git.zerfleddert.de Git - proxmark3-svn/blob

1 //-----------------------------------------------------------------------------

3 //

4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,

5 // at your option, any later version. See the LICENSE.txt file for the text of

6 // the license.

7 //-----------------------------------------------------------------------------

8 // High frequency ISO14443B commands

9 //-----------------------------------------------------------------------------

11 #include <stdio.h>

12 #include <stdlib.h>

13 #include <stdbool.h>

14 #include <string.h>

15 #include <stdint.h>

16 #include "iso14443crc.h"

17 #include "proxmark3.h"

18 #include "data.h"

19 #include "graph.h"

20 #include "util.h"

21 #include "ui.h"

22 #include "cmdparser.h"

23 #include "cmdhf14b.h"

24 #include "cmdmain.h"

 static int CmdHelp(const char *Cmd);

 int CmdHF14BDemod(const char *Cmd)

29 {

30 int i, j, iold;

31 int isum, qsum;

32 int outOfWeakAt;

33 bool negateI, negateQ;

35 uint8_t data[256];

36 int dataLen = 0;

38 // As received, the samples are pairs, correlations against I and Q

39 // square waves. So estimate angle of initial carrier (or just

40 // quadrant, actually), and then do the demod.

42 // First, estimate where the tag starts modulating.

   for (i = 0; i < GraphTraceLen; i += 2) {

     if (abs(GraphBuffer[i]) + abs(GraphBuffer[i + 1]) > 40) {

45 break;

46 }

47 }

48 if (i >= GraphTraceLen) {

49 PrintAndLog("too weak to sync");

50 return 0;

51 }

   PrintAndLog("out of weak at %d", i);

53 outOfWeakAt = i;

55 // Now, estimate the phase in the initial modulation of the tag

56 isum = 0;

57 qsum = 0;

   for (; i < (outOfWeakAt + 16); i += 2) {

     isum += GraphBuffer[i + 0];

     qsum += GraphBuffer[i + 1];

61 }

62 negateI = (isum < 0);

63 negateQ = (qsum < 0);

65 // Turn the correlation pairs into soft decisions on the bit.

66 j = 0;

   for (i = 0; i < GraphTraceLen / 2; i++) {

68 int si = GraphBuffer[j];

     int sq = GraphBuffer[j + 1];

     if (negateI) si = -si;

     if (negateQ) sq = -sq;

72 GraphBuffer[i] = si + sq;

73 j += 2;

74 }

75 GraphTraceLen = i;

77 i = outOfWeakAt / 2;

   while (GraphBuffer[i] > 0 && i < GraphTraceLen)

79 i++;

   if (i >= GraphTraceLen) goto demodError;

82 iold = i;

   while (GraphBuffer[i] < 0 && i < GraphTraceLen)

84 i++;

   if (i >= GraphTraceLen) goto demodError;

   if ((i - iold) > 23) goto demodError;

88 PrintAndLog("make it to demod loop");

90 for (;;) {

91 iold = i;

     while (GraphBuffer[i] >= 0 && i < GraphTraceLen)

93 i++;

     if (i >= GraphTraceLen) goto demodError;

     if ((i - iold) > 6) goto demodError;

97 uint16_t shiftReg = 0;

     if (i + 20 >= GraphTraceLen) goto demodError;

     for (j = 0; j < 10; j++) {

       int soft = GraphBuffer[i] + GraphBuffer[i + 1];

102

       if (abs(soft) < (abs(isum) + abs(qsum)) / 20) {

104 PrintAndLog("weak bit");

105 }

106

107 shiftReg >>= 1;

       if(GraphBuffer[i] + GraphBuffer[i+1] >= 0) {

109 shiftReg |= 0x200;

110 }

111

112 i+= 2;

113 }

114

     if ((shiftReg & 0x200) && !(shiftReg & 0x001))

116 {

117 // valid data byte, start and stop bits okay

       PrintAndLog("   %02x", (shiftReg >> 1) & 0xff);

       data[dataLen++] = (shiftReg >> 1) & 0xff;

       if (dataLen >= sizeof(data)) {

121 return 0;

122 }

     } else if (shiftReg == 0x000) {

124 // this is EOF

125 break;

126 } else {

127 goto demodError;

128 }

129 }

130

131 uint8_t first, second;

   ComputeCrc14443(CRC_14443_B, data, dataLen-2, &first, &second);

   PrintAndLog("CRC: %02x %02x (%s)\n", first, second,

     (first == data[dataLen-2] && second == data[dataLen-1]) ?

135 "ok" : "****FAIL****");

136

137 RepaintGraphWindow();

138 return 0;

139

140 demodError:

141 PrintAndLog("demod error");

142 RepaintGraphWindow();

143 return 0;

144 }

145

 int CmdHF14BList(const char *Cmd)

147 {

         uint8_t *got = malloc(USB_CMD_DATA_SIZE);

149

150 // Query for the actual size of the trace

151 UsbCommand response;

         GetFromBigBuf(got, USB_CMD_DATA_SIZE, 0);

153 WaitForResponse(CMD_ACK, &response);

         uint16_t traceLen = response.arg[2];

155 if (traceLen > USB_CMD_DATA_SIZE) {

                 uint8_t *p = realloc(got, traceLen);

157 if (p == NULL) {

158 PrintAndLog("Cannot allocate memory for trace");

159 free(got);

160 return 2;

161 }

162 got = p;

                 GetFromBigBuf(got, traceLen, 0);

164 WaitForResponse(CMD_ACK,NULL);

165 }

   PrintAndLog("recorded activity: (TraceLen = %d bytes)", traceLen);

167 PrintAndLog(" time :rssi: who bytes");

168 PrintAndLog("---------+----+----+-----------");

169

170 int i = 0;

171 int prev = -1;

172

173 for(;;) {

174

         if(i >= traceLen) { break; }

176

177 bool isResponse;

     int timestamp = *((uint32_t *)(got+i));

     if(timestamp & 0x80000000) {

180 timestamp &= 0x7fffffff;

181 isResponse = 1;

182 } else {

183 isResponse = 0;

184 }

     int metric = *((uint32_t *)(got+i+4));

186

     int len = got[i+8];

188

     if(len > 100) {

190 break;

191 }

     if(i + len >= traceLen) {

193 break;

194 }

195

     uint8_t *frame = (got+i+9);

197

198 // Break and stick with current result if buffer was not completely full

         if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break; 

200

     char line[1000] = "";

202 int j;

     for(j = 0; j < len; j++) {

       sprintf(line+(j*3), "%02x  ", frame[j]);

205 }

206

207 char *crc;

     if(len > 2) {

209 uint8_t b1, b2;

       ComputeCrc14443(CRC_14443_B, frame, len-2, &b1, &b2);

       if(b1 != frame[len-2] || b2 != frame[len-1]) {

212 crc = "**FAIL CRC**";

213 } else {

214 crc = "";

215 }

216 } else {

217 crc = "(SHORT)";

218 }

219

220 char metricString[100];

221 if(isResponse) {

       sprintf(metricString, "%3d", metric);

223 } else {

       strcpy(metricString, "   ");

225 }

226

227 PrintAndLog(" +%7d: %s: %s %s %s",

       (prev < 0 ? 0 : timestamp - prev),

229 metricString,

       (isResponse ? "TAG" : "   "), line, crc);

231

232 prev = timestamp;

233 i += (len + 9);

234 }

235 free(got);

236 return 0;

237 }

238

 int CmdHF14BRead(const char *Cmd)

240 {

   UsbCommand c = {CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443, {strtol(Cmd, NULL, 0), 0, 0}};

242 SendCommand(&c);

243 return 0;

244 }

245

 int CmdHF14Sim(const char *Cmd)

247 {

248 UsbCommand c={CMD_SIMULATE_TAG_ISO_14443};

249 SendCommand(&c);

250 return 0;

251 }

252

 int CmdHFSimlisten(const char *Cmd)

254 {

255 UsbCommand c = {CMD_SIMULATE_TAG_HF_LISTEN};

256 SendCommand(&c);

257 return 0;

258 }

259

 int CmdHF14BSnoop(const char *Cmd)

261 {

262 UsbCommand c = {CMD_SNOOP_ISO_14443};

263 SendCommand(&c);

264 return 0;

265 }

266

267 /* New command to read the contents of a SRI512 tag

268 * SRI512 tags are ISO14443-B modulated memory tags,

269 * this command just dumps the contents of the memory

270 */

 int CmdSri512Read(const char *Cmd)

272 {

   UsbCommand c = {CMD_READ_SRI512_TAG, {strtol(Cmd, NULL, 0), 0, 0}};

274 SendCommand(&c);

275 return 0;

276 }

277

278 /* New command to read the contents of a SRIX4K tag

279 * SRIX4K tags are ISO14443-B modulated memory tags,

280 * this command just dumps the contents of the memory/

281 */

 int CmdSrix4kRead(const char *Cmd)

283 {

   UsbCommand c = {CMD_READ_SRIX4K_TAG, {strtol(Cmd, NULL, 0), 0, 0}};

285 SendCommand(&c);

286 return 0;

287 }

288

 int CmdHF14BCmdRaw (const char *cmd) {

290 UsbCommand resp;

291 uint8_t *recv;

     UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; // len,recv?

293 uint8_t reply=1;

294 uint8_t crc=0;

295 uint8_t power=0;

     char buf[5]="";

297 int i=0;

     uint8_t data[100] = {0x00};

     unsigned int datalen=0, temp;

300 char *hexout;

301

     if (strlen(cmd)<3) {

303 PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] <0A 0B 0C ... hex>");

304 PrintAndLog(" -r do not read response");

305 PrintAndLog(" -c calculate and append CRC");

306 PrintAndLog(" -p leave the field on after receive");

307 return 0;

308 }

309

310 // strip

     while (*cmd==' ' || *cmd=='\t') cmd++;

312

     while (cmd[i]!='\0') {

         if (cmd[i]==' ' || cmd[i]=='\t') { i++; continue; }

         if (cmd[i]=='-') {

             switch (cmd[i+1]) {

317 case 'r':

318 case 'R':

319 reply=0;

320 break;

321 case 'c':

322 case 'C':

323 crc=1;

324 break;

325 case 'p':

326 case 'P':

327 power=1;

328 break;

329 default:

330 PrintAndLog("Invalid option");

331 return 0;

332 }

333 i+=2;

334 continue;

335 }

         if ((cmd[i]>='0' && cmd[i]<='9') ||

             (cmd[i]>='a' && cmd[i]<='f') ||

             (cmd[i]>='A' && cmd[i]<='F') ) {

             buf[strlen(buf)+1]=0;

             buf[strlen(buf)]=cmd[i];

341 i++;

342

             if (strlen(buf)>=2) {

                 sscanf(buf,"%x",&temp);

                 data[datalen]=(uint8_t)(temp & 0xff);

346 datalen++;

347 *buf=0;

348 }

349 continue;

350 }

351 PrintAndLog("Invalid char on input");

352 return 1;

353 }

     if (datalen == 0)

355 {

356 PrintAndLog("Missing data input");

357 return 0;

358 }

359 if(crc)

360 {

361 uint8_t first, second;

         ComputeCrc14443(CRC_14443_B, data, datalen, &first, &second);

363 data[datalen++] = first;

364 data[datalen++] = second;

365 }

366

     c.arg[0] = datalen;

     c.arg[1] = reply;

     c.arg[2] = power;

     memcpy(c.d.asBytes,data,datalen);

371

372 SendCommand(&c);

373

374 if (reply) {

         if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {

376 recv = resp.d.asBytes;

             PrintAndLog("received %i octets",resp.arg[0]);

             if(!resp.arg[0])

379 return 0;

             hexout = (char *)malloc(resp.arg[0] * 3 + 1);

381 if (hexout != NULL) {

382 uint8_t first, second;

                 for (int i = 0; i < resp.arg[0]; i++) { // data in hex

                     sprintf(&hexout[i * 3], "%02X ", recv[i]);

385 }

                 PrintAndLog("%s", hexout);

387 free(hexout);

                 ComputeCrc14443(CRC_14443_B, recv, resp.arg[0]-2, &first, &second);

                 if(recv[resp.arg[0]-2]==first && recv[resp.arg[0]-1]==second) {

390 PrintAndLog("CRC OK");

391 } else {

392 PrintAndLog("CRC failed");

393 }

394 } else {

395 PrintAndLog("malloc failed your client has low memory?");

396 }

397 } else {

398 PrintAndLog("timeout while waiting for reply.");

399 }

400 } // if reply

401 return 0;

402 }

403

 int CmdHF14BWrite( const char *Cmd){

405

406 /*

407 * For SRIX4K blocks 00 - 7F

408 * hf 14b raw -c -p 09 $srix4kwblock $srix4kwdata

409 *

410 * For SR512 blocks 00 - 0F

411 * hf 14b raw -c -p 09 $sr512wblock $sr512wdata

412 *

413 * Special block FF = otp_lock_reg block.

414 * Data len 4 bytes-

415 */

         char cmdp = param_getchar(Cmd, 0);

417 uint8_t blockno = -1;

         uint8_t data[4] = {0x00};

419 bool isSrix4k = true;

420 char str[20];

421

         if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') {

423 PrintAndLog("Usage: hf 14b write <1|2> <BLOCK> <DATA>");

424 PrintAndLog(" [1 = SRIX4K]");

425 PrintAndLog(" [2 = SRI512]");

426 PrintAndLog(" [BLOCK number depends on tag, special block == FF]");

427 PrintAndLog(" sample: hf 14b write 1 7F 11223344");

428 PrintAndLog(" : hf 14b write 1 FF 11223344");

429 PrintAndLog(" : hf 14b write 2 15 11223344");

430 PrintAndLog(" : hf 14b write 2 FF 11223344");

431 return 0;

432 }

433

         if ( cmdp == '2' )

435 isSrix4k = false;

436

437 //blockno = param_get8(Cmd, 1);

438

         if ( param_gethex(Cmd,1, &blockno, 2) ) {

440 PrintAndLog("Block number must include 2 HEX symbols");

441 return 0;

442 }

443

444 if ( isSrix4k ){

                 if ( blockno > 0x7f && blockno != 0xff ){

446 PrintAndLog("Block number out of range");

447 return 0;

448 }

449 } else {

                 if ( blockno > 0x0f && blockno != 0xff ){

451 PrintAndLog("Block number out of range");

452 return 0;

453 }

454 }

455

         if (param_gethex(Cmd, 2, data, 8)) {

457 PrintAndLog("Data must include 8 HEX symbols");

458 return 0;

459 }

460

         if ( blockno == 0xff)

                 PrintAndLog("[%s] Write special block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512" , blockno,  sprint_hex(data,4) );

463 else

                 PrintAndLog("[%s] Write block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512", blockno,  sprint_hex(data,4) );

465

         sprintf(str, "-c 09 %02x %02x%02x%02x%02x", blockno, data[0], data[1], data[2], data[3]);

467

468 CmdHF14BCmdRaw(str);

469 return 0;

470 }

471

472 static command_t CommandTable[] =

473 {

   {"help",        CmdHelp,        1, "This help"},

   {"demod",       CmdHF14BDemod,  1, "Demodulate ISO14443 Type B from tag"},

   {"list",        CmdHF14BList,   0, "List ISO 14443 history"},

   {"read",        CmdHF14BRead,   0, "Read HF tag (ISO 14443)"},

   {"sim",         CmdHF14Sim,     0, "Fake ISO 14443 tag"},

   {"simlisten",   CmdHFSimlisten, 0, "Get HF samples as fake tag"},

   {"snoop",       CmdHF14BSnoop,  0, "Eavesdrop ISO 14443"},

   {"sri512read",  CmdSri512Read,  0, "Read contents of a SRI512 tag"},

   {"srix4kread",  CmdSrix4kRead,  0, "Read contents of a SRIX4K tag"},

   {"raw",         CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},

   {"write",       CmdHF14BWrite,  0, "Write data to a SRI512 | SRIX4K tag"},

   {NULL, NULL, 0, NULL}

486 };

487

 int CmdHF14B(const char *Cmd)

489 {

490 CmdsParse(CommandTable, Cmd);

491 return 0;

492 }

493

 int CmdHelp(const char *Cmd)

495 {

496 CmdsHelp(CommandTable);

497 return 0;

498 }