]> git.zerfleddert.de Git - proxmark3-svn/blame - client/cmdhf14b.c
projects / proxmark3-svn / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
ADD: @piwi's fixes to "hf snoop" where it empties the bigbuffer before snooping.
[proxmark3-svn] / client / cmdhf14b.c
CommitLineData
a553f267 1//-----------------------------------------------------------------------------
2// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3//
4// This code is licensed to you under the terms of the GNU GPL, version 2 or,
5// at your option, any later version. See the LICENSE.txt file for the text of
6// the license.
7//-----------------------------------------------------------------------------
8// High frequency ISO14443B commands
9//-----------------------------------------------------------------------------
10
7fe9b0b7 11#include <stdio.h>
12#include <stdlib.h>
13#include <stdbool.h>
7fe9b0b7 14#include <stdint.h>
15#include "iso14443crc.h"
902cb3c0 16#include "proxmark3.h"
7fe9b0b7 17#include "data.h"
18#include "graph.h"
3fe4ff4f 19#include "util.h"
7fe9b0b7 20#include "ui.h"
21#include "cmdparser.h"
22#include "cmdhf14b.h"
7cf3ef20 23#include "cmdmain.h"
d71d59db 24#include "cmdhf14a.h"
7fe9b0b7 25
26static int CmdHelp(const char *Cmd);
27
7fe9b0b7 28int CmdHF14BList(const char *Cmd)
29{
388c92bd 30 PrintAndLog("Deprecated command, use 'hf list 14b' instead");
7fe9b0b7 31
388c92bd 32 return 0;
7fe9b0b7 33}
7fe9b0b7 34
22e24700 35int CmdHF14BSim(const char *Cmd)
7fe9b0b7 36{
5de79e20 37 UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443B};
17ad0e09 38 clearCommandBuffer();
22e24700 39 SendCommand(&c);
40 return 0;
7fe9b0b7 41}
42
43int CmdHF14BSnoop(const char *Cmd)
44{
14e18625 45 UsbCommand c = {CMD_SNOOP_ISO_14443B};
17ad0e09 46 clearCommandBuffer();
22e24700 47 SendCommand(&c);
48 return 0;
7fe9b0b7 49}
50
51/* New command to read the contents of a SRI512 tag
52 * SRI512 tags are ISO14443-B modulated memory tags,
53 * this command just dumps the contents of the memory
54 */
55int CmdSri512Read(const char *Cmd)
56{
22e24700 57 UsbCommand c = {CMD_READ_SRI512_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
abb21530 58 clearCommandBuffer();
22e24700 59 SendCommand(&c);
60 return 0;
7fe9b0b7 61}
62
63/* New command to read the contents of a SRIX4K tag
64 * SRIX4K tags are ISO14443-B modulated memory tags,
65 * this command just dumps the contents of the memory/
66 */
67int CmdSrix4kRead(const char *Cmd)
68{
22e24700 69 UsbCommand c = {CMD_READ_SRIX4K_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
abb21530 70 clearCommandBuffer();
22e24700 71 SendCommand(&c);
72 return 0;
7fe9b0b7 73}
74
d71d59db 75int rawClose(void){
e98572a1 76 UsbCommand resp;
d71d59db 77 UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}};
abb21530 78 clearCommandBuffer();
d71d59db 79 SendCommand(&c);
e98572a1 80 if (!WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
d71d59db 81 return 0;
e98572a1 82 }
83 return 0;
d71d59db 84}
85
22e24700 86int HF14BCmdRaw(bool reply, bool *crc, bool power, uint8_t *data, uint8_t *datalen, bool verbose){
6de14cec 87
88 if(*crc) {
89 ComputeCrc14443(CRC_14443_B, data, *datalen, data+*datalen, data+*datalen+1);
22e24700 90 *datalen += 2;
91 }
92
6de14cec 93 UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; // len,recv,power
22e24700 94 c.arg[0] = *datalen;
95 c.arg[1] = reply;
96 c.arg[2] = power;
6de14cec 97 memcpy(c.d.asBytes, data, *datalen);
abb21530 98 clearCommandBuffer();
22e24700 99 SendCommand(&c);
100
101 if (!reply) return 1;
102
6de14cec 103 UsbCommand resp;
17ad0e09 104 if (!WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
22e24700 105 if (verbose) PrintAndLog("timeout while waiting for reply.");
17ad0e09 106 return 0;
107 }
22e24700 108
6de14cec 109 *datalen = resp.arg[0];
b10a759f 110 if (verbose) PrintAndLog("received %u octets", *datalen);
111 if(*datalen<3) return 0;
17ad0e09 112
6de14cec 113 memcpy(data, resp.d.asBytes, *datalen);
114
115 uint8_t first = 0, second = 0;
116 ComputeCrc14443(CRC_14443_B, data, *datalen-2, &first, &second);
117 *crc = ( data[*datalen-2] == first && data[*datalen-1] == second);
118
119 if (verbose)
120 PrintAndLog("[LEN %u] %s[%02X %02X] %s",
121 *datalen,
122 sprint_hex(data, *datalen-2),
123 data[*datalen-2],
124 data[*datalen-1],
125 (*crc)?"OK":"FAIL"
126 );
127
22e24700 128 return 1;
1299c798 129}
130
131int CmdHF14BCmdRaw (const char *Cmd) {
132 bool reply = true;
133 bool crc = false;
22e24700 134 bool power = false;
b10a759f 135 bool select = false;
136 bool SRx = false;
7cf3ef20 137 char buf[5]="";
17ad0e09 138 uint8_t data[USB_CMD_DATA_SIZE] = {0x00};
1299c798 139 uint8_t datalen = 0;
140 unsigned int temp;
141 int i = 0;
142 if (strlen(Cmd)<3) {
b10a759f 143 PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] [-s || -ss] <0A 0B 0C ... hex>");
7cf3ef20 144 PrintAndLog(" -r do not read response");
145 PrintAndLog(" -c calculate and append CRC");
146 PrintAndLog(" -p leave the field on after receive");
b10a759f 147 PrintAndLog(" -s active signal field ON with select");
148 PrintAndLog(" -ss active signal field ON with select for SRx ST Microelectronics tags");
7cf3ef20 149 return 0;
150 }
151
152 // strip
1299c798 153 while (*Cmd==' ' || *Cmd=='\t') Cmd++;
7cf3ef20 154
1299c798 155 while (Cmd[i]!='\0') {
156 if (Cmd[i]==' ' || Cmd[i]=='\t') { i++; continue; }
157 if (Cmd[i]=='-') {
158 switch (Cmd[i+1]) {
7cf3ef20 159 case 'r':
160 case 'R':
1299c798 161 reply = false;
7cf3ef20 162 break;
163 case 'c':
164 case 'C':
1299c798 165 crc = true;
7cf3ef20 166 break;
167 case 'p':
168 case 'P':
22e24700 169 power = true;
7cf3ef20 170 break;
b10a759f 171 case 's':
172 case 'S':
173 select = true;
174 if (Cmd[i+2]=='s' || Cmd[i+2]=='S') {
175 SRx = true;
176 i++;
177 }
178 break;
7cf3ef20 179 default:
180 PrintAndLog("Invalid option");
181 return 0;
182 }
183 i+=2;
184 continue;
185 }
1299c798 186 if ((Cmd[i]>='0' && Cmd[i]<='9') ||
187 (Cmd[i]>='a' && Cmd[i]<='f') ||
188 (Cmd[i]>='A' && Cmd[i]<='F') ) {
7cf3ef20 189 buf[strlen(buf)+1]=0;
1299c798 190 buf[strlen(buf)]=Cmd[i];
7cf3ef20 191 i++;
192
193 if (strlen(buf)>=2) {
194 sscanf(buf,"%x",&temp);
1299c798 195 data[datalen++]=(uint8_t)(temp & 0xff);
7cf3ef20 196 *buf=0;
b10a759f 197 memset(buf, 0x00, sizeof(buf));
7cf3ef20 198 }
199 continue;
200 }
201 PrintAndLog("Invalid char on input");
b10a759f 202 return 0;
7cf3ef20 203 }
06b82e6a 204 if (datalen == 0)
205 {
206 PrintAndLog("Missing data input");
207 return 0;
208 }
1299c798 209
b10a759f 210 if (select){ //auto select 14b tag
211 uint8_t cmd2[16];
212 bool crc2 = true;
213 uint8_t cmdLen;
214
215 if (SRx) {
216 // REQ SRx
217 cmdLen = 2;
218 cmd2[0] = 0x06;
219 cmd2[1] = 0x00;
220 } else {
221 // REQB
222 cmdLen = 3;
223 cmd2[0] = 0x05;
224 cmd2[1] = 0x00;
225 cmd2[2] = 0x08;
226 }
227
228 // REQB
229 if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose();
230
d8af608f 231 PrintAndLog("REQB : %s", sprint_hex(cmd2, cmdLen));
b10a759f 232
233 if ( SRx && (cmdLen != 3 || !crc2) ) return rawClose();
234 else if (cmd2[0] != 0x50 || cmdLen != 14 || !crc2) return rawClose();
235
236 uint8_t chipID = 0;
237 if (SRx) {
238 // select
239 chipID = cmd2[0];
240 cmd2[0] = 0x0E;
241 cmd2[1] = chipID;
242 cmdLen = 2;
243 } else {
244 // attrib
245 cmd2[0] = 0x1D;
246 // UID from cmd2[1 - 4]
247 cmd2[5] = 0x00;
248 cmd2[6] = 0x08;
249 cmd2[7] = 0x01;
250 cmd2[8] = 0x00;
251 cmdLen = 9;
252 }
253 // wait
254
255 // attrib
256 if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose();
d8af608f 257 PrintAndLog("ATTRIB : %s", sprint_hex(cmd2, cmdLen));
b10a759f 258
259 if (cmdLen != 3 || !crc2) return rawClose();
260 if (SRx && cmd2[0] != chipID) return rawClose();
261
262 }
22e24700 263 return HF14BCmdRaw(reply, &crc, power, data, &datalen, true);
1299c798 264}
265
6de14cec 266// print full atqb info
d71d59db 267static void print_atqb_resp(uint8_t *data){
b10a759f 268 //PrintAndLog (" UID: %s", sprint_hex(data+1,4));
22e24700 269 PrintAndLog (" App Data: %s", sprint_hex(data+5,4));
270 PrintAndLog (" Protocol: %s", sprint_hex(data+9,3));
271 uint8_t BitRate = data[9];
272 if (!BitRate) PrintAndLog (" Bit Rate: 106 kbit/s only PICC <-> PCD");
273 if (BitRate & 0x10) PrintAndLog (" Bit Rate: 212 kbit/s PICC -> PCD supported");
274 if (BitRate & 0x20) PrintAndLog (" Bit Rate: 424 kbit/s PICC -> PCD supported");
275 if (BitRate & 0x40) PrintAndLog (" Bit Rate: 847 kbit/s PICC -> PCD supported");
276 if (BitRate & 0x01) PrintAndLog (" Bit Rate: 212 kbit/s PICC <- PCD supported");
277 if (BitRate & 0x02) PrintAndLog (" Bit Rate: 424 kbit/s PICC <- PCD supported");
278 if (BitRate & 0x04) PrintAndLog (" Bit Rate: 847 kbit/s PICC <- PCD supported");
279 if (BitRate & 0x80) PrintAndLog (" Same bit rate <-> required");
280
281 uint16_t maxFrame = data[10]>>4;
282 if (maxFrame < 5) maxFrame = 8 * maxFrame + 16;
283 else if (maxFrame == 5) maxFrame = 64;
284 else if (maxFrame == 6) maxFrame = 96;
285 else if (maxFrame == 7) maxFrame = 128;
286 else if (maxFrame == 8) maxFrame = 256;
287 else maxFrame = 257;
288
b10a759f 289 PrintAndLog ("Max Frame Size: %u%s",maxFrame, (maxFrame == 257) ? "+ RFU" : "");
22e24700 290
291 uint8_t protocolT = data[10] & 0xF;
292 PrintAndLog (" Protocol Type: Protocol is %scompliant with ISO/IEC 14443-4",(protocolT) ? "" : "not " );
b10a759f 293 PrintAndLog ("Frame Wait Int: %u", data[11]>>4);
22e24700 294 PrintAndLog (" App Data Code: Application is %s",(data[11]&4) ? "Standard" : "Proprietary");
295 PrintAndLog (" Frame Options: NAD is %ssupported",(data[11]&2) ? "" : "not ");
296 PrintAndLog (" Frame Options: CID is %ssupported",(data[11]&1) ? "" : "not ");
b10a759f 297 PrintAndLog ("Max Buf Length: %u (MBLI) %s",data[14]>>4, (data[14] & 0xF0) ? "" : "not supported");
22e24700 298
299 return;
1299c798 300}
301
6de14cec 302// get SRx chip model (from UID) // from ST Microelectronics
d71d59db 303char *get_ST_Chip_Model(uint8_t data){
304 static char model[20];
305 char *retStr = model;
306 memset(model,0, sizeof(model));
307
308 switch (data) {
309 case 0x0: sprintf(retStr, "SRIX4K (Special)"); break;
310 case 0x2: sprintf(retStr, "SR176"); break;
311 case 0x3: sprintf(retStr, "SRIX4K"); break;
312 case 0x4: sprintf(retStr, "SRIX512"); break;
313 case 0x6: sprintf(retStr, "SRI512"); break;
314 case 0x7: sprintf(retStr, "SRI4K"); break;
315 case 0xC: sprintf(retStr, "SRT512"); break;
316 default: sprintf(retStr, "Unknown"); break;
317 }
17ad0e09 318 return retStr;
319}
320
b10a759f 321int print_ST_Lock_info(uint8_t model){
322 //assume connection open and tag selected...
323 uint8_t data[16] = {0x00};
324 uint8_t datalen = 2;
325 bool crc = true;
326 uint8_t resplen;
327 uint8_t blk1;
328 data[0] = 0x08;
329
330 if (model == 0x2) { //SR176 has special command:
331 data[1] = 0xf;
332 resplen = 4;
333 } else {
334 data[1] = 0xff;
335 resplen = 6;
336 }
337
338 //std read cmd
339 if (HF14BCmdRaw(true, &crc, true, data, &datalen, false)==0) return rawClose();
340
341 if (datalen != resplen || !crc) return rawClose();
342
343 PrintAndLog("Chip Write Protection Bits:");
344 // now interpret the data
345 switch (model){
346 case 0x0: //fall through (SRIX4K special)
347 case 0x3: //fall through (SRIx4K)
348 case 0x7: // (SRI4K)
349 //only need data[3]
350 blk1 = 9;
351 PrintAndLog(" raw: %s",printBits(1,data+3));
352 PrintAndLog(" 07/08:%slocked", (data[3] & 1) ? " not " : " " );
353 for (uint8_t i = 1; i<8; i++){
354 PrintAndLog(" %02u:%slocked", blk1, (data[3] & (1 << i)) ? " not " : " " );
355 blk1++;
356 }
357 break;
358 case 0x4: //fall through (SRIX512)
359 case 0x6: //fall through (SRI512)
360 case 0xC: // (SRT512)
361 //need data[2] and data[3]
362 blk1 = 0;
363 PrintAndLog(" raw: %s",printBits(2,data+2));
364 for (uint8_t b=2; b<4; b++){
365 for (uint8_t i=0; i<8; i++){
366 PrintAndLog(" %02u:%slocked", blk1, (data[b] & (1 << i)) ? " not " : " " );
367 blk1++;
368 }
369 }
370 break;
371 case 0x2: // (SR176)
372 //need data[2]
373 blk1 = 0;
374 PrintAndLog(" raw: %s",printBits(1,data+2));
375 for (uint8_t i = 0; i<8; i++){
376 PrintAndLog(" %02u/%02u:%slocked", blk1, blk1+1, (data[2] & (1 << i)) ? " " : " not " );
377 blk1+=2;
378 }
379 break;
380 default:
381 return rawClose();
382 }
383 return 1;
384}
385
6de14cec 386// print UID info from SRx chips (ST Microelectronics)
387static void print_st_general_info(uint8_t *data){
17ad0e09 388 //uid = first 8 bytes in data
389 PrintAndLog(" UID: %s", sprint_hex(SwapEndian64(data,8,8),8));
390 PrintAndLog(" MFG: %02X, %s", data[6], getTagInfo(data[6]));
391 PrintAndLog("Chip: %02X, %s", data[5]>>2, get_ST_Chip_Model(data[5]>>2));
392 return;
393}
394
6de14cec 395// 14b get and print UID only (general info)
396int HF14BStdReader(uint8_t *data, uint8_t *datalen){
17ad0e09 397 //05 00 00 = find one tag in field
b10a759f 398 //1d xx xx xx xx 00 08 01 00 = attrib xx=UID (resp 10 [f9 e0])
399 //a3 = ? (resp 03 [e2 c2])
400 //02 = ? (resp 02 [6a d3])
17ad0e09 401 // 022b (resp 02 67 00 [29 5b])
402 // 0200a40400 (resp 02 67 00 [29 5b])
403 // 0200a4040c07a0000002480300 (resp 02 67 00 [29 5b])
404 // 0200a4040c07a0000002480200 (resp 02 67 00 [29 5b])
405 // 0200a4040006a0000000010100 (resp 02 6a 82 [4b 4c])
406 // 0200a4040c09d27600002545500200 (resp 02 67 00 [29 5b])
407 // 0200a404000cd2760001354b414e4d30310000 (resp 02 6a 82 [4b 4c])
408 // 0200a404000ca000000063504b43532d313500 (resp 02 6a 82 [4b 4c])
409 // 0200a4040010a000000018300301000000000000000000 (resp 02 6a 82 [4b 4c])
410 //03 = ? (resp 03 [e3 c2])
411 //c2 = ? (resp c2 [66 15])
6de14cec 412 //b2 = ? (resp a3 [e9 67])
b10a759f 413 //a2 = ? (resp 02 [6a d3])
17ad0e09 414 bool crc = true;
415 *datalen = 3;
416 //std read cmd
417 data[0] = 0x05;
418 data[1] = 0x00;
6de14cec 419 data[2] = 0x08;
17ad0e09 420
b10a759f 421 if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
17ad0e09 422
b10a759f 423 if (data[0] != 0x50 || *datalen != 14 || !crc) return rawClose();
17ad0e09 424
425 PrintAndLog ("\n14443-3b tag found:");
6de14cec 426 PrintAndLog (" UID: %s", sprint_hex(data+1,4));
427
b10a759f 428 uint8_t cmd2[16];
429 uint8_t cmdLen = 3;
430 bool crc2 = true;
431
432 cmd2[0] = 0x1D;
433 // UID from data[1 - 4]
434 cmd2[1] = data[1];
435 cmd2[2] = data[2];
436 cmd2[3] = data[3];
437 cmd2[4] = data[4];
438 cmd2[5] = 0x00;
439 cmd2[6] = 0x08;
440 cmd2[7] = 0x01;
441 cmd2[8] = 0x00;
442 cmdLen = 9;
443
444 // attrib
445 if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose();
446
447 if (cmdLen != 3 || !crc2) return rawClose();
448 // add attrib responce to data
449 data[14] = cmd2[0];
450 rawClose();
6de14cec 451 return 1;
452}
453
454// 14b get and print Full Info (as much as we know)
455int HF14BStdInfo(uint8_t *data, uint8_t *datalen){
456 if (!HF14BStdReader(data,datalen)) return 0;
457
458 //add more info here
17ad0e09 459 print_atqb_resp(data);
460
b10a759f 461
17ad0e09 462 return 1;
463}
464
6de14cec 465// SRx get and print general info about SRx chip from UID
b10a759f 466int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen, bool closeCon){
17ad0e09 467 bool crc = true;
468 *datalen = 2;
469 //wake cmd
470 data[0] = 0x06;
471 data[1] = 0x00;
472
473 //leave power on
474 // verbose on for now for testing - turn off when functional
475 if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
476
477 if (*datalen != 3 || !crc) return rawClose();
478
479 uint8_t chipID = data[0];
480 // select
481 data[0] = 0x0E;
482 data[1] = chipID;
483 *datalen = 2;
484
485 //leave power on
17ad0e09 486 if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
487
488 if (*datalen != 3 || !crc || data[0] != chipID) return rawClose();
489
490 // get uid
491 data[0] = 0x0B;
492 *datalen = 1;
493
b10a759f 494 //leave power on
495 if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
496
497 if (*datalen != 10 || !crc) return rawClose();
498
499 //power off ?
500 if (closeCon) rawClose();
17ad0e09 501
502 PrintAndLog("\n14443-3b ST tag found:");
6de14cec 503 print_st_general_info(data);
504 return 1;
505}
506
507// SRx get and print full info (needs more info...)
508int HF14B_ST_Info(uint8_t *data, uint8_t *datalen){
b10a759f 509 if (!HF14B_ST_Reader(data, datalen, false)) return 0;
6de14cec 510
511 //add locking bit information here.
b10a759f 512 if (print_ST_Lock_info(data[5]>>2))
513 rawClose();
6de14cec 514
17ad0e09 515 return 1;
516}
517
518// test for other 14b type tags (mimic another reader - don't have tags to identify)
6de14cec 519int HF14B_Other_Reader(uint8_t *data, uint8_t *datalen){
17ad0e09 520 bool crc = true;
521 *datalen = 4;
522 //std read cmd
523 data[0] = 0x00;
524 data[1] = 0x0b;
525 data[2] = 0x3f;
526 data[3] = 0x80;
527
6de14cec 528 if (HF14BCmdRaw(true, &crc, true, data, datalen, false)!=0) {
17ad0e09 529 if (*datalen > 2 || !crc) {
530 PrintAndLog ("\n14443-3b tag found:");
531 PrintAndLog ("Unknown tag type answered to a 0x000b3f80 command ans:");
532 PrintAndLog ("%s",sprint_hex(data,*datalen));
b10a759f 533 rawClose();
17ad0e09 534 return 1;
535 }
22e24700 536 }
537
538 crc = false;
539 *datalen = 1;
540 data[0] = 0x0a;
541
6de14cec 542 if (HF14BCmdRaw(true, &crc, true, data, datalen, false)!=0) {
22e24700 543 if (*datalen > 0) {
544 PrintAndLog ("\n14443-3b tag found:");
545 PrintAndLog ("Unknown tag type answered to a 0x0A command ans:");
546 PrintAndLog ("%s",sprint_hex(data,*datalen));
b10a759f 547 rawClose();
22e24700 548 return 1;
549 }
550 }
551
552 crc = false;
553 *datalen = 1;
554 data[0] = 0x0c;
555
6de14cec 556 if (HF14BCmdRaw(true, &crc, true, data, datalen, false)!=0) {
22e24700 557 if (*datalen > 0) {
558 PrintAndLog ("\n14443-3b tag found:");
559 PrintAndLog ("Unknown tag type answered to a 0x0C command ans:");
560 PrintAndLog ("%s",sprint_hex(data,*datalen));
b10a759f 561 rawClose();
22e24700 562 return 1;
563 }
564 }
6de14cec 565 rawClose();
22e24700 566 return 0;
1299c798 567}
568
6de14cec 569// get and print all info known about any known 14b tag
17ad0e09 570int HF14BInfo(bool verbose){
6de14cec 571 uint8_t data[USB_CMD_DATA_SIZE];
22e24700 572 uint8_t datalen = 5;
573
574 // try std 14b (atqb)
17ad0e09 575 if (HF14BStdInfo(data, &datalen)) return 1;
22e24700 576
577 // try st 14b
17ad0e09 578 if (HF14B_ST_Info(data, &datalen)) return 1;
1299c798 579
22e24700 580 // try unknown 14b read commands (to be identified later)
581 // could be read of calypso, CEPAS, moneo, or pico pass.
6de14cec 582 if (HF14B_Other_Reader(data, &datalen)) return 1;
abb21530 583
d71d59db 584 if (verbose) PrintAndLog("no 14443B tag found");
585 return 0;
d71d59db 586}
587
6de14cec 588// menu command to get and print all info known about any known 14b tag
17ad0e09 589int CmdHF14Binfo(const char *Cmd){
590 return HF14BInfo(true);
7cf3ef20 591}
592
6de14cec 593// get and print general info about all known 14b chips
594int HF14BReader(bool verbose){
595 uint8_t data[USB_CMD_DATA_SIZE];
596 uint8_t datalen = 5;
597
598 // try std 14b (atqb)
599 if (HF14BStdReader(data, &datalen)) return 1;
600
601 // try st 14b
b10a759f 602 if (HF14B_ST_Reader(data, &datalen, true)) return 1;
6de14cec 603
604 // try unknown 14b read commands (to be identified later)
605 // could be read of calypso, CEPAS, moneo, or pico pass.
606 if (HF14B_Other_Reader(data, &datalen)) return 1;
607
608 if (verbose) PrintAndLog("no 14443B tag found");
609 return 0;
610}
611
612// menu command to get and print general info about all known 14b chips
613int CmdHF14BReader(const char *Cmd){
614 return HF14BReader(true);
615}
616
17ad0e09 617int CmdSriWrite( const char *Cmd){
3fe4ff4f 618/*
619 * For SRIX4K blocks 00 - 7F
620 * hf 14b raw -c -p 09 $srix4kwblock $srix4kwdata
621 *
622 * For SR512 blocks 00 - 0F
623 * hf 14b raw -c -p 09 $sr512wblock $sr512wdata
624 *
625 * Special block FF = otp_lock_reg block.
626 * Data len 4 bytes-
627 */
628 char cmdp = param_getchar(Cmd, 0);
629 uint8_t blockno = -1;
630 uint8_t data[4] = {0x00};
631 bool isSrix4k = true;
632 char str[20];
633
b5be31f9 634 if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') {
3fe4ff4f 635 PrintAndLog("Usage: hf 14b write <1|2> <BLOCK> <DATA>");
b5be31f9 636 PrintAndLog(" [1 = SRIX4K]");
637 PrintAndLog(" [2 = SRI512]");
638 PrintAndLog(" [BLOCK number depends on tag, special block == FF]");
639 PrintAndLog(" sample: hf 14b write 1 7F 11223344");
640 PrintAndLog(" : hf 14b write 1 FF 11223344");
641 PrintAndLog(" : hf 14b write 2 15 11223344");
642 PrintAndLog(" : hf 14b write 2 FF 11223344");
3fe4ff4f 643 return 0;
644 }
645
b5be31f9 646 if ( cmdp == '2' )
3fe4ff4f 647 isSrix4k = false;
648
b5be31f9 649 //blockno = param_get8(Cmd, 1);
650
651 if ( param_gethex(Cmd,1, &blockno, 2) ) {
652 PrintAndLog("Block number must include 2 HEX symbols");
653 return 0;
654 }
3fe4ff4f 655
656 if ( isSrix4k ){
657 if ( blockno > 0x7f && blockno != 0xff ){
658 PrintAndLog("Block number out of range");
659 return 0;
660 }
661 } else {
662 if ( blockno > 0x0f && blockno != 0xff ){
663 PrintAndLog("Block number out of range");
664 return 0;
665 }
666 }
667
668 if (param_gethex(Cmd, 2, data, 8)) {
669 PrintAndLog("Data must include 8 HEX symbols");
670 return 0;
671 }
672
673 if ( blockno == 0xff)
b5be31f9 674 PrintAndLog("[%s] Write special block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512" , blockno, sprint_hex(data,4) );
3fe4ff4f 675 else
b5be31f9 676 PrintAndLog("[%s] Write block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512", blockno, sprint_hex(data,4) );
3fe4ff4f 677
fe5b3a44 678 sprintf(str, "-c 09 %02x %02x%02x%02x%02x", blockno, data[0], data[1], data[2], data[3]);
b5be31f9 679
3fe4ff4f 680 CmdHF14BCmdRaw(str);
681 return 0;
682}
683
7fe9b0b7 684static command_t CommandTable[] =
685{
22e24700 686 {"help", CmdHelp, 1, "This help"},
6de14cec 687 {"info", CmdHF14Binfo, 0, "Find and print details about a 14443B tag"},
688 {"list", CmdHF14BList, 0, "[Deprecated] List ISO 14443B history"},
689 {"reader", CmdHF14BReader, 0, "Act as a 14443B reader to identify a tag"},
690 {"sim", CmdHF14BSim, 0, "Fake ISO 14443B tag"},
691 {"snoop", CmdHF14BSnoop, 0, "Eavesdrop ISO 14443B"},
22e24700 692 {"sri512read", CmdSri512Read, 0, "Read contents of a SRI512 tag"},
693 {"srix4kread", CmdSrix4kRead, 0, "Read contents of a SRIX4K tag"},
6de14cec 694 {"sriwrite", CmdSriWrite, 0, "Write data to a SRI512 | SRIX4K tag"},
22e24700 695 {"raw", CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},
22e24700 696 {NULL, NULL, 0, NULL}
7fe9b0b7 697};
698
699int CmdHF14B(const char *Cmd)
700{
22e24700 701 CmdsParse(CommandTable, Cmd);
702 return 0;
7fe9b0b7 703}
704
705int CmdHelp(const char *Cmd)
706{
22e24700 707 CmdsHelp(CommandTable);
708 return 0;
7fe9b0b7 709}
Proxmark3 GIT tracking
Impressum, Datenschutz