]>
Commit | Line | Data |
---|---|---|
1 | //----------------------------------------------------------------------------- | |
2 | // Copyright (C) 2010 iZsh <izsh at fail0verflow.com> | |
3 | // Modified 2010-2012 by <adrian -at- atrox.at> | |
4 | // Modified 2012 by <vsza at vsza.hu> | |
5 | // | |
6 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
7 | // at your option, any later version. See the LICENSE.txt file for the text of | |
8 | // the license. | |
9 | //----------------------------------------------------------------------------- | |
10 | // High frequency ISO15693 commands | |
11 | //----------------------------------------------------------------------------- | |
12 | // There are three basic operation modes, depending on which device (proxmark/pc) | |
13 | // the signal processing, (de)modulation, transmission protocol and logic is done. | |
14 | // Mode 1: | |
15 | // All steps are done on the proxmark, the output of the commands is returned via | |
16 | // USB-debug-print commands. | |
17 | // Mode 2: | |
18 | // The protocol is done on the PC, passing only Iso15693 data frames via USB. This | |
19 | // allows direct communication with a tag on command level | |
20 | // Mode 3: | |
21 | // The proxmark just samples the antenna and passes this "analog" data via USB to | |
22 | // the client. Signal Processing & decoding is done on the pc. This is the slowest | |
23 | // variant, but offers the possibility to analyze the waveforms directly. | |
24 | ||
25 | #include <stdio.h> | |
26 | #include <stdlib.h> | |
27 | #include <string.h> | |
28 | #include <stdint.h> | |
29 | ||
30 | #include "proxmark3.h" | |
31 | #include "data.h" | |
32 | #include "graph.h" | |
33 | #include "ui.h" | |
34 | #include "util.h" | |
35 | #include "cmdparser.h" | |
36 | #include "cmdhf15.h" | |
37 | #include "iso15693tools.h" | |
38 | #include "cmdmain.h" | |
39 | ||
40 | #define FrameSOF Iso15693FrameSOF | |
41 | #define Logic0 Iso15693Logic0 | |
42 | #define Logic1 Iso15693Logic1 | |
43 | #define FrameEOF Iso15693FrameEOF | |
44 | ||
45 | #define Crc(data,datalen) Iso15693Crc(data,datalen) | |
46 | #define AddCrc(data,datalen) Iso15693AddCrc(data,datalen) | |
47 | #define sprintUID(target,uid) Iso15693sprintUID(target,uid) | |
48 | ||
49 | // structure and database for uid -> tagtype lookups | |
50 | typedef struct { | |
51 | uint64_t uid; | |
52 | int mask; // how many MSB bits used | |
53 | char* desc; | |
54 | } productName; | |
55 | ||
56 | ||
57 | const productName uidmapping[] = { | |
58 | ||
59 | // UID, #significant Bits, "Vendor(+Product)" | |
60 | { 0xE001000000000000LL, 16, "Motorola UK" }, | |
61 | ||
62 | // E0 02 xx | |
63 | // 02 = ST Microelectronics | |
64 | // XX = IC id (Chip ID Family) | |
65 | { 0xE002000000000000LL, 16, "ST Microelectronics SA France" }, | |
66 | { 0xE002050000000000LL, 24, "ST Microelectronics; LRI64 [IC id = 05]"}, | |
67 | { 0xE002080000000000LL, 24, "ST Microelectronics; LRI2K [IC id = 08]"}, | |
68 | { 0xE0020A0000000000LL, 24, "ST Microelectronics; LRIS2K [IC id = 10]"}, | |
69 | { 0xE002440000000000LL, 24, "ST Microelectronics; LRIS64K [IC id = 68]"}, | |
70 | ||
71 | { 0xE003000000000000LL, 16, "Hitachi, Ltd Japan" }, | |
72 | ||
73 | // E0 04 xx | |
74 | // 04 = Manufacturer code (Philips/NXP) | |
75 | // XX = IC id (Chip ID Family) | |
76 | //I-Code SLI SL2 ICS20 [IC id = 01] | |
77 | //I-Code SLI-S [IC id = 02] | |
78 | //I-Code SLI-L [IC id = 03] | |
79 | //I-Code SLIX [IC id = 01 + bit36 set to 1 (starting from bit0 - different from normal SLI)] | |
80 | //I-Code SLIX-S [IC id = 02 + bit36 set to 1] | |
81 | //I-Code SLIX-L [IC id = 03 + bit36 set to 1] | |
82 | { 0xE004000000000000LL, 16, "NXP Semiconductors Germany (Philips)" }, | |
83 | { 0xE004010000000000LL, 24, "NXP(Philips); IC SL2 ICS20/ICS21(SLI) ICS2002/ICS2102(SLIX)" }, | |
84 | { 0xE004020000000000LL, 24, "NXP(Philips); IC SL2 ICS53/ICS54(SLI-S) ICS5302/ICS5402(SLIX-S)" }, | |
85 | { 0xE004030000000000LL, 24, "NXP(Philips); IC SL2 ICS50/ICS51(SLI-L) ICS5002/ICS5102(SLIX-L)" }, | |
86 | ||
87 | // E0 05 XX .. .. .. | |
88 | // 05 = Manufacturer code (Infineon) | |
89 | // XX = IC id (Chip ID Family) | |
90 | { 0xE005000000000000LL, 16, "Infineon Technologies AG Germany" }, | |
91 | { 0xE005A10000000000LL, 24, "Infineon; SRF55V01P [IC id = 161] plain mode 1kBit"}, | |
92 | { 0xE005A80000000000LL, 24, "Infineon; SRF55V01P [IC id = 168] pilot series 1kBit"}, | |
93 | { 0xE005400000000000LL, 24, "Infineon; SRF55V02P [IC id = 64] plain mode 2kBit"}, | |
94 | { 0xE005000000000000LL, 24, "Infineon; SRF55V10P [IC id = 00] plain mode 10KBit"}, | |
95 | { 0xE005500000000000LL, 24, "Infineon; SRF55V02S [IC id = 80] secure mode 2kBit"}, | |
96 | { 0xE005100000000000LL, 24, "Infineon; SRF55V10S [IC id = 16] secure mode 10KBit"}, | |
97 | { 0xE0051E0000000000LL, 23, "Infineon; SLE66r01P [IC id = 3x = My-d Move or My-d move NFC]"}, | |
98 | { 0xE005200000000000LL, 21, "Infineon; SLE66r01P [IC id = 3x = My-d Move or My-d move NFC]"}, | |
99 | ||
100 | { 0xE006000000000000LL, 16, "Cylink USA" }, | |
101 | ||
102 | ||
103 | // E0 07 xx | |
104 | // 07 = Texas Instruments | |
105 | // XX = from bit 41 to bit 43 = product configuration - from bit 44 to bit 47 IC id (Chip ID Family) | |
106 | //Tag IT RFIDType-I Plus, 2kBit, TI Inlay | |
107 | //Tag-it HF-I Plus Inlay [IC id = 00] -> b'0000 000 2kBit | |
108 | //Tag-it HF-I Plus Chip [IC id = 64] -> b'1000 000 2kBit | |
109 | //Tag-it HF-I Standard Chip / Inlays [IC id = 96] -> b'1100 000 256Bit | |
110 | //Tag-it HF-I Pro Chip / Inlays [IC id = 98] -> b'1100 010 256Bit, Password protection | |
111 | { 0xE007000000000000LL, 16, "Texas Instrument France" }, | |
112 | { 0xE007000000000000LL, 20, "Texas Instrument; Tag-it HF-I Plus Inlay; 64x32bit" }, | |
113 | { 0xE007100000000000LL, 20, "Texas Instrument; Tag-it HF-I Plus Chip; 64x32bit" }, | |
114 | { 0xE007800000000000LL, 23, "Texas Instrument; Tag-it HF-I Plus (RF-HDT-DVBB tag or Third Party Products)" }, | |
115 | { 0xE007C00000000000LL, 23, "Texas Instrument; Tag-it HF-I Standard; 8x32bit" }, | |
116 | { 0xE007C40000000000LL, 23, "Texas Instrument; Tag-it HF-I Pro; 8x23bit; password" }, | |
117 | ||
118 | { 0xE008000000000000LL, 16, "Fujitsu Limited Japan" }, | |
119 | { 0xE009000000000000LL, 16, "Matsushita Electronics Corporation, Semiconductor Company Japan" }, | |
120 | { 0xE00A000000000000LL, 16, "NEC Japan" }, | |
121 | { 0xE00B000000000000LL, 16, "Oki Electric Industry Co. Ltd Japan" }, | |
122 | { 0xE00C000000000000LL, 16, "Toshiba Corp. Japan" }, | |
123 | { 0xE00D000000000000LL, 16, "Mitsubishi Electric Corp. Japan" }, | |
124 | { 0xE00E000000000000LL, 16, "Samsung Electronics Co. Ltd Korea" }, | |
125 | { 0xE00F000000000000LL, 16, "Hynix / Hyundai, Korea" }, | |
126 | { 0xE010000000000000LL, 16, "LG-Semiconductors Co. Ltd Korea" }, | |
127 | { 0xE011000000000000LL, 16, "Emosyn-EM Microelectronics USA" }, | |
128 | ||
129 | { 0xE012000000000000LL, 16, "HID Corporation" }, | |
130 | { 0xE012000000000000LL, 16, "INSIDE Technology France" }, | |
131 | { 0xE013000000000000LL, 16, "ORGA Kartensysteme GmbH Germany" }, | |
132 | { 0xE014000000000000LL, 16, "SHARP Corporation Japan" }, | |
133 | { 0xE015000000000000LL, 16, "ATMEL France" }, | |
134 | ||
135 | { 0xE016000000000000LL, 16, "EM Microelectronic-Marin SA Switzerland (Skidata)" }, | |
136 | { 0xE016040000000000LL, 24, "EM-Marin SA (Skidata Keycard-eco); EM4034? no 'read', just 'readmulti'" }, | |
137 | { 0xE0160c0000000000LL, 24, "EM-Marin SA; EM4035?" }, | |
138 | { 0xE016100000000000LL, 24, "EM-Marin SA (Skidata); EM4135; 36x64bit start page 13" }, | |
139 | { 0xE016940000000000LL, 24, "EM-Marin SA (Skidata); 51x64bit" }, | |
140 | ||
141 | { 0xE017000000000000LL, 16, "KSW Microtec GmbH Germany" }, | |
142 | { 0xE018000000000000LL, 16, "ZMD AG Germany" }, | |
143 | { 0xE019000000000000LL, 16, "XICOR, Inc. USA" }, | |
144 | { 0xE01A000000000000LL, 16, "Sony Corporation Japan Identifier Company Country" }, | |
145 | { 0xE01B000000000000LL, 16, "Malaysia Microelectronic Solutions Sdn. Bhd Malaysia" }, | |
146 | { 0xE01C000000000000LL, 16, "Emosyn USA" }, | |
147 | { 0xE01D000000000000LL, 16, "Shanghai Fudan Microelectronics Co. Ltd. P.R. China" }, | |
148 | { 0xE01E000000000000LL, 16, "Magellan Technology Pty Limited Australia" }, | |
149 | { 0xE01F000000000000LL, 16, "Melexis NV BO Switzerland" }, | |
150 | { 0xE020000000000000LL, 16, "Renesas Technology Corp. Japan" }, | |
151 | { 0xE021000000000000LL, 16, "TAGSYS France" }, | |
152 | { 0xE022000000000000LL, 16, "Transcore USA" }, | |
153 | { 0xE023000000000000LL, 16, "Shanghai belling corp., ltd. China" }, | |
154 | { 0xE024000000000000LL, 16, "Masktech Germany Gmbh Germany" }, | |
155 | { 0xE025000000000000LL, 16, "Innovision Research and Technology Plc UK" }, | |
156 | { 0xE026000000000000LL, 16, "Hitachi ULSI Systems Co., Ltd. Japan" }, | |
157 | { 0xE027000000000000LL, 16, "Cypak AB Sweden" }, | |
158 | { 0xE028000000000000LL, 16, "Ricoh Japan" }, | |
159 | { 0xE029000000000000LL, 16, "ASK France" }, | |
160 | { 0xE02A000000000000LL, 16, "Unicore Microsystems, LLC Russian Federation" }, | |
161 | { 0xE02B000000000000LL, 16, "Dallas Semiconductor/Maxim USA" }, | |
162 | { 0xE02C000000000000LL, 16, "Impinj, Inc. USA" }, | |
163 | { 0xE02D000000000000LL, 16, "RightPlug Alliance USA" }, | |
164 | { 0xE02E000000000000LL, 16, "Broadcom Corporation USA" }, | |
165 | { 0xE02F000000000000LL, 16, "MStar Semiconductor, Inc Taiwan, ROC" }, | |
166 | { 0xE030000000000000LL, 16, "BeeDar Technology Inc. USA" }, | |
167 | { 0xE031000000000000LL, 16, " RFIDsec Denmark" }, | |
168 | { 0xE032000000000000LL, 16, " Schweizer Electronic AG Germany" }, | |
169 | { 0xE033000000000000LL, 16, " AMIC Technology Corp Taiwan" }, | |
170 | { 0xE034000000000000LL, 16, "Mikron JSC Russia" }, | |
171 | { 0xE035000000000000LL, 16, "Fraunhofer Institute for Photonic Microsystems Germany" }, | |
172 | { 0xE036000000000000LL, 16, "IDS Microchip AG Switzerland" }, | |
173 | { 0xE037000000000000LL, 16, "Kovio USA" }, | |
174 | { 0xE038000000000000LL, 16, "HMT Microelectronic Ltd Switzerland Identifier Company Country" }, | |
175 | { 0xE039000000000000LL, 16, "Silicon Craft Technology Thailand" }, | |
176 | { 0xE03A000000000000LL, 16, "Advanced Film Device Inc. Japan" }, | |
177 | { 0xE03B000000000000LL, 16, "Nitecrest Ltd UK" }, | |
178 | { 0xE03C000000000000LL, 16, "Verayo Inc. USA" }, | |
179 | { 0xE03D000000000000LL, 16, "HID Global USA" }, | |
180 | { 0xE03E000000000000LL, 16, "Productivity Engineering Gmbh Germany" }, | |
181 | { 0xE03F000000000000LL, 16, "Austriamicrosystems AG (reserved) Austria" }, | |
182 | { 0xE040000000000000LL, 16, "Gemalto SA France" }, | |
183 | { 0xE041000000000000LL, 16, "Renesas Electronics Corporation Japan" }, | |
184 | { 0xE042000000000000LL, 16, "3Alogics Inc Korea" }, | |
185 | { 0xE043000000000000LL, 16, "Top TroniQ Asia Limited Hong Kong" }, | |
186 | { 0xE044000000000000LL, 16, "Gentag Inc (USA) USA" }, | |
187 | { 0,0,"no tag-info available" } // must be the last entry | |
188 | }; | |
189 | ||
190 | ||
191 | // fast method to just read the UID of a tag (collission detection not supported) | |
192 | // *buf should be large enough to fit the 64bit uid | |
193 | // returns 1 if suceeded | |
194 | int getUID(uint8_t *buf) | |
195 | { | |
196 | UsbCommand resp; | |
197 | uint8_t *recv; | |
198 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? | |
199 | uint8_t *req=c.d.asBytes; | |
200 | int reqlen=0; | |
201 | ||
202 | for (int retry=0;retry<3; retry++) { // don't give up the at the first try | |
203 | ||
204 | req[0]= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | | |
205 | ISO15_REQ_INVENTORY | ISO15_REQINV_SLOT1; | |
206 | req[1]=ISO15_CMD_INVENTORY; | |
207 | req[2]=0; // mask length | |
208 | reqlen=AddCrc(req,3); | |
209 | c.arg[0]=reqlen; | |
210 | ||
211 | SendCommand(&c); | |
212 | ||
213 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) { | |
214 | recv = resp.d.asBytes; | |
215 | if (resp.arg[0]>=12 && ISO15_CRC_CHECK==Crc(recv,12)) { | |
216 | memcpy(buf,&recv[2],8); | |
217 | return 1; | |
218 | } | |
219 | } | |
220 | } // retry | |
221 | return 0; | |
222 | } | |
223 | ||
224 | ||
225 | ||
226 | // get a product description based on the UID | |
227 | // uid[8] tag uid | |
228 | // returns description of the best match | |
229 | static char* getTagInfo(uint8_t *uid) { | |
230 | uint64_t myuid,mask; | |
231 | int i=0, best=-1; | |
232 | memcpy(&myuid,uid,sizeof(uint64_t)); | |
233 | while (uidmapping[i].mask>0) { | |
234 | mask=(~0LL) <<(64-uidmapping[i].mask); | |
235 | if ((myuid & mask) == uidmapping[i].uid) { | |
236 | if (best==-1) { | |
237 | best=i; | |
238 | } else { | |
239 | if (uidmapping[i].mask>uidmapping[best].mask) { | |
240 | best=i; | |
241 | } | |
242 | } | |
243 | } | |
244 | i++; | |
245 | } | |
246 | ||
247 | if (best>=0) return uidmapping[best].desc; | |
248 | ||
249 | return uidmapping[i].desc; | |
250 | } | |
251 | ||
252 | ||
253 | // return a clear-text message to an errorcode | |
254 | static char* TagErrorStr(uint8_t error) { | |
255 | switch (error) { | |
256 | case 0x01: return "The command is not supported"; | |
257 | case 0x02: return "The command is not recognised"; | |
258 | case 0x03: return "The option is not supported."; | |
259 | case 0x0f: return "Unknown error."; | |
260 | case 0x10: return "The specified block is not available (doesn’t exist)."; | |
261 | case 0x11: return "The specified block is already -locked and thus cannot be locked again"; | |
262 | case 0x12: return "The specified block is locked and its content cannot be changed."; | |
263 | case 0x13: return "The specified block was not successfully programmed."; | |
264 | case 0x14: return "The specified block was not successfully locked."; | |
265 | default: return "Reserved for Future Use or Custom command error."; | |
266 | } | |
267 | } | |
268 | ||
269 | ||
270 | // Mode 3 | |
271 | int CmdHF15Demod(const char *Cmd) | |
272 | { | |
273 | // The sampling rate is 106.353 ksps/s, for T = 18.8 us | |
274 | ||
275 | int i, j; | |
276 | int max = 0, maxPos = 0; | |
277 | ||
278 | int skip = 4; | |
279 | ||
280 | if (GraphTraceLen < 1000) return 0; | |
281 | ||
282 | // First, correlate for SOF | |
283 | for (i = 0; i < 100; i++) { | |
284 | int corr = 0; | |
285 | for (j = 0; j < arraylen(FrameSOF); j += skip) { | |
286 | corr += FrameSOF[j] * GraphBuffer[i + (j / skip)]; | |
287 | } | |
288 | if (corr > max) { | |
289 | max = corr; | |
290 | maxPos = i; | |
291 | } | |
292 | } | |
293 | PrintAndLog("SOF at %d, correlation %d", maxPos, | |
294 | max / (arraylen(FrameSOF) / skip)); | |
295 | ||
296 | i = maxPos + arraylen(FrameSOF) / skip; | |
297 | int k = 0; | |
298 | uint8_t outBuf[20]; | |
299 | memset(outBuf, 0, sizeof(outBuf)); | |
300 | uint8_t mask = 0x01; | |
301 | for (;;) { | |
302 | int corr0 = 0, corr1 = 0, corrEOF = 0; | |
303 | for (j = 0; j < arraylen(Logic0); j += skip) { | |
304 | corr0 += Logic0[j] * GraphBuffer[i + (j / skip)]; | |
305 | } | |
306 | for (j = 0; j < arraylen(Logic1); j += skip) { | |
307 | corr1 += Logic1[j] * GraphBuffer[i + (j / skip)]; | |
308 | } | |
309 | for (j = 0; j < arraylen(FrameEOF); j += skip) { | |
310 | corrEOF += FrameEOF[j] * GraphBuffer[i + (j / skip)]; | |
311 | } | |
312 | // Even things out by the length of the target waveform. | |
313 | corr0 *= 4; | |
314 | corr1 *= 4; | |
315 | ||
316 | if (corrEOF > corr1 && corrEOF > corr0) { | |
317 | PrintAndLog("EOF at %d", i); | |
318 | break; | |
319 | } else if (corr1 > corr0) { | |
320 | i += arraylen(Logic1) / skip; | |
321 | outBuf[k] |= mask; | |
322 | } else { | |
323 | i += arraylen(Logic0) / skip; | |
324 | } | |
325 | mask <<= 1; | |
326 | if (mask == 0) { | |
327 | k++; | |
328 | mask = 0x01; | |
329 | } | |
330 | if ((i + (int)arraylen(FrameEOF)) >= GraphTraceLen) { | |
331 | PrintAndLog("ran off end!"); | |
332 | break; | |
333 | } | |
334 | } | |
335 | if (mask != 0x01) { | |
336 | PrintAndLog("error, uneven octet! (discard extra bits!)"); | |
337 | PrintAndLog(" mask=%02x", mask); | |
338 | } | |
339 | PrintAndLog("%d octets", k); | |
340 | ||
341 | for (i = 0; i < k; i++) { | |
342 | PrintAndLog("# %2d: %02x ", i, outBuf[i]); | |
343 | } | |
344 | PrintAndLog("CRC=%04x", Iso15693Crc(outBuf, k - 2)); | |
345 | return 0; | |
346 | } | |
347 | ||
348 | ||
349 | ||
350 | // * Acquire Samples as Reader (enables carrier, sends inquiry) | |
351 | int CmdHF15Read(const char *Cmd) | |
352 | { | |
353 | UsbCommand c = {CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693}; | |
354 | SendCommand(&c); | |
355 | return 0; | |
356 | } | |
357 | ||
358 | // Record Activity without enabeling carrier | |
359 | int CmdHF15Record(const char *Cmd) | |
360 | { | |
361 | UsbCommand c = {CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693}; | |
362 | SendCommand(&c); | |
363 | return 0; | |
364 | } | |
365 | ||
366 | int CmdHF15Reader(const char *Cmd) | |
367 | { | |
368 | UsbCommand c = {CMD_READER_ISO_15693, {strtol(Cmd, NULL, 0), 0, 0}}; | |
369 | SendCommand(&c); | |
370 | return 0; | |
371 | } | |
372 | ||
373 | // Simulation is still not working very good | |
374 | int CmdHF15Sim(const char *Cmd) | |
375 | { | |
376 | char cmdp = param_getchar(Cmd, 0); | |
377 | uint8_t uid[8] = {0x00}; | |
378 | ||
379 | //E0 16 24 00 00 00 00 00 | |
380 | if (cmdp == 'h' || cmdp == 'H') { | |
381 | PrintAndLog("Usage: hf 15 sim <UID>"); | |
382 | PrintAndLog(""); | |
383 | PrintAndLog(" sample: hf 15 sim E016240000000000"); | |
384 | return 0; | |
385 | } | |
386 | ||
387 | if (param_gethex(Cmd, 0, uid, 16)) { | |
388 | PrintAndLog("UID must include 16 HEX symbols"); | |
389 | return 0; | |
390 | } | |
391 | ||
392 | PrintAndLog("Starting simulating UID %02X %02X %02X %02X %02X %02X %02X %02X", | |
393 | uid[0],uid[1],uid[2],uid[3],uid[4], uid[5], uid[6], uid[7]); | |
394 | ||
395 | UsbCommand c = {CMD_SIMTAG_ISO_15693, {0, 0, 0}}; | |
396 | memcpy(c.d.asBytes,uid,8); | |
397 | ||
398 | SendCommand(&c); | |
399 | return 0; | |
400 | } | |
401 | ||
402 | // finds the AFI (Application Family Idendifier) of a card, by trying all values | |
403 | // (There is no standard way of reading the AFI, allthough some tags support this) | |
404 | int CmdHF15Afi(const char *Cmd) | |
405 | { | |
406 | UsbCommand c = {CMD_ISO_15693_FIND_AFI, {strtol(Cmd, NULL, 0), 0, 0}}; | |
407 | SendCommand(&c); | |
408 | return 0; | |
409 | } | |
410 | ||
411 | // Reads all memory pages | |
412 | int CmdHF15DumpMem(const char*Cmd) { | |
413 | UsbCommand resp; | |
414 | uint8_t uid[8]; | |
415 | uint8_t *recv=NULL; | |
416 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? | |
417 | uint8_t *req=c.d.asBytes; | |
418 | int reqlen=0; | |
419 | int blocknum=0; | |
420 | char output[80]; | |
421 | ||
422 | if (!getUID(uid)) { | |
423 | PrintAndLog("No Tag found."); | |
424 | return 0; | |
425 | } | |
426 | ||
427 | PrintAndLog("Reading memory from tag UID=%s",sprintUID(NULL,uid)); | |
428 | PrintAndLog("Tag Info: %s",getTagInfo(uid)); | |
429 | ||
430 | for (int retry=0; retry<5; retry++) { | |
431 | ||
432 | req[0]= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | | |
433 | ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS; | |
434 | req[1]=ISO15_CMD_READ; | |
435 | memcpy(&req[2],uid,8); | |
436 | req[10]=blocknum; | |
437 | reqlen=AddCrc(req,11); | |
438 | c.arg[0]=reqlen; | |
439 | ||
440 | SendCommand(&c); | |
441 | ||
442 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) { | |
443 | recv = resp.d.asBytes; | |
444 | if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) { | |
445 | if (!(recv[0] & ISO15_RES_ERROR)) { | |
446 | retry=0; | |
447 | *output=0; // reset outputstring | |
448 | sprintf(output, "Block %02x ",blocknum); | |
449 | for ( int i=1; i<resp.arg[0]-2; i++) { // data in hex | |
450 | sprintf(output+strlen(output),"%02X ",recv[i]); | |
451 | } | |
452 | strcat(output," "); | |
453 | for ( int i=1; i<resp.arg[0]-2; i++) { // data in cleaned ascii | |
454 | sprintf(output+strlen(output),"%c",(recv[i]>31 && recv[i]<127)?recv[i]:'.'); | |
455 | } | |
456 | PrintAndLog("%s",output); | |
457 | blocknum++; | |
458 | // PrintAndLog("bn=%i",blocknum); | |
459 | } else { | |
460 | PrintAndLog("Tag returned Error %i: %s",recv[1],TagErrorStr(recv[1])); | |
461 | return 0; | |
462 | } | |
463 | } // else PrintAndLog("crc"); | |
464 | } // else PrintAndLog("r null"); | |
465 | } // retry | |
466 | // TODO: need fix | |
467 | // if (resp.arg[0]<3) | |
468 | // PrintAndLog("Lost Connection"); | |
469 | // else if (ISO15_CRC_CHECK!=Crc(resp.d.asBytes,resp.arg[0])) | |
470 | // PrintAndLog("CRC Failed"); | |
471 | // else | |
472 | // PrintAndLog("Tag returned Error %i: %s",recv[1],TagErrorStr(recv[1])); | |
473 | return 0; | |
474 | } | |
475 | ||
476 | ||
477 | // "HF 15" interface | |
478 | ||
479 | static command_t CommandTable15[] = | |
480 | { | |
481 | {"help", CmdHF15Help, 1, "This help"}, | |
482 | {"demod", CmdHF15Demod, 1, "Demodulate ISO15693 from tag"}, | |
483 | {"read", CmdHF15Read, 0, "Read HF tag (ISO 15693)"}, | |
484 | {"record", CmdHF15Record, 0, "Record Samples (ISO 15693)"}, // atrox | |
485 | {"reader", CmdHF15Reader, 0, "Act like an ISO15693 reader"}, | |
486 | {"sim", CmdHF15Sim, 0, "Fake an ISO15693 tag"}, | |
487 | {"cmd", CmdHF15Cmd, 0, "Send direct commands to ISO15693 tag"}, | |
488 | {"findafi", CmdHF15Afi, 0, "Brute force AFI of an ISO15693 tag"}, | |
489 | {"dumpmemory", CmdHF15DumpMem, 0, "Read all memory pages of an ISO15693 tag"}, | |
490 | {NULL, NULL, 0, NULL} | |
491 | }; | |
492 | ||
493 | int CmdHF15(const char *Cmd) | |
494 | { | |
495 | CmdsParse(CommandTable15, Cmd); | |
496 | return 0; | |
497 | } | |
498 | ||
499 | int CmdHF15Help(const char *Cmd) | |
500 | { | |
501 | CmdsHelp(CommandTable15); | |
502 | return 0; | |
503 | } | |
504 | ||
505 | ||
506 | // "HF 15 Cmd" Interface | |
507 | // Allows direct communication with the tag on command level | |
508 | ||
509 | int CmdHF15CmdInquiry(const char *Cmd) | |
510 | { | |
511 | UsbCommand resp; | |
512 | uint8_t *recv; | |
513 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? | |
514 | uint8_t *req=c.d.asBytes; | |
515 | int reqlen=0; | |
516 | ||
517 | req[0]= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | | |
518 | ISO15_REQ_INVENTORY | ISO15_REQINV_SLOT1; | |
519 | req[1]=ISO15_CMD_INVENTORY; | |
520 | req[2]=0; // mask length | |
521 | reqlen=AddCrc(req,3); | |
522 | c.arg[0]=reqlen; | |
523 | ||
524 | SendCommand(&c); | |
525 | ||
526 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) { | |
527 | if (resp.arg[0]>=12) { | |
528 | recv = resp.d.asBytes; | |
529 | PrintAndLog("UID=%s",sprintUID(NULL,&recv[2])); | |
530 | PrintAndLog("Tag Info: %s",getTagInfo(&recv[2])); | |
531 | } else { | |
532 | PrintAndLog("Response to short, just %i bytes. No tag?\n",resp.arg[0]); | |
533 | } | |
534 | } else { | |
535 | PrintAndLog("timeout."); | |
536 | } | |
537 | return 0; | |
538 | } | |
539 | ||
540 | ||
541 | // Turns debugging on(1)/off(0) | |
542 | int CmdHF15CmdDebug( const char *cmd) { | |
543 | int debug=atoi(cmd); | |
544 | if (strlen(cmd)<1) { | |
545 | PrintAndLog("Usage: hf 15 cmd debug <0|1>"); | |
546 | PrintAndLog(" 0 no debugging"); | |
547 | PrintAndLog(" 1 turn debugging on"); | |
548 | return 0; | |
549 | } | |
550 | ||
551 | UsbCommand c = {CMD_ISO_15693_DEBUG, {debug, 0, 0}}; | |
552 | SendCommand(&c); | |
553 | return 0; | |
554 | } | |
555 | ||
556 | ||
557 | int CmdHF15CmdRaw (const char *cmd) { | |
558 | UsbCommand resp; | |
559 | uint8_t *recv; | |
560 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? | |
561 | int reply=1; | |
562 | int fast=1; | |
563 | int crc=0; | |
564 | char buf[5]=""; | |
565 | int i=0; | |
566 | uint8_t data[100]; | |
567 | unsigned int datalen=0, temp; | |
568 | char *hexout; | |
569 | ||
570 | ||
571 | if (strlen(cmd)<3) { | |
572 | PrintAndLog("Usage: hf 15 cmd raw [-r] [-2] [-c] <0A 0B 0C ... hex>"); | |
573 | PrintAndLog(" -r do not read response"); | |
574 | PrintAndLog(" -2 use slower '1 out of 256' mode"); | |
575 | PrintAndLog(" -c calculate and append CRC"); | |
576 | PrintAndLog(" Tip: turn on debugging for verbose output"); | |
577 | return 0; | |
578 | } | |
579 | ||
580 | // strip | |
581 | while (*cmd==' ' || *cmd=='\t') cmd++; | |
582 | ||
583 | while (cmd[i]!='\0') { | |
584 | if (cmd[i]==' ' || cmd[i]=='\t') { i++; continue; } | |
585 | if (cmd[i]=='-') { | |
586 | switch (cmd[i+1]) { | |
587 | case 'r': | |
588 | case 'R': | |
589 | reply=0; | |
590 | break; | |
591 | case '2': | |
592 | fast=0; | |
593 | break; | |
594 | case 'c': | |
595 | case 'C': | |
596 | crc=1; | |
597 | break; | |
598 | default: | |
599 | PrintAndLog("Invalid option"); | |
600 | return 0; | |
601 | } | |
602 | i+=2; | |
603 | continue; | |
604 | } | |
605 | if ((cmd[i]>='0' && cmd[i]<='9') || | |
606 | (cmd[i]>='a' && cmd[i]<='f') || | |
607 | (cmd[i]>='A' && cmd[i]<='F') ) { | |
608 | buf[strlen(buf)+1]=0; | |
609 | buf[strlen(buf)]=cmd[i]; | |
610 | i++; | |
611 | ||
612 | if (strlen(buf)>=2) { | |
613 | sscanf(buf,"%x",&temp); | |
614 | data[datalen]=(uint8_t)(temp & 0xff); | |
615 | datalen++; | |
616 | *buf=0; | |
617 | } | |
618 | continue; | |
619 | } | |
620 | PrintAndLog("Invalid char on input"); | |
621 | return 0; | |
622 | } | |
623 | if (crc) datalen=AddCrc(data,datalen); | |
624 | ||
625 | c.arg[0]=datalen; | |
626 | c.arg[1]=fast; | |
627 | c.arg[2]=reply; | |
628 | memcpy(c.d.asBytes,data,datalen); | |
629 | ||
630 | SendCommand(&c); | |
631 | ||
632 | if (reply) { | |
633 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) { | |
634 | recv = resp.d.asBytes; | |
635 | PrintAndLog("received %i octets",resp.arg[0]); | |
636 | hexout = (char *)malloc(resp.arg[0] * 3 + 1); | |
637 | if (hexout != NULL) { | |
638 | for (int i = 0; i < resp.arg[0]; i++) { // data in hex | |
639 | sprintf(&hexout[i * 3], "%02X ", recv[i]); | |
640 | } | |
641 | PrintAndLog("%s", hexout); | |
642 | free(hexout); | |
643 | } | |
644 | } else { | |
645 | PrintAndLog("timeout while waiting for reply."); | |
646 | } | |
647 | ||
648 | } // if reply | |
649 | return 0; | |
650 | } | |
651 | ||
652 | ||
653 | /** | |
654 | * parses common HF 15 CMD parameters and prepares some data structures | |
655 | * Parameters: | |
656 | * **cmd command line | |
657 | */ | |
658 | int prepareHF15Cmd(char **cmd, UsbCommand *c, uint8_t iso15cmd[], int iso15cmdlen) { | |
659 | int temp; | |
660 | uint8_t *req=c->d.asBytes; | |
661 | uint8_t uid[8] = {0x00}; | |
662 | uint32_t reqlen=0; | |
663 | ||
664 | // strip | |
665 | while (**cmd==' ' || **cmd=='\t') (*cmd)++; | |
666 | ||
667 | if (strstr(*cmd,"-2")==*cmd) { | |
668 | c->arg[1]=0; // use 1of256 | |
669 | (*cmd)+=2; | |
670 | } | |
671 | ||
672 | // strip | |
673 | while (**cmd==' ' || **cmd=='\t') (*cmd)++; | |
674 | ||
675 | if (strstr(*cmd,"-o")==*cmd) { | |
676 | req[reqlen]=ISO15_REQ_OPTION; | |
677 | (*cmd)+=2; | |
678 | } | |
679 | ||
680 | // strip | |
681 | while (**cmd==' ' || **cmd=='\t') (*cmd)++; | |
682 | ||
683 | switch (**cmd) { | |
684 | case 0: | |
685 | PrintAndLog("missing addr"); | |
686 | return 0; | |
687 | break; | |
688 | case 's': | |
689 | case 'S': | |
690 | // you must have selected the tag earlier | |
691 | req[reqlen++]|= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | | |
692 | ISO15_REQ_NONINVENTORY | ISO15_REQ_SELECT; | |
693 | memcpy(&req[reqlen],&iso15cmd[0],iso15cmdlen); | |
694 | reqlen+=iso15cmdlen; | |
695 | break; | |
696 | case 'u': | |
697 | case 'U': | |
698 | // unaddressed mode may not be supported by all vendors | |
699 | req[reqlen++]|= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | | |
700 | ISO15_REQ_NONINVENTORY; | |
701 | memcpy(&req[reqlen],&iso15cmd[0],iso15cmdlen); | |
702 | reqlen+=iso15cmdlen; | |
703 | break; | |
704 | case '*': | |
705 | // we scan for the UID ourself | |
706 | req[reqlen++]|= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | | |
707 | ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS; | |
708 | memcpy(&req[reqlen],&iso15cmd[0],iso15cmdlen); | |
709 | reqlen+=iso15cmdlen; | |
710 | if (!getUID(uid)) { | |
711 | PrintAndLog("No Tag found"); | |
712 | return 0; | |
713 | } | |
714 | memcpy(req+reqlen,uid,8); | |
715 | PrintAndLog("Detected UID %s",sprintUID(NULL,uid)); | |
716 | reqlen+=8; | |
717 | break; | |
718 | default: | |
719 | req[reqlen++]|= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | | |
720 | ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS; | |
721 | memcpy(&req[reqlen],&iso15cmd[0],iso15cmdlen); | |
722 | reqlen+=iso15cmdlen; | |
723 | ||
724 | /* sscanf(cmd,"%hX%hX%hX%hX%hX%hX%hX%hX", | |
725 | (short unsigned int *)&uid[7],(short unsigned int *)&uid[6], | |
726 | (short unsigned int *)&uid[5],(short unsigned int *)&uid[4], | |
727 | (short unsigned int *)&uid[3],(short unsigned int *)&uid[2], | |
728 | (short unsigned int *)&uid[1],(short unsigned int *)&uid[0]); */ | |
729 | for (int i=0;i<8 && (*cmd)[i*2] && (*cmd)[i*2+1];i++) { // parse UID | |
730 | sscanf((char[]){(*cmd)[i*2],(*cmd)[i*2+1],0},"%X",&temp); | |
731 | uid[7-i]=temp&0xff; | |
732 | } | |
733 | ||
734 | PrintAndLog("Using UID %s",sprintUID(NULL,uid)); | |
735 | memcpy(&req[reqlen],&uid[0],8); | |
736 | reqlen+=8; | |
737 | } | |
738 | // skip to next space | |
739 | while (**cmd!=' ' && **cmd!='\t') (*cmd)++; | |
740 | // skip over the space | |
741 | while (**cmd==' ' || **cmd=='\t') (*cmd)++; | |
742 | ||
743 | c->arg[0]=reqlen; | |
744 | return 1; | |
745 | } | |
746 | ||
747 | /** | |
748 | * Commandline handling: HF15 CMD SYSINFO | |
749 | * get system information from tag/VICC | |
750 | */ | |
751 | int CmdHF15CmdSysinfo(const char *Cmd) { | |
752 | UsbCommand resp; | |
753 | uint8_t *recv; | |
754 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? | |
755 | uint8_t *req=c.d.asBytes; | |
756 | int reqlen=0; | |
757 | char cmdbuf[100]; | |
758 | char *cmd=cmdbuf; | |
759 | char output[2048]=""; | |
760 | int i; | |
761 | ||
762 | strncpy(cmd,Cmd,99); | |
763 | ||
764 | // usage: | |
765 | if (strlen(cmd)<1) { | |
766 | PrintAndLog("Usage: hf 15 cmd sysinfo [options] <uid|s|u|*>"); | |
767 | PrintAndLog(" options:"); | |
768 | PrintAndLog(" -2 use slower '1 out of 256' mode"); | |
769 | PrintAndLog(" uid (either): "); | |
770 | PrintAndLog(" <8B hex> full UID eg E011223344556677"); | |
771 | PrintAndLog(" s selected tag"); | |
772 | PrintAndLog(" u unaddressed mode"); | |
773 | PrintAndLog(" * scan for tag"); | |
774 | PrintAndLog(" start#: page number to start 0-255"); | |
775 | PrintAndLog(" count#: number of pages"); | |
776 | return 0; | |
777 | } | |
778 | ||
779 | prepareHF15Cmd(&cmd, &c,(uint8_t[]){ISO15_CMD_SYSINFO},1); | |
780 | reqlen=c.arg[0]; | |
781 | ||
782 | reqlen=AddCrc(req,reqlen); | |
783 | c.arg[0]=reqlen; | |
784 | ||
785 | SendCommand(&c); | |
786 | ||
787 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000) && resp.arg[0]>2) { | |
788 | recv = resp.d.asBytes; | |
789 | if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) { | |
790 | if (!(recv[0] & ISO15_RES_ERROR)) { | |
791 | *output=0; // reset outputstring | |
792 | for ( i=1; i<resp.arg[0]-2; i++) { | |
793 | sprintf(output+strlen(output),"%02X ",recv[i]); | |
794 | } | |
795 | strcat(output,"\n\r"); | |
796 | strcat(output,"UID = "); | |
797 | strcat(output,sprintUID(NULL,recv+2)); | |
798 | strcat(output,"\n\r"); | |
799 | strcat(output,getTagInfo(recv+2)); //ABC | |
800 | strcat(output,"\n\r"); | |
801 | i=10; | |
802 | if (recv[1] & 0x01) | |
803 | sprintf(output+strlen(output),"DSFID supported, set to %02X\n\r",recv[i++]); | |
804 | else | |
805 | strcat(output,"DSFID not supported\n\r"); | |
806 | if (recv[1] & 0x02) | |
807 | sprintf(output+strlen(output),"AFI supported, set to %03X\n\r",recv[i++]); | |
808 | else | |
809 | strcat(output,"AFI not supported\n\r"); | |
810 | if (recv[1] & 0x04) { | |
811 | strcat(output,"Tag provides info on memory layout (vendor dependent)\n\r"); | |
812 | sprintf(output+strlen(output)," %i (or %i) bytes/page x %i pages \n\r", | |
813 | (recv[i+1]&0x1F)+1, (recv[i+1]&0x1F), recv[i]+1); | |
814 | i+=2; | |
815 | } else | |
816 | strcat(output,"Tag does not provide information on memory layout\n\r"); | |
817 | if (recv[1] & 0x08) sprintf(output+strlen(output),"IC reference given: %02X\n\r",recv[i++]); | |
818 | else strcat(output,"IC reference not given\n\r"); | |
819 | ||
820 | ||
821 | PrintAndLog("%s",output); | |
822 | } else { | |
823 | PrintAndLog("Tag returned Error %i: %s",recv[0],TagErrorStr(recv[0])); | |
824 | } | |
825 | } else { | |
826 | PrintAndLog("CRC failed"); | |
827 | } | |
828 | } else { | |
829 | PrintAndLog("timeout: no answer"); | |
830 | } | |
831 | ||
832 | return 0; | |
833 | } | |
834 | ||
835 | /** | |
836 | * Commandline handling: HF15 CMD READMULTI | |
837 | * Read multiple blocks at once (not all tags support this) | |
838 | */ | |
839 | int CmdHF15CmdReadmulti(const char *Cmd) { | |
840 | UsbCommand resp; | |
841 | uint8_t *recv; | |
842 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? | |
843 | uint8_t *req=c.d.asBytes; | |
844 | int reqlen=0, pagenum,pagecount; | |
845 | char cmdbuf[100]; | |
846 | char *cmd=cmdbuf; | |
847 | char output[2048]=""; | |
848 | ||
849 | strncpy(cmd,Cmd,99); | |
850 | ||
851 | // usage: | |
852 | if (strlen(cmd)<3) { | |
853 | PrintAndLog("Usage: hf 15 cmd readmulti [options] <uid|s|u|*> <start#> <count#>"); | |
854 | PrintAndLog(" options:"); | |
855 | PrintAndLog(" -2 use slower '1 out of 256' mode"); | |
856 | PrintAndLog(" uid (either): "); | |
857 | PrintAndLog(" <8B hex> full UID eg E011223344556677"); | |
858 | PrintAndLog(" s selected tag"); | |
859 | PrintAndLog(" u unaddressed mode"); | |
860 | PrintAndLog(" * scan for tag"); | |
861 | PrintAndLog(" start#: page number to start 0-255"); | |
862 | PrintAndLog(" count#: number of pages"); | |
863 | return 0; | |
864 | } | |
865 | ||
866 | prepareHF15Cmd(&cmd, &c,(uint8_t[]){ISO15_CMD_READMULTI},1); | |
867 | reqlen=c.arg[0]; | |
868 | ||
869 | pagenum=strtol(cmd,NULL,0); | |
870 | ||
871 | // skip to next space | |
872 | while (*cmd!=' ' && *cmd!='\t') cmd++; | |
873 | // skip over the space | |
874 | while (*cmd==' ' || *cmd=='\t') cmd++; | |
875 | ||
876 | pagecount=strtol(cmd,NULL,0); | |
877 | if (pagecount>0) pagecount--; // 0 means 1 page, 1 means 2 pages, ... | |
878 | ||
879 | req[reqlen++]=(uint8_t)pagenum; | |
880 | req[reqlen++]=(uint8_t)pagecount; | |
881 | ||
882 | reqlen=AddCrc(req,reqlen); | |
883 | ||
884 | c.arg[0]=reqlen; | |
885 | ||
886 | SendCommand(&c); | |
887 | ||
888 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000) && resp.arg[0]>2) { | |
889 | recv = resp.d.asBytes; | |
890 | if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) { | |
891 | if (!(recv[0] & ISO15_RES_ERROR)) { | |
892 | *output=0; // reset outputstring | |
893 | for ( int i=1; i<resp.arg[0]-2; i++) { | |
894 | sprintf(output+strlen(output),"%02X ",recv[i]); | |
895 | } | |
896 | strcat(output," "); | |
897 | for ( int i=1; i<resp.arg[0]-2; i++) { | |
898 | sprintf(output+strlen(output),"%c",recv[i]>31 && recv[i]<127?recv[i]:'.'); | |
899 | } | |
900 | PrintAndLog("%s",output); | |
901 | } else { | |
902 | PrintAndLog("Tag returned Error %i: %s",recv[0],TagErrorStr(recv[0])); | |
903 | } | |
904 | } else { | |
905 | PrintAndLog("CRC failed"); | |
906 | } | |
907 | } else { | |
908 | PrintAndLog("no answer"); | |
909 | } | |
910 | ||
911 | return 0; | |
912 | } | |
913 | ||
914 | /** | |
915 | * Commandline handling: HF15 CMD READ | |
916 | * Reads a single Block | |
917 | */ | |
918 | int CmdHF15CmdRead(const char *Cmd) { | |
919 | UsbCommand resp; | |
920 | uint8_t *recv; | |
921 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? | |
922 | uint8_t *req=c.d.asBytes; | |
923 | int reqlen=0, pagenum; | |
924 | char cmdbuf[100]; | |
925 | char *cmd=cmdbuf; | |
926 | char output[100]=""; | |
927 | ||
928 | strncpy(cmd,Cmd,99); | |
929 | ||
930 | // usage: | |
931 | if (strlen(cmd)<3) { | |
932 | PrintAndLog("Usage: hf 15 cmd read [options] <uid|s|u|*> <page#>"); | |
933 | PrintAndLog(" options:"); | |
934 | PrintAndLog(" -2 use slower '1 out of 256' mode"); | |
935 | PrintAndLog(" uid (either): "); | |
936 | PrintAndLog(" <8B hex> full UID eg E011223344556677"); | |
937 | PrintAndLog(" s selected tag"); | |
938 | PrintAndLog(" u unaddressed mode"); | |
939 | PrintAndLog(" * scan for tag"); | |
940 | PrintAndLog(" page#: page number 0-255"); | |
941 | return 0; | |
942 | } | |
943 | ||
944 | prepareHF15Cmd(&cmd, &c,(uint8_t[]){ISO15_CMD_READ},1); | |
945 | reqlen=c.arg[0]; | |
946 | ||
947 | pagenum=strtol(cmd,NULL,0); | |
948 | /*if (pagenum<0) { | |
949 | PrintAndLog("invalid pagenum"); | |
950 | return 0; | |
951 | } */ | |
952 | ||
953 | req[reqlen++]=(uint8_t)pagenum; | |
954 | ||
955 | reqlen=AddCrc(req,reqlen); | |
956 | ||
957 | c.arg[0]=reqlen; | |
958 | ||
959 | SendCommand(&c); | |
960 | ||
961 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000) && resp.arg[0]>2) { | |
962 | recv = resp.d.asBytes; | |
963 | if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) { | |
964 | if (!(recv[0] & ISO15_RES_ERROR)) { | |
965 | *output=0; // reset outputstring | |
966 | //sprintf(output, "Block %2i ",blocknum); | |
967 | for ( int i=1; i<resp.arg[0]-2; i++) { | |
968 | sprintf(output+strlen(output),"%02X ",recv[i]); | |
969 | } | |
970 | strcat(output," "); | |
971 | for ( int i=1; i<resp.arg[0]-2; i++) { | |
972 | sprintf(output+strlen(output),"%c",recv[i]>31 && recv[i]<127?recv[i]:'.'); | |
973 | } | |
974 | PrintAndLog("%s",output); | |
975 | } else { | |
976 | PrintAndLog("Tag returned Error %i: %s",recv[1],TagErrorStr(recv[1])); | |
977 | } | |
978 | } else { | |
979 | PrintAndLog("CRC failed"); | |
980 | } | |
981 | } else { | |
982 | PrintAndLog("no answer"); | |
983 | } | |
984 | ||
985 | return 0; | |
986 | } | |
987 | ||
988 | ||
989 | /** | |
990 | * Commandline handling: HF15 CMD WRITE | |
991 | * Writes a single Block - might run into timeout, even when successful | |
992 | */ | |
993 | int CmdHF15CmdWrite(const char *Cmd) { | |
994 | UsbCommand resp; | |
995 | uint8_t *recv; | |
996 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? | |
997 | uint8_t *req=c.d.asBytes; | |
998 | int reqlen=0, pagenum, temp; | |
999 | char cmdbuf[100]; | |
1000 | char *cmd=cmdbuf; | |
1001 | char *cmd2; | |
1002 | ||
1003 | strncpy(cmd,Cmd,99); | |
1004 | ||
1005 | // usage: | |
1006 | if (strlen(cmd)<3) { | |
1007 | PrintAndLog("Usage: hf 15 cmd write [options] <uid|s|u|*> <page#> <hexdata>"); | |
1008 | PrintAndLog(" options:"); | |
1009 | PrintAndLog(" -2 use slower '1 out of 256' mode"); | |
1010 | PrintAndLog(" -o set OPTION Flag (needed for TI)"); | |
1011 | PrintAndLog(" uid (either): "); | |
1012 | PrintAndLog(" <8B hex> full UID eg E011223344556677"); | |
1013 | PrintAndLog(" s selected tag"); | |
1014 | PrintAndLog(" u unaddressed mode"); | |
1015 | PrintAndLog(" * scan for tag"); | |
1016 | PrintAndLog(" page#: page number 0-255"); | |
1017 | PrintAndLog(" hexdata: data to be written eg AA BB CC DD"); | |
1018 | return 0; | |
1019 | } | |
1020 | ||
1021 | prepareHF15Cmd(&cmd, &c,(uint8_t[]){ISO15_CMD_WRITE},1); | |
1022 | reqlen=c.arg[0]; | |
1023 | ||
1024 | // *cmd -> page num ; *cmd2 -> data | |
1025 | cmd2=cmd; | |
1026 | while (*cmd2!=' ' && *cmd2!='\t' && *cmd2) cmd2++; | |
1027 | *cmd2=0; | |
1028 | cmd2++; | |
1029 | ||
1030 | pagenum=strtol(cmd,NULL,0); | |
1031 | /*if (pagenum<0) { | |
1032 | PrintAndLog("invalid pagenum"); | |
1033 | return 0; | |
1034 | } */ | |
1035 | req[reqlen++]=(uint8_t)pagenum; | |
1036 | ||
1037 | ||
1038 | while (cmd2[0] && cmd2[1]) { // hexdata, read by 2 hexchars | |
1039 | if (*cmd2==' ') { | |
1040 | cmd2++; | |
1041 | continue; | |
1042 | } | |
1043 | sscanf((char[]){cmd2[0],cmd2[1],0},"%X",&temp); | |
1044 | req[reqlen++]=temp & 0xff; | |
1045 | cmd2+=2; | |
1046 | } | |
1047 | ||
1048 | reqlen=AddCrc(req,reqlen); | |
1049 | ||
1050 | c.arg[0]=reqlen; | |
1051 | ||
1052 | SendCommand(&c); | |
1053 | ||
1054 | if (WaitForResponseTimeout(CMD_ACK,&resp,2000) && resp.arg[0]>2) { | |
1055 | recv = resp.d.asBytes; | |
1056 | if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) { | |
1057 | if (!(recv[0] & ISO15_RES_ERROR)) { | |
1058 | PrintAndLog("OK"); | |
1059 | } else { | |
1060 | PrintAndLog("Tag returned Error %i: %s",recv[1],TagErrorStr(recv[1])); | |
1061 | } | |
1062 | } else { | |
1063 | PrintAndLog("CRC failed"); | |
1064 | } | |
1065 | } else { | |
1066 | PrintAndLog("timeout: no answer - data may be written anyway"); | |
1067 | } | |
1068 | ||
1069 | return 0; | |
1070 | } | |
1071 | ||
1072 | ||
1073 | ||
1074 | static command_t CommandTable15Cmd[] = | |
1075 | { | |
1076 | {"help", CmdHF15CmdHelp, 1, "This Help"}, | |
1077 | {"inquiry", CmdHF15CmdInquiry, 0, "Search for tags in range"}, | |
1078 | /* | |
1079 | {"select", CmdHF15CmdSelect, 0, "Select an tag with a specific UID for further commands"}, | |
1080 | */ | |
1081 | {"read", CmdHF15CmdRead, 0, "Read a block"}, | |
1082 | {"write", CmdHF15CmdWrite, 0, "Write a block"}, | |
1083 | {"readmulti",CmdHF15CmdReadmulti, 0, "Reads multiple Blocks"}, | |
1084 | {"sysinfo",CmdHF15CmdSysinfo, 0, "Get Card Information"}, | |
1085 | {"raw", CmdHF15CmdRaw, 0, "Send raw hex data to tag"}, | |
1086 | {"debug", CmdHF15CmdDebug, 0, "Turn debugging on/off"}, | |
1087 | {NULL, NULL, 0, NULL} | |
1088 | }; | |
1089 | ||
1090 | int CmdHF15Cmd(const char *Cmd) | |
1091 | { | |
1092 | CmdsParse(CommandTable15Cmd, Cmd); | |
1093 | return 0; | |
1094 | } | |
1095 | ||
1096 | int CmdHF15CmdHelp(const char *Cmd) | |
1097 | { | |
1098 | CmdsHelp(CommandTable15Cmd); | |
1099 | return 0; | |
1100 | } | |
1101 |