]> cvs.zerfleddert.de Git - proxmark3-svn/blobdiff - armsrc/iclass.c
Increase threshold to 160, fix for issue 756 (#760)
[proxmark3-svn] / armsrc / iclass.c
index eb5a5a7969f98a7dd96d94832b5087ceb9148ed2..d27fc1c6f70ff533fe94b70e0590aae541a8100f 100644 (file)
@@ -42,6 +42,7 @@
 #include "string.h"
 #include "common.h"
 #include "cmd.h"
+#include "iso14443a.h"
 // Needed for CRC in emulation mode;
 // same construction as in ISO 14443;
 // different initial value (CRC_ICLASS)
@@ -49,6 +50,7 @@
 #include "iso15693tools.h"
 #include "protocols.h"
 #include "optimized_cipher.h"
+#include "usb_cdc.h" // for usb_poll_validate_length
 
 static int timeout = 4096;
 
@@ -89,7 +91,7 @@ static RAMFUNC int OutOfNDecoding(int bit)
 
        if(!Uart.bitBuffer) {
                Uart.bitBuffer = bit ^ 0xFF0;
-               return FALSE;
+               return false;
        }
        else {
                Uart.bitBuffer <<= 4;
@@ -100,7 +102,7 @@ static RAMFUNC int OutOfNDecoding(int bit)
                Uart.output[Uart.byteCnt] = Uart.bitBuffer & 0xFF;
                Uart.byteCnt++;
                Uart.swapper = 0;
-               if(Uart.byteCnt > 15) { return TRUE; }
+               if(Uart.byteCnt > 15) { return true; }
        }
        else {
                Uart.swapper = 1;
@@ -137,12 +139,12 @@ static RAMFUNC int OutOfNDecoding(int bit)
                                        Uart.highCnt = 0;
                                        if(Uart.byteCnt == 0) {
                                                // Its not straightforward to show single EOFs
-                                               // So just leave it and do not return TRUE
+                                               // So just leave it and do not return true
                                                Uart.output[0] = 0xf0;
                                                Uart.byteCnt++;
                                        }
                                        else {
-                                               return TRUE;
+                                               return true;
                                        }
                                }
                                else if(Uart.state != STATE_START_OF_COMMUNICATION) {
@@ -261,7 +263,7 @@ static RAMFUNC int OutOfNDecoding(int bit)
                                Uart.byteCnt++;
                                Uart.output[Uart.byteCnt] = 0xAA;
                                Uart.byteCnt++;
-                               return TRUE;
+                               return true;
                        }*/
                }
 
@@ -316,7 +318,7 @@ static RAMFUNC int OutOfNDecoding(int bit)
                }
        }
 
-    return FALSE;
+    return false;
 }
 
 //=============================================================================
@@ -369,7 +371,7 @@ static RAMFUNC int ManchesterDecoding(int v)
 
        if(Demod.buff < 3) {
                Demod.buff++;
-               return FALSE;
+               return false;
        }
 
        if(Demod.state==DEMOD_UNSYNCD) {
@@ -471,7 +473,7 @@ static RAMFUNC int ManchesterDecoding(int v)
                                        Demod.len++;
                                        Demod.state = DEMOD_UNSYNCD;
 //                                     error = 0x0f;
-                                       return TRUE;
+                                       return true;
                                }
                                else {
                                        Demod.state = DEMOD_ERROR_WAIT;
@@ -555,7 +557,7 @@ static RAMFUNC int ManchesterDecoding(int v)
                                                }
 
                                                Demod.state = DEMOD_UNSYNCD;
-                                               return TRUE;
+                                               return true;
                                        }
                                        else {
                                                Demod.output[Demod.len] = 0xad;
@@ -610,14 +612,14 @@ static RAMFUNC int ManchesterDecoding(int v)
                                Demod.len++;
                                Demod.output[Demod.len] = 0xBB;
                                Demod.len++;
-                               return TRUE;
+                               return true;
                        }
 
                }
 
        } // end (state != UNSYNCED)
 
-    return FALSE;
+    return false;
 }
 
 //=============================================================================
@@ -637,7 +639,7 @@ void RAMFUNC SnoopIClass(void)
     // We won't start recording the frames that we acquire until we trigger;
     // a good trigger condition to get started is probably when we see a
     // response from the tag.
-    //int triggered = FALSE; // FALSE to wait first for card
+    //int triggered = false; // false to wait first for card
 
     // The command (reader -> tag) that we're receiving.
        // The length of a received command will in most cases be no more than 18 bytes.
@@ -654,9 +656,9 @@ void RAMFUNC SnoopIClass(void)
     // The DMA buffer, used to stream samples from the FPGA
     uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
  
-       set_tracing(TRUE);
+       set_tracing(true);
        clear_trace();
-    iso14a_set_trigger(FALSE);
+    iso14a_set_trigger(false);
 
        int lastRxCounter;
     uint8_t *upTo;
@@ -674,7 +676,7 @@ void RAMFUNC SnoopIClass(void)
     Demod.state = DEMOD_UNSYNCD;
 
     // Setup for the DMA.
-    FpgaSetupSsc();
+    FpgaSetupSsc(FPGA_MAJOR_MODE_HF_ISO14443A);
     upTo = dmaBuf;
     lastRxCounter = DMA_BUFFER_SIZE;
     FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
@@ -747,14 +749,11 @@ void RAMFUNC SnoopIClass(void)
                        time_stop = (GetCountSspClk()-time_0) << 4;
                    LED_C_ON();
 
-                       //if(!LogTrace(Uart.output,Uart.byteCnt, rsamples, Uart.parityBits,TRUE)) break;
-                       //if(!LogTrace(NULL, 0, Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER, 0, TRUE)) break;
-                       if(tracing)     {
-                               uint8_t parity[MAX_PARITY_SIZE];
-                               GetParity(Uart.output, Uart.byteCnt, parity);
-                               LogTrace(Uart.output,Uart.byteCnt, time_start, time_stop, parity, TRUE);
-                       }
-
+                       //if(!LogTrace(Uart.output,Uart.byteCnt, rsamples, Uart.parityBits,true)) break;
+                       //if(!LogTrace(NULL, 0, Uart.endTime*16 - DELAY_READER_AIR2ARM_AS_SNIFFER, 0, true)) break;
+                       uint8_t parity[MAX_PARITY_SIZE];
+                       GetParity(Uart.output, Uart.byteCnt, parity);
+                       LogTrace(Uart.output,Uart.byteCnt, time_start, time_stop, parity, true);
 
                        /* And ready to receive another command. */
                    Uart.state = STATE_UNSYNCD;
@@ -777,11 +776,9 @@ void RAMFUNC SnoopIClass(void)
                        rsamples = samples - Demod.samples;
                    LED_B_ON();
 
-                       if(tracing)     {
-                               uint8_t parity[MAX_PARITY_SIZE];
-                               GetParity(Demod.output, Demod.len, parity);
-                               LogTrace(Demod.output, Demod.len, time_start, time_stop, parity, FALSE);
-                       }
+                       uint8_t parity[MAX_PARITY_SIZE];
+                       GetParity(Demod.output, Demod.len, parity);
+                       LogTrace(Demod.output, Demod.len, time_start, time_stop, parity, false);
 
                    // And ready to receive another response.
                    memset(&Demod, 0, sizeof(Demod));
@@ -828,7 +825,7 @@ void rotateCSN(uint8_t* originalCSN, uint8_t* rotatedCSN) {
 //-----------------------------------------------------------------------------
 // Wait for commands from reader
 // Stop when button is pressed
-// Or return TRUE when command is captured
+// Or return true when command is captured
 //-----------------------------------------------------------------------------
 static int GetIClassCommandFromReader(uint8_t *received, int *len, int maxLen)
 {
@@ -846,7 +843,7 @@ static int GetIClassCommandFromReader(uint8_t *received, int *len, int maxLen)
     for(;;) {
         WDT_HIT();
 
-        if(BUTTON_PRESS()) return FALSE;
+        if(BUTTON_PRESS()) return false;
 
         if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
             AT91C_BASE_SSC->SSC_THR = 0x00;
@@ -856,7 +853,7 @@ static int GetIClassCommandFromReader(uint8_t *received, int *len, int maxLen)
 
                        if(OutOfNDecoding(b & 0x0f)) {
                                *len = Uart.byteCnt;
-                               return TRUE;
+                               return true;
                        }
         }
     }
@@ -991,7 +988,7 @@ void SimulateIClass(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain
        FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
 
        // Enable and clear the trace
-       set_tracing(TRUE);
+       set_tracing(true);
        clear_trace();
        //Use the emulator memory for SIM
        uint8_t *emulator = BigBuf_get_EM_addr();
@@ -1161,7 +1158,7 @@ int doIClassSimulation( int simulationMode, uint8_t *reader_mac_buf)
        StartCountSspClk();
        // We need to listen to the high-frequency, peak-detected path.
        SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
-       FpgaSetupSsc();
+       FpgaSetupSsc(FPGA_MAJOR_MODE_HF_ISO14443A);
 
        // To control where we are in the protocol
        int cmdsRecvd = 0;
@@ -1320,20 +1317,17 @@ int doIClassSimulation( int simulationMode, uint8_t *reader_mac_buf)
                        t2r_time = GetCountSspClk();
                }
 
-               if (tracing) {
-                       uint8_t parity[MAX_PARITY_SIZE];
-                       GetParity(receivedCmd, len, parity);
-                       LogTrace(receivedCmd,len, (r2t_time-time_0)<< 4, (r2t_time-time_0) << 4, parity, TRUE);
-
-                       if (trace_data != NULL) {
-                               GetParity(trace_data, trace_data_size, parity);
-                               LogTrace(trace_data, trace_data_size, (t2r_time-time_0) << 4, (t2r_time-time_0) << 4, parity, FALSE);
-                       }
-                       if(!tracing) {
-                               DbpString("Trace full");
-                               //break;
-                       }
+               uint8_t parity[MAX_PARITY_SIZE];
+               GetParity(receivedCmd, len, parity);
+               LogTrace(receivedCmd,len, (r2t_time-time_0)<< 4, (r2t_time-time_0) << 4, parity, true);
 
+               if (trace_data != NULL) {
+                       GetParity(trace_data, trace_data_size, parity);
+                       LogTrace(trace_data, trace_data_size, (t2r_time-time_0) << 4, (t2r_time-time_0) << 4, parity, false);
+               }
+               if(!get_tracing()) {
+                       DbpString("Trace full");
+                       //break;
                }
        }
 
@@ -1358,7 +1352,7 @@ static int SendIClassAnswer(uint8_t *resp, int respLen, int delay)
        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_SIMULATOR|FPGA_HF_SIMULATOR_MODULATE_424K_8BIT);
 
        AT91C_BASE_SSC->SSC_THR = 0x00;
-       FpgaSetupSsc();
+       FpgaSetupSsc(FPGA_MAJOR_MODE_HF_SIMULATOR);
        while(!BUTTON_PRESS()) {
                if((AT91C_BASE_SSC->SSC_SR & AT91C_SSC_RXRDY)){
                        b = AT91C_BASE_SSC->SSC_RHR; (void) b;
@@ -1396,7 +1390,7 @@ static void TransmitIClassCommand(const uint8_t *cmd, int len, int *samples, int
   int c;
   FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
   AT91C_BASE_SSC->SSC_THR = 0x00;
-  FpgaSetupSsc();
+  FpgaSetupSsc(FPGA_MAJOR_MODE_HF_ISO14443A);
 
    if (wait)
    {
@@ -1418,7 +1412,7 @@ static void TransmitIClassCommand(const uint8_t *cmd, int len, int *samples, int
 
 
   uint8_t sendbyte;
-  bool firstpart = TRUE;
+  bool firstpart = true;
   c = 0;
   for(;;) {
     if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
@@ -1507,17 +1501,15 @@ void ReaderTransmitIClass(uint8_t* frame, int len)
                LED_A_ON();
 
        // Store reader command in buffer
-       if (tracing) {
-               uint8_t par[MAX_PARITY_SIZE];
-               GetParity(frame, len, par);
-               LogTrace(frame, len, rsamples, rsamples, par, TRUE);
-       }
+       uint8_t par[MAX_PARITY_SIZE];
+       GetParity(frame, len, par);
+       LogTrace(frame, len, rsamples, rsamples, par, true);
 }
 
 //-----------------------------------------------------------------------------
 // Wait a certain time for tag response
-//  If a response is captured return TRUE
-//  If it takes too long return FALSE
+//  If a response is captured return true
+//  If it takes too long return false
 //-----------------------------------------------------------------------------
 static int GetIClassAnswer(uint8_t *receivedResponse, int maxLen, int *samples, int *elapsed) //uint8_t *buffer
 {
@@ -1536,27 +1528,27 @@ static int GetIClassAnswer(uint8_t *receivedResponse, int maxLen, int *samples,
        uint8_t b;
        if (elapsed) *elapsed = 0;
 
-       bool skip = FALSE;
+       bool skip = false;
 
        c = 0;
        for(;;) {
                WDT_HIT();
 
-               if(BUTTON_PRESS()) return FALSE;
+               if(BUTTON_PRESS()) return false;
 
                if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
                        AT91C_BASE_SSC->SSC_THR = 0x00;  // To make use of exact timing of next command from reader!!
                        if (elapsed) (*elapsed)++;
                }
                if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) {
-                       if(c < timeout) { c++; } else { return FALSE; }
+                       if(c < timeout) { c++; } else { return false; }
                        b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
                        skip = !skip;
                        if(skip) continue;
                
                        if(ManchesterDecoding(b & 0x0f)) {
                                *samples = c << 3;
-                               return  TRUE;
+                               return  true;
                        }
                }
        }
@@ -1565,14 +1557,12 @@ static int GetIClassAnswer(uint8_t *receivedResponse, int maxLen, int *samples,
 int ReaderReceiveIClass(uint8_t* receivedAnswer)
 {
   int samples = 0;
-  if (!GetIClassAnswer(receivedAnswer,160,&samples,0)) return FALSE;
+  if (!GetIClassAnswer(receivedAnswer,160,&samples,0)) return false;
   rsamples += samples;
-  if (tracing) {
-       uint8_t parity[MAX_PARITY_SIZE];
-       GetParity(receivedAnswer, Demod.len, parity);
-       LogTrace(receivedAnswer,Demod.len,rsamples,rsamples,parity,FALSE);
-  }
-  if(samples == 0) return FALSE;
+  uint8_t parity[MAX_PARITY_SIZE];
+  GetParity(receivedAnswer, Demod.len, parity);
+  LogTrace(receivedAnswer,Demod.len,rsamples,rsamples,parity,false);
+  if(samples == 0) return false;
   return Demod.len;
 }
 
@@ -1580,11 +1570,11 @@ void setupIclassReader()
 {
     FpgaDownloadAndGo(FPGA_BITSTREAM_HF);
     // Reset trace buffer
-         set_tracing(TRUE);
+         set_tracing(true);
          clear_trace();
 
     // Setup SSC
-    FpgaSetupSsc();
+    FpgaSetupSsc(FPGA_MAJOR_MODE_HF_ISO14443A);
     // Start from off (no field generated)
     // Signal field is off with the appropriate LED
     LED_D_OFF();
@@ -1661,7 +1651,7 @@ uint8_t handshakeIclassTag_ext(uint8_t *card_data, bool use_credit_key)
        //Flag that we got to at least stage 1, read CSN
        read_status = 1;
 
-       // Card selected, now read e-purse (cc)
+       // Card selected, now read e-purse (cc) (only 8 bytes no CRC)
        ReaderTransmitIClass(readcheck_cc, sizeof(readcheck_cc));
        if(ReaderReceiveIClass(resp) == 8) {
                //Save CC (e-purse) in response data
@@ -1681,30 +1671,39 @@ void ReaderIClass(uint8_t arg0) {
 
        uint8_t card_data[6 * 8]={0};
        memset(card_data, 0xFF, sizeof(card_data));
-       uint8_t last_csn[8]={0};
-       
+       uint8_t last_csn[8]={0,0,0,0,0,0,0,0};
+       uint8_t resp[ICLASS_BUFFER_SIZE];
+       memset(resp, 0xFF, sizeof(resp));
        //Read conf block CRC(0x01) => 0xfa 0x22
        uint8_t readConf[] = { ICLASS_CMD_READ_OR_IDENTIFY,0x01, 0xfa, 0x22};
-       //Read conf block CRC(0x05) => 0xde  0x64
+       //Read App Issuer Area block CRC(0x05) => 0xde  0x64
        uint8_t readAA[] = { ICLASS_CMD_READ_OR_IDENTIFY,0x05, 0xde, 0x64};
 
-
        int read_status= 0;
        uint8_t result_status = 0;
+       // flag to read until one tag is found successfully
        bool abort_after_read = arg0 & FLAG_ICLASS_READER_ONLY_ONCE;
+       // flag to only try 5 times to find one tag then return
        bool try_once = arg0 & FLAG_ICLASS_READER_ONE_TRY;
-       bool use_credit_key = false;
-       if (arg0 & FLAG_ICLASS_READER_CEDITKEY)
-               use_credit_key = true;
-       set_tracing(TRUE);
+       // if neither abort_after_read nor try_once then continue reading until button pressed.
+
+       bool use_credit_key = arg0 & FLAG_ICLASS_READER_CEDITKEY;
+       // test flags for what blocks to be sure to read
+       uint8_t flagReadConfig = arg0 & FLAG_ICLASS_READER_CONF;
+       uint8_t flagReadCC = arg0 & FLAG_ICLASS_READER_CC;
+       uint8_t flagReadAA = arg0 & FLAG_ICLASS_READER_AA;
+
+       set_tracing(true);
        setupIclassReader();
 
        uint16_t tryCnt=0;
-       while(!BUTTON_PRESS())
+       bool userCancelled = BUTTON_PRESS() || usb_poll_validate_length();
+       while(!userCancelled)
        {
-               if (try_once && tryCnt > 5) break; 
+               // if only looking for one card try 2 times if we missed it the first time
+               if (try_once && tryCnt > 2) break; 
                tryCnt++;
-               if(!tracing) {
+               if(!get_tracing()) {
                        DbpString("Trace full");
                        break;
                }
@@ -1721,21 +1720,22 @@ void ReaderIClass(uint8_t arg0) {
                // moving CC forward 8 bytes
                memcpy(card_data+16,card_data+8, 8);
                //Read block 1, config
-               if(arg0 & FLAG_ICLASS_READER_CONF)
-               {
-                       if(sendCmdGetResponseWithRetries(readConf, sizeof(readConf),card_data+8, 10, 10))
+               if(flagReadConfig) {
+                       if(sendCmdGetResponseWithRetries(readConf, sizeof(readConf), resp, 10, 10))
                        {
                                result_status |= FLAG_ICLASS_READER_CONF;
+                               memcpy(card_data+8, resp, 8);
                        } else {
                                Dbprintf("Failed to dump config block");
                        }
                }
 
                //Read block 5, AA
-               if(arg0 & FLAG_ICLASS_READER_AA){
-                       if(sendCmdGetResponseWithRetries(readAA, sizeof(readAA),card_data+(8*4), 10, 10))
+               if(flagReadAA) {
+                       if(sendCmdGetResponseWithRetries(readAA, sizeof(readAA), resp, 10, 10))
                        {
                                result_status |= FLAG_ICLASS_READER_AA;
+                               memcpy(card_data+(8*5), resp, 8);
                        } else {
                                //Dbprintf("Failed to dump AA block");
                        }
@@ -1747,19 +1747,20 @@ void ReaderIClass(uint8_t arg0) {
                // (3,4 write-only, kc and kd)
                // 5 Application issuer area
                //
-               //Then we can 'ship' back the 8 * 5 bytes of data,
+               //Then we can 'ship' back the 8 * 6 bytes of data,
                // with 0xFF:s in block 3 and 4.
 
                LED_B_ON();
-               //Send back to client, but don't bother if we already sent this
+               //Send back to client, but don't bother if we already sent this - 
+               //  only useful if looping in arm (not try_once && not abort_after_read)
                if(memcmp(last_csn, card_data, 8) != 0)
                {
-                       // If caller requires that we get CC, continue until we got it
-                       if( (arg0 & read_status & FLAG_ICLASS_READER_CC) || !(arg0 & FLAG_ICLASS_READER_CC))
-                       {
+                       // If caller requires that we get Conf, CC, AA, continue until we got it
+                       if( (result_status ^ FLAG_ICLASS_READER_CSN ^ flagReadConfig ^ flagReadCC ^ flagReadAA) == 0) {
                                cmd_send(CMD_ACK,result_status,0,0,card_data,sizeof(card_data));
                                if(abort_after_read) {
                                        LED_A_OFF();
+                                       LED_B_OFF();
                                        return;
                                }
                                //Save that we already sent this....
@@ -1768,8 +1769,13 @@ void ReaderIClass(uint8_t arg0) {
 
                }
                LED_B_OFF();
+               userCancelled = BUTTON_PRESS() || usb_poll_validate_length();
+       }
+       if (userCancelled) {
+               cmd_send(CMD_ACK,0xFF,0,0,card_data, 0);
+       } else {
+               cmd_send(CMD_ACK,0,0,0,card_data, 0);
        }
-       cmd_send(CMD_ACK,0,0,0,card_data, 0);
        LED_A_OFF();
 }
 
@@ -1804,13 +1810,13 @@ void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
        uint8_t resp[ICLASS_BUFFER_SIZE];
        
     setupIclassReader();
-       set_tracing(TRUE);
+       set_tracing(true);
 
        while(!BUTTON_PRESS()) {
        
                WDT_HIT();
 
-               if(!tracing) {
+               if(!get_tracing()) {
                        DbpString("Trace full");
                        break;
                }
Impressum, Datenschutz