mirror of
https://github.com/Proxmark/proxmark3.git
synced 2025-08-20 13:23:25 -07:00
bugfixes iso14443a (hf 14a commands)
- buffers were too small to handle 256 byte frames - parity bits were only handled for up to 32 byte frames - trace format was inefficient - removed parity calculation from decoders in iclass.c (parity not used on air anyway)
This commit is contained in:
pwpiwi
parent
ca4714cd23
commit
6a1f2d82bb
15 changed files with 732 additions and 686 deletions
|
|
@ -43,10 +43,13 @@ int CmdHF14AList(const char *Cmd)
|
|||
if (param == 'f') {
|
||||
ShowWaitCycles = true;
|
||||
}
|
||||
|
||||
uint8_t got[1920];
|
||||
GetFromBigBuf(got,sizeof(got),0);
|
||||
WaitForResponse(CMD_ACK,NULL);
|
||||
|
||||
// for the time being. Need better Bigbuf handling.
|
||||
#define TRACE_SIZE 3000
|
||||
|
||||
uint8_t trace[TRACE_SIZE];
|
||||
GetFromBigBuf(trace, TRACE_SIZE, 0);
|
||||
WaitForResponse(CMD_ACK, NULL);
|
||||
|
||||
PrintAndLog("Recorded Activity");
|
||||
PrintAndLog("");
|
||||
|
|
@ -56,123 +59,105 @@ int CmdHF14AList(const char *Cmd)
|
|||
PrintAndLog(" Start | End | Src | Data");
|
||||
PrintAndLog("-----------|-----------|-----|--------");
|
||||
|
||||
int i = 0;
|
||||
uint32_t first_timestamp = 0;
|
||||
uint16_t tracepos = 0;
|
||||
uint16_t duration;
|
||||
uint16_t data_len;
|
||||
uint16_t parity_len;
|
||||
bool isResponse;
|
||||
uint32_t timestamp;
|
||||
uint32_t EndOfTransmissionTimestamp = 0;
|
||||
uint32_t first_timestamp;
|
||||
uint32_t EndOfTransmissionTimestamp;
|
||||
|
||||
for (;;) {
|
||||
if(i >= 1900) {
|
||||
|
||||
if(tracepos >= TRACE_SIZE) {
|
||||
break;
|
||||
}
|
||||
|
||||
bool isResponse;
|
||||
timestamp = *((uint32_t *)(got+i));
|
||||
if (timestamp & 0x80000000) {
|
||||
timestamp &= 0x7fffffff;
|
||||
timestamp = *((uint32_t *)(trace + tracepos));
|
||||
if(tracepos == 0) {
|
||||
first_timestamp = timestamp;
|
||||
}
|
||||
tracepos += 4;
|
||||
duration = *((uint16_t *)(trace + tracepos));
|
||||
tracepos += 2;
|
||||
data_len = *((uint16_t *)(trace + tracepos));
|
||||
tracepos += 2;
|
||||
|
||||
if (data_len & 0x8000) {
|
||||
data_len &= 0x7fff;
|
||||
isResponse = true;
|
||||
} else {
|
||||
isResponse = false;
|
||||
}
|
||||
|
||||
if(i==0) {
|
||||
first_timestamp = timestamp;
|
||||
parity_len = (data_len-1)/8 + 1;
|
||||
|
||||
if (tracepos + data_len + parity_len >= TRACE_SIZE) {
|
||||
break;
|
||||
}
|
||||
|
||||
int parityBits = *((uint32_t *)(got+i+4));
|
||||
|
||||
int len = got[i+8];
|
||||
|
||||
if (len > 100) {
|
||||
break;
|
||||
}
|
||||
if (i + len >= 1900) {
|
||||
break;
|
||||
}
|
||||
|
||||
uint8_t *frame = (got+i+9);
|
||||
uint8_t *frame = trace + tracepos;
|
||||
tracepos += data_len;
|
||||
uint8_t *parityBytes = trace + tracepos;
|
||||
tracepos += parity_len;
|
||||
|
||||
// Break and stick with current result if buffer was not completely full
|
||||
if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;
|
||||
if (timestamp == 0x44444444) break;
|
||||
|
||||
char line[1000] = "";
|
||||
int j;
|
||||
if (len) {
|
||||
for (j = 0; j < len; j++) {
|
||||
int oddparity = 0x01;
|
||||
int k;
|
||||
for (j = 0; j < data_len; j++) {
|
||||
int oddparity = 0x01;
|
||||
int k;
|
||||
|
||||
for (k=0;k<8;k++) {
|
||||
oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
|
||||
}
|
||||
|
||||
//if((parityBits >> (len - j - 1)) & 0x01) {
|
||||
if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
|
||||
sprintf(line+(j*4), "%02x! ", frame[j]);
|
||||
} else {
|
||||
sprintf(line+(j*4), "%02x ", frame[j]);
|
||||
}
|
||||
for (k=0;k<8;k++) {
|
||||
oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
|
||||
}
|
||||
} else {
|
||||
if (ShowWaitCycles) {
|
||||
uint32_t next_timestamp = (*((uint32_t *)(got+i+9))) & 0x7fffffff;
|
||||
sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
|
||||
|
||||
uint8_t parityBits = parityBytes[j>>3];
|
||||
if (isResponse && (oddparity != ((parityBits >> (7-(j&0x0007))) & 0x01))) {
|
||||
sprintf(line+(j*4), "%02x! ", frame[j]);
|
||||
} else {
|
||||
sprintf(line+(j*4), "%02x ", frame[j]);
|
||||
}
|
||||
}
|
||||
|
||||
char *crc;
|
||||
crc = "";
|
||||
if (len > 2) {
|
||||
uint8_t b1, b2;
|
||||
for (j = 0; j < (len - 1); j++) {
|
||||
// gives problems... search for the reason..
|
||||
/*if(frame[j] == 0xAA) {
|
||||
switch(frame[j+1]) {
|
||||
case 0x01:
|
||||
crc = "[1] Two drops close after each other";
|
||||
break;
|
||||
case 0x02:
|
||||
crc = "[2] Potential SOC with a drop in second half of bitperiod";
|
||||
break;
|
||||
case 0x03:
|
||||
crc = "[3] Segment Z after segment X is not possible";
|
||||
break;
|
||||
case 0x04:
|
||||
crc = "[4] Parity bit of a fully received byte was wrong";
|
||||
break;
|
||||
default:
|
||||
crc = "[?] Unknown error";
|
||||
break;
|
||||
}
|
||||
break;
|
||||
}*/
|
||||
char crc[6] = "";
|
||||
if (data_len > 2) {
|
||||
uint8_t b1, b2;
|
||||
ComputeCrc14443(CRC_14443_A, frame, data_len-2, &b1, &b2);
|
||||
if (b1 != frame[data_len-2] || b2 != frame[data_len-1]) {
|
||||
sprintf(crc, (isResponse & (data_len < 6)) ? "" : " !crc");
|
||||
} else {
|
||||
sprintf(crc, "");
|
||||
}
|
||||
|
||||
if (strlen(crc)==0) {
|
||||
ComputeCrc14443(CRC_14443_A, frame, len-2, &b1, &b2);
|
||||
if (b1 != frame[len-2] || b2 != frame[len-1]) {
|
||||
crc = (isResponse & (len < 6)) ? "" : " !crc";
|
||||
} else {
|
||||
crc = "";
|
||||
}
|
||||
}
|
||||
} else {
|
||||
crc = ""; // SHORT
|
||||
}
|
||||
|
||||
i += (len + 9);
|
||||
|
||||
EndOfTransmissionTimestamp = (*((uint32_t *)(got+i))) & 0x7fffffff;
|
||||
|
||||
if (!ShowWaitCycles) i += 9;
|
||||
EndOfTransmissionTimestamp = timestamp + duration;
|
||||
|
||||
PrintAndLog(" %9d | %9d | %s | %s %s",
|
||||
(timestamp - first_timestamp),
|
||||
(EndOfTransmissionTimestamp - first_timestamp),
|
||||
(len?(isResponse ? "Tag" : "Rdr"):" "),
|
||||
line, crc);
|
||||
(isResponse ? "Tag" : "Rdr"),
|
||||
line,
|
||||
crc);
|
||||
|
||||
bool next_isResponse = *((uint16_t *)(trace + tracepos + 6)) & 0x8000;
|
||||
|
||||
if (ShowWaitCycles && !isResponse && next_isResponse) {
|
||||
uint32_t next_timestamp = *((uint32_t *)(trace + tracepos));
|
||||
if (next_timestamp != 0x44444444) {
|
||||
PrintAndLog(" %9d | %9d | %s | fdt (Frame Delay Time): %d",
|
||||
(EndOfTransmissionTimestamp - first_timestamp),
|
||||
(next_timestamp - first_timestamp),
|
||||
" ",
|
||||
(next_timestamp - EndOfTransmissionTimestamp));
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1894,7 +1894,6 @@ int CmdHF14AMfSniff(const char *Cmd){
|
|||
uint8_t atqa[2];
|
||||
uint8_t sak;
|
||||
bool isTag;
|
||||
uint32_t parity;
|
||||
uint8_t buf[3000];
|
||||
uint8_t * bufPtr = buf;
|
||||
memset(buf, 0x00, 3000);
|
||||
|
|
@ -1961,14 +1960,17 @@ int CmdHF14AMfSniff(const char *Cmd){
|
|||
printf(">\n");
|
||||
PrintAndLog("received trace len: %d packages: %d", blockLen, pckNum);
|
||||
num = 0;
|
||||
while (bufPtr - buf + 9 < blockLen) {
|
||||
isTag = bufPtr[3] & 0x80 ? true:false;
|
||||
bufPtr += 4;
|
||||
parity = *((uint32_t *)(bufPtr));
|
||||
bufPtr += 4;
|
||||
len = bufPtr[0];
|
||||
bufPtr++;
|
||||
if ((len == 14) && (bufPtr[0] == 0xff) && (bufPtr[1] == 0xff)) {
|
||||
while (bufPtr - buf < blockLen) {
|
||||
bufPtr += 6; // ignore void timing information
|
||||
len = *((uint16_t *)bufPtr);
|
||||
if(len & 0x8000) {
|
||||
isTag = true;
|
||||
len &= 0x7fff;
|
||||
} else {
|
||||
isTag = false;
|
||||
}
|
||||
bufPtr += 2;
|
||||
if ((len == 14) && (bufPtr[0] == 0xff) && (bufPtr[1] == 0xff) && (bufPtr[12] == 0xff) && (bufPtr[13] == 0xff)) {
|
||||
memcpy(uid, bufPtr + 2, 7);
|
||||
memcpy(atqa, bufPtr + 2 + 7, 2);
|
||||
uid_len = (atqa[0] & 0xC0) == 0x40 ? 7 : 4;
|
||||
|
|
@ -1987,9 +1989,10 @@ int CmdHF14AMfSniff(const char *Cmd){
|
|||
} else {
|
||||
PrintAndLog("%s(%d):%s", isTag ? "TAG":"RDR", num, sprint_hex(bufPtr, len));
|
||||
if (wantLogToFile) AddLogHex(logHexFileName, isTag ? "TAG: ":"RDR: ", bufPtr, len);
|
||||
if (wantDecrypt) mfTraceDecode(bufPtr, len, parity, wantSaveToEmlFile);
|
||||
if (wantDecrypt) mfTraceDecode(bufPtr, len, wantSaveToEmlFile);
|
||||
}
|
||||
bufPtr += len;
|
||||
bufPtr += ((len-1)/8+1); // ignore parity
|
||||
num++;
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -238,7 +238,7 @@ int mfEmlSetMem(uint8_t *data, int blockNum, int blocksCount) {
|
|||
|
||||
// "MAGIC" CARD
|
||||
|
||||
int mfCSetUID(uint8_t *uid, uint8_t *oldUID, int wantWipe) {
|
||||
int mfCSetUID(uint8_t *uid, uint8_t *oldUID, bool wantWipe) {
|
||||
uint8_t block0[16];
|
||||
memset(block0, 0, 16);
|
||||
memcpy(block0, uid, 4);
|
||||
|
|
@ -251,7 +251,7 @@ int mfCSetUID(uint8_t *uid, uint8_t *oldUID, int wantWipe) {
|
|||
return mfCSetBlock(0, block0, oldUID, wantWipe, CSETBLOCK_SINGLE_OPER);
|
||||
}
|
||||
|
||||
int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, int wantWipe, uint8_t params) {
|
||||
int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, bool wantWipe, uint8_t params) {
|
||||
uint8_t isOK = 0;
|
||||
|
||||
UsbCommand c = {CMD_MIFARE_EML_CSETBLOCK, {wantWipe, params & (0xFE | (uid == NULL ? 0:1)), blockNo}};
|
||||
|
|
@ -310,12 +310,9 @@ uint32_t ks3;
|
|||
|
||||
uint32_t uid; // serial number
|
||||
uint32_t nt; // tag challenge
|
||||
uint32_t nt_par;
|
||||
uint32_t nr_enc; // encrypted reader challenge
|
||||
uint32_t ar_enc; // encrypted reader response
|
||||
uint32_t nr_ar_par;
|
||||
uint32_t at_enc; // encrypted tag response
|
||||
uint32_t at_par;
|
||||
|
||||
int isTraceCardEmpty(void) {
|
||||
return ((traceCard[0] == 0) && (traceCard[1] == 0) && (traceCard[2] == 0) && (traceCard[3] == 0));
|
||||
|
|
@ -424,7 +421,7 @@ void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len, bool i
|
|||
}
|
||||
|
||||
|
||||
int mfTraceDecode(uint8_t *data_src, int len, uint32_t parity, bool wantSaveToEmlFile) {
|
||||
int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile) {
|
||||
uint8_t data[64];
|
||||
|
||||
if (traceState == TRACE_ERROR) return 1;
|
||||
|
|
@ -527,7 +524,6 @@ int mfTraceDecode(uint8_t *data_src, int len, uint32_t parity, bool wantSaveToEm
|
|||
traceState = TRACE_AUTH2;
|
||||
|
||||
nt = bytes_to_num(data, 4);
|
||||
nt_par = parity;
|
||||
return 0;
|
||||
} else {
|
||||
traceState = TRACE_ERROR;
|
||||
|
|
@ -541,7 +537,6 @@ int mfTraceDecode(uint8_t *data_src, int len, uint32_t parity, bool wantSaveToEm
|
|||
|
||||
nr_enc = bytes_to_num(data, 4);
|
||||
ar_enc = bytes_to_num(data + 4, 4);
|
||||
nr_ar_par = parity;
|
||||
return 0;
|
||||
} else {
|
||||
traceState = TRACE_ERROR;
|
||||
|
|
@ -554,7 +549,6 @@ int mfTraceDecode(uint8_t *data_src, int len, uint32_t parity, bool wantSaveToEm
|
|||
traceState = TRACE_IDLE;
|
||||
|
||||
at_enc = bytes_to_num(data, 4);
|
||||
at_par = parity;
|
||||
|
||||
// decode key here)
|
||||
ks2 = ar_enc ^ prng_successor(nt, 64);
|
||||
|
|
|
|||
|
|
@ -56,12 +56,12 @@ int mfCheckKeys (uint8_t blockNo, uint8_t keyType, uint8_t keycnt, uint8_t * key
|
|||
int mfEmlGetMem(uint8_t *data, int blockNum, int blocksCount);
|
||||
int mfEmlSetMem(uint8_t *data, int blockNum, int blocksCount);
|
||||
|
||||
int mfCSetUID(uint8_t *uid, uint8_t *oldUID, int wantWipe);
|
||||
int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, int wantWipe, uint8_t params);
|
||||
int mfCSetUID(uint8_t *uid, uint8_t *oldUID, bool wantWipe);
|
||||
int mfCSetBlock(uint8_t blockNo, uint8_t *data, uint8_t *uid, bool wantWipe, uint8_t params);
|
||||
int mfCGetBlock(uint8_t blockNo, uint8_t *data, uint8_t params);
|
||||
|
||||
int mfTraceInit(uint8_t *tuid, uint8_t *atqa, uint8_t sak, bool wantSaveToEmlFile);
|
||||
int mfTraceDecode(uint8_t *data_src, int len, uint32_t parity, bool wantSaveToEmlFile);
|
||||
int mfTraceDecode(uint8_t *data_src, int len, bool wantSaveToEmlFile);
|
||||
|
||||
int isTraceCardEmpty(void);
|
||||
int isBlockEmpty(int blockN);
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue