git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf14a.c

   1 //-----------------------------------------------------------------------------
   2 // 2011, Merlok
   3 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
   4 //
   5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   6 // at your option, any later version. See the LICENSE.txt file for the text of
   7 // the license.
   8 //-----------------------------------------------------------------------------
   9 // High frequency ISO14443A commands
  10 //-----------------------------------------------------------------------------
  11
  12 #include <stdio.h>
  13 #include <stdlib.h>
  14 #include <string.h>
  15 #include <unistd.h>
  16 #include "util.h"
  17 #include "../common/iso14443crc.h"
  18 #include "data.h"
  19 #include "proxmark3.h"
  20 #include "ui.h"
  21 #include "cmdparser.h"
  22 #include "cmdhf14a.h"
  23 #include "../include/common.h"
  24 #include "cmdmain.h"
  25 #include "../include/mifare.h"
  26
  27 static int CmdHelp(const char *Cmd);
  28 static void waitCmd(uint8_t iLen);
  29
  30 int CmdHF14AList(const char *Cmd)
  31 {
  32         bool ShowWaitCycles = false;
  33         char param = param_getchar(Cmd, 0);
  34
  35         if (param == 'h' || (param != 0 && param != 'f')) {
  36                 PrintAndLog("List data in trace buffer.");
  37                 PrintAndLog("Usage:  hf 14a list [f]");
  38                 PrintAndLog("f - show frame delay times as well");
  39                 PrintAndLog("sample: hf 14a list f");
  40                 return 0;
  41         }
  42
  43         if (param == 'f') {
  44                 ShowWaitCycles = true;
  45         }
  46
  47         uint8_t trace[TRACE_BUFFER_SIZE];
  48         GetFromBigBuf(trace,TRACE_BUFFER_SIZE,0);
  49         WaitForResponse(CMD_ACK,NULL);
  50
  51         PrintAndLog("Recorded Activity");
  52         PrintAndLog("");
  53         PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
  54         PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
  55         PrintAndLog("");
  56         PrintAndLog("     Start |       End | Src | Data");
  57         PrintAndLog("-----------|-----------|-----|--------");
  58
  59         uint16_t tracepos = 0;
  60         uint16_t duration;
  61         uint16_t data_len;
  62         uint16_t parity_len;
  63         bool isResponse;
  64         uint32_t timestamp;
  65         uint32_t first_timestamp;
  66         uint32_t EndOfTransmissionTimestamp;
  67
  68         for (;;) {
  69
  70                 if( tracepos >= TRACE_BUFFER_SIZE) break;
  71
  72                 timestamp = *((uint32_t *)(trace + tracepos));
  73                 if(tracepos == 0) {
  74                         first_timestamp = timestamp;
  75                 }
  76                 tracepos += 4;
  77                 duration = *((uint16_t *)(trace + tracepos));
  78                 tracepos += 2;
  79                 data_len = *((uint16_t *)(trace + tracepos));
  80                 tracepos += 2;
  81
  82                 if (data_len & 0x8000) {
  83                         data_len &= 0x7fff;
  84                         isResponse = true;
  85                 } else {
  86                         isResponse = false;
  87                 }
  88
  89                 parity_len = (data_len-1)/8 + 1;
  90
  91
  92                 if (tracepos + data_len + parity_len >= TRACE_BUFFER_SIZE) { break; }
  93
  94                 uint8_t *frame = trace + tracepos;
  95                 tracepos += data_len;
  96                 uint8_t *parityBytes = trace + tracepos;
  97                 tracepos += parity_len;
  98
  99                 // Break and stick with current result if buffer was not completely full
 100                 if (timestamp == 0x44444444) break;
 101
 102                 char line[1000] = "";
 103                 int j;
 104                 for (j = 0; j < data_len; j++) {
 105                         int oddparity = 0x01;
 106                         int k;
 107
 108                         for (k=0;k<8;k++) {
 109                                 oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
 110                         }
 111
 112                         uint8_t parityBits = parityBytes[j>>3];
 113                         if (isResponse && (oddparity != ((parityBits >> (7-(j&0x0007))) & 0x01))) {
 114                                 sprintf(line+(j*4), "%02x! ", frame[j]);
 115                         } else {
 116                                 sprintf(line+(j*4), "%02x ", frame[j]);
 117                         }
 118                 }
 119
 120                 char crc[6] = "";
 121                 if (data_len > 2) {
 122                         uint8_t b1, b2;
 123                         ComputeCrc14443(CRC_14443_A, frame, data_len-2, &b1, &b2);
 124                         if (b1 != frame[data_len-2] || b2 != frame[data_len-1]) {
 125                                 sprintf(crc, (isResponse & (data_len < 6)) ? "" : " !crc");
 126                         } else {
 127                                 sprintf(crc, "");
 128                         }
 129
 130                 EndOfTransmissionTimestamp = timestamp + duration;
 131
 132                 PrintAndLog(" %9d | %9d | %s | %s %s",
 133                         (timestamp - first_timestamp),
 134                         (EndOfTransmissionTimestamp - first_timestamp),
 135                         (isResponse ? "Tag" : "Rdr"),
 136                         line,
 137                         crc);
 138
 139                 bool next_isResponse = *((uint16_t *)(trace + tracepos + 6)) & 0x8000;
 140                 if (ShowWaitCycles && !isResponse && next_isResponse) {
 141                         uint32_t next_timestamp = *((uint32_t *)(trace + tracepos));
 142                         if (next_timestamp != 0x44444444) {
 143                         PrintAndLog(" %9d | %9d | %s | fdt (Frame Delay Time): %d",
 144                                 (EndOfTransmissionTimestamp - first_timestamp),
 145                                 (next_timestamp - first_timestamp),
 146                                 " ",
 147                                 (next_timestamp - EndOfTransmissionTimestamp));
 148                                 }
 149                         }
 150                 }
 151         }
 152         return 0;
 153 }
 154
 155 void iso14a_set_timeout(uint32_t timeout) {
 156         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_SET_TIMEOUT, 0, timeout}};
 157         SendCommand(&c);
 158 }
 159
 160 int CmdHF14AReader(const char *Cmd)
 161 {
 162         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT, 0, 0}};
 163         SendCommand(&c);
 164
 165         UsbCommand resp;
 166         WaitForResponse(CMD_ACK,&resp);
 167
 168         iso14a_card_select_t *card = (iso14a_card_select_t *)resp.d.asBytes;
 169
 170         if(resp.arg[0] == 0) {
 171                 PrintAndLog("iso14443a card select failed");
 172                 return 0;
 173         }
 174
 175         PrintAndLog("ATQA : %02x %02x", card->atqa[0], card->atqa[1]);
 176         PrintAndLog(" UID : %s", sprint_hex(card->uid, card->uidlen));
 177         PrintAndLog(" SAK : %02x [%d]", card->sak, resp.arg[0]);
 178
 179         switch (card->sak) {
 180                 case 0x00: PrintAndLog("TYPE : NXP MIFARE Ultralight | Ultralight C"); break;
 181                 case 0x01: PrintAndLog("TYPE : NXP TNP3xxx  Activision Game Appliance"); break;
 182                 case 0x04: PrintAndLog("TYPE : NXP MIFARE (various !DESFire !DESFire EV1)"); break;
 183                 case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1"); break;
 184                 case 0x09: PrintAndLog("TYPE : NXP MIFARE Mini 0.3k"); break;
 185                 case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k SL2"); break;
 186                 case 0x11: PrintAndLog("TYPE : NXP MIFARE Plus 4k SL2"); break;
 187                 case 0x18: PrintAndLog("TYPE : NXP MIFARE Classic 4k | Plus 4k SL1"); break;
 188                 case 0x20: PrintAndLog("TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41"); break;
 189                 case 0x24: PrintAndLog("TYPE : NXP MIFARE DESFire | DESFire EV1"); break;
 190                 case 0x28: PrintAndLog("TYPE : JCOP31 or JCOP41 v2.3.1"); break;
 191                 case 0x38: PrintAndLog("TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K"); break;
 192                 case 0x88: PrintAndLog("TYPE : Infineon MIFARE CLASSIC 1K"); break;
 193                 case 0x98: PrintAndLog("TYPE : Gemplus MPCOS"); break;
 194                 default: ;
 195         }
 196         if(resp.arg[0] == 1) {
 197                 bool ta1 = 0, tb1 = 0, tc1 = 0;
 198                 int pos;
 199
 200                 PrintAndLog(" ATS : %s", sprint_hex(card->ats, card->ats_len));
 201                 if (card->ats_len > 0) {
 202                         PrintAndLog("       -  TL : length is %d bytes", card->ats[0]);
 203                 }
 204                 if (card->ats_len > 1) {
 205                         ta1 = (card->ats[1] & 0x10) == 0x10;
 206                         tb1 = (card->ats[1] & 0x20) == 0x20;
 207                         tc1 = (card->ats[1] & 0x40) == 0x40;
 208                         PrintAndLog("       -  T0 : TA1 is%s present, TB1 is%s present, "
 209                                         "TC1 is%s present, FSCI is %d",
 210                                 (ta1 ? "" : " NOT"), (tb1 ? "" : " NOT"), (tc1 ? "" : " NOT"),
 211                                 (card->ats[1] & 0x0f));
 212                 }
 213                 pos = 2;
 214                 if (ta1 && card->ats_len > pos) {
 215                         char dr[16], ds[16];
 216                         dr[0] = ds[0] = '\0';
 217                         if (card->ats[pos] & 0x10) strcat(ds, "2, ");
 218                         if (card->ats[pos] & 0x20) strcat(ds, "4, ");
 219                         if (card->ats[pos] & 0x40) strcat(ds, "8, ");
 220                         if (card->ats[pos] & 0x01) strcat(dr, "2, ");
 221                         if (card->ats[pos] & 0x02) strcat(dr, "4, ");
 222                         if (card->ats[pos] & 0x04) strcat(dr, "8, ");
 223                         if (strlen(ds) != 0) ds[strlen(ds) - 2] = '\0';
 224                         if (strlen(dr) != 0) dr[strlen(dr) - 2] = '\0';
 225                         PrintAndLog("       - TA1 : different divisors are%s supported, "
 226                                         "DR: [%s], DS: [%s]",
 227                                         (card->ats[pos] & 0x80 ? " NOT" : ""), dr, ds);
 228                         pos++;
 229                 }
 230                 if (tb1 && card->ats_len > pos) {
 231                         PrintAndLog("       - TB1 : SFGI = %d, FWI = %d",
 232                                         (card->ats[pos] & 0x08),
 233                                         (card->ats[pos] & 0x80) >> 4);
 234                         pos++;
 235                 }
 236                 if (tc1 && card->ats_len > pos) {
 237                         PrintAndLog("       - TC1 : NAD is%s supported, CID is%s supported",
 238                                         (card->ats[pos] & 0x01) ? "" : " NOT",
 239                                         (card->ats[pos] & 0x02) ? "" : " NOT");
 240                         pos++;
 241                 }
 242                 if (card->ats_len > pos) {
 243                         char *tip = "";
 244                         if (card->ats_len - pos > 7) {
 245                                 if (memcmp(card->ats + pos, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) {
 246                                         tip = "-> MIFARE Plus X 2K or 4K";
 247                                 } else if (memcmp(card->ats + pos, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) {
 248                                         tip = "-> MIFARE Plus S 2K or 4K";
 249                                 }
 250                         }
 251                         PrintAndLog("       -  HB : %s%s", sprint_hex(card->ats + pos, card->ats_len - pos - 2), tip);
 252                         if (card->ats[pos] == 0xC1) {
 253                                 PrintAndLog("               c1 -> Mifare or (multiple) virtual cards of various type");
 254                                 PrintAndLog("                  %02x -> Length is %d bytes",
 255                                                 card->ats[pos + 1], card->ats[pos + 1]);
 256                                 switch (card->ats[pos + 2] & 0xf0) {
 257                                         case 0x10:
 258                                                 PrintAndLog("                     1x -> MIFARE DESFire");
 259                                                 break;
 260                                         case 0x20:
 261                                                 PrintAndLog("                     2x -> MIFARE Plus");
 262                                                 break;
 263                                 }
 264                                 switch (card->ats[pos + 2] & 0x0f) {
 265                                         case 0x00:
 266                                                 PrintAndLog("                     x0 -> <1 kByte");
 267                                                 break;
 268                                         case 0x01:
 269                                                 PrintAndLog("                     x0 -> 1 kByte");
 270                                                 break;
 271                                         case 0x02:
 272                                                 PrintAndLog("                     x0 -> 2 kByte");
 273                                                 break;
 274                                         case 0x03:
 275                                                 PrintAndLog("                     x0 -> 4 kByte");
 276                                                 break;
 277                                         case 0x04:
 278                                                 PrintAndLog("                     x0 -> 8 kByte");
 279                                                 break;
 280                                 }
 281                                 switch (card->ats[pos + 3] & 0xf0) {
 282                                         case 0x00:
 283                                                 PrintAndLog("                        0x -> Engineering sample");
 284                                                 break;
 285                                         case 0x20:
 286                                                 PrintAndLog("                        2x -> Released");
 287                                                 break;
 288                                 }
 289                                 switch (card->ats[pos + 3] & 0x0f) {
 290                                         case 0x00:
 291                                                 PrintAndLog("                        x0 -> Generation 1");
 292                                                 break;
 293                                         case 0x01:
 294                                                 PrintAndLog("                        x1 -> Generation 2");
 295                                                 break;
 296                                         case 0x02:
 297                                                 PrintAndLog("                        x2 -> Generation 3");
 298                                                 break;
 299                                 }
 300                                 switch (card->ats[pos + 4] & 0x0f) {
 301                                         case 0x00:
 302                                                 PrintAndLog("                           x0 -> Only VCSL supported");
 303                                                 break;
 304                                         case 0x01:
 305                                                 PrintAndLog("                           x1 -> VCS, VCSL, and SVC supported");
 306                                                 break;
 307                                         case 0x0E:
 308                                                 PrintAndLog("                           xE -> no VCS command supported");
 309                                                 break;
 310                                 }
 311                         }
 312                 }
 313         } else {
 314                 PrintAndLog("proprietary non iso14443a-4 card found, RATS not supported");
 315         }
 316
 317         return resp.arg[0];
 318 }
 319
 320 // Collect ISO14443 Type A UIDs
 321 int CmdHF14ACUIDs(const char *Cmd)
 322 {
 323         // requested number of UIDs
 324         int n = atoi(Cmd);
 325         // collect at least 1 (e.g. if no parameter was given)
 326         n = n > 0 ? n : 1;
 327
 328         PrintAndLog("Collecting %d UIDs", n);
 329         PrintAndLog("Start: %u", time(NULL));
 330         // repeat n times
 331         for (int i = 0; i < n; i++) {
 332                 // execute anticollision procedure
 333                 UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT, 0, 0}};
 334                 SendCommand(&c);
 335
 336                 UsbCommand resp;
 337                 WaitForResponse(CMD_ACK,&resp);
 338
 339                 uint8_t *uid  = resp.d.asBytes;
 340                 iso14a_card_select_t *card = (iso14a_card_select_t *)(uid + 12);
 341
 342                 // check if command failed
 343                 if (resp.arg[0] == 0) {
 344                         PrintAndLog("Card select failed.");
 345                 } else {
 346                         // check if UID is 4 bytes
 347                         if ((card->atqa[1] & 0xC0) == 0) {
 348                                 PrintAndLog("%02X%02X%02X%02X",
 349                                             *uid, *(uid + 1), *(uid + 2), *(uid + 3));
 350                         } else {
 351                                 PrintAndLog("UID longer than 4 bytes");
 352                         }
 353                 }
 354         }
 355         PrintAndLog("End: %u", time(NULL));
 356
 357         return 1;
 358 }
 359
 360 // ## simulate iso14443a tag
 361 // ## greg - added ability to specify tag UID
 362 int CmdHF14ASim(const char *Cmd)
 363 {
 364         UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,{0,0,0}};
 365
 366         // Retrieve the tag type
 367         uint8_t tagtype = param_get8ex(Cmd,0,0,10);
 368
 369         // When no argument was given, just print help message
 370         if (tagtype == 0) {
 371                 PrintAndLog("");
 372                 PrintAndLog(" Emulating ISO/IEC 14443 type A tag with 4 or 7 byte UID");
 373                 PrintAndLog("");
 374                 PrintAndLog("   syntax: hf 14a sim <type> <uid>");
 375                 PrintAndLog("    types: 1 = MIFARE Classic");
 376                 PrintAndLog("           2 = MIFARE Ultralight");
 377                 PrintAndLog("           3 = MIFARE DESFIRE");
 378                 PrintAndLog("           4 = ISO/IEC 14443-4");
 379                 PrintAndLog("           5 = MIFARE TNP3XXX");
 380                 PrintAndLog("");
 381                 return 1;
 382         }
 383
 384         // Store the tag type
 385         c.arg[0] = tagtype;
 386
 387         // Retrieve the full 4 or 7 byte long uid
 388         uint64_t long_uid = param_get64ex(Cmd,1,0,16);
 389
 390         // Are we handling the (optional) second part uid?
 391         if (long_uid > 0xffffffff) {
 392                 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 7 byte UID (%014"llx")",long_uid);
 393                 // Store the second part
 394                 c.arg[2] = (long_uid & 0xffffffff);
 395                 long_uid >>= 32;
 396                 // Store the first part, ignore the first byte, it is replaced by cascade byte (0x88)
 397                 c.arg[1] = (long_uid & 0xffffff);
 398         } else {
 399                 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 4 byte UID (%08x)",long_uid);
 400                 // Only store the first part
 401                 c.arg[1] = long_uid & 0xffffffff;
 402         }
 403 /*
 404                 // At lease save the mandatory first part of the UID
 405                 c.arg[0] = long_uid & 0xffffffff;
 406
 407         if (c.arg[1] == 0) {
 408                 PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
 409         }
 410
 411         switch (c.arg[0]) {
 412                 case 1: {
 413                         PrintAndLog("Emulating ISO/IEC 14443-3 type A tag with 4 byte UID");
 414                         UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
 415                 } break;
 416                 case 2: {
 417                         PrintAndLog("Emulating ISO/IEC 14443-4 type A tag with 7 byte UID");
 418                 } break;
 419                 default: {
 420                         PrintAndLog("Error: unkown tag type (%d)",c.arg[0]);
 421                         PrintAndLog("syntax: hf 14a sim <uid>",c.arg[0]);
 422                         PrintAndLog(" type1: 4 ",c.arg[0]);
 423
 424                         return 1;
 425                 } break;
 426         }
 427 */
 428 /*
 429   unsigned int hi = 0, lo = 0;
 430   int n = 0, i = 0;
 431   while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
 432     hi= (hi << 4) | (lo >> 28);
 433     lo= (lo << 4) | (n & 0xf);
 434   }
 435 */
 436 //      UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
 437 //  PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
 438   SendCommand(&c);
 439   return 0;
 440 }
 441
 442 int CmdHF14ASnoop(const char *Cmd) {
 443         int param = 0;
 444
 445         if (param_getchar(Cmd, 0) == 'h') {
 446                 PrintAndLog("It get data from the field and saves it into command buffer.");
 447                 PrintAndLog("Buffer accessible from command hf 14a list.");
 448                 PrintAndLog("Usage:  hf 14a snoop [c][r]");
 449                 PrintAndLog("c - triggered by first data from card");
 450                 PrintAndLog("r - triggered by first 7-bit request from reader (REQ,WUP,...)");
 451                 PrintAndLog("sample: hf 14a snoop c r");
 452                 return 0;
 453         }
 454
 455         for (int i = 0; i < 2; i++) {
 456                 char ctmp = param_getchar(Cmd, i);
 457                 if (ctmp == 'c' || ctmp == 'C') param |= 0x01;
 458                 if (ctmp == 'r' || ctmp == 'R') param |= 0x02;
 459         }
 460
 461   UsbCommand c = {CMD_SNOOP_ISO_14443a, {param, 0, 0}};
 462   SendCommand(&c);
 463   return 0;
 464 }
 465
 466 int CmdHF14ACmdRaw(const char *cmd) {
 467     UsbCommand c = {CMD_READER_ISO_14443a, {0, 0, 0}};
 468     uint8_t reply=1;
 469     uint8_t crc=0;
 470     uint8_t power=0;
 471     uint8_t active=0;
 472     uint8_t active_select=0;
 473     uint16_t numbits=0;
 474         uint16_t timeout=0;
 475         uint8_t bTimeout=0;
 476     char buf[5]="";
 477     int i=0;
 478     uint8_t data[USB_CMD_DATA_SIZE];
 479     unsigned int datalen=0, temp;
 480
 481     if (strlen(cmd)<2) {
 482         PrintAndLog("Usage: hf 14a raw [-r] [-c] [-p] [-f] [-b] [-t] <number of bits> <0A 0B 0C ... hex>");
 483         PrintAndLog("       -r    do not read response");
 484         PrintAndLog("       -c    calculate and append CRC");
 485         PrintAndLog("       -p    leave the signal field ON after receive");
 486         PrintAndLog("       -a    active signal field ON without select");
 487         PrintAndLog("       -s    active signal field ON with select");
 488         PrintAndLog("       -b    number of bits to send. Useful for send partial byte");
 489                 PrintAndLog("       -t    timeout");
 490         return 0;
 491     }
 492
 493     // strip
 494     while (*cmd==' ' || *cmd=='\t') cmd++;
 495
 496     while (cmd[i]!='\0') {
 497         if (cmd[i]==' ' || cmd[i]=='\t') { i++; continue; }
 498         if (cmd[i]=='-') {
 499             switch (cmd[i+1]) {
 500                 case 'r':
 501                     reply=0;
 502                     break;
 503                 case 'c':
 504                     crc=1;
 505                     break;
 506                 case 'p':
 507                     power=1;
 508                     break;
 509                 case 'a':
 510                     active=1;
 511                     break;
 512                 case 's':
 513                     active_select=1;
 514                     break;
 515                 case 'b':
 516                     sscanf(cmd+i+2,"%d",&temp);
 517                     numbits = temp & 0xFFFF;
 518                     i+=3;
 519                     while(cmd[i]!=' ' && cmd[i]!='\0') { i++; }
 520                     i-=2;
 521                     break;
 522                                 case 't':
 523                                         bTimeout=1;
 524                                         sscanf(cmd+i+2,"%d",&temp);
 525                                         timeout = temp & 0xFFFF;
 526                                         i+=3;
 527                                         while(cmd[i]!=' ' && cmd[i]!='\0') { i++; }
 528                                         i+=2;
 529                                         break;
 530                 default:
 531                     PrintAndLog("Invalid option");
 532                     return 0;
 533             }
 534             i+=2;
 535             continue;
 536         }
 537         if ((cmd[i]>='0' && cmd[i]<='9') ||
 538             (cmd[i]>='a' && cmd[i]<='f') ||
 539             (cmd[i]>='A' && cmd[i]<='F') ) {
 540             buf[strlen(buf)+1]=0;
 541             buf[strlen(buf)]=cmd[i];
 542             i++;
 543
 544             if (strlen(buf)>=2) {
 545                 sscanf(buf,"%x",&temp);
 546                 data[datalen]=(uint8_t)(temp & 0xff);
 547                 *buf=0;
 548                                 if (++datalen>sizeof(data)){
 549                                         if (crc)
 550                                                 PrintAndLog("Buffer is full, we can't add CRC to your data");
 551                                         break;
 552                                 }
 553             }
 554             continue;
 555         }
 556         PrintAndLog("Invalid char on input");
 557         return 0;
 558     }
 559     if(crc && datalen>0 && datalen<sizeof(data)-2)
 560     {
 561         uint8_t first, second;
 562         ComputeCrc14443(CRC_14443_A, data, datalen, &first, &second);
 563         data[datalen++] = first;
 564         data[datalen++] = second;
 565     }
 566
 567     if(active || active_select)
 568     {
 569         c.arg[0] |= ISO14A_CONNECT;
 570         if(active)
 571             c.arg[0] |= ISO14A_NO_SELECT;
 572     }
 573         if(bTimeout){
 574             #define MAX_TIMEOUT 624*105 // max timeout is 624 ms
 575         c.arg[0] |= ISO14A_SET_TIMEOUT;
 576         c.arg[2] = timeout * 105; // each bit is about 9.4 us
 577         if(c.arg[2]>MAX_TIMEOUT) {
 578             c.arg[2] = MAX_TIMEOUT;
 579             PrintAndLog("Set timeout to 624 ms. The max we can wait for response");
 580         }
 581         }
 582     if(power)
 583         c.arg[0] |= ISO14A_NO_DISCONNECT;
 584     if(datalen>0)
 585         c.arg[0] |= ISO14A_RAW;
 586
 587         // Max buffer is USB_CMD_DATA_SIZE
 588     c.arg[1] = (datalen & 0xFFFF) | (numbits << 16);
 589     memcpy(c.d.asBytes,data,datalen);
 590
 591     SendCommand(&c);
 592
 593     if (reply) {
 594         if(active_select)
 595             waitCmd(1);
 596         if(datalen>0)
 597             waitCmd(0);
 598     } // if reply
 599     return 0;
 600 }
 601
 602 static void waitCmd(uint8_t iSelect)
 603 {
 604     uint8_t *recv;
 605     UsbCommand resp;
 606     char *hexout;
 607
 608     if (WaitForResponseTimeout(CMD_ACK,&resp,10000)) {
 609         recv = resp.d.asBytes;
 610         uint8_t iLen = iSelect ? resp.arg[1] : resp.arg[0];
 611         PrintAndLog("received %i octets",iLen);
 612         if(!iLen)
 613             return;
 614         hexout = (char *)malloc(iLen * 3 + 1);
 615         if (hexout != NULL) {
 616             for (int i = 0; i < iLen; i++) { // data in hex
 617                 sprintf(&hexout[i * 3], "%02X ", recv[i]);
 618             }
 619             PrintAndLog("%s", hexout);
 620             free(hexout);
 621         } else {
 622             PrintAndLog("malloc failed your client has low memory?");
 623         }
 624     } else {
 625         PrintAndLog("timeout while waiting for reply.");
 626     }
 627 }
 628
 629 static command_t CommandTable[] =
 630 {
 631   {"help",   CmdHelp,              1, "This help"},
 632   {"list",   CmdHF14AList,         0, "List ISO 14443a history"},
 633   {"reader", CmdHF14AReader,       0, "Act like an ISO14443 Type A reader"},
 634   {"cuids",  CmdHF14ACUIDs,        0, "<n> Collect n>0 ISO14443 Type A UIDs in one go"},
 635   {"sim",    CmdHF14ASim,          0, "<UID> -- Fake ISO 14443a tag"},
 636   {"snoop",  CmdHF14ASnoop,        0, "Eavesdrop ISO 14443 Type A"},
 637   {"raw",    CmdHF14ACmdRaw,       0, "Send raw hex data to tag"},
 638   {NULL, NULL, 0, NULL}
 639 };
 640
 641 int CmdHF14A(const char *Cmd) {
 642         // flush
 643         WaitForResponseTimeout(CMD_ACK,NULL,100);
 644
 645         // parse
 646   CmdsParse(CommandTable, Cmd);
 647   return 0;
 648 }
 649
 650 int CmdHelp(const char *Cmd)
 651 {
 652   CmdsHelp(CommandTable);
 653   return 0;
 654 }