mirror of
https://github.com/Proxmark/proxmark3.git
synced 2025-08-21 05:43:23 -07:00
Merge branch 'master' into topaz
Conflicts: client/Makefile client/cmdhf.c client/cmdhf14a.c
This commit is contained in:
pwpiwi
commit
db2b81ba11
119 changed files with 20403 additions and 4640 deletions
|
|
@ -555,12 +555,8 @@ void RAMFUNC SnoopIso14443a(uint8_t param) {
|
|||
|
||||
LEDsoff();
|
||||
|
||||
// We won't start recording the frames that we acquire until we trigger;
|
||||
// a good trigger condition to get started is probably when we see a
|
||||
// response from the tag.
|
||||
// triggered == FALSE -- to wait first for card
|
||||
bool triggered = !(param & 0x03);
|
||||
|
||||
iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
|
||||
|
||||
// Allocate memory from BigBuf for some buffers
|
||||
// free all previous allocations first
|
||||
BigBuf_free();
|
||||
|
|
@ -587,8 +583,6 @@ void RAMFUNC SnoopIso14443a(uint8_t param) {
|
|||
bool TagIsActive = FALSE;
|
||||
bool ReaderIsActive = FALSE;
|
||||
|
||||
iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
|
||||
|
||||
// Set up the demodulator for tag -> reader responses.
|
||||
DemodInit(receivedResponse, receivedResponsePar);
|
||||
|
||||
|
|
@ -598,6 +592,12 @@ void RAMFUNC SnoopIso14443a(uint8_t param) {
|
|||
// Setup and start DMA.
|
||||
FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE);
|
||||
|
||||
// We won't start recording the frames that we acquire until we trigger;
|
||||
// a good trigger condition to get started is probably when we see a
|
||||
// response from the tag.
|
||||
// triggered == FALSE -- to wait first for card
|
||||
bool triggered = !(param & 0x03);
|
||||
|
||||
// And now we loop, receiving samples.
|
||||
for(uint32_t rsamples = 0; TRUE; ) {
|
||||
|
||||
|
|
@ -1033,6 +1033,9 @@ void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)
|
|||
.modulation_n = 0
|
||||
};
|
||||
|
||||
// We need to listen to the high-frequency, peak-detected path.
|
||||
iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
|
||||
|
||||
BigBuf_free_keep_EM();
|
||||
|
||||
// allocate buffers:
|
||||
|
|
@ -1061,9 +1064,6 @@ void SimulateIso14443aTag(int tagType, int uid_1st, int uid_2nd, byte_t* data)
|
|||
int happened2 = 0;
|
||||
int cmdsRecvd = 0;
|
||||
|
||||
// We need to listen to the high-frequency, peak-detected path.
|
||||
iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
|
||||
|
||||
cmdsRecvd = 0;
|
||||
tag_response_info_t* p_response;
|
||||
|
||||
|
|
@ -2010,7 +2010,7 @@ int32_t dist_nt(uint32_t nt1, uint32_t nt2) {
|
|||
nttmp1 = prng_successor(nttmp1, 1);
|
||||
if (nttmp1 == nt2) return i;
|
||||
nttmp2 = prng_successor(nttmp2, 1);
|
||||
if (nttmp2 == nt1) return -i;
|
||||
if (nttmp2 == nt1) return -i;
|
||||
}
|
||||
|
||||
return(-99999); // either nt1 or nt2 are invalid nonces
|
||||
|
|
@ -2033,6 +2033,10 @@ void ReaderMifare(bool first_try)
|
|||
uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
|
||||
uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
|
||||
|
||||
if (first_try) {
|
||||
iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
|
||||
}
|
||||
|
||||
// free eventually allocated BigBuf memory. We want all for tracing.
|
||||
BigBuf_free();
|
||||
|
||||
|
|
@ -2061,7 +2065,6 @@ void ReaderMifare(bool first_try)
|
|||
|
||||
if (first_try) {
|
||||
mf_nr_ar3 = 0;
|
||||
iso14443a_setup(FPGA_HF_ISO14443A_READER_MOD);
|
||||
sync_time = GetCountSspClk() & 0xfffffff8;
|
||||
sync_cycles = 65536; // theory: Mifare Classic's random generator repeats every 2^16 cycles (and so do the nonces).
|
||||
nt_attacked = 0;
|
||||
|
|
@ -2079,18 +2082,21 @@ void ReaderMifare(bool first_try)
|
|||
LED_B_OFF();
|
||||
LED_C_OFF();
|
||||
|
||||
|
||||
|
||||
#define DARKSIDE_MAX_TRIES 32 // number of tries to sync on PRNG cycle. Then give up.
|
||||
uint16_t unsuccessfull_tries = 0;
|
||||
|
||||
for(uint16_t i = 0; TRUE; i++) {
|
||||
|
||||
LED_C_ON();
|
||||
WDT_HIT();
|
||||
|
||||
// Test if the action was cancelled
|
||||
if(BUTTON_PRESS()) {
|
||||
isOK = -1;
|
||||
break;
|
||||
}
|
||||
|
||||
LED_C_ON();
|
||||
|
||||
if(!iso14443a_select_card(uid, NULL, &cuid)) {
|
||||
if (MF_DBGLEVEL >= 1) Dbprintf("Mifare: Can't select card");
|
||||
continue;
|
||||
|
|
@ -2125,8 +2131,14 @@ void ReaderMifare(bool first_try)
|
|||
nt_attacked = nt;
|
||||
}
|
||||
else {
|
||||
if (nt_distance == -99999) { // invalid nonce received, try again
|
||||
continue;
|
||||
if (nt_distance == -99999) { // invalid nonce received
|
||||
unsuccessfull_tries++;
|
||||
if (!nt_attacked && unsuccessfull_tries > DARKSIDE_MAX_TRIES) {
|
||||
isOK = -3; // Card has an unpredictable PRNG. Give up
|
||||
break;
|
||||
} else {
|
||||
continue; // continue trying...
|
||||
}
|
||||
}
|
||||
sync_cycles = (sync_cycles - nt_distance);
|
||||
if (MF_DBGLEVEL >= 3) Dbprintf("calibrating in cycle %d. nt_distance=%d, Sync_cycles: %d\n", i, nt_distance, sync_cycles);
|
||||
|
|
@ -2188,6 +2200,10 @@ void ReaderMifare(bool first_try)
|
|||
if (nt_diff == 0 && first_try)
|
||||
{
|
||||
par[0]++;
|
||||
if (par[0] == 0x00) { // tried all 256 possible parities without success. Card doesn't send NACK.
|
||||
isOK = -2;
|
||||
break;
|
||||
}
|
||||
} else {
|
||||
par[0] = ((par[0] & 0x1F) + 1) | par_low;
|
||||
}
|
||||
|
|
@ -2204,7 +2220,7 @@ void ReaderMifare(bool first_try)
|
|||
memcpy(buf + 16, ks_list, 8);
|
||||
memcpy(buf + 24, mf_nr_ar, 4);
|
||||
|
||||
cmd_send(CMD_ACK,isOK,0,0,buf,28);
|
||||
cmd_send(CMD_ACK, isOK, 0, 0, buf, 28);
|
||||
|
||||
// Thats it...
|
||||
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
|
||||
|
|
@ -2265,13 +2281,6 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
|
|||
uint32_t ar_nr_responses[] = {0,0,0,0,0,0,0,0};
|
||||
uint8_t ar_nr_collected = 0;
|
||||
|
||||
// free eventually allocated BigBuf memory but keep Emulator Memory
|
||||
BigBuf_free_keep_EM();
|
||||
|
||||
// clear trace
|
||||
clear_trace();
|
||||
set_tracing(TRUE);
|
||||
|
||||
// Authenticate response - nonce
|
||||
uint32_t nonce = bytes_to_num(rAUTH_NT, 4);
|
||||
|
||||
|
|
@ -2309,13 +2318,10 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
|
|||
if (_7BUID) {
|
||||
rATQA[0] = 0x44;
|
||||
rUIDBCC1[0] = 0x88;
|
||||
rUIDBCC1[4] = rUIDBCC1[0] ^ rUIDBCC1[1] ^ rUIDBCC1[2] ^ rUIDBCC1[3];
|
||||
rUIDBCC2[4] = rUIDBCC2[0] ^ rUIDBCC2[1] ^ rUIDBCC2[2] ^ rUIDBCC2[3];
|
||||
}
|
||||
|
||||
// We need to listen to the high-frequency, peak-detected path.
|
||||
iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
|
||||
|
||||
|
||||
if (MF_DBGLEVEL >= 1) {
|
||||
if (!_7BUID) {
|
||||
Dbprintf("4B UID: %02x%02x%02x%02x",
|
||||
|
|
@ -2327,6 +2333,17 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
|
|||
}
|
||||
}
|
||||
|
||||
// We need to listen to the high-frequency, peak-detected path.
|
||||
iso14443a_setup(FPGA_HF_ISO14443A_TAGSIM_LISTEN);
|
||||
|
||||
// free eventually allocated BigBuf memory but keep Emulator Memory
|
||||
BigBuf_free_keep_EM();
|
||||
|
||||
// clear trace
|
||||
clear_trace();
|
||||
set_tracing(TRUE);
|
||||
|
||||
|
||||
bool finished = FALSE;
|
||||
while (!BUTTON_PRESS() && !finished) {
|
||||
WDT_HIT();
|
||||
|
|
@ -2548,13 +2565,13 @@ void Mifare1ksim(uint8_t flags, uint8_t exitAfterNReads, uint8_t arg2, uint8_t *
|
|||
|| receivedCmd[0] == 0xB0) { // transfer
|
||||
if (receivedCmd[1] >= 16 * 4) {
|
||||
EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
|
||||
if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02) on out of range block: %d (0x%02x), nacking",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
|
||||
if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02x) on out of range block: %d (0x%02x), nacking",receivedCmd[0],receivedCmd[1],receivedCmd[1]);
|
||||
break;
|
||||
}
|
||||
|
||||
if (receivedCmd[1] / 4 != cardAUTHSC) {
|
||||
EmSend4bit(mf_crypto1_encrypt4bit(pcs, CARD_NACK_NA));
|
||||
if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd[0],receivedCmd[1],cardAUTHSC);
|
||||
if (MF_DBGLEVEL >= 2) Dbprintf("Reader tried to operate (0x%02x) on block (0x%02x) not authenticated for (0x%02x), nacking",receivedCmd[0],receivedCmd[1],cardAUTHSC);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
|
@ -2745,10 +2762,8 @@ void RAMFUNC SniffMifare(uint8_t param) {
|
|||
uint8_t receivedResponse[MAX_MIFARE_FRAME_SIZE];
|
||||
uint8_t receivedResponsePar[MAX_MIFARE_PARITY_SIZE];
|
||||
|
||||
// As we receive stuff, we copy it from receivedCmd or receivedResponse
|
||||
// into trace, along with its length and other annotations.
|
||||
//uint8_t *trace = (uint8_t *)BigBuf;
|
||||
|
||||
iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
|
||||
|
||||
// free eventually allocated BigBuf memory
|
||||
BigBuf_free();
|
||||
// allocate the DMA buffer, used to stream samples from the FPGA
|
||||
|
|
@ -2760,8 +2775,6 @@ void RAMFUNC SniffMifare(uint8_t param) {
|
|||
bool ReaderIsActive = FALSE;
|
||||
bool TagIsActive = FALSE;
|
||||
|
||||
iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
|
||||
|
||||
// Set up the demodulator for tag -> reader responses.
|
||||
DemodInit(receivedResponse, receivedResponsePar);
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue