git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf14a.c

   1 //-----------------------------------------------------------------------------
   2 // 2011, Merlok
   3 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
   4 //
   5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   6 // at your option, any later version. See the LICENSE.txt file for the text of
   7 // the license.
   8 //-----------------------------------------------------------------------------
   9 // High frequency ISO14443A commands
  10 //-----------------------------------------------------------------------------
  11
  12 #include <stdio.h>
  13 #include <stdlib.h>
  14 #include <string.h>
  15 #include <unistd.h>
  16 #include "util.h"
  17 #include "iso14443crc.h"
  18 #include "data.h"
  19 #include "proxmark3.h"
  20 #include "ui.h"
  21 #include "cmdparser.h"
  22 #include "cmdhf14a.h"
  23 #include "common.h"
  24 #include "cmdmain.h"
  25 #include "mifare.h"
  26
  27 static int CmdHelp(const char *Cmd);
  28 static void waitCmd(uint8_t iLen);
  29
  30 int CmdHF14AList(const char *Cmd)
  31 {
  32         bool ShowWaitCycles = false;
  33         char param = param_getchar(Cmd, 0);
  34
  35         if (param == 'h' || (param != 0 && param != 'f')) {
  36                 PrintAndLog("List data in trace buffer.");
  37                 PrintAndLog("Usage:  hf 14a list [f]");
  38                 PrintAndLog("f - show frame delay times as well");
  39                 PrintAndLog("sample: hf 14a list f");
  40                 return 0;
  41         }
  42
  43         if (param == 'f') {
  44                 ShowWaitCycles = true;
  45         }
  46
  47 // for the time being. Need better Bigbuf handling.
  48 #define TRACE_SIZE 3000
  49
  50         uint8_t trace[TRACE_SIZE];
  51         GetFromBigBuf(trace, TRACE_SIZE, 0);
  52         WaitForResponse(CMD_ACK, NULL);
  53
  54         PrintAndLog("Recorded Activity");
  55         PrintAndLog("");
  56         PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
  57         PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
  58         PrintAndLog("");
  59         PrintAndLog("     Start |       End | Src | Data (! denotes parity error)                                   | CRC ");
  60         PrintAndLog("-----------|-----------|-----|-----------------------------------------------------------------------");
  61
  62         uint16_t tracepos = 0;
  63         uint16_t duration;
  64         uint16_t data_len;
  65         uint16_t parity_len;
  66         bool isResponse;
  67         uint32_t timestamp;
  68         uint32_t first_timestamp;
  69         uint32_t EndOfTransmissionTimestamp;
  70
  71         for (;;) {
  72
  73                 if(tracepos >= TRACE_SIZE) {
  74                         break;
  75                 }
  76
  77                 timestamp = *((uint32_t *)(trace + tracepos));
  78                 if(tracepos == 0) {
  79                         first_timestamp = timestamp;
  80                 }
  81
  82                 // Break and stick with current result if buffer was not completely full
  83                 if (timestamp == 0x44444444) break;
  84
  85                 tracepos += 4;
  86                 duration = *((uint16_t *)(trace + tracepos));
  87                 tracepos += 2;
  88                 data_len = *((uint16_t *)(trace + tracepos));
  89                 tracepos += 2;
  90
  91                 if (data_len & 0x8000) {
  92                   data_len &= 0x7fff;
  93                   isResponse = true;
  94                 } else {
  95                   isResponse = false;
  96                 }
  97
  98                 parity_len = (data_len-1)/8 + 1;
  99
 100                 if (tracepos + data_len + parity_len >= TRACE_SIZE) {
 101                         break;
 102                 }
 103
 104                 uint8_t *frame = trace + tracepos;
 105                 tracepos += data_len;
 106                 uint8_t *parityBytes = trace + tracepos;
 107                 tracepos += parity_len;
 108
 109                 char line[16][110];
 110                 for (int j = 0; j < data_len; j++) {
 111                         int oddparity = 0x01;
 112                         int k;
 113
 114                         for (k=0;k<8;k++) {
 115                                 oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
 116                         }
 117
 118                         uint8_t parityBits = parityBytes[j>>3];
 119                         if (isResponse && (oddparity != ((parityBits >> (7-(j&0x0007))) & 0x01))) {
 120                                 sprintf(line[j/16]+((j%16)*4), "%02x! ", frame[j]);
 121                         } else {
 122                                 sprintf(line[j/16]+((j%16)*4), "%02x  ", frame[j]);
 123                         }
 124
 125                 }
 126
 127                 char crc[5] = "";
 128                 if (data_len > 2) {
 129                 uint8_t b1, b2;
 130                         ComputeCrc14443(CRC_14443_A, frame, data_len-2, &b1, &b2);
 131                         if (b1 != frame[data_len-2] || b2 != frame[data_len-1]) {
 132                                 sprintf(crc, (isResponse & (data_len < 6)) ? "" : "!crc");
 133                         } else {
 134                                 sprintf(crc, "");
 135                         }
 136                 }
 137
 138                 EndOfTransmissionTimestamp = timestamp + duration;
 139
 140                 int num_lines = (data_len - 1)/16 + 1;
 141                 for (int j = 0; j < num_lines; j++) {
 142                         if (j == 0) {
 143                                 PrintAndLog(" %9d | %9d | %s | %-64s| %s",
 144                                         (timestamp - first_timestamp),
 145                                         (EndOfTransmissionTimestamp - first_timestamp),
 146                                         (isResponse ? "Tag" : "Rdr"),
 147                                         line[j],
 148                                         (j == num_lines-1)?crc:"");
 149                         } else {
 150                                 PrintAndLog("           |           |     | %-64s| %s",
 151                                         line[j],
 152                                         (j == num_lines-1)?crc:"");
 153                         }
 154                 }
 155
 156                 bool next_isResponse = *((uint16_t *)(trace + tracepos + 6)) & 0x8000;
 157
 158                 if (ShowWaitCycles && !isResponse && next_isResponse) {
 159                         uint32_t next_timestamp = *((uint32_t *)(trace + tracepos));
 160                         if (next_timestamp != 0x44444444) {
 161                                 PrintAndLog(" %9d | %9d | %s | fdt (Frame Delay Time): %d",
 162                                         (EndOfTransmissionTimestamp - first_timestamp),
 163                                         (next_timestamp - first_timestamp),
 164                                         "   ",
 165                                         (next_timestamp - EndOfTransmissionTimestamp));
 166                         }
 167                 }
 168
 169         }
 170
 171         return 0;
 172 }
 173
 174 void iso14a_set_timeout(uint32_t timeout) {
 175         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_SET_TIMEOUT, 0, timeout}};
 176         SendCommand(&c);
 177 }
 178
 179 int CmdHF14AReader(const char *Cmd)
 180 {
 181         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT | ISO14A_NO_DISCONNECT, 0, 0}};
 182         SendCommand(&c);
 183
 184         UsbCommand resp;
 185         WaitForResponse(CMD_ACK,&resp);
 186
 187         iso14a_card_select_t card;
 188         memcpy(&card, (iso14a_card_select_t *)resp.d.asBytes, sizeof(iso14a_card_select_t));
 189
 190         uint64_t select_status = resp.arg[0];           // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS
 191
 192         if(select_status == 0) {
 193                 PrintAndLog("iso14443a card select failed");
 194                 // disconnect
 195                 c.arg[0] = 0;
 196                 c.arg[1] = 0;
 197                 c.arg[2] = 0;
 198                 SendCommand(&c);
 199                 return 0;
 200         }
 201
 202         PrintAndLog("ATQA : %02x %02x", card.atqa[1], card.atqa[0]);
 203         PrintAndLog(" UID : %s", sprint_hex(card.uid, card.uidlen));
 204         PrintAndLog(" SAK : %02x [%d]", card.sak, resp.arg[0]);
 205
 206         switch (card.sak) {
 207                 case 0x00: PrintAndLog("TYPE : NXP MIFARE Ultralight | Ultralight C"); break;
 208                 case 0x04: PrintAndLog("TYPE : NXP MIFARE (various !DESFire !DESFire EV1)"); break;
 209                 case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1"); break;
 210                 case 0x09: PrintAndLog("TYPE : NXP MIFARE Mini 0.3k"); break;
 211                 case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k SL2"); break;
 212                 case 0x11: PrintAndLog("TYPE : NXP MIFARE Plus 4k SL2"); break;
 213                 case 0x18: PrintAndLog("TYPE : NXP MIFARE Classic 4k | Plus 4k SL1"); break;
 214                 case 0x20: PrintAndLog("TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41"); break;
 215                 case 0x24: PrintAndLog("TYPE : NXP MIFARE DESFire | DESFire EV1"); break;
 216                 case 0x28: PrintAndLog("TYPE : JCOP31 or JCOP41 v2.3.1"); break;
 217                 case 0x38: PrintAndLog("TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K"); break;
 218                 case 0x88: PrintAndLog("TYPE : Infineon MIFARE CLASSIC 1K"); break;
 219                 case 0x98: PrintAndLog("TYPE : Gemplus MPCOS"); break;
 220                 default: ;
 221         }
 222
 223
 224         // try to request ATS even if tag claims not to support it
 225         if (select_status == 2) {
 226                 uint8_t rats[] = { 0xE0, 0x80 }; // FSDI=8 (FSD=256), CID=0
 227                 c.arg[0] = ISO14A_RAW | ISO14A_APPEND_CRC | ISO14A_NO_DISCONNECT;
 228                 c.arg[1] = 2;
 229                 c.arg[2] = 0;
 230                 memcpy(c.d.asBytes, rats, 2);
 231                 SendCommand(&c);
 232                 WaitForResponse(CMD_ACK,&resp);
 233
 234             memcpy(&card.ats, resp.d.asBytes, resp.arg[0]);
 235                 card.ats_len = resp.arg[0];                             // note: ats_len includes CRC Bytes
 236         }
 237
 238         // disconnect
 239         c.arg[0] = 0;
 240         c.arg[1] = 0;
 241         c.arg[2] = 0;
 242         SendCommand(&c);
 243
 244
 245         if(card.ats_len >= 3) {                 // a valid ATS consists of at least the length byte (TL) and 2 CRC bytes
 246                 bool ta1 = 0, tb1 = 0, tc1 = 0;
 247                 int pos;
 248
 249                 if (select_status == 2) {
 250                         PrintAndLog("SAK incorrectly claims that card doesn't support RATS");
 251                 }
 252                 PrintAndLog(" ATS : %s", sprint_hex(card.ats, card.ats_len));
 253                 PrintAndLog("       -  TL : length is %d bytes", card.ats[0]);
 254                 if (card.ats[0] != card.ats_len - 2) {
 255                         PrintAndLog("ATS may be corrupted. Length of ATS (%d bytes incl. 2 Bytes CRC) doesn't match TL", card.ats_len);
 256                 }
 257
 258                 if (card.ats[0] > 1) {          // there is a format byte (T0)
 259                         ta1 = (card.ats[1] & 0x10) == 0x10;
 260                         tb1 = (card.ats[1] & 0x20) == 0x20;
 261                         tc1 = (card.ats[1] & 0x40) == 0x40;
 262                         int16_t fsci = card.ats[1] & 0x0f;
 263                         PrintAndLog("       -  T0 : TA1 is%s present, TB1 is%s present, "
 264                                         "TC1 is%s present, FSCI is %d (FSC = %ld)",
 265                                 (ta1 ? "" : " NOT"), (tb1 ? "" : " NOT"), (tc1 ? "" : " NOT"),
 266                                 fsci,
 267                                 fsci < 5 ? (fsci - 2) * 8 :
 268                                         fsci < 8 ? (fsci - 3) * 32 :
 269                                         fsci == 8 ? 256 :
 270                                         -1
 271                                 );
 272                 }
 273                 pos = 2;
 274                 if (ta1) {
 275                         char dr[16], ds[16];
 276                         dr[0] = ds[0] = '\0';
 277                         if (card.ats[pos] & 0x10) strcat(ds, "2, ");
 278                         if (card.ats[pos] & 0x20) strcat(ds, "4, ");
 279                         if (card.ats[pos] & 0x40) strcat(ds, "8, ");
 280                         if (card.ats[pos] & 0x01) strcat(dr, "2, ");
 281                         if (card.ats[pos] & 0x02) strcat(dr, "4, ");
 282                         if (card.ats[pos] & 0x04) strcat(dr, "8, ");
 283                         if (strlen(ds) != 0) ds[strlen(ds) - 2] = '\0';
 284                         if (strlen(dr) != 0) dr[strlen(dr) - 2] = '\0';
 285                         PrintAndLog("       - TA1 : different divisors are%s supported, "
 286                                         "DR: [%s], DS: [%s]",
 287                                         (card.ats[pos] & 0x80 ? " NOT" : ""), dr, ds);
 288                         pos++;
 289                 }
 290                 if (tb1) {
 291                         uint32_t sfgi = card.ats[pos] & 0x0F;
 292                         uint32_t fwi = card.ats[pos] >> 4;
 293                         PrintAndLog("       - TB1 : SFGI = %d (SFGT = %s%ld/fc), FWI = %d (FWT = %ld/fc)",
 294                                         (sfgi),
 295                                         sfgi ? "" : "(not needed) ",
 296                                         sfgi ? (1 << 12) << sfgi : 0,
 297                                         fwi,
 298                                         (1 << 12) << fwi
 299                                         );
 300                         pos++;
 301                 }
 302                 if (tc1) {
 303                         PrintAndLog("       - TC1 : NAD is%s supported, CID is%s supported",
 304                                         (card.ats[pos] & 0x01) ? "" : " NOT",
 305                                         (card.ats[pos] & 0x02) ? "" : " NOT");
 306                         pos++;
 307                 }
 308                 if (card.ats[0] > pos) {
 309                         char *tip = "";
 310                         if (card.ats[0] - pos >= 7) {
 311                                 if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) {
 312                                         tip = "-> MIFARE Plus X 2K or 4K";
 313                                 } else if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) {
 314                                         tip = "-> MIFARE Plus S 2K or 4K";
 315                                 }
 316                         }
 317                         PrintAndLog("       -  HB : %s%s", sprint_hex(card.ats + pos, card.ats[0] - pos), tip);
 318                         if (card.ats[pos] == 0xC1) {
 319                                 PrintAndLog("               c1 -> Mifare or (multiple) virtual cards of various type");
 320                                 PrintAndLog("                  %02x -> Length is %d bytes",
 321                                                 card.ats[pos + 1], card.ats[pos + 1]);
 322                                 switch (card.ats[pos + 2] & 0xf0) {
 323                                         case 0x10:
 324                                                 PrintAndLog("                     1x -> MIFARE DESFire");
 325                                                 break;
 326                                         case 0x20:
 327                                                 PrintAndLog("                     2x -> MIFARE Plus");
 328                                                 break;
 329                                 }
 330                                 switch (card.ats[pos + 2] & 0x0f) {
 331                                         case 0x00:
 332                                                 PrintAndLog("                     x0 -> <1 kByte");
 333                                                 break;
 334                                         case 0x01:
 335                                                 PrintAndLog("                     x0 -> 1 kByte");
 336                                                 break;
 337                                         case 0x02:
 338                                                 PrintAndLog("                     x0 -> 2 kByte");
 339                                                 break;
 340                                         case 0x03:
 341                                                 PrintAndLog("                     x0 -> 4 kByte");
 342                                                 break;
 343                                         case 0x04:
 344                                                 PrintAndLog("                     x0 -> 8 kByte");
 345                                                 break;
 346                                 }
 347                                 switch (card.ats[pos + 3] & 0xf0) {
 348                                         case 0x00:
 349                                                 PrintAndLog("                        0x -> Engineering sample");
 350                                                 break;
 351                                         case 0x20:
 352                                                 PrintAndLog("                        2x -> Released");
 353                                                 break;
 354                                 }
 355                                 switch (card.ats[pos + 3] & 0x0f) {
 356                                         case 0x00:
 357                                                 PrintAndLog("                        x0 -> Generation 1");
 358                                                 break;
 359                                         case 0x01:
 360                                                 PrintAndLog("                        x1 -> Generation 2");
 361                                                 break;
 362                                         case 0x02:
 363                                                 PrintAndLog("                        x2 -> Generation 3");
 364                                                 break;
 365                                 }
 366                                 switch (card.ats[pos + 4] & 0x0f) {
 367                                         case 0x00:
 368                                                 PrintAndLog("                           x0 -> Only VCSL supported");
 369                                                 break;
 370                                         case 0x01:
 371                                                 PrintAndLog("                           x1 -> VCS, VCSL, and SVC supported");
 372                                                 break;
 373                                         case 0x0E:
 374                                                 PrintAndLog("                           xE -> no VCS command supported");
 375                                                 break;
 376                                 }
 377                         }
 378                 }
 379         } else {
 380                 PrintAndLog("proprietary non iso14443-4 card found, RATS not supported");
 381         }
 382
 383         return select_status;
 384 }
 385
 386 // Collect ISO14443 Type A UIDs
 387 int CmdHF14ACUIDs(const char *Cmd)
 388 {
 389         // requested number of UIDs
 390         int n = atoi(Cmd);
 391         // collect at least 1 (e.g. if no parameter was given)
 392         n = n > 0 ? n : 1;
 393
 394         PrintAndLog("Collecting %d UIDs", n);
 395         PrintAndLog("Start: %u", time(NULL));
 396         // repeat n times
 397         for (int i = 0; i < n; i++) {
 398                 // execute anticollision procedure
 399                 UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT, 0, 0}};
 400                 SendCommand(&c);
 401
 402                 UsbCommand resp;
 403                 WaitForResponse(CMD_ACK,&resp);
 404
 405                 iso14a_card_select_t *card = (iso14a_card_select_t *) resp.d.asBytes;
 406
 407                 // check if command failed
 408                 if (resp.arg[0] == 0) {
 409                         PrintAndLog("Card select failed.");
 410                 } else {
 411                         char uid_string[20];
 412                         for (uint16_t i = 0; i < card->uidlen; i++) {
 413                                 sprintf(&uid_string[2*i], "%02X", card->uid[i]);
 414                         }
 415                         PrintAndLog("%s", uid_string);
 416                 }
 417         }
 418         PrintAndLog("End: %u", time(NULL));
 419
 420         return 1;
 421 }
 422
 423 // ## simulate iso14443a tag
 424 // ## greg - added ability to specify tag UID
 425 int CmdHF14ASim(const char *Cmd)
 426 {
 427         UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,{0,0,0}};
 428
 429         // Retrieve the tag type
 430         uint8_t tagtype = param_get8ex(Cmd,0,0,10);
 431
 432         // When no argument was given, just print help message
 433         if (tagtype == 0) {
 434                 PrintAndLog("");
 435                 PrintAndLog(" Emulating ISO/IEC 14443 type A tag with 4 or 7 byte UID");
 436                 PrintAndLog("");
 437                 PrintAndLog("   syntax: hf 14a sim <type> <uid>");
 438                 PrintAndLog("    types: 1 = MIFARE Classic");
 439                 PrintAndLog("           2 = MIFARE Ultralight");
 440                 PrintAndLog("           3 = MIFARE DESFIRE");
 441                 PrintAndLog("           4 = ISO/IEC 14443-4");
 442                 PrintAndLog("");
 443                 return 1;
 444         }
 445
 446         // Store the tag type
 447         c.arg[0] = tagtype;
 448
 449         // Retrieve the full 4 or 7 byte long uid
 450         uint64_t long_uid = param_get64ex(Cmd,1,0,16);
 451
 452         // Are we handling the (optional) second part uid?
 453         if (long_uid > 0xffffffff) {
 454                 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 7 byte UID (%014"llx")",long_uid);
 455                 // Store the second part
 456                 c.arg[2] = (long_uid & 0xffffffff);
 457                 long_uid >>= 32;
 458                 // Store the first part, ignore the first byte, it is replaced by cascade byte (0x88)
 459                 c.arg[1] = (long_uid & 0xffffff);
 460         } else {
 461                 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 4 byte UID (%08x)",long_uid);
 462                 // Only store the first part
 463                 c.arg[1] = long_uid & 0xffffffff;
 464         }
 465 /*
 466                 // At lease save the mandatory first part of the UID
 467                 c.arg[0] = long_uid & 0xffffffff;
 468
 469
 470         // At lease save the mandatory first part of the UID
 471         c.arg[0] = long_uid & 0xffffffff;
 472
 473         if (c.arg[1] == 0) {
 474                 PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
 475         }
 476
 477         switch (c.arg[0]) {
 478                 case 1: {
 479                         PrintAndLog("Emulating ISO/IEC 14443-3 type A tag with 4 byte UID");
 480                         UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
 481                 } break;
 482                 case 2: {
 483                         PrintAndLog("Emulating ISO/IEC 14443-4 type A tag with 7 byte UID");
 484                 } break;
 485                 default: {
 486                         PrintAndLog("Error: unkown tag type (%d)",c.arg[0]);
 487                         PrintAndLog("syntax: hf 14a sim <uid>",c.arg[0]);
 488                         PrintAndLog(" type1: 4 ",c.arg[0]);
 489
 490                         return 1;
 491                 } break;
 492         }
 493 */
 494 /*
 495   unsigned int hi = 0, lo = 0;
 496   int n = 0, i = 0;
 497   while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
 498     hi= (hi << 4) | (lo >> 28);
 499     lo= (lo << 4) | (n & 0xf);
 500   }
 501 */
 502 //      UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
 503 //  PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
 504   SendCommand(&c);
 505   return 0;
 506 }
 507
 508 int CmdHF14ASnoop(const char *Cmd) {
 509         int param = 0;
 510
 511         if (param_getchar(Cmd, 0) == 'h') {
 512                 PrintAndLog("It get data from the field and saves it into command buffer.");
 513                 PrintAndLog("Buffer accessible from command hf 14a list.");
 514                 PrintAndLog("Usage:  hf 14a snoop [c][r]");
 515                 PrintAndLog("c - triggered by first data from card");
 516                 PrintAndLog("r - triggered by first 7-bit request from reader (REQ,WUP,...)");
 517                 PrintAndLog("sample: hf 14a snoop c r");
 518                 return 0;
 519         }
 520
 521         for (int i = 0; i < 2; i++) {
 522                 char ctmp = param_getchar(Cmd, i);
 523                 if (ctmp == 'c' || ctmp == 'C') param |= 0x01;
 524                 if (ctmp == 'r' || ctmp == 'R') param |= 0x02;
 525         }
 526
 527   UsbCommand c = {CMD_SNOOP_ISO_14443a, {param, 0, 0}};
 528   SendCommand(&c);
 529   return 0;
 530 }
 531
 532 int CmdHF14ACmdRaw(const char *cmd) {
 533     UsbCommand c = {CMD_READER_ISO_14443a, {0, 0, 0}};
 534     uint8_t reply=1;
 535     uint8_t crc=0;
 536     uint8_t power=0;
 537     uint8_t active=0;
 538     uint8_t active_select=0;
 539     uint16_t numbits=0;
 540     char buf[5]="";
 541     int i=0;
 542     uint8_t data[100];
 543     unsigned int datalen=0, temp;
 544
 545     if (strlen(cmd)<2) {
 546         PrintAndLog("Usage: hf 14a raw [-r] [-c] [-p] [-f] [-b] <number of bits> <0A 0B 0C ... hex>");
 547         PrintAndLog("       -r    do not read response");
 548         PrintAndLog("       -c    calculate and append CRC");
 549         PrintAndLog("       -p    leave the signal field ON after receive");
 550         PrintAndLog("       -a    active signal field ON without select");
 551         PrintAndLog("       -s    active signal field ON with select");
 552         PrintAndLog("       -b    number of bits to send. Useful for send partial byte");
 553         return 0;
 554     }
 555
 556     // strip
 557     while (*cmd==' ' || *cmd=='\t') cmd++;
 558
 559     while (cmd[i]!='\0') {
 560         if (cmd[i]==' ' || cmd[i]=='\t') { i++; continue; }
 561         if (cmd[i]=='-') {
 562             switch (cmd[i+1]) {
 563                 case 'r':
 564                     reply=0;
 565                     break;
 566                 case 'c':
 567                     crc=1;
 568                     break;
 569                 case 'p':
 570                     power=1;
 571                     break;
 572                 case 'a':
 573                     active=1;
 574                     break;
 575                 case 's':
 576                     active_select=1;
 577                     break;
 578                 case 'b':
 579                     sscanf(cmd+i+2,"%d",&temp);
 580                     numbits = temp & 0xFFFF;
 581                     i+=3;
 582                     while(cmd[i]!=' ' && cmd[i]!='\0') { i++; }
 583                     i-=2;
 584                     break;
 585                 default:
 586                     PrintAndLog("Invalid option");
 587                     return 0;
 588             }
 589             i+=2;
 590             continue;
 591         }
 592         if ((cmd[i]>='0' && cmd[i]<='9') ||
 593             (cmd[i]>='a' && cmd[i]<='f') ||
 594             (cmd[i]>='A' && cmd[i]<='F') ) {
 595             buf[strlen(buf)+1]=0;
 596             buf[strlen(buf)]=cmd[i];
 597             i++;
 598
 599             if (strlen(buf)>=2) {
 600                 sscanf(buf,"%x",&temp);
 601                 data[datalen]=(uint8_t)(temp & 0xff);
 602                 datalen++;
 603                 *buf=0;
 604             }
 605             continue;
 606         }
 607         PrintAndLog("Invalid char on input");
 608         return 0;
 609     }
 610     if(crc && datalen>0)
 611     {
 612         uint8_t first, second;
 613         ComputeCrc14443(CRC_14443_A, data, datalen, &first, &second);
 614         data[datalen++] = first;
 615         data[datalen++] = second;
 616     }
 617
 618     if(active || active_select)
 619     {
 620         c.arg[0] |= ISO14A_CONNECT;
 621         if(active)
 622             c.arg[0] |= ISO14A_NO_SELECT;
 623     }
 624     if(power)
 625         c.arg[0] |= ISO14A_NO_DISCONNECT;
 626     if(datalen>0)
 627         c.arg[0] |= ISO14A_RAW;
 628
 629     c.arg[1] = datalen;
 630     c.arg[2] = numbits;
 631     memcpy(c.d.asBytes,data,datalen);
 632
 633     SendCommand(&c);
 634
 635     if (reply) {
 636         if(active_select)
 637             waitCmd(1);
 638         if(datalen>0)
 639             waitCmd(0);
 640     } // if reply
 641     return 0;
 642 }
 643
 644 static void waitCmd(uint8_t iSelect)
 645 {
 646     uint8_t *recv;
 647     UsbCommand resp;
 648     char *hexout;
 649
 650     if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
 651         recv = resp.d.asBytes;
 652         uint8_t iLen = iSelect ? resp.arg[1] : resp.arg[0];
 653         PrintAndLog("received %i octets",iLen);
 654         if(!iLen)
 655             return;
 656         hexout = (char *)malloc(iLen * 3 + 1);
 657         if (hexout != NULL) {
 658             for (int i = 0; i < iLen; i++) { // data in hex
 659                 sprintf(&hexout[i * 3], "%02X ", recv[i]);
 660             }
 661             PrintAndLog("%s", hexout);
 662             free(hexout);
 663         } else {
 664             PrintAndLog("malloc failed your client has low memory?");
 665         }
 666     } else {
 667         PrintAndLog("timeout while waiting for reply.");
 668     }
 669 }
 670
 671 static command_t CommandTable[] =
 672 {
 673   {"help",   CmdHelp,              1, "This help"},
 674   {"list",   CmdHF14AList,         0, "List ISO 14443a history"},
 675   {"reader", CmdHF14AReader,       0, "Act like an ISO14443 Type A reader"},
 676   {"cuids",  CmdHF14ACUIDs,        0, "<n> Collect n>0 ISO14443 Type A UIDs in one go"},
 677   {"sim",    CmdHF14ASim,          0, "<UID> -- Fake ISO 14443a tag"},
 678   {"snoop",  CmdHF14ASnoop,        0, "Eavesdrop ISO 14443 Type A"},
 679   {"raw",    CmdHF14ACmdRaw,       0, "Send raw hex data to tag"},
 680   {NULL, NULL, 0, NULL}
 681 };
 682
 683 int CmdHF14A(const char *Cmd) {
 684         // flush
 685         WaitForResponseTimeout(CMD_ACK,NULL,100);
 686
 687         // parse
 688   CmdsParse(CommandTable, Cmd);
 689   return 0;
 690 }
 691
 692 int CmdHelp(const char *Cmd)
 693 {
 694   CmdsHelp(CommandTable);
 695   return 0;
 696 }