X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/55acbb2a3903f7940d0db5fae2e8f4fdab51d1b8..8ca5586d49825e3a01b7ec58d8ade4d64564d244:/client/mifarehost.c?ds=sidebyside

diff --git a/client/mifarehost.c b/client/mifarehost.c
index cfcc17ba..f34759df 100644
--- a/client/mifarehost.c
+++ b/client/mifarehost.c
@@ -275,9 +275,13 @@ int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params) {
 
 // SNIFFER
 
+// constants
+static uint8_t trailerAccessBytes[4] = {0x08, 0x77, 0x8F, 0x00};
+
 // variables
 char logHexFileName[200] = {0x00};
-static uint8_t traceCard[4096];
+static uint8_t traceCard[4096] = {0x00};
+static char traceFileName[20];
 static int traceState = TRACE_IDLE;
 static uint8_t traceCurBlock = 0;
 static uint8_t traceCurKey = 0;
@@ -291,17 +295,86 @@ uint32_t ks3;
 
 uint32_t uid;     // serial number
 uint32_t nt;      // tag challenge
+uint32_t nt_par; 
 uint32_t nr_enc;  // encrypted reader challenge
 uint32_t ar_enc;  // encrypted reader response
+uint32_t nr_ar_par; 
 uint32_t at_enc;  // encrypted tag response
+uint32_t at_par; 
 
-int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak) {
+int isTraceCardEmpty(void) {
+	return ((traceCard[0] == 0) && (traceCard[1] == 0) && (traceCard[2] == 0) && (traceCard[3] == 0));
+}
 
-	if (traceCrypto1) crypto1_destroy(traceCrypto1);
-	traceCrypto1 = NULL;
+int isBlockEmpty(int blockN) {
+	for (int i = 0; i < 16; i++) 
+		if (traceCard[blockN * 16 + i] != 0) return 0;
+
+	return 1;
+}
+
+int isBlockTrailer(int blockN) {
+ return ((blockN & 0x03) == 0x03);
+}
 
+int loadTraceCard(uint8_t *tuid) {
+	FILE * f;
+	char buf[64];
+	uint8_t buf8[64];
+	int i, blockNum;
+	
+	if (!isTraceCardEmpty()) saveTraceCard();
 	memset(traceCard, 0x00, 4096);
 	memcpy(traceCard, tuid + 3, 4);
+	FillFileNameByUID(traceFileName, tuid, ".eml", 7);
+
+	f = fopen(traceFileName, "r");
+	if (!f) return 1;
+	
+	blockNum = 0;
+	while(!feof(f)){
+		memset(buf, 0, sizeof(buf));
+		fgets(buf, sizeof(buf), f);
+
+		if (strlen(buf) < 32){
+			if (feof(f)) break;
+			PrintAndLog("File content error. Block data must include 32 HEX symbols");
+			return 2;
+		}
+		for (i = 0; i < 32; i += 2)
+			sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]);
+
+		memcpy(traceCard + blockNum * 16, buf8, 16);
+
+		blockNum++;
+	}
+	fclose(f);
+
+	return 0;
+}
+
+int saveTraceCard(void) {
+	FILE * f;
+	
+	if ((!strlen(traceFileName)) || (isTraceCardEmpty())) return 0;
+	
+	f = fopen(traceFileName, "w+");
+	for (int i = 0; i < 64; i++) {  // blocks
+		for (int j = 0; j < 16; j++)  // bytes
+			fprintf(f, "%02x", *(traceCard + i * 16 + j)); 
+		fprintf(f,"\n");
+	}
+	fclose(f);
+
+	return 0;
+}
+
+int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile) {
+
+	if (traceCrypto1) crypto1_destroy(traceCrypto1);
+	traceCrypto1 = NULL;
+
+	if (wantSaveToEmlFile) loadTraceCard(tuid);
 	traceCard[4] = traceCard[0] ^ traceCard[1] ^ traceCard[2] ^ traceCard[3];
 	traceCard[5] = sak;
 	memcpy(&traceCard[6], atqa, 2);
@@ -331,7 +404,7 @@ void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len, bool i
 }
 
 
-int mfTraceDecode(uint8_t *data_src, int len) {
+int mfTraceDecode(uint8_t *data_src, int len, uint32_t parity, bool wantSaveToEmlFile) {
 	uint8_t data[64];
 
 	if (traceState == TRACE_ERROR) return 1;
@@ -349,7 +422,13 @@ int mfTraceDecode(uint8_t *data_src, int len) {
 	
 	switch (traceState) {
 	case TRACE_IDLE: 
-		// TODO: check packet crc16!
+		// check packet crc16!
+		if ((len >= 4) && (!CheckCrc14443(CRC_14443_A, data, len))) {
+			PrintAndLog("dec> CRC ERROR!!!");
+			AddLogLine(logHexFileName, "dec> ", "CRC ERROR!!!"); 
+			traceState = TRACE_ERROR;  // do not decrypt the next commands
+			return 1;
+		}
 		
 		// AUTHENTICATION
 		if ((len ==4) && ((data[0] == 0x60) || (data[0] == 0x61))) {
@@ -386,7 +465,12 @@ int mfTraceDecode(uint8_t *data_src, int len) {
 		if (len == 18) {
 			traceState = TRACE_IDLE;
 
-			memcpy(traceCard + traceCurBlock * 16, data, 16);
+			if (isBlockTrailer(traceCurBlock)) {
+				memcpy(traceCard + traceCurBlock * 16 + 6, data + 6, 4);
+			} else {
+				memcpy(traceCard + traceCurBlock * 16, data, 16);
+			}
+			if (wantSaveToEmlFile) saveTraceCard();
 			return 0;
 		} else {
 			traceState = TRACE_ERROR;
@@ -410,6 +494,7 @@ int mfTraceDecode(uint8_t *data_src, int len) {
 			traceState = TRACE_IDLE;
 
 			memcpy(traceCard + traceCurBlock * 16, data, 16);
+			if (wantSaveToEmlFile) saveTraceCard();
 			return 0;
 		} else {
 			traceState = TRACE_ERROR;
@@ -422,6 +507,7 @@ int mfTraceDecode(uint8_t *data_src, int len) {
 			traceState = TRACE_AUTH2;
 
 			nt = bytes_to_num(data, 4);
+			nt_par = parity;
 			return 0;
 		} else {
 			traceState = TRACE_ERROR;
@@ -435,6 +521,7 @@ int mfTraceDecode(uint8_t *data_src, int len) {
 
 			nr_enc = bytes_to_num(data, 4);
 			ar_enc = bytes_to_num(data + 4, 4);
+			nr_ar_par = parity;
 			return 0;
 		} else {
 			traceState = TRACE_ERROR;
@@ -447,6 +534,7 @@ int mfTraceDecode(uint8_t *data_src, int len) {
 			traceState = TRACE_IDLE;
 
 			at_enc = bytes_to_num(data, 4);
+			at_par = parity;
 			
 			//  decode key here)
 			if (!traceCrypto1) {
@@ -470,11 +558,15 @@ int mfTraceDecode(uint8_t *data_src, int len) {
 			printf("key> %x%x\n", (unsigned int)((lfsr & 0xFFFFFFFF00000000) >> 32), (unsigned int)(lfsr & 0xFFFFFFFF));
 			AddLogUint64(logHexFileName, "key> ", lfsr); 
 			
+			int blockShift = ((traceCurBlock & 0xFC) + 3) * 16;
+			if (isBlockEmpty((traceCurBlock & 0xFC) + 3)) memcpy(traceCard + blockShift + 6, trailerAccessBytes, 4);
+			
 			if (traceCurKey) {
-				num_to_bytes(lfsr, 6, traceCard + traceCurBlock * 16 + 10);
+				num_to_bytes(lfsr, 6, traceCard + blockShift + 10);
 			} else {
-				num_to_bytes(lfsr, 6, traceCard + traceCurBlock * 16);
+				num_to_bytes(lfsr, 6, traceCard + blockShift);
 			}
+			if (wantSaveToEmlFile) saveTraceCard();
 
 			if (traceCrypto1) {
 				crypto1_destroy(traceCrypto1);