| | 1 | //----------------------------------------------------------------------------- |
| | 2 | // Merlok - 2012 |
| | 3 | // |
| | 4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
| | 5 | // at your option, any later version. See the LICENSE.txt file for the text of |
| | 6 | // the license. |
| | 7 | //----------------------------------------------------------------------------- |
| | 8 | // Routines to support mifare classic sniffer. |
| | 9 | //----------------------------------------------------------------------------- |
| | 10 | |
| | 11 | #include "mifaresniff.h" |
| | 12 | |
| | 13 | #include "proxmark3.h" |
| | 14 | #include "util.h" |
| | 15 | #include "string.h" |
| | 16 | #include "iso14443crc.h" |
| | 17 | #include "iso14443a.h" |
| | 18 | #include "crapto1/crapto1.h" |
| | 19 | #include "mifareutil.h" |
| | 20 | #include "common.h" |
| | 21 | #include "cmd.h" |
| | 22 | #include "BigBuf.h" |
| | 23 | #include "fpgaloader.h" |
| | 24 | |
| | 25 | |
| | 26 | static int sniffState = SNF_INIT; |
| | 27 | static uint8_t sniffUIDType; |
| | 28 | static uint8_t sniffUID[8] = {0x00}; |
| | 29 | static uint8_t sniffATQA[2] = {0x00}; |
| | 30 | static uint8_t sniffSAK; |
| | 31 | static uint8_t sniffBuf[16] = {0x00}; |
| | 32 | static uint32_t timerData = 0; |
| | 33 | |
| | 34 | |
| | 35 | bool MfSniffInit(void){ |
| | 36 | memset(sniffUID, 0x00, 8); |
| | 37 | memset(sniffATQA, 0x00, 2); |
| | 38 | sniffSAK = 0; |
| | 39 | sniffUIDType = SNF_UID_4; |
| | 40 | |
| | 41 | return false; |
| | 42 | } |
| | 43 | |
| | 44 | bool MfSniffEnd(void){ |
| | 45 | LED_B_ON(); |
| | 46 | cmd_send(CMD_ACK,0,0,0,0,0); |
| | 47 | LED_B_OFF(); |
| | 48 | |
| | 49 | return false; |
| | 50 | } |
| | 51 | |
| | 52 | bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint8_t *parity, uint16_t bitCnt, bool reader) { |
| | 53 | |
| | 54 | if (reader && (len == 1) && (bitCnt == 7)) { // reset on 7-Bit commands from reader |
| | 55 | sniffState = SNF_INIT; |
| | 56 | } |
| | 57 | |
| | 58 | switch (sniffState) { |
| | 59 | case SNF_INIT:{ |
| | 60 | if ((len == 1) && (reader) && (bitCnt == 7) ) { // REQA or WUPA from reader |
| | 61 | sniffUIDType = SNF_UID_4; |
| | 62 | memset(sniffUID, 0x00, 8); |
| | 63 | memset(sniffATQA, 0x00, 2); |
| | 64 | sniffSAK = 0; |
| | 65 | sniffState = SNF_ATQA; |
| | 66 | if (data[0] == 0x40) |
| | 67 | sniffState = SNF_MAGIC_WUPC2; |
| | 68 | } |
| | 69 | break; |
| | 70 | } |
| | 71 | case SNF_MAGIC_WUPC2: |
| | 72 | if ((len == 1) && (reader) && (data[0] == 0x43) ) { |
| | 73 | sniffState = SNF_CARD_IDLE; |
| | 74 | } |
| | 75 | break; |
| | 76 | case SNF_ATQA:{ |
| | 77 | if ((!reader) && (len == 2)) { // ATQA from tag |
| | 78 | memcpy(sniffATQA, data, 2); |
| | 79 | sniffState = SNF_UID1; |
| | 80 | } |
| | 81 | break; |
| | 82 | } |
| | 83 | case SNF_UID1:{\r |
| | 84 | if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 4 Byte UID from reader\r |
| | 85 | memcpy(sniffUID + 3, &data[2], 4);\r |
| | 86 | sniffState = SNF_SAK;\r |
| | 87 | }\r |
| | 88 | break; |
| | 89 | }\r |
| | 90 | case SNF_SAK:{ |
| | 91 | if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card? |
| | 92 | sniffSAK = data[0]; |
| | 93 | if ((sniffUID[3] == 0x88) && (sniffUIDType == SNF_UID_4)) { // CL2 UID part to be expected |
| | 94 | sniffUIDType = SNF_UID_7;\r |
| | 95 | memcpy(sniffUID, sniffUID + 4, 3);\r |
| | 96 | sniffState = SNF_UID2; |
| | 97 | } else { // select completed |
| | 98 | sniffState = SNF_CARD_IDLE; |
| | 99 | } |
| | 100 | } |
| | 101 | break; |
| | 102 | } |
| | 103 | case SNF_UID2:{\r |
| | 104 | if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) {\r |
| | 105 | memcpy(sniffUID + 3, &data[2], 4);\r |
| | 106 | sniffState = SNF_SAK;\r |
| | 107 | }\r |
| | 108 | break;\r |
| | 109 | }\r |
| | 110 | case SNF_CARD_IDLE:{ // trace the card select sequence |
| | 111 | sniffBuf[0] = 0xFF; |
| | 112 | sniffBuf[1] = 0xFF; |
| | 113 | memcpy(sniffBuf + 2, sniffUID, 7); |
| | 114 | memcpy(sniffBuf + 9, sniffATQA, 2); |
| | 115 | sniffBuf[11] = sniffSAK; |
| | 116 | sniffBuf[12] = 0xFF; |
| | 117 | sniffBuf[13] = 0xFF; |
| | 118 | LogTrace(sniffBuf, 14, 0, 0, NULL, true); |
| | 119 | sniffState = SNF_CARD_CMD; |
| | 120 | } // intentionally no break; |
| | 121 | case SNF_CARD_CMD:{ |
| | 122 | LogTrace(data, len, 0, 0, parity, reader); |
| | 123 | timerData = GetTickCount(); |
| | 124 | break; |
| | 125 | } |
| | 126 | |
| | 127 | default: |
| | 128 | sniffState = SNF_INIT; |
| | 129 | break; |
| | 130 | } |
| | 131 | |
| | 132 | |
| | 133 | return false; |
| | 134 | } |
| | 135 | |
| | 136 | bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) { |
| | 137 | if (BigBuf_get_traceLen() && (GetTickCount() > timerData + maxTimeoutMs)) { |
| | 138 | return intMfSniffSend(); |
| | 139 | } |
| | 140 | return false; |
| | 141 | } |
| | 142 | |
| | 143 | // internal sending function. not a RAMFUNC. |
| | 144 | bool intMfSniffSend() { |
| | 145 | |
| | 146 | int pckSize = 0; |
| | 147 | int pckLen = BigBuf_get_traceLen(); |
| | 148 | int pckNum = 0; |
| | 149 | uint8_t *trace = BigBuf_get_addr(); |
| | 150 | |
| | 151 | FpgaDisableSscDma(); |
| | 152 | while (pckLen > 0) { |
| | 153 | pckSize = MIN(USB_CMD_DATA_SIZE, pckLen); |
| | 154 | LED_B_ON(); |
| | 155 | cmd_send(CMD_ACK, 1, BigBuf_get_traceLen(), pckSize, trace + BigBuf_get_traceLen() - pckLen, pckSize); |
| | 156 | LED_B_OFF(); |
| | 157 | |
| | 158 | pckLen -= pckSize; |
| | 159 | pckNum++; |
| | 160 | } |
| | 161 | |
| | 162 | LED_B_ON(); |
| | 163 | cmd_send(CMD_ACK,2,0,0,0,0); |
| | 164 | LED_B_OFF(); |
| | 165 | |
| | 166 | clear_trace(); |
| | 167 | |
| | 168 | return true; |
| | 169 | } |
projects / proxmark3-svn / blame_incremental