]>
Commit | Line | Data |
---|---|---|
1 | #ifndef PROTOCOLS_H | |
2 | #define PROTOCOLS_H | |
3 | ||
4 | //The following data is taken from http://www.proxmark.org/forum/viewtopic.php?pid=13501#p13501 | |
5 | /* | |
6 | ISO14443A (usually NFC tags) | |
7 | 26 (7bits) = REQA | |
8 | 30 = Read (usage: 30+1byte block number+2bytes ISO14443A-CRC - answer: 16bytes) | |
9 | A2 = Write (usage: A2+1byte block number+4bytes data+2bytes ISO14443A-CRC - answer: 0A [ACK] or 00 [NAK]) | |
10 | 52 (7bits) = WUPA (usage: 52(7bits) - answer: 2bytes ATQA) | |
11 | 93 20 = Anticollision (usage: 9320 - answer: 4bytes UID+1byte UID-bytes-xor) | |
12 | 93 70 = Select (usage: 9370+5bytes 9320 answer - answer: 1byte SAK) | |
13 | 95 20 = Anticollision of cascade level2 | |
14 | 95 70 = Select of cascade level2 | |
15 | 50 00 = Halt (usage: 5000+2bytes ISO14443A-CRC - no answer from card) | |
16 | Mifare | |
17 | 60 = Authenticate with KeyA | |
18 | 61 = Authenticate with KeyB | |
19 | 40 (7bits) = Used to put Chinese Changeable UID cards in special mode (must be followed by 43 (8bits) - answer: 0A) | |
20 | C0 = Decrement | |
21 | C1 = Increment | |
22 | C2 = Restore | |
23 | B0 = Transfer | |
24 | Ultralight C | |
25 | A0 = Compatibility Write (to accomodate MIFARE commands) | |
26 | 1A = Step1 Authenticate | |
27 | AF = Step2 Authenticate | |
28 | ||
29 | ||
30 | ISO14443B | |
31 | 05 = REQB | |
32 | 1D = ATTRIB | |
33 | 50 = HALT | |
34 | SRIX4K (tag does not respond to 05) | |
35 | 06 00 = INITIATE | |
36 | 0E xx = SELECT ID (xx = Chip-ID) | |
37 | 0B = Get UID | |
38 | 08 yy = Read Block (yy = block number) | |
39 | 09 yy dd dd dd dd = Write Block (yy = block number; dd dd dd dd = data to be written) | |
40 | 0C = Reset to Inventory | |
41 | 0F = Completion | |
42 | 0A 11 22 33 44 55 66 = Authenticate (11 22 33 44 55 66 = data to authenticate) | |
43 | ||
44 | ||
45 | ISO15693 | |
46 | MANDATORY COMMANDS (all ISO15693 tags must support those) | |
47 | 01 = Inventory (usage: 260100+2bytes ISO15693-CRC - answer: 12bytes) | |
48 | 02 = Stay Quiet | |
49 | OPTIONAL COMMANDS (not all tags support them) | |
50 | 20 = Read Block (usage: 0220+1byte block number+2bytes ISO15693-CRC - answer: 4bytes) | |
51 | 21 = Write Block (usage: 0221+1byte block number+4bytes data+2bytes ISO15693-CRC - answer: 4bytes) | |
52 | 22 = Lock Block | |
53 | 23 = Read Multiple Blocks (usage: 0223+1byte 1st block to read+1byte last block to read+2bytes ISO15693-CRC) | |
54 | 25 = Select | |
55 | 26 = Reset to Ready | |
56 | 27 = Write AFI | |
57 | 28 = Lock AFI | |
58 | 29 = Write DSFID | |
59 | 2A = Lock DSFID | |
60 | 2B = Get_System_Info (usage: 022B+2bytes ISO15693-CRC - answer: 14 or more bytes) | |
61 | 2C = Read Multiple Block Security Status (usage: 022C+1byte 1st block security to read+1byte last block security to read+2bytes ISO15693-CRC) | |
62 | ||
63 | EM Microelectronic CUSTOM COMMANDS | |
64 | A5 = Active EAS (followed by 1byte IC Manufacturer code+1byte EAS type) | |
65 | A7 = Write EAS ID (followed by 1byte IC Manufacturer code+2bytes EAS value) | |
66 | B8 = Get Protection Status for a specific block (followed by 1byte IC Manufacturer code+1byte block number+1byte of how many blocks after the previous is needed the info) | |
67 | E4 = Login (followed by 1byte IC Manufacturer code+4bytes password) | |
68 | NXP/Philips CUSTOM COMMANDS | |
69 | A0 = Inventory Read | |
70 | A1 = Fast Inventory Read | |
71 | A2 = Set EAS | |
72 | A3 = Reset EAS | |
73 | A4 = Lock EAS | |
74 | A5 = EAS Alarm | |
75 | A6 = Password Protect EAS | |
76 | A7 = Write EAS ID | |
77 | A8 = Read EPC | |
78 | B0 = Inventory Page Read | |
79 | B1 = Fast Inventory Page Read | |
80 | B2 = Get Random Number | |
81 | B3 = Set Password | |
82 | B4 = Write Password | |
83 | B5 = Lock Password | |
84 | B6 = Bit Password Protection | |
85 | B7 = Lock Page Protection Condition | |
86 | B8 = Get Multiple Block Protection Status | |
87 | B9 = Destroy SLI | |
88 | BA = Enable Privacy | |
89 | BB = 64bit Password Protection | |
90 | 40 = Long Range CMD (Standard ISO/TR7003:1990) | |
91 | */ | |
92 | ||
93 | #define ICLASS_CMD_ACTALL 0x0A | |
94 | #define ICLASS_CMD_READ_OR_IDENTIFY 0x0C | |
95 | #define ICLASS_CMD_SELECT 0x81 | |
96 | #define ICLASS_CMD_PAGESEL 0x84 | |
97 | #define ICLASS_CMD_READCHECK_KD 0x88 | |
98 | #define ICLASS_CMD_READCHECK_KC 0x18 | |
99 | #define ICLASS_CMD_CHECK 0x05 | |
100 | #define ICLASS_CMD_DETECT 0x0F | |
101 | #define ICLASS_CMD_HALT 0x00 | |
102 | #define ICLASS_CMD_UPDATE 0x87 | |
103 | #define ICLASS_CMD_ACT 0x8E | |
104 | #define ICLASS_CMD_READ4 0x06 | |
105 | ||
106 | ||
107 | #define ISO14443A_CMD_REQA 0x26 | |
108 | #define ISO14443A_CMD_READBLOCK 0x30 | |
109 | #define ISO14443A_CMD_WUPA 0x52 | |
110 | #define ISO14443A_CMD_ANTICOLL_OR_SELECT 0x93 | |
111 | #define ISO14443A_CMD_ANTICOLL_OR_SELECT_2 0x95 | |
112 | #define ISO14443A_CMD_ANTICOLL_OR_SELECT_3 0x97 | |
113 | #define ISO14443A_CMD_WRITEBLOCK 0xA0 // or 0xA2 ? | |
114 | #define ISO14443A_CMD_HALT 0x50 | |
115 | #define ISO14443A_CMD_RATS 0xE0 | |
116 | ||
117 | #define MIFARE_AUTH_KEYA 0x60 | |
118 | #define MIFARE_AUTH_KEYB 0x61 | |
119 | #define MIFARE_MAGICWUPC1 0x40 | |
120 | #define MIFARE_MAGICWUPC2 0x43 | |
121 | #define MIFARE_MAGICWIPEC 0x41 | |
122 | #define MIFARE_CMD_INC 0xC0 | |
123 | #define MIFARE_CMD_DEC 0xC1 | |
124 | #define MIFARE_CMD_RESTORE 0xC2 | |
125 | #define MIFARE_CMD_TRANSFER 0xB0 | |
126 | ||
127 | #define MIFARE_EV1_PERSONAL_UID 0x40 | |
128 | #define MIFARE_EV1_SETMODE 0x43 | |
129 | ||
130 | ||
131 | #define MIFARE_ULC_WRITE 0xA2 | |
132 | //#define MIFARE_ULC__COMP_WRITE 0xA0 | |
133 | #define MIFARE_ULC_AUTH_1 0x1A | |
134 | #define MIFARE_ULC_AUTH_2 0xAF | |
135 | ||
136 | #define MIFARE_ULEV1_AUTH 0x1B | |
137 | #define MIFARE_ULEV1_VERSION 0x60 | |
138 | #define MIFARE_ULEV1_FASTREAD 0x3A | |
139 | //#define MIFARE_ULEV1_WRITE 0xA2 | |
140 | //#define MIFARE_ULEV1_COMP_WRITE 0xA0 | |
141 | #define MIFARE_ULEV1_READ_CNT 0x39 | |
142 | #define MIFARE_ULEV1_INCR_CNT 0xA5 | |
143 | #define MIFARE_ULEV1_READSIG 0x3C | |
144 | #define MIFARE_ULEV1_CHECKTEAR 0x3E | |
145 | #define MIFARE_ULEV1_VCSL 0x4B | |
146 | ||
147 | /** | |
148 | 06 00 = INITIATE | |
149 | 0E xx = SELECT ID (xx = Chip-ID) | |
150 | 0B = Get UID | |
151 | 08 yy = Read Block (yy = block number) | |
152 | 09 yy dd dd dd dd = Write Block (yy = block number; dd dd dd dd = data to be written) | |
153 | 0C = Reset to Inventory | |
154 | 0F = Completion | |
155 | 0A 11 22 33 44 55 66 = Authenticate (11 22 33 44 55 66 = data to authenticate) | |
156 | **/ | |
157 | ||
158 | #define ISO14443B_REQB 0x05 | |
159 | #define ISO14443B_ATTRIB 0x1D | |
160 | #define ISO14443B_HALT 0x50 | |
161 | #define ISO14443B_INITIATE 0x06 | |
162 | #define ISO14443B_SELECT 0x0E | |
163 | #define ISO14443B_GET_UID 0x0B | |
164 | #define ISO14443B_READ_BLK 0x08 | |
165 | #define ISO14443B_WRITE_BLK 0x09 | |
166 | #define ISO14443B_RESET 0x0C | |
167 | #define ISO14443B_COMPLETION 0x0F | |
168 | #define ISO14443B_AUTHENTICATE 0x0A | |
169 | ||
170 | //First byte is 26 | |
171 | #define ISO15693_INVENTORY 0x01 | |
172 | #define ISO15693_STAYQUIET 0x02 | |
173 | //First byte is 02 | |
174 | #define ISO15693_READBLOCK 0x20 | |
175 | #define ISO15693_WRITEBLOCK 0x21 | |
176 | #define ISO15693_LOCKBLOCK 0x22 | |
177 | #define ISO15693_READ_MULTI_BLOCK 0x23 | |
178 | #define ISO15693_SELECT 0x25 | |
179 | #define ISO15693_RESET_TO_READY 0x26 | |
180 | #define ISO15693_WRITE_AFI 0x27 | |
181 | #define ISO15693_LOCK_AFI 0x28 | |
182 | #define ISO15693_WRITE_DSFID 0x29 | |
183 | #define ISO15693_LOCK_DSFID 0x2A | |
184 | #define ISO15693_GET_SYSTEM_INFO 0x2B | |
185 | #define ISO15693_READ_MULTI_SECSTATUS 0x2C | |
186 | ||
187 | ||
188 | // Topaz command set: | |
189 | #define TOPAZ_REQA 0x26 // Request | |
190 | #define TOPAZ_WUPA 0x52 // WakeUp | |
191 | #define TOPAZ_RID 0x78 // Read ID | |
192 | #define TOPAZ_RALL 0x00 // Read All (all bytes) | |
193 | #define TOPAZ_READ 0x01 // Read (a single byte) | |
194 | #define TOPAZ_WRITE_E 0x53 // Write-with-erase (a single byte) | |
195 | #define TOPAZ_WRITE_NE 0x1a // Write-no-erase (a single byte) | |
196 | // additional commands for Dynamic Memory Model | |
197 | #define TOPAZ_RSEG 0x10 // Read segment | |
198 | #define TOPAZ_READ8 0x02 // Read (eight bytes) | |
199 | #define TOPAZ_WRITE_E8 0x54 // Write-with-erase (eight bytes) | |
200 | #define TOPAZ_WRITE_NE8 0x1B // Write-no-erase (eight bytes) | |
201 | ||
202 | ||
203 | #define ISO_14443A 0 | |
204 | #define ICLASS 1 | |
205 | #define ISO_14443B 2 | |
206 | #define TOPAZ 3 | |
207 | ||
208 | //-- Picopass fuses | |
209 | #define FUSE_FPERS 0x80 | |
210 | #define FUSE_CODING1 0x40 | |
211 | #define FUSE_CODING0 0x20 | |
212 | #define FUSE_CRYPT1 0x10 | |
213 | #define FUSE_CRYPT0 0x08 | |
214 | #define FUSE_FPROD1 0x04 | |
215 | #define FUSE_FPROD0 0x02 | |
216 | #define FUSE_RA 0x01 | |
217 | ||
218 | void printIclassDumpInfo(uint8_t* iclass_dump); | |
219 | void getMemConfig(uint8_t mem_cfg, uint8_t chip_cfg, uint8_t *max_blk, uint8_t *app_areas, uint8_t *kb); | |
220 | ||
221 | /* T55x7 configuration register definitions */ | |
222 | #define T55x7_POR_DELAY 0x00000001 | |
223 | #define T55x7_ST_TERMINATOR 0x00000008 | |
224 | #define T55x7_PWD 0x00000010 | |
225 | #define T55x7_MAXBLOCK_SHIFT 5 | |
226 | #define T55x7_AOR 0x00000200 | |
227 | #define T55x7_PSKCF_RF_2 0 | |
228 | #define T55x7_PSKCF_RF_4 0x00000400 | |
229 | #define T55x7_PSKCF_RF_8 0x00000800 | |
230 | #define T55x7_MODULATION_DIRECT 0 | |
231 | #define T55x7_MODULATION_PSK1 0x00001000 | |
232 | #define T55x7_MODULATION_PSK2 0x00002000 | |
233 | #define T55x7_MODULATION_PSK3 0x00003000 | |
234 | #define T55x7_MODULATION_FSK1 0x00004000 | |
235 | #define T55x7_MODULATION_FSK2 0x00005000 | |
236 | #define T55x7_MODULATION_FSK1a 0x00006000 | |
237 | #define T55x7_MODULATION_FSK2a 0x00007000 | |
238 | #define T55x7_MODULATION_MANCHESTER 0x00008000 | |
239 | #define T55x7_MODULATION_BIPHASE 0x00010000 | |
240 | #define T55x7_MODULATION_DIPHASE 0x00018000 | |
241 | #define T55x7_X_MODE 0x00020000 | |
242 | #define T55x7_BITRATE_RF_8 0 | |
243 | #define T55x7_BITRATE_RF_16 0x00040000 | |
244 | #define T55x7_BITRATE_RF_32 0x00080000 | |
245 | #define T55x7_BITRATE_RF_40 0x000C0000 | |
246 | #define T55x7_BITRATE_RF_50 0x00100000 | |
247 | #define T55x7_BITRATE_RF_64 0x00140000 | |
248 | #define T55x7_BITRATE_RF_100 0x00180000 | |
249 | #define T55x7_BITRATE_RF_128 0x001C0000 | |
250 | ||
251 | /* T5555 (Q5) configuration register definitions */ | |
252 | #define T5555_ST_TERMINATOR 0x00000001 | |
253 | #define T5555_MAXBLOCK_SHIFT 0x00000001 | |
254 | #define T5555_MODULATION_MANCHESTER 0 | |
255 | #define T5555_MODULATION_PSK1 0x00000010 | |
256 | #define T5555_MODULATION_PSK2 0x00000020 | |
257 | #define T5555_MODULATION_PSK3 0x00000030 | |
258 | #define T5555_MODULATION_FSK1 0x00000040 | |
259 | #define T5555_MODULATION_FSK2 0x00000050 | |
260 | #define T5555_MODULATION_BIPHASE 0x00000060 | |
261 | #define T5555_MODULATION_DIRECT 0x00000070 | |
262 | #define T5555_INVERT_OUTPUT 0x00000080 | |
263 | #define T5555_PSK_RF_2 0 | |
264 | #define T5555_PSK_RF_4 0x00000100 | |
265 | #define T5555_PSK_RF_8 0x00000200 | |
266 | #define T5555_USE_PWD 0x00000400 | |
267 | #define T5555_USE_AOR 0x00000800 | |
268 | #define T5555_SET_BITRATE(x) (((x-2)/2)<<12) | |
269 | #define T5555_GET_BITRATE(x) ((((x >> 12) & 0x3F)*2)+2) | |
270 | #define T5555_BITRATE_SHIFT 12 //(RF=2n+2) ie 64=2*0x1F+2 or n = (RF-2)/2 | |
271 | #define T5555_FAST_WRITE 0x00004000 | |
272 | #define T5555_PAGE_SELECT 0x00008000 | |
273 | ||
274 | #define T55XX_WRITE_TIMEOUT 1500 | |
275 | ||
276 | uint32_t GetT55xxClockBit(uint32_t clock); | |
277 | ||
278 | // em4x05 & em4x69 chip configuration register definitions | |
279 | #define EM4x05_GET_BITRATE(x) (((x & 0x3F)*2)+2) | |
280 | #define EM4x05_SET_BITRATE(x) ((x-2)/2) | |
281 | #define EM4x05_MODULATION_NRZ 0x00000000 | |
282 | #define EM4x05_MODULATION_MANCHESTER 0x00000040 | |
283 | #define EM4x05_MODULATION_BIPHASE 0x00000080 | |
284 | #define EM4x05_MODULATION_MILLER 0x000000C0 //not supported by all 4x05/4x69 chips | |
285 | #define EM4x05_MODULATION_PSK1 0x00000100 //not supported by all 4x05/4x69 chips | |
286 | #define EM4x05_MODULATION_PSK2 0x00000140 //not supported by all 4x05/4x69 chips | |
287 | #define EM4x05_MODULATION_PSK3 0x00000180 //not supported by all 4x05/4x69 chips | |
288 | #define EM4x05_MODULATION_FSK1 0x00000200 //not supported by all 4x05/4x69 chips | |
289 | #define EM4x05_MODULATION_FSK2 0x00000240 //not supported by all 4x05/4x69 chips | |
290 | #define EM4x05_PSK_RF_2 0 | |
291 | #define EM4x05_PSK_RF_4 0x00000400 | |
292 | #define EM4x05_PSK_RF_8 0x00000800 | |
293 | #define EM4x05_MAXBLOCK_SHIFT 14 | |
294 | #define EM4x05_FIRST_USER_BLOCK 5 | |
295 | #define EM4x05_SET_NUM_BLOCKS(x) ((x+5-1)<<14) //# of blocks sent during default read mode | |
296 | #define EM4x05_GET_NUM_BLOCKS(x) (((x>>14) & 0xF)-5+1) | |
297 | #define EM4x05_READ_LOGIN_REQ 1<<18 | |
298 | #define EM4x05_READ_HK_LOGIN_REQ 1<<19 | |
299 | #define EM4x05_WRITE_LOGIN_REQ 1<<20 | |
300 | #define EM4x05_WRITE_HK_LOGIN_REQ 1<<21 | |
301 | #define EM4x05_READ_AFTER_WRITE 1<<22 | |
302 | #define EM4x05_DISABLE_ALLOWED 1<<23 | |
303 | #define EM4x05_READER_TALK_FIRST 1<<24 | |
304 | ||
305 | #endif | |
306 | // PROTOCOLS_H |