git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhftopaz.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2015 Piwi
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // High frequency Topaz (NFC Type 1) commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <stdlib.h>
  13 #include <string.h>
  14 #include <unistd.h>
  15 #include "cmdmain.h"
  16 #include "cmdparser.h"
  17 #include "cmdhftopaz.h"
  18 #include "cmdhf14a.h"
  19 #include "ui.h"
  20 #include "mifare.h"
  21 #include "proxmark3.h"
  22 #include "iso14443crc.h"
  23 #include "protocols.h"
  24
  25 #define TOPAZ_STATIC_MEMORY     (0x0f * 8)
  26
  27 typedef struct dynamic_lock_area {
  28         struct dynamic_lock_area *next;
  29         uint16_t        byte_offset;
  30         uint16_t        size_in_bits;
  31         uint16_t        first_locked_byte;
  32         uint16_t        bytes_locked_per_bit;
  33 } dynamic_lock_area_t;
  34
  35
  36 static struct {
  37         uint8_t HR01[2];
  38         uint8_t uid[7];
  39         uint8_t size;
  40         uint8_t data_blocks[TOPAZ_STATIC_MEMORY/8][8];
  41         dynamic_lock_area_t *dynamic_lock_areas;
  42         uint8_t *dynamic_reserved_areas;
  43         uint8_t *dynamic_memory;
  44 } topaz_tag;
  45
  46
  47 static void topaz_switch_on_field(void)
  48 {
  49         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT | ISO14A_NO_SELECT | ISO14A_NO_DISCONNECT | ISO14A_TOPAZMODE, 0, 0}};
  50         SendCommand(&c);
  51 }
  52
  53
  54 static void topaz_switch_off_field(void)
  55 {
  56         UsbCommand c = {CMD_READER_ISO_14443a, {0, 0, 0}};
  57         SendCommand(&c);
  58 }
  59
  60
  61 static int topaz_send_cmd_raw(uint8_t *cmd, uint8_t len, uint8_t *response)
  62 {
  63         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_RAW | ISO14A_NO_DISCONNECT | ISO14A_TOPAZMODE, len, 0}};
  64         memcpy(c.d.asBytes, cmd, len);
  65         SendCommand(&c);
  66
  67         UsbCommand resp;
  68         WaitForResponse(CMD_ACK, &resp);
  69
  70         if (resp.arg[0] > 0) {
  71                 memcpy(response, resp.d.asBytes, resp.arg[0]);
  72         }
  73
  74         return resp.arg[0];
  75 }
  76
  77
  78 static int topaz_send_cmd(uint8_t *cmd, uint8_t len, uint8_t *response)
  79 {
  80         if (len > 1) {
  81         uint8_t first, second;
  82                 ComputeCrc14443(CRC_14443_B, cmd, len-2, &first, &second);
  83         cmd[len-2] = first;
  84         cmd[len-1] = second;
  85         }
  86
  87         return topaz_send_cmd_raw(cmd, len, response);
  88 }
  89
  90
  91 static int topaz_select(uint8_t *atqa, uint8_t *rid_response)
  92 {
  93         // ToDo: implement anticollision
  94
  95         uint8_t wupa_cmd[] = {TOPAZ_WUPA};
  96         uint8_t rid_cmd[] = {TOPAZ_RID, 0, 0, 0, 0, 0, 0, 0, 0};
  97
  98         topaz_switch_on_field();
  99
 100         if (!topaz_send_cmd(wupa_cmd, sizeof(wupa_cmd), atqa)) {
 101                 topaz_switch_off_field();
 102                 return -1;              // WUPA failed
 103         }
 104
 105         if (!topaz_send_cmd(rid_cmd, sizeof(rid_cmd), rid_response)) {
 106                 topaz_switch_off_field();
 107                 return -2;              // RID failed
 108         }
 109
 110         return 0;               // OK
 111 }
 112
 113
 114 static int topaz_rall(uint8_t *uid, uint8_t *response)
 115 {
 116         uint8_t rall_cmd[] = {TOPAZ_RALL, 0, 0, 0, 0, 0, 0, 0, 0};
 117
 118         memcpy(&rall_cmd[3], uid, 4);
 119         if (!topaz_send_cmd(rall_cmd, sizeof(rall_cmd), response)) {
 120                 topaz_switch_off_field();
 121                 return -1;              // RALL failed
 122         }
 123
 124         return 0;
 125 }
 126
 127
 128 static dynamic_lock_area_t *get_dynamic_lock_area(uint16_t byteno)
 129 {
 130         dynamic_lock_area_t *lock_area;
 131
 132         lock_area = topaz_tag.dynamic_lock_areas;
 133
 134         while (lock_area != NULL) {
 135                 if (byteno < lock_area->first_locked_byte) {
 136                         lock_area = lock_area->next;
 137                 } else {
 138                         return lock_area;
 139                 }
 140         }
 141
 142         return NULL;
 143 }
 144
 145
 146 // check if a memory block (8 Bytes) is locked.
 147 // TODO: support other sizes of locked_bytes_per_bit (current assumption: each lock bit locks 8 Bytes)
 148 static bool topaz_byte_is_locked(uint16_t byteno)
 149 {
 150         uint8_t *lockbits;
 151         uint16_t locked_bytes_per_bit;
 152         dynamic_lock_area_t *lock_area;
 153
 154         if (byteno < TOPAZ_STATIC_MEMORY) {
 155                 lockbits = &topaz_tag.data_blocks[0x0e][0];
 156                 locked_bytes_per_bit = 8;
 157         } else {
 158                 lock_area = get_dynamic_lock_area(byteno);
 159                 if (lock_area == NULL) {
 160                         return false;
 161                 }
 162                 locked_bytes_per_bit = lock_area->bytes_locked_per_bit;
 163                 byteno = byteno - lock_area->first_locked_byte;
 164                 lockbits = &topaz_tag.dynamic_memory[lock_area->byte_offset - TOPAZ_STATIC_MEMORY];
 165         }
 166
 167         uint16_t blockno = byteno / locked_bytes_per_bit;
 168         if(lockbits[blockno/8] >> (blockno % 8) & 0x01) {
 169                 return true;
 170         } else {
 171                 return false;
 172         }
 173 }
 174
 175
 176 static int topaz_print_CC(uint8_t *data)
 177 {
 178         if(data[0] != 0xe1) {
 179                 return -1;              // no NDEF message
 180         }
 181
 182         PrintAndLog("Capability Container: %02x %02x %02x %02x", data[0], data[1], data[2], data[3]);
 183         PrintAndLog("  %02x: NDEF Magic Number", data[0]);
 184         PrintAndLog("  %02x: version %d.%d supported by tag", data[1], (data[1] & 0xF0) >> 4, data[1] & 0x0f);
 185         uint16_t memsize = (data[2] + 1) * 8;
 186         topaz_tag.dynamic_memory = malloc(memsize - TOPAZ_STATIC_MEMORY);
 187         PrintAndLog("  %02x: Physical Memory Size of this tag: %d bytes", data[2], memsize);
 188         PrintAndLog("  %02x: %s / %s", data[3],
 189                                 (data[3] & 0xF0) ? "(RFU)" : "Read access granted without any security",
 190                                 (data[3] & 0x0F)==0 ? "Write access granted without any security" : (data[3] & 0x0F)==0x0F ? "No write access granted at all" : "(RFU)");
 191         return 0;
 192 }
 193
 194
 195 static void get_TLV(uint8_t **TLV_ptr, uint8_t *tag, uint16_t *length, uint8_t **value)
 196 {
 197         *length = 0;
 198         *value = NULL;
 199
 200         *tag = **TLV_ptr;
 201         *TLV_ptr += 1;
 202         switch (*tag) {
 203                 case 0x00:                      // NULL TLV.
 204                 case 0xFE:                      // Terminator TLV.
 205                         break;
 206                 case 0x01:                      // Lock Control TLV
 207                 case 0x02:                      // Reserved Memory TLV
 208                 case 0x03:                      // NDEF message TLV
 209                 case 0xFD:                      // proprietary TLV
 210                         *length = **TLV_ptr;
 211                         *TLV_ptr += 1;
 212                         if (*length == 0xff) {
 213                                 *length = **TLV_ptr << 8;
 214                                 *TLV_ptr += 1;
 215                                 *length |= **TLV_ptr;
 216                                 *TLV_ptr += 1;
 217                         }
 218                         *value = *TLV_ptr;
 219                         *TLV_ptr += *length;
 220                         break;
 221                 default:                        // RFU
 222                         break;
 223         }
 224 }
 225
 226
 227 static bool topaz_print_lock_control_TLVs(uint8_t *memory)
 228 {
 229         uint8_t *TLV_ptr = memory;
 230         uint8_t tag = 0;
 231         uint16_t length;
 232         uint8_t *value;
 233         bool lock_TLV_present = false;
 234         uint16_t first_locked_byte = 0x0f * 8;
 235
 236         while(*TLV_ptr != 0x03 && *TLV_ptr != 0xFD && *TLV_ptr != 0xFE) {
 237                 // all Lock Control TLVs shall be present before the NDEF message TLV, the proprietary TLV (and the Terminator TLV)
 238                 get_TLV(&TLV_ptr, &tag, &length, &value);
 239                 if (tag == 0x01) {                      // the Lock Control TLV
 240                         uint8_t pages_addr = value[0] >> 4;
 241                         uint8_t byte_offset = value[0] & 0x0f;
 242                         uint16_t size_in_bits = value[1] ? value[1] : 256;
 243                         uint16_t bytes_per_page = 1 << (value[2] & 0x0f);
 244                         uint16_t bytes_locked_per_bit = 1 << (value[2] >> 4);
 245                         PrintAndLog("Lock Area of %d bits at byte offset 0x%04x. Each Lock Bit locks %d bytes.",
 246                                                 size_in_bits,
 247                                                 pages_addr * bytes_per_page + byte_offset,
 248                                                 bytes_locked_per_bit);
 249                         lock_TLV_present = true;
 250                         dynamic_lock_area_t *old = topaz_tag.dynamic_lock_areas;
 251                         dynamic_lock_area_t *new = topaz_tag.dynamic_lock_areas;
 252                         if (old == NULL) {
 253                                 new = topaz_tag.dynamic_lock_areas = (dynamic_lock_area_t *)malloc(sizeof(dynamic_lock_area_t));
 254                         } else {
 255                                 while(old->next != NULL) {
 256                                         old = old->next;
 257                                 }
 258                                 new = old->next = (dynamic_lock_area_t *)malloc(sizeof(dynamic_lock_area_t));
 259                         }
 260                         new->next = NULL;
 261                         new->first_locked_byte = first_locked_byte;
 262                         new->byte_offset = pages_addr * bytes_per_page + byte_offset;
 263                         new->size_in_bits = size_in_bits;
 264                         new->bytes_locked_per_bit = bytes_locked_per_bit;
 265                         first_locked_byte = first_locked_byte + size_in_bits*bytes_locked_per_bit;
 266                 }
 267         }
 268
 269         if (!lock_TLV_present) {
 270                 PrintAndLog("(No Lock Control TLV present)");
 271                 return -1;
 272         } else {
 273                 return 0;
 274         }
 275 }
 276
 277
 278 static int topaz_print_reserved_memory_control_TLVs(uint8_t *memory)
 279 {
 280         uint8_t *TLV_ptr = memory;
 281         uint8_t tag = 0;
 282         uint16_t length;
 283         uint8_t *value;
 284         bool reserved_memory_control_TLV_present = false;
 285
 286         while(*TLV_ptr != 0x03 && *TLV_ptr != 0xFD && *TLV_ptr != 0xFE) {
 287                 // all Reserved Memory Control TLVs shall be present before the NDEF message TLV, the proprietary TLV (and the Terminator TLV)
 288                 get_TLV(&TLV_ptr, &tag, &length, &value);
 289                 if (tag == 0x02) {                      // the Reserved Memory Control TLV
 290                         uint8_t pages_addr = value[0] >> 4;
 291                         uint8_t byte_offset = value[0] & 0x0f;
 292                         uint8_t size_in_bytes = value[1] ? value[1] : 256;
 293                         uint8_t bytes_per_page = 1 << (value[2] & 0x0f);
 294                         PrintAndLog("Reserved Memory of %d bytes at byte offset 0x%02x.",
 295                                                 size_in_bytes,
 296                                                 pages_addr * bytes_per_page + byte_offset);
 297                         reserved_memory_control_TLV_present = true;
 298                 }
 299         }
 300
 301         if (!reserved_memory_control_TLV_present) {
 302                 PrintAndLog("(No Reserved Memory Control TLV present)");
 303                 return -1;
 304         } else {
 305                 return 0;
 306         }
 307 }
 308
 309
 310 static void topaz_print_lifecycle_state(uint8_t *data)
 311 {
 312
 313 }
 314
 315
 316 static void topaz_print_NDEF(uint8_t *data)
 317 {
 318
 319 }
 320
 321
 322 int CmdHFTopazReader(const char *Cmd)
 323 {
 324         int status;
 325         uint8_t atqa[2];
 326         uint8_t rid_response[8];
 327         uint8_t *uid_echo = &rid_response[2];
 328         uint8_t rall_response[124];
 329
 330         status = topaz_select(atqa, rid_response);
 331
 332         if (status == -1) {
 333                 PrintAndLog("Error: couldn't receive ATQA");
 334                 return -1;
 335         }
 336
 337         PrintAndLog("ATQA : %02x %02x", atqa[1], atqa[0]);
 338         if (atqa[1] != 0x0c && atqa[0] != 0x00) {
 339                 PrintAndLog("Tag doesn't support the Topaz protocol.");
 340                 topaz_switch_off_field();
 341                 return -1;
 342         }
 343
 344         if (status == -2) {
 345                 PrintAndLog("Error: tag didn't answer to RID");
 346                 topaz_switch_off_field();
 347                 return -1;
 348         }
 349
 350         topaz_tag.HR01[0] = rid_response[0];
 351         topaz_tag.HR01[1] = rid_response[1];
 352
 353         // ToDo: CRC check
 354         PrintAndLog("HR0  : %02x (%sa Topaz tag (%scapable of carrying a NDEF message), %s memory map)", rid_response[0],
 355                                                 (rid_response[0] & 0xF0) == 0x10 ? "" : "not ",
 356                                                 (rid_response[0] & 0xF0) == 0x10 ? "" : "not ",
 357                                                 (rid_response[0] & 0x0F) == 0x10 ? "static" : "dynamic");
 358         PrintAndLog("HR1  : %02x", rid_response[1]);
 359
 360         status = topaz_rall(uid_echo, rall_response);
 361
 362         if(status == -1) {
 363                 PrintAndLog("Error: tag didn't answer to RALL");
 364                 topaz_switch_off_field();
 365                 return -1;
 366         }
 367
 368         memcpy(topaz_tag.uid, rall_response+2, 7);
 369         PrintAndLog("UID  : %02x %02x %02x %02x %02x %02x %02x",
 370                         topaz_tag.uid[6],
 371                         topaz_tag.uid[5],
 372                         topaz_tag.uid[4],
 373                         topaz_tag.uid[3],
 374                         topaz_tag.uid[2],
 375                         topaz_tag.uid[1],
 376                         topaz_tag.uid[0]);
 377         PrintAndLog("       UID[6] (Manufacturer Byte) = %02x, Manufacturer: %s",
 378                         topaz_tag.uid[6],
 379                         getTagInfo(topaz_tag.uid[6]));
 380
 381         memcpy(topaz_tag.data_blocks, rall_response+2, 0x10*8);
 382         PrintAndLog("");
 383         PrintAndLog("Static Data blocks 00 to 0c:");
 384         PrintAndLog("block# | offset | Data                    | Locked(y/n)");
 385         char line[80];
 386         for (uint16_t i = 0; i <= 0x0c; i++) {
 387                 for (uint16_t j = 0; j < 8; j++) {
 388                         sprintf(&line[3*j], "%02x ", topaz_tag.data_blocks[i][j] /*rall_response[2 + 8*i + j]*/);
 389                 }
 390                 PrintAndLog("  0x%02x | 0x%04x | %s|   %-3s", i, i*8, line, topaz_byte_is_locked(i*8) ? "yyyyyyyy" : "nnnnnnnn");
 391         }
 392
 393         PrintAndLog("");
 394         PrintAndLog("Static Reserved block 0d:");
 395         for (uint16_t j = 0; j < 8; j++) {
 396                 sprintf(&line[3*j], "%02x ", topaz_tag.data_blocks[0x0d][j]);
 397         }
 398         PrintAndLog("  0x%02x | 0x%04x | %s|   %-3s", 0x0d, 0x0d*8, line, "n/a");
 399
 400         PrintAndLog("");
 401         PrintAndLog("Static Lockbits and OTP Bytes:");
 402         for (uint16_t j = 0; j < 8; j++) {
 403                 sprintf(&line[3*j], "%02x ", topaz_tag.data_blocks[0x0e][j]);
 404         }
 405         PrintAndLog("  0x%02x | 0x%04x | %s|   %-3s", 0x0e, 0x0e*8, line, "n/a");
 406
 407         PrintAndLog("");
 408
 409         status = topaz_print_CC(&topaz_tag.data_blocks[1][0]);
 410
 411         if (status == -1) {
 412                 PrintAndLog("No NDEF message present");
 413                 topaz_switch_off_field();
 414                 return 0;
 415         }
 416
 417         PrintAndLog("");
 418         bool lock_TLV_present = topaz_print_lock_control_TLVs(&topaz_tag.data_blocks[1][4]);
 419
 420         PrintAndLog("");
 421         bool reserved_mem_present = topaz_print_reserved_memory_control_TLVs(&topaz_tag.data_blocks[1][4]);
 422
 423         topaz_print_lifecycle_state(&topaz_tag.data_blocks[1][0]);
 424
 425         topaz_print_NDEF(&topaz_tag.data_blocks[1][0]);
 426
 427         topaz_switch_off_field();
 428         return 0;
 429 }
 430
 431
 432 int CmdHFTopazSim(const char *Cmd)
 433 {
 434         PrintAndLog("not yet implemented");
 435         return 0;
 436 }
 437
 438
 439 int CmdHFTopazCmdRaw(const char *Cmd)
 440 {
 441         PrintAndLog("not yet implemented");
 442         return 0;
 443 }
 444
 445
 446 static int CmdHelp(const char *Cmd);
 447
 448
 449 static command_t CommandTable[] =
 450 {
 451         {"help",        CmdHelp,                        1, "This help"},
 452         {"reader",      CmdHFTopazReader,       0, "Act like a Topaz reader"},
 453         {"sim",         CmdHFTopazSim,          0, "<UID> -- Simulate Topaz tag"},
 454         {"snoop",       CmdHF14ASnoop,          0, "Eavesdrop a Topaz reader-tag communication"},
 455         {"raw",         CmdHFTopazCmdRaw,       0, "Send raw hex data to tag"},
 456         {NULL,          NULL,                           0, NULL}
 457 };
 458
 459
 460 int CmdHFTopaz(const char *Cmd) {
 461         // flush
 462         WaitForResponseTimeout(CMD_ACK,NULL,100);
 463
 464         // parse
 465         CmdsParse(CommandTable, Cmd);
 466         return 0;
 467 }
 468
 469 static int CmdHelp(const char *Cmd)
 470 {
 471         CmdsHelp(CommandTable);
 472         return 0;
 473 }
 474
 475