]> git.zerfleddert.de Git - proxmark3-svn/blame_incremental - client/cmdhf14a.c
projects / proxmark3-svn / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
Moved iclass crc to be based on a lookup table
[proxmark3-svn] / client / cmdhf14a.c
... / ...
CommitLineData
1//-----------------------------------------------------------------------------
2// 2011, Merlok
3// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
4//
5// This code is licensed to you under the terms of the GNU GPL, version 2 or,
6// at your option, any later version. See the LICENSE.txt file for the text of
7// the license.
8//-----------------------------------------------------------------------------
9// High frequency ISO14443A commands
10//-----------------------------------------------------------------------------
11
12#include <stdio.h>
13#include <stdlib.h>
14#include <string.h>
15#include <unistd.h>
16#include "util.h"
17#include "iso14443crc.h"
18#include "data.h"
19#include "proxmark3.h"
20#include "ui.h"
21#include "cmdparser.h"
22#include "cmdhf14a.h"
23#include "common.h"
24#include "cmdmain.h"
25#include "mifare.h"
26
27static int CmdHelp(const char *Cmd);
28static void waitCmd(uint8_t iLen);
29
30int CmdHF14AList(const char *Cmd)
31{
32 PrintAndLog("Deprecated command, use 'hf list 14a' instead");
33 return 0;
34}
35
36void iso14a_set_timeout(uint32_t timeout) {
37 UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_SET_TIMEOUT, 0, timeout}};
38 SendCommand(&c);
39}
40
41int CmdHF14AReader(const char *Cmd)
42{
43 UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT | ISO14A_NO_DISCONNECT, 0, 0}};
44 SendCommand(&c);
45
46 UsbCommand resp;
47 WaitForResponse(CMD_ACK,&resp);
48
49 iso14a_card_select_t card;
50 memcpy(&card, (iso14a_card_select_t *)resp.d.asBytes, sizeof(iso14a_card_select_t));
51
52 uint64_t select_status = resp.arg[0]; // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS
53
54 if(select_status == 0) {
55 PrintAndLog("iso14443a card select failed");
56 // disconnect
57 c.arg[0] = 0;
58 c.arg[1] = 0;
59 c.arg[2] = 0;
60 SendCommand(&c);
61 return 0;
62 }
63
64 PrintAndLog("ATQA : %02x %02x", card.atqa[1], card.atqa[0]);
65 PrintAndLog(" UID : %s", sprint_hex(card.uid, card.uidlen));
66 PrintAndLog(" SAK : %02x [%d]", card.sak, resp.arg[0]);
67
68 switch (card.sak) {
69 case 0x00: PrintAndLog("TYPE : NXP MIFARE Ultralight | Ultralight C"); break;
70 case 0x04: PrintAndLog("TYPE : NXP MIFARE (various !DESFire !DESFire EV1)"); break;
71 case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1"); break;
72 case 0x09: PrintAndLog("TYPE : NXP MIFARE Mini 0.3k"); break;
73 case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k SL2"); break;
74 case 0x11: PrintAndLog("TYPE : NXP MIFARE Plus 4k SL2"); break;
75 case 0x18: PrintAndLog("TYPE : NXP MIFARE Classic 4k | Plus 4k SL1"); break;
76 case 0x20: PrintAndLog("TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41"); break;
77 case 0x24: PrintAndLog("TYPE : NXP MIFARE DESFire | DESFire EV1"); break;
78 case 0x28: PrintAndLog("TYPE : JCOP31 or JCOP41 v2.3.1"); break;
79 case 0x38: PrintAndLog("TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K"); break;
80 case 0x88: PrintAndLog("TYPE : Infineon MIFARE CLASSIC 1K"); break;
81 case 0x98: PrintAndLog("TYPE : Gemplus MPCOS"); break;
82 default: ;
83 }
84
85
86 // try to request ATS even if tag claims not to support it
87 if (select_status == 2) {
88 uint8_t rats[] = { 0xE0, 0x80 }; // FSDI=8 (FSD=256), CID=0
89 c.arg[0] = ISO14A_RAW | ISO14A_APPEND_CRC | ISO14A_NO_DISCONNECT;
90 c.arg[1] = 2;
91 c.arg[2] = 0;
92 memcpy(c.d.asBytes, rats, 2);
93 SendCommand(&c);
94 WaitForResponse(CMD_ACK,&resp);
95
96 memcpy(&card.ats, resp.d.asBytes, resp.arg[0]);
97 card.ats_len = resp.arg[0]; // note: ats_len includes CRC Bytes
98 }
99
100 // disconnect
101 c.arg[0] = 0;
102 c.arg[1] = 0;
103 c.arg[2] = 0;
104 SendCommand(&c);
105
106
107 if(card.ats_len >= 3) { // a valid ATS consists of at least the length byte (TL) and 2 CRC bytes
108 bool ta1 = 0, tb1 = 0, tc1 = 0;
109 int pos;
110
111 if (select_status == 2) {
112 PrintAndLog("SAK incorrectly claims that card doesn't support RATS");
113 }
114 PrintAndLog(" ATS : %s", sprint_hex(card.ats, card.ats_len));
115 PrintAndLog(" - TL : length is %d bytes", card.ats[0]);
116 if (card.ats[0] != card.ats_len - 2) {
117 PrintAndLog("ATS may be corrupted. Length of ATS (%d bytes incl. 2 Bytes CRC) doesn't match TL", card.ats_len);
118 }
119
120 if (card.ats[0] > 1) { // there is a format byte (T0)
121 ta1 = (card.ats[1] & 0x10) == 0x10;
122 tb1 = (card.ats[1] & 0x20) == 0x20;
123 tc1 = (card.ats[1] & 0x40) == 0x40;
124 int16_t fsci = card.ats[1] & 0x0f;
125 PrintAndLog(" - T0 : TA1 is%s present, TB1 is%s present, "
126 "TC1 is%s present, FSCI is %d (FSC = %ld)",
127 (ta1 ? "" : " NOT"), (tb1 ? "" : " NOT"), (tc1 ? "" : " NOT"),
128 fsci,
129 fsci < 5 ? (fsci - 2) * 8 :
130 fsci < 8 ? (fsci - 3) * 32 :
131 fsci == 8 ? 256 :
132 -1
133 );
134 }
135 pos = 2;
136 if (ta1) {
137 char dr[16], ds[16];
138 dr[0] = ds[0] = '\0';
139 if (card.ats[pos] & 0x10) strcat(ds, "2, ");
140 if (card.ats[pos] & 0x20) strcat(ds, "4, ");
141 if (card.ats[pos] & 0x40) strcat(ds, "8, ");
142 if (card.ats[pos] & 0x01) strcat(dr, "2, ");
143 if (card.ats[pos] & 0x02) strcat(dr, "4, ");
144 if (card.ats[pos] & 0x04) strcat(dr, "8, ");
145 if (strlen(ds) != 0) ds[strlen(ds) - 2] = '\0';
146 if (strlen(dr) != 0) dr[strlen(dr) - 2] = '\0';
147 PrintAndLog(" - TA1 : different divisors are%s supported, "
148 "DR: [%s], DS: [%s]",
149 (card.ats[pos] & 0x80 ? " NOT" : ""), dr, ds);
150 pos++;
151 }
152 if (tb1) {
153 uint32_t sfgi = card.ats[pos] & 0x0F;
154 uint32_t fwi = card.ats[pos] >> 4;
155 PrintAndLog(" - TB1 : SFGI = %d (SFGT = %s%ld/fc), FWI = %d (FWT = %ld/fc)",
156 (sfgi),
157 sfgi ? "" : "(not needed) ",
158 sfgi ? (1 << 12) << sfgi : 0,
159 fwi,
160 (1 << 12) << fwi
161 );
162 pos++;
163 }
164 if (tc1) {
165 PrintAndLog(" - TC1 : NAD is%s supported, CID is%s supported",
166 (card.ats[pos] & 0x01) ? "" : " NOT",
167 (card.ats[pos] & 0x02) ? "" : " NOT");
168 pos++;
169 }
170 if (card.ats[0] > pos) {
171 char *tip = "";
172 if (card.ats[0] - pos >= 7) {
173 if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) {
174 tip = "-> MIFARE Plus X 2K or 4K";
175 } else if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) {
176 tip = "-> MIFARE Plus S 2K or 4K";
177 }
178 }
179 PrintAndLog(" - HB : %s%s", sprint_hex(card.ats + pos, card.ats[0] - pos), tip);
180 if (card.ats[pos] == 0xC1) {
181 PrintAndLog(" c1 -> Mifare or (multiple) virtual cards of various type");
182 PrintAndLog(" %02x -> Length is %d bytes",
183 card.ats[pos + 1], card.ats[pos + 1]);
184 switch (card.ats[pos + 2] & 0xf0) {
185 case 0x10:
186 PrintAndLog(" 1x -> MIFARE DESFire");
187 break;
188 case 0x20:
189 PrintAndLog(" 2x -> MIFARE Plus");
190 break;
191 }
192 switch (card.ats[pos + 2] & 0x0f) {
193 case 0x00:
194 PrintAndLog(" x0 -> <1 kByte");
195 break;
196 case 0x01:
197 PrintAndLog(" x0 -> 1 kByte");
198 break;
199 case 0x02:
200 PrintAndLog(" x0 -> 2 kByte");
201 break;
202 case 0x03:
203 PrintAndLog(" x0 -> 4 kByte");
204 break;
205 case 0x04:
206 PrintAndLog(" x0 -> 8 kByte");
207 break;
208 }
209 switch (card.ats[pos + 3] & 0xf0) {
210 case 0x00:
211 PrintAndLog(" 0x -> Engineering sample");
212 break;
213 case 0x20:
214 PrintAndLog(" 2x -> Released");
215 break;
216 }
217 switch (card.ats[pos + 3] & 0x0f) {
218 case 0x00:
219 PrintAndLog(" x0 -> Generation 1");
220 break;
221 case 0x01:
222 PrintAndLog(" x1 -> Generation 2");
223 break;
224 case 0x02:
225 PrintAndLog(" x2 -> Generation 3");
226 break;
227 }
228 switch (card.ats[pos + 4] & 0x0f) {
229 case 0x00:
230 PrintAndLog(" x0 -> Only VCSL supported");
231 break;
232 case 0x01:
233 PrintAndLog(" x1 -> VCS, VCSL, and SVC supported");
234 break;
235 case 0x0E:
236 PrintAndLog(" xE -> no VCS command supported");
237 break;
238 }
239 }
240 }
241 } else {
242 PrintAndLog("proprietary non iso14443-4 card found, RATS not supported");
243 }
244
245 return select_status;
246}
247
248// Collect ISO14443 Type A UIDs
249int CmdHF14ACUIDs(const char *Cmd)
250{
251 // requested number of UIDs
252 int n = atoi(Cmd);
253 // collect at least 1 (e.g. if no parameter was given)
254 n = n > 0 ? n : 1;
255
256 PrintAndLog("Collecting %d UIDs", n);
257 PrintAndLog("Start: %u", time(NULL));
258 // repeat n times
259 for (int i = 0; i < n; i++) {
260 // execute anticollision procedure
261 UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT, 0, 0}};
262 SendCommand(&c);
263
264 UsbCommand resp;
265 WaitForResponse(CMD_ACK,&resp);
266
267 iso14a_card_select_t *card = (iso14a_card_select_t *) resp.d.asBytes;
268
269 // check if command failed
270 if (resp.arg[0] == 0) {
271 PrintAndLog("Card select failed.");
272 } else {
273 char uid_string[20];
274 for (uint16_t i = 0; i < card->uidlen; i++) {
275 sprintf(&uid_string[2*i], "%02X", card->uid[i]);
276 }
277 PrintAndLog("%s", uid_string);
278 }
279 }
280 PrintAndLog("End: %u", time(NULL));
281
282 return 1;
283}
284
285// ## simulate iso14443a tag
286// ## greg - added ability to specify tag UID
287int CmdHF14ASim(const char *Cmd)
288{
289 UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,{0,0,0}};
290
291 // Retrieve the tag type
292 uint8_t tagtype = param_get8ex(Cmd,0,0,10);
293
294 // When no argument was given, just print help message
295 if (tagtype == 0) {
296 PrintAndLog("");
297 PrintAndLog(" Emulating ISO/IEC 14443 type A tag with 4 or 7 byte UID");
298 PrintAndLog("");
299 PrintAndLog(" syntax: hf 14a sim <type> <uid>");
300 PrintAndLog(" types: 1 = MIFARE Classic");
301 PrintAndLog(" 2 = MIFARE Ultralight");
302 PrintAndLog(" 3 = MIFARE DESFIRE");
303 PrintAndLog(" 4 = ISO/IEC 14443-4");
304 PrintAndLog("");
305 return 1;
306 }
307
308 // Store the tag type
309 c.arg[0] = tagtype;
310
311 // Retrieve the full 4 or 7 byte long uid
312 uint64_t long_uid = param_get64ex(Cmd,1,0,16);
313
314 // Are we handling the (optional) second part uid?
315 if (long_uid > 0xffffffff) {
316 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 7 byte UID (%014"llx")",long_uid);
317 // Store the second part
318 c.arg[2] = (long_uid & 0xffffffff);
319 long_uid >>= 32;
320 // Store the first part, ignore the first byte, it is replaced by cascade byte (0x88)
321 c.arg[1] = (long_uid & 0xffffff);
322 } else {
323 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 4 byte UID (%08x)",long_uid);
324 // Only store the first part
325 c.arg[1] = long_uid & 0xffffffff;
326 }
327/*
328 // At lease save the mandatory first part of the UID
329 c.arg[0] = long_uid & 0xffffffff;
330
331
332 // At lease save the mandatory first part of the UID
333 c.arg[0] = long_uid & 0xffffffff;
334
335 if (c.arg[1] == 0) {
336 PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
337 }
338
339 switch (c.arg[0]) {
340 case 1: {
341 PrintAndLog("Emulating ISO/IEC 14443-3 type A tag with 4 byte UID");
342 UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
343 } break;
344 case 2: {
345 PrintAndLog("Emulating ISO/IEC 14443-4 type A tag with 7 byte UID");
346 } break;
347 default: {
348 PrintAndLog("Error: unkown tag type (%d)",c.arg[0]);
349 PrintAndLog("syntax: hf 14a sim <uid>",c.arg[0]);
350 PrintAndLog(" type1: 4 ",c.arg[0]);
351
352 return 1;
353 } break;
354 }
355*/
356/*
357 unsigned int hi = 0, lo = 0;
358 int n = 0, i = 0;
359 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
360 hi= (hi << 4) | (lo >> 28);
361 lo= (lo << 4) | (n & 0xf);
362 }
363*/
364// UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
365// PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
366 SendCommand(&c);
367 return 0;
368}
369
370int CmdHF14ASnoop(const char *Cmd) {
371 int param = 0;
372
373 if (param_getchar(Cmd, 0) == 'h') {
374 PrintAndLog("It get data from the field and saves it into command buffer.");
375 PrintAndLog("Buffer accessible from command hf list 14a.");
376 PrintAndLog("Usage: hf 14a snoop [c][r]");
377 PrintAndLog("c - triggered by first data from card");
378 PrintAndLog("r - triggered by first 7-bit request from reader (REQ,WUP,...)");
379 PrintAndLog("sample: hf 14a snoop c r");
380 return 0;
381 }
382
383 for (int i = 0; i < 2; i++) {
384 char ctmp = param_getchar(Cmd, i);
385 if (ctmp == 'c' || ctmp == 'C') param |= 0x01;
386 if (ctmp == 'r' || ctmp == 'R') param |= 0x02;
387 }
388
389 UsbCommand c = {CMD_SNOOP_ISO_14443a, {param, 0, 0}};
390 SendCommand(&c);
391 return 0;
392}
393
394int CmdHF14ACmdRaw(const char *cmd) {
395 UsbCommand c = {CMD_READER_ISO_14443a, {0, 0, 0}};
396 uint8_t reply=1;
397 uint8_t crc=0;
398 uint8_t power=0;
399 uint8_t active=0;
400 uint8_t active_select=0;
401 uint16_t numbits=0;
402 char buf[5]="";
403 int i=0;
404 uint8_t data[100];
405 unsigned int datalen=0, temp;
406
407 if (strlen(cmd)<2) {
408 PrintAndLog("Usage: hf 14a raw [-r] [-c] [-p] [-f] [-b] <number of bits> <0A 0B 0C ... hex>");
409 PrintAndLog(" -r do not read response");
410 PrintAndLog(" -c calculate and append CRC");
411 PrintAndLog(" -p leave the signal field ON after receive");
412 PrintAndLog(" -a active signal field ON without select");
413 PrintAndLog(" -s active signal field ON with select");
414 PrintAndLog(" -b number of bits to send. Useful for send partial byte");
415 return 0;
416 }
417
418 // strip
419 while (*cmd==' ' || *cmd=='\t') cmd++;
420
421 while (cmd[i]!='\0') {
422 if (cmd[i]==' ' || cmd[i]=='\t') { i++; continue; }
423 if (cmd[i]=='-') {
424 switch (cmd[i+1]) {
425 case 'r':
426 reply=0;
427 break;
428 case 'c':
429 crc=1;
430 break;
431 case 'p':
432 power=1;
433 break;
434 case 'a':
435 active=1;
436 break;
437 case 's':
438 active_select=1;
439 break;
440 case 'b':
441 sscanf(cmd+i+2,"%d",&temp);
442 numbits = temp & 0xFFFF;
443 i+=3;
444 while(cmd[i]!=' ' && cmd[i]!='\0') { i++; }
445 i-=2;
446 break;
447 default:
448 PrintAndLog("Invalid option");
449 return 0;
450 }
451 i+=2;
452 continue;
453 }
454 if ((cmd[i]>='0' && cmd[i]<='9') ||
455 (cmd[i]>='a' && cmd[i]<='f') ||
456 (cmd[i]>='A' && cmd[i]<='F') ) {
457 buf[strlen(buf)+1]=0;
458 buf[strlen(buf)]=cmd[i];
459 i++;
460
461 if (strlen(buf)>=2) {
462 sscanf(buf,"%x",&temp);
463 data[datalen]=(uint8_t)(temp & 0xff);
464 datalen++;
465 *buf=0;
466 }
467 continue;
468 }
469 PrintAndLog("Invalid char on input");
470 return 0;
471 }
472 if(crc && datalen>0)
473 {
474 uint8_t first, second;
475 ComputeCrc14443(CRC_14443_A, data, datalen, &first, &second);
476 data[datalen++] = first;
477 data[datalen++] = second;
478 }
479
480 if(active || active_select)
481 {
482 c.arg[0] |= ISO14A_CONNECT;
483 if(active)
484 c.arg[0] |= ISO14A_NO_SELECT;
485 }
486 if(power)
487 c.arg[0] |= ISO14A_NO_DISCONNECT;
488 if(datalen>0)
489 c.arg[0] |= ISO14A_RAW;
490
491 c.arg[1] = datalen;
492 c.arg[2] = numbits;
493 memcpy(c.d.asBytes,data,datalen);
494
495 SendCommand(&c);
496
497 if (reply) {
498 if(active_select)
499 waitCmd(1);
500 if(datalen>0)
501 waitCmd(0);
502 } // if reply
503 return 0;
504}
505
506static void waitCmd(uint8_t iSelect)
507{
508 uint8_t *recv;
509 UsbCommand resp;
510 char *hexout;
511
512 if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
513 recv = resp.d.asBytes;
514 uint8_t iLen = iSelect ? resp.arg[1] : resp.arg[0];
515 PrintAndLog("received %i octets",iLen);
516 if(!iLen)
517 return;
518 hexout = (char *)malloc(iLen * 3 + 1);
519 if (hexout != NULL) {
520 for (int i = 0; i < iLen; i++) { // data in hex
521 sprintf(&hexout[i * 3], "%02X ", recv[i]);
522 }
523 PrintAndLog("%s", hexout);
524 free(hexout);
525 } else {
526 PrintAndLog("malloc failed your client has low memory?");
527 }
528 } else {
529 PrintAndLog("timeout while waiting for reply.");
530 }
531}
532
533static command_t CommandTable[] =
534{
535 {"help", CmdHelp, 1, "This help"},
536 {"list", CmdHF14AList, 0, "[Deprecated] List ISO 14443a history"},
537 {"reader", CmdHF14AReader, 0, "Act like an ISO14443 Type A reader"},
538 {"cuids", CmdHF14ACUIDs, 0, "<n> Collect n>0 ISO14443 Type A UIDs in one go"},
539 {"sim", CmdHF14ASim, 0, "<UID> -- Fake ISO 14443a tag"},
540 {"snoop", CmdHF14ASnoop, 0, "Eavesdrop ISO 14443 Type A"},
541 {"raw", CmdHF14ACmdRaw, 0, "Send raw hex data to tag"},
542 {NULL, NULL, 0, NULL}
543};
544
545int CmdHF14A(const char *Cmd) {
546 // flush
547 WaitForResponseTimeout(CMD_ACK,NULL,100);
548
549 // parse
550 CmdsParse(CommandTable, Cmd);
551 return 0;
552}
553
554int CmdHelp(const char *Cmd)
555{
556 CmdsHelp(CommandTable);
557 return 0;
558}
Proxmark3 GIT tracking
Impressum, Datenschutz