]>
cvs.zerfleddert.de Git - proxmark3-svn/blob - armsrc/mifaresniff.c
20b54e820d15c9e02aff61449b3c75c16a922ca3
1 //-----------------------------------------------------------------------------
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Routines to support mifare classic sniffer.
9 //-----------------------------------------------------------------------------
11 #include "mifaresniff.h"
13 #include "proxmark3.h"
16 #include "iso14443crc.h"
17 #include "iso14443a.h"
18 #include "crapto1/crapto1.h"
19 #include "mifareutil.h"
23 static int sniffState
= SNF_INIT
;
24 static uint8_t sniffUIDType
;
25 static uint8_t sniffUID
[8] = {0x00};
26 static uint8_t sniffATQA
[2] = {0x00};
27 static uint8_t sniffSAK
;
28 static uint8_t sniffBuf
[16] = {0x00};
29 static uint32_t timerData
= 0;
32 bool MfSniffInit(void){
33 memset(sniffUID
, 0x00, 8);
34 memset(sniffATQA
, 0x00, 2);
36 sniffUIDType
= SNF_UID_4
;
41 bool MfSniffEnd(void){
43 cmd_send(CMD_ACK
,0,0,0,0,0);
49 bool RAMFUNC
MfSniffLogic(const uint8_t *data
, uint16_t len
, uint8_t *parity
, uint16_t bitCnt
, bool reader
) {
51 if (reader
&& (len
== 1) && (bitCnt
== 7)) { // reset on 7-Bit commands from reader
52 sniffState
= SNF_INIT
;
57 if ((len
== 1) && (reader
) && (bitCnt
== 7) ) { // REQA or WUPA from reader
58 sniffUIDType
= SNF_UID_4
;
59 memset(sniffUID
, 0x00, 8);
60 memset(sniffATQA
, 0x00, 2);
62 sniffState
= SNF_ATQA
;
67 if ((!reader
) && (len
== 2)) { // ATQA from tag
68 memcpy(sniffATQA
, data
, 2);
69 sniffState
= SNF_UID1
;
74 if ((reader
) && (len
== 9) && (data
[0] == 0x93) && (data
[1] == 0x70) && (CheckCrc14443(CRC_14443_A
, data
, 9))) { // Select 4 Byte UID from reader
75 memcpy(sniffUID
+ 3, &data
[2], 4);
81 if ((!reader
) && (len
== 3) && (CheckCrc14443(CRC_14443_A
, data
, 3))) { // SAK from card?
83 if ((sniffUID
[3] == 0x88) && (sniffUIDType
== SNF_UID_4
)) { // CL2 UID part to be expected
84 sniffUIDType
= SNF_UID_7
;
85 memcpy(sniffUID
, sniffUID
+ 4, 3);
86 sniffState
= SNF_UID2
;
87 } else { // select completed
88 sniffState
= SNF_CARD_IDLE
;
94 if ((reader
) && (len
== 9) && (data
[0] == 0x95) && (data
[1] == 0x70) && (CheckCrc14443(CRC_14443_A
, data
, 9))) {
95 memcpy(sniffUID
+ 3, &data
[2], 4);
100 case SNF_CARD_IDLE
:{ // trace the card select sequence
103 memcpy(sniffBuf
+ 2, sniffUID
, 7);
104 memcpy(sniffBuf
+ 9, sniffATQA
, 2);
105 sniffBuf
[11] = sniffSAK
;
108 LogTrace(sniffBuf
, 14, 0, 0, NULL
, TRUE
);
109 sniffState
= SNF_CARD_CMD
;
110 } // intentionally no break;
112 LogTrace(data
, len
, 0, 0, NULL
, reader
);
113 timerData
= GetTickCount();
118 sniffState
= SNF_INIT
;
126 bool RAMFUNC
MfSniffSend(uint16_t maxTimeoutMs
) {
127 if (BigBuf_get_traceLen() && (GetTickCount() > timerData
+ maxTimeoutMs
)) {
128 return intMfSniffSend();
133 // internal sending function. not a RAMFUNC.
134 bool intMfSniffSend() {
137 int pckLen
= BigBuf_get_traceLen();
139 uint8_t *trace
= BigBuf_get_addr();
143 pckSize
= MIN(USB_CMD_DATA_SIZE
, pckLen
);
145 cmd_send(CMD_ACK
, 1, BigBuf_get_traceLen(), pckSize
, trace
+ BigBuf_get_traceLen() - pckLen
, pckSize
);
153 cmd_send(CMD_ACK
,2,0,0,0,0);