armsrc/Standalone/hf_bog.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) Bogiton 2018
   3 // Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
   4 //
   5 // This program is free software: you can redistribute it and/or modify
   6 // it under the terms of the GNU General Public License as published by
   7 // the Free Software Foundation, either version 3 of the License, or
   8 // (at your option) any later version.
   9 //
  10 // This program is distributed in the hope that it will be useful,
  11 // but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 // GNU General Public License for more details.
  14 //
  15 // See LICENSE.txt for the text of the license.
  16 //-----------------------------------------------------------------------------
  17 // main code for standalone HF Sniff (and ULC/NTAG/ULEV1 pwd storing)
  18 //-----------------------------------------------------------------------------
  19
  20 /*
  21 This can actually be used in two separate ways.
  22 It can either be used to just HF 14a sniff on the go and/or grab the
  23 authentication attempts for ULC/NTAG/ULEV1 into the flash mem (RDV4).
  24
  25 The retrieved sniffing session can be acquired by connecting the device
  26 to a client that supports the reconnect capability and issue 'hf 14a list'.
  27
  28 In order to view the grabbed authentication attempts in the flash mem,
  29 you can simply run 'script run mem_readpwd' or just 'mem dump p l 256'
  30 from the client to view the stored quadlets.
  31 */
  32
  33 #include "standalone.h" // standalone definitions
  34 #include "proxmark3_arm.h"
  35 #include "iso14443a.h"
  36 #include "protocols.h"
  37 #include "util.h"
  38 #include "spiffs.h"
  39 #include "appmain.h"
  40 #include "fpgaloader.h"
  41 #include "dbprint.h"
  42 #include "ticks.h"
  43 #include "BigBuf.h"
  44 #include "string.h"
  45
  46 #define DELAY_READER_AIR2ARM_AS_SNIFFER (2 + 3 + 8)
  47 #define DELAY_TAG_AIR2ARM_AS_SNIFFER (3 + 14 + 8)
  48
  49 // Maximum number of auth attempts per standalone session
  50 #define MAX_PWDS_PER_SESSION 64
  51
  52 #define HF_BOG_LOGFILE "hf_bog.log"
  53
  54 // This is actually copied from SniffIso14443a
  55 static void RAMFUNC SniffAndStore(uint8_t param) {
  56
  57     iso14443a_setup(FPGA_HF_ISO14443A_SNIFFER);
  58
  59     // Allocate memory from BigBuf for some buffers
  60     // free all previous allocations first
  61     BigBuf_free();
  62     BigBuf_Clear_ext(false);
  63     set_tracing(true);
  64
  65     // Array to store the authpwds
  66     uint8_t *capturedPwds = BigBuf_malloc(4 * MAX_PWDS_PER_SESSION);
  67
  68     // The command (reader -> tag) that we're receiving.
  69     uint8_t *receivedCmd = BigBuf_malloc(MAX_FRAME_SIZE);
  70     uint8_t *receivedCmdPar = BigBuf_malloc(MAX_PARITY_SIZE);
  71
  72     // The response (tag -> reader) that we're receiving.
  73     uint8_t *receivedResp = BigBuf_malloc(MAX_FRAME_SIZE);
  74     uint8_t *receivedRespPar = BigBuf_malloc(MAX_PARITY_SIZE);
  75
  76     // The DMA buffer, used to stream samples from the FPGA
  77     uint8_t *dmaBuf = BigBuf_malloc(DMA_BUFFER_SIZE);
  78     uint8_t *data = dmaBuf;
  79
  80     uint8_t previous_data = 0;
  81     int dataLen;
  82     bool TagIsActive = false;
  83     bool ReaderIsActive = false;
  84
  85     // Set up the demodulator for tag -> reader responses.
  86     Demod14aInit(receivedResp, MAX_FRAME_SIZE, receivedRespPar);
  87
  88     // Set up the demodulator for the reader -> tag commands
  89     Uart14aInit(receivedCmd, MAX_FRAME_SIZE, receivedCmdPar);
  90
  91     // Setup and start DMA.
  92     if (!FpgaSetupSscDma((uint8_t *)dmaBuf, DMA_BUFFER_SIZE)) {
  93         if (g_dbglevel > 1) {
  94             Dbprintf("FpgaSetupSscDma failed. Exiting");
  95         }
  96         return;
  97     }
  98
  99     tUart14a *uart = GetUart14a();
 100     tDemod14a *demod = GetDemod14a();
 101
 102     // We won't start recording the frames that we acquire until we trigger;
 103     // a good trigger condition to get started is probably when we see a
 104     // response from the tag.
 105     // triggered == false -- to wait first for card
 106     bool triggered = !(param & 0x03);
 107
 108     uint32_t my_rsamples = 0;
 109
 110     // Current captured passwords counter
 111     uint8_t auth_attempts = 0;
 112
 113     SpinDelay(50);
 114
 115     // loop and listen
 116     while (BUTTON_PRESS() == false) {
 117         WDT_HIT();
 118         LED_A_ON();
 119
 120         int register readBufDataP = data - dmaBuf;
 121         int register dmaBufDataP = DMA_BUFFER_SIZE - AT91C_BASE_PDC_SSC->PDC_RCR;
 122         if (readBufDataP <= dmaBufDataP)
 123             dataLen = dmaBufDataP - readBufDataP;
 124         else
 125             dataLen = DMA_BUFFER_SIZE - readBufDataP + dmaBufDataP;
 126
 127         // test for length of buffer
 128         if (dataLen > DMA_BUFFER_SIZE) { // TODO: Check if this works properly
 129             Dbprintf("[!] blew circular buffer! | datalen %u", dataLen);
 130             break;
 131         }
 132         if (dataLen < 1)
 133             continue;
 134
 135         // primary buffer was stopped( <-- we lost data!
 136         if (AT91C_BASE_PDC_SSC->PDC_RCR == 0) {
 137             AT91C_BASE_PDC_SSC->PDC_RPR = (uint32_t)dmaBuf;
 138             AT91C_BASE_PDC_SSC->PDC_RCR = DMA_BUFFER_SIZE;
 139             // Dbprintf("[-] RxEmpty ERROR | data length %d", dataLen); // temporary
 140         }
 141         // secondary buffer sets as primary, secondary buffer was stopped
 142         if (AT91C_BASE_PDC_SSC->PDC_RNCR == 0) {
 143             AT91C_BASE_PDC_SSC->PDC_RNPR = (uint32_t)dmaBuf;
 144             AT91C_BASE_PDC_SSC->PDC_RNCR = DMA_BUFFER_SIZE;
 145         }
 146
 147         LED_A_OFF();
 148
 149         // Need two samples to feed Miller and Manchester-Decoder
 150         if (my_rsamples & 0x01) {
 151
 152             if (!TagIsActive) { // no need to try decoding reader data if the tag is sending
 153                 uint8_t readerdata = (previous_data & 0xF0) | (*data >> 4);
 154                 if (MillerDecoding(readerdata, (my_rsamples - 1) * 4)) {
 155                     LED_C_ON();
 156
 157                     // check - if there is a short 7bit request from reader
 158                     if ((!triggered) && (param & 0x02) && (uart->len == 1) && (uart->bitCount == 7))
 159                         triggered = true;
 160
 161                     if (triggered) {
 162                         if ((receivedCmd) &&
 163                                 ((receivedCmd[0] == MIFARE_ULEV1_AUTH) || (receivedCmd[0] == MIFARE_ULC_AUTH_1))) {
 164                             if (g_dbglevel > 1)
 165                                 Dbprintf("PWD-AUTH KEY: 0x%02x%02x%02x%02x", receivedCmd[1], receivedCmd[2],
 166                                          receivedCmd[3], receivedCmd[4]);
 167
 168                             // temporarily save the captured pwd in our array
 169                             memcpy(&capturedPwds[4 * auth_attempts], receivedCmd + 1, 4);
 170                             auth_attempts++;
 171                         }
 172
 173                         if (!LogTrace(receivedCmd, uart->len, uart->startTime * 16 - DELAY_READER_AIR2ARM_AS_SNIFFER,
 174                                       uart->endTime * 16 - DELAY_READER_AIR2ARM_AS_SNIFFER, uart->parity, true))
 175                             break;
 176                     }
 177                     /* ready to receive another command. */
 178                     Uart14aReset();
 179                     /* reset the demod code, which might have been */
 180                     /* false-triggered by the commands from the reader. */
 181                     Demod14aReset();
 182                     LED_B_OFF();
 183                 }
 184                 ReaderIsActive = (uart->state != STATE_14A_UNSYNCD);
 185             }
 186
 187             // no need to try decoding tag data if the reader is sending - and we cannot afford the time
 188             if (!ReaderIsActive) {
 189                 uint8_t tagdata = (previous_data << 4) | (*data & 0x0F);
 190                 if (ManchesterDecoding(tagdata, 0, (my_rsamples - 1) * 4)) {
 191                     LED_B_ON();
 192
 193                     if (!LogTrace(receivedResp, demod->len, demod->startTime * 16 - DELAY_TAG_AIR2ARM_AS_SNIFFER,
 194                                   demod->endTime * 16 - DELAY_TAG_AIR2ARM_AS_SNIFFER, demod->parity, false))
 195                         break;
 196
 197                     if ((!triggered) && (param & 0x01))
 198                         triggered = true;
 199
 200                     // ready to receive another response.
 201                     Demod14aReset();
 202                     // reset the Miller decoder including its (now outdated) input buffer
 203                     Uart14aReset();
 204                     // UartInit(receivedCmd, receivedCmdPar);
 205                     LED_C_OFF();
 206                 }
 207                 TagIsActive = (demod->state != DEMOD_14A_UNSYNCD);
 208             }
 209         }
 210
 211         previous_data = *data;
 212         my_rsamples++;
 213         data++;
 214         if (data == dmaBuf + DMA_BUFFER_SIZE) {
 215             data = dmaBuf;
 216         }
 217     } // end main loop
 218
 219     FpgaDisableSscDma();
 220     set_tracing(false);
 221
 222     Dbprintf("Stopped sniffing");
 223
 224     SpinDelay(200);
 225
 226     // Write stuff to spiffs logfile
 227     if (auth_attempts > 0) {
 228         if (g_dbglevel > 1)
 229             Dbprintf("[!] Authentication attempts = %u", auth_attempts);
 230
 231         if (!exists_in_spiffs((char *)HF_BOG_LOGFILE)) {
 232             rdv40_spiffs_write((char *)HF_BOG_LOGFILE, capturedPwds, 4 * auth_attempts, RDV40_SPIFFS_SAFETY_SAFE);
 233         } else {
 234             rdv40_spiffs_append((char *)HF_BOG_LOGFILE, capturedPwds, 4 * auth_attempts, RDV40_SPIFFS_SAFETY_SAFE);
 235         }
 236     }
 237
 238     if (g_dbglevel > 1)
 239         Dbprintf("[!] Wrote %u Authentication attempts into logfile", auth_attempts);
 240
 241     SpinErr(LED_A, 200, 5);
 242     SpinDelay(100);
 243 }
 244
 245 void ModInfo(void) {
 246     DbpString("  HF 14a sniff standalone with ULC/ULEV1/NTAG auth storing in flashmem - aka BogitoRun (Bogito)");
 247 }
 248
 249 void RunMod(void) {
 250
 251     StandAloneMode();
 252
 253     Dbprintf(">>  Bogiton 14a Sniff UL/UL-EV1/NTAG a.k.a BogitoRun Started  <<");
 254     Dbprintf("Starting to sniff");
 255
 256     // param:
 257     // bit 0 - trigger from first card answer
 258     // bit 1 - trigger from first reader 7-bit request
 259     SniffAndStore(0);
 260     LEDsoff();
 261     SpinDelay(300);
 262     Dbprintf("- [ End ] -> You can take shell back ...");
 263     Dbprintf("- [  !  ] -> use 'script run data_read_pwd_mem_spiffs' to print passwords");
 264 }