started fixing the paritiy == 0 special attack against chinese clones with bad prng...

[proxmark3-svn] / armsrc / hitag2.c

diff --git a/armsrc/hitag2.c b/armsrc/hitag2.c
index aef28e788a6226eb0d0aa25b02cf91885dd71ada..4596d3f17cfc6005dc58520537b37ff7b8125d05 100644 (file)
--- a/armsrc/hitag2.c
+++ b/armsrc/hitag2.c
@@ -712,7 +712,10 @@ void SnoopHitag(uint32_t type) {
        size_t rxlen=0;
        
        FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
-
+       
+       // free eventually allocated BigBuf memory
+       BigBuf_free(); BigBuf_Clear_ext(false);
+       
        // Clean up trace and prepare it for storing frames
        clear_trace();
        set_tracing(TRUE);
@@ -720,7 +723,6 @@ void SnoopHitag(uint32_t type) {
        auth_table_len = 0;
        auth_table_pos = 0;
 
-       BigBuf_free();
     auth_table = (byte_t *)BigBuf_malloc(AUTH_TABLE_LENGTH);
        memset(auth_table, 0x00, AUTH_TABLE_LENGTH);
        
@@ -927,6 +929,9 @@ void SimulateHitagTag(bool tag_mem_supplied, byte_t* data) {
        
        FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
 
+       // free eventually allocated BigBuf memory
+       BigBuf_free(); BigBuf_Clear_ext(false);
+
        // Clean up trace and prepare it for storing frames
        clear_trace();
        set_tracing(TRUE);
@@ -934,7 +939,7 @@ void SimulateHitagTag(bool tag_mem_supplied, byte_t* data) {
        auth_table_len = 0;
        auth_table_pos = 0;
     byte_t* auth_table;
-       BigBuf_free();
+
     auth_table = (byte_t *)BigBuf_malloc(AUTH_TABLE_LENGTH);
        memset(auth_table, 0x00, AUTH_TABLE_LENGTH);
 
@@ -1149,7 +1154,7 @@ void ReaderHitag(hitag_function htf, hitag_data* htd) {
       
                case RHT2F_CRYPTO: {
                        DbpString("Authenticating using key:");
-                       memcpy(key,htd->crypto.key,4);    //HACK; 4 or 6??  I read both in the code.
+                       memcpy(key,htd->crypto.key,6);    //HACK; 4 or 6??  I read both in the code.
                        Dbhexdump(6,key,false);
                        blocknr = 0;
                        bQuiet = false;