git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhftopaz.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2015 Piwi
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // High frequency Topaz (NFC Type 1) commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <stdlib.h>
  13 #include <string.h>
  14 #include <unistd.h>
  15 #include "cmdmain.h"
  16 #include "cmdparser.h"
  17 #include "cmdhftopaz.h"
  18 #include "cmdhf14a.h"
  19 #include "ui.h"
  20 #include "mifare.h"
  21 #include "proxmark3.h"
  22 #include "iso14443crc.h"
  23 #include "protocols.h"
  24
  25 #define TOPAZ_MAX_MEMORY        2048
  26
  27 static struct {
  28         uint8_t HR01[2];
  29         uint8_t uid[7];
  30         uint8_t size;
  31         uint8_t data_blocks[TOPAZ_MAX_MEMORY/8][8];
  32         uint8_t *dynamic_lock_areas;
  33         uint8_t *dynamic_reserved_areas;
  34 } topaz_tag;
  35
  36
  37 static void topaz_switch_on_field(void)
  38 {
  39         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT | ISO14A_NO_SELECT | ISO14A_NO_DISCONNECT | ISO14A_TOPAZMODE, 0, 0}};
  40         SendCommand(&c);
  41 }
  42
  43
  44 static void topaz_switch_off_field(void)
  45 {
  46         UsbCommand c = {CMD_READER_ISO_14443a, {0, 0, 0}};
  47         SendCommand(&c);
  48 }
  49
  50
  51 static int topaz_send_cmd_raw(uint8_t *cmd, uint8_t len, uint8_t *response)
  52 {
  53         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_RAW | ISO14A_NO_DISCONNECT | ISO14A_TOPAZMODE, len, 0}};
  54         memcpy(c.d.asBytes, cmd, len);
  55         SendCommand(&c);
  56
  57         UsbCommand resp;
  58         WaitForResponse(CMD_ACK, &resp);
  59
  60         if (resp.arg[0] > 0) {
  61                 memcpy(response, resp.d.asBytes, resp.arg[0]);
  62         }
  63
  64         return resp.arg[0];
  65 }
  66
  67
  68 static int topaz_send_cmd(uint8_t *cmd, uint8_t len, uint8_t *response)
  69 {
  70         if (len > 1) {
  71         uint8_t first, second;
  72                 ComputeCrc14443(CRC_14443_B, cmd, len-2, &first, &second);
  73         cmd[len-2] = first;
  74         cmd[len-1] = second;
  75         }
  76
  77         return topaz_send_cmd_raw(cmd, len, response);
  78 }
  79
  80
  81 static int topaz_select(uint8_t *atqa, uint8_t *rid_response)
  82 {
  83         // ToDo: implement anticollision
  84
  85         uint8_t wupa_cmd[] = {TOPAZ_WUPA};
  86         uint8_t rid_cmd[] = {TOPAZ_RID, 0, 0, 0, 0, 0, 0, 0, 0};
  87
  88         topaz_switch_on_field();
  89
  90         if (!topaz_send_cmd(wupa_cmd, sizeof(wupa_cmd), atqa)) {
  91                 topaz_switch_off_field();
  92                 return -1;              // WUPA failed
  93         }
  94
  95         if (!topaz_send_cmd(rid_cmd, sizeof(rid_cmd), rid_response)) {
  96                 topaz_switch_off_field();
  97                 return -2;              // RID failed
  98         }
  99
 100         return 0;               // OK
 101 }
 102
 103
 104 static int topaz_rall(uint8_t *uid, uint8_t *response)
 105 {
 106         uint8_t rall_cmd[] = {TOPAZ_RALL, 0, 0, 0, 0, 0, 0, 0, 0};
 107
 108         memcpy(&rall_cmd[3], uid, 4);
 109         if (!topaz_send_cmd(rall_cmd, sizeof(rall_cmd), response)) {
 110                 topaz_switch_off_field();
 111                 return -1;              // RALL failed
 112         }
 113
 114         return 0;
 115 }
 116
 117
 118 static bool topaz_block_is_locked(uint8_t blockno, uint8_t *lockbits)
 119 {
 120         if(lockbits[blockno/8] >> (blockno % 8) & 0x01) {
 121                 return true;
 122         } else {
 123                 return false;
 124         }
 125 }
 126
 127
 128 static int topaz_print_CC(uint8_t *data)
 129 {
 130         if(data[0] != 0xe1) {
 131                 return -1;              // no NDEF message
 132         }
 133
 134         PrintAndLog("Capability Container: %02x %02x %02x %02x", data[0], data[1], data[2], data[3]);
 135         PrintAndLog("  %02x: NDEF Magic Number", data[0]);
 136         PrintAndLog("  %02x: version %d.%d supported by tag", data[1], (data[1] & 0xF0) >> 4, data[1] & 0x0f);
 137         PrintAndLog("  %02x: Physical Memory Size of this tag: %d bytes", data[2], (data[2] + 1) * 8);
 138         PrintAndLog("  %02x: %s / %s", data[3],
 139                                 (data[3] & 0xF0) ? "(RFU)" : "Read access granted without any security",
 140                                 (data[3] & 0x0F)==0 ? "Write access granted without any security" : (data[3] & 0x0F)==0x0F ? "No write access granted at all" : "(RFU)");
 141         return 0;
 142 }
 143
 144
 145 static void get_TLV(uint8_t **TLV_ptr, uint8_t *tag, uint16_t *length, uint8_t **value)
 146 {
 147         *length = 0;
 148         *value = NULL;
 149
 150         *tag = **TLV_ptr;
 151         *TLV_ptr += 1;
 152         switch (*tag) {
 153                 case 0x00:                      // NULL TLV.
 154                 case 0xFE:                      // Terminator TLV.
 155                         break;
 156                 case 0x01:                      // Lock Control TLV
 157                 case 0x02:                      // Reserved Memory TLV
 158                 case 0x03:                      // NDEF message TLV
 159                 case 0xFD:                      // proprietary TLV
 160                         *length = **TLV_ptr;
 161                         *TLV_ptr += 1;
 162                         if (*length == 0xff) {
 163                                 *length = **TLV_ptr << 8;
 164                                 *TLV_ptr += 1;
 165                                 *length |= **TLV_ptr;
 166                                 *TLV_ptr += 1;
 167                         }
 168                         *value = *TLV_ptr;
 169                         *TLV_ptr += *length;
 170                         break;
 171                 default:                        // RFU
 172                         break;
 173         }
 174 }
 175
 176
 177 static bool topaz_print_lock_control_TLVs(uint8_t *memory)
 178 {
 179         uint8_t *TLV_ptr = memory;
 180         uint8_t tag = 0;
 181         uint16_t length;
 182         uint8_t *value;
 183         bool lock_TLV_present = false;
 184
 185         while(*TLV_ptr != 0x03 && *TLV_ptr != 0xFD && *TLV_ptr != 0xFE) {
 186                 // all Lock Control TLVs shall be present before the NDEF message TLV, the proprietary TLV (and the Terminator TLV)
 187                 get_TLV(&TLV_ptr, &tag, &length, &value);
 188                 if (tag == 0x01) {                      // the Lock Control TLV
 189                         uint8_t pages_addr = value[0] >> 4;
 190                         uint8_t byte_offset = value[0] & 0x0f;
 191                         uint8_t size_in_bits = value[1] ? value[1] : 256;
 192                         uint8_t bytes_per_page = 1 << (value[2] & 0x0f);
 193                         uint8_t bytes_locked_per_bit = 1 << (value[2] >> 4);
 194                         PrintAndLog("Lock Area of %d bits at byte offset 0x%02x. Each Lock Bit locks %d bytes.",
 195                                                 size_in_bits,
 196                                                 pages_addr * bytes_per_page + byte_offset,
 197                                                 bytes_locked_per_bit);
 198                         lock_TLV_present = true;
 199                 }
 200         }
 201
 202         if (!lock_TLV_present) {
 203                 PrintAndLog("(No Lock Control TLV present)");
 204                 return -1;
 205         } else {
 206                 return 0;
 207         }
 208 }
 209
 210
 211 static int topaz_print_reserved_memory_control_TLVs(uint8_t *memory)
 212 {
 213         uint8_t *TLV_ptr = memory;
 214         uint8_t tag = 0;
 215         uint16_t length;
 216         uint8_t *value;
 217         bool reserved_memory_control_TLV_present = false;
 218
 219         while(*TLV_ptr != 0x03 && *TLV_ptr != 0xFD && *TLV_ptr != 0xFE) {
 220                 // all Reserved Memory Control TLVs shall be present before the NDEF message TLV, the proprietary TLV (and the Terminator TLV)
 221                 get_TLV(&TLV_ptr, &tag, &length, &value);
 222                 if (tag == 0x02) {                      // the Reserved Memory Control TLV
 223                         uint8_t pages_addr = value[0] >> 4;
 224                         uint8_t byte_offset = value[0] & 0x0f;
 225                         uint8_t size_in_bytes = value[1] ? value[1] : 256;
 226                         uint8_t bytes_per_page = 1 << (value[2] & 0x0f);
 227                         PrintAndLog("Reserved Memory of %d bytes at byte offset 0x%02x.",
 228                                                 size_in_bytes,
 229                                                 pages_addr * bytes_per_page + byte_offset);
 230                         reserved_memory_control_TLV_present = true;
 231                 }
 232         }
 233
 234         if (!reserved_memory_control_TLV_present) {
 235                 PrintAndLog("(No Reserved Memory Control TLV present)");
 236                 return -1;
 237         } else {
 238                 return 0;
 239         }
 240 }
 241
 242
 243 static void topaz_print_lifecycle_state(uint8_t *data)
 244 {
 245
 246 }
 247
 248
 249 static void topaz_print_NDEF(uint8_t *data)
 250 {
 251
 252 }
 253
 254
 255 int CmdHFTopazReader(const char *Cmd)
 256 {
 257         int status;
 258         uint8_t atqa[2];
 259         uint8_t rid_response[8];
 260         uint8_t *uid_echo = &rid_response[2];
 261         uint8_t rall_response[124];
 262
 263         status = topaz_select(atqa, rid_response);
 264
 265         if (status == -1) {
 266                 PrintAndLog("Error: couldn't receive ATQA");
 267                 return -1;
 268         }
 269
 270         PrintAndLog("ATQA : %02x %02x", atqa[1], atqa[0]);
 271         if (atqa[1] != 0x0c && atqa[0] != 0x00) {
 272                 PrintAndLog("Tag doesn't support the Topaz protocol.");
 273                 topaz_switch_off_field();
 274                 return -1;
 275         }
 276
 277         if (status == -2) {
 278                 PrintAndLog("Error: tag didn't answer to RID");
 279                 topaz_switch_off_field();
 280                 return -1;
 281         }
 282
 283         topaz_tag.HR01[0] = rid_response[0];
 284         topaz_tag.HR01[1] = rid_response[1];
 285
 286         // ToDo: CRC check
 287         PrintAndLog("HR0  : %02x (%sa Topaz tag (%scapable of carrying a NDEF message), %s memory map)", rid_response[0],
 288                                                 (rid_response[0] & 0xF0) == 0x10 ? "" : "not ",
 289                                                 (rid_response[0] & 0xF0) == 0x10 ? "" : "not ",
 290                                                 (rid_response[0] & 0x0F) == 0x10 ? "static" : "dynamic");
 291         PrintAndLog("HR1  : %02x", rid_response[1]);
 292
 293         status = topaz_rall(uid_echo, rall_response);
 294
 295         if(status == -1) {
 296                 PrintAndLog("Error: tag didn't answer to RALL");
 297                 topaz_switch_off_field();
 298                 return -1;
 299         }
 300
 301         memcpy(topaz_tag.uid, rall_response+2, 7);
 302         PrintAndLog("UID  : %02x %02x %02x %02x %02x %02x %02x",
 303                         topaz_tag.uid[6],
 304                         topaz_tag.uid[5],
 305                         topaz_tag.uid[4],
 306                         topaz_tag.uid[3],
 307                         topaz_tag.uid[2],
 308                         topaz_tag.uid[1],
 309                         topaz_tag.uid[0]);
 310         PrintAndLog("       UID[6] (Manufacturer Byte) = %02x, Manufacturer: %s",
 311                         topaz_tag.uid[6],
 312                         getTagInfo(topaz_tag.uid[6]));
 313
 314         memcpy(topaz_tag.data_blocks, rall_response+2, 0x10*8);
 315         PrintAndLog("");
 316         PrintAndLog("Static Data blocks 00 to 0c:");
 317         PrintAndLog("block# | offset | Data                    | Locked?");
 318         char line[80];
 319         for (uint16_t i = 0; i <= 0x0c; i++) {
 320                 for (uint16_t j = 0; j < 8; j++) {
 321                         sprintf(&line[3*j], "%02x ", topaz_tag.data_blocks[i][j] /*rall_response[2 + 8*i + j]*/);
 322                 }
 323                 PrintAndLog("  0x%02x |  0x%02x  | %s|   %-3s", i, i*8, line, topaz_block_is_locked(i, &topaz_tag.data_blocks[0x0e][0]) ? "yes" : "no");
 324         }
 325
 326         PrintAndLog("");
 327         PrintAndLog("Static Reserved block 0d:");
 328         for (uint16_t j = 0; j < 8; j++) {
 329                 sprintf(&line[3*j], "%02x ", topaz_tag.data_blocks[0x0d][j]);
 330         }
 331         PrintAndLog("  0x%02x |  0x%02x  | %s|   %-3s", 0x0d, 0x0d*8, line, "n/a");
 332
 333         PrintAndLog("");
 334         PrintAndLog("Static Lockbits and OTP Bytes:");
 335         for (uint16_t j = 0; j < 8; j++) {
 336                 sprintf(&line[3*j], "%02x ", topaz_tag.data_blocks[0x0e][j]);
 337         }
 338         PrintAndLog("  0x%02x |  0x%02x  | %s|   %-3s", 0x0e, 0x0e*8, line, "n/a");
 339
 340         PrintAndLog("");
 341
 342         status = topaz_print_CC(&topaz_tag.data_blocks[1][0]);
 343
 344         if (status == -1) {
 345                 PrintAndLog("No NDEF message present");
 346                 topaz_switch_off_field();
 347                 return 0;
 348         }
 349
 350         PrintAndLog("");
 351         bool lock_TLV_present = topaz_print_lock_control_TLVs(&topaz_tag.data_blocks[1][4]);
 352
 353         PrintAndLog("");
 354         bool reserved_mem_present = topaz_print_reserved_memory_control_TLVs(&topaz_tag.data_blocks[1][4]);
 355
 356         topaz_print_lifecycle_state(&topaz_tag.data_blocks[1][0]);
 357
 358         topaz_print_NDEF(&topaz_tag.data_blocks[1][0]);
 359
 360         topaz_switch_off_field();
 361         return 0;
 362 }
 363
 364
 365 int CmdHFTopazSim(const char *Cmd)
 366 {
 367         PrintAndLog("not yet implemented");
 368         return 0;
 369 }
 370
 371
 372 int CmdHFTopazCmdRaw(const char *Cmd)
 373 {
 374         PrintAndLog("not yet implemented");
 375         return 0;
 376 }
 377
 378
 379 static int CmdHelp(const char *Cmd);
 380
 381
 382 static command_t CommandTable[] =
 383 {
 384         {"help",        CmdHelp,                        1, "This help"},
 385         {"reader",      CmdHFTopazReader,       0, "Act like a Topaz reader"},
 386         {"sim",         CmdHFTopazSim,          0, "<UID> -- Simulate Topaz tag"},
 387         {"snoop",       CmdHF14ASnoop,          0, "Eavesdrop a Topaz reader-tag communication"},
 388         {"raw",         CmdHFTopazCmdRaw,       0, "Send raw hex data to tag"},
 389         {NULL,          NULL,                           0, NULL}
 390 };
 391
 392
 393 int CmdHFTopaz(const char *Cmd) {
 394         // flush
 395         WaitForResponseTimeout(CMD_ACK,NULL,100);
 396
 397         // parse
 398         CmdsParse(CommandTable, Cmd);
 399         return 0;
 400 }
 401
 402 static int CmdHelp(const char *Cmd)
 403 {
 404         CmdsHelp(CommandTable);
 405         return 0;
 406 }
 407
 408