github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-19 21:03:48 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

and some more adjustments..

Browse source
This commit is contained in:
iceman1001 2017-08-26 12:59:10 +02:00
commit fda4a25f51
2 changed files with 85 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

77
armsrc/lfops.c
View file

@ -397,14 +397,17 @@ void WriteTItag(uint32_t idhi, uint32_t idlo, uint16_t crc)
void SimulateTagLowFrequency(int period, int gap, int ledcontrol) void SimulateTagLowFrequency(int period, int gap, int ledcontrol)
{ {
#define BREAK_OUT_LIMIT // note this may destroy the bigbuf so be sure this is called before now...
int i = 0; //FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
uint8_t *buf = BigBuf_get_addr();
//FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_TOGGLE_MODE ); //FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT | FPGA_LF_EDGE_DETECT_TOGGLE_MODE );
FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT); FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_EDGE_DETECT);
SpinDelay(20); SpinDelay(20);
#define BREAK_OUT_LIMIT
int i = 0;
uint8_t *buf = BigBuf_get_addr();
// set frequency, get values from 'lf config' command // set frequency, get values from 'lf config' command
sample_config *sc = getSamplingConfig(); sample_config *sc = getSamplingConfig();
@ -415,12 +418,10 @@ void SimulateTagLowFrequency(int period, int gap, int ledcontrol)
else else
FpgaSendCommand(FPGA_CMD_SET_DIVISOR, sc->divisor); FpgaSendCommand(FPGA_CMD_SET_DIVISOR, sc->divisor);
AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK; AT91C_BASE_PIOA->PIO_PER = GPIO_SSC_DOUT | GPIO_SSC_CLK;
AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT; AT91C_BASE_PIOA->PIO_OER = GPIO_SSC_DOUT;
AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK; AT91C_BASE_PIOA->PIO_ODR = GPIO_SSC_CLK;
for(;;) { for(;;) {
if (ledcontrol) LED_D_ON(); if (ledcontrol) LED_D_ON();
@ -467,8 +468,10 @@ OUT:
void SimulateTagLowFrequencyBidir(int divisor, int t0) void SimulateTagLowFrequencyBidir(int divisor, int t0)
{ {
} }
// compose fc/5 fc/8 waveform (FSK1)
// compose fc/8 fc/10 waveform (FSK2) // compose fc/8 fc/10 waveform (FSK2)
// also manchester,
static void fc(int c, int *n) static void fc(int c, int *n)
{ {
uint8_t *dest = BigBuf_get_addr(); uint8_t *dest = BigBuf_get_addr();
@ -516,6 +519,16 @@ static void fc(int c, int *n)
} }
} }
} }
// special start of frame marker containing invalid bit sequences
// this one is focused on HID, with manchester encoding.
static void fcSTT(int *n) {
fc(8, n); fc(8, n); // invalid
fc(8, n); fc(10, n); // logical 0
fc(10, n); fc(10, n); // invalid
fc(8, n); fc(10, n); // logical 0
}
// compose fc/X fc/Y waveform (FSKx) // compose fc/X fc/Y waveform (FSKx)
static void fcAll(uint8_t fc, int *n, uint8_t clock, uint16_t *modCnt) static void fcAll(uint8_t fc, int *n, uint8_t clock, uint16_t *modCnt)
{ {
@ -525,6 +538,7 @@ static void fcAll(uint8_t fc, int *n, uint8_t clock, uint16_t *modCnt)
uint8_t mod = clock % fc; //modifier uint8_t mod = clock % fc; //modifier
uint8_t modAdj = fc/mod; //how often to apply modifier uint8_t modAdj = fc/mod; //how often to apply modifier
bool modAdjOk = !(fc % mod); //if (fc % mod==0) modAdjOk = true; bool modAdjOk = !(fc % mod); //if (fc % mod==0) modAdjOk = true;
// loop through clock - step field clock // loop through clock - step field clock
for (uint8_t idx=0; idx < wavesPerClock; idx++){ for (uint8_t idx=0; idx < wavesPerClock; idx++){
// put 1/2 FC length 1's and 1/2 0's per field clock wave (to create the wave) // put 1/2 FC length 1's and 1/2 0's per field clock wave (to create the wave)
@ -563,21 +577,22 @@ void CmdHIDsimTAG(int hi, int lo, int ledcontrol) {
/* /*
HID tag bitstream format HID tag bitstream format
The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits
A 1 bit is represented as 6 fc8 and 5 fc10 patterns A 1 bit is represented as 6 fc8 and 5 fc10 patterns (manchester 10) during 2 clock periods. (1bit = 1clock period)
A 0 bit is represented as 5 fc10 and 6 fc8 patterns A 0 bit is represented as 5 fc10 and 6 fc8 patterns (manchester 01)
A fc8 is inserted before every 4 bits A fc8 is inserted before every 4 bits
A special start of frame pattern is used consisting a0b0 where a and b are neither 0 A special start of frame pattern is used consisting a0b0 where a and b are neither 0
nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10) nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10)
FSK2a
bit 1 = fc10
bit 0 = fc8
*/ */
fc(0, &n); fc(0, &n);
// special start of frame marker containing invalid bit sequences
fc(8, &n); fc(8, &n); // invalid
fc(8, &n); fc(10, &n); // logical 0
fc(10, &n); fc(10, &n); // invalid
fc(8, &n); fc(10, &n); // logical 0
WDT_HIT(); // special start of frame marker containing invalid bit sequences
fcSTT(&n);
// manchester encode bits 43 to 32 // manchester encode bits 43 to 32
for (i=11; i>=0; i--) { for (i=11; i>=0; i--) {
@ -590,7 +605,6 @@ void CmdHIDsimTAG(int hi, int lo, int ledcontrol) {
} }
} }
WDT_HIT();
// manchester encode bits 31 to 0 // manchester encode bits 31 to 0
for (i=31; i>=0; i--) { for (i=31; i>=0; i--) {
@ -602,7 +616,6 @@ void CmdHIDsimTAG(int hi, int lo, int ledcontrol) {
fc(8, &n); fc(10, &n); // high-low transition fc(8, &n); fc(10, &n); // high-low transition
} }
} }
WDT_HIT();
if (ledcontrol) LED_A_ON(); if (ledcontrol) LED_A_ON();
SimulateTagLowFrequency(n, 0, ledcontrol); SimulateTagLowFrequency(n, 0, ledcontrol);
@ -611,9 +624,8 @@ void CmdHIDsimTAG(int hi, int lo, int ledcontrol) {
// prepare a waveform pattern in the buffer based on the ID given then // prepare a waveform pattern in the buffer based on the ID given then
// simulate a FSK tag until the button is pressed // simulate a FSK tag until the button is pressed
// arg1 contains fcHigh and fcLow, arg2 contains invert and clock // arg1 contains fcHigh and fcLow, arg2 contains STT marker and clock
void CmdFSKsimTAG(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *bits) void CmdFSKsimTAG(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *bits) {
{
FpgaDownloadAndGo(FPGA_BITSTREAM_LF); FpgaDownloadAndGo(FPGA_BITSTREAM_LF);
// free eventually allocated BigBuf memory // free eventually allocated BigBuf memory
@ -626,18 +638,23 @@ void CmdFSKsimTAG(uint16_t arg1, uint16_t arg2, size_t size, uint8_t *bits)
uint8_t fcLow = arg1 & 0xFF; uint8_t fcLow = arg1 & 0xFF;
uint16_t modCnt = 0; uint16_t modCnt = 0;
uint8_t clk = arg2 & 0xFF; uint8_t clk = arg2 & 0xFF;
uint8_t invert = (arg2 >> 8) & 1; uint8_t stt = (arg2 >> 8) & 1;
if ( stt ) {
//int fsktype = ( fcHigh == 8 && fcLow == 5) ? 1 : 2;
//fcSTT(&n);
}
for (i=0; i<size; i++){ for (i=0; i<size; i++){
if (bits[i])
if (bits[i] == invert)
fcAll(fcLow, &n, clk, &modCnt); fcAll(fcLow, &n, clk, &modCnt);
else else
fcAll(fcHigh, &n, clk, &modCnt); fcAll(fcHigh, &n, clk, &modCnt);
} }
WDT_HIT(); WDT_HIT();
Dbprintf("Simulating with fcHigh: %d, fcLow: %d, clk: %d, invert: %d, n: %d", fcHigh, fcLow, clk, invert, n); Dbprintf("Simulating with fcHigh: %d, fcLow: %d, clk: %d, STT: %d, n: %d", fcHigh, fcLow, clk, stt, n);
if (ledcontrol) LED_A_ON(); if (ledcontrol) LED_A_ON();
SimulateTagLowFrequency(n, 0, ledcontrol); SimulateTagLowFrequency(n, 0, ledcontrol);
@ -1438,13 +1455,13 @@ void CopyIOtoT55x7(uint32_t hi, uint32_t lo) {
// Clone Indala 64-bit tag by UID to T55x7 // Clone Indala 64-bit tag by UID to T55x7
void CopyIndala64toT55x7(uint32_t hi, uint32_t lo) { void CopyIndala64toT55x7(uint32_t hi, uint32_t lo) {
//Program the 2 data blocks for supplied 64bit UID //Program the 2 data blocks for supplied 64bit UID
// and the Config for Indala 64 format (RF/32;PSK1 with RF/2;Maxblock=2) // and the Config for Indala 64 format (RF/32;PSK2 with RF/2;Maxblock=2)
uint32_t data[] = { T55x7_BITRATE_RF_32 | T55x7_MODULATION_PSK1 | (2 << T55x7_MAXBLOCK_SHIFT), hi, lo}; uint32_t data[] = { T55x7_BITRATE_RF_32 | T55x7_MODULATION_PSK2 | (2 << T55x7_MAXBLOCK_SHIFT), hi, lo};
//TODO add selection of chip for Q5 or T55x7 //TODO add selection of chip for Q5 or T55x7
// data[0] = T5555_SET_BITRATE(32 | T5555_MODULATION_PSK1 | 2 << T5555_MAXBLOCK_SHIFT; // data[0] = T5555_SET_BITRATE(32 | T5555_MODULATION_PSK2 | 2 << T5555_MAXBLOCK_SHIFT;
WriteT55xx(data, 0, 3); WriteT55xx(data, 0, 3);
//Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=2;Inverse data) //Alternative config for Indala (Extended mode;RF/32;PSK2 with RF/2;Maxblock=2;Inverse data)
// T5567WriteBlock(0x603E1042,0); // T5567WriteBlock(0x603E1042,0);
} }
// Clone Indala 224-bit tag by UID to T55x7 // Clone Indala 224-bit tag by UID to T55x7
@ -1452,12 +1469,12 @@ void CopyIndala224toT55x7(uint32_t uid1, uint32_t uid2, uint32_t uid3, uint32_t
//Program the 7 data blocks for supplied 224bit UID //Program the 7 data blocks for supplied 224bit UID
uint32_t data[] = {0, uid1, uid2, uid3, uid4, uid5, uid6, uid7}; uint32_t data[] = {0, uid1, uid2, uid3, uid4, uid5, uid6, uid7};
// and the block 0 for Indala224 format // and the block 0 for Indala224 format
//Config for Indala (RF/32;PSK1 with RF/2;Maxblock=7) //Config for Indala (RF/32;PSK2 with RF/2;Maxblock=7)
data[0] = T55x7_BITRATE_RF_32 | T55x7_MODULATION_PSK1 | (7 << T55x7_MAXBLOCK_SHIFT); data[0] = T55x7_BITRATE_RF_32 | T55x7_MODULATION_PSK2 | (7 << T55x7_MAXBLOCK_SHIFT);
//TODO add selection of chip for Q5 or T55x7 //TODO add selection of chip for Q5 or T55x7
// data[0] = T5555_SET_BITRATE(32 | T5555_MODULATION_PSK1 | 7 << T5555_MAXBLOCK_SHIFT; // data[0] = T5555_SET_BITRATE(32 | T5555_MODULATION_PSK2 | 7 << T5555_MAXBLOCK_SHIFT;
WriteT55xx(data, 0, 8); WriteT55xx(data, 0, 8);
//Alternative config for Indala (Extended mode;RF/32;PSK1 with RF/2;Maxblock=7;Inverse data) //Alternative config for Indala (Extended mode;RF/32;PSK2 with RF/2;Maxblock=7;Inverse data)
// T5567WriteBlock(0x603E10E2,0); // T5567WriteBlock(0x603E10E2,0);
} }
// clone viking tag to T55xx // clone viking tag to T55xx

76
client/cmdhf.c
View file

@ -467,8 +467,8 @@ uint8_t iclass_CRC_check(bool isResponse, uint8_t* data, uint8_t len)
uint8_t b1, b2; uint8_t b1, b2;
if(!isResponse)//Commands to tag //Commands to tag
{ if (!isResponse) {
/** /**
These commands should have CRC. Total length leftmost These commands should have CRC. Total length leftmost
4 READ 4 READ
@ -477,40 +477,39 @@ uint8_t iclass_CRC_check(bool isResponse, uint8_t* data, uint8_t len)
14 UPDATE - secured, ends with signature instead 14 UPDATE - secured, ends with signature instead
4 PAGESEL 4 PAGESEL
**/ **/
if(len == 4 || len == 12)//Covers three of them //Covers three of them
{ if(len == 4 || len == 12) {
//Don't include the command byte //Don't include the command byte
ComputeCrc14443(CRC_ICLASS, (data+1), len-3, &b1, &b2); ComputeCrc14443(CRC_ICLASS, (data+1), len-3, &b1, &b2);
return b1 == data[len -2] && b2 == data[len-1]; return b1 == data[len -2] && b2 == data[len-1];
} }
return 2; return 2;
}else{
/**
These tag responses should have CRC. Total length leftmost
10 READ data[8] crc[2]
34 READ4 data[32]crc[2]
10 UPDATE data[8] crc[2]
10 SELECT csn[8] crc[2]
10 IDENTIFY asnb[8] crc[2]
10 PAGESEL block1[8] crc[2]
10 DETECT csn[8] crc[2]
These should not
4 CHECK chip_response[4]
8 READCHECK data[8]
1 ACTALL sof[1]
1 ACT sof[1]
In conclusion, without looking at the command; any response
of length 10 or 34 should have CRC
**/
if(len != 10 && len != 34) return true;
ComputeCrc14443(CRC_ICLASS, data, len-2, &b1, &b2);
return b1 == data[len -2] && b2 == data[len-1];
} }
/**
These tag responses should have CRC. Total length leftmost
10 READ data[8] crc[2]
34 READ4 data[32]crc[2]
10 UPDATE data[8] crc[2]
10 SELECT csn[8] crc[2]
10 IDENTIFY asnb[8] crc[2]
10 PAGESEL block1[8] crc[2]
10 DETECT csn[8] crc[2]
These should not
4 CHECK chip_response[4]
8 READCHECK data[8]
1 ACTALL sof[1]
1 ACT sof[1]
In conclusion, without looking at the command; any response
of length 10 or 34 should have CRC
**/
if(len != 10 && len != 34) return true;
ComputeCrc14443(CRC_ICLASS, data, len-2, &b1, &b2);
return b1 == data[len -2] && b2 == data[len-1];
} }
bool is_last_record(uint16_t tracepos, uint8_t *trace, uint16_t traceLen) bool is_last_record(uint16_t tracepos, uint8_t *trace, uint16_t traceLen)
@ -568,21 +567,22 @@ bool merge_topaz_reader_frames(uint32_t timestamp, uint32_t *duration, uint16_t
uint16_t printTraceLine(uint16_t tracepos, uint16_t traceLen, uint8_t *trace, uint8_t protocol, bool showWaitCycles, bool markCRCBytes) uint16_t printTraceLine(uint16_t tracepos, uint16_t traceLen, uint8_t *trace, uint8_t protocol, bool showWaitCycles, bool markCRCBytes)
{ {
// sanity check
if (tracepos + sizeof(uint32_t) + sizeof(uint16_t) + sizeof(uint16_t) > traceLen) return traceLen;
bool isResponse; bool isResponse;
uint16_t data_len, parity_len; uint16_t data_len, parity_len;
uint32_t duration; uint32_t duration, timestamp, first_timestamp, EndOfTransmissionTimestamp;
uint8_t topaz_reader_command[9]; uint8_t topaz_reader_command[9];
uint32_t timestamp, first_timestamp, EndOfTransmissionTimestamp;
char explanation[30] = {0}; char explanation[30] = {0};
if (tracepos + sizeof(uint32_t) + sizeof(uint16_t) + sizeof(uint16_t) > traceLen) return traceLen;
first_timestamp = *((uint32_t *)(trace)); first_timestamp = *((uint32_t *)(trace));
timestamp = *((uint32_t *)(trace + tracepos)); timestamp = *((uint32_t *)(trace + tracepos));
tracepos += 4; tracepos += 4;
duration = *((uint16_t *)(trace + tracepos)); duration = *((uint16_t *)(trace + tracepos));
tracepos += 2; tracepos += 2;
data_len = *((uint16_t *)(trace + tracepos)); data_len = *((uint16_t *)(trace + tracepos));
tracepos += 2; tracepos += 2;
@ -640,7 +640,11 @@ uint16_t printTraceLine(uint16_t tracepos, uint16_t traceLen, uint8_t *trace, ui
for (int j = 0; j < data_len && j/16 < 16; j++) { for (int j = 0; j < data_len && j/16 < 16; j++) {
uint8_t parityBits = parityBytes[j>>3]; uint8_t parityBits = parityBytes[j>>3];
if (protocol != LEGIC && protocol != ISO_14443B && protocol != ISO_7816_4 && (isResponse || protocol == ISO_14443A) && (oddparity8(frame[j]) != ((parityBits >> (7-(j&0x0007))) & 0x01))) { if (protocol != LEGIC &&
protocol != ISO_14443B &&
protocol != ISO_7816_4 &&
(isResponse || protocol == ISO_14443A) &&
(oddparity8(frame[j]) != ((parityBits >> (7-(j&0x0007))) & 0x01))) {
snprintf(line[j/16]+(( j % 16) * 4),110, "%02x! ", frame[j]); snprintf(line[j/16]+(( j % 16) * 4),110, "%02x! ", frame[j]);
} else { } else {
snprintf(line[j/16]+(( j % 16) * 4),110, "%02x ", frame[j]); snprintf(line[j/16]+(( j % 16) * 4),110, "%02x ", frame[j]);