]> cvs.zerfleddert.de Git - proxmark3-svn/commitdiff
Merged latest trunk changes into scripting-branch
authormartin.holst@gmail.com <martin.holst@gmail.com@ef4ab9da-24cd-11de-8aaa-f3a34680c41f>
Sun, 1 Sep 2013 20:00:56 +0000 (20:00 +0000)
committermartin.holst@gmail.com <martin.holst@gmail.com@ef4ab9da-24cd-11de-8aaa-f3a34680c41f>
Sun, 1 Sep 2013 20:00:56 +0000 (20:00 +0000)
18 files changed:
armsrc/appmain.c
armsrc/apps.h
armsrc/iso14443.c
armsrc/iso14443a.c
armsrc/mifarecmd.c
armsrc/util.c
armsrc/util.h
client/Makefile
client/cmddata.c
client/cmdhf14b.c
client/cmdhflegic.c
client/cmdhfmf.c
client/cmdmain.c
client/nonce2key/nonce2key.c
client/nonce2key/nonce2key.h
client/proxmark3.c
client/uart.c
include/usb_cmd.h

index cecf4d35e1156774fa02b26d0c997cdd08f986b8..cfde4fbb63733bf87d257eed430e1fd9a2e36c64 100644 (file)
@@ -626,7 +626,7 @@ void UsbPacketReceived(uint8_t *packet, int len)
 #ifdef WITH_LF
                case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
                        AcquireRawAdcSamples125k(c->arg[0]);
-      cmd_send(CMD_ACK,0,0,0,0,0);
+                       cmd_send(CMD_ACK,0,0,0,0,0);
                        break;
                case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
                        ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
@@ -638,7 +638,7 @@ void UsbPacketReceived(uint8_t *packet, int len)
                        CmdHIDsimTAG(c->arg[0], c->arg[1], 1);                                  // Simulate HID tag by ID
                        break;
     case CMD_HID_CLONE_TAG: // Clone HID tag by ID to T55x7
-      CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
+                       CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
                        break;
                case CMD_EM410X_WRITE_TAG:
                        WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
@@ -663,26 +663,26 @@ void UsbPacketReceived(uint8_t *packet, int len)
                case CMD_INDALA_CLONE_TAG_L:                                    // Clone Indala 224-bit tag by UID to T55x7
                        CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
                        break;
-    case CMD_T55XX_READ_BLOCK:
-      T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
-      break;
-    case CMD_T55XX_WRITE_BLOCK:
-      T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
-      break;
-    case CMD_T55XX_READ_TRACE: // Clone HID tag by ID to T55x7
-      T55xxReadTrace();
-      break;
-    case CMD_PCF7931_READ: // Read PCF7931 tag
-      ReadPCF7931();
-      cmd_send(CMD_ACK,0,0,0,0,0);
-//      UsbSendPacket((uint8_t*)&ack, sizeof(ack));
-      break;
-    case CMD_EM4X_READ_WORD:
-      EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
-      break;
-    case CMD_EM4X_WRITE_WORD:
-      EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
-      break;
+               case CMD_T55XX_READ_BLOCK:
+                       T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
+                       break;
+               case CMD_T55XX_WRITE_BLOCK:
+                       T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
+                       break;
+               case CMD_T55XX_READ_TRACE: // Clone HID tag by ID to T55x7
+                       T55xxReadTrace();
+                       break;
+               case CMD_PCF7931_READ: // Read PCF7931 tag
+                       ReadPCF7931();
+                       cmd_send(CMD_ACK,0,0,0,0,0);
+//             UsbSendPacket((uint8_t*)&ack, sizeof(ack));
+                       break;
+               case CMD_EM4X_READ_WORD:
+                       EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
+                       break;
+               case CMD_EM4X_WRITE_WORD:
+                       EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
+                       break;
 #endif
 
 #ifdef WITH_HITAG
@@ -744,10 +744,10 @@ void UsbPacketReceived(uint8_t *packet, int len)
                        AcquireRawAdcSamplesIso14443(c->arg[0]);
                        break;
                case CMD_READ_SRI512_TAG:
-                       ReadSRI512Iso14443(c->arg[0]);
+                       ReadSTMemoryIso14443(0x0F);
                        break;
                case CMD_READ_SRIX4K_TAG:
-                       ReadSRIX4KIso14443(c->arg[0]);
+                       ReadSTMemoryIso14443(0x7F);
                        break;
                case CMD_SNOOP_ISO_14443:
                        SnoopIso14443();
@@ -755,6 +755,9 @@ void UsbPacketReceived(uint8_t *packet, int len)
                case CMD_SIMULATE_TAG_ISO_14443:
                        SimulateIso14443Tag();
                        break;
+               case CMD_ISO_14443B_COMMAND:
+                       SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
+                       break;
 #endif
 
 #ifdef WITH_ISO14443a
@@ -772,7 +775,7 @@ void UsbPacketReceived(uint8_t *packet, int len)
                        break;
                        
                case CMD_READER_MIFARE:
-            ReaderMifare(c);
+            ReaderMifare(c->arg[0]);
                        break;
                case CMD_MIFARE_READBL:
                        MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
@@ -877,13 +880,13 @@ void UsbPacketReceived(uint8_t *packet, int len)
       //                       UsbSendPacket((uint8_t *)&n, sizeof(n));
       //                       LED_B_OFF();
 
-      LED_B_ON();
-      for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
-        size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
-        cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,0,((byte_t*)BigBuf)+c->arg[0]+i,len);
-      }
-      // Trigger a finish downloading signal with an ACK frame
-      cmd_send(CMD_ACK,0,0,0,0,0);
+                       LED_B_ON();
+                       for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
+                               size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
+                               cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,0,((byte_t*)BigBuf)+c->arg[0]+i,len);
+                       }
+                       // Trigger a finish downloading signal with an ACK frame
+                       cmd_send(CMD_ACK,0,0,0,0,0);
                        LED_B_OFF();
                } break;
 
@@ -892,9 +895,9 @@ void UsbPacketReceived(uint8_t *packet, int len)
                        memcpy(b+c->arg[0], c->d.asBytes, 48);
                        //Dbprintf("copied 48 bytes to %i",b+c->arg[0]);
 //                     UsbSendPacket((uint8_t*)&ack, sizeof(ack));
-      cmd_send(CMD_ACK,0,0,0,0,0);
-               } break;
-
+                       cmd_send(CMD_ACK,0,0,0,0,0);
+                       break;
+               }       
                case CMD_READ_MEM:
                        ReadMem(c->arg[0]);
                        break;
@@ -926,35 +929,35 @@ void UsbPacketReceived(uint8_t *packet, int len)
 #endif
                case CMD_SETUP_WRITE:
                case CMD_FINISH_WRITE:
-               case CMD_HARDWARE_RESET: {
-      usb_disable();
+               case CMD_HARDWARE_RESET:
+                       usb_disable();
                        SpinDelay(1000);
                        SpinDelay(1000);
                        AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
                        for(;;) {
                                // We're going to reset, and the bootrom will take control.
                        }
-        } break;
+                       break;
 
-               case CMD_START_FLASH: {
+               case CMD_START_FLASH:
                        if(common_area.flags.bootrom_present) {
                                common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
                        }
-      usb_disable();
+                       usb_disable();
                        AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
                        for(;;);
-        } break;
+                       break;
 
                case CMD_DEVICE_INFO: {
                        uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
                        if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
 //                     UsbSendPacket((uint8_t*)&c, sizeof(c));
-      cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
-               } break;
-            
-               default: {
+                       cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);     
+                       break;
+               }
+               default:
                        Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
-        } break;
+                       break;
        }
 }
 
index 2f003cc49ab0600df0761b1951b5ad19a54d78c3..9574a937282e30edc351a10238cbd43f4bff3cb9 100644 (file)
@@ -135,10 +135,9 @@ void EM4xWriteWord(uint32_t Data, uint8_t Address, uint32_t Pwd, uint8_t PwdMode
 /// iso14443.h
 void SimulateIso14443Tag(void);
 void AcquireRawAdcSamplesIso14443(uint32_t parameter);
-void ReadSRI512Iso14443(uint32_t parameter);
-void ReadSRIX4KIso14443(uint32_t parameter);
-void ReadSTMemoryIso14443(uint32_t parameter,uint32_t dwLast);
+void ReadSTMemoryIso14443(uint32_t);
 void RAMFUNC SnoopIso14443(void);
+void SendRawCommand14443B(uint32_t, uint32_t, uint8_t, uint8_t[]);
 
 /// iso14443a.h
 void RAMFUNC SnoopIso14443a(uint8_t param);
@@ -156,7 +155,7 @@ void RAMFUNC SniffMifare(uint8_t param);
 void EPA_PACE_Collect_Nonce(UsbCommand * c);
 
 // mifarecmd.h
-void ReaderMifare(UsbCommand *c);
+void ReaderMifare(bool first_try);
 void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *data);
 void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain);
 void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain);
index 9452ae83091c7415dee11fb65d4d3001a545be5d..ca06fc813cc067f68d7abfc7f6dc9d1eb80eca39 100644 (file)
@@ -537,7 +537,7 @@ static RAMFUNC int Handle14443SamplesDemod(int ci, int cq)
                 if(Demod.posCount < 12) {
                     Demod.state = DEMOD_UNSYNCD;
                 } else {
-                       LED_C_ON(); // Got SOF
+                    LED_C_ON(); // Got SOF
                     Demod.state = DEMOD_AWAITING_START_BIT;
                     Demod.posCount = 0;
                     Demod.len = 0;
@@ -598,8 +598,8 @@ static RAMFUNC int Handle14443SamplesDemod(int ci, int cq)
                     } else if(s == 0x000) {
                         // This is EOF
                        LED_C_OFF();
-                        return TRUE;
                         Demod.state = DEMOD_UNSYNCD;
+                        return TRUE;
                     } else {
                         Demod.state = DEMOD_UNSYNCD;
                     }
@@ -639,7 +639,7 @@ static void GetSamplesFor14443Demod(int weTx, int n, int quiet)
     int samples = 0;
 
     // Clear out the state of the "UART" that receives from the tag.
-    memset(BigBuf, 0x44, 400);
+    memset(BigBuf, 0x00, 400);
     Demod.output = (uint8_t *)BigBuf;
     Demod.len = 0;
     Demod.state = DEMOD_UNSYNCD;
@@ -656,7 +656,7 @@ static void GetSamplesFor14443Demod(int weTx, int n, int quiet)
     FpgaSetupSscDma((uint8_t *)dmaBuf, DEMOD_DMA_BUFFER_SIZE);
 
     // Signal field is ON with the appropriate LED:
-       if (weTx) LED_D_ON(); else LED_D_OFF();
+    if (weTx) LED_D_ON(); else LED_D_OFF();
     // And put the FPGA in the appropriate mode
     FpgaWriteConfWord(
        FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
@@ -786,7 +786,7 @@ static void TransmitFor14443(void)
 // Code a layer 2 command (string of octets, including CRC) into ToSend[],
 // so that it is ready to transmit to the tag using TransmitFor14443().
 //-----------------------------------------------------------------------------
-void CodeIso14443bAsReader(const uint8_t *cmd, int len)
+static void CodeIso14443bAsReader(const uint8_t *cmd, int len)
 {
     int i, j;
     uint8_t b;
@@ -843,32 +843,14 @@ void CodeIso14443bAsReader(const uint8_t *cmd, int len)
 // responses.
 // The command name is misleading, it actually decodes the reponse in HEX
 // into the output buffer (read the result using hexsamples, not hisamples)
+//
+// obsolete function only for test
 //-----------------------------------------------------------------------------
 void AcquireRawAdcSamplesIso14443(uint32_t parameter)
 {
     uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
 
-    // Make sure that we start from off, since the tags are stateful;
-    // confusing things will happen if we don't reset them between reads.
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-    LED_D_OFF();
-    SpinDelay(200);
-
-    SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
-    FpgaSetupSsc();
-
-    // Now give it time to spin up.
-    // Signal field is on with the appropriate LED
-    LED_D_ON();
-    FpgaWriteConfWord(
-       FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
-    SpinDelay(200);
-
-    CodeIso14443bAsReader(cmd1, sizeof(cmd1));
-    TransmitFor14443();
-//    LED_A_ON();
-    GetSamplesFor14443Demod(TRUE, 2000, FALSE);
-//    LED_A_OFF();
+    SendRawCommand14443B(sizeof(cmd1),1,1,cmd1);
 }
 
 //-----------------------------------------------------------------------------
@@ -880,16 +862,7 @@ void AcquireRawAdcSamplesIso14443(uint32_t parameter)
 //
 // I tried to be systematic and check every answer of the tag, every CRC, etc...
 //-----------------------------------------------------------------------------
-void ReadSRI512Iso14443(uint32_t parameter)
-{
-     ReadSTMemoryIso14443(parameter,0x0F);
-}
-void ReadSRIX4KIso14443(uint32_t parameter)
-{
-     ReadSTMemoryIso14443(parameter,0x7F);
-}
-
-void ReadSTMemoryIso14443(uint32_t parameter,uint32_t dwLast)
+void ReadSTMemoryIso14443(uint32_t dwLast)
 {
     uint8_t i = 0x00;
 
@@ -973,8 +946,8 @@ void ReadSTMemoryIso14443(uint32_t parameter,uint32_t dwLast)
        (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
        (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
 
-    // Now loop to read all 16 blocks, address from 0 to 15
-    DbpString("Tag memory dump, block 0 to 15");
+    // Now loop to read all 16 blocks, address from 0 to last block
+    Dbprintf("Tag memory dump, block 0 to %d",dwLast);
     cmd1[0] = 0x08;
     i = 0x00;
     dwLast++;
@@ -1072,13 +1045,12 @@ void RAMFUNC SnoopIso14443(void)
     Uart.byteCntMax = 100;
     Uart.state = STATE_UNSYNCD;
 
-       // Print some debug information about the buffer sizes
-       Dbprintf("Snooping buffers initialized:");
-       Dbprintf("  Trace: %i bytes", DEMOD_TRACE_SIZE);
-       Dbprintf("  Reader -> tag: %i bytes", READER_TAG_BUFFER_SIZE);
-       Dbprintf("  tag -> Reader: %i bytes", TAG_READER_BUFFER_SIZE);
-       Dbprintf("  DMA: %i bytes", DEMOD_DMA_BUFFER_SIZE);
-
+    // Print some debug information about the buffer sizes
+    Dbprintf("Snooping buffers initialized:");
+    Dbprintf("  Trace: %i bytes", DEMOD_TRACE_SIZE);
+    Dbprintf("  Reader -> tag: %i bytes", READER_TAG_BUFFER_SIZE);
+    Dbprintf("  tag -> Reader: %i bytes", TAG_READER_BUFFER_SIZE);
+    Dbprintf("  DMA: %i bytes", DEMOD_DMA_BUFFER_SIZE);
 
     // And put the FPGA in the appropriate mode
     // Signal field is off with the appropriate LED
@@ -1187,7 +1159,7 @@ void RAMFUNC SnoopIso14443(void)
             Demod.output = receivedResponse;
             Demod.state = DEMOD_UNSYNCD;
         }
-               WDT_HIT();
+       WDT_HIT();
 
         if(BUTTON_PRESS()) {
             DbpString("cancelled");
@@ -1207,3 +1179,56 @@ done:
        Dbprintf("  Uart ByteCntMax: %i", Uart.byteCntMax);
        Dbprintf("  Trace length: %i", traceLen);
 }
+
+/*
+ * Send raw command to tag ISO14443B
+ * @Input
+ * datalen     len of buffer data
+ * recv        bool when true wait for data from tag and send to client
+ * powerfield  bool leave the field on when true
+ * data        buffer with byte to send
+ *
+ * @Output
+ * none
+ *
+ */
+
+void SendRawCommand14443B(uint32_t datalen, uint32_t recv,uint8_t powerfield, uint8_t data[])
+{
+    if(!powerfield)
+    {
+        // Make sure that we start from off, since the tags are stateful;
+        // confusing things will happen if we don't reset them between reads.
+        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+        LED_D_OFF();
+        SpinDelay(200);
+    }
+
+    if(!GETBIT(GPIO_LED_D))
+    {
+        SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
+        FpgaSetupSsc();
+
+        // Now give it time to spin up.
+        // Signal field is on with the appropriate LED
+        LED_D_ON();
+        FpgaWriteConfWord(
+            FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
+        SpinDelay(200);
+    }
+
+    CodeIso14443bAsReader(data, datalen);
+    TransmitFor14443();
+    if(recv)
+    {
+        uint16_t iLen = MIN(Demod.len,USB_CMD_DATA_SIZE);
+        GetSamplesFor14443Demod(TRUE, 2000, TRUE);
+        cmd_send(CMD_ACK,iLen,0,0,Demod.output,iLen);
+    }
+    if(!powerfield)
+    {
+        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+        LED_D_OFF();
+    }
+}
+
index 111d713989caa1abc4d50ffa55513d95f83b6cf0..56afaeb84931dd3d1ee350576de0436c536eca4b 100644 (file)
@@ -1515,7 +1515,7 @@ static int GetIso14443aAnswerFromTag(uint8_t *receivedResponse, int maxLen, int
        // Signal field is on with the appropriate LED
        LED_D_ON();
        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_LISTEN);
-
+       
        // Now get the answer from the card
        Demod.output = receivedResponse;
        Demod.len = 0;
@@ -1612,11 +1612,11 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u
   int len;
         
   // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
-  ReaderTransmitBitsPar(wupa,7,0);
+    ReaderTransmitBitsPar(wupa,7,0);
   // Receive the ATQA
   if(!ReaderReceive(resp)) return 0;
 //  Dbprintf("atqa: %02x %02x",resp[0],resp[1]);
-  
+
   if(p_hi14a_card) {
     memcpy(p_hi14a_card->atqa, resp, 2);
     p_hi14a_card->uidlen = 0;
@@ -1625,7 +1625,7 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u
        
   // clear uid
   if (uid_ptr) {
-    memset(uid_ptr,0,8);
+    memset(uid_ptr,0,10);
   }
 
   // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
@@ -1688,7 +1688,7 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u
   // Request for answer to select
   AppendCrc14443a(rats, 2);
   ReaderTransmit(rats, sizeof(rats));
-  
+
   if (!(len = ReaderReceive(resp))) return 0;
 
   if(p_hi14a_card) {
@@ -1811,354 +1811,266 @@ void ReaderIso14443a(UsbCommand * c)
        LEDsoff();
 }
 
-#define TEST_LENGTH 100
-typedef struct mftest{
-    uint8_t nt[8];
-    uint8_t count;
-}mftest ;
-
-/**
- *@brief Tunes the mifare attack settings. This method checks the nonce entropy when
- *using a specified timeout.
- *Different cards behave differently, some cards require up to a second to power down (and thus reset
- *token generator), other cards are fine with 50 ms.
- *
- * @param time
- * @return the entropy. A value of 100 (%) means that every nonce was unique, while a value close to
- *zero indicates a low entropy: the given timeout is sufficient to power down the card.
- */
-int TuneMifare(int time)
+
+// prepare the Mifare AUTH transfer with an added necessary delay.
+void PrepareDelayedAuthTransfer(uint8_t* frame, int len, uint16_t delay)
 {
-    // Mifare AUTH
-    uint8_t mf_auth[]    = { 0x60,0x00,0xf5,0x7b };
-    uint8_t* receivedAnswer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
-
-    iso14443a_setup();
-    int TIME1=time;
-    int TIME2=2000;
-    uint8_t uid[8];
-    uint32_t cuid;
-    byte_t nt[4];
-    Dbprintf("Tuning... testing a delay of %d ms (press button to skip)",time);
-
-
-    mftest nt_values[TEST_LENGTH];
-    int nt_size = 0;
-    int i = 0;
-    for(i = 0 ; i< 100 ; i++)
-    {
-        LED_C_OFF();
-        FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-        SpinDelay(TIME1);
-        FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
-        LED_C_ON();
-        SpinDelayUs(TIME2);
-        if(!iso14443a_select_card(uid, NULL, &cuid)) continue;
-
-        // Transmit MIFARE_CLASSIC_AUTH
-        ReaderTransmit(mf_auth, sizeof(mf_auth));
-
-        // Receive the (16 bit) "random" nonce
-        if (!ReaderReceive(receivedAnswer)) continue;
-        memcpy(nt, receivedAnswer, 4);
-
-        //store it
-        int already_stored = 0;
-        for(int i =  0 ; i < nt_size && !already_stored; i++)
-        {
-            if( memcmp(nt, nt_values[i].nt, 4) == 0)
-            {
-                nt_values[i].count++;
-                already_stored = 1;
-            }
-        }
-        if(!already_stored)
-        {
-            mftest* ptr= &nt_values[nt_size++];
-            //Clear it before use
-            memset(ptr, 0, sizeof(mftest));
-            memcpy(ptr->nt, nt, 4);
-            ptr->count = 1;
-        }
+       CodeIso14443aBitsAsReaderPar(frame, len*8, GetParity(frame,len));
 
-        if(BUTTON_PRESS())
-        {
-            Dbprintf("Tuning aborted prematurely");
-            break;
-        }
-    }
-    /*
-    for(int i = 0 ; i < nt_size;i++){
-        mftest x = nt_values[i];
-        Dbprintf("%d,%d,%d,%d   : %d",x.nt[0],x.nt[1],x.nt[2],x.nt[3],x.count);
-    }
-    */
-    int result = nt_size *100 / i;
-    Dbprintf("      ... results for %d ms : %d %",time, result);
-    return result;
+       uint8_t bitmask = 0;
+       uint8_t bits_to_shift = 0;
+       uint8_t bits_shifted = 0;
+       
+       if (delay) {
+               for (uint16_t i = 0; i < delay; i++) {
+                       bitmask |= (0x01 << i);
+               }
+               ToSend[++ToSendMax] = 0x00;
+               for (uint16_t i = 0; i < ToSendMax; i++) {
+                       bits_to_shift = ToSend[i] & bitmask;
+                       ToSend[i] = ToSend[i] >> delay;
+                       ToSend[i] = ToSend[i] | (bits_shifted << (8 - delay));
+                       bits_shifted = bits_to_shift;
+               }
+       }
 }
 
-//-----------------------------------------------------------------------------
-// Read an ISO 14443a tag. Send out commands and store answers.
-//
-//-----------------------------------------------------------------------------
-#define STATE_SIZE 100
-typedef struct AttackState{
-    byte_t nt[4];
-    byte_t par_list[8];
-    byte_t ks_list[8];
-    byte_t par;
-    byte_t par_low;
-    byte_t nt_diff;
-    uint8_t mf_nr_ar[8];
-} AttackState;
-
-
-int continueAttack(AttackState* pState,uint8_t* receivedAnswer)
-{
 
-    // Transmit reader nonce and reader answer
-    ReaderTransmitPar(pState->mf_nr_ar, sizeof(pState->mf_nr_ar),pState->par);
 
-    // Receive 4 bit answer
-    int len = ReaderReceive(receivedAnswer);
-    if (!len)
-    {
-        if (pState->nt_diff == 0)
-        {
-            pState->par++;
-        } else {
-            pState->par = (((pState->par >> 3) + 1) << 3) | pState->par_low;
-        }
-        return 2;
-    }
-    if(pState->nt_diff == 0)
-    {
-        pState->par_low = pState->par & 0x07;
-    }
-    //Dbprintf("answer received, parameter (%d), (memcmp(nt, nt_no)=%d",parameter,memcmp(nt, nt_noattack, 4));
-    //if ( (parameter != 0) && (memcmp(nt, nt_noattack, 4) == 0) ) continue;
-    //isNULL =  0;//|| !(nt_attacked[0] == 0) && (nt_attacked[1] == 0) && (nt_attacked[2] == 0) && (nt_attacked[3] == 0);
-     //
-      //  if ( /*(isNULL != 0 ) && */(memcmp(nt, nt_attacked, 4) != 0) ) continue;
-
-    //led_on = !led_on;
-    //if(led_on) LED_B_ON(); else LED_B_OFF();
-    pState->par_list[pState->nt_diff] = pState->par;
-    pState->ks_list[pState->nt_diff] = receivedAnswer[0] ^ 0x05;
-
-    // Test if the information is complete
-    if (pState->nt_diff == 0x07) {
-        return 0;
-    }
+// Determine the distance between two nonces.
+// Assume that the difference is small, but we don't know which is first.
+// Therefore try in alternating directions.
+int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
+
+       uint16_t i;
+       uint32_t nttmp1, nttmp2;
+
+       if (nt1 == nt2) return 0;
 
-    pState->nt_diff = (pState->nt_diff + 1) & 0x07;
-    pState->mf_nr_ar[3] = pState->nt_diff << 5;
-    pState->par = pState->par_low;
-    return 1;
+       nttmp1 = nt1;
+       nttmp2 = nt2;
+       
+       for (i = 1; i < 32768; i++) {
+               nttmp1 = prng_successor(nttmp1, 1);
+               if (nttmp1 == nt2) return i;
+               nttmp2 = prng_successor(nttmp2, 1);
+                       if (nttmp2 == nt1) return -i;
+               }
+       
+       return(-99999); // either nt1 or nt2 are invalid nonces
 }
 
-void reportResults(uint8_t uid[8],AttackState *pState, int isOK)
-{
-    LogTrace(pState->nt, 4, 0, GetParity(pState->nt, 4), TRUE);
-    LogTrace(pState->par_list, 8, 0, GetParity(pState->par_list, 8), TRUE);
-    LogTrace(pState->ks_list, 8, 0, GetParity(pState->ks_list, 8), TRUE);
-
-    byte_t buf[48];
-    memcpy(buf + 0,  uid, 4);
-    if(pState != NULL)
-    {
-        memcpy(buf + 4,  pState->nt, 4);
-        memcpy(buf + 8,  pState->par_list, 8);
-        memcpy(buf + 16, pState->ks_list, 8);
-    }
 
-    LED_B_ON();
-    cmd_send(CMD_ACK,isOK,0,0,buf,48);
-    LED_B_OFF();
+//-----------------------------------------------------------------------------
+// Recover several bits of the cypher stream. This implements (first stages of)
+// the algorithm described in "The Dark Side of Security by Obscurity and
+// Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
+// (article by Nicolas T. Courtois, 2009)
+//-----------------------------------------------------------------------------
+void ReaderMifare(bool first_try)
+{
+       // Mifare AUTH
+       uint8_t mf_auth[]    = { 0x60,0x00,0xf5,0x7b };
+       uint8_t mf_nr_ar[]   = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
+       static uint8_t mf_nr_ar3;
 
-    // Thats it...
-    FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-    LEDsoff();
-    tracing = TRUE;
+       uint8_t* receivedAnswer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
+       traceLen = 0;
+       tracing = false;
 
-    if (MF_DBGLEVEL >= 1)      DbpString("COMMAND mifare FINISHED");
-}
+       byte_t nt_diff = 0;
+       byte_t par = 0;
+       //byte_t par_mask = 0xff;
+       static byte_t par_low = 0;
+       bool led_on = TRUE;
+       uint8_t uid[10];
+       uint32_t cuid;
 
-void ReaderMifareBegin(uint32_t offset_time, uint32_t powerdown_time);
-
-/**
- * @brief New implementation of ReaderMifare, the classic mifare attack.
- *  This implementation is backwards-compatible, but has some added parameters.
- * @param c the usbcommand in complete
- *  c->arg[0] - nt_noattack (deprecated)
- *  c->arg[1] - offset_time us (0 => random)
- *  c->arg[2] - powerdown_time ms (0=> tuning)
- *
- */
-void ReaderMifare(UsbCommand *c)
-{
-    /*
-     * The 'no-attack' is not used anymore, with the introduction of
-     * state tables. Instead, we use an offset which is random. This means that we
-     * should not get stuck on a 'bad' nonce, so no-attack is not needed.
-     * Anyway, arg[0] is reserved for backwards compatibility
-    uint32_t nt_noattack_uint = c->arg[0];
-    byte_t nt_noattack[4];
-    num_to_bytes(parameter, 4, nt_noattack_uint);
-
-     */
-    /*
-     *IF, for some reason, you want to attack a specific nonce or whatever,
-     *you can specify the offset time yourself, in which case it won't be random.
-     *
-     * The offset time is microseconds, MICROSECONDS, not ms.
-     */
-    uint32_t offset_time = c->arg[1];
-    if(offset_time == 0)
-    {
-        //[Martin:]I would like to have used rand(), but linking problems prevented it
-        //offset_time = rand() % 4000;
-        //So instead, I found this nifty thingy, which seems to fit the bill
-        offset_time = GetTickCount() % 2000;
-    }
-    /*
-     * There is an implementation of tuning. Tuning will try to determine
-     * a good power-down time, which is different for different cards.
-     * If a value is specified from the packet, we won't do any tuning.
-     * A value of zero will initialize a tuning.
-     * The power-down time is milliseconds, that MILLI-seconds .
-     */
-    uint32_t powerdown_time = c->arg[2];
-    if(powerdown_time == 0)
-    {
-        //Tuning required
-        int entropy = 100;
-        int time = 25;
-        entropy = TuneMifare(time);
-
-        while(entropy > 50 && time < 2000){
-            //Increase timeout, but never more than 500ms at a time
-            time = MIN(time*2, time+500);
-            entropy = TuneMifare(time);
-        }
-        if(entropy > 50){
-            Dbprintf("OBS! This card has high entropy (%d) and slow power-down. This may take a while", entropy);
-        }
-        powerdown_time = time;
-    }
-    //The actual attack
-    ReaderMifareBegin(offset_time, powerdown_time);
-}
-void ReaderMifareBegin(uint32_t offset_time, uint32_t powerdown_time)
-{
-    Dbprintf("Using power-down-time of %d ms, offset time %d us", powerdown_time, offset_time);
+       uint32_t nt, previous_nt;
+       static uint32_t nt_attacked = 0;
+       byte_t par_list[8] = {0,0,0,0,0,0,0,0};
+       byte_t ks_list[8] = {0,0,0,0,0,0,0,0};
 
-    /**
-     *Allocate our state-table and initialize with zeroes
-     **/
+       static uint32_t sync_time;
+       static uint32_t sync_cycles;
+       int catch_up_cycles = 0;
+       int last_catch_up = 0;
+       uint16_t consecutive_resyncs = 0;
+       int isOK = 0;
 
-    AttackState states[STATE_SIZE] ;
-    //Dbprintf("Memory allocated ok! (%d bytes)",STATE_SIZE*sizeof(AttackState) );
-    memset(states, 0, STATE_SIZE*sizeof(AttackState));
 
-    // Mifare AUTH
-       uint8_t mf_auth[]    = { 0x60,0x00,0xf5,0x7b };
-       uint8_t* receivedAnswer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);   // was 3560 - tied to other size changes
 
-    traceLen = 0;
-       tracing = false;
+       if (first_try) { 
+               StartCountMifare();
+               mf_nr_ar3 = 0;
+               iso14443a_setup();
+               FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN); // resets some FPGA internal registers
+               while((GetCountMifare() & 0xffff0000) != 0x10000);              // wait for counter to reset and "warm up" 
+               while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_FRAME);              // wait for ssp_frame to be low
+               while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_FRAME));   // sync on rising edge of ssp_frame
+               sync_time = GetCountMifare();
+               sync_cycles = 65536;                                                                    // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
+               nt_attacked = 0;
+               nt = 0;
+               par = 0;
+       }
+       else {
+               // we were unsuccessful on a previous call. Try another READER nonce (first 3 parity bits remain the same)
+               // nt_attacked = prng_successor(nt_attacked, 1);
+               mf_nr_ar3++;
+               mf_nr_ar[3] = mf_nr_ar3;
+               par = par_low;
+       }
 
-       iso14443a_setup();
        LED_A_ON();
        LED_B_OFF();
        LED_C_OFF();
+       
+  
+       for(uint16_t i = 0; TRUE; i++) {
+               
+               WDT_HIT();
 
-       LED_A_OFF();
-       uint8_t uid[8];
-       uint32_t cuid;
+               // Test if the action was cancelled
+               if(BUTTON_PRESS()) {
+                       break;
+               }
+               
+               LED_C_ON();
 
-    byte_t nt[4];
-    int nts_attacked= 0;
-    //Keeps track of progress (max value of nt_diff for our states)
-    int progress = 0;
-    int high_entropy_warning_issued = 0;
-    while(!BUTTON_PRESS())
-       {
-               LED_C_OFF();
-               FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
-        SpinDelay(powerdown_time);
+               if(!iso14443a_select_card(uid, NULL, &cuid)) {
+                       continue;
+               }
+
+               //keep the card active
                FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
-               LED_C_ON();
-        SpinDelayUs(offset_time);
 
-               if(!iso14443a_select_card(uid, NULL, &cuid)) continue;
+               PrepareDelayedAuthTransfer(mf_auth, sizeof(mf_auth), (sync_cycles + catch_up_cycles) & 0x00000007);
 
+               sync_time = sync_time + ((sync_cycles + catch_up_cycles) & 0xfffffff8);
+               catch_up_cycles = 0;
+
+               // if we missed the sync time already, advance to the next nonce repeat
+               while(GetCountMifare() > sync_time) {
+                       sync_time = sync_time + (sync_cycles & 0xfffffff8);
+               }
+
+               // now sync. After syncing, the following Classic Auth will return the same tag nonce (mostly)
+               while(GetCountMifare() < sync_time);
+               
                // Transmit MIFARE_CLASSIC_AUTH
-               ReaderTransmit(mf_auth, sizeof(mf_auth));
-
-               // Receive the (16 bit) "random" nonce
-               if (!ReaderReceive(receivedAnswer)) continue;
-        memcpy(nt, receivedAnswer, 4);
-
-        //Now we have the NT. Check if this NT is already under attack
-        AttackState* pState = NULL;
-        int i = 0;
-        for(i = 0 ; i < nts_attacked && pState == NULL; i++)
-        {
-            if( memcmp(nt, states[i].nt, 4) == 0)
-            {
-                //we have it
-                pState = &states[i];
-                //Dbprintf("Existing state found (%d)", i);
-            }
-        }
+               int samples = 0;
+               int wait = 0;
+               TransmitFor14443a(ToSend, ToSendMax, &samples, &wait);
 
-        if(pState == NULL){
-            if(nts_attacked < STATE_SIZE )
-            {
-                //Initialize  a new state
-                pState = &states[nts_attacked++];
-                //Clear it before use
-                memset(pState, 0, sizeof(AttackState));
-                memcpy(pState->nt, nt, 4);
-                i = nts_attacked;
-                //Dbprintf("New state created, nt=");
-            }else if(!high_entropy_warning_issued){
-                /**
-                 *If we wound up here, it means that the state table was eaten up by potential nonces. This could be fixed by
-                 *increasing the size of the state buffer, however, it points to some other problem. Ideally, we should get the same nonce
-                 *every time. Realistically we should get a few different nonces, but if we get more than 50, there is probably somehting
-                 *else that is wrong. An attack using too high nonce entropy will take **LONG** time to finish.
-                 */
-                DbpString("WARNING: Nonce entropy is suspiciously high, something is wrong. Check timeouts (and perhaps increase STATE_SIZE)");
-                high_entropy_warning_issued = 1;
-            }
-        }
-        if(pState == NULL) continue;
-
-        int result = continueAttack(pState, receivedAnswer);
-
-        if(result == 1){
-            //One state progressed another step
-            if(pState->nt_diff >  progress)
-            {
-                progress = pState->nt_diff;
-                //Alert the user
-                Dbprintf("Recovery progress: %d/8, NTs attacked: %d ", progress,nts_attacked );
-            }
-            //Dbprintf("State increased to %d in state %d", pState->nt_diff, i);
-        }
-        else if(result == 2){
-            //Dbprintf("Continue attack no answer, par is now %d", pState->par);
-        }
-        else if(result == 0){
-            reportResults(uid,pState,1);
-            return;
-        }
-    }
-    reportResults(uid,NULL,0);
+               // Receive the (4 Byte) "random" nonce
+               if (!ReaderReceive(receivedAnswer)) {
+                       continue;
+                 }
+
+               previous_nt = nt;
+               nt = bytes_to_num(receivedAnswer, 4);
+
+               // Transmit reader nonce with fake par
+               ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par);
+
+               if (first_try && previous_nt && !nt_attacked) { // we didn't calibrate our clock yet
+                       int nt_distance = dist_nt(previous_nt, nt);
+                       if (nt_distance == 0) {
+                               nt_attacked = nt;
+                       }
+                       else {
+                               if (nt_distance == -99999) { // invalid nonce received, try again
+                                       continue;
+                               }
+                               sync_cycles = (sync_cycles - nt_distance);
+//                             Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);
+                               continue;
+                       }
+               }
+
+               if ((nt != nt_attacked) && nt_attacked) {       // we somehow lost sync. Try to catch up again...
+                       catch_up_cycles = -dist_nt(nt_attacked, nt);
+                       if (catch_up_cycles == 99999) {                 // invalid nonce received. Don't resync on that one.
+                               catch_up_cycles = 0;
+                               continue;
+                       }
+                       if (catch_up_cycles == last_catch_up) {
+                               consecutive_resyncs++;
+                       }
+                       else {
+                               last_catch_up = catch_up_cycles;
+                           consecutive_resyncs = 0;
+                       }
+                       if (consecutive_resyncs < 3) {
+                               Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i, -catch_up_cycles, consecutive_resyncs);
+                       }
+                       else {  
+                               sync_cycles = sync_cycles + catch_up_cycles;
+                               Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i, -catch_up_cycles, sync_cycles);
+                       }
+                       continue;
+               }
+               consecutive_resyncs = 0;
+               
+               // Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding
+               if (ReaderReceive(receivedAnswer))
+               {
+                       catch_up_cycles = 8;    // the PRNG doesn't run during data transfers. 4 Bit = 8 cycles
+       
+                       if (nt_diff == 0)
+                       {
+                               par_low = par & 0x07; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
+                       }
+
+                       led_on = !led_on;
+                       if(led_on) LED_B_ON(); else LED_B_OFF();
+
+                       par_list[nt_diff] = par;
+                       ks_list[nt_diff] = receivedAnswer[0] ^ 0x05;
+
+                       // Test if the information is complete
+                       if (nt_diff == 0x07) {
+                               isOK = 1;
+                               break;
+                       }
+
+                       nt_diff = (nt_diff + 1) & 0x07;
+                       mf_nr_ar[3] = (mf_nr_ar[3] & 0x1F) | (nt_diff << 5);
+                       par = par_low;
+               } else {
+                       if (nt_diff == 0 && first_try)
+                       {
+                               par++;
+                       } else {
+                               par = (((par >> 3) + 1) << 3) | par_low;
+                       }
+               }
+       }
+
+       LogTrace((const uint8_t *)&nt, 4, 0, GetParity((const uint8_t *)&nt, 4), TRUE);
+       LogTrace(par_list, 8, 0, GetParity(par_list, 8), TRUE);
+       LogTrace(ks_list, 8, 0, GetParity(ks_list, 8), TRUE);
+
+       mf_nr_ar[3] &= 0x1F;
+       
+       byte_t buf[28];
+       memcpy(buf + 0,  uid, 4);
+       num_to_bytes(nt, 4, buf + 4);
+       memcpy(buf + 8,  par_list, 8);
+       memcpy(buf + 16, ks_list, 8);
+       memcpy(buf + 24, mf_nr_ar, 4);
+               
+       cmd_send(CMD_ACK,isOK,0,0,buf,28);
+
+       // Thats it...
+       FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
+       LEDsoff();
+       tracing = TRUE;
 }
+
 //-----------------------------------------------------------------------------
 // MIFARE 1K simulate. 
 // 
index a0e0b01f967c4f127fd796ca5ea80e813834dce5..02470702a8207d82865c1903b8d6548330d512e5 100644 (file)
@@ -28,7 +28,7 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
        // variables\r
        byte_t isOK = 0;\r
        byte_t dataoutbuf[16];\r
-       uint8_t uid[8];\r
+       uint8_t uid[10];\r
        uint32_t cuid;\r
        struct Crypto1State mpcs = {0, 0};\r
        struct Crypto1State *pcs;\r
@@ -109,7 +109,7 @@ void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
        // variables\r
        byte_t isOK = 0;\r
        byte_t dataoutbuf[16 * 4];\r
-       uint8_t uid[8];\r
+       uint8_t uid[10];\r
        uint32_t cuid;\r
        struct Crypto1State mpcs = {0, 0};\r
        struct Crypto1State *pcs;\r
@@ -208,7 +208,7 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
        \r
        // variables\r
        byte_t isOK = 0;\r
-       uint8_t uid[8];\r
+       uint8_t uid[10];\r
        uint32_t cuid;\r
        struct Crypto1State mpcs = {0, 0};\r
        struct Crypto1State *pcs;\r
@@ -298,7 +298,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain)
        // variables\r
        int rtr, i, j, m, len;\r
        int davg, dmin, dmax;\r
-       uint8_t uid[8];\r
+       uint8_t uid[10];\r
        uint32_t cuid, nt1, nt2, nttmp, nttest, par, ks1;\r
        uint8_t par_array[4];\r
        nestedVector nvector[NES_MAX_INFO + 1][11];\r
@@ -493,7 +493,6 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain)
                        }\r
        \r
                        LED_B_ON();\r
-//                     SpinDelay(100);\r
       cmd_send(CMD_ACK,0,ncount,targetBlockNo + (targetKeyType * 0x100),buf,48);\r
 //                     UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));\r
                        LED_B_OFF();\r
@@ -507,7 +506,6 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain)
 //     memset(ack.d.asBytes, 0x00, sizeof(ack.d.asBytes));\r
        \r
        LED_B_ON();\r
-//     SpinDelay(300);\r
 //     UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));\r
   cmd_send(CMD_ACK,1,0,0,0,0);\r
        LED_B_OFF();\r
@@ -536,7 +534,7 @@ void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
        // variables\r
        int i;\r
        byte_t isOK = 0;\r
-       uint8_t uid[8];\r
+       uint8_t uid[10];\r
        uint32_t cuid;\r
        struct Crypto1State mpcs = {0, 0};\r
        struct Crypto1State *pcs;\r
@@ -649,7 +647,7 @@ void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
        // variables\r
        byte_t dataoutbuf[16];\r
        byte_t dataoutbuf2[16];\r
-       uint8_t uid[8];\r
+       uint8_t uid[10];\r
 \r
        // clear trace\r
        iso14a_clear_trace();\r
@@ -761,11 +759,11 @@ void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
        \r
        // variables\r
        byte_t isOK = 0;\r
-       uint8_t uid[8];\r
+       uint8_t uid[10];\r
        uint8_t d_block[18];\r
        uint32_t cuid;\r
        \r
-       memset(uid, 0x00, 8);\r
+       memset(uid, 0x00, 10);\r
        uint8_t* receivedAnswer = mifare_get_bigbufptr();\r
        \r
        if (workFlags & 0x08) {\r
index f2298290246b2174101f9175e3df4d58e768dd9f..9bea9e7efbcddc3c5adf29b21a30090afc9cfc7e 100644 (file)
@@ -294,11 +294,11 @@ void StartCountUS()
        
        AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; // timer disable  
        AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_XC1; // from timer 0
-
+       
        AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN;
        AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN;
        AT91C_BASE_TCB->TCB_BCR = 1;
-}
+       }
 
 uint32_t RAMFUNC GetCountUS(){
        return (AT91C_BASE_TC1->TC_CV * 0x8000) + ((AT91C_BASE_TC0->TC_CV / 15) * 10);
@@ -314,3 +314,60 @@ uint32_t RAMFUNC GetDeltaCountUS(){
 }
 
 
+//  -------------------------------------------------------------------------
+//  Mifare timer. Uses ssp_clk from FPGA 
+//  -------------------------------------------------------------------------
+void StartCountMifare()
+{
+       AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC0) | (1 << AT91C_ID_TC1) | (1 << AT91C_ID_TC2);  // Enable Clock to all timers
+       AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC0XC0S_TIOA1               // XC0 Clock = TIOA1
+                                                       | AT91C_TCB_TC1XC1S_NONE                // XC1 Clock = none
+                                                       | AT91C_TCB_TC2XC2S_TIOA0;              // XC2 Clock = TIOA0
+
+       // configure TC1 to create a short pulse on TIOA1 when a rising edge on TIOB1 (= ssp_clk from FPGA) occurs:
+       AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;                               // disable TC1
+       AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK // TC1 Clock = MCK(48MHz)/2 = 24MHz
+                                                       | AT91C_TC_CPCSTOP                              // Stop clock on RC compare
+                                                       | AT91C_TC_EEVTEDG_RISING               // Trigger on rising edge of Event
+                                                       | AT91C_TC_EEVT_TIOB                    // Event-Source: TIOB1 (= ssc_clk from FPGA = 13,56MHz / 16)
+                                                       | AT91C_TC_ENETRG                               // Enable external trigger event
+                                                       | AT91C_TC_WAVESEL_UP                   // Upmode without automatic trigger on RC compare
+                                                       | AT91C_TC_WAVE                                 // Waveform Mode
+                                                       | AT91C_TC_AEEVT_SET                    // Set TIOA1 on external event
+                                                       | AT91C_TC_ACPC_CLEAR;                  // Clear TIOA1 on RC Compare
+       AT91C_BASE_TC1->TC_RC = 0x04;                                                   // RC Compare value = 0x04
+
+       // use TC0 to count TIOA1 pulses
+       AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;                               // disable TC0  
+       AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_XC0                              // TC0 clock = XC0 clock = TIOA1
+                                                       | AT91C_TC_WAVE                                 // Waveform Mode
+                                                       | AT91C_TC_WAVESEL_UP                   // just count
+                                                       | AT91C_TC_ACPA_CLEAR                   // Clear TIOA0 on RA Compare
+                                                       | AT91C_TC_ACPC_SET;                    // Set TIOA0 on RC Compare
+       AT91C_BASE_TC0->TC_RA = 1;                                                              // RA Compare value = 1; pulse width to TC2
+       AT91C_BASE_TC0->TC_RC = 0;                                                              // RC Compare value = 0; increment TC2 on overflow
+
+       // use TC2 to count TIOA0 pulses (giving us a 32bit counter (TC0/TC2) clocked by ssp_clk)
+       AT91C_BASE_TC2->TC_CCR = AT91C_TC_CLKDIS;                               // disable TC2  
+       AT91C_BASE_TC2->TC_CMR = AT91C_TC_CLKS_XC2                              // TC2 clock = XC2 clock = TIOA0
+                                                       | AT91C_TC_WAVE                                 // Waveform Mode
+                                                       | AT91C_TC_WAVESEL_UP;                  // just count
+       
+       
+       AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN;                                // enable TC0
+       AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN;                                // enable TC1
+       AT91C_BASE_TC2->TC_CCR = AT91C_TC_CLKEN;                                // enable TC2
+       AT91C_BASE_TCB->TCB_BCR = 1;                                                    // assert Sync (set all timers to 0 on next active clock edge)
+}
+
+
+uint32_t RAMFUNC GetCountMifare(){
+       uint32_t tmp_count;
+       tmp_count = (AT91C_BASE_TC2->TC_CV << 16) | AT91C_BASE_TC0->TC_CV;
+       if ((tmp_count & 0xffff) == 0) { //small chance that we may have missed an increment in TC2
+               return (AT91C_BASE_TC2->TC_CV << 16);
+       } 
+       else {
+               return tmp_count;
+       }
+}
index 135468aeee7e4b3954fa50d9c146221c2ed6e6ac..9c4b4c58e75a81e09661a829695960bb4e53cf46 100644 (file)
@@ -47,4 +47,7 @@ void StartCountUS();
 uint32_t RAMFUNC GetCountUS();
 uint32_t RAMFUNC GetDeltaCountUS();
 
+void StartCountMifare();
+uint32_t RAMFUNC GetCountMifare();
+
 #endif
index 1f2f23e87442dac671d5925e5d7c9b478a25dc9c..b7376c92b3b21c9a286bac5c1e67d5b9cdcb5c80 100644 (file)
@@ -32,6 +32,8 @@ else
 CXXFLAGS = $(shell pkg-config --cflags QtCore QtGui 2>/dev/null) -Wall -O4
 QTLDLIBS = $(shell pkg-config --libs QtCore QtGui 2>/dev/null)
 MOC = $(shell pkg-config --variable=moc_location QtCore)
+# Below is a variant you can use if you have problems compiling with QT5 on ubuntu. see http://www.proxmark.org/forum/viewtopic.php?id=1661 for more info. 
+#MOC = /usr/lib/x86_64-linux-gnu/qt4/bin/moc
 LUAPLATFORM = linux
 endif
 
@@ -46,7 +48,8 @@ endif
 
 CORESRCS =     uart.c \
                util.c \
-               sleep.c \
+               sleep.c
+
 
 CMDSRCS =      nonce2key/crapto1.c\
                nonce2key/crypto1.c\
index a333fe39b88468d7191aaa4f982e8567a86077a2..7eec667d301673bc656da2fd5b21c02538e6a4b7 100644 (file)
@@ -393,46 +393,43 @@ int CmdGrid(const char *Cmd)
 
 int CmdHexsamples(const char *Cmd)
 {
-  int n;
+  int i, j;
   int requested = 0;
   int offset = 0;
-  sscanf(Cmd, "%i %i", &requested, &offset);
-
-  int delivered = 0;
+  char string_buf[25];
+  char* string_ptr = string_buf;
   uint8_t got[40000];
+  sscanf(Cmd, "%i %i", &requested, &offset);
 
-  /* round up to nearest 8 bytes so the printed data is all valid */
-  if (requested < 8) {
+  /* if no args send something */
+  if (requested == 0) {
     requested = 8;
   }
-  if (requested % 8 != 0) {
-    int remainder = requested % 8;
-    requested = requested + 8 - remainder;
-  }  
   if (offset + requested > sizeof(got)) {
     PrintAndLog("Tried to read past end of buffer, <bytes> + <offset> > 40000");
-       return 0;
-  } else {
-    n = requested;
-  }
+    return 0;
+  } 
 
-  GetFromBigBuf(got,n,offset);
+  GetFromBigBuf(got,requested,offset);
   WaitForResponse(CMD_ACK,NULL);
 
-  for (int j = 0; j < n; j += 8) {
-    PrintAndLog("%02x %02x %02x %02x %02x %02x %02x %02x",
-      sample_buf[j+0],
-      sample_buf[j+1],
-      sample_buf[j+2],
-      sample_buf[j+3],
-      sample_buf[j+4],
-      sample_buf[j+5],
-      sample_buf[j+6],
-      sample_buf[j+7]
-    );
-    delivered += 8;
-    if (delivered >= requested)
-      break;
+  i = 0;
+  for (j = 0; j < requested; j++) {
+    i++;
+    string_ptr += sprintf(string_ptr, "%02x ", got[j]);
+    if (i == 8) {
+      *(string_ptr - 1) = '\0';    // remove the trailing space
+      PrintAndLog("%s", string_buf);
+      string_buf[0] = '\0';
+      string_ptr = string_buf;
+      i = 0;
+    }
+    if (j == requested - 1 && string_buf[0] != '\0') { // print any remaining bytes
+      *(string_ptr - 1) = '\0';
+      PrintAndLog("%s", string_buf);
+      string_buf[0] = '\0';
+    }  
   }
   return 0;
 }
index f1238d223f19920b87c28cecaad77d76d9d84121..83d6633c1e72e31d29cec4f714fabe9d87f425d9 100644 (file)
@@ -21,6 +21,7 @@
 #include "ui.h"
 #include "cmdparser.h"
 #include "cmdhf14b.h"
+#include "cmdmain.h"
 
 static int CmdHelp(const char *Cmd);
 
@@ -267,6 +268,116 @@ int CmdSrix4kRead(const char *Cmd)
   return 0;
 }
 
+int CmdHF14BCmdRaw (const char *cmd) {
+    UsbCommand resp;
+    uint8_t *recv;
+    UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; // len,recv?
+    uint8_t reply=1;
+    uint8_t crc=0;
+    uint8_t power=0;
+    char buf[5]="";
+    int i=0;
+    uint8_t data[100];
+    unsigned int datalen=0, temp;
+    char *hexout;
+    
+    if (strlen(cmd)<3) {
+        PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] <0A 0B 0C ... hex>");
+        PrintAndLog("       -r    do not read response");
+        PrintAndLog("       -c    calculate and append CRC");
+        PrintAndLog("       -p    leave the field on after receive");
+        return 0;    
+    }
+
+    // strip
+    while (*cmd==' ' || *cmd=='\t') cmd++;
+    
+    while (cmd[i]!='\0') {
+        if (cmd[i]==' ' || cmd[i]=='\t') { i++; continue; }
+        if (cmd[i]=='-') {
+            switch (cmd[i+1]) {
+                case 'r': 
+                case 'R': 
+                    reply=0;
+                    break;
+                case 'c':
+                case 'C':                
+                    crc=1;
+                    break;
+                case 'p': 
+                case 'P': 
+                    power=1;
+                    break;
+                default:
+                    PrintAndLog("Invalid option");
+                    return 0;
+            }
+            i+=2;
+            continue;
+        }
+        if ((cmd[i]>='0' && cmd[i]<='9') ||
+            (cmd[i]>='a' && cmd[i]<='f') ||
+            (cmd[i]>='A' && cmd[i]<='F') ) {
+            buf[strlen(buf)+1]=0;
+            buf[strlen(buf)]=cmd[i];
+            i++;
+            
+            if (strlen(buf)>=2) {
+                sscanf(buf,"%x",&temp);
+                data[datalen]=(uint8_t)(temp & 0xff);
+                datalen++;
+                *buf=0;
+            }
+            continue;
+        }
+        PrintAndLog("Invalid char on input");
+        return 0;
+    }
+    if(crc)
+    {
+        uint8_t first, second;
+        ComputeCrc14443(CRC_14443_B, data, datalen, &first, &second);
+        data[datalen++] = first;
+        data[datalen++] = second;
+    }
+    
+    c.arg[0] = datalen;
+    c.arg[1] = reply;
+    c.arg[2] = power;
+    memcpy(c.d.asBytes,data,datalen);
+    
+    SendCommand(&c);
+    
+    if (reply) {
+        if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
+            recv = resp.d.asBytes;
+            PrintAndLog("received %i octets",resp.arg[0]);
+            if(!resp.arg[0])
+                return 0;
+            hexout = (char *)malloc(resp.arg[0] * 3 + 1);
+            if (hexout != NULL) {
+                uint8_t first, second;
+                for (int i = 0; i < resp.arg[0]; i++) { // data in hex
+                    sprintf(&hexout[i * 3], "%02hX ", recv[i]);
+                }
+                PrintAndLog("%s", hexout);
+                free(hexout);
+                ComputeCrc14443(CRC_14443_B, recv, resp.arg[0]-2, &first, &second);
+                if(recv[resp.arg[0]-2]==first && recv[resp.arg[0]-1]==second) {
+                    PrintAndLog("CRC OK");
+                } else {
+                    PrintAndLog("CRC failed");
+                }
+            } else {
+                PrintAndLog("malloc failed your client has low memory?");
+            }
+        } else {
+            PrintAndLog("timeout while waiting for reply.");
+        }
+    } // if reply
+    return 0;
+}
+
 static command_t CommandTable[] = 
 {
   {"help",        CmdHelp,        1, "This help"},
@@ -276,8 +387,9 @@ static command_t CommandTable[] =
   {"sim",         CmdHF14Sim,     0, "Fake ISO 14443 tag"},
   {"simlisten",   CmdHFSimlisten, 0, "Get HF samples as fake tag"},
   {"snoop",       CmdHF14BSnoop,  0, "Eavesdrop ISO 14443"},
-  {"sri512read",  CmdSri512Read,  0, "<int> -- Read contents of a SRI512 tag"},
-  {"srix4kread",  CmdSrix4kRead,  0, "<int> -- Read contents of a SRIX4K tag"},
+  {"sri512read",  CmdSri512Read,  0, "Read contents of a SRI512 tag"},
+  {"srix4kread",  CmdSrix4kRead,  0, "Read contents of a SRIX4K tag"},
+  {"raw",         CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},
   {NULL, NULL, 0, NULL}
 };
 
index ebc75f796ce494d09968a7927c47cad3034c502b..8366b09bdb9bf69322a1c1d32669875bfc5f9631 100644 (file)
@@ -52,35 +52,20 @@ int CmdHelp(const char *Cmd)
  */
 int CmdLegicDecode(const char *Cmd)
 {
-  int h, i, j, k, n;
+  int i, j, k, n;
   int segment_len = 0;
   int segment_flag = 0;
   int stamp_len = 0;
   int crc = 0;
   int wrp = 0;
   int wrc = 0;
-  int data_buf[1032]; // receiver buffer
+  uint8_t data_buf[1024]; // receiver buffer
   char out_string[3076]; // just use big buffer - bad practice
   char token_type[4];
-  int delivered = 0;
-
-  h = 0;
   
   // copy data from proxmark into buffer
-  for (i = 0; i < 256; i += 12, h += 48) {
-    UsbCommand c = {CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K, {i, 0, 0}};
-    SendCommand(&c);
-    WaitForResponse(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, NULL);
-    
-    for (j = 0; j < 48; j += 8) {
-      for (k = 0; k < 8; k++) {
-        data_buf[h+j+k] = sample_buf[j+k];
-      }
-      delivered += 8;
-      if (delivered >= 1024)
-        break;
-    }
-  }
+   GetFromBigBuf(data_buf,sizeof(data_buf),0);
+   WaitForResponse(CMD_ACK,NULL);
     
   // Output CDF System area (9 bytes) plus remaining header area (12 bytes)
   
@@ -264,51 +249,50 @@ int CmdLegicLoad(const char *Cmd)
 
 int CmdLegicSave(const char *Cmd)
 {
-  int n;
   int requested = 1024;
   int offset = 0;
+  int delivered = 0;
   char filename[1024];
+  uint8_t got[1024];
+  
   sscanf(Cmd, " %s %i %i", filename, &requested, &offset);
-  if (offset % 4 != 0) {
-    PrintAndLog("Offset must be a multiple of 4");
-    return 0;
-  }
-  offset = offset/4;
-
-  int delivered = 0;
 
+  /* If no length given save entire legic read buffer */
+  /* round up to nearest 8 bytes so the saved data can be used with legicload */
   if (requested == 0) {
-    n = 12;
-    requested = 12;
-  } else {
-    n = requested/4;
+    requested = 1024;
   }
-
+  if (requested % 8 != 0) {
+    int remainder = requested % 8;
+    requested = requested + 8 - remainder;
+  }
+  
+  if (offset + requested > sizeof(got)) {
+    PrintAndLog("Tried to read past end of buffer, <bytes> + <offset> > 1024");
+    return 0;
+  }
+  
   FILE *f = fopen(filename, "w");
   if(!f) {
     PrintAndLog("couldn't open '%s'", Cmd+1);
     return -1;
   }
 
-  for (int i = offset; i < n+offset; i += 12) {
-    UsbCommand c = {CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K, {i, 0, 0}};
-    SendCommand(&c);
-    WaitForResponse(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, NULL);
-    for (int j = 0; j < 48; j += 8) {
-      fprintf(f, "%02x %02x %02x %02x %02x %02x %02x %02x\n",
-        sample_buf[j+0],
-        sample_buf[j+1],
-        sample_buf[j+2],
-        sample_buf[j+3],
-        sample_buf[j+4],
-        sample_buf[j+5],
-        sample_buf[j+6],
-        sample_buf[j+7]
-      );
-      delivered += 8;
-      if (delivered >= requested)
-        break;
-    }
+  GetFromBigBuf(got,requested,offset);
+  WaitForResponse(CMD_ACK,NULL);
+
+  for (int j = 0; j < requested; j += 8) {
+    fprintf(f, "%02x %02x %02x %02x %02x %02x %02x %02x\n",
+      got[j+0],
+      got[j+1],
+      got[j+2],
+      got[j+3],
+      got[j+4],
+      got[j+5],
+      got[j+6],
+      got[j+7]
+    );
+    delivered += 8;
     if (delivered >= requested)
       break;
   }
index 597841e17fa08b41ff80b3932f87411794163713..96eb800782a3fc1110eca30191d1efc741a06a05 100644 (file)
@@ -15,33 +15,31 @@ static int CmdHelp(const char *Cmd);
 int CmdHF14AMifare(const char *Cmd)\r
 {\r
        uint32_t uid = 0;\r
-       uint32_t nt = 0;\r
+       uint32_t nt = 0, nr = 0;\r
        uint64_t par_list = 0, ks_list = 0, r_key = 0;\r
        uint8_t isOK = 0;\r
        uint8_t keyBlock[8] = {0};\r
 \r
-       if (param_getchar(Cmd, 0) && param_gethex(Cmd, 0, keyBlock, 8)) {\r
-               PrintAndLog("Nt must include 8 HEX symbols");\r
-               return 1;\r
-       }\r
+       UsbCommand c = {CMD_READER_MIFARE, {true, 0, 0}};\r
+\r
+       // message\r
+       printf("-------------------------------------------------------------------------\n");\r
+       printf("Executing command. Expected execution time: 25sec on average  :-)\n");\r
+       printf("Press the key on the proxmark3 device to abort both proxmark3 and client.\n");\r
+       printf("-------------------------------------------------------------------------\n");\r
 \r
        \r
-       UsbCommand c = {CMD_READER_MIFARE, {(uint32_t)bytes_to_num(keyBlock, 4), 0, 0}};\r
 start:\r
-       SendCommand(&c);\r
+    clearCommandBuffer();\r
+    SendCommand(&c);\r
        \r
        //flush queue\r
        while (ukbhit())        getchar();\r
 \r
-       // message\r
-       printf("-------------------------------------------------------------------------\n");\r
-       printf("Executing command. It may take up to 30 min.\n");\r
-       printf("Press the key on the proxmark3 device to abort both proxmark3 and client.\n");\r
-       printf("-------------------------------------------------------------------------\n");\r
        \r
        // wait cycle\r
        while (true) {\r
-               printf(".");\r
+        printf(".");\r
                fflush(stdout);\r
                if (ukbhit()) {\r
                        getchar();\r
@@ -50,27 +48,26 @@ start:
                }\r
                \r
                UsbCommand resp;\r
-               if (WaitForResponseTimeout(CMD_ACK,&resp,2000)) {\r
+               if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {\r
                        isOK  = resp.arg[0] & 0xff;\r
-       \r
                        uid = (uint32_t)bytes_to_num(resp.d.asBytes +  0, 4);\r
                        nt =  (uint32_t)bytes_to_num(resp.d.asBytes +  4, 4);\r
                        par_list = bytes_to_num(resp.d.asBytes +  8, 8);\r
                        ks_list = bytes_to_num(resp.d.asBytes +  16, 8);\r
-       \r
+                       nr = bytes_to_num(resp.d.asBytes + 24, 4);\r
                        printf("\n\n");\r
-                       PrintAndLog("isOk:%02x", isOK);\r
                        if (!isOK) PrintAndLog("Proxmark can't get statistic info. Execution aborted.\n");\r
                        break;\r
                }\r
        }       \r
+\r
        printf("\n");\r
        \r
        // error\r
        if (isOK != 1) return 1;\r
        \r
        // execute original function from util nonce2key\r
-       if (nonce2key(uid, nt, par_list, ks_list, &r_key))\r
+       if (nonce2key(uid, nt, nr, par_list, ks_list, &r_key))\r
        {\r
                isOK = 2;\r
                PrintAndLog("Key not found (lfsr_common_prefix list is null). Nt=%08x", nt);    \r
@@ -85,8 +82,9 @@ start:
                PrintAndLog("Found valid key:%012"llx, r_key);\r
        else\r
        {\r
-               if (isOK != 2) PrintAndLog("Found invalid key. ( Nt=%08x ,Trying use it to run again...", nt);  \r
-               c.arg[0] = nt;\r
+               if (isOK != 2) PrintAndLog("Found invalid key. ");      \r
+               PrintAndLog("Failing is expected to happen in 25%% of all cases. Trying again with a different reader nonce...");\r
+               c.arg[0] = false;\r
                goto start;\r
        }\r
        \r
index 9da1b308282fc53d21c4a6b125c8c7bb6c3c9cb3..b6f32adacf158691a22c6a6ef353d358a0ac121f 100644 (file)
@@ -26,6 +26,7 @@
 #include "util.h"
 #include "cmdscript.h"
 
+
 unsigned int current_command = CMD_UNKNOWN;
 //unsigned int received_command = CMD_UNKNOWN;
 //UsbCommand current_response;
index 7459f1bb59aa44653f2205622bf51f5d71ad6211..d2e50d5ef84f35dd22b507018969b0dfac7b1d0c 100644 (file)
 #include "nonce2key.h"
 #include "ui.h"
 
-int nonce2key(uint32_t uid, uint32_t nt, uint64_t par_info, uint64_t ks_info, uint64_t * key) {
+int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_t ks_info, uint64_t * key) {
   struct Crypto1State *state, *state_s;
-  uint32_t pos, nr, rr, nr_diff;//, ks1, ks2;
+  uint32_t pos, rr, nr_diff;//, ks1, ks2;
   byte_t bt, i, ks3x[8], par[8][8];
   uint64_t key_recovered;
-  nr = rr = 0;
+  rr = 0;
   
   // Reset the last three significant bits of the reader nonce
   nr &= 0xffffff1f;
index 8ae6050468001a3d8773e2fe30a7381b4ef1e2d0..e7d5f431194f92a4777bc2726c66aad8038ff0b4 100644 (file)
@@ -18,6 +18,6 @@
 #include "crapto1.h"
 #include "common.h"
 
-int nonce2key(uint32_t uid, uint32_t nt, uint64_t par_info, uint64_t ks_info, uint64_t * key); 
+int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_t ks_info, uint64_t * key); 
 
 #endif
index a6274bc111b648ebe91b40c1066061521173803d..5cbacc8608cd1024aa4f6a271e3744a4405ed3c1 100644 (file)
@@ -26,7 +26,7 @@
 
 static serial_port sp;
 static UsbCommand txcmd;
-static volatile bool txcmd_pending = false;
+volatile static bool txcmd_pending = false;
 
 void SendCommand(UsbCommand *c) {
 #if 0
index 041186c7e9d195b817766dba7e1b80adffe2117c..f7c5e35c3b0d7ad0a04c950c0ab55d328712933b 100644 (file)
@@ -266,7 +266,7 @@ bool uart_receive(const serial_port sp, byte_t* pbtRx, size_t* pszRxLen) {
     if (res < 0) {
       return false;
     }
-    
     // Read time-out
     if (res == 0) {
       if (*pszRxLen == 0) {
@@ -277,21 +277,24 @@ bool uart_receive(const serial_port sp, byte_t* pbtRx, size_t* pszRxLen) {
         return true;
       }
     }
-    
     // Retrieve the count of the incoming bytes
     res = ioctl(((serial_port_unix*)sp)->fd, FIONREAD, &byteCount);
     if (res < 0) return false;
-    
+
     // There is something available, read the data
     res = read(((serial_port_unix*)sp)->fd,pbtRx+(*pszRxLen),byteCount);
-    
+
     // Stop if the OS has some troubles reading the data
     if (res <= 0) return false;
-    
     *pszRxLen += res;
+
+    if(res==byteCount)
+        return true;
     
   } while (byteCount);
-  
+
   return true;
 }
 
index eec849b8916310860fb074bc6c63c2023332a5e2..8726ec67513e2982f8cbb9b473b789394f00fef3 100644 (file)
@@ -86,6 +86,7 @@ typedef struct {
 #define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443                             0x0301
 #define CMD_READ_SRI512_TAG                                               0x0303
 #define CMD_READ_SRIX4K_TAG                                               0x0304
+#define CMD_ISO_14443B_COMMAND                                            0x0305
 #define CMD_READER_ISO_15693                                              0x0310
 #define CMD_SIMTAG_ISO_15693                                              0x0311
 #define CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693                              0x0312
Impressum, Datenschutz