]>
Commit | Line | Data |
---|---|---|
b67f7ec3 MHS |
1 | #ifndef PROTOCOLS_H |
2 | #define PROTOCOLS_H | |
3 | ||
4 | //The following data is taken from http://www.proxmark.org/forum/viewtopic.php?pid=13501#p13501 | |
5 | /* | |
6 | ISO14443A (usually NFC tags) | |
7 | 26 (7bits) = REQA | |
8 | 30 = Read (usage: 30+1byte block number+2bytes ISO14443A-CRC - answer: 16bytes) | |
9 | A2 = Write (usage: A2+1byte block number+4bytes data+2bytes ISO14443A-CRC - answer: 0A [ACK] or 00 [NAK]) | |
10 | 52 (7bits) = WUPA (usage: 52(7bits) - answer: 2bytes ATQA) | |
11 | 93 20 = Anticollision (usage: 9320 - answer: 4bytes UID+1byte UID-bytes-xor) | |
12 | 93 70 = Select (usage: 9370+5bytes 9320 answer - answer: 1byte SAK) | |
13 | 95 20 = Anticollision of cascade level2 | |
14 | 95 70 = Select of cascade level2 | |
15 | 50 00 = Halt (usage: 5000+2bytes ISO14443A-CRC - no answer from card) | |
16 | Mifare | |
17 | 60 = Authenticate with KeyA | |
18 | 61 = Authenticate with KeyB | |
19 | 40 (7bits) = Used to put Chinese Changeable UID cards in special mode (must be followed by 43 (8bits) - answer: 0A) | |
20 | C0 = Decrement | |
21 | C1 = Increment | |
22 | C2 = Restore | |
23 | B0 = Transfer | |
24 | Ultralight C | |
25 | A0 = Compatibility Write (to accomodate MIFARE commands) | |
26 | 1A = Step1 Authenticate | |
27 | AF = Step2 Authenticate | |
28 | ||
29 | ||
30 | ISO14443B | |
31 | 05 = REQB | |
32 | 1D = ATTRIB | |
33 | 50 = HALT | |
c5f8c67a | 34 | |
35 | BA = PING (reader -> tag) | |
36 | AB = PONG (tag -> reader) | |
b67f7ec3 MHS |
37 | SRIX4K (tag does not respond to 05) |
38 | 06 00 = INITIATE | |
39 | 0E xx = SELECT ID (xx = Chip-ID) | |
40 | 0B = Get UID | |
41 | 08 yy = Read Block (yy = block number) | |
42 | 09 yy dd dd dd dd = Write Block (yy = block number; dd dd dd dd = data to be written) | |
43 | 0C = Reset to Inventory | |
44 | 0F = Completion | |
45 | 0A 11 22 33 44 55 66 = Authenticate (11 22 33 44 55 66 = data to authenticate) | |
46 | ||
47 | ||
48 | ISO15693 | |
49 | MANDATORY COMMANDS (all ISO15693 tags must support those) | |
50 | 01 = Inventory (usage: 260100+2bytes ISO15693-CRC - answer: 12bytes) | |
51 | 02 = Stay Quiet | |
52 | OPTIONAL COMMANDS (not all tags support them) | |
53 | 20 = Read Block (usage: 0220+1byte block number+2bytes ISO15693-CRC - answer: 4bytes) | |
54 | 21 = Write Block (usage: 0221+1byte block number+4bytes data+2bytes ISO15693-CRC - answer: 4bytes) | |
55 | 22 = Lock Block | |
56 | 23 = Read Multiple Blocks (usage: 0223+1byte 1st block to read+1byte last block to read+2bytes ISO15693-CRC) | |
57 | 25 = Select | |
58 | 26 = Reset to Ready | |
59 | 27 = Write AFI | |
60 | 28 = Lock AFI | |
61 | 29 = Write DSFID | |
62 | 2A = Lock DSFID | |
63 | 2B = Get_System_Info (usage: 022B+2bytes ISO15693-CRC - answer: 14 or more bytes) | |
64 | 2C = Read Multiple Block Security Status (usage: 022C+1byte 1st block security to read+1byte last block security to read+2bytes ISO15693-CRC) | |
65 | ||
66 | EM Microelectronic CUSTOM COMMANDS | |
67 | A5 = Active EAS (followed by 1byte IC Manufacturer code+1byte EAS type) | |
68 | A7 = Write EAS ID (followed by 1byte IC Manufacturer code+2bytes EAS value) | |
69 | B8 = Get Protection Status for a specific block (followed by 1byte IC Manufacturer code+1byte block number+1byte of how many blocks after the previous is needed the info) | |
70 | E4 = Login (followed by 1byte IC Manufacturer code+4bytes password) | |
71 | NXP/Philips CUSTOM COMMANDS | |
72 | A0 = Inventory Read | |
73 | A1 = Fast Inventory Read | |
74 | A2 = Set EAS | |
75 | A3 = Reset EAS | |
76 | A4 = Lock EAS | |
77 | A5 = EAS Alarm | |
78 | A6 = Password Protect EAS | |
79 | A7 = Write EAS ID | |
80 | A8 = Read EPC | |
81 | B0 = Inventory Page Read | |
82 | B1 = Fast Inventory Page Read | |
83 | B2 = Get Random Number | |
84 | B3 = Set Password | |
85 | B4 = Write Password | |
86 | B5 = Lock Password | |
87 | B6 = Bit Password Protection | |
88 | B7 = Lock Page Protection Condition | |
89 | B8 = Get Multiple Block Protection Status | |
90 | B9 = Destroy SLI | |
91 | BA = Enable Privacy | |
92 | BB = 64bit Password Protection | |
93 | 40 = Long Range CMD (Standard ISO/TR7003:1990) | |
c5f8c67a | 94 | |
95 | ISO 7816-4 Basic interindustry commands. For command APDU's. | |
96 | B0 = READ BINARY | |
97 | D0 = WRITE BINARY | |
98 | D6 = UPDATE BINARY | |
99 | 0E = ERASE BINARY | |
100 | B2 = READ RECORDS | |
101 | D2 = WRITE RECORDS | |
102 | E2 = APPEND RECORD | |
103 | DC = UPDATE RECORD | |
104 | CA = GET DATA | |
105 | DA = PUT DATA | |
106 | A4 = SELECT FILE | |
107 | 20 = VERIFY | |
108 | 88 = INTERNAL AUTHENTICATION | |
109 | 82 = EXTERNAL AUTHENTICATION | |
110 | B4 = GET CHALLENGE | |
111 | 70 = MANAGE CHANNEL | |
112 | ||
113 | For response APDU's | |
114 | 90 00 = OK | |
115 | 6x xx = ERROR | |
116 | */ | |
b67f7ec3 MHS |
117 | |
118 | #define ICLASS_CMD_ACTALL 0x0A | |
119 | #define ICLASS_CMD_READ_OR_IDENTIFY 0x0C | |
120 | #define ICLASS_CMD_SELECT 0x81 | |
121 | #define ICLASS_CMD_PAGESEL 0x84 | |
122 | #define ICLASS_CMD_READCHECK_KD 0x88 | |
123 | #define ICLASS_CMD_READCHECK_KC 0x18 | |
124 | #define ICLASS_CMD_CHECK 0x05 | |
125 | #define ICLASS_CMD_DETECT 0x0F | |
126 | #define ICLASS_CMD_HALT 0x00 | |
127 | #define ICLASS_CMD_UPDATE 0x87 | |
128 | #define ICLASS_CMD_ACT 0x8E | |
129 | #define ICLASS_CMD_READ4 0x06 | |
130 | ||
131 | ||
132 | #define ISO14443A_CMD_REQA 0x26 | |
133 | #define ISO14443A_CMD_READBLOCK 0x30 | |
134 | #define ISO14443A_CMD_WUPA 0x52 | |
135 | #define ISO14443A_CMD_ANTICOLL_OR_SELECT 0x93 | |
136 | #define ISO14443A_CMD_ANTICOLL_OR_SELECT_2 0x95 | |
2c39c25c | 137 | #define ISO14443A_CMD_WRITEBLOCK 0xA0 |
b67f7ec3 MHS |
138 | #define ISO14443A_CMD_HALT 0x50 |
139 | #define ISO14443A_CMD_RATS 0xE0 | |
140 | ||
141 | #define MIFARE_AUTH_KEYA 0x60 | |
142 | #define MIFARE_AUTH_KEYB 0x61 | |
16a95d76 | 143 | #define MIFARE_MAGICWUPC1 0x40 |
144 | #define MIFARE_MAGICWUPC2 0x43 | |
145 | #define MIFARE_MAGICWIPEC 0x41 | |
b67f7ec3 MHS |
146 | #define MIFARE_CMD_INC 0xC0 |
147 | #define MIFARE_CMD_DEC 0xC1 | |
148 | #define MIFARE_CMD_RESTORE 0xC2 | |
149 | #define MIFARE_CMD_TRANSFER 0xB0 | |
150 | ||
e98572a1 | 151 | #define MIFARE_EV1_PERSONAL_UID 0x40 |
152 | #define MIFARE_EV1_SETMODE 0x43 | |
153 | ||
154 | ||
a98b05b7 | 155 | #define MIFARE_ULC_WRITE 0xA2 |
156 | //#define MIFARE_ULC__COMP_WRITE 0xA0 | |
b67f7ec3 | 157 | #define MIFARE_ULC_AUTH_1 0x1A |
11b1e2e5 | 158 | #define MIFARE_ULC_AUTH_2 0xAF |
7d010c49 | 159 | |
11b1e2e5 | 160 | #define MIFARE_ULEV1_AUTH 0x1B |
7d010c49 | 161 | #define MIFARE_ULEV1_VERSION 0x60 |
11b1e2e5 | 162 | #define MIFARE_ULEV1_FASTREAD 0x3A |
11b1e2e5 | 163 | #define MIFARE_ULEV1_READ_CNT 0x39 |
164 | #define MIFARE_ULEV1_INCR_CNT 0xA5 | |
165 | #define MIFARE_ULEV1_READSIG 0x3C | |
166 | #define MIFARE_ULEV1_CHECKTEAR 0x3E | |
167 | #define MIFARE_ULEV1_VCSL 0x4B | |
b67f7ec3 | 168 | |
e98572a1 | 169 | |
170 | ||
b67f7ec3 MHS |
171 | /** |
172 | 06 00 = INITIATE | |
173 | 0E xx = SELECT ID (xx = Chip-ID) | |
174 | 0B = Get UID | |
175 | 08 yy = Read Block (yy = block number) | |
176 | 09 yy dd dd dd dd = Write Block (yy = block number; dd dd dd dd = data to be written) | |
177 | 0C = Reset to Inventory | |
178 | 0F = Completion | |
179 | 0A 11 22 33 44 55 66 = Authenticate (11 22 33 44 55 66 = data to authenticate) | |
180 | **/ | |
181 | ||
182 | #define ISO14443B_REQB 0x05 | |
183 | #define ISO14443B_ATTRIB 0x1D | |
184 | #define ISO14443B_HALT 0x50 | |
185 | #define ISO14443B_INITIATE 0x06 | |
186 | #define ISO14443B_SELECT 0x0E | |
187 | #define ISO14443B_GET_UID 0x0B | |
188 | #define ISO14443B_READ_BLK 0x08 | |
189 | #define ISO14443B_WRITE_BLK 0x09 | |
190 | #define ISO14443B_RESET 0x0C | |
191 | #define ISO14443B_COMPLETION 0x0F | |
192 | #define ISO14443B_AUTHENTICATE 0x0A | |
c5f8c67a | 193 | #define ISO14443B_PING 0xBA |
194 | #define ISO14443B_PONG 0xAB | |
b67f7ec3 MHS |
195 | |
196 | //First byte is 26 | |
197 | #define ISO15693_INVENTORY 0x01 | |
198 | #define ISO15693_STAYQUIET 0x02 | |
199 | //First byte is 02 | |
200 | #define ISO15693_READBLOCK 0x20 | |
201 | #define ISO15693_WRITEBLOCK 0x21 | |
202 | #define ISO15693_LOCKBLOCK 0x22 | |
203 | #define ISO15693_READ_MULTI_BLOCK 0x23 | |
204 | #define ISO15693_SELECT 0x25 | |
205 | #define ISO15693_RESET_TO_READY 0x26 | |
206 | #define ISO15693_WRITE_AFI 0x27 | |
207 | #define ISO15693_LOCK_AFI 0x28 | |
208 | #define ISO15693_WRITE_DSFID 0x29 | |
209 | #define ISO15693_LOCK_DSFID 0x2A | |
210 | #define ISO15693_GET_SYSTEM_INFO 0x2B | |
211 | #define ISO15693_READ_MULTI_SECSTATUS 0x2C | |
212 | ||
213 | ||
0ec548dc | 214 | // Topaz command set: |
215 | #define TOPAZ_REQA 0x26 // Request | |
216 | #define TOPAZ_WUPA 0x52 // WakeUp | |
217 | #define TOPAZ_RID 0x78 // Read ID | |
218 | #define TOPAZ_RALL 0x00 // Read All (all bytes) | |
219 | #define TOPAZ_READ 0x01 // Read (a single byte) | |
220 | #define TOPAZ_WRITE_E 0x53 // Write-with-erase (a single byte) | |
221 | #define TOPAZ_WRITE_NE 0x1a // Write-no-erase (a single byte) | |
222 | // additional commands for Dynamic Memory Model | |
223 | #define TOPAZ_RSEG 0x10 // Read segment | |
224 | #define TOPAZ_READ8 0x02 // Read (eight bytes) | |
225 | #define TOPAZ_WRITE_E8 0x54 // Write-with-erase (eight bytes) | |
226 | #define TOPAZ_WRITE_NE8 0x1B // Write-no-erase (eight bytes) | |
227 | ||
228 | ||
c5f8c67a | 229 | #define ISO_14443A 0 |
230 | #define ICLASS 1 | |
231 | #define ISO_14443B 2 | |
0ec548dc | 232 | #define TOPAZ 3 |
c5f8c67a | 233 | #define ISO_7816_4 4 |
b67f7ec3 | 234 | |
1defcf60 MHS |
235 | //-- Picopass fuses |
236 | #define FUSE_FPERS 0x80 | |
237 | #define FUSE_CODING1 0x40 | |
238 | #define FUSE_CODING0 0x20 | |
239 | #define FUSE_CRYPT1 0x10 | |
240 | #define FUSE_CRYPT0 0x08 | |
241 | #define FUSE_FPROD1 0x04 | |
242 | #define FUSE_FPROD0 0x02 | |
243 | #define FUSE_RA 0x01 | |
244 | ||
c5f8c67a | 245 | // ISO 7816-4 Basic interindustry commands. For command APDU's. |
246 | #define ISO7816_READ_BINARY 0xB0 | |
247 | #define ISO7816_WRITE_BINARY 0xD0 | |
248 | #define ISO7816_UPDATE_BINARY 0xD6 | |
249 | #define ISO7816_ERASE_BINARY 0x0E | |
250 | #define ISO7816_READ_RECORDS 0xB2 | |
251 | #define ISO7816_WRITE_RECORDS 0xD2 | |
252 | #define ISO7816_APPEND_RECORD 0xE2 | |
253 | #define ISO7816_UPDATE_RECORD 0xDC | |
254 | #define ISO7816_GET_DATA 0xCA | |
255 | #define ISO7816_PUT_DATA 0xDA | |
256 | #define ISO7816_SELECT_FILE 0xA4 | |
257 | #define ISO7816_VERIFY 0x20 | |
258 | #define ISO7816_INTERNAL_AUTHENTICATION 0x88 | |
259 | #define ISO7816_EXTERNAL_AUTHENTICATION 0x82 | |
260 | #define ISO7816_GET_CHALLENGE 0xB4 | |
261 | #define ISO7816_MANAGE_CHANNEL 0x70 | |
1defcf60 | 262 | |
c5f8c67a | 263 | // ISO7816-4 For response APDU's |
264 | #define ISO7816_OK 0x9000 | |
265 | // 6x xx = ERROR | |
266 | ||
1defcf60 | 267 | void printIclassDumpInfo(uint8_t* iclass_dump); |
e98572a1 | 268 | void getMemConfig(uint8_t mem_cfg, uint8_t chip_cfg, uint8_t *max_blk, uint8_t *app_areas, uint8_t *kb); |
b67f7ec3 | 269 | |
1d0ccbe0 | 270 | /* T55x7 configuration register definitions */ |
857bc2ff | 271 | #define T55x7_POR_DELAY 0x00000001 |
272 | #define T55x7_ST_TERMINATOR 0x00000008 | |
273 | #define T55x7_PWD 0x00000010 | |
1d0ccbe0 | 274 | #define T55x7_MAXBLOCK_SHIFT 5 |
857bc2ff | 275 | #define T55x7_AOR 0x00000200 |
276 | #define T55x7_PSKCF_RF_2 0 | |
277 | #define T55x7_PSKCF_RF_4 0x00000400 | |
278 | #define T55x7_PSKCF_RF_8 0x00000800 | |
1d0ccbe0 | 279 | #define T55x7_MODULATION_DIRECT 0 |
280 | #define T55x7_MODULATION_PSK1 0x00001000 | |
281 | #define T55x7_MODULATION_PSK2 0x00002000 | |
282 | #define T55x7_MODULATION_PSK3 0x00003000 | |
283 | #define T55x7_MODULATION_FSK1 0x00004000 | |
284 | #define T55x7_MODULATION_FSK2 0x00005000 | |
285 | #define T55x7_MODULATION_FSK1a 0x00006000 | |
286 | #define T55x7_MODULATION_FSK2a 0x00007000 | |
287 | #define T55x7_MODULATION_MANCHESTER 0x00008000 | |
288 | #define T55x7_MODULATION_BIPHASE 0x00010000 | |
289 | #define T55x7_MODULATION_DIPHASE 0x00018000 | |
857bc2ff | 290 | #define T55x7_BITRATE_RF_8 0 |
291 | #define T55x7_BITRATE_RF_16 0x00040000 | |
292 | #define T55x7_BITRATE_RF_32 0x00080000 | |
293 | #define T55x7_BITRATE_RF_40 0x000C0000 | |
294 | #define T55x7_BITRATE_RF_50 0x00100000 | |
295 | #define T55x7_BITRATE_RF_64 0x00140000 | |
1d0ccbe0 | 296 | #define T55x7_BITRATE_RF_100 0x00180000 |
297 | #define T55x7_BITRATE_RF_128 0x001C0000 | |
298 | ||
299 | /* T5555 (Q5) configuration register definitions */ | |
857bc2ff | 300 | #define T5555_ST_TERMINATOR 0x00000001 |
1d0ccbe0 | 301 | #define T5555_MAXBLOCK_SHIFT 0x00000001 |
302 | #define T5555_MODULATION_MANCHESTER 0 | |
303 | #define T5555_MODULATION_PSK1 0x00000010 | |
304 | #define T5555_MODULATION_PSK2 0x00000020 | |
305 | #define T5555_MODULATION_PSK3 0x00000030 | |
306 | #define T5555_MODULATION_FSK1 0x00000040 | |
307 | #define T5555_MODULATION_FSK2 0x00000050 | |
308 | #define T5555_MODULATION_BIPHASE 0x00000060 | |
309 | #define T5555_MODULATION_DIRECT 0x00000070 | |
857bc2ff | 310 | #define T5555_INVERT_OUTPUT 0x00000080 |
311 | #define T5555_PSK_RF_2 0 | |
312 | #define T5555_PSK_RF_4 0x00000100 | |
313 | #define T5555_PSK_RF_8 0x00000200 | |
314 | #define T5555_USE_PWD 0x00000400 | |
315 | #define T5555_USE_AOR 0x00000800 | |
316 | #define T5555_BITRATE_SHIFT 12 | |
317 | #define T5555_FAST_WRITE 0x00004000 | |
318 | #define T5555_PAGE_SELECT 0x00008000 | |
1d0ccbe0 | 319 | |
320 | uint32_t GetT55xxClockBit(uint32_t clock); | |
321 | ||
322 | #endif | |
323 | // PROTOCOLS_H |