1 //-----------------------------------------------------------------------------
3 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
8 //-----------------------------------------------------------------------------
9 // High frequency ISO14443A commands
10 //-----------------------------------------------------------------------------
18 #include "util_posix.h"
19 #include "iso14443crc.h"
21 #include "proxmark3.h"
23 #include "cmdparser.h"
29 #include "mifarehost.h"
31 static int CmdHelp(const char *Cmd
);
32 static void waitCmd(uint8_t iLen
);
34 // structure and database for uid -> tagtype lookups
40 const manufactureName manufactureMapping
[] = {
41 // ID, "Vendor Country"
42 { 0x01, "Motorola UK" },
43 { 0x02, "ST Microelectronics SA France" },
44 { 0x03, "Hitachi, Ltd Japan" },
45 { 0x04, "NXP Semiconductors Germany" },
46 { 0x05, "Infineon Technologies AG Germany" },
47 { 0x06, "Cylink USA" },
48 { 0x07, "Texas Instrument France" },
49 { 0x08, "Fujitsu Limited Japan" },
50 { 0x09, "Matsushita Electronics Corporation, Semiconductor Company Japan" },
51 { 0x0A, "NEC Japan" },
52 { 0x0B, "Oki Electric Industry Co. Ltd Japan" },
53 { 0x0C, "Toshiba Corp. Japan" },
54 { 0x0D, "Mitsubishi Electric Corp. Japan" },
55 { 0x0E, "Samsung Electronics Co. Ltd Korea" },
56 { 0x0F, "Hynix / Hyundai, Korea" },
57 { 0x10, "LG-Semiconductors Co. Ltd Korea" },
58 { 0x11, "Emosyn-EM Microelectronics USA" },
59 { 0x12, "INSIDE Technology France" },
60 { 0x13, "ORGA Kartensysteme GmbH Germany" },
61 { 0x14, "SHARP Corporation Japan" },
62 { 0x15, "ATMEL France" },
63 { 0x16, "EM Microelectronic-Marin SA Switzerland" },
64 { 0x17, "KSW Microtec GmbH Germany" },
65 { 0x18, "ZMD AG Germany" },
66 { 0x19, "XICOR, Inc. USA" },
67 { 0x1A, "Sony Corporation Japan Identifier Company Country" },
68 { 0x1B, "Malaysia Microelectronic Solutions Sdn. Bhd Malaysia" },
69 { 0x1C, "Emosyn USA" },
70 { 0x1D, "Shanghai Fudan Microelectronics Co. Ltd. P.R. China" },
71 { 0x1E, "Magellan Technology Pty Limited Australia" },
72 { 0x1F, "Melexis NV BO Switzerland" },
73 { 0x20, "Renesas Technology Corp. Japan" },
74 { 0x21, "TAGSYS France" },
75 { 0x22, "Transcore USA" },
76 { 0x23, "Shanghai belling corp., ltd. China" },
77 { 0x24, "Masktech Germany Gmbh Germany" },
78 { 0x25, "Innovision Research and Technology Plc UK" },
79 { 0x26, "Hitachi ULSI Systems Co., Ltd. Japan" },
80 { 0x27, "Cypak AB Sweden" },
81 { 0x28, "Ricoh Japan" },
82 { 0x29, "ASK France" },
83 { 0x2A, "Unicore Microsystems, LLC Russian Federation" },
84 { 0x2B, "Dallas Semiconductor/Maxim USA" },
85 { 0x2C, "Impinj, Inc. USA" },
86 { 0x2D, "RightPlug Alliance USA" },
87 { 0x2E, "Broadcom Corporation USA" },
88 { 0x2F, "MStar Semiconductor, Inc Taiwan, ROC" },
89 { 0x30, "BeeDar Technology Inc. USA" },
90 { 0x31, "RFIDsec Denmark" },
91 { 0x32, "Schweizer Electronic AG Germany" },
92 { 0x33, "AMIC Technology Corp Taiwan" },
93 { 0x34, "Mikron JSC Russia" },
94 { 0x35, "Fraunhofer Institute for Photonic Microsystems Germany" },
95 { 0x36, "IDS Microchip AG Switzerland" },
96 { 0x37, "Kovio USA" },
97 { 0x38, "HMT Microelectronic Ltd Switzerland Identifier Company Country" },
98 { 0x39, "Silicon Craft Technology Thailand" },
99 { 0x3A, "Advanced Film Device Inc. Japan" },
100 { 0x3B, "Nitecrest Ltd UK" },
101 { 0x3C, "Verayo Inc. USA" },
102 { 0x3D, "HID Global USA" },
103 { 0x3E, "Productivity Engineering Gmbh Germany" },
104 { 0x3F, "Austriamicrosystems AG (reserved) Austria" },
105 { 0x40, "Gemalto SA France" },
106 { 0x41, "Renesas Electronics Corporation Japan" },
107 { 0x42, "3Alogics Inc Korea" },
108 { 0x43, "Top TroniQ Asia Limited Hong Kong" },
109 { 0x44, "Gentag Inc (USA) USA" },
110 { 0x00, "no tag-info available" } // must be the last entry
114 // get a product description based on the UID
116 // returns description of the best match
117 char* getTagInfo(uint8_t uid
) {
120 int len
= sizeof(manufactureMapping
) / sizeof(manufactureName
);
122 for ( i
= 0; i
< len
; ++i
)
123 if ( uid
== manufactureMapping
[i
].uid
)
124 return manufactureMapping
[i
].desc
;
126 //No match, return default
127 return manufactureMapping
[len
-1].desc
;
130 int CmdHF14AList(const char *Cmd
)
132 PrintAndLog("Deprecated command, use 'hf list 14a' instead");
136 int CmdHF14AReader(const char *Cmd
)
138 UsbCommand c
= {CMD_READER_ISO_14443a
, {ISO14A_CONNECT
| ISO14A_NO_DISCONNECT
, 0, 0}};
142 WaitForResponse(CMD_ACK
,&resp
);
144 iso14a_card_select_t card
;
145 memcpy(&card
, (iso14a_card_select_t
*)resp
.d
.asBytes
, sizeof(iso14a_card_select_t
));
147 uint64_t select_status
= resp
.arg
[0]; // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS, 3: proprietary Anticollision
149 if(select_status
== 0) {
150 if (Cmd
[0] != 's') PrintAndLog("iso14443a card select failed");
159 if(select_status
== 3) {
160 PrintAndLog("Card doesn't support standard iso14443-3 anticollision");
161 PrintAndLog("ATQA : %02x %02x", card
.atqa
[1], card
.atqa
[0]);
170 PrintAndLog(" UID : %s", sprint_hex(card
.uid
, card
.uidlen
));
171 PrintAndLog("ATQA : %02x %02x", card
.atqa
[1], card
.atqa
[0]);
172 PrintAndLog(" SAK : %02x [%d]", card
.sak
, resp
.arg
[0]);
177 //***************************************test****************
184 uint32_t tagT
= GetHF14AMfU_Type();
185 ul_print_type(tagT
, 0);
187 //reconnect for further tests
188 c
.arg
[0] = ISO14A_CONNECT
| ISO14A_NO_DISCONNECT
;
195 WaitForResponse(CMD_ACK
,&resp
);
197 memcpy(&card
, (iso14a_card_select_t
*)resp
.d
.asBytes
, sizeof(iso14a_card_select_t
));
199 select_status
= resp
.arg
[0]; // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS
201 if(select_status
== 0) {
202 //PrintAndLog("iso14443a card select failed");
212 // check if the tag answers to GETVERSION (0x60)
213 c.arg[0] = ISO14A_RAW | ISO14A_APPEND_CRC | ISO14A_NO_DISCONNECT;
216 c.d.asBytes[0] = 0x60;
218 WaitForResponse(CMD_ACK,&resp);
220 uint8_t version[10] = {0};
221 memcpy(version, resp.d.asBytes, resp.arg[0] < sizeof(version) ? resp.arg[0] : sizeof(version));
222 uint8_t len = resp.arg[0] & 0xff;
224 // todo, identify "Magic UL-C tags". // they usually have a static nonce response to 0x1A command.
225 // UL-EV1, size, check version[6] == 0x0b (smaller) 0x0b * 4 == 48
226 case 0x0A:PrintAndLog("TYPE : NXP MIFARE Ultralight EV1 %d bytes", (version[6] == 0xB) ? 48 : 128);break;
227 case 0x01:PrintAndLog("TYPE : NXP MIFARE Ultralight C");break;
228 case 0x00:PrintAndLog("TYPE : NXP MIFARE Ultralight");break;
232 case 0x01: PrintAndLog("TYPE : NXP TNP3xxx Activision Game Appliance"); break;
233 case 0x04: PrintAndLog("TYPE : NXP MIFARE (various !DESFire !DESFire EV1)"); break;
234 case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1"); break;
235 case 0x09: PrintAndLog("TYPE : NXP MIFARE Mini 0.3k"); break;
236 case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k SL2"); break;
237 case 0x11: PrintAndLog("TYPE : NXP MIFARE Plus 4k SL2"); break;
238 case 0x18: PrintAndLog("TYPE : NXP MIFARE Classic 4k | Plus 4k SL1"); break;
239 case 0x20: PrintAndLog("TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41"); break;
240 case 0x24: PrintAndLog("TYPE : NXP MIFARE DESFire | DESFire EV1"); break;
241 case 0x28: PrintAndLog("TYPE : JCOP31 or JCOP41 v2.3.1"); break;
242 case 0x38: PrintAndLog("TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K"); break;
243 case 0x88: PrintAndLog("TYPE : Infineon MIFARE CLASSIC 1K"); break;
244 case 0x98: PrintAndLog("TYPE : Gemplus MPCOS"); break;
248 // Double & triple sized UID, can be mapped to a manufacturer.
249 // HACK: does this apply for Ultralight cards?
250 if ( card
.uidlen
> 4 ) {
251 PrintAndLog("MANUFACTURER : %s", getTagInfo(card
.uid
[0]));
254 // try to request ATS even if tag claims not to support it
255 if (select_status
== 2) {
256 uint8_t rats
[] = { 0xE0, 0x80 }; // FSDI=8 (FSD=256), CID=0
257 c
.arg
[0] = ISO14A_RAW
| ISO14A_APPEND_CRC
| ISO14A_NO_DISCONNECT
;
260 memcpy(c
.d
.asBytes
, rats
, 2);
262 WaitForResponse(CMD_ACK
,&resp
);
264 memcpy(card
.ats
, resp
.d
.asBytes
, resp
.arg
[0]);
265 card
.ats_len
= resp
.arg
[0]; // note: ats_len includes CRC Bytes
268 if(card
.ats_len
>= 3) { // a valid ATS consists of at least the length byte (TL) and 2 CRC bytes
269 bool ta1
= 0, tb1
= 0, tc1
= 0;
272 if (select_status
== 2) {
273 PrintAndLog("SAK incorrectly claims that card doesn't support RATS");
275 PrintAndLog(" ATS : %s", sprint_hex(card
.ats
, card
.ats_len
));
276 PrintAndLog(" - TL : length is %d bytes", card
.ats
[0]);
277 if (card
.ats
[0] != card
.ats_len
- 2) {
278 PrintAndLog("ATS may be corrupted. Length of ATS (%d bytes incl. 2 Bytes CRC) doesn't match TL", card
.ats_len
);
281 if (card
.ats
[0] > 1) { // there is a format byte (T0)
282 ta1
= (card
.ats
[1] & 0x10) == 0x10;
283 tb1
= (card
.ats
[1] & 0x20) == 0x20;
284 tc1
= (card
.ats
[1] & 0x40) == 0x40;
285 int16_t fsci
= card
.ats
[1] & 0x0f;
286 PrintAndLog(" - T0 : TA1 is%s present, TB1 is%s present, "
287 "TC1 is%s present, FSCI is %d (FSC = %ld)",
288 (ta1
? "" : " NOT"), (tb1
? "" : " NOT"), (tc1
? "" : " NOT"),
290 fsci
< 5 ? (fsci
- 2) * 8 :
291 fsci
< 8 ? (fsci
- 3) * 32 :
299 dr
[0] = ds
[0] = '\0';
300 if (card
.ats
[pos
] & 0x10) strcat(ds
, "2, ");
301 if (card
.ats
[pos
] & 0x20) strcat(ds
, "4, ");
302 if (card
.ats
[pos
] & 0x40) strcat(ds
, "8, ");
303 if (card
.ats
[pos
] & 0x01) strcat(dr
, "2, ");
304 if (card
.ats
[pos
] & 0x02) strcat(dr
, "4, ");
305 if (card
.ats
[pos
] & 0x04) strcat(dr
, "8, ");
306 if (strlen(ds
) != 0) ds
[strlen(ds
) - 2] = '\0';
307 if (strlen(dr
) != 0) dr
[strlen(dr
) - 2] = '\0';
308 PrintAndLog(" - TA1 : different divisors are%s supported, "
309 "DR: [%s], DS: [%s]",
310 (card
.ats
[pos
] & 0x80 ? " NOT" : ""), dr
, ds
);
314 uint32_t sfgi
= card
.ats
[pos
] & 0x0F;
315 uint32_t fwi
= card
.ats
[pos
] >> 4;
316 PrintAndLog(" - TB1 : SFGI = %d (SFGT = %s%ld/fc), FWI = %d (FWT = %ld/fc)",
318 sfgi
? "" : "(not needed) ",
319 sfgi
? (1 << 12) << sfgi
: 0,
326 PrintAndLog(" - TC1 : NAD is%s supported, CID is%s supported",
327 (card
.ats
[pos
] & 0x01) ? "" : " NOT",
328 (card
.ats
[pos
] & 0x02) ? "" : " NOT");
331 if (card
.ats
[0] > pos
) {
333 if (card
.ats
[0] - pos
>= 7) {
334 if (memcmp(card
.ats
+ pos
, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) {
335 tip
= "-> MIFARE Plus X 2K or 4K";
336 } else if (memcmp(card
.ats
+ pos
, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) {
337 tip
= "-> MIFARE Plus S 2K or 4K";
340 PrintAndLog(" - HB : %s%s", sprint_hex(card
.ats
+ pos
, card
.ats
[0] - pos
), tip
);
341 if (card
.ats
[pos
] == 0xC1) {
342 PrintAndLog(" c1 -> Mifare or (multiple) virtual cards of various type");
343 PrintAndLog(" %02x -> Length is %d bytes",
344 card
.ats
[pos
+ 1], card
.ats
[pos
+ 1]);
345 switch (card
.ats
[pos
+ 2] & 0xf0) {
347 PrintAndLog(" 1x -> MIFARE DESFire");
350 PrintAndLog(" 2x -> MIFARE Plus");
353 switch (card
.ats
[pos
+ 2] & 0x0f) {
355 PrintAndLog(" x0 -> <1 kByte");
358 PrintAndLog(" x1 -> 1 kByte");
361 PrintAndLog(" x2 -> 2 kByte");
364 PrintAndLog(" x3 -> 4 kByte");
367 PrintAndLog(" x4 -> 8 kByte");
370 switch (card
.ats
[pos
+ 3] & 0xf0) {
372 PrintAndLog(" 0x -> Engineering sample");
375 PrintAndLog(" 2x -> Released");
378 switch (card
.ats
[pos
+ 3] & 0x0f) {
380 PrintAndLog(" x0 -> Generation 1");
383 PrintAndLog(" x1 -> Generation 2");
386 PrintAndLog(" x2 -> Generation 3");
389 switch (card
.ats
[pos
+ 4] & 0x0f) {
391 PrintAndLog(" x0 -> Only VCSL supported");
394 PrintAndLog(" x1 -> VCS, VCSL, and SVC supported");
397 PrintAndLog(" xE -> no VCS command supported");
403 PrintAndLog("proprietary non iso14443-4 card found, RATS not supported");
407 // try to see if card responses to "chinese magic backdoor" commands.
408 c
.cmd
= CMD_MIFARE_CIDENT
;
413 WaitForResponse(CMD_ACK
,&resp
);
415 uint8_t isGeneration
= resp
.arg
[0] & 0xff;
416 switch( isGeneration
){
417 case 1: PrintAndLog("Answers to chinese magic backdoor commands (GEN 1a): YES"); break;
418 case 2: PrintAndLog("Answers to chinese magic backdoor commands (GEN 1b): YES"); break;
419 default: PrintAndLog("Answers to chinese magic backdoor commands: NO"); break;
423 c
.cmd
= CMD_READER_ISO_14443a
;
429 return select_status
;
432 // Collect ISO14443 Type A UIDs
433 int CmdHF14ACUIDs(const char *Cmd
)
435 // requested number of UIDs
437 // collect at least 1 (e.g. if no parameter was given)
440 PrintAndLog("Collecting %d UIDs", n
);
441 PrintAndLog("Start: %" PRIu64
, msclock()/1000);
443 for (int i
= 0; i
< n
; i
++) {
444 // execute anticollision procedure
445 UsbCommand c
= {CMD_READER_ISO_14443a
, {ISO14A_CONNECT
, 0, 0}};
449 WaitForResponse(CMD_ACK
,&resp
);
451 iso14a_card_select_t
*card
= (iso14a_card_select_t
*) resp
.d
.asBytes
;
453 // check if command failed
454 if (resp
.arg
[0] == 0) {
455 PrintAndLog("Card select failed.");
458 for (uint16_t i
= 0; i
< card
->uidlen
; i
++) {
459 sprintf(&uid_string
[2*i
], "%02X", card
->uid
[i
]);
461 PrintAndLog("%s", uid_string
);
464 PrintAndLog("End: %" PRIu64
, msclock()/1000);
469 // ## simulate iso14443a tag
470 // ## greg - added ability to specify tag UID
471 int CmdHF14ASim(const char *Cmd
)
473 UsbCommand c
= {CMD_SIMULATE_TAG_ISO_14443a
,{0,0,0}};
475 // Retrieve the tag type
476 uint8_t tagtype
= param_get8ex(Cmd
,0,0,10);
478 // When no argument was given, just print help message
481 PrintAndLog(" Emulating ISO/IEC 14443 type A tag with 4 or 7 byte UID");
483 PrintAndLog(" syntax: hf 14a sim <type> <uid>");
484 PrintAndLog(" types: 1 = MIFARE Classic");
485 PrintAndLog(" 2 = MIFARE Ultralight");
486 PrintAndLog(" 3 = MIFARE Desfire");
487 PrintAndLog(" 4 = ISO/IEC 14443-4");
488 PrintAndLog(" 5 = MIFARE Tnp3xxx");
493 // Store the tag type
496 // Retrieve the full 4 or 7 byte long uid
497 uint64_t long_uid
= param_get64ex(Cmd
,1,0,16);
499 // Are we handling the (optional) second part uid?
500 if (long_uid
> 0xffffffff) {
501 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 7 byte UID (%014" PRIx64
")",long_uid
);
502 // Store the second part
503 c
.arg
[2] = (long_uid
& 0xffffffff);
505 // Store the first part, ignore the first byte, it is replaced by cascade byte (0x88)
506 c
.arg
[1] = (long_uid
& 0xffffff);
508 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 4 byte UID (%08x)",long_uid
);
509 // Only store the first part
510 c
.arg
[1] = long_uid
& 0xffffffff;
513 // At lease save the mandatory first part of the UID
514 c.arg[0] = long_uid & 0xffffffff;
517 PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
522 PrintAndLog("Emulating ISO/IEC 14443-3 type A tag with 4 byte UID");
523 UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
526 PrintAndLog("Emulating ISO/IEC 14443-4 type A tag with 7 byte UID");
529 PrintAndLog("Error: unkown tag type (%d)",c.arg[0]);
530 PrintAndLog("syntax: hf 14a sim <uid>",c.arg[0]);
531 PrintAndLog(" type1: 4 ",c.arg[0]);
538 unsigned int hi = 0, lo = 0;
540 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
541 hi= (hi << 4) | (lo >> 28);
542 lo= (lo << 4) | (n & 0xf);
545 // UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
546 // PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
551 int CmdHF14ASnoop(const char *Cmd
) {
554 uint8_t ctmp
= param_getchar(Cmd
, 0) ;
555 if (ctmp
== 'h' || ctmp
== 'H') {
556 PrintAndLog("It get data from the field and saves it into command buffer.");
557 PrintAndLog("Buffer accessible from command hf list 14a.");
558 PrintAndLog("Usage: hf 14a snoop [c][r]");
559 PrintAndLog("c - triggered by first data from card");
560 PrintAndLog("r - triggered by first 7-bit request from reader (REQ,WUP,...)");
561 PrintAndLog("sample: hf 14a snoop c r");
565 for (int i
= 0; i
< 2; i
++) {
566 ctmp
= param_getchar(Cmd
, i
);
567 if (ctmp
== 'c' || ctmp
== 'C') param
|= 0x01;
568 if (ctmp
== 'r' || ctmp
== 'R') param
|= 0x02;
571 UsbCommand c
= {CMD_SNOOP_ISO_14443a
, {param
, 0, 0}};
577 int CmdHF14ACmdRaw(const char *cmd
) {
578 UsbCommand c
= {CMD_READER_ISO_14443a
, {0, 0, 0}};
583 bool active_select
= false;
584 uint16_t numbits
= 0;
585 bool bTimeout
= false;
586 uint32_t timeout
= 0;
587 bool topazmode
= false;
590 uint8_t data
[USB_CMD_DATA_SIZE
];
591 uint16_t datalen
= 0;
595 PrintAndLog("Usage: hf 14a raw [-r] [-c] [-p] [-f] [-b] [-t] <number of bits> <0A 0B 0C ... hex>");
596 PrintAndLog(" -r do not read response");
597 PrintAndLog(" -c calculate and append CRC");
598 PrintAndLog(" -p leave the signal field ON after receive");
599 PrintAndLog(" -a active signal field ON without select");
600 PrintAndLog(" -s active signal field ON with select");
601 PrintAndLog(" -b number of bits to send. Useful for send partial byte");
602 PrintAndLog(" -t timeout in ms");
603 PrintAndLog(" -T use Topaz protocol to send command");
609 while (*cmd
==' ' || *cmd
=='\t') cmd
++;
611 while (cmd
[i
]!='\0') {
612 if (cmd
[i
]==' ' || cmd
[i
]=='\t') { i
++; continue; }
628 active_select
= true;
631 sscanf(cmd
+i
+2,"%d",&temp
);
632 numbits
= temp
& 0xFFFF;
634 while(cmd
[i
]!=' ' && cmd
[i
]!='\0') { i
++; }
639 sscanf(cmd
+i
+2,"%d",&temp
);
642 while(cmd
[i
]!=' ' && cmd
[i
]!='\0') { i
++; }
649 PrintAndLog("Invalid option");
655 if ((cmd
[i
]>='0' && cmd
[i
]<='9') ||
656 (cmd
[i
]>='a' && cmd
[i
]<='f') ||
657 (cmd
[i
]>='A' && cmd
[i
]<='F') ) {
658 buf
[strlen(buf
)+1]=0;
659 buf
[strlen(buf
)]=cmd
[i
];
662 if (strlen(buf
)>=2) {
663 sscanf(buf
,"%x",&temp
);
664 data
[datalen
]=(uint8_t)(temp
& 0xff);
666 if (datalen
> sizeof(data
)-1) {
668 PrintAndLog("Buffer is full, we can't add CRC to your data");
676 PrintAndLog("Invalid char on input");
680 if(crc
&& datalen
>0 && datalen
<sizeof(data
)-2)
682 uint8_t first
, second
;
684 ComputeCrc14443(CRC_14443_B
, data
, datalen
, &first
, &second
);
686 ComputeCrc14443(CRC_14443_A
, data
, datalen
, &first
, &second
);
688 data
[datalen
++] = first
;
689 data
[datalen
++] = second
;
692 if(active
|| active_select
)
694 c
.arg
[0] |= ISO14A_CONNECT
;
696 c
.arg
[0] |= ISO14A_NO_SELECT
;
700 #define MAX_TIMEOUT 40542464 // = (2^32-1) * (8*16) / 13560000Hz * 1000ms/s
701 c
.arg
[0] |= ISO14A_SET_TIMEOUT
;
702 if(timeout
> MAX_TIMEOUT
) {
703 timeout
= MAX_TIMEOUT
;
704 PrintAndLog("Set timeout to 40542 seconds (11.26 hours). The max we can wait for response");
706 c
.arg
[2] = 13560000 / 1000 / (8*16) * timeout
; // timeout in ETUs (time to transfer 1 bit, approx. 9.4 us)
710 c
.arg
[0] |= ISO14A_NO_DISCONNECT
;
714 c
.arg
[0] |= ISO14A_RAW
;
718 c
.arg
[0] |= ISO14A_TOPAZMODE
;
721 // Max buffer is USB_CMD_DATA_SIZE (512)
722 c
.arg
[1] = (datalen
& 0xFFFF) | ((uint32_t)numbits
<< 16);
723 memcpy(c
.d
.asBytes
,data
,datalen
);
737 static void waitCmd(uint8_t iSelect
)
743 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1500)) {
744 recv
= resp
.d
.asBytes
;
745 uint8_t iLen
= iSelect
? resp
.arg
[1] : resp
.arg
[0];
746 PrintAndLog("received %i octets", iLen
);
749 hexout
= (char *)malloc(iLen
* 3 + 1);
750 if (hexout
!= NULL
) {
751 for (int i
= 0; i
< iLen
; i
++) { // data in hex
752 sprintf(&hexout
[i
* 3], "%02X ", recv
[i
]);
754 PrintAndLog("%s", hexout
);
757 PrintAndLog("malloc failed your client has low memory?");
760 PrintAndLog("timeout while waiting for reply.");
764 static command_t CommandTable
[] =
766 {"help", CmdHelp
, 1, "This help"},
767 {"list", CmdHF14AList
, 0, "[Deprecated] List ISO 14443a history"},
768 {"reader", CmdHF14AReader
, 0, "Act like an ISO14443 Type A reader"},
769 {"cuids", CmdHF14ACUIDs
, 0, "<n> Collect n>0 ISO14443 Type A UIDs in one go"},
770 {"sim", CmdHF14ASim
, 0, "<UID> -- Simulate ISO 14443a tag"},
771 {"snoop", CmdHF14ASnoop
, 0, "Eavesdrop ISO 14443 Type A"},
772 {"raw", CmdHF14ACmdRaw
, 0, "Send raw hex data to tag"},
773 {NULL
, NULL
, 0, NULL
}
776 int CmdHF14A(const char *Cmd
) {
778 WaitForResponseTimeout(CMD_ACK
,NULL
,100);
781 CmdsParse(CommandTable
, Cmd
);
785 int CmdHelp(const char *Cmd
)
787 CmdsHelp(CommandTable
);