- while(!exitLoop) {
-
- LED_B_OFF();
- //Signal tracer
- // Can be used to get a trigger for an oscilloscope..
- LED_C_OFF();
-
- if(!GetIClassCommandFromReader(receivedCmd, &len, 100)) {
- buttonPressed = true;
- break;
- }
- r2t_time = GetCountSspClk();
- //Signal tracer
- LED_C_ON();
-
- // Okay, look at the command now.
- if(receivedCmd[0] == ICLASS_CMD_ACTALL ) {
- // Reader in anticollission phase
- modulated_response = resp_sof; modulated_response_size = resp_sof_Len; //order = 1;
- trace_data = sof_data;
- trace_data_size = sizeof(sof_data);
- } else if(receivedCmd[0] == ICLASS_CMD_READ_OR_IDENTIFY && len == 1) {
- // Reader asks for anticollission CSN
- modulated_response = resp_anticoll; modulated_response_size = resp_anticoll_len; //order = 2;
- trace_data = anticoll_data;
- trace_data_size = sizeof(anticoll_data);
- //DbpString("Reader requests anticollission CSN:");
- } else if(receivedCmd[0] == ICLASS_CMD_SELECT) {
- // Reader selects anticollission CSN.
- // Tag sends the corresponding real CSN
- modulated_response = resp_csn; modulated_response_size = resp_csn_len; //order = 3;
- trace_data = csn_data;
- trace_data_size = sizeof(csn_data);
- //DbpString("Reader selects anticollission CSN:");
- } else if(receivedCmd[0] == ICLASS_CMD_READCHECK_KD) {
- // Read e-purse (88 02)
- modulated_response = resp_cc; modulated_response_size = resp_cc_len; //order = 4;
- trace_data = card_challenge_data;
- trace_data_size = sizeof(card_challenge_data);
- LED_B_ON();
- } else if(receivedCmd[0] == ICLASS_CMD_CHECK) {
- // Reader random and reader MAC!!!
- if(simulationMode == MODE_FULLSIM)
- { //This is what we must do..
- //Reader just sent us NR and MAC(k,cc * nr)
- //The diversified key should be stored on block 3
- //However, from a typical dump, the key will not be there
- uint8_t diversified_key[8] = { 0 };
-
- //Get the diversified key from emulator memory
- memcpy(diversified_key, emulator+(8*3),8);
- uint8_t ccnr[12] = { 0 };
- //Put our cc there (block 2)
- memcpy(ccnr, emulator + (8 * 2), 8);
- //Put nr there
- memcpy(ccnr+8, receivedCmd+1,4);
- //Now, calc MAC
- opt_doMAC(ccnr,diversified_key, data_generic_trace);
- trace_data = data_generic_trace;
- trace_data_size = 4;
- CodeIClassTagAnswer(trace_data , trace_data_size);
- memcpy(data_response, ToSend, ToSendMax);
- modulated_response = data_response;
- modulated_response_size = ToSendMax;
- //exitLoop = true;
- }else
- { //Not fullsim, we don't respond
- // We do not know what to answer, so lets keep quiet
- modulated_response = resp_sof; modulated_response_size = 0;
- trace_data = NULL;
- trace_data_size = 0;
- if (simulationMode == MODE_EXIT_AFTER_MAC){
- // dbprintf:ing ...
- Dbprintf("CSN: %02x %02x %02x %02x %02x %02x %02x %02x"
- ,csn[0],csn[1],csn[2],csn[3],csn[4],csn[5],csn[6],csn[7]);
- Dbprintf("RDR: (len=%02d): %02x %02x %02x %02x %02x %02x %02x %02x %02x",len,
- receivedCmd[0], receivedCmd[1], receivedCmd[2],
- receivedCmd[3], receivedCmd[4], receivedCmd[5],
- receivedCmd[6], receivedCmd[7], receivedCmd[8]);
- if (reader_mac_buf != NULL)
- {
- memcpy(reader_mac_buf,receivedCmd+1,8);
- }
- exitLoop = true;
- }
- }
-
- } else if(receivedCmd[0] == ICLASS_CMD_HALT && len == 1) {
- // Reader ends the session
- modulated_response = resp_sof; modulated_response_size = 0; //order = 0;
- trace_data = NULL;
- trace_data_size = 0;
- } else if(simulationMode == MODE_FULLSIM && receivedCmd[0] == ICLASS_CMD_READ_OR_IDENTIFY && len == 4){
- //Read block
- uint16_t blk = receivedCmd[1];
- trace_data = emulator+(blk << 3);
- trace_data_size = 8;
- CodeIClassTagAnswer(trace_data , trace_data_size);
- memcpy(data_response, ToSend, ToSendMax);
- modulated_response = data_response;
- modulated_response_size = ToSendMax;
- }
- else if(receivedCmd[0] == ICLASS_CMD_PAGESEL)
- {//Pagesel
- //Pagesel enables to select a page in the selected chip memory and return its configuration block
- //Chips with a single page will not answer to this command
- // It appears we're fine ignoring this.
- //Otherwise, we should answer 8bytes (block) + 2bytes CRC
- }
- else {
- //#db# Unknown command received from reader (len=5): 26 1 0 f6 a 44 44 44 44
- // Never seen this command before
- Dbprintf("Unknown command received from reader (len=%d): %x %x %x %x %x %x %x %x %x",
- len,
- receivedCmd[0], receivedCmd[1], receivedCmd[2],
- receivedCmd[3], receivedCmd[4], receivedCmd[5],
- receivedCmd[6], receivedCmd[7], receivedCmd[8]);
- // Do not respond
- modulated_response = resp_sof; modulated_response_size = 0; //order = 0;
- trace_data = NULL;
- trace_data_size = 0;
- }
-
- if(cmdsRecvd > 100) {
- //DbpString("100 commands later...");
- //break;
- }
- else {
- cmdsRecvd++;
- }
- /**
- A legit tag has about 380us delay between reader EOT and tag SOF.
- **/
- if(modulated_response_size > 0) {
- SendIClassAnswer(modulated_response, modulated_response_size, 1);
- t2r_time = GetCountSspClk();
- }
-
- if (tracing) {
- uint8_t parity[MAX_PARITY_SIZE];
- GetParity(receivedCmd, len, parity);
- LogTrace(receivedCmd,len, (r2t_time-time_0)<< 4, (r2t_time-time_0) << 4, parity, TRUE);
projects / proxmark3-svn / blobdiff