]> git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf14b.c
Merge pull request #13 from k02a/patch-1
[proxmark3-svn] / client / cmdhf14b.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // High frequency ISO14443B commands
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <stdlib.h>
13 #include <stdbool.h>
14 #include <stdint.h>
15 #include "cmdhf14b.h"
16
17 #define TIMEOUT 2000
18 static int CmdHelp(const char *Cmd);
19
20 int usage_hf_14b_info(void){
21 PrintAndLog("Usage: hf 14b info [h] [s]");
22 PrintAndLog("Options:");
23 PrintAndLog(" h this help");
24 PrintAndLog(" s silently");
25 PrintAndLog("sample:");
26 PrintAndLog(" hf 14b info");
27 return 0;
28 }
29 int usage_hf_14b_reader(void){
30 PrintAndLog("Usage: hf 14b reader [h] [s]");
31 PrintAndLog("Options:");
32 PrintAndLog(" h this help");
33 PrintAndLog(" s silently");
34 PrintAndLog("sample:");
35 PrintAndLog(" hf 14b reader");
36 return 0;
37 }
38 int usage_hf_14b_raw(void){
39 PrintAndLog("Usage: hf 14b raw [-h] [-r] [-c] [-p] [-s || -ss] <0A 0B 0C ... hex>");
40 PrintAndLog("Options:");
41 PrintAndLog(" -h this help");
42 PrintAndLog(" -r do not read response");
43 PrintAndLog(" -c calculate and append CRC");
44 PrintAndLog(" -p leave the field on after receive");
45 PrintAndLog(" -s active signal field ON with select");
46 PrintAndLog(" -ss active signal field ON with select for SRx ST Microelectronics tags");
47 PrintAndLog("sample:");
48 PrintAndLog(" hf 14b raw -s -c -p 0200a40400");
49 return 0;
50 }
51 int usage_hf_14b_snoop(void){
52 PrintAndLog("It get data from the field and saves it into command buffer.");
53 PrintAndLog("Buffer accessible from command 'hf list 14b'");
54 PrintAndLog("Usage: hf 14b snoop [h]");
55 PrintAndLog("Options:");
56 PrintAndLog(" h this help");
57 PrintAndLog("sample:");
58 PrintAndLog(" hf 14b snoop");
59 return 0;
60 }
61 int usage_hf_14b_sim(void){
62 PrintAndLog("Emulating ISO/IEC 14443 type B tag with 4 UID / PUPI");
63 PrintAndLog("Usage: hf 14b sim [h] u <uid>");
64 PrintAndLog("Options:");
65 PrintAndLog(" h this help");
66 PrintAndLog(" u 4byte UID/PUPI");
67 PrintAndLog("sample:");
68 PrintAndLog(" hf 14b sim");
69 PrintAndLog(" hf 14b sim u 11223344");
70 return 0;
71 }
72 int usage_hf_14b_read_srx(void){
73 PrintAndLog("Usage: hf 14b read [h] <1|2>");
74 PrintAndLog("Options:");
75 PrintAndLog(" h this help");
76 PrintAndLog(" <1|2> 1 = SRIX4K , 2 = SRI512");
77 PrintAndLog("sample:");
78 PrintAndLog(" hf 14b read 1");
79 PrintAndLog(" hf 14b read 2");
80 return 0;
81 }
82 int usage_hf_14b_write_srx(void){
83 PrintAndLog("Usage: hf 14b [h] write <1|2> <BLOCK> <DATA>");
84 PrintAndLog("Options:");
85 PrintAndLog(" h this help");
86 PrintAndLog(" <1|2> 1 = SRIX4K , 2 = SRI512");
87 PrintAndLog(" <block> BLOCK number depends on tag, special block == FF");
88 PrintAndLog(" <data> hex bytes of data to be written");
89 PrintAndLog("sample:");
90 PrintAndLog(" hf 14b write 1 7F 11223344");
91 PrintAndLog(" hf 14b write 1 FF 11223344");
92 PrintAndLog(" hf 14b write 2 15 11223344");
93 PrintAndLog(" hf 14b write 2 FF 11223344");
94 return 0;
95 }
96
97 static void switch_on_field_14b(void) {
98 UsbCommand c = {CMD_ISO_14443B_COMMAND, {ISO14B_CONNECT, 0, 0}};
99 clearCommandBuffer();
100 SendCommand(&c);
101 }
102
103 static int switch_off_field_14b(void) {
104 UsbCommand c = {CMD_ISO_14443B_COMMAND, {ISO14B_DISCONNECT, 0, 0}};
105 clearCommandBuffer();
106 SendCommand(&c);
107 return 0;
108 }
109
110 int CmdHF14BList(const char *Cmd) {
111 CmdHFList("14b");
112 return 0;
113 }
114
115 int CmdHF14BSim(const char *Cmd) {
116 char cmdp = param_getchar(Cmd, 0);
117 if (cmdp == 'h' || cmdp == 'H') return usage_hf_14b_sim();
118
119 uint32_t pupi = 0;
120 if (cmdp == 'u' || cmdp == 'U') {
121 pupi = param_get32ex(Cmd, 1, 0, 16);
122 }
123
124 UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443B, {pupi, 0, 0}};
125 clearCommandBuffer();
126 SendCommand(&c);
127 return 0;
128 }
129
130 int CmdHF14BSnoop(const char *Cmd) {
131
132 char cmdp = param_getchar(Cmd, 0);
133 if (cmdp == 'h' || cmdp == 'H') return usage_hf_14b_snoop();
134
135 UsbCommand c = {CMD_SNOOP_ISO_14443B, {0, 0, 0}};
136 clearCommandBuffer();
137 SendCommand(&c);
138 return 0;
139 }
140
141 int CmdHF14BCmdRaw (const char *Cmd) {
142 bool reply = TRUE;
143 bool power = FALSE;
144 bool select = FALSE;
145 char buf[5]="";
146
147 int i = 0;
148 uint8_t data[USB_CMD_DATA_SIZE] = {0x00};
149 uint16_t datalen = 0;
150 uint32_t flags = ISO14B_CONNECT;
151 uint32_t temp = 0;
152
153 if (strlen(Cmd)<3) return usage_hf_14b_raw();
154
155 // strip
156 while (*Cmd==' ' || *Cmd=='\t') ++Cmd;
157
158 while (Cmd[i]!='\0') {
159 if (Cmd[i]==' ' || Cmd[i]=='\t') { ++i; continue; }
160 if (Cmd[i]=='-') {
161 switch (Cmd[i+1]) {
162 case 'H':
163 case 'h':
164 return usage_hf_14b_raw();
165 case 'r':
166 case 'R':
167 reply = FALSE;
168 break;
169 case 'c':
170 case 'C':
171 flags |= ISO14B_APPEND_CRC;
172 break;
173 case 'p':
174 case 'P':
175 power = TRUE;
176 break;
177 case 's':
178 case 'S':
179 select = TRUE;
180 if (Cmd[i+2]=='s' || Cmd[i+2]=='S') {
181 flags |= ISO14B_SELECT_SR;
182 ++i;
183 } else {
184 flags |= ISO14B_SELECT_STD;
185 }
186 break;
187 default:
188 return usage_hf_14b_raw();
189 }
190 i+=2;
191 continue;
192 }
193 if ((Cmd[i]>='0' && Cmd[i]<='9') ||
194 (Cmd[i]>='a' && Cmd[i]<='f') ||
195 (Cmd[i]>='A' && Cmd[i]<='F') ) {
196 buf[strlen(buf)+1]=0;
197 buf[strlen(buf)]=Cmd[i];
198 i++;
199
200 if (strlen(buf)>=2) {
201 sscanf(buf,"%x",&temp);
202 data[datalen++] = (uint8_t)(temp & 0xff);
203 *buf=0;
204 memset(buf, 0x00, sizeof(buf));
205 }
206 continue;
207 }
208 PrintAndLog("Invalid char on input");
209 return 0;
210 }
211
212 if(!power)
213 flags |= ISO14B_DISCONNECT;
214
215 if(datalen>0)
216 flags |= ISO14B_RAW;
217
218 // Max buffer is USB_CMD_DATA_SIZE
219 datalen = (datalen > USB_CMD_DATA_SIZE) ? USB_CMD_DATA_SIZE : datalen;
220
221 UsbCommand c = {CMD_ISO_14443B_COMMAND, {flags, datalen, 0}};
222 memcpy(c.d.asBytes, data, datalen);
223 clearCommandBuffer();
224 SendCommand(&c);
225
226 if (!reply) return 1;
227
228 bool success = TRUE;
229 // get back iso14b_card_select_t, don't print it.
230 if(select)
231 success = waitCmd(FALSE);
232
233 // get back response from the raw bytes you sent.
234 if(success && datalen>0) waitCmd(TRUE);
235
236 return 1;
237 }
238
239 // print full atqb info
240 // bytes
241 // 0,1,2,3 = application data
242 // 4 = bit rate capacity
243 // 5 = max frame size / -4 info
244 // 6 = FWI / Coding options
245 static void print_atqb_resp(uint8_t *data, uint8_t cid){
246 //PrintAndLog(" UID: %s", sprint_hex(data+1,4));
247 PrintAndLog(" App Data: %s", sprint_hex(data,4));
248 PrintAndLog(" Protocol: %s", sprint_hex(data+4,3));
249 uint8_t BitRate = data[4];
250 if (!BitRate) PrintAndLog(" Bit Rate: 106 kbit/s only PICC <-> PCD");
251 if (BitRate & 0x10) PrintAndLog(" Bit Rate: 212 kbit/s PICC -> PCD supported");
252 if (BitRate & 0x20) PrintAndLog(" Bit Rate: 424 kbit/s PICC -> PCD supported");
253 if (BitRate & 0x40) PrintAndLog(" Bit Rate: 847 kbit/s PICC -> PCD supported");
254 if (BitRate & 0x01) PrintAndLog(" Bit Rate: 212 kbit/s PICC <- PCD supported");
255 if (BitRate & 0x02) PrintAndLog(" Bit Rate: 424 kbit/s PICC <- PCD supported");
256 if (BitRate & 0x04) PrintAndLog(" Bit Rate: 847 kbit/s PICC <- PCD supported");
257 if (BitRate & 0x80) PrintAndLog(" Same bit rate <-> required");
258
259 uint16_t maxFrame = data[5]>>4;
260 if (maxFrame < 5) maxFrame = 8 * maxFrame + 16;
261 else if (maxFrame == 5) maxFrame = 64;
262 else if (maxFrame == 6) maxFrame = 96;
263 else if (maxFrame == 7) maxFrame = 128;
264 else if (maxFrame == 8) maxFrame = 256;
265 else maxFrame = 257;
266
267 PrintAndLog("Max Frame Size: %u%s bytes",maxFrame, (maxFrame == 257) ? "+ RFU" : "");
268
269 uint8_t protocolT = data[5] & 0xF;
270 PrintAndLog(" Protocol Type: Protocol is %scompliant with ISO/IEC 14443-4",(protocolT) ? "" : "not " );
271
272 uint8_t fwt = data[6]>>4;
273 if ( fwt < 16 ){
274 uint32_t etus = (32 << fwt);
275 uint32_t fwt_time = (302 << fwt);
276 PrintAndLog("Frame Wait Integer: %u - %u ETUs | %u us", fwt, etus, fwt_time);
277 } else {
278 PrintAndLog("Frame Wait Integer: %u - RFU", fwt);
279 }
280
281 PrintAndLog(" App Data Code: Application is %s",(data[6]&4) ? "Standard" : "Proprietary");
282 PrintAndLog(" Frame Options: NAD is %ssupported",(data[6]&2) ? "" : "not ");
283 PrintAndLog(" Frame Options: CID is %ssupported",(data[6]&1) ? "" : "not ");
284 PrintAndLog("Tag :");
285 PrintAndLog(" Max Buf Length: %u (MBLI) %s", cid>>4, (cid & 0xF0) ? "" : "chained frames not supported");
286 PrintAndLog(" CDI : %u", cid & 0x0f);
287 return;
288 }
289
290 // get SRx chip model (from UID) // from ST Microelectronics
291 char *get_ST_Chip_Model(uint8_t data){
292 static char model[20];
293 char *retStr = model;
294 memset(model,0, sizeof(model));
295
296 switch (data) {
297 case 0x0: sprintf(retStr, "SRIX4K (Special)"); break;
298 case 0x2: sprintf(retStr, "SR176"); break;
299 case 0x3: sprintf(retStr, "SRIX4K"); break;
300 case 0x4: sprintf(retStr, "SRIX512"); break;
301 case 0x6: sprintf(retStr, "SRI512"); break;
302 case 0x7: sprintf(retStr, "SRI4K"); break;
303 case 0xC: sprintf(retStr, "SRT512"); break;
304 default : sprintf(retStr, "Unknown"); break;
305 }
306 return retStr;
307 }
308
309 // REMAKE:
310 int print_ST_Lock_info(uint8_t model){
311
312 // PrintAndLog("Chip Write Protection Bits:");
313 // // now interpret the data
314 // switch (model){
315 // case 0x0: //fall through (SRIX4K special)
316 // case 0x3: //fall through (SRIx4K)
317 // case 0x7: // (SRI4K)
318 // //only need data[3]
319 // blk1 = 9;
320 // PrintAndLog(" raw: %s", sprint_bin(data+3, 1));
321 // PrintAndLog(" 07/08:%slocked", (data[3] & 1) ? " not " : " " );
322 // for (uint8_t i = 1; i<8; i++){
323 // PrintAndLog(" %02u:%slocked", blk1, (data[3] & (1 << i)) ? " not " : " " );
324 // blk1++;
325 // }
326 // break;
327 // case 0x4: //fall through (SRIX512)
328 // case 0x6: //fall through (SRI512)
329 // case 0xC: // (SRT512)
330 // //need data[2] and data[3]
331 // blk1 = 0;
332 // PrintAndLog(" raw: %s", sprint_bin(data+2, 2));
333 // for (uint8_t b=2; b<4; b++){
334 // for (uint8_t i=0; i<8; i++){
335 // PrintAndLog(" %02u:%slocked", blk1, (data[b] & (1 << i)) ? " not " : " " );
336 // blk1++;
337 // }
338 // }
339 // break;
340 // case 0x2: // (SR176)
341 // //need data[2]
342 // blk1 = 0;
343 // PrintAndLog(" raw: %s", sprint_bin(data+2, 1));
344 // for (uint8_t i = 0; i<8; i++){
345 // PrintAndLog(" %02u/%02u:%slocked", blk1, blk1+1, (data[2] & (1 << i)) ? " " : " not " );
346 // blk1+=2;
347 // }
348 // break;
349 // default:
350 // return rawClose();
351 // }
352 return 1;
353 }
354
355 // print UID info from SRx chips (ST Microelectronics)
356 static void print_st_general_info(uint8_t *data, uint8_t len){
357 //uid = first 8 bytes in data
358 PrintAndLog(" UID: %s", sprint_hex(SwapEndian64(data,8,8), len));
359 PrintAndLog(" MFG: %02X, %s", data[6], getTagInfo(data[6]));
360 PrintAndLog("Chip: %02X, %s", data[5]>>2, get_ST_Chip_Model(data[5]>>2));
361 return;
362 }
363
364 //05 00 00 = find one tag in field
365 //1d xx xx xx xx 00 08 01 00 = attrib xx=UID (resp 10 [f9 e0])
366 //a3 = ? (resp 03 [e2 c2])
367 //02 = ? (resp 02 [6a d3])
368 // 022b (resp 02 67 00 [29 5b])
369 // 0200a40400 (resp 02 67 00 [29 5b])
370 // 0200a4040c07a0000002480300 (resp 02 67 00 [29 5b])
371 // 0200a4040c07a0000002480200 (resp 02 67 00 [29 5b])
372 // 0200a4040006a0000000010100 (resp 02 6a 82 [4b 4c])
373 // 0200a4040c09d27600002545500200 (resp 02 67 00 [29 5b])
374 // 0200a404000cd2760001354b414e4d30310000 (resp 02 6a 82 [4b 4c])
375 // 0200a404000ca000000063504b43532d313500 (resp 02 6a 82 [4b 4c])
376 // 0200a4040010a000000018300301000000000000000000 (resp 02 6a 82 [4b 4c])
377 //03 = ? (resp 03 [e3 c2])
378 //c2 = ? (resp c2 [66 15])
379 //b2 = ? (resp a3 [e9 67])
380 //a2 = ? (resp 02 [6a d3])
381
382 // 14b get and print Full Info (as much as we know)
383 bool HF14B_Std_Info(bool verbose){
384 //add more info here
385 return FALSE;
386 }
387
388 // SRx get and print full info (needs more info...)
389 bool HF14B_ST_Info(bool verbose){
390
391 UsbCommand c = {CMD_ISO_14443B_COMMAND, {ISO14B_CONNECT | ISO14B_SELECT_SR | ISO14B_DISCONNECT, 0, 0}};
392 clearCommandBuffer();
393 SendCommand(&c);
394 UsbCommand resp;
395
396 if (!WaitForResponseTimeout(CMD_ACK, &resp, TIMEOUT)) {
397 if (verbose) PrintAndLog("timeout while waiting for reply.");
398 return FALSE;
399 }
400
401 iso14b_card_select_t card;
402 memcpy(&card, (iso14b_card_select_t *)resp.d.asBytes, sizeof(iso14b_card_select_t));
403
404 uint64_t status = resp.arg[0];
405 if ( status > 0 ) return switch_off_field_14b();
406
407 //add locking bit information here. uint8_t data[16] = {0x00};
408 // uint8_t datalen = 2;
409 // uint8_t resplen;
410 // uint8_t blk1;
411 // data[0] = 0x08;
412
413 //
414 // if (model == 0x2) { //SR176 has special command:
415 // data[1] = 0xf;
416 // resplen = 4;
417 // } else {
418 // data[1] = 0xff;
419 // resplen = 6;
420 // }
421
422 // //std read cmd
423 // if (HF14BCmdRaw(true, true, data, &datalen, false)==0)
424 // return rawClose();
425
426 // if (datalen != resplen || !crc) return rawClose();
427 //print_ST_Lock_info(data[5]>>2);
428 switch_off_field_14b();
429 return TRUE;
430 }
431
432 // get and print all info known about any known 14b tag
433 bool HF14BInfo(bool verbose){
434
435 // try std 14b (atqb)
436 if (HF14B_Std_Info(verbose)) return TRUE;
437
438 // try st 14b
439 if (HF14B_ST_Info(verbose)) return TRUE;
440
441 // try unknown 14b read commands (to be identified later)
442 // could be read of calypso, CEPAS, moneo, or pico pass.
443
444 if (verbose) PrintAndLog("no 14443B tag found");
445 return FALSE;
446 }
447
448 // menu command to get and print all info known about any known 14b tag
449 int CmdHF14Binfo(const char *Cmd){
450 char cmdp = param_getchar(Cmd, 0);
451 if (cmdp == 'h' || cmdp == 'H') return usage_hf_14b_info();
452
453 bool verbose = !((cmdp == 's') || (cmdp == 'S'));
454 return HF14BInfo(verbose);
455 }
456
457 bool HF14B_ST_Reader(bool verbose){
458
459 bool isSuccess = FALSE;
460
461 switch_on_field_14b();
462
463 // SRx get and print general info about SRx chip from UID
464 UsbCommand c = {CMD_ISO_14443B_COMMAND, {ISO14B_SELECT_SR, 0, 0}};
465 clearCommandBuffer();
466 SendCommand(&c);
467 UsbCommand resp;
468 if (!WaitForResponseTimeout(CMD_ACK, &resp, TIMEOUT)) {
469 if (verbose) PrintAndLog("timeout while waiting for reply.");
470 return FALSE;
471 }
472
473 iso14b_card_select_t card;
474 memcpy(&card, (iso14b_card_select_t *)resp.d.asBytes, sizeof(iso14b_card_select_t));
475
476 uint64_t status = resp.arg[0];
477
478 switch( status ){
479 case 0:
480 print_st_general_info(card.uid, card.uidlen);
481 isSuccess = TRUE;
482 break;
483 case 1:
484 if (verbose) PrintAndLog("iso14443-3 random chip id fail");
485 break;
486 case 2:
487 if (verbose) PrintAndLog("iso14443-3 ATTRIB fail");
488 break;
489 case 3:
490 if (verbose) PrintAndLog("iso14443-3 CRC fail");
491 break;
492 default:
493 if (verbose) PrintAndLog("iso14443b card select SRx failed");
494 break;
495 }
496
497 switch_off_field_14b();
498 return isSuccess;
499 }
500
501 bool HF14B_Std_Reader(bool verbose){
502
503 bool isSuccess = FALSE;
504
505 // 14b get and print UID only (general info)
506 UsbCommand c = {CMD_ISO_14443B_COMMAND, {ISO14B_CONNECT | ISO14B_SELECT_STD | ISO14B_DISCONNECT, 0, 0}};
507 clearCommandBuffer();
508 SendCommand(&c);
509 UsbCommand resp;
510
511 if (!WaitForResponseTimeout(CMD_ACK, &resp, TIMEOUT)) {
512 if (verbose) PrintAndLog("timeout while waiting for reply.");
513 return FALSE;
514 }
515
516 iso14b_card_select_t card;
517 memcpy(&card, (iso14b_card_select_t *)resp.d.asBytes, sizeof(iso14b_card_select_t));
518
519 uint64_t status = resp.arg[0];
520
521 switch( status ){
522 case 0:
523 PrintAndLog(" UID : %s", sprint_hex(card.uid, card.uidlen));
524 PrintAndLog(" ATQB : %s", sprint_hex(card.atqb, sizeof(card.atqb)));
525 PrintAndLog(" CHIPID : %02X", card.chipid);
526 print_atqb_resp(card.atqb, card.cid);
527 isSuccess = TRUE;
528 break;
529 case 2:
530 if (verbose) PrintAndLog("iso14443-3 ATTRIB fail");
531 break;
532 case 3:
533 if (verbose) PrintAndLog("iso14443-3 CRC fail");
534 break;
535 default:
536 if (verbose) PrintAndLog("iso14443b card select failed");
537 break;
538 }
539
540 switch_off_field_14b();
541 return isSuccess;
542 }
543
544 // test for other 14b type tags (mimic another reader - don't have tags to identify)
545 bool HF14B_Other_Reader(){
546
547 // uint8_t data[] = {0x00, 0x0b, 0x3f, 0x80};
548 // uint8_t datalen = 4;
549
550 // // 14b get and print UID only (general info)
551 // uint32_t flags = ISO14B_CONNECT | ISO14B_SELECT_STD | ISO14B_RAW | ISO14B_APPEND_CRC;
552
553 // UsbCommand c = {CMD_ISO_14443B_COMMAND, {flags, datalen, 0}};
554 // memcpy(c.d.asBytes, data, datalen);
555
556 // clearCommandBuffer();
557 // SendCommand(&c);
558 // UsbCommand resp;
559 // WaitForResponse(CMD_ACK,&resp);
560
561 // if (datalen > 2 ) {
562 // printandlog ("\n14443-3b tag found:");
563 // printandlog ("unknown tag type answered to a 0x000b3f80 command ans:");
564 // //printandlog ("%s", sprint_hex(data, datalen));
565 // rawclose();
566 // return true;
567 // }
568
569 // c.arg1 = 1;
570 // c.d.asBytes[0] = ISO14443B_AUTHENTICATE;
571 // clearCommandBuffer();
572 // SendCommand(&c);
573 // UsbCommand resp;
574 // WaitForResponse(CMD_ACK, &resp);
575
576 // if (datalen > 0) {
577 // PrintAndLog ("\n14443-3b tag found:");
578 // PrintAndLog ("Unknown tag type answered to a 0x0A command ans:");
579 // // PrintAndLog ("%s", sprint_hex(data, datalen));
580 // rawClose();
581 // return TRUE;
582 // }
583
584 // c.arg1 = 1;
585 // c.d.asBytes[0] = ISO14443B_RESET;
586 // clearCommandBuffer();
587 // SendCommand(&c);
588 // UsbCommand resp;
589 // WaitForResponse(CMD_ACK, &resp);
590
591 // if (datalen > 0) {
592 // PrintAndLog ("\n14443-3b tag found:");
593 // PrintAndLog ("Unknown tag type answered to a 0x0C command ans:");
594 // PrintAndLog ("%s", sprint_hex(data, datalen));
595 // rawClose();
596 // return TRUE;
597 // }
598
599 // rawClose();
600 return FALSE;
601 }
602
603 // get and print general info about all known 14b chips
604 bool HF14BReader(bool verbose){
605
606 // try std 14b (atqb)
607 if (HF14B_Std_Reader(verbose)) return TRUE;
608
609 // try ST Microelectronics 14b
610 if (HF14B_ST_Reader(verbose)) return TRUE;
611
612 // try unknown 14b read commands (to be identified later)
613 // could be read of calypso, CEPAS, moneo, or pico pass.
614 if (HF14B_Other_Reader()) return TRUE;
615
616 if (verbose) PrintAndLog("no 14443B tag found");
617 return FALSE;
618 }
619
620 // menu command to get and print general info about all known 14b chips
621 int CmdHF14BReader(const char *Cmd){
622 char cmdp = param_getchar(Cmd, 0);
623 if (cmdp == 'h' || cmdp == 'H') return usage_hf_14b_reader();
624
625 bool verbose = !((cmdp == 's') || (cmdp == 'S'));
626 return HF14BReader(verbose);
627 }
628
629 /* New command to read the contents of a SRI512|SRIX4K tag
630 * SRI* tags are ISO14443-B modulated memory tags,
631 * this command just dumps the contents of the memory/
632 */
633 int CmdHF14BReadSri(const char *Cmd){
634 char cmdp = param_getchar(Cmd, 0);
635 if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') return usage_hf_14b_read_srx();
636
637 uint8_t tagtype = param_get8(Cmd, 0);
638 uint8_t blocks = (tagtype == 1) ? 0x7F : 0x0F;
639
640 UsbCommand c = {CMD_READ_SRI_TAG, {blocks, 0, 0}};
641 clearCommandBuffer();
642 SendCommand(&c);
643 return 0;
644 }
645 // New command to write a SRI512/SRIX4K tag.
646 int CmdHF14BWriteSri(const char *Cmd){
647 /*
648 * For SRIX4K blocks 00 - 7F
649 * hf 14b raw -c -p 09 $srix4kwblock $srix4kwdata
650 *
651 * For SR512 blocks 00 - 0F
652 * hf 14b raw -c -p 09 $sr512wblock $sr512wdata
653 *
654 * Special block FF = otp_lock_reg block.
655 * Data len 4 bytes-
656 */
657 char cmdp = param_getchar(Cmd, 0);
658 uint8_t blockno = -1;
659 uint8_t data[4] = {0x00};
660 bool isSrix4k = true;
661 char str[30];
662 memset(str, 0x00, sizeof(str));
663
664 if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') return usage_hf_14b_write_srx();
665
666 if ( cmdp == '2' )
667 isSrix4k = false;
668
669 //blockno = param_get8(Cmd, 1);
670
671 if ( param_gethex(Cmd, 1, &blockno, 2) ) {
672 PrintAndLog("Block number must include 2 HEX symbols");
673 return 0;
674 }
675
676 if ( isSrix4k ){
677 if ( blockno > 0x7f && blockno != 0xff ){
678 PrintAndLog("Block number out of range");
679 return 0;
680 }
681 } else {
682 if ( blockno > 0x0f && blockno != 0xff ){
683 PrintAndLog("Block number out of range");
684 return 0;
685 }
686 }
687
688 if (param_gethex(Cmd, 2, data, 8)) {
689 PrintAndLog("Data must include 8 HEX symbols");
690 return 0;
691 }
692
693 if ( blockno == 0xff) {
694 PrintAndLog("[%s] Write special block %02X [ %s ]",
695 (isSrix4k) ? "SRIX4K":"SRI512",
696 blockno,
697 sprint_hex(data,4)
698 );
699 } else {
700 PrintAndLog("[%s] Write block %02X [ %s ]",
701 (isSrix4k) ? "SRIX4K":"SRI512",
702 blockno,
703 sprint_hex(data,4)
704 );
705 }
706
707 sprintf(str, "-ss -c %02x %02x %02x%02x%02x%02x", ISO14443B_WRITE_BLK, blockno, data[0], data[1], data[2], data[3]);
708 CmdHF14BCmdRaw(str);
709 return 0;
710 }
711
712 uint32_t srix4kEncode(uint32_t value) {
713 /*
714 // vv = value
715 // pp = position
716 // vv vv vv pp
717 4 bytes : 00 1A 20 01
718 */
719 // only the lower crumbs.
720 uint8_t block = (value & 0xFF);
721 uint8_t i = 0;
722 uint8_t valuebytes[] = {0,0,0};
723
724 num_to_bytes(value, 3, valuebytes);
725
726 // Scrambled part
727 // Crumb swapping of value.
728 uint8_t temp[] = {0,0};
729 temp[0] = (CRUMB(value, 22) << 4 | CRUMB(value, 14 ) << 2 | CRUMB(value, 6)) << 4;
730 temp[0] |= CRUMB(value, 20) << 4 | CRUMB(value, 12 ) << 2 | CRUMB(value, 4);
731 temp[1] = (CRUMB(value, 18) << 4 | CRUMB(value, 10 ) << 2 | CRUMB(value, 2)) << 4;
732 temp[1] |= CRUMB(value, 16) << 4 | CRUMB(value, 8 ) << 2 | CRUMB(value, 0);
733
734 // chksum part
735 uint32_t chksum = 0xFF - block;
736
737 // chksum is reduced by each nibbles of value.
738 for (i = 0; i < 3; ++i){
739 chksum -= NIBBLE_HIGH(valuebytes[i]);
740 chksum -= NIBBLE_LOW(valuebytes[i]);
741 }
742
743 // base4 conversion and left shift twice
744 i = 3;
745 uint8_t base4[] = {0,0,0,0};
746 while( chksum !=0 ){
747 base4[i--] = (chksum % 4 << 2);
748 chksum /= 4;
749 }
750
751 // merge scambled and chksum parts
752 uint32_t encvalue =
753 ( NIBBLE_LOW ( base4[0]) << 28 ) |
754 ( NIBBLE_HIGH( temp[0]) << 24 ) |
755
756 ( NIBBLE_LOW ( base4[1]) << 20 ) |
757 ( NIBBLE_LOW ( temp[0]) << 16 ) |
758
759 ( NIBBLE_LOW ( base4[2]) << 12 ) |
760 ( NIBBLE_HIGH( temp[1]) << 8 ) |
761
762 ( NIBBLE_LOW ( base4[3]) << 4 ) |
763 NIBBLE_LOW ( temp[1] );
764
765 PrintAndLog("ICE encoded | %08X -> %08X", value, encvalue);
766 return encvalue;
767 }
768 uint32_t srix4kDecode(uint32_t value) {
769 switch(value) {
770 case 0xC04F42C5: return 0x003139;
771 case 0xC1484807: return 0x002943;
772 case 0xC0C60848: return 0x001A20;
773 }
774 return 0;
775 }
776 uint32_t srix4kDecodeCounter(uint32_t num) {
777 uint32_t value = ~num;
778 ++value;
779 return value;
780 }
781
782 uint32_t srix4kGetMagicbytes( uint64_t uid, uint32_t block6, uint32_t block18, uint32_t block19 ){
783 #define MASK 0xFFFFFFFF;
784 uint32_t uid32 = uid & MASK;
785 uint32_t counter = srix4kDecodeCounter(block6);
786 uint32_t decodedBlock18 = srix4kDecode(block18);
787 uint32_t decodedBlock19 = srix4kDecode(block19);
788 uint32_t doubleBlock = (decodedBlock18 << 16 | decodedBlock19) + 1;
789
790 uint32_t result = (uid32 * doubleBlock * counter) & MASK;
791 PrintAndLog("Magic bytes | %08X", result);
792 return result;
793 }
794 int srix4kValid(const char *Cmd){
795
796 uint64_t uid = 0xD00202501A4532F9;
797 uint32_t block6 = 0xFFFFFFFF;
798 uint32_t block18 = 0xC04F42C5;
799 uint32_t block19 = 0xC1484807;
800 uint32_t block21 = 0xD1BCABA4;
801
802 uint32_t test_b18 = 0x00313918;
803 uint32_t test_b18_enc = srix4kEncode(test_b18);
804 //uint32_t test_b18_dec = srix4kDecode(test_b18_enc);
805 PrintAndLog("ENCODE & CHECKSUM | %08X -> %08X (%s)", test_b18, test_b18_enc , "");
806
807 uint32_t magic = srix4kGetMagicbytes(uid, block6, block18, block19);
808 PrintAndLog("BLOCK 21 | %08X -> %08X (no XOR)", block21, magic ^ block21);
809 return 0;
810 }
811
812 int CmdteaSelfTest(const char *Cmd){
813
814 uint8_t v[8], v_le[8];
815 memset(v, 0x00, sizeof(v));
816 memset(v_le, 0x00, sizeof(v_le));
817 uint8_t* v_ptr = v_le;
818
819 uint8_t cmdlen = strlen(Cmd);
820 cmdlen = ( sizeof(v)<<2 < cmdlen ) ? sizeof(v)<<2 : cmdlen;
821
822 if ( param_gethex(Cmd, 0, v, cmdlen) > 0 ){
823 PrintAndLog("can't read hex chars, uneven? :: %u", cmdlen);
824 return 1;
825 }
826
827 SwapEndian64ex(v , 8, 4, v_ptr);
828
829 // ENCRYPTION KEY:
830 uint8_t key[16] = {0x55,0xFE,0xF6,0x30,0x62,0xBF,0x0B,0xC1,0xC9,0xB3,0x7C,0x34,0x97,0x3E,0x29,0xFB };
831 uint8_t keyle[16];
832 uint8_t* key_ptr = keyle;
833 SwapEndian64ex(key , sizeof(key), 4, key_ptr);
834
835 PrintAndLog("TEST LE enc| %s", sprint_hex(v_ptr, 8));
836
837 tea_decrypt(v_ptr, key_ptr);
838 PrintAndLog("TEST LE dec | %s", sprint_hex_ascii(v_ptr, 8));
839
840 tea_encrypt(v_ptr, key_ptr);
841 tea_encrypt(v_ptr, key_ptr);
842 PrintAndLog("TEST enc2 | %s", sprint_hex_ascii(v_ptr, 8));
843
844 return 0;
845 }
846
847 bool waitCmd(bool verbose) {
848
849 bool crc = FALSE;
850 uint8_t b1 = 0, b2 = 0;
851 uint8_t data[USB_CMD_DATA_SIZE] = {0x00};
852 uint8_t status = 0;
853 uint16_t len = 0;
854 UsbCommand resp;
855
856 if (WaitForResponseTimeout(CMD_ACK, &resp, TIMEOUT)) {
857
858 status = (resp.arg[0] & 0xFF);
859 if ( status > 0 ) return FALSE;
860
861 len = (resp.arg[1] & 0xFFFF);
862
863 memcpy(data, resp.d.asBytes, len);
864
865 if (verbose) {
866 if ( len >= 3 ) {
867 ComputeCrc14443(CRC_14443_B, data, len-2, &b1, &b2);
868 crc = ( data[len-2] == b1 && data[len-1] == b2);
869
870 PrintAndLog("[LEN %u] %s[%02X %02X] %s",
871 len,
872 sprint_hex(data, len-2),
873 data[len-2],
874 data[len-1],
875 (crc) ? "OK" : "FAIL"
876 );
877 } else {
878 PrintAndLog("[LEN %u] %s", len, sprint_hex(data, len) );
879 }
880 }
881 return TRUE;
882 } else {
883 PrintAndLog("timeout while waiting for reply.");
884 return FALSE;
885 }
886 }
887
888 static command_t CommandTable[] = {
889 {"help", CmdHelp, 1, "This help"},
890 {"info", CmdHF14Binfo, 0, "Find and print details about a 14443B tag"},
891 {"list", CmdHF14BList, 0, "[Deprecated] List ISO 14443B history"},
892 {"raw", CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},
893 {"reader", CmdHF14BReader, 0, "Act as a 14443B reader to identify a tag"},
894 {"sim", CmdHF14BSim, 0, "Fake ISO 14443B tag"},
895 {"snoop", CmdHF14BSnoop, 0, "Eavesdrop ISO 14443B"},
896 {"sriread", CmdHF14BReadSri, 0, "Read contents of a SRI512 | SRIX4K tag"},
897 {"sriwrite", CmdHF14BWriteSri, 0, "Write data to a SRI512 | SRIX4K tag"},
898 //{"valid", srix4kValid, 1, "srix4k checksum test"},
899 //{"valid", CmdteaSelfTest, 1, "tea test"},
900 {NULL, NULL, 0, NULL}
901 };
902
903 int CmdHF14B(const char *Cmd) {
904 clearCommandBuffer();
905 CmdsParse(CommandTable, Cmd);
906 return 0;
907 }
908
909 int CmdHelp(const char *Cmd) {
910 CmdsHelp(CommandTable);
911 return 0;
912 }
Impressum, Datenschutz