armsrc/Standalone/hf_bog.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) Bogiton 2018
   3 // Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
   4 //
   5 // This program is free software: you can redistribute it and/or modify
   6 // it under the terms of the GNU General Public License as published by
   7 // the Free Software Foundation, either version 3 of the License, or
   8 // (at your option) any later version.
   9 //
  10 // This program is distributed in the hope that it will be useful,
  11 // but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 // GNU General Public License for more details.
  14 //
  15 // See LICENSE.txt for the text of the license.
  16 //-----------------------------------------------------------------------------
  17 // main code for standalone HF Sniff (and ULC/NTAG/ULEV1 pwd storing)
  18 //-----------------------------------------------------------------------------
  19
  20 /*
  21 This can actually be used in two separate ways.
  22 It can either be used to just HF 14a sniff on the go and/or grab the
  23 authentication attempts for ULC/NTAG/ULEV1 into the flash mem (RDV4).
  24
  25 The retrieved sniffing session can be acquired by connecting the device
  26 to a client that supports the reconnect capability and issue 'hf 14a list'.
  27
  28 In order to view the grabbed authentication attempts in the flash mem,
  29 you can simply run 'script run mem_readpwd' or just 'mem dump p l 256'
  30 from the client to view the stored quadlets.
  31 */
  32
  33 #include "standalone.h" // standalone definitions
  34 #include "proxmark3_arm.h"
  35 #include "iso14443a.h"
  36 #include "protocols.h"
  37 #include "util.h"
  38 #include "spiffs.h"
  39 #include "appmain.h"
  40 #include "fpgaloader.h"
  41 #include "dbprint.h"
  42 #include "ticks.h"
  43 #include "BigBuf.h"
  44 #include "string.h"
  45
  46 #define DELAY_READER_AIR2ARM_AS_SNIFFER (2 + 3 + 8)
  47 #define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 14 + 8)
  48
  49 // Maximum number of auth attempts per standalone session
  50 #define MAX_PWDS_PER_SESSION 64
  51
  52 #define HF_BOG_LOGFILE "hf_bog.log"
  53
  54 // This is actually copied from SniffIso14443a
  55 static void RAMFUNC SniffAndStore(uint8_t param) {
  56
  57     iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
  58
  59     // Allocate memory from BigBuf for some buffers
  60     // free all previous allocations first
  61     BigBuf_free();
  62     BigBuf_Clear_ext(false);
  63     clear_trace();
  64     set_tracing(true);
  65
  66     // Array to store the authpwds
  67     uint8_t *capturedPwds = BigBuf_malloc(4 * MAX_PWDS_PER_SESSION);
  68
  69     // The command (reader -> tag) that we're receiving.
  70     uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
  71     uint8_t *receivedCmdPar = BigBuf_malloc(MAX_PARITY_SIZE);
  72
  73     // The response (tag -> reader) that we're receiving.
  74     uint8_t *receivedResp = BigBuf_malloc(MAX_FRAME_SIZE);
  75     uint8_t *receivedRespPar = BigBuf_malloc(MAX_PARITY_SIZE);
  76
  77     // The DMA buffer, used to stream samples from the FPGA
  78     uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
  79     uint8_t *data = dmaBuf;
  80
  81     uint8_t previous_data = 0;
  82     int dataLen;
  83     bool TagIsActive = false;
  84     bool ReaderIsActive = false;
  85
  86     // Set up the demodulator for tag -> reader responses.
  87     Demod14aInit(receivedResp, MAX_FRAME_SIZE, receivedRespPar);
  88
  89     // Set up the demodulator for the reader -> tag commands
  90     Uart14aInit(receivedCmd, MAX_FRAME_SIZE, receivedCmdPar);
  91
  92     // Setup and start DMA.
  93     if (!FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE)) {
  94         if (g_dbglevel > 1) {
  95             Dbprintf("FpgaSetupSscDma failed. Exiting");
  96         }
  97         return;
  98     }
  99
 100     tUart14a *uart = GetUart14a();
 101     tDemod14a *demod = GetDemod14a();
 102
 103     // We won't start recording the frames that we acquire until we trigger;
 104     // a good trigger condition to get started is probably when we see a
 105     // response from the tag.
 106     // triggered == false -- to wait first for card
 107     bool triggered = !(param & 0x03);
 108
 109     uint32_t my_rsamples = 0;
 110
 111     // Current captured passwords counter
 112     uint8_t auth_attempts = 0;
 113
 114     SpinDelay(50);
 115
 116     // loop and listen
 117     while (BUTTON_PRESS() == false) {
 118         WDT_HIT();
 119         LED_A_ON();
 120
 121         int register readBufDataP = data - dmaBuf;
 122         int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR;
 123         if (readBufDataP <= dmaBufDataP)
 124             dataLen = dmaBufDataP - readBufDataP;
 125         else
 126             dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP;
 127
 128         // test for length of buffer
 129         if (dataLen > DMA_BUFFER_SIZE) { // TODO: Check if this works properly
 130             Dbprintf("[!] blew circular buffer! | datalen %u", dataLen);
 131             break;
 132         }
 133         if (dataLen < 1)
 134             continue;
 135
 136         // primary buffer was stopped( <-- we lost data!
 137         if (!AT91C_BASE_PDC_SSC->PDC_RCR) {
 138             AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t)dmaBuf;
 139             AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
 140             // Dbprintf("[-] RxEmpty ERROR | data length %d", dataLen); // temporary
 141         }
 142         // secondary buffer sets as primary, secondary buffer was stopped
 143         if (!AT91C_BASE_PDC_SSC->PDC_RNCR) {
 144             AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t)dmaBuf;
 145             AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
 146         }
 147
 148         LED_A_OFF();
 149
 150         // Need two samples to feed Miller and Manchester-Decoder
 151         if (my_rsamples & 0x01) {
 152
 153             if (!TagIsActive) { // no need to try decoding reader data if the tag is sending
 154                 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
 155                 if (MillerDecoding(readerdata, (my_rsamples - 1) * 4)) {
 156                     LED_C_ON();
 157
 158                     // check - if there is a short 7bit request from reader
 159                     if ((!triggered) && (param & 0x02) && (uart->len == 1) && (uart->bitCount == 7))
 160                         triggered = true;
 161
 162                     if (triggered) {
 163                         if ((receivedCmd) &&
 164                                 ((receivedCmd[0] == MIFARE_ULEV1_AUTH) || (receivedCmd[0] == MIFARE_ULC_AUTH_1))) {
 165                             if (g_dbglevel > 1)
 166                                 Dbprintf("PWD-AUTH KEY: 0x%02x%02x%02x%02x", receivedCmd[1], receivedCmd[2],
 167                                          receivedCmd[3], receivedCmd[4]);
 168
 169                             // temporarily save the captured pwd in our array
 170                             memcpy(&capturedPwds[4 * auth_attempts], receivedCmd + 1, 4);
 171                             auth_attempts++;
 172                         }
 173
 174                         if (!LogTrace(receivedCmd, uart->len, uart->startTime * 16 - DELAY_READER_AIR2ARM_AS_SNIFFER,
 175                                       uart->endTime * 16 - DELAY_READER_AIR2ARM_AS_SNIFFER, uart->parity, true))
 176                             break;
 177                     }
 178                     /* ready to receive another command. */
 179                     Uart14aReset();
 180                     /* reset the demod code, which might have been */
 181                     /* false-triggered by the commands from the reader. */
 182                     Demod14aReset();
 183                     LED_B_OFF();
 184                 }
 185                 ReaderIsActive = (uart->state != STATE_14A_UNSYNCD);
 186             }
 187
 188             // no need to try decoding tag data if the reader is sending - and we cannot afford the time
 189             if (!ReaderIsActive) {
 190                 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
 191                 if (ManchesterDecoding(tagdata, 0, (my_rsamples - 1) * 4)) {
 192                     LED_B_ON();
 193
 194                     if (!LogTrace(receivedResp, demod->len, demod->startTime * 16 - DELAY_TAG_AIR2ARM_AS_SNIFFER,
 195                                   demod->endTime * 16 - DELAY_TAG_AIR2ARM_AS_SNIFFER, demod->parity, false))
 196                         break;
 197
 198                     if ((!triggered) && (param & 0x01))
 199                         triggered = true;
 200
 201                     // ready to receive another response.
 202                     Demod14aReset();
 203                     // reset the Miller decoder including its (now outdated) input buffer
 204                     Uart14aReset();
 205                     // UartInit(receivedCmd, receivedCmdPar);
 206                     LED_C_OFF();
 207                 }
 208                 TagIsActive = (demod->state != DEMOD_14A_UNSYNCD);
 209             }
 210         }
 211
 212         previous_data = *data;
 213         my_rsamples++;
 214         data++;
 215         if (data == dmaBuf + DMA_BUFFER_SIZE) {
 216             data = dmaBuf;
 217         }
 218     } // end main loop
 219
 220     FpgaDisableSscDma();
 221     set_tracing(false);
 222
 223     Dbprintf("Stopped sniffing");
 224
 225     SpinDelay(200);
 226
 227     // Write stuff to spiffs logfile
 228     if (auth_attempts > 0) {
 229         if (g_dbglevel > 1)
 230             Dbprintf("[!] Authentication attempts = %u", auth_attempts);
 231
 232         if (!exists_in_spiffs((char *)HF_BOG_LOGFILE)) {
 233             rdv40_spiffs_write((char *)HF_BOG_LOGFILE, capturedPwds, 4 * auth_attempts, RDV40_SPIFFS_SAFETY_SAFE);
 234         } else {
 235             rdv40_spiffs_append((char *)HF_BOG_LOGFILE, capturedPwds, 4 * auth_attempts, RDV40_SPIFFS_SAFETY_SAFE);
 236         }
 237     }
 238
 239     if (g_dbglevel > 1)
 240         Dbprintf("[!] Wrote %u Authentication attempts into logfile", auth_attempts);
 241
 242     SpinErr(LED_A, 200, 5);
 243     SpinDelay(100);
 244 }
 245
 246 void ModInfo(void) {
 247     DbpString("  HF 14a sniff standalone with ULC/ULEV1/NTAG auth storing in flashmem - aka BogitoRun (Bogito)");
 248 }
 249
 250 void RunMod(void) {
 251
 252     StandAloneMode();
 253
 254     Dbprintf(">>  Bogiton 14a Sniff UL/UL-EV1/NTAG a.k.a BogitoRun Started  <<");
 255     Dbprintf("Starting to sniff");
 256
 257     // param:
 258     // bit 0 - trigger from first card answer
 259     // bit 1 - trigger from first reader 7-bit request
 260     SniffAndStore(0);
 261     LEDsoff();
 262     SpinDelay(300);
 263     Dbprintf("- [ End ] -> You can take shell back ...");
 264     Dbprintf("- [  !  ] -> use 'script run data_read_pwd_mem_spiffs' to print passwords");
 265 }