From: iceman1001 Date: Mon, 9 Nov 2015 20:46:15 +0000 (+0100) Subject: CHG: a major remake of the "hf mf c*" commands. Ie chinese magic tags. Tried to... X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/commitdiff_plain/c2731f37bef482bde1a87d79566c0b3bde658c98 CHG: a major remake of the "hf mf c*" commands. Ie chinese magic tags. Tried to make them consistent in parameter calls and simplified. And fixed the annoying gen1 tags that answers with a ACK/NACK on HALT commands.. --- diff --git a/Makefile b/Makefile index 0e065b41..bafd8161 100644 --- a/Makefile +++ b/Makefile @@ -22,7 +22,7 @@ help: @echo + all - Make bootrom, armsrc and the OS-specific host directory @echo + client - Make only the OS-specific host directory @echo + flash-bootrom - Make bootrom and flash it - @echo + flash-os - Make armsrc and flash os (includes fpga) + @echo + flash-os - Make armsrc and flash os \(includes fpga\) @echo + flash-all - Make bootrom and armsrc and flash bootrom and os image @echo + clean - Clean in bootrom, armsrc and the OS-specific host directory diff --git a/armsrc/appmain.c b/armsrc/appmain.c index ec686b13..8c982eaf 100644 --- a/armsrc/appmain.c +++ b/armsrc/appmain.c @@ -34,6 +34,7 @@ // Craig Young - 14a stand-alone code #ifdef WITH_ISO14443a_StandAlone #include "iso14443a.h" + #include "protocols.h" #endif #define abs(x) ( ((x)<0) ? -(x) : (x) ) @@ -387,6 +388,8 @@ void StandAloneMode14a() uint32_t uid_tmp2 = 0; iso14a_card_select_t hi14a_card[OPTS]; + uint8_t params = (MAGIC_SINGLE | MAGIC_DATAIN); + LED(selected + 1, 0); for (;;) @@ -480,87 +483,84 @@ void StandAloneMode14a() else if (iGotoClone==1) { iGotoClone=0; - LEDsoff(); - LED(selected + 1, 0); - LED(LED_ORANGE, 250); + LEDsoff(); + LED(selected + 1, 0); + LED(LED_ORANGE, 250); + // record + Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]); - // record - Dbprintf("Preparing to Clone card [Bank: %x]; uid: %08x", selected, uid_1st[selected]); + // wait for button to be released + // Delay cloning until card is in place + while(BUTTON_PRESS()) + WDT_HIT(); - // wait for button to be released - while(BUTTON_PRESS()) - { - // Delay cloning until card is in place - WDT_HIT(); - } - Dbprintf("Starting clone. [Bank: %u]", selected); - // need this delay to prevent catching some weird data - SpinDelay(500); - // Begin clone function here: - /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards: - UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}}; - memcpy(c.d.asBytes, data, 16); - SendCommand(&c); - - Block read is similar: - UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}}; - We need to imitate that call with blockNo 0 to set a uid. - - The get and set commands are handled in this file: - // Work with "magic Chinese" card - case CMD_MIFARE_CSETBLOCK: - MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); - break; - case CMD_MIFARE_CGETBLOCK: - MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); - break; - - mfCSetUID provides example logic for UID set workflow: - -Read block0 from card in field with MifareCGetBlock() - -Configure new values without replacing reserved bytes - memcpy(block0, uid, 4); // Copy UID bytes from byte array - // Mifare UID BCC - block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5 - Bytes 5-7 are reserved SAK and ATQA for mifare classic - -Use mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER) to write it - */ - uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0}; - // arg0 = Flags == CSETBLOCK_SINGLE_OPER=0x1F, arg1=returnSlot, arg2=blockNo - MifareCGetBlock(0x3F, 1, 0, oldBlock0); + Dbprintf("Starting clone. [Bank: %u]", selected); + // need this delay to prevent catching some weird data + SpinDelay(500); + // Begin clone function here: + /* Example from client/mifarehost.c for commanding a block write for "magic Chinese" cards: + UsbCommand c = {CMD_MIFARE_CSETBLOCK, {params & (0xFE | (uid == NULL ? 0:1)), blockNo, 0}}; + memcpy(c.d.asBytes, data, 16); + SendCommand(&c); + + Block read is similar: + UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, blockNo, 0}}; + We need to imitate that call with blockNo 0 to set a uid. + + The get and set commands are handled in this file: + // Work with "magic Chinese" card + case CMD_MIFARE_CSETBLOCK: + MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes); + break; + case CMD_MIFARE_CGETBLOCK: + MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes); + break; + + mfCSetUID provides example logic for UID set workflow: + -Read block0 from card in field with MifareCGetBlock() + -Configure new values without replacing reserved bytes + memcpy(block0, uid, 4); // Copy UID bytes from byte array + // Mifare UID BCC + block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // BCC on byte 5 + Bytes 5-7 are reserved SAK and ATQA for mifare classic + -Use mfCSetBlock(0, block0, oldUID, wantWipe, MAGIC_SINGLE) to write it + */ + uint8_t oldBlock0[16] = {0}, newBlock0[16] = {0}, testBlock0[16] = {0}; + // arg0 = Flags, arg1=blockNo + MifareCGetBlock(params, 0, oldBlock0); if (oldBlock0[0] == 0 && oldBlock0[0] == oldBlock0[1] && oldBlock0[1] == oldBlock0[2] && oldBlock0[2] == oldBlock0[3]) { Dbprintf("No changeable tag detected. Returning to replay mode for bank[%d]", selected); playing = 1; } else { - Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]); - memcpy(newBlock0,oldBlock0,16); - // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic) - - newBlock0[0] = uid_1st[selected]>>24; - newBlock0[1] = 0xFF & (uid_1st[selected]>>16); - newBlock0[2] = 0xFF & (uid_1st[selected]>>8); - newBlock0[3] = 0xFF & (uid_1st[selected]); - newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3]; - // arg0 = needWipe, arg1 = workFlags, arg2 = blockNo, datain - MifareCSetBlock(0, 0xFF,0, newBlock0); - MifareCGetBlock(0x3F, 1, 0, testBlock0); - if (memcmp(testBlock0,newBlock0,16)==0) - { - DbpString("Cloned successfull!"); - cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it + Dbprintf("UID from target tag: %02X%02X%02X%02X", oldBlock0[0],oldBlock0[1],oldBlock0[2],oldBlock0[3]); + memcpy(newBlock0,oldBlock0,16); + // Copy uid_1st for bank (2nd is for longer UIDs not supported if classic) + + newBlock0[0] = uid_1st[selected]>>24; + newBlock0[1] = 0xFF & (uid_1st[selected]>>16); + newBlock0[2] = 0xFF & (uid_1st[selected]>>8); + newBlock0[3] = 0xFF & (uid_1st[selected]); + newBlock0[4] = newBlock0[0]^newBlock0[1]^newBlock0[2]^newBlock0[3]; + + // arg0 = workFlags, arg1 = blockNo, datain + MifareCSetBlock(params, 0, newBlock0); + MifareCGetBlock(params, 0, testBlock0); + + if (memcmp(testBlock0, newBlock0, 16)==0) { + DbpString("Cloned successfull!"); + cardRead[selected] = 0; // Only if the card was cloned successfully should we clear it playing = 0; iGotoRecord = 1; - selected = (selected + 1) % OPTS; - } - else { + selected = (selected + 1) % OPTS; + } else { Dbprintf("Clone failed. Back to replay mode on bank[%d]", selected); playing = 1; } } LEDsoff(); LED(selected + 1, 0); - } // Change where to record (or begin playing) else if (playing==1) // button_pressed == BUTTON_SINGLE_CLICK && cardRead[selected]) @@ -1162,10 +1162,10 @@ void UsbPacketReceived(uint8_t *packet, int len) // Work with "magic Chinese" card case CMD_MIFARE_CSETBLOCK: - MifareCSetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); + MifareCSetBlock(c->arg[0], c->arg[1], c->d.asBytes); break; case CMD_MIFARE_CGETBLOCK: - MifareCGetBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); + MifareCGetBlock(c->arg[0], c->arg[1], c->d.asBytes); break; case CMD_MIFARE_CIDENT: MifareCIdent(); @@ -1196,7 +1196,6 @@ void UsbPacketReceived(uint8_t *packet, int len) break; case CMD_MIFARE_COLLECT_NONCES: - MifareCollectNonces(c->arg[0], c->arg[1]); break; #endif diff --git a/armsrc/apps.h b/armsrc/apps.h index 0a69f155..c2bd5204 100644 --- a/armsrc/apps.h +++ b/armsrc/apps.h @@ -139,11 +139,12 @@ void MifareEMemClr(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain) void MifareEMemSet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); void MifareEMemGet(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); -void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); // Work with "magic Chinese" card -void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain); +void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain); // Work with "magic Chinese" card +void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain); void MifareCIdent(); // is "magic chinese" card? void MifareUSetPwd(uint8_t arg0, uint8_t *datain); - +void OnSuccessMagic(); +void OnErrorMagic(uint8_t reason); void MifareCollectNonces(uint32_t arg0, uint32_t arg1); //desfire diff --git a/armsrc/mifarecmd.c b/armsrc/mifarecmd.c index e51ae18b..ba3034bf 100644 --- a/armsrc/mifarecmd.c +++ b/armsrc/mifarecmd.c @@ -17,6 +17,7 @@ #include "apps.h" #include "util.h" #include "crc.h" +#include "protocols.h" //----------------------------------------------------------------------------- // Select, Authenticate, Read a MIFARE tag. @@ -1010,224 +1011,176 @@ void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai //----------------------------------------------------------------------------- // Work with "magic Chinese" card (email him: ouyangweidaxian@live.cn) // +// PARAMS - workFlags +// bit 0 - need get UID +// bit 1 - need wupC +// bit 2 - need HALT after sequence +// bit 3 - need turn on FPGA before sequence +// bit 4 - need turn off FPGA +// bit 5 - need to set datain instead of issuing USB reply (called via ARM for StandAloneMode14a) +// bit 6 - wipe tag. //----------------------------------------------------------------------------- -void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){ +// magic uid card generation 1 commands +uint8_t wupC1[] = { MIFARE_MAGICWUPC1 }; +uint8_t wupC2[] = { MIFARE_MAGICWUPC2 }; +uint8_t wipeC[] = { MIFARE_MAGICWIPEC }; + +void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){ - // params - uint8_t needWipe = arg0; - // bit 0 - need get UID - // bit 1 - need wupC - // bit 2 - need HALT after sequence - // bit 3 - need init FPGA and field before sequence - // bit 4 - need reset FPGA and LED - uint8_t workFlags = arg1; - uint8_t blockNo = arg2; + // params + uint8_t workFlags = arg0; + uint8_t blockNo = arg1; - // card commands - uint8_t wupC1[] = { 0x40 }; - uint8_t wupC2[] = { 0x43 }; - uint8_t wipeC[] = { 0x41 }; + Dbprintf("ICE :: CSetBlocks Flags %02x", workFlags); // variables - byte_t isOK = 0; uint8_t uid[10] = {0x00}; - uint8_t d_block[18] = {0x00}; + uint8_t data[18] = {0x00}; uint32_t cuid; uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE]; uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE]; - // reset FPGA and LED - if (workFlags & 0x08) { + if (workFlags & MAGIC_INIT) { LED_A_ON(); LED_B_OFF(); - LED_C_OFF(); iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); - clear_trace(); set_tracing(TRUE); } - while (true) { - - // get UID from chip - if (workFlags & 0x01) { - if(!iso14443a_select_card(uid, NULL, &cuid)) { - if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card"); - //break; - }; - - if(mifare_classic_halt(NULL, cuid)) { - if (MF_DBGLEVEL >= 1) Dbprintf("Halt error"); - //break; - }; + // read UID and return to client + if (workFlags & MAGIC_UID) { + if(!iso14443a_select_card(uid, NULL, &cuid)) { + if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("Can't select card"); + OnErrorMagic(MAGIC_UID); }; + }; - // reset chip - if (needWipe){ - ReaderTransmitBitsPar(wupC1,7,0, NULL); - if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) { - if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error"); - break; - }; - - ReaderTransmit(wipeC, sizeof(wipeC), NULL); - if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) { - if (MF_DBGLEVEL >= 1) Dbprintf("wipeC error"); - break; - }; - - if(mifare_classic_halt(NULL, cuid)) { - if (MF_DBGLEVEL >= 4) Dbprintf("INFO - Tag answered the 'Halt' command"); - break; - }; - }; + // wipe tag, fill it with zeros + if (workFlags & MAGIC_WIPE){ + ReaderTransmitBitsPar(wupC1,7,0, NULL); + if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) { + if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error"); + OnErrorMagic(MAGIC_WIPE); + }; - // write block - if (workFlags & 0x02) { - ReaderTransmitBitsPar(wupC1,7,0, NULL); - if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) { - if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error"); - break; - }; + ReaderTransmit(wipeC, sizeof(wipeC), NULL); + if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) { + if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wipeC error"); + OnErrorMagic(MAGIC_WIPE); + }; + }; - ReaderTransmit(wupC2, sizeof(wupC2), NULL); - if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) { - if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error"); - break; - }; - } + // write block + if (workFlags & MAGIC_WUPC) { + ReaderTransmitBitsPar(wupC1,7,0, NULL); + if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) { + if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error"); + OnErrorMagic(MAGIC_WUPC); + }; - if ((mifare_sendcmd_short(NULL, 0, 0xA0, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) { - if (MF_DBGLEVEL >= 1) Dbprintf("write block send command error"); - break; + ReaderTransmit(wupC2, sizeof(wupC2), NULL); + if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) { + if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC2 error"); + OnErrorMagic(MAGIC_WUPC); }; + } + + if ((mifare_sendcmd_short(NULL, 0, ISO14443A_CMD_WRITEBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 1) || (receivedAnswer[0] != 0x0a)) { + if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("write block send command error"); + OnErrorMagic(4); + }; - memcpy(d_block, datain, 16); - AppendCrc14443a(d_block, 16); + memcpy(data, datain, sizeof(data)); + AppendCrc14443a(data, sizeof(data)); - ReaderTransmit(d_block, sizeof(d_block), NULL); - if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) { - if (MF_DBGLEVEL >= 1) Dbprintf("write block send data error"); - break; - }; + ReaderTransmit(data, sizeof(data), NULL); + if ((ReaderReceive(receivedAnswer, receivedAnswerPar) != 1) || (receivedAnswer[0] != 0x0a)) { + if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("write block send data error"); + OnErrorMagic(0); + }; - if (workFlags & 0x04) { - if (mifare_classic_halt(NULL, cuid)) { - if (MF_DBGLEVEL >= 4) Dbprintf("INFO - Tag answered the 'Halt' command"); - break; - }; - } - - isOK = 1; - break; - } + if (workFlags & MAGIC_OFF) + mifare_classic_halt_ex(NULL); LED_B_ON(); - cmd_send(CMD_ACK,isOK,0,0,uid,4); + // check if uid is cuid? + cmd_send(CMD_ACK,1,0,0,uid,sizeof(uid)); LED_B_OFF(); - if ((workFlags & 0x10) || (!isOK)) { - FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); - LEDsoff(); - set_tracing(FALSE); - } + if (workFlags & MAGIC_OFF) + OnSuccessMagic(); } - -void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain){ - - // params - // bit 1 - need wupC - // bit 2 - need HALT after sequence - // bit 3 - need init FPGA and field before sequence - // bit 4 - need reset FPGA and LED - // bit 5 - need to set datain instead of issuing USB reply (called via ARM for StandAloneMode14a) +void MifareCGetBlock(uint32_t arg0, uint32_t arg1, uint8_t *datain){ + uint8_t workFlags = arg0; - uint8_t blockNo = arg2; - - // card commands - uint8_t wupC1[] = { 0x40 }; - uint8_t wupC2[] = { 0x43 }; + uint8_t blockNo = arg1; + + Dbprintf("ICE :: CGetBlocks Flags %02x", workFlags); // variables - byte_t isOK = 0; - uint8_t data[18] = {0x00}; - uint32_t cuid = 0; - + uint8_t data[MAX_MIFARE_FRAME_SIZE]; uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE]; uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE]; - if (workFlags & 0x08) { + memset(data, 0x00, sizeof(data)); + + if (workFlags & MAGIC_INIT) { LED_A_ON(); LED_B_OFF(); - LED_C_OFF(); - iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); - + iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); clear_trace(); set_tracing(TRUE); } - while (true) { - if (workFlags & 0x02) { - ReaderTransmitBitsPar(wupC1,7,0, NULL); - if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) { - if (MF_DBGLEVEL >= 1) Dbprintf("wupC1 error"); - break; - }; - - ReaderTransmit(wupC2, sizeof(wupC2), NULL); - if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) { - if (MF_DBGLEVEL >= 1) Dbprintf("wupC2 error"); - break; - }; - } + if (workFlags & MAGIC_WUPC) { + ReaderTransmitBitsPar(wupC1,7,0, NULL); + if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) { + if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC1 error"); + OnErrorMagic(MAGIC_WUPC); + }; - // read block - if ((mifare_sendcmd_short(NULL, 0, 0x30, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) { - if (MF_DBGLEVEL >= 1) Dbprintf("read block send command error"); - break; + ReaderTransmit(wupC2, sizeof(wupC2), NULL); + if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) { + if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("wupC2 error"); + OnErrorMagic(MAGIC_WUPC); }; - memcpy(data, receivedAnswer, 18); - - if (workFlags & 0x04) { - if (mifare_classic_halt(NULL, cuid)) { - if (MF_DBGLEVEL >= 4) Dbprintf("INFO - Tag answered the 'Halt' command"); - break; - }; - } - - isOK = 1; - break; } + + // read block + if ((mifare_sendcmd_short(NULL, 0, ISO14443A_CMD_READBLOCK, blockNo, receivedAnswer, receivedAnswerPar, NULL) != 18)) { + if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("read block send command error"); + OnErrorMagic(0); + }; + + memcpy(data, receivedAnswer, sizeof(data)); + + // send HALT + if (workFlags & MAGIC_HALT) + mifare_classic_halt_ex(NULL); LED_B_ON(); - if (workFlags & 0x20) { - if (isOK) - memcpy(datain, data, 18); - } + + // if MAGIC_DATAIN, the data stays on device side. + if (workFlags & MAGIC_DATAIN) + memcpy(datain, data, sizeof(data)); else - cmd_send(CMD_ACK,isOK,0,0,data,18); + cmd_send(CMD_ACK,1,0,0,data,sizeof(data)); + LED_B_OFF(); - if ((workFlags & 0x10) || (!isOK)) { - FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); - LEDsoff(); - set_tracing(FALSE); - } + if (workFlags & MAGIC_OFF) + OnSuccessMagic(); } void MifareCIdent(){ - - // card commands - uint8_t wupC1[] = { 0x40 }; - uint8_t wupC2[] = { 0x43 }; // variables - byte_t isOK = 1; - - uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE]; - uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE]; + byte_t isOK = 1; + uint8_t receivedAnswer[1]; + uint8_t receivedAnswerPar[1]; ReaderTransmitBitsPar(wupC1,7,0, NULL); if(!ReaderReceive(receivedAnswer, receivedAnswerPar) || (receivedAnswer[0] != 0x0a)) { @@ -1241,76 +1194,21 @@ void MifareCIdent(){ // removed the if, since some magic tags misbehavies and send an answer to it. mifare_classic_halt(NULL, 0); - cmd_send(CMD_ACK,isOK,0,0,0,0); } -void MifareCollectNonces(uint32_t arg0, uint32_t arg1){ - - BigBuf_free(); - - uint32_t iterations = arg0; - uint8_t uid[10] = {0x00}; - - uint8_t *response = BigBuf_malloc(MAX_MIFARE_FRAME_SIZE); - uint8_t *responsePar = BigBuf_malloc(MAX_MIFARE_PARITY_SIZE); - - uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b }; - - // get memory from BigBuf. - uint8_t *nonces = BigBuf_malloc(iterations * 4); - - LED_A_ON(); - LED_B_OFF(); - LED_C_OFF(); - - iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN); - clear_trace(); - set_tracing(TRUE); - - for (int i = 0; i < iterations; i++) { - - WDT_HIT(); - - // Test if the action was cancelled - if(BUTTON_PRESS()) break; - - // if(mifare_classic_halt(pcs, cuid)) { - // if (MF_DBGLEVEL >= 1) Dbprintf("Halt error"); - //} - - if(!iso14443a_select_card(uid, NULL, NULL)) { - if (MF_DBGLEVEL >= 1) Dbprintf("Can't select card"); - continue; - }; - - // Transmit MIFARE_CLASSIC_AUTH. - ReaderTransmit(mf_auth, sizeof(mf_auth), NULL); - - // Receive the (4 Byte) "random" nonce - if (!ReaderReceive(response, responsePar)) { - if (MF_DBGLEVEL >= 1) Dbprintf("Couldn't receive tag nonce"); - continue; - } - - nonces[i*4] = bytes_to_num(response, 4); - } - - int packLen = iterations * 4; - int packSize = 0; - int packNum = 0; - while (packLen > 0) { - packSize = MIN(USB_CMD_DATA_SIZE, packLen); - LED_B_ON(); - cmd_send(CMD_ACK, 77, 0, packSize, nonces - packLen, packSize); - LED_B_OFF(); - - packLen -= packSize; - packNum++; - } +void OnSuccessMagic(){ FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); LEDsoff(); - set_tracing(FALSE); + set_tracing(FALSE); +} +void OnErrorMagic(uint8_t reason){ + // ACK, ISOK, reason,0,0,0 + cmd_send(CMD_ACK,0,reason,0,0,0); + OnSuccessMagic(); +} + +void MifareCollectNonces(uint32_t arg0, uint32_t arg1){ } // diff --git a/armsrc/mifaredesfire.c b/armsrc/mifaredesfire.c index 57681d71..cacd767f 100644 --- a/armsrc/mifaredesfire.c +++ b/armsrc/mifaredesfire.c @@ -575,11 +575,6 @@ void OnSuccess(){ } void OnError(uint8_t reason){ - pcb_blocknum = 0; - ReaderTransmit(deselect_cmd, 3 , NULL); - - FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); cmd_send(CMD_ACK,0,reason,0,0,0); - LEDsoff(); - set_tracing(FALSE); + OnSuccess(); } diff --git a/armsrc/mifareutil.c b/armsrc/mifareutil.c index eab8a930..7546919d 100644 --- a/armsrc/mifareutil.c +++ b/armsrc/mifareutil.c @@ -501,22 +501,21 @@ int mifare_ultra_writeblock(uint8_t blockNo, uint8_t *blockData) } return 0; } - -int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid) -{ +int mifare_classic_halt_ex(struct Crypto1State *pcs) { uint16_t len; - uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE]; - uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE]; + uint8_t receivedAnswer[4]; + uint8_t receivedAnswerPar[4]; len = mifare_sendcmd_short(pcs, pcs == NULL ? false:true, 0x50, 0x00, receivedAnswer, receivedAnswerPar, NULL); if (len != 0) { - if (MF_DBGLEVEL >= MF_DBG_ERROR) - Dbprintf("halt error. response len: %x", len); + if (MF_DBGLEVEL >= MF_DBG_ERROR) Dbprintf("halt error. response len: %x", len); return 1; } - return 0; } +int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid) { + return mifare_classic_halt_ex(pcs); +} int mifare_ultra_halt() { diff --git a/armsrc/mifareutil.h b/armsrc/mifareutil.h index 1dd77ed8..25657a82 100644 --- a/armsrc/mifareutil.h +++ b/armsrc/mifareutil.h @@ -62,6 +62,7 @@ int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint8_t isNested, uint32_t * ntptr, uint32_t *timing); int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData); int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid); +int mifare_classic_halt_ex(struct Crypto1State *pcs); int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData); // Ultralight/NTAG... diff --git a/client/cmdhf14a.c b/client/cmdhf14a.c index c85fadda..33197cf5 100644 --- a/client/cmdhf14a.c +++ b/client/cmdhf14a.c @@ -136,8 +136,8 @@ int CmdHF14AList(const char *Cmd) int CmdHF14AReader(const char *Cmd) { UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT | ISO14A_NO_DISCONNECT, 0, 0}}; + clearCommandBuffer(); SendCommand(&c); - UsbCommand resp; WaitForResponse(CMD_ACK,&resp); @@ -185,6 +185,7 @@ int CmdHF14AReader(const char *Cmd) c.arg[1] = 0; c.arg[2] = 0; + clearCommandBuffer(); SendCommand(&c); UsbCommand resp; @@ -248,6 +249,7 @@ int CmdHF14AReader(const char *Cmd) c.arg[1] = 2; c.arg[2] = 0; memcpy(c.d.asBytes, rats, 2); + clearCommandBuffer(); SendCommand(&c); WaitForResponse(CMD_ACK,&resp); @@ -345,16 +347,16 @@ int CmdHF14AReader(const char *Cmd) PrintAndLog(" x0 -> <1 kByte"); break; case 0x01: - PrintAndLog(" x0 -> 1 kByte"); + PrintAndLog(" x1 -> 1 kByte"); break; case 0x02: - PrintAndLog(" x0 -> 2 kByte"); + PrintAndLog(" x2 -> 2 kByte"); break; case 0x03: - PrintAndLog(" x0 -> 4 kByte"); + PrintAndLog(" x3 -> 4 kByte"); break; case 0x04: - PrintAndLog(" x0 -> 8 kByte"); + PrintAndLog(" x4 -> 8 kByte"); break; } switch (card.ats[pos + 3] & 0xf0) { @@ -395,14 +397,17 @@ int CmdHF14AReader(const char *Cmd) // try to see if card responses to "chinese magic backdoor" commands. + uint8_t isOK = 0; + clearCommandBuffer(); c.cmd = CMD_MIFARE_CIDENT; c.arg[0] = 0; c.arg[1] = 0; c.arg[2] = 0; SendCommand(&c); - WaitForResponse(CMD_ACK,&resp); - uint8_t isOK = resp.arg[0] & 0xff; - PrintAndLog("Answers to chinese magic backdoor commands: %s", (isOK ? "YES" : "NO") ); + if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) + isOK = resp.arg[0] & 0xff; + + PrintAndLog("Answers to magic commands (GEN1): %s", (isOK ? "YES" : "NO") ); // disconnect c.cmd = CMD_READER_ISO_14443a; diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c index e41afb6a..ed362cd1 100644 --- a/client/cmdhfmf.c +++ b/client/cmdhfmf.c @@ -1543,7 +1543,7 @@ int CmdHF14AMfCSetBlk(const char *Cmd) { uint8_t memBlock[16] = {0x00}; uint8_t blockNo = 0; - bool wipeCard = FALSE; + uint8_t params = MAGIC_SINGLE; int res; if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') { @@ -1562,10 +1562,12 @@ int CmdHF14AMfCSetBlk(const char *Cmd) } char ctmp = param_getchar(Cmd, 2); - wipeCard = (ctmp == 'w' || ctmp == 'W'); + if (ctmp == 'w' || ctmp == 'W') + params |= MAGIC_WIPE; + PrintAndLog("--block number:%2d data:%s", blockNo, sprint_hex(memBlock, 16)); - res = mfCSetBlock(blockNo, memBlock, NULL, wipeCard, CSETBLOCK_SINGLE_OPER); + res = mfCSetBlock(blockNo, memBlock, NULL, params); if (res) { PrintAndLog("Can't write block. error=%d", res); return 1; @@ -1576,13 +1578,15 @@ int CmdHF14AMfCSetBlk(const char *Cmd) int CmdHF14AMfCLoad(const char *Cmd) { FILE * f; - char filename[FILE_PATH_SIZE] = {0x00}; + char filename[FILE_PATH_SIZE]; char * fnameptr = filename; char buf[64] = {0x00}; uint8_t buf8[64] = {0x00}; uint8_t fillFromEmulator = 0; int i, len, blockNum, flags=0; + memset(filename, 0, sizeof(filename)); + char ctmp = param_getchar(Cmd, 0); if (ctmp == 'h' || ctmp == 'H' || ctmp == 0x00) { @@ -1602,11 +1606,11 @@ int CmdHF14AMfCLoad(const char *Cmd) PrintAndLog("Cant get block: %d", blockNum); return 2; } - if (blockNum == 0) flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC; // switch on field and send magic sequence + if (blockNum == 0) flags = MAGIC_INIT + MAGIC_WUPC; // switch on field and send magic sequence if (blockNum == 1) flags = 0; // just write - if (blockNum == 16 * 4 - 1) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD; // Done. Magic Halt and switch off field. + if (blockNum == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF; // Done. Magic Halt and switch off field. - if (mfCSetBlock(blockNum, buf8, NULL, 0, flags)) { + if (mfCSetBlock(blockNum, buf8, NULL, flags)) { PrintAndLog("Cant set magic card block: %d", blockNum); return 3; } @@ -1649,11 +1653,11 @@ int CmdHF14AMfCLoad(const char *Cmd) for (i = 0; i < 32; i += 2) sscanf(&buf[i], "%02x", (unsigned int *)&buf8[i / 2]); - if (blockNum == 0) flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC; // switch on field and send magic sequence + if (blockNum == 0) flags = MAGIC_INIT + MAGIC_WUPC; // switch on field and send magic sequence if (blockNum == 1) flags = 0; // just write - if (blockNum == 16 * 4 - 1) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD; // Done. Switch off field. + if (blockNum == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF; // Done. Switch off field. - if (mfCSetBlock(blockNum, buf8, NULL, 0, flags)) { + if (mfCSetBlock(blockNum, buf8, NULL, flags)) { PrintAndLog("Can't set magic card block: %d", blockNum); return 3; } @@ -1663,6 +1667,7 @@ int CmdHF14AMfCLoad(const char *Cmd) } fclose(f); + // 64 or 256blocks. if (blockNum != 16 * 4 && blockNum != 32 * 4 + 8 * 16){ PrintAndLog("File content error. There must be 64 blocks"); return 4; @@ -1674,12 +1679,13 @@ int CmdHF14AMfCLoad(const char *Cmd) } int CmdHF14AMfCGetBlk(const char *Cmd) { - uint8_t memBlock[16]; + uint8_t data[16]; uint8_t blockNo = 0; int res; - memset(memBlock, 0x00, sizeof(memBlock)); + memset(data, 0x00, sizeof(data)); + char ctmp = param_getchar(Cmd, 0); - if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') { + if (strlen(Cmd) < 1 || ctmp == 'h' || ctmp == 'H') { PrintAndLog("Usage: hf mf cgetblk "); PrintAndLog("sample: hf mf cgetblk 1"); PrintAndLog("Get block data from magic Chinese card (only works with such cards)\n"); @@ -1690,22 +1696,24 @@ int CmdHF14AMfCGetBlk(const char *Cmd) { PrintAndLog("--block number:%2d ", blockNo); - res = mfCGetBlock(blockNo, memBlock, CSETBLOCK_SINGLE_OPER); + res = mfCGetBlock(blockNo, data, MAGIC_SINGLE); if (res) { - PrintAndLog("Can't read block. error=%d", res); - return 1; - } + PrintAndLog("Can't read block. error=%d", res); + return 1; + } - PrintAndLog("block data:%s", sprint_hex(memBlock, 16)); + PrintAndLog("data:%s", sprint_hex(data, sizeof(data))); return 0; } int CmdHF14AMfCGetSc(const char *Cmd) { - uint8_t memBlock[16] = {0x00}; + uint8_t data[16]; uint8_t sectorNo = 0; int i, res, flags; - - if (strlen(Cmd) < 1 || param_getchar(Cmd, 0) == 'h') { + memset(data, 0x00, sizeof(data)); + char ctmp = param_getchar(Cmd, 0); + + if (strlen(Cmd) < 1 || ctmp == 'h' || ctmp == 'H') { PrintAndLog("Usage: hf mf cgetsc "); PrintAndLog("sample: hf mf cgetsc 0"); PrintAndLog("Get sector data from magic Chinese card (only works with such cards)\n"); @@ -1719,19 +1727,19 @@ int CmdHF14AMfCGetSc(const char *Cmd) { } PrintAndLog("--sector number:%d ", sectorNo); + PrintAndLog("block | data"); - flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC; + flags = MAGIC_INIT + MAGIC_WUPC; for (i = 0; i < 4; i++) { if (i == 1) flags = 0; - if (i == 3) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD; + if (i == 3) flags = MAGIC_HALT + MAGIC_OFF; - res = mfCGetBlock(sectorNo * 4 + i, memBlock, flags); + res = mfCGetBlock(sectorNo * 4 + i, data, flags); if (res) { PrintAndLog("Can't read block. %d error=%d", sectorNo * 4 + i, res); return 1; - } - - PrintAndLog("block %3d data:%s", sectorNo * 4 + i, sprint_hex(memBlock, 16)); + } + PrintAndLog(" %3d | %s", sectorNo * 4 + i, sprint_hex(data, sizeof(data))); } return 0; } @@ -1739,14 +1747,14 @@ int CmdHF14AMfCGetSc(const char *Cmd) { int CmdHF14AMfCSave(const char *Cmd) { FILE * f; - char filename[FILE_PATH_SIZE] = {0x00}; + char filename[FILE_PATH_SIZE]; char * fnameptr = filename; uint8_t fillFromEmulator = 0; - uint8_t buf[64] = {0x00}; + uint8_t buf[64]; int i, j, len, flags; - // memset(filename, 0, sizeof(filename)); - // memset(buf, 0, sizeof(buf)); + memset(filename, 0, sizeof(filename)); + memset(buf, 0, sizeof(buf)); char ctmp = param_getchar(Cmd, 0); if ( ctmp == 'h' || ctmp == 'H' ) { @@ -1762,10 +1770,10 @@ int CmdHF14AMfCSave(const char *Cmd) { if (fillFromEmulator) { // put into emulator - flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC; + flags = MAGIC_INIT + MAGIC_WUPC; for (i = 0; i < 16 * 4; i++) { if (i == 1) flags = 0; - if (i == 16 * 4 - 1) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD; + if (i == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF; if (mfCGetBlock(i, buf, flags)) { PrintAndLog("Cant get block: %d", i); @@ -1782,9 +1790,10 @@ int CmdHF14AMfCSave(const char *Cmd) { len = strlen(Cmd); if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4; + // get filename based on UID if (len < 1) { - // get filename - if (mfCGetBlock(0, buf, CSETBLOCK_SINGLE_OPER)) { + + if (mfCGetBlock(0, buf, MAGIC_SINGLE)) { PrintAndLog("Cant get block: %d", 0); len = sprintf(fnameptr, "dump"); fnameptr += len; @@ -1797,6 +1806,7 @@ int CmdHF14AMfCSave(const char *Cmd) { fnameptr += len; } + // add .eml extension sprintf(fnameptr, ".eml"); // open file @@ -1808,10 +1818,10 @@ int CmdHF14AMfCSave(const char *Cmd) { } // put hex - flags = CSETBLOCK_INIT_FIELD + CSETBLOCK_WUPC; + flags = MAGIC_INIT + MAGIC_WUPC; for (i = 0; i < 16 * 4; i++) { if (i == 1) flags = 0; - if (i == 16 * 4 - 1) flags = CSETBLOCK_HALT + CSETBLOCK_RESET_FIELD; + if (i == 16 * 4 - 1) flags = MAGIC_HALT + MAGIC_OFF; if (mfCGetBlock(i, buf, flags)) { PrintAndLog("Cant get block: %d", i); @@ -1821,10 +1831,9 @@ int CmdHF14AMfCSave(const char *Cmd) { fprintf(f, "%02x", buf[j]); fprintf(f,"\n"); } + fflush(f); fclose(f); - PrintAndLog("Saved to file: %s", filename); - return 0; } } @@ -2031,13 +2040,12 @@ int CmdHFMF(const char *Cmd) { // flush WaitForResponseTimeout(CMD_ACK,NULL,100); - - CmdsParse(CommandTable, Cmd); - return 0; + CmdsParse(CommandTable, Cmd); + return 0; } int CmdHelp(const char *Cmd) { - CmdsHelp(CommandTable); - return 0; + CmdsHelp(CommandTable); + return 0; } diff --git a/client/cmdlf.c b/client/cmdlf.c index c638bb93..ef5817ac 100644 --- a/client/cmdlf.c +++ b/client/cmdlf.c @@ -1199,32 +1199,32 @@ int CmdLFfind(const char *Cmd) static command_t CommandTable[] = { - {"help", CmdHelp, 1, "This help"}, + {"help", CmdHelp, 1, "This help"}, {"awid", CmdLFAWID, 1, "{ AWID RFIDs... }"}, - {"em4x", CmdLFEM4X, 1, "{ EM4X RFIDs... }"}, - {"hid", CmdLFHID, 1, "{ HID RFIDs... }"}, - {"hitag", CmdLFHitag, 1, "{ HITAG RFIDs... }"}, - {"io", CmdLFIO, 1, "{ IOPROX RFIDs... }"}, - {"pcf7931", CmdLFPCF7931, 1, "{ PCF7931 RFIDs... }"}, - {"ti", CmdLFTI, 1, "{ TI RFIDs... }"}, - {"t55xx", CmdLFT55XX, 1, "{ T55X7 RFIDs... }"}, - {"viking", CmdLFViking, 1, "{ Viking RFIDs... }"}, - {"config", CmdLFSetConfig, 0, "Set config for LF sampling, bit/sample, decimation, frequency"}, - - {"cmdread", CmdLFCommandRead, 0, " <'0' period> <'1' period> ['h' 134] \n\t\t-- Modulate LF reader field to send command before read (all periods in microseconds)"}, - {"flexdemod", CmdFlexdemod, 1, "Demodulate samples for FlexPass"}, - {"indalademod", CmdIndalaDemod, 1, "['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)"}, - {"indalaclone", CmdIndalaClone, 0, " ['l']-- Clone Indala to T55x7 (tag must be in antenna)(UID in HEX)(option 'l' for 224 UID"}, - {"read", CmdLFRead, 0, "['s' silent] Read 125/134 kHz LF ID-only tag. Do 'lf read h' for help"}, - {"search", CmdLFfind, 1, "[offline] ['u'] Read and Search for valid known tag (in offline mode it you can load first then search) \n\t\t-- 'u' to search for unknown tags"}, - {"sim", CmdLFSim, 0, "[GAP] -- Simulate LF tag from buffer with optional GAP (in microseconds)"}, - {"simask", CmdLFaskSim, 0, "[clock] [invert <1|0>] [biphase/manchester/raw <'b'|'m'|'r'>] [msg separator 's'] [d ] \n\t\t-- Simulate LF ASK tag from demodbuffer or input"}, - {"simfsk", CmdLFfskSim, 0, "[c ] [i] [H ] [L ] [d ] \n\t\t-- Simulate LF FSK tag from demodbuffer or input"}, - {"simpsk", CmdLFpskSim, 0, "[1|2|3] [c ] [i] [r ] [d ] \n\t\t-- Simulate LF PSK tag from demodbuffer or input"}, - {"simbidir", CmdLFSimBidir, 0, "Simulate LF tag (with bidirectional data transmission between reader and tag)"}, - {"snoop", CmdLFSnoop, 0, "['l'|'h'|] [trigger threshold] -- Snoop LF (l:125khz, h:134khz)"}, - {"vchdemod", CmdVchDemod, 1, "['clone'] -- Demodulate samples for VeriChip"}, - {NULL, NULL, 0, NULL} + {"em4x", CmdLFEM4X, 1, "{ EM4X RFIDs... }"}, + {"hid", CmdLFHID, 1, "{ HID RFIDs... }"}, + {"hitag", CmdLFHitag, 1, "{ HITAG RFIDs... }"}, + {"io", CmdLFIO, 1, "{ IOPROX RFIDs... }"}, + {"pcf7931", CmdLFPCF7931, 1, "{ PCF7931 RFIDs... }"}, + {"ti", CmdLFTI, 1, "{ TI RFIDs... }"}, + {"t55xx", CmdLFT55XX, 1, "{ T55X7 RFIDs... }"}, + {"viking", CmdLFViking, 1, "{ Viking RFIDs... }"}, + {"config", CmdLFSetConfig, 0, "Set config for LF sampling, bit/sample, decimation, frequency"}, + + {"cmdread", CmdLFCommandRead, 0, " <'0' period> <'1' period> ['h' 134] \n\t\t-- Modulate LF reader field to send command before read (all periods in microseconds)"}, + {"flexdemod", CmdFlexdemod, 1, "Demodulate samples for FlexPass"}, + {"indalademod", CmdIndalaDemod, 1, "['224'] -- Demodulate samples for Indala 64 bit UID (option '224' for 224 bit)"}, + {"indalaclone", CmdIndalaClone, 0, " ['l']-- Clone Indala to T55x7 (tag must be in antenna)(UID in HEX)(option 'l' for 224 UID"}, + {"read", CmdLFRead, 0, "['s' silent] Read 125/134 kHz LF ID-only tag. Do 'lf read h' for help"}, + {"search", CmdLFfind, 1, "[offline] ['u'] Read and Search for valid known tag (in offline mode it you can load first then search) \n\t\t-- 'u' to search for unknown tags"}, + {"sim", CmdLFSim, 0, "[GAP] -- Simulate LF tag from buffer with optional GAP (in microseconds)"}, + {"simask", CmdLFaskSim, 0, "[clock] [invert <1|0>] [biphase/manchester/raw <'b'|'m'|'r'>] [msg separator 's'] [d ] \n\t\t-- Simulate LF ASK tag from demodbuffer or input"}, + {"simfsk", CmdLFfskSim, 0, "[c ] [i] [H ] [L ] [d ] \n\t\t-- Simulate LF FSK tag from demodbuffer or input"}, + {"simpsk", CmdLFpskSim, 0, "[1|2|3] [c ] [i] [r ] [d ] \n\t\t-- Simulate LF PSK tag from demodbuffer or input"}, + {"simbidir", CmdLFSimBidir, 0, "Simulate LF tag (with bidirectional data transmission between reader and tag)"}, + {"snoop", CmdLFSnoop, 0, "Snoop LF"}, + {"vchdemod", CmdVchDemod, 1, "['clone'] -- Demodulate samples for VeriChip"}, + {NULL, NULL, 0, NULL} }; int CmdLF(const char *Cmd) diff --git a/client/mifarehost.c b/client/mifarehost.c index dc3b988a..e6ad6016 100644 --- a/client/mifarehost.c +++ b/client/mifarehost.c @@ -237,14 +237,16 @@ int mfEmlSetMem_xt(uint8_t *data, int blockNum, int blocksCount, int blockBtWidt // "MAGIC" CARD -int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool wantWipe) { - uint8_t oldblock0[16] = {0x00}; - uint8_t block0[16] = {0x00}; +int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, uint8_t wipecard) { - int old = mfCGetBlock(0, oldblock0, CSETBLOCK_SINGLE_OPER); + uint8_t params = MAGIC_SINGLE; + uint8_t block0[16]; + memset(block0, 0x00, sizeof(block0)); + + + int old = mfCGetBlock(0, block0, params); if (old == 0) { - memcpy(block0, oldblock0, 16); - PrintAndLog("old block 0: %s", sprint_hex(block0,16)); + PrintAndLog("old block 0: %s", sprint_hex(block0, sizeof(block0))); } else { PrintAndLog("Couldn't get old data. Will write over the last bytes of Block 0."); } @@ -255,26 +257,30 @@ int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool w // Mifare UID BCC block0[4] = block0[0]^block0[1]^block0[2]^block0[3]; // mifare classic SAK(byte 5) and ATQA(byte 6 and 7, reversed) - if (sak!=NULL) + if ( sak != NULL ) block0[5]=sak[0]; - if (atqa!=NULL) { + + if ( atqa != NULL ) { block0[6]=atqa[1]; block0[7]=atqa[0]; } PrintAndLog("new block 0: %s", sprint_hex(block0,16)); - return mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER); + + if ( wipecard ) params |= MAGIC_WIPE; + if ( oldUID == NULL) params |= MAGIC_UID; + + return mfCSetBlock(0, block0, oldUID, params); } -int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, bool wantWipe, uint8_t params) { +int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, uint8_t params) { uint8_t isOK = 0; - UsbCommand c = {CMD_MIFARE_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}}; + UsbCommand c = {CMD_MIFARE_CSETBLOCK, {params, blockNo, 0}}; memcpy(c.d.asBytes, data, 16); - clearCommandBuffer(); SendCommand(&c); UsbCommand resp; - if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) { + if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) { isOK = resp.arg[0] & 0xff; if (uid != NULL) memcpy(uid, resp.d.asBytes, 4); @@ -289,9 +295,7 @@ int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, bool wantWipe, uin int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params) { uint8_t isOK = 0; - - UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, 0, blockNo}}; - + UsbCommand c = {CMD_MIFARE_CGETBLOCK, {params, blockNo, 0}}; clearCommandBuffer(); SendCommand(&c); UsbCommand resp; diff --git a/client/mifarehost.h b/client/mifarehost.h index 49991d66..a214ede4 100644 --- a/client/mifarehost.h +++ b/client/mifarehost.h @@ -19,28 +19,21 @@ #include "nonce2key/nonce2key.h" #include "nonce2key/crapto1.h" #include "iso14443crc.h" +#include "protocols.h" #define MEM_CHUNK 1000000 #define NESTED_SECTOR_RETRY 10 -// mfCSetBlock work flags -#define CSETBLOCK_UID 0x01 -#define CSETBLOCK_WUPC 0x02 -#define CSETBLOCK_HALT 0x04 -#define CSETBLOCK_INIT_FIELD 0x08 -#define CSETBLOCK_RESET_FIELD 0x10 -#define CSETBLOCK_SINGLE_OPER 0x1F - // mifare tracer flags -#define TRACE_IDLE 0x00 -#define TRACE_AUTH1 0x01 -#define TRACE_AUTH2 0x02 -#define TRACE_AUTH_OK 0x03 -#define TRACE_READ_DATA 0x04 -#define TRACE_WRITE_OK 0x05 -#define TRACE_WRITE_DATA 0x06 +#define TRACE_IDLE 0x00 +#define TRACE_AUTH1 0x01 +#define TRACE_AUTH2 0x02 +#define TRACE_AUTH_OK 0x03 +#define TRACE_READ_DATA 0x04 +#define TRACE_WRITE_OK 0x05 +#define TRACE_WRITE_DATA 0x06 -#define TRACE_ERROR 0xFF +#define TRACE_ERROR 0xFF typedef struct { uint64_t Key[2]; @@ -56,8 +49,8 @@ int mfEmlGetMem(uint8_t *data, int blockNum, int blocksCount); int mfEmlSetMem(uint8_t *data, int blockNum, int blocksCount); int mfEmlSetMem_xt(uint8_t *data, int blockNum, int blocksCount, int blockBtWidth); -int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, bool wantWipe); -int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, bool wantWipe, uint8_t params); +int mfCSetUID(uint8_t *uid, uint8_t *atqa, uint8_t *sak, uint8_t *oldUID, uint8_t wipecard); +int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, uint8_t params); int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params); int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile); diff --git a/common/protocols.h b/common/protocols.h index 152039b9..875b0af0 100644 --- a/common/protocols.h +++ b/common/protocols.h @@ -167,6 +167,21 @@ ISO 7816-4 Basic interindustry commands. For command APDU's. #define MIFARE_ULEV1_VCSL 0x4B +// Magic Generation 1, parameter "work flags" +// bit 0 - need get UID +// bit 1 - send wupC (wakeup chinese) +// bit 2 - send HALT cmd after sequence +// bit 3 - turn on FPGA +// bit 4 - turn off FPGA +// bit 5 - set datain instead of issuing USB reply (called via ARM for StandAloneMode14a) +#define MAGIC_UID 0x01 +#define MAGIC_WUPC 0x02 +#define MAGIC_HALT 0x04 +#define MAGIC_INIT 0x08 +#define MAGIC_OFF 0x10 +#define MAGIC_DATAIN 0x20 +#define MAGIC_WIPE 0x40 +#define MAGIC_SINGLE (MAGIC_WUPC | MAGIC_HALT | MAGIC_INIT | MAGIC_OFF) //0x1E /** 06 00 = INITIATE @@ -313,7 +328,7 @@ void getMemConfig(uint8_t mem_cfg, uint8_t chip_cfg, uint8_t *max_blk, uint8_t * #define T5555_PSK_RF_8 0x00000200 #define T5555_USE_PWD 0x00000400 #define T5555_USE_AOR 0x00000800 -#define T5555_BITRATE_SHIFT 12 +#define T5555_BITRATE_SHIFT 12 //(RF=2n+2) ie 64=2*0x1F+2 or n = (RF-2)/2 #define T5555_FAST_WRITE 0x00004000 #define T5555_PAGE_SELECT 0x00008000