git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf14b.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // High frequency ISO14443B commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <stdlib.h>
  13 #include <stdbool.h>
  14 #include <string.h>
  15 #include <stdint.h>
  16 #include "iso14443crc.h"
  17 #include "proxmark3.h"
  18 #include "data.h"
  19 #include "graph.h"
  20 #include "util.h"
  21 #include "ui.h"
  22 #include "cmdparser.h"
  23 #include "cmdhf14b.h"
  24 #include "cmdmain.h"
  25 #include "cmdhf14a.h"
  26
  27 static int CmdHelp(const char *Cmd);
  28
  29 int CmdHF14BList(const char *Cmd)
  30 {
  31         PrintAndLog("Deprecated command, use 'hf list 14b' instead");
  32
  33         return 0;
  34 }
  35
  36 int CmdHF14BSim(const char *Cmd)
  37 {
  38         UsbCommand c={CMD_SIMULATE_TAG_ISO_14443B};
  39         clearCommandBuffer();
  40         SendCommand(&c);
  41         return 0;
  42 }
  43
  44 int CmdHF14BSnoop(const char *Cmd)
  45 {
  46         UsbCommand c = {CMD_SNOOP_ISO_14443B};
  47         clearCommandBuffer();
  48         SendCommand(&c);
  49         return 0;
  50 }
  51
  52 /* New command to read the contents of a SRI512 tag
  53  * SRI512 tags are ISO14443-B modulated memory tags,
  54  * this command just dumps the contents of the memory
  55  */
  56 int CmdSri512Read(const char *Cmd)
  57 {
  58         UsbCommand c = {CMD_READ_SRI512_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
  59         clearCommandBuffer();
  60         SendCommand(&c);
  61         return 0;
  62 }
  63
  64 /* New command to read the contents of a SRIX4K tag
  65  * SRIX4K tags are ISO14443-B modulated memory tags,
  66  * this command just dumps the contents of the memory/
  67  */
  68 int CmdSrix4kRead(const char *Cmd)
  69 {
  70         UsbCommand c = {CMD_READ_SRIX4K_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
  71         clearCommandBuffer();
  72         SendCommand(&c);
  73         return 0;
  74 }
  75
  76 int rawClose(void){
  77         UsbCommand resp;
  78         UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}};
  79         clearCommandBuffer();
  80         SendCommand(&c);
  81         if (!WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
  82                 return 0;
  83         }
  84         return 0;
  85 }
  86
  87 int HF14BCmdRaw(bool reply, bool *crc, bool power, uint8_t *data, uint8_t *datalen, bool verbose){
  88         UsbCommand resp;
  89         UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; // len,recv,power
  90         if(*crc)
  91         {
  92                 uint8_t first, second;
  93                 ComputeCrc14443(CRC_14443_B, data, *datalen, &first, &second);
  94                 data[*datalen] = first;
  95                 data[*datalen + 1] = second;
  96                 *datalen += 2;
  97         }
  98
  99         c.arg[0] = *datalen;
 100         c.arg[1] = reply;
 101         c.arg[2] = power;
 102         memcpy(c.d.asBytes,data,*datalen);
 103         clearCommandBuffer();
 104         SendCommand(&c);
 105
 106         if (!reply) return 1;
 107
 108         if (!WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
 109                 if (verbose) PrintAndLog("timeout while waiting for reply.");
 110                         return 0;
 111                 }
 112                 *datalen = resp.arg[0];
 113                 if (verbose) PrintAndLog("received %u octets", *datalen);
 114                 if(*datalen<2) return 0;
 115
 116                 memcpy(data, resp.d.asBytes, *datalen);
 117                 if (verbose) PrintAndLog("%s", sprint_hex(data, *datalen));
 118
 119                 uint8_t first, second;
 120                 ComputeCrc14443(CRC_14443_B, data, *datalen-2, &first, &second);
 121                 if(data[*datalen-2] == first && data[*datalen-1] == second) {
 122                         if (verbose) PrintAndLog("CRC OK");
 123                         *crc = true;
 124                 } else {
 125                         if (verbose) PrintAndLog("CRC failed");
 126                         *crc = false;
 127                 }
 128         return 1;
 129 }
 130
 131 int CmdHF14BCmdRaw (const char *Cmd) {
 132     bool reply = true;
 133     bool crc = false;
 134         bool power = false;
 135     char buf[5]="";
 136     uint8_t data[100] = {0x00};
 137     uint8_t datalen = 0;
 138     unsigned int temp;
 139     int i = 0;
 140     if (strlen(Cmd)<3) {
 141         PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] <0A 0B 0C ... hex>");
 142         PrintAndLog("       -r    do not read response");
 143         PrintAndLog("       -c    calculate and append CRC");
 144         PrintAndLog("       -p    leave the field on after receive");
 145         return 0;
 146     }
 147
 148     // strip
 149     while (*Cmd==' ' || *Cmd=='\t') Cmd++;
 150
 151     while (Cmd[i]!='\0') {
 152         if (Cmd[i]==' ' || Cmd[i]=='\t') { i++; continue; }
 153         if (Cmd[i]=='-') {
 154             switch (Cmd[i+1]) {
 155                 case 'r':
 156                 case 'R':
 157                     reply = false;
 158                     break;
 159                 case 'c':
 160                 case 'C':
 161                     crc = true;
 162                     break;
 163                 case 'p':
 164                 case 'P':
 165                                         power = true;
 166                     break;
 167                 default:
 168                     PrintAndLog("Invalid option");
 169                     return 0;
 170             }
 171             i+=2;
 172             continue;
 173         }
 174         if ((Cmd[i]>='0' && Cmd[i]<='9') ||
 175             (Cmd[i]>='a' && Cmd[i]<='f') ||
 176             (Cmd[i]>='A' && Cmd[i]<='F') ) {
 177             buf[strlen(buf)+1]=0;
 178             buf[strlen(buf)]=Cmd[i];
 179             i++;
 180
 181             if (strlen(buf)>=2) {
 182                 sscanf(buf,"%x",&temp);
 183                 data[datalen++]=(uint8_t)(temp & 0xff);
 184                 *buf=0;
 185             }
 186             continue;
 187         }
 188         PrintAndLog("Invalid char on input");
 189         return 1;
 190     }
 191     if (datalen == 0)
 192     {
 193       PrintAndLog("Missing data input");
 194       return 0;
 195     }
 196
 197         return HF14BCmdRaw(reply, &crc, power, data, &datalen, true);
 198 }
 199
 200 static void print_atqb_resp(uint8_t *data){
 201         PrintAndLog ("           UID: %s", sprint_hex(data+1,4));
 202         PrintAndLog ("      App Data: %s", sprint_hex(data+5,4));
 203         PrintAndLog ("      Protocol: %s", sprint_hex(data+9,3));
 204         uint8_t BitRate = data[9];
 205         if (!BitRate) PrintAndLog ("      Bit Rate: 106 kbit/s only PICC <-> PCD");
 206         if (BitRate & 0x10)     PrintAndLog ("      Bit Rate: 212 kbit/s PICC -> PCD supported");
 207         if (BitRate & 0x20)     PrintAndLog ("      Bit Rate: 424 kbit/s PICC -> PCD supported");
 208         if (BitRate & 0x40)     PrintAndLog ("      Bit Rate: 847 kbit/s PICC -> PCD supported");
 209         if (BitRate & 0x01)     PrintAndLog ("      Bit Rate: 212 kbit/s PICC <- PCD supported");
 210         if (BitRate & 0x02)     PrintAndLog ("      Bit Rate: 424 kbit/s PICC <- PCD supported");
 211         if (BitRate & 0x04)     PrintAndLog ("      Bit Rate: 847 kbit/s PICC <- PCD supported");
 212         if (BitRate & 0x80)     PrintAndLog ("                Same bit rate <-> required");
 213
 214         uint16_t maxFrame = data[10]>>4;
 215         if (maxFrame < 5)               maxFrame = 8 * maxFrame + 16;
 216         else if (maxFrame == 5) maxFrame = 64;
 217         else if (maxFrame == 6) maxFrame = 96;
 218         else if (maxFrame == 7) maxFrame = 128;
 219         else if (maxFrame == 8) maxFrame = 256;
 220         else maxFrame = 257;
 221
 222         PrintAndLog ("Max Frame Size: %d%s", maxFrame, (maxFrame == 257) ? "+ RFU" : "");
 223
 224         uint8_t protocolT = data[10] & 0xF;
 225         PrintAndLog (" Protocol Type: Protocol is %scompliant with ISO/IEC 14443-4",(protocolT) ? "" : "not " );
 226         PrintAndLog ("Frame Wait Int: %d", data[11]>>4);
 227         PrintAndLog (" App Data Code: Application is %s",(data[11]&4) ? "Standard" : "Proprietary");
 228         PrintAndLog (" Frame Options: NAD is %ssupported",(data[11]&2) ? "" : "not ");
 229         PrintAndLog (" Frame Options: CID is %ssupported",(data[11]&1) ? "" : "not ");
 230
 231         return;
 232 }
 233
 234 char *get_ST_Chip_Model(uint8_t data){
 235         static char model[20];
 236         char *retStr = model;
 237         memset(model,0, sizeof(model));
 238
 239         switch (data) {
 240                 case 0x0: sprintf(retStr, "SRIX4K (Special)"); break;
 241                 case 0x2: sprintf(retStr, "SR176"); break;
 242                 case 0x3: sprintf(retStr, "SRIX4K"); break;
 243                 case 0x4: sprintf(retStr, "SRIX512"); break;
 244                 case 0x6: sprintf(retStr, "SRI512"); break;
 245                 case 0x7: sprintf(retStr, "SRI4K"); break;
 246                 case 0xC: sprintf(retStr, "SRT512"); break;
 247                 default: sprintf(retStr, "Unknown"); break;
 248         }
 249         return retStr;
 250 }
 251
 252 static void print_st_info(uint8_t *data){
 253         //uid = first 8 bytes in data
 254         PrintAndLog(" UID: %s", sprint_hex(SwapEndian64(data,8,8),8));
 255         PrintAndLog(" MFG: %02X, %s", data[6], getTagInfo(data[6]));
 256         PrintAndLog("Chip: %02X, %s", data[5]>>2, get_ST_Chip_Model(data[5]>>2));
 257         return;
 258 }
 259
 260 int HF14BStdReader(uint8_t *data, uint8_t *datalen){
 261
 262         //05 00 00 = find one tag in field
 263         //1d xx xx xx xx 20 00 08 01 00 = attrib xx=crc
 264         //a3 = ?  (resp 03 e2 c2)
 265         //02 = ?  (resp 02 6a d3)
 266         // 022b (resp 02 67 00 [29  5b])
 267         // 0200a40400 (resp 02 67 00 [29 5b])
 268         // 0200a4040c07a0000002480300 (resp 02 67 00 [29 5b])
 269         // 0200a4040c07a0000002480200 (resp 02 67 00 [29 5b])
 270         // 0200a4040006a0000000010100 (resp 02 6a 82 [4b 4c])
 271         // 0200a4040c09d27600002545500200 (resp 02 67 00 [29 5b])
 272         // 0200a404000cd2760001354b414e4d30310000 (resp 02 6a 82 [4b 4c])
 273         // 0200a404000ca000000063504b43532d313500 (resp 02 6a 82 [4b 4c])
 274         // 0200a4040010a000000018300301000000000000000000 (resp 02 6a 82 [4b 4c])
 275         //03 = ?  (resp 03 [e3 c2])
 276         //c2 = ?  (resp c2 [66 15])
 277         //b2 = ?  (resp a3 [e9 67])
 278         bool crc = true;
 279         *datalen = 3;
 280         //std read cmd
 281         data[0] = 0x05;
 282         data[1] = 0x00;
 283         data[2] = 0x00;
 284
 285         if (HF14BCmdRaw(true, &crc, false, data, datalen, false)==0) return 0;
 286
 287         if (data[0] != 0x50  || *datalen != 14 || !crc) return 0;
 288
 289         PrintAndLog ("\n14443-3b tag found:");
 290         print_atqb_resp(data);
 291
 292         return 1;
 293         }
 294
 295 int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen){
 296         bool crc = true;
 297         *datalen = 2;
 298         //wake cmd
 299         data[0] = 0x06;
 300         data[1] = 0x00;
 301
 302         //leave power on
 303         // verbose on for now for testing - turn off when functional
 304         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 305
 306         if (*datalen != 3 || !crc) return rawClose();
 307
 308         uint8_t chipID = data[0];
 309         // select
 310         data[0] = 0x0E;
 311         data[1] = chipID;
 312         *datalen = 2;
 313
 314         //leave power on
 315         // verbose on for now for testing - turn off when functional
 316         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 317
 318         if (*datalen != 3 || !crc || data[0] != chipID) return rawClose();
 319
 320         // get uid
 321         data[0] = 0x0B;
 322         *datalen = 1;
 323
 324         //power off
 325         // verbose on for now for testing - turn off when functional
 326         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return 0;
 327         rawClose();
 328         if (*datalen != 10 || !crc) return 0;
 329
 330         PrintAndLog("\n14443-3b ST tag found:");
 331         print_st_info(data);
 332         return 1;
 333 }
 334
 335 // test for other 14b type tags (mimic another reader - don't have tags to identify)
 336 int HF14B_Other_Reader(uint8_t *data, uint8_t *datalen){
 337         bool crc = true;
 338         *datalen = 4;
 339         //std read cmd
 340         data[0] = 0x00;
 341         data[1] = 0x0b;
 342         data[2] = 0x3f;
 343         data[3] = 0x80;
 344
 345         if (HF14BCmdRaw(true, &crc, false, data, datalen, false)!=0) {
 346                 if (*datalen > 2 || !crc) {
 347                         PrintAndLog ("\n14443-3b tag found:");
 348                         PrintAndLog ("Unknown tag type answered to a 0x000b3f80 command ans:");
 349                         PrintAndLog ("%s",sprint_hex(data,*datalen));
 350                         return 1;
 351                 }
 352         }
 353
 354         crc = false;
 355         *datalen = 1;
 356         data[0] = 0x0a;
 357
 358         if (HF14BCmdRaw(true, &crc, false, data, datalen, false)!=0) {
 359                 if (*datalen > 0) {
 360                         PrintAndLog ("\n14443-3b tag found:");
 361                         PrintAndLog ("Unknown tag type answered to a 0x0A command ans:");
 362                         PrintAndLog ("%s",sprint_hex(data,*datalen));
 363                         return 1;
 364                 }
 365         }
 366
 367         crc = false;
 368         *datalen = 1;
 369         data[0] = 0x0c;
 370
 371         if (HF14BCmdRaw(true, &crc, false, data, datalen, false)!=0) {
 372                 if (*datalen > 0) {
 373                         PrintAndLog ("\n14443-3b tag found:");
 374                         PrintAndLog ("Unknown tag type answered to a 0x0C command ans:");
 375                         PrintAndLog ("%s",sprint_hex(data,*datalen));
 376                         return 1;
 377                 }
 378         }
 379
 380         return 0;
 381
 382 }
 383
 384 int HF14BReader(bool verbose){
 385         uint8_t data[100];
 386         uint8_t datalen = 5;
 387
 388         // try std 14b (atqb)
 389         if (HF14BStdReader(data, &datalen)) return 1;
 390
 391         // try st 14b
 392         if (HF14B_ST_Reader(data, &datalen)) return 1;
 393
 394         // try unknown 14b read commands (to be identified later)
 395         //   could be read of calypso, CEPAS, moneo, or pico pass.
 396         if (HF14B_Other_Reader(data, &datalen)) return 1;
 397
 398         if (verbose) PrintAndLog("no 14443B tag found");
 399         return 0;
 400 }
 401
 402 int CmdHF14BReader(const char *Cmd){
 403         return HF14BReader(true);
 404 }
 405
 406 int CmdHF14BWrite( const char *Cmd){
 407 /*
 408  * For SRIX4K  blocks 00 - 7F
 409  * hf 14b raw -c -p 09 $srix4kwblock $srix4kwdata
 410  *
 411  * For SR512  blocks 00 - 0F
 412  * hf 14b raw -c -p 09 $sr512wblock $sr512wdata
 413  *
 414  * Special block FF =  otp_lock_reg block.
 415  * Data len 4 bytes-
 416  */
 417         char cmdp = param_getchar(Cmd, 0);
 418         uint8_t blockno = -1;
 419         uint8_t data[4] = {0x00};
 420         bool isSrix4k = true;
 421         char str[20];
 422
 423         if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') {
 424                 PrintAndLog("Usage:  hf 14b write <1|2> <BLOCK> <DATA>");
 425                 PrintAndLog("    [1 = SRIX4K]");
 426                 PrintAndLog("    [2 = SRI512]");
 427                 PrintAndLog("    [BLOCK number depends on tag, special block == FF]");
 428                 PrintAndLog("     sample: hf 14b write 1 7F 11223344");
 429                 PrintAndLog("           : hf 14b write 1 FF 11223344");
 430                 PrintAndLog("           : hf 14b write 2 15 11223344");
 431                 PrintAndLog("           : hf 14b write 2 FF 11223344");
 432                 return 0;
 433         }
 434
 435         if ( cmdp == '2' )
 436                 isSrix4k = false;
 437
 438         //blockno = param_get8(Cmd, 1);
 439
 440         if ( param_gethex(Cmd,1, &blockno, 2) ) {
 441                 PrintAndLog("Block number must include 2 HEX symbols");
 442                 return 0;
 443         }
 444
 445         if ( isSrix4k ){
 446                 if ( blockno > 0x7f && blockno != 0xff ){
 447                         PrintAndLog("Block number out of range");
 448                         return 0;
 449                 }
 450         } else {
 451                 if ( blockno > 0x0f && blockno != 0xff ){
 452                         PrintAndLog("Block number out of range");
 453                         return 0;
 454                 }
 455         }
 456
 457         if (param_gethex(Cmd, 2, data, 8)) {
 458                 PrintAndLog("Data must include 8 HEX symbols");
 459                 return 0;
 460         }
 461
 462         if ( blockno == 0xff)
 463                 PrintAndLog("[%s] Write special block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512" , blockno,  sprint_hex(data,4) );
 464         else
 465                 PrintAndLog("[%s] Write block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512", blockno,  sprint_hex(data,4) );
 466
 467         sprintf(str, "-c 09 %02x %02x%02x%02x%02x", blockno, data[0], data[1], data[2], data[3]);
 468
 469         CmdHF14BCmdRaw(str);
 470         return 0;
 471 }
 472
 473 static command_t CommandTable[] =
 474 {
 475         {"help",        CmdHelp,        1, "This help"},
 476         {"list",        CmdHF14BList,   0, "[Deprecated] List ISO 14443b history"},
 477         {"reader",      CmdHF14BReader, 0, "Find 14b tag (HF ISO 14443b)"},
 478         {"sim",         CmdHF14BSim,     0, "Fake ISO 14443B tag"},
 479
 480         {"snoop",       CmdHF14BSnoop,  0, "Eavesdrop ISO 14443B"},
 481         {"sri512read",  CmdSri512Read,  0, "Read contents of a SRI512 tag"},
 482         {"srix4kread",  CmdSrix4kRead,  0, "Read contents of a SRIX4K tag"},
 483         {"raw",         CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},
 484         {"write",       CmdHF14BWrite,  0, "Write data to a SRI512 | SRIX4K tag"},
 485         {NULL, NULL, 0, NULL}
 486 };
 487
 488 int CmdHF14B(const char *Cmd)
 489 {
 490         CmdsParse(CommandTable, Cmd);
 491         return 0;
 492 }
 493
 494 int CmdHelp(const char *Cmd)
 495 {
 496         CmdsHelp(CommandTable);
 497         return 0;
 498 }