a553f267 |
1 | //----------------------------------------------------------------------------- |
2 | // Copyright (C) 2010 iZsh <izsh at fail0verflow.com> |
0546b4aa |
3 | // Modified 2010-2012 by <adrian -at- atrox.at> |
65a23af2 |
4 | // Modified 2012 by <vsza at vsza.hu> |
a553f267 |
5 | // |
6 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
7 | // at your option, any later version. See the LICENSE.txt file for the text of |
8 | // the license. |
9 | //----------------------------------------------------------------------------- |
10 | // High frequency ISO15693 commands |
11 | //----------------------------------------------------------------------------- |
9455b51c |
12 | // There are three basic operation modes, depending on which device (proxmark/pc) |
13 | // the signal processing, (de)modulation, transmission protocol and logic is done. |
14 | // Mode 1: |
15 | // All steps are done on the proxmark, the output of the commands is returned via |
16 | // USB-debug-print commands. |
17 | // Mode 2: |
18 | // The protocol is done on the PC, passing only Iso15693 data frames via USB. This |
19 | // allows direct communication with a tag on command level |
20 | // Mode 3: |
21 | // The proxmark just samples the antenna and passes this "analog" data via USB to |
22 | // the client. Signal Processing & decoding is done on the pc. This is the slowest |
23 | // variant, but offers the possibility to analyze the waveforms directly. |
a553f267 |
24 | |
7fe9b0b7 |
25 | #include <stdio.h> |
26 | #include <stdlib.h> |
27 | #include <string.h> |
28 | #include <stdint.h> |
28fdb04f |
29 | //#include "proxusb.h" |
902cb3c0 |
30 | #include "proxmark3.h" |
7fe9b0b7 |
31 | #include "data.h" |
32 | #include "graph.h" |
33 | #include "ui.h" |
34 | #include "cmdparser.h" |
35 | #include "cmdhf15.h" |
9455b51c |
36 | #include "iso15693tools.h" |
37 | #include "cmdmain.h" |
38 | |
39 | #define FrameSOF Iso15693FrameSOF |
40 | #define Logic0 Iso15693Logic0 |
41 | #define Logic1 Iso15693Logic1 |
42 | #define FrameEOF Iso15693FrameEOF |
43 | |
44 | #define Crc(data,datalen) Iso15693Crc(data,datalen) |
45 | #define AddCrc(data,datalen) Iso15693AddCrc(data,datalen) |
46 | #define sprintUID(target,uid) Iso15693sprintUID(target,uid) |
7fe9b0b7 |
47 | |
9455b51c |
48 | // structure and database for uid -> tagtype lookups |
49 | typedef struct { |
50 | uint64_t uid; |
51 | int mask; // how many MSB bits used |
52 | char* desc; |
53 | } productName; |
54 | |
55 | |
56 | const productName uidmapping[] = { |
0546b4aa |
57 | // UID, #significant Bits, "Vendor(+Product)" |
c71e7235 |
58 | { 0xE001000000000000LL, 16, "Motorola" }, |
59 | { 0xE002000000000000LL, 16, "ST Microelectronics" }, |
60 | { 0xE003000000000000LL, 16, "Hitachi" }, |
61 | { 0xE004000000000000LL, 16, "Philips" }, |
62 | { 0xE004010000000000LL, 24, "Philips; IC SL2 ICS20" }, |
63 | { 0xE005000000000000LL, 16, "Infineon" }, |
64 | { 0xE005400000000000LL, 24, "Infineon; 56x32bit" }, |
65 | { 0xE006000000000000LL, 16, "Cylinc" }, |
9455b51c |
66 | { 0xE007000000000000LL, 16, "Texas Instrument; " }, |
67 | { 0xE007000000000000LL, 20, "Texas Instrument; Tag-it HF-I Plus Inlay; 64x32bit" }, |
68 | { 0xE007100000000000LL, 20, "Texas Instrument; Tag-it HF-I Plus Chip; 64x32bit" }, |
0546b4aa |
69 | { 0xE007800000000000LL, 23, "Texas Instrument; Tag-it HF-I Plus (RF-HDT-DVBB tag or Third Party Products)" }, |
9455b51c |
70 | { 0xE007C00000000000LL, 23, "Texas Instrument; Tag-it HF-I Standard; 8x32bit" }, |
71 | { 0xE007C40000000000LL, 23, "Texas Instrument; Tag-it HF-I Pro; 8x23bit; password" }, |
c71e7235 |
72 | { 0xE008000000000000LL, 16, "Fujitsu" }, |
73 | { 0xE009000000000000LL, 16, "Matsushita" }, |
74 | { 0xE00A000000000000LL, 16, "NEC" }, |
75 | { 0xE00B000000000000LL, 16, "Oki Electric" }, |
76 | { 0xE00C000000000000LL, 16, "Toshiba" }, |
77 | { 0xE00D000000000000LL, 16, "Mitsubishi" }, |
78 | { 0xE00E000000000000LL, 16, "Samsung" }, |
79 | { 0xE00F000000000000LL, 16, "Hyundai" }, |
80 | { 0xE010000000000000LL, 16, "LG-Semiconductors" }, |
81 | { 0xE012000000000000LL, 16, "HID Corporation" }, |
9455b51c |
82 | { 0xE016000000000000LL, 16, "EM-Marin SA (Skidata)" }, |
0546b4aa |
83 | { 0xE016040000000000LL, 24, "EM-Marin SA (Skidata Keycard-eco); EM4034? no 'read', just 'readmulti'" }, |
84 | { 0xE0160c0000000000LL, 24, "EM-Marin SA; EM4035?" }, |
9455b51c |
85 | { 0xE016100000000000LL, 24, "EM-Marin SA (Skidata); EM4135; 36x64bit start page 13" }, |
0546b4aa |
86 | { 0xE016940000000000LL, 24, "EM-Marin SA (Skidata); 51x64bit" }, |
9455b51c |
87 | { 0,0,"no tag-info available" } // must be the last entry |
88 | }; |
89 | |
90 | |
e4da8ed0 |
91 | // fast method to just read the UID of a tag (collission detection not supported) |
92 | // *buf should be large enough to fit the 64bit uid |
9455b51c |
93 | // returns 1 if suceeded |
94 | int getUID(uint8_t *buf) |
7fe9b0b7 |
95 | { |
902cb3c0 |
96 | UsbCommand resp; |
9455b51c |
97 | uint8_t *recv; |
98 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? |
99 | uint8_t *req=c.d.asBytes; |
100 | int reqlen=0; |
101 | |
102 | for (int retry=0;retry<3; retry++) { // don't give up the at the first try |
103 | |
104 | req[0]= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | |
105 | ISO15_REQ_INVENTORY | ISO15_REQINV_SLOT1; |
106 | req[1]=ISO15_CMD_INVENTORY; |
107 | req[2]=0; // mask length |
108 | reqlen=AddCrc(req,3); |
109 | c.arg[0]=reqlen; |
110 | |
111 | SendCommand(&c); |
112 | |
902cb3c0 |
113 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) { |
114 | recv = resp.d.asBytes; |
115 | if (resp.arg[0]>=12 && ISO15_CRC_CHECK==Crc(recv,12)) { |
9455b51c |
116 | memcpy(buf,&recv[2],8); |
117 | return 1; |
118 | } |
119 | } |
120 | } // retry |
121 | return 0; |
122 | } |
123 | |
124 | |
7fe9b0b7 |
125 | |
9455b51c |
126 | // get a product description based on the UID |
127 | // uid[8] tag uid |
128 | // returns description of the best match |
129 | static char* getTagInfo(uint8_t *uid) { |
31b6e9af |
130 | uint64_t myuid,mask; |
9455b51c |
131 | int i=0, best=-1; |
132 | memcpy(&myuid,uid,sizeof(uint64_t)); |
133 | while (uidmapping[i].mask>0) { |
134 | mask=(~0LL) <<(64-uidmapping[i].mask); |
135 | if ((myuid & mask) == uidmapping[i].uid) { |
136 | if (best==-1) { |
137 | best=i; |
138 | } else { |
139 | if (uidmapping[i].mask>uidmapping[best].mask) { |
140 | best=i; |
141 | } |
142 | } |
143 | } |
144 | i++; |
145 | } |
7fe9b0b7 |
146 | |
9455b51c |
147 | if (best>=0) return uidmapping[best].desc; |
148 | |
149 | return uidmapping[i].desc; |
7fe9b0b7 |
150 | } |
151 | |
9455b51c |
152 | |
b4a9d841 |
153 | // return a clear-text message to an errorcode |
9455b51c |
154 | static char* TagErrorStr(uint8_t error) { |
b4a9d841 |
155 | switch (error) { |
156 | case 0x01: return "The command is not supported"; |
157 | case 0x02: return "The command is not recognised"; |
158 | case 0x03: return "The option is not supported."; |
159 | case 0x0f: return "Unknown error."; |
160 | case 0x10: return "The specified block is not available (doesn’t exist)."; |
161 | case 0x11: return "The specified block is already -locked and thus cannot be locked again"; |
162 | case 0x12: return "The specified block is locked and its content cannot be changed."; |
163 | case 0x13: return "The specified block was not successfully programmed."; |
164 | case 0x14: return "The specified block was not successfully locked."; |
165 | default: return "Reserved for Future Use or Custom command error."; |
166 | } |
9455b51c |
167 | } |
168 | |
169 | |
170 | // Mode 3 |
7fe9b0b7 |
171 | int CmdHF15Demod(const char *Cmd) |
172 | { |
9455b51c |
173 | // The sampling rate is 106.353 ksps/s, for T = 18.8 us |
174 | |
175 | int i, j; |
176 | int max = 0, maxPos = 0; |
177 | |
178 | int skip = 4; |
179 | |
180 | if (GraphTraceLen < 1000) return 0; |
181 | |
182 | // First, correlate for SOF |
183 | for (i = 0; i < 100; i++) { |
184 | int corr = 0; |
185 | for (j = 0; j < arraylen(FrameSOF); j += skip) { |
186 | corr += FrameSOF[j] * GraphBuffer[i + (j / skip)]; |
187 | } |
188 | if (corr > max) { |
189 | max = corr; |
190 | maxPos = i; |
191 | } |
192 | } |
193 | PrintAndLog("SOF at %d, correlation %d", maxPos, |
194 | max / (arraylen(FrameSOF) / skip)); |
195 | |
196 | i = maxPos + arraylen(FrameSOF) / skip; |
197 | int k = 0; |
198 | uint8_t outBuf[20]; |
199 | memset(outBuf, 0, sizeof(outBuf)); |
200 | uint8_t mask = 0x01; |
201 | for (;;) { |
202 | int corr0 = 0, corr1 = 0, corrEOF = 0; |
203 | for (j = 0; j < arraylen(Logic0); j += skip) { |
204 | corr0 += Logic0[j] * GraphBuffer[i + (j / skip)]; |
205 | } |
206 | for (j = 0; j < arraylen(Logic1); j += skip) { |
207 | corr1 += Logic1[j] * GraphBuffer[i + (j / skip)]; |
208 | } |
209 | for (j = 0; j < arraylen(FrameEOF); j += skip) { |
210 | corrEOF += FrameEOF[j] * GraphBuffer[i + (j / skip)]; |
211 | } |
212 | // Even things out by the length of the target waveform. |
213 | corr0 *= 4; |
214 | corr1 *= 4; |
215 | |
216 | if (corrEOF > corr1 && corrEOF > corr0) { |
217 | PrintAndLog("EOF at %d", i); |
218 | break; |
219 | } else if (corr1 > corr0) { |
220 | i += arraylen(Logic1) / skip; |
221 | outBuf[k] |= mask; |
222 | } else { |
223 | i += arraylen(Logic0) / skip; |
224 | } |
225 | mask <<= 1; |
226 | if (mask == 0) { |
227 | k++; |
228 | mask = 0x01; |
229 | } |
230 | if ((i + (int)arraylen(FrameEOF)) >= GraphTraceLen) { |
231 | PrintAndLog("ran off end!"); |
232 | break; |
233 | } |
234 | } |
235 | if (mask != 0x01) { |
236 | PrintAndLog("error, uneven octet! (discard extra bits!)"); |
237 | PrintAndLog(" mask=%02x", mask); |
238 | } |
239 | PrintAndLog("%d octets", k); |
240 | |
241 | for (i = 0; i < k; i++) { |
242 | PrintAndLog("# %2d: %02x ", i, outBuf[i]); |
243 | } |
244 | PrintAndLog("CRC=%04x", Iso15693Crc(outBuf, k - 2)); |
245 | return 0; |
7fe9b0b7 |
246 | } |
247 | |
9455b51c |
248 | |
249 | |
250 | // * Acquire Samples as Reader (enables carrier, sends inquiry) |
7fe9b0b7 |
251 | int CmdHF15Read(const char *Cmd) |
252 | { |
9455b51c |
253 | UsbCommand c = {CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693}; |
254 | SendCommand(&c); |
255 | return 0; |
256 | } |
257 | |
258 | // Record Activity without enabeling carrier |
259 | int CmdHF15Record(const char *Cmd) |
260 | { |
261 | UsbCommand c = {CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693}; |
262 | SendCommand(&c); |
263 | return 0; |
7fe9b0b7 |
264 | } |
265 | |
266 | int CmdHF15Reader(const char *Cmd) |
267 | { |
9455b51c |
268 | UsbCommand c = {CMD_READER_ISO_15693, {strtol(Cmd, NULL, 0), 0, 0}}; |
269 | SendCommand(&c); |
270 | return 0; |
7fe9b0b7 |
271 | } |
272 | |
9455b51c |
273 | // Simulation is still not working very good |
7fe9b0b7 |
274 | int CmdHF15Sim(const char *Cmd) |
275 | { |
9455b51c |
276 | UsbCommand c = {CMD_SIMTAG_ISO_15693, {strtol(Cmd, NULL, 0), 0, 0}}; |
277 | SendCommand(&c); |
278 | return 0; |
7fe9b0b7 |
279 | } |
280 | |
9455b51c |
281 | // finds the AFI (Application Family Idendifier) of a card, by trying all values |
282 | // (There is no standard way of reading the AFI, allthough some tags support this) |
283 | int CmdHF15Afi(const char *Cmd) |
7fe9b0b7 |
284 | { |
9455b51c |
285 | UsbCommand c = {CMD_ISO_15693_FIND_AFI, {strtol(Cmd, NULL, 0), 0, 0}}; |
286 | SendCommand(&c); |
287 | return 0; |
288 | } |
289 | |
290 | // Reads all memory pages |
291 | int CmdHF15DumpMem(const char*Cmd) { |
902cb3c0 |
292 | UsbCommand resp; |
9455b51c |
293 | uint8_t uid[8]; |
294 | uint8_t *recv=NULL; |
295 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? |
296 | uint8_t *req=c.d.asBytes; |
297 | int reqlen=0; |
298 | int blocknum=0; |
299 | char output[80]; |
300 | |
301 | if (!getUID(uid)) { |
302 | PrintAndLog("No Tag found."); |
303 | return 0; |
304 | } |
305 | |
306 | PrintAndLog("Reading memory from tag UID=%s",sprintUID(NULL,uid)); |
307 | PrintAndLog("Tag Info: %s",getTagInfo(uid)); |
308 | |
309 | for (int retry=0; retry<5; retry++) { |
310 | |
311 | req[0]= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | |
312 | ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS; |
313 | req[1]=ISO15_CMD_READ; |
314 | memcpy(&req[2],uid,8); |
315 | req[10]=blocknum; |
316 | reqlen=AddCrc(req,11); |
317 | c.arg[0]=reqlen; |
318 | |
319 | SendCommand(&c); |
320 | |
902cb3c0 |
321 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) { |
322 | recv = resp.d.asBytes; |
323 | if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) { |
9455b51c |
324 | if (!(recv[0] & ISO15_RES_ERROR)) { |
325 | retry=0; |
326 | *output=0; // reset outputstring |
327 | sprintf(output, "Block %2i ",blocknum); |
902cb3c0 |
328 | for ( int i=1; i<resp.arg[0]-2; i++) { // data in hex |
7bb9d33e |
329 | sprintf(output+strlen(output),"%02X ",recv[i]); |
9455b51c |
330 | } |
331 | strcat(output," "); |
902cb3c0 |
332 | for ( int i=1; i<resp.arg[0]-2; i++) { // data in cleaned ascii |
9455b51c |
333 | sprintf(output+strlen(output),"%c",(recv[i]>31 && recv[i]<127)?recv[i]:'.'); |
334 | } |
335 | PrintAndLog("%s",output); |
336 | blocknum++; |
337 | // PrintAndLog("bn=%i",blocknum); |
338 | } else { |
b4a9d841 |
339 | PrintAndLog("Tag returned Error %i: %s",recv[1],TagErrorStr(recv[1])); |
9455b51c |
340 | return 0; |
341 | } |
342 | } // else PrintAndLog("crc"); |
343 | } // else PrintAndLog("r null"); |
9455b51c |
344 | } // retry |
902cb3c0 |
345 | // TODO: need fix |
346 | // if (resp.arg[0]<3) |
347 | // PrintAndLog("Lost Connection"); |
348 | // else if (ISO15_CRC_CHECK!=Crc(resp.d.asBytes,resp.arg[0])) |
349 | // PrintAndLog("CRC Failed"); |
350 | // else |
351 | // PrintAndLog("Tag returned Error %i: %s",recv[1],TagErrorStr(recv[1])); |
9455b51c |
352 | return 0; |
353 | } |
354 | |
355 | |
356 | // "HF 15" interface |
357 | |
358 | static command_t CommandTable15[] = |
359 | { |
360 | {"help", CmdHF15Help, 1, "This help"}, |
361 | {"demod", CmdHF15Demod, 1, "Demodulate ISO15693 from tag"}, |
362 | {"read", CmdHF15Read, 0, "Read HF tag (ISO 15693)"}, |
363 | {"record", CmdHF15Record, 0, "Record Samples (ISO 15693)"}, // atrox |
364 | {"reader", CmdHF15Reader, 0, "Act like an ISO15693 reader"}, |
365 | {"sim", CmdHF15Sim, 0, "Fake an ISO15693 tag"}, |
366 | {"cmd", CmdHF15Cmd, 0, "Send direct commands to ISO15693 tag"}, |
367 | {"findafi", CmdHF15Afi, 0, "Brute force AFI of an ISO15693 tag"}, |
368 | {"dumpmemory", CmdHF15DumpMem, 0, "Read all memory pages of an ISO15693 tag"}, |
369 | {NULL, NULL, 0, NULL} |
7fe9b0b7 |
370 | }; |
371 | |
372 | int CmdHF15(const char *Cmd) |
373 | { |
9455b51c |
374 | CmdsParse(CommandTable15, Cmd); |
375 | return 0; |
7fe9b0b7 |
376 | } |
377 | |
9455b51c |
378 | int CmdHF15Help(const char *Cmd) |
7fe9b0b7 |
379 | { |
9455b51c |
380 | CmdsHelp(CommandTable15); |
381 | return 0; |
7fe9b0b7 |
382 | } |
9455b51c |
383 | |
384 | |
385 | // "HF 15 Cmd" Interface |
386 | // Allows direct communication with the tag on command level |
387 | |
388 | int CmdHF15CmdInquiry(const char *Cmd) |
389 | { |
902cb3c0 |
390 | UsbCommand resp; |
9455b51c |
391 | uint8_t *recv; |
392 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? |
393 | uint8_t *req=c.d.asBytes; |
394 | int reqlen=0; |
395 | |
396 | req[0]= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | |
397 | ISO15_REQ_INVENTORY | ISO15_REQINV_SLOT1; |
398 | req[1]=ISO15_CMD_INVENTORY; |
399 | req[2]=0; // mask length |
400 | reqlen=AddCrc(req,3); |
401 | c.arg[0]=reqlen; |
402 | |
403 | SendCommand(&c); |
404 | |
902cb3c0 |
405 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) { |
406 | if (resp.arg[0]>=12) { |
407 | recv = resp.d.asBytes; |
9455b51c |
408 | PrintAndLog("UID=%s",sprintUID(NULL,&recv[2])); |
409 | PrintAndLog("Tag Info: %s",getTagInfo(&recv[2])); |
410 | } else { |
902cb3c0 |
411 | PrintAndLog("Response to short, just %i bytes. No tag?\n",resp.arg[0]); |
9455b51c |
412 | } |
413 | } else { |
414 | PrintAndLog("timeout."); |
415 | } |
416 | return 0; |
417 | } |
418 | |
419 | |
420 | // Turns debugging on(1)/off(0) |
421 | int CmdHF15CmdDebug( const char *cmd) { |
422 | int debug=atoi(cmd); |
423 | if (strlen(cmd)<1) { |
424 | PrintAndLog("Usage: hf 15 cmd debug <0/1>"); |
425 | PrintAndLog(" 0..no debugging output 1..turn debugging on"); |
426 | return 0; |
427 | } |
428 | |
429 | UsbCommand c = {CMD_ISO_15693_DEBUG, {debug, 0, 0}}; |
430 | SendCommand(&c); |
431 | return 0; |
432 | } |
433 | |
434 | |
435 | int CmdHF15CmdRaw (const char *cmd) { |
902cb3c0 |
436 | UsbCommand resp; |
9455b51c |
437 | uint8_t *recv; |
438 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? |
439 | int reply=1; |
440 | int fast=1; |
441 | int crc=0; |
442 | char buf[5]=""; |
443 | int i=0; |
444 | uint8_t data[100]; |
445 | unsigned int datalen=0, temp; |
fdb67f1c |
446 | char *hexout; |
9455b51c |
447 | |
448 | |
449 | if (strlen(cmd)<3) { |
450 | PrintAndLog("Usage: hf 15 cmd raw [-r] [-2] [-c] <0A 0B 0C ... hex>"); |
451 | PrintAndLog(" -r do not read response"); |
452 | PrintAndLog(" -2 use slower '1 out of 256' mode"); |
453 | PrintAndLog(" -c calculate and append CRC"); |
454 | PrintAndLog(" Tip: turn on debugging for verbose output"); |
455 | return 0; |
456 | } |
457 | |
458 | // strip |
459 | while (*cmd==' ' || *cmd=='\t') cmd++; |
460 | |
461 | while (cmd[i]!='\0') { |
462 | if (cmd[i]==' ' || cmd[i]=='\t') { i++; continue; } |
463 | if (cmd[i]=='-') { |
464 | switch (cmd[i+1]) { |
465 | case 'r': |
466 | case 'R': |
467 | reply=0; |
468 | break; |
469 | case '2': |
470 | fast=0; |
471 | break; |
472 | case 'c': |
473 | case 'C': |
474 | crc=1; |
475 | break; |
476 | default: |
477 | PrintAndLog("Invalid option"); |
478 | return 0; |
479 | } |
480 | i+=2; |
481 | continue; |
482 | } |
483 | if ((cmd[i]>='0' && cmd[i]<='9') || |
484 | (cmd[i]>='a' && cmd[i]<='f') || |
485 | (cmd[i]>='A' && cmd[i]<='F') ) { |
486 | buf[strlen(buf)+1]=0; |
487 | buf[strlen(buf)]=cmd[i]; |
488 | i++; |
489 | |
490 | if (strlen(buf)>=2) { |
491 | sscanf(buf,"%x",&temp); |
492 | data[datalen]=(uint8_t)(temp & 0xff); |
493 | datalen++; |
494 | *buf=0; |
495 | } |
496 | continue; |
497 | } |
498 | PrintAndLog("Invalid char on input"); |
499 | return 0; |
500 | } |
501 | if (crc) datalen=AddCrc(data,datalen); |
502 | |
503 | c.arg[0]=datalen; |
504 | c.arg[1]=fast; |
505 | c.arg[2]=reply; |
506 | memcpy(c.d.asBytes,data,datalen); |
507 | |
508 | SendCommand(&c); |
509 | |
510 | if (reply) { |
902cb3c0 |
511 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) { |
512 | recv = resp.d.asBytes; |
513 | PrintAndLog("received %i octets",resp.arg[0]); |
514 | hexout = (char *)malloc(resp.arg[0] * 3 + 1); |
fdb67f1c |
515 | if (hexout != NULL) { |
902cb3c0 |
516 | for (int i = 0; i < resp.arg[0]; i++) { // data in hex |
7bb9d33e |
517 | sprintf(&hexout[i * 3], "%02X ", recv[i]); |
fdb67f1c |
518 | } |
519 | PrintAndLog("%s", hexout); |
520 | free(hexout); |
521 | } |
9455b51c |
522 | } else { |
523 | PrintAndLog("timeout while waiting for reply."); |
524 | } |
525 | |
526 | } // if reply |
527 | return 0; |
528 | } |
529 | |
530 | |
0546b4aa |
531 | /** |
532 | * parses common HF 15 CMD parameters and prepares some data structures |
533 | * Parameters: |
534 | * **cmd command line |
535 | */ |
9455b51c |
536 | int prepareHF15Cmd(char **cmd, UsbCommand *c, uint8_t iso15cmd[], int iso15cmdlen) { |
537 | int temp; |
538 | uint8_t *req=c->d.asBytes, uid[8]; |
539 | uint32_t reqlen=0; |
540 | |
541 | // strip |
542 | while (**cmd==' ' || **cmd=='\t') (*cmd)++; |
543 | |
544 | if (strstr(*cmd,"-2")==*cmd) { |
c43897de |
545 | c->arg[1]=0; // use 1of256 |
9455b51c |
546 | (*cmd)+=2; |
547 | } |
548 | |
549 | // strip |
550 | while (**cmd==' ' || **cmd=='\t') (*cmd)++; |
551 | |
552 | if (strstr(*cmd,"-o")==*cmd) { |
553 | req[reqlen]=ISO15_REQ_OPTION; |
554 | (*cmd)+=2; |
555 | } |
556 | |
557 | // strip |
558 | while (**cmd==' ' || **cmd=='\t') (*cmd)++; |
559 | |
560 | switch (**cmd) { |
561 | case 0: |
562 | PrintAndLog("missing addr"); |
563 | return 0; |
564 | break; |
565 | case 's': |
566 | case 'S': |
567 | // you must have selected the tag earlier |
568 | req[reqlen++]|= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | |
569 | ISO15_REQ_NONINVENTORY | ISO15_REQ_SELECT; |
570 | memcpy(&req[reqlen],&iso15cmd[0],iso15cmdlen); |
571 | reqlen+=iso15cmdlen; |
572 | break; |
573 | case 'u': |
574 | case 'U': |
575 | // unaddressed mode may not be supported by all vendors |
576 | req[reqlen++]|= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | |
577 | ISO15_REQ_NONINVENTORY; |
578 | memcpy(&req[reqlen],&iso15cmd[0],iso15cmdlen); |
579 | reqlen+=iso15cmdlen; |
580 | break; |
581 | case '*': |
65a23af2 |
582 | // we scan for the UID ourself |
9455b51c |
583 | req[reqlen++]|= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | |
584 | ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS; |
585 | memcpy(&req[reqlen],&iso15cmd[0],iso15cmdlen); |
586 | reqlen+=iso15cmdlen; |
587 | if (!getUID(uid)) { |
588 | PrintAndLog("No Tag found"); |
589 | return 0; |
590 | } |
591 | memcpy(req+reqlen,uid,8); |
592 | PrintAndLog("Detected UID %s",sprintUID(NULL,uid)); |
593 | reqlen+=8; |
594 | break; |
595 | default: |
596 | req[reqlen++]|= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | |
597 | ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS; |
598 | memcpy(&req[reqlen],&iso15cmd[0],iso15cmdlen); |
599 | reqlen+=iso15cmdlen; |
600 | |
601 | /* sscanf(cmd,"%hX%hX%hX%hX%hX%hX%hX%hX", |
602 | (short unsigned int *)&uid[7],(short unsigned int *)&uid[6], |
603 | (short unsigned int *)&uid[5],(short unsigned int *)&uid[4], |
604 | (short unsigned int *)&uid[3],(short unsigned int *)&uid[2], |
605 | (short unsigned int *)&uid[1],(short unsigned int *)&uid[0]); */ |
606 | for (int i=0;i<8 && (*cmd)[i*2] && (*cmd)[i*2+1];i++) { // parse UID |
607 | sscanf((char[]){(*cmd)[i*2],(*cmd)[i*2+1],0},"%X",&temp); |
608 | uid[7-i]=temp&0xff; |
609 | } |
610 | |
611 | PrintAndLog("Using UID %s",sprintUID(NULL,uid)); |
612 | memcpy(&req[reqlen],&uid[0],8); |
613 | reqlen+=8; |
614 | } |
615 | // skip to next space |
616 | while (**cmd!=' ' && **cmd!='\t') (*cmd)++; |
617 | // skip over the space |
618 | while (**cmd==' ' || **cmd=='\t') (*cmd)++; |
619 | |
620 | c->arg[0]=reqlen; |
621 | return 1; |
622 | } |
623 | |
6d7234cd |
624 | /** |
625 | * Commandline handling: HF15 CMD SYSINFO |
626 | * get system information from tag/VICC |
627 | */ |
628 | int CmdHF15CmdSysinfo(const char *Cmd) { |
902cb3c0 |
629 | UsbCommand resp; |
6d7234cd |
630 | uint8_t *recv; |
631 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? |
632 | uint8_t *req=c.d.asBytes; |
633 | int reqlen=0; |
634 | char cmdbuf[100]; |
635 | char *cmd=cmdbuf; |
636 | char output[2048]=""; |
637 | int i; |
638 | |
639 | strncpy(cmd,Cmd,99); |
640 | |
641 | // usage: |
642 | if (strlen(cmd)<1) { |
0546b4aa |
643 | PrintAndLog("Usage: hf 15 cmd sysinfo [options] <uid|s|u|*>"); |
6d7234cd |
644 | PrintAndLog(" options:"); |
645 | PrintAndLog(" -2 use slower '1 out of 256' mode"); |
646 | PrintAndLog(" uid (either): "); |
647 | PrintAndLog(" <8B hex> full UID eg E011223344556677"); |
648 | PrintAndLog(" s selected tag"); |
649 | PrintAndLog(" u unaddressed mode"); |
650 | PrintAndLog(" * scan for tag"); |
651 | PrintAndLog(" start#: page number to start 0-255"); |
652 | PrintAndLog(" count#: number of pages"); |
653 | return 0; |
654 | } |
655 | |
656 | prepareHF15Cmd(&cmd, &c,(uint8_t[]){ISO15_CMD_SYSINFO},1); |
657 | reqlen=c.arg[0]; |
658 | |
659 | reqlen=AddCrc(req,reqlen); |
660 | c.arg[0]=reqlen; |
661 | |
662 | SendCommand(&c); |
663 | |
902cb3c0 |
664 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000) && resp.arg[0]>2) { |
665 | recv = resp.d.asBytes; |
666 | if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) { |
6d7234cd |
667 | if (!(recv[0] & ISO15_RES_ERROR)) { |
668 | *output=0; // reset outputstring |
902cb3c0 |
669 | for ( i=1; i<resp.arg[0]-2; i++) { |
7bb9d33e |
670 | sprintf(output+strlen(output),"%02X ",recv[i]); |
6d7234cd |
671 | } |
672 | strcat(output,"\n\r"); |
673 | strcat(output,"UID = "); |
674 | strcat(output,sprintUID(NULL,recv+2)); |
675 | strcat(output,"\n\r"); |
676 | strcat(output,getTagInfo(recv+2)); //ABC |
677 | strcat(output,"\n\r"); |
678 | i=10; |
679 | if (recv[1] & 0x01) |
7bb9d33e |
680 | sprintf(output+strlen(output),"DSFID supported, set to %02X\n\r",recv[i++]); |
6d7234cd |
681 | else |
682 | strcat(output,"DSFID not supported\n\r"); |
683 | if (recv[1] & 0x02) |
7bb9d33e |
684 | sprintf(output+strlen(output),"AFI supported, set to %03X\n\r",recv[i++]); |
6d7234cd |
685 | else |
686 | strcat(output,"AFI not supported\n\r"); |
687 | if (recv[1] & 0x04) { |
688 | strcat(output,"Tag provides info on memory layout (vendor dependent)\n\r"); |
689 | sprintf(output+strlen(output)," %i (or %i) bytes/page x %i pages \n\r", |
690 | (recv[i+1]&0x1F)+1, (recv[i+1]&0x1F), recv[i]+1); |
691 | i+=2; |
692 | } else |
693 | strcat(output,"Tag does not provide information on memory layout\n\r"); |
7bb9d33e |
694 | if (recv[1] & 0x08) sprintf(output+strlen(output),"IC reference given: %02X\n\r",recv[i++]); |
6d7234cd |
695 | else strcat(output,"IC reference not given\n\r"); |
696 | |
697 | |
698 | PrintAndLog("%s",output); |
699 | } else { |
700 | PrintAndLog("Tag returned Error %i: %s",recv[0],TagErrorStr(recv[0])); |
701 | } |
702 | } else { |
703 | PrintAndLog("CRC failed"); |
704 | } |
705 | } else { |
eba61a56 |
706 | PrintAndLog("timeout: no answer"); |
6d7234cd |
707 | } |
708 | |
709 | return 0; |
710 | } |
711 | |
7853775e |
712 | /** |
713 | * Commandline handling: HF15 CMD READMULTI |
714 | * Read multiple blocks at once (not all tags support this) |
715 | */ |
716 | int CmdHF15CmdReadmulti(const char *Cmd) { |
902cb3c0 |
717 | UsbCommand resp; |
7853775e |
718 | uint8_t *recv; |
719 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? |
720 | uint8_t *req=c.d.asBytes; |
721 | int reqlen=0, pagenum,pagecount; |
722 | char cmdbuf[100]; |
723 | char *cmd=cmdbuf; |
724 | char output[2048]=""; |
725 | |
726 | strncpy(cmd,Cmd,99); |
727 | |
728 | // usage: |
729 | if (strlen(cmd)<3) { |
0546b4aa |
730 | PrintAndLog("Usage: hf 15 cmd readmulti [options] <uid|s|u|*> <start#> <count#>"); |
7853775e |
731 | PrintAndLog(" options:"); |
732 | PrintAndLog(" -2 use slower '1 out of 256' mode"); |
733 | PrintAndLog(" uid (either): "); |
734 | PrintAndLog(" <8B hex> full UID eg E011223344556677"); |
735 | PrintAndLog(" s selected tag"); |
736 | PrintAndLog(" u unaddressed mode"); |
737 | PrintAndLog(" * scan for tag"); |
738 | PrintAndLog(" start#: page number to start 0-255"); |
739 | PrintAndLog(" count#: number of pages"); |
740 | return 0; |
741 | } |
742 | |
743 | prepareHF15Cmd(&cmd, &c,(uint8_t[]){ISO15_CMD_READMULTI},1); |
744 | reqlen=c.arg[0]; |
745 | |
746 | pagenum=strtol(cmd,NULL,0); |
747 | |
748 | // skip to next space |
749 | while (*cmd!=' ' && *cmd!='\t') cmd++; |
750 | // skip over the space |
751 | while (*cmd==' ' || *cmd=='\t') cmd++; |
752 | |
753 | pagecount=strtol(cmd,NULL,0); |
754 | if (pagecount>0) pagecount--; // 0 means 1 page, 1 means 2 pages, ... |
755 | |
756 | req[reqlen++]=(uint8_t)pagenum; |
757 | req[reqlen++]=(uint8_t)pagecount; |
758 | |
759 | reqlen=AddCrc(req,reqlen); |
760 | |
761 | c.arg[0]=reqlen; |
762 | |
763 | SendCommand(&c); |
0546b4aa |
764 | |
902cb3c0 |
765 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000) && resp.arg[0]>2) { |
766 | recv = resp.d.asBytes; |
767 | if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) { |
7853775e |
768 | if (!(recv[0] & ISO15_RES_ERROR)) { |
769 | *output=0; // reset outputstring |
902cb3c0 |
770 | for ( int i=1; i<resp.arg[0]-2; i++) { |
7bb9d33e |
771 | sprintf(output+strlen(output),"%02X ",recv[i]); |
7853775e |
772 | } |
773 | strcat(output," "); |
902cb3c0 |
774 | for ( int i=1; i<resp.arg[0]-2; i++) { |
7853775e |
775 | sprintf(output+strlen(output),"%c",recv[i]>31 && recv[i]<127?recv[i]:'.'); |
776 | } |
777 | PrintAndLog("%s",output); |
778 | } else { |
779 | PrintAndLog("Tag returned Error %i: %s",recv[0],TagErrorStr(recv[0])); |
780 | } |
781 | } else { |
782 | PrintAndLog("CRC failed"); |
783 | } |
784 | } else { |
785 | PrintAndLog("no answer"); |
786 | } |
787 | |
788 | return 0; |
789 | } |
790 | |
05151b6f |
791 | /** |
792 | * Commandline handling: HF15 CMD READ |
793 | * Reads a single Block |
794 | */ |
9455b51c |
795 | int CmdHF15CmdRead(const char *Cmd) { |
902cb3c0 |
796 | UsbCommand resp; |
9455b51c |
797 | uint8_t *recv; |
798 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? |
799 | uint8_t *req=c.d.asBytes; |
800 | int reqlen=0, pagenum; |
801 | char cmdbuf[100]; |
802 | char *cmd=cmdbuf; |
803 | char output[100]=""; |
804 | |
805 | strncpy(cmd,Cmd,99); |
806 | |
807 | // usage: |
808 | if (strlen(cmd)<3) { |
0546b4aa |
809 | PrintAndLog("Usage: hf 15 cmd read [options] <uid|s|u|*> <page#>"); |
9455b51c |
810 | PrintAndLog(" options:"); |
811 | PrintAndLog(" -2 use slower '1 out of 256' mode"); |
812 | PrintAndLog(" uid (either): "); |
813 | PrintAndLog(" <8B hex> full UID eg E011223344556677"); |
814 | PrintAndLog(" s selected tag"); |
815 | PrintAndLog(" u unaddressed mode"); |
816 | PrintAndLog(" * scan for tag"); |
817 | PrintAndLog(" page#: page number 0-255"); |
818 | return 0; |
819 | } |
820 | |
821 | prepareHF15Cmd(&cmd, &c,(uint8_t[]){ISO15_CMD_READ},1); |
822 | reqlen=c.arg[0]; |
823 | |
824 | pagenum=strtol(cmd,NULL,0); |
825 | /*if (pagenum<0) { |
826 | PrintAndLog("invalid pagenum"); |
827 | return 0; |
828 | } */ |
829 | |
830 | req[reqlen++]=(uint8_t)pagenum; |
831 | |
832 | reqlen=AddCrc(req,reqlen); |
833 | |
834 | c.arg[0]=reqlen; |
835 | |
836 | SendCommand(&c); |
837 | |
902cb3c0 |
838 | if (WaitForResponseTimeout(CMD_ACK,&resp,1000) && resp.arg[0]>2) { |
839 | recv = resp.d.asBytes; |
840 | if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) { |
9455b51c |
841 | if (!(recv[0] & ISO15_RES_ERROR)) { |
842 | *output=0; // reset outputstring |
843 | //sprintf(output, "Block %2i ",blocknum); |
902cb3c0 |
844 | for ( int i=1; i<resp.arg[0]-2; i++) { |
7bb9d33e |
845 | sprintf(output+strlen(output),"%02X ",recv[i]); |
9455b51c |
846 | } |
847 | strcat(output," "); |
902cb3c0 |
848 | for ( int i=1; i<resp.arg[0]-2; i++) { |
e8da7740 |
849 | sprintf(output+strlen(output),"%c",recv[i]>31 && recv[i]<127?recv[i]:'.'); |
9455b51c |
850 | } |
851 | PrintAndLog("%s",output); |
852 | } else { |
b4a9d841 |
853 | PrintAndLog("Tag returned Error %i: %s",recv[1],TagErrorStr(recv[1])); |
9455b51c |
854 | } |
855 | } else { |
856 | PrintAndLog("CRC failed"); |
857 | } |
858 | } else { |
859 | PrintAndLog("no answer"); |
860 | } |
861 | |
862 | return 0; |
863 | } |
864 | |
865 | |
05151b6f |
866 | /** |
867 | * Commandline handling: HF15 CMD WRITE |
868 | * Writes a single Block - might run into timeout, even when successful |
869 | */ |
9455b51c |
870 | int CmdHF15CmdWrite(const char *Cmd) { |
902cb3c0 |
871 | UsbCommand resp; |
9455b51c |
872 | uint8_t *recv; |
873 | UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv? |
874 | uint8_t *req=c.d.asBytes; |
875 | int reqlen=0, pagenum, temp; |
876 | char cmdbuf[100]; |
877 | char *cmd=cmdbuf; |
878 | char *cmd2; |
879 | |
880 | strncpy(cmd,Cmd,99); |
881 | |
882 | // usage: |
883 | if (strlen(cmd)<3) { |
0546b4aa |
884 | PrintAndLog("Usage: hf 15 cmd write [options] <uid|s|u|*> <page#> <hexdata>"); |
9455b51c |
885 | PrintAndLog(" options:"); |
886 | PrintAndLog(" -2 use slower '1 out of 256' mode"); |
887 | PrintAndLog(" -o set OPTION Flag (needed for TI)"); |
888 | PrintAndLog(" uid (either): "); |
889 | PrintAndLog(" <8B hex> full UID eg E011223344556677"); |
890 | PrintAndLog(" s selected tag"); |
891 | PrintAndLog(" u unaddressed mode"); |
892 | PrintAndLog(" * scan for tag"); |
893 | PrintAndLog(" page#: page number 0-255"); |
894 | PrintAndLog(" hexdata: data to be written eg AA BB CC DD"); |
895 | return 0; |
896 | } |
897 | |
898 | prepareHF15Cmd(&cmd, &c,(uint8_t[]){ISO15_CMD_WRITE},1); |
899 | reqlen=c.arg[0]; |
900 | |
901 | // *cmd -> page num ; *cmd2 -> data |
902 | cmd2=cmd; |
903 | while (*cmd2!=' ' && *cmd2!='\t' && *cmd2) cmd2++; |
904 | *cmd2=0; |
905 | cmd2++; |
906 | |
907 | pagenum=strtol(cmd,NULL,0); |
908 | /*if (pagenum<0) { |
909 | PrintAndLog("invalid pagenum"); |
910 | return 0; |
911 | } */ |
912 | req[reqlen++]=(uint8_t)pagenum; |
913 | |
914 | |
915 | while (cmd2[0] && cmd2[1]) { // hexdata, read by 2 hexchars |
916 | if (*cmd2==' ') { |
917 | cmd2++; |
918 | continue; |
919 | } |
920 | sscanf((char[]){cmd2[0],cmd2[1],0},"%X",&temp); |
921 | req[reqlen++]=temp & 0xff; |
922 | cmd2+=2; |
923 | } |
924 | |
925 | reqlen=AddCrc(req,reqlen); |
926 | |
927 | c.arg[0]=reqlen; |
928 | |
929 | SendCommand(&c); |
930 | |
902cb3c0 |
931 | if (WaitForResponseTimeout(CMD_ACK,&resp,2000) && resp.arg[0]>2) { |
932 | recv = resp.d.asBytes; |
933 | if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) { |
9455b51c |
934 | if (!(recv[0] & ISO15_RES_ERROR)) { |
935 | PrintAndLog("OK"); |
936 | } else { |
b4a9d841 |
937 | PrintAndLog("Tag returned Error %i: %s",recv[1],TagErrorStr(recv[1])); |
9455b51c |
938 | } |
939 | } else { |
940 | PrintAndLog("CRC failed"); |
941 | } |
942 | } else { |
65a23af2 |
943 | PrintAndLog("timeout: no answer - data may be written anyway"); |
9455b51c |
944 | } |
945 | |
946 | return 0; |
947 | } |
948 | |
949 | |
950 | |
951 | static command_t CommandTable15Cmd[] = |
952 | { |
953 | {"help", CmdHF15CmdHelp, 1, "This Help"}, |
954 | {"inquiry", CmdHF15CmdInquiry, 0, "Search for tags in range"}, |
955 | /* |
956 | {"select", CmdHF15CmdSelect, 0, "Select an tag with a specific UID for further commands"}, |
957 | */ |
958 | {"read", CmdHF15CmdRead, 0, "Read a block"}, |
959 | {"write", CmdHF15CmdWrite, 0, "Write a block"}, |
9455b51c |
960 | {"readmulti",CmdHF15CmdReadmulti, 0, "Reads multiple Blocks"}, |
0546b4aa |
961 | {"sysinfo",CmdHF15CmdSysinfo, 0, "Get Card Information"}, |
9455b51c |
962 | {"raw", CmdHF15CmdRaw, 0, "Send raw hex data to tag"}, |
963 | {"debug", CmdHF15CmdDebug, 0, "Turn debugging on/off"}, |
964 | {NULL, NULL, 0, NULL} |
965 | }; |
966 | |
967 | int CmdHF15Cmd(const char *Cmd) |
968 | { |
969 | CmdsParse(CommandTable15Cmd, Cmd); |
970 | return 0; |
971 | } |
972 | |
973 | int CmdHF15CmdHelp(const char *Cmd) |
974 | { |
975 | CmdsHelp(CommandTable15Cmd); |
976 | return 0; |
977 | } |
978 | |