git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf14a.c

   1 //-----------------------------------------------------------------------------
   2 // 2011, Merlok
   3 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
   4 //
   5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   6 // at your option, any later version. See the LICENSE.txt file for the text of
   7 // the license.
   8 //-----------------------------------------------------------------------------
   9 // High frequency ISO14443A commands
  10 //-----------------------------------------------------------------------------
  11
  12 #include <stdio.h>
  13 #include <stdlib.h>
  14 #include <string.h>
  15 #include <unistd.h>
  16 #include "util.h"
  17 #include "iso14443crc.h"
  18 #include "data.h"
  19 #include "proxusb.h"
  20 #include "ui.h"
  21 #include "cmdparser.h"
  22 #include "cmdhf14a.h"
  23 #include "common.h"
  24 #include "cmdmain.h"
  25
  26 static int CmdHelp(const char *Cmd);
  27
  28 int CmdHF14AList(const char *Cmd)
  29 {
  30   uint8_t got[1920];
  31   GetFromBigBuf(got, sizeof(got));
  32
  33   PrintAndLog("recorded activity:");
  34   PrintAndLog(" ETU     :rssi: who bytes");
  35   PrintAndLog("---------+----+----+-----------");
  36
  37   int i = 0;
  38   int prev = -1;
  39
  40   for (;;) {
  41     if(i >= 1900) {
  42       break;
  43     }
  44
  45     bool isResponse;
  46     int timestamp = *((uint32_t *)(got+i));
  47     if (timestamp & 0x80000000) {
  48       timestamp &= 0x7fffffff;
  49       isResponse = 1;
  50     } else {
  51       isResponse = 0;
  52     }
  53
  54     int metric = 0;
  55     int parityBits = *((uint32_t *)(got+i+4));
  56     // 4 bytes of additional information...
  57     // maximum of 32 additional parity bit information
  58     //
  59     // TODO:
  60     // at each quarter bit period we can send power level (16 levels)
  61     // or each half bit period in 256 levels.
  62
  63
  64     int len = got[i+8];
  65
  66     if (len > 100) {
  67       break;
  68     }
  69     if (i + len >= 1900) {
  70       break;
  71     }
  72
  73     uint8_t *frame = (got+i+9);
  74
  75     // Break and stick with current result if buffer was not completely full
  76     if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }
  77
  78     char line[1000] = "";
  79     int j;
  80     for (j = 0; j < len; j++) {
  81       int oddparity = 0x01;
  82       int k;
  83
  84       for (k=0;k<8;k++) {
  85         oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
  86       }
  87
  88       //if((parityBits >> (len - j - 1)) & 0x01) {
  89       if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
  90         sprintf(line+(j*4), "%02x!  ", frame[j]);
  91       }
  92       else {
  93         sprintf(line+(j*4), "%02x   ", frame[j]);
  94       }
  95     }
  96
  97     char *crc;
  98     crc = "";
  99     if (len > 2) {
 100       uint8_t b1, b2;
 101       for (j = 0; j < (len - 1); j++) {
 102         // gives problems... search for the reason..
 103         /*if(frame[j] == 0xAA) {
 104           switch(frame[j+1]) {
 105             case 0x01:
 106               crc = "[1] Two drops close after each other";
 107             break;
 108             case 0x02:
 109               crc = "[2] Potential SOC with a drop in second half of bitperiod";
 110               break;
 111             case 0x03:
 112               crc = "[3] Segment Z after segment X is not possible";
 113               break;
 114             case 0x04:
 115               crc = "[4] Parity bit of a fully received byte was wrong";
 116               break;
 117             default:
 118               crc = "[?] Unknown error";
 119               break;
 120           }
 121           break;
 122         }*/
 123       }
 124
 125       if (strlen(crc)==0) {
 126         ComputeCrc14443(CRC_14443_A, frame, len-2, &b1, &b2);
 127         if (b1 != frame[len-2] || b2 != frame[len-1]) {
 128           crc = (isResponse & (len < 6)) ? "" : " !crc";
 129         } else {
 130           crc = "";
 131         }
 132       }
 133     } else {
 134       crc = ""; // SHORT
 135     }
 136
 137     char metricString[100];
 138     if (isResponse) {
 139       sprintf(metricString, "%3d", metric);
 140     } else {
 141       strcpy(metricString, "   ");
 142     }
 143
 144     PrintAndLog(" +%7d: %s: %s %s %s",
 145       (prev < 0 ? 0 : (timestamp - prev)),
 146       metricString,
 147       (isResponse ? "TAG" : "   "), line, crc);
 148
 149     prev = timestamp;
 150     i += (len + 9);
 151   }
 152         return 0;
 153 }
 154
 155 void iso14a_set_timeout(uint32_t timeout) {
 156         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_SET_TIMEOUT, 0, timeout}};
 157         SendCommand(&c);
 158 }
 159
 160 int CmdHF14AReader(const char *Cmd)
 161 {
 162         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT, 0, 0}};
 163         SendCommand(&c);
 164         UsbCommand * resp = WaitForResponse(CMD_ACK);
 165         uint8_t              * uid  = resp->d.asBytes;
 166         iso14a_card_select_t * card = (iso14a_card_select_t *)(uid + 12);
 167
 168         if(resp->arg[0] == 0) {
 169                 PrintAndLog("iso14443a card select failed");
 170                 return 0;
 171         }
 172
 173         PrintAndLog("ATQA : %02x %02x", card->atqa[0], card->atqa[1]);
 174         PrintAndLog(" UID : %s", sprint_hex(uid, 12));
 175         PrintAndLog(" SAK : %02x [%d]", card->sak, resp->arg[0]);
 176
 177         switch (card->sak) {
 178                 case 0x00: PrintAndLog(" SAK : NXP MIFARE Ultralight | Ultralight C"); break;
 179                 case 0x04: PrintAndLog(" SAK : NXP MIFARE (various !DESFire !DESFire EV1)"); break;
 180
 181                 case 0x08: PrintAndLog(" SAK : NXP MIFARE CLASSIC 1k | Plus 2k"); break;
 182                 case 0x09: PrintAndLog(" SAK : NXP MIFARE Mini 0.3k"); break;
 183                 case 0x10: PrintAndLog(" SAK : NXP MIFARE Plus 2k"); break;
 184                 case 0x11: PrintAndLog(" SAK : NXP MIFARE Plus 4k"); break;
 185                 case 0x18: PrintAndLog(" SAK : NXP MIFARE Classic 4k | Plus 4k"); break;
 186                 case 0x20: PrintAndLog(" SAK : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k | JCOP 31/41"); break;
 187                 case 0x24: PrintAndLog(" SAK : NXP MIFARE DESFire | DESFire EV1"); break;
 188                 case 0x28: PrintAndLog(" SAK : JCOP31 or JCOP41 v2.3.1"); break;
 189                 case 0x38: PrintAndLog(" SAK : Nokia 6212 or 6131 MIFARE CLASSIC 4K"); break;
 190                 case 0x88: PrintAndLog(" SAK : Infineon MIFARE CLASSIC 1K"); break;
 191                 case 0x98: PrintAndLog(" SAK : Gemplus MPCOS"); break;
 192                 default: ;
 193         }
 194         if(resp->arg[0] == 1)
 195                 PrintAndLog(" ATS : %s", sprint_hex(card->ats, card->ats_len));
 196         else
 197                 PrintAndLog("proprietary non-iso14443a card found, RATS not supported");
 198
 199         return resp->arg[0];
 200 }
 201
 202 // ## simulate iso14443a tag
 203 // ## greg - added ability to specify tag UID
 204 int CmdHF14ASim(const char *Cmd)
 205 {
 206         UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,{0,0,0}};
 207
 208         // Retrieve the tag type
 209         uint8_t tagtype = param_get8ex(Cmd,0,0,10);
 210
 211         // When no argument was given, just print help message
 212         if (tagtype == 0) {
 213                 PrintAndLog("");
 214                 PrintAndLog(" Emulating ISO/IEC 14443 type A tag with 4 or 7 byte UID");
 215                 PrintAndLog("");
 216                 PrintAndLog("   syntax: hf 14a sim <type> <uid>");
 217                 PrintAndLog("    types: 1 = MIFARE Classic");
 218                 PrintAndLog("           2 = MIFARE Ultralight");
 219                 PrintAndLog("           3 = MIFARE DESFIRE");
 220                 PrintAndLog("           4 = ISO/IEC 14443-4");
 221                 PrintAndLog("");
 222                 return 1;
 223         }
 224
 225         // Store the tag type
 226         c.arg[0] = tagtype;
 227
 228         // Retrieve the full 4 or 7 byte long uid
 229         uint64_t long_uid = param_get64ex(Cmd,1,0,16);
 230
 231         // Are we handling the (optional) second part uid?
 232         if (long_uid > 0xffffffff) {
 233                 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 7 byte UID (%014llx)",long_uid);
 234                 // Store the second part
 235                 c.arg[2] = (long_uid & 0xffffffff);
 236                 long_uid >>= 32;
 237                 // Store the first part, ignore the first byte, it is replaced by cascade byte (0x88)
 238                 c.arg[1] = (long_uid & 0xffffff);
 239         } else {
 240                 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 4 byte UID (%08x)",long_uid);
 241                 // Only store the first part
 242                 c.arg[1] = long_uid & 0xffffffff;
 243         }
 244 /*
 245                 // At lease save the mandatory first part of the UID
 246                 c.arg[0] = long_uid & 0xffffffff;
 247
 248
 249         // At lease save the mandatory first part of the UID
 250         c.arg[0] = long_uid & 0xffffffff;
 251
 252         if (c.arg[1] == 0) {
 253                 PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
 254         }
 255
 256         switch (c.arg[0]) {
 257                 case 1: {
 258                         PrintAndLog("Emulating ISO/IEC 14443-3 type A tag with 4 byte UID");
 259                         UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
 260                 } break;
 261                 case 2: {
 262                         PrintAndLog("Emulating ISO/IEC 14443-4 type A tag with 7 byte UID");
 263                 } break;
 264                 default: {
 265                         PrintAndLog("Error: unkown tag type (%d)",c.arg[0]);
 266                         PrintAndLog("syntax: hf 14a sim <uid>",c.arg[0]);
 267                         PrintAndLog(" type1: 4 ",c.arg[0]);
 268
 269                         return 1;
 270                 } break;
 271         }
 272 */
 273 /*
 274   unsigned int hi = 0, lo = 0;
 275   int n = 0, i = 0;
 276   while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
 277     hi= (hi << 4) | (lo >> 28);
 278     lo= (lo << 4) | (n & 0xf);
 279   }
 280 */
 281 //      UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
 282 //  PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
 283   SendCommand(&c);
 284   return 0;
 285 }
 286
 287 int CmdHF14ASnoop(const char *Cmd) {
 288         int param = 0;
 289
 290         if (param_getchar(Cmd, 0) == 'h') {
 291                 PrintAndLog("It get data from the field and saves it into command buffer.");
 292                 PrintAndLog("Buffer accessible from command hf 14a list.");
 293                 PrintAndLog("Usage:  hf 14a snoop [c][r]");
 294                 PrintAndLog("c - triggered by first data from card");
 295                 PrintAndLog("r - triggered by first 7-bit request from reader (REQ,WUP,...)");
 296                 PrintAndLog("sample: hf 14a snoop c r");
 297                 return 0;
 298         }
 299
 300         for (int i = 0; i < 2; i++) {
 301                 char ctmp = param_getchar(Cmd, i);
 302                 if (ctmp == 'c' || ctmp == 'C') param |= 0x01;
 303                 if (ctmp == 'r' || ctmp == 'R') param |= 0x02;
 304         }
 305
 306   UsbCommand c = {CMD_SNOOP_ISO_14443a, {param, 0, 0}};
 307   SendCommand(&c);
 308   return 0;
 309 }
 310
 311 static command_t CommandTable[] =
 312 {
 313   {"help",   CmdHelp,          1, "This help"},
 314   {"list",   CmdHF14AList,     0, "List ISO 14443a history"},
 315   {"reader", CmdHF14AReader,   0, "Act like an ISO14443 Type A reader"},
 316   {"sim",    CmdHF14ASim,      0, "<UID> -- Fake ISO 14443a tag"},
 317   {"snoop",  CmdHF14ASnoop,    0, "Eavesdrop ISO 14443 Type A"},
 318   {NULL, NULL, 0, NULL}
 319 };
 320
 321 int CmdHF14A(const char *Cmd)
 322 {
 323         // flush
 324         while (WaitForResponseTimeout(CMD_ACK, 500) != NULL) ;
 325
 326         // parse
 327   CmdsParse(CommandTable, Cmd);
 328   return 0;
 329 }
 330
 331 int CmdHelp(const char *Cmd)
 332 {
 333   CmdsHelp(CommandTable);
 334   return 0;
 335 }