search

RfidResearchGroup / proxmark3

Iceman Fork - Proxmark3
http://www.icedev.se
GNU General Public License v3.0
3.65k stars 981 forks source link

Hitag sniff deadlocks if not first command #220

Closed ViRb3 closed 5 years ago

ViRb3 commented 5 years ago

Hitag sniff works only if it's the first command you run. If it's preceded by any other command (e.g. lf search) it deadlocks here forever:

https://github.com/RfidResearchGroup/proxmark3/blob/a3962c16c3ef14c9c5d82755b2b36dcaea87b2f1/armsrc/hitag2.c#L742

ViRb3 commented 5 years ago

It looks to me that TC0 is not used or initialized yet we are waiting for it to be zeroed?

https://github.com/RfidResearchGroup/proxmark3/blob/a3962c16c3ef14c9c5d82755b2b36dcaea87b2f1/armsrc/hitag2.c#L731-L744

ViRb3 commented 5 years ago

No clue if a proper fix, but the below seems to work: https://github.com/RfidResearchGroup/proxmark3/blob/a3962c16c3ef14c9c5d82755b2b36dcaea87b2f1/armsrc/hitag2.c#L742 Change to:

while (AT91C_BASE_TC1->TC_CV > 0) {}; // wait until TC1 returned to zero

And of course remove the clear at the end: https://github.com/RfidResearchGroup/proxmark3/blob/a3962c16c3ef14c9c5d82755b2b36dcaea87b2f1/armsrc/hitag2.c#L890

iceman1001 commented 5 years ago

Clock 0 - AT91C_BASE_TC0 vs Clock 1 - AT91C_BASE_TC1

Hm, is there any more references to clock 0 in the hitag code? If no, then a change to clock1 is ok.

iceman1001 commented 5 years ago

A quick look at it, looks like it only use clock1. Make a PR for your suggested fix :)

ViRb3 commented 5 years ago

Wouldn't it be better if we use clock0 instead?

iceman1001 commented 5 years ago

Don't think it does any difference. clock1 in the sniff code will do just fine.