git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf14b.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // High frequency ISO14443B commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <stdlib.h>
  13 #include <stdbool.h>
  14 #include <string.h>
  15 #include <stdint.h>
  16 #include "iso14443crc.h"
  17 #include "proxmark3.h"
  18 #include "data.h"
  19 #include "graph.h"
  20 #include "util.h"
  21 #include "ui.h"
  22 #include "cmdparser.h"
  23 #include "cmdhf14b.h"
  24 #include "cmdmain.h"
  25
  26 static int CmdHelp(const char *Cmd);
  27
  28 int CmdHF14BDemod(const char *Cmd)
  29 {
  30   int i, j, iold;
  31   int isum, qsum;
  32   int outOfWeakAt;
  33   bool negateI, negateQ;
  34
  35   uint8_t data[256];
  36   int dataLen = 0;
  37
  38   // As received, the samples are pairs, correlations against I and Q
  39   // square waves. So estimate angle of initial carrier (or just
  40   // quadrant, actually), and then do the demod.
  41
  42   // First, estimate where the tag starts modulating.
  43   for (i = 0; i < GraphTraceLen; i += 2) {
  44     if (abs(GraphBuffer[i]) + abs(GraphBuffer[i + 1]) > 40) {
  45       break;
  46     }
  47   }
  48   if (i >= GraphTraceLen) {
  49     PrintAndLog("too weak to sync");
  50     return 0;
  51   }
  52   PrintAndLog("out of weak at %d", i);
  53   outOfWeakAt = i;
  54
  55   // Now, estimate the phase in the initial modulation of the tag
  56   isum = 0;
  57   qsum = 0;
  58   for (; i < (outOfWeakAt + 16); i += 2) {
  59     isum += GraphBuffer[i + 0];
  60     qsum += GraphBuffer[i + 1];
  61   }
  62   negateI = (isum < 0);
  63   negateQ = (qsum < 0);
  64
  65   // Turn the correlation pairs into soft decisions on the bit.
  66   j = 0;
  67   for (i = 0; i < GraphTraceLen / 2; i++) {
  68     int si = GraphBuffer[j];
  69     int sq = GraphBuffer[j + 1];
  70     if (negateI) si = -si;
  71     if (negateQ) sq = -sq;
  72     GraphBuffer[i] = si + sq;
  73     j += 2;
  74   }
  75   GraphTraceLen = i;
  76
  77   i = outOfWeakAt / 2;
  78   while (GraphBuffer[i] > 0 && i < GraphTraceLen)
  79     i++;
  80   if (i >= GraphTraceLen) goto demodError;
  81
  82   iold = i;
  83   while (GraphBuffer[i] < 0 && i < GraphTraceLen)
  84     i++;
  85   if (i >= GraphTraceLen) goto demodError;
  86   if ((i - iold) > 23) goto demodError;
  87
  88   PrintAndLog("make it to demod loop");
  89
  90   for (;;) {
  91     iold = i;
  92     while (GraphBuffer[i] >= 0 && i < GraphTraceLen)
  93       i++;
  94     if (i >= GraphTraceLen) goto demodError;
  95     if ((i - iold) > 6) goto demodError;
  96
  97     uint16_t shiftReg = 0;
  98     if (i + 20 >= GraphTraceLen) goto demodError;
  99
 100     for (j = 0; j < 10; j++) {
 101       int soft = GraphBuffer[i] + GraphBuffer[i + 1];
 102
 103       if (abs(soft) < (abs(isum) + abs(qsum)) / 20) {
 104         PrintAndLog("weak bit");
 105       }
 106
 107       shiftReg >>= 1;
 108       if(GraphBuffer[i] + GraphBuffer[i+1] >= 0) {
 109         shiftReg |= 0x200;
 110       }
 111
 112       i+= 2;
 113     }
 114
 115     if ((shiftReg & 0x200) && !(shiftReg & 0x001))
 116     {
 117       // valid data byte, start and stop bits okay
 118       PrintAndLog("   %02x", (shiftReg >> 1) & 0xff);
 119       data[dataLen++] = (shiftReg >> 1) & 0xff;
 120       if (dataLen >= sizeof(data)) {
 121         return 0;
 122       }
 123     } else if (shiftReg == 0x000) {
 124       // this is EOF
 125       break;
 126     } else {
 127       goto demodError;
 128     }
 129   }
 130
 131   uint8_t first, second;
 132   ComputeCrc14443(CRC_14443_B, data, dataLen-2, &first, &second);
 133   PrintAndLog("CRC: %02x %02x (%s)\n", first, second,
 134     (first == data[dataLen-2] && second == data[dataLen-1]) ?
 135       "ok" : "****FAIL****");
 136
 137   RepaintGraphWindow();
 138   return 0;
 139
 140 demodError:
 141   PrintAndLog("demod error");
 142   RepaintGraphWindow();
 143   return 0;
 144 }
 145
 146 int CmdHF14BList(const char *Cmd)
 147 {
 148         uint8_t *got = malloc(USB_CMD_DATA_SIZE);
 149
 150         // Query for the actual size of the trace
 151         UsbCommand response;
 152         GetFromBigBuf(got, USB_CMD_DATA_SIZE, 0);
 153         WaitForResponse(CMD_ACK, &response);
 154         uint16_t traceLen = response.arg[2];
 155         if (traceLen > USB_CMD_DATA_SIZE) {
 156                 uint8_t *p = realloc(got, traceLen);
 157                 if (p == NULL) {
 158                         PrintAndLog("Cannot allocate memory for trace");
 159                         free(got);
 160                         return 2;
 161                 }
 162                 got = p;
 163                 GetFromBigBuf(got, traceLen, 0);
 164                 WaitForResponse(CMD_ACK,NULL);
 165         }
 166   PrintAndLog("recorded activity: (TraceLen = %d bytes)", traceLen);
 167   PrintAndLog(" time  :rssi: who bytes");
 168   PrintAndLog("---------+----+----+-----------");
 169
 170   int i = 0;
 171   int prev = -1;
 172
 173   for(;;) {
 174
 175         if(i >= traceLen) { break; }
 176
 177     bool isResponse;
 178     int timestamp = *((uint32_t *)(got+i));
 179     if(timestamp & 0x80000000) {
 180       timestamp &= 0x7fffffff;
 181       isResponse = 1;
 182     } else {
 183       isResponse = 0;
 184     }
 185     int metric = *((uint32_t *)(got+i+4));
 186
 187     int len = got[i+8];
 188
 189     if(len > 100) {
 190       break;
 191     }
 192     if(i + len >= traceLen) {
 193       break;
 194     }
 195
 196     uint8_t *frame = (got+i+9);
 197
 198         // Break and stick with current result if buffer was not completely full
 199         if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;
 200
 201     char line[1000] = "";
 202     int j;
 203     for(j = 0; j < len; j++) {
 204       sprintf(line+(j*3), "%02x  ", frame[j]);
 205     }
 206
 207     char *crc;
 208     if(len > 2) {
 209       uint8_t b1, b2;
 210       ComputeCrc14443(CRC_14443_B, frame, len-2, &b1, &b2);
 211       if(b1 != frame[len-2] || b2 != frame[len-1]) {
 212         crc = "**FAIL CRC**";
 213       } else {
 214         crc = "";
 215       }
 216     } else {
 217       crc = "(SHORT)";
 218     }
 219
 220     char metricString[100];
 221     if(isResponse) {
 222       sprintf(metricString, "%3d", metric);
 223     } else {
 224       strcpy(metricString, "   ");
 225     }
 226
 227     PrintAndLog(" +%7d: %s: %s %s %s",
 228       (prev < 0 ? 0 : timestamp - prev),
 229       metricString,
 230       (isResponse ? "TAG" : "   "), line, crc);
 231
 232     prev = timestamp;
 233     i += (len + 9);
 234   }
 235   free(got);
 236   return 0;
 237 }
 238
 239 int CmdHF14BRead(const char *Cmd)
 240 {
 241   UsbCommand c = {CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443, {strtol(Cmd, NULL, 0), 0, 0}};
 242   SendCommand(&c);
 243   return 0;
 244 }
 245
 246 int CmdHF14Sim(const char *Cmd)
 247 {
 248   UsbCommand c={CMD_SIMULATE_TAG_ISO_14443};
 249   SendCommand(&c);
 250   return 0;
 251 }
 252
 253 int CmdHFSimlisten(const char *Cmd)
 254 {
 255   UsbCommand c = {CMD_SIMULATE_TAG_HF_LISTEN};
 256   SendCommand(&c);
 257   return 0;
 258 }
 259
 260 int CmdHF14BSnoop(const char *Cmd)
 261 {
 262   UsbCommand c = {CMD_SNOOP_ISO_14443};
 263   SendCommand(&c);
 264   return 0;
 265 }
 266
 267 /* New command to read the contents of a SRI512 tag
 268  * SRI512 tags are ISO14443-B modulated memory tags,
 269  * this command just dumps the contents of the memory
 270  */
 271 int CmdSri512Read(const char *Cmd)
 272 {
 273   UsbCommand c = {CMD_READ_SRI512_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
 274   SendCommand(&c);
 275   return 0;
 276 }
 277
 278 /* New command to read the contents of a SRIX4K tag
 279  * SRIX4K tags are ISO14443-B modulated memory tags,
 280  * this command just dumps the contents of the memory/
 281  */
 282 int CmdSrix4kRead(const char *Cmd)
 283 {
 284   UsbCommand c = {CMD_READ_SRIX4K_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
 285   SendCommand(&c);
 286   return 0;
 287 }
 288
 289 int CmdHF14BCmdRaw (const char *cmd) {
 290     UsbCommand resp;
 291     uint8_t *recv;
 292     UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; // len,recv?
 293     uint8_t reply=1;
 294     uint8_t crc=0;
 295     uint8_t power=0;
 296     char buf[5]="";
 297     int i=0;
 298     uint8_t data[100] = {0x00};
 299     unsigned int datalen=0, temp;
 300     char *hexout;
 301
 302     if (strlen(cmd)<3) {
 303         PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] <0A 0B 0C ... hex>");
 304         PrintAndLog("       -r    do not read response");
 305         PrintAndLog("       -c    calculate and append CRC");
 306         PrintAndLog("       -p    leave the field on after receive");
 307         return 0;
 308     }
 309
 310     // strip
 311     while (*cmd==' ' || *cmd=='\t') cmd++;
 312
 313     while (cmd[i]!='\0') {
 314         if (cmd[i]==' ' || cmd[i]=='\t') { i++; continue; }
 315         if (cmd[i]=='-') {
 316             switch (cmd[i+1]) {
 317                 case 'r':
 318                 case 'R':
 319                     reply=0;
 320                     break;
 321                 case 'c':
 322                 case 'C':
 323                     crc=1;
 324                     break;
 325                 case 'p':
 326                 case 'P':
 327                     power=1;
 328                     break;
 329                 default:
 330                     PrintAndLog("Invalid option");
 331                     return 0;
 332             }
 333             i+=2;
 334             continue;
 335         }
 336         if ((cmd[i]>='0' && cmd[i]<='9') ||
 337             (cmd[i]>='a' && cmd[i]<='f') ||
 338             (cmd[i]>='A' && cmd[i]<='F') ) {
 339             buf[strlen(buf)+1]=0;
 340             buf[strlen(buf)]=cmd[i];
 341             i++;
 342
 343             if (strlen(buf)>=2) {
 344                 sscanf(buf,"%x",&temp);
 345                 data[datalen]=(uint8_t)(temp & 0xff);
 346                 datalen++;
 347                 *buf=0;
 348             }
 349             continue;
 350         }
 351         PrintAndLog("Invalid char on input");
 352         return 1;
 353     }
 354     if (datalen == 0)
 355     {
 356       PrintAndLog("Missing data input");
 357       return 0;
 358     }
 359     if(crc)
 360     {
 361         uint8_t first, second;
 362         ComputeCrc14443(CRC_14443_B, data, datalen, &first, &second);
 363         data[datalen++] = first;
 364         data[datalen++] = second;
 365     }
 366
 367     c.arg[0] = datalen;
 368     c.arg[1] = reply;
 369     c.arg[2] = power;
 370     memcpy(c.d.asBytes,data,datalen);
 371
 372     SendCommand(&c);
 373
 374     if (reply) {
 375         if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
 376             recv = resp.d.asBytes;
 377             PrintAndLog("received %i octets",resp.arg[0]);
 378             if(!resp.arg[0])
 379                 return 0;
 380             hexout = (char *)malloc(resp.arg[0] * 3 + 1);
 381             if (hexout != NULL) {
 382                 uint8_t first, second;
 383                 for (int i = 0; i < resp.arg[0]; i++) { // data in hex
 384                     sprintf(&hexout[i * 3], "%02X ", recv[i]);
 385                 }
 386                 PrintAndLog("%s", hexout);
 387                 free(hexout);
 388                 ComputeCrc14443(CRC_14443_B, recv, resp.arg[0]-2, &first, &second);
 389                 if(recv[resp.arg[0]-2]==first && recv[resp.arg[0]-1]==second) {
 390                     PrintAndLog("CRC OK");
 391                 } else {
 392                     PrintAndLog("CRC failed");
 393                 }
 394             } else {
 395                 PrintAndLog("malloc failed your client has low memory?");
 396             }
 397         } else {
 398             PrintAndLog("timeout while waiting for reply.");
 399         }
 400     } // if reply
 401     return 0;
 402 }
 403
 404 int CmdHF14BWrite( const char *Cmd){
 405
 406 /*
 407  * For SRIX4K  blocks 00 - 7F
 408  * hf 14b raw -c -p 09 $srix4kwblock $srix4kwdata
 409  *
 410  * For SR512  blocks 00 - 0F
 411  * hf 14b raw -c -p 09 $sr512wblock $sr512wdata
 412  *
 413  * Special block FF =  otp_lock_reg block.
 414  * Data len 4 bytes-
 415  */
 416         char cmdp = param_getchar(Cmd, 0);
 417         uint8_t blockno = -1;
 418         uint8_t data[4] = {0x00};
 419         bool isSrix4k = true;
 420         char str[20];
 421
 422         if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') {
 423                 PrintAndLog("Usage:  hf 14b write <1|2> <BLOCK> <DATA>");
 424                 PrintAndLog("    [1 = SRIX4K]");
 425                 PrintAndLog("    [2 = SRI512]");
 426                 PrintAndLog("    [BLOCK number depends on tag, special block == FF]");
 427                 PrintAndLog("     sample: hf 14b write 1 7F 11223344");
 428                 PrintAndLog("           : hf 14b write 1 FF 11223344");
 429                 PrintAndLog("           : hf 14b write 2 15 11223344");
 430                 PrintAndLog("           : hf 14b write 2 FF 11223344");
 431                 return 0;
 432         }
 433
 434         if ( cmdp == '2' )
 435                 isSrix4k = false;
 436
 437         //blockno = param_get8(Cmd, 1);
 438
 439         if ( param_gethex(Cmd,1, &blockno, 2) ) {
 440                 PrintAndLog("Block number must include 2 HEX symbols");
 441                 return 0;
 442         }
 443
 444         if ( isSrix4k ){
 445                 if ( blockno > 0x7f && blockno != 0xff ){
 446                         PrintAndLog("Block number out of range");
 447                         return 0;
 448                 }
 449         } else {
 450                 if ( blockno > 0x0f && blockno != 0xff ){
 451                         PrintAndLog("Block number out of range");
 452                         return 0;
 453                 }
 454         }
 455
 456         if (param_gethex(Cmd, 2, data, 8)) {
 457                 PrintAndLog("Data must include 8 HEX symbols");
 458                 return 0;
 459         }
 460
 461         if ( blockno == 0xff)
 462                 PrintAndLog("[%s] Write special block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512" , blockno,  sprint_hex(data,4) );
 463         else
 464                 PrintAndLog("[%s] Write block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512", blockno,  sprint_hex(data,4) );
 465
 466         sprintf(str, "-c 09 %02x %02x%02x%02x%02x", blockno, data[0], data[1], data[2], data[3]);
 467
 468         CmdHF14BCmdRaw(str);
 469         return 0;
 470 }
 471
 472 static command_t CommandTable[] =
 473 {
 474   {"help",        CmdHelp,        1, "This help"},
 475   {"demod",       CmdHF14BDemod,  1, "Demodulate ISO14443 Type B from tag"},
 476   {"list",        CmdHF14BList,   0, "List ISO 14443 history"},
 477   {"read",        CmdHF14BRead,   0, "Read HF tag (ISO 14443)"},
 478   {"sim",         CmdHF14Sim,     0, "Fake ISO 14443 tag"},
 479   {"simlisten",   CmdHFSimlisten, 0, "Get HF samples as fake tag"},
 480   {"snoop",       CmdHF14BSnoop,  0, "Eavesdrop ISO 14443"},
 481   {"sri512read",  CmdSri512Read,  0, "Read contents of a SRI512 tag"},
 482   {"srix4kread",  CmdSrix4kRead,  0, "Read contents of a SRIX4K tag"},
 483   {"raw",         CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},
 484   {"write",       CmdHF14BWrite,  0, "Write data to a SRI512 | SRIX4K tag"},
 485   {NULL, NULL, 0, NULL}
 486 };
 487
 488 int CmdHF14B(const char *Cmd)
 489 {
 490   CmdsParse(CommandTable, Cmd);
 491   return 0;
 492 }
 493
 494 int CmdHelp(const char *Cmd)
 495 {
 496   CmdsHelp(CommandTable);
 497   return 0;
 498 }