Merge branch 'master' of https://github.com/Proxmark/proxmark3

Conflicts:
	armsrc/iclass.c

armsrc/BigBuf.c

@@ -224,3 +224,16 @@ int LogTraceHitag(const uint8_t * btBytes, int iBits, int iSamples, uint32_t dwP
 
 	return TRUE;
 }
+// Emulator memory
+uint8_t emlSet(uint8_t *data, uint32_t offset, uint32_t length){
+	uint8_t* mem = BigBuf_get_EM_addr();
+	if(offset+length < CARD_MEMORY_SIZE)
+	{
+		memcpy(mem+offset, data, length);
+		return 0;
+	}else
+	{
+		Dbprintf("Error, trying to set memory outside of bounds! %d  > %d", (offset+length), CARD_MEMORY_SIZE);
+		return 1;
+	}
+}

armsrc/BigBuf.h

@@ -34,4 +34,5 @@ void clear_trace();
 void set_tracing(bool enable);
 bool RAMFUNC LogTrace(const uint8_t *btBytes, uint16_t iLen, uint32_t timestamp_start, uint32_t timestamp_end, uint8_t *parity, bool readerToTag);
 int LogTraceHitag(const uint8_t * btBytes, int iBits, int iSamples, uint32_t dwParity, int bReader);
+uint8_t emlSet(uint8_t *data, uint32_t offset, uint32_t length);
 #endif /* __BIGBUF_H */

armsrc/appmain.c

@@ -902,6 +902,9 @@ void UsbPacketReceived(uint8_t *packet, int len)
 		case CMD_READER_ICLASS_REPLAY:
 		        ReaderIClass_Replay(c->arg[0], c->d.asBytes);
 			break;
+	case CMD_ICLASS_EML_MEMSET:
+			emlSet(c->d.asBytes,c->arg[0], c->arg[1]);
+			break;
 #endif
 
 		case CMD_SIMULATE_TAG_HF_LISTEN:

armsrc/iclass.c

@@ -1706,7 +1706,7 @@ void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
 		//Set card_data to all zeroes, we'll fill it with data
 		memset(card_data,0x0,USB_CMD_DATA_SIZE);
 		uint8_t failedRead =0;
-		uint8_t stored_data_length =0;
+		uint32_t stored_data_length =0;
 				//then loop around remaining blocks
 		for(int block=0; block < cardsize; block++){
 
@@ -1725,7 +1725,6 @@ void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
 				//Fill up the buffer
 				memcpy(card_data+stored_data_length,resp,8);
 				stored_data_length += 8;
-
 				if(stored_data_length +8 > USB_CMD_DATA_SIZE)
 				{//Time to send this off and start afresh
 					cmd_send(CMD_ACK,
@@ -1744,6 +1743,7 @@ void ReaderIClass_Replay(uint8_t arg0, uint8_t *MAC) {
 				Dbprintf("Failed to dump block %d", block);
 			}
 		}
+
 		//Send off any remaining data
 		if(stored_data_length > 0)
 		{

armsrc/lfops.c

@@ -1286,9 +1286,10 @@ void CopyIndala224toT55x7(int uid1, int uid2, int uid3, int uid4, int uid5, int
 #define max(x,y) ( x<y ? y:x)
 
 int DemodPCF7931(uint8_t **outBlocks) {
-    uint8_t BitStream[256];
+
-    uint8_t Blocks[8][16];
+    uint8_t BitStream[256] = {0x00};
-    uint8_t *GraphBuffer = BigBuf_get_addr();
+	uint8_t Blocks[8][16] = [0x00};
+    uint8_t *dest = BigBuf_get_addr();
     int GraphTraceLen = BigBuf_max_traceLen();
     int i, j, lastval, bitidx, half_switch;
     int clock = 64;
@@ -1300,8 +1301,7 @@ int DemodPCF7931(uint8_t **outBlocks) {
     uint8_t dir;
 
 	LFSetupFPGAForADC(95, true);
-	DoAcquisition_default(0, 0);
+	DoAcquisition_default(0, true);
-
 
     lmin = 64;
     lmax = 192;
@@ -1309,9 +1309,9 @@ int DemodPCF7931(uint8_t **outBlocks) {
     i = 2;
 
     /* Find first local max/min */
-    if(GraphBuffer[1] > GraphBuffer[0]) {
+    if(dest[1] > dest[0]) {
         while(i < GraphTraceLen) {
-            if( !(GraphBuffer[i] > GraphBuffer[i-1]) && GraphBuffer[i] > lmax)
+            if( !(dest[i] > dest[i-1]) && dest[i] > lmax)
                 break;
             i++;
         }
@@ -1319,7 +1319,7 @@ int DemodPCF7931(uint8_t **outBlocks) {
     }
     else {
         while(i < GraphTraceLen) {
-            if( !(GraphBuffer[i] < GraphBuffer[i-1]) && GraphBuffer[i] < lmin)
+            if( !(dest[i] < dest[i-1]) && v[i] < lmin)
                 break;
             i++;
         }
@@ -1333,7 +1333,7 @@ int DemodPCF7931(uint8_t **outBlocks) {
 
     for (bitidx = 0; i < GraphTraceLen; i++)
     {
-        if ( (GraphBuffer[i-1] > GraphBuffer[i] && dir == 1 && GraphBuffer[i] > lmax) || (GraphBuffer[i-1] < GraphBuffer[i] && dir == 0 && GraphBuffer[i] < lmin))
+        if ( (dest[i-1] > dest[i] && dir == 1 && dest[i] > lmax) || (dest[i-1] < dest[i] && dir == 0 && dest[i] < lmin))
         {
             lc = i - lastval;
             lastval = i;
@@ -1400,7 +1400,7 @@ int DemodPCF7931(uint8_t **outBlocks) {
             }
             if(i < GraphTraceLen)
             {
-                if (GraphBuffer[i-1] > GraphBuffer[i]) dir=0;
+                if (dest[i-1] > dest[i]) dir=0;
                 else dir = 1;
             }
         }

armsrc/lfsampling.c

@@ -13,7 +13,7 @@
 
 #include "lfsampling.h"
 
-sample_config config = { 1, 8, 1, 88, 0 } ;
+sample_config config = { 1, 8, 1, 95, 0 } ;
 
 void printConfig()
 {

client/cmdhficlass.c

@@ -329,8 +329,8 @@ int CmdHFiClassReader_Dump(const char *Cmd)
 	printvar("MAC", MAC, 4);
 
 	uint8_t iclass_data[32000] = {0};
-	uint8_t iclass_datalen = 0;
+	uint32_t iclass_datalen = 0;
-	uint8_t iclass_blocksFailed = 0;//Set to 1 if dump was incomplete
+	uint32_t iclass_blocksFailed = 0;//Set to 1 if dump was incomplete
 
 	UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
 	memcpy(d.d.asBytes, MAC, 4);
@@ -346,11 +346,11 @@ int CmdHFiClassReader_Dump(const char *Cmd)
 		}
 		if(WaitForResponseTimeout(CMD_ACK,&resp,4500))
 		{
-			uint64_t dataLength = resp.arg[0];
+			uint32_t dataLength = resp.arg[0];
 			iclass_blocksFailed |= resp.arg[1];
-
 			if(dataLength > 0)
 			{
+				PrintAndLog("Got %d bytes data (total so far %d)" ,dataLength,iclass_datalen);
 				memcpy(iclass_data, resp.d.asBytes,dataLength);
 				iclass_datalen += dataLength;
 			}else
@@ -368,7 +368,6 @@ int CmdHFiClassReader_Dump(const char *Cmd)
 							 CSN[0],CSN[1],CSN[2],CSN[3],
 							CSN[4],CSN[5],CSN[6],CSN[7]);
 					saveFile(filename,"bin",iclass_data, iclass_datalen );
-
 				}
 				//Aaaand we're finished
 				return 0;
@@ -380,6 +379,78 @@ int CmdHFiClassReader_Dump(const char *Cmd)
 	return 0;
 }
 
+int hf_iclass_eload_usage()
+{
+	PrintAndLog("Loads iclass tag-dump into emulator memory on device");
+	PrintAndLog("Usage:  hf iclass eload f <filename>");
+	PrintAndLog("");
+	PrintAndLog("Example: hf iclass eload f iclass_tagdump-aa162d30f8ff12f1.bin");
+	return 0;
+
+}
+
+int iclassEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
+	UsbCommand c = {CMD_MIFARE_EML_MEMSET, {blockNum, blocksCount, 0}};
+	memcpy(c.d.asBytes, data, blocksCount * 16);
+	SendCommand(&c);
+	return 0;
+}
+int CmdHFiClassELoad(const char *Cmd)
+{
+
+	char opt = param_getchar(Cmd, 0);
+	if (strlen(Cmd)<1 || opt == 'h')
+		return hf_iclass_eload_usage();
+
+	//File handling and reading
+	FILE *f;
+	char filename[FILE_PATH_SIZE];
+	if(opt == 'f' && param_getstr(Cmd, 1, filename) > 0)
+	{
+		f = fopen(filename, "rb");
+	}else{
+		return hf_iclass_eload_usage();
+	}
+
+	if(!f) {
+		PrintAndLog("Failed to read from file '%s'", filename);
+		return 1;
+	}
+
+	fseek(f, 0, SEEK_END);
+	long fsize = ftell(f);
+	fseek(f, 0, SEEK_SET);
+
+	uint8_t *dump = malloc(fsize);
+	size_t bytes_read = fread(dump, 1, fsize, f);
+	fclose(f);
+
+	//Validate
+
+	if (bytes_read < fsize)
+	{
+		prnlog("Error, could only read %d bytes (should be %d)",bytes_read, fsize );
+		free(dump);
+		return 1;
+	}
+	//Send to device
+	uint32_t bytes_sent = 0;
+	uint32_t bytes_remaining  = bytes_read;
+
+	while(bytes_remaining > 0){
+		uint32_t bytes_in_packet = MIN(USB_CMD_DATA_SIZE, bytes_remaining);
+		UsbCommand c = {CMD_ICLASS_EML_MEMSET, {bytes_sent,bytes_in_packet,0}};
+		memcpy(c.d.asBytes, dump, bytes_in_packet);
+		SendCommand(&c);
+		bytes_remaining -= bytes_in_packet;
+		bytes_sent += bytes_in_packet;
+	}
+	free(dump);
+	PrintAndLog("Sent %d bytes of data to device emulator memory", bytes_sent);
+	return 0;
+}
+
+
 int CmdHFiClass_iso14443A_write(const char *Cmd)
 {
 	uint8_t readerType = 0;
@@ -512,8 +583,9 @@ static command_t CommandTable[] =
 	{"reader",CmdHFiClassReader,	0,	"Read an iClass tag"},
 	{"replay",CmdHFiClassReader_Replay,	0,	"Read an iClass tag via Reply Attack"},
 	{"dump",	CmdHFiClassReader_Dump,	0,		"Authenticate and Dump iClass tag"},
-	{"write",	CmdHFiClass_iso14443A_write,	0,	"Authenticate and Write iClass block"},
+//	{"write",	CmdHFiClass_iso14443A_write,	0,	"Authenticate and Write iClass block"},
 	{"loclass",	CmdHFiClass_loclass,	1,	"Use loclass to perform bruteforce of reader attack dump"},
+	{"eload",   CmdHFiClassELoad,    0,     "[experimental] Load data into iclass emulator memory"},
 	{NULL, NULL, 0, NULL}
 };
 

include/usb_cmd.h

@@ -132,6 +132,7 @@ typedef struct{
 #define CMD_READER_ICLASS                                                 0x0394
 #define CMD_READER_ICLASS_REPLAY										  0x0395
 #define CMD_ICLASS_ISO14443A_WRITE										  0x0397
+#define CMD_ICLASS_EML_MEMSET                                             0x0398
 
 // For measurements of the antenna tuning
 #define CMD_MEASURE_ANTENNA_TUNING                                        0x0400