github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-21 13:53:55 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merged latest trunk changes into scripting-branch

Browse source
This commit is contained in:
martin.holst@gmail.com 2013-09-01 20:00:56 +00:00
commit cda2a4c0a5
18 changed files with 646 additions and 550 deletions
Download patch file Download diff file Expand all files Collapse all files

95
armsrc/appmain.c
View file

@ -626,7 +626,7 @@ void UsbPacketReceived(uint8_t *packet, int len)
#ifdef WITH_LF #ifdef WITH_LF
case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K: case CMD_ACQUIRE_RAW_ADC_SAMPLES_125K:
AcquireRawAdcSamples125k(c->arg[0]); AcquireRawAdcSamples125k(c->arg[0]);
cmd_send(CMD_ACK,0,0,0,0,0); cmd_send(CMD_ACK,0,0,0,0,0);
break; break;
case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K: case CMD_MOD_THEN_ACQUIRE_RAW_ADC_SAMPLES_125K:
ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes); ModThenAcquireRawAdcSamples125k(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
@ -638,7 +638,7 @@ void UsbPacketReceived(uint8_t *packet, int len)
CmdHIDsimTAG(c->arg[0], c->arg[1], 1); // Simulate HID tag by ID CmdHIDsimTAG(c->arg[0], c->arg[1], 1); // Simulate HID tag by ID
break; break;
case CMD_HID_CLONE_TAG: // Clone HID tag by ID to T55x7 case CMD_HID_CLONE_TAG: // Clone HID tag by ID to T55x7
CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]); CopyHIDtoT55x7(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
break; break;
case CMD_EM410X_WRITE_TAG: case CMD_EM410X_WRITE_TAG:
WriteEM410x(c->arg[0], c->arg[1], c->arg[2]); WriteEM410x(c->arg[0], c->arg[1], c->arg[2]);
@ -663,26 +663,26 @@ void UsbPacketReceived(uint8_t *packet, int len)
case CMD_INDALA_CLONE_TAG_L: // Clone Indala 224-bit tag by UID to T55x7 case CMD_INDALA_CLONE_TAG_L: // Clone Indala 224-bit tag by UID to T55x7
CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]); CopyIndala224toT55x7(c->d.asDwords[0], c->d.asDwords[1], c->d.asDwords[2], c->d.asDwords[3], c->d.asDwords[4], c->d.asDwords[5], c->d.asDwords[6]);
break; break;
case CMD_T55XX_READ_BLOCK: case CMD_T55XX_READ_BLOCK:
T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]); T55xxReadBlock(c->arg[1], c->arg[2],c->d.asBytes[0]);
break; break;
case CMD_T55XX_WRITE_BLOCK: case CMD_T55XX_WRITE_BLOCK:
T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]); T55xxWriteBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
break; break;
case CMD_T55XX_READ_TRACE: // Clone HID tag by ID to T55x7 case CMD_T55XX_READ_TRACE: // Clone HID tag by ID to T55x7
T55xxReadTrace(); T55xxReadTrace();
break; break;
case CMD_PCF7931_READ: // Read PCF7931 tag case CMD_PCF7931_READ: // Read PCF7931 tag
ReadPCF7931(); ReadPCF7931();
cmd_send(CMD_ACK,0,0,0,0,0); cmd_send(CMD_ACK,0,0,0,0,0);
// UsbSendPacket((uint8_t*)&ack, sizeof(ack)); // UsbSendPacket((uint8_t*)&ack, sizeof(ack));
break; break;
case CMD_EM4X_READ_WORD: case CMD_EM4X_READ_WORD:
EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]); EM4xReadWord(c->arg[1], c->arg[2],c->d.asBytes[0]);
break; break;
case CMD_EM4X_WRITE_WORD: case CMD_EM4X_WRITE_WORD:
EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]); EM4xWriteWord(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes[0]);
break; break;
#endif #endif
#ifdef WITH_HITAG #ifdef WITH_HITAG
@ -744,10 +744,10 @@ void UsbPacketReceived(uint8_t *packet, int len)
AcquireRawAdcSamplesIso14443(c->arg[0]); AcquireRawAdcSamplesIso14443(c->arg[0]);
break; break;
case CMD_READ_SRI512_TAG: case CMD_READ_SRI512_TAG:
ReadSRI512Iso14443(c->arg[0]); ReadSTMemoryIso14443(0x0F);
break; break;
case CMD_READ_SRIX4K_TAG: case CMD_READ_SRIX4K_TAG:
ReadSRIX4KIso14443(c->arg[0]); ReadSTMemoryIso14443(0x7F);
break; break;
case CMD_SNOOP_ISO_14443: case CMD_SNOOP_ISO_14443:
SnoopIso14443(); SnoopIso14443();
@ -755,6 +755,9 @@ void UsbPacketReceived(uint8_t *packet, int len)
case CMD_SIMULATE_TAG_ISO_14443: case CMD_SIMULATE_TAG_ISO_14443:
SimulateIso14443Tag(); SimulateIso14443Tag();
break; break;
case CMD_ISO_14443B_COMMAND:
SendRawCommand14443B(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
break;
#endif #endif
#ifdef WITH_ISO14443a #ifdef WITH_ISO14443a
@ -772,7 +775,7 @@ void UsbPacketReceived(uint8_t *packet, int len)
break; break;
case CMD_READER_MIFARE: case CMD_READER_MIFARE:
ReaderMifare(c); ReaderMifare(c->arg[0]);
break; break;
case CMD_MIFARE_READBL: case CMD_MIFARE_READBL:
MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes); MifareReadBlock(c->arg[0], c->arg[1], c->arg[2], c->d.asBytes);
@ -877,13 +880,13 @@ void UsbPacketReceived(uint8_t *packet, int len)
// UsbSendPacket((uint8_t *)&n, sizeof(n)); // UsbSendPacket((uint8_t *)&n, sizeof(n));
// LED_B_OFF(); // LED_B_OFF();
LED_B_ON(); LED_B_ON();
for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) { for(size_t i=0; i<c->arg[1]; i += USB_CMD_DATA_SIZE) {
size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE); size_t len = MIN((c->arg[1] - i),USB_CMD_DATA_SIZE);
cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,0,((byte_t*)BigBuf)+c->arg[0]+i,len); cmd_send(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K,i,len,0,((byte_t*)BigBuf)+c->arg[0]+i,len);
} }
// Trigger a finish downloading signal with an ACK frame // Trigger a finish downloading signal with an ACK frame
cmd_send(CMD_ACK,0,0,0,0,0); cmd_send(CMD_ACK,0,0,0,0,0);
LED_B_OFF(); LED_B_OFF();
} break; } break;
@ -892,9 +895,9 @@ void UsbPacketReceived(uint8_t *packet, int len)
memcpy(b+c->arg[0], c->d.asBytes, 48); memcpy(b+c->arg[0], c->d.asBytes, 48);
//Dbprintf("copied 48 bytes to %i",b+c->arg[0]); //Dbprintf("copied 48 bytes to %i",b+c->arg[0]);
// UsbSendPacket((uint8_t*)&ack, sizeof(ack)); // UsbSendPacket((uint8_t*)&ack, sizeof(ack));
cmd_send(CMD_ACK,0,0,0,0,0); cmd_send(CMD_ACK,0,0,0,0,0);
} break; break;
}
case CMD_READ_MEM: case CMD_READ_MEM:
ReadMem(c->arg[0]); ReadMem(c->arg[0]);
break; break;
@ -926,35 +929,35 @@ void UsbPacketReceived(uint8_t *packet, int len)
#endif #endif
case CMD_SETUP_WRITE: case CMD_SETUP_WRITE:
case CMD_FINISH_WRITE: case CMD_FINISH_WRITE:
case CMD_HARDWARE_RESET: { case CMD_HARDWARE_RESET:
usb_disable(); usb_disable();
SpinDelay(1000); SpinDelay(1000);
SpinDelay(1000); SpinDelay(1000);
AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST; AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
for(;;) { for(;;) {
// We're going to reset, and the bootrom will take control. // We're going to reset, and the bootrom will take control.
} }
} break; break;
case CMD_START_FLASH: { case CMD_START_FLASH:
if(common_area.flags.bootrom_present) { if(common_area.flags.bootrom_present) {
common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE; common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
} }
usb_disable(); usb_disable();
AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST; AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
for(;;); for(;;);
} break; break;
case CMD_DEVICE_INFO: { case CMD_DEVICE_INFO: {
uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS; uint32_t dev_info = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT; if(common_area.flags.bootrom_present) dev_info |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
// UsbSendPacket((uint8_t*)&c, sizeof(c)); // UsbSendPacket((uint8_t*)&c, sizeof(c));
cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0); cmd_send(CMD_DEVICE_INFO,dev_info,0,0,0,0);
} break; break;
}
default: { default:
Dbprintf("%s: 0x%04x","unknown command:",c->cmd); Dbprintf("%s: 0x%04x","unknown command:",c->cmd);
} break; break;
} }
} }

7
armsrc/apps.h
View file

@ -135,10 +135,9 @@ void EM4xWriteWord(uint32_t Data, uint8_t Address, uint32_t Pwd, uint8_t PwdMode
/// iso14443.h /// iso14443.h
void SimulateIso14443Tag(void); void SimulateIso14443Tag(void);
void AcquireRawAdcSamplesIso14443(uint32_t parameter); void AcquireRawAdcSamplesIso14443(uint32_t parameter);
void ReadSRI512Iso14443(uint32_t parameter); void ReadSTMemoryIso14443(uint32_t);
void ReadSRIX4KIso14443(uint32_t parameter);
void ReadSTMemoryIso14443(uint32_t parameter,uint32_t dwLast);
void RAMFUNC SnoopIso14443(void); void RAMFUNC SnoopIso14443(void);
void SendRawCommand14443B(uint32_t, uint32_t, uint8_t, uint8_t[]);
/// iso14443a.h /// iso14443a.h
void RAMFUNC SnoopIso14443a(uint8_t param); void RAMFUNC SnoopIso14443a(uint8_t param);
@ -156,7 +155,7 @@ void RAMFUNC SniffMifare(uint8_t param);
void EPA_PACE_Collect_Nonce(UsbCommand * c); void EPA_PACE_Collect_Nonce(UsbCommand * c);
// mifarecmd.h // mifarecmd.h
void ReaderMifare(UsbCommand *c); void ReaderMifare(bool first_try);
void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *data); void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *data);
void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain); void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain);
void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain); void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain);

117
armsrc/iso14443.c
View file

@ -537,7 +537,7 @@ static RAMFUNC int Handle14443SamplesDemod(int ci, int cq)
if(Demod.posCount < 12) { if(Demod.posCount < 12) {
Demod.state = DEMOD_UNSYNCD; Demod.state = DEMOD_UNSYNCD;
} else { } else {
LED_C_ON(); // Got SOF LED_C_ON(); // Got SOF
Demod.state = DEMOD_AWAITING_START_BIT; Demod.state = DEMOD_AWAITING_START_BIT;
Demod.posCount = 0; Demod.posCount = 0;
Demod.len = 0; Demod.len = 0;
@ -598,8 +598,8 @@ static RAMFUNC int Handle14443SamplesDemod(int ci, int cq)
} else if(s == 0x000) { } else if(s == 0x000) {
// This is EOF // This is EOF
LED_C_OFF(); LED_C_OFF();
return TRUE;
Demod.state = DEMOD_UNSYNCD; Demod.state = DEMOD_UNSYNCD;
return TRUE;
} else { } else {
Demod.state = DEMOD_UNSYNCD; Demod.state = DEMOD_UNSYNCD;
} }
@ -639,7 +639,7 @@ static void GetSamplesFor14443Demod(int weTx, int n, int quiet)
int samples = 0; int samples = 0;
// Clear out the state of the "UART" that receives from the tag. // Clear out the state of the "UART" that receives from the tag.
memset(BigBuf, 0x44, 400); memset(BigBuf, 0x00, 400);
Demod.output = (uint8_t *)BigBuf; Demod.output = (uint8_t *)BigBuf;
Demod.len = 0; Demod.len = 0;
Demod.state = DEMOD_UNSYNCD; Demod.state = DEMOD_UNSYNCD;
@ -656,7 +656,7 @@ static void GetSamplesFor14443Demod(int weTx, int n, int quiet)
FpgaSetupSscDma((uint8_t *)dmaBuf, DEMOD_DMA_BUFFER_SIZE); FpgaSetupSscDma((uint8_t *)dmaBuf, DEMOD_DMA_BUFFER_SIZE);
// Signal field is ON with the appropriate LED: // Signal field is ON with the appropriate LED:
if (weTx) LED_D_ON(); else LED_D_OFF(); if (weTx) LED_D_ON(); else LED_D_OFF();
// And put the FPGA in the appropriate mode // And put the FPGA in the appropriate mode
FpgaWriteConfWord( FpgaWriteConfWord(
FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ | FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ |
@ -786,7 +786,7 @@ static void TransmitFor14443(void)
// Code a layer 2 command (string of octets, including CRC) into ToSend[], // Code a layer 2 command (string of octets, including CRC) into ToSend[],
// so that it is ready to transmit to the tag using TransmitFor14443(). // so that it is ready to transmit to the tag using TransmitFor14443().
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
void CodeIso14443bAsReader(const uint8_t *cmd, int len) static void CodeIso14443bAsReader(const uint8_t *cmd, int len)
{ {
int i, j; int i, j;
uint8_t b; uint8_t b;
@ -843,32 +843,14 @@ void CodeIso14443bAsReader(const uint8_t *cmd, int len)
// responses. // responses.
// The command name is misleading, it actually decodes the reponse in HEX // The command name is misleading, it actually decodes the reponse in HEX
// into the output buffer (read the result using hexsamples, not hisamples) // into the output buffer (read the result using hexsamples, not hisamples)
//
// obsolete function only for test
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
void AcquireRawAdcSamplesIso14443(uint32_t parameter) void AcquireRawAdcSamplesIso14443(uint32_t parameter)
{ {
uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 }; uint8_t cmd1[] = { 0x05, 0x00, 0x08, 0x39, 0x73 };
// Make sure that we start from off, since the tags are stateful; SendRawCommand14443B(sizeof(cmd1),1,1,cmd1);
// confusing things will happen if we don't reset them between reads.
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF();
SpinDelay(200);
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
FpgaSetupSsc();
// Now give it time to spin up.
// Signal field is on with the appropriate LED
LED_D_ON();
FpgaWriteConfWord(
FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
SpinDelay(200);
CodeIso14443bAsReader(cmd1, sizeof(cmd1));
TransmitFor14443();
// LED_A_ON();
GetSamplesFor14443Demod(TRUE, 2000, FALSE);
// LED_A_OFF();
} }
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
@ -880,16 +862,7 @@ void AcquireRawAdcSamplesIso14443(uint32_t parameter)
// //
// I tried to be systematic and check every answer of the tag, every CRC, etc... // I tried to be systematic and check every answer of the tag, every CRC, etc...
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
void ReadSRI512Iso14443(uint32_t parameter) void ReadSTMemoryIso14443(uint32_t dwLast)
{
ReadSTMemoryIso14443(parameter,0x0F);
}
void ReadSRIX4KIso14443(uint32_t parameter)
{
ReadSTMemoryIso14443(parameter,0x7F);
}
void ReadSTMemoryIso14443(uint32_t parameter,uint32_t dwLast)
{ {
uint8_t i = 0x00; uint8_t i = 0x00;
@ -973,8 +946,8 @@ void ReadSTMemoryIso14443(uint32_t parameter,uint32_t dwLast)
(Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4], (Demod.output[7]<<24) + (Demod.output[6]<<16) + (Demod.output[5]<<8) + Demod.output[4],
(Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]); (Demod.output[3]<<24) + (Demod.output[2]<<16) + (Demod.output[1]<<8) + Demod.output[0]);
// Now loop to read all 16 blocks, address from 0 to 15 // Now loop to read all 16 blocks, address from 0 to last block
DbpString("Tag memory dump, block 0 to 15"); Dbprintf("Tag memory dump, block 0 to %d",dwLast);
cmd1[0] = 0x08; cmd1[0] = 0x08;
i = 0x00; i = 0x00;
dwLast++; dwLast++;
@ -1072,13 +1045,12 @@ void RAMFUNC SnoopIso14443(void)
Uart.byteCntMax = 100; Uart.byteCntMax = 100;
Uart.state = STATE_UNSYNCD; Uart.state = STATE_UNSYNCD;
// Print some debug information about the buffer sizes // Print some debug information about the buffer sizes
Dbprintf("Snooping buffers initialized:"); Dbprintf("Snooping buffers initialized:");
Dbprintf(" Trace: %i bytes", DEMOD_TRACE_SIZE); Dbprintf(" Trace: %i bytes", DEMOD_TRACE_SIZE);
Dbprintf(" Reader -> tag: %i bytes", READER_TAG_BUFFER_SIZE); Dbprintf(" Reader -> tag: %i bytes", READER_TAG_BUFFER_SIZE);
Dbprintf(" tag -> Reader: %i bytes", TAG_READER_BUFFER_SIZE); Dbprintf(" tag -> Reader: %i bytes", TAG_READER_BUFFER_SIZE);
Dbprintf(" DMA: %i bytes", DEMOD_DMA_BUFFER_SIZE); Dbprintf(" DMA: %i bytes", DEMOD_DMA_BUFFER_SIZE);
// And put the FPGA in the appropriate mode // And put the FPGA in the appropriate mode
// Signal field is off with the appropriate LED // Signal field is off with the appropriate LED
@ -1187,7 +1159,7 @@ void RAMFUNC SnoopIso14443(void)
Demod.output = receivedResponse; Demod.output = receivedResponse;
Demod.state = DEMOD_UNSYNCD; Demod.state = DEMOD_UNSYNCD;
} }
WDT_HIT(); WDT_HIT();
if(BUTTON_PRESS()) { if(BUTTON_PRESS()) {
DbpString("cancelled"); DbpString("cancelled");
@ -1207,3 +1179,56 @@ done:
Dbprintf(" Uart ByteCntMax: %i", Uart.byteCntMax); Dbprintf(" Uart ByteCntMax: %i", Uart.byteCntMax);
Dbprintf(" Trace length: %i", traceLen); Dbprintf(" Trace length: %i", traceLen);
} }
/*
* Send raw command to tag ISO14443B
* @Input
* datalen len of buffer data
* recv bool when true wait for data from tag and send to client
* powerfield bool leave the field on when true
* data buffer with byte to send
*
* @Output
* none
*
*/
void SendRawCommand14443B(uint32_t datalen, uint32_t recv,uint8_t powerfield, uint8_t data[])
{
if(!powerfield)
{
// Make sure that we start from off, since the tags are stateful;
// confusing things will happen if we don't reset them between reads.
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF();
SpinDelay(200);
}
if(!GETBIT(GPIO_LED_D))
{
SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
FpgaSetupSsc();
// Now give it time to spin up.
// Signal field is on with the appropriate LED
LED_D_ON();
FpgaWriteConfWord(
FPGA_MAJOR_MODE_HF_READER_RX_XCORR | FPGA_HF_READER_RX_XCORR_848_KHZ);
SpinDelay(200);
}
CodeIso14443bAsReader(data, datalen);
TransmitFor14443();
if(recv)
{
uint16_t iLen = MIN(Demod.len,USB_CMD_DATA_SIZE);
GetSamplesFor14443Demod(TRUE, 2000, TRUE);
cmd_send(CMD_ACK,iLen,0,0,Demod.output,iLen);
}
if(!powerfield)
{
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF();
}
}

556
armsrc/iso14443a.c
View file

@ -1612,7 +1612,7 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u
int len; int len;
// Broadcast for a card, WUPA (0x52) will force response from all cards in the field // Broadcast for a card, WUPA (0x52) will force response from all cards in the field
ReaderTransmitBitsPar(wupa,7,0); ReaderTransmitBitsPar(wupa,7,0);
// Receive the ATQA // Receive the ATQA
if(!ReaderReceive(resp)) return 0; if(!ReaderReceive(resp)) return 0;
// Dbprintf("atqa: %02x %02x",resp[0],resp[1]); // Dbprintf("atqa: %02x %02x",resp[0],resp[1]);
@ -1625,7 +1625,7 @@ int iso14443a_select_card(byte_t* uid_ptr, iso14a_card_select_t* p_hi14a_card, u
// clear uid // clear uid
if (uid_ptr) { if (uid_ptr) {
memset(uid_ptr,0,8); memset(uid_ptr,0,10);
} }
// OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in // OK we will select at least at cascade 1, lets see if first byte of UID was 0x88 in
@ -1811,354 +1811,266 @@ void ReaderIso14443a(UsbCommand * c)
LEDsoff(); LEDsoff();
} }
#define TEST_LENGTH 100
typedef struct mftest{
uint8_t nt[8];
uint8_t count;
}mftest ;
/** // prepare the Mifare AUTH transfer with an added necessary delay.
*@brief Tunes the mifare attack settings. This method checks the nonce entropy when void PrepareDelayedAuthTransfer(uint8_t* frame, int len, uint16_t delay)
*using a specified timeout.
*Different cards behave differently, some cards require up to a second to power down (and thus reset
*token generator), other cards are fine with 50 ms.
*
* @param time
* @return the entropy. A value of 100 (%) means that every nonce was unique, while a value close to
*zero indicates a low entropy: the given timeout is sufficient to power down the card.
*/
int TuneMifare(int time)
{ {
// Mifare AUTH CodeIso14443aBitsAsReaderPar(frame, len*8, GetParity(frame,len));
uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
uint8_t* receivedAnswer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
iso14443a_setup(); uint8_t bitmask = 0;
int TIME1=time; uint8_t bits_to_shift = 0;
int TIME2=2000; uint8_t bits_shifted = 0;
uint8_t uid[8];
uint32_t cuid;
byte_t nt[4];
Dbprintf("Tuning... testing a delay of %d ms (press button to skip)",time);
if (delay) {
mftest nt_values[TEST_LENGTH]; for (uint16_t i = 0; i < delay; i++) {
int nt_size = 0; bitmask |= (0x01 << i);
int i = 0; }
for(i = 0 ; i< 100 ; i++) ToSend[++ToSendMax] = 0x00;
{ for (uint16_t i = 0; i < ToSendMax; i++) {
LED_C_OFF(); bits_to_shift = ToSend[i] & bitmask;
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); ToSend[i] = ToSend[i] >> delay;
SpinDelay(TIME1); ToSend[i] = ToSend[i] | (bits_shifted << (8 - delay));
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD); bits_shifted = bits_to_shift;
LED_C_ON(); }
SpinDelayUs(TIME2); }
if(!iso14443a_select_card(uid, NULL, &cuid)) continue;
// Transmit MIFARE_CLASSIC_AUTH
ReaderTransmit(mf_auth, sizeof(mf_auth));
// Receive the (16 bit) "random" nonce
if (!ReaderReceive(receivedAnswer)) continue;
memcpy(nt, receivedAnswer, 4);
//store it
int already_stored = 0;
for(int i = 0 ; i < nt_size && !already_stored; i++)
{
if( memcmp(nt, nt_values[i].nt, 4) == 0)
{
nt_values[i].count++;
already_stored = 1;
}
}
if(!already_stored)
{
mftest* ptr= &nt_values[nt_size++];
//Clear it before use
memset(ptr, 0, sizeof(mftest));
memcpy(ptr->nt, nt, 4);
ptr->count = 1;
}
if(BUTTON_PRESS())
{
Dbprintf("Tuning aborted prematurely");
break;
}
}
/*
for(int i = 0 ; i < nt_size;i++){
mftest x = nt_values[i];
Dbprintf("%d,%d,%d,%d : %d",x.nt[0],x.nt[1],x.nt[2],x.nt[3],x.count);
}
*/
int result = nt_size *100 / i;
Dbprintf(" ... results for %d ms : %d %",time, result);
return result;
} }
// Determine the distance between two nonces.
// Assume that the difference is small, but we don't know which is first.
// Therefore try in alternating directions.
int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
uint16_t i;
uint32_t nttmp1, nttmp2;
if (nt1 == nt2) return 0;
nttmp1 = nt1;
nttmp2 = nt2;
for (i = 1; i < 32768; i++) {
nttmp1 = prng_successor(nttmp1, 1);
if (nttmp1 == nt2) return i;
nttmp2 = prng_successor(nttmp2, 1);
if (nttmp2 == nt1) return -i;
}
return(-99999); // either nt1 or nt2 are invalid nonces
}
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// Read an ISO 14443a tag. Send out commands and store answers. // Recover several bits of the cypher stream. This implements (first stages of)
// // the algorithm described in "The Dark Side of Security by Obscurity and
// Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime"
// (article by Nicolas T. Courtois, 2009)
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
#define STATE_SIZE 100 void ReaderMifare(bool first_try)
typedef struct AttackState{
byte_t nt[4];
byte_t par_list[8];
byte_t ks_list[8];
byte_t par;
byte_t par_low;
byte_t nt_diff;
uint8_t mf_nr_ar[8];
} AttackState;
int continueAttack(AttackState* pState,uint8_t* receivedAnswer)
{ {
// Mifare AUTH
// Transmit reader nonce and reader answer
ReaderTransmitPar(pState->mf_nr_ar, sizeof(pState->mf_nr_ar),pState->par);
// Receive 4 bit answer
int len = ReaderReceive(receivedAnswer);
if (!len)
{
if (pState->nt_diff == 0)
{
pState->par++;
} else {
pState->par = (((pState->par >> 3) + 1) << 3) | pState->par_low;
}
return 2;
}
if(pState->nt_diff == 0)
{
pState->par_low = pState->par & 0x07;
}
//Dbprintf("answer received, parameter (%d), (memcmp(nt, nt_no)=%d",parameter,memcmp(nt, nt_noattack, 4));
//if ( (parameter != 0) && (memcmp(nt, nt_noattack, 4) == 0) ) continue;
//isNULL = 0;//|| !(nt_attacked[0] == 0) && (nt_attacked[1] == 0) && (nt_attacked[2] == 0) && (nt_attacked[3] == 0);
//
// if ( /*(isNULL != 0 ) && */(memcmp(nt, nt_attacked, 4) != 0) ) continue;
//led_on = !led_on;
//if(led_on) LED_B_ON(); else LED_B_OFF();
pState->par_list[pState->nt_diff] = pState->par;
pState->ks_list[pState->nt_diff] = receivedAnswer[0] ^ 0x05;
// Test if the information is complete
if (pState->nt_diff == 0x07) {
return 0;
}
pState->nt_diff = (pState->nt_diff + 1) & 0x07;
pState->mf_nr_ar[3] = pState->nt_diff << 5;
pState->par = pState->par_low;
return 1;
}
void reportResults(uint8_t uid[8],AttackState *pState, int isOK)
{
LogTrace(pState->nt, 4, 0, GetParity(pState->nt, 4), TRUE);
LogTrace(pState->par_list, 8, 0, GetParity(pState->par_list, 8), TRUE);
LogTrace(pState->ks_list, 8, 0, GetParity(pState->ks_list, 8), TRUE);
byte_t buf[48];
memcpy(buf + 0, uid, 4);
if(pState != NULL)
{
memcpy(buf + 4, pState->nt, 4);
memcpy(buf + 8, pState->par_list, 8);
memcpy(buf + 16, pState->ks_list, 8);
}
LED_B_ON();
cmd_send(CMD_ACK,isOK,0,0,buf,48);
LED_B_OFF();
// Thats it...
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LEDsoff();
tracing = TRUE;
if (MF_DBGLEVEL >= 1) DbpString("COMMAND mifare FINISHED");
}
void ReaderMifareBegin(uint32_t offset_time, uint32_t powerdown_time);
/**
* @brief New implementation of ReaderMifare, the classic mifare attack.
* This implementation is backwards-compatible, but has some added parameters.
* @param c the usbcommand in complete
* c->arg[0] - nt_noattack (deprecated)
* c->arg[1] - offset_time us (0 => random)
* c->arg[2] - powerdown_time ms (0=> tuning)
*
*/
void ReaderMifare(UsbCommand *c)
{
/*
* The 'no-attack' is not used anymore, with the introduction of
* state tables. Instead, we use an offset which is random. This means that we
* should not get stuck on a 'bad' nonce, so no-attack is not needed.
* Anyway, arg[0] is reserved for backwards compatibility
uint32_t nt_noattack_uint = c->arg[0];
byte_t nt_noattack[4];
num_to_bytes(parameter, 4, nt_noattack_uint);
*/
/*
*IF, for some reason, you want to attack a specific nonce or whatever,
*you can specify the offset time yourself, in which case it won't be random.
*
* The offset time is microseconds, MICROSECONDS, not ms.
*/
uint32_t offset_time = c->arg[1];
if(offset_time == 0)
{
//[Martin:]I would like to have used rand(), but linking problems prevented it
//offset_time = rand() % 4000;
//So instead, I found this nifty thingy, which seems to fit the bill
offset_time = GetTickCount() % 2000;
}
/*
* There is an implementation of tuning. Tuning will try to determine
* a good power-down time, which is different for different cards.
* If a value is specified from the packet, we won't do any tuning.
* A value of zero will initialize a tuning.
* The power-down time is milliseconds, that MILLI-seconds .
*/
uint32_t powerdown_time = c->arg[2];
if(powerdown_time == 0)
{
//Tuning required
int entropy = 100;
int time = 25;
entropy = TuneMifare(time);
while(entropy > 50 && time < 2000){
//Increase timeout, but never more than 500ms at a time
time = MIN(time*2, time+500);
entropy = TuneMifare(time);
}
if(entropy > 50){
Dbprintf("OBS! This card has high entropy (%d) and slow power-down. This may take a while", entropy);
}
powerdown_time = time;
}
//The actual attack
ReaderMifareBegin(offset_time, powerdown_time);
}
void ReaderMifareBegin(uint32_t offset_time, uint32_t powerdown_time)
{
Dbprintf("Using power-down-time of %d ms, offset time %d us", powerdown_time, offset_time);
/**
*Allocate our state-table and initialize with zeroes
**/
AttackState states[STATE_SIZE] ;
//Dbprintf("Memory allocated ok! (%d bytes)",STATE_SIZE*sizeof(AttackState) );
memset(states, 0, STATE_SIZE*sizeof(AttackState));
// Mifare AUTH
uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b }; uint8_t mf_auth[] = { 0x60,0x00,0xf5,0x7b };
uint8_t* receivedAnswer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET); // was 3560 - tied to other size changes uint8_t mf_nr_ar[] = { 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 };
static uint8_t mf_nr_ar3;
traceLen = 0; uint8_t* receivedAnswer = (((uint8_t *)BigBuf) + FREE_BUFFER_OFFSET);
traceLen = 0;
tracing = false; tracing = false;
iso14443a_setup(); byte_t nt_diff = 0;
byte_t par = 0;
//byte_t par_mask = 0xff;
static byte_t par_low = 0;
bool led_on = TRUE;
uint8_t uid[10];
uint32_t cuid;
uint32_t nt, previous_nt;
static uint32_t nt_attacked = 0;
byte_t par_list[8] = {0,0,0,0,0,0,0,0};
byte_t ks_list[8] = {0,0,0,0,0,0,0,0};
static uint32_t sync_time;
static uint32_t sync_cycles;
int catch_up_cycles = 0;
int last_catch_up = 0;
uint16_t consecutive_resyncs = 0;
int isOK = 0;
if (first_try) {
StartCountMifare();
mf_nr_ar3 = 0;
iso14443a_setup();
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN); // resets some FPGA internal registers
while((GetCountMifare() & 0xffff0000) != 0x10000); // wait for counter to reset and "warm up"
while(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_FRAME); // wait for ssp_frame to be low
while(!(AT91C_BASE_PIOA->PIO_PDSR & GPIO_SSC_FRAME)); // sync on rising edge of ssp_frame
sync_time = GetCountMifare();
sync_cycles = 65536; // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
nt_attacked = 0;
nt = 0;
par = 0;
}
else {
// we were unsuccessful on a previous call. Try another READER nonce (first 3 parity bits remain the same)
// nt_attacked = prng_successor(nt_attacked, 1);
mf_nr_ar3++;
mf_nr_ar[3] = mf_nr_ar3;
par = par_low;
}
LED_A_ON(); LED_A_ON();
LED_B_OFF(); LED_B_OFF();
LED_C_OFF(); LED_C_OFF();
LED_A_OFF();
uint8_t uid[8];
uint32_t cuid;
byte_t nt[4]; for(uint16_t i = 0; TRUE; i++) {
int nts_attacked= 0;
//Keeps track of progress (max value of nt_diff for our states) WDT_HIT();
int progress = 0;
int high_entropy_warning_issued = 0; // Test if the action was cancelled
while(!BUTTON_PRESS()) if(BUTTON_PRESS()) {
{ break;
LED_C_OFF(); }
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
SpinDelay(powerdown_time);
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
LED_C_ON(); LED_C_ON();
SpinDelayUs(offset_time);
if(!iso14443a_select_card(uid, NULL, &cuid)) continue; if(!iso14443a_select_card(uid, NULL, &cuid)) {
continue;
}
//keep the card active
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_READER_MOD);
PrepareDelayedAuthTransfer(mf_auth, sizeof(mf_auth), (sync_cycles + catch_up_cycles) & 0x00000007);
sync_time = sync_time + ((sync_cycles + catch_up_cycles) & 0xfffffff8);
catch_up_cycles = 0;
// if we missed the sync time already, advance to the next nonce repeat
while(GetCountMifare() > sync_time) {
sync_time = sync_time + (sync_cycles & 0xfffffff8);
}
// now sync. After syncing, the following Classic Auth will return the same tag nonce (mostly)
while(GetCountMifare() < sync_time);
// Transmit MIFARE_CLASSIC_AUTH // Transmit MIFARE_CLASSIC_AUTH
ReaderTransmit(mf_auth, sizeof(mf_auth)); int samples = 0;
int wait = 0;
TransmitFor14443a(ToSend, ToSendMax, &samples, &wait);
// Receive the (16 bit) "random" nonce // Receive the (4 Byte) "random" nonce
if (!ReaderReceive(receivedAnswer)) continue; if (!ReaderReceive(receivedAnswer)) {
memcpy(nt, receivedAnswer, 4); continue;
}
//Now we have the NT. Check if this NT is already under attack
AttackState* pState = NULL;
int i = 0;
for(i = 0 ; i < nts_attacked && pState == NULL; i++)
{
if( memcmp(nt, states[i].nt, 4) == 0)
{
//we have it
pState = &states[i];
//Dbprintf("Existing state found (%d)", i);
}
}
if(pState == NULL){ previous_nt = nt;
if(nts_attacked < STATE_SIZE ) nt = bytes_to_num(receivedAnswer, 4);
{
//Initialize a new state
pState = &states[nts_attacked++];
//Clear it before use
memset(pState, 0, sizeof(AttackState));
memcpy(pState->nt, nt, 4);
i = nts_attacked;
//Dbprintf("New state created, nt=");
}else if(!high_entropy_warning_issued){
/**
*If we wound up here, it means that the state table was eaten up by potential nonces. This could be fixed by
*increasing the size of the state buffer, however, it points to some other problem. Ideally, we should get the same nonce
*every time. Realistically we should get a few different nonces, but if we get more than 50, there is probably somehting
*else that is wrong. An attack using too high nonce entropy will take **LONG** time to finish.
*/
DbpString("WARNING: Nonce entropy is suspiciously high, something is wrong. Check timeouts (and perhaps increase STATE_SIZE)");
high_entropy_warning_issued = 1;
}
}
if(pState == NULL) continue;
int result = continueAttack(pState, receivedAnswer); // Transmit reader nonce with fake par
ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), par);
if(result == 1){ if (first_try && previous_nt && !nt_attacked) { // we didn't calibrate our clock yet
//One state progressed another step int nt_distance = dist_nt(previous_nt, nt);
if(pState->nt_diff > progress) if (nt_distance == 0) {
{ nt_attacked = nt;
progress = pState->nt_diff; }
//Alert the user else {
Dbprintf("Recovery progress: %d/8, NTs attacked: %d ", progress,nts_attacked ); if (nt_distance == -99999) { // invalid nonce received, try again
} continue;
//Dbprintf("State increased to %d in state %d", pState->nt_diff, i); }
} sync_cycles = (sync_cycles - nt_distance);
else if(result == 2){ // Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);
//Dbprintf("Continue attack no answer, par is now %d", pState->par); continue;
} }
else if(result == 0){ }
reportResults(uid,pState,1);
return; if ((nt != nt_attacked) && nt_attacked) { // we somehow lost sync. Try to catch up again...
} catch_up_cycles = -dist_nt(nt_attacked, nt);
} if (catch_up_cycles == 99999) { // invalid nonce received. Don't resync on that one.
reportResults(uid,NULL,0); catch_up_cycles = 0;
continue;
}
if (catch_up_cycles == last_catch_up) {
consecutive_resyncs++;
}
else {
last_catch_up = catch_up_cycles;
consecutive_resyncs = 0;
}
if (consecutive_resyncs < 3) {
Dbprintf("Lost sync in cycle %d. nt_distance=%d. Consecutive Resyncs = %d. Trying one time catch up...\n", i, -catch_up_cycles, consecutive_resyncs);
}
else {
sync_cycles = sync_cycles + catch_up_cycles;
Dbprintf("Lost sync in cycle %d for the fourth time consecutively (nt_distance = %d). Adjusting sync_cycles to %d.\n", i, -catch_up_cycles, sync_cycles);
}
continue;
}
consecutive_resyncs = 0;
// Receive answer. This will be a 4 Bit NACK when the 8 parity bits are OK after decoding
if (ReaderReceive(receivedAnswer))
{
catch_up_cycles = 8; // the PRNG doesn't run during data transfers. 4 Bit = 8 cycles
if (nt_diff == 0)
{
par_low = par & 0x07; // there is no need to check all parities for other nt_diff. Parity Bits for mf_nr_ar[0..2] won't change
}
led_on = !led_on;
if(led_on) LED_B_ON(); else LED_B_OFF();
par_list[nt_diff] = par;
ks_list[nt_diff] = receivedAnswer[0] ^ 0x05;
// Test if the information is complete
if (nt_diff == 0x07) {
isOK = 1;
break;
}
nt_diff = (nt_diff + 1) & 0x07;
mf_nr_ar[3] = (mf_nr_ar[3] & 0x1F) | (nt_diff << 5);
par = par_low;
} else {
if (nt_diff == 0 && first_try)
{
par++;
} else {
par = (((par >> 3) + 1) << 3) | par_low;
}
}
}
LogTrace((const uint8_t *)&nt, 4, 0, GetParity((const uint8_t *)&nt, 4), TRUE);
LogTrace(par_list, 8, 0, GetParity(par_list, 8), TRUE);
LogTrace(ks_list, 8, 0, GetParity(ks_list, 8), TRUE);
mf_nr_ar[3] &= 0x1F;
byte_t buf[28];
memcpy(buf + 0, uid, 4);
num_to_bytes(nt, 4, buf + 4);
memcpy(buf + 8, par_list, 8);
memcpy(buf + 16, ks_list, 8);
memcpy(buf + 24, mf_nr_ar, 4);
cmd_send(CMD_ACK,isOK,0,0,buf,28);
// Thats it...
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LEDsoff();
tracing = TRUE;
} }
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// MIFARE 1K simulate. // MIFARE 1K simulate.
// //

18
armsrc/mifarecmd.c
View file

@ -28,7 +28,7 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
// variables // variables
byte_t isOK = 0; byte_t isOK = 0;
byte_t dataoutbuf[16]; byte_t dataoutbuf[16];
uint8_t uid[8]; uint8_t uid[10];
uint32_t cuid; uint32_t cuid;
struct Crypto1State mpcs = {0, 0}; struct Crypto1State mpcs = {0, 0};
struct Crypto1State *pcs; struct Crypto1State *pcs;
@ -109,7 +109,7 @@ void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
// variables // variables
byte_t isOK = 0; byte_t isOK = 0;
byte_t dataoutbuf[16 * 4]; byte_t dataoutbuf[16 * 4];
uint8_t uid[8]; uint8_t uid[10];
uint32_t cuid; uint32_t cuid;
struct Crypto1State mpcs = {0, 0}; struct Crypto1State mpcs = {0, 0};
struct Crypto1State *pcs; struct Crypto1State *pcs;
@ -208,7 +208,7 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
// variables // variables
byte_t isOK = 0; byte_t isOK = 0;
uint8_t uid[8]; uint8_t uid[10];
uint32_t cuid; uint32_t cuid;
struct Crypto1State mpcs = {0, 0}; struct Crypto1State mpcs = {0, 0};
struct Crypto1State *pcs; struct Crypto1State *pcs;
@ -298,7 +298,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain)
// variables // variables
int rtr, i, j, m, len; int rtr, i, j, m, len;
int davg, dmin, dmax; int davg, dmin, dmax;
uint8_t uid[8]; uint8_t uid[10];
uint32_t cuid, nt1, nt2, nttmp, nttest, par, ks1; uint32_t cuid, nt1, nt2, nttmp, nttest, par, ks1;
uint8_t par_array[4]; uint8_t par_array[4];
nestedVector nvector[NES_MAX_INFO + 1][11]; nestedVector nvector[NES_MAX_INFO + 1][11];
@ -493,7 +493,6 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain)
} }
LED_B_ON(); LED_B_ON();
// SpinDelay(100);
cmd_send(CMD_ACK,0,ncount,targetBlockNo + (targetKeyType * 0x100),buf,48); cmd_send(CMD_ACK,0,ncount,targetBlockNo + (targetKeyType * 0x100),buf,48);
// UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand)); // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
LED_B_OFF(); LED_B_OFF();
@ -507,7 +506,6 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain)
// memset(ack.d.asBytes, 0x00, sizeof(ack.d.asBytes)); // memset(ack.d.asBytes, 0x00, sizeof(ack.d.asBytes));
LED_B_ON(); LED_B_ON();
// SpinDelay(300);
// UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand)); // UsbSendPacket((uint8_t *)&ack, sizeof(UsbCommand));
cmd_send(CMD_ACK,1,0,0,0,0); cmd_send(CMD_ACK,1,0,0,0,0);
LED_B_OFF(); LED_B_OFF();
@ -536,7 +534,7 @@ void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
// variables // variables
int i; int i;
byte_t isOK = 0; byte_t isOK = 0;
uint8_t uid[8]; uint8_t uid[10];
uint32_t cuid; uint32_t cuid;
struct Crypto1State mpcs = {0, 0}; struct Crypto1State mpcs = {0, 0};
struct Crypto1State *pcs; struct Crypto1State *pcs;
@ -649,7 +647,7 @@ void MifareECardLoad(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
// variables // variables
byte_t dataoutbuf[16]; byte_t dataoutbuf[16];
byte_t dataoutbuf2[16]; byte_t dataoutbuf2[16];
uint8_t uid[8]; uint8_t uid[10];
// clear trace // clear trace
iso14a_clear_trace(); iso14a_clear_trace();
@ -761,11 +759,11 @@ void MifareCSetBlock(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datai
// variables // variables
byte_t isOK = 0; byte_t isOK = 0;
uint8_t uid[8]; uint8_t uid[10];
uint8_t d_block[18]; uint8_t d_block[18];
uint32_t cuid; uint32_t cuid;
memset(uid, 0x00, 8); memset(uid, 0x00, 10);
uint8_t* receivedAnswer = mifare_get_bigbufptr(); uint8_t* receivedAnswer = mifare_get_bigbufptr();
if (workFlags & 0x08) { if (workFlags & 0x08) {

59
armsrc/util.c
View file

@ -298,7 +298,7 @@ void StartCountUS()
AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN; AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN;
AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN; AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN;
AT91C_BASE_TCB->TCB_BCR = 1; AT91C_BASE_TCB->TCB_BCR = 1;
} }
uint32_t RAMFUNC GetCountUS(){ uint32_t RAMFUNC GetCountUS(){
return (AT91C_BASE_TC1->TC_CV * 0x8000) + ((AT91C_BASE_TC0->TC_CV / 15) * 10); return (AT91C_BASE_TC1->TC_CV * 0x8000) + ((AT91C_BASE_TC0->TC_CV / 15) * 10);
@ -314,3 +314,60 @@ uint32_t RAMFUNC GetDeltaCountUS(){
} }
// -------------------------------------------------------------------------
// Mifare timer. Uses ssp_clk from FPGA
// -------------------------------------------------------------------------
void StartCountMifare()
{
AT91C_BASE_PMC->PMC_PCER = (1 << AT91C_ID_TC0) | (1 << AT91C_ID_TC1) | (1 << AT91C_ID_TC2); // Enable Clock to all timers
AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC0XC0S_TIOA1 // XC0 Clock = TIOA1
| AT91C_TCB_TC1XC1S_NONE // XC1 Clock = none
| AT91C_TCB_TC2XC2S_TIOA0; // XC2 Clock = TIOA0
// configure TC1 to create a short pulse on TIOA1 when a rising edge on TIOB1 (= ssp_clk from FPGA) occurs:
AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; // disable TC1
AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_TIMER_DIV1_CLOCK // TC1 Clock = MCK(48MHz)/2 = 24MHz
| AT91C_TC_CPCSTOP // Stop clock on RC compare
| AT91C_TC_EEVTEDG_RISING // Trigger on rising edge of Event
| AT91C_TC_EEVT_TIOB // Event-Source: TIOB1 (= ssc_clk from FPGA = 13,56MHz / 16)
| AT91C_TC_ENETRG // Enable external trigger event
| AT91C_TC_WAVESEL_UP // Upmode without automatic trigger on RC compare
| AT91C_TC_WAVE // Waveform Mode
| AT91C_TC_AEEVT_SET // Set TIOA1 on external event
| AT91C_TC_ACPC_CLEAR; // Clear TIOA1 on RC Compare
AT91C_BASE_TC1->TC_RC = 0x04; // RC Compare value = 0x04
// use TC0 to count TIOA1 pulses
AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS; // disable TC0
AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_XC0 // TC0 clock = XC0 clock = TIOA1
| AT91C_TC_WAVE // Waveform Mode
| AT91C_TC_WAVESEL_UP // just count
| AT91C_TC_ACPA_CLEAR // Clear TIOA0 on RA Compare
| AT91C_TC_ACPC_SET; // Set TIOA0 on RC Compare
AT91C_BASE_TC0->TC_RA = 1; // RA Compare value = 1; pulse width to TC2
AT91C_BASE_TC0->TC_RC = 0; // RC Compare value = 0; increment TC2 on overflow
// use TC2 to count TIOA0 pulses (giving us a 32bit counter (TC0/TC2) clocked by ssp_clk)
AT91C_BASE_TC2->TC_CCR = AT91C_TC_CLKDIS; // disable TC2
AT91C_BASE_TC2->TC_CMR = AT91C_TC_CLKS_XC2 // TC2 clock = XC2 clock = TIOA0
| AT91C_TC_WAVE // Waveform Mode
| AT91C_TC_WAVESEL_UP; // just count
AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN; // enable TC0
AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN; // enable TC1
AT91C_BASE_TC2->TC_CCR = AT91C_TC_CLKEN; // enable TC2
AT91C_BASE_TCB->TCB_BCR = 1; // assert Sync (set all timers to 0 on next active clock edge)
}
uint32_t RAMFUNC GetCountMifare(){
uint32_t tmp_count;
tmp_count = (AT91C_BASE_TC2->TC_CV << 16) | AT91C_BASE_TC0->TC_CV;
if ((tmp_count & 0xffff) == 0) { //small chance that we may have missed an increment in TC2
return (AT91C_BASE_TC2->TC_CV << 16);
}
else {
return tmp_count;
}
}

3
armsrc/util.h
View file

@ -47,4 +47,7 @@ void StartCountUS();
uint32_t RAMFUNC GetCountUS(); uint32_t RAMFUNC GetCountUS();
uint32_t RAMFUNC GetDeltaCountUS(); uint32_t RAMFUNC GetDeltaCountUS();
void StartCountMifare();
uint32_t RAMFUNC GetCountMifare();
#endif #endif

5
client/Makefile
View file

@ -32,6 +32,8 @@ else
CXXFLAGS = $(shell pkg-config --cflags QtCore QtGui 2>/dev/null) -Wall -O4 CXXFLAGS = $(shell pkg-config --cflags QtCore QtGui 2>/dev/null) -Wall -O4
QTLDLIBS = $(shell pkg-config --libs QtCore QtGui 2>/dev/null) QTLDLIBS = $(shell pkg-config --libs QtCore QtGui 2>/dev/null)
MOC = $(shell pkg-config --variable=moc_location QtCore) MOC = $(shell pkg-config --variable=moc_location QtCore)
# Below is a variant you can use if you have problems compiling with QT5 on ubuntu. see http://www.proxmark.org/forum/viewtopic.php?id=1661 for more info.
#MOC = /usr/lib/x86_64-linux-gnu/qt4/bin/moc
LUAPLATFORM = linux LUAPLATFORM = linux
endif endif
@ -46,7 +48,8 @@ endif
CORESRCS = uart.c \ CORESRCS = uart.c \
util.c \ util.c \
sleep.c \ sleep.c
CMDSRCS = nonce2key/crapto1.c\ CMDSRCS = nonce2key/crapto1.c\
nonce2key/crypto1.c\ nonce2key/crypto1.c\

53
client/cmddata.c
View file

@ -393,46 +393,43 @@ int CmdGrid(const char *Cmd)
int CmdHexsamples(const char *Cmd) int CmdHexsamples(const char *Cmd)
{ {
int n; int i, j;
int requested = 0; int requested = 0;
int offset = 0; int offset = 0;
sscanf(Cmd, "%i %i", &requested, &offset); char string_buf[25];
char* string_ptr = string_buf;
int delivered = 0;
uint8_t got[40000]; uint8_t got[40000];
/* round up to nearest 8 bytes so the printed data is all valid */ sscanf(Cmd, "%i %i", &requested, &offset);
if (requested < 8) {
/* if no args send something */
if (requested == 0) {
requested = 8; requested = 8;
} }
if (requested % 8 != 0) {
int remainder = requested % 8;
requested = requested + 8 - remainder;
}
if (offset + requested > sizeof(got)) { if (offset + requested > sizeof(got)) {
PrintAndLog("Tried to read past end of buffer, <bytes> + <offset> > 40000"); PrintAndLog("Tried to read past end of buffer, <bytes> + <offset> > 40000");
return 0; return 0;
} else {
n = requested;
} }
GetFromBigBuf(got,n,offset); GetFromBigBuf(got,requested,offset);
WaitForResponse(CMD_ACK,NULL); WaitForResponse(CMD_ACK,NULL);
for (int j = 0; j < n; j += 8) { i = 0;
PrintAndLog("%02x %02x %02x %02x %02x %02x %02x %02x", for (j = 0; j < requested; j++) {
sample_buf[j+0], i++;
sample_buf[j+1], string_ptr += sprintf(string_ptr, "%02x ", got[j]);
sample_buf[j+2], if (i == 8) {
sample_buf[j+3], *(string_ptr - 1) = '\0'; // remove the trailing space
sample_buf[j+4], PrintAndLog("%s", string_buf);
sample_buf[j+5], string_buf[0] = '\0';
sample_buf[j+6], string_ptr = string_buf;
sample_buf[j+7] i = 0;
); }
delivered += 8; if (j == requested - 1 && string_buf[0] != '\0') { // print any remaining bytes
if (delivered >= requested) *(string_ptr - 1) = '\0';
break; PrintAndLog("%s", string_buf);
string_buf[0] = '\0';
}
} }
return 0; return 0;
} }

116
client/cmdhf14b.c
View file

@ -21,6 +21,7 @@
#include "ui.h" #include "ui.h"
#include "cmdparser.h" #include "cmdparser.h"
#include "cmdhf14b.h" #include "cmdhf14b.h"
#include "cmdmain.h"
static int CmdHelp(const char *Cmd); static int CmdHelp(const char *Cmd);
@ -267,6 +268,116 @@ int CmdSrix4kRead(const char *Cmd)
return 0; return 0;
} }
int CmdHF14BCmdRaw (const char *cmd) {
UsbCommand resp;
uint8_t *recv;
UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; // len,recv?
uint8_t reply=1;
uint8_t crc=0;
uint8_t power=0;
char buf[5]="";
int i=0;
uint8_t data[100];
unsigned int datalen=0, temp;
char *hexout;
if (strlen(cmd)<3) {
PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] <0A 0B 0C ... hex>");
PrintAndLog(" -r do not read response");
PrintAndLog(" -c calculate and append CRC");
PrintAndLog(" -p leave the field on after receive");
return 0;
}
// strip
while (*cmd==' ' || *cmd=='\t') cmd++;
while (cmd[i]!='\0') {
if (cmd[i]==' ' || cmd[i]=='\t') { i++; continue; }
if (cmd[i]=='-') {
switch (cmd[i+1]) {
case 'r':
case 'R':
reply=0;
break;
case 'c':
case 'C':
crc=1;
break;
case 'p':
case 'P':
power=1;
break;
default:
PrintAndLog("Invalid option");
return 0;
}
i+=2;
continue;
}
if ((cmd[i]>='0' && cmd[i]<='9') ||
(cmd[i]>='a' && cmd[i]<='f') ||
(cmd[i]>='A' && cmd[i]<='F') ) {
buf[strlen(buf)+1]=0;
buf[strlen(buf)]=cmd[i];
i++;
if (strlen(buf)>=2) {
sscanf(buf,"%x",&temp);
data[datalen]=(uint8_t)(temp & 0xff);
datalen++;
*buf=0;
}
continue;
}
PrintAndLog("Invalid char on input");
return 0;
}
if(crc)
{
uint8_t first, second;
ComputeCrc14443(CRC_14443_B, data, datalen, &first, &second);
data[datalen++] = first;
data[datalen++] = second;
}
c.arg[0] = datalen;
c.arg[1] = reply;
c.arg[2] = power;
memcpy(c.d.asBytes,data,datalen);
SendCommand(&c);
if (reply) {
if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
recv = resp.d.asBytes;
PrintAndLog("received %i octets",resp.arg[0]);
if(!resp.arg[0])
return 0;
hexout = (char *)malloc(resp.arg[0] * 3 + 1);
if (hexout != NULL) {
uint8_t first, second;
for (int i = 0; i < resp.arg[0]; i++) { // data in hex
sprintf(&hexout[i * 3], "%02hX ", recv[i]);
}
PrintAndLog("%s", hexout);
free(hexout);
ComputeCrc14443(CRC_14443_B, recv, resp.arg[0]-2, &first, &second);
if(recv[resp.arg[0]-2]==first && recv[resp.arg[0]-1]==second) {
PrintAndLog("CRC OK");
} else {
PrintAndLog("CRC failed");
}
} else {
PrintAndLog("malloc failed your client has low memory?");
}
} else {
PrintAndLog("timeout while waiting for reply.");
}
} // if reply
return 0;
}
static command_t CommandTable[] = static command_t CommandTable[] =
{ {
{"help", CmdHelp, 1, "This help"}, {"help", CmdHelp, 1, "This help"},
@ -276,8 +387,9 @@ static command_t CommandTable[] =
{"sim", CmdHF14Sim, 0, "Fake ISO 14443 tag"}, {"sim", CmdHF14Sim, 0, "Fake ISO 14443 tag"},
{"simlisten", CmdHFSimlisten, 0, "Get HF samples as fake tag"}, {"simlisten", CmdHFSimlisten, 0, "Get HF samples as fake tag"},
{"snoop", CmdHF14BSnoop, 0, "Eavesdrop ISO 14443"}, {"snoop", CmdHF14BSnoop, 0, "Eavesdrop ISO 14443"},
{"sri512read", CmdSri512Read, 0, "<int> -- Read contents of a SRI512 tag"}, {"sri512read", CmdSri512Read, 0, "Read contents of a SRI512 tag"},
{"srix4kread", CmdSrix4kRead, 0, "<int> -- Read contents of a SRIX4K tag"}, {"srix4kread", CmdSrix4kRead, 0, "Read contents of a SRIX4K tag"},
{"raw", CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},
{NULL, NULL, 0, NULL} {NULL, NULL, 0, NULL}
}; };

86
client/cmdhflegic.c
View file

@ -52,35 +52,20 @@ int CmdHelp(const char *Cmd)
*/ */
int CmdLegicDecode(const char *Cmd) int CmdLegicDecode(const char *Cmd)
{ {
int h, i, j, k, n; int i, j, k, n;
int segment_len = 0; int segment_len = 0;
int segment_flag = 0; int segment_flag = 0;
int stamp_len = 0; int stamp_len = 0;
int crc = 0; int crc = 0;
int wrp = 0; int wrp = 0;
int wrc = 0; int wrc = 0;
int data_buf[1032]; // receiver buffer uint8_t data_buf[1024]; // receiver buffer
char out_string[3076]; // just use big buffer - bad practice char out_string[3076]; // just use big buffer - bad practice
char token_type[4]; char token_type[4];
int delivered = 0;
h = 0;
// copy data from proxmark into buffer // copy data from proxmark into buffer
for (i = 0; i < 256; i += 12, h += 48) { GetFromBigBuf(data_buf,sizeof(data_buf),0);
UsbCommand c = {CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K, {i, 0, 0}}; WaitForResponse(CMD_ACK,NULL);
SendCommand(&c);
WaitForResponse(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, NULL);
for (j = 0; j < 48; j += 8) {
for (k = 0; k < 8; k++) {
data_buf[h+j+k] = sample_buf[j+k];
}
delivered += 8;
if (delivered >= 1024)
break;
}
}
// Output CDF System area (9 bytes) plus remaining header area (12 bytes) // Output CDF System area (9 bytes) plus remaining header area (12 bytes)
@ -264,24 +249,27 @@ int CmdLegicLoad(const char *Cmd)
int CmdLegicSave(const char *Cmd) int CmdLegicSave(const char *Cmd)
{ {
int n;
int requested = 1024; int requested = 1024;
int offset = 0; int offset = 0;
char filename[1024];
sscanf(Cmd, " %s %i %i", filename, &requested, &offset);
if (offset % 4 != 0) {
PrintAndLog("Offset must be a multiple of 4");
return 0;
}
offset = offset/4;
int delivered = 0; int delivered = 0;
char filename[1024];
uint8_t got[1024];
sscanf(Cmd, " %s %i %i", filename, &requested, &offset);
/* If no length given save entire legic read buffer */
/* round up to nearest 8 bytes so the saved data can be used with legicload */
if (requested == 0) { if (requested == 0) {
n = 12; requested = 1024;
requested = 12; }
} else { if (requested % 8 != 0) {
n = requested/4; int remainder = requested % 8;
requested = requested + 8 - remainder;
}
if (offset + requested > sizeof(got)) {
PrintAndLog("Tried to read past end of buffer, <bytes> + <offset> > 1024");
return 0;
} }
FILE *f = fopen(filename, "w"); FILE *f = fopen(filename, "w");
@ -290,25 +278,21 @@ int CmdLegicSave(const char *Cmd)
return -1; return -1;
} }
for (int i = offset; i < n+offset; i += 12) { GetFromBigBuf(got,requested,offset);
UsbCommand c = {CMD_DOWNLOAD_RAW_ADC_SAMPLES_125K, {i, 0, 0}}; WaitForResponse(CMD_ACK,NULL);
SendCommand(&c);
WaitForResponse(CMD_DOWNLOADED_RAW_ADC_SAMPLES_125K, NULL); for (int j = 0; j < requested; j += 8) {
for (int j = 0; j < 48; j += 8) { fprintf(f, "%02x %02x %02x %02x %02x %02x %02x %02x\n",
fprintf(f, "%02x %02x %02x %02x %02x %02x %02x %02x\n", got[j+0],
sample_buf[j+0], got[j+1],
sample_buf[j+1], got[j+2],
sample_buf[j+2], got[j+3],
sample_buf[j+3], got[j+4],
sample_buf[j+4], got[j+5],
sample_buf[j+5], got[j+6],
sample_buf[j+6], got[j+7]
sample_buf[j+7] );
); delivered += 8;
delivered += 8;
if (delivered >= requested)
break;
}
if (delivered >= requested) if (delivered >= requested)
break; break;
} }

38
client/cmdhfmf.c
View file

@ -15,33 +15,31 @@ static int CmdHelp(const char *Cmd);
int CmdHF14AMifare(const char *Cmd) int CmdHF14AMifare(const char *Cmd)
{ {
uint32_t uid = 0; uint32_t uid = 0;
uint32_t nt = 0; uint32_t nt = 0, nr = 0;
uint64_t par_list = 0, ks_list = 0, r_key = 0; uint64_t par_list = 0, ks_list = 0, r_key = 0;
uint8_t isOK = 0; uint8_t isOK = 0;
uint8_t keyBlock[8] = {0}; uint8_t keyBlock[8] = {0};
if (param_getchar(Cmd, 0) && param_gethex(Cmd, 0, keyBlock, 8)) { UsbCommand c = {CMD_READER_MIFARE, {true, 0, 0}};
PrintAndLog("Nt must include 8 HEX symbols");
return 1; // message
} printf("-------------------------------------------------------------------------\n");
printf("Executing command. Expected execution time: 25sec on average :-)\n");
printf("Press the key on the proxmark3 device to abort both proxmark3 and client.\n");
printf("-------------------------------------------------------------------------\n");
UsbCommand c = {CMD_READER_MIFARE, {(uint32_t)bytes_to_num(keyBlock, 4), 0, 0}};
start: start:
SendCommand(&c); clearCommandBuffer();
SendCommand(&c);
//flush queue //flush queue
while (ukbhit()) getchar(); while (ukbhit()) getchar();
// message
printf("-------------------------------------------------------------------------\n");
printf("Executing command. It may take up to 30 min.\n");
printf("Press the key on the proxmark3 device to abort both proxmark3 and client.\n");
printf("-------------------------------------------------------------------------\n");
// wait cycle // wait cycle
while (true) { while (true) {
printf("."); printf(".");
fflush(stdout); fflush(stdout);
if (ukbhit()) { if (ukbhit()) {
getchar(); getchar();
@ -50,27 +48,26 @@ start:
} }
UsbCommand resp; UsbCommand resp;
if (WaitForResponseTimeout(CMD_ACK,&resp,2000)) { if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
isOK = resp.arg[0] & 0xff; isOK = resp.arg[0] & 0xff;
uid = (uint32_t)bytes_to_num(resp.d.asBytes + 0, 4); uid = (uint32_t)bytes_to_num(resp.d.asBytes + 0, 4);
nt = (uint32_t)bytes_to_num(resp.d.asBytes + 4, 4); nt = (uint32_t)bytes_to_num(resp.d.asBytes + 4, 4);
par_list = bytes_to_num(resp.d.asBytes + 8, 8); par_list = bytes_to_num(resp.d.asBytes + 8, 8);
ks_list = bytes_to_num(resp.d.asBytes + 16, 8); ks_list = bytes_to_num(resp.d.asBytes + 16, 8);
nr = bytes_to_num(resp.d.asBytes + 24, 4);
printf("\n\n"); printf("\n\n");
PrintAndLog("isOk:%02x", isOK);
if (!isOK) PrintAndLog("Proxmark can't get statistic info. Execution aborted.\n"); if (!isOK) PrintAndLog("Proxmark can't get statistic info. Execution aborted.\n");
break; break;
} }
} }
printf("\n"); printf("\n");
// error // error
if (isOK != 1) return 1; if (isOK != 1) return 1;
// execute original function from util nonce2key // execute original function from util nonce2key
if (nonce2key(uid, nt, par_list, ks_list, &r_key)) if (nonce2key(uid, nt, nr, par_list, ks_list, &r_key))
{ {
isOK = 2; isOK = 2;
PrintAndLog("Key not found (lfsr_common_prefix list is null). Nt=%08x", nt); PrintAndLog("Key not found (lfsr_common_prefix list is null). Nt=%08x", nt);
@ -85,8 +82,9 @@ start:
PrintAndLog("Found valid key:%012"llx, r_key); PrintAndLog("Found valid key:%012"llx, r_key);
else else
{ {
if (isOK != 2) PrintAndLog("Found invalid key. ( Nt=%08x ,Trying use it to run again...", nt); if (isOK != 2) PrintAndLog("Found invalid key. ");
c.arg[0] = nt; PrintAndLog("Failing is expected to happen in 25%% of all cases. Trying again with a different reader nonce...");
c.arg[0] = false;
goto start; goto start;
} }

1
client/cmdmain.c
View file

@ -26,6 +26,7 @@
#include "util.h" #include "util.h"
#include "cmdscript.h" #include "cmdscript.h"
unsigned int current_command = CMD_UNKNOWN; unsigned int current_command = CMD_UNKNOWN;
//unsigned int received_command = CMD_UNKNOWN; //unsigned int received_command = CMD_UNKNOWN;
//UsbCommand current_response; //UsbCommand current_response;

6
client/nonce2key/nonce2key.c
View file

@ -17,12 +17,12 @@
#include "nonce2key.h" #include "nonce2key.h"
#include "ui.h" #include "ui.h"
int nonce2key(uint32_t uid, uint32_t nt, uint64_t par_info, uint64_t ks_info, uint64_t * key) { int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_t ks_info, uint64_t * key) {
struct Crypto1State *state, *state_s; struct Crypto1State *state, *state_s;
uint32_t pos, nr, rr, nr_diff;//, ks1, ks2; uint32_t pos, rr, nr_diff;//, ks1, ks2;
byte_t bt, i, ks3x[8], par[8][8]; byte_t bt, i, ks3x[8], par[8][8];
uint64_t key_recovered; uint64_t key_recovered;
nr = rr = 0; rr = 0;
// Reset the last three significant bits of the reader nonce // Reset the last three significant bits of the reader nonce
nr &= 0xffffff1f; nr &= 0xffffff1f;

2
client/nonce2key/nonce2key.h
View file

@ -18,6 +18,6 @@
#include "crapto1.h" #include "crapto1.h"
#include "common.h" #include "common.h"
int nonce2key(uint32_t uid, uint32_t nt, uint64_t par_info, uint64_t ks_info, uint64_t * key); int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_t ks_info, uint64_t * key);
#endif #endif

2
client/proxmark3.c
View file

@ -26,7 +26,7 @@
static serial_port sp; static serial_port sp;
static UsbCommand txcmd; static UsbCommand txcmd;
static volatile bool txcmd_pending = false; volatile static bool txcmd_pending = false;
void SendCommand(UsbCommand *c) { void SendCommand(UsbCommand *c) {
#if 0 #if 0

3
client/uart.c
View file

@ -290,6 +290,9 @@ bool uart_receive(const serial_port sp, byte_t* pbtRx, size_t* pszRxLen) {
*pszRxLen += res; *pszRxLen += res;
if(res==byteCount)
return true;
} while (byteCount); } while (byteCount);
return true; return true;

1
include/usb_cmd.h
View file

@ -86,6 +86,7 @@ typedef struct {
#define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443 0x0301 #define CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443 0x0301
#define CMD_READ_SRI512_TAG 0x0303 #define CMD_READ_SRI512_TAG 0x0303
#define CMD_READ_SRIX4K_TAG 0x0304 #define CMD_READ_SRIX4K_TAG 0x0304
#define CMD_ISO_14443B_COMMAND 0x0305
#define CMD_READER_ISO_15693 0x0310 #define CMD_READER_ISO_15693 0x0310
#define CMD_SIMTAG_ISO_15693 0x0311 #define CMD_SIMTAG_ISO_15693 0x0311
#define CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693 0x0312 #define CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693 0x0312