github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-21 05:43:48 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

CHG: deviceside changes to deal with sniffing UID's with length of 10.

Browse source
This commit is contained in:
iceman1001 2016-04-18 13:19:11 +02:00
commit c01d8e21ea
1 changed files with 21 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

43
armsrc/mifaresniff.c
View file

@ -16,10 +16,9 @@ static uint8_t sniffUIDType = 0;
static uint8_t sniffUID[10] = {0,0,0,0,0,0,0,0,0,0};
static uint8_t sniffATQA[2] = {0,0};
static uint8_t sniffSAK = 0;
static uint8_t sniffBuf[19];
static uint8_t sniffBuf[17];
static uint32_t timerData = 0;
void MfSniffInit(void){
memset(sniffUID, 0x00, sizeof(sniffUID));
memset(sniffATQA, 0x00, sizeof(sniffATQA));
@ -61,41 +60,40 @@ bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint8_t *parity, ui
}
case SNF_ATQA:{
// Select ALL from reader
if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20)) {
if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20))
sniffState = SNF_ANTICOL1;
}
break;
}
case SNF_ANTICOL1:{
// UID from tag (CL1)
if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) {
memcpy(sniffUID + 3, data, 4);
memcpy(sniffUID, data, 4);
sniffState = SNF_UID1;
}
break;
}
case SNF_UID1:{
// Select 4 Byte UID from reader
if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) {
if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9)))
sniffState = SNF_SAK;
}
break;
}
case SNF_SAK:{
if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card?
sniffSAK = data[0];
if (sniffUID[3] == 0x88) { // CL2 UID part to be expected
sniffState = SNF_ANTICOL2;
} else { // select completed
if (sniffUID[0] == 0x88) // CL2/3 UID part to be expected
sniffState = (sniffState == SNF_ANTICOL2 ) ? SNF_ANTICOL3 : SNF_ANTICOL2;
else // select completed
sniffState = SNF_CARD_IDLE;
}
}
break;
}
case SNF_ANTICOL2:{
// CL2 UID
if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) {
memcpy(sniffUID, sniffUID+4, 3);
sniffUID[0] = sniffUID[1];
sniffUID[1] = sniffUID[2];
sniffUID[2] = sniffUID[3];
memcpy(sniffUID+3, data, 4);
sniffUIDType = SNF_UID_7;
sniffState = SNF_UID2;
@ -104,16 +102,18 @@ bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint8_t *parity, ui
}
case SNF_UID2:{
// Select 2nd part of 7 Byte UID
if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) {
if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9)))
sniffState = SNF_SAK;
}
break;
}
case SNF_ANTICOL3:{
// CL3 UID
if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) {
memcpy(sniffUID, sniffUID+4, 3);
memcpy(sniffUID+3, data, 4);
// 3+3+4 = 10.
sniffUID[3] = sniffUID[4];
sniffUID[4] = sniffUID[5];
sniffUID[5] = sniffUID[6];
memcpy(sniffUID+6, data, 4);
sniffUIDType = SNF_UID_10;
sniffState = SNF_UID3;
}
@ -121,16 +121,15 @@ bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint8_t *parity, ui
}
case SNF_UID3:{
// Select 3nd part of 10 Byte UID
if ((reader) && (len == 9) && (data[0] == 0x97) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) {
if ((reader) && (len == 9) && (data[0] == 0x97) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9)))
sniffState = SNF_SAK;
}
break;
}
case SNF_CARD_IDLE:{ // trace the card select sequence
sniffBuf[0] = 0xFF;
sniffBuf[1] = 0xFF;
memcpy(sniffBuf + 2, sniffUID, sizeof(sniffUID));
memcpy(sniffBuf + 9, sniffATQA, sizeof(sniffATQA));
memcpy(sniffBuf + 12, sniffATQA, sizeof(sniffATQA));
sniffBuf[14] = sniffSAK;
sniffBuf[15] = 0xFF;
sniffBuf[16] = 0xFF;
@ -168,20 +167,20 @@ bool intMfSniffSend() {
int pckSize = 0;
int pckLen = BigBuf_get_traceLen();
int pckNum = 0;
uint8_t *trace = BigBuf_get_addr();
uint8_t *data = BigBuf_get_addr();
FpgaDisableSscDma();
while (pckLen > 0) {
pckSize = MIN(USB_CMD_DATA_SIZE, pckLen);
LED_B_ON();
cmd_send(CMD_ACK, 1, BigBuf_get_traceLen(), pckSize, trace + BigBuf_get_traceLen() - pckLen, pckSize);
cmd_send(CMD_ACK, 1, BigBuf_get_traceLen(), pckSize, data + BigBuf_get_traceLen() - pckLen, pckSize);
LED_B_OFF();
pckLen -= pckSize;
pckNum++;
}
LED_B_ON();
cmd_send(CMD_ACK,2,0,0,0,0);
cmd_send(CMD_ACK,2,0,0,0,0); // 2 == data transfer is finished.
LED_B_OFF();
clear_trace();