break;
case CMD_SIMULATE_TAG_125K:
LED_A_ON();
- SimulateTagLowFrequency(c->arg[0], c->arg[1], 1);
+ SimulateTagLowFrequency(c->arg[0], c->arg[1], 0);
LED_A_OFF();
break;
case CMD_LF_SIMULATE_BIDIR:
// return code
int return_code = 0;
// card UID
- uint8_t uid[8];
+ uint8_t uid[10];
// card select information
iso14a_card_select_t card_select_info;
// power up the field
if ((sak & 0x04) /* && uid_resp[0] == 0x88 */) {
// Remove first byte, 0x88 is not an UID byte, it CT, see page 3 of:
// http://www.nxp.com/documents/application_note/AN10927.pdf
- memcpy(uid_resp, uid_resp + 1, 3);
+ // This was earlier:
+ //memcpy(uid_resp, uid_resp + 1, 3);
+ // But memcpy should not be used for overlapping arrays,
+ // and memmove appears to not be available in the arm build.
+ // So this has been replaced with a for-loop:
+ for(int xx = 0; xx < 3; xx++)
+ uid_resp[xx] = uid_resp[xx+1];
uid_resp_len = 3;
}
uint8_t uid[10];
uint32_t cuid;
- uint32_t nt, previous_nt;
+ uint32_t nt = 0;
+ uint32_t previous_nt = 0;
static uint32_t nt_attacked = 0;
byte_t par_list[8] = {0,0,0,0,0,0,0,0};
byte_t ks_list[8] = {0,0,0,0,0,0,0,0};
#include "crapto1.h"
#include "mifareutil.h"
+#define SHORT_COIL() LOW(GPIO_SSC_DOUT)
+#define OPEN_COIL() HIGH(GPIO_SSC_DOUT)
+
void LFSetupFPGAForADC(int divisor, bool lf_field)
{
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
{
uint8_t *dest = mifare_get_bigbufptr();
int n = 24000;
- int i;
-
+ int i = 0;
memset(dest, 0x00, n);
- i = 0;
+
for(;;) {
if (AT91C_BASE_SSC->SSC_SR & AT91C_SSC_TXRDY) {
AT91C_BASE_SSC->SSC_THR = 0x43;
{
if (b&(1<<i)) {
// stop modulating antenna
- LOW(GPIO_SSC_DOUT);
+ SHORT_COIL();
SpinDelayUs(1000);
// modulate antenna
- HIGH(GPIO_SSC_DOUT);
+ OPEN_COIL();
SpinDelayUs(1000);
} else {
// stop modulating antenna
- LOW(GPIO_SSC_DOUT);
+ SHORT_COIL();
SpinDelayUs(300);
// modulate antenna
- HIGH(GPIO_SSC_DOUT);
+ OPEN_COIL();
SpinDelayUs(1700);
}
}
void SimulateTagLowFrequency(int period, int gap, int ledcontrol)
{
- int i;
+ int i = 0;
uint8_t *buff = (uint8_t *)BigBuf;
-
+
FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT);
SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
-
- // Give it a bit of time for the resonant antenna to settle.
- SpinDelay(150);
-
+
+ // Configure output and enable pin that is connected to the FPGA (for modulating)
AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK;
AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
+
AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK;
-
-#define SHORT_COIL() LOW(GPIO_SSC_DOUT)
-#define OPEN_COIL() HIGH(GPIO_SSC_DOUT)
-
- i = 0;
- for(;;) {
+
+ // Give it a bit of time for the resonant antenna to settle.
+ SpinDelay(30);
+
+ for(;;) {
+
while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK)) {
- if(BUTTON_PRESS()) {
- DbpString("Stopped");
- return;
- }
- WDT_HIT();
+ if(BUTTON_PRESS()) {
+ DbpString("Stopped at 0");
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
+ return;
+ }
+ WDT_HIT();
}
- if (ledcontrol)
- LED_D_ON();
-
- if(buff[i])
+ if ( buff[i] )
OPEN_COIL();
else
SHORT_COIL();
-
- if (ledcontrol)
- LED_D_OFF();
-
- while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
- if(BUTTON_PRESS()) {
- DbpString("Stopped");
+
+ while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_CLK) {
+ if(BUTTON_PRESS()) {
+ DbpString("Stopped at 1");
+ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); // field off
return;
}
WDT_HIT();
- }
+ }
- i++;
+ ++i;
if(i == period) {
i = 0;
if (gap) {
+ // turn of modulation
SHORT_COIL();
- SpinDelayUs(gap);
- }
+ // wait
+ SpinDelay(gap);
+ }
}
}
}
if (ledcontrol)
LED_A_ON();
+
SimulateTagLowFrequency(n, 0, ledcontrol);
if (ledcontrol)
LFSetupFPGAForADC(0, true);
while(!BUTTON_PRESS()) {
-
-
WDT_HIT();
if (ledcontrol) LED_A_ON();
{
struct version_information *v = (struct version_information*)version_information;
dst[0] = 0;
- strncat(dst, prefix, len);
+ strncat(dst, prefix, len-1);
if(v->magic != VERSION_INFORMATION_MAGIC) {
strncat(dst, "Missing/Invalid version information", len - strlen(dst) - 1);
return;
/* But it does not work if compiling on WIndows: therefore we just allocate a */
/* large array */
- uint8_t BitStream[MAX_GRAPH_TRACE_LEN];
+ uint8_t BitStream[MAX_GRAPH_TRACE_LEN] = {0x00};
/* Detect high and lows */
for (i = 0; i < GraphTraceLen; i++)
}
/* Get our clock */
- clock = GetClock(Cmd, high, 1);
-
+ clock = GetClock(Cmd, high, 1);
int tolerance = clock/4;
/* Detect first transition */
break;
}
}
-
- PrintAndLog("Clock: %d", clock);
/* If we're not working with 1/0s, demod based off clock */
if (high != 1)
int CmdManchesterMod(const char *Cmd)
{
int i, j;
- int clock;
int bit, lastbit, wave;
-
- /* Get our clock */
- clock = GetClock(Cmd, 0, 1);
-
+ int clock = GetClock(Cmd, 0, 1);
+ int clock1 = GetT55x7Clock( GraphBuffer, GraphTraceLen, 0 );
+ PrintAndLog("MAN MOD CLOCKS: %d ice %d", clock,clock1);
+
+ int half = (int)(clock/2);
+
wave = 0;
lastbit = 1;
for (i = 0; i < (int)(GraphTraceLen / clock); i++)
{
bit = GraphBuffer[i * clock] ^ 1;
- for (j = 0; j < (int)(clock/2); j++)
+ for (j = 0; j < half; ++j)
GraphBuffer[(i * clock) + j] = bit ^ lastbit ^ wave;
- for (j = (int)(clock/2); j < clock; j++)
+ for (j = half; j < clock; ++j)
GraphBuffer[(i * clock) + j] = bit ^ lastbit ^ wave ^ 1;
/* Keep track of how we start our wave and if we changed or not this time */
*/
int prepareHF15Cmd(char **cmd, UsbCommand *c, uint8_t iso15cmd[], int iso15cmdlen) {
int temp;
- uint8_t *req=c->d.asBytes, uid[8];
- uint32_t reqlen=0;
+ uint8_t *req = c->d.asBytes;
+ uint8_t uid[8] = {0x00};
+ uint32_t reqlen = 0;
// strip
while (**cmd==' ' || **cmd=='\t') (*cmd)++;
SendCommand(&c);
UsbCommand resp;
-
+ uint8_t key_sel[8] = {0x00};
+ uint8_t key_sel_p[8] = {0x00};
+
if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
uint8_t isOK = resp.arg[0] & 0xff;
uint8_t * data = resp.d.asBytes;
{
if(elite)
{
- uint8_t key_sel[8] = {0};
- uint8_t key_sel_p[8] = { 0 };
+
//Get the key index (hash1)
uint8_t key_index[8] = {0};
\r
int size = GetCardSize(); \r
char cmdp = param_getchar(Cmd, 0);\r
- \r
- \r
\r
if ( size > -1) \r
cmdp = (char)(48+size);\r
}\r
\r
if ((fin = fopen("dumpkeys.bin","rb")) == NULL) {\r
- PrintAndLog("Could not find file dumpkeys.bin");\r
+ PrintAndLog("Could not find file dumpkeys.bin"); \r
return 1;\r
}\r
\r
for (sectorNo=0; sectorNo<numSectors; sectorNo++) {\r
if (fread( keyA[sectorNo], 1, 6, fin ) == 0) {\r
PrintAndLog("File reading error.");\r
+ fclose(fin);\r
return 2;\r
}\r
}\r
for (sectorNo=0; sectorNo<numSectors; sectorNo++) {\r
if (fread( keyB[sectorNo], 1, 6, fin ) == 0) {\r
PrintAndLog("File reading error.");\r
+ fclose(fin);\r
return 2;\r
}\r
}\r
\r
+ fclose(fin);\r
+ \r
PrintAndLog("|-----------------------------------------|");\r
PrintAndLog("|------ Reading sector access bits...-----|");\r
PrintAndLog("|-----------------------------------------|");\r
PrintAndLog("Dumped %d blocks (%d bytes) to file dumpdata.bin", numblocks, 16*numblocks);\r
}\r
\r
- fclose(fin);\r
return 0;\r
}\r
\r
keycnt++;\r
memset(buf, 0, sizeof(buf));\r
}\r
+ fclose(f);\r
} else {\r
PrintAndLog("File: %s: not found or locked.", filename);\r
free(keyBlock);\r
return 1;\r
- fclose(f);\r
+ \r
}\r
}\r
}\r
break;\r
}\r
PrintAndLog("File reading error.");\r
+ fclose(f);\r
return 2;\r
}\r
if (strlen(buf) < 32){\r
\r
if ((blockNum != 16*4) && (blockNum != 32*4 + 8*16)) {\r
PrintAndLog("File content error. There must be 64 or 256 blocks.");\r
+ fclose(f);\r
return 4;\r
}\r
PrintAndLog("Loaded %d blocks from file: %s", blockNum, filename);\r
int CmdHF14AMfCSetUID(const char *Cmd)\r
{\r
uint8_t wipeCard = 0;\r
- uint8_t uid[8];\r
- uint8_t oldUid[8];\r
+ uint8_t uid[8] = {0x00};\r
+ uint8_t oldUid[8] = {0x00};\r
int res;\r
\r
if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') {\r
printf(".");
}
printf("\n");
- PrintAndLog("Starting simulator...");
+ PrintAndLog("Starting to simulate");
UsbCommand c = {CMD_SIMULATE_TAG_125K, {GraphTraceLen, gap, 0}};
SendCommand(&c);
return 0;
/* get clock */
clock = GetClock(Cmd, high, 0);
-
+
+
/* parity for our 4 columns */
parity[0] = parity[1] = parity[2] = parity[3] = 0;
header = rows = 0;
int clock = 64;
/* clear our graph */
- ClearGraph(0);
- GraphTraceLen = 0;
+ ClearGraph(1);
/* write it out a few times */
for (h = 0; h < 4; h++)
}
/* modulate that biatch */
- CmdManchesterMod("");
+ CmdManchesterMod("64");
/* booyah! */
RepaintGraphWindow();
- CmdLFSim("64");
+ CmdLFSim("");
return 0;
}
}
CmdLFRead(read_h ? "h" : "");
- CmdSamples("12000");
+ CmdSamples("16000");
} while (
- !CmdEM410xRead("64")
+ !CmdEM410xRead("")
);
return 0;
}
++i;
while ((GraphBuffer[i] > low) && (i<GraphTraceLen))
++i;
- if (j>(MAX_GRAPH_TRACE_LEN/64)) {
+ if (j>=(MAX_GRAPH_TRACE_LEN/64)) {
break;
}
tmpbuff[j++]= i - start;
return 1;
}
- PrintAndLog("Writting word %d with data %08X", Word, Data);
+ PrintAndLog("Writing word %d with data %08X", Word, Data);
c.cmd = CMD_EM4X_WRITE_WORD;
c.d.asBytes[0] = 0x0; //Normal mode
int CmdWriteWordPWD(const char *Cmd)
{
- int Word = 8; //default to invalid word
+ int Word = 16; //default to invalid word
int Data = 0xFFFFFFFF; //default to blank data
int Password = 0xFFFFFFFF; //default to blank password
UsbCommand c;
return 1;
}
- PrintAndLog("Writting word %d with data %08X and password %08X", Word, Data, Password);
+ PrintAndLog("Writing word %d with data %08X and password %08X", Word, Data, Password);
c.cmd = CMD_EM4X_WRITE_WORD;
c.d.asBytes[0] = 0x1; //Password mode
{"rdpwd", CmdReadBlkPWD, 0, "<block> <password> -- Read T55xx block data with password mode"},\r
{"wr", CmdWriteBlk, 0, "<data> <block> -- Write T55xx block data (page 0)"},\r
{"wrpwd", CmdWriteBlkPWD, 0, "<data> <block> <password> -- Write T55xx block data with password"},\r
- {"trace", CmdReadTrace, 0, "[1] Read T55xx traceability data (page 1 / blk 0-1) "},\r
- {"info", CmdInfo, 0, "[1] Read T55xx configuration data (page0 /blk 0)"},\r
+ {"trace", CmdReadTrace, 0, "[1] Read T55xx traceability data (page 1/ blk 0-1)"},\r
+ {"info", CmdInfo, 0, "[1] Read T55xx configuration data (page 0/ blk 0)"},\r
{"dump", CmdDump, 0, "[password] Dump T55xx card block 0-7. optional with password"},\r
{"fsk", CmdIceFsk, 0, "FSK demod"},\r
{"man", CmdIceManchester, 0, "Manchester demod (with SST)"},\r
* @return true if command was returned, otherwise false
*/
bool WaitForResponseTimeout(uint32_t cmd, UsbCommand* response, size_t ms_timeout) {
-
+
+ UsbCommand resp;
+
if (response == NULL) {
- UsbCommand resp;
+
response = &resp;
}
void AppendGraph(int redraw, int clock, int bit)
{
int i;
-
- for (i = 0; i < (int)(clock / 2); ++i)
- GraphBuffer[GraphTraceLen++] = bit ^ 1;
+ int half = (int)(clock/2);
+ int firstbit = bit ^ 1;
+
+ for (i = 0; i < half; ++i)
+ GraphBuffer[GraphTraceLen++] = firstbit;
- for (i = (int)(clock / 2); i < clock; ++i)
+ for (i = 0; i <= half; ++i)
GraphBuffer[GraphTraceLen++] = bit;
if (redraw)
lastpeak = i;
}
}
-
- return clock;
+
+ int clockmod = clock%8;
+ if ( clockmod == 0)
+ return clock;
+
+ // When detected clock is 31 or 33 then return 32
+
+ printf("Found clock at %d ", clock);
+ switch( clockmod )
+ {
+ case 7: clock++; break;
+ case 6: clock += 2 ; break;
+ case 1: clock--; break;
+ case 2: clock -= 2; break;
+ }
+ printf("- adjusted it to %d \n", clock);
+ return clock;
}
/* Get or auto-detect clock rate */
int readKeyFile(uint8_t key[8])
{
-
FILE *f;
-
+ int retval = 1;
f = fopen("iclass_key.bin", "rb");
if (f)
{
if(fread(key, sizeof(key), 1, f) == 1) return 0;
}
- return 1;
-
+ return retval;
}
// variables\r
char logHexFileName[200] = {0x00};\r
static uint8_t traceCard[4096] = {0x00};\r
-static char traceFileName[20];\r
+static char traceFileName[200] = {0x00};\r
static int traceState = TRACE_IDLE;\r
static uint8_t traceCurBlock = 0;\r
static uint8_t traceCurKey = 0;\r
}\r
\r
// AUTHENTICATION\r
- if ((len ==4) && ((data[0] == 0x60) || (data[0] == 0x61))) {\r
+ if ((len == 4) && ((data[0] == 0x60) || (data[0] == 0x61))) {\r
traceState = TRACE_AUTH1;\r
traceCurBlock = data[1];\r
traceCurKey = data[0] == 60 ? 1:0;\r
break;\r
\r
case TRACE_WRITE_OK: \r
- if ((len == 1) && (data[0] = 0x0a)) {\r
+ if ((len == 1) && (data[0] == 0x0a)) {\r
traceState = TRACE_WRITE_DATA;\r
\r
return 0;\r
at_par = parity;\r
\r
// decode key here)\r
- if (!traceCrypto1) {\r
- ks2 = ar_enc ^ prng_successor(nt, 64);\r
- ks3 = at_enc ^ prng_successor(nt, 96);\r
- revstate = lfsr_recovery64(ks2, ks3);\r
- lfsr_rollback_word(revstate, 0, 0);\r
- lfsr_rollback_word(revstate, 0, 0);\r
- lfsr_rollback_word(revstate, nr_enc, 1);\r
- lfsr_rollback_word(revstate, uid ^ nt, 0);\r
- }else{\r
- ks2 = ar_enc ^ prng_successor(nt, 64);\r
- ks3 = at_enc ^ prng_successor(nt, 96);\r
- revstate = lfsr_recovery64(ks2, ks3);\r
- lfsr_rollback_word(revstate, 0, 0);\r
- lfsr_rollback_word(revstate, 0, 0);\r
- lfsr_rollback_word(revstate, nr_enc, 1);\r
- lfsr_rollback_word(revstate, uid ^ nt, 0);\r
- }\r
+ ks2 = ar_enc ^ prng_successor(nt, 64);\r
+ ks3 = at_enc ^ prng_successor(nt, 96);\r
+ revstate = lfsr_recovery64(ks2, ks3);\r
+ lfsr_rollback_word(revstate, 0, 0);\r
+ lfsr_rollback_word(revstate, 0, 0);\r
+ lfsr_rollback_word(revstate, nr_enc, 1);\r
+ lfsr_rollback_word(revstate, uid ^ nt, 0);\r
+\r
crypto1_get_lfsr(revstate, &lfsr);\r
printf("key> %x%x\n", (unsigned int)((lfsr & 0xFFFFFFFF00000000) >> 32), (unsigned int)(lfsr & 0xFFFFFFFF));\r
AddLogUint64(logHexFileName, "key> ", lfsr); \r
\r
statelist = malloc((sizeof *statelist) << 21); //how large should be? \r
if(!statelist || !odd || !even)\r
- return 0;\r
+ {\r
+ free(statelist);\r
+ free(odd);\r
+ free(even);\r
+ return 0;\r
+ }\r
\r
s = statelist;\r
for(o = odd; *o != -1; ++o)\r
lastpeak = i;
}
}
- //return clock;
- //defaults clock to precise values.
- switch(clock){
- case 8:
- case 16:
- case 32:
- case 40:
- case 50:
- case 64:
- case 100:
- case 128:
- return clock;
- break;
- default: break;
- }
-
- //PrintAndLog(" Found Clock : %d - trying to adjust", clock);
// When detected clock is 31 or 33 then then return
int clockmod = clock%8;
- if ( clockmod == 7 )
- clock += 1;
- else if ( clockmod == 1 )
- clock -= 1;
+ if ( clockmod == 0) return clock;
+
+ if ( clockmod == 7 ) clock += 1;
+ else if ( clockmod == 1 ) clock -= 1;
return clock;
}