git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf14b.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // High frequency ISO14443B commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <stdlib.h>
  13 #include <stdbool.h>
  14 #include <stdint.h>
  15 #include "iso14443crc.h"
  16 #include "proxmark3.h"
  17 #include "data.h"
  18 #include "graph.h"
  19 #include "util.h"
  20 #include "ui.h"
  21 #include "cmdparser.h"
  22 #include "cmdhf14b.h"
  23 #include "cmdmain.h"
  24 #include "cmdhf14a.h"
  25
  26 static int CmdHelp(const char *Cmd);
  27
  28 int CmdHF14BList(const char *Cmd)
  29 {
  30         PrintAndLog("Deprecated command, use 'hf list 14b' instead");
  31
  32         return 0;
  33 }
  34
  35 int CmdHF14BSim(const char *Cmd)
  36 {
  37         UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443B};
  38         clearCommandBuffer();
  39         SendCommand(&c);
  40         return 0;
  41 }
  42
  43 int CmdHF14BSnoop(const char *Cmd)
  44 {
  45         UsbCommand c = {CMD_SNOOP_ISO_14443B};
  46         clearCommandBuffer();
  47         SendCommand(&c);
  48         return 0;
  49 }
  50
  51 /* New command to read the contents of a SRI512 tag
  52  * SRI512 tags are ISO14443-B modulated memory tags,
  53  * this command just dumps the contents of the memory
  54  */
  55 int CmdSri512Read(const char *Cmd)
  56 {
  57         UsbCommand c = {CMD_READ_SRI512_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
  58         clearCommandBuffer();
  59         SendCommand(&c);
  60         return 0;
  61 }
  62
  63 /* New command to read the contents of a SRIX4K tag
  64  * SRIX4K tags are ISO14443-B modulated memory tags,
  65  * this command just dumps the contents of the memory/
  66  */
  67 int CmdSrix4kRead(const char *Cmd)
  68 {
  69         UsbCommand c = {CMD_READ_SRIX4K_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
  70         clearCommandBuffer();
  71         SendCommand(&c);
  72         return 0;
  73 }
  74
  75 int rawClose(void){
  76         UsbCommand resp;
  77         UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}};
  78         clearCommandBuffer();
  79         SendCommand(&c);
  80         if (!WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
  81         return 0;
  82         }
  83         return 0;
  84 }
  85
  86 int HF14BCmdRaw(bool reply, bool *crc, bool power, uint8_t *data, uint8_t *datalen, bool verbose){
  87
  88         if(*crc) {
  89                 ComputeCrc14443(CRC_14443_B, data, *datalen, data+*datalen, data+*datalen+1);
  90                 *datalen += 2;
  91         }
  92
  93         UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; // len,recv,power
  94         c.arg[0] = *datalen;
  95         c.arg[1] = reply;
  96         c.arg[2] = power;
  97         memcpy(c.d.asBytes, data, *datalen);
  98         clearCommandBuffer();
  99         SendCommand(&c);
 100
 101         if (!reply) return 1;
 102
 103         UsbCommand resp;
 104         if (!WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
 105                 if (verbose) PrintAndLog("timeout while waiting for reply.");
 106                 return 0;
 107         }
 108
 109         *datalen = resp.arg[0];
 110         if (verbose) PrintAndLog("received %u octets", *datalen);
 111         if(*datalen<3) return 0;
 112
 113         memcpy(data, resp.d.asBytes, *datalen);
 114
 115         uint8_t first = 0, second = 0;
 116         ComputeCrc14443(CRC_14443_B, data, *datalen-2, &first, &second);
 117         *crc = ( data[*datalen-2] == first && data[*datalen-1] == second);
 118
 119         if (verbose)
 120                 PrintAndLog("[LEN %u] %s[%02X %02X] %s",
 121                                 *datalen,
 122                                 sprint_hex(data, *datalen-2),
 123                                 data[*datalen-2],
 124                                 data[*datalen-1],
 125                                 (*crc)?"OK":"FAIL"
 126                                 );
 127
 128         return 1;
 129 }
 130
 131 int CmdHF14BCmdRaw (const char *Cmd) {
 132     bool reply = true;
 133     bool crc = false;
 134         bool power = false;
 135         bool select = false;
 136         bool SRx = false;
 137     char buf[5]="";
 138     uint8_t data[USB_CMD_DATA_SIZE] = {0x00};
 139     uint8_t datalen = 0;
 140     unsigned int temp;
 141     int i = 0;
 142     if (strlen(Cmd)<3) {
 143                 PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] [-s || -ss] <0A 0B 0C ... hex>");
 144         PrintAndLog("       -r    do not read response");
 145         PrintAndLog("       -c    calculate and append CRC");
 146         PrintAndLog("       -p    leave the field on after receive");
 147                 PrintAndLog("       -s    active signal field ON with select");
 148                 PrintAndLog("       -ss   active signal field ON with select for SRx ST Microelectronics tags");
 149         return 0;
 150     }
 151
 152     // strip
 153     while (*Cmd==' ' || *Cmd=='\t') Cmd++;
 154
 155     while (Cmd[i]!='\0') {
 156         if (Cmd[i]==' ' || Cmd[i]=='\t') { i++; continue; }
 157         if (Cmd[i]=='-') {
 158             switch (Cmd[i+1]) {
 159                 case 'r':
 160                 case 'R':
 161                     reply = false;
 162                     break;
 163                 case 'c':
 164                 case 'C':
 165                     crc = true;
 166                     break;
 167                 case 'p':
 168                 case 'P':
 169                                         power = true;
 170                     break;
 171                                 case 's':
 172                                 case 'S':
 173                                         select = true;
 174                                         if (Cmd[i+2]=='s' || Cmd[i+2]=='S') {
 175                                                 SRx = true;
 176                                                 i++;
 177                                         }
 178                                         break;
 179                 default:
 180                     PrintAndLog("Invalid option");
 181                     return 0;
 182             }
 183             i+=2;
 184             continue;
 185         }
 186         if ((Cmd[i]>='0' && Cmd[i]<='9') ||
 187             (Cmd[i]>='a' && Cmd[i]<='f') ||
 188             (Cmd[i]>='A' && Cmd[i]<='F') ) {
 189             buf[strlen(buf)+1]=0;
 190             buf[strlen(buf)]=Cmd[i];
 191             i++;
 192
 193             if (strlen(buf)>=2) {
 194                 sscanf(buf,"%x",&temp);
 195                 data[datalen++]=(uint8_t)(temp & 0xff);
 196                 *buf=0;
 197                                 memset(buf, 0x00, sizeof(buf));
 198             }
 199             continue;
 200         }
 201         PrintAndLog("Invalid char on input");
 202                 return 0;
 203     }
 204     if (datalen == 0)
 205     {
 206       PrintAndLog("Missing data input");
 207       return 0;
 208     }
 209
 210         if (select){ //auto select 14b tag
 211                 uint8_t cmd2[16];
 212                 bool crc2 = true;
 213                 uint8_t cmdLen;
 214
 215                 if (SRx) {
 216                         // REQ SRx
 217                         cmdLen = 2;
 218                         cmd2[0] = 0x06;
 219                         cmd2[1] = 0x00;
 220                 } else {
 221                         // REQB
 222                         cmdLen = 3;
 223                         cmd2[0] = 0x05;
 224                         cmd2[1] = 0x00;
 225                         cmd2[2] = 0x08;
 226                 }
 227
 228                 // REQB
 229                 if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose();
 230
 231                 PrintAndLog("REQB   : %s", sprint_hex(cmd2, cmdLen));
 232
 233                 if ( SRx && (cmdLen != 3 || !crc2) ) return rawClose();
 234                 else if (cmd2[0] != 0x50 || cmdLen != 14 || !crc2) return rawClose();
 235
 236                 uint8_t chipID = 0;
 237                 if (SRx) {
 238                         // select
 239                         chipID = cmd2[0];
 240                         cmd2[0] = 0x0E;
 241                         cmd2[1] = chipID;
 242                         cmdLen = 2;
 243                 } else {
 244                         // attrib
 245                         cmd2[0] = 0x1D;
 246                         // UID from cmd2[1 - 4]
 247                         cmd2[5] = 0x00;
 248                         cmd2[6] = 0x08;
 249                         cmd2[7] = 0x01;
 250                         cmd2[8] = 0x00;
 251                         cmdLen = 9;
 252                 }
 253                 // wait
 254
 255                 // attrib
 256                 if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose();
 257                 PrintAndLog("ATTRIB : %s", sprint_hex(cmd2, cmdLen));
 258
 259                 if (cmdLen != 3 || !crc2) return rawClose();
 260                 if (SRx && cmd2[0] != chipID) return rawClose();
 261
 262         }
 263         return HF14BCmdRaw(reply, &crc, power, data, &datalen, true);
 264 }
 265
 266 // print full atqb info
 267 static void print_atqb_resp(uint8_t *data){
 268         //PrintAndLog ("           UID: %s", sprint_hex(data+1,4));
 269         PrintAndLog ("      App Data: %s", sprint_hex(data+5,4));
 270         PrintAndLog ("      Protocol: %s", sprint_hex(data+9,3));
 271         uint8_t BitRate = data[9];
 272         if (!BitRate) PrintAndLog ("      Bit Rate: 106 kbit/s only PICC <-> PCD");
 273         if (BitRate & 0x10)     PrintAndLog ("      Bit Rate: 212 kbit/s PICC -> PCD supported");
 274         if (BitRate & 0x20)     PrintAndLog ("      Bit Rate: 424 kbit/s PICC -> PCD supported");
 275         if (BitRate & 0x40)     PrintAndLog ("      Bit Rate: 847 kbit/s PICC -> PCD supported");
 276         if (BitRate & 0x01)     PrintAndLog ("      Bit Rate: 212 kbit/s PICC <- PCD supported");
 277         if (BitRate & 0x02)     PrintAndLog ("      Bit Rate: 424 kbit/s PICC <- PCD supported");
 278         if (BitRate & 0x04)     PrintAndLog ("      Bit Rate: 847 kbit/s PICC <- PCD supported");
 279         if (BitRate & 0x80)     PrintAndLog ("                Same bit rate <-> required");
 280
 281         uint16_t maxFrame = data[10]>>4;
 282         if (maxFrame < 5)               maxFrame = 8 * maxFrame + 16;
 283         else if (maxFrame == 5) maxFrame = 64;
 284         else if (maxFrame == 6) maxFrame = 96;
 285         else if (maxFrame == 7) maxFrame = 128;
 286         else if (maxFrame == 8) maxFrame = 256;
 287         else maxFrame = 257;
 288
 289         PrintAndLog ("Max Frame Size: %u%s",maxFrame, (maxFrame == 257) ? "+ RFU" : "");
 290
 291         uint8_t protocolT = data[10] & 0xF;
 292         PrintAndLog (" Protocol Type: Protocol is %scompliant with ISO/IEC 14443-4",(protocolT) ? "" : "not " );
 293         PrintAndLog ("Frame Wait Int: %u", data[11]>>4);
 294         PrintAndLog (" App Data Code: Application is %s",(data[11]&4) ? "Standard" : "Proprietary");
 295         PrintAndLog (" Frame Options: NAD is %ssupported",(data[11]&2) ? "" : "not ");
 296         PrintAndLog (" Frame Options: CID is %ssupported",(data[11]&1) ? "" : "not ");
 297         PrintAndLog ("Max Buf Length: %u (MBLI) %s",data[14]>>4, (data[14] & 0xF0) ? "" : "not supported");
 298
 299         return;
 300 }
 301
 302 // get SRx chip model (from UID) // from ST Microelectronics
 303 char *get_ST_Chip_Model(uint8_t data){
 304         static char model[20];
 305         char *retStr = model;
 306         memset(model,0, sizeof(model));
 307
 308         switch (data) {
 309                 case 0x0: sprintf(retStr, "SRIX4K (Special)"); break;
 310                 case 0x2: sprintf(retStr, "SR176"); break;
 311                 case 0x3: sprintf(retStr, "SRIX4K"); break;
 312                 case 0x4: sprintf(retStr, "SRIX512"); break;
 313                 case 0x6: sprintf(retStr, "SRI512"); break;
 314                 case 0x7: sprintf(retStr, "SRI4K"); break;
 315                 case 0xC: sprintf(retStr, "SRT512"); break;
 316                 default: sprintf(retStr, "Unknown"); break;
 317         }
 318         return retStr;
 319 }
 320
 321 int print_ST_Lock_info(uint8_t model){
 322         //assume connection open and tag selected...
 323         uint8_t data[16] = {0x00};
 324         uint8_t datalen = 2;
 325         bool crc = true;
 326         uint8_t resplen;
 327         uint8_t blk1;
 328         data[0] = 0x08;
 329
 330         if (model == 0x2) { //SR176 has special command:
 331                 data[1] = 0xf;
 332                 resplen = 4;
 333         } else {
 334                 data[1] = 0xff;
 335                 resplen = 6;
 336         }
 337
 338         //std read cmd
 339         if (HF14BCmdRaw(true, &crc, true, data, &datalen, false)==0) return rawClose();
 340
 341         if (datalen != resplen || !crc) return rawClose();
 342
 343         PrintAndLog("Chip Write Protection Bits:");
 344         // now interpret the data
 345         switch (model){
 346                 case 0x0: //fall through (SRIX4K special)
 347                 case 0x3: //fall through (SRIx4K)
 348                 case 0x7: //             (SRI4K)
 349                         //only need data[3]
 350                         blk1 = 9;
 351                         PrintAndLog("   raw: %s",printBits(1,data+3));
 352                         PrintAndLog(" 07/08:%slocked", (data[3] & 1) ? " not " : " " );
 353                         for (uint8_t i = 1; i<8; i++){
 354                                 PrintAndLog("    %02u:%slocked", blk1, (data[3] & (1 << i)) ? " not " : " " );
 355                                 blk1++;
 356                         }
 357                         break;
 358                 case 0x4: //fall through (SRIX512)
 359                 case 0x6: //fall through (SRI512)
 360                 case 0xC: //             (SRT512)
 361                         //need data[2] and data[3]
 362                         blk1 = 0;
 363                         PrintAndLog("   raw: %s",printBits(2,data+2));
 364                         for (uint8_t b=2; b<4; b++){
 365                                 for (uint8_t i=0; i<8; i++){
 366                                         PrintAndLog("    %02u:%slocked", blk1, (data[b] & (1 << i)) ? " not " : " " );
 367                                         blk1++;
 368                                 }
 369                         }
 370                         break;
 371                 case 0x2: //             (SR176)
 372                         //need data[2]
 373                         blk1 = 0;
 374                         PrintAndLog("   raw: %s",printBits(1,data+2));
 375                         for (uint8_t i = 0; i<8; i++){
 376                                 PrintAndLog(" %02u/%02u:%slocked", blk1, blk1+1, (data[2] & (1 << i)) ? " " : " not " );
 377                                 blk1+=2;
 378                         }
 379                         break;
 380                 default:
 381                         return rawClose();
 382         }
 383         return 1;
 384 }
 385
 386 // print UID info from SRx chips (ST Microelectronics)
 387 static void print_st_general_info(uint8_t *data){
 388         //uid = first 8 bytes in data
 389         PrintAndLog(" UID: %s", sprint_hex(SwapEndian64(data,8,8),8));
 390         PrintAndLog(" MFG: %02X, %s", data[6], getTagInfo(data[6]));
 391         PrintAndLog("Chip: %02X, %s", data[5]>>2, get_ST_Chip_Model(data[5]>>2));
 392         return;
 393 }
 394
 395 // 14b get and print UID only (general info)
 396 int HF14BStdReader(uint8_t *data, uint8_t *datalen){
 397         //05 00 00 = find one tag in field
 398         //1d xx xx xx xx 00 08 01 00 = attrib xx=UID (resp 10 [f9 e0])
 399         //a3 = ?  (resp 03 [e2 c2])
 400         //02 = ?  (resp 02 [6a d3])
 401         // 022b (resp 02 67 00 [29  5b])
 402         // 0200a40400 (resp 02 67 00 [29 5b])
 403         // 0200a4040c07a0000002480300 (resp 02 67 00 [29 5b])
 404         // 0200a4040c07a0000002480200 (resp 02 67 00 [29 5b])
 405         // 0200a4040006a0000000010100 (resp 02 6a 82 [4b 4c])
 406         // 0200a4040c09d27600002545500200 (resp 02 67 00 [29 5b])
 407         // 0200a404000cd2760001354b414e4d30310000 (resp 02 6a 82 [4b 4c])
 408         // 0200a404000ca000000063504b43532d313500 (resp 02 6a 82 [4b 4c])
 409         // 0200a4040010a000000018300301000000000000000000 (resp 02 6a 82 [4b 4c])
 410         //03 = ?  (resp 03 [e3 c2])
 411         //c2 = ?  (resp c2 [66 15])
 412         //b2 = ?  (resp a3 [e9 67])
 413         //a2 = ?  (resp 02 [6a d3])
 414         bool crc = true;
 415         *datalen = 3;
 416         //std read cmd
 417         data[0] = 0x05;
 418         data[1] = 0x00;
 419         data[2] = 0x08;
 420
 421         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 422
 423         if (data[0] != 0x50 || *datalen != 14 || !crc) return rawClose();
 424
 425         PrintAndLog ("\n14443-3b tag found:");
 426         PrintAndLog ("           UID: %s", sprint_hex(data+1,4));
 427
 428         uint8_t cmd2[16];
 429         uint8_t cmdLen = 3;
 430         bool crc2 = true;
 431
 432         cmd2[0] = 0x1D;
 433         // UID from data[1 - 4]
 434         cmd2[1] = data[1];
 435         cmd2[2] = data[2];
 436         cmd2[3] = data[3];
 437         cmd2[4] = data[4];
 438         cmd2[5] = 0x00;
 439         cmd2[6] = 0x08;
 440         cmd2[7] = 0x01;
 441         cmd2[8] = 0x00;
 442         cmdLen = 9;
 443
 444         // attrib
 445         if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose();
 446
 447         if (cmdLen != 3 || !crc2) return rawClose();
 448         // add attrib responce to data
 449         data[14] = cmd2[0];
 450         rawClose();
 451         return 1;
 452 }
 453
 454 // 14b get and print Full Info (as much as we know)
 455 int HF14BStdInfo(uint8_t *data, uint8_t *datalen){
 456         if (!HF14BStdReader(data,datalen)) return 0;
 457
 458         //add more info here
 459         print_atqb_resp(data);
 460
 461
 462         return 1;
 463 }
 464
 465 // SRx get and print general info about SRx chip from UID
 466 int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen, bool closeCon){
 467         bool crc = true;
 468         *datalen = 2;
 469         //wake cmd
 470         data[0] = 0x06;
 471         data[1] = 0x00;
 472
 473         //leave power on
 474         // verbose on for now for testing - turn off when functional
 475         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 476
 477         if (*datalen != 3 || !crc) return rawClose();
 478
 479         uint8_t chipID = data[0];
 480         // select
 481         data[0] = 0x0E;
 482         data[1] = chipID;
 483         *datalen = 2;
 484
 485         //leave power on
 486         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 487
 488         if (*datalen != 3 || !crc || data[0] != chipID) return rawClose();
 489
 490         // get uid
 491         data[0] = 0x0B;
 492         *datalen = 1;
 493
 494         //leave power on
 495         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 496
 497         if (*datalen != 10 || !crc) return rawClose();
 498
 499         //power off ?
 500         if (closeCon) rawClose();
 501
 502         PrintAndLog("\n14443-3b ST tag found:");
 503         print_st_general_info(data);
 504         return 1;
 505 }
 506
 507 // SRx get and print full info (needs more info...)
 508 int HF14B_ST_Info(uint8_t *data, uint8_t *datalen){
 509         if (!HF14B_ST_Reader(data, datalen, false)) return 0;
 510
 511         //add locking bit information here.
 512         if (print_ST_Lock_info(data[5]>>2))
 513                 rawClose();
 514
 515         return 1;
 516 }
 517
 518 // test for other 14b type tags (mimic another reader - don't have tags to identify)
 519 int HF14B_Other_Reader(uint8_t *data, uint8_t *datalen){
 520         bool crc = true;
 521         *datalen = 4;
 522         //std read cmd
 523         data[0] = 0x00;
 524         data[1] = 0x0b;
 525         data[2] = 0x3f;
 526         data[3] = 0x80;
 527
 528         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)!=0) {
 529                 if (*datalen > 2 || !crc) {
 530                         PrintAndLog ("\n14443-3b tag found:");
 531                         PrintAndLog ("Unknown tag type answered to a 0x000b3f80 command ans:");
 532                         PrintAndLog ("%s",sprint_hex(data,*datalen));
 533                         rawClose();
 534                         return 1;
 535                 }
 536         }
 537
 538         crc = false;
 539         *datalen = 1;
 540         data[0] = 0x0a;
 541
 542         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)!=0) {
 543                 if (*datalen > 0) {
 544                         PrintAndLog ("\n14443-3b tag found:");
 545                         PrintAndLog ("Unknown tag type answered to a 0x0A command ans:");
 546                         PrintAndLog ("%s",sprint_hex(data,*datalen));
 547                         rawClose();
 548                         return 1;
 549                 }
 550         }
 551
 552         crc = false;
 553         *datalen = 1;
 554         data[0] = 0x0c;
 555
 556         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)!=0) {
 557                 if (*datalen > 0) {
 558                         PrintAndLog ("\n14443-3b tag found:");
 559                         PrintAndLog ("Unknown tag type answered to a 0x0C command ans:");
 560                         PrintAndLog ("%s",sprint_hex(data,*datalen));
 561                         rawClose();
 562                         return 1;
 563                 }
 564         }
 565         rawClose();
 566         return 0;
 567 }
 568
 569 // get and print all info known about any known 14b tag
 570 int HF14BInfo(bool verbose){
 571         uint8_t data[USB_CMD_DATA_SIZE];
 572         uint8_t datalen = 5;
 573
 574         // try std 14b (atqb)
 575         if (HF14BStdInfo(data, &datalen)) return 1;
 576
 577         // try st 14b
 578         if (HF14B_ST_Info(data, &datalen)) return 1;
 579
 580         // try unknown 14b read commands (to be identified later)
 581         //   could be read of calypso, CEPAS, moneo, or pico pass.
 582         if (HF14B_Other_Reader(data, &datalen)) return 1;
 583
 584         if (verbose) PrintAndLog("no 14443B tag found");
 585         return 0;
 586 }
 587
 588 // menu command to get and print all info known about any known 14b tag
 589 int CmdHF14Binfo(const char *Cmd){
 590         return HF14BInfo(true);
 591 }
 592
 593 // get and print general info about all known 14b chips
 594 int HF14BReader(bool verbose){
 595         uint8_t data[USB_CMD_DATA_SIZE];
 596         uint8_t datalen = 5;
 597
 598         // try std 14b (atqb)
 599         if (HF14BStdReader(data, &datalen)) return 1;
 600
 601         // try st 14b
 602         if (HF14B_ST_Reader(data, &datalen, true)) return 1;
 603
 604         // try unknown 14b read commands (to be identified later)
 605         //   could be read of calypso, CEPAS, moneo, or pico pass.
 606         if (HF14B_Other_Reader(data, &datalen)) return 1;
 607
 608         if (verbose) PrintAndLog("no 14443B tag found");
 609         return 0;
 610 }
 611
 612 // menu command to get and print general info about all known 14b chips
 613 int CmdHF14BReader(const char *Cmd){
 614         return HF14BReader(true);
 615 }
 616
 617 int CmdSriWrite( const char *Cmd){
 618 /*
 619  * For SRIX4K  blocks 00 - 7F
 620  * hf 14b raw -c -p 09 $srix4kwblock $srix4kwdata
 621  *
 622  * For SR512  blocks 00 - 0F
 623  * hf 14b raw -c -p 09 $sr512wblock $sr512wdata
 624  *
 625  * Special block FF =  otp_lock_reg block.
 626  * Data len 4 bytes-
 627  */
 628         char cmdp = param_getchar(Cmd, 0);
 629         uint8_t blockno = -1;
 630         uint8_t data[4] = {0x00};
 631         bool isSrix4k = true;
 632         char str[20];
 633
 634         if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') {
 635                 PrintAndLog("Usage:  hf 14b write <1|2> <BLOCK> <DATA>");
 636                 PrintAndLog("    [1 = SRIX4K]");
 637                 PrintAndLog("    [2 = SRI512]");
 638                 PrintAndLog("    [BLOCK number depends on tag, special block == FF]");
 639                 PrintAndLog("     sample: hf 14b write 1 7F 11223344");
 640                 PrintAndLog("           : hf 14b write 1 FF 11223344");
 641                 PrintAndLog("           : hf 14b write 2 15 11223344");
 642                 PrintAndLog("           : hf 14b write 2 FF 11223344");
 643                 return 0;
 644         }
 645
 646         if ( cmdp == '2' )
 647                 isSrix4k = false;
 648
 649         //blockno = param_get8(Cmd, 1);
 650
 651         if ( param_gethex(Cmd,1, &blockno, 2) ) {
 652                 PrintAndLog("Block number must include 2 HEX symbols");
 653                 return 0;
 654         }
 655
 656         if ( isSrix4k ){
 657                 if ( blockno > 0x7f && blockno != 0xff ){
 658                         PrintAndLog("Block number out of range");
 659                         return 0;
 660                 }
 661         } else {
 662                 if ( blockno > 0x0f && blockno != 0xff ){
 663                         PrintAndLog("Block number out of range");
 664                         return 0;
 665                 }
 666         }
 667
 668         if (param_gethex(Cmd, 2, data, 8)) {
 669                 PrintAndLog("Data must include 8 HEX symbols");
 670                 return 0;
 671         }
 672
 673         if ( blockno == 0xff)
 674                 PrintAndLog("[%s] Write special block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512" , blockno,  sprint_hex(data,4) );
 675         else
 676                 PrintAndLog("[%s] Write block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512", blockno,  sprint_hex(data,4) );
 677
 678         sprintf(str, "-c 09 %02x %02x%02x%02x%02x", blockno, data[0], data[1], data[2], data[3]);
 679
 680         CmdHF14BCmdRaw(str);
 681         return 0;
 682 }
 683
 684 static command_t CommandTable[] =
 685 {
 686         {"help",        CmdHelp,        1, "This help"},
 687         {"info",        CmdHF14Binfo,   0, "Find and print details about a 14443B tag"},
 688         {"list",        CmdHF14BList,   0, "[Deprecated] List ISO 14443B history"},
 689         {"reader",      CmdHF14BReader, 0, "Act as a 14443B reader to identify a tag"},
 690         {"sim",         CmdHF14BSim,    0, "Fake ISO 14443B tag"},
 691         {"snoop",       CmdHF14BSnoop,  0, "Eavesdrop ISO 14443B"},
 692         {"sri512read",  CmdSri512Read,  0, "Read contents of a SRI512 tag"},
 693         {"srix4kread",  CmdSrix4kRead,  0, "Read contents of a SRIX4K tag"},
 694         {"sriwrite",    CmdSriWrite,    0, "Write data to a SRI512 | SRIX4K tag"},
 695         {"raw",         CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},
 696         {NULL, NULL, 0, NULL}
 697 };
 698
 699 int CmdHF14B(const char *Cmd)
 700 {
 701         CmdsParse(CommandTable, Cmd);
 702         return 0;
 703 }
 704
 705 int CmdHelp(const char *Cmd)
 706 {
 707         CmdsHelp(CommandTable);
 708         return 0;
 709 }