mirror of
https://github.com/Proxmark/proxmark3.git
synced 2025-08-19 04:49:38 -07:00
fixed #541
This commit is contained in:
merlokk
parent
feb328c90a
commit
3544b99715
1 changed files with 174 additions and 167 deletions
|
|
@ -1,177 +1,184 @@
|
||||||
//-----------------------------------------------------------------------------
|
//-----------------------------------------------------------------------------
|
||||||
// Merlok - 2012
|
// Merlok - 2012
|
||||||
//
|
//
|
||||||
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
|
||||||
// at your option, any later version. See the LICENSE.txt file for the text of
|
// at your option, any later version. See the LICENSE.txt file for the text of
|
||||||
// the license.
|
// the license.
|
||||||
//-----------------------------------------------------------------------------
|
//-----------------------------------------------------------------------------
|
||||||
// Routines to support mifare classic sniffer.
|
// Routines to support mifare classic sniffer.
|
||||||
//-----------------------------------------------------------------------------
|
//-----------------------------------------------------------------------------
|
||||||
|
|
||||||
#include "mifaresniff.h"
|
#include "mifaresniff.h"
|
||||||
#include "apps.h"
|
#include "apps.h"
|
||||||
#include "proxmark3.h"
|
#include "proxmark3.h"
|
||||||
#include "util.h"
|
#include "util.h"
|
||||||
#include "string.h"
|
#include "string.h"
|
||||||
#include "iso14443crc.h"
|
#include "iso14443crc.h"
|
||||||
#include "iso14443a.h"
|
#include "iso14443a.h"
|
||||||
#include "crapto1/crapto1.h"
|
#include "crapto1/crapto1.h"
|
||||||
#include "mifareutil.h"
|
#include "mifareutil.h"
|
||||||
#include "common.h"
|
#include "common.h"
|
||||||
|
|
||||||
|
|
||||||
static int sniffState = SNF_INIT;
|
static int sniffState = SNF_INIT;
|
||||||
static uint8_t sniffUIDType;
|
static uint8_t sniffUIDType;
|
||||||
static uint8_t sniffUID[8] = {0x00};
|
static uint8_t sniffUID[8] = {0x00};
|
||||||
static uint8_t sniffATQA[2] = {0x00};
|
static uint8_t sniffATQA[2] = {0x00};
|
||||||
static uint8_t sniffSAK;
|
static uint8_t sniffSAK;
|
||||||
static uint8_t sniffBuf[16] = {0x00};
|
static uint8_t sniffBuf[16] = {0x00};
|
||||||
static uint32_t timerData = 0;
|
static uint32_t timerData = 0;
|
||||||
|
|
||||||
|
|
||||||
bool MfSniffInit(void){
|
bool MfSniffInit(void){
|
||||||
memset(sniffUID, 0x00, 8);
|
memset(sniffUID, 0x00, 8);
|
||||||
memset(sniffATQA, 0x00, 2);
|
memset(sniffATQA, 0x00, 2);
|
||||||
sniffSAK = 0;
|
sniffSAK = 0;
|
||||||
sniffUIDType = SNF_UID_4;
|
sniffUIDType = SNF_UID_4;
|
||||||
|
|
||||||
return FALSE;
|
return FALSE;
|
||||||
}
|
}
|
||||||
|
|
||||||
bool MfSniffEnd(void){
|
bool MfSniffEnd(void){
|
||||||
LED_B_ON();
|
LED_B_ON();
|
||||||
cmd_send(CMD_ACK,0,0,0,0,0);
|
cmd_send(CMD_ACK,0,0,0,0,0);
|
||||||
LED_B_OFF();
|
LED_B_OFF();
|
||||||
|
|
||||||
return FALSE;
|
return FALSE;
|
||||||
}
|
}
|
||||||
|
|
||||||
bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint8_t *parity, uint16_t bitCnt, bool reader) {
|
bool RAMFUNC MfSniffLogic(const uint8_t *data, uint16_t len, uint8_t *parity, uint16_t bitCnt, bool reader) {
|
||||||
|
|
||||||
if (reader && (len == 1) && (bitCnt == 7)) { // reset on 7-Bit commands from reader
|
if (reader && (len == 1) && (bitCnt == 7)) { // reset on 7-Bit commands from reader
|
||||||
sniffState = SNF_INIT;
|
sniffState = SNF_INIT;
|
||||||
}
|
}
|
||||||
|
|
||||||
switch (sniffState) {
|
switch (sniffState) {
|
||||||
case SNF_INIT:{
|
case SNF_INIT:{
|
||||||
if ((len == 1) && (reader) && (bitCnt == 7) ) { // REQA or WUPA from reader
|
if ((len == 1) && (reader) && (bitCnt == 7) ) { // REQA or WUPA from reader
|
||||||
sniffUIDType = SNF_UID_4;
|
sniffUIDType = SNF_UID_4;
|
||||||
memset(sniffUID, 0x00, 8);
|
memset(sniffUID, 0x00, 8);
|
||||||
memset(sniffATQA, 0x00, 2);
|
memset(sniffATQA, 0x00, 2);
|
||||||
sniffSAK = 0;
|
sniffSAK = 0;
|
||||||
sniffState = SNF_WUPREQ;
|
sniffState = SNF_WUPREQ;
|
||||||
}
|
}
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
case SNF_WUPREQ:{
|
case SNF_WUPREQ:{
|
||||||
if ((!reader) && (len == 2)) { // ATQA from tag
|
if ((!reader) && (len == 2)) { // ATQA from tag
|
||||||
memcpy(sniffATQA, data, 2);
|
memcpy(sniffATQA, data, 2);
|
||||||
sniffState = SNF_ATQA;
|
sniffState = SNF_ATQA;
|
||||||
}
|
}
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
case SNF_ATQA:{
|
case SNF_ATQA:
|
||||||
if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20)) { // Select ALL from reader
|
|
||||||
sniffState = SNF_ANTICOL1;
|
|
||||||
}
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
case SNF_ANTICOL1:{
|
|
||||||
if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // UID from tag (CL1)
|
|
||||||
memcpy(sniffUID + 3, data, 4);
|
|
||||||
sniffState = SNF_UID1;
|
|
||||||
}
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
case SNF_UID1:{
|
case SNF_UID1:{
|
||||||
|
// SNF_ATQA
|
||||||
|
if ((reader) && (len == 2) && (data[0] == 0x93) && (data[1] == 0x20)) { // Select ALL from reader
|
||||||
|
sniffState = SNF_ANTICOL1;
|
||||||
|
}
|
||||||
|
|
||||||
|
// SNF_UID1
|
||||||
if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 4 Byte UID from reader
|
if ((reader) && (len == 9) && (data[0] == 0x93) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 4 Byte UID from reader
|
||||||
|
memcpy(sniffUID + 3, &data[2], 4);
|
||||||
sniffState = SNF_SAK;
|
sniffState = SNF_SAK;
|
||||||
}
|
}
|
||||||
break;
|
break;
|
||||||
}
|
|
||||||
case SNF_SAK:{
|
|
||||||
if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card?
|
|
||||||
sniffSAK = data[0];
|
|
||||||
if (sniffUID[3] == 0x88) { // CL2 UID part to be expected
|
|
||||||
sniffState = SNF_ANTICOL2;
|
|
||||||
} else { // select completed
|
|
||||||
sniffState = SNF_CARD_IDLE;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
case SNF_ANTICOL2:{
|
|
||||||
if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // CL2 UID
|
|
||||||
memcpy(sniffUID, sniffUID+4, 3);
|
|
||||||
memcpy(sniffUID+3, data, 4);
|
|
||||||
sniffUIDType = SNF_UID_7;
|
|
||||||
sniffState = SNF_UID2;
|
|
||||||
}
|
|
||||||
break;
|
|
||||||
}
|
}
|
||||||
|
case SNF_ANTICOL1:{
|
||||||
|
if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // UID from tag (CL1)
|
||||||
|
memcpy(sniffUID + 3, data, 4);
|
||||||
|
sniffState = SNF_UID1;
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
case SNF_SAK:{
|
||||||
|
if ((!reader) && (len == 3) && (CheckCrc14443(CRC_14443_A, data, 3))) { // SAK from card?
|
||||||
|
sniffSAK = data[0];
|
||||||
|
if ((sniffUID[3] == 0x88) && (sniffUIDType == SNF_UID_4)) { // CL2 UID part to be expected
|
||||||
|
sniffUIDType = SNF_UID_7;
|
||||||
|
memcpy(sniffUID, sniffUID + 4, 3);
|
||||||
|
sniffState = SNF_UID2;
|
||||||
|
} else { // select completed
|
||||||
|
sniffState = SNF_CARD_IDLE;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
case SNF_ANTICOL2:{
|
||||||
|
if ((!reader) && (len == 5) && ((data[0] ^ data[1] ^ data[2] ^ data[3]) == data[4])) { // CL2 UID
|
||||||
|
memcpy(sniffUID + 3, data, 4);
|
||||||
|
sniffState = SNF_UID2;
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
}
|
||||||
case SNF_UID2:{
|
case SNF_UID2:{
|
||||||
if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) { // Select 2nd part of 7 Byte UID
|
if ((reader) && (len == 2) && (data[0] == 0x95) && (data[1] == 0x20)) {
|
||||||
|
sniffState = SNF_ANTICOL2;
|
||||||
|
}
|
||||||
|
|
||||||
|
if ((reader) && (len == 9) && (data[0] == 0x95) && (data[1] == 0x70) && (CheckCrc14443(CRC_14443_A, data, 9))) {
|
||||||
|
memcpy(sniffUID + 3, &data[2], 4);
|
||||||
sniffState = SNF_SAK;
|
sniffState = SNF_SAK;
|
||||||
}
|
}
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
case SNF_CARD_IDLE:{ // trace the card select sequence
|
case SNF_CARD_IDLE:{ // trace the card select sequence
|
||||||
sniffBuf[0] = 0xFF;
|
sniffBuf[0] = 0xFF;
|
||||||
sniffBuf[1] = 0xFF;
|
sniffBuf[1] = 0xFF;
|
||||||
memcpy(sniffBuf + 2, sniffUID, 7);
|
memcpy(sniffBuf + 2, sniffUID, 7);
|
||||||
memcpy(sniffBuf + 9, sniffATQA, 2);
|
memcpy(sniffBuf + 9, sniffATQA, 2);
|
||||||
sniffBuf[11] = sniffSAK;
|
sniffBuf[11] = sniffSAK;
|
||||||
sniffBuf[12] = 0xFF;
|
sniffBuf[12] = 0xFF;
|
||||||
sniffBuf[13] = 0xFF;
|
sniffBuf[13] = 0xFF;
|
||||||
LogTrace(sniffBuf, 14, 0, 0, NULL, TRUE);
|
LogTrace(sniffBuf, 14, 0, 0, NULL, TRUE);
|
||||||
sniffState = SNF_CARD_CMD;
|
sniffState = SNF_CARD_CMD;
|
||||||
} // intentionally no break;
|
} // intentionally no break;
|
||||||
case SNF_CARD_CMD:{
|
case SNF_CARD_CMD:{
|
||||||
LogTrace(data, len, 0, 0, NULL, reader);
|
LogTrace(data, len, 0, 0, NULL, reader);
|
||||||
timerData = GetTickCount();
|
timerData = GetTickCount();
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
|
||||||
default:
|
default:
|
||||||
sniffState = SNF_INIT;
|
sniffState = SNF_INIT;
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
return FALSE;
|
return FALSE;
|
||||||
}
|
}
|
||||||
|
|
||||||
bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) {
|
bool RAMFUNC MfSniffSend(uint16_t maxTimeoutMs) {
|
||||||
if (BigBuf_get_traceLen() && (GetTickCount() > timerData + maxTimeoutMs)) {
|
if (BigBuf_get_traceLen() && (GetTickCount() > timerData + maxTimeoutMs)) {
|
||||||
return intMfSniffSend();
|
return intMfSniffSend();
|
||||||
}
|
}
|
||||||
return FALSE;
|
return FALSE;
|
||||||
}
|
}
|
||||||
|
|
||||||
// internal sending function. not a RAMFUNC.
|
// internal sending function. not a RAMFUNC.
|
||||||
bool intMfSniffSend() {
|
bool intMfSniffSend() {
|
||||||
|
|
||||||
int pckSize = 0;
|
int pckSize = 0;
|
||||||
int pckLen = BigBuf_get_traceLen();
|
int pckLen = BigBuf_get_traceLen();
|
||||||
int pckNum = 0;
|
int pckNum = 0;
|
||||||
uint8_t *trace = BigBuf_get_addr();
|
uint8_t *trace = BigBuf_get_addr();
|
||||||
|
|
||||||
FpgaDisableSscDma();
|
FpgaDisableSscDma();
|
||||||
while (pckLen > 0) {
|
while (pckLen > 0) {
|
||||||
pckSize = MIN(USB_CMD_DATA_SIZE, pckLen);
|
pckSize = MIN(USB_CMD_DATA_SIZE, pckLen);
|
||||||
LED_B_ON();
|
LED_B_ON();
|
||||||
cmd_send(CMD_ACK, 1, BigBuf_get_traceLen(), pckSize, trace + BigBuf_get_traceLen() - pckLen, pckSize);
|
cmd_send(CMD_ACK, 1, BigBuf_get_traceLen(), pckSize, trace + BigBuf_get_traceLen() - pckLen, pckSize);
|
||||||
LED_B_OFF();
|
LED_B_OFF();
|
||||||
|
|
||||||
pckLen -= pckSize;
|
pckLen -= pckSize;
|
||||||
pckNum++;
|
pckNum++;
|
||||||
}
|
}
|
||||||
|
|
||||||
LED_B_ON();
|
LED_B_ON();
|
||||||
cmd_send(CMD_ACK,2,0,0,0,0);
|
cmd_send(CMD_ACK,2,0,0,0,0);
|
||||||
LED_B_OFF();
|
LED_B_OFF();
|
||||||
|
|
||||||
clear_trace();
|
clear_trace();
|
||||||
|
|
||||||
return TRUE;
|
return TRUE;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue