This commit is contained in:
iceman1001 2021-04-08 10:44:31 +02:00
commit 27184d7f5b
21 changed files with 334 additions and 334 deletions

View file

@ -5,7 +5,7 @@
// at your option, any later version. See the LICENSE.txt file for the text of // at your option, any later version. See the LICENSE.txt file for the text of
// the license. // the license.
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// main code for hf_craftbyte // main code for hf_craftbyte
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// //
// //
@ -77,7 +77,7 @@ void RunMod(void) {
flags |= FLAG_4B_UID_IN_DATA; flags |= FLAG_4B_UID_IN_DATA;
} else if (card.uidlen == 7) { } else if (card.uidlen == 7) {
flags |= FLAG_7B_UID_IN_DATA; flags |= FLAG_7B_UID_IN_DATA;
} else if (card.uidlen == 10){ } else if (card.uidlen == 10) {
flags |= FLAG_10B_UID_IN_DATA; flags |= FLAG_10B_UID_IN_DATA;
} else { } else {
Dbprintf("Unusual UID length, something is wrong. Try again please."); Dbprintf("Unusual UID length, something is wrong. Try again please.");

View file

@ -327,7 +327,7 @@ void RunMod(void) {
if (i == 4) { if (i == 4) {
// Get NDEF Data // Get NDEF Data
if (apdubuffer[1] == 0x1b && apdubuffer[2] == 0xd1) { if (apdubuffer[1] == 0x1b && apdubuffer[2] == 0xd1) {
gotndef = true; gotndef = true;
memcpy(&ndef, &apdubuffer, apdulen - 2); memcpy(&ndef, &apdubuffer, apdulen - 2);
break; break;

View file

@ -1112,7 +1112,7 @@ static void PacketReceived(PacketCommandNG *packet) {
} }
break; break;
} }
case CMD_LF_HITAG_ELOAD: { case CMD_LF_HITAG_ELOAD: {
/* /*
struct p { struct p {
uint16_t len; uint16_t len;
@ -1746,7 +1746,7 @@ static void PacketReceived(PacketCommandNG *packet) {
break; break;
} }
case CMD_SMART_RAW: { case CMD_SMART_RAW: {
SmartCardRaw((smart_card_raw_t*)packet->data.asBytes); SmartCardRaw((smart_card_raw_t *)packet->data.asBytes);
break; break;
} }
case CMD_SMART_UPLOAD: { case CMD_SMART_UPLOAD: {

View file

@ -592,7 +592,7 @@ void felica_sniff(uint32_t samplesToSkip, uint32_t triggersToSkip) {
WDT_HIT(); WDT_HIT();
// since simulation is a tight time critical loop, // since simulation is a tight time critical loop,
// we only check for user request to end at iteration 3000, 9000. // we only check for user request to end at iteration 3000, 9000.
if (flip == 3) { if (flip == 3) {
if (data_available()) { if (data_available()) {
retval = PM3_EOPABORTED; retval = PM3_EOPABORTED;
@ -689,7 +689,7 @@ void felica_sim_lite(uint8_t *uid) {
uint8_t *curresp = NULL; uint8_t *curresp = NULL;
bool listenmode = true; bool listenmode = true;
// uint32_t frtm = GetCountSspClk(); // uint32_t frtm = GetCountSspClk();
uint8_t flip = 0; uint8_t flip = 0;
uint16_t checker = 0; uint16_t checker = 0;
for (;;) { for (;;) {
@ -697,7 +697,7 @@ void felica_sim_lite(uint8_t *uid) {
WDT_HIT(); WDT_HIT();
// since simulation is a tight time critical loop, // since simulation is a tight time critical loop,
// we only check for user request to end at iteration 3000, 9000. // we only check for user request to end at iteration 3000, 9000.
if (flip == 3) { if (flip == 3) {
if (data_available()) { if (data_available()) {
retval = PM3_EOPABORTED; retval = PM3_EOPABORTED;

View file

@ -998,311 +998,311 @@ void SniffHitag2(void) {
DbpString("Starting Hitag2 sniffing"); DbpString("Starting Hitag2 sniffing");
LED_D_ON(); LED_D_ON();
FpgaDownloadAndGo(FPGA_BITSTREAM_LF); FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
BigBuf_free(); BigBuf_free();
BigBuf_Clear_ext(false); BigBuf_Clear_ext(false);
clear_trace(); clear_trace();
set_tracing(true); set_tracing(true);
/* /*
lf_init(false, false); lf_init(false, false);
// no logging of the raw signal // no logging of the raw signal
g_logging = lf_get_reader_modulation(); g_logging = lf_get_reader_modulation();
uint32_t total_count = 0; uint32_t total_count = 0;
uint8_t rx[20 * 8 * 2]; uint8_t rx[20 * 8 * 2];
while (BUTTON_PRESS() == false) { while (BUTTON_PRESS() == false) {
lf_reset_counter(); lf_reset_counter();
WDT_HIT(); WDT_HIT();
size_t periods = 0; size_t periods = 0;
uint16_t rxlen = 0; uint16_t rxlen = 0;
memset(rx, 0x00, sizeof(rx)); memset(rx, 0x00, sizeof(rx));
// Use the current modulation state as starting point // Use the current modulation state as starting point
uint8_t mod_state = lf_get_reader_modulation(); uint8_t mod_state = lf_get_reader_modulation();
while (rxlen < sizeof(rx)) { while (rxlen < sizeof(rx)) {
periods = lf_count_edge_periods(64); periods = lf_count_edge_periods(64);
// Evaluate the number of periods before the next edge // Evaluate the number of periods before the next edge
if (periods >= 24 && periods < 64) { if (periods >= 24 && periods < 64) {
// Detected two sequential equal bits and a modulation switch // Detected two sequential equal bits and a modulation switch
// NRZ modulation: (11 => --|) or (11 __|) // NRZ modulation: (11 => --|) or (11 __|)
rx[rxlen++] = mod_state; rx[rxlen++] = mod_state;
rx[rxlen++] = mod_state; rx[rxlen++] = mod_state;
// toggle tag modulation state // toggle tag modulation state
mod_state ^= 1; mod_state ^= 1;
} else if (periods > 0 && periods < 24) { } else if (periods > 0 && periods < 24) {
// Detected one bit and a modulation switch // Detected one bit and a modulation switch
// NRZ modulation: (1 => -|) or (0 _|) // NRZ modulation: (1 => -|) or (0 _|)
rx[rxlen++] = mod_state; rx[rxlen++] = mod_state;
mod_state ^= 1; mod_state ^= 1;
} else {
mod_state ^= 1;
break;
}
}
if (rxlen == 0)
continue;
// tag sends 11111 + uid,
bool got_tag = ((memcmp(rx, "\x01\x00\x01\x00\x01\x00\x01\x00\x01\x00", 10) == 0));
if (got_tag) {
// mqnchester decode
bool bad_man = false;
uint16_t bitnum = 0;
for (uint16_t i = 0; i < rxlen; i += 2) {
if (rx[i] == 1 && (rx[i + 1] == 0)) {
rx[bitnum++] = 0;
} else if ((rx[i] == 0) && rx[i + 1] == 1) {
rx[bitnum++] = 1;
} else { } else {
bad_man = true; mod_state ^= 1;
break;
} }
} }
if (bad_man) {
DBG DbpString("bad manchester");
continue;
}
if (bitnum < 5) {
DBG DbpString("too few bits");
continue;
}
// skip header 11111
uint16_t i = 0;
if (got_tag) {
i = 5;
}
// Pack the response into a byte array
rxlen = 0;
for (; i < bitnum; i++) {
uint8_t b = rx[i];
rx[rxlen >> 3] |= b << (7 - (rxlen % 8));
rxlen++;
}
// skip spurious bit
if (rxlen % 8 == 1) {
rxlen--;
}
// nothing to log
if (rxlen == 0) if (rxlen == 0)
continue; continue;
LogTrace(rx, nbytes(rxlen), 0, 0, NULL, false); // tag sends 11111 + uid,
total_count += nbytes(rxlen); bool got_tag = ((memcmp(rx, "\x01\x00\x01\x00\x01\x00\x01\x00\x01\x00", 10) == 0));
} else {
// decode reader comms
LogTrace(rx, rxlen, 0, 0, NULL, true);
total_count += rxlen;
// Pack the response into a byte array
// LogTrace(rx, nbytes(rdr), 0, 0, NULL, true); if (got_tag) {
// total_count += nbytes(rdr); // mqnchester decode
bool bad_man = false;
uint16_t bitnum = 0;
for (uint16_t i = 0; i < rxlen; i += 2) {
if (rx[i] == 1 && (rx[i + 1] == 0)) {
rx[bitnum++] = 0;
} else if ((rx[i] == 0) && rx[i + 1] == 1) {
rx[bitnum++] = 1;
} else {
bad_man = true;
}
}
if (bad_man) {
DBG DbpString("bad manchester");
continue;
}
if (bitnum < 5) {
DBG DbpString("too few bits");
continue;
}
// skip header 11111
uint16_t i = 0;
if (got_tag) {
i = 5;
}
// Pack the response into a byte array
rxlen = 0;
for (; i < bitnum; i++) {
uint8_t b = rx[i];
rx[rxlen >> 3] |= b << (7 - (rxlen % 8));
rxlen++;
}
// skip spurious bit
if (rxlen % 8 == 1) {
rxlen--;
}
// nothing to log
if (rxlen == 0)
continue;
LogTrace(rx, nbytes(rxlen), 0, 0, NULL, false);
total_count += nbytes(rxlen);
} else {
// decode reader comms
LogTrace(rx, rxlen, 0, 0, NULL, true);
total_count += rxlen;
// Pack the response into a byte array
// LogTrace(rx, nbytes(rdr), 0, 0, NULL, true);
// total_count += nbytes(rdr);
}
LED_A_INV();
} }
LED_A_INV();
}
lf_finalize(); lf_finalize();
Dbprintf("Collected %u bytes", total_count); Dbprintf("Collected %u bytes", total_count);
*/ */
// Set up eavesdropping mode, frequency divisor which will drive the FPGA // Set up eavesdropping mode, frequency divisor which will drive the FPGA
// and analog mux selection. // and analog mux selection.
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_TOGGLE_MODE); FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_TOGGLE_MODE);
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); // 125Khz FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); // 125Khz
SetAdcMuxFor(GPIO_MUXSEL_LOPKD); SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
RELAY_OFF(); RELAY_OFF();
// Configure output pin that is connected to the FPGA (for modulating) // Configure output pin that is connected to the FPGA (for modulating)
AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT; AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT;
// Disable modulation, we are going to eavesdrop, not modulate ;)
LOW(GPIO_SSC_DOUT);
// Enable Peripheral Clock for TIMER_CLOCK1, used to capture edges of the reader frames
AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1);
AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME;
// Disable timer during configuration
AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
// Capture mode, defaul timer source = MCK/2 (TIMER_CLOCK1), TIOA is external trigger,
// external trigger rising edge, load RA on rising edge of TIOA.
AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK | AT91C_TC_ETRGEDG_BOTH | AT91C_TC_ABETRG | AT91C_TC_LDRA_BOTH;
// Enable and reset counter
AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
// Disable modulation, we are going to eavesdrop, not modulate ;)
LOW(GPIO_SSC_DOUT);
// Enable Peripheral Clock for TIMER_CLOCK1, used to capture edges of the reader frames
AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC1);
AT91C_BASE_PIOA->PIO_BSR = GPIO_SSC_FRAME;
// Disable timer during configuration
AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
// Capture mode, defaul timer source = MCK/2 (TIMER_CLOCK1), TIOA is external trigger,
// external trigger rising edge, load RA on rising edge of TIOA.
AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK | AT91C_TC_ETRGEDG_BOTH | AT91C_TC_ABETRG | AT91C_TC_LDRA_BOTH;
// Enable and reset counter
AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN | AT91C_TC_SWTRG;
int frame_count = 0, response = 0, overflow = 0, lastbit = 1, tag_sof = 4; int frame_count = 0, response = 0, overflow = 0, lastbit = 1, tag_sof = 4;
bool rising_edge = false, reader_frame = false, bSkip = true; bool rising_edge = false, reader_frame = false, bSkip = true;
uint8_t rx[HITAG_FRAME_LEN]; uint8_t rx[HITAG_FRAME_LEN];
size_t rxlen = 0; size_t rxlen = 0;
auth_table_len = 0; auth_table_len = 0;
auth_table_pos = 0; auth_table_pos = 0;
// Reset the received frame, frame count and timing info
memset(rx, 0x00, sizeof(rx));
// Reset the received frame, frame count and timing info
memset(rx, 0x00, sizeof(rx));
auth_table = (uint8_t *)BigBuf_malloc(AUTH_TABLE_LENGTH); auth_table = (uint8_t *)BigBuf_malloc(AUTH_TABLE_LENGTH);
memset(auth_table, 0x00, AUTH_TABLE_LENGTH); memset(auth_table, 0x00, AUTH_TABLE_LENGTH);
while(BUTTON_PRESS() == false) { while (BUTTON_PRESS() == false) {
WDT_HIT(); WDT_HIT();
memset(rx, 0x00, sizeof(rx)); memset(rx, 0x00, sizeof(rx));
// Receive frame, watch for at most T0 * EOF periods // Receive frame, watch for at most T0 * EOF periods
while (AT91C_BASE_TC1->TC_CV < (HITAG_T0 * HITAG_T_EOF) ) { while (AT91C_BASE_TC1->TC_CV < (HITAG_T0 * HITAG_T_EOF)) {
// Check if rising edge in modulation is detected // Check if rising edge in modulation is detected
if(AT91C_BASE_TC1->TC_SR & AT91C_TC_LDRAS) { if (AT91C_BASE_TC1->TC_SR & AT91C_TC_LDRAS) {
// Retrieve the new timing values // Retrieve the new timing values
int ra = (AT91C_BASE_TC1->TC_RA / HITAG_T0); int ra = (AT91C_BASE_TC1->TC_RA / HITAG_T0);
// Find out if we are dealing with a rising or falling edge
rising_edge = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_FRAME) > 0;
// Shorter periods will only happen with reader frames // Find out if we are dealing with a rising or falling edge
if (reader_frame == false && rising_edge && ra < HITAG_T_TAG_CAPTURE_ONE_HALF) { rising_edge = (AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_FRAME) > 0;
// Switch from tag to reader capture
LED_C_OFF(); // Shorter periods will only happen with reader frames
reader_frame = true; if (reader_frame == false && rising_edge && ra < HITAG_T_TAG_CAPTURE_ONE_HALF) {
rxlen = 0; // Switch from tag to reader capture
} LED_C_OFF();
reader_frame = true;
// Only handle if reader frame and rising edge, or tag frame and falling edge rxlen = 0;
if (reader_frame == rising_edge) { }
// Only handle if reader frame and rising edge, or tag frame and falling edge
if (reader_frame == rising_edge) {
overflow += ra; overflow += ra;
continue; continue;
} }
// Add the buffered timing values of earlier captured edges which were skipped // Add the buffered timing values of earlier captured edges which were skipped
ra += overflow; ra += overflow;
overflow = 0; overflow = 0;
if (reader_frame) { if (reader_frame) {
LED_B_ON(); LED_B_ON();
// Capture reader frame // Capture reader frame
if(ra >= HITAG_T_STOP) { if (ra >= HITAG_T_STOP) {
// if (rxlen != 0) { // if (rxlen != 0) {
//DbpString("wierd0?"); //DbpString("wierd0?");
// } // }
// Capture the T0 periods that have passed since last communication or field drop (reset) // Capture the T0 periods that have passed since last communication or field drop (reset)
response = (ra - HITAG_T_LOW); response = (ra - HITAG_T_LOW);
} else if(ra >= HITAG_T_1_MIN ) { } else if (ra >= HITAG_T_1_MIN) {
// '1' bit // '1' bit
rx[rxlen / 8] |= 1 << (7 - (rxlen % 8)); rx[rxlen / 8] |= 1 << (7 - (rxlen % 8));
rxlen++; rxlen++;
} else if(ra >= HITAG_T_0_MIN) { } else if (ra >= HITAG_T_0_MIN) {
// '0' bit // '0' bit
rx[rxlen / 8] |= 0 << (7-(rxlen%8)); rx[rxlen / 8] |= 0 << (7 - (rxlen % 8));
rxlen++; rxlen++;
} }
} else { } else {
LED_C_ON(); LED_C_ON();
// Capture tag frame (manchester decoding using only falling edges) // Capture tag frame (manchester decoding using only falling edges)
if(ra >= HITAG_T_EOF) { if (ra >= HITAG_T_EOF) {
// if (rxlen != 0) { // if (rxlen != 0) {
//DbpString("wierd1?"); //DbpString("wierd1?");
// } // }
// Capture the T0 periods that have passed since last communication or field drop (reset) // Capture the T0 periods that have passed since last communication or field drop (reset)
// We always recieve a 'one' first, which has the falling edge after a half period |-_| // We always recieve a 'one' first, which has the falling edge after a half period |-_|
response = ra - HITAG_T_TAG_HALF_PERIOD; response = ra - HITAG_T_TAG_HALF_PERIOD;
} else if(ra >= HITAG_T_TAG_CAPTURE_FOUR_HALF) { } else if (ra >= HITAG_T_TAG_CAPTURE_FOUR_HALF) {
// Manchester coding example |-_|_-|-_| (101) // Manchester coding example |-_|_-|-_| (101)
rx[rxlen / 8] |= 0 << (7 - (rxlen % 8)); rx[rxlen / 8] |= 0 << (7 - (rxlen % 8));
rxlen++; rxlen++;
rx[rxlen / 8] |= 1 << (7 - (rxlen % 8)); rx[rxlen / 8] |= 1 << (7 - (rxlen % 8));
rxlen++; rxlen++;
} else if(ra >= HITAG_T_TAG_CAPTURE_THREE_HALF) { } else if (ra >= HITAG_T_TAG_CAPTURE_THREE_HALF) {
// Manchester coding example |_-|...|_-|-_| (0...01) // Manchester coding example |_-|...|_-|-_| (0...01)
rx[rxlen / 8] |= 0 << (7 - (rxlen % 8)); rx[rxlen / 8] |= 0 << (7 - (rxlen % 8));
rxlen++; rxlen++;
// We have to skip this half period at start and add the 'one' the second time // We have to skip this half period at start and add the 'one' the second time
if (bSkip == false) { if (bSkip == false) {
rx[rxlen / 8] |= 1 << (7 - (rxlen % 8)); rx[rxlen / 8] |= 1 << (7 - (rxlen % 8));
rxlen++; rxlen++;
} }
lastbit = !lastbit; lastbit = !lastbit;
bSkip = !bSkip; bSkip = !bSkip;
} else if(ra >= HITAG_T_TAG_CAPTURE_TWO_HALF) { } else if (ra >= HITAG_T_TAG_CAPTURE_TWO_HALF) {
// Manchester coding example |_-|_-| (00) or |-_|-_| (11) // Manchester coding example |_-|_-| (00) or |-_|-_| (11)
if (tag_sof) { if (tag_sof) {
// Ignore bits that are transmitted during SOF // Ignore bits that are transmitted during SOF
tag_sof--; tag_sof--;
} else { } else {
// bit is same as last bit // bit is same as last bit
rx[rxlen / 8] |= lastbit << (7 - (rxlen % 8)); rx[rxlen / 8] |= lastbit << (7 - (rxlen % 8));
rxlen++; rxlen++;
} }
} }
} }
} }
} }
// Check if frame was captured // Check if frame was captured
if(rxlen) { if (rxlen) {
frame_count++; frame_count++;
LogTrace(rx, nbytes(rxlen), response, 0, NULL, reader_frame); LogTrace(rx, nbytes(rxlen), response, 0, NULL, reader_frame);
// Check if we recognize a valid authentication attempt // Check if we recognize a valid authentication attempt
if (nbytes(rxlen) == 8) { if (nbytes(rxlen) == 8) {
// Store the authentication attempt // Store the authentication attempt
if (auth_table_len < (AUTH_TABLE_LENGTH - 8)) { if (auth_table_len < (AUTH_TABLE_LENGTH - 8)) {
memcpy(auth_table + auth_table_len, rx, 8); memcpy(auth_table + auth_table_len, rx, 8);
auth_table_len += 8; auth_table_len += 8;
} }
} }
// Reset the received frame and response timing info // Reset the received frame and response timing info
memset(rx, 0x00, sizeof(rx)); memset(rx, 0x00, sizeof(rx));
response = 0; response = 0;
reader_frame = false; reader_frame = false;
lastbit = 1; lastbit = 1;
bSkip = true; bSkip = true;
tag_sof = 4; tag_sof = 4;
overflow = 0; overflow = 0;
LED_B_OFF(); LED_B_OFF();
LED_C_OFF(); LED_C_OFF();
} else { } else {
// Save the timer overflow, will be 0 when frame was received // Save the timer overflow, will be 0 when frame was received
overflow += (AT91C_BASE_TC1->TC_CV / HITAG_T0); overflow += (AT91C_BASE_TC1->TC_CV / HITAG_T0);
} }
// Reset the frame length // Reset the frame length
rxlen = 0; rxlen = 0;
// Reset the timer to restart while-loop that receives frames // Reset the timer to restart while-loop that receives frames
AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG;
AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG; AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG;
} AT91C_BASE_TC1->TC_CCR = AT91C_TC_SWTRG;
}
LEDsoff(); LEDsoff();
AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS;
AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS; AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS;
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
set_tracing(false); set_tracing(false);
Dbprintf("frame received: %d",frame_count); Dbprintf("frame received: %d", frame_count);
Dbprintf("Authentication Attempts: %d",(auth_table_len / 8)); Dbprintf("Authentication Attempts: %d", (auth_table_len / 8));
} }

View file

@ -735,7 +735,7 @@ void SmartCardRaw(smart_card_raw_t *p) {
if ((flags & SC_LOG) == SC_LOG) if ((flags & SC_LOG) == SC_LOG)
set_tracing(true); set_tracing(true);
else else
set_tracing(false); set_tracing(false);
if ((flags & SC_CONNECT) == SC_CONNECT) { if ((flags & SC_CONNECT) == SC_CONNECT) {
@ -758,11 +758,11 @@ void SmartCardRaw(smart_card_raw_t *p) {
LogTrace(p->data, p->len, 0, 0, NULL, true); LogTrace(p->data, p->len, 0, 0, NULL, true);
bool res = I2C_BufferWrite( bool res = I2C_BufferWrite(
p->data, p->data,
p->len, p->len,
((flags & SC_RAW_T0) ? I2C_DEVICE_CMD_SEND_T0 : I2C_DEVICE_CMD_SEND), ((flags & SC_RAW_T0) ? I2C_DEVICE_CMD_SEND_T0 : I2C_DEVICE_CMD_SEND),
I2C_DEVICE_ADDRESS_MAIN I2C_DEVICE_ADDRESS_MAIN
); );
if (res == false && DBGLEVEL > 3) { if (res == false && DBGLEVEL > 3) {
DbpString(I2C_ERROR); DbpString(I2C_ERROR);
reply_ng(CMD_SMART_RAW, PM3_ESOFT, NULL, 0); reply_ng(CMD_SMART_RAW, PM3_ESOFT, NULL, 0);

View file

@ -79,7 +79,7 @@ static size_t lf_count_edge_periods_ex(size_t max, bool wait, bool detect_gap) {
#define LIMIT_DEV 20 #define LIMIT_DEV 20
// timeout limit to 100 000 w/o // timeout limit to 100 000 w/o
uint32_t timeout = 100000; uint32_t timeout = 100000;
size_t periods = 0; size_t periods = 0;
uint8_t avg_peak = adc_avg + LIMIT_DEV; uint8_t avg_peak = adc_avg + LIMIT_DEV;
@ -135,7 +135,7 @@ static size_t lf_count_edge_periods_ex(size_t max, bool wait, bool detect_gap) {
} }
} }
} }
} }
previous_adc_val = adc_val; previous_adc_val = adc_val;
@ -220,8 +220,8 @@ void lf_init(bool reader, bool simulate) {
// When in reader mode, give the field a bit of time to settle. // When in reader mode, give the field a bit of time to settle.
// 313T0 = 313 * 8us = 2504us = 2.5ms Hitag2 tags needs to be fully powered. // 313T0 = 313 * 8us = 2504us = 2.5ms Hitag2 tags needs to be fully powered.
// if (reader) { // if (reader) {
// 10 ms // 10 ms
SpinDelay(10); SpinDelay(10);
// } // }
// Steal this pin from the SSP (SPI communication channel with fpga) and use it to control the modulation // Steal this pin from the SSP (SPI communication channel with fpga) and use it to control the modulation

View file

@ -663,10 +663,10 @@ void MifareUSetPwd(uint8_t arg0, uint8_t *datain) {
// Return 1 if the nonce is invalid else return 0 // Return 1 if the nonce is invalid else return 0
static int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) { static int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
return ( return (
(oddparity8((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity8((NtEnc >> 24) & 0xFF) ^ BIT(Ks1, 16))) && \ (oddparity8((Nt >> 24) & 0xFF) == ((parity[0]) ^ oddparity8((NtEnc >> 24) & 0xFF) ^ BIT(Ks1, 16))) && \
(oddparity8((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity8((NtEnc >> 16) & 0xFF) ^ BIT(Ks1, 8))) && \ (oddparity8((Nt >> 16) & 0xFF) == ((parity[1]) ^ oddparity8((NtEnc >> 16) & 0xFF) ^ BIT(Ks1, 8))) && \
(oddparity8((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity8((NtEnc >> 8) & 0xFF) ^ BIT(Ks1, 0))) (oddparity8((Nt >> 8) & 0xFF) == ((parity[2]) ^ oddparity8((NtEnc >> 8) & 0xFF) ^ BIT(Ks1, 0)))
) ? 1 : 0; ) ? 1 : 0;
} }
void MifareAcquireNonces(uint32_t arg0, uint32_t flags) { void MifareAcquireNonces(uint32_t arg0, uint32_t flags) {

View file

@ -545,24 +545,24 @@ void Mifare1ksim(uint16_t flags, uint8_t exitAfterNReads, uint8_t *datain, uint1
counter++; counter++;
} }
/* /*
// find reader field // find reader field
if (cardSTATE == MFEMUL_NOFIELD) { if (cardSTATE == MFEMUL_NOFIELD) {
#if defined RDV4 #if defined RDV4
vHf = (MAX_ADC_HF_VOLTAGE_RDV40 * SumAdc(ADC_CHAN_HF_RDV40, 32)) >> 15; vHf = (MAX_ADC_HF_VOLTAGE_RDV40 * SumAdc(ADC_CHAN_HF_RDV40, 32)) >> 15;
#else #else
vHf = (MAX_ADC_HF_VOLTAGE * SumAdc(ADC_CHAN_HF, 32)) >> 15; vHf = (MAX_ADC_HF_VOLTAGE * SumAdc(ADC_CHAN_HF, 32)) >> 15;
#endif #endif
if (vHf > MF_MINFIELDV) { if (vHf > MF_MINFIELDV) {
cardSTATE_TO_IDLE(); cardSTATE_TO_IDLE();
LED_A_ON(); LED_A_ON();
} }
button_pushed = BUTTON_PRESS(); button_pushed = BUTTON_PRESS();
continue; continue;
} }
*/ */
FpgaEnableTracing(); FpgaEnableTracing();
//Now, get data //Now, get data

View file

@ -213,7 +213,7 @@ uint32_t size_in_spiffs(const char *filename) {
if (SPIFFS_stat(&fs, filename, &s) < 0) { if (SPIFFS_stat(&fs, filename, &s) < 0) {
Dbprintf("errno %i\n", SPIFFS_errno(&fs)); Dbprintf("errno %i\n", SPIFFS_errno(&fs));
return 0; return 0;
} }
return s.size; return s.size;
} }

View file

@ -148,7 +148,7 @@ bool nfc3d_amiibo_load_keys(nfc3d_amiibo_keys *amiiboKeys) {
return false; return false;
} }
if ((amiiboKeys->data.magicBytesSize > 16) || (amiiboKeys->tag.magicBytesSize > 16)) { if ((amiiboKeys->data.magicBytesSize > 16) || (amiiboKeys->tag.magicBytesSize > 16)) {
free(dump); free(dump);
return false; return false;
} }

View file

@ -376,7 +376,7 @@ static void precalculate_bit0_bitflip_bitarrays(uint8_t const bitflip, uint16_t
count[odd_even], count[odd_even],
odd_even == EVEN_STATE ? "even" : "odd", odd_even == EVEN_STATE ? "even" : "odd",
bitflip, bitflip,
(1 << 24) - count[odd_even], (1 << 24) - count[odd_even],
(float)((1 << 24) - count[odd_even]) / (1 << 24) * 100.0); (float)((1 << 24) - count[odd_even]) / (1 << 24) * 100.0);
#ifndef TEST_RUN #ifndef TEST_RUN
write_bitflips_file(odd_even, bitflip, sum_a0, test_bitarray[odd_even], count[odd_even]); write_bitflips_file(odd_even, bitflip, sum_a0, test_bitarray[odd_even], count[odd_even]);
@ -404,7 +404,7 @@ static void precalculate_bit0_bitflip_bitarrays(uint8_t const bitflip, uint16_t
count[odd_even], count[odd_even],
odd_even == EVEN_STATE ? "even" : "odd", odd_even == EVEN_STATE ? "even" : "odd",
bitflip | BITFLIP_2ND_BYTE, bitflip | BITFLIP_2ND_BYTE,
(1 << 24) - count[odd_even], (1 << 24) - count[odd_even],
(float)((1 << 24) - count[odd_even]) / (1 << 24) * 100.0); (float)((1 << 24) - count[odd_even]) / (1 << 24) * 100.0);
#ifndef TEST_RUN #ifndef TEST_RUN
write_bitflips_file(odd_even, bitflip | BITFLIP_2ND_BYTE, sum_a0, test_bitarray_2nd, count[odd_even]); write_bitflips_file(odd_even, bitflip | BITFLIP_2ND_BYTE, sum_a0, test_bitarray_2nd, count[odd_even]);
@ -490,7 +490,7 @@ static void precalculate_bit0_bitflip_bitarrays(uint8_t const bitflip, uint16_t
count[odd_even], count[odd_even],
odd_even == EVEN_STATE ? "even" : "odd", odd_even == EVEN_STATE ? "even" : "odd",
bitflip | 0x100, bitflip | 0x100,
(1 << 24) - count[odd_even], (1 << 24) - count[odd_even],
(float)((1 << 24) - count[odd_even]) / (1 << 24) * 100.0); (float)((1 << 24) - count[odd_even]) / (1 << 24) * 100.0);
#ifndef TEST_RUN #ifndef TEST_RUN
write_bitflips_file(odd_even, bitflip | 0x100, sum_a0, test_not_bitarray[odd_even], count[odd_even]); write_bitflips_file(odd_even, bitflip | 0x100, sum_a0, test_not_bitarray[odd_even], count[odd_even]);
@ -517,7 +517,7 @@ static void precalculate_bit0_bitflip_bitarrays(uint8_t const bitflip, uint16_t
printf("Writing %u possible %s states for bitflip property %03x (%u (%1.2f%%) states eliminated)\n", printf("Writing %u possible %s states for bitflip property %03x (%u (%1.2f%%) states eliminated)\n",
count[odd_even], count[odd_even],
odd_even == EVEN_STATE ? "even" : "odd", odd_even == EVEN_STATE ? "even" : "odd",
bitflip | 0x100 | BITFLIP_2ND_BYTE, bitflip | 0x100 | BITFLIP_2ND_BYTE,
(1 << 24) - count[odd_even], (1 << 24) - count[odd_even],
(float)((1 << 24) - count[odd_even]) / (1 << 24) * 100.0); (float)((1 << 24) - count[odd_even]) / (1 << 24) * 100.0);
#ifndef TEST_RUN #ifndef TEST_RUN

View file

@ -14,12 +14,12 @@ Any other input char will exit the script.
You can supply a password, which will set the config block / block 7 on the T5577. You can supply a password, which will set the config block / block 7 on the T5577.
The verify option will issue a 'lf em 410x reader' command, so you can manually verify The verify option will issue a 'lf em 410x reader' command, so you can manually verify
that the write worked. that the write worked.
]] ]]
example = [[ example = [[
-- resets and start enrolling EM410x id 11CC334455 -- resets and start enrolling EM410x id 11CC334455
script run lf_em4100_bulk.lua -s 11CC334455 script run lf_em4100_bulk.lua -s 11CC334455
-- continue enrolling from where last iteration -- continue enrolling from where last iteration
@ -28,7 +28,7 @@ example = [[
-- reset and start enrolling from 11223344, -- reset and start enrolling from 11223344,
-- protecting the tag with password 010203 -- protecting the tag with password 010203
-- and verify the em id write. -- and verify the em id write.
script run lf_em4100_bulk.lua -s 1122334455 -p 01020304 -v script run lf_em4100_bulk.lua -s 1122334455 -p 01020304 -v
]] ]]
usage = [[ usage = [[
script run lf_en4100_bulk.lua [-h] [-c] [-p password] [-s <start cn>] [-v] script run lf_en4100_bulk.lua [-h] [-c] [-p password] [-s <start cn>] [-v]
@ -143,7 +143,7 @@ local function main(args)
end end
-- if reset/start over, check -s -- if reset/start over, check -s
if not shall_continue then if not shall_continue then
if startid == nil then return oops('empty card number string') end if startid == nil then return oops('empty card number string') end
if #startid == 0 then return oops('empty card number string') end if #startid == 0 then return oops('empty card number string') end
if #startid ~= 10 then return oops('card number wrong length. Must be 5 hex bytes') end if #startid ~= 10 then return oops('card number wrong length. Must be 5 hex bytes') end
@ -159,7 +159,7 @@ local function main(args)
print(ac.red..'disable hints for less output'..ac.reset) print(ac.red..'disable hints for less output'..ac.reset)
core.console('pref set hint --off') core.console('pref set hint --off')
print('') print('')
local hi = tonumber(startid:sub(1, 2), 16) local hi = tonumber(startid:sub(1, 2), 16)
local low = tonumber(startid:sub(3, 10), 16) local low = tonumber(startid:sub(3, 10), 16)
local pwd = tonumber(ipwd, 16) local pwd = tonumber(ipwd, 16)
@ -178,7 +178,7 @@ local function main(args)
else else
print('reset & starting enrolling from refresh') print('reset & starting enrolling from refresh')
end end
local template = 'EM4100 ID '..ac.green..'%02X%08X'..ac.reset local template = 'EM4100 ID '..ac.green..'%02X%08X'..ac.reset
for i = low, low + 10000, 1 do for i = low, low + 10000, 1 do
print('') print('')
@ -186,7 +186,7 @@ local function main(args)
local msg = (template):format(hi, i) local msg = (template):format(hi, i)
local ans = utils.input(msg, 'y'):lower() local ans = utils.input(msg, 'y'):lower()
if ans == 'y' then if ans == 'y' then
core.console( ('lf em 410x clone --id %02X%08X'):format(hi, i) ) core.console( ('lf em 410x clone --id %02X%08X'):format(hi, i) )
-- print ( ('lf em 410x clone --id %02X%08X'):format(hi, i) ) -- print ( ('lf em 410x clone --id %02X%08X'):format(hi, i) )
if got_pwd then if got_pwd then

View file

@ -440,15 +440,15 @@ static void showSavePathState(savePaths_t path_index, prefShowOpt_t opt) {
if (path_index < spItemCount) { if (path_index < spItemCount) {
if ((session.defaultPaths[path_index] == NULL) || (strcmp(session.defaultPaths[path_index], "") == 0)) { if ((session.defaultPaths[path_index] == NULL) || (strcmp(session.defaultPaths[path_index], "") == 0)) {
PrintAndLogEx(INFO, " %s %s "_WHITE_("not set"), PrintAndLogEx(INFO, " %s %s "_WHITE_("not set"),
prefShowMsg(opt), prefShowMsg(opt),
s s
); );
} else { } else {
PrintAndLogEx(INFO, " %s %s "_GREEN_("%s"), PrintAndLogEx(INFO, " %s %s "_GREEN_("%s"),
prefShowMsg(opt), prefShowMsg(opt),
s, s,
session.defaultPaths[path_index] session.defaultPaths[path_index]
); );
} }
} }
} }

View file

@ -521,7 +521,7 @@ static void set_my_user_directory(void) {
char *cwd_buffer = (char *)calloc(pathLen, sizeof(uint8_t)); char *cwd_buffer = (char *)calloc(pathLen, sizeof(uint8_t));
if (cwd_buffer == NULL) { if (cwd_buffer == NULL) {
PrintAndLogEx(WARNING, "failed to allocate memory"); PrintAndLogEx(WARNING, "failed to allocate memory");
return; return;
} }
while (GetCurrentDir(cwd_buffer, pathLen) == NULL) { while (GetCurrentDir(cwd_buffer, pathLen) == NULL) {

View file

@ -1281,7 +1281,7 @@ static int l_cwd(lua_State *L) {
uint16_t path_len = FILENAME_MAX; // should be a good starting point uint16_t path_len = FILENAME_MAX; // should be a good starting point
char *cwd = (char *)calloc(path_len, sizeof(uint8_t)); char *cwd = (char *)calloc(path_len, sizeof(uint8_t));
if (cwd == NULL) { if (cwd == NULL) {
return returnToLuaWithError(L, "Failed to allocate memory"); return returnToLuaWithError(L, "Failed to allocate memory");
} }
while (GetCurrentDir(cwd, path_len) == NULL) { while (GetCurrentDir(cwd, path_len) == NULL) {

View file

@ -299,7 +299,7 @@ char *sprint_bin_break(const uint8_t *data, const size_t len, const uint8_t brea
// manchester wrong bit marker // manchester wrong bit marker
if (c == 7) if (c == 7)
c = '.'; c = '.';
else else
c += '0'; c += '0';
*(tmp++) = c; *(tmp++) = c;
@ -308,7 +308,7 @@ char *sprint_bin_break(const uint8_t *data, const size_t len, const uint8_t brea
if (breaks) { if (breaks) {
if (((i + 1) % breaks) == 0) { if (((i + 1) % breaks) == 0) {
*(tmp++) = '\n'; *(tmp++) = '\n';
} }
} }
} }
@ -1026,7 +1026,7 @@ int hexstring_to_u96(uint32_t *hi2, uint32_t *hi, uint32_t *lo, const char *str)
int binstring_to_u96(uint32_t *hi2, uint32_t *hi, uint32_t *lo, const char *str) { int binstring_to_u96(uint32_t *hi2, uint32_t *hi, uint32_t *lo, const char *str) {
uint32_t n = 0, i = 0; uint32_t n = 0, i = 0;
for(;;) { for (;;) {
int res = sscanf(&str[i], "%1u", &n); int res = sscanf(&str[i], "%1u", &n);
if ((res != 1) || (n > 1)) if ((res != 1) || (n > 1))
@ -1050,7 +1050,7 @@ int binstring_to_u96(uint32_t *hi2, uint32_t *hi, uint32_t *lo, const char *str)
*/ */
int binarray_to_u96(uint32_t *hi2, uint32_t *hi, uint32_t *lo, uint8_t *arr, int arrlen) { int binarray_to_u96(uint32_t *hi2, uint32_t *hi, uint32_t *lo, uint8_t *arr, int arrlen) {
int i = 0; int i = 0;
for(; i < arrlen; i++) { for (; i < arrlen; i++) {
uint8_t n = arr[i]; uint8_t n = arr[i];
if (n > 1) if (n > 1)
break; break;

View file

@ -91,7 +91,7 @@ void DecodeBlock6(uint8_t *src) {
c[5] = 0x02; c[5] = 0x02;
ExchangeAPDUSC(false, c, sizeof(c), false, false, resp, sizeof(resp), &resp_len); ExchangeAPDUSC(false, c, sizeof(c), false, false, resp, sizeof(resp), &resp_len);
if (resp_len < 11) { if (resp_len < 11) {
return; return;
} }
@ -137,7 +137,7 @@ int GetConfigCardByIdx(uint8_t typ, uint8_t *blocks) {
int resp_len = 0; int resp_len = 0;
uint8_t resp[254] = {0}; uint8_t resp[254] = {0};
uint8_t c[] = {0x96, CARD_INS_CC, 0x00, 0x00, 17, typ, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}; uint8_t c[] = {0x96, CARD_INS_CC, 0x00, 0x00, 17, typ, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
ExchangeAPDUSC(false, c, sizeof(c), false, true, resp, sizeof(resp), &resp_len); ExchangeAPDUSC(false, c, sizeof(c), false, true, resp, sizeof(resp), &resp_len);
if (resp_len < 2) { if (resp_len < 2) {

View file

@ -1,6 +1,6 @@
MYSRCPATHS = ../../common ../../common/crapto1 MYSRCPATHS = ../../common ../../common/crapto1
MYSRCS = crypto1.c crapto1.c bucketsort.c iso14443crc.c sleep.c MYSRCS = crypto1.c crapto1.c bucketsort.c iso14443crc.c sleep.c
MYINCLUDES = -I../../include -I../../common MYINCLUDES = -I../../include -I../../common
MYCFLAGS = MYCFLAGS =
MYDEFS = MYDEFS =
MYLDLIBS = MYLDLIBS =
@ -22,4 +22,4 @@ endif
mf_nonce_brute : $(OBJDIR)/mf_nonce_brute.o $(MYOBJS) mf_nonce_brute : $(OBJDIR)/mf_nonce_brute.o $(MYOBJS)
mf_trace_brute : $(OBJDIR)/mf_trace_brute.o $(MYOBJS) mf_trace_brute : $(OBJDIR)/mf_trace_brute.o $(MYOBJS)

View file

@ -1,11 +1,11 @@
// //
// bruteforce the upper 16bits of a partial key recovered from mf_nonce_brute. // bruteforce the upper 16bits of a partial key recovered from mf_nonce_brute.
// J-run's original idea was a two part recovery vector with first a offline trace and then online for 2 bytes. // J-run's original idea was a two part recovery vector with first a offline trace and then online for 2 bytes.
// //
// This idea is two use only offline, to recover a nested authentication key. // This idea is two use only offline, to recover a nested authentication key.
// Assumption, we get a read/write command after a nested auth, we need 22 bytes of data. // Assumption, we get a read/write command after a nested auth, we need 22 bytes of data.
// Iceman, 2021, // Iceman, 2021,
// //
#define __STDC_FORMAT_MACROS #define __STDC_FORMAT_MACROS
@ -41,7 +41,7 @@ typedef struct thread_args {
uint32_t part_key; uint32_t part_key;
uint32_t nt_enc; uint32_t nt_enc;
uint32_t nr_enc; uint32_t nr_enc;
uint8_t enc[ENC_LEN]; // next encrypted command + a full read/write uint8_t enc[ENC_LEN]; // next encrypted command + a full read/write
} targs; } targs;
//------------------------------------------------------------------ //------------------------------------------------------------------
@ -137,7 +137,7 @@ static int param_gethex_to_eol(const char *line, int paramnum, uint8_t *data, in
} }
static void hex_to_buffer(const uint8_t *buf, const uint8_t *hex_data, const size_t hex_len, const size_t hex_max_len, static void hex_to_buffer(const uint8_t *buf, const uint8_t *hex_data, const size_t hex_len, const size_t hex_max_len,
const size_t min_str_len, const size_t spaces_between, bool uppercase) { const size_t min_str_len, const size_t spaces_between, bool uppercase) {
if (buf == NULL) return; if (buf == NULL) return;
@ -216,10 +216,10 @@ static void *brute_thread(void *arguments) {
crypto1_deinit(pcs); crypto1_deinit(pcs);
if (CheckCrc14443(CRC_14443_A, dec , 4)) { if (CheckCrc14443(CRC_14443_A, dec, 4)) {
// check crc-16 in the end // check crc-16 in the end
if (CheckCrc14443(CRC_14443_A, dec + 4, 18)) { if (CheckCrc14443(CRC_14443_A, dec + 4, 18)) {
// lock this section to avoid interlacing prints from different threats // lock this section to avoid interlacing prints from different threats
@ -259,7 +259,7 @@ int main(int argc, char *argv[]) {
sscanf(argv[4], "%x", &nr_enc); sscanf(argv[4], "%x", &nr_enc);
int enc_len = 0; int enc_len = 0;
uint8_t enc[ENC_LEN] = {0}; // next encrypted command + a full read/write uint8_t enc[ENC_LEN] = {0}; // next encrypted command + a full read/write
param_gethex_to_eol(argv[5], 0, enc, sizeof(enc), &enc_len); param_gethex_to_eol(argv[5], 0, enc, sizeof(enc), &enc_len);
printf("-------------------------------------------------\n"); printf("-------------------------------------------------\n");
@ -267,7 +267,7 @@ int main(int argc, char *argv[]) {
printf("partial key.. %08x\n", part_key); printf("partial key.. %08x\n", part_key);
printf("nt enc....... %08x\n", nt_enc); printf("nt enc....... %08x\n", nt_enc);
printf("nr enc....... %08x\n", nr_enc); printf("nr enc....... %08x\n", nr_enc);
printf("next encrypted cmd: %s\n", sprint_hex_inrow_ex(enc, ENC_LEN ,0)); printf("next encrypted cmd: %s\n", sprint_hex_inrow_ex(enc, ENC_LEN, 0));
clock_t t1 = clock(); clock_t t1 = clock();

View file

@ -147,7 +147,7 @@ def selftests():
for c in curvenames: for c in curvenames:
for h in [None, "md5", "sha1", "sha256", "sha512"]: for h in [None, "md5", "sha1", "sha256", "sha512"]:
recovered |= recover_multiple(t['samples'][::2], t['samples'][1::2], c, alghash=h) recovered |= recover_multiple(t['samples'][::2], t['samples'][1::2], c, alghash=h)
if (len(recovered) == 1): if (len(recovered) == 1):
pk = recovered.pop() pk = recovered.pop()
pk = binascii.hexlify(pk).decode('utf8') pk = binascii.hexlify(pk).decode('utf8')