]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf14b.c
e3d0fc230423905891593df9bdca291584eadde2
[proxmark3-svn] / client / cmdhf14b.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // High frequency ISO14443B commands
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <stdlib.h>
13 #include <stdbool.h>
14 #include <string.h>
15 #include <stdint.h>
16 #include "iso14443crc.h"
17 #include "proxmark3.h"
18 #include "data.h"
19 #include "graph.h"
20 #include "util.h"
21 #include "ui.h"
22 #include "cmdparser.h"
23 #include "cmdhf14b.h"
24 #include "cmdmain.h"
25
26 static int CmdHelp(const char *Cmd);
27
28 int CmdHF14BDemod(const char *Cmd)
29 {
30 int i, j, iold;
31 int isum, qsum;
32 int outOfWeakAt;
33 bool negateI, negateQ;
34
35 uint8_t data[256];
36 int dataLen = 0;
37
38 // As received, the samples are pairs, correlations against I and Q
39 // square waves. So estimate angle of initial carrier (or just
40 // quadrant, actually), and then do the demod.
41
42 // First, estimate where the tag starts modulating.
43 for (i = 0; i < GraphTraceLen; i += 2) {
44 if (abs(GraphBuffer[i]) + abs(GraphBuffer[i + 1]) > 40) {
45 break;
46 }
47 }
48 if (i >= GraphTraceLen) {
49 PrintAndLog("too weak to sync");
50 return 0;
51 }
52 PrintAndLog("out of weak at %d", i);
53 outOfWeakAt = i;
54
55 // Now, estimate the phase in the initial modulation of the tag
56 isum = 0;
57 qsum = 0;
58 for (; i < (outOfWeakAt + 16); i += 2) {
59 isum += GraphBuffer[i + 0];
60 qsum += GraphBuffer[i + 1];
61 }
62 negateI = (isum < 0);
63 negateQ = (qsum < 0);
64
65 // Turn the correlation pairs into soft decisions on the bit.
66 j = 0;
67 for (i = 0; i < GraphTraceLen / 2; i++) {
68 int si = GraphBuffer[j];
69 int sq = GraphBuffer[j + 1];
70 if (negateI) si = -si;
71 if (negateQ) sq = -sq;
72 GraphBuffer[i] = si + sq;
73 j += 2;
74 }
75 GraphTraceLen = i;
76
77 i = outOfWeakAt / 2;
78 while (GraphBuffer[i] > 0 && i < GraphTraceLen)
79 i++;
80 if (i >= GraphTraceLen) goto demodError;
81
82 iold = i;
83 while (GraphBuffer[i] < 0 && i < GraphTraceLen)
84 i++;
85 if (i >= GraphTraceLen) goto demodError;
86 if ((i - iold) > 23) goto demodError;
87
88 PrintAndLog("make it to demod loop");
89
90 for (;;) {
91 iold = i;
92 while (GraphBuffer[i] >= 0 && i < GraphTraceLen)
93 i++;
94 if (i >= GraphTraceLen) goto demodError;
95 if ((i - iold) > 6) goto demodError;
96
97 uint16_t shiftReg = 0;
98 if (i + 20 >= GraphTraceLen) goto demodError;
99
100 for (j = 0; j < 10; j++) {
101 int soft = GraphBuffer[i] + GraphBuffer[i + 1];
102
103 if (abs(soft) < (abs(isum) + abs(qsum)) / 20) {
104 PrintAndLog("weak bit");
105 }
106
107 shiftReg >>= 1;
108 if(GraphBuffer[i] + GraphBuffer[i+1] >= 0) {
109 shiftReg |= 0x200;
110 }
111
112 i+= 2;
113 }
114
115 if ((shiftReg & 0x200) && !(shiftReg & 0x001))
116 {
117 // valid data byte, start and stop bits okay
118 PrintAndLog(" %02x", (shiftReg >> 1) & 0xff);
119 data[dataLen++] = (shiftReg >> 1) & 0xff;
120 if (dataLen >= sizeof(data)) {
121 return 0;
122 }
123 } else if (shiftReg == 0x000) {
124 // this is EOF
125 break;
126 } else {
127 goto demodError;
128 }
129 }
130
131 uint8_t first, second;
132 ComputeCrc14443(CRC_14443_B, data, dataLen-2, &first, &second);
133 PrintAndLog("CRC: %02x %02x (%s)\n", first, second,
134 (first == data[dataLen-2] && second == data[dataLen-1]) ?
135 "ok" : "****FAIL****");
136
137 RepaintGraphWindow();
138 return 0;
139
140 demodError:
141 PrintAndLog("demod error");
142 RepaintGraphWindow();
143 return 0;
144 }
145
146 int CmdHF14BList(const char *Cmd)
147 {
148 uint8_t got[TRACE_BUFFER_SIZE];
149 GetFromBigBuf(got,sizeof(got),0);
150 WaitForResponse(CMD_ACK,NULL);
151
152 PrintAndLog("recorded activity:");
153 PrintAndLog(" time :rssi: who bytes");
154 PrintAndLog("---------+----+----+-----------");
155
156 int i = 0;
157 int prev = -1;
158
159 for(;;) {
160
161 if(i >= TRACE_BUFFER_SIZE) { break; }
162
163 bool isResponse;
164 int timestamp = *((uint32_t *)(got+i));
165 if(timestamp & 0x80000000) {
166 timestamp &= 0x7fffffff;
167 isResponse = 1;
168 } else {
169 isResponse = 0;
170 }
171 int metric = *((uint32_t *)(got+i+4));
172
173 int len = got[i+8];
174
175 if(len > 100) {
176 break;
177 }
178 if(i + len >= TRACE_BUFFER_SIZE) {
179 break;
180 }
181
182 uint8_t *frame = (got+i+9);
183
184 // Break and stick with current result if buffer was not completely full
185 if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;
186
187 char line[1000] = "";
188 int j;
189 for(j = 0; j < len; j++) {
190 sprintf(line+(j*3), "%02x ", frame[j]);
191 }
192
193 char *crc;
194 if(len > 2) {
195 uint8_t b1, b2;
196 ComputeCrc14443(CRC_14443_B, frame, len-2, &b1, &b2);
197 if(b1 != frame[len-2] || b2 != frame[len-1]) {
198 crc = "**FAIL CRC**";
199 } else {
200 crc = "";
201 }
202 } else {
203 crc = "(SHORT)";
204 }
205
206 char metricString[100];
207 if(isResponse) {
208 sprintf(metricString, "%3d", metric);
209 } else {
210 strcpy(metricString, " ");
211 }
212
213 PrintAndLog(" +%7d: %s: %s %s %s",
214 (prev < 0 ? 0 : timestamp - prev),
215 metricString,
216 (isResponse ? "TAG" : " "), line, crc);
217
218 prev = timestamp;
219 i += (len + 9);
220 }
221 return 0;
222 }
223
224 int CmdHF14BRead(const char *Cmd)
225 {
226 UsbCommand c = {CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443, {strtol(Cmd, NULL, 0), 0, 0}};
227 SendCommand(&c);
228 return 0;
229 }
230
231 int CmdHF14Sim(const char *Cmd)
232 {
233 UsbCommand c={CMD_SIMULATE_TAG_ISO_14443};
234 SendCommand(&c);
235 return 0;
236 }
237
238 int CmdHFSimlisten(const char *Cmd)
239 {
240 UsbCommand c = {CMD_SIMULATE_TAG_HF_LISTEN};
241 SendCommand(&c);
242 return 0;
243 }
244
245 int CmdHF14BSnoop(const char *Cmd)
246 {
247 UsbCommand c = {CMD_SNOOP_ISO_14443};
248 SendCommand(&c);
249 return 0;
250 }
251
252 /* New command to read the contents of a SRI512 tag
253 * SRI512 tags are ISO14443-B modulated memory tags,
254 * this command just dumps the contents of the memory
255 */
256 int CmdSri512Read(const char *Cmd)
257 {
258 UsbCommand c = {CMD_READ_SRI512_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
259 SendCommand(&c);
260 return 0;
261 }
262
263 /* New command to read the contents of a SRIX4K tag
264 * SRIX4K tags are ISO14443-B modulated memory tags,
265 * this command just dumps the contents of the memory/
266 */
267 int CmdSrix4kRead(const char *Cmd)
268 {
269 UsbCommand c = {CMD_READ_SRIX4K_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
270 SendCommand(&c);
271 return 0;
272 }
273
274 int CmdHF14BCmdRaw (const char *cmd) {
275 UsbCommand resp;
276 uint8_t *recv;
277 UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; // len,recv?
278 uint8_t reply=1;
279 uint8_t crc=0;
280 uint8_t power=0;
281 char buf[5]="";
282 int i=0;
283 uint8_t data[100];
284 unsigned int datalen=0, temp;
285 char *hexout;
286
287 if (strlen(cmd)<3) {
288 PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] <0A 0B 0C ... hex>");
289 PrintAndLog(" -r do not read response");
290 PrintAndLog(" -c calculate and append CRC");
291 PrintAndLog(" -p leave the field on after receive");
292 return 0;
293 }
294
295 // strip
296 while (*cmd==' ' || *cmd=='\t') cmd++;
297
298 while (cmd[i]!='\0') {
299 if (cmd[i]==' ' || cmd[i]=='\t') { i++; continue; }
300 if (cmd[i]=='-') {
301 switch (cmd[i+1]) {
302 case 'r':
303 case 'R':
304 reply=0;
305 break;
306 case 'c':
307 case 'C':
308 crc=1;
309 break;
310 case 'p':
311 case 'P':
312 power=1;
313 break;
314 default:
315 PrintAndLog("Invalid option");
316 return 0;
317 }
318 i+=2;
319 continue;
320 }
321 if ((cmd[i]>='0' && cmd[i]<='9') ||
322 (cmd[i]>='a' && cmd[i]<='f') ||
323 (cmd[i]>='A' && cmd[i]<='F') ) {
324 buf[strlen(buf)+1]=0;
325 buf[strlen(buf)]=cmd[i];
326 i++;
327
328 if (strlen(buf)>=2) {
329 sscanf(buf,"%x",&temp);
330 data[datalen]=(uint8_t)(temp & 0xff);
331 datalen++;
332 *buf=0;
333 }
334 continue;
335 }
336 PrintAndLog("Invalid char on input");
337 return 0;
338 }
339 if (datalen == 0)
340 {
341 PrintAndLog("Missing data input");
342 return 0;
343 }
344 if(crc)
345 {
346 uint8_t first, second;
347 ComputeCrc14443(CRC_14443_B, data, datalen, &first, &second);
348 data[datalen++] = first;
349 data[datalen++] = second;
350 }
351
352 c.arg[0] = datalen;
353 c.arg[1] = reply;
354 c.arg[2] = power;
355 memcpy(c.d.asBytes,data,datalen);
356
357 SendCommand(&c);
358
359 if (reply) {
360 if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
361 recv = resp.d.asBytes;
362 PrintAndLog("received %i octets",resp.arg[0]);
363 if(!resp.arg[0])
364 return 0;
365 hexout = (char *)malloc(resp.arg[0] * 3 + 1);
366 if (hexout != NULL) {
367 uint8_t first, second;
368 for (int i = 0; i < resp.arg[0]; i++) { // data in hex
369 sprintf(&hexout[i * 3], "%02X ", recv[i]);
370 }
371 PrintAndLog("%s", hexout);
372 free(hexout);
373 ComputeCrc14443(CRC_14443_B, recv, resp.arg[0]-2, &first, &second);
374 if(recv[resp.arg[0]-2]==first && recv[resp.arg[0]-1]==second) {
375 PrintAndLog("CRC OK");
376 } else {
377 PrintAndLog("CRC failed");
378 }
379 } else {
380 PrintAndLog("malloc failed your client has low memory?");
381 }
382 } else {
383 PrintAndLog("timeout while waiting for reply.");
384 }
385 } // if reply
386 return 0;
387 }
388
389 int CmdHF14BWrite( const char *Cmd){
390
391 /*
392 * For SRIX4K blocks 00 - 7F
393 * hf 14b raw -c -p 09 $srix4kwblock $srix4kwdata
394 *
395 * For SR512 blocks 00 - 0F
396 * hf 14b raw -c -p 09 $sr512wblock $sr512wdata
397 *
398 * Special block FF = otp_lock_reg block.
399 * Data len 4 bytes-
400 */
401 char cmdp = param_getchar(Cmd, 0);
402 uint8_t blockno = -1;
403 uint8_t data[4] = {0x00};
404 bool isSrix4k = true;
405 char str[20];
406
407 if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') {
408 PrintAndLog("Usage: hf 14b write <1|2> <BLOCK> <DATA>");
409 PrintAndLog(" [1 = SRIX4K]");
410 PrintAndLog(" [2 = SRI512]");
411 PrintAndLog(" [BLOCK number depends on tag, special block == FF]");
412 PrintAndLog(" sample: hf 14b write 1 7F 11223344");
413 PrintAndLog(" : hf 14b write 1 FF 11223344");
414 PrintAndLog(" : hf 14b write 2 15 11223344");
415 PrintAndLog(" : hf 14b write 2 FF 11223344");
416 return 0;
417 }
418
419 if ( cmdp == '2' )
420 isSrix4k = false;
421
422 //blockno = param_get8(Cmd, 1);
423
424 if ( param_gethex(Cmd,1, &blockno, 2) ) {
425 PrintAndLog("Block number must include 2 HEX symbols");
426 return 0;
427 }
428
429 if ( isSrix4k ){
430 if ( blockno > 0x7f && blockno != 0xff ){
431 PrintAndLog("Block number out of range");
432 return 0;
433 }
434 } else {
435 if ( blockno > 0x0f && blockno != 0xff ){
436 PrintAndLog("Block number out of range");
437 return 0;
438 }
439 }
440
441 if (param_gethex(Cmd, 2, data, 8)) {
442 PrintAndLog("Data must include 8 HEX symbols");
443 return 0;
444 }
445
446 if ( blockno == 0xff)
447 PrintAndLog("[%s] Write special block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512" , blockno, sprint_hex(data,4) );
448 else
449 PrintAndLog("[%s] Write block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512", blockno, sprint_hex(data,4) );
450
451 sprintf(str, "-c -p 09 %02x %02x%02x%02x%02x", blockno, data[0], data[1], data[2], data[3]);
452
453 CmdHF14BCmdRaw(str);
454 return 0;
455 }
456
457 static command_t CommandTable[] =
458 {
459 {"help", CmdHelp, 1, "This help"},
460 {"demod", CmdHF14BDemod, 1, "Demodulate ISO14443 Type B from tag"},
461 {"list", CmdHF14BList, 0, "List ISO 14443 history"},
462 {"read", CmdHF14BRead, 0, "Read HF tag (ISO 14443)"},
463 {"sim", CmdHF14Sim, 0, "Fake ISO 14443 tag"},
464 {"simlisten", CmdHFSimlisten, 0, "Get HF samples as fake tag"},
465 {"snoop", CmdHF14BSnoop, 0, "Eavesdrop ISO 14443"},
466 {"sri512read", CmdSri512Read, 0, "Read contents of a SRI512 tag"},
467 {"srix4kread", CmdSrix4kRead, 0, "Read contents of a SRIX4K tag"},
468 {"raw", CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},
469 {"write", CmdHF14BWrite, 0, "Write data to a SRI512 | SRIX4K tag"},
470 {NULL, NULL, 0, NULL}
471 };
472
473 int CmdHF14B(const char *Cmd)
474 {
475 CmdsParse(CommandTable, Cmd);
476 return 0;
477 }
478
479 int CmdHelp(const char *Cmd)
480 {
481 CmdsHelp(CommandTable);
482 return 0;
483 }
Impressum, Datenschutz