github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-20 13:23:51 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

fgpa merge hell p.N

Browse source
This commit is contained in:
iceman1001 2020-07-13 12:21:42 +02:00
commit 713301226d
1 changed files with 246 additions and 264 deletions
Download patch file Download diff file Expand all files Collapse all files

120
armsrc/iclass.c
View file

@ -15,27 +15,6 @@
// //
// Please feel free to contribute and extend iClass support!! // Please feel free to contribute and extend iClass support!!
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
//
// FIX:
// ====
// We still have sometimes a demodulation error when sniffing iClass communication.
// The resulting trace of a read-block-03 command may look something like this:
//
// + 22279: : 0c 03 e8 01
//
// ...with an incorrect answer...
//
// + 85: 0: TAG ff! ff! ff! ff! ff! ff! ff! ff! bb 33 bb 00 01! 0e! 04! bb !crc
//
// We still left the error signalling bytes in the traces like 0xbb
//
// A correct trace should look like this:
//
// + 21112: : 0c 03 e8 01
// + 85: 0: TAG ff ff ff ff ff ff ff ff ea f5
//
//-----------------------------------------------------------------------------
#include "iclass.h" #include "iclass.h"
#include "proxmark3_arm.h" #include "proxmark3_arm.h"
@ -78,11 +57,6 @@
#define AddCrc(data, len) compute_crc(CRC_ICLASS, (data), (len), (data)+(len), (data)+(len)+1) #define AddCrc(data, len) compute_crc(CRC_ICLASS, (data), (len), (data)+(len), (data)+(len)+1)
static void OnError(uint8_t reason) {
reply_mix(CMD_ACK, 0, reason, 0, 0, 0);
switch_off();
}
/* /*
* CARD TO READER * CARD TO READER
* in ISO15693-2 mode - Manchester * in ISO15693-2 mode - Manchester
@ -776,20 +750,16 @@ send:
// THE READER CODE // THE READER CODE
// logs.
static void iclass_send_as_reader(uint8_t *frame, int len, uint32_t *start_time) { static void iclass_send_as_reader(uint8_t *frame, int len, uint32_t *start_time) {
CodeIso15693AsReader(frame, len); CodeIso15693AsReader(frame, len);
TransmitTo15693Tag(ToSend, ToSendMax, start_time); TransmitTo15693Tag(ToSend, ToSendMax, start_time);
uint32_t end_time = *start_time + (32 * ((8 * ToSendMax) - 4)); // substract the 4 padding bits after EOF uint32_t end_time = *start_time + (32 * ((8 * ToSendMax) - 4)); // substract the 4 padding bits after EOF
LogTrace(frame, len, (*start_time * 4), (end_time * 4), NULL, true);
if (LogTrace(frame, len, (*start_time * 4), (end_time * 4), NULL, true) == false)
DbpString("send_as_reader: failed logtrace");
} }
static bool iclass_send_cmd_with_retries(uint8_t* cmd, size_t cmdsize, uint8_t* resp, size_t max_resp_size, static bool iclass_send_cmd_with_retries(uint8_t* cmd, size_t cmdsize, uint8_t* resp, size_t max_resp_size,
uint8_t expected_size, uint8_t tries, uint32_t start_time, uint8_t expected_size, uint8_t tries, uint32_t start_time,
uint32_t timeout, uint32_t *eof_time) { uint16_t timeout, uint32_t *eof_time) {
while (tries-- > 0) { while (tries-- > 0) {
iclass_send_as_reader(cmd, cmdsize, &start_time); iclass_send_as_reader(cmd, cmdsize, &start_time);
@ -800,6 +770,7 @@ static bool iclass_send_cmd_with_retries(uint8_t* cmd, size_t cmdsize, uint8_t*
if (expected_size == GetIso15693AnswerFromTag(resp, max_resp_size, timeout, eof_time)) { if (expected_size == GetIso15693AnswerFromTag(resp, max_resp_size, timeout, eof_time)) {
return true; return true;
} }
start_time = *eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
} }
return false; return false;
} }
@ -826,15 +797,22 @@ static bool select_iclass_tag(uint8_t *card_data, bool use_credit_key, uint32_t
if (use_credit_key) if (use_credit_key)
read_check_cc[0] = 0x10 | ICLASS_CMD_READCHECK; read_check_cc[0] = 0x10 | ICLASS_CMD_READCHECK;
uint32_t start_time = GetCountSspClk(); set_tracing(true);
iclass_send_as_reader(act_all, sizeof(act_all), &start_time);
// card present? int len;
int len = GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_ACTALL, eof_time); uint32_t start_time;
if (len < 0) { uint8_t tries = 10;
Dbprintf("Fail act all (%d)", len); do {
// wakeup
start_time = GetCountSspClk();
iclass_send_as_reader(act_all, 1, &start_time);
len = GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_ACTALL, eof_time);
if (len >= 0) {
break;
} else if (len == -2) {
return false; return false;
} }
} while (tries-- > 0);
// send Identify // send Identify
start_time = *eof_time + DELAY_ICLASS_VICC_TO_VCD_READER; start_time = *eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
@ -893,8 +871,6 @@ void ReaderIClass(uint8_t flags) {
uint8_t card_data[6 * 8] = {0xFF}; uint8_t card_data[6 * 8] = {0xFF};
// uint8_t last_csn[8] = {0, 0, 0, 0, 0, 0, 0, 0}; // uint8_t last_csn[8] = {0, 0, 0, 0, 0, 0, 0, 0};
uint8_t resp[ICLASS_BUFFER_SIZE]; uint8_t resp[ICLASS_BUFFER_SIZE];
// memset(card_data, 0xFF, sizeof(card_data));
memset(resp, 0xFF, sizeof(resp)); memset(resp, 0xFF, sizeof(resp));
// bool flag_readonce = flags & FLAG_ICLASS_READER_ONLY_ONCE; // flag to read until one tag is found successfully // bool flag_readonce = flags & FLAG_ICLASS_READER_ONLY_ONCE; // flag to read until one tag is found successfully
@ -902,11 +878,11 @@ void ReaderIClass(uint8_t flags) {
bool flag_read_aia = flags & FLAG_ICLASS_READER_AIA; // flag to read block5, application issuer area bool flag_read_aia = flags & FLAG_ICLASS_READER_AIA; // flag to read block5, application issuer area
if ((flags & FLAG_ICLASS_READER_INIT) == FLAG_ICLASS_READER_INIT) { if ((flags & FLAG_ICLASS_READER_INIT) == FLAG_ICLASS_READER_INIT) {
switch_off();
Iso15693InitReader(); Iso15693InitReader();
StartCountSspClk();
} }
set_tracing(true);
if ((flags & FLAG_ICLASS_READER_CLEARTRACE) == FLAG_ICLASS_READER_CLEARTRACE) { if ((flags & FLAG_ICLASS_READER_CLEARTRACE) == FLAG_ICLASS_READER_CLEARTRACE) {
clear_trace(); clear_trace();
} }
@ -926,7 +902,7 @@ void ReaderIClass(uint8_t flags) {
if (flag_read_aia) { if (flag_read_aia) {
//Read App Issuer Area block CRC(0x05) => 0xde 0x64 //Read App Issuer Area block CRC(0x05) => 0xde 0x64
uint8_t read_aa[] = { ICLASS_CMD_READ_OR_IDENTIFY, 0x05, 0xde, 0x64}; uint8_t read_aa[] = { ICLASS_CMD_READ_OR_IDENTIFY, 0x05, 0xde, 0x64};
status = iclass_send_cmd_with_retries(read_aa, sizeof(read_aa), resp, sizeof(resp), 10, 10, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time); status = iclass_send_cmd_with_retries(read_aa, sizeof(read_aa), resp, sizeof(resp), 10, 3, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
if (status) { if (status) {
result_status |= FLAG_ICLASS_AIA; result_status |= FLAG_ICLASS_AIA;
memcpy(card_data + (8 * 5), resp, 8); memcpy(card_data + (8 * 5), resp, 8);
@ -968,6 +944,7 @@ void ReaderIClass(uint8_t flags) {
// } else { // } else {
// reply_mix(CMD_ACK, result_status, 0, 0, card_data, 0); // reply_mix(CMD_ACK, result_status, 0, 0, card_data, 0);
// } // }
switch_off(); switch_off();
} }
@ -1106,6 +1083,7 @@ void iClass_ReadCheck(uint8_t blockno, uint8_t keytype) {
uint8_t readcheck[] = { keytype, blockno }; uint8_t readcheck[] = { keytype, blockno };
uint8_t resp[8] = {0}; uint8_t resp[8] = {0};
uint32_t eof_time = 0; uint32_t eof_time = 0;
// start_time = *eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
bool isOK = iclass_send_cmd_with_retries(readcheck, sizeof(readcheck), resp, sizeof(resp), 8, 3, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time); bool isOK = iclass_send_cmd_with_retries(readcheck, sizeof(readcheck), resp, sizeof(resp), 8, 3, 0, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
reply_mix(CMD_ACK, isOK, 0, 0, 0, 0); reply_mix(CMD_ACK, isOK, 0, 0, 0, 0);
switch_off(); switch_off();
@ -1132,14 +1110,13 @@ void iClass_Authentication(uint8_t *bytes) {
} PACKED packet; } PACKED packet;
Iso15693InitReader(); Iso15693InitReader();
StartCountSspClk();
uint8_t card_data[3 * 8] = {0xFF}; uint8_t card_data[3 * 8] = {0xFF};
uint32_t eof_time = 0; uint32_t eof_time = 0;
packet.isOK = select_iclass_tag(card_data, payload->use_credit_key, &eof_time); packet.isOK = select_iclass_tag(card_data, payload->use_credit_key, &eof_time);
if (packet.isOK == false) { if (packet.isOK == false) {
reply_ng(CMD_HF_ICLASS_AUTH, PM3_SUCCESS, (uint8_t *)&packet, sizeof(packet)); reply_ng(CMD_HF_ICLASS_AUTH, PM3_ESOFT, (uint8_t *)&packet, sizeof(packet));
return; return;
} }
uint32_t start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER; uint32_t start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
@ -1163,7 +1140,8 @@ void iClass_Authentication(uint8_t *bytes) {
uint8_t resp[ICLASS_BUFFER_SIZE]; uint8_t resp[ICLASS_BUFFER_SIZE];
packet.isOK = iclass_send_cmd_with_retries(check, sizeof(check), resp, sizeof(resp), 4, 3, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time); packet.isOK = iclass_send_cmd_with_retries(check, sizeof(check), resp, sizeof(resp), 4, 3, start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time);
reply_ng(CMD_HF_ICLASS_AUTH, PM3_SUCCESS, (uint8_t *)&packet, sizeof(packet));
reply_ng(CMD_HF_ICLASS_AUTH, (packet.isOK)? PM3_SUCCESS : PM3_ESOFT, (uint8_t *)&packet, sizeof(packet));
} }
typedef struct iclass_premac { typedef struct iclass_premac {
@ -1198,22 +1176,19 @@ void iClass_Authentication_fast(uint64_t arg0, uint64_t arg1, uint8_t *datain) {
LED_A_ON(); LED_A_ON();
// fresh start
switch_off(); switch_off();
SpinDelay(20); SpinDelay(20);
Iso15693InitReader();
bool read_status = false;
uint32_t start_time = 0; uint32_t start_time = 0;
uint32_t eof_time = 0; uint32_t eof_time = 0;
uint8_t tries = 10; if (select_iclass_tag(card_data, use_credit_key, &eof_time) == false)
while (tries-- > 0 || read_status == false) {
read_status = select_iclass_tag(card_data, use_credit_key, &eof_time);
}
// failed to select card 10 times. return fail to client
if (read_status == false)
goto out; goto out;
start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER;
// since select_iclass_tag call sends s readcheck, we start with sending first response. // since select_iclass_tag call sends s readcheck, we start with sending first response.
uint16_t checked = 0; uint16_t checked = 0;
@ -1222,7 +1197,7 @@ void iClass_Authentication_fast(uint64_t arg0, uint64_t arg1, uint8_t *datain) {
// Allow button press / usb cmd to interrupt device // Allow button press / usb cmd to interrupt device
if (checked == 1000) { if (checked == 1000) {
if (BUTTON_PRESS() || !data_available()) goto out; if (BUTTON_PRESS() || data_available()) goto out;
checked = 0; checked = 0;
} }
++checked; ++checked;
@ -1251,20 +1226,21 @@ void iClass_Authentication_fast(uint64_t arg0, uint64_t arg1, uint8_t *datain) {
out: out:
// send keyindex. // send keyindex.
reply_mix(CMD_ACK, isOK, i, 0, 0, 0); reply_mix(CMD_HF_ICLASS_CHKKEYS, isOK, i, 0, 0, 0);
if (isOK >= 1 || lastChunk) { if (isOK >= 1 || lastChunk) {
switch_off();
LED_A_OFF(); LED_A_OFF();
} }
switch_off();
LED_B_OFF(); LED_B_OFF();
LED_C_OFF(); LED_C_OFF();
} }
// Tries to read block. // Tries to read block.
// retries 10times. // retries 10times.
static bool iClass_ReadBlock(uint8_t blockno, uint8_t *data) { static bool iclass_readblock(uint8_t blockno, uint8_t *data) {
uint8_t resp[10]; uint8_t resp[10];
uint8_t c[] = {ICLASS_CMD_READ_OR_IDENTIFY, blockno, 0x00, 0x00}; uint8_t c[] = {ICLASS_CMD_READ_OR_IDENTIFY, blockno, 0x00, 0x00};
AddCrc(c + 1, 1); AddCrc(c + 1, 1);
@ -1283,7 +1259,7 @@ void iClass_ReadBlk(uint8_t blockno) {
} PACKED result; } PACKED result;
LED_A_ON(); LED_A_ON();
result.isOK = iClass_ReadBlock(blockno, result.blockdata); result.isOK = iclass_readblock(blockno, result.blockdata);
switch_off(); switch_off();
reply_ng(CMD_HF_ICLASS_READBL, PM3_SUCCESS, (uint8_t *)&result, sizeof(result)); reply_ng(CMD_HF_ICLASS_READBL, PM3_SUCCESS, (uint8_t *)&result, sizeof(result));
} }
@ -1300,7 +1276,8 @@ void iClass_Dump(uint8_t start_blockno, uint8_t numblks) {
uint8_t *dataout = BigBuf_malloc(0xFF * 8); uint8_t *dataout = BigBuf_malloc(0xFF * 8);
if (dataout == NULL) { if (dataout == NULL) {
DbpString("fail to allocate memory"); DbpString("fail to allocate memory");
OnError(1); reply_ng(CMD_HF_ICLASS_DUMP, PM3_EMALLOC, NULL, 0);
switch_off();
return; return;
} }
memset(dataout, 0xFF, 0xFF * 8); memset(dataout, 0xFF, 0xFF * 8);
@ -1308,24 +1285,29 @@ void iClass_Dump(uint8_t start_blockno, uint8_t numblks) {
bool isOK; bool isOK;
uint8_t blkcnt = 0; uint8_t blkcnt = 0;
for (; blkcnt < numblks; blkcnt++) { for (; blkcnt < numblks; blkcnt++) {
isOK = iClass_ReadBlock(start_blockno + blkcnt, dataout + (8 * blkcnt)); isOK = iclass_readblock(start_blockno + blkcnt, dataout + (8 * blkcnt));
if (isOK == false) {
if (!isOK) {
isOK = iClass_ReadBlock(start_blockno + blkcnt, dataout + (8 * blkcnt));
if (!isOK) {
Dbprintf("failed to read block %02X", start_blockno + blkcnt); Dbprintf("failed to read block %02X", start_blockno + blkcnt);
break; break;
} }
} }
}
switch_off(); switch_off();
// return pointer to dump memory in arg3 // return pointer to dump memory in arg3
// iceman: why not return | dataout - getbigbuf ? Should give exact location. // iceman: why not return | dataout - getbigbuf ? Should give exact location.
Dbprintf("ICE:: dataout, %u max trace %u, bb start %u, data-bb %u ", dataout, BigBuf_max_traceLen(), BigBuf_get_addr(), dataout - BigBuf_get_addr() ); // Dbprintf("ICE:: dataout, %u max trace %u, bb start %u, data-bb %u ", dataout, BigBuf_max_traceLen(), BigBuf_get_addr(), dataout - BigBuf_get_addr() );
Dbprintf("ICE:: bb size %u, malloced %u (255*8)", BigBuf_get_size(), BigBuf_get_size() - (dataout - BigBuf_get_addr()) ); // Dbprintf("ICE:: bb size %u, malloced %u (255*8)", BigBuf_get_size(), BigBuf_get_size() - (dataout - BigBuf_get_addr()) );
reply_mix(CMD_ACK, isOK, blkcnt, BigBuf_max_traceLen(), 0, 0); // reply_mix(CMD_ACK, isOK, blkcnt, BigBuf_max_traceLen(), 0, 0);
struct p {
bool isOK;
uint8_t block_cnt;
uint32_t bb_offset;
} PACKED payload;
payload.isOK = isOK;
payload.block_cnt = blkcnt;
payload.bb_offset = BigBuf_max_traceLen();
reply_ng(CMD_HF_ICLASS_DUMP, PM3_SUCCESS, (uint8_t *)&payload, sizeof(payload));
BigBuf_free(); BigBuf_free();
} }