]>
Commit | Line | Data |
---|---|---|
a553f267 | 1 | //----------------------------------------------------------------------------- |
2 | // Copyright (C) 2010 iZsh <izsh at fail0verflow.com> | |
0546b4aa | 3 | // Modified 2010-2012 by <adrian -at- atrox.at> |
65a23af2 | 4 | // Modified 2012 by <vsza at vsza.hu> |
a553f267 | 5 | // |
6 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
7 | // at your option, any later version. See the LICENSE.txt file for the text of | |
8 | // the license. | |
9 | //----------------------------------------------------------------------------- | |
10 | // High frequency ISO15693 commands | |
11 | //----------------------------------------------------------------------------- | |
9455b51c | 12 | // There are three basic operation modes, depending on which device (proxmark/pc) |
13 | // the signal processing, (de)modulation, transmission protocol and logic is done. | |
14 | // Mode 1: | |
15 | // All steps are done on the proxmark, the output of the commands is returned via | |
16 | // USB-debug-print commands. | |
17 | // Mode 2: | |
18 | // The protocol is done on the PC, passing only Iso15693 data frames via USB. This | |
19 | // allows direct communication with a tag on command level | |
20 | // Mode 3: | |
21 | // The proxmark just samples the antenna and passes this "analog" data via USB to | |
22 | // the client. Signal Processing & decoding is done on the pc. This is the slowest | |
23 | // variant, but offers the possibility to analyze the waveforms directly. | |
a553f267 | 24 | |
7fe9b0b7 | 25 | #include <stdio.h> |
26 | #include <stdlib.h> | |
27 | #include <string.h> | |
28 | #include <stdint.h> | |
3fe4ff4f | 29 | |
902cb3c0 | 30 | #include "proxmark3.h" |
7fe9b0b7 | 31 | #include "data.h" |
32 | #include "graph.h" | |
33 | #include "ui.h" | |
3fe4ff4f | 34 | #include "util.h" |
7fe9b0b7 | 35 | #include "cmdparser.h" |
36 | #include "cmdhf15.h" | |
9455b51c | 37 | #include "iso15693tools.h" |
38 | #include "cmdmain.h" | |
39 | ||
40 | #define FrameSOF Iso15693FrameSOF | |
41 | #define Logic0 Iso15693Logic0 | |
42 | #define Logic1 Iso15693Logic1 | |
43 | #define FrameEOF Iso15693FrameEOF | |
44 | ||
45 | #define Crc(data,datalen) Iso15693Crc(data,datalen) | |
46 | #define AddCrc(data,datalen) Iso15693AddCrc(data,datalen) | |
47 | #define sprintUID(target,uid) Iso15693sprintUID(target,uid) | |
7fe9b0b7 | 48 | |
9455b51c | 49 | // structure and database for uid -> tagtype lookups |
50 | typedef struct { | |
51 | uint64_t uid; | |
52 | int mask; // how many MSB bits used | |
53 | char* desc; | |
54 | } productName; | |
55 | ||
56 | ||
57 | const productName uidmapping[] = { | |
52ab55ab | 58 | |
0546b4aa | 59 | // UID, #significant Bits, "Vendor(+Product)" |
52ab55ab | 60 | { 0xE001000000000000LL, 16, "Motorola UK" }, |
61 | ||
62 | // E0 02 xx | |
63 | // 02 = ST Microelectronics | |
64 | // XX = IC id (Chip ID Family) | |
65 | { 0xE002000000000000LL, 16, "ST Microelectronics SA France" }, | |
66 | { 0xE002050000000000LL, 24, "ST Microelectronics; LRI64 [IC id = 05]"}, | |
67 | { 0xE002080000000000LL, 24, "ST Microelectronics; LRI2K [IC id = 08]"}, | |
68 | { 0xE0020A0000000000LL, 24, "ST Microelectronics; LRIS2K [IC id = 10]"}, | |
69 | { 0xE002440000000000LL, 24, "ST Microelectronics; LRIS64K [IC id = 68]"}, | |
70 | ||
71 | { 0xE003000000000000LL, 16, "Hitachi, Ltd Japan" }, | |
72 | ||
73 | // E0 04 xx | |
74 | // 04 = Manufacturer code (Philips/NXP) | |
75 | // XX = IC id (Chip ID Family) | |
76 | //I-Code SLI SL2 ICS20 [IC id = 01] | |
77 | //I-Code SLI-S [IC id = 02] | |
78 | //I-Code SLI-L [IC id = 03] | |
79 | //I-Code SLIX [IC id = 01 + bit36 set to 1 (starting from bit0 - different from normal SLI)] | |
80 | //I-Code SLIX-S [IC id = 02 + bit36 set to 1] | |
81 | //I-Code SLIX-L [IC id = 03 + bit36 set to 1] | |
82 | { 0xE004000000000000LL, 16, "NXP Semiconductors Germany (Philips)" }, | |
3fe4ff4f | 83 | { 0xE004010000000000LL, 24, "NXP(Philips); IC SL2 ICS20/ICS21(SLI) ICS2002/ICS2102(SLIX)" }, |
84 | { 0xE004020000000000LL, 24, "NXP(Philips); IC SL2 ICS53/ICS54(SLI-S) ICS5302/ICS5402(SLIX-S)" }, | |
85 | { 0xE004030000000000LL, 24, "NXP(Philips); IC SL2 ICS50/ICS51(SLI-L) ICS5002/ICS5102(SLIX-L)" }, | |
52ab55ab | 86 | |
87 | // E0 05 XX .. .. .. | |
88 | // 05 = Manufacturer code (Infineon) | |
89 | // XX = IC id (Chip ID Family) | |
90 | { 0xE005000000000000LL, 16, "Infineon Technologies AG Germany" }, | |
91 | { 0xE005A10000000000LL, 24, "Infineon; SRF55V01P [IC id = 161] plain mode 1kBit"}, | |
92 | { 0xE005A80000000000LL, 24, "Infineon; SRF55V01P [IC id = 168] pilot series 1kBit"}, | |
93 | { 0xE005400000000000LL, 24, "Infineon; SRF55V02P [IC id = 64] plain mode 2kBit"}, | |
94 | { 0xE005000000000000LL, 24, "Infineon; SRF55V10P [IC id = 00] plain mode 10KBit"}, | |
95 | { 0xE005500000000000LL, 24, "Infineon; SRF55V02S [IC id = 80] secure mode 2kBit"}, | |
96 | { 0xE005100000000000LL, 24, "Infineon; SRF55V10S [IC id = 16] secure mode 10KBit"}, | |
97 | { 0xE0051E0000000000LL, 23, "Infineon; SLE66r01P [IC id = 3x = My-d Move or My-d move NFC]"}, | |
98 | { 0xE005200000000000LL, 21, "Infineon; SLE66r01P [IC id = 3x = My-d Move or My-d move NFC]"}, | |
99 | ||
100 | { 0xE006000000000000LL, 16, "Cylink USA" }, | |
101 | ||
102 | ||
103 | // E0 07 xx | |
104 | // 07 = Texas Instruments | |
105 | // XX = from bit 41 to bit 43 = product configuration - from bit 44 to bit 47 IC id (Chip ID Family) | |
106 | //Tag IT RFIDType-I Plus, 2kBit, TI Inlay | |
107 | //Tag-it HF-I Plus Inlay [IC id = 00] -> b'0000 000 2kBit | |
108 | //Tag-it HF-I Plus Chip [IC id = 64] -> b'1000 000 2kBit | |
109 | //Tag-it HF-I Standard Chip / Inlays [IC id = 96] -> b'1100 000 256Bit | |
110 | //Tag-it HF-I Pro Chip / Inlays [IC id = 98] -> b'1100 010 256Bit, Password protection | |
111 | { 0xE007000000000000LL, 16, "Texas Instrument France" }, | |
9455b51c | 112 | { 0xE007000000000000LL, 20, "Texas Instrument; Tag-it HF-I Plus Inlay; 64x32bit" }, |
113 | { 0xE007100000000000LL, 20, "Texas Instrument; Tag-it HF-I Plus Chip; 64x32bit" }, | |
0546b4aa | 114 | { 0xE007800000000000LL, 23, "Texas Instrument; Tag-it HF-I Plus (RF-HDT-DVBB tag or Third Party Products)" }, |
9455b51c | 115 | { 0xE007C00000000000LL, 23, "Texas Instrument; Tag-it HF-I Standard; 8x32bit" }, |
116 | { 0xE007C40000000000LL, 23, "Texas Instrument; Tag-it HF-I Pro; 8x23bit; password" }, | |
52ab55ab | 117 | |
118 | { 0xE008000000000000LL, 16, "Fujitsu Limited Japan" }, | |
119 | { 0xE009000000000000LL, 16, "Matsushita Electronics Corporation, Semiconductor Company Japan" }, | |
120 | { 0xE00A000000000000LL, 16, "NEC Japan" }, | |
121 | { 0xE00B000000000000LL, 16, "Oki Electric Industry Co. Ltd Japan" }, | |
122 | { 0xE00C000000000000LL, 16, "Toshiba Corp. Japan" }, | |
123 | { 0xE00D000000000000LL, 16, "Mitsubishi Electric Corp. Japan" }, | |
124 | { 0xE00E000000000000LL, 16, "Samsung Electronics Co. Ltd Korea" }, | |
125 | { 0xE00F000000000000LL, 16, "Hynix / Hyundai, Korea" }, | |
126 | { 0xE010000000000000LL, 16, "LG-Semiconductors Co. Ltd Korea" }, | |
127 | { 0xE011000000000000LL, 16, "Emosyn-EM Microelectronics USA" }, | |
128 | ||
c71e7235 | 129 | { 0xE012000000000000LL, 16, "HID Corporation" }, |
52ab55ab | 130 | { 0xE012000000000000LL, 16, "INSIDE Technology France" }, |
131 | { 0xE013000000000000LL, 16, "ORGA Kartensysteme GmbH Germany" }, | |
132 | { 0xE014000000000000LL, 16, "SHARP Corporation Japan" }, | |
133 | { 0xE015000000000000LL, 16, "ATMEL France" }, | |
134 | ||
0853ffa2 | 135 | { 0xE016000000000000LL, 16, "EM Microelectronic-Marin SA Switzerland (Skidata)"}, |
136 | { 0xE016040000000000LL, 24, "EM-Marin SA (Skidata Keycard-eco); EM4034 [IC id = 01] (Read/Write - no AFI)"}, | |
137 | { 0xE0160C0000000000LL, 24, "EM-Marin SA (Skidata); EM4035 [IC id = 03] (Read/Write - replaced by 4233)"}, | |
138 | { 0xE016100000000000LL, 24, "EM-Marin SA (Skidata); EM4135 [IC id = 04] (Read/Write - replaced by 4233) 36x64bit start page 13"}, | |
139 | { 0xE016140000000000LL, 24, "EM-Marin SA (Skidata); EM4036 [IC id = 05] 28pF"}, | |
140 | { 0xE016180000000000LL, 24, "EM-Marin SA (Skidata); EM4006 [IC id = 06] (Read Only)"}, | |
141 | { 0xE0161C0000000000LL, 24, "EM-Marin SA (Skidata); EM4133 [IC id = 07] 23,5pF (Read/Write)"}, | |
142 | { 0xE016200000000000LL, 24, "EM-Marin SA (Skidata); EM4033 [IC id = 08] 23,5pF (Read Only - no AFI / no DSFID / no security blocks)"}, | |
143 | { 0xE016240000000000LL, 24, "EM-Marin SA (Skidata); EM4233 [IC id = 09] 23,5pF CustomerID-102"}, | |
144 | { 0xE016280000000000LL, 24, "EM-Marin SA (Skidata); EM4233 SLIC [IC id = 10] 23,5pF (1Kb flash memory - not provide High Security mode and QuietStorage feature)" }, | |
145 | { 0xE0163C0000000000LL, 24, "EM-Marin SA (Skidata); EM4237 [IC id = 15] 23,5pF"}, | |
146 | { 0xE0167C0000000000LL, 24, "EM-Marin SA (Skidata); EM4233 [IC id = 31] 95pF"}, | |
147 | { 0xE016940000000000LL, 24, "EM-Marin SA (Skidata); EM4036 [IC id = 37] 95pF 51x64bit "}, | |
148 | { 0xE0169c0000000000LL, 24, "EM-Marin SA (Skidata); EM4133 [IC id = 39] 95pF (Read/Write)" }, | |
149 | { 0xE016A80000000000LL, 24, "EM-Marin SA (Skidata); EM4233 SLIC [IC id = 42] 97pF" }, | |
150 | { 0xE016BC0000000000LL, 24, "EM-Marin SA (Skidata); EM4237 [IC id = 47] 97pF" }, | |
151 | ||
52ab55ab | 152 | { 0xE017000000000000LL, 16, "KSW Microtec GmbH Germany" }, |
153 | { 0xE018000000000000LL, 16, "ZMD AG Germany" }, | |
154 | { 0xE019000000000000LL, 16, "XICOR, Inc. USA" }, | |
155 | { 0xE01A000000000000LL, 16, "Sony Corporation Japan Identifier Company Country" }, | |
156 | { 0xE01B000000000000LL, 16, "Malaysia Microelectronic Solutions Sdn. Bhd Malaysia" }, | |
157 | { 0xE01C000000000000LL, 16, "Emosyn USA" }, | |
158 | { 0xE01D000000000000LL, 16, "Shanghai Fudan Microelectronics Co. Ltd. P.R. China" }, | |
159 | { 0xE01E000000000000LL, 16, "Magellan Technology Pty Limited Australia" }, | |
160 | { 0xE01F000000000000LL, 16, "Melexis NV BO Switzerland" }, | |
161 | { 0xE020000000000000LL, 16, "Renesas Technology Corp. Japan" }, | |
162 | { 0xE021000000000000LL, 16, "TAGSYS France" }, | |
163 | { 0xE022000000000000LL, 16, "Transcore USA" }, | |
164 | { 0xE023000000000000LL, 16, "Shanghai belling corp., ltd. China" }, | |
165 | { 0xE024000000000000LL, 16, "Masktech Germany Gmbh Germany" }, | |
166 | { 0xE025000000000000LL, 16, "Innovision Research and Technology Plc UK" }, | |
167 | { 0xE026000000000000LL, 16, "Hitachi ULSI Systems Co., Ltd. Japan" }, | |
168 | { 0xE027000000000000LL, 16, "Cypak AB Sweden" }, | |
169 | { 0xE028000000000000LL, 16, "Ricoh Japan" }, | |
170 | { 0xE029000000000000LL, 16, "ASK France" }, | |
171 | { 0xE02A000000000000LL, 16, "Unicore Microsystems, LLC Russian Federation" }, | |
172 | { 0xE02B000000000000LL, 16, "Dallas Semiconductor/Maxim USA" }, | |
173 | { 0xE02C000000000000LL, 16, "Impinj, Inc. USA" }, | |
174 | { 0xE02D000000000000LL, 16, "RightPlug Alliance USA" }, | |
175 | { 0xE02E000000000000LL, 16, "Broadcom Corporation USA" }, | |
176 | { 0xE02F000000000000LL, 16, "MStar Semiconductor, Inc Taiwan, ROC" }, | |
177 | { 0xE030000000000000LL, 16, "BeeDar Technology Inc. USA" }, | |
178 | { 0xE031000000000000LL, 16, " RFIDsec Denmark" }, | |
179 | { 0xE032000000000000LL, 16, " Schweizer Electronic AG Germany" }, | |
180 | { 0xE033000000000000LL, 16, " AMIC Technology Corp Taiwan" }, | |
181 | { 0xE034000000000000LL, 16, "Mikron JSC Russia" }, | |
182 | { 0xE035000000000000LL, 16, "Fraunhofer Institute for Photonic Microsystems Germany" }, | |
183 | { 0xE036000000000000LL, 16, "IDS Microchip AG Switzerland" }, | |
184 | { 0xE037000000000000LL, 16, "Kovio USA" }, | |
185 | { 0xE038000000000000LL, 16, "HMT Microelectronic Ltd Switzerland Identifier Company Country" }, | |
186 | { 0xE039000000000000LL, 16, "Silicon Craft Technology Thailand" }, | |
187 | { 0xE03A000000000000LL, 16, "Advanced Film Device Inc. Japan" }, | |
188 | { 0xE03B000000000000LL, 16, "Nitecrest Ltd UK" }, | |
189 | { 0xE03C000000000000LL, 16, "Verayo Inc. USA" }, | |
190 | { 0xE03D000000000000LL, 16, "HID Global USA" }, | |
191 | { 0xE03E000000000000LL, 16, "Productivity Engineering Gmbh Germany" }, | |
192 | { 0xE03F000000000000LL, 16, "Austriamicrosystems AG (reserved) Austria" }, | |
193 | { 0xE040000000000000LL, 16, "Gemalto SA France" }, | |
194 | { 0xE041000000000000LL, 16, "Renesas Electronics Corporation Japan" }, | |
195 | { 0xE042000000000000LL, 16, "3Alogics Inc Korea" }, | |
196 | { 0xE043000000000000LL, 16, "Top TroniQ Asia Limited Hong Kong" }, | |
197 | { 0xE044000000000000LL, 16, "Gentag Inc (USA) USA" }, | |
9455b51c | 198 | { 0,0,"no tag-info available" } // must be the last entry |
199 | }; | |
200 | ||
201 | ||
e4da8ed0 | 202 | // fast method to just read the UID of a tag (collission detection not supported) |
203 | // *buf should be large enough to fit the 64bit uid | |
9455b51c | 204 | // returns 1 if suceeded |
205 | int getUID(uint8_t *buf) | |
7fe9b0b7 | 206 | { |
902cb3c0 | 207 | UsbCommand resp; |
9455b51c | 208 | uint8_t *recv; |
209 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? | |
210 | uint8_t *req=c.d.asBytes; | |
211 | int reqlen=0; | |
212 | ||
213 | for (int retry=0;retry<3; retry++) { // don't give up the at the first try | |
214 | ||
215 | req[0]= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | | |
216 | ISO15_REQ_INVENTORY | ISO15_REQINV_SLOT1; | |
217 | req[1]=ISO15_CMD_INVENTORY; | |
218 | req[2]=0; // mask length | |
219 | reqlen=AddCrc(req,3); | |
220 | c.arg[0]=reqlen; | |
221 | ||
222 | SendCommand(&c); | |
223 | ||
902cb3c0 | 224 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) { |
225 | recv = resp.d.asBytes; | |
226 | if (resp.arg[0]>=12 && ISO15_CRC_CHECK==Crc(recv,12)) { | |
9455b51c | 227 | memcpy(buf,&recv[2],8); |
228 | return 1; | |
229 | } | |
230 | } | |
231 | } // retry | |
232 | return 0; | |
233 | } | |
234 | ||
235 | ||
7fe9b0b7 | 236 | |
9455b51c | 237 | // get a product description based on the UID |
238 | // uid[8] tag uid | |
239 | // returns description of the best match | |
240 | static char* getTagInfo(uint8_t *uid) { | |
31b6e9af | 241 | uint64_t myuid,mask; |
9455b51c | 242 | int i=0, best=-1; |
243 | memcpy(&myuid,uid,sizeof(uint64_t)); | |
244 | while (uidmapping[i].mask>0) { | |
245 | mask=(~0LL) <<(64-uidmapping[i].mask); | |
246 | if ((myuid & mask) == uidmapping[i].uid) { | |
247 | if (best==-1) { | |
248 | best=i; | |
249 | } else { | |
250 | if (uidmapping[i].mask>uidmapping[best].mask) { | |
251 | best=i; | |
252 | } | |
253 | } | |
254 | } | |
255 | i++; | |
256 | } | |
7fe9b0b7 | 257 | |
9455b51c | 258 | if (best>=0) return uidmapping[best].desc; |
259 | ||
260 | return uidmapping[i].desc; | |
7fe9b0b7 | 261 | } |
262 | ||
9455b51c | 263 | |
b4a9d841 | 264 | // return a clear-text message to an errorcode |
9455b51c | 265 | static char* TagErrorStr(uint8_t error) { |
b4a9d841 | 266 | switch (error) { |
267 | case 0x01: return "The command is not supported"; | |
268 | case 0x02: return "The command is not recognised"; | |
269 | case 0x03: return "The option is not supported."; | |
270 | case 0x0f: return "Unknown error."; | |
271 | case 0x10: return "The specified block is not available (doesn’t exist)."; | |
272 | case 0x11: return "The specified block is already -locked and thus cannot be locked again"; | |
273 | case 0x12: return "The specified block is locked and its content cannot be changed."; | |
274 | case 0x13: return "The specified block was not successfully programmed."; | |
275 | case 0x14: return "The specified block was not successfully locked."; | |
276 | default: return "Reserved for Future Use or Custom command error."; | |
277 | } | |
9455b51c | 278 | } |
279 | ||
280 | ||
281 | // Mode 3 | |
7fe9b0b7 | 282 | int CmdHF15Demod(const char *Cmd) |
283 | { | |
9455b51c | 284 | // The sampling rate is 106.353 ksps/s, for T = 18.8 us |
285 | ||
286 | int i, j; | |
287 | int max = 0, maxPos = 0; | |
288 | ||
289 | int skip = 4; | |
290 | ||
291 | if (GraphTraceLen < 1000) return 0; | |
292 | ||
293 | // First, correlate for SOF | |
294 | for (i = 0; i < 100; i++) { | |
295 | int corr = 0; | |
296 | for (j = 0; j < arraylen(FrameSOF); j += skip) { | |
297 | corr += FrameSOF[j] * GraphBuffer[i + (j / skip)]; | |
298 | } | |
299 | if (corr > max) { | |
300 | max = corr; | |
301 | maxPos = i; | |
302 | } | |
303 | } | |
304 | PrintAndLog("SOF at %d, correlation %d", maxPos, | |
305 | max / (arraylen(FrameSOF) / skip)); | |
306 | ||
307 | i = maxPos + arraylen(FrameSOF) / skip; | |
308 | int k = 0; | |
309 | uint8_t outBuf[20]; | |
310 | memset(outBuf, 0, sizeof(outBuf)); | |
311 | uint8_t mask = 0x01; | |
312 | for (;;) { | |
313 | int corr0 = 0, corr1 = 0, corrEOF = 0; | |
314 | for (j = 0; j < arraylen(Logic0); j += skip) { | |
315 | corr0 += Logic0[j] * GraphBuffer[i + (j / skip)]; | |
316 | } | |
317 | for (j = 0; j < arraylen(Logic1); j += skip) { | |
318 | corr1 += Logic1[j] * GraphBuffer[i + (j / skip)]; | |
319 | } | |
320 | for (j = 0; j < arraylen(FrameEOF); j += skip) { | |
321 | corrEOF += FrameEOF[j] * GraphBuffer[i + (j / skip)]; | |
322 | } | |
323 | // Even things out by the length of the target waveform. | |
324 | corr0 *= 4; | |
325 | corr1 *= 4; | |
326 | ||
327 | if (corrEOF > corr1 && corrEOF > corr0) { | |
328 | PrintAndLog("EOF at %d", i); | |
329 | break; | |
330 | } else if (corr1 > corr0) { | |
331 | i += arraylen(Logic1) / skip; | |
332 | outBuf[k] |= mask; | |
333 | } else { | |
334 | i += arraylen(Logic0) / skip; | |
335 | } | |
336 | mask <<= 1; | |
337 | if (mask == 0) { | |
338 | k++; | |
339 | mask = 0x01; | |
340 | } | |
341 | if ((i + (int)arraylen(FrameEOF)) >= GraphTraceLen) { | |
342 | PrintAndLog("ran off end!"); | |
343 | break; | |
344 | } | |
345 | } | |
346 | if (mask != 0x01) { | |
347 | PrintAndLog("error, uneven octet! (discard extra bits!)"); | |
348 | PrintAndLog(" mask=%02x", mask); | |
349 | } | |
350 | PrintAndLog("%d octets", k); | |
351 | ||
352 | for (i = 0; i < k; i++) { | |
353 | PrintAndLog("# %2d: %02x ", i, outBuf[i]); | |
354 | } | |
355 | PrintAndLog("CRC=%04x", Iso15693Crc(outBuf, k - 2)); | |
356 | return 0; | |
7fe9b0b7 | 357 | } |
358 | ||
9455b51c | 359 | |
360 | ||
361 | // * Acquire Samples as Reader (enables carrier, sends inquiry) | |
7fe9b0b7 | 362 | int CmdHF15Read(const char *Cmd) |
363 | { | |
9455b51c | 364 | UsbCommand c = {CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693}; |
365 | SendCommand(&c); | |
366 | return 0; | |
367 | } | |
368 | ||
369 | // Record Activity without enabeling carrier | |
370 | int CmdHF15Record(const char *Cmd) | |
371 | { | |
372 | UsbCommand c = {CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693}; | |
373 | SendCommand(&c); | |
374 | return 0; | |
7fe9b0b7 | 375 | } |
376 | ||
6ce0e538 | 377 | int HF15Reader(const char *Cmd, bool verbose) |
378 | { | |
379 | uint8_t uid[8]; | |
380 | ||
381 | if (!getUID(uid)) { | |
382 | if (verbose) PrintAndLog("No Tag found."); | |
383 | return 0; | |
384 | } | |
385 | ||
386 | PrintAndLog("Tag UID : %s",sprintUID(NULL,uid)); | |
387 | PrintAndLog("Tag Info: %s",getTagInfo(uid)); | |
388 | return 1; | |
389 | } | |
390 | ||
7fe9b0b7 | 391 | int CmdHF15Reader(const char *Cmd) |
392 | { | |
9455b51c | 393 | UsbCommand c = {CMD_READER_ISO_15693, {strtol(Cmd, NULL, 0), 0, 0}}; |
394 | SendCommand(&c); | |
395 | return 0; | |
7fe9b0b7 | 396 | } |
397 | ||
9455b51c | 398 | // Simulation is still not working very good |
7fe9b0b7 | 399 | int CmdHF15Sim(const char *Cmd) |
400 | { | |
3fe4ff4f | 401 | char cmdp = param_getchar(Cmd, 0); |
402 | uint8_t uid[8] = {0x00}; | |
403 | ||
404 | //E0 16 24 00 00 00 00 00 | |
405 | if (cmdp == 'h' || cmdp == 'H') { | |
406 | PrintAndLog("Usage: hf 15 sim <UID>"); | |
407 | PrintAndLog(""); | |
408 | PrintAndLog(" sample: hf 15 sim E016240000000000"); | |
409 | return 0; | |
410 | } | |
411 | ||
412 | if (param_gethex(Cmd, 0, uid, 16)) { | |
413 | PrintAndLog("UID must include 16 HEX symbols"); | |
414 | return 0; | |
415 | } | |
416 | ||
417 | PrintAndLog("Starting simulating UID %02X %02X %02X %02X %02X %02X %02X %02X", | |
418 | uid[0],uid[1],uid[2],uid[3],uid[4], uid[5], uid[6], uid[7]); | |
419 | ||
420 | UsbCommand c = {CMD_SIMTAG_ISO_15693, {0, 0, 0}}; | |
421 | memcpy(c.d.asBytes,uid,8); | |
422 | ||
9455b51c | 423 | SendCommand(&c); |
424 | return 0; | |
7fe9b0b7 | 425 | } |
426 | ||
9455b51c | 427 | // finds the AFI (Application Family Idendifier) of a card, by trying all values |
428 | // (There is no standard way of reading the AFI, allthough some tags support this) | |
429 | int CmdHF15Afi(const char *Cmd) | |
7fe9b0b7 | 430 | { |
9455b51c | 431 | UsbCommand c = {CMD_ISO_15693_FIND_AFI, {strtol(Cmd, NULL, 0), 0, 0}}; |
432 | SendCommand(&c); | |
433 | return 0; | |
434 | } | |
435 | ||
436 | // Reads all memory pages | |
437 | int CmdHF15DumpMem(const char*Cmd) { | |
902cb3c0 | 438 | UsbCommand resp; |
9455b51c | 439 | uint8_t uid[8]; |
440 | uint8_t *recv=NULL; | |
441 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? | |
442 | uint8_t *req=c.d.asBytes; | |
443 | int reqlen=0; | |
444 | int blocknum=0; | |
445 | char output[80]; | |
446 | ||
447 | if (!getUID(uid)) { | |
448 | PrintAndLog("No Tag found."); | |
449 | return 0; | |
450 | } | |
451 | ||
452 | PrintAndLog("Reading memory from tag UID=%s",sprintUID(NULL,uid)); | |
453 | PrintAndLog("Tag Info: %s",getTagInfo(uid)); | |
454 | ||
455 | for (int retry=0; retry<5; retry++) { | |
456 | ||
457 | req[0]= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | | |
458 | ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS; | |
459 | req[1]=ISO15_CMD_READ; | |
460 | memcpy(&req[2],uid,8); | |
461 | req[10]=blocknum; | |
462 | reqlen=AddCrc(req,11); | |
463 | c.arg[0]=reqlen; | |
464 | ||
465 | SendCommand(&c); | |
466 | ||
902cb3c0 | 467 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) { |
468 | recv = resp.d.asBytes; | |
469 | if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) { | |
9455b51c | 470 | if (!(recv[0] & ISO15_RES_ERROR)) { |
471 | retry=0; | |
472 | *output=0; // reset outputstring | |
3fe4ff4f | 473 | sprintf(output, "Block %02x ",blocknum); |
902cb3c0 | 474 | for ( int i=1; i<resp.arg[0]-2; i++) { // data in hex |
7bb9d33e | 475 | sprintf(output+strlen(output),"%02X ",recv[i]); |
9455b51c | 476 | } |
477 | strcat(output," "); | |
902cb3c0 | 478 | for ( int i=1; i<resp.arg[0]-2; i++) { // data in cleaned ascii |
9455b51c | 479 | sprintf(output+strlen(output),"%c",(recv[i]>31 && recv[i]<127)?recv[i]:'.'); |
480 | } | |
481 | PrintAndLog("%s",output); | |
482 | blocknum++; | |
483 | // PrintAndLog("bn=%i",blocknum); | |
484 | } else { | |
b4a9d841 | 485 | PrintAndLog("Tag returned Error %i: %s",recv[1],TagErrorStr(recv[1])); |
6ce0e538 | 486 | return 1; |
9455b51c | 487 | } |
488 | } // else PrintAndLog("crc"); | |
489 | } // else PrintAndLog("r null"); | |
9455b51c | 490 | } // retry |
902cb3c0 | 491 | // TODO: need fix |
492 | // if (resp.arg[0]<3) | |
493 | // PrintAndLog("Lost Connection"); | |
494 | // else if (ISO15_CRC_CHECK!=Crc(resp.d.asBytes,resp.arg[0])) | |
495 | // PrintAndLog("CRC Failed"); | |
496 | // else | |
497 | // PrintAndLog("Tag returned Error %i: %s",recv[1],TagErrorStr(recv[1])); | |
6ce0e538 | 498 | return 1; |
9455b51c | 499 | } |
500 | ||
501 | ||
502 | // "HF 15" interface | |
503 | ||
504 | static command_t CommandTable15[] = | |
505 | { | |
506 | {"help", CmdHF15Help, 1, "This help"}, | |
507 | {"demod", CmdHF15Demod, 1, "Demodulate ISO15693 from tag"}, | |
508 | {"read", CmdHF15Read, 0, "Read HF tag (ISO 15693)"}, | |
509 | {"record", CmdHF15Record, 0, "Record Samples (ISO 15693)"}, // atrox | |
510 | {"reader", CmdHF15Reader, 0, "Act like an ISO15693 reader"}, | |
511 | {"sim", CmdHF15Sim, 0, "Fake an ISO15693 tag"}, | |
512 | {"cmd", CmdHF15Cmd, 0, "Send direct commands to ISO15693 tag"}, | |
513 | {"findafi", CmdHF15Afi, 0, "Brute force AFI of an ISO15693 tag"}, | |
514 | {"dumpmemory", CmdHF15DumpMem, 0, "Read all memory pages of an ISO15693 tag"}, | |
515 | {NULL, NULL, 0, NULL} | |
7fe9b0b7 | 516 | }; |
517 | ||
518 | int CmdHF15(const char *Cmd) | |
519 | { | |
9455b51c | 520 | CmdsParse(CommandTable15, Cmd); |
521 | return 0; | |
7fe9b0b7 | 522 | } |
523 | ||
9455b51c | 524 | int CmdHF15Help(const char *Cmd) |
7fe9b0b7 | 525 | { |
9455b51c | 526 | CmdsHelp(CommandTable15); |
527 | return 0; | |
7fe9b0b7 | 528 | } |
9455b51c | 529 | |
530 | ||
531 | // "HF 15 Cmd" Interface | |
532 | // Allows direct communication with the tag on command level | |
533 | ||
534 | int CmdHF15CmdInquiry(const char *Cmd) | |
535 | { | |
902cb3c0 | 536 | UsbCommand resp; |
9455b51c | 537 | uint8_t *recv; |
538 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? | |
539 | uint8_t *req=c.d.asBytes; | |
540 | int reqlen=0; | |
541 | ||
542 | req[0]= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | | |
543 | ISO15_REQ_INVENTORY | ISO15_REQINV_SLOT1; | |
544 | req[1]=ISO15_CMD_INVENTORY; | |
545 | req[2]=0; // mask length | |
546 | reqlen=AddCrc(req,3); | |
547 | c.arg[0]=reqlen; | |
548 | ||
549 | SendCommand(&c); | |
550 | ||
902cb3c0 | 551 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) { |
552 | if (resp.arg[0]>=12) { | |
553 | recv = resp.d.asBytes; | |
9455b51c | 554 | PrintAndLog("UID=%s",sprintUID(NULL,&recv[2])); |
555 | PrintAndLog("Tag Info: %s",getTagInfo(&recv[2])); | |
556 | } else { | |
902cb3c0 | 557 | PrintAndLog("Response to short, just %i bytes. No tag?\n",resp.arg[0]); |
9455b51c | 558 | } |
559 | } else { | |
560 | PrintAndLog("timeout."); | |
561 | } | |
562 | return 0; | |
563 | } | |
564 | ||
565 | ||
566 | // Turns debugging on(1)/off(0) | |
567 | int CmdHF15CmdDebug( const char *cmd) { | |
568 | int debug=atoi(cmd); | |
569 | if (strlen(cmd)<1) { | |
3fe4ff4f | 570 | PrintAndLog("Usage: hf 15 cmd debug <0|1>"); |
571 | PrintAndLog(" 0 no debugging"); | |
572 | PrintAndLog(" 1 turn debugging on"); | |
9455b51c | 573 | return 0; |
574 | } | |
575 | ||
576 | UsbCommand c = {CMD_ISO_15693_DEBUG, {debug, 0, 0}}; | |
577 | SendCommand(&c); | |
578 | return 0; | |
579 | } | |
580 | ||
581 | ||
582 | int CmdHF15CmdRaw (const char *cmd) { | |
902cb3c0 | 583 | UsbCommand resp; |
9455b51c | 584 | uint8_t *recv; |
585 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? | |
586 | int reply=1; | |
587 | int fast=1; | |
588 | int crc=0; | |
589 | char buf[5]=""; | |
590 | int i=0; | |
591 | uint8_t data[100]; | |
592 | unsigned int datalen=0, temp; | |
fdb67f1c | 593 | char *hexout; |
9455b51c | 594 | |
595 | ||
596 | if (strlen(cmd)<3) { | |
597 | PrintAndLog("Usage: hf 15 cmd raw [-r] [-2] [-c] <0A 0B 0C ... hex>"); | |
598 | PrintAndLog(" -r do not read response"); | |
599 | PrintAndLog(" -2 use slower '1 out of 256' mode"); | |
600 | PrintAndLog(" -c calculate and append CRC"); | |
601 | PrintAndLog(" Tip: turn on debugging for verbose output"); | |
602 | return 0; | |
603 | } | |
604 | ||
605 | // strip | |
606 | while (*cmd==' ' || *cmd=='\t') cmd++; | |
607 | ||
608 | while (cmd[i]!='\0') { | |
609 | if (cmd[i]==' ' || cmd[i]=='\t') { i++; continue; } | |
610 | if (cmd[i]=='-') { | |
611 | switch (cmd[i+1]) { | |
612 | case 'r': | |
613 | case 'R': | |
614 | reply=0; | |
615 | break; | |
616 | case '2': | |
617 | fast=0; | |
618 | break; | |
619 | case 'c': | |
620 | case 'C': | |
621 | crc=1; | |
622 | break; | |
623 | default: | |
624 | PrintAndLog("Invalid option"); | |
625 | return 0; | |
626 | } | |
627 | i+=2; | |
628 | continue; | |
629 | } | |
630 | if ((cmd[i]>='0' && cmd[i]<='9') || | |
631 | (cmd[i]>='a' && cmd[i]<='f') || | |
632 | (cmd[i]>='A' && cmd[i]<='F') ) { | |
633 | buf[strlen(buf)+1]=0; | |
634 | buf[strlen(buf)]=cmd[i]; | |
635 | i++; | |
636 | ||
637 | if (strlen(buf)>=2) { | |
638 | sscanf(buf,"%x",&temp); | |
639 | data[datalen]=(uint8_t)(temp & 0xff); | |
640 | datalen++; | |
641 | *buf=0; | |
642 | } | |
643 | continue; | |
644 | } | |
645 | PrintAndLog("Invalid char on input"); | |
646 | return 0; | |
647 | } | |
648 | if (crc) datalen=AddCrc(data,datalen); | |
649 | ||
650 | c.arg[0]=datalen; | |
651 | c.arg[1]=fast; | |
652 | c.arg[2]=reply; | |
653 | memcpy(c.d.asBytes,data,datalen); | |
654 | ||
655 | SendCommand(&c); | |
656 | ||
657 | if (reply) { | |
902cb3c0 | 658 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) { |
659 | recv = resp.d.asBytes; | |
660 | PrintAndLog("received %i octets",resp.arg[0]); | |
661 | hexout = (char *)malloc(resp.arg[0] * 3 + 1); | |
fdb67f1c | 662 | if (hexout != NULL) { |
902cb3c0 | 663 | for (int i = 0; i < resp.arg[0]; i++) { // data in hex |
7bb9d33e | 664 | sprintf(&hexout[i * 3], "%02X ", recv[i]); |
fdb67f1c | 665 | } |
666 | PrintAndLog("%s", hexout); | |
667 | free(hexout); | |
668 | } | |
9455b51c | 669 | } else { |
670 | PrintAndLog("timeout while waiting for reply."); | |
671 | } | |
672 | ||
673 | } // if reply | |
674 | return 0; | |
675 | } | |
676 | ||
677 | ||
0546b4aa | 678 | /** |
679 | * parses common HF 15 CMD parameters and prepares some data structures | |
680 | * Parameters: | |
681 | * **cmd command line | |
682 | */ | |
9455b51c | 683 | int prepareHF15Cmd(char **cmd, UsbCommand *c, uint8_t iso15cmd[], int iso15cmdlen) { |
684 | int temp; | |
90e278d3 | 685 | uint8_t *req=c->d.asBytes; |
3fe4ff4f | 686 | uint8_t uid[8] = {0x00}; |
9455b51c | 687 | uint32_t reqlen=0; |
688 | ||
689 | // strip | |
690 | while (**cmd==' ' || **cmd=='\t') (*cmd)++; | |
691 | ||
692 | if (strstr(*cmd,"-2")==*cmd) { | |
c43897de | 693 | c->arg[1]=0; // use 1of256 |
9455b51c | 694 | (*cmd)+=2; |
695 | } | |
696 | ||
697 | // strip | |
698 | while (**cmd==' ' || **cmd=='\t') (*cmd)++; | |
699 | ||
700 | if (strstr(*cmd,"-o")==*cmd) { | |
701 | req[reqlen]=ISO15_REQ_OPTION; | |
702 | (*cmd)+=2; | |
703 | } | |
704 | ||
705 | // strip | |
706 | while (**cmd==' ' || **cmd=='\t') (*cmd)++; | |
707 | ||
708 | switch (**cmd) { | |
709 | case 0: | |
710 | PrintAndLog("missing addr"); | |
711 | return 0; | |
712 | break; | |
713 | case 's': | |
714 | case 'S': | |
715 | // you must have selected the tag earlier | |
716 | req[reqlen++]|= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | | |
717 | ISO15_REQ_NONINVENTORY | ISO15_REQ_SELECT; | |
718 | memcpy(&req[reqlen],&iso15cmd[0],iso15cmdlen); | |
719 | reqlen+=iso15cmdlen; | |
720 | break; | |
721 | case 'u': | |
722 | case 'U': | |
723 | // unaddressed mode may not be supported by all vendors | |
724 | req[reqlen++]|= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | | |
725 | ISO15_REQ_NONINVENTORY; | |
726 | memcpy(&req[reqlen],&iso15cmd[0],iso15cmdlen); | |
727 | reqlen+=iso15cmdlen; | |
728 | break; | |
729 | case '*': | |
65a23af2 | 730 | // we scan for the UID ourself |
9455b51c | 731 | req[reqlen++]|= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | |
732 | ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS; | |
733 | memcpy(&req[reqlen],&iso15cmd[0],iso15cmdlen); | |
734 | reqlen+=iso15cmdlen; | |
735 | if (!getUID(uid)) { | |
736 | PrintAndLog("No Tag found"); | |
737 | return 0; | |
738 | } | |
739 | memcpy(req+reqlen,uid,8); | |
740 | PrintAndLog("Detected UID %s",sprintUID(NULL,uid)); | |
741 | reqlen+=8; | |
742 | break; | |
743 | default: | |
744 | req[reqlen++]|= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | | |
745 | ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS; | |
746 | memcpy(&req[reqlen],&iso15cmd[0],iso15cmdlen); | |
747 | reqlen+=iso15cmdlen; | |
748 | ||
749 | /* sscanf(cmd,"%hX%hX%hX%hX%hX%hX%hX%hX", | |
750 | (short unsigned int *)&uid[7],(short unsigned int *)&uid[6], | |
751 | (short unsigned int *)&uid[5],(short unsigned int *)&uid[4], | |
752 | (short unsigned int *)&uid[3],(short unsigned int *)&uid[2], | |
753 | (short unsigned int *)&uid[1],(short unsigned int *)&uid[0]); */ | |
754 | for (int i=0;i<8 && (*cmd)[i*2] && (*cmd)[i*2+1];i++) { // parse UID | |
755 | sscanf((char[]){(*cmd)[i*2],(*cmd)[i*2+1],0},"%X",&temp); | |
756 | uid[7-i]=temp&0xff; | |
757 | } | |
758 | ||
759 | PrintAndLog("Using UID %s",sprintUID(NULL,uid)); | |
760 | memcpy(&req[reqlen],&uid[0],8); | |
761 | reqlen+=8; | |
762 | } | |
763 | // skip to next space | |
764 | while (**cmd!=' ' && **cmd!='\t') (*cmd)++; | |
765 | // skip over the space | |
766 | while (**cmd==' ' || **cmd=='\t') (*cmd)++; | |
767 | ||
768 | c->arg[0]=reqlen; | |
769 | return 1; | |
770 | } | |
771 | ||
6d7234cd | 772 | /** |
773 | * Commandline handling: HF15 CMD SYSINFO | |
774 | * get system information from tag/VICC | |
775 | */ | |
776 | int CmdHF15CmdSysinfo(const char *Cmd) { | |
902cb3c0 | 777 | UsbCommand resp; |
6d7234cd | 778 | uint8_t *recv; |
779 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? | |
780 | uint8_t *req=c.d.asBytes; | |
781 | int reqlen=0; | |
782 | char cmdbuf[100]; | |
783 | char *cmd=cmdbuf; | |
784 | char output[2048]=""; | |
785 | int i; | |
786 | ||
787 | strncpy(cmd,Cmd,99); | |
788 | ||
789 | // usage: | |
790 | if (strlen(cmd)<1) { | |
0546b4aa | 791 | PrintAndLog("Usage: hf 15 cmd sysinfo [options] <uid|s|u|*>"); |
6d7234cd | 792 | PrintAndLog(" options:"); |
793 | PrintAndLog(" -2 use slower '1 out of 256' mode"); | |
794 | PrintAndLog(" uid (either): "); | |
795 | PrintAndLog(" <8B hex> full UID eg E011223344556677"); | |
796 | PrintAndLog(" s selected tag"); | |
797 | PrintAndLog(" u unaddressed mode"); | |
798 | PrintAndLog(" * scan for tag"); | |
799 | PrintAndLog(" start#: page number to start 0-255"); | |
800 | PrintAndLog(" count#: number of pages"); | |
801 | return 0; | |
802 | } | |
803 | ||
804 | prepareHF15Cmd(&cmd, &c,(uint8_t[]){ISO15_CMD_SYSINFO},1); | |
805 | reqlen=c.arg[0]; | |
806 | ||
807 | reqlen=AddCrc(req,reqlen); | |
808 | c.arg[0]=reqlen; | |
809 | ||
810 | SendCommand(&c); | |
811 | ||
902cb3c0 | 812 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000) && resp.arg[0]>2) { |
813 | recv = resp.d.asBytes; | |
814 | if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) { | |
6d7234cd | 815 | if (!(recv[0] & ISO15_RES_ERROR)) { |
816 | *output=0; // reset outputstring | |
902cb3c0 | 817 | for ( i=1; i<resp.arg[0]-2; i++) { |
7bb9d33e | 818 | sprintf(output+strlen(output),"%02X ",recv[i]); |
6d7234cd | 819 | } |
820 | strcat(output,"\n\r"); | |
821 | strcat(output,"UID = "); | |
822 | strcat(output,sprintUID(NULL,recv+2)); | |
823 | strcat(output,"\n\r"); | |
824 | strcat(output,getTagInfo(recv+2)); //ABC | |
825 | strcat(output,"\n\r"); | |
826 | i=10; | |
827 | if (recv[1] & 0x01) | |
7bb9d33e | 828 | sprintf(output+strlen(output),"DSFID supported, set to %02X\n\r",recv[i++]); |
6d7234cd | 829 | else |
830 | strcat(output,"DSFID not supported\n\r"); | |
831 | if (recv[1] & 0x02) | |
7bb9d33e | 832 | sprintf(output+strlen(output),"AFI supported, set to %03X\n\r",recv[i++]); |
6d7234cd | 833 | else |
834 | strcat(output,"AFI not supported\n\r"); | |
835 | if (recv[1] & 0x04) { | |
836 | strcat(output,"Tag provides info on memory layout (vendor dependent)\n\r"); | |
837 | sprintf(output+strlen(output)," %i (or %i) bytes/page x %i pages \n\r", | |
838 | (recv[i+1]&0x1F)+1, (recv[i+1]&0x1F), recv[i]+1); | |
839 | i+=2; | |
840 | } else | |
841 | strcat(output,"Tag does not provide information on memory layout\n\r"); | |
7bb9d33e | 842 | if (recv[1] & 0x08) sprintf(output+strlen(output),"IC reference given: %02X\n\r",recv[i++]); |
6d7234cd | 843 | else strcat(output,"IC reference not given\n\r"); |
844 | ||
845 | ||
846 | PrintAndLog("%s",output); | |
847 | } else { | |
848 | PrintAndLog("Tag returned Error %i: %s",recv[0],TagErrorStr(recv[0])); | |
849 | } | |
850 | } else { | |
851 | PrintAndLog("CRC failed"); | |
852 | } | |
853 | } else { | |
eba61a56 | 854 | PrintAndLog("timeout: no answer"); |
6d7234cd | 855 | } |
856 | ||
857 | return 0; | |
858 | } | |
859 | ||
7853775e | 860 | /** |
861 | * Commandline handling: HF15 CMD READMULTI | |
862 | * Read multiple blocks at once (not all tags support this) | |
863 | */ | |
864 | int CmdHF15CmdReadmulti(const char *Cmd) { | |
902cb3c0 | 865 | UsbCommand resp; |
7853775e | 866 | uint8_t *recv; |
867 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? | |
868 | uint8_t *req=c.d.asBytes; | |
869 | int reqlen=0, pagenum,pagecount; | |
870 | char cmdbuf[100]; | |
871 | char *cmd=cmdbuf; | |
872 | char output[2048]=""; | |
873 | ||
874 | strncpy(cmd,Cmd,99); | |
875 | ||
876 | // usage: | |
877 | if (strlen(cmd)<3) { | |
0546b4aa | 878 | PrintAndLog("Usage: hf 15 cmd readmulti [options] <uid|s|u|*> <start#> <count#>"); |
7853775e | 879 | PrintAndLog(" options:"); |
880 | PrintAndLog(" -2 use slower '1 out of 256' mode"); | |
881 | PrintAndLog(" uid (either): "); | |
882 | PrintAndLog(" <8B hex> full UID eg E011223344556677"); | |
883 | PrintAndLog(" s selected tag"); | |
884 | PrintAndLog(" u unaddressed mode"); | |
885 | PrintAndLog(" * scan for tag"); | |
886 | PrintAndLog(" start#: page number to start 0-255"); | |
887 | PrintAndLog(" count#: number of pages"); | |
888 | return 0; | |
889 | } | |
890 | ||
891 | prepareHF15Cmd(&cmd, &c,(uint8_t[]){ISO15_CMD_READMULTI},1); | |
892 | reqlen=c.arg[0]; | |
893 | ||
894 | pagenum=strtol(cmd,NULL,0); | |
895 | ||
896 | // skip to next space | |
897 | while (*cmd!=' ' && *cmd!='\t') cmd++; | |
898 | // skip over the space | |
899 | while (*cmd==' ' || *cmd=='\t') cmd++; | |
900 | ||
901 | pagecount=strtol(cmd,NULL,0); | |
902 | if (pagecount>0) pagecount--; // 0 means 1 page, 1 means 2 pages, ... | |
903 | ||
904 | req[reqlen++]=(uint8_t)pagenum; | |
905 | req[reqlen++]=(uint8_t)pagecount; | |
906 | ||
907 | reqlen=AddCrc(req,reqlen); | |
908 | ||
909 | c.arg[0]=reqlen; | |
910 | ||
911 | SendCommand(&c); | |
0546b4aa | 912 | |
902cb3c0 | 913 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000) && resp.arg[0]>2) { |
914 | recv = resp.d.asBytes; | |
915 | if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) { | |
7853775e | 916 | if (!(recv[0] & ISO15_RES_ERROR)) { |
917 | *output=0; // reset outputstring | |
902cb3c0 | 918 | for ( int i=1; i<resp.arg[0]-2; i++) { |
7bb9d33e | 919 | sprintf(output+strlen(output),"%02X ",recv[i]); |
7853775e | 920 | } |
921 | strcat(output," "); | |
902cb3c0 | 922 | for ( int i=1; i<resp.arg[0]-2; i++) { |
7853775e | 923 | sprintf(output+strlen(output),"%c",recv[i]>31 && recv[i]<127?recv[i]:'.'); |
924 | } | |
925 | PrintAndLog("%s",output); | |
926 | } else { | |
927 | PrintAndLog("Tag returned Error %i: %s",recv[0],TagErrorStr(recv[0])); | |
928 | } | |
929 | } else { | |
930 | PrintAndLog("CRC failed"); | |
931 | } | |
932 | } else { | |
933 | PrintAndLog("no answer"); | |
934 | } | |
935 | ||
936 | return 0; | |
937 | } | |
938 | ||
05151b6f | 939 | /** |
940 | * Commandline handling: HF15 CMD READ | |
941 | * Reads a single Block | |
942 | */ | |
9455b51c | 943 | int CmdHF15CmdRead(const char *Cmd) { |
902cb3c0 | 944 | UsbCommand resp; |
9455b51c | 945 | uint8_t *recv; |
946 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? | |
947 | uint8_t *req=c.d.asBytes; | |
948 | int reqlen=0, pagenum; | |
949 | char cmdbuf[100]; | |
950 | char *cmd=cmdbuf; | |
951 | char output[100]=""; | |
952 | ||
953 | strncpy(cmd,Cmd,99); | |
954 | ||
955 | // usage: | |
956 | if (strlen(cmd)<3) { | |
0546b4aa | 957 | PrintAndLog("Usage: hf 15 cmd read [options] <uid|s|u|*> <page#>"); |
9455b51c | 958 | PrintAndLog(" options:"); |
959 | PrintAndLog(" -2 use slower '1 out of 256' mode"); | |
960 | PrintAndLog(" uid (either): "); | |
961 | PrintAndLog(" <8B hex> full UID eg E011223344556677"); | |
962 | PrintAndLog(" s selected tag"); | |
963 | PrintAndLog(" u unaddressed mode"); | |
964 | PrintAndLog(" * scan for tag"); | |
965 | PrintAndLog(" page#: page number 0-255"); | |
966 | return 0; | |
967 | } | |
968 | ||
969 | prepareHF15Cmd(&cmd, &c,(uint8_t[]){ISO15_CMD_READ},1); | |
970 | reqlen=c.arg[0]; | |
971 | ||
972 | pagenum=strtol(cmd,NULL,0); | |
973 | /*if (pagenum<0) { | |
974 | PrintAndLog("invalid pagenum"); | |
975 | return 0; | |
976 | } */ | |
977 | ||
978 | req[reqlen++]=(uint8_t)pagenum; | |
979 | ||
980 | reqlen=AddCrc(req,reqlen); | |
981 | ||
982 | c.arg[0]=reqlen; | |
983 | ||
984 | SendCommand(&c); | |
985 | ||
902cb3c0 | 986 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000) && resp.arg[0]>2) { |
987 | recv = resp.d.asBytes; | |
988 | if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) { | |
9455b51c | 989 | if (!(recv[0] & ISO15_RES_ERROR)) { |
990 | *output=0; // reset outputstring | |
991 | //sprintf(output, "Block %2i ",blocknum); | |
902cb3c0 | 992 | for ( int i=1; i<resp.arg[0]-2; i++) { |
7bb9d33e | 993 | sprintf(output+strlen(output),"%02X ",recv[i]); |
9455b51c | 994 | } |
995 | strcat(output," "); | |
902cb3c0 | 996 | for ( int i=1; i<resp.arg[0]-2; i++) { |
e8da7740 | 997 | sprintf(output+strlen(output),"%c",recv[i]>31 && recv[i]<127?recv[i]:'.'); |
9455b51c | 998 | } |
999 | PrintAndLog("%s",output); | |
1000 | } else { | |
b4a9d841 | 1001 | PrintAndLog("Tag returned Error %i: %s",recv[1],TagErrorStr(recv[1])); |
9455b51c | 1002 | } |
1003 | } else { | |
1004 | PrintAndLog("CRC failed"); | |
1005 | } | |
1006 | } else { | |
1007 | PrintAndLog("no answer"); | |
1008 | } | |
1009 | ||
1010 | return 0; | |
1011 | } | |
1012 | ||
1013 | ||
05151b6f | 1014 | /** |
1015 | * Commandline handling: HF15 CMD WRITE | |
1016 | * Writes a single Block - might run into timeout, even when successful | |
1017 | */ | |
9455b51c | 1018 | int CmdHF15CmdWrite(const char *Cmd) { |
902cb3c0 | 1019 | UsbCommand resp; |
9455b51c | 1020 | uint8_t *recv; |
1021 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? | |
1022 | uint8_t *req=c.d.asBytes; | |
1023 | int reqlen=0, pagenum, temp; | |
1024 | char cmdbuf[100]; | |
1025 | char *cmd=cmdbuf; | |
1026 | char *cmd2; | |
1027 | ||
1028 | strncpy(cmd,Cmd,99); | |
1029 | ||
1030 | // usage: | |
1031 | if (strlen(cmd)<3) { | |
0546b4aa | 1032 | PrintAndLog("Usage: hf 15 cmd write [options] <uid|s|u|*> <page#> <hexdata>"); |
9455b51c | 1033 | PrintAndLog(" options:"); |
1034 | PrintAndLog(" -2 use slower '1 out of 256' mode"); | |
1035 | PrintAndLog(" -o set OPTION Flag (needed for TI)"); | |
1036 | PrintAndLog(" uid (either): "); | |
1037 | PrintAndLog(" <8B hex> full UID eg E011223344556677"); | |
1038 | PrintAndLog(" s selected tag"); | |
1039 | PrintAndLog(" u unaddressed mode"); | |
1040 | PrintAndLog(" * scan for tag"); | |
1041 | PrintAndLog(" page#: page number 0-255"); | |
1042 | PrintAndLog(" hexdata: data to be written eg AA BB CC DD"); | |
1043 | return 0; | |
1044 | } | |
1045 | ||
1046 | prepareHF15Cmd(&cmd, &c,(uint8_t[]){ISO15_CMD_WRITE},1); | |
1047 | reqlen=c.arg[0]; | |
1048 | ||
1049 | // *cmd -> page num ; *cmd2 -> data | |
1050 | cmd2=cmd; | |
1051 | while (*cmd2!=' ' && *cmd2!='\t' && *cmd2) cmd2++; | |
1052 | *cmd2=0; | |
1053 | cmd2++; | |
1054 | ||
1055 | pagenum=strtol(cmd,NULL,0); | |
1056 | /*if (pagenum<0) { | |
1057 | PrintAndLog("invalid pagenum"); | |
1058 | return 0; | |
1059 | } */ | |
1060 | req[reqlen++]=(uint8_t)pagenum; | |
1061 | ||
1062 | ||
1063 | while (cmd2[0] && cmd2[1]) { // hexdata, read by 2 hexchars | |
1064 | if (*cmd2==' ') { | |
1065 | cmd2++; | |
1066 | continue; | |
1067 | } | |
1068 | sscanf((char[]){cmd2[0],cmd2[1],0},"%X",&temp); | |
1069 | req[reqlen++]=temp & 0xff; | |
1070 | cmd2+=2; | |
1071 | } | |
1072 | ||
1073 | reqlen=AddCrc(req,reqlen); | |
1074 | ||
1075 | c.arg[0]=reqlen; | |
1076 | ||
1077 | SendCommand(&c); | |
1078 | ||
902cb3c0 | 1079 | if (WaitForResponseTimeout(CMD_ACK,&resp,2000) && resp.arg[0]>2) { |
1080 | recv = resp.d.asBytes; | |
1081 | if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) { | |
9455b51c | 1082 | if (!(recv[0] & ISO15_RES_ERROR)) { |
1083 | PrintAndLog("OK"); | |
1084 | } else { | |
b4a9d841 | 1085 | PrintAndLog("Tag returned Error %i: %s",recv[1],TagErrorStr(recv[1])); |
9455b51c | 1086 | } |
1087 | } else { | |
1088 | PrintAndLog("CRC failed"); | |
1089 | } | |
1090 | } else { | |
65a23af2 | 1091 | PrintAndLog("timeout: no answer - data may be written anyway"); |
9455b51c | 1092 | } |
1093 | ||
1094 | return 0; | |
1095 | } | |
1096 | ||
1097 | ||
1098 | ||
1099 | static command_t CommandTable15Cmd[] = | |
1100 | { | |
1101 | {"help", CmdHF15CmdHelp, 1, "This Help"}, | |
1102 | {"inquiry", CmdHF15CmdInquiry, 0, "Search for tags in range"}, | |
1103 | /* | |
1104 | {"select", CmdHF15CmdSelect, 0, "Select an tag with a specific UID for further commands"}, | |
1105 | */ | |
1106 | {"read", CmdHF15CmdRead, 0, "Read a block"}, | |
1107 | {"write", CmdHF15CmdWrite, 0, "Write a block"}, | |
9455b51c | 1108 | {"readmulti",CmdHF15CmdReadmulti, 0, "Reads multiple Blocks"}, |
0546b4aa | 1109 | {"sysinfo",CmdHF15CmdSysinfo, 0, "Get Card Information"}, |
9455b51c | 1110 | {"raw", CmdHF15CmdRaw, 0, "Send raw hex data to tag"}, |
1111 | {"debug", CmdHF15CmdDebug, 0, "Turn debugging on/off"}, | |
1112 | {NULL, NULL, 0, NULL} | |
1113 | }; | |
1114 | ||
1115 | int CmdHF15Cmd(const char *Cmd) | |
1116 | { | |
1117 | CmdsParse(CommandTable15Cmd, Cmd); | |
1118 | return 0; | |
1119 | } | |
1120 | ||
1121 | int CmdHF15CmdHelp(const char *Cmd) | |
1122 | { | |
1123 | CmdsHelp(CommandTable15Cmd); | |
1124 | return 0; | |
1125 | } | |
1126 |