| | 1 | //----------------------------------------------------------------------------- |
| | 2 | // Merlok - 2012 |
| | 3 | // |
| | 4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
| | 5 | // at your option, any later version. See the LICENSE.txt file for the text of |
| | 6 | // the license. |
| | 7 | //----------------------------------------------------------------------------- |
| | 8 | // Routines to support mifare classic sniffer. |
| | 9 | //----------------------------------------------------------------------------- |
| | 10 | |
| | 11 | #include "mifaresniff.h" |
| | 12 | #include "apps.h" |
| | 13 | #include "proxmark3.h" |
| | 14 | #include "util.h" |
| | 15 | #include "string.h" |
| | 16 | #include "iso14443crc.h" |
| | 17 | #include "iso14443a.h" |
| | 18 | #include "crapto1/crapto1.h" |
| | 19 | #include "mifareutil.h" |
| | 20 | #include "common.h" |
| | 21 | |
| | 22 | |
| | 23 | static int sniffState = SNF_INIT; |
| | 24 | static uint8_t sniffUIDType; |
| | 25 | static uint8_t sniffUID[8] = {0x00}; |
| | 26 | static uint8_t sniffATQA[2] = {0x00}; |
| | 27 | static uint8_t sniffSAK; |
| | 28 | static uint8_t sniffBuf[16] = {0x00}; |
| | 29 | static uint32_t timerData = 0; |
| | 30 | |
| | 31 | |
| | 32 | bool MfSniffInit(void){ |
| | 33 | memset(sniffUID, 0x00, 8); |
| | 34 | memset(sniffATQA, 0x00, 2); |
| | 35 | sniffSAK = 0; |
| | 36 | sniffUIDType = SNF_UID_4; |
| | 37 | |
| | 38 | return false; |
| | 39 | } |
| | 40 | |
| | 41 | bool MfSniffEnd(void){ |
| | 42 | LED_B_ON(); |
| | 43 | cmd_send(CMD_ACK,0,0,0,0,0); |
| | 44 | LED_B_OFF(); |
| | 45 | |
| | 46 | return false; |
| | 47 | } |
| | 48 | |
| | 49 | bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint8_t *parity, uint16_t bitCnt, bool reader) { |
| | 50 | |
| | 51 | if (reader && (len == 1) && (bitCnt == 7)) { // reset on 7-Bit commands from reader |
| | 52 | sniffState = SNF_INIT; |
| | 53 | } |
| | 54 | |
| | 55 | switch (sniffState) { |
| | 56 | case SNF_INIT:{ |
| | 57 | if ((len == 1) && (reader) && (bitCnt == 7) ) { // REQA or WUPA from reader |
| | 58 | sniffUIDType = SNF_UID_4; |
| | 59 | memset(sniffUID, 0x00, 8); |
| | 60 | memset(sniffATQA, 0x00, 2); |
| | 61 | sniffSAK = 0; |
| | 62 | sniffState = SNF_ATQA; |
| | 63 | if (data[0] == 0x40) |
| | 64 | sniffState = SNF_MAGIC_WUPC2; |
| | 65 | } |
| | 66 | break; |
| | 67 | } |
| | 68 | case SNF_MAGIC_WUPC2: |
| | 69 | if ((len == 1) && (reader) && (data[0] == 0x43) ) { |
| | 70 | sniffState = SNF_CARD_IDLE; |
| | 71 | } |
| | 72 | break; |
| | 73 | case SNF_ATQA:{ |
| | 74 | if ((!reader) && (len == 2)) { // ATQA from tag |
| | 75 | memcpy(sniffATQA, data, 2); |
| | 76 | sniffState = SNF_UID1; |
| | 77 | } |
| | 78 | break; |
| | 79 | } |
| | 80 | case SNF_UID1:{\r |
| | 81 | if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 4 Byte UID from reader\r |
| | 82 | memcpy(sniffUID + 3, &data[2], 4);\r |
| | 83 | sniffState = SNF_SAK;\r |
| | 84 | }\r |
| | 85 | break; |
| | 86 | }\r |
| | 87 | case SNF_SAK:{ |
| | 88 | if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card? |
| | 89 | sniffSAK = data[0]; |
| | 90 | if ((sniffUID[3] == 0x88) && (sniffUIDType == SNF_UID_4)) { // CL2 UID part to be expected |
| | 91 | sniffUIDType = SNF_UID_7;\r |
| | 92 | memcpy(sniffUID, sniffUID + 4, 3);\r |
| | 93 | sniffState = SNF_UID2; |
| | 94 | } else { // select completed |
| | 95 | sniffState = SNF_CARD_IDLE; |
| | 96 | } |
| | 97 | } |
| | 98 | break; |
| | 99 | } |
| | 100 | case SNF_UID2:{\r |
| | 101 | if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) {\r |
| | 102 | memcpy(sniffUID + 3, &data[2], 4);\r |
| | 103 | sniffState = SNF_SAK;\r |
| | 104 | }\r |
| | 105 | break;\r |
| | 106 | }\r |
| | 107 | case SNF_CARD_IDLE:{ // trace the card select sequence |
| | 108 | sniffBuf[0] = 0xFF; |
| | 109 | sniffBuf[1] = 0xFF; |
| | 110 | memcpy(sniffBuf + 2, sniffUID, 7); |
| | 111 | memcpy(sniffBuf + 9, sniffATQA, 2); |
| | 112 | sniffBuf[11] = sniffSAK; |
| | 113 | sniffBuf[12] = 0xFF; |
| | 114 | sniffBuf[13] = 0xFF; |
| | 115 | LogTrace(sniffBuf, 14, 0, 0, NULL, true); |
| | 116 | sniffState = SNF_CARD_CMD; |
| | 117 | } // intentionally no break; |
| | 118 | case SNF_CARD_CMD:{ |
| | 119 | LogTrace(data, len, 0, 0, parity, reader); |
| | 120 | timerData = GetTickCount(); |
| | 121 | break; |
| | 122 | } |
| | 123 | |
| | 124 | default: |
| | 125 | sniffState = SNF_INIT; |
| | 126 | break; |
| | 127 | } |
| | 128 | |
| | 129 | |
| | 130 | return false; |
| | 131 | } |
| | 132 | |
| | 133 | bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) { |
| | 134 | if (BigBuf_get_traceLen() && (GetTickCount() > timerData + maxTimeoutMs)) { |
| | 135 | return intMfSniffSend(); |
| | 136 | } |
| | 137 | return false; |
| | 138 | } |
| | 139 | |
| | 140 | // internal sending function. not a RAMFUNC. |
| | 141 | bool intMfSniffSend() { |
| | 142 | |
| | 143 | int pckSize = 0; |
| | 144 | int pckLen = BigBuf_get_traceLen(); |
| | 145 | int pckNum = 0; |
| | 146 | uint8_t *trace = BigBuf_get_addr(); |
| | 147 | |
| | 148 | FpgaDisableSscDma(); |
| | 149 | while (pckLen > 0) { |
| | 150 | pckSize = MIN(USB_CMD_DATA_SIZE, pckLen); |
| | 151 | LED_B_ON(); |
| | 152 | cmd_send(CMD_ACK, 1, BigBuf_get_traceLen(), pckSize, trace + BigBuf_get_traceLen() - pckLen, pckSize); |
| | 153 | LED_B_OFF(); |
| | 154 | |
| | 155 | pckLen -= pckSize; |
| | 156 | pckNum++; |
| | 157 | } |
| | 158 | |
| | 159 | LED_B_ON(); |
| | 160 | cmd_send(CMD_ACK,2,0,0,0,0); |
| | 161 | LED_B_OFF(); |
| | 162 | |
| | 163 | clear_trace(); |
| | 164 | |
| | 165 | return true; |
| | 166 | } |
projects / proxmark3-svn / blame_incremental