1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // High frequency ISO14443B commands
9 //-----------------------------------------------------------------------------
16 #include "iso14443crc.h"
17 #include "proxmark3.h"
22 #include "cmdparser.h"
26 static int CmdHelp(const char *Cmd
);
28 int CmdHF14BDemod(const char *Cmd
)
33 bool negateI
, negateQ
;
38 // As received, the samples are pairs, correlations against I and Q
39 // square waves. So estimate angle of initial carrier (or just
40 // quadrant, actually), and then do the demod.
42 // First, estimate where the tag starts modulating.
43 for (i
= 0; i
< GraphTraceLen
; i
+= 2) {
44 if (abs(GraphBuffer
[i
]) + abs(GraphBuffer
[i
+ 1]) > 40) {
48 if (i
>= GraphTraceLen
) {
49 PrintAndLog("too weak to sync");
52 PrintAndLog("out of weak at %d", i
);
55 // Now, estimate the phase in the initial modulation of the tag
58 for (; i
< (outOfWeakAt
+ 16); i
+= 2) {
59 isum
+= GraphBuffer
[i
+ 0];
60 qsum
+= GraphBuffer
[i
+ 1];
65 // Turn the correlation pairs into soft decisions on the bit.
67 for (i
= 0; i
< GraphTraceLen
/ 2; i
++) {
68 int si
= GraphBuffer
[j
];
69 int sq
= GraphBuffer
[j
+ 1];
70 if (negateI
) si
= -si
;
71 if (negateQ
) sq
= -sq
;
72 GraphBuffer
[i
] = si
+ sq
;
78 while (GraphBuffer
[i
] > 0 && i
< GraphTraceLen
)
80 if (i
>= GraphTraceLen
) goto demodError
;
83 while (GraphBuffer
[i
] < 0 && i
< GraphTraceLen
)
85 if (i
>= GraphTraceLen
) goto demodError
;
86 if ((i
- iold
) > 23) goto demodError
;
88 PrintAndLog("make it to demod loop");
92 while (GraphBuffer
[i
] >= 0 && i
< GraphTraceLen
)
94 if (i
>= GraphTraceLen
) goto demodError
;
95 if ((i
- iold
) > 6) goto demodError
;
97 uint16_t shiftReg
= 0;
98 if (i
+ 20 >= GraphTraceLen
) goto demodError
;
100 for (j
= 0; j
< 10; j
++) {
101 int soft
= GraphBuffer
[i
] + GraphBuffer
[i
+ 1];
103 if (abs(soft
) < (abs(isum
) + abs(qsum
)) / 20) {
104 PrintAndLog("weak bit");
108 if(GraphBuffer
[i
] + GraphBuffer
[i
+1] >= 0) {
115 if ((shiftReg
& 0x200) && !(shiftReg
& 0x001))
117 // valid data byte, start and stop bits okay
118 PrintAndLog(" %02x", (shiftReg
>> 1) & 0xff);
119 data
[dataLen
++] = (shiftReg
>> 1) & 0xff;
120 if (dataLen
>= sizeof(data
)) {
123 } else if (shiftReg
== 0x000) {
131 uint8_t first
, second
;
132 ComputeCrc14443(CRC_14443_B
, data
, dataLen
-2, &first
, &second
);
133 PrintAndLog("CRC: %02x %02x (%s)\n", first
, second
,
134 (first
== data
[dataLen
-2] && second
== data
[dataLen
-1]) ?
135 "ok" : "****FAIL****");
137 RepaintGraphWindow();
141 PrintAndLog("demod error");
142 RepaintGraphWindow();
146 int CmdHF14BList(const char *Cmd
)
148 uint8_t got
[TRACE_BUFFER_SIZE
];
149 GetFromBigBuf(got
,sizeof(got
),0);
150 WaitForResponse(CMD_ACK
,NULL
);
152 PrintAndLog("recorded activity:");
153 PrintAndLog(" time :rssi: who bytes");
154 PrintAndLog("---------+----+----+-----------");
161 if(i
>= TRACE_BUFFER_SIZE
) { break; }
164 int timestamp
= *((uint32_t *)(got
+i
));
165 if(timestamp
& 0x80000000) {
166 timestamp
&= 0x7fffffff;
171 int metric
= *((uint32_t *)(got
+i
+4));
178 if(i
+ len
>= TRACE_BUFFER_SIZE
) {
182 uint8_t *frame
= (got
+i
+9);
184 // Break and stick with current result if buffer was not completely full
185 if (frame
[0] == 0x44 && frame
[1] == 0x44 && frame
[2] == 0x44 && frame
[3] == 0x44) break;
187 char line
[1000] = "";
189 for(j
= 0; j
< len
; j
++) {
190 sprintf(line
+(j
*3), "%02x ", frame
[j
]);
196 ComputeCrc14443(CRC_14443_B
, frame
, len
-2, &b1
, &b2
);
197 if(b1
!= frame
[len
-2] || b2
!= frame
[len
-1]) {
198 crc
= "**FAIL CRC**";
206 char metricString
[100];
208 sprintf(metricString
, "%3d", metric
);
210 strcpy(metricString
, " ");
213 PrintAndLog(" +%7d: %s: %s %s %s",
214 (prev
< 0 ? 0 : timestamp
- prev
),
216 (isResponse
? "TAG" : " "), line
, crc
);
224 int CmdHF14BRead(const char *Cmd
)
226 UsbCommand c
= {CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443
, {strtol(Cmd
, NULL
, 0), 0, 0}};
231 int CmdHF14Sim(const char *Cmd
)
233 UsbCommand c
={CMD_SIMULATE_TAG_ISO_14443
};
238 int CmdHFSimlisten(const char *Cmd
)
240 UsbCommand c
= {CMD_SIMULATE_TAG_HF_LISTEN
};
245 int CmdHF14BSnoop(const char *Cmd
)
247 UsbCommand c
= {CMD_SNOOP_ISO_14443
};
252 /* New command to read the contents of a SRI512 tag
253 * SRI512 tags are ISO14443-B modulated memory tags,
254 * this command just dumps the contents of the memory
256 int CmdSri512Read(const char *Cmd
)
258 UsbCommand c
= {CMD_READ_SRI512_TAG
, {strtol(Cmd
, NULL
, 0), 0, 0}};
263 /* New command to read the contents of a SRIX4K tag
264 * SRIX4K tags are ISO14443-B modulated memory tags,
265 * this command just dumps the contents of the memory/
267 int CmdSrix4kRead(const char *Cmd
)
269 UsbCommand c
= {CMD_READ_SRIX4K_TAG
, {strtol(Cmd
, NULL
, 0), 0, 0}};
274 int CmdHF14BCmdRaw (const char *cmd
) {
277 UsbCommand c
= {CMD_ISO_14443B_COMMAND
, {0, 0, 0}}; // len,recv?
283 uint8_t data
[100] = {0x00};
284 unsigned int datalen
=0, temp
;
288 PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] <0A 0B 0C ... hex>");
289 PrintAndLog(" -r do not read response");
290 PrintAndLog(" -c calculate and append CRC");
291 PrintAndLog(" -p leave the field on after receive");
296 while (*cmd
==' ' || *cmd
=='\t') cmd
++;
298 while (cmd
[i
]!='\0') {
299 if (cmd
[i
]==' ' || cmd
[i
]=='\t') { i
++; continue; }
315 PrintAndLog("Invalid option");
321 if ((cmd
[i
]>='0' && cmd
[i
]<='9') ||
322 (cmd
[i
]>='a' && cmd
[i
]<='f') ||
323 (cmd
[i
]>='A' && cmd
[i
]<='F') ) {
324 buf
[strlen(buf
)+1]=0;
325 buf
[strlen(buf
)]=cmd
[i
];
328 if (strlen(buf
)>=2) {
329 sscanf(buf
,"%x",&temp
);
330 data
[datalen
]=(uint8_t)(temp
& 0xff);
336 PrintAndLog("Invalid char on input");
341 PrintAndLog("Missing data input");
346 uint8_t first
, second
;
347 ComputeCrc14443(CRC_14443_B
, data
, datalen
, &first
, &second
);
348 data
[datalen
++] = first
;
349 data
[datalen
++] = second
;
355 memcpy(c
.d
.asBytes
,data
,datalen
);
360 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1000)) {
361 recv
= resp
.d
.asBytes
;
362 PrintAndLog("received %i octets",resp
.arg
[0]);
365 hexout
= (char *)malloc(resp
.arg
[0] * 3 + 1);
366 if (hexout
!= NULL
) {
367 uint8_t first
, second
;
368 for (int i
= 0; i
< resp
.arg
[0]; i
++) { // data in hex
369 sprintf(&hexout
[i
* 3], "%02X ", recv
[i
]);
371 PrintAndLog("%s", hexout
);
373 ComputeCrc14443(CRC_14443_B
, recv
, resp
.arg
[0]-2, &first
, &second
);
374 if(recv
[resp
.arg
[0]-2]==first
&& recv
[resp
.arg
[0]-1]==second
) {
375 PrintAndLog("CRC OK");
377 PrintAndLog("CRC failed");
380 PrintAndLog("malloc failed your client has low memory?");
383 PrintAndLog("timeout while waiting for reply.");
389 int CmdHF14BWrite( const char *Cmd
){
392 * For SRIX4K blocks 00 - 7F
393 * hf 14b raw -c -p 09 $srix4kwblock $srix4kwdata
395 * For SR512 blocks 00 - 0F
396 * hf 14b raw -c -p 09 $sr512wblock $sr512wdata
398 * Special block FF = otp_lock_reg block.
401 char cmdp
= param_getchar(Cmd
, 0);
402 uint8_t blockno
= -1;
403 uint8_t data
[4] = {0x00};
404 bool isSrix4k
= true;
407 if (strlen(Cmd
) < 1 || cmdp
== 'h' || cmdp
== 'H') {
408 PrintAndLog("Usage: hf 14b write <1|2> <BLOCK> <DATA>");
409 PrintAndLog(" [1 = SRIX4K]");
410 PrintAndLog(" [2 = SRI512]");
411 PrintAndLog(" [BLOCK number depends on tag, special block == FF]");
412 PrintAndLog(" sample: hf 14b write 1 7F 11223344");
413 PrintAndLog(" : hf 14b write 1 FF 11223344");
414 PrintAndLog(" : hf 14b write 2 15 11223344");
415 PrintAndLog(" : hf 14b write 2 FF 11223344");
422 //blockno = param_get8(Cmd, 1);
424 if ( param_gethex(Cmd
,1, &blockno
, 2) ) {
425 PrintAndLog("Block number must include 2 HEX symbols");
430 if ( blockno
> 0x7f && blockno
!= 0xff ){
431 PrintAndLog("Block number out of range");
435 if ( blockno
> 0x0f && blockno
!= 0xff ){
436 PrintAndLog("Block number out of range");
441 if (param_gethex(Cmd
, 2, data
, 8)) {
442 PrintAndLog("Data must include 8 HEX symbols");
446 if ( blockno
== 0xff)
447 PrintAndLog("[%s] Write special block %02X [ %s ]", (isSrix4k
)?"SRIX4K":"SRI512" , blockno
, sprint_hex(data
,4) );
449 PrintAndLog("[%s] Write block %02X [ %s ]", (isSrix4k
)?"SRIX4K":"SRI512", blockno
, sprint_hex(data
,4) );
451 sprintf(str
, "-c -p 09 %02x %02x%02x%02x%02x", blockno
, data
[0], data
[1], data
[2], data
[3]);
457 static command_t CommandTable
[] =
459 {"help", CmdHelp
, 1, "This help"},
460 {"demod", CmdHF14BDemod
, 1, "Demodulate ISO14443 Type B from tag"},
461 {"list", CmdHF14BList
, 0, "List ISO 14443 history"},
462 {"read", CmdHF14BRead
, 0, "Read HF tag (ISO 14443)"},
463 {"sim", CmdHF14Sim
, 0, "Fake ISO 14443 tag"},
464 {"simlisten", CmdHFSimlisten
, 0, "Get HF samples as fake tag"},
465 {"snoop", CmdHF14BSnoop
, 0, "Eavesdrop ISO 14443"},
466 {"sri512read", CmdSri512Read
, 0, "Read contents of a SRI512 tag"},
467 {"srix4kread", CmdSrix4kRead
, 0, "Read contents of a SRIX4K tag"},
468 {"raw", CmdHF14BCmdRaw
, 0, "Send raw hex data to tag"},
469 {"write", CmdHF14BWrite
, 0, "Write data to a SRI512 | SRIX4K tag"},
470 {NULL
, NULL
, 0, NULL
}
473 int CmdHF14B(const char *Cmd
)
475 CmdsParse(CommandTable
, Cmd
);
479 int CmdHelp(const char *Cmd
)
481 CmdsHelp(CommandTable
);