git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // High frequency commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <string.h>
  13 #include "proxmark3.h"
  14 #include "graph.h"
  15 #include "ui.h"
  16 #include "cmdparser.h"
  17 #include "cmdhf.h"
  18 #include "cmdhf14a.h"
  19 #include "cmdhf14b.h"
  20 #include "cmdhf15.h"
  21 #include "cmdhfepa.h"
  22 #include "cmdhflegic.h"
  23 #include "cmdhficlass.h"
  24 #include "cmdhfmf.h"
  25
  26 static int CmdHelp(const char *Cmd);
  27
  28 int CmdHFTune(const char *Cmd)
  29 {
  30   UsbCommand c={CMD_MEASURE_ANTENNA_TUNING_HF};
  31   SendCommand(&c);
  32   return 0;
  33 }
  34 // for the time being. Need better Bigbuf handling.
  35 #define TRACE_SIZE 3000
  36
  37 #define ICLASS_CMD_ACTALL 0x0A
  38 #define ICLASS_CMD_IDENTIFY 0x0C
  39 #define ICLASS_CMD_READ 0x0C
  40 #define ICLASS_CMD_SELECT 0x81
  41 #define ICLASS_CMD_PAGESEL 0x84
  42 #define ICLASS_CMD_READCHECK 0x88
  43 #define ICLASS_CMD_CHECK 0x05
  44 #define ICLASS_CMD_SOF 0x0F
  45 #define ICLASS_CMD_HALT 0x00
  46
  47 #define iso14443_CMD_WUPA       0x52
  48 #define iso14443_CMD_SELECT     0x93
  49 #define iso14443_CMD_SELECT_2   0x95
  50 #define iso14443_CMD_SELECT_3   0x97
  51 #define iso14443_CMD_REQ        0x26
  52 #define iso14443_CMD_READBLOCK  0x30
  53 #define iso14443_CMD_WRITEBLOCK 0xA0
  54 #define iso14443_CMD_WRITE              0xA2
  55 #define iso14443_CMD_INC        0xC0
  56 #define iso14443_CMD_DEC        0xC1
  57 #define iso14443_CMD_RESTORE    0xC2
  58 #define iso14443_CMD_TRANSFER   0xB0
  59 #define iso14443_CMD_HALT       0x50
  60 #define iso14443_CMD_RATS       0xE0
  61
  62 #define iso14443_CMD_AUTH_KEYA  0x60
  63 #define iso14443_CMD_AUTH_KEYB  0x61
  64
  65 #define iso14443_CMD_AUTH_STEP1 0x1A
  66 #define iso14443_CMD_AUTH_STEP2 0xAA
  67 #define iso14443_CMD_AUTH_RESPONSE      0xAF
  68
  69 #define CHINESE_BACKDOOR_INIT   0x40
  70 #define CHINESE_BACKDOOR_STEP2   0x43
  71
  72 void annotateIso14443a(char *exp, size_t size, uint8_t* cmd, uint8_t cmdsize)
  73 {
  74         switch(cmd[0])
  75         {
  76         case iso14443_CMD_WUPA:            snprintf(exp,size,"WUPA"); break;
  77         case iso14443_CMD_SELECT:{
  78                 if(cmdsize > 2)
  79                 {
  80                         snprintf(exp,size,"SELECT_UID"); break;
  81                 }else
  82                 {
  83                         snprintf(exp,size,"SELECT_ALL"); break;
  84                 }
  85         }
  86         case iso14443_CMD_SELECT_2:    snprintf(exp,size,"SELECT_2"); break;
  87         case iso14443_CMD_REQ:         snprintf(exp,size,"REW"); break;
  88         case iso14443_CMD_READBLOCK:   snprintf(exp,size,"READBLOCK(%d)",cmd[1]); break;
  89         case iso14443_CMD_WRITEBLOCK:  snprintf(exp,size,"WRITEBLOCK(%d)",cmd[1]); break;
  90         case iso14443_CMD_WRITE:           snprintf(exp,size,"WRITE"); break;
  91         case iso14443_CMD_INC:         snprintf(exp,size,"INC(%d)",cmd[1]); break;
  92         case iso14443_CMD_DEC:         snprintf(exp,size,"DEC(%d)",cmd[1]); break;
  93         case iso14443_CMD_RESTORE:     snprintf(exp,size,"RESTORE(%d)",cmd[1]); break;
  94         case iso14443_CMD_TRANSFER:    snprintf(exp,size,"TRANSFER(%d)",cmd[1]); break;
  95         case iso14443_CMD_HALT:        snprintf(exp,size,"HALT"); break;
  96         case iso14443_CMD_RATS:        snprintf(exp,size,"RATS"); break;
  97
  98         case iso14443_CMD_AUTH_KEYA:   snprintf(exp,size,"AUTH KEY A"); break;
  99         case iso14443_CMD_AUTH_KEYB:   snprintf(exp,size,"AUTH KEY B"); break;
 100         case iso14443_CMD_AUTH_STEP1:  snprintf(exp,size,"AUTH REQ NONCE"); break;
 101         case iso14443_CMD_AUTH_STEP2:  snprintf(exp,size,"AUTH STEP 2"); break;
 102         case iso14443_CMD_AUTH_RESPONSE:  snprintf(exp,size,"AUTH RESPONSE"); break;
 103
 104         case CHINESE_BACKDOOR_INIT:    snprintf(exp,size,"BACKDOOR INIT");break;
 105         case CHINESE_BACKDOOR_STEP2:    snprintf(exp,size,"BACKDOOR STEP2");break;
 106         default:                       snprintf(exp,size,"?"); break;
 107         }
 108         return;
 109 }
 110
 111 void annotateIclass(char *exp, size_t size, uint8_t* cmd, uint8_t cmdsize)
 112 {
 113         if(cmdsize > 1 && cmd[0] == ICLASS_CMD_READ)
 114         {
 115                   snprintf(exp,size,"READ(%d)",cmd[1]);
 116                   return;
 117         }
 118
 119         switch(cmd[0])
 120         {
 121         case ICLASS_CMD_ACTALL:      snprintf(exp,size,"ACTALL"); break;
 122         case ICLASS_CMD_IDENTIFY:    snprintf(exp,size,"IDENTIFY"); break;
 123         case ICLASS_CMD_SELECT:      snprintf(exp,size,"SELECT"); break;
 124         case ICLASS_CMD_PAGESEL:     snprintf(exp,size,"PAGESEL"); break;
 125         case ICLASS_CMD_READCHECK:   snprintf(exp,size,"READCHECK"); break;
 126         case ICLASS_CMD_CHECK:       snprintf(exp,size,"CHECK"); break;
 127         case ICLASS_CMD_SOF:         snprintf(exp,size,"SOF"); break;
 128         case ICLASS_CMD_HALT:        snprintf(exp,size,"HALT"); break;
 129         default:                     snprintf(exp,size,"?"); break;
 130         }
 131         return;
 132 }
 133
 134
 135 uint16_t printTraceLine(uint16_t tracepos, uint8_t* trace, bool iclass, bool showWaitCycles)
 136 {
 137         bool isResponse;
 138         uint16_t duration, data_len,parity_len;
 139
 140         uint32_t timestamp, first_timestamp, EndOfTransmissionTimestamp;
 141         char explanation[30] = {0};
 142
 143         first_timestamp = *((uint32_t *)(trace));
 144         timestamp = *((uint32_t *)(trace + tracepos));
 145         // Break and stick with current result if buffer was not completely full
 146         if (timestamp == 0x44444444) return TRACE_SIZE;
 147
 148         tracepos += 4;
 149         duration = *((uint16_t *)(trace + tracepos));
 150         tracepos += 2;
 151         data_len = *((uint16_t *)(trace + tracepos));
 152         tracepos += 2;
 153
 154         if (data_len & 0x8000) {
 155           data_len &= 0x7fff;
 156           isResponse = true;
 157         } else {
 158           isResponse = false;
 159         }
 160         parity_len = (data_len-1)/8 + 1;
 161
 162         if (tracepos + data_len + parity_len >= TRACE_SIZE) {
 163                 return TRACE_SIZE;
 164         }
 165
 166         uint8_t *frame = trace + tracepos;
 167         tracepos += data_len;
 168         uint8_t *parityBytes = trace + tracepos;
 169         tracepos += parity_len;
 170
 171         //--- Draw the data column
 172         char line[16][110];
 173         for (int j = 0; j < data_len; j++) {
 174                 int oddparity = 0x01;
 175                 int k;
 176
 177                 for (k=0 ; k<8 ; k++) {
 178                         oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
 179                 }
 180
 181                 uint8_t parityBits = parityBytes[j>>3];
 182
 183                 if (isResponse && (oddparity != ((parityBits >> (7-(j&0x0007))) & 0x01))) {
 184                         sprintf(line[j/16]+((j%16)*4), "%02x! ", frame[j]);
 185                 } else {
 186                         sprintf(line[j/16]+((j%16)*4), "%02x  ", frame[j]);
 187                 }
 188         }
 189         //--- Draw the CRC column
 190         bool crcError = false;
 191
 192         if (data_len > 2) {
 193                 uint8_t b1, b2;
 194                 if(iclass)
 195                 {
 196                         if(!isResponse && data_len == 4 ) {
 197                                 // Rough guess that this is a command from the reader
 198                                 // For iClass the command byte is not part of the CRC
 199                                 ComputeCrc14443(CRC_ICLASS, &frame[1], data_len-3, &b1, &b2);
 200                         } else {
 201                                 // For other data.. CRC might not be applicable (UPDATE commands etc.)
 202                                 ComputeCrc14443(CRC_ICLASS, frame, data_len-2, &b1, &b2);
 203                         }
 204
 205                         if (b1 != frame[data_len-2] || b2 != frame[data_len-1]) {
 206                                 crcError = true;
 207                         }
 208
 209                 }else{//Iso 14443a
 210
 211                         ComputeCrc14443(CRC_14443_A, frame, data_len-2, &b1, &b2);
 212
 213                         if (b1 != frame[data_len-2] || b2 != frame[data_len-1]) {
 214                                 if(!(isResponse & (data_len < 6)))
 215                                 {
 216                                                 crcError = true;
 217                                 }
 218                         }
 219                 }
 220         }
 221         char *crc = crcError ? "!crc" :"    ";
 222
 223         EndOfTransmissionTimestamp = timestamp + duration;
 224
 225         if(!isResponse)
 226         {
 227                 if(iclass)
 228                         annotateIclass(explanation,sizeof(explanation),frame,data_len);
 229                 else
 230                         annotateIso14443a(explanation,sizeof(explanation),frame,data_len);
 231         }
 232
 233         int num_lines = (data_len - 1)/16 + 1;
 234         for (int j = 0; j < num_lines; j++) {
 235                 if (j == 0) {
 236                         PrintAndLog(" %9d | %9d | %s | %-64s| %s| %s",
 237                                 (timestamp - first_timestamp),
 238                                 (EndOfTransmissionTimestamp - first_timestamp),
 239                                 (isResponse ? "Tag" : "Rdr"),
 240                                 line[j],
 241                                 (j == num_lines-1) ? crc : "    ",
 242                                 (j == num_lines-1) ? explanation : "");
 243                 } else {
 244                         PrintAndLog("           |           |     | %-64s| %s| %s",
 245                                 line[j],
 246                                 (j == num_lines-1)?crc:"    ",
 247                                 (j == num_lines-1) ? explanation : "");
 248                 }
 249         }
 250
 251         bool next_isResponse = *((uint16_t *)(trace + tracepos + 6)) & 0x8000;
 252
 253         if (showWaitCycles && !isResponse && next_isResponse) {
 254                 uint32_t next_timestamp = *((uint32_t *)(trace + tracepos));
 255                 if (next_timestamp != 0x44444444) {
 256                         PrintAndLog(" %9d | %9d | %s | fdt (Frame Delay Time): %d",
 257                                 (EndOfTransmissionTimestamp - first_timestamp),
 258                                 (next_timestamp - first_timestamp),
 259                                 "   ",
 260                                 (next_timestamp - EndOfTransmissionTimestamp));
 261                 }
 262         }
 263         return tracepos;
 264 }
 265
 266 int CmdHFList(const char *Cmd)
 267 {
 268         bool showWaitCycles = false;
 269         char type[40] = {0};
 270         int tlen = param_getstr(Cmd,0,type);
 271         char param = param_getchar(Cmd, 1);
 272         bool errors = false;
 273         bool iclass = false;
 274         //Validate params
 275         if(tlen == 0 || (strcmp(type, "iclass") != 0 && strcmp(type,"14a") != 0))
 276         {
 277                 errors = true;
 278         }
 279         if(param == 'h' || (param !=0 && param != 'f'))
 280         {
 281                 errors = true;
 282         }
 283
 284         if (errors) {
 285                 PrintAndLog("List protocol data in trace buffer.");
 286                 PrintAndLog("Usage:  hf list [14a|iclass] [f]");
 287                 PrintAndLog("    14a    - interpret data as iso14443a communications");
 288                 PrintAndLog("    iclass - interpret data as iclass communications");
 289                 PrintAndLog("    f      - show frame delay times as well");
 290                 PrintAndLog("");
 291                 PrintAndLog("example: hf list 14a f");
 292                 PrintAndLog("example: hf list iclass");
 293                 return 0;
 294         }
 295         if(strcmp(type, "iclass") == 0)
 296         {
 297                 iclass = true;
 298         }
 299
 300         if (param == 'f') {
 301                 showWaitCycles = true;
 302         }
 303
 304
 305         uint8_t trace[TRACE_SIZE];
 306         uint16_t tracepos = 0;
 307         GetFromBigBuf(trace, TRACE_SIZE, 0);
 308         WaitForResponse(CMD_ACK, NULL);
 309
 310         PrintAndLog("Recorded Activity");
 311         PrintAndLog("");
 312         PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
 313         PrintAndLog("iso14443a - All times are in carrier periods (1/13.56Mhz)");
 314         PrintAndLog("iClass    - Timings are not as accurate");
 315         PrintAndLog("");
 316         PrintAndLog("     Start |       End | Src | Data (! denotes parity error)                                   | CRC | Annotation         |");
 317         PrintAndLog("-----------|-----------|-----|-----------------------------------------------------------------|-----|--------------------|");
 318
 319         while(tracepos < TRACE_SIZE)
 320         {
 321                 tracepos = printTraceLine(tracepos, trace, iclass, showWaitCycles);
 322         }
 323         return 0;
 324 }
 325
 326
 327 static command_t CommandTable[] =
 328 {
 329   {"help",        CmdHelp,          1, "This help"},
 330   {"14a",         CmdHF14A,         1, "{ ISO14443A RFIDs... }"},
 331   {"14b",         CmdHF14B,         1, "{ ISO14443B RFIDs... }"},
 332   {"15",          CmdHF15,          1, "{ ISO15693 RFIDs... }"},
 333   {"epa",         CmdHFEPA,         1, "{ German Identification Card... }"},
 334   {"legic",       CmdHFLegic,       0, "{ LEGIC RFIDs... }"},
 335   {"iclass",      CmdHFiClass,      1, "{ ICLASS RFIDs... }"},
 336   {"mf",                CmdHFMF,                1, "{ MIFARE RFIDs... }"},
 337   {"tune",        CmdHFTune,        0, "Continuously measure HF antenna tuning"},
 338   {"list",       CmdHFList,         1, "List protocol data in trace buffer"},
 339         {NULL, NULL, 0, NULL}
 340 };
 341
 342 int CmdHF(const char *Cmd)
 343 {
 344   CmdsParse(CommandTable, Cmd);
 345   return 0;
 346 }
 347
 348 int CmdHelp(const char *Cmd)
 349 {
 350   CmdsHelp(CommandTable);
 351   return 0;
 352 }