+int CmdEMVScan(const char *cmd) {
+ uint8_t AID[APDU_DATA_LEN] = {0};
+ size_t AIDlen = 0;
+ uint8_t buf[APDU_RESPONSE_LEN] = {0};
+ size_t len = 0;
+ uint16_t sw = 0;
+ int res;
+ json_t *root;
+ json_error_t error;
+
+ CLIParserInit("emv scan",
+ "Scan EMV card and save it contents to a file.",
+ "It executes EMV contactless transaction and saves result to a file which can be used for emulation\n"
+ "Usage:\n\temv scan -at -> scan MSD transaction mode and show APDU and TLV\n"
+ "\temv scan -c -> scan CDA transaction mode\n");
+
+ void* argtable[] = {
+ arg_param_begin,
+ arg_lit0("aA", "apdu", "show APDU reqests and responses."),
+ arg_lit0("tT", "tlv", "TLV decode results."),
+ arg_lit0("eE", "extract", "Extract TLV elements and fill Application Data"),
+ arg_lit0("jJ", "jload", "Load transaction parameters from `emv/defparams.json` file."),
+ arg_rem("By default:", "Transaction type - MSD"),
+ arg_lit0("vV", "qvsdc", "Transaction type - qVSDC or M/Chip."),
+ arg_lit0("cC", "qvsdccda", "Transaction type - qVSDC or M/Chip plus CDA (SDAD generation)."),
+ arg_lit0("xX", "vsdc", "Transaction type - VSDC. For test only. Not a standart behavior."),
+ arg_lit0("gG", "acgpo", "VISA. generate AC from GPO."),
+ arg_lit0("mM", "merge", "Merge output file with card's data. (warning: the file may be corrupted!)"),
+#ifdef WITH_SMARTCARD
+ arg_lit0("wW", "wired", "Send data via contact (iso7816) interface. Contactless interface set by default."),
+#endif
+ arg_str1(NULL, NULL, "output.json", "JSON output file name"),
+ arg_param_end
+ };
+ CLIExecWithReturn(cmd, argtable, true);
+
+ bool showAPDU = arg_get_lit(1);
+ bool decodeTLV = arg_get_lit(2);
+ bool extractTLVElements = arg_get_lit(3);
+ bool paramLoadJSON = arg_get_lit(4);
+
+ enum TransactionType TrType = TT_MSD;
+ if (arg_get_lit(6))
+ TrType = TT_QVSDCMCHIP;
+ if (arg_get_lit(7))
+ TrType = TT_CDA;
+ if (arg_get_lit(8))
+ TrType = TT_VSDC;
+
+ bool GenACGPO = arg_get_lit(9);
+ bool MergeJSON = arg_get_lit(10);
+ EMVCommandChannel channel = ECC_CONTACTLESS;
+ uint8_t relfname[250] = {0};
+ char *crelfname = (char *)relfname;
+ int relfnamelen = 0;
+#ifdef WITH_SMARTCARD
+ if (arg_get_lit(11)) {
+ channel = ECC_CONTACT;
+ }
+ CLIGetStrWithReturn(12, relfname, &relfnamelen);
+#else
+ CLIGetStrWithReturn(11, relfname, &relfnamelen);
+#endif
+ uint8_t psenum = (channel == ECC_CONTACT) ? 1 : 2;
+ CLIParserFree();
+
+ SetAPDULogging(showAPDU);
+
+ // TODO
+ if (channel == ECC_CONTACT) {
+ PrintAndLogEx(ERR, "Do not use contact interface. Exit.");
+ return 1;
+ }
+
+ // current path + file name
+ if (!strstr(crelfname, ".json"))
+ strcat(crelfname, ".json");
+ char fname[strlen(get_my_executable_directory()) + strlen(crelfname) + 1];
+ strcpy(fname, get_my_executable_directory());
+ strcat(fname, crelfname);
+
+ if (MergeJSON) {
+ root = json_load_file(fname, 0, &error);
+ if (!root) {
+ PrintAndLogEx(ERR, "json error on line %d: %s", error.line, error.text);
+ return 1;
+ }
+
+ if (!json_is_object(root)) {
+ PrintAndLogEx(ERR, "Invalid json format. root must be an object.");
+ return 1;
+ }
+ } else {
+ root = json_object();
+ }
+
+ // drop field at start
+ if (channel == ECC_CONTACTLESS) {
+ DropField();
+ }
+
+ // iso 14443 select
+ PrintAndLogEx(NORMAL, "--> GET UID, ATS.");
+
+ iso14a_card_select_t card;
+ if (Hf14443_4aGetCardData(&card)) {
+ return 2;
+ }
+
+ JsonSaveStr(root, "$.File.Created", "proxmark3 `emv scan`");
+
+ JsonSaveStr(root, "$.Card.Communication", "iso14443-4a");
+ JsonSaveBufAsHex(root, "$.Card.UID", (uint8_t *)&card.uid, card.uidlen);
+ JsonSaveHex(root, "$.Card.ATQA", card.atqa[0] + (card.atqa[1] << 2), 2);
+ JsonSaveHex(root, "$.Card.SAK", card.sak, 0);
+ JsonSaveBufAsHex(root, "$.Card.ATS", (uint8_t *)card.ats, card.ats_len);
+
+ // init applets list tree
+ const char *al = "Applets list";
+ struct tlvdb *tlvSelect = tlvdb_fixed(1, strlen(al), (const unsigned char *)al);
+
+ // EMV PPSE
+ PrintAndLogEx(NORMAL, "--> PPSE.");
+ res = EMVSelectPSE(channel, true, true, 2, buf, sizeof(buf), &len, &sw);
+
+ if (!res && sw == 0x9000){
+ if (decodeTLV)
+ TLVPrintFromBuffer(buf, len);
+
+ JsonSaveBufAsHex(root, "$.PPSE.AID", (uint8_t *)"2PAY.SYS.DDF01", 14);
+
+ struct tlvdb *fci = tlvdb_parse_multi(buf, len);
+ if (extractTLVElements)
+ JsonSaveTLVTree(root, root, "$.PPSE.FCITemplate", fci);
+ else
+ JsonSaveTLVTreeElm(root, "$.PPSE.FCITemplate", fci, true, true, false);
+ JsonSaveTLVValue(root, "$.Application.KernelID", tlvdb_find_full(fci, 0x9f2a));
+ tlvdb_free(fci);
+ }
+
+ res = EMVSearchPSE(channel, false, true, psenum, decodeTLV, tlvSelect);
+
+ // check PPSE and select application id
+ if (!res) {
+ TLVPrintAIDlistFromSelectTLV(tlvSelect);
+ } else {
+ // EMV SEARCH with AID list
+ SetAPDULogging(false);
+ PrintAndLogEx(NORMAL, "--> AID search.");
+ if (EMVSearch(channel, false, true, decodeTLV, tlvSelect)) {
+ PrintAndLogEx(ERR, "Can't found any of EMV AID. Exit...");
+ tlvdb_free(tlvSelect);
+ DropField();
+ return 3;
+ }
+
+ // check search and select application id
+ TLVPrintAIDlistFromSelectTLV(tlvSelect);
+ }
+
+ // EMV SELECT application
+ SetAPDULogging(showAPDU);
+ EMVSelectApplication(tlvSelect, AID, &AIDlen);
+
+ tlvdb_free(tlvSelect);
+
+ if (!AIDlen) {
+ PrintAndLogEx(INFO, "Can't select AID. EMV AID not found. Exit...");
+ if (channel == ECC_CONTACTLESS) {
+ DropField();
+ }
+ return 4;
+ }
+
+ JsonSaveBufAsHex(root, "$.Application.AID", AID, AIDlen);
+
+ // Init TLV tree
+ const char *alr = "Root terminal TLV tree";
+ struct tlvdb *tlvRoot = tlvdb_fixed(1, strlen(alr), (const unsigned char *)alr);
+
+ // EMV SELECT applet
+
+ PrintAndLogEx(NORMAL, "\n-->Selecting AID:%s.", sprint_hex_inrow(AID, AIDlen));
+ SetAPDULogging(showAPDU);
+ res = EMVSelect(channel, false, true, AID, AIDlen, buf, sizeof(buf), &len, &sw, tlvRoot);
+
+ if (res) {
+ PrintAndLogEx(ERR, "Can't select AID (%d). Exit...", res);
+ tlvdb_free(tlvRoot);
+ DropField();
+ return 5;
+ }
+
+ if (decodeTLV)
+ TLVPrintFromBuffer(buf, len);
+
+ // save mode
+ if (tlvdb_get(tlvRoot, 0x9f38, NULL)) {
+ JsonSaveStr(root, "$.Application.Mode", TransactionTypeStr[TrType]);
+ }