]>
Commit | Line | Data |
---|---|---|
1 | //----------------------------------------------------------------------------- | |
2 | // Copyright (C) 2010 iZsh <izsh at fail0verflow.com> | |
3 | // | |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
5 | // at your option, any later version. See the LICENSE.txt file for the text of | |
6 | // the license. | |
7 | //----------------------------------------------------------------------------- | |
8 | // High frequency ISO14443B commands | |
9 | //----------------------------------------------------------------------------- | |
10 | ||
11 | #include <stdio.h> | |
12 | #include <stdlib.h> | |
13 | #include <stdbool.h> | |
14 | #include <stdint.h> | |
15 | #include "cmdhf14b.h" | |
16 | ||
17 | #define TIMEOUT 2000 | |
18 | static int CmdHelp(const char *Cmd); | |
19 | ||
20 | int usage_hf_14b_info(void){ | |
21 | PrintAndLog("Usage: hf 14b info [-h] [-s]"); | |
22 | PrintAndLog(" -h this help"); | |
23 | PrintAndLog(" -s silently"); | |
24 | return 0; | |
25 | } | |
26 | int usage_hf_14b_reader(void){ | |
27 | PrintAndLog("Usage: hf 14b reader [-h] [-s]"); | |
28 | PrintAndLog(" -h this help"); | |
29 | PrintAndLog(" -s silently"); | |
30 | return 0; | |
31 | } | |
32 | int usage_hf_14b_raw(void){ | |
33 | PrintAndLog("Usage: hf 14b raw [-h] [-r] [-c] [-p] [-s || -ss] <0A 0B 0C ... hex>"); | |
34 | PrintAndLog(" -h this help"); | |
35 | PrintAndLog(" -r do not read response"); | |
36 | PrintAndLog(" -c calculate and append CRC"); | |
37 | PrintAndLog(" -p leave the field on after receive"); | |
38 | PrintAndLog(" -s active signal field ON with select"); | |
39 | PrintAndLog(" -ss active signal field ON with select for SRx ST Microelectronics tags"); | |
40 | return 0; | |
41 | } | |
42 | int usage_hf_14b_snoop(void){ | |
43 | PrintAndLog("It get data from the field and saves it into command buffer."); | |
44 | PrintAndLog("Buffer accessible from command 'hf list 14b'"); | |
45 | PrintAndLog("Usage: hf 14b snoop [-h]"); | |
46 | PrintAndLog(" -h this help"); | |
47 | PrintAndLog("sample: hf 14b snoop"); | |
48 | return 0; | |
49 | } | |
50 | int usage_hf_14b_sim(void){ | |
51 | PrintAndLog("Emulating ISO/IEC 14443 type B tag with 4 UID"); | |
52 | PrintAndLog("Usage: hf 14b sim [-h]"); | |
53 | PrintAndLog(" -h this help"); | |
54 | PrintAndLog("sample: hf 14b sim"); | |
55 | return 0; | |
56 | } | |
57 | int usage_hf_14b_read_srx(void){ | |
58 | PrintAndLog("Usage: hf 14b read [h] <1|2>"); | |
59 | PrintAndLog("Options:"); | |
60 | PrintAndLog(" h this help"); | |
61 | PrintAndLog(" <1|2> 1 = SRIX4K , 2 = SRI512"); | |
62 | PrintAndLog("sample: hf 14b read 1"); | |
63 | PrintAndLog(" : hf 14b read 2"); | |
64 | return 0; | |
65 | } | |
66 | int usage_hf_14b_write_srx(void){ | |
67 | PrintAndLog("Usage: hf 14b write <1|2> <BLOCK> <DATA>"); | |
68 | PrintAndLog("Options:"); | |
69 | PrintAndLog(" h this help"); | |
70 | PrintAndLog(" <1|2> 1 = SRIX4K , 2 = SRI512"); | |
71 | PrintAndLog(" <block> BLOCK number depends on tag, special block == FF"); | |
72 | PrintAndLog(" <data> hex bytes of data to be written"); | |
73 | PrintAndLog("sample : hf 14b write 1 7F 11223344"); | |
74 | PrintAndLog(" : hf 14b write 1 FF 11223344"); | |
75 | PrintAndLog(" : hf 14b write 2 15 11223344"); | |
76 | PrintAndLog(" : hf 14b write 2 FF 11223344"); | |
77 | return 0; | |
78 | } | |
79 | ||
80 | static int rawClose(){ | |
81 | UsbCommand c = {CMD_ISO_14443B_COMMAND, {ISO14B_DISCONNECT, 0, 0}}; | |
82 | clearCommandBuffer(); | |
83 | SendCommand(&c); | |
84 | return 1; | |
85 | } | |
86 | ||
87 | int CmdHF14BList(const char *Cmd) { | |
88 | CmdHFList("14b"); | |
89 | return 0; | |
90 | } | |
91 | ||
92 | int CmdHF14BSim(const char *Cmd) { | |
93 | char cmdp = param_getchar(Cmd, 0); | |
94 | if (cmdp == 'h' || cmdp == 'H') return usage_hf_14b_sim(); | |
95 | ||
96 | UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443B, {0, 0, 0}}; | |
97 | clearCommandBuffer(); | |
98 | SendCommand(&c); | |
99 | return 0; | |
100 | } | |
101 | ||
102 | int CmdHF14BSnoop(const char *Cmd) { | |
103 | ||
104 | char cmdp = param_getchar(Cmd, 0); | |
105 | if (cmdp == 'h' || cmdp == 'H') return usage_hf_14b_snoop(); | |
106 | ||
107 | UsbCommand c = {CMD_SNOOP_ISO_14443B, {0, 0, 0}}; | |
108 | clearCommandBuffer(); | |
109 | SendCommand(&c); | |
110 | return 0; | |
111 | } | |
112 | ||
113 | int CmdHF14BCmdRaw (const char *Cmd) { | |
114 | bool reply = TRUE; | |
115 | bool power = FALSE; | |
116 | bool select = FALSE; | |
117 | char buf[5]=""; | |
118 | ||
119 | int i = 0; | |
120 | uint8_t data[USB_CMD_DATA_SIZE] = {0x00}; | |
121 | uint16_t datalen = 0; | |
122 | uint32_t flags = 0; | |
123 | uint32_t temp = 0; | |
124 | ||
125 | if (strlen(Cmd)<3) return usage_hf_14b_raw(); | |
126 | ||
127 | // strip | |
128 | while (*Cmd==' ' || *Cmd=='\t') ++Cmd; | |
129 | ||
130 | while (Cmd[i]!='\0') { | |
131 | if (Cmd[i]==' ' || Cmd[i]=='\t') { ++i; continue; } | |
132 | if (Cmd[i]=='-') { | |
133 | switch (Cmd[i+1]) { | |
134 | case 'H': | |
135 | case 'h': | |
136 | return usage_hf_14b_raw(); | |
137 | case 'r': | |
138 | case 'R': | |
139 | reply = FALSE; | |
140 | break; | |
141 | case 'c': | |
142 | case 'C': | |
143 | flags |= ISO14B_APPEND_CRC; | |
144 | break; | |
145 | case 'p': | |
146 | case 'P': | |
147 | power = TRUE; | |
148 | break; | |
149 | case 's': | |
150 | case 'S': | |
151 | flags |= ISO14B_CONNECT; | |
152 | select = TRUE; | |
153 | if (Cmd[i+2]=='s' || Cmd[i+2]=='S') { | |
154 | flags |= ISO14B_SELECT_SR; | |
155 | ++i; | |
156 | } else { | |
157 | flags |= ISO14B_SELECT_STD; | |
158 | } | |
159 | break; | |
160 | default: | |
161 | return usage_hf_14b_raw(); | |
162 | } | |
163 | i+=2; | |
164 | continue; | |
165 | } | |
166 | if ((Cmd[i]>='0' && Cmd[i]<='9') || | |
167 | (Cmd[i]>='a' && Cmd[i]<='f') || | |
168 | (Cmd[i]>='A' && Cmd[i]<='F') ) { | |
169 | buf[strlen(buf)+1]=0; | |
170 | buf[strlen(buf)]=Cmd[i]; | |
171 | i++; | |
172 | ||
173 | if (strlen(buf)>=2) { | |
174 | sscanf(buf,"%x",&temp); | |
175 | data[datalen++] = (uint8_t)(temp & 0xff); | |
176 | *buf=0; | |
177 | memset(buf, 0x00, sizeof(buf)); | |
178 | } | |
179 | continue; | |
180 | } | |
181 | PrintAndLog("Invalid char on input"); | |
182 | return 0; | |
183 | } | |
184 | ||
185 | if(!power) | |
186 | flags |= ISO14B_DISCONNECT; | |
187 | ||
188 | if(datalen>0) | |
189 | flags |= ISO14B_RAW; | |
190 | ||
191 | // Max buffer is USB_CMD_DATA_SIZE | |
192 | datalen = (datalen > USB_CMD_DATA_SIZE) ? USB_CMD_DATA_SIZE : datalen; | |
193 | ||
194 | UsbCommand c = {CMD_ISO_14443B_COMMAND, {flags, datalen, 0}}; | |
195 | memcpy(c.d.asBytes, data, datalen); | |
196 | clearCommandBuffer(); | |
197 | SendCommand(&c); | |
198 | ||
199 | if (!reply) return 1; | |
200 | ||
201 | bool success = TRUE; | |
202 | // get back iso14b_card_select_t, don't print it. | |
203 | if(select) | |
204 | success = waitCmd(FALSE); | |
205 | ||
206 | // get back response from the raw bytes you sent. | |
207 | if(success && datalen>0) waitCmd(TRUE); | |
208 | ||
209 | return 1; | |
210 | } | |
211 | ||
212 | // print full atqb info | |
213 | static void print_atqb_resp(uint8_t *data, uint8_t cid){ | |
214 | //PrintAndLog (" UID: %s", sprint_hex(data+1,4)); | |
215 | PrintAndLog (" App Data: %s", sprint_hex(data,4)); | |
216 | PrintAndLog (" Protocol: %s", sprint_hex(data+4,3)); | |
217 | uint8_t BitRate = data[4]; | |
218 | if (!BitRate) PrintAndLog (" Bit Rate: 106 kbit/s only PICC <-> PCD"); | |
219 | if (BitRate & 0x10) PrintAndLog (" Bit Rate: 212 kbit/s PICC -> PCD supported"); | |
220 | if (BitRate & 0x20) PrintAndLog (" Bit Rate: 424 kbit/s PICC -> PCD supported"); | |
221 | if (BitRate & 0x40) PrintAndLog (" Bit Rate: 847 kbit/s PICC -> PCD supported"); | |
222 | if (BitRate & 0x01) PrintAndLog (" Bit Rate: 212 kbit/s PICC <- PCD supported"); | |
223 | if (BitRate & 0x02) PrintAndLog (" Bit Rate: 424 kbit/s PICC <- PCD supported"); | |
224 | if (BitRate & 0x04) PrintAndLog (" Bit Rate: 847 kbit/s PICC <- PCD supported"); | |
225 | if (BitRate & 0x80) PrintAndLog (" Same bit rate <-> required"); | |
226 | ||
227 | uint16_t maxFrame = data[5]>>4; | |
228 | if (maxFrame < 5) maxFrame = 8 * maxFrame + 16; | |
229 | else if (maxFrame == 5) maxFrame = 64; | |
230 | else if (maxFrame == 6) maxFrame = 96; | |
231 | else if (maxFrame == 7) maxFrame = 128; | |
232 | else if (maxFrame == 8) maxFrame = 256; | |
233 | else maxFrame = 257; | |
234 | ||
235 | PrintAndLog ("Max Frame Size: %u%s",maxFrame, (maxFrame == 257) ? "+ RFU" : ""); | |
236 | ||
237 | uint8_t protocolT = data[5] & 0xF; | |
238 | PrintAndLog (" Protocol Type: Protocol is %scompliant with ISO/IEC 14443-4",(protocolT) ? "" : "not " ); | |
239 | PrintAndLog ("Frame Wait Int: %u", data[6]>>4); | |
240 | PrintAndLog (" App Data Code: Application is %s",(data[6]&4) ? "Standard" : "Proprietary"); | |
241 | PrintAndLog (" Frame Options: NAD is %ssupported",(data[6]&2) ? "" : "not "); | |
242 | PrintAndLog (" Frame Options: CID is %ssupported",(data[6]&1) ? "" : "not "); | |
243 | PrintAndLog ("Tag :"); | |
244 | PrintAndLog (" Max Buf Length: %u (MBLI) %s",cid>>4, (cid & 0xF0) ? "" : "not supported"); | |
245 | PrintAndLog (" Cid : %u", cid & 0x0f); | |
246 | return; | |
247 | } | |
248 | ||
249 | // get SRx chip model (from UID) // from ST Microelectronics | |
250 | char *get_ST_Chip_Model(uint8_t data){ | |
251 | static char model[20]; | |
252 | char *retStr = model; | |
253 | memset(model,0, sizeof(model)); | |
254 | ||
255 | switch (data) { | |
256 | case 0x0: sprintf(retStr, "SRIX4K (Special)"); break; | |
257 | case 0x2: sprintf(retStr, "SR176"); break; | |
258 | case 0x3: sprintf(retStr, "SRIX4K"); break; | |
259 | case 0x4: sprintf(retStr, "SRIX512"); break; | |
260 | case 0x6: sprintf(retStr, "SRI512"); break; | |
261 | case 0x7: sprintf(retStr, "SRI4K"); break; | |
262 | case 0xC: sprintf(retStr, "SRT512"); break; | |
263 | default : sprintf(retStr, "Unknown"); break; | |
264 | } | |
265 | return retStr; | |
266 | } | |
267 | ||
268 | // REMAKE: | |
269 | int print_ST_Lock_info(uint8_t model){ | |
270 | ||
271 | // PrintAndLog("Chip Write Protection Bits:"); | |
272 | // // now interpret the data | |
273 | // switch (model){ | |
274 | // case 0x0: //fall through (SRIX4K special) | |
275 | // case 0x3: //fall through (SRIx4K) | |
276 | // case 0x7: // (SRI4K) | |
277 | // //only need data[3] | |
278 | // blk1 = 9; | |
279 | // PrintAndLog(" raw: %s", sprint_bin(data+3, 1)); | |
280 | // PrintAndLog(" 07/08:%slocked", (data[3] & 1) ? " not " : " " ); | |
281 | // for (uint8_t i = 1; i<8; i++){ | |
282 | // PrintAndLog(" %02u:%slocked", blk1, (data[3] & (1 << i)) ? " not " : " " ); | |
283 | // blk1++; | |
284 | // } | |
285 | // break; | |
286 | // case 0x4: //fall through (SRIX512) | |
287 | // case 0x6: //fall through (SRI512) | |
288 | // case 0xC: // (SRT512) | |
289 | // //need data[2] and data[3] | |
290 | // blk1 = 0; | |
291 | // PrintAndLog(" raw: %s", sprint_bin(data+2, 2)); | |
292 | // for (uint8_t b=2; b<4; b++){ | |
293 | // for (uint8_t i=0; i<8; i++){ | |
294 | // PrintAndLog(" %02u:%slocked", blk1, (data[b] & (1 << i)) ? " not " : " " ); | |
295 | // blk1++; | |
296 | // } | |
297 | // } | |
298 | // break; | |
299 | // case 0x2: // (SR176) | |
300 | // //need data[2] | |
301 | // blk1 = 0; | |
302 | // PrintAndLog(" raw: %s", sprint_bin(data+2, 1)); | |
303 | // for (uint8_t i = 0; i<8; i++){ | |
304 | // PrintAndLog(" %02u/%02u:%slocked", blk1, blk1+1, (data[2] & (1 << i)) ? " " : " not " ); | |
305 | // blk1+=2; | |
306 | // } | |
307 | // break; | |
308 | // default: | |
309 | // return rawClose(); | |
310 | // } | |
311 | return 1; | |
312 | } | |
313 | ||
314 | // print UID info from SRx chips (ST Microelectronics) | |
315 | static void print_st_general_info(uint8_t *data, uint8_t len){ | |
316 | //uid = first 8 bytes in data | |
317 | PrintAndLog(" UID: %s", sprint_hex(SwapEndian64(data,8,8), len)); | |
318 | PrintAndLog(" MFG: %02X, %s", data[6], getTagInfo(data[6])); | |
319 | PrintAndLog("Chip: %02X, %s", data[5]>>2, get_ST_Chip_Model(data[5]>>2)); | |
320 | return; | |
321 | } | |
322 | ||
323 | //05 00 00 = find one tag in field | |
324 | //1d xx xx xx xx 00 08 01 00 = attrib xx=UID (resp 10 [f9 e0]) | |
325 | //a3 = ? (resp 03 [e2 c2]) | |
326 | //02 = ? (resp 02 [6a d3]) | |
327 | // 022b (resp 02 67 00 [29 5b]) | |
328 | // 0200a40400 (resp 02 67 00 [29 5b]) | |
329 | // 0200a4040c07a0000002480300 (resp 02 67 00 [29 5b]) | |
330 | // 0200a4040c07a0000002480200 (resp 02 67 00 [29 5b]) | |
331 | // 0200a4040006a0000000010100 (resp 02 6a 82 [4b 4c]) | |
332 | // 0200a4040c09d27600002545500200 (resp 02 67 00 [29 5b]) | |
333 | // 0200a404000cd2760001354b414e4d30310000 (resp 02 6a 82 [4b 4c]) | |
334 | // 0200a404000ca000000063504b43532d313500 (resp 02 6a 82 [4b 4c]) | |
335 | // 0200a4040010a000000018300301000000000000000000 (resp 02 6a 82 [4b 4c]) | |
336 | //03 = ? (resp 03 [e3 c2]) | |
337 | //c2 = ? (resp c2 [66 15]) | |
338 | //b2 = ? (resp a3 [e9 67]) | |
339 | //a2 = ? (resp 02 [6a d3]) | |
340 | ||
341 | // 14b get and print Full Info (as much as we know) | |
342 | bool HF14B_Std_Info(bool verbose){ | |
343 | //add more info here | |
344 | return FALSE; | |
345 | } | |
346 | ||
347 | // SRx get and print full info (needs more info...) | |
348 | bool HF14B_ST_Info(bool verbose){ | |
349 | ||
350 | UsbCommand c = {CMD_ISO_14443B_COMMAND, {ISO14B_CONNECT | ISO14B_SELECT_SR | ISO14B_DISCONNECT, 0, 0}}; | |
351 | clearCommandBuffer(); | |
352 | SendCommand(&c); | |
353 | UsbCommand resp; | |
354 | ||
355 | if (!WaitForResponseTimeout(CMD_ACK, &resp, TIMEOUT)) { | |
356 | if (verbose) PrintAndLog("timeout while waiting for reply."); | |
357 | return FALSE; | |
358 | } | |
359 | ||
360 | iso14b_card_select_t card; | |
361 | memcpy(&card, (iso14b_card_select_t *)resp.d.asBytes, sizeof(iso14b_card_select_t)); | |
362 | ||
363 | uint64_t status = resp.arg[0]; | |
364 | if ( status > 0 ) { | |
365 | rawClose(); | |
366 | return FALSE; | |
367 | } | |
368 | ||
369 | //add locking bit information here. uint8_t data[16] = {0x00}; | |
370 | // uint8_t datalen = 2; | |
371 | // uint8_t resplen; | |
372 | // uint8_t blk1; | |
373 | // data[0] = 0x08; | |
374 | ||
375 | // | |
376 | // if (model == 0x2) { //SR176 has special command: | |
377 | // data[1] = 0xf; | |
378 | // resplen = 4; | |
379 | // } else { | |
380 | // data[1] = 0xff; | |
381 | // resplen = 6; | |
382 | // } | |
383 | ||
384 | // //std read cmd | |
385 | // if (HF14BCmdRaw(true, true, data, &datalen, false)==0) | |
386 | // return rawClose(); | |
387 | ||
388 | // if (datalen != resplen || !crc) return rawClose(); | |
389 | //print_ST_Lock_info(data[5]>>2); | |
390 | rawClose(); | |
391 | return TRUE; | |
392 | } | |
393 | ||
394 | // get and print all info known about any known 14b tag | |
395 | bool HF14BInfo(bool verbose){ | |
396 | ||
397 | // try std 14b (atqb) | |
398 | if (HF14B_Std_Info(verbose)) return TRUE; | |
399 | ||
400 | // try st 14b | |
401 | if (HF14B_ST_Info(verbose)) return TRUE; | |
402 | ||
403 | // try unknown 14b read commands (to be identified later) | |
404 | // could be read of calypso, CEPAS, moneo, or pico pass. | |
405 | ||
406 | if (verbose) PrintAndLog("no 14443B tag found"); | |
407 | return FALSE; | |
408 | } | |
409 | ||
410 | // menu command to get and print all info known about any known 14b tag | |
411 | int CmdHF14Binfo(const char *Cmd){ | |
412 | char cmdp = param_getchar(Cmd, 0); | |
413 | if (cmdp == 'h' || cmdp == 'H') return usage_hf_14b_info(); | |
414 | ||
415 | bool verbose = !((cmdp == 's') || (cmdp == 'S')); | |
416 | return HF14BInfo(verbose); | |
417 | } | |
418 | ||
419 | bool HF14B_ST_Reader(bool verbose){ | |
420 | ||
421 | bool isSuccess = FALSE; | |
422 | ||
423 | // SRx get and print general info about SRx chip from UID | |
424 | UsbCommand c = {CMD_ISO_14443B_COMMAND, {ISO14B_CONNECT | ISO14B_SELECT_SR | ISO14B_DISCONNECT, 0, 0}}; | |
425 | clearCommandBuffer(); | |
426 | SendCommand(&c); | |
427 | UsbCommand resp; | |
428 | ||
429 | if (!WaitForResponseTimeout(CMD_ACK, &resp, TIMEOUT)) { | |
430 | if (verbose) PrintAndLog("timeout while waiting for reply."); | |
431 | return FALSE; | |
432 | } | |
433 | ||
434 | ||
435 | iso14b_card_select_t card; | |
436 | memcpy(&card, (iso14b_card_select_t *)resp.d.asBytes, sizeof(iso14b_card_select_t)); | |
437 | ||
438 | uint64_t status = resp.arg[0]; | |
439 | ||
440 | switch( status ){ | |
441 | case 0: | |
442 | print_st_general_info(card.uid, card.uidlen); | |
443 | isSuccess = TRUE; | |
444 | break; | |
445 | case 1: | |
446 | if (verbose) PrintAndLog("iso14443-3 random chip id fail"); | |
447 | break; | |
448 | case 2: | |
449 | if (verbose) PrintAndLog("iso14443-3 ATTRIB fail"); | |
450 | break; | |
451 | case 3: | |
452 | if (verbose) PrintAndLog("iso14443-3 CRC fail"); | |
453 | break; | |
454 | default: | |
455 | if (verbose) PrintAndLog("iso14443b card select SRx failed"); | |
456 | break; | |
457 | } | |
458 | ||
459 | rawClose(); | |
460 | return isSuccess; | |
461 | } | |
462 | ||
463 | bool HF14B_Std_Reader(bool verbose){ | |
464 | ||
465 | bool isSuccess = FALSE; | |
466 | ||
467 | // 14b get and print UID only (general info) | |
468 | UsbCommand c = {CMD_ISO_14443B_COMMAND, {ISO14B_CONNECT | ISO14B_SELECT_STD | ISO14B_DISCONNECT, 0, 0}}; | |
469 | clearCommandBuffer(); | |
470 | SendCommand(&c); | |
471 | UsbCommand resp; | |
472 | ||
473 | if (!WaitForResponseTimeout(CMD_ACK, &resp, TIMEOUT)) { | |
474 | if (verbose) PrintAndLog("timeout while waiting for reply."); | |
475 | return FALSE; | |
476 | } | |
477 | ||
478 | iso14b_card_select_t card; | |
479 | memcpy(&card, (iso14b_card_select_t *)resp.d.asBytes, sizeof(iso14b_card_select_t)); | |
480 | ||
481 | uint64_t status = resp.arg[0]; | |
482 | ||
483 | switch( status ){ | |
484 | case 0: | |
485 | PrintAndLog(" UID : %s", sprint_hex(card.uid, card.uidlen)); | |
486 | PrintAndLog(" ATQB : %s", sprint_hex(card.atqb, sizeof(card.atqb))); | |
487 | PrintAndLog(" CHIPID : %02X", card.chipid); | |
488 | print_atqb_resp(card.atqb, card.cid); | |
489 | isSuccess = TRUE; | |
490 | break; | |
491 | case 2: | |
492 | if (verbose) PrintAndLog("iso14443-3 ATTRIB fail"); | |
493 | break; | |
494 | case 3: | |
495 | if (verbose) PrintAndLog("iso14443-3 CRC fail"); | |
496 | break; | |
497 | default: | |
498 | if (verbose) PrintAndLog("iso14443b card select failed"); | |
499 | break; | |
500 | } | |
501 | ||
502 | rawClose(); | |
503 | return isSuccess; | |
504 | } | |
505 | ||
506 | // test for other 14b type tags (mimic another reader - don't have tags to identify) | |
507 | bool HF14B_Other_Reader(){ | |
508 | ||
509 | // uint8_t data[] = {0x00, 0x0b, 0x3f, 0x80}; | |
510 | // uint8_t datalen = 4; | |
511 | ||
512 | // // 14b get and print UID only (general info) | |
513 | // uint32_t flags = ISO14B_CONNECT | ISO14B_SELECT_STD | ISO14B_RAW | ISO14B_APPEND_CRC; | |
514 | ||
515 | // UsbCommand c = {CMD_ISO_14443B_COMMAND, {flags, datalen, 0}}; | |
516 | // memcpy(c.d.asBytes, data, datalen); | |
517 | ||
518 | // clearCommandBuffer(); | |
519 | // SendCommand(&c); | |
520 | // UsbCommand resp; | |
521 | // WaitForResponse(CMD_ACK,&resp); | |
522 | ||
523 | // if (datalen > 2 ) { | |
524 | // printandlog ("\n14443-3b tag found:"); | |
525 | // printandlog ("unknown tag type answered to a 0x000b3f80 command ans:"); | |
526 | // //printandlog ("%s", sprint_hex(data, datalen)); | |
527 | // rawclose(); | |
528 | // return true; | |
529 | // } | |
530 | ||
531 | // c.arg1 = 1; | |
532 | // c.d.asBytes[0] = ISO14443B_AUTHENTICATE; | |
533 | // clearCommandBuffer(); | |
534 | // SendCommand(&c); | |
535 | // UsbCommand resp; | |
536 | // WaitForResponse(CMD_ACK, &resp); | |
537 | ||
538 | // if (datalen > 0) { | |
539 | // PrintAndLog ("\n14443-3b tag found:"); | |
540 | // PrintAndLog ("Unknown tag type answered to a 0x0A command ans:"); | |
541 | // // PrintAndLog ("%s", sprint_hex(data, datalen)); | |
542 | // rawClose(); | |
543 | // return TRUE; | |
544 | // } | |
545 | ||
546 | // c.arg1 = 1; | |
547 | // c.d.asBytes[0] = ISO14443B_RESET; | |
548 | // clearCommandBuffer(); | |
549 | // SendCommand(&c); | |
550 | // UsbCommand resp; | |
551 | // WaitForResponse(CMD_ACK, &resp); | |
552 | ||
553 | // if (datalen > 0) { | |
554 | // PrintAndLog ("\n14443-3b tag found:"); | |
555 | // PrintAndLog ("Unknown tag type answered to a 0x0C command ans:"); | |
556 | // PrintAndLog ("%s", sprint_hex(data, datalen)); | |
557 | // rawClose(); | |
558 | // return TRUE; | |
559 | // } | |
560 | ||
561 | // rawClose(); | |
562 | return FALSE; | |
563 | } | |
564 | ||
565 | // get and print general info about all known 14b chips | |
566 | bool HF14BReader(bool verbose){ | |
567 | ||
568 | // try std 14b (atqb) | |
569 | if (HF14B_Std_Reader(verbose)) return TRUE; | |
570 | ||
571 | // try ST Microelectronics 14b | |
572 | if (HF14B_ST_Reader(verbose)) return TRUE; | |
573 | ||
574 | // try unknown 14b read commands (to be identified later) | |
575 | // could be read of calypso, CEPAS, moneo, or pico pass. | |
576 | if (HF14B_Other_Reader()) return TRUE; | |
577 | ||
578 | if (verbose) PrintAndLog("no 14443B tag found"); | |
579 | return FALSE; | |
580 | } | |
581 | ||
582 | // menu command to get and print general info about all known 14b chips | |
583 | int CmdHF14BReader(const char *Cmd){ | |
584 | char cmdp = param_getchar(Cmd, 0); | |
585 | if (cmdp == 'h' || cmdp == 'H') return usage_hf_14b_reader(); | |
586 | ||
587 | bool verbose = !((cmdp == 's') || (cmdp == 'S')); | |
588 | return HF14BReader(verbose); | |
589 | } | |
590 | ||
591 | /* New command to read the contents of a SRI512|SRIX4K tag | |
592 | * SRI* tags are ISO14443-B modulated memory tags, | |
593 | * this command just dumps the contents of the memory/ | |
594 | */ | |
595 | int CmdHF14BReadSri(const char *Cmd){ | |
596 | char cmdp = param_getchar(Cmd, 0); | |
597 | if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') return usage_hf_14b_read_srx(); | |
598 | ||
599 | uint8_t tagtype = param_get8(Cmd, 0); | |
600 | uint8_t blocks = (tagtype == 1) ? 0x7F : 0x0F; | |
601 | ||
602 | UsbCommand c = {CMD_READ_SRI_TAG, {blocks, 0, 0}}; | |
603 | clearCommandBuffer(); | |
604 | SendCommand(&c); | |
605 | return 0; | |
606 | } | |
607 | // New command to write a SRI512/SRIX4K tag. | |
608 | int CmdHF14BWriteSri(const char *Cmd){ | |
609 | /* | |
610 | * For SRIX4K blocks 00 - 7F | |
611 | * hf 14b raw -c -p 09 $srix4kwblock $srix4kwdata | |
612 | * | |
613 | * For SR512 blocks 00 - 0F | |
614 | * hf 14b raw -c -p 09 $sr512wblock $sr512wdata | |
615 | * | |
616 | * Special block FF = otp_lock_reg block. | |
617 | * Data len 4 bytes- | |
618 | */ | |
619 | char cmdp = param_getchar(Cmd, 0); | |
620 | uint8_t blockno = -1; | |
621 | uint8_t data[4] = {0x00}; | |
622 | bool isSrix4k = true; | |
623 | char str[30]; | |
624 | memset(str, 0x00, sizeof(str)); | |
625 | ||
626 | if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') return usage_hf_14b_write_srx(); | |
627 | ||
628 | if ( cmdp == '2' ) | |
629 | isSrix4k = false; | |
630 | ||
631 | //blockno = param_get8(Cmd, 1); | |
632 | ||
633 | if ( param_gethex(Cmd, 1, &blockno, 2) ) { | |
634 | PrintAndLog("Block number must include 2 HEX symbols"); | |
635 | return 0; | |
636 | } | |
637 | ||
638 | if ( isSrix4k ){ | |
639 | if ( blockno > 0x7f && blockno != 0xff ){ | |
640 | PrintAndLog("Block number out of range"); | |
641 | return 0; | |
642 | } | |
643 | } else { | |
644 | if ( blockno > 0x0f && blockno != 0xff ){ | |
645 | PrintAndLog("Block number out of range"); | |
646 | return 0; | |
647 | } | |
648 | } | |
649 | ||
650 | if (param_gethex(Cmd, 2, data, 8)) { | |
651 | PrintAndLog("Data must include 8 HEX symbols"); | |
652 | return 0; | |
653 | } | |
654 | ||
655 | if ( blockno == 0xff) { | |
656 | PrintAndLog("[%s] Write special block %02X [ %s ]", | |
657 | (isSrix4k) ? "SRIX4K":"SRI512", | |
658 | blockno, | |
659 | sprint_hex(data,4) | |
660 | ); | |
661 | } else { | |
662 | PrintAndLog("[%s] Write block %02X [ %s ]", | |
663 | (isSrix4k) ? "SRIX4K":"SRI512", | |
664 | blockno, | |
665 | sprint_hex(data,4) | |
666 | ); | |
667 | } | |
668 | ||
669 | sprintf(str, "-ss -c %02x %02x %02x%02x%02x%02x", ISO14443B_WRITE_BLK, blockno, data[0], data[1], data[2], data[3]); | |
670 | CmdHF14BCmdRaw(str); | |
671 | return 0; | |
672 | } | |
673 | ||
674 | uint32_t srix4kEncode(uint32_t value) { | |
675 | /* | |
676 | // vv = value | |
677 | // pp = position | |
678 | // vv vv vv pp | |
679 | 4 bytes : 00 1A 20 01 | |
680 | */ | |
681 | // only the lower crumbs. | |
682 | uint8_t block = (value & 0xFF); | |
683 | uint8_t i = 0; | |
684 | uint8_t valuebytes[] = {0,0,0}; | |
685 | ||
686 | num_to_bytes(value, 3, valuebytes); | |
687 | ||
688 | // Scrambled part | |
689 | // Crumb swapping of value. | |
690 | uint8_t temp[] = {0,0}; | |
691 | temp[0] = (CRUMB(value, 22) << 4 | CRUMB(value, 14 ) << 2 | CRUMB(value, 6)) << 4; | |
692 | temp[0] |= CRUMB(value, 20) << 4 | CRUMB(value, 12 ) << 2 | CRUMB(value, 4); | |
693 | temp[1] = (CRUMB(value, 18) << 4 | CRUMB(value, 10 ) << 2 | CRUMB(value, 2)) << 4; | |
694 | temp[1] |= CRUMB(value, 16) << 4 | CRUMB(value, 8 ) << 2 | CRUMB(value, 0); | |
695 | ||
696 | // chksum part | |
697 | uint32_t chksum = 0xFF - block; | |
698 | ||
699 | // chksum is reduced by each nibbles of value. | |
700 | for (i = 0; i < 3; ++i){ | |
701 | chksum -= NIBBLE_HIGH(valuebytes[i]); | |
702 | chksum -= NIBBLE_LOW(valuebytes[i]); | |
703 | } | |
704 | ||
705 | // base4 conversion and left shift twice | |
706 | i = 3; | |
707 | uint8_t base4[] = {0,0,0,0}; | |
708 | while( chksum !=0 ){ | |
709 | base4[i--] = (chksum % 4 << 2); | |
710 | chksum /= 4; | |
711 | } | |
712 | ||
713 | // merge scambled and chksum parts | |
714 | uint32_t encvalue = | |
715 | ( NIBBLE_LOW ( base4[0]) << 28 ) | | |
716 | ( NIBBLE_HIGH( temp[0]) << 24 ) | | |
717 | ||
718 | ( NIBBLE_LOW ( base4[1]) << 20 ) | | |
719 | ( NIBBLE_LOW ( temp[0]) << 16 ) | | |
720 | ||
721 | ( NIBBLE_LOW ( base4[2]) << 12 ) | | |
722 | ( NIBBLE_HIGH( temp[1]) << 8 ) | | |
723 | ||
724 | ( NIBBLE_LOW ( base4[3]) << 4 ) | | |
725 | NIBBLE_LOW ( temp[1] ); | |
726 | ||
727 | PrintAndLog("ICE encoded | %08X -> %08X", value, encvalue); | |
728 | return encvalue; | |
729 | } | |
730 | uint32_t srix4kDecode(uint32_t value) { | |
731 | switch(value) { | |
732 | case 0xC04F42C5: return 0x003139; | |
733 | case 0xC1484807: return 0x002943; | |
734 | case 0xC0C60848: return 0x001A20; | |
735 | } | |
736 | return 0; | |
737 | } | |
738 | uint32_t srix4kDecodeCounter(uint32_t num) { | |
739 | uint32_t value = ~num; | |
740 | ++value; | |
741 | return value; | |
742 | } | |
743 | ||
744 | uint32_t srix4kGetMagicbytes( uint64_t uid, uint32_t block6, uint32_t block18, uint32_t block19 ){ | |
745 | #define MASK 0xFFFFFFFF; | |
746 | uint32_t uid32 = uid & MASK; | |
747 | uint32_t counter = srix4kDecodeCounter(block6); | |
748 | uint32_t decodedBlock18 = srix4kDecode(block18); | |
749 | uint32_t decodedBlock19 = srix4kDecode(block19); | |
750 | uint32_t doubleBlock = (decodedBlock18 << 16 | decodedBlock19) + 1; | |
751 | ||
752 | uint32_t result = (uid32 * doubleBlock * counter) & MASK; | |
753 | PrintAndLog("Magic bytes | %08X", result); | |
754 | return result; | |
755 | } | |
756 | int srix4kValid(const char *Cmd){ | |
757 | ||
758 | uint64_t uid = 0xD00202501A4532F9; | |
759 | uint32_t block6 = 0xFFFFFFFF; | |
760 | uint32_t block18 = 0xC04F42C5; | |
761 | uint32_t block19 = 0xC1484807; | |
762 | uint32_t block21 = 0xD1BCABA4; | |
763 | ||
764 | uint32_t test_b18 = 0x00313918; | |
765 | uint32_t test_b18_enc = srix4kEncode(test_b18); | |
766 | //uint32_t test_b18_dec = srix4kDecode(test_b18_enc); | |
767 | PrintAndLog("ENCODE & CHECKSUM | %08X -> %08X (%s)", test_b18, test_b18_enc , ""); | |
768 | ||
769 | uint32_t magic = srix4kGetMagicbytes(uid, block6, block18, block19); | |
770 | PrintAndLog("BLOCK 21 | %08X -> %08X (no XOR)", block21, magic ^ block21); | |
771 | return 0; | |
772 | } | |
773 | ||
774 | int CmdteaSelfTest(const char *Cmd){ | |
775 | ||
776 | uint8_t v[8], v_le[8]; | |
777 | memset(v, 0x00, sizeof(v)); | |
778 | memset(v_le, 0x00, sizeof(v_le)); | |
779 | uint8_t* v_ptr = v_le; | |
780 | ||
781 | uint8_t cmdlen = strlen(Cmd); | |
782 | cmdlen = ( sizeof(v)<<2 < cmdlen ) ? sizeof(v)<<2 : cmdlen; | |
783 | ||
784 | if ( param_gethex(Cmd, 0, v, cmdlen) > 0 ){ | |
785 | PrintAndLog("can't read hex chars, uneven? :: %u", cmdlen); | |
786 | return 1; | |
787 | } | |
788 | ||
789 | SwapEndian64ex(v , 8, 4, v_ptr); | |
790 | ||
791 | // ENCRYPTION KEY: | |
792 | uint8_t key[16] = {0x55,0xFE,0xF6,0x30,0x62,0xBF,0x0B,0xC1,0xC9,0xB3,0x7C,0x34,0x97,0x3E,0x29,0xFB }; | |
793 | uint8_t keyle[16]; | |
794 | uint8_t* key_ptr = keyle; | |
795 | SwapEndian64ex(key , sizeof(key), 4, key_ptr); | |
796 | ||
797 | PrintAndLog("TEST LE enc| %s", sprint_hex(v_ptr, 8)); | |
798 | ||
799 | tea_decrypt(v_ptr, key_ptr); | |
800 | PrintAndLog("TEST LE dec | %s", sprint_hex_ascii(v_ptr, 8)); | |
801 | ||
802 | tea_encrypt(v_ptr, key_ptr); | |
803 | tea_encrypt(v_ptr, key_ptr); | |
804 | PrintAndLog("TEST enc2 | %s", sprint_hex_ascii(v_ptr, 8)); | |
805 | ||
806 | return 0; | |
807 | } | |
808 | ||
809 | bool waitCmd(bool verbose) { | |
810 | ||
811 | bool crc = FALSE; | |
812 | uint8_t b1 = 0, b2 = 0; | |
813 | uint8_t data[USB_CMD_DATA_SIZE] = {0x00}; | |
814 | uint8_t status = 0; | |
815 | uint16_t len = 0; | |
816 | UsbCommand resp; | |
817 | ||
818 | if (WaitForResponseTimeout(CMD_ACK, &resp, TIMEOUT)) { | |
819 | ||
820 | status = (resp.arg[0] & 0xFFFF); | |
821 | if ( status > 0 ) return FALSE; | |
822 | ||
823 | len = (resp.arg[1] & 0xFFFF); | |
824 | memcpy(data, resp.d.asBytes, len); | |
825 | ||
826 | if (verbose) { | |
827 | ||
828 | ComputeCrc14443(CRC_14443_B, data, len-2, &b1, &b2); | |
829 | crc = ( data[len-2] == b1 && data[len-1] == b2); | |
830 | ||
831 | PrintAndLog("[LEN %u] %s[%02X %02X] %s", | |
832 | len, | |
833 | sprint_hex(data, len-2), | |
834 | data[len-2], | |
835 | data[len-1], | |
836 | (crc) ? "OK" : "FAIL" | |
837 | ); | |
838 | } | |
839 | return TRUE; | |
840 | } else { | |
841 | PrintAndLog("timeout while waiting for reply."); | |
842 | return FALSE; | |
843 | } | |
844 | } | |
845 | ||
846 | static command_t CommandTable[] = { | |
847 | {"help", CmdHelp, 1, "This help"}, | |
848 | {"info", CmdHF14Binfo, 0, "Find and print details about a 14443B tag"}, | |
849 | {"list", CmdHF14BList, 0, "[Deprecated] List ISO 14443B history"}, | |
850 | {"raw", CmdHF14BCmdRaw, 0, "Send raw hex data to tag"}, | |
851 | {"reader", CmdHF14BReader, 0, "Act as a 14443B reader to identify a tag"}, | |
852 | {"sim", CmdHF14BSim, 0, "Fake ISO 14443B tag"}, | |
853 | {"snoop", CmdHF14BSnoop, 0, "Eavesdrop ISO 14443B"}, | |
854 | {"sriread", CmdHF14BReadSri, 0, "Read contents of a SRI512 | SRIX4K tag"}, | |
855 | {"sriwrite", CmdHF14BWriteSri, 0, "Write data to a SRI512 | SRIX4K tag"}, | |
856 | //{"valid", srix4kValid, 1, "srix4k checksum test"}, | |
857 | //{"valid", CmdteaSelfTest, 1, "tea test"}, | |
858 | {NULL, NULL, 0, NULL} | |
859 | }; | |
860 | ||
861 | int CmdHF14B(const char *Cmd) { | |
862 | clearCommandBuffer(); | |
863 | CmdsParse(CommandTable, Cmd); | |
864 | return 0; | |
865 | } | |
866 | ||
867 | int CmdHelp(const char *Cmd) { | |
868 | CmdsHelp(CommandTable); | |
869 | return 0; | |
870 | } |