during a security research at Radboud University Nijmegen
15//
16// Please feel free to contribute and extend iClass support!!
17//-----------------------------------------------------------------------------
18//
19// FIX:
20// ====
21// We still have sometimes a demodulation error when snooping iClass communication.
22// The resulting trace of a read-block-03 command may look something like this:
23//
24// + 22279: : 0c 03 e8 01
25//
26// ...with an incorrect answer...
27//
28// + 85: 0: TAG ff! ff! ff! ff! ff! ff! ff! ff! bb 33 bb 00 01! 0e! 04! bb !crc
29//
30// We still left the error signalling bytes in the traces like 0xbb
31//
32// A correct trace should look like this:
33//
34// + 21112: : 0c 03 e8 01
35// + 85: 0: TAG ff ff ff ff ff ff ff ff ea f5
36//
37//-----------------------------------------------------------------------------
38
39#include "proxmark3.h"
40#include "apps.h"
41#include "util.h"
42#include "string.h"
43#include "common.h"
44#include "cmd.h"
45// Needed for CRC in emulation mode;
46// same construction as in ISO 14443;
47// different initial value (CRC_ICLASS)
48#include "iso14443crc.h"
49#include "iso15693tools.h"
50
51static int timeout = 4096;
52
53
54static int SendIClassAnswer(uint8_t *resp, int respLen, int delay);
55
56//-----------------------------------------------------------------------------
57// The software UART that receives commands from the reader, and its state
58// variables.
59//-----------------------------------------------------------------------------
60static struct {
61 enum {
62 STATE_UNSYNCD,
63 STATE_START_OF_COMMUNICATION,
64 STATE_RECEIVING
65 } state;
66 uint16_t shiftReg;
67 int bitCnt;
68 int byteCnt;
69 int byteCntMax;
70 int posCnt;
71 int nOutOfCnt;
72 int OutOfCnt;
73 int syncBit;
74 int parityBits;
75 int samples;
76 int highCnt;
77 int swapper;
78 int counter;
79 int bitBuffer;
80 int dropPosition;
81 uint8_t *output;
82} Uart;
83
84static RAMFUNC int OutOfNDecoding(int bit)
85{
86 //int error = 0;
87 int bitright;
88
89 if(!Uart.bitBuffer) {
90 Uart.bitBuffer = bit ^ 0xFF0;
91 return FALSE;
92 }
93 else {
94 Uart.bitBuffer <<= 4;
95 Uart.bitBuffer ^= bit;
96 }
97
98 /*if(Uart.swapper) {
99 Uart.output[Uart.byteCnt] = Uart.bitBuffer & 0xFF;
100 Uart.byteCnt++;
101 Uart.swapper = 0;
102 if(Uart.byteCnt > 15) { return TRUE; }
103 }
104 else {
105 Uart.swapper = 1;
106 }*/
107
108 if(Uart.state != STATE_UNSYNCD) {
109 Uart.posCnt++;
110
111 if((Uart.bitBuffer & Uart.syncBit) ^ Uart.syncBit) {
112 bit = 0x00;
113 }
114 else {
115 bit = 0x01;
116 }
117 if(((Uart.bitBuffer << 1) & Uart.syncBit) ^ Uart.syncBit) {
118 bitright = 0x00;
119 }
120 else {
121 bitright = 0x01;
122 }
123 if(bit != bitright) { bit = bitright; }
124
125
126 // So, now we only have to deal with *bit*, lets see...
127 if(Uart.posCnt == 1) {
128 // measurement first half bitperiod
129 if(!bit) {
130 // Drop in first half means that we are either seeing
131 // an SOF or an EOF.
132
133 if(Uart.nOutOfCnt == 1) {
134 // End of Communication
135 Uart.state = STATE_UNSYNCD;
136 Uart.highCnt = 0;
137 if(Uart.byteCnt == 0) {
138 // Its not straightforward to show single EOFs
139 // So just leave it and do not return TRUE
140 Uart.output[Uart.byteCnt] = 0xf0;
141 Uart.byteCnt++;
142
143 // Calculate the parity bit for the client...
144 Uart.parityBits = 1;
145 }
146 else {
147 return TRUE;
148 }
149 }
150 else if(Uart.state != STATE_START_OF_COMMUNICATION) {
151 // When not part of SOF or EOF, it is an error
152 Uart.state = STATE_UNSYNCD;
153 Uart.highCnt = 0;
154 //error = 4;
155 }
156 }
157 }
158 else {
159 // measurement second half bitperiod
160 // Count the bitslot we are in... (ISO 15693)
161 Uart.nOutOfCnt++;
162
163 if(!bit) {
164 if(Uart.dropPosition) {
165 if(Uart.state == STATE_START_OF_COMMUNICATION) {
166 //error = 1;
167 }
168 else {
169 //error = 7;
170 }
171 // It is an error if we already have seen a drop in current frame
172 Uart.state = STATE_UNSYNCD;
173 Uart.highCnt = 0;
174 }
175 else {
176 Uart.dropPosition = Uart.nOutOfCnt;
177 }
178 }
179
180 Uart.posCnt = 0;
181
182
183 if(Uart.nOutOfCnt == Uart.OutOfCnt && Uart.OutOfCnt == 4) {
184 Uart.nOutOfCnt = 0;
185
186 if(Uart.state == STATE_START_OF_COMMUNICATION) {
187 if(Uart.dropPosition == 4) {
188 Uart.state = STATE_RECEIVING;
189 Uart.OutOfCnt = 256;
190 }
191 else if(Uart.dropPosition == 3) {
192 Uart.state = STATE_RECEIVING;
193 Uart.OutOfCnt = 4;
194 //Uart.output[Uart.byteCnt] = 0xdd;
195 //Uart.byteCnt++;
196 }
197 else {
198 Uart.state = STATE_UNSYNCD;
199 Uart.highCnt = 0;
200 }
201 Uart.dropPosition = 0;
202 }
203 else {
204 // RECEIVING DATA
205 // 1 out of 4
206 if(!Uart.dropPosition) {
207 Uart.state = STATE_UNSYNCD;
208 Uart.highCnt = 0;
209 //error = 9;
210 }
211 else {
212 Uart.shiftReg >>= 2;
213
214 // Swap bit order
215 Uart.dropPosition--;
216 //if(Uart.dropPosition == 1) { Uart.dropPosition = 2; }
217 //else if(Uart.dropPosition == 2) { Uart.dropPosition = 1; }
218
219 Uart.shiftReg ^= ((Uart.dropPosition & 0x03) << 6);
220 Uart.bitCnt += 2;
221 Uart.dropPosition = 0;
222
223 if(Uart.bitCnt == 8) {
224 Uart.output[Uart.byteCnt] = (Uart.shiftReg & 0xff);
225 Uart.byteCnt++;
226
227 // Calculate the parity bit for the client...
228 Uart.parityBits <<= 1;
229 Uart.parityBits ^= OddByteParity[(Uart.shiftReg & 0xff)];
230
231 Uart.bitCnt = 0;
232 Uart.shiftReg = 0;
233 }
234 }
235 }
236 }
237 else if(Uart.nOutOfCnt == Uart.OutOfCnt) {
238 // RECEIVING DATA
239 // 1 out of 256
240 if(!Uart.dropPosition) {
241 Uart.state = STATE_UNSYNCD;
242 Uart.highCnt = 0;
243 //error = 3;
244 }
245 else {
246 Uart.dropPosition--;
247 Uart.output[Uart.byteCnt] = (Uart.dropPosition & 0xff);
248 Uart.byteCnt++;
249
250 // Calculate the parity bit for the client...
251 Uart.parityBits <<= 1;
252 Uart.parityBits ^= OddByteParity[(Uart.dropPosition & 0xff)];
253
254 Uart.bitCnt = 0;
255 Uart.shiftReg = 0;
256 Uart.nOutOfCnt = 0;
257 Uart.dropPosition = 0;
258 }
259 }
260
261 /*if(error) {
262 Uart.output[Uart.byteCnt] = 0xAA;
263 Uart.byteCnt++;
264 Uart.output[Uart.byteCnt] = error & 0xFF;
265 Uart.byteCnt++;
266 Uart.output[Uart.byteCnt] = 0xAA;
267 Uart.byteCnt++;
268 Uart.output[Uart.byteCnt] = (Uart.bitBuffer >> 8) & 0xFF;
269 Uart.byteCnt++;
270 Uart.output[Uart.byteCnt] = Uart.bitBuffer & 0xFF;
271 Uart.byteCnt++;
272 Uart.output[Uart.byteCnt] = (Uart.syncBit >> 3) & 0xFF;
273 Uart.byteCnt++;
274 Uart.output[Uart.byteCnt] = 0xAA;
275 Uart.byteCnt++;
276 return TRUE;
277 }*/
278 }
279
280 }
281 else {
282 bit = Uart.bitBuffer & 0xf0;
283 bit >>= 4;
284 bit ^= 0x0F; // drops become 1s ;-)
285 if(bit) {
286 // should have been high or at least (4 * 128) / fc
287 // according to ISO this should be at least (9 * 128 + 20) / fc
288 if(Uart.highCnt == 8) {
289 // we went low, so this could be start of communication
290 // it turns out to be safer to choose a less significant
291 // syncbit... so we check whether the neighbour also represents the drop
292 Uart.posCnt = 1; // apparently we are busy with our first half bit period
293 Uart.syncBit = bit & 8;
294 Uart.samples = 3;
295 if(!Uart.syncBit) { Uart.syncBit = bit & 4; Uart.samples = 2; }
296 else if(bit & 4) { Uart.syncBit = bit & 4; Uart.samples = 2; bit <<= 2; }
297 if(!Uart.syncBit) { Uart.syncBit = bit & 2; Uart.samples = 1; }
298 else if(bit & 2) { Uart.syncBit = bit & 2; Uart.samples = 1; bit <<= 1; }
299 if(!Uart.syncBit) { Uart.syncBit = bit & 1; Uart.samples = 0;
300 if(Uart.syncBit && (Uart.bitBuffer & 8)) {
301 Uart.syncBit = 8;
302
303 // the first half bit period is expected in next sample
304 Uart.posCnt = 0;
305 Uart.samples = 3;
306 }
307 }
308 else if(bit & 1) { Uart.syncBit = bit & 1; Uart.samples = 0; }
309
310 Uart.syncBit <<= 4;
311 Uart.state = STATE_START_OF_COMMUNICATION;
312 Uart.bitCnt = 0;
313 Uart.byteCnt = 0;
314 Uart.parityBits = 0;
315 Uart.nOutOfCnt = 0;
316 Uart.OutOfCnt = 4; // Start at 1/4, could switch to 1/256
317 Uart.dropPosition = 0;
318 Uart.shiftReg = 0;
319 //error = 0;
320 }
321 else {
322 Uart.highCnt = 0;
323 }
324 }
325 else {
326 if(Uart.highCnt < 8) {
327 Uart.highCnt++;
328 }
329 }
330 }
331
332 return FALSE;
333}
334
335//=============================================================================
336// Manchester
337//=============================================================================
338
339static struct {
340 enum {
341 DEMOD_UNSYNCD,
342 DEMOD_START_OF_COMMUNICATION,
343 DEMOD_START_OF_COMMUNICATION2,
344 DEMOD_START_OF_COMMUNICATION3,
345 DEMOD_SOF_COMPLETE,
346 DEMOD_MANCHESTER_D,
347 DEMOD_MANCHESTER_E,
348 DEMOD_END_OF_COMMUNICATION,
349 DEMOD_END_OF_COMMUNICATION2,
350 DEMOD_MANCHESTER_F,
351 DEMOD_ERROR_WAIT
352 } state;
353 int bitCount;
354 int posCount;
355 int syncBit;
356 int parityBits;
357 uint16_t shiftReg;
358 int buffer;
359 int buffer2;
360 int buffer3;
361 int buff;
362 int samples;
363 int len;
364 enum {
365 SUB_NONE,
366 SUB_FIRST_HALF,
367 SUB_SECOND_HALF,
368 SUB_BOTH
369 } sub;
370 uint8_t *output;
371} Demod;
372
373static RAMFUNC int ManchesterDecoding(int v)
374{
375 int bit;
376 int modulation;
377 int error = 0;
378
379 bit = Demod.buffer;
380 Demod.buffer = Demod.buffer2;
381 Demod.buffer2 = Demod.buffer3;
382 Demod.buffer3 = v;
383
384 if(Demod.buff < 3) {
385 Demod.buff++;
386 return FALSE;
387 }
388
389 if(Demod.state==DEMOD_UNSYNCD) {
390 Demod.output[Demod.len] = 0xfa;
391 Demod.syncBit = 0;
392 //Demod.samples = 0;
393 Demod.posCount = 1; // This is the first half bit period, so after syncing handle the second part
394
395 if(bit & 0x08) {
396 Demod.syncBit = 0x08;
397 }
398
399 if(bit & 0x04) {
400 if(Demod.syncBit) {
401 bit <<= 4;
402 }
403 Demod.syncBit = 0x04;
404 }
405
406 if(bit & 0x02) {
407 if(Demod.syncBit) {
408 bit <<= 2;
409 }
410 Demod.syncBit = 0x02;
411 }
412
413 if(bit & 0x01 && Demod.syncBit) {
414 Demod.syncBit = 0x01;
415 }
416
417 if(Demod.syncBit) {
418 Demod.len = 0;
419 Demod.state = DEMOD_START_OF_COMMUNICATION;
420 Demod.sub = SUB_FIRST_HALF;
421 Demod.bitCount = 0;
422 Demod.shiftReg = 0;
423 Demod.parityBits = 0;
424 Demod.samples = 0;
425 if(Demod.posCount) {
426 //if(trigger) LED_A_OFF(); // Not useful in this case...
427 switch(Demod.syncBit) {
428 case 0x08: Demod.samples = 3; break;
429 case 0x04: Demod.samples = 2; break;
430 case 0x02: Demod.samples = 1; break;
431 case 0x01: Demod.samples = 0; break;
432 }
433 // SOF must be long burst... otherwise stay unsynced!!!
434 if(!(Demod.buffer & Demod.syncBit) || !(Demod.buffer2 & Demod.syncBit)) {
435 Demod.state = DEMOD_UNSYNCD;
436 }
437 }
438 else {
439 // SOF must be long burst... otherwise stay unsynced!!!
440 if(!(Demod.buffer2 & Demod.syncBit) || !(Demod.buffer3 & Demod.syncBit)) {
441 Demod.state = DEMOD_UNSYNCD;
442 error = 0x88;
443 }
444
445 }
446 error = 0;
447
448 }
449 }
450 else {
451 modulation = bit & Demod.syncBit;
452 modulation |= ((bit << 1) ^ ((Demod.buffer & 0x08) >> 3)) & Demod.syncBit;
453 //modulation = ((bit << 1) ^ ((Demod.buffer & 0x08) >> 3)) & Demod.syncBit;
454
455 Demod.samples += 4;
456
457 if(Demod.posCount==0) {
458 Demod.posCount = 1;
459 if(modulation) {
460 Demod.sub = SUB_FIRST_HALF;
461 }
462 else {
463 Demod.sub = SUB_NONE;
464 }
465 }
466 else {
467 Demod.posCount = 0;
468 /*(modulation && (Demod.sub == SUB_FIRST_HALF)) {
469 if(Demod.state!=DEMOD_ERROR_WAIT) {
470 Demod.state = DEMOD_ERROR_WAIT;
471 Demod.output[Demod.len] = 0xaa;
472 error = 0x01;
473 }
474 }*/
475 //else if(modulation) {
476 if(modulation) {
477 if(Demod.sub == SUB_FIRST_HALF) {
478 Demod.sub = SUB_BOTH;
479 }
480 else {
481 Demod.sub = SUB_SECOND_HALF;
482 }
483 }
484 else if(Demod.sub == SUB_NONE) {
485 if(Demod.state == DEMOD_SOF_COMPLETE) {
486 Demod.output[Demod.len] = 0x0f;
487 Demod.len++;
488 Demod.parityBits <<= 1;
489 Demod.parityBits ^= OddByteParity[0x0f];
490 Demod.state = DEMOD_UNSYNCD;
491// error = 0x0f;
492 return TRUE;
493 }
494 else {
495 Demod.state = DEMOD_ERROR_WAIT;
496 error = 0x33;
497 }
498 /*if(Demod.state!=DEMOD_ERROR_WAIT) {
499 Demod.state = DEMOD_ERROR_WAIT;
500 Demod.output[Demod.len] = 0xaa;
501 error = 0x01;
502 }*/
503 }
504
505 switch(Demod.state) {
506 case DEMOD_START_OF_COMMUNICATION:
507 if(Demod.sub == SUB_BOTH) {
508 //Demod.state = DEMOD_MANCHESTER_D;
509 Demod.state = DEMOD_START_OF_COMMUNICATION2;
510 Demod.posCount = 1;
511 Demod.sub = SUB_NONE;
512 }
513 else {
514 Demod.output[Demod.len] = 0xab;
515 Demod.state = DEMOD_ERROR_WAIT;
516 error = 0xd2;
517 }
518 break;
519 case DEMOD_START_OF_COMMUNICATION2:
520 if(Demod.sub == SUB_SECOND_HALF) {
521 Demod.state = DEMOD_START_OF_COMMUNICATION3;
522 }
523 else {
524 Demod.output[Demod.len] = 0xab;
525 Demod.state = DEMOD_ERROR_WAIT;
526 error = 0xd3;
527 }
528 break;
529 case DEMOD_START_OF_COMMUNICATION3:
530 if(Demod.sub == SUB_SECOND_HALF) {
531// Demod.state = DEMOD_MANCHESTER_D;
532 Demod.state = DEMOD_SOF_COMPLETE;
533 //Demod.output[Demod.len] = Demod.syncBit & 0xFF;
534 //Demod.len++;
535 }
536 else {
537 Demod.output[Demod.len] = 0xab;
538 Demod.state = DEMOD_ERROR_WAIT;
539 error = 0xd4;
540 }
541 break;
542 case DEMOD_SOF_COMPLETE:
543 case DEMOD_MANCHESTER_D:
544 case DEMOD_MANCHESTER_E:
545 // OPPOSITE FROM ISO14443 - 11110000 = 0 (1 in 14443)
546 // 00001111 = 1 (0 in 14443)
547 if(Demod.sub == SUB_SECOND_HALF) { // SUB_FIRST_HALF
548 Demod.bitCount++;
549 Demod.shiftReg = (Demod.shiftReg >> 1) ^ 0x100;
550 Demod.state = DEMOD_MANCHESTER_D;
551 }
552 else if(Demod.sub == SUB_FIRST_HALF) { // SUB_SECOND_HALF
553 Demod.bitCount++;
554 Demod.shiftReg >>= 1;
555 Demod.state = DEMOD_MANCHESTER_E;
556 }
557 else if(Demod.sub == SUB_BOTH) {
558 Demod.state = DEMOD_MANCHESTER_F;
559 }
560 else {
561 Demod.state = DEMOD_ERROR_WAIT;
562 error = 0x55;
563 }
564 break;
565
566 case DEMOD_MANCHESTER_F:
567 // Tag response does not need to be a complete byte!
568 if(Demod.len > 0 || Demod.bitCount > 0) {
569 if(Demod.bitCount > 1) { // was > 0, do not interpret last closing bit, is part of EOF
570 Demod.shiftReg >>= (9 - Demod.bitCount);
571 Demod.output[Demod.len] = Demod.shiftReg & 0xff;
572 Demod.len++;
573 // No parity bit, so just shift a 0
574 Demod.parityBits <<= 1;
575 }
576
577 Demod.state = DEMOD_UNSYNCD;
578 return TRUE;
579 }
580 else {
581 Demod.output[Demod.len] = 0xad;
582 Demod.state = DEMOD_ERROR_WAIT;
583 error = 0x03;
584 }
585 break;
586
587 case DEMOD_ERROR_WAIT:
588 Demod.state = DEMOD_UNSYNCD;
589 break;
590
591 default:
592 Demod.output[Demod.len] = 0xdd;
593 Demod.state = DEMOD_UNSYNCD;
594 break;
595 }
596
597 /*if(Demod.bitCount>=9) {
598 Demod.output[Demod.len] = Demod.shiftReg & 0xff;
599 Demod.len++;
600
601 Demod.parityBits <<= 1;
602 Demod.parityBits ^= ((Demod.shiftReg >> 8) & 0x01);
603
604 Demod.bitCount = 0;
605 Demod.shiftReg = 0;
606 }*/
607 if(Demod.bitCount>=8) {
608 Demod.shiftReg >>= 1;
609 Demod.output[Demod.len] = (Demod.shiftReg & 0xff);
610 Demod.len++;
611
612 // FOR ISO15639 PARITY NOT SEND OTA, JUST CALCULATE IT FOR THE CLIENT
613 Demod.parityBits <<= 1;
614 Demod.parityBits ^= OddByteParity[(Demod.shiftReg & 0xff)];
615
616 Demod.bitCount = 0;
617 Demod.shiftReg = 0;
618 }
619
620 if(error) {
621 Demod.output[Demod.len] = 0xBB;
622 Demod.len++;
623 Demod.output[Demod.len] = error & 0xFF;
624 Demod.len++;
625 Demod.output[Demod.len] = 0xBB;
626 Demod.len++;
627 Demod.output[Demod.len] = bit & 0xFF;
628 Demod.len++;
629 Demod.output[Demod.len] = Demod.buffer & 0xFF;
630 Demod.len++;
631 // Look harder ;-)
632 Demod.output[Demod.len] = Demod.buffer2 & 0xFF;
633 Demod.len++;
634 Demod.output[Demod.len] = Demod.syncBit & 0xFF;
635 Demod.len++;
636 Demod.output[Demod.len] = 0xBB;
637 Demod.len++;
638 return TRUE;
639 }
640
641 }
642
643 } // end (state != UNSYNCED)
644
645 return FALSE;
646}
647
648//=============================================================================
649// Finally, a `sniffer' for iClass communication
650// Both sides of communication!
651//=============================================================================
652
653//-----------------------------------------------------------------------------
654// Record the sequence of commands sent by the reader to the tag, with
655// triggering so that we start recording at the point that the tag is moved
656// near the reader.
657//-----------------------------------------------------------------------------
658void RAMFUNC SnoopIClass(void)
659{
660
661
662 // We won't start recording the frames that we acquire until we trigger;
663 // a good trigger condition to get started is probably when we see a
664 // response from the tag.
665 //int triggered = FALSE; // FALSE to wait first for card
666
667 // The command (reader -> tag) that we're receiving.
668 // The length of a received command will in most cases be no more than 18 bytes.
669 // So 32 should be enough!
670 uint8_t *readerToTagCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
671 // The response (tag -> reader) that we're receiving.
672 uint8_t *tagToReaderResponse = (((uint8_t *)BigBuf) + RECV_RES_OFFSET);
673
674 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
675
676 // reset traceLen to 0
677 iso14a_set_tracing(TRUE);
678 iso14a_clear_trace();
679 iso14a_set_trigger(FALSE);
680
681 // The DMA buffer, used to stream samples from the FPGA
682 int8_t *dmaBuf = ((int8_t *)BigBuf) + DMA_BUFFER_OFFSET;
683 int lastRxCounter;
684 int8_t *upTo;
685 int smpl;
686 int maxBehindBy = 0;
687
688 // Count of samples received so far, so that we can include timing
689 // information in the trace buffer.
690 int samples = 0;
691 rsamples = 0;
692
693 // Set up the demodulator for tag -> reader responses.
694 Demod.output = tagToReaderResponse;
695 Demod.len = 0;
696 Demod.state = DEMOD_UNSYNCD;
697
698 // Setup for the DMA.
699 FpgaSetupSsc();
700 upTo = dmaBuf;
701 lastRxCounter = DMA_BUFFER_SIZE;
702 FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
703
704 // And the reader -> tag commands
705 memset(&Uart, 0, sizeof(Uart));
706 Uart.output = readerToTagCmd;
707 Uart.byteCntMax = 32; // was 100 (greg)////////////////////////////////////////////////////////////////////////
708 Uart.state = STATE_UNSYNCD;
709
710 // And put the FPGA in the appropriate mode
711 // Signal field is off with the appropriate LED
712 LED_D_OFF();
713 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_SNIFFER);
714 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
715
716 uint32_t time_0 = GetCountSspClk();
717
718
719 int div = 0;
720 //int div2 = 0;
721 int decbyte = 0;
722 int decbyter = 0;
723
724 // And now we loop, receiving samples.
725 for(;;) {
726 LED_A_ON();
727 WDT_HIT();
728 int behindBy = (lastRxCounter - AT91C_BASE_PDC_SSC->PDC_RCR) &
729 (DMA_BUFFER_SIZE-1);
730 if(behindBy > maxBehindBy) {
731 maxBehindBy = behindBy;
732 if(behindBy > 400) {
733 Dbprintf("blew circular buffer! behindBy=0x%x", behindBy);
734 goto done;
735 }
736 }
737 if(behindBy < 1) continue;
738
739 LED_A_OFF();
740 smpl = upTo[0];
741 upTo++;
742 lastRxCounter -= 1;
743 if(upTo - dmaBuf > DMA_BUFFER_SIZE) {
744 upTo -= DMA_BUFFER_SIZE;
745 lastRxCounter += DMA_BUFFER_SIZE;
746 AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t) upTo;
747 AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
748 }
749
750 //samples += 4;
751 samples += 1;
752
753 if(smpl & 0xF) {
754 decbyte ^= (1 << (3 - div));
755 }
756
757 // FOR READER SIDE COMMUMICATION...
758
759 decbyter <<= 2;
760 decbyter ^= (smpl & 0x30);
761
762 div++;
763
764 if((div + 1) % 2 == 0) {
765 smpl = decbyter;
766 if(OutOfNDecoding((smpl & 0xF0) >> 4)) {
767 rsamples = samples - Uart.samples;
768 LED_C_ON();
769
770 //if(!LogTrace(Uart.output,Uart.byteCnt, rsamples, Uart.parityBits,TRUE)) break;
771 //if(!LogTrace(NULL, 0, Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER, 0, TRUE)) break;
772 if(tracing)
773 {
774 LogTrace(Uart.output,Uart.byteCnt, (GetCountSspClk()-time_0) << 4, Uart.parityBits,TRUE);
775 LogTrace(NULL, 0, (GetCountSspClk()-time_0) << 4, 0, TRUE);
776 }
777
778
779 /* And ready to receive another command. */
780 Uart.state = STATE_UNSYNCD;
781 /* And also reset the demod code, which might have been */
782 /* false-triggered by the commands from the reader. */
783 Demod.state = DEMOD_UNSYNCD;
784 LED_B_OFF();
785 Uart.byteCnt = 0;
786 }
787 decbyter = 0;
788 }
789
790 if(div > 3) {
791 smpl = decbyte;
792 if(ManchesterDecoding(smpl & 0x0F)) {
793 rsamples = samples - Demod.samples;
794 LED_B_ON();
795
796 if(tracing)
797 {
798 LogTrace(Demod.output,Demod.len, (GetCountSspClk()-time_0) << 4 , Demod.parityBits,FALSE);
799 LogTrace(NULL, 0, (GetCountSspClk()-time_0) << 4, 0, FALSE);
800 }
801
802
803 // And ready to receive another response.
804 memset(&Demod, 0, sizeof(Demod));
805 Demod.output = tagToReaderResponse;
806 Demod.state = DEMOD_UNSYNCD;
807 LED_C_OFF();
808 }
809
810 div = 0;
811 decbyte = 0x00;
812 }
813 //}
814
815 if(BUTTON_PRESS()) {
816 DbpString("cancelled_a");
817 goto done;
818 }
819 }
820
821 DbpString("COMMAND FINISHED");
822
823 Dbprintf("%x %x %x", maxBehindBy, Uart.state, Uart.byteCnt);
824 Dbprintf("%x %x %x", Uart.byteCntMax, traceLen, (int)Uart.output[0]);
825
826done:
827 AT91C_BASE_PDC_SSC->PDC_PTCR = AT91C_PDC_RXTDIS;
828 Dbprintf("%x %x %x", maxBehindBy, Uart.state, Uart.byteCnt);
829 Dbprintf("%x %x %x", Uart.byteCntMax, traceLen, (int)Uart.output[0]);
830 LED_A_OFF();
831 LED_B_OFF();
832 LED_C_OFF();
833 LED_D_OFF();
834}
835
836void rotateCSN(uint8_t* originalCSN, uint8_t* rotatedCSN) {
837 int i;
838 for(i = 0; i < 8; i++) {
839 rotatedCSN[i] = (originalCSN[i] >> 3) | (originalCSN[(i+1)%8] << 5);
840 }
841}
842
843//-----------------------------------------------------------------------------
844// Wait for commands from reader
845// Stop when button is pressed
846// Or return TRUE when command is captured
847//-----------------------------------------------------------------------------
848static int GetIClassCommandFromReader(uint8_t *received, int *len, int maxLen)
849{
850 // Set FPGA mode to "simulated ISO 14443 tag", no modulation (listen
851 // only, since we are receiving, not transmitting).
852 // Signal field is off with the appropriate LED
853 LED_D_OFF();
854 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
855
856 // Now run a `software UART' on the stream of incoming samples.
857 Uart.output = received;
858 Uart.byteCntMax = maxLen;
859 Uart.state = STATE_UNSYNCD;
860
861 for(;;) {
862 WDT_HIT();
863
864 if(BUTTON_PRESS()) return FALSE;
865
866 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
867 AT91C_BASE_SSC->SSC_THR = 0x00;
868 }
869 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
870 uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
871 /*if(OutOfNDecoding((b & 0xf0) >> 4)) {
872 *len = Uart.byteCnt;
873 return TRUE;
874 }*/
875 if(OutOfNDecoding(b & 0x0f)) {
876 *len = Uart.byteCnt;
877 return TRUE;
878 }
879 }
880 }
881}
882
883
884//-----------------------------------------------------------------------------
885// Prepare tag messages
886//-----------------------------------------------------------------------------
887static void CodeIClassTagAnswer(const uint8_t *cmd, int len)
888{
889 //So far a dummy implementation, not used
890 //int lastProxToAirDuration =0;
891 int i;
892
893 ToSendReset();
894
895 // Send SOF
896 ToSend[++ToSendMax] = 0x00;
897 ToSend[++ToSendMax] = 0x00;
898 ToSend[++ToSendMax] = 0x00;
899 ToSend[++ToSendMax] = 0xff;//Proxtoair duration starts here
900 ToSend[++ToSendMax] = 0xff;
901 ToSend[++ToSendMax] = 0xff;
902 ToSend[++ToSendMax] = 0x00;
903 ToSend[++ToSendMax] = 0xff;
904
905 for(i = 0; i < len; i++) {
906 int j;
907 uint8_t b = cmd[i];
908
909 // Data bits
910 for(j = 0; j < 8; j++) {
911 if(b & 1) {
912 ToSend[++ToSendMax] = 0x00;
913 ToSend[++ToSendMax] = 0xff;
914 } else {
915 ToSend[++ToSendMax] = 0xff;
916 ToSend[++ToSendMax] = 0x00;
917 }
918 b >>= 1;
919 }
920 }
921
922 // Send EOF
923 ToSend[++ToSendMax] = 0xff;
924 ToSend[++ToSendMax] = 0x00;
925 ToSend[++ToSendMax] = 0xff;
926 ToSend[++ToSendMax] = 0xff;
927 ToSend[++ToSendMax] = 0xff;
928 ToSend[++ToSendMax] = 0x00;
929 ToSend[++ToSendMax] = 0x00;
930 ToSend[++ToSendMax] = 0x00;
931
932 //lastProxToAirDuration = 8*ToSendMax - 3*8 - 3*8;//Not counting zeroes in the beginning or end
933
934 // Convert from last byte pos to length
935 ToSendMax++;
936}
937
938// Only SOF
939static void CodeIClassTagSOF()
940{
941 //So far a dummy implementation, not used
942 //int lastProxToAirDuration =0;
943
944 ToSendReset();
945 // Send SOF
946 ToSend[++ToSendMax] = 0x00;
947 ToSend[++ToSendMax] = 0x00;
948 ToSend[++ToSendMax] = 0x00;
949 ToSend[++ToSendMax] = 0xff;
950 ToSend[++ToSendMax] = 0xff;
951 ToSend[++ToSendMax] = 0xff;
952 ToSend[++ToSendMax] = 0x00;
953 ToSend[++ToSendMax] = 0xff;
954
955// lastProxToAirDuration = 8*ToSendMax - 3*8;//Not counting zeroes in the beginning
956
957
958 // Convert from last byte pos to length
959 ToSendMax++;
960}
961int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived, uint8_t *reader_mac_buf);
962/**
963 * @brief SimulateIClass simulates an iClass card.
964 * @param arg0 type of simulation
965 * - 0 uses the first 8 bytes in usb data as CSN
966 * - 2 "dismantling iclass"-attack. This mode iterates through all CSN's specified
967 * in the usb data. This mode collects MAC from the reader, in order to do an offline
968 * attack on the keys. For more info, see "dismantling iclass" and proxclone.com.
969 * - Other : Uses the default CSN (031fec8af7ff12e0)
970 * @param arg1 - number of CSN's contained in datain (applicable for mode 2 only)
971 * @param arg2
972 * @param datain
973 */
974void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain)
975{
976 uint32_t simType = arg0;
977 uint32_t numberOfCSNS = arg1;
978 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
979
980 // Enable and clear the trace
981 iso14a_set_tracing(TRUE);
982 iso14a_clear_trace();
983
984 uint8_t csn_crc[] = { 0x03, 0x1f, 0xec, 0x8a, 0xf7, 0xff, 0x12, 0xe0, 0x00, 0x00 };
985 if(simType == 0) {
986 // Use the CSN from commandline
987 memcpy(csn_crc, datain, 8);
988 doIClassSimulation(csn_crc,0,NULL);
989 }else if(simType == 1)
990 {
991 doIClassSimulation(csn_crc,0,NULL);
992 }
993 else if(simType == 2)
994 {
995
996 uint8_t mac_responses[64] = { 0 };
997 Dbprintf("Going into attack mode, %d CSNS sent", numberOfCSNS);
998 // In this mode, a number of csns are within datain. We'll simulate each one, one at a time
999 // in order to collect MAC's from the reader. This can later be used in an offlne-attack
1000 // in order to obtain the keys, as in the "dismantling iclass"-paper.
1001 int i = 0;
1002 for( ; i < numberOfCSNS && i*8+8 < USB_CMD_DATA_SIZE; i++)
1003 {
1004 // The usb data is 512 bytes, fitting 65 8-byte CSNs in there.
1005
1006 memcpy(csn_crc, datain+(i*8), 8);
1007 if(doIClassSimulation(csn_crc,1,mac_responses+i*8))
1008 {
1009 return; // Button pressed
1010 }
1011 }
1012 cmd_send(CMD_ACK,CMD_SIMULATE_TAG_ICLASS,i,0,mac_responses,i*8);
1013
1014 }
1015 else{
1016 // We may want a mode here where we hardcode the csns to use (from proxclone).
1017 // That will speed things up a little, but not required just yet.
1018 Dbprintf("The mode is not implemented, reserved for future use");
1019 }
1020 Dbprintf("Done...");
1021
1022}
1023/**
1024 * @brief Does the actual simulation
1025 * @param csn - csn to use
1026 * @param breakAfterMacReceived if true, returns after reader MAC has been received.
1027 */
1028int doIClassSimulation(uint8_t csn[], int breakAfterMacReceived, uint8_t *reader_mac_buf)
1029{
1030
1031
1032 // CSN followed by two CRC bytes
1033 uint8_t response2[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1034 uint8_t response3[] = { 0,0,0,0,0,0,0,0,0,0};
1035 memcpy(response3,csn,sizeof(response3));
1036 Dbprintf("Simulating CSN %02x%02x%02x%02x%02x%02x%02x%02x",csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
1037 // e-Purse
1038 uint8_t response4[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1039
1040 // Construct anticollision-CSN
1041 rotateCSN(response3,response2);
1042
1043 // Compute CRC on both CSNs
1044 ComputeCrc14443(CRC_ICLASS, response2, 8, &response2[8], &response2[9]);
1045 ComputeCrc14443(CRC_ICLASS, response3, 8, &response3[8], &response3[9]);
1046
1047 int exitLoop = 0;
1048 // Reader 0a
1049 // Tag 0f
1050 // Reader 0c
1051 // Tag anticoll. CSN
1052 // Reader 81 anticoll. CSN
1053 // Tag CSN
1054
1055 uint8_t *resp;
1056 int respLen;
1057 uint8_t* respdata = NULL;
1058 int respsize = 0;
1059 uint8_t sof = 0x0f;
1060
1061 // Respond SOF -- takes 8 bytes
1062 uint8_t *resp1 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
1063 int resp1Len;
1064
1065 // Anticollision CSN (rotated CSN)
1066 // 176: Takes 16 bytes for SOF/EOF and 10 * 16 = 160 bytes (2 bytes/bit)
1067 uint8_t *resp2 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + 10);
1068 int resp2Len;
1069
1070 // CSN
1071 // 176: Takes 16 bytes for SOF/EOF and 10 * 16 = 160 bytes (2 bytes/bit)
1072 uint8_t *resp3 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + 190);
1073 int resp3Len;
1074
1075 // e-Purse
1076 // 144: Takes 16 bytes for SOF/EOF and 8 * 16 = 128 bytes (2 bytes/bit)
1077 uint8_t *resp4 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + 370);
1078 int resp4Len;
1079
1080 // + 1720..
1081 uint8_t *receivedCmd = (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
1082 memset(receivedCmd, 0x44, RECV_CMD_SIZE);
1083 int len;
1084
1085 // Prepare card messages
1086 ToSendMax = 0;
1087
1088 // First card answer: SOF
1089 CodeIClassTagSOF();
1090 memcpy(resp1, ToSend, ToSendMax); resp1Len = ToSendMax;
1091
1092 // Anticollision CSN
1093 CodeIClassTagAnswer(response2, sizeof(response2));
1094 memcpy(resp2, ToSend, ToSendMax); resp2Len = ToSendMax;
1095
1096 // CSN
1097 CodeIClassTagAnswer(response3, sizeof(response3));
1098 memcpy(resp3, ToSend, ToSendMax); resp3Len = ToSendMax;
1099
1100 // e-Purse
1101 CodeIClassTagAnswer(response4, sizeof(response4));
1102 memcpy(resp4, ToSend, ToSendMax); resp4Len = ToSendMax;
1103
1104
1105 // Start from off (no field generated)
1106 //FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1107 //SpinDelay(200);
1108 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
1109 SpinDelay(100);
1110 StartCountSspClk();
1111 // We need to listen to the high-frequency, peak-detected path.
1112 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1113 FpgaSetupSsc();
1114
1115 // To control where we are in the protocol
1116 int cmdsRecvd = 0;
1117 uint32_t time_0 = GetCountSspClk();
1118 uint32_t t2r_time =0;
1119 uint32_t r2t_time =0;
1120
1121 LED_A_ON();
1122 bool buttonPressed = false;
1123
1124 /** Hack for testing
1125 memcpy(reader_mac_buf,csn,8);
1126 exitLoop = true;
1127 end hack **/
1128
1129 while(!exitLoop) {
1130
1131 LED_B_OFF();
1132 //Signal tracer
1133 // Can be used to get a trigger for an oscilloscope..
1134 LED_C_OFF();
1135 if(!GetIClassCommandFromReader(receivedCmd, &len, 100)) {
1136 buttonPressed = true;
1137 break;
1138 }
1139 r2t_time = GetCountSspClk();
1140 //Signal tracer
1141 LED_C_ON();
1142
1143 // Okay, look at the command now.
1144 if(receivedCmd[0] == 0x0a ) {
1145 // Reader in anticollission phase
1146 resp = resp1; respLen = resp1Len; //order = 1;
1147 respdata = &sof;
1148 respsize = sizeof(sof);
1149 } else if(receivedCmd[0] == 0x0c) {
1150 // Reader asks for anticollission CSN
1151 resp = resp2; respLen = resp2Len; //order = 2;
1152 respdata = response2;
1153 respsize = sizeof(response2);
1154 //DbpString("Reader requests anticollission CSN:");
1155 } else if(receivedCmd[0] == 0x81) {
1156 // Reader selects anticollission CSN.
1157 // Tag sends the corresponding real CSN
1158 resp = resp3; respLen = resp3Len; //order = 3;
1159 respdata = response3;
1160 respsize = sizeof(response3);
1161 //DbpString("Reader selects anticollission CSN:");
1162 } else if(receivedCmd[0] == 0x88) {
1163 // Read e-purse (88 02)
1164 resp = resp4; respLen = resp4Len; //order = 4;
1165 respdata = response4;
1166 respsize = sizeof(response4);
1167 LED_B_ON();
1168 } else if(receivedCmd[0] == 0x05) {
1169 // Reader random and reader MAC!!!
1170 // Do not respond
1171 // We do not know what to answer, so lets keep quiet
1172 resp = resp1; respLen = 0; //order = 5;
1173 respdata = NULL;
1174 respsize = 0;
1175 if (breakAfterMacReceived){
1176 // dbprintf:ing ...
1177 Dbprintf("CSN: %02x %02x %02x %02x %02x %02x %02x %02x"
1178 ,csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
1179 Dbprintf("RDR: (len=%02d): %02x %02x %02x %02x %02x %02x %02x %02x %02x",len,
1180 receivedCmd[0], receivedCmd[1], receivedCmd[2],
1181 receivedCmd[3], receivedCmd[4], receivedCmd[5],
1182 receivedCmd[6], receivedCmd[7], receivedCmd[8]);
1183 if (reader_mac_buf != NULL)
1184 {
1185 memcpy(reader_mac_buf,receivedCmd+1,8);
1186 }
1187 exitLoop = true;
1188 }
1189 } else if(receivedCmd[0] == 0x00 && len == 1) {
1190 // Reader ends the session
1191 resp = resp1; respLen = 0; //order = 0;
1192 respdata = NULL;
1193 respsize = 0;
1194 } else {
1195 //#db# Unknown command received from reader (len=5): 26 1 0 f6 a 44 44 44 44
1196 // Never seen this command before
1197 Dbprintf("Unknown command received from reader (len=%d): %x %x %x %x %x %x %x %x %x",
1198 len,
1199 receivedCmd[0], receivedCmd[1], receivedCmd[2],
1200 receivedCmd[3], receivedCmd[4], receivedCmd[5],
1201 receivedCmd[6], receivedCmd[7], receivedCmd[8]);
1202 // Do not respond
1203 resp = resp1; respLen = 0; //order = 0;
1204 respdata = NULL;
1205 respsize = 0;
1206 }
1207
1208 if(cmdsRecvd > 100) {
1209 //DbpString("100 commands later...");
1210 //break;
1211 }
1212 else {
1213 cmdsRecvd++;
1214 }
1215
1216 if(respLen > 0) {
1217 SendIClassAnswer(resp, respLen, 21);
1218 t2r_time = GetCountSspClk();
1219 }
1220
1221 if (tracing) {
1222 LogTrace(receivedCmd,len, (r2t_time-time_0)<< 4, Uart.parityBits,TRUE);
1223 LogTrace(NULL,0, (r2t_time-time_0) << 4, 0,TRUE);
1224
1225 if (respdata != NULL) {
1226 LogTrace(respdata,respsize, (t2r_time-time_0) << 4,SwapBits(GetParity(respdata,respsize),respsize),FALSE);
1227 LogTrace(NULL,0, (t2r_time-time_0) << 4,0,FALSE);
1228
1229
1230 }
1231 if(!tracing) {
1232 DbpString("Trace full");
1233 //break;
1234 }
1235
1236 }
1237 memset(receivedCmd, 0x44, RECV_CMD_SIZE);
1238 }
1239
1240 //Dbprintf("%x", cmdsRecvd);
1241 LED_A_OFF();
1242 LED_B_OFF();
1243 if(buttonPressed)
1244 {
1245 DbpString("Button pressed");
1246 }
1247 return buttonPressed;
1248}
1249
1250static int SendIClassAnswer(uint8_t *resp, int respLen, int delay)
1251{
1252 int i = 0, d=0;//, u = 0, d = 0;
1253 uint8_t b = 0;
1254
1255 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR|FPGA_HF_SIMULATOR_MODULATE_424K);
1256
1257 AT91C_BASE_SSC->SSC_THR = 0x00;
1258 FpgaSetupSsc();
1259 while(!BUTTON_PRESS()) {
1260 if((AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY)){
1261 b = AT91C_BASE_SSC->SSC_RHR; (void) b;
1262 }
1263 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)){
1264 b = 0x00;
1265 if(d < delay) {
1266 d++;
1267 }
1268 else {
1269 if( i < respLen){
1270 b = resp[i];
1271 //Hack
1272 //b = 0xAC;
1273 }
1274 i++;
1275 }
1276 AT91C_BASE_SSC->SSC_THR = b;
1277 }
1278
1279 if (i > respLen +4) break;
1280 }
1281
1282 return 0;
1283}
1284
1285/// THE READER CODE
1286
1287//-----------------------------------------------------------------------------
1288// Transmit the command (to the tag) that was placed in ToSend[].
1289//-----------------------------------------------------------------------------
1290static void TransmitIClassCommand(const uint8_t *cmd, int len, int *samples, int *wait)
1291{
1292 int c;
1293 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1294 AT91C_BASE_SSC->SSC_THR = 0x00;
1295 FpgaSetupSsc();
1296
1297 if (wait)
1298 {
1299 if(*wait < 10) *wait = 10;
1300
1301 for(c = 0; c < *wait;) {
1302 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1303 AT91C_BASE_SSC->SSC_THR = 0x00; // For exact timing!
1304 c++;
1305 }
1306 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1307 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
1308 (void)r;
1309 }
1310 WDT_HIT();
1311 }
1312
1313 }
1314
1315
1316 uint8_t sendbyte;
1317 bool firstpart = TRUE;
1318 c = 0;
1319 for(;;) {
1320 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1321
1322 // DOUBLE THE SAMPLES!
1323 if(firstpart) {
1324 sendbyte = (cmd[c] & 0xf0) | (cmd[c] >> 4);
1325 }
1326 else {
1327 sendbyte = (cmd[c] & 0x0f) | (cmd[c] << 4);
1328 c++;
1329 }
1330 if(sendbyte == 0xff) {
1331 sendbyte = 0xfe;
1332 }
1333 AT91C_BASE_SSC->SSC_THR = sendbyte;
1334 firstpart = !firstpart;
1335
1336 if(c >= len) {
1337 break;
1338 }
1339 }
1340 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1341 volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR;
1342 (void)r;
1343 }
1344 WDT_HIT();
1345 }
1346 if (samples) *samples = (c + *wait) << 3;
1347}
1348
1349
1350//-----------------------------------------------------------------------------
1351// Prepare iClass reader command to send to FPGA
1352//-----------------------------------------------------------------------------
1353void CodeIClassCommand(const uint8_t * cmd, int len)
1354{
1355 int i, j, k;
1356 uint8_t b;
1357
1358 ToSendReset();
1359
1360 // Start of Communication: 1 out of 4
1361 ToSend[++ToSendMax] = 0xf0;
1362 ToSend[++ToSendMax] = 0x00;
1363 ToSend[++ToSendMax] = 0x0f;
1364 ToSend[++ToSendMax] = 0x00;
1365
1366 // Modulate the bytes
1367 for (i = 0; i < len; i++) {
1368 b = cmd[i];
1369 for(j = 0; j < 4; j++) {
1370 for(k = 0; k < 4; k++) {
1371 if(k == (b & 3)) {
1372 ToSend[++ToSendMax] = 0x0f;
1373 }
1374 else {
1375 ToSend[++ToSendMax] = 0x00;
1376 }
1377 }
1378 b >>= 2;
1379 }
1380 }
1381
1382 // End of Communication
1383 ToSend[++ToSendMax] = 0x00;
1384 ToSend[++ToSendMax] = 0x00;
1385 ToSend[++ToSendMax] = 0xf0;
1386 ToSend[++ToSendMax] = 0x00;
1387
1388 // Convert from last character reference to length
1389 ToSendMax++;
1390}
1391
1392void ReaderTransmitIClass(uint8_t* frame, int len)
1393{
1394 int wait = 0;
1395 int samples = 0;
1396 int par = 0;
1397
1398 // This is tied to other size changes
1399 // uint8_t* frame_addr = ((uint8_t*)BigBuf) + 2024;
1400 CodeIClassCommand(frame,len);
1401
1402 // Select the card
1403 TransmitIClassCommand(ToSend, ToSendMax, &samples, &wait);
1404 if(trigger)
1405 LED_A_ON();
1406
1407 // Store reader command in buffer
1408 if (tracing) LogTrace(frame,len,rsamples,par,TRUE);
1409}
1410
1411//-----------------------------------------------------------------------------
1412// Wait a certain time for tag response
1413// If a response is captured return TRUE
1414// If it takes too long return FALSE
1415//-----------------------------------------------------------------------------
1416static int GetIClassAnswer(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed) //uint8_t *buffer
1417{
1418 // buffer needs to be 512 bytes
1419 int c;
1420
1421 // Set FPGA mode to "reader listen mode", no modulation (listen
1422 // only, since we are receiving, not transmitting).
1423 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
1424
1425 // Now get the answer from the card
1426 Demod.output = receivedResponse;
1427 Demod.len = 0;
1428 Demod.state = DEMOD_UNSYNCD;
1429
1430 uint8_t b;
1431 if (elapsed) *elapsed = 0;
1432
1433 bool skip = FALSE;
1434
1435 c = 0;
1436 for(;;) {
1437 WDT_HIT();
1438
1439 if(BUTTON_PRESS()) return FALSE;
1440
1441 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
1442 AT91C_BASE_SSC->SSC_THR = 0x00; // To make use of exact timing of next command from reader!!
1443 if (elapsed) (*elapsed)++;
1444 }
1445 if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
1446 if(c < timeout) { c++; } else { return FALSE; }
1447 b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
1448 skip = !skip;
1449 if(skip) continue;
1450 /*if(ManchesterDecoding((b>>4) & 0xf)) {
1451 *samples = ((c - 1) << 3) + 4;
1452 return TRUE;
1453 }*/
1454 if(ManchesterDecoding(b & 0x0f)) {
1455 *samples = c << 3;
1456 return TRUE;
1457 }
1458 }
1459 }
1460}
1461
1462int ReaderReceiveIClass(uint8_t* receivedAnswer)
1463{
1464 int samples = 0;
1465 if (!GetIClassAnswer(receivedAnswer,160,&samples,0)) return FALSE;
1466 rsamples += samples;
1467 if (tracing) LogTrace(receivedAnswer,Demod.len,rsamples,Demod.parityBits,FALSE);
1468 if(samples == 0) return FALSE;
1469 return Demod.len;
1470}
1471
1472void setupIclassReader()
1473{
1474 FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
1475 // Reset trace buffer
1476 iso14a_set_tracing(TRUE);
1477 iso14a_clear_trace();
1478
1479 // Setup SSC
1480 FpgaSetupSsc();
1481 // Start from off (no field generated)
1482 // Signal field is off with the appropriate LED
1483 LED_D_OFF();
1484 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1485 SpinDelay(200);
1486
1487 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1488
1489 // Now give it time to spin up.
1490 // Signal field is on with the appropriate LED
1491 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1492 SpinDelay(200);
1493 LED_A_ON();
1494
1495}
1496
1497// Reader iClass Anticollission
1498void ReaderIClass(uint8_t arg0) {
1499 uint8_t act_all[] = { 0x0a };
1500 uint8_t identify[] = { 0x0c };
1501 uint8_t select[] = { 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1502 uint8_t readcheck_cc[]= { 0x88, 0x02 };
1503
1504 uint8_t card_data[24]={0};
1505 uint8_t last_csn[8]={0};
1506
1507 uint8_t* resp = (((uint8_t *)BigBuf) + 3560); // was 3560 - tied to other size changes
1508
1509 int read_status= 0;
1510 bool abort_after_read = arg0 & FLAG_ICLASS_READER_ONLY_ONCE;
1511
1512 setupIclassReader();
1513
1514 size_t datasize = 0;
1515 while(!BUTTON_PRESS())
1516 {
1517 WDT_HIT();
1518
1519 // Send act_all
1520 ReaderTransmitIClass(act_all, 1);
1521 // Card present?
1522 if(ReaderReceiveIClass(resp)) {
1523
1524 ReaderTransmitIClass(identify, 1);
1525
1526 if(ReaderReceiveIClass(resp) == 10) {
1527 //Copy the Anti-collision CSN to our select-packet
1528 memcpy(&select[1],resp,8);
1529 //Dbprintf("Anti-collision CSN: %02x %02x %02x %02x %02x %02x %02x %02x",resp[0], resp[1], resp[2],
1530 // resp[3], resp[4], resp[5],
1531 // resp[6], resp[7]);
1532 //Select the card
1533 ReaderTransmitIClass(select, sizeof(select));
1534
1535 if(ReaderReceiveIClass(resp) == 10) {
1536 //Save CSN in response data
1537 memcpy(card_data,resp,8);
1538 datasize += 8;
1539 //Flag that we got to at least stage 1, read CSN
1540 read_status = 1;
1541
1542 // Card selected
1543 //Dbprintf("Readcheck on Sector 2");
1544 ReaderTransmitIClass(readcheck_cc, sizeof(readcheck_cc));
1545 if(ReaderReceiveIClass(resp) == 8) {
1546 //Save CC (e-purse) in response data
1547 memcpy(card_data+8,resp,8);
1548 datasize += 8;
1549 //Got both
1550 read_status = 2;
1551 }
1552
1553 LED_B_ON();
1554 //Send back to client, but don't bother if we already sent this
1555 if(memcmp(last_csn, card_data, 8) != 0)
1556 cmd_send(CMD_ACK,read_status,0,0,card_data,datasize);
1557
1558 //Save that we already sent this....
1559 if(read_status == 2)
1560 memcpy(last_csn, card_data, 8);
1561
1562 LED_B_OFF();
1563
1564 if(abort_after_read) break;
1565 }
1566 }
1567 }
1568
1569 if(traceLen > TRACE_SIZE) {
1570 DbpString("Trace full");
1571 break;
1572 }
1573 }
1574 LED_A_OFF();
1575}
1576
1577void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
1578 uint8_t act_all[] = { 0x0a };
1579 uint8_t identify[] = { 0x0c };
1580 uint8_t select[] = { 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1581 uint8_t readcheck_cc[]= { 0x88, 0x02 };
1582 uint8_t check[] = { 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1583 uint8_t read[] = { 0x0c, 0x00, 0x00, 0x00 };
1584
1585 uint16_t crc = 0;
1586 uint8_t cardsize=0;
1587 bool read_success=false;
1588 uint8_t mem=0;
1589
1590 static struct memory_t{
1591 int k16;
1592 int book;
1593 int k2;
1594 int lockauth;
1595 int keyaccess;
1596 } memory;
1597
1598 uint8_t* resp = (((uint8_t *)BigBuf) + 3560); // was 3560 - tied to other size changes
1599
1600 setupIclassReader();
1601
1602
1603 for(int i=0;i<1;i++) {
1604
1605 if(traceLen > TRACE_SIZE) {
1606 DbpString("Trace full");
1607 break;
1608 }
1609
1610 if (BUTTON_PRESS()) break;
1611
1612 // Send act_all
1613 ReaderTransmitIClass(act_all, 1);
1614 // Card present?
1615 if(ReaderReceiveIClass(resp)) {
1616 ReaderTransmitIClass(identify, 1);
1617 if(ReaderReceiveIClass(resp) == 10) {
1618 // Select card
1619 memcpy(&select[1],resp,8);
1620 ReaderTransmitIClass(select, sizeof(select));
1621
1622 if(ReaderReceiveIClass(resp) == 10) {
1623 Dbprintf(" Selected CSN: %02x %02x %02x %02x %02x %02x %02x %02x",
1624 resp[0], resp[1], resp[2],
1625 resp[3], resp[4], resp[5],
1626 resp[6], resp[7]);
1627 }
1628 // Card selected
1629 Dbprintf("Readcheck on Sector 2");
1630 ReaderTransmitIClass(readcheck_cc, sizeof(readcheck_cc));
1631 if(ReaderReceiveIClass(resp) == 8) {
1632 Dbprintf(" CC: %02x %02x %02x %02x %02x %02x %02x %02x",
1633 resp[0], resp[1], resp[2],
1634 resp[3], resp[4], resp[5],
1635 resp[6], resp[7]);
1636 }else return;
1637 Dbprintf("Authenticate");
1638 //for now replay captured auth (as cc not updated)
1639 memcpy(check+5,MAC,4);
1640 //Dbprintf(" AA: %02x %02x %02x %02x",
1641 // check[5], check[6], check[7],check[8]);
1642 ReaderTransmitIClass(check, sizeof(check));
1643 if(ReaderReceiveIClass(resp) == 4) {
1644 Dbprintf(" AR: %02x %02x %02x %02x",
1645 resp[0], resp[1], resp[2],resp[3]);
1646 }else {
1647 Dbprintf("Error: Authentication Fail!");
1648 return;
1649 }
1650 Dbprintf("Dump Contents");
1651 //first get configuration block
1652 read_success=false;
1653 read[1]=1;
1654 uint8_t *blockno=&read[1];
1655 crc = iclass_crc16((char *)blockno,1);
1656 read[2] = crc >> 8;
1657 read[3] = crc & 0xff;
1658 while(!read_success){
1659 ReaderTransmitIClass(read, sizeof(read));
1660 if(ReaderReceiveIClass(resp) == 10) {
1661 read_success=true;
1662 mem=resp[5];
1663 memory.k16= (mem & 0x80);
1664 memory.book= (mem & 0x20);
1665 memory.k2= (mem & 0x8);
1666 memory.lockauth= (mem & 0x2);
1667 memory.keyaccess= (mem & 0x1);
1668
1669 }
1670 }
1671 if (memory.k16){
1672 cardsize=255;
1673 }else cardsize=32;
1674 //then loop around remaining blocks
1675 for(uint8_t j=0; j<cardsize; j++){
1676 read_success=false;
1677 uint8_t *blockno=&j;
1678 //crc_data[0]=j;
1679 read[1]=j;
1680 crc = iclass_crc16((char *)blockno,1);
1681 read[2] = crc >> 8;
1682 read[3] = crc & 0xff;
1683 while(!read_success){
1684 ReaderTransmitIClass(read, sizeof(read));
1685 if(ReaderReceiveIClass(resp) == 10) {
1686 read_success=true;
1687 Dbprintf(" %02x: %02x %02x %02x %02x %02x %02x %02x %02x",
1688 j, resp[0], resp[1], resp[2],
1689 resp[3], resp[4], resp[5],
1690 resp[6], resp[7]);
1691 }
1692 }
1693 }
1694 }
1695 }
1696 WDT_HIT();
1697 }
1698
1699 LED_A_OFF();
1700}
1701
1702//2. Create Read method (cut-down from above) based off responses from 1.
1703// Since we have the MAC could continue to use replay function.
1704//3. Create Write method
1705/*
1706void IClass_iso14443A_write(uint8_t arg0, uint8_t blockNo, uint8_t *data, uint8_t *MAC) {
1707 uint8_t act_all[] = { 0x0a };
1708 uint8_t identify[] = { 0x0c };
1709 uint8_t select[] = { 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1710 uint8_t readcheck_cc[]= { 0x88, 0x02 };
1711 uint8_t check[] = { 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1712 uint8_t read[] = { 0x0c, 0x00, 0x00, 0x00 };
1713 uint8_t write[] = { 0x87, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1714
1715 uint16_t crc = 0;
1716
1717 uint8_t* resp = (((uint8_t *)BigBuf) + 3560); // was 3560 - tied to other size changes
1718
1719 // Reset trace buffer
1720 memset(trace, 0x44, RECV_CMD_OFFSET);
1721 traceLen = 0;
1722
1723 // Setup SSC
1724 FpgaSetupSsc();
1725 // Start from off (no field generated)
1726 // Signal field is off with the appropriate LED
1727 LED_D_OFF();
1728 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
1729 SpinDelay(200);
1730
1731 SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
1732
1733 // Now give it time to spin up.
1734 // Signal field is on with the appropriate LED
1735 FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
1736 SpinDelay(200);
1737
1738 LED_A_ON();
1739
1740 for(int i=0;i<1;i++) {
1741
1742 if(traceLen > TRACE_SIZE) {
1743 DbpString("Trace full");
1744 break;
1745 }
1746
1747 if (BUTTON_PRESS()) break;
1748
1749 // Send act_all
1750 ReaderTransmitIClass(act_all, 1);
1751 // Card present?
1752 if(ReaderReceiveIClass(resp)) {
1753 ReaderTransmitIClass(identify, 1);
1754 if(ReaderReceiveIClass(resp) == 10) {
1755 // Select card
1756 memcpy(&select[1],resp,8);
1757 ReaderTransmitIClass(select, sizeof(select));
1758
1759 if(ReaderReceiveIClass(resp) == 10) {
1760 Dbprintf(" Selected CSN: %02x %02x %02x %02x %02x %02x %02x %02x",
1761 resp[0], resp[1], resp[2],
1762 resp[3], resp[4], resp[5],
1763 resp[6], resp[7]);
1764 }
1765 // Card selected
1766 Dbprintf("Readcheck on Sector 2");
1767 ReaderTransmitIClass(readcheck_cc, sizeof(readcheck_cc));
1768 if(ReaderReceiveIClass(resp) == 8) {
1769 Dbprintf(" CC: %02x %02x %02x %02x %02x %02x %02x %02x",
1770 resp[0], resp[1], resp[2],
1771 resp[3], resp[4], resp[5],
1772 resp[6], resp[7]);
1773 }else return;
1774 Dbprintf("Authenticate");
1775 //for now replay captured auth (as cc not updated)
1776 memcpy(check+5,MAC,4);
1777 Dbprintf(" AA: %02x %02x %02x %02x",
1778 check[5], check[6], check[7],check[8]);
1779 ReaderTransmitIClass(check, sizeof(check));
1780 if(ReaderReceiveIClass(resp) == 4) {
1781 Dbprintf(" AR: %02x %02x %02x %02x",
1782 resp[0], resp[1], resp[2],resp[3]);
1783 }else {
1784 Dbprintf("Error: Authentication Fail!");
1785 return;
1786 }
1787 Dbprintf("Write Block");
1788
1789 //read configuration for max block number
1790 read_success=false;
1791 read[1]=1;
1792 uint8_t *blockno=&read[1];
1793 crc = iclass_crc16((char *)blockno,1);
1794 read[2] = crc >> 8;
1795 read[3] = crc & 0xff;
1796 while(!read_success){
1797 ReaderTransmitIClass(read, sizeof(read));
1798 if(ReaderReceiveIClass(resp) == 10) {
1799 read_success=true;
1800 mem=resp[5];
1801 memory.k16= (mem & 0x80);
1802 memory.book= (mem & 0x20);
1803 memory.k2= (mem & 0x8);
1804 memory.lockauth= (mem & 0x2);
1805 memory.keyaccess= (mem & 0x1);
1806
1807 }
1808 }
1809 if (memory.k16){
1810 cardsize=255;
1811 }else cardsize=32;
1812 //check card_size
1813
1814 memcpy(write+1,blockNo,1);
1815 memcpy(write+2,data,8);
1816 memcpy(write+10,mac,4);
1817 while(!send_success){
1818 ReaderTransmitIClass(write, sizeof(write));
1819 if(ReaderReceiveIClass(resp) == 10) {
1820 write_success=true;
1821 }
1822 }//
1823 }
1824 WDT_HIT();
1825 }
1826
1827 LED_A_OFF();
1828}*/
Proxmark3 GIT tracking
Impressum, Datenschutz