git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf14b.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // High frequency ISO14443B commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <stdlib.h>
  13 #include <stdbool.h>
  14 #include <string.h>
  15 #include <stdint.h>
  16 #include "iso14443crc.h"
  17 #include "proxmark3.h"
  18 #include "data.h"
  19 #include "graph.h"
  20 #include "util.h"
  21 #include "ui.h"
  22 #include "cmdparser.h"
  23 #include "cmdhf14b.h"
  24 #include "cmdmain.h"
  25 #include "cmdhf14a.h"
  26
  27 static int CmdHelp(const char *Cmd);
  28
  29 int CmdHF14BList(const char *Cmd)
  30 {
  31         PrintAndLog("Deprecated command, use 'hf list 14b' instead");
  32
  33         return 0;
  34 }
  35
  36 int CmdHF14BSim(const char *Cmd)
  37 {
  38   UsbCommand c={CMD_SIMULATE_TAG_ISO_14443B};
  39   clearCommandBuffer();
  40   SendCommand(&c);
  41   return 0;
  42 }
  43
  44 int CmdHF14BSnoop(const char *Cmd)
  45 {
  46   UsbCommand c = {CMD_SNOOP_ISO_14443B};
  47   clearCommandBuffer();
  48   SendCommand(&c);
  49   return 0;
  50 }
  51
  52 /* New command to read the contents of a SRI512 tag
  53  * SRI512 tags are ISO14443-B modulated memory tags,
  54  * this command just dumps the contents of the memory
  55  */
  56 int CmdSri512Read(const char *Cmd)
  57 {
  58   UsbCommand c = {CMD_READ_SRI512_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
  59   clearCommandBuffer();
  60   SendCommand(&c);
  61   return 0;
  62 }
  63
  64 /* New command to read the contents of a SRIX4K tag
  65  * SRIX4K tags are ISO14443-B modulated memory tags,
  66  * this command just dumps the contents of the memory/
  67  */
  68 int CmdSrix4kRead(const char *Cmd)
  69 {
  70   UsbCommand c = {CMD_READ_SRIX4K_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
  71   clearCommandBuffer();
  72   SendCommand(&c);
  73   return 0;
  74 }
  75
  76 int rawClose(void){
  77         UsbCommand resp;
  78         UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}};
  79         clearCommandBuffer();
  80         SendCommand(&c);
  81         if (!WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
  82                 return 0;
  83         }
  84         return 0;
  85 }
  86
  87 int HF14BCmdRaw(bool reply, bool *crc, bool power, uint8_t *data, uint8_t *datalen, bool verbose){
  88         UsbCommand resp;
  89         UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; // len,recv,power
  90         if(*crc)
  91         {
  92                 uint8_t first, second;
  93                 ComputeCrc14443(CRC_14443_B, data, *datalen, &first, &second);
  94                 data[*datalen] = first;
  95                 data[*datalen + 1] = second;
  96                 *datalen += 2;
  97         }
  98
  99         c.arg[0] = *datalen;
 100         c.arg[1] = reply;
 101         c.arg[2] = power;
 102         memcpy(c.d.asBytes,data,*datalen);
 103         clearCommandBuffer();
 104         SendCommand(&c);
 105
 106         if (!reply) return 1;
 107
 108         if (!WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
 109                 if (verbose) PrintAndLog("timeout while waiting for reply.");
 110                 return 0;
 111         }
 112         *datalen = resp.arg[0];
 113         if (verbose) PrintAndLog("received %u octets", *datalen);
 114         if(*datalen<2) return 0;
 115
 116         memcpy(data, resp.d.asBytes, *datalen);
 117         if (verbose) PrintAndLog("%s", sprint_hex(data, *datalen));
 118
 119         uint8_t first, second;
 120         ComputeCrc14443(CRC_14443_B, data, *datalen-2, &first, &second);
 121         if(data[*datalen-2] == first && data[*datalen-1] == second) {
 122                 if (verbose) PrintAndLog("CRC OK");
 123                 *crc = true;
 124         } else {
 125                 if (verbose) PrintAndLog("CRC failed");
 126                 *crc = false;
 127         }
 128         return 1;
 129 }
 130
 131 int CmdHF14BCmdRaw (const char *Cmd) {
 132         bool reply = true;
 133         bool crc = false;
 134         bool power = false;
 135         char buf[5] = "";
 136         uint8_t data[100] = {0x00};
 137         uint8_t datalen = 0;
 138         unsigned int temp;
 139         int i = 0;
 140         if (strlen(Cmd)<3) {
 141                         PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] <0A 0B 0C ... hex>");
 142                         PrintAndLog("       -r    do not read response");
 143                         PrintAndLog("       -c    calculate and append CRC");
 144                         PrintAndLog("       -p    leave the field on after receive");
 145                         return 0;
 146         }
 147
 148         // strip
 149         while (*Cmd==' ' || *Cmd=='\t') Cmd++;
 150
 151         while (Cmd[i]!='\0') {
 152                 if (Cmd[i]==' ' || Cmd[i]=='\t') { i++; continue; }
 153                 if (Cmd[i]=='-') {
 154                         switch (Cmd[i+1]) {
 155                                 case 'r':
 156                                 case 'R':
 157                                         reply = false;
 158                                         break;
 159                                 case 'c':
 160                                 case 'C':
 161                                         crc = true;
 162                                         break;
 163                                 case 'p':
 164                                 case 'P':
 165                                         power = true;
 166                                         break;
 167                                 default:
 168                                         PrintAndLog("Invalid option");
 169                                         return 0;
 170                         }
 171                         i+=2;
 172                         continue;
 173                 }
 174                 if ((Cmd[i]>='0' && Cmd[i]<='9') ||
 175                     (Cmd[i]>='a' && Cmd[i]<='f') ||
 176                     (Cmd[i]>='A' && Cmd[i]<='F') ) {
 177                         buf[strlen(buf)+1]=0;
 178                         buf[strlen(buf)]=Cmd[i];
 179                         i++;
 180
 181                         if (strlen(buf)>=2) {
 182                                 sscanf(buf,"%x",&temp);
 183                                 data[datalen++]=(uint8_t)(temp & 0xff);
 184                                 *buf=0;
 185                         }
 186                         continue;
 187                 }
 188                 PrintAndLog("Invalid char on input");
 189                 return 1;
 190         }
 191         if (datalen == 0)
 192         {
 193                 PrintAndLog("Missing data input");
 194                 return 0;
 195         }
 196
 197         return HF14BCmdRaw(reply, &crc, power, data, &datalen, true);
 198 }
 199
 200 static void print_atqb_resp(uint8_t *data){
 201         PrintAndLog ("           UID: %s", sprint_hex(data+1,4));
 202         PrintAndLog ("      App Data: %s", sprint_hex(data+5,4));
 203         PrintAndLog ("      Protocol: %s", sprint_hex(data+9,3));
 204         uint8_t BitRate = data[9];
 205         if (!BitRate)
 206                 PrintAndLog ("      Bit Rate: 106 kbit/s only PICC <-> PCD");
 207         if (BitRate & 0x10)
 208                 PrintAndLog ("      Bit Rate: 212 kbit/s PICC -> PCD supported");
 209         if (BitRate & 0x20)
 210                 PrintAndLog ("      Bit Rate: 424 kbit/s PICC -> PCD supported");
 211         if (BitRate & 0x40)
 212                 PrintAndLog ("      Bit Rate: 847 kbit/s PICC -> PCD supported");
 213         if (BitRate & 0x01)
 214                 PrintAndLog ("      Bit Rate: 212 kbit/s PICC <- PCD supported");
 215         if (BitRate & 0x02)
 216                 PrintAndLog ("      Bit Rate: 424 kbit/s PICC <- PCD supported");
 217         if (BitRate & 0x04)
 218                 PrintAndLog ("      Bit Rate: 847 kbit/s PICC <- PCD supported");
 219         if (BitRate & 0x80)
 220                 PrintAndLog ("                Same bit rate <-> required");
 221
 222         uint16_t maxFrame = data[10]>>4;
 223         if (maxFrame < 5)
 224                 maxFrame = 8*maxFrame + 16;
 225         else if (maxFrame == 5)
 226                 maxFrame = 64;
 227         else if (maxFrame == 6)
 228                 maxFrame = 96;
 229         else if (maxFrame == 7)
 230                 maxFrame = 128;
 231         else if (maxFrame == 8)
 232                 maxFrame = 256;
 233         else
 234                 maxFrame = 257;
 235
 236         PrintAndLog ("Max Frame Size: %d%s",maxFrame, (maxFrame == 257) ? "+ RFU" : "");
 237
 238         uint8_t protocolT = data[10] & 0xF;
 239         PrintAndLog (" Protocol Type: Protocol is %scompliant with ISO/IEC 14443-4",(protocolT) ? "" : "not " );
 240         PrintAndLog ("Frame Wait Int: %d", data[11]>>4);
 241         PrintAndLog (" App Data Code: Application is %s",(data[11]&4) ? "Standard" : "Proprietary");
 242         PrintAndLog (" Frame Options: NAD is %ssupported",(data[11]&2) ? "" : "not ");
 243         PrintAndLog (" Frame Options: CID is %ssupported",(data[11]&1) ? "" : "not ");
 244
 245         return;
 246 }
 247
 248 char *get_ST_Chip_Model(uint8_t data){
 249         static char model[20];
 250         char *retStr = model;
 251         memset(model,0, sizeof(model));
 252
 253         switch (data) {
 254                 case 0x0: sprintf(retStr, "SRIX4K (Special)"); break;
 255                 case 0x2: sprintf(retStr, "SR176"); break;
 256                 case 0x3: sprintf(retStr, "SRIX4K"); break;
 257                 case 0x4: sprintf(retStr, "SRIX512"); break;
 258                 case 0x6: sprintf(retStr, "SRI512"); break;
 259                 case 0x7: sprintf(retStr, "SRI4K"); break;
 260                 case 0xC: sprintf(retStr, "SRT512"); break;
 261                 default : sprintf(retStr, "Unknown"); break;
 262         }
 263         return retStr;
 264 }
 265
 266 static void print_st_info(uint8_t *data){
 267         //uid = first 8 bytes in data
 268         PrintAndLog(" UID: %s", sprint_hex(SwapEndian64(data,8,8),8));
 269         PrintAndLog(" MFG: %02X, %s", data[6], getTagInfo(data[6]));
 270         PrintAndLog("Chip: %02X, %s", data[5]>>2, get_ST_Chip_Model(data[5]>>2));
 271         return;
 272 }
 273
 274 int HF14BStdInfo(uint8_t *data, uint8_t *datalen){
 275
 276         //05 00 00 = find one tag in field
 277         //1d xx xx xx xx 20 00 08 01 00 = attrib xx=crc
 278         //a3 = ?  (resp 03 e2 c2)
 279         //02 = ?  (resp 02 6a d3)
 280         // 022b (resp 02 67 00 [29  5b])
 281         // 0200a40400 (resp 02 67 00 [29 5b])
 282         // 0200a4040c07a0000002480300 (resp 02 67 00 [29 5b])
 283         // 0200a4040c07a0000002480200 (resp 02 67 00 [29 5b])
 284         // 0200a4040006a0000000010100 (resp 02 6a 82 [4b 4c])
 285         // 0200a4040c09d27600002545500200 (resp 02 67 00 [29 5b])
 286         // 0200a404000cd2760001354b414e4d30310000 (resp 02 6a 82 [4b 4c])
 287         // 0200a404000ca000000063504b43532d313500 (resp 02 6a 82 [4b 4c])
 288         // 0200a4040010a000000018300301000000000000000000 (resp 02 6a 82 [4b 4c])
 289         //03 = ?  (resp 03 [e3 c2])
 290         //c2 = ?  (resp c2 [66 15])
 291         //b2 = ?  (resp a3 [e9 67])
 292         bool crc = true;
 293         *datalen = 3;
 294         //std read cmd
 295         data[0] = 0x05;
 296         data[1] = 0x00;
 297         data[2] = 0x00;
 298
 299         if (HF14BCmdRaw(true, &crc, false, data, datalen, false)==0) return 0;
 300
 301         if (data[0] != 0x50  || *datalen != 14 || !crc) return 0;
 302
 303         PrintAndLog ("\n14443-3b tag found:");
 304         print_atqb_resp(data);
 305
 306         return 1;
 307 }
 308
 309 int HF14B_ST_Info(uint8_t *data, uint8_t *datalen){
 310         bool crc = true;
 311         *datalen = 2;
 312         //wake cmd
 313         data[0] = 0x06;
 314         data[1] = 0x00;
 315
 316         //leave power on
 317         // verbose on for now for testing - turn off when functional
 318         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 319
 320         if (*datalen != 3 || !crc) return rawClose();
 321
 322         uint8_t chipID = data[0];
 323         // select
 324         data[0] = 0x0E;
 325         data[1] = chipID;
 326         *datalen = 2;
 327
 328         //leave power on
 329         // verbose on for now for testing - turn off when functional
 330         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 331
 332         if (*datalen != 3 || !crc || data[0] != chipID) return rawClose();
 333
 334         // get uid
 335         data[0] = 0x0B;
 336         *datalen = 1;
 337
 338         //power off
 339         // verbose on for now for testing - turn off when functional
 340         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return 0;
 341         rawClose();
 342         if (*datalen != 10 || !crc) return 0;
 343
 344         PrintAndLog("\n14443-3b ST tag found:");
 345         print_st_info(data);
 346         return 1;
 347 }
 348
 349 // test for other 14b type tags (mimic another reader - don't have tags to identify)
 350 int HF14B_Other_Info(uint8_t *data, uint8_t *datalen){
 351         bool crc = true;
 352         *datalen = 4;
 353         //std read cmd
 354         data[0] = 0x00;
 355         data[1] = 0x0b;
 356         data[2] = 0x3f;
 357         data[3] = 0x80;
 358
 359         if (HF14BCmdRaw(true, &crc, false, data, datalen, false)!=0) {
 360                 if (*datalen > 2 || !crc) {
 361                         PrintAndLog ("\n14443-3b tag found:");
 362                         PrintAndLog ("Unknown tag type answered to a 0x000b3f80 command ans:");
 363                         PrintAndLog ("%s",sprint_hex(data,*datalen));
 364                         return 1;
 365                 }
 366         }
 367
 368         crc = false;
 369         *datalen = 1;
 370         data[0] = 0x0a;
 371
 372         if (HF14BCmdRaw(true, &crc, false, data, datalen, false)!=0) {
 373                 if (*datalen > 0) {
 374                         PrintAndLog ("\n14443-3b tag found:");
 375                         PrintAndLog ("Unknown tag type answered to a 0x0A command ans:");
 376                         PrintAndLog ("%s",sprint_hex(data,*datalen));
 377                         return 1;
 378                 }
 379         }
 380
 381         crc = false;
 382         *datalen = 1;
 383         data[0] = 0x0c;
 384
 385         if (HF14BCmdRaw(true, &crc, false, data, datalen, false)!=0) {
 386                 if (*datalen > 0) {
 387                         PrintAndLog ("\n14443-3b tag found:");
 388                         PrintAndLog ("Unknown tag type answered to a 0x0C command ans:");
 389                         PrintAndLog ("%s",sprint_hex(data,*datalen));
 390                         return 1;
 391                 }
 392         }
 393
 394         return 0;
 395
 396 }
 397
 398 int HF14BInfo(bool verbose){
 399         uint8_t data[100];
 400         uint8_t datalen = 5;
 401
 402         // try std 14b (atqb)
 403         if (HF14BStdInfo(data, &datalen)) return 1;
 404
 405         // try st 14b
 406         if (HF14B_ST_Info(data, &datalen)) return 1;
 407
 408         // try unknown 14b read commands (to be identified later)
 409         //   could be read of calypso, CEPAS, moneo, or pico pass.
 410         if (HF14B_Other_Info(data, &datalen)) return 1;
 411
 412         if (verbose) PrintAndLog("no 14443B tag found");
 413         return 0;
 414 }
 415
 416 int CmdHF14Binfo(const char *Cmd){
 417         return HF14BInfo(true);
 418 }
 419
 420 int CmdSriWrite( const char *Cmd){
 421 /*
 422  * For SRIX4K  blocks 00 - 7F
 423  * hf 14b raw -c -p 09 $srix4kwblock $srix4kwdata
 424  *
 425  * For SR512  blocks 00 - 0F
 426  * hf 14b raw -c -p 09 $sr512wblock $sr512wdata
 427  *
 428  * Special block FF =  otp_lock_reg block.
 429  * Data len 4 bytes-
 430  */
 431         char cmdp = param_getchar(Cmd, 0);
 432         uint8_t blockno = -1;
 433         uint8_t data[4] = {0x00};
 434         bool isSrix4k = true;
 435         char str[20];
 436
 437         if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') {
 438                 PrintAndLog("Usage:  hf 14b write <1|2> <BLOCK> <DATA>");
 439                 PrintAndLog("    [1 = SRIX4K]");
 440                 PrintAndLog("    [2 = SRI512]");
 441                 PrintAndLog("    [BLOCK number depends on tag, special block == FF]");
 442                 PrintAndLog("     sample: hf 14b write 1 7F 11223344");
 443                 PrintAndLog("           : hf 14b write 1 FF 11223344");
 444                 PrintAndLog("           : hf 14b write 2 15 11223344");
 445                 PrintAndLog("           : hf 14b write 2 FF 11223344");
 446                 return 0;
 447         }
 448
 449         if ( cmdp == '2' )
 450                 isSrix4k = false;
 451
 452         //blockno = param_get8(Cmd, 1);
 453
 454         if ( param_gethex(Cmd,1, &blockno, 2) ) {
 455                 PrintAndLog("Block number must include 2 HEX symbols");
 456                 return 0;
 457         }
 458
 459         if ( isSrix4k ){
 460                 if ( blockno > 0x7f && blockno != 0xff ){
 461                         PrintAndLog("Block number out of range");
 462                         return 0;
 463                 }
 464         } else {
 465                 if ( blockno > 0x0f && blockno != 0xff ){
 466                         PrintAndLog("Block number out of range");
 467                         return 0;
 468                 }
 469         }
 470
 471         if (param_gethex(Cmd, 2, data, 8)) {
 472                 PrintAndLog("Data must include 8 HEX symbols");
 473                 return 0;
 474         }
 475
 476         if ( blockno == 0xff)
 477                 PrintAndLog("[%s] Write special block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512" , blockno,  sprint_hex(data,4) );
 478         else
 479                 PrintAndLog("[%s] Write block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512", blockno,  sprint_hex(data,4) );
 480
 481         sprintf(str, "-c 09 %02x %02x%02x%02x%02x", blockno, data[0], data[1], data[2], data[3]);
 482
 483         CmdHF14BCmdRaw(str);
 484         return 0;
 485 }
 486
 487 static command_t CommandTable[] =
 488 {
 489   {"help",        CmdHelp,        1, "This help"},
 490         {"info",        CmdHF14Binfo,   0, "Find and print info about a 14b type tag (HF ISO 14443b)"},
 491   {"list",        CmdHF14BList,   0, "[Deprecated] List ISO 14443b history"},
 492   {"sim",         CmdHF14BSim,    0, "Fake ISO 14443B tag"},
 493   {"snoop",       CmdHF14BSnoop,  0, "Eavesdrop ISO 14443B"},
 494   {"sri512read",  CmdSri512Read,  0, "Read contents of a SRI512 tag"},
 495   {"srix4kread",  CmdSrix4kRead,  0, "Read contents of a SRIX4K tag"},
 496   {"sriwrite",    CmdSriWrite,    0, "Write data to a SRI512 | SRIX4K tag"},
 497   {"raw",         CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},
 498   {NULL, NULL, 0, NULL}
 499 };
 500
 501 int CmdHF14B(const char *Cmd)
 502 {
 503   CmdsParse(CommandTable, Cmd);
 504   return 0;
 505 }
 506
 507 int CmdHelp(const char *Cmd)
 508 {
 509   CmdsHelp(CommandTable);
 510   return 0;
 511 }