github/proxmark3
1
0
Fork 0
mirror of https://github.com/Proxmark/proxmark3.git synced 2025-08-19 04:49:38 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

1. fixed send manchester

Browse source 
2. emulator commands select, authenticate, read block, write block works
3. nested authentication - not working (maybe next release)
4. small bugfixes
5. mifare1ksim - in alpha state!!! code not so clear!!!
This commit is contained in:
Merlokbr@gmail.com 2011-06-16 14:43:49 +00:00
commit 8f51ddb0bd
6 changed files with 366 additions and 122 deletions
Download patch file Download diff file Expand all files Collapse all files

310
armsrc/iso14443a.c
View file

@ -26,11 +26,11 @@ static int rsamples = 0;
static int tracing = TRUE; static int tracing = TRUE;
static uint32_t iso14a_timeout; static uint32_t iso14a_timeout;
// CARD TO READER // CARD TO READER - manchester
// Sequence D: 11110000 modulation with subcarrier during first half // Sequence D: 11110000 modulation with subcarrier during first half
// Sequence E: 00001111 modulation with subcarrier during second half // Sequence E: 00001111 modulation with subcarrier during second half
// Sequence F: 00000000 no modulation with subcarrier // Sequence F: 00000000 no modulation with subcarrier
// READER TO CARD // READER TO CARD - miller
// Sequence X: 00001100 drop after half a period // Sequence X: 00001100 drop after half a period
// Sequence Y: 00000000 no drop // Sequence Y: 00000000 no drop
// Sequence Z: 11000000 drop at start // Sequence Z: 11000000 drop at start
@ -60,16 +60,6 @@ static const uint8_t OddByteParity[256] = {
1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
}; };
// BIG CHANGE - UNDERSTAND THIS BEFORE WE COMMIT
#define RECV_CMD_OFFSET 3032
#define RECV_RES_OFFSET 3096
#define DMA_BUFFER_OFFSET 3160
#define DMA_BUFFER_SIZE 4096
#define TRACE_LENGTH 3000
// card emulator memory
#define CARD_MEMORY 7260
#define CARD_MEMORY_LEN 1024
uint8_t trigger = 0; uint8_t trigger = 0;
void iso14a_set_trigger(int enable) { void iso14a_set_trigger(int enable) {
trigger = enable; trigger = enable;
@ -787,12 +777,12 @@ done:
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// Prepare tag messages // Prepare tag messages
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
static void CodeIso14443aAsTag(const uint8_t *cmd, int len) static void CodeIso14443aAsTagPar(const uint8_t *cmd, int len, uint32_t dwParity)
{ {
int i; int i;
int oddparity; // int oddparity;
ToSendReset(); ToSendReset();
// Correction bit, might be removed when not needed // Correction bit, might be removed when not needed
ToSendStuffBit(0); ToSendStuffBit(0);
@ -803,55 +793,68 @@ static void CodeIso14443aAsTag(const uint8_t *cmd, int len)
ToSendStuffBit(0); ToSendStuffBit(0);
ToSendStuffBit(0); ToSendStuffBit(0);
ToSendStuffBit(0); ToSendStuffBit(0);
// Send startbit // Send startbit
ToSend[++ToSendMax] = SEC_D; ToSend[++ToSendMax] = SEC_D;
for(i = 0; i < len; i++) { for(i = 0; i < len; i++) {
int j; int j;
uint8_t b = cmd[i]; uint8_t b = cmd[i];
// Data bits // Data bits
oddparity = 0x01; // oddparity = 0x01;
for(j = 0; j < 8; j++) { for(j = 0; j < 8; j++) {
oddparity ^= (b & 1); // oddparity ^= (b & 1);
if(b & 1) { if(b & 1) {
ToSend[++ToSendMax] = SEC_D; ToSend[++ToSendMax] = SEC_D;
} else { } else {
ToSend[++ToSendMax] = SEC_E; ToSend[++ToSendMax] = SEC_E;
} }
b >>= 1; b >>= 1;
} }
// Parity bit // Get the parity bit
if(oddparity) { if ((dwParity >> i) & 0x01) {
ToSend[++ToSendMax] = SEC_D; ToSend[++ToSendMax] = SEC_D;
} else { } else {
ToSend[++ToSendMax] = SEC_E; ToSend[++ToSendMax] = SEC_E;
} }
}
// Parity bit
// if(oddparity) {
// ToSend[++ToSendMax] = SEC_D;
// } else {
// ToSend[++ToSendMax] = SEC_E;
// }
// Send stopbit // if (oddparity != ((dwParity >> i) & 0x01))
ToSend[++ToSendMax] = SEC_F; // Dbprintf("par error. i=%d", i);
}
// Send stopbit
ToSend[++ToSendMax] = SEC_F;
// Flush the buffer in FPGA!! // Flush the buffer in FPGA!!
for(i = 0; i < 5; i++) { for(i = 0; i < 5; i++) {
ToSend[++ToSendMax] = SEC_F; ToSend[++ToSendMax] = SEC_F;
} }
// Convert from last byte pos to length // Convert from last byte pos to length
ToSendMax++; ToSendMax++;
// Add a few more for slop // Add a few more for slop
ToSend[ToSendMax++] = 0x00; // ToSend[ToSendMax++] = 0x00;
ToSend[ToSendMax++] = 0x00; // ToSend[ToSendMax++] = 0x00;
//ToSendMax += 2; }
static void CodeIso14443aAsTag(const uint8_t *cmd, int len){
CodeIso14443aAsTagPar(cmd, len, GetParity(cmd, len));
} }
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// This is to send a NACK kind of answer, its only 3 bits, I know it should be 4 // This is to send a NACK kind of answer, its only 3 bits, I know it should be 4
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
static void CodeStrangeAnswer() static void CodeStrangeAnswerAsTag()
{ {
int i; int i;
@ -889,11 +892,47 @@ static void CodeStrangeAnswer()
// Convert from last byte pos to length // Convert from last byte pos to length
ToSendMax++; ToSendMax++;
}
// Add a few more for slop static void Code4bitAnswerAsTag(uint8_t cmd)
ToSend[ToSendMax++] = 0x00; {
ToSend[ToSendMax++] = 0x00; int i;
//ToSendMax += 2;
ToSendReset();
// Correction bit, might be removed when not needed
ToSendStuffBit(0);
ToSendStuffBit(0);
ToSendStuffBit(0);
ToSendStuffBit(0);
ToSendStuffBit(1); // 1
ToSendStuffBit(0);
ToSendStuffBit(0);
ToSendStuffBit(0);
// Send startbit
ToSend[++ToSendMax] = SEC_D;
uint8_t b = cmd;
for(i = 0; i < 4; i++) {
if(b & 1) {
ToSend[++ToSendMax] = SEC_D;
} else {
ToSend[++ToSendMax] = SEC_E;
}
b >>= 1;
}
// Send stopbit
ToSend[++ToSendMax] = SEC_F;
// Flush the buffer in FPGA!!
for(i = 0; i < 5; i++) {
ToSend[++ToSendMax] = SEC_F;
}
// Convert from last byte pos to length
ToSendMax++;
} }
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
@ -1066,7 +1105,7 @@ ComputeCrc14443(CRC_14443_A, response3a, 1, &response3a[1], &response3a[2]);
memcpy(resp3a, ToSend, ToSendMax); resp3aLen = ToSendMax; memcpy(resp3a, ToSend, ToSendMax); resp3aLen = ToSendMax;
// Strange answer is an example of rare message size (3 bits) // Strange answer is an example of rare message size (3 bits)
CodeStrangeAnswer(); CodeStrangeAnswerAsTag();
memcpy(resp4, ToSend, ToSendMax); resp4Len = ToSendMax; memcpy(resp4, ToSend, ToSendMax); resp4Len = ToSendMax;
// Authentication answer (random nonce) // Authentication answer (random nonce)
@ -1472,12 +1511,12 @@ static int EmGetCmd(uint8_t *received, int *len, int maxLen)
volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR; volatile uint8_t b = (uint8_t)AT91C_BASE_SSC->SSC_RHR;
if(MillerDecoding((b & 0xf0) >> 4)) { if(MillerDecoding((b & 0xf0) >> 4)) {
*len = Uart.byteCnt; *len = Uart.byteCnt;
if (tracing) LogTrace(received, *len, 0, GetParity(received, *len), TRUE); if (tracing) LogTrace(received, *len, GetDeltaCountUS(), Uart.parityBits, TRUE);
return 0; return 0;
} }
if(MillerDecoding(b & 0x0f)) { if(MillerDecoding(b & 0x0f)) {
*len = Uart.byteCnt; *len = Uart.byteCnt;
if (tracing) LogTrace(received, *len, 0, GetParity(received, *len), TRUE); if (tracing) LogTrace(received, *len, GetDeltaCountUS(), Uart.parityBits, TRUE);
return 0; return 0;
} }
} }
@ -1509,7 +1548,7 @@ static int EmSendCmd14443aRaw(uint8_t *resp, int respLen, int correctionNeeded)
} }
if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) { if(AT91C_BASE_SSC->SSC_SR & (AT91C_SSC_TXRDY)) {
if(i > respLen) { if(i > respLen) {
b = 0x00; b = 0xff; // was 0x00
u++; u++;
} else { } else {
b = resp[i]; b = resp[i];
@ -1527,15 +1566,34 @@ static int EmSendCmd14443aRaw(uint8_t *resp, int respLen, int correctionNeeded)
return 0; return 0;
} }
static int EmSendCmdEx(uint8_t *resp, int respLen, int correctionNeeded){ int EmSend4bitEx(uint8_t resp, int correctionNeeded){
CodeIso14443aAsTag(resp, respLen); Code4bitAnswerAsTag(resp);
int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded); int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
if (tracing) LogTrace(resp, respLen, 0, GetParity(resp, respLen), FALSE); if (tracing) LogTrace(&resp, 1, GetDeltaCountUS(), GetParity(&resp, 1), FALSE);
return res; return res;
} }
static int EmSendCmd(uint8_t *resp, int respLen){ int EmSend4bit(uint8_t resp){
return EmSendCmdEx(resp, respLen, 0); return EmSend4bitEx(resp, 0);
}
int EmSendCmdExPar(uint8_t *resp, int respLen, int correctionNeeded, uint32_t par){
CodeIso14443aAsTagPar(resp, respLen, par);
int res = EmSendCmd14443aRaw(ToSend, ToSendMax, correctionNeeded);
if (tracing) LogTrace(resp, respLen, GetDeltaCountUS(), par, FALSE);
return res;
}
int EmSendCmdEx(uint8_t *resp, int respLen, int correctionNeeded){
return EmSendCmdExPar(resp, respLen, correctionNeeded, GetParity(resp, respLen));
}
int EmSendCmd(uint8_t *resp, int respLen){
return EmSendCmdExPar(resp, respLen, 0, GetParity(resp, respLen));
}
int EmSendCmdPar(uint8_t *resp, int respLen, uint32_t par){
return EmSendCmdExPar(resp, respLen, 0, par);
} }
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
@ -1993,10 +2051,7 @@ void MifareReadBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED"); if (MF_DBGLEVEL >= 2) DbpString("READ BLOCK FINISHED");
// add trace trailer // add trace trailer
uid[0] = 0xff; memset(uid, 0x44, 4);
uid[1] = 0xff;
uid[2] = 0xff;
uid[3] = 0xff;
LogTrace(uid, 4, 0, 0, TRUE); LogTrace(uid, 4, 0, 0, TRUE);
UsbCommand ack = {CMD_ACK, {isOK, 0, 0}}; UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
@ -2088,10 +2143,7 @@ void MifareReadSector(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED"); if (MF_DBGLEVEL >= 2) DbpString("READ SECTOR FINISHED");
// add trace trailer // add trace trailer
uid[0] = 0xff; memset(uid, 0x44, 4);
uid[1] = 0xff;
uid[2] = 0xff;
uid[3] = 0xff;
LogTrace(uid, 4, 0, 0, TRUE); LogTrace(uid, 4, 0, 0, TRUE);
UsbCommand ack = {CMD_ACK, {isOK, 0, 0}}; UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
@ -2177,10 +2229,7 @@ void MifareWriteBlock(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED"); if (MF_DBGLEVEL >= 2) DbpString("WRITE BLOCK FINISHED");
// add trace trailer // add trace trailer
uid[0] = 0xff; memset(uid, 0x44, 4);
uid[1] = 0xff;
uid[2] = 0xff;
uid[3] = 0xff;
LogTrace(uid, 4, 0, 0, TRUE); LogTrace(uid, 4, 0, 0, TRUE);
UsbCommand ack = {CMD_ACK, {isOK, 0, 0}}; UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
@ -2392,10 +2441,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t arg2, uint8_t *datain)
crypto1_destroy(pcs); crypto1_destroy(pcs);
// add trace trailer // add trace trailer
uid[0] = 0xff; memset(uid, 0x44, 4);
uid[1] = 0xff;
uid[2] = 0xff;
uid[3] = 0xff;
LogTrace(uid, 4, 0, 0, TRUE); LogTrace(uid, 4, 0, 0, TRUE);
for (i = 0; i < NES_MAX_INFO; i++) { for (i = 0; i < NES_MAX_INFO; i++) {
@ -2502,10 +2548,7 @@ void MifareChkKeys(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
crypto1_destroy(pcs); crypto1_destroy(pcs);
// add trace trailer // add trace trailer
uid[0] = 0xff; memset(uid, 0x44, 4);
uid[1] = 0xff;
uid[2] = 0xff;
uid[3] = 0xff;
LogTrace(uid, 4, 0, 0, TRUE); LogTrace(uid, 4, 0, 0, TRUE);
UsbCommand ack = {CMD_ACK, {isOK, 0, 0}}; UsbCommand ack = {CMD_ACK, {isOK, 0, 0}};
@ -2531,13 +2574,14 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
{ {
int cardSTATE = MFEMUL_NOFIELD; int cardSTATE = MFEMUL_NOFIELD;
int vHf = 0; // in mV int vHf = 0; // in mV
int res, i; int nextCycleTimeout = 0;
int res;
uint32_t timer = 0; uint32_t timer = 0;
uint32_t selTimer = 0; uint32_t selTimer = 0;
uint32_t authTimer = 0; uint32_t authTimer = 0;
uint32_t par = 0; uint32_t par = 0;
int len = 0; int len = 0;
uint8_t bt; uint8_t cardWRBL = 0;
uint8_t cardAUTHSC = 0; uint8_t cardAUTHSC = 0;
uint8_t cardAUTHKEY = 0xff; // no authentication uint8_t cardAUTHKEY = 0xff; // no authentication
uint32_t cuid = 0; uint32_t cuid = 0;
@ -2547,7 +2591,8 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
uint64_t key64 = 0xffffffffffffULL; uint64_t key64 = 0xffffffffffffULL;
uint8_t* receivedCmd = mifare_get_bigbufptr(); uint8_t* receivedCmd = eml_get_bigbufptr_recbuf();
uint8_t *response = eml_get_bigbufptr_sendbuf();
static uint8_t rATQA[] = {0x04, 0x00}; // Mifare classic 1k static uint8_t rATQA[] = {0x04, 0x00}; // Mifare classic 1k
@ -2558,19 +2603,23 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
static uint8_t rAUTH_NT[] = {0x1a, 0xac, 0xff, 0x4f}; static uint8_t rAUTH_NT[] = {0x1a, 0xac, 0xff, 0x4f};
static uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00}; static uint8_t rAUTH_AT[] = {0x00, 0x00, 0x00, 0x00};
static uint8_t cmdBuf[18];
// clear trace // clear trace
traceLen = 0; traceLen = 0;
tracing = true; tracing = true;
// emulator memory
emlClearMem();
emlGetMemBt(rUIDBCC1, 0, 4);
rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
// -------------------------------------- test area // -------------------------------------- test area
// Authenticate response - nonce // Authenticate response - nonce
uint8_t *resp1 = (((uint8_t *)BigBuf) + CARD_MEMORY); uint8_t *resp1 = (((uint8_t *)BigBuf) + EML_RESPONSES);
int resp1Len; int resp1Len;
uint8_t *resp2 = (((uint8_t *)BigBuf) + CARD_MEMORY + 200); // uint8_t *resp2 = (((uint8_t *)BigBuf) + EML_RESPONSES + 200);
int resp2Len; // int resp2Len;
CodeIso14443aAsTag(rAUTH_NT, sizeof(rAUTH_NT)); CodeIso14443aAsTag(rAUTH_NT, sizeof(rAUTH_NT));
memcpy(resp1, ToSend, ToSendMax); resp1Len = ToSendMax; memcpy(resp1, ToSend, ToSendMax); resp1Len = ToSendMax;
@ -2579,7 +2628,7 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
uint32_t rn_enc = 0x98d76b77; // !!!!!!!!!!!!!!!!! uint32_t rn_enc = 0x98d76b77; // !!!!!!!!!!!!!!!!!
uint32_t ans = 0; uint32_t ans = 0;
cuid = bytes_to_num(rUIDBCC1, 4); cuid = bytes_to_num(rUIDBCC1, 4);
/*
crypto1_create(pcs, key64); crypto1_create(pcs, key64);
crypto1_word(pcs, cuid ^ nonce, 0); crypto1_word(pcs, cuid ^ nonce, 0);
crypto1_word(pcs, rn_enc , 1); crypto1_word(pcs, rn_enc , 1);
@ -2589,8 +2638,10 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
CodeIso14443aAsTag(rAUTH_AT, sizeof(rAUTH_AT)); CodeIso14443aAsTag(rAUTH_AT, sizeof(rAUTH_AT));
memcpy(resp2, ToSend, ToSendMax); resp2Len = ToSendMax; memcpy(resp2, ToSend, ToSendMax); resp2Len = ToSendMax;
Dbprintf("crypto auth time: %d", GetTickCount() - timer); Dbprintf("crypto auth time: %d", GetTickCount() - timer);
*/
// -------------------------------------- END test area // -------------------------------------- END test area
// start mkseconds counter
StartCountUS();
// We need to listen to the high-frequency, peak-detected path. // We need to listen to the high-frequency, peak-detected path.
SetAdcMuxFor(GPIO_MUXSEL_HIPKD); SetAdcMuxFor(GPIO_MUXSEL_HIPKD);
@ -2599,10 +2650,16 @@ void Mifare1ksim(uint8_t arg0, uint8_t arg1, uint8_t arg2, uint8_t *datain)
FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN); FpgaWriteConfWord(FPGA_MAJOR_MODE_HF_ISO14443A | FPGA_HF_ISO14443A_TAGSIM_LISTEN);
SpinDelay(200); SpinDelay(200);
Dbprintf("--> start"); Dbprintf("--> start");
// calibrate mkseconds counter
GetDeltaCountUS();
while (true) { while (true) {
WDT_HIT(); WDT_HIT();
if(BUTTON_PRESS()) {
break;
}
// find reader field // find reader field
// Vref = 3300mV, and an 10:1 voltage divider on the input // Vref = 3300mV, and an 10:1 voltage divider on the input
// can measure voltages up to 33000 mV // can measure voltages up to 33000 mV
@ -2615,7 +2672,7 @@ Dbprintf("--> start");
} }
if (cardSTATE != MFEMUL_NOFIELD) { if (cardSTATE != MFEMUL_NOFIELD) {
res = EmGetCmd(receivedCmd, &len, 100); res = EmGetCmd(receivedCmd, &len, 100); // (+ nextCycleTimeout)
if (res == 2) { if (res == 2) {
cardSTATE = MFEMUL_NOFIELD; cardSTATE = MFEMUL_NOFIELD;
LEDsoff(); LEDsoff();
@ -2624,13 +2681,12 @@ Dbprintf("--> start");
if(res) break; if(res) break;
} }
if(BUTTON_PRESS()) { nextCycleTimeout = 0;
break;
}
// if (len) Dbprintf("len:%d cmd: %02x %02x %02x %02x", len, receivedCmd[0], receivedCmd[1], receivedCmd[2], receivedCmd[3]); // if (len) Dbprintf("len:%d cmd: %02x %02x %02x %02x", len, receivedCmd[0], receivedCmd[1], receivedCmd[2], receivedCmd[3]);
if (len != 4 && cardSTATE != MFEMUL_NOFIELD) { // len != 4 <---- speed up the code 4 authentication if (len != 4 && cardSTATE != MFEMUL_NOFIELD) { // len != 4 <---- speed up the code 4 authentication
// REQ or WUP request in ANY state and WUP in HALTED state // REQ or WUP request in ANY state and WUP in HALTED state
if (len == 1 && ((receivedCmd[0] == 0x26 && cardSTATE != MFEMUL_HALTED) || receivedCmd[0] == 0x52)) { if (len == 1 && ((receivedCmd[0] == 0x26 && cardSTATE != MFEMUL_HALTED) || receivedCmd[0] == 0x52)) {
selTimer = GetTickCount(); selTimer = GetTickCount();
EmSendCmdEx(rATQA, sizeof(rATQA), (receivedCmd[0] == 0x52)); EmSendCmdEx(rATQA, sizeof(rATQA), (receivedCmd[0] == 0x52));
@ -2683,12 +2739,11 @@ Dbprintf("--> start");
cuid = bytes_to_num(rUIDBCC2, 4); cuid = bytes_to_num(rUIDBCC2, 4);
cardSTATE = MFEMUL_WORK; cardSTATE = MFEMUL_WORK;
LED_B_ON(); LED_B_ON();
Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - timer); Dbprintf("--> WORK. anticol2 time: %d", GetTickCount() - selTimer);
break; break;
} }
case MFEMUL_AUTH1:{ case MFEMUL_AUTH1:{
if (len == 8) { if (len == 8) {
timer = GetTickCount();
// --------------------------------- // ---------------------------------
rn_enc = bytes_to_num(receivedCmd, 4); rn_enc = bytes_to_num(receivedCmd, 4);
crypto1_create(pcs, key64); crypto1_create(pcs, key64);
@ -2699,7 +2754,6 @@ timer = GetTickCount();
num_to_bytes(ans, 4, rAUTH_AT); num_to_bytes(ans, 4, rAUTH_AT);
// --------------------------------- // ---------------------------------
EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT)); EmSendCmd(rAUTH_AT, sizeof(rAUTH_AT));
// EmSendCmd14443aRaw(resp2, resp2Len, 0);
cardSTATE = MFEMUL_AUTH2; cardSTATE = MFEMUL_AUTH2;
} else { } else {
cardSTATE = MFEMUL_IDLE; cardSTATE = MFEMUL_IDLE;
@ -2713,16 +2767,16 @@ timer = GetTickCount();
LED_C_ON(); LED_C_ON();
cardSTATE = MFEMUL_WORK; cardSTATE = MFEMUL_WORK;
Dbprintf("AUTH COMPLETED. sec=%d, key=%d time=%d a=%d", cardAUTHSC, cardAUTHKEY, GetTickCount() - authTimer, GetTickCount() - timer); Dbprintf("AUTH COMPLETED. sec=%d, key=%d time=%d", cardAUTHSC, cardAUTHKEY, GetTickCount() - authTimer);
break; break;
} }
case MFEMUL_WORK:{ case MFEMUL_WORK:{
// auth // auth
if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) { if (len == 4 && (receivedCmd[0] == 0x60 || receivedCmd[0] == 0x61)) {
authTimer = GetTickCount(); authTimer = GetTickCount();
// EmSendCmd(rAUTH_NT, sizeof(rAUTH_NT)); // EmSendCmd(rAUTH_NT, sizeof(rAUTH_NT));
//SpinDelayUs(30);
EmSendCmd14443aRaw(resp1, resp1Len, 0); EmSendCmd14443aRaw(resp1, resp1Len, 0);
LogTrace(NULL, 0, GetDeltaCountUS(), 0, TRUE);
// crypto1_create(pcs, key64); // crypto1_create(pcs, key64);
// if (cardAUTHKEY == 0xff) { // first auth // if (cardAUTHKEY == 0xff) { // first auth
// crypto1_word(pcs, cuid ^ bytes_to_num(rAUTH_NT, 4), 0); // uid ^ nonce // crypto1_word(pcs, cuid ^ bytes_to_num(rAUTH_NT, 4), 0); // uid ^ nonce
@ -2732,50 +2786,54 @@ Dbprintf("AUTH COMPLETED. sec=%d, key=%d time=%d a=%d", cardAUTHSC, cardAUTHKEY,
cardAUTHSC = receivedCmd[1] / 4; // received block num cardAUTHSC = receivedCmd[1] / 4; // received block num
cardAUTHKEY = receivedCmd[0] - 0x60; cardAUTHKEY = receivedCmd[0] - 0x60;
cardSTATE = MFEMUL_AUTH1; cardSTATE = MFEMUL_AUTH1;
nextCycleTimeout = 10;
break; break;
} }
if (len == 0) break; if (len == 0) break;
// decrypt seqence // decrypt seqence
if (cardAUTHKEY != 0xff){ if (cardAUTHKEY != 0xff) mf_crypto1_decrypt(pcs, receivedCmd, len);
if (len != 1) {
for (i = 0; i < len; i++)
receivedCmd[i] = crypto1_byte(pcs, 0x00, 0) ^ receivedCmd[i];
} else {
bt = 0;
for (i = 0; i < 4; i++)
bt |= (crypto1_bit(pcs, 0, 0) ^ BIT(receivedCmd[0], i)) << i;
receivedCmd[0] = bt; // rule 13 of 7.5.3. in ISO 14443-4. chaining shall be continued
} // BUT... ACK --> NACK
if (len == 1 && receivedCmd[0] == CARD_ACK) {
EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
break;
}
// rule 12 of 7.5.3. in ISO 14443-4. R(NAK) --> R(ACK)
if (len == 1 && receivedCmd[0] == CARD_NACK_NA) {
EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
break;
} }
// read block // read block
if (len == 4 && receivedCmd[0] == 0x30) { if (len == 4 && receivedCmd[0] == 0x30) {
cmdBuf[0] = 0; if (receivedCmd[1] >= 16 * 4) {
par = 0; EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
/* memcpy(cmdBuf, blockData, 16); break;
AppendCrc14443a(cmdBuf, 16); }
emlGetMem(response, receivedCmd[1], 1);
// crypto AppendCrc14443a(response, 16);
par = 0; mf_crypto1_encrypt(pcs, response, 18, &par);
for (i = 0; i < 18; i++) { EmSendCmdPar(response, 18, par);
d_block_enc[pos] = crypto1_byte(pcs, 0x00, 0) ^ cmdBuf[pos];
par = (par >> 1) | ( ((filter(pcs->odd) ^ oddparity(cmdBuf[pos])) & 0x01) * 0x20000 );
}
*/
//ReaderTransmitPar(d_block_enc, sizeof(d_block_enc), par);
Dbprintf("read block: %d", receivedCmd[1]);
break; break;
} }
// write block // write block
if (len == 4 && receivedCmd[0] == 0xA0) { if (len == 4 && receivedCmd[0] == 0xA0) {
Dbprintf("write block: %d", receivedCmd[1]); if (receivedCmd[1] >= 16 * 4) {
EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
break;
}
EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
nextCycleTimeout = 50;
cardSTATE = MFEMUL_WRITEBL2;
cardWRBL = receivedCmd[1];
break; break;
} }
// halt // halt
if (len == 4 && (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00)) { if (len == 4 && (receivedCmd[0] == 0x50 && receivedCmd[1] == 0x00)) {
cardSTATE = MFEMUL_HALTED; cardSTATE = MFEMUL_HALTED;
@ -2785,6 +2843,23 @@ Dbprintf("write block: %d", receivedCmd[1]);
break; break;
} }
break; break;
// command not allowed
if (len == 4) {
EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
break;
}
}
case MFEMUL_WRITEBL2:{
if (len == 18){
mf_crypto1_decrypt(pcs, receivedCmd, len);
emlSetMem(receivedCmd, cardWRBL, 1);
EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_ACK));
cardSTATE = MFEMUL_WORK;
break;
}
Dbprintf("err write block: %d len:%d", cardWRBL, len);
break;
} }
} }
@ -2795,6 +2870,7 @@ Dbprintf("write block: %d", receivedCmd[1]);
LEDsoff(); LEDsoff();
// add trace trailer // add trace trailer
memset(rAUTH_NT, 0x44, 4);
LogTrace(rAUTH_NT, 4, 0, 0, TRUE); LogTrace(rAUTH_NT, 4, 0, 0, TRUE);
DbpString("Emulator stopped."); DbpString("Emulator stopped.");

13
armsrc/iso14443a.h
View file

@ -14,6 +14,19 @@
#define __ISO14443A_H #define __ISO14443A_H
#include "common.h" #include "common.h"
// BIG CHANGE - UNDERSTAND THIS BEFORE WE COMMIT
#define RECV_CMD_OFFSET 3032
#define RECV_RES_OFFSET 3096
#define DMA_BUFFER_OFFSET 3160
#define DMA_BUFFER_SIZE 4096
#define TRACE_LENGTH 3000
// mifare reader over DMA buffer (SnoopIso14443a())!!!
#define MIFARE_BUFF_OFFSET 3560 // \/ \/ \/
// card emulator memory
#define EML_RESPONSES 4000
#define CARD_MEMORY 6000
#define CARD_MEMORY_LEN 1024
typedef struct nestedVector { uint32_t nt, ks1; } nestedVector; typedef struct nestedVector { uint32_t nt, ks1; } nestedVector;

96
armsrc/mifareutil.c
View file

@ -1,12 +1,12 @@
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// Merlok, May 2011 // Merlok, May 2011
// Many authors, that makes it possible // Many authors, whom made it possible
// //
// This code is licensed to you under the terms of the GNU GPL, version 2 or, // This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of // at your option, any later version. See the LICENSE.txt file for the text of
// the license. // the license.
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
// code for work with mifare cards. // Work with mifare cards.
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
#include "proxmark3.h" #include "proxmark3.h"
@ -21,10 +21,62 @@
int MF_DBGLEVEL = MF_DBG_ALL; int MF_DBGLEVEL = MF_DBG_ALL;
// memory management
uint8_t* mifare_get_bigbufptr(void) { uint8_t* mifare_get_bigbufptr(void) {
return (((uint8_t *)BigBuf) + 3560); // was 3560 - tied to other size changes return (((uint8_t *)BigBuf) + MIFARE_BUFF_OFFSET); // was 3560 - tied to other size changes
}
uint8_t* eml_get_bigbufptr_sendbuf(void) {
return (((uint8_t *)BigBuf) + RECV_CMD_OFFSET);
}
uint8_t* eml_get_bigbufptr_recbuf(void) {
return (((uint8_t *)BigBuf) + MIFARE_BUFF_OFFSET);
}
uint8_t* eml_get_bigbufptr_cardmem(void) {
return (((uint8_t *)BigBuf) + CARD_MEMORY);
} }
// crypto1 helpers
void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *data, int len){
uint8_t bt = 0;
int i;
if (len != 1) {
for (i = 0; i < len; i++)
data[i] = crypto1_byte(pcs, 0x00, 0) ^ data[i];
} else {
bt = 0;
for (i = 0; i < 4; i++)
bt |= (crypto1_bit(pcs, 0, 0) ^ BIT(data[0], i)) << i;
data[0] = bt;
}
return;
}
void mf_crypto1_encrypt(struct Crypto1State *pcs, uint8_t *data, int len, uint32_t *par) {
uint8_t bt = 0;
int i;
uint32_t mltpl = 1 << (len - 1); // for len=18 it=0x20000
*par = 0;
for (i = 0; i < len; i++) {
bt = data[i];
data[i] = crypto1_byte(pcs, 0x00, 0) ^ data[i];
*par = (*par >> 1) | ( ((filter(pcs->odd) ^ oddparity(bt)) & 0x01) * mltpl );
}
return;
}
uint8_t mf_crypto1_encrypt4bit(struct Crypto1State *pcs, uint8_t data) {
uint8_t bt = 0;
int i;
for (i = 0; i < 4; i++)
bt |= (crypto1_bit(pcs, 0, 0) ^ BIT(data, i)) << i;
return bt;
}
// send commands
int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t* answer) int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t* answer)
{ {
return mifare_sendcmd_shortex(pcs, crypted, cmd, data, answer, NULL); return mifare_sendcmd_shortex(pcs, crypted, cmd, data, answer, NULL);
@ -78,6 +130,7 @@ int mifare_sendcmd_shortex(struct Crypto1State *pcs, uint8_t crypted, uint8_t cm
return len; return len;
} }
// mifare commands
int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint64_t isNested) int mifare_classic_auth(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t keyType, uint64_t ui64Key, uint64_t isNested)
{ {
return mifare_classic_authex(pcs, uid, blockNo, keyType, ui64Key, isNested, NULL); return mifare_classic_authex(pcs, uid, blockNo, keyType, ui64Key, isNested, NULL);
@ -267,3 +320,40 @@ int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid)
return 0; return 0;
} }
// work with emulator memory
void emlSetMem(uint8_t *data, int blockNum, int blocksCount) {
uint8_t* emCARD = eml_get_bigbufptr_cardmem();
memcpy(emCARD + blockNum * 16, data, blocksCount * 16);
}
void emlGetMem(uint8_t *data, int blockNum, int blocksCount) {
uint8_t* emCARD = eml_get_bigbufptr_cardmem();
memcpy(data, emCARD + blockNum * 16, blocksCount * 16);
}
void emlGetMemBt(uint8_t *data, int bytePtr, int byteCount) {
uint8_t* emCARD = eml_get_bigbufptr_cardmem();
memcpy(data, emCARD + bytePtr, byteCount);
}
void emlClearMem(void) {
int i;
const uint8_t trailer[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x07, 0x80, 0x69, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
const uint8_t empty[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
const uint8_t uid[] = {0xe6, 0x84, 0x87, 0xf3, 0x16, 0x88, 0x04, 0x00, 0x46, 0x8e, 0x45, 0x55, 0x4d, 0x70, 0x41, 0x04};
// fill sectors data
for(i = 0; i < 16; i++) {
emlSetMem((uint8_t *)empty, i * 4 + 0, 1);
emlSetMem((uint8_t *)empty, i * 4 + 1, 1);
emlSetMem((uint8_t *)empty, i * 4 + 2, 1);
emlSetMem((uint8_t *)trailer, i * 4 + 3, 1);
}
// uid
emlSetMem((uint8_t *)uid, 0, 1);
return;
}

24
armsrc/mifareutil.h
View file

@ -19,6 +19,11 @@
#define AUTH_FIRST 0 #define AUTH_FIRST 0
#define AUTH_NESTED 2 #define AUTH_NESTED 2
// mifare 4bit card answers
#define CARD_ACK 0x0A // 1010 - ACK
#define CARD_NACK_NA 0x04 // 0100 - NACK, not allowed (command not allowed)
#define CARD_NACK_TR 0x05 // 0101 - NACK, transmission error
// reader voltage field detector // reader voltage field detector
#define MF_MINFIELDV 4000 #define MF_MINFIELDV 4000
@ -46,7 +51,8 @@ extern int MF_DBGLEVEL;
#define MFEMUL_AUTH1 4 #define MFEMUL_AUTH1 4
#define MFEMUL_AUTH2 5 #define MFEMUL_AUTH2 5
#define MFEMUL_WORK 6 #define MFEMUL_WORK 6
#define MFEMUL_HALTED 7 #define MFEMUL_WRITEBL2 7
#define MFEMUL_HALTED 8
//functions //functions
uint8_t* mifare_get_bigbufptr(void); uint8_t* mifare_get_bigbufptr(void);
@ -61,4 +67,20 @@ int mifare_classic_readblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blo
int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData); int mifare_classic_writeblock(struct Crypto1State *pcs, uint32_t uid, uint8_t blockNo, uint8_t *blockData);
int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid); int mifare_classic_halt(struct Crypto1State *pcs, uint32_t uid);
// crypto functions
void mf_crypto1_decrypt(struct Crypto1State *pcs, uint8_t *receivedCmd, int len);
void mf_crypto1_encrypt(struct Crypto1State *pcs, uint8_t *data, int len, uint32_t *par);
uint8_t mf_crypto1_encrypt4bit(struct Crypto1State *pcs, uint8_t data);
// memory management
uint8_t* mifare_get_bigbufptr(void);
uint8_t* eml_get_bigbufptr_sendbuf(void);
uint8_t* eml_get_bigbufptr_recbuf(void);
// emulator functions
void emlClearMem(void);
void emlSetMem(uint8_t *data, int blockNum, int blocksCount);
void emlGetMem(uint8_t *data, int blockNum, int blocksCount);
void emlGetMemBt(uint8_t *data, int bytePtr, int byteCount);
#endif #endif

41
armsrc/util.c
View file

@ -259,6 +259,45 @@ void StartTickCount()
* Get the current count. * Get the current count.
*/ */
uint32_t RAMFUNC GetTickCount(){ uint32_t RAMFUNC GetTickCount(){
return AT91C_BASE_RTTC->RTTC_RTVR;// * 2; return AT91C_BASE_RTTC->RTTC_RTVR;// was * 2;
} }
// -------------------------------------------------------------------------
// microseconds timer
// -------------------------------------------------------------------------
void StartCountUS()
{
AT91C_BASE_PMC->PMC_PCER |= (0x1 << 12) | (0x1 << 13) | (0x1 << 14);
// AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC1XC1S_TIOA0;
AT91C_BASE_TCB->TCB_BMR = AT91C_TCB_TC0XC0S_NONE | AT91C_TCB_TC1XC1S_TIOA0 | AT91C_TCB_TC2XC2S_NONE;
// fast clock
AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKDIS; // timer disable
AT91C_BASE_TC0->TC_CMR = AT91C_TC_CLKS_TIMER_DIV3_CLOCK | // MCK(48MHz)/32 -- tick=1.5mks
AT91C_TC_WAVE | AT91C_TC_WAVESEL_UP_AUTO | AT91C_TC_ACPA_CLEAR |
AT91C_TC_ACPC_SET | AT91C_TC_ASWTRG_SET;
AT91C_BASE_TC0->TC_RA = 1;
AT91C_BASE_TC0->TC_RC = 0xBFFF + 1; // 0xC000
AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKDIS; // timer disable
AT91C_BASE_TC1->TC_CMR = AT91C_TC_CLKS_XC1; // from timer 0
AT91C_BASE_TC0->TC_CCR = AT91C_TC_CLKEN;
AT91C_BASE_TC1->TC_CCR = AT91C_TC_CLKEN;
AT91C_BASE_TCB->TCB_BCR = 1;
}
uint32_t RAMFUNC GetCountUS(){
return (AT91C_BASE_TC1->TC_CV * 0x8000) + ((AT91C_BASE_TC0->TC_CV / 15) * 10);
}
static uint32_t GlobalUsCounter = 0;
uint32_t RAMFUNC GetDeltaCountUS(){
uint32_t g_cnt = GetCountUS();
uint32_t g_res = g_cnt - GlobalUsCounter;
GlobalUsCounter = g_cnt;
return g_res;
}

4
armsrc/util.h
View file

@ -42,4 +42,8 @@ void FormatVersionInformation(char *dst, int len, const char *prefix, void *vers
void StartTickCount(); void StartTickCount();
uint32_t RAMFUNC GetTickCount(); uint32_t RAMFUNC GetTickCount();
void StartCountUS();
uint32_t RAMFUNC GetCountUS();
uint32_t RAMFUNC GetDeltaCountUS();
#endif #endif