cvs.zerfleddert.de Git - proxmark3-svn/blobdiff

index a7102168e09d75522e1e35ac02526136a464a57d..5c7367a15e634ae035bdf2af4f26470a75df216c 100644 (file)

--- a/armsrc/iso14443a.c

+++ b/armsrc/iso14443a.c

@@ -141,16 +141,40 @@ const uint8_t OddByteParity[256] = {

1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1

};

1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1

};

void iso14a_set_trigger(bool enable) {

trigger = enable;

}

void iso14a_set_trigger(bool enable) {

trigger = enable;

}

void iso14a_set_timeout(uint32_t timeout) {

iso14a_timeout = timeout;

void iso14a_set_timeout(uint32_t timeout) {

iso14a_timeout = timeout;

+ if(MF_DBGLEVEL >= 3) Dbprintf("ISO14443A Timeout set to %ld (%dms)", iso14a_timeout, iso14a_timeout / 106);

}

+void iso14a_set_ATS_timeout(uint8_t *ats) {

+ uint8_t tb1;

+ uint8_t fwi;

+ uint32_t fwt;

+ if (ats[0] > 1) { // there is a format byte T0

+ if ((ats[1] & 0x20) == 0x20) { // there is an interface byte TB(1)

+ if ((ats[1] & 0x10) == 0x10) { // there is an interface byte TA(1) preceding TB(1)

+ tb1 = ats[3];

+ } else {

+ tb1 = ats[2];

+ }

+ fwi = (tb1 & 0xf0) >> 4; // frame waiting indicator (FWI)

+ fwt = 256 * 16 * (1 << fwi); // frame waiting time (FWT) in 1/fc

+ iso14a_set_timeout(fwt/(8*16));

+ }

//-----------------------------------------------------------------------------

// Generate the parity value for a byte sequence

//-----------------------------------------------------------------------------

// Generate the parity value for a byte sequence

@@ -527,12 +551,8 @@ void RAMFUNC SnoopIso14443a(uint8_t param) {

LEDsoff();

- // We won't start recording the frames that we acquire until we trigger;

- // a good trigger condition to get started is probably when we see a

- // response from the tag.

- // triggered == FALSE -- to wait first for card

- bool triggered = !(param & 0x03);

+ iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);

// Allocate memory from BigBuf for some buffers

// free all previous allocations first

BigBuf_free();

// Allocate memory from BigBuf for some buffers

// free all previous allocations first

BigBuf_free();

@@ -559,8 +579,6 @@ void RAMFUNC SnoopIso14443a(uint8_t param) {

bool TagIsActive = FALSE;

bool ReaderIsActive = FALSE;

bool TagIsActive = FALSE;

bool ReaderIsActive = FALSE;

- iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);

// Set up the demodulator for tag -> reader responses.

DemodInit(receivedResponse, receivedResponsePar);

// Set up the demodulator for tag -> reader responses.

DemodInit(receivedResponse, receivedResponsePar);

@@ -570,6 +588,12 @@ void RAMFUNC SnoopIso14443a(uint8_t param) {

// Setup and start DMA.

FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);

// Setup and start DMA.

FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);

+ // We won't start recording the frames that we acquire until we trigger;

+ // a good trigger condition to get started is probably when we see a

+ // response from the tag.

+ // triggered == FALSE -- to wait first for card

+ bool triggered = !(param & 0x03);

// And now we loop, receiving samples.

for(uint32_t rsamples = 0; TRUE; ) {

// And now we loop, receiving samples.

for(uint32_t rsamples = 0; TRUE; ) {

@@ -1002,6 +1026,9 @@ void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)

.modulation_n = 0

};

.modulation_n = 0

};

+ // We need to listen to the high-frequency, peak-detected path.

+ iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);

BigBuf_free_keep_EM();

// allocate buffers:

BigBuf_free_keep_EM();

// allocate buffers:

@@ -1030,9 +1057,6 @@ void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)

int happened2 = 0;

int cmdsRecvd = 0;

int happened2 = 0;

int cmdsRecvd = 0;

- // We need to listen to the high-frequency, peak-detected path.

- iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);

cmdsRecvd = 0;

tag_response_info_t* p_response;

cmdsRecvd = 0;

tag_response_info_t* p_response;

@@ -1600,7 +1624,7 @@ static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, uint8_t *receive

if(ManchesterDecoding(b, offset, 0)) {

NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);

return TRUE;

if(ManchesterDecoding(b, offset, 0)) {

NextTransferTime = MAX(NextTransferTime, Demod.endTime - (DELAY_AIR2ARM_AS_READER + DELAY_ARM2AIR_AS_READER)/16 + FRAME_DELAY_TIME_PICC_TO_PCD);

return TRUE;

- } else if (c++ > iso14a_timeout) {

+ } else if (c++ > iso14a_timeout && Demod.state == DEMOD_UNSYNCD) {

return FALSE;

}

return FALSE;

}

@@ -1798,6 +1822,10 @@ int iso14443a_select_card(byte_t *uid_ptr, iso14a_card_select_t *p_hi14a_card, u

// reset the PCB block number

iso14_pcb_blocknum = 0;

// reset the PCB block number

iso14_pcb_blocknum = 0;

+ // set default timeout based on ATS

+ iso14a_set_ATS_timeout(resp);

return 1;

}

return 1;

}

@@ -1862,8 +1890,9 @@ void ReaderIso14443a(UsbCommand *c)

{

iso14a_command_t param = c->arg[0];

uint8_t *cmd = c->d.asBytes;

{

iso14a_command_t param = c->arg[0];

uint8_t *cmd = c->d.asBytes;

- size_t len = c->arg[1];

- size_t lenbits = c->arg[2];

+ size_t len = c->arg[1] & 0xffff;

+ size_t lenbits = c->arg[1] >> 16;

+ uint32_t timeout = c->arg[2];

uint32_t arg0 = 0;

byte_t buf[USB_CMD_DATA_SIZE];

uint8_t par[MAX_PARITY_SIZE];

uint32_t arg0 = 0;

byte_t buf[USB_CMD_DATA_SIZE];

uint8_t par[MAX_PARITY_SIZE];

@@ -1888,7 +1917,7 @@ void ReaderIso14443a(UsbCommand *c)

}

if(param & ISO14A_SET_TIMEOUT) {

}

if(param & ISO14A_SET_TIMEOUT) {

- iso14a_set_timeout(c->arg[2]);

+ iso14a_set_timeout(timeout);

}

if(param & ISO14A_APDU) {

}

if(param & ISO14A_APDU) {

@@ -1942,7 +1971,7 @@ int32_t dist_nt(uint32_t nt1, uint32_t nt2) {

nttmp1 = prng_successor(nttmp1, 1);

if (nttmp1 == nt2) return i;

nttmp2 = prng_successor(nttmp2, 1);

nttmp1 = prng_successor(nttmp1, 1);

if (nttmp1 == nt2) return i;

nttmp2 = prng_successor(nttmp2, 1);

- if (nttmp2 == nt1) return -i;

+ if (nttmp2 == nt1) return -i;

}

return(-99999); // either nt1 or nt2 are invalid nonces

}

return(-99999); // either nt1 or nt2 are invalid nonces

@@ -1965,6 +1994,10 @@ void ReaderMifare(bool first_try)

uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];

uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];

uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];

uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];

+ if (first_try) {

+ iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);

+ }

// free eventually allocated BigBuf memory. We want all for tracing.

BigBuf_free();

// free eventually allocated BigBuf memory. We want all for tracing.

BigBuf_free();

@@ -1993,7 +2026,6 @@ void ReaderMifare(bool first_try)

if (first_try) {

mf_nr_ar3 = 0;

if (first_try) {

mf_nr_ar3 = 0;

- iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);

sync_time = GetCountSspClk() & 0xfffffff8;

sync_cycles = 65536; // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).

nt_attacked = 0;

sync_time = GetCountSspClk() & 0xfffffff8;

sync_cycles = 65536; // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).

nt_attacked = 0;

@@ -2011,18 +2043,21 @@ void ReaderMifare(bool first_try)

LED_B_OFF();

LED_C_OFF();

LED_B_OFF();

LED_C_OFF();

+ #define DARKSIDE_MAX_TRIES 32 // number of tries to sync on PRNG cycle. Then give up.

+ uint16_t unsuccessfull_tries = 0;

for(uint16_t i = 0; TRUE; i++) {

+ LED_C_ON();

WDT_HIT();

// Test if the action was cancelled

if(BUTTON_PRESS()) {

WDT_HIT();

// Test if the action was cancelled

if(BUTTON_PRESS()) {

+ isOK = -1;

break;

}

break;

}

- LED_C_ON();

if(!iso14443a_select_card(uid, NULL, &cuid)) {

if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Can't select card");

continue;

if(!iso14443a_select_card(uid, NULL, &cuid)) {

if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Can't select card");

continue;

@@ -2057,8 +2092,14 @@ void ReaderMifare(bool first_try)

nt_attacked = nt;

}

else {

nt_attacked = nt;

}

else {

- if (nt_distance == -99999) { // invalid nonce received, try again

- continue;

+ if (nt_distance == -99999) { // invalid nonce received

+ unsuccessfull_tries++;

+ if (!nt_attacked && unsuccessfull_tries > DARKSIDE_MAX_TRIES) {

+ isOK = -3; // Card has an unpredictable PRNG. Give up

+ break;

+ } else {

+ continue; // continue trying...

+ }

}

sync_cycles = (sync_cycles - nt_distance);

if (MF_DBGLEVEL >= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);

}

sync_cycles = (sync_cycles - nt_distance);

if (MF_DBGLEVEL >= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);

@@ -2120,6 +2161,10 @@ void ReaderMifare(bool first_try)

if (nt_diff == 0 && first_try)

{

par[0]++;

if (nt_diff == 0 && first_try)

{

par[0]++;

+ if (par[0] == 0x00) { // tried all 256 possible parities without success. Card doesn't send NACK.

+ isOK = -2;

+ break;

+ }

} else {

par[0] = ((par[0] & 0x1F) + 1) | par_low;

}

} else {

par[0] = ((par[0] & 0x1F) + 1) | par_low;

}

@@ -2136,7 +2181,7 @@ void ReaderMifare(bool first_try)

memcpy(buf + 16, ks_list, 8);

memcpy(buf + 24, mf_nr_ar, 4);

memcpy(buf + 16, ks_list, 8);

memcpy(buf + 24, mf_nr_ar, 4);

- cmd_send(CMD_ACK,isOK,0,0,buf,28);

+ cmd_send(CMD_ACK, isOK, 0, 0, buf, 28);

// Thats it...

FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

// Thats it...

FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);

@@ -2197,13 +2242,6 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *

uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0};

uint8_t ar_nr_collected = 0;

uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0};

uint8_t ar_nr_collected = 0;

- // free eventually allocated BigBuf memory but keep Emulator Memory

- BigBuf_free_keep_EM();

- // clear trace

- clear_trace();

- set_tracing(TRUE);

// Authenticate response - nonce

uint32_t nonce = bytes_to_num(rAUTH_NT, 4);

// Authenticate response - nonce

uint32_t nonce = bytes_to_num(rAUTH_NT, 4);

@@ -2241,13 +2279,10 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *

if (_7BUID) {

rATQA[0] = 0x44;

rUIDBCC1[0] = 0x88;

if (_7BUID) {

rATQA[0] = 0x44;

rUIDBCC1[0] = 0x88;

+ rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];

rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];

}

rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];

}

- // We need to listen to the high-frequency, peak-detected path.

- iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);

if (MF_DBGLEVEL >= 1) {

if (!_7BUID) {

Dbprintf("4B UID: %02x%02x%02x%02x",

if (MF_DBGLEVEL >= 1) {

if (!_7BUID) {

Dbprintf("4B UID: %02x%02x%02x%02x",

@@ -2259,6 +2294,17 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *

}

+ // We need to listen to the high-frequency, peak-detected path.

+ iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);

+ // free eventually allocated BigBuf memory but keep Emulator Memory

+ BigBuf_free_keep_EM();

+ // clear trace

+ clear_trace();

+ set_tracing(TRUE);

bool finished = FALSE;

while (!BUTTON_PRESS() && !finished) {

WDT_HIT();

bool finished = FALSE;

while (!BUTTON_PRESS() && !finished) {

WDT_HIT();

@@ -2480,13 +2526,13 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *

|| receivedCmd[0] == 0xB0) { // transfer

if (receivedCmd[1] >= 16 * 4) {

EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));

|| receivedCmd[0] == 0xB0) { // transfer

if (receivedCmd[1] >= 16 * 4) {

EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));

- if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02) on out of range block: %d (0x%02x), nacking",receivedCmd[0],receivedCmd[1],receivedCmd[1]);

+ if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02x) on out of range block: %d (0x%02x), nacking",receivedCmd[0],receivedCmd[1],receivedCmd[1]);

break;

}

if (receivedCmd[1] / 4 != cardAUTHSC) {

EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));

break;

}

if (receivedCmd[1] / 4 != cardAUTHSC) {

EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));

- if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd[0],receivedCmd[1],cardAUTHSC);

+ if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02x) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd[0],receivedCmd[1],cardAUTHSC);

break;

}

break;

}

@@ -2677,10 +2723,8 @@ void RAMFUNC SniffMifare(uint8_t param) {

uint8_t receivedResponse[MAX_MIFARE_FRAME_SIZE];

uint8_t receivedResponsePar[MAX_MIFARE_PARITY_SIZE];

uint8_t receivedResponse[MAX_MIFARE_FRAME_SIZE];

uint8_t receivedResponsePar[MAX_MIFARE_PARITY_SIZE];

- // As we receive stuff, we copy it from receivedCmd or receivedResponse

- // into trace, along with its length and other annotations.

- //uint8_t *trace = (uint8_t *)BigBuf;

+ iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);

// free eventually allocated BigBuf memory

BigBuf_free();

// allocate the DMA buffer, used to stream samples from the FPGA

// free eventually allocated BigBuf memory

BigBuf_free();

// allocate the DMA buffer, used to stream samples from the FPGA

@@ -2692,8 +2736,6 @@ void RAMFUNC SniffMifare(uint8_t param) {

bool ReaderIsActive = FALSE;

bool TagIsActive = FALSE;

bool ReaderIsActive = FALSE;

bool TagIsActive = FALSE;

- iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);

// Set up the demodulator for tag -> reader responses.

DemodInit(receivedResponse, receivedResponsePar);

// Set up the demodulator for tag -> reader responses.

DemodInit(receivedResponse, receivedResponsePar);