CHG: some minor changes in the ouput from hf 14b raw.

[proxmark3-svn] / armsrc / iso14443a.c

diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index 9f2b6d9477d14764cf88a0c07f01f68d16b39974..9b7efaf6834bb5e4e98b4ca72be5470348c35607 100644 (file)
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -568,11 +568,8 @@ void RAMFUNC SniffIso14443a(uint8_t param) {
        
        LEDsoff();
 
        
        LEDsoff();
 

-       // We won't start recording the frames that we acquire until we trigger;
-       // a good trigger condition to get started is probably when we see a
-       // response from the tag.
-       // triggered == FALSE -- to wait first for card
-       bool triggered = !(param & 0x03); 
+
+       iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);

        
        // Allocate memory from BigBuf for some buffers
        // free all previous allocations first
        
        // Allocate memory from BigBuf for some buffers
        // free all previous allocations first


@@ -600,8 +597,6 @@ void RAMFUNC SniffIso14443a(uint8_t param) {
        bool TagIsActive = FALSE;
        bool ReaderIsActive = FALSE;
        
        bool TagIsActive = FALSE;
        bool ReaderIsActive = FALSE;
        

-       iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
-

        // Set up the demodulator for tag -> reader responses.
        DemodInit(receivedResponse, receivedResponsePar);
        
        // Set up the demodulator for tag -> reader responses.
        DemodInit(receivedResponse, receivedResponsePar);
        


@@ -611,6 +606,12 @@ void RAMFUNC SniffIso14443a(uint8_t param) {
        // Setup and start DMA.
        FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
        
        // Setup and start DMA.
        FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
        

+       // We won't start recording the frames that we acquire until we trigger;
+       // a good trigger condition to get started is probably when we see a
+       // response from the tag.
+       // triggered == FALSE -- to wait first for card
+       bool triggered = !(param & 0x03); 
+       

        // And now we loop, receiving samples.
        for(uint32_t rsamples = 0; TRUE; ) {
 
        // And now we loop, receiving samples.
        for(uint32_t rsamples = 0; TRUE; ) {
 


@@ -673,7 +674,6 @@ void RAMFUNC SniffIso14443a(uint8_t param) {
                                        }
                                        /* And ready to receive another command. */
                                        UartReset();
                                        }
                                        /* And ready to receive another command. */
                                        UartReset();

-                                       //UartInit(receivedCmd, receivedCmdPar);

                                        /* And also reset the demod code, which might have been */
                                        /* false-triggered by the commands from the reader. */
                                        DemodReset();
                                        /* And also reset the demod code, which might have been */
                                        /* false-triggered by the commands from the reader. */
                                        DemodReset();


@@ -1092,6 +1092,9 @@ void SimulateIso14443aTag(int tagType, int flags, int uid_2nd, byte_t* data)
                .modulation_n = 0
        };
   
                .modulation_n = 0
        };
   

+       // We need to listen to the high-frequency, peak-detected path.
+       iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
+

        BigBuf_free_keep_EM();
 
        // allocate buffers:
        BigBuf_free_keep_EM();
 
        // allocate buffers:


@@ -1120,9 +1123,6 @@ void SimulateIso14443aTag(int tagType, int flags, int uid_2nd, byte_t* data)
        int happened2 = 0;
        int cmdsRecvd = 0;
 
        int happened2 = 0;
        int cmdsRecvd = 0;
 

-       // We need to listen to the high-frequency, peak-detected path.
-       iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
-

        cmdsRecvd = 0;
        tag_response_info_t* p_response;
 
        cmdsRecvd = 0;
        tag_response_info_t* p_response;
 


@@ -1685,9 +1685,7 @@ static int EmSendCmd14443aRaw(uint8_t *resp, uint16_t respLen, bool correctionNe
                        FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
                }
        
                        FpgaSendQueueDelay = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
                }
        

-               if(BUTTON_PRESS()) {
-                       break;
-               }
+               if(BUTTON_PRESS()) break;

        }
 
        // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:
        }
 
        // Ensure that the FPGA Delay Queue is empty before we switch to TAGSIM_LISTEN again:


@@ -2177,11 +2175,13 @@ void ReaderIso14443a(UsbCommand *c)
 // Therefore try in alternating directions.
 int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
 
 // Therefore try in alternating directions.
 int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
 

+       uint16_t i;
+       uint32_t nttmp1, nttmp2;
+

        if (nt1 == nt2) return 0;
 
        if (nt1 == nt2) return 0;
 

-       uint16_t i;
-       uint32_t nttmp1 = nt1;
-       uint32_t nttmp2 = nt2;
+       nttmp1 = nt1;
+       nttmp2 = nt2;

        
        for (i = 1; i < 32768; i++) {
                nttmp1 = prng_successor(nttmp1, 1);
        
        for (i = 1; i < 32768; i++) {
                nttmp1 = prng_successor(nttmp1, 1);


@@ -2200,27 +2200,32 @@ int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
 // Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
 // (article by Nicolas T. Courtois, 2009)
 //-----------------------------------------------------------------------------
 // Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
 // (article by Nicolas T. Courtois, 2009)
 //-----------------------------------------------------------------------------

-void ReaderMifare(bool first_try) {
+void ReaderMifare(bool first_try)
+{
+       // Mifare AUTH
+       uint8_t mf_auth[]    = { 0x60,0x00,0xf5,0x7b };
+       uint8_t mf_nr_ar[]   = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
+       static uint8_t mf_nr_ar3;
+
+       uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
+       uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
+
+       if (first_try) { 
+               iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
+       }
+       

        // free eventually allocated BigBuf memory. We want all for tracing.
        BigBuf_free();
        
        clear_trace();
        set_tracing(TRUE);
 
        // free eventually allocated BigBuf memory. We want all for tracing.
        BigBuf_free();
        
        clear_trace();
        set_tracing(TRUE);
 

-       // Mifare AUTH
-       uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
-       uint8_t mf_nr_ar[8] = { 0x00 }; //{ 0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01 };
-       static uint8_t mf_nr_ar3 = 0;
-
-       uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE] = { 0x00 };
-       uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE] = { 0x00 };
-

        byte_t nt_diff = 0;
        uint8_t par[1] = {0};   // maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
        static byte_t par_low = 0;
        bool led_on = TRUE;
        byte_t nt_diff = 0;
        uint8_t par[1] = {0};   // maximum 8 Bytes to be sent here, 1 byte parity is therefore enough
        static byte_t par_low = 0;
        bool led_on = TRUE;

-       uint8_t uid[10] = {0x00};
-       //uint32_t cuid = 0x00;
+       uint8_t uid[10]  ={0};
+       uint32_t cuid;

 
        uint32_t nt = 0;
        uint32_t previous_nt = 0;
 
        uint32_t nt = 0;
        uint32_t previous_nt = 0;


@@ -2235,11 +2240,8 @@ void ReaderMifare(bool first_try) {
        uint16_t consecutive_resyncs = 0;
        int isOK = 0;
 
        uint16_t consecutive_resyncs = 0;
        int isOK = 0;
 

-       int numWrongDistance = 0;
-       

        if (first_try) { 
                mf_nr_ar3 = 0;
        if (first_try) { 
                mf_nr_ar3 = 0;

-               iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);

                sync_time = GetCountSspClk() & 0xfffffff8;
                sync_cycles = 65536;                                                                    // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
                nt_attacked = 0;
                sync_time = GetCountSspClk() & 0xfffffff8;
                sync_cycles = 65536;                                                                    // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
                nt_attacked = 0;


@@ -2256,22 +2258,23 @@ void ReaderMifare(bool first_try) {
        LED_A_ON();
        LED_B_OFF();
        LED_C_OFF();
        LED_A_ON();
        LED_B_OFF();
        LED_C_OFF();

-       LED_C_ON();     
+       
+
+       #define DARKSIDE_MAX_TRIES      32              // number of tries to sync on PRNG cycle. Then give up.
+       uint16_t unsuccessfull_tries = 0;

   
        for(uint16_t i = 0; TRUE; i++) {
                
   
        for(uint16_t i = 0; TRUE; i++) {
                

+               LED_C_ON();

                WDT_HIT();
 
                // Test if the action was cancelled
                WDT_HIT();
 
                // Test if the action was cancelled

-               if(BUTTON_PRESS()) break;
-               
-               if (numWrongDistance > 1000) {
-                       isOK = 0;
+               if(BUTTON_PRESS()) {
+                       isOK = -1;

                        break;
                }
                
                        break;
                }
                

-               //if(!iso14443a_select_card(uid, NULL, &cuid)) {
-               if(!iso14443a_select_card(uid, NULL, NULL)) {
+               if(!iso14443a_select_card(uid, NULL, &cuid)) {

                        if (MF_DBGLEVEL >= 1)   Dbprintf("Mifare: Can't select card");
                        continue;
                }
                        if (MF_DBGLEVEL >= 1)   Dbprintf("Mifare: Can't select card");
                        continue;
                }


@@ -2305,14 +2308,15 @@ void ReaderMifare(bool first_try) {
                                nt_attacked = nt;
                        }
                        else {
                                nt_attacked = nt;
                        }
                        else {

-                               
-                               // invalid nonce received, try again
-                               if (nt_distance == -99999) { 
-                                       numWrongDistance++;
-                                       if (MF_DBGLEVEL >= 3) Dbprintf("The two nonces has invalid distance, tag could have good PRNG\n");
-                                       continue;
+                               if (nt_distance == -99999) { // invalid nonce received
+                                       unsuccessfull_tries++;
+                                       if (!nt_attacked && unsuccessfull_tries > DARKSIDE_MAX_TRIES) {
+                                               isOK = -3;              // Card has an unpredictable PRNG. Give up      
+                                               break;
+                                       } else {
+                                               continue;               // continue trying...
+                                       }

                                }
                                }

-                               

                                sync_cycles = (sync_cycles - nt_distance);
                                if (MF_DBGLEVEL >= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);
                                continue;
                                sync_cycles = (sync_cycles - nt_distance);
                                if (MF_DBGLEVEL >= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);
                                continue;


@@ -2321,7 +2325,7 @@ void ReaderMifare(bool first_try) {
 
                if ((nt != nt_attacked) && nt_attacked) {       // we somehow lost sync. Try to catch up again...
                        catch_up_cycles = -dist_nt(nt_attacked, nt);
 
                if ((nt != nt_attacked) && nt_attacked) {       // we somehow lost sync. Try to catch up again...
                        catch_up_cycles = -dist_nt(nt_attacked, nt);

-                       if (catch_up_cycles >= 99999) {                 // invalid nonce received. Don't resync on that one.
+                       if (catch_up_cycles == 99999) {                 // invalid nonce received. Don't resync on that one.

                                catch_up_cycles = 0;
                                continue;
                        }
                                catch_up_cycles = 0;
                                continue;
                        }


@@ -2373,12 +2377,17 @@ void ReaderMifare(bool first_try) {
                        if (nt_diff == 0 && first_try)
                        {
                                par[0]++;
                        if (nt_diff == 0 && first_try)
                        {
                                par[0]++;

+                               if (par[0] == 0x00) {           // tried all 256 possible parities without success. Card doesn't send NACK.
+                                       isOK = -2;
+                                       break;
+                               }

                        } else {
                                par[0] = ((par[0] & 0x1F) + 1) | par_low;
                        }
                }
        }
 
                        } else {
                                par[0] = ((par[0] & 0x1F) + 1) | par_low;
                        }
                }
        }
 

+

        mf_nr_ar[3] &= 0x1F;
        
        byte_t buf[28] = {0x00};
        mf_nr_ar[3] &= 0x1F;
        
        byte_t buf[28] = {0x00};


@@ -2391,9 +2400,11 @@ void ReaderMifare(bool first_try) {
                
        cmd_send(CMD_ACK,isOK,0,0,buf,28);
 
                
        cmd_send(CMD_ACK,isOK,0,0,buf,28);
 

-       set_tracing(FALSE);
+       // Thats it...

        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        LEDsoff();
        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
        LEDsoff();

+
+       set_tracing(FALSE);

 }
 
 
 }
 
 


@@ -2450,13 +2461,6 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
        uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
        uint8_t ar_nr_collected = 0;
 
        uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0,0,0};
        uint8_t ar_nr_collected = 0;
 

-       // free eventually allocated BigBuf memory but keep Emulator Memory
-       BigBuf_free_keep_EM();
-
-       // clear trace
-       clear_trace();
-       set_tracing(TRUE);
-

        // Authenticate response - nonce
        uint32_t nonce = bytes_to_num(rAUTH_NT, 4);
        
        // Authenticate response - nonce
        uint32_t nonce = bytes_to_num(rAUTH_NT, 4);
        


@@ -2503,10 +2507,6 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];
        }
 
                rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];
        }
 

-       // We need to listen to the high-frequency, peak-detected path.
-       iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
-
-

        if (MF_DBGLEVEL >= 1)   {
                if (!_7BUID) {
                        Dbprintf("4B UID: %02x%02x%02x%02x", 
        if (MF_DBGLEVEL >= 1)   {
                if (!_7BUID) {
                        Dbprintf("4B UID: %02x%02x%02x%02x", 


@@ -2518,6 +2518,17 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
                }
        }
 
                }
        }
 

+       // We need to listen to the high-frequency, peak-detected path.
+       iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
+
+       // free eventually allocated BigBuf memory but keep Emulator Memory
+       BigBuf_free_keep_EM();
+
+       // clear trace
+       clear_trace();
+       set_tracing(TRUE);
+
+

        bool finished = FALSE;
        while (!BUTTON_PRESS() && !finished) {
                WDT_HIT();
        bool finished = FALSE;
        while (!BUTTON_PRESS() && !finished) {
                WDT_HIT();


@@ -2929,9 +2940,6 @@ void RAMFUNC SniffMifare(uint8_t param) {
        // bit 0 - trigger from first card answer
        // bit 1 - trigger from first reader 7-bit request
 
        // bit 0 - trigger from first card answer
        // bit 1 - trigger from first reader 7-bit request
 

-       // free eventually allocated BigBuf memory
-       BigBuf_free();
-       

        // C(red) A(yellow) B(green)
        LEDsoff();
        // init trace buffer
        // C(red) A(yellow) B(green)
        LEDsoff();
        // init trace buffer


@@ -2947,6 +2955,10 @@ void RAMFUNC SniffMifare(uint8_t param) {
        uint8_t receivedResponse[MAX_MIFARE_FRAME_SIZE];
        uint8_t receivedResponsePar[MAX_MIFARE_PARITY_SIZE];
 
        uint8_t receivedResponse[MAX_MIFARE_FRAME_SIZE];
        uint8_t receivedResponsePar[MAX_MIFARE_PARITY_SIZE];
 

+       iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
+
+       // free eventually allocated BigBuf memory
+       BigBuf_free();

        // allocate the DMA buffer, used to stream samples from the FPGA
        uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
        uint8_t *data = dmaBuf;
        // allocate the DMA buffer, used to stream samples from the FPGA
        uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
        uint8_t *data = dmaBuf;


@@ -2956,8 +2968,6 @@ void RAMFUNC SniffMifare(uint8_t param) {
        bool ReaderIsActive = FALSE;
        bool TagIsActive = FALSE;
 
        bool ReaderIsActive = FALSE;
        bool TagIsActive = FALSE;
 

-       iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
-

        // Set up the demodulator for tag -> reader responses.
        DemodInit(receivedResponse, receivedResponsePar);
 
        // Set up the demodulator for tag -> reader responses.
        DemodInit(receivedResponse, receivedResponsePar);
 


@@ -3037,7 +3047,6 @@ void RAMFUNC SniffMifare(uint8_t param) {
                                        if (MfSniffLogic(receivedCmd, Uart.len, Uart.parity, Uart.bitCount, TRUE)) break;
 
                                        /* And ready to receive another command. */
                                        if (MfSniffLogic(receivedCmd, Uart.len, Uart.parity, Uart.bitCount, TRUE)) break;
 
                                        /* And ready to receive another command. */

-                                       //UartInit(receivedCmd, receivedCmdPar);

                                        UartReset();
                                        
                                        /* And also reset the demod code */
                                        UartReset();
                                        
                                        /* And also reset the demod code */