git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf14b.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // High frequency ISO14443B commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <stdlib.h>
  13 #include <stdbool.h>
  14 #include <string.h>
  15 #include <stdint.h>
  16 #include "../common/iso14443crc.h"
  17 #include "proxmark3.h"
  18 #include "data.h"
  19 #include "graph.h"
  20 #include "ui.h"
  21 #include "cmdparser.h"
  22 #include "cmdhf14b.h"
  23 #include "cmdmain.h"
  24
  25 static int CmdHelp(const char *Cmd);
  26
  27 int CmdHF14BDemod(const char *Cmd)
  28 {
  29   int i, j, iold;
  30   int isum, qsum;
  31   int outOfWeakAt;
  32   bool negateI, negateQ;
  33
  34   uint8_t data[256];
  35   int dataLen = 0;
  36
  37   // As received, the samples are pairs, correlations against I and Q
  38   // square waves. So estimate angle of initial carrier (or just
  39   // quadrant, actually), and then do the demod.
  40
  41   // First, estimate where the tag starts modulating.
  42   for (i = 0; i < GraphTraceLen; i += 2) {
  43     if (abs(GraphBuffer[i]) + abs(GraphBuffer[i + 1]) > 40) {
  44       break;
  45     }
  46   }
  47   if (i >= GraphTraceLen) {
  48     PrintAndLog("too weak to sync");
  49     return 0;
  50   }
  51   PrintAndLog("out of weak at %d", i);
  52   outOfWeakAt = i;
  53
  54   // Now, estimate the phase in the initial modulation of the tag
  55   isum = 0;
  56   qsum = 0;
  57   for (; i < (outOfWeakAt + 16); i += 2) {
  58     isum += GraphBuffer[i + 0];
  59     qsum += GraphBuffer[i + 1];
  60   }
  61   negateI = (isum < 0);
  62   negateQ = (qsum < 0);
  63
  64   // Turn the correlation pairs into soft decisions on the bit.
  65   j = 0;
  66   for (i = 0; i < GraphTraceLen / 2; i++) {
  67     int si = GraphBuffer[j];
  68     int sq = GraphBuffer[j + 1];
  69     if (negateI) si = -si;
  70     if (negateQ) sq = -sq;
  71     GraphBuffer[i] = si + sq;
  72     j += 2;
  73   }
  74   GraphTraceLen = i;
  75
  76   i = outOfWeakAt / 2;
  77   while (GraphBuffer[i] > 0 && i < GraphTraceLen)
  78     i++;
  79   if (i >= GraphTraceLen) goto demodError;
  80
  81   iold = i;
  82   while (GraphBuffer[i] < 0 && i < GraphTraceLen)
  83     i++;
  84   if (i >= GraphTraceLen) goto demodError;
  85   if ((i - iold) > 23) goto demodError;
  86
  87   PrintAndLog("make it to demod loop");
  88
  89   for (;;) {
  90     iold = i;
  91     while (GraphBuffer[i] >= 0 && i < GraphTraceLen)
  92       i++;
  93     if (i >= GraphTraceLen) goto demodError;
  94     if ((i - iold) > 6) goto demodError;
  95
  96     uint16_t shiftReg = 0;
  97     if (i + 20 >= GraphTraceLen) goto demodError;
  98
  99     for (j = 0; j < 10; j++) {
 100       int soft = GraphBuffer[i] + GraphBuffer[i + 1];
 101
 102       if (abs(soft) < (abs(isum) + abs(qsum)) / 20) {
 103         PrintAndLog("weak bit");
 104       }
 105
 106       shiftReg >>= 1;
 107       if(GraphBuffer[i] + GraphBuffer[i+1] >= 0) {
 108         shiftReg |= 0x200;
 109       }
 110
 111       i+= 2;
 112     }
 113
 114     if ((shiftReg & 0x200) && !(shiftReg & 0x001))
 115     {
 116       // valid data byte, start and stop bits okay
 117       PrintAndLog("   %02x", (shiftReg >> 1) & 0xff);
 118       data[dataLen++] = (shiftReg >> 1) & 0xff;
 119       if (dataLen >= sizeof(data)) {
 120         return 0;
 121       }
 122     } else if (shiftReg == 0x000) {
 123       // this is EOF
 124       break;
 125     } else {
 126       goto demodError;
 127     }
 128   }
 129
 130   uint8_t first, second;
 131   ComputeCrc14443(CRC_14443_B, data, dataLen-2, &first, &second);
 132   PrintAndLog("CRC: %02x %02x (%s)\n", first, second,
 133     (first == data[dataLen-2] && second == data[dataLen-1]) ?
 134       "ok" : "****FAIL****");
 135
 136   RepaintGraphWindow();
 137   return 0;
 138
 139 demodError:
 140   PrintAndLog("demod error");
 141   RepaintGraphWindow();
 142   return 0;
 143 }
 144
 145 int CmdHF14BList(const char *Cmd)
 146 {
 147   uint8_t got[TRACE_BUFFER_SIZE];
 148   GetFromBigBuf(got,sizeof(got),0);
 149   WaitForResponse(CMD_ACK,NULL);
 150
 151   PrintAndLog("recorded activity:");
 152   PrintAndLog(" time  :rssi: who bytes");
 153   PrintAndLog("---------+----+----+-----------");
 154
 155   int i = 0;
 156   int prev = -1;
 157
 158   for(;;) {
 159
 160         if(i >= TRACE_BUFFER_SIZE) { break; }
 161
 162     bool isResponse;
 163     int timestamp = *((uint32_t *)(got+i));
 164     if(timestamp & 0x80000000) {
 165       timestamp &= 0x7fffffff;
 166       isResponse = 1;
 167     } else {
 168       isResponse = 0;
 169     }
 170     int metric = *((uint32_t *)(got+i+4));
 171
 172     int len = got[i+8];
 173
 174     if(len > 100) {
 175       break;
 176     }
 177     if(i + len >= TRACE_BUFFER_SIZE) {
 178       break;
 179     }
 180
 181     uint8_t *frame = (got+i+9);
 182
 183         // Break and stick with current result if buffer was not completely full
 184         if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;
 185
 186     char line[1000] = "";
 187     int j;
 188     for(j = 0; j < len; j++) {
 189       sprintf(line+(j*3), "%02x  ", frame[j]);
 190     }
 191
 192     char *crc;
 193     if(len > 2) {
 194       uint8_t b1, b2;
 195       ComputeCrc14443(CRC_14443_B, frame, len-2, &b1, &b2);
 196       if(b1 != frame[len-2] || b2 != frame[len-1]) {
 197         crc = "**FAIL CRC**";
 198       } else {
 199         crc = "";
 200       }
 201     } else {
 202       crc = "(SHORT)";
 203     }
 204
 205     char metricString[100];
 206     if(isResponse) {
 207       sprintf(metricString, "%3d", metric);
 208     } else {
 209       strcpy(metricString, "   ");
 210     }
 211
 212     PrintAndLog(" +%7d: %s: %s %s %s",
 213       (prev < 0 ? 0 : timestamp - prev),
 214       metricString,
 215       (isResponse ? "TAG" : "   "), line, crc);
 216
 217     prev = timestamp;
 218     i += (len + 9);
 219   }
 220   return 0;
 221 }
 222
 223 int CmdHF14BRead(const char *Cmd)
 224 {
 225   UsbCommand c = {CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443, {strtol(Cmd, NULL, 0), 0, 0}};
 226   SendCommand(&c);
 227   return 0;
 228 }
 229
 230 int CmdHF14Sim(const char *Cmd)
 231 {
 232   UsbCommand c={CMD_SIMULATE_TAG_ISO_14443};
 233   SendCommand(&c);
 234   return 0;
 235 }
 236
 237 int CmdHFSimlisten(const char *Cmd)
 238 {
 239   UsbCommand c = {CMD_SIMULATE_TAG_HF_LISTEN};
 240   SendCommand(&c);
 241   return 0;
 242 }
 243
 244 int CmdHF14BSnoop(const char *Cmd)
 245 {
 246   UsbCommand c = {CMD_SNOOP_ISO_14443};
 247   SendCommand(&c);
 248   return 0;
 249 }
 250
 251 /* New command to read the contents of a SRI512 tag
 252  * SRI512 tags are ISO14443-B modulated memory tags,
 253  * this command just dumps the contents of the memory
 254  */
 255 int CmdSri512Read(const char *Cmd)
 256 {
 257   UsbCommand c = {CMD_READ_SRI512_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
 258   SendCommand(&c);
 259   return 0;
 260 }
 261
 262 /* New command to read the contents of a SRIX4K tag
 263  * SRIX4K tags are ISO14443-B modulated memory tags,
 264  * this command just dumps the contents of the memory/
 265  */
 266 int CmdSrix4kRead(const char *Cmd)
 267 {
 268   UsbCommand c = {CMD_READ_SRIX4K_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
 269   SendCommand(&c);
 270   return 0;
 271 }
 272
 273 int CmdHF14BCmdRaw (const char *cmd) {
 274     UsbCommand resp;
 275     uint8_t *recv;
 276     UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; // len,recv?
 277     uint8_t reply=1;
 278     uint8_t crc=0;
 279     uint8_t power=0;
 280     char buf[5]="";
 281     int i=0;
 282     uint8_t data[100];
 283     unsigned int datalen=0, temp;
 284     char *hexout;
 285
 286     if (strlen(cmd)<3) {
 287         PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] <0A 0B 0C ... hex>");
 288         PrintAndLog("       -r    do not read response");
 289         PrintAndLog("       -c    calculate and append CRC");
 290         PrintAndLog("       -p    leave the field on after receive");
 291         return 0;
 292     }
 293
 294     // strip
 295     while (*cmd==' ' || *cmd=='\t') cmd++;
 296
 297     while (cmd[i]!='\0') {
 298         if (cmd[i]==' ' || cmd[i]=='\t') { i++; continue; }
 299         if (cmd[i]=='-') {
 300             switch (cmd[i+1]) {
 301                 case 'r':
 302                 case 'R':
 303                     reply=0;
 304                     break;
 305                 case 'c':
 306                 case 'C':
 307                     crc=1;
 308                     break;
 309                 case 'p':
 310                 case 'P':
 311                     power=1;
 312                     break;
 313                 default:
 314                     PrintAndLog("Invalid option");
 315                     return 0;
 316             }
 317             i+=2;
 318             continue;
 319         }
 320         if ((cmd[i]>='0' && cmd[i]<='9') ||
 321             (cmd[i]>='a' && cmd[i]<='f') ||
 322             (cmd[i]>='A' && cmd[i]<='F') ) {
 323             buf[strlen(buf)+1]=0;
 324             buf[strlen(buf)]=cmd[i];
 325             i++;
 326
 327             if (strlen(buf)>=2) {
 328                 sscanf(buf,"%x",&temp);
 329                 data[datalen]=(uint8_t)(temp & 0xff);
 330                 datalen++;
 331                 *buf=0;
 332             }
 333             continue;
 334         }
 335         PrintAndLog("Invalid char on input");
 336         return 0;
 337     }
 338     if (datalen == 0)
 339     {
 340       PrintAndLog("Missing data input");
 341       return 0;
 342     }
 343     if(crc)
 344     {
 345         uint8_t first, second;
 346         ComputeCrc14443(CRC_14443_B, data, datalen, &first, &second);
 347         data[datalen++] = first;
 348         data[datalen++] = second;
 349     }
 350
 351     c.arg[0] = datalen;
 352     c.arg[1] = reply;
 353     c.arg[2] = power;
 354     memcpy(c.d.asBytes,data,datalen);
 355
 356     SendCommand(&c);
 357
 358     if (reply) {
 359         if (WaitForResponseTimeout(CMD_ACK,&resp,10000)) {
 360             recv = resp.d.asBytes;
 361             PrintAndLog("received %i octets",resp.arg[0]);
 362             if(!resp.arg[0])
 363                 return 0;
 364             hexout = (char *)malloc(resp.arg[0] * 3 + 1);
 365             if (hexout != NULL) {
 366                 uint8_t first, second;
 367                 for (int i = 0; i < resp.arg[0]; i++) { // data in hex
 368                     sprintf(&hexout[i * 3], "%02X ", recv[i]);
 369                 }
 370                 PrintAndLog("%s", hexout);
 371                 free(hexout);
 372                 ComputeCrc14443(CRC_14443_B, recv, resp.arg[0]-2, &first, &second);
 373                 if(recv[resp.arg[0]-2]==first && recv[resp.arg[0]-1]==second) {
 374                     PrintAndLog("CRC OK");
 375                 } else {
 376                     PrintAndLog("CRC failed");
 377                 }
 378             } else {
 379                 PrintAndLog("malloc failed your client has low memory?");
 380             }
 381         } else {
 382             PrintAndLog("timeout while waiting for reply.");
 383         }
 384     } // if reply
 385     return 0;
 386 }
 387
 388 int CmdHF14BWrite( const char *Cmd){
 389
 390 /*
 391  * For SRIX4K  blocks 00 - 7F
 392  * hf 14b raw -c -p 09 $srix4kwblock $srix4kwdata
 393  *
 394  * For SR512  blocks 00 - 0F
 395  * hf 14b raw -c -p 09 $sr512wblock $sr512wdata
 396  *
 397  * Special block FF =  otp_lock_reg block.
 398  * Data len 4 bytes-
 399  */
 400         char cmdp = param_getchar(Cmd, 0);
 401         uint8_t blockno = -1;
 402         uint8_t data[4] = {0x00};
 403         bool isSrix4k = true;
 404         char str[20];
 405
 406         if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') {
 407                 PrintAndLog("Usage:  hf 14b write <1|2> <BLOCK> <DATA>");
 408                 PrintAndLog("    [1 = SRIX4K]");
 409                 PrintAndLog("    [2 = SRI512]");
 410                 PrintAndLog("    [BLOCK number depends on tag, special block == FF]");
 411                 PrintAndLog("     sample: hf 14b write 1 7F 11223344");
 412                 PrintAndLog("           : hf 14b write 1 FF 11223344");
 413                 PrintAndLog("           : hf 14b write 2 15 11223344");
 414                 PrintAndLog("           : hf 14b write 2 FF 11223344");
 415                 return 0;
 416         }
 417
 418         if ( cmdp == '2' )
 419                 isSrix4k = false;
 420
 421         //blockno = param_get8(Cmd, 1);
 422
 423         if ( param_gethex(Cmd,1, &blockno, 2) ) {
 424                 PrintAndLog("Block number must include 2 HEX symbols");
 425                 return 0;
 426         }
 427
 428         if ( isSrix4k ){
 429                 if ( blockno > 0x7f && blockno != 0xff ){
 430                         PrintAndLog("Block number out of range");
 431                         return 0;
 432                 }
 433         } else {
 434                 if ( blockno > 0x0f && blockno != 0xff ){
 435                         PrintAndLog("Block number out of range");
 436                         return 0;
 437                 }
 438         }
 439
 440         if (param_gethex(Cmd, 2, data, 8)) {
 441                 PrintAndLog("Data must include 8 HEX symbols");
 442                 return 0;
 443         }
 444
 445         if ( blockno == 0xff)
 446                 PrintAndLog("[%s] Write special block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512" , blockno,  sprint_hex(data,4) );
 447         else
 448                 PrintAndLog("[%s] Write block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512", blockno,  sprint_hex(data,4) );
 449
 450         sprintf(str, "-c -p 09 %02x %02x%02x%02x%02x", blockno, data[0], data[1], data[2], data[3]);
 451
 452         CmdHF14BCmdRaw(str);
 453         return 0;
 454 }
 455
 456 static command_t CommandTable[] =
 457 {
 458   {"help",        CmdHelp,        1, "This help"},
 459   {"demod",       CmdHF14BDemod,  1, "Demodulate ISO14443 Type B from tag"},
 460   {"list",        CmdHF14BList,   0, "List ISO 14443 history"},
 461   {"read",        CmdHF14BRead,   0, "Read HF tag (ISO 14443)"},
 462   {"sim",         CmdHF14Sim,     0, "Fake ISO 14443 tag"},
 463   {"simlisten",   CmdHFSimlisten, 0, "Get HF samples as fake tag"},
 464   {"snoop",       CmdHF14BSnoop,  0, "Eavesdrop ISO 14443"},
 465   {"sri512read",  CmdSri512Read,  0, "Read contents of a SRI512 tag"},
 466   {"srix4kread",  CmdSrix4kRead,  0, "Read contents of a SRIX4K tag"},
 467   {"raw",         CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},
 468   {"write",       CmdHF14BWrite,  0, "Write data to a SRI512 | SRIX4K tag"},
 469   {NULL, NULL, 0, NULL}
 470 };
 471
 472 int CmdHF14B(const char *Cmd)
 473 {
 474   CmdsParse(CommandTable, Cmd);
 475   return 0;
 476 }
 477
 478 int CmdHelp(const char *Cmd)
 479 {
 480   CmdsHelp(CommandTable);
 481   return 0;
 482 }