X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/1c611bbd26066e1a8dd36ffd389b57040a7dfad6..e12b82d362238b49d3b4b88ff7d7a1d7e618bac8:/armsrc/iso14443a.c?ds=inline diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c index 56afaeb8..b3316ef0 100644 --- a/armsrc/iso14443a.c +++ b/armsrc/iso14443a.c @@ -88,25 +88,25 @@ void iso14a_set_timeout(uint32_t timeout) { //----------------------------------------------------------------------------- byte_t oddparity (const byte_t bt) { - return OddByteParity[bt]; + return OddByteParity[bt]; } uint32_t GetParity(const uint8_t * pbtCmd, int iLen) { - int i; - uint32_t dwPar = 0; + int i; + uint32_t dwPar = 0; - // Generate the encrypted data - for (i = 0; i < iLen; i++) { - // Save the encrypted parity bit - dwPar |= ((OddByteParity[pbtCmd[i]]) << i); - } - return dwPar; + // Generate the encrypted data + for (i = 0; i < iLen; i++) { + // Save the encrypted parity bit + dwPar |= ((OddByteParity[pbtCmd[i]]) << i); + } + return dwPar; } void AppendCrc14443a(uint8_t* data, int len) { - ComputeCrc14443(CRC_14443_A,data,len,data+len,data+len+1); + ComputeCrc14443(CRC_14443_A,data,len,data+len,data+len+1); } // The function LogTrace() is also used by the iClass implementation in iClass.c @@ -584,7 +584,7 @@ void RAMFUNC SnoopIso14443a(uint8_t param) { LEDsoff(); // init trace buffer - iso14a_clear_trace(); + iso14a_clear_trace(); // We won't start recording the frames that we acquire until we trigger; // a good trigger condition to get started is probably when we see a @@ -775,54 +775,54 @@ static void CodeIso14443aAsTag(const uint8_t *cmd, int len){ CodeIso14443aAsTagPar(cmd, len, GetParity(cmd, len)); } -//----------------------------------------------------------------------------- -// This is to send a NACK kind of answer, its only 3 bits, I know it should be 4 -//----------------------------------------------------------------------------- -static void CodeStrangeAnswerAsTag() -{ - int i; - - ToSendReset(); - - // Correction bit, might be removed when not needed - ToSendStuffBit(0); - ToSendStuffBit(0); - ToSendStuffBit(0); - ToSendStuffBit(0); - ToSendStuffBit(1); // 1 - ToSendStuffBit(0); - ToSendStuffBit(0); - ToSendStuffBit(0); - - // Send startbit - ToSend[++ToSendMax] = SEC_D; - - // 0 - ToSend[++ToSendMax] = SEC_E; - - // 0 - ToSend[++ToSendMax] = SEC_E; - - // 1 - ToSend[++ToSendMax] = SEC_D; - - // Send stopbit - ToSend[++ToSendMax] = SEC_F; - - // Flush the buffer in FPGA!! - for(i = 0; i < 5; i++) { - ToSend[++ToSendMax] = SEC_F; - } - - // Convert from last byte pos to length - ToSendMax++; -} +////----------------------------------------------------------------------------- +//// This is to send a NACK kind of answer, its only 3 bits, I know it should be 4 +////----------------------------------------------------------------------------- +//static void CodeStrangeAnswerAsTag() +//{ +// int i; +// +// ToSendReset(); +// +// // Correction bit, might be removed when not needed +// ToSendStuffBit(0); +// ToSendStuffBit(0); +// ToSendStuffBit(0); +// ToSendStuffBit(0); +// ToSendStuffBit(1); // 1 +// ToSendStuffBit(0); +// ToSendStuffBit(0); +// ToSendStuffBit(0); +// +// // Send startbit +// ToSend[++ToSendMax] = SEC_D; +// +// // 0 +// ToSend[++ToSendMax] = SEC_E; +// +// // 0 +// ToSend[++ToSendMax] = SEC_E; +// +// // 1 +// ToSend[++ToSendMax] = SEC_D; +// +// // Send stopbit +// ToSend[++ToSendMax] = SEC_F; +// +// // Flush the buffer in FPGA!! +// for(i = 0; i < 5; i++) { +// ToSend[++ToSendMax] = SEC_F; +// } +// +// // Convert from last byte pos to length +// ToSendMax++; +//} static void Code4bitAnswerAsTag(uint8_t cmd) { int i; - ToSendReset(); + ToSendReset(); // Correction bit, might be removed when not needed ToSendStuffBit(0); @@ -855,8 +855,8 @@ static void Code4bitAnswerAsTag(uint8_t cmd) ToSend[++ToSendMax] = SEC_F; } - // Convert from last byte pos to length - ToSendMax++; + // Convert from last byte pos to length + ToSendMax++; } //----------------------------------------------------------------------------- @@ -908,15 +908,76 @@ int EmSendCmdEx(uint8_t *resp, int respLen, int correctionNeeded); int EmSendCmd(uint8_t *resp, int respLen); int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par); +static uint8_t* free_buffer_pointer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); + +typedef struct { + uint8_t* response; + size_t response_n; + uint8_t* modulation; + size_t modulation_n; +} tag_response_info_t; + +void reset_free_buffer() { + free_buffer_pointer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); +} + +bool prepare_tag_modulation(tag_response_info_t* response_info, size_t max_buffer_size) { + // Exmaple response, answer to MIFARE Classic read block will be 16 bytes + 2 CRC = 18 bytes + // This will need the following byte array for a modulation sequence + // 144 data bits (18 * 8) + // 18 parity bits + // 2 Start and stop + // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA) + // 1 just for the case + // ----------- + + // 166 bytes, since every bit that needs to be send costs us a byte + // + + // Prepare the tag modulation bits from the message + CodeIso14443aAsTag(response_info->response,response_info->response_n); + + // Make sure we do not exceed the free buffer space + if (ToSendMax > max_buffer_size) { + Dbprintf("Out of memory, when modulating bits for tag answer:"); + Dbhexdump(response_info->response_n,response_info->response,false); + return false; + } + + // Copy the byte array, used for this modulation to the buffer position + memcpy(response_info->modulation,ToSend,ToSendMax); + + // Store the number of bytes that were used for encoding/modulation + response_info->modulation_n = ToSendMax; + + return true; +} + +bool prepare_allocated_tag_modulation(tag_response_info_t* response_info) { + // Retrieve and store the current buffer index + response_info->modulation = free_buffer_pointer; + + // Determine the maximum size we can use from our buffer + size_t max_buffer_size = (((uint8_t *)BigBuf)+FREE_BUFFER_OFFSET+FREE_BUFFER_SIZE)-free_buffer_pointer; + + // Forward the prepare tag modulation function to the inner function + if (prepare_tag_modulation(response_info,max_buffer_size)) { + // Update the free buffer offset + free_buffer_pointer += ToSendMax; + return true; + } else { + return false; + } +} + //----------------------------------------------------------------------------- // Main loop of simulated tag: receive commands from reader, decide what // response to send, and send it. //----------------------------------------------------------------------------- void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data) { - // Enable and clear the trace + // Enable and clear the trace tracing = TRUE; - iso14a_clear_trace(); + iso14a_clear_trace(); // This function contains the tag emulation uint8_t sak; @@ -990,57 +1051,41 @@ void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data) ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]); uint8_t response5[] = { 0x00, 0x00, 0x00, 0x00 }; // Very random tag nonce - uint8_t response6[] = { 0x03, 0x3B, 0x00, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS - ComputeCrc14443(CRC_14443_A, response6, 3, &response6[3], &response6[4]); - - uint8_t *resp = NULL; - int respLen; - - // Longest possible response will be 16 bytes + 2 CRC = 18 bytes - // This will need - // 144 data bits (18 * 8) - // 18 parity bits - // 2 Start and stop - // 1 Correction bit (Answer in 1172 or 1236 periods, see FPGA) - // 1 just for the case - // ----------- + - // 166 - // - // 166 bytes, since every bit that needs to be send costs us a byte - // - - // Respond with card type - uint8_t *resp1 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); - int resp1Len; - - // Anticollision cascade1 - respond with uid - uint8_t *resp2 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + 166); - int resp2Len; - - // Anticollision cascade2 - respond with 2nd half of uid if asked - // we're only going to be asked if we set the 1st byte of the UID (during cascade1) to 0x88 - uint8_t *resp2a = (((uint8_t *)BigBuf) + 1140); - int resp2aLen; - - // Acknowledge select - cascade 1 - uint8_t *resp3 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + (166*2)); - int resp3Len; - - // Acknowledge select - cascade 2 - uint8_t *resp3a = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + (166*3)); - int resp3aLen; - - // Response to a read request - not implemented atm - uint8_t *resp4 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + (166*4)); -// int resp4Len; - - // Authenticate response - nonce - uint8_t *resp5 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + (166*5)); - int resp5Len; - - // Authenticate response - nonce - uint8_t *resp6 = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET + (166*6)); - int resp6Len; + uint8_t response6[] = { 0x04, 0x58, 0x00, 0x02, 0x00, 0x00 }; // dummy ATS (pseudo-ATR), answer to RATS + ComputeCrc14443(CRC_14443_A, response6, 4, &response6[4], &response6[5]); + + #define TAG_RESPONSE_COUNT 7 + tag_response_info_t responses[TAG_RESPONSE_COUNT] = { + { .response = response1, .response_n = sizeof(response1) }, // Answer to request - respond with card type + { .response = response2, .response_n = sizeof(response2) }, // Anticollision cascade1 - respond with uid + { .response = response2a, .response_n = sizeof(response2a) }, // Anticollision cascade2 - respond with 2nd half of uid if asked + { .response = response3, .response_n = sizeof(response3) }, // Acknowledge select - cascade 1 + { .response = response3a, .response_n = sizeof(response3a) }, // Acknowledge select - cascade 2 + { .response = response5, .response_n = sizeof(response5) }, // Authentication answer (random nonce) + { .response = response6, .response_n = sizeof(response6) }, // dummy ATS (pseudo-ATR), answer to RATS + }; + + // Allocate 512 bytes for the dynamic modulation, created when the reader querries for it + // Such a response is less time critical, so we can prepare them on the fly + #define DYNAMIC_RESPONSE_BUFFER_SIZE 64 + #define DYNAMIC_MODULATION_BUFFER_SIZE 512 + uint8_t dynamic_response_buffer[DYNAMIC_RESPONSE_BUFFER_SIZE]; + uint8_t dynamic_modulation_buffer[DYNAMIC_MODULATION_BUFFER_SIZE]; + tag_response_info_t dynamic_response_info = { + .response = dynamic_response_buffer, + .response_n = 0, + .modulation = dynamic_modulation_buffer, + .modulation_n = 0 + }; + + // Reset the offset pointer of the free buffer + reset_free_buffer(); + + // Prepare the responses of the anticollision phase + // there will be not enough time to do this at the moment the reader sends it REQA + for (size_t i=0; i 0) { + // Copy the CID from the reader query + dynamic_response_info.response[1] = receivedCmd[1]; + + // Add CRC bytes, always used in ISO 14443A-4 compliant cards + AppendCrc14443a(dynamic_response_info.response,dynamic_response_info.response_n); + dynamic_response_info.response_n += 2; + + if (prepare_tag_modulation(&dynamic_response_info,DYNAMIC_MODULATION_BUFFER_SIZE) == false) { + Dbprintf("Error preparing tag response"); + break; + } + p_response = &dynamic_response_info; } - // Do not respond - resp = resp1; respLen = 0; order = 0; - respdata = NULL; - respsize = 0; } // Count number of wakeups received after a halt @@ -1193,72 +1229,91 @@ void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data) if(cmdsRecvd > 999) { DbpString("1000 commands later..."); break; - } else { - cmdsRecvd++; - } - - if(respLen > 0) { - EmSendCmd14443aRaw(resp, respLen, receivedCmd[0] == 0x52); } - - if (tracing) { - if (respdata != NULL) { - LogTrace(respdata,respsize, 0, SwapBits(GetParity(respdata,respsize),respsize), FALSE); - } - if(traceLen > TRACE_SIZE) { - DbpString("Trace full"); - break; - } - } - - memset(receivedCmd, 0x44, RECV_CMD_SIZE); + cmdsRecvd++; + + if (p_response != NULL) { + EmSendCmd14443aRaw(p_response->modulation, p_response->modulation_n, receivedCmd[0] == 0x52); + if (tracing) { + LogTrace(p_response->response,p_response->response_n,0,SwapBits(GetParity(p_response->response,p_response->response_n),p_response->response_n),FALSE); + if(traceLen > TRACE_SIZE) { + DbpString("Trace full"); +// break; + } + } + } } Dbprintf("%x %x %x", happened, happened2, cmdsRecvd); LED_A_OFF(); } + +// prepare a delayed transfer. This simply shifts ToSend[] by a number +// of bits specified in the delay parameter. +void PrepareDelayedTransfer(uint16_t delay) +{ + uint8_t bitmask = 0; + uint8_t bits_to_shift = 0; + uint8_t bits_shifted = 0; + + delay &= 0x07; + if (delay) { + for (uint16_t i = 0; i < delay; i++) { + bitmask |= (0x01 << i); + } + ToSend[++ToSendMax] = 0x00; + for (uint16_t i = 0; i < ToSendMax; i++) { + bits_to_shift = ToSend[i] & bitmask; + ToSend[i] = ToSend[i] >> delay; + ToSend[i] = ToSend[i] | (bits_shifted << (8 - delay)); + bits_shifted = bits_to_shift; + } + } +} + //----------------------------------------------------------------------------- // Transmit the command (to the tag) that was placed in ToSend[]. +// Parameter timing: +// if NULL: ignored +// if == 0: return time of transfer +// if != 0: delay transfer until time specified //----------------------------------------------------------------------------- -static void TransmitFor14443a(const uint8_t *cmd, int len, int *samples, int *wait) +static void TransmitFor14443a(const uint8_t *cmd, int len, uint32_t *timing) { - int c; + int c; - FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD); + FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD); - if (wait) - if(*wait < 10) - *wait = 10; - for(c = 0; c < *wait;) { - if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { - AT91C_BASE_SSC->SSC_THR = 0x00; // For exact timing! - c++; - } - if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { - volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR; - (void)r; - } - WDT_HIT(); - } + if (timing) { + if(*timing == 0) { // Measure time + *timing = (GetCountMifare() + 8) & 0xfffffff8; + } else { + PrepareDelayedTransfer(*timing & 0x00000007); // Delay transfer (fine tuning - up to 7 MF clock ticks) + } + if(MF_DBGLEVEL >= 4 && GetCountMifare() >= (*timing & 0xfffffff8)) Dbprintf("TransmitFor14443a: Missed timing"); + while(GetCountMifare() < (*timing & 0xfffffff8)); // Delay transfer (multiple of 8 MF clock ticks) + } + + for(c = 0; c < 10;) { // standard delay for each transfer (allow tag to be ready after last transmission) + if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { + AT91C_BASE_SSC->SSC_THR = 0x00; + c++; + } + } + + c = 0; + for(;;) { + if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { + AT91C_BASE_SSC->SSC_THR = cmd[c]; + c++; + if(c >= len) { + break; + } + } + } - c = 0; - for(;;) { - if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { - AT91C_BASE_SSC->SSC_THR = cmd[c]; - c++; - if(c >= len) { - break; - } - } - if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { - volatile uint32_t r = AT91C_BASE_SSC->SSC_RHR; - (void)r; - } - WDT_HIT(); - } - if (samples) *samples = (c + *wait) << 3; } //----------------------------------------------------------------------------- @@ -1528,10 +1583,10 @@ static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, int maxLen, int for(;;) { WDT_HIT(); - if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { - AT91C_BASE_SSC->SSC_THR = 0x00; // To make use of exact timing of next command from reader!! - if (elapsed) (*elapsed)++; - } + // if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { + // AT91C_BASE_SSC->SSC_THR = 0x00; // To make use of exact timing of next command from reader!! + // if (elapsed) (*elapsed)++; + // } if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_RXRDY)) { if(c < iso14a_timeout) { c++; } else { return FALSE; } b = (uint8_t)AT91C_BASE_SSC->SSC_RHR; @@ -1547,17 +1602,13 @@ static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, int maxLen, int } } -void ReaderTransmitBitsPar(uint8_t* frame, int bits, uint32_t par) +void ReaderTransmitBitsPar(uint8_t* frame, int bits, uint32_t par, uint32_t *timing) { - int wait = 0; - int samples = 0; - - // This is tied to other size changes - // uint8_t* frame_addr = ((uint8_t*)BigBuf) + 2024; + CodeIso14443aBitsAsReaderPar(frame,bits,par); // Select the card - TransmitFor14443a(ToSend, ToSendMax, &samples, &wait); + TransmitFor14443a(ToSend, ToSendMax, timing); if(trigger) LED_A_ON(); @@ -1565,15 +1616,15 @@ void ReaderTransmitBitsPar(uint8_t* frame, int bits, uint32_t par) if (tracing) LogTrace(frame,nbytes(bits),0,par,TRUE); } -void ReaderTransmitPar(uint8_t* frame, int len, uint32_t par) +void ReaderTransmitPar(uint8_t* frame, int len, uint32_t par, uint32_t *timing) { - ReaderTransmitBitsPar(frame,len*8,par); + ReaderTransmitBitsPar(frame,len*8,par, timing); } -void ReaderTransmit(uint8_t* frame, int len) +void ReaderTransmit(uint8_t* frame, int len, uint32_t *timing) { // Generate parity and redirect - ReaderTransmitBitsPar(frame,len*8,GetParity(frame,len)); + ReaderTransmitBitsPar(frame,len*8,GetParity(frame,len), timing); } int ReaderReceive(uint8_t* receivedAnswer) @@ -1612,7 +1663,7 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u int len; // Broadcast for a card, WUPA (0x52) will force response from all cards in the field - ReaderTransmitBitsPar(wupa,7,0); + ReaderTransmitBitsPar(wupa,7,0, NULL); // Receive the ATQA if(!ReaderReceive(resp)) return 0; // Dbprintf("atqa: %02x %02x",resp[0],resp[1]); @@ -1622,7 +1673,7 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u p_hi14a_card->uidlen = 0; memset(p_hi14a_card->uid,0,10); } - + // clear uid if (uid_ptr) { memset(uid_ptr,0,10); @@ -1636,23 +1687,23 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u sel_uid[0] = sel_all[0] = 0x93 + cascade_level * 2; // SELECT_ALL - ReaderTransmit(sel_all,sizeof(sel_all)); + ReaderTransmit(sel_all,sizeof(sel_all), NULL); if (!ReaderReceive(resp)) return 0; - + // First backup the current uid memcpy(uid_resp,resp,4); uid_resp_len = 4; // Dbprintf("uid: %02x %02x %02x %02x",uid_resp[0],uid_resp[1],uid_resp[2],uid_resp[3]); - - // calculate crypto UID - if(cuid_ptr) { - *cuid_ptr = bytes_to_num(uid_resp, 4); + + // calculate crypto UID. Always use last 4 Bytes. + if(cuid_ptr) { + *cuid_ptr = bytes_to_num(uid_resp, 4); } // Construct SELECT UID command - memcpy(sel_uid+2,resp,5); + memcpy(sel_uid+2,resp,5); AppendCrc14443a(sel_uid,7); - ReaderTransmit(sel_uid,sizeof(sel_uid)); + ReaderTransmit(sel_uid,sizeof(sel_uid), NULL); // Receive the SAK if (!ReaderReceive(resp)) return 0; @@ -1665,11 +1716,11 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u memcpy(uid_resp, uid_resp + 1, 3); uid_resp_len = 3; } - + if(uid_ptr) { memcpy(uid_ptr + (cascade_level*3), uid_resp, uid_resp_len); } - + if(p_hi14a_card) { memcpy(p_hi14a_card->uid + (cascade_level*3), uid_resp, uid_resp_len); p_hi14a_card->uidlen += uid_resp_len; @@ -1687,7 +1738,7 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u // Request for answer to select AppendCrc14443a(rats, 2); - ReaderTransmit(rats, sizeof(rats)); + ReaderTransmit(rats, sizeof(rats), NULL); if (!(len = ReaderReceive(resp))) return 0; @@ -1695,20 +1746,20 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u memcpy(p_hi14a_card->ats, resp, sizeof(p_hi14a_card->ats)); p_hi14a_card->ats_len = len; } - + // reset the PCB block number iso14_pcb_blocknum = 0; return 1; } void iso14443a_setup() { - // Set up the synchronous serial port - FpgaSetupSsc(); + // Set up the synchronous serial port + FpgaSetupSsc(); // Start from off (no field generated) // Signal field is off with the appropriate LED - LED_D_OFF(); - FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); - SpinDelay(50); +// LED_D_OFF(); +// FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + // SpinDelay(50); SetAdcMuxFor(GPIO_MUXSEL_HIPKD); @@ -1716,7 +1767,7 @@ void iso14443a_setup() { // Signal field is on with the appropriate LED LED_D_ON(); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD); - SpinDelay(50); + SpinDelay(7); // iso14443-3 specifies 5ms max. iso14a_timeout = 2048; //default } @@ -1730,7 +1781,7 @@ int iso14_apdu(uint8_t * cmd, size_t cmd_len, void * data) { memcpy(real_cmd+2, cmd, cmd_len); AppendCrc14443a(real_cmd,cmd_len+2); - ReaderTransmit(real_cmd, cmd_len+4); + ReaderTransmit(real_cmd, cmd_len+4, NULL); size_t len = ReaderReceive(data); uint8_t * data_bytes = (uint8_t *) data; if (!len) @@ -1757,21 +1808,26 @@ void ReaderIso14443a(UsbCommand * c) iso14a_command_t param = c->arg[0]; uint8_t * cmd = c->d.asBytes; size_t len = c->arg[1]; - uint32_t arg0 = 0; - byte_t buf[USB_CMD_DATA_SIZE]; + size_t lenbits = c->arg[2]; + uint32_t arg0 = 0; + byte_t buf[USB_CMD_DATA_SIZE]; - iso14a_clear_trace(); - iso14a_set_tracing(true); + if(param & ISO14A_CONNECT) { + iso14a_clear_trace(); + } + iso14a_set_tracing(true); if(param & ISO14A_REQUEST_TRIGGER) { - iso14a_set_trigger(1); - } + iso14a_set_trigger(1); + } if(param & ISO14A_CONNECT) { iso14443a_setup(); - arg0 = iso14443a_select_card(NULL,(iso14a_card_select_t*)buf,NULL); - cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(iso14a_card_select_t)); -// UsbSendPacket((void *)ack, sizeof(UsbCommand)); + if(!(param & ISO14A_NO_SELECT)) { + iso14a_card_select_t *card = (iso14a_card_select_t*)buf; + arg0 = iso14443a_select_card(NULL,card,NULL); + cmd_send(CMD_ACK,arg0,card->uidlen,0,buf,sizeof(iso14a_card_select_t)); + } } if(param & ISO14A_SET_TIMEOUT) { @@ -1785,7 +1841,6 @@ void ReaderIso14443a(UsbCommand * c) if(param & ISO14A_APDU) { arg0 = iso14_apdu(cmd, len, buf); cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf)); -// UsbSendPacket((void *)ack, sizeof(UsbCommand)); } if(param & ISO14A_RAW) { @@ -1793,50 +1848,28 @@ void ReaderIso14443a(UsbCommand * c) AppendCrc14443a(cmd,len); len += 2; } - ReaderTransmit(cmd,len); + if(lenbits>0) { + ReaderTransmitBitsPar(cmd,lenbits,GetParity(cmd,lenbits/8), NULL); + } else { + ReaderTransmit(cmd,len, NULL); + } arg0 = ReaderReceive(buf); -// UsbSendPacket((void *)ack, sizeof(UsbCommand)); - cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf)); + cmd_send(CMD_ACK,arg0,0,0,buf,sizeof(buf)); } if(param & ISO14A_REQUEST_TRIGGER) { - iso14a_set_trigger(0); - } + iso14a_set_trigger(0); + } if(param & ISO14A_NO_DISCONNECT) { return; - } + } FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); LEDsoff(); } -// prepare the Mifare AUTH transfer with an added necessary delay. -void PrepareDelayedAuthTransfer(uint8_t* frame, int len, uint16_t delay) -{ - CodeIso14443aBitsAsReaderPar(frame, len*8, GetParity(frame,len)); - - uint8_t bitmask = 0; - uint8_t bits_to_shift = 0; - uint8_t bits_shifted = 0; - - if (delay) { - for (uint16_t i = 0; i < delay; i++) { - bitmask |= (0x01 << i); - } - ToSend[++ToSendMax] = 0x00; - for (uint16_t i = 0; i < ToSendMax; i++) { - bits_to_shift = ToSend[i] & bitmask; - ToSend[i] = ToSend[i] >> delay; - ToSend[i] = ToSend[i] | (bits_shifted << (8 - delay)); - bits_shifted = bits_to_shift; - } - } -} - - - // Determine the distance between two nonces. // Assume that the difference is small, but we don't know which is first. // Therefore try in alternating directions. @@ -1904,11 +1937,8 @@ void ReaderMifare(bool first_try) StartCountMifare(); mf_nr_ar3 = 0; iso14443a_setup(); - FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN); // resets some FPGA internal registers while((GetCountMifare() & 0xffff0000) != 0x10000); // wait for counter to reset and "warm up" - while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_FRAME); // wait for ssp_frame to be low - while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_FRAME)); // sync on rising edge of ssp_frame - sync_time = GetCountMifare(); + sync_time = GetCountMifare() & 0xfffffff8; sync_cycles = 65536; // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces). nt_attacked = 0; nt = 0; @@ -1939,41 +1969,37 @@ void ReaderMifare(bool first_try) LED_C_ON(); if(!iso14443a_select_card(uid, NULL, &cuid)) { + if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Can't select card"); continue; } //keep the card active FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD); - PrepareDelayedAuthTransfer(mf_auth, sizeof(mf_auth), (sync_cycles + catch_up_cycles) & 0x00000007); + // CodeIso14443aBitsAsReaderPar(mf_auth, sizeof(mf_auth)*8, GetParity(mf_auth, sizeof(mf_auth)*8)); - sync_time = sync_time + ((sync_cycles + catch_up_cycles) & 0xfffffff8); + sync_time = (sync_time & 0xfffffff8) + sync_cycles + catch_up_cycles; catch_up_cycles = 0; // if we missed the sync time already, advance to the next nonce repeat while(GetCountMifare() > sync_time) { - sync_time = sync_time + (sync_cycles & 0xfffffff8); + sync_time = (sync_time & 0xfffffff8) + sync_cycles; } - // now sync. After syncing, the following Classic Auth will return the same tag nonce (mostly) - while(GetCountMifare() < sync_time); - - // Transmit MIFARE_CLASSIC_AUTH - int samples = 0; - int wait = 0; - TransmitFor14443a(ToSend, ToSendMax, &samples, &wait); + // Transmit MIFARE_CLASSIC_AUTH at synctime. Should result in returning the same tag nonce (== nt_attacked) + ReaderTransmit(mf_auth, sizeof(mf_auth), &sync_time); // Receive the (4 Byte) "random" nonce if (!ReaderReceive(receivedAnswer)) { + if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Couldn't receive tag nonce"); continue; } - previous_nt = nt; nt = bytes_to_num(receivedAnswer, 4); // Transmit reader nonce with fake par - ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par); + ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par, NULL); if (first_try && previous_nt && !nt_attacked) { // we didn't calibrate our clock yet int nt_distance = dist_nt(previous_nt, nt); @@ -1985,7 +2011,7 @@ void ReaderMifare(bool first_try) continue; } sync_cycles = (sync_cycles - nt_distance); -// Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles); + if (MF_DBGLEVEL >= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles); continue; } } @@ -2004,11 +2030,11 @@ void ReaderMifare(bool first_try) consecutive_resyncs = 0; } if (consecutive_resyncs < 3) { - Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i, -catch_up_cycles, consecutive_resyncs); + if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i, -catch_up_cycles, consecutive_resyncs); } else { sync_cycles = sync_cycles + catch_up_cycles; - Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i, -catch_up_cycles, sync_cycles); + if (MF_DBGLEVEL >= 3) Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i, -catch_up_cycles, sync_cycles); } continue; } @@ -2018,7 +2044,7 @@ void ReaderMifare(bool first_try) // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding if (ReaderReceive(receivedAnswer)) { - catch_up_cycles = 8; // the PRNG doesn't run during data transfers. 4 Bit = 8 cycles + catch_up_cycles = 8; // the PRNG is delayed by 8 cycles due to the NAC (4Bits = 0x05 encrypted) transfer if (nt_diff == 0) {