diff --git a/armsrc/i2c.c b/armsrc/i2c.c index 8520061b6..f79943d90 100644 --- a/armsrc/i2c.c +++ b/armsrc/i2c.c @@ -37,20 +37,22 @@ #define I2C_ERROR "I2C_WaitAck Error" -// delay=1 is about 200kbps -// I2CSpinDelayClk(4) about 12us -// I2CSpinDelayClk(1) about 3us -// static void I2CSpinDelayClk(const uint16_t delay) { -// for (uint16_t i = 0; i < delay; i++) { -// SpinDelayUsPrecision(2); -// } -// } +// Bus timing lives in i2c.h alongside the timeouts derived from it, so the two +// cannot drift apart. +#define I2C_DELAY_1CLK SpinDelayUsPrecision(I2C_DELAY_1CLK_US) +#define I2C_DELAY_2CLK SpinDelayUsPrecision(I2C_DELAY_2CLK_US) -// TODO DXL 修改了速度到比较慢的情况，测完需要改回来，原先是2和4 +#define SC_PROTO_T0 (1 << 0) +#define SC_PROTO_T1 (1 << 1) -#define I2C_DELAY_1CLK SpinDelayUsPrecision(20) -#define I2C_DELAY_2CLK SpinDelayUsPrecision(22) -// #define I2C_DELAY_XCLK(x) I2CSpinDelayClk((x)) +// Protocols the last ATR offered, as a bit mask of (1 << T). Zero means we do +// not know - no ATR has been read since the module was last reset. +static uint8_t s_card_protocols = 0; + +// Whether the protocol choice has already been reported this session. These +// messages are worth seeing once; sc_raw_device_cmd() runs per APDU, and an +// EMV AID sweep is 150 of them. +static bool s_proto_announced = false; // try i2c bus recovery at 100kHz = 5us high, 5us low void I2C_recovery(void) { @@ -120,6 +122,9 @@ void I2C_SetResetStatus(uint8_t LineRST, uint8_t LineSCK, uint8_t LineSDA) { // Reset the SIM_Adapter, then enter the main program // Note: the SIM_Adapter will not enter the main program after power up. Please run this function before use SIM_Adapter. void I2C_Reset_EnterMainProgram(void) { + // whatever we knew about the card is no longer trustworthy + s_card_protocols = 0; + s_proto_announced = false; StartTicks(); I2C_init(true); I2C_SetResetStatus(0, 0, 0); @@ -152,10 +157,8 @@ static bool WaitSCL_H_delay(uint32_t delay) { return false; } -// 5000 * 3.07us = 15350 us = 15.35 ms -// 15000 * 3.07us = 46050 us = 46.05 ms static bool WaitSCL_H(void) { - return WaitSCL_H_delay(5000); + return WaitSCL_H_delay(I2C_ITERS_FOR_MS(I2C_STRETCH_TIMEOUT_MS)); } static bool WaitSCL_L_delay(uint32_t delay) { @@ -168,10 +171,8 @@ static bool WaitSCL_L_delay(uint32_t delay) { return false; } -// 5000 * 3.07us = 15350us. 15.35ms -// 15000 * 3.07us = 46050us. 46.05ms static bool WaitSCL_L(void) { - return WaitSCL_L_delay(5000); + return WaitSCL_L_delay(I2C_ITERS_FOR_MS(I2C_STRETCH_TIMEOUT_MS)); } // How long to allow the SIM module to *start* an operation, i.e. to pull SCL @@ -235,14 +236,7 @@ static bool I2C_WaitForSim(uint32_t wait) { return false; } - // 8051 speaks with smart card. - // 1000*50*3.07 = 153.5ms - // 1000*110*3.07 = 337.7ms (337700) - // 4 560 000 * 3.07 = 13999,2ms (13999200) - // 1byte transfer == 1ms with max frame being 256bytes - - // fct WaitSCL_H_delay uses a I2C_DELAY_1CLK in the loop with "wait" as number of iterations. - // I2C_DELAY_1CLK == I2CSpinDelayClk(1) = 3.07us + // wait is an iteration count; build it with I2C_ITERS_FOR_MS(). return WaitSCL_H_delay(wait); } @@ -854,13 +848,97 @@ bool sc_rx_bytes(uint8_t *dest, uint16_t *destlen, uint32_t wait) { return true; } +/* + * ISO/IEC 7816-3 clause 8: the protocols on offer are the low nibbles of the + * TDi bytes. With no TD1 at all, only T=0 is offered. T=15 carries global + * interface bytes rather than a transmission protocol and is ignored here. + */ +static uint8_t atr_protocols(const uint8_t *atr, uint8_t len) { + + if (len < 2) { + return 0; + } + + uint8_t y = (uint8_t)(atr[1] >> 4); // T0 + uint8_t i = 2; + uint8_t mask = 0; + + while (y) { + + if (y & 0x01) i++; // TA(i) + if (y & 0x02) i++; // TB(i) + if (y & 0x04) i++; // TC(i) + + if ((y & 0x08) == 0) { + break; // no TD(i), nothing further named + } + if (i >= len) { + break; // truncated ATR + } + + uint8_t td = atr[i++]; + uint8_t t = (uint8_t)(td & 0x0F); + if (t < 8) { + mask |= (uint8_t)(1u << t); + } + y = (uint8_t)(td >> 4); + } + + if (mask == 0) { + mask = SC_PROTO_T0; // clause 8.2.3 + } + return mask; +} + uint8_t sc_raw_device_cmd(smartcard_command_t flags) { + + // An explicit T=1 request is always honoured as asked - it is an override, + // and a card that supports T=1 without advertising it is a real thing. But + // say so when the ATR disagrees, because the alternative is silence from + // the card and no clue why. if ((flags & SC_RAW_T1) == SC_RAW_T1) { + + if ((s_card_protocols != 0) && ((s_card_protocols & SC_PROTO_T1) == 0)) { + if ((g_dbglevel >= DBG_ERROR) && (s_proto_announced == false)) { + s_proto_announced = true; + DbpString("SC: " _YELLOW_("card offers no T=1") ", sending it anyway"); + } + } return I2C_DEVICE_CMD_SEND_T1; } + if ((flags & SC_RAW_T0) == SC_RAW_T0) { + + /* + * A T=0 request to a card whose ATR offers no T=0 cannot work - the + * card will not hear it at all, which shows up as silence rather than + * an error. Most modern EMV and JCOP cards are T=1 only, and callers + * like ExchangeAPDUSC() ask for T=0 unconditionally. + * + * Only this one case is redirected, and only once an ATR has actually + * been read. A card that does offer T=0 is left alone even if it also + * offers T=1, because there the caller's choice is a real one - use + * SC_RAW_T1 to say otherwise. + * + * Note this cannot make anything worse even against a SIM module too + * old to know SEND_T1: in the exact case it fires, the request as given + * was already guaranteed to fail. + */ + if ((s_card_protocols != 0) && + ((s_card_protocols & SC_PROTO_T0) == 0) && + ((s_card_protocols & SC_PROTO_T1) == SC_PROTO_T1)) { + + if ((g_dbglevel >= DBG_INFO) && (s_proto_announced == false)) { + s_proto_announced = true; + DbpString("SC: card offers no T=0, sending as T=1"); + } + return I2C_DEVICE_CMD_SEND_T1; + } + return I2C_DEVICE_CMD_SEND_T0; } + + // Raw pass through: the host owns the framing, so never second guess it. return I2C_DEVICE_CMD_SEND; } @@ -918,6 +996,16 @@ bool GetATR(smart_card_atr_t *card_ptr, bool verbose) { } card_ptr->atr_len = (uint8_t)(len & 0xff); + + s_card_protocols = atr_protocols(card_ptr->atr, card_ptr->atr_len); + s_proto_announced = false; + if (g_dbglevel >= DBG_INFO) { + Dbprintf("SC: card offers%s%s" + , (s_card_protocols & SC_PROTO_T0) ? " T=0" : "" + , (s_card_protocols & SC_PROTO_T1) ? " T=1" : "" + ); + } + if (verbose) { LogTrace(card_ptr->atr, card_ptr->atr_len, 0, 0, NULL, false); } @@ -981,10 +1069,14 @@ void SmartCardRaw(const smart_card_raw_t *p) { uint32_t wait = SIM_WAIT_DELAY; if ((flags & SC_WAIT) == SC_WAIT) { - // wait_delay is in ms; one WaitSCL_H_delay iteration is ~3.07us. - // Integer-only conversion via uint64_t to avoid soft-float and avoid - // overflow at large wait_delay values: (ms * 100000 + 153) / 307. - wait = (uint32_t)(((uint64_t)p->wait_delay * 100000U + 153U) / 307U); + // Asking for N ms now actually waits N ms. The old conversion + // assumed 3.07 us per iteration while the delay had been changed to + // 20 us, so `--timeout 1000` sat there for six and a half seconds. + uint32_t ms = p->wait_delay; + if (ms > I2C_WAIT_MAX_MS) { + ms = I2C_WAIT_MAX_MS; + } + wait = I2C_ITERS_FOR_MS(ms); } LogTrace(p->data, p->len, 0, 0, NULL, true); diff --git a/armsrc/i2c.h b/armsrc/i2c.h index 4b5903bd2..41453dbb9 100644 --- a/armsrc/i2c.h +++ b/armsrc/i2c.h @@ -50,12 +50,95 @@ // The SIM module v4 supports up to 384 bytes for the length. #define ISO7816_MAX_FRAME 270 -// 8051 speaks with smart card. -// 1 byte transfer == 1ms with max frame being 256 bytes. -// SIM_WAIT_DELAY is the iteration count passed to WaitSCL_H_delay(); each iter -// is ~3.07us, so 150000 * 3.07us = ~460ms - the upper bound we wait for the -// SIM module to assert SCL after a SIM-side operation. -#define SIM_WAIT_DELAY 150000 // ~460ms total wait via WaitSCL_H_delay +/* + * Bit banged bus timing. + * + * I2C_DELAY_1CLK is spent twice per bit and I2C_DELAY_2CLK once, so the bit + * period is 2 * 1CLK + 2CLK. At 2/4 us that is ~125 kHz nominal; expect nearer + * 90 kHz once SpinDelayUsPrecision()'s own overhead at these short durations is + * counted. + * + * TODO DXL 修改了速度到比较慢的情况，测完需要改回来，原先是2和4 + * + * ("the speed was changed to a slower setting; change it back after testing, + * originally 2 and 4") + * + * That TODO belongs to the HAL refactoring for the Proxmark5 (Artery + * AT32F435/437), where SpinDelayUsPrecision() is a different implementation + * whose overhead at a two microsecond request has not been measured. The + * 20/22 us it was raised to is kept for that platform rather than thrown away. + * + * Nothing depends on it yet: smartcard support is not built for PM5 - see the + * "暂时不要编译i2c" note beside its PLATFORM_DEFS in common_arm/Makefile.hal - + * so the AT32 branch below is an unvalidated starting point, not a measurement. + * When that bring-up happens, measure the AT32 delay and set it here; every + * timeout in this file is derived from these two numbers, so that is the only + * place it needs to change. + */ +/* + * 20/22 on both platforms for now. + * + * Dropping this to 2/4 was tried and the bus stopped working entirely - no ATR, + * no answer to anything - even with the delay primitive's overshoot bug fixed + * (see SpinDelayUsPrecision in common_arm/ticks/ticks_hw_at91.c). 8 us per bit + * is about 125 kHz, and something in the path will not carry it: rise time + * through the pull ups is the obvious candidate, but it was not measured. + * + * Worth revisiting with a scope on SCL and SDA rather than by trial. Every + * timeout below is derived from these two numbers, so changing them is a + * two line edit once someone knows what the bus can actually do. + */ +#define I2C_DELAY_1CLK_US 20 +#define I2C_DELAY_2CLK_US 22 + +/* + * Every SCL wait loop spends one I2C_DELAY_1CLK per iteration, so the timeouts + * below are iteration counts rather than times - which is why changing the + * delay used to silently rescale every one of them, and why the constants had + * drifted to roughly 6.5x their documented length. + * + * They are written in milliseconds now and converted in one place, so the two + * cannot come apart again. The conversion uses the nominal delay rather than a + * measured one on purpose: with the real per-iteration cost being a little + * higher, a timeout always lasts at least as long as it asks for. + */ +#define I2C_ITERS_PER_MS (1000U / I2C_DELAY_1CLK_US) +#define I2C_ITERS_FOR_MS(ms) ((uint32_t)(ms) * (uint32_t)I2C_ITERS_PER_MS) + +// How long the master tolerates the slave stretching SCL inside a transfer. +#define I2C_STRETCH_TIMEOUT_MS 100 + +/* + * How long to wait for the SIM module to finish an operation and release SCL. + * + * This has to cover the card's own thinking time. A T=1 card's block waiting + * time is 1.4 s at the default BWI = 4, and a HID iCLASS SE SAM asks for + * BWI = 5, i.e. 2.9 s - so 3 s is the smallest value that clears both. + */ +// Upper bound on a host supplied SC_WAIT, so the conversion cannot overflow. +#define I2C_WAIT_MAX_MS 60000 + +#define SIM_WAIT_MS 3000 +#define SIM_WAIT_DELAY I2C_ITERS_FOR_MS(SIM_WAIT_MS) + +/* + * Compile time guards on the two numbers above. The build is -std=c99 so this + * is the negative array size trick rather than _Static_assert. + */ +#define I2C_BUILD_ASSERT(cond, name) typedef char i2c_assert_##name[(cond) ? 1 : -1] + +// A delay that does not divide 1000 makes I2C_ITERS_PER_MS silently lose +// precision, and every timeout with it. +I2C_BUILD_ASSERT((1000U % I2C_DELAY_1CLK_US) == 0, clk_divides_ms); + +// A T=1 card may sit quiet for its whole block waiting time before answering: +// 1.4 s at the default BWI = 4, and 2.9 s at the BWI = 5 a HID iCLASS SE SAM +// asks for. Shorten this and T=1 starts timing out on slow cards with nothing +// to show for it but an empty response. +I2C_BUILD_ASSERT(SIM_WAIT_MS >= 3000, sim_wait_covers_bwt); + +// The largest host supplied wait must still fit the iteration counter. +I2C_BUILD_ASSERT((uint64_t)I2C_WAIT_MAX_MS * I2C_ITERS_PER_MS <= 0xFFFFFFFFULL, wait_fits_u32); void I2C_recovery(void); diff --git a/armsrc/i2c_direct.c b/armsrc/i2c_direct.c index 0d50cc15c..4408157cc 100644 --- a/armsrc/i2c_direct.c +++ b/armsrc/i2c_direct.c @@ -85,10 +85,12 @@ static void SmartCardDirectSend(uint8_t prepend, const smart_card_raw_t *p, uint ((flags & SC_RAW_T1) == SC_RAW_T1)) { if ((flags & SC_WAIT) == SC_WAIT) { - // wait_delay is in ms; one WaitSCL_H_delay iteration is ~3.07us. - // Integer-only conversion via uint64_t to avoid soft-float and - // avoid overflow at large wait_delay values. - wait = (uint32_t)(((uint64_t)p->wait_delay * 100000U + 153U) / 307U); + // see the same conversion in SmartCardRaw() + uint32_t ms = p->wait_delay; + if (ms > I2C_WAIT_MAX_MS) { + ms = I2C_WAIT_MAX_MS; + } + wait = I2C_ITERS_FOR_MS(ms); } LogTrace(p->data, p->len, 0, 0, NULL, true); diff --git a/client/src/cmdsmartcard.c b/client/src/cmdsmartcard.c index e8daeced7..e088b348d 100644 --- a/client/src/cmdsmartcard.c +++ b/client/src/cmdsmartcard.c @@ -442,8 +442,23 @@ static int smart_responseEx(uint8_t *out, int maxoutlen, bool verbose, uint8_t c goto out; } - // data wo ACK - if (datalen != len + 2) { + /* + * Two shapes are valid here, depending on how the GET RESPONSE went out: + * + * len + 2 the data and its status word. This is what SEND_T0 + * gives, because the module runs the procedure byte + * exchange itself and strips the echoed INS. + * len + 2 + 1 the same with that procedure byte still in front, + * which is what the raw pass through leaves behind. + * + * Only the second needs unwrapping - but the first used to fall through + * both branches without ever adding to totallen, so the caller got zero + * bytes and reported "result length = 0" while the card had answered + * perfectly. It went unnoticed while GET RESPONSE was always sent raw. + */ + if (datalen == len + 2) { + totallen += datalen; + } else { // data with ACK if (datalen == len + 2 + 1) { // 2 - response, 1 - ACK if (out[ofs] != ISO7816_GET_RESPONSE) { @@ -1638,6 +1653,24 @@ int CmdSmartcard(const char *Cmd) { return CmdsParse(CommandTable, Cmd); } +/* + * Which protocol the contact exchanges below ask for. + * + * T=0 by default, which is what this has always sent. The ARM side already + * redirects a T=0 request to T=1 when the card's ATR offers no T=0 at all - a + * request that could not have worked as asked. This is for the other case: a + * card that offers both, where T=0 would work but you want T=1 anyway. + */ +static smartcard_command_t s_sc_protocol = SC_RAW_T0; + +void SetSmartcardProtocolT1(bool use_t1) { + s_sc_protocol = use_t1 ? SC_RAW_T1 : SC_RAW_T0; +} + +bool GetSmartcardProtocolT1(void) { + return (s_sc_protocol == SC_RAW_T1); +} + int ExchangeAPDUSC(bool verbose, uint8_t *datain, int datainlen, bool activateCard, bool leaveSignalON, uint8_t *dataout, int maxdataoutlen, int *dataoutlen) { *dataoutlen = 0; @@ -1647,7 +1680,7 @@ int ExchangeAPDUSC(bool verbose, uint8_t *datain, int datainlen, bool activateCa PrintAndLogEx(WARNING, "Failed to allocate memory"); return PM3_EMALLOC; } - payload->flags = (SC_RAW_T0 | SC_LOG); + payload->flags = (s_sc_protocol | SC_LOG); if (activateCard) { payload->flags |= (SC_SELECT | SC_CONNECT); } @@ -1658,7 +1691,7 @@ int ExchangeAPDUSC(bool verbose, uint8_t *datain, int datainlen, bool activateCa clearCommandBuffer(); SendCommandNG(CMD_SMART_RAW, (uint8_t *)payload, sizeof(smart_card_raw_t) + datainlen); - int len = smart_responseEx(dataout, maxdataoutlen, verbose, (datainlen > 0) ? datain[0] : 0x00, SC_RAW); + int len = smart_responseEx(dataout, maxdataoutlen, verbose, (datainlen > 0) ? datain[0] : 0x00, s_sc_protocol); if (len < 0) { free(payload); return PM3_ESOFT; @@ -1667,7 +1700,7 @@ int ExchangeAPDUSC(bool verbose, uint8_t *datain, int datainlen, bool activateCa // retry if (len > 1 && dataout[len - 2] == 0x6c && datainlen > 4) { - payload->flags = SC_RAW_T0; + payload->flags = s_sc_protocol; payload->len = 5; // transfer length via T=0 datain[4] = dataout[len - 1]; @@ -1675,7 +1708,7 @@ int ExchangeAPDUSC(bool verbose, uint8_t *datain, int datainlen, bool activateCa clearCommandBuffer(); SendCommandNG(CMD_SMART_RAW, (uint8_t *)payload, sizeof(smart_card_raw_t) + 5); datain[4] = 0; - len = smart_responseEx(dataout, maxdataoutlen, verbose, datain[0], SC_RAW); + len = smart_responseEx(dataout, maxdataoutlen, verbose, datain[0], s_sc_protocol); if (len < 0) { free(payload); return PM3_ESOFT; diff --git a/client/src/cmdsmartcard.h b/client/src/cmdsmartcard.h index 6ed0a2842..e630f5dee 100644 --- a/client/src/cmdsmartcard.h +++ b/client/src/cmdsmartcard.h @@ -30,6 +30,11 @@ int CmdSmartcard(const char *Cmd); bool smart_select(bool verbose, smart_card_atr_t *atr); +// Ask the contact exchanges for T=1 rather than the default T=0. Only needed +// for a card that offers both - the ARM redirects a T=1 only card by itself. +void SetSmartcardProtocolT1(bool use_t1); +bool GetSmartcardProtocolT1(void); + int ExchangeAPDUSC(bool verbose, uint8_t *datain, int datainlen, bool activateCard, bool leaveSignalON, uint8_t *dataout, int maxdataoutlen, int *dataoutlen); #endif diff --git a/client/src/emv/cmdemv.c b/client/src/emv/cmdemv.c index 4c38dae53..9792bacdd 100644 --- a/client/src/emv/cmdemv.c +++ b/client/src/emv/cmdemv.c @@ -2776,11 +2776,15 @@ static int CmdEMVReader(const char *Cmd) { "In `verbose` mode it will also try to extract and decode the transaction logs stored on card in either channel.\n", "emv reader\n" "emv reader -v\n" - "emv reader -@ -> Continuous mode\n" + "emv reader -w -> contact interface\n" + "emv reader -w -1 -> contact interface, protocol T=1\n" + "emv reader -@ -> Continuous mode\n" ); void *argtable[] = { arg_param_begin, arg_lit0("w", "wired", "Send data via contact (iso7816) interface. (def: Contactless interface)"), + arg_lit0("0", NULL, "use protocol T=0 (default)"), + arg_lit0("1", NULL, "use protocol T=1"), arg_lit0("v", "verbose", "Verbose output"), arg_lit0("@", NULL, "continuous reader mode"), arg_param_end @@ -2792,11 +2796,27 @@ static int CmdEMVReader(const char *Cmd) { channel = CC_CONTACT; } + bool use_t0 = arg_get_lit(ctx, 2); + bool use_t1 = arg_get_lit(ctx, 3); uint8_t psenum = (channel == CC_CONTACT) ? 1 : 2; - bool verbose = arg_get_lit(ctx, 2); - bool continuous = arg_get_lit(ctx, 3); + bool verbose = arg_get_lit(ctx, 4); + bool continuous = arg_get_lit(ctx, 5); CLIParserFree(ctx); + if (use_t0 && use_t1) { + PrintAndLogEx(FAILED, "Choose either -0 or -1, not both"); + return PM3_EINVARG; + } + + if ((use_t0 || use_t1) && channel != CC_CONTACT) { + PrintAndLogEx(FAILED, "-0 and -1 only apply to the contact interface, add -w"); + return PM3_EINVARG; + } + + // A card whose ATR offers no T=0 is switched over by the ARM on its own; + // this is for one that offers both and would otherwise be driven as T=0. + SetSmartcardProtocolT1(use_t1); + if (continuous) { PrintAndLogEx(INFO, "Press " _GREEN_("") " to exit"); } diff --git a/client/src/emv/emvcore.c b/client/src/emv/emvcore.c index b663af706..07487dfa4 100644 --- a/client/src/emv/emvcore.c +++ b/client/src/emv/emvcore.c @@ -329,6 +329,12 @@ static int EMVSelectWithRetry(Iso7816CommandChannel channel, bool ActivateField, // retry if error and not returned sw error if (res && res != 5) { + + // a PM3_E* transport failure will not be fixed by asking again + if (res < 0) { + return res; + } + if (++retrycnt < 3) { continue; } else { @@ -379,7 +385,9 @@ static int EMVCheckAID(Iso7816CommandChannel channel, bool decodeTLV, struct tlv return res; } -int EMVSearchPSE(Iso7816CommandChannel channel, bool ActivateField, bool LeaveFieldON, uint8_t PSENum, bool decodeTLV, struct tlvdb *tlv) { +// quiet: the caller has a fallback lined up, so a failure here is a probe +// rather than a problem and should not be reported as one. +int EMVSearchPSE(Iso7816CommandChannel channel, bool ActivateField, bool LeaveFieldON, uint8_t PSENum, bool decodeTLV, struct tlvdb *tlv, bool quiet) { uint8_t data[APDU_RES_LEN] = {0}; size_t datalen = 0; uint16_t sw = 0; @@ -391,7 +399,9 @@ int EMVSearchPSE(Iso7816CommandChannel channel, bool ActivateField, bool LeaveFi if (!res) { if (sw != ISO7816_OK) { - PrintAndLogEx(FAILED, "Select PSE error. APDU error: %04x.", sw); + if (quiet == false) { + PrintAndLogEx(FAILED, "Select PSE error. APDU error: %04x.", sw); + } return 1; } @@ -463,7 +473,7 @@ int EMVSearchPSE(Iso7816CommandChannel channel, bool ActivateField, bool LeaveFi } else { PrintAndLogEx(WARNING, "%s ERROR: Can't get TLV from response.", PSE_or_PPSE); } - } else { + } else if (quiet == false) { PrintAndLogEx(ERR, "%s ERROR: Can't select PPSE AID. Error: %d", PSE_or_PPSE, res); } @@ -492,6 +502,23 @@ int EMVSearch(Iso7816CommandChannel channel, bool ActivateField, bool LeaveField int res = EMVSelect(channel, (i == 0) ? ActivateField : false, true, aidbuf, aidlen, data, sizeof(data), &datalen, &sw, tlv); // retry if error and not returned sw error if (res && res != 5) { + + // A negative result is a PM3_E* transport failure rather than + // anything the card said - PM3_EIO when the field has gone + // inactive, for instance. Retrying the same AID cannot fix that, + // and neither can the ~150 AIDs still to come: without this it + // retries each of them three times and prints a failure for every + // attempt. + if (res < 0) { + if (LeaveFieldON == false) { + DropFieldEx(channel); + } + if (verbose) { + PrintAndLogEx(WARNING, "exiting..."); + } + return 1; + } + if (++retrycnt < 3) { i--; } else { diff --git a/client/src/emv/emvcore.h b/client/src/emv/emvcore.h index 6ff2b6ef9..934d6a617 100644 --- a/client/src/emv/emvcore.h +++ b/client/src/emv/emvcore.h @@ -62,7 +62,7 @@ struct tlvdb *GetdCVVRawFromTrack2(const struct tlv *track2); int EMVExchange(Iso7816CommandChannel channel, bool LeaveFieldON, sAPDU_t apdu, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv); // search application -int EMVSearchPSE(Iso7816CommandChannel channel, bool ActivateField, bool LeaveFieldON, uint8_t PSENum, bool decodeTLV, struct tlvdb *tlv); +int EMVSearchPSE(Iso7816CommandChannel channel, bool ActivateField, bool LeaveFieldON, uint8_t PSENum, bool decodeTLV, struct tlvdb *tlv, bool quiet); int EMVSearch(Iso7816CommandChannel channel, bool ActivateField, bool LeaveFieldON, bool decodeTLV, struct tlvdb *tlv, bool verbose); int EMVSelectPSE(Iso7816CommandChannel channel, bool ActivateField, bool LeaveFieldON, uint8_t PSENum, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw); int EMVSelect(Iso7816CommandChannel channel, bool ActivateField, bool LeaveFieldON, uint8_t *AID, size_t AIDLen, uint8_t *Result, size_t MaxResultLen, size_t *ResultLen, uint16_t *sw, struct tlvdb *tlv); diff --git a/client/src/iso7816/iso7816core.c b/client/src/iso7816/iso7816core.c index 6699a2d2b..c15f3c858 100644 --- a/client/src/iso7816/iso7816core.c +++ b/client/src/iso7816/iso7816core.c @@ -208,9 +208,9 @@ int Iso7816Exchange(Iso7816CommandChannel channel, bool leave_field_on, sAPDU_t int Iso7816Select(Iso7816CommandChannel channel, bool activate_field, bool leave_field_on, uint8_t *aid, size_t aid_len, uint8_t *result, size_t max_result_len, size_t *result_len, uint16_t *sw) { - return Iso7816ExchangeEx(channel - , activate_field - , leave_field_on + int res = Iso7816ExchangeEx(channel + , activate_field + , leave_field_on , (sAPDU_t) {0x00, 0xa4, 0x04, 0x00, aid_len, aid} , (channel == CC_CONTACTLESS) , 0 @@ -218,5 +218,42 @@ int Iso7816Select(Iso7816CommandChannel channel, bool activate_field, bool leave , max_result_len , result_len , sw - ); + ); + + /* + * A contact card running T=1 needs the Le that a T=0 card must not be + * given. T=0 answers a case 4 command with 61xx and hands the data over + * through GET RESPONSE, so the Le is left off; T=1 carries the whole APDU + * in one block and has no such step, so the command has to ask for its + * length up front. Send one without and a strict card answers 6700. + * + * Rather than work out which protocol the link ended up on - the ARM may + * have switched to T=1 on its own, off the ATR, without the client being + * told - let the card say so and reissue. EMVReadRecord() and + * EMVGenerateChallenge() already do the mirror image of this. + * + * Only on 6700/6F00, and only on contact: a T=0 card has no reason to + * answer a SELECT that way, and if one did the retry costs a single extra + * APDU that it will reject just as it rejected the first. + */ + if ((channel == CC_CONTACT) && (sw != NULL) && ((*sw == 0x6700) || (*sw == 0x6F00))) { + + if (APDULogging) { + PrintAndLogEx(INFO, ">>> wrong length, reissuing SELECT with Le..."); + } + + res = Iso7816ExchangeEx(channel + , false + , leave_field_on + , (sAPDU_t) {0x00, 0xa4, 0x04, 0x00, aid_len, aid} + , true + , 0 + , result + , max_result_len + , result_len + , sw + ); + } + + return res; }