git.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf14b.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // High frequency ISO14443B commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <stdlib.h>
  13 #include <stdbool.h>
  14 //#include <string.h>
  15 #include <stdint.h>
  16 #include "iso14443crc.h"
  17 #include "proxmark3.h"
  18 #include "data.h"
  19 #include "graph.h"
  20 #include "util.h"
  21 #include "ui.h"
  22 #include "cmdparser.h"
  23 #include "cmdhf14b.h"
  24 #include "cmdmain.h"
  25 #include "cmdhf14a.h"
  26
  27 static int CmdHelp(const char *Cmd);
  28
  29 int CmdHF14BList(const char *Cmd)
  30 {
  31         PrintAndLog("Deprecated command, use 'hf list 14b' instead");
  32
  33         return 0;
  34 }
  35
  36 int CmdHF14BSim(const char *Cmd)
  37 {
  38         UsbCommand c={CMD_SIMULATE_TAG_ISO_14443B};
  39         clearCommandBuffer();
  40         SendCommand(&c);
  41         return 0;
  42 }
  43
  44 int CmdHF14BSnoop(const char *Cmd)
  45 {
  46   UsbCommand c = {CMD_SNOOP_ISO_14443B};
  47         clearCommandBuffer();
  48         SendCommand(&c);
  49         return 0;
  50 }
  51
  52 /* New command to read the contents of a SRI512 tag
  53  * SRI512 tags are ISO14443-B modulated memory tags,
  54  * this command just dumps the contents of the memory
  55  */
  56 int CmdSri512Read(const char *Cmd)
  57 {
  58         UsbCommand c = {CMD_READ_SRI512_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
  59         clearCommandBuffer();
  60         SendCommand(&c);
  61         return 0;
  62 }
  63
  64 /* New command to read the contents of a SRIX4K tag
  65  * SRIX4K tags are ISO14443-B modulated memory tags,
  66  * this command just dumps the contents of the memory/
  67  */
  68 int CmdSrix4kRead(const char *Cmd)
  69 {
  70         UsbCommand c = {CMD_READ_SRIX4K_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
  71         clearCommandBuffer();
  72         SendCommand(&c);
  73         return 0;
  74 }
  75
  76 int rawClose(void){
  77         UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}};
  78         clearCommandBuffer();
  79         SendCommand(&c);
  80         return 0;
  81 }
  82
  83 int HF14BCmdRaw(bool reply, bool *crc, bool power, uint8_t *data, uint8_t *datalen, bool verbose){
  84
  85         if(*crc) {
  86                 ComputeCrc14443(CRC_14443_B, data, *datalen, data+*datalen, data+*datalen+1);
  87                 *datalen += 2;
  88         }
  89
  90         UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; // len,recv,power
  91         c.arg[0] = *datalen;
  92         c.arg[1] = reply;
  93         c.arg[2] = power;
  94         memcpy(c.d.asBytes, data, *datalen);
  95         clearCommandBuffer();
  96         SendCommand(&c);
  97
  98         if (!reply) return 1;
  99
 100         UsbCommand resp;
 101         if (!WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
 102                 if (verbose) PrintAndLog("timeout while waiting for reply.");
 103                 return 0;
 104         }
 105
 106         *datalen = resp.arg[0];
 107         if (verbose) PrintAndLog("received %u octets", *datalen);
 108         if(*datalen<3) return 0;
 109
 110         memcpy(data, resp.d.asBytes, *datalen);
 111
 112         uint8_t first = 0, second = 0;
 113         ComputeCrc14443(CRC_14443_B, data, *datalen-2, &first, &second);
 114         *crc = ( data[*datalen-2] == first && data[*datalen-1] == second);
 115
 116         if (verbose)
 117                 PrintAndLog("[LEN %u] %s[%02X %02X] %s",
 118                                 *datalen,
 119                                 sprint_hex(data, *datalen-2),
 120                                 data[*datalen-2],
 121                                 data[*datalen-1],
 122                                 (*crc)?"OK":"FAIL"
 123                                 );
 124
 125         return 1;
 126 }
 127
 128 int CmdHF14BCmdRaw (const char *Cmd) {
 129     bool reply = true;
 130     bool crc = false;
 131         bool power = false;
 132         bool select = false;
 133         bool SRx = false;
 134     char buf[5]="";
 135     uint8_t data[USB_CMD_DATA_SIZE] = {0x00};
 136     uint8_t datalen = 0;
 137     unsigned int temp;
 138     int i = 0;
 139     if (strlen(Cmd)<3) {
 140                 PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] [-s || -ss] <0A 0B 0C ... hex>");
 141         PrintAndLog("       -r    do not read response");
 142         PrintAndLog("       -c    calculate and append CRC");
 143         PrintAndLog("       -p    leave the field on after receive");
 144                 PrintAndLog("       -s    active signal field ON with select");
 145                 PrintAndLog("       -ss   active signal field ON with select for SRx ST Microelectronics tags");
 146         return 0;
 147     }
 148
 149     // strip
 150     while (*Cmd==' ' || *Cmd=='\t') Cmd++;
 151
 152     while (Cmd[i]!='\0') {
 153         if (Cmd[i]==' ' || Cmd[i]=='\t') { i++; continue; }
 154         if (Cmd[i]=='-') {
 155             switch (Cmd[i+1]) {
 156                 case 'r':
 157                 case 'R':
 158                     reply = false;
 159                     break;
 160                 case 'c':
 161                 case 'C':
 162                     crc = true;
 163                     break;
 164                 case 'p':
 165                 case 'P':
 166                                         power = true;
 167                     break;
 168                                 case 's':
 169                                 case 'S':
 170                                         select = true;
 171                                         if (Cmd[i+2]=='s' || Cmd[i+2]=='S') {
 172                                                 SRx = true;
 173                                                 i++;
 174                                         }
 175                                         break;
 176                 default:
 177                     PrintAndLog("Invalid option");
 178                     return 0;
 179             }
 180             i+=2;
 181             continue;
 182         }
 183         if ((Cmd[i]>='0' && Cmd[i]<='9') ||
 184             (Cmd[i]>='a' && Cmd[i]<='f') ||
 185             (Cmd[i]>='A' && Cmd[i]<='F') ) {
 186             buf[strlen(buf)+1]=0;
 187             buf[strlen(buf)]=Cmd[i];
 188             i++;
 189
 190             if (strlen(buf)>=2) {
 191                 sscanf(buf,"%x",&temp);
 192                 data[datalen++]=(uint8_t)(temp & 0xff);
 193                 *buf=0;
 194                                 memset(buf, 0x00, sizeof(buf));
 195             }
 196             continue;
 197         }
 198         PrintAndLog("Invalid char on input");
 199                 return 0;
 200     }
 201     if (datalen == 0)
 202     {
 203       PrintAndLog("Missing data input");
 204       return 0;
 205     }
 206
 207         if (select){ //auto select 14b tag
 208                 uint8_t cmd2[16];
 209                 bool crc2 = true;
 210                 uint8_t cmdLen;
 211
 212                 if (SRx) {
 213                         // REQ SRx
 214                         cmdLen = 2;
 215                         cmd2[0] = 0x06;
 216                         cmd2[1] = 0x00;
 217                 } else {
 218                         // REQB
 219                         cmdLen = 3;
 220                         cmd2[0] = 0x05;
 221                         cmd2[1] = 0x00;
 222                         cmd2[2] = 0x08;
 223                 }
 224
 225                 // REQB
 226                 if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose();
 227
 228                 PrintAndLog("REQB   : %s", sprint_hex(cmd2, 9));
 229
 230                 if ( SRx && (cmdLen != 3 || !crc2) ) return rawClose();
 231                 else if (cmd2[0] != 0x50 || cmdLen != 14 || !crc2) return rawClose();
 232
 233                 uint8_t chipID = 0;
 234                 if (SRx) {
 235                         // select
 236                         chipID = cmd2[0];
 237                         cmd2[0] = 0x0E;
 238                         cmd2[1] = chipID;
 239                         cmdLen = 2;
 240                 } else {
 241                         // attrib
 242                         cmd2[0] = 0x1D;
 243                         // UID from cmd2[1 - 4]
 244                         cmd2[5] = 0x00;
 245                         cmd2[6] = 0x08;
 246                         cmd2[7] = 0x01;
 247                         cmd2[8] = 0x00;
 248                         cmdLen = 9;
 249                 }
 250                 // wait
 251
 252                 // attrib
 253                 if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose();
 254                 PrintAndLog("ATTRIB : %s", sprint_hex(cmd2, 3));
 255
 256                 if (cmdLen != 3 || !crc2) return rawClose();
 257                 if (SRx && cmd2[0] != chipID) return rawClose();
 258
 259         }
 260         return HF14BCmdRaw(reply, &crc, power, data, &datalen, true);
 261 }
 262
 263 // print full atqb info
 264 static void print_atqb_resp(uint8_t *data){
 265         //PrintAndLog ("           UID: %s", sprint_hex(data+1,4));
 266         PrintAndLog ("      App Data: %s", sprint_hex(data+5,4));
 267         PrintAndLog ("      Protocol: %s", sprint_hex(data+9,3));
 268         uint8_t BitRate = data[9];
 269         if (!BitRate) PrintAndLog ("      Bit Rate: 106 kbit/s only PICC <-> PCD");
 270         if (BitRate & 0x10)     PrintAndLog ("      Bit Rate: 212 kbit/s PICC -> PCD supported");
 271         if (BitRate & 0x20)     PrintAndLog ("      Bit Rate: 424 kbit/s PICC -> PCD supported");
 272         if (BitRate & 0x40)     PrintAndLog ("      Bit Rate: 847 kbit/s PICC -> PCD supported");
 273         if (BitRate & 0x01)     PrintAndLog ("      Bit Rate: 212 kbit/s PICC <- PCD supported");
 274         if (BitRate & 0x02)     PrintAndLog ("      Bit Rate: 424 kbit/s PICC <- PCD supported");
 275         if (BitRate & 0x04)     PrintAndLog ("      Bit Rate: 847 kbit/s PICC <- PCD supported");
 276         if (BitRate & 0x80)     PrintAndLog ("                Same bit rate <-> required");
 277
 278         uint16_t maxFrame = data[10]>>4;
 279         if (maxFrame < 5)               maxFrame = 8 * maxFrame + 16;
 280         else if (maxFrame == 5) maxFrame = 64;
 281         else if (maxFrame == 6) maxFrame = 96;
 282         else if (maxFrame == 7) maxFrame = 128;
 283         else if (maxFrame == 8) maxFrame = 256;
 284         else maxFrame = 257;
 285
 286         PrintAndLog ("Max Frame Size: %u%s",maxFrame, (maxFrame == 257) ? "+ RFU" : "");
 287
 288         uint8_t protocolT = data[10] & 0xF;
 289         PrintAndLog (" Protocol Type: Protocol is %scompliant with ISO/IEC 14443-4",(protocolT) ? "" : "not " );
 290         PrintAndLog ("Frame Wait Int: %u", data[11]>>4);
 291         PrintAndLog (" App Data Code: Application is %s",(data[11]&4) ? "Standard" : "Proprietary");
 292         PrintAndLog (" Frame Options: NAD is %ssupported",(data[11]&2) ? "" : "not ");
 293         PrintAndLog (" Frame Options: CID is %ssupported",(data[11]&1) ? "" : "not ");
 294         PrintAndLog ("Max Buf Length: %u (MBLI) %s",data[14]>>4, (data[14] & 0xF0) ? "" : "not supported");
 295
 296         return;
 297 }
 298
 299 // get SRx chip model (from UID) // from ST Microelectronics
 300 char *get_ST_Chip_Model(uint8_t data){
 301         static char model[20];
 302         char *retStr = model;
 303         memset(model,0, sizeof(model));
 304
 305         switch (data) {
 306                 case 0x0: sprintf(retStr, "SRIX4K (Special)"); break;
 307                 case 0x2: sprintf(retStr, "SR176"); break;
 308                 case 0x3: sprintf(retStr, "SRIX4K"); break;
 309                 case 0x4: sprintf(retStr, "SRIX512"); break;
 310                 case 0x6: sprintf(retStr, "SRI512"); break;
 311                 case 0x7: sprintf(retStr, "SRI4K"); break;
 312                 case 0xC: sprintf(retStr, "SRT512"); break;
 313                 default: sprintf(retStr, "Unknown"); break;
 314         }
 315         return retStr;
 316 }
 317
 318 int print_ST_Lock_info(uint8_t model){
 319         //assume connection open and tag selected...
 320         uint8_t data[16] = {0x00};
 321         uint8_t datalen = 2;
 322         bool crc = true;
 323         uint8_t resplen;
 324         uint8_t blk1;
 325         data[0] = 0x08;
 326
 327         if (model == 0x2) { //SR176 has special command:
 328                 data[1] = 0xf;
 329                 resplen = 4;
 330         } else {
 331                 data[1] = 0xff;
 332                 resplen = 6;
 333         }
 334
 335         //std read cmd
 336         if (HF14BCmdRaw(true, &crc, true, data, &datalen, false)==0) return rawClose();
 337
 338         if (datalen != resplen || !crc) return rawClose();
 339
 340         PrintAndLog("Chip Write Protection Bits:");
 341         // now interpret the data
 342         switch (model){
 343                 case 0x0: //fall through (SRIX4K special)
 344                 case 0x3: //fall through (SRIx4K)
 345                 case 0x7: //             (SRI4K)
 346                         //only need data[3]
 347                         blk1 = 9;
 348                         PrintAndLog("   raw: %s",printBits(1,data+3));
 349                         PrintAndLog(" 07/08:%slocked", (data[3] & 1) ? " not " : " " );
 350                         for (uint8_t i = 1; i<8; i++){
 351                                 PrintAndLog("    %02u:%slocked", blk1, (data[3] & (1 << i)) ? " not " : " " );
 352                                 blk1++;
 353                         }
 354                         break;
 355                 case 0x4: //fall through (SRIX512)
 356                 case 0x6: //fall through (SRI512)
 357                 case 0xC: //             (SRT512)
 358                         //need data[2] and data[3]
 359                         blk1 = 0;
 360                         PrintAndLog("   raw: %s",printBits(2,data+2));
 361                         for (uint8_t b=2; b<4; b++){
 362                                 for (uint8_t i=0; i<8; i++){
 363                                         PrintAndLog("    %02u:%slocked", blk1, (data[b] & (1 << i)) ? " not " : " " );
 364                                         blk1++;
 365                                 }
 366                         }
 367                         break;
 368                 case 0x2: //             (SR176)
 369                         //need data[2]
 370                         blk1 = 0;
 371                         PrintAndLog("   raw: %s",printBits(1,data+2));
 372                         for (uint8_t i = 0; i<8; i++){
 373                                 PrintAndLog(" %02u/%02u:%slocked", blk1, blk1+1, (data[2] & (1 << i)) ? " " : " not " );
 374                                 blk1+=2;
 375                         }
 376                         break;
 377                 default:
 378                         return rawClose();
 379         }
 380         return 1;
 381 }
 382
 383 // print UID info from SRx chips (ST Microelectronics)
 384 static void print_st_general_info(uint8_t *data){
 385         //uid = first 8 bytes in data
 386         PrintAndLog(" UID: %s", sprint_hex(SwapEndian64(data,8,8),8));
 387         PrintAndLog(" MFG: %02X, %s", data[6], getTagInfo(data[6]));
 388         PrintAndLog("Chip: %02X, %s", data[5]>>2, get_ST_Chip_Model(data[5]>>2));
 389         return;
 390 }
 391
 392 // 14b get and print UID only (general info)
 393 int HF14BStdReader(uint8_t *data, uint8_t *datalen){
 394         //05 00 00 = find one tag in field
 395         //1d xx xx xx xx 00 08 01 00 = attrib xx=UID (resp 10 [f9 e0])
 396         //a3 = ?  (resp 03 [e2 c2])
 397         //02 = ?  (resp 02 [6a d3])
 398         // 022b (resp 02 67 00 [29  5b])
 399         // 0200a40400 (resp 02 67 00 [29 5b])
 400         // 0200a4040c07a0000002480300 (resp 02 67 00 [29 5b])
 401         // 0200a4040c07a0000002480200 (resp 02 67 00 [29 5b])
 402         // 0200a4040006a0000000010100 (resp 02 6a 82 [4b 4c])
 403         // 0200a4040c09d27600002545500200 (resp 02 67 00 [29 5b])
 404         // 0200a404000cd2760001354b414e4d30310000 (resp 02 6a 82 [4b 4c])
 405         // 0200a404000ca000000063504b43532d313500 (resp 02 6a 82 [4b 4c])
 406         // 0200a4040010a000000018300301000000000000000000 (resp 02 6a 82 [4b 4c])
 407         //03 = ?  (resp 03 [e3 c2])
 408         //c2 = ?  (resp c2 [66 15])
 409         //b2 = ?  (resp a3 [e9 67])
 410         //a2 = ?  (resp 02 [6a d3])
 411         bool crc = true;
 412         *datalen = 3;
 413         //std read cmd
 414         data[0] = 0x05;
 415         data[1] = 0x00;
 416         data[2] = 0x08;
 417
 418         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 419
 420         if (data[0] != 0x50 || *datalen != 14 || !crc) return rawClose();
 421
 422         PrintAndLog ("\n14443-3b tag found:");
 423         PrintAndLog ("           UID: %s", sprint_hex(data+1,4));
 424
 425         uint8_t cmd2[16];
 426         uint8_t cmdLen = 3;
 427         bool crc2 = true;
 428
 429         cmd2[0] = 0x1D;
 430         // UID from data[1 - 4]
 431         cmd2[1] = data[1];
 432         cmd2[2] = data[2];
 433         cmd2[3] = data[3];
 434         cmd2[4] = data[4];
 435         cmd2[5] = 0x00;
 436         cmd2[6] = 0x08;
 437         cmd2[7] = 0x01;
 438         cmd2[8] = 0x00;
 439         cmdLen = 9;
 440
 441         // attrib
 442         if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose();
 443
 444         if (cmdLen != 3 || !crc2) return rawClose();
 445         // add attrib responce to data
 446         data[14] = cmd2[0];
 447         rawClose();
 448         return 1;
 449 }
 450
 451 // 14b get and print Full Info (as much as we know)
 452 int HF14BStdInfo(uint8_t *data, uint8_t *datalen){
 453         if (!HF14BStdReader(data,datalen)) return 0;
 454
 455         //add more info here
 456         print_atqb_resp(data);
 457
 458
 459         return 1;
 460 }
 461
 462 // SRx get and print general info about SRx chip from UID
 463 int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen, bool closeCon){
 464         bool crc = true;
 465         *datalen = 2;
 466         //wake cmd
 467         data[0] = 0x06;
 468         data[1] = 0x00;
 469
 470         //leave power on
 471         // verbose on for now for testing - turn off when functional
 472         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 473
 474         if (*datalen != 3 || !crc) return rawClose();
 475
 476         uint8_t chipID = data[0];
 477         // select
 478         data[0] = 0x0E;
 479         data[1] = chipID;
 480         *datalen = 2;
 481
 482         //leave power on
 483         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 484
 485         if (*datalen != 3 || !crc || data[0] != chipID) return rawClose();
 486
 487         // get uid
 488         data[0] = 0x0B;
 489         *datalen = 1;
 490
 491         //leave power on
 492         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 493
 494         if (*datalen != 10 || !crc) return rawClose();
 495
 496         //power off ?
 497         if (closeCon) rawClose();
 498
 499         PrintAndLog("\n14443-3b ST tag found:");
 500         print_st_general_info(data);
 501         return 1;
 502 }
 503
 504 // SRx get and print full info (needs more info...)
 505 int HF14B_ST_Info(uint8_t *data, uint8_t *datalen){
 506         if (!HF14B_ST_Reader(data, datalen, false)) return 0;
 507
 508         //add locking bit information here.
 509         if (print_ST_Lock_info(data[5]>>2))
 510                 rawClose();
 511
 512         return 1;
 513 }
 514
 515 // test for other 14b type tags (mimic another reader - don't have tags to identify)
 516 int HF14B_Other_Reader(uint8_t *data, uint8_t *datalen){
 517         bool crc = true;
 518         *datalen = 4;
 519         //std read cmd
 520         data[0] = 0x00;
 521         data[1] = 0x0b;
 522         data[2] = 0x3f;
 523         data[3] = 0x80;
 524
 525         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)!=0) {
 526                 if (*datalen > 2 || !crc) {
 527                         PrintAndLog ("\n14443-3b tag found:");
 528                         PrintAndLog ("Unknown tag type answered to a 0x000b3f80 command ans:");
 529                         PrintAndLog ("%s",sprint_hex(data,*datalen));
 530                         rawClose();
 531                         return 1;
 532                 }
 533         }
 534
 535         crc = false;
 536         *datalen = 1;
 537         data[0] = 0x0a;
 538
 539         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)!=0) {
 540                 if (*datalen > 0) {
 541                         PrintAndLog ("\n14443-3b tag found:");
 542                         PrintAndLog ("Unknown tag type answered to a 0x0A command ans:");
 543                         PrintAndLog ("%s",sprint_hex(data,*datalen));
 544                         rawClose();
 545                         return 1;
 546                 }
 547         }
 548
 549         crc = false;
 550         *datalen = 1;
 551         data[0] = 0x0c;
 552
 553         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)!=0) {
 554                 if (*datalen > 0) {
 555                         PrintAndLog ("\n14443-3b tag found:");
 556                         PrintAndLog ("Unknown tag type answered to a 0x0C command ans:");
 557                         PrintAndLog ("%s",sprint_hex(data,*datalen));
 558                         rawClose();
 559                         return 1;
 560                 }
 561         }
 562         rawClose();
 563         return 0;
 564 }
 565
 566 // get and print all info known about any known 14b tag
 567 int HF14BInfo(bool verbose){
 568         uint8_t data[USB_CMD_DATA_SIZE];
 569         uint8_t datalen = 5;
 570
 571         // try std 14b (atqb)
 572         if (HF14BStdInfo(data, &datalen)) return 1;
 573
 574         // try st 14b
 575         if (HF14B_ST_Info(data, &datalen)) return 1;
 576
 577         // try unknown 14b read commands (to be identified later)
 578         //   could be read of calypso, CEPAS, moneo, or pico pass.
 579         if (HF14B_Other_Reader(data, &datalen)) return 1;
 580
 581         if (verbose) PrintAndLog("no 14443B tag found");
 582         return 0;
 583 }
 584
 585 // menu command to get and print all info known about any known 14b tag
 586 int CmdHF14Binfo(const char *Cmd){
 587         return HF14BInfo(true);
 588 }
 589
 590 // get and print general info about all known 14b chips
 591 int HF14BReader(bool verbose){
 592         uint8_t data[USB_CMD_DATA_SIZE];
 593         uint8_t datalen = 5;
 594
 595         // try std 14b (atqb)
 596         if (HF14BStdReader(data, &datalen)) return 1;
 597
 598         // try st 14b
 599         if (HF14B_ST_Reader(data, &datalen, true)) return 1;
 600
 601         // try unknown 14b read commands (to be identified later)
 602         //   could be read of calypso, CEPAS, moneo, or pico pass.
 603         if (HF14B_Other_Reader(data, &datalen)) return 1;
 604
 605         if (verbose) PrintAndLog("no 14443B tag found");
 606         return 0;
 607 }
 608
 609 // menu command to get and print general info about all known 14b chips
 610 int CmdHF14BReader(const char *Cmd){
 611         return HF14BReader(true);
 612 }
 613
 614 int CmdSriWrite( const char *Cmd){
 615 /*
 616  * For SRIX4K  blocks 00 - 7F
 617  * hf 14b raw -c -p 09 $srix4kwblock $srix4kwdata
 618  *
 619  * For SR512  blocks 00 - 0F
 620  * hf 14b raw -c -p 09 $sr512wblock $sr512wdata
 621  *
 622  * Special block FF =  otp_lock_reg block.
 623  * Data len 4 bytes-
 624  */
 625         char cmdp = param_getchar(Cmd, 0);
 626         uint8_t blockno = -1;
 627         uint8_t data[4] = {0x00};
 628         bool isSrix4k = true;
 629         char str[20];
 630
 631         if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') {
 632                 PrintAndLog("Usage:  hf 14b write <1|2> <BLOCK> <DATA>");
 633                 PrintAndLog("    [1 = SRIX4K]");
 634                 PrintAndLog("    [2 = SRI512]");
 635                 PrintAndLog("    [BLOCK number depends on tag, special block == FF]");
 636                 PrintAndLog("     sample: hf 14b write 1 7F 11223344");
 637                 PrintAndLog("           : hf 14b write 1 FF 11223344");
 638                 PrintAndLog("           : hf 14b write 2 15 11223344");
 639                 PrintAndLog("           : hf 14b write 2 FF 11223344");
 640                 return 0;
 641         }
 642
 643         if ( cmdp == '2' )
 644                 isSrix4k = false;
 645
 646         //blockno = param_get8(Cmd, 1);
 647
 648         if ( param_gethex(Cmd,1, &blockno, 2) ) {
 649                 PrintAndLog("Block number must include 2 HEX symbols");
 650                 return 0;
 651         }
 652
 653         if ( isSrix4k ){
 654                 if ( blockno > 0x7f && blockno != 0xff ){
 655                         PrintAndLog("Block number out of range");
 656                         return 0;
 657                 }
 658         } else {
 659                 if ( blockno > 0x0f && blockno != 0xff ){
 660                         PrintAndLog("Block number out of range");
 661                         return 0;
 662                 }
 663         }
 664
 665         if (param_gethex(Cmd, 2, data, 8)) {
 666                 PrintAndLog("Data must include 8 HEX symbols");
 667                 return 0;
 668         }
 669
 670         if ( blockno == 0xff)
 671                 PrintAndLog("[%s] Write special block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512" , blockno,  sprint_hex(data,4) );
 672         else
 673                 PrintAndLog("[%s] Write block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512", blockno,  sprint_hex(data,4) );
 674
 675         sprintf(str, "-c 09 %02x %02x%02x%02x%02x", blockno, data[0], data[1], data[2], data[3]);
 676
 677         CmdHF14BCmdRaw(str);
 678         return 0;
 679 }
 680
 681 static command_t CommandTable[] =
 682 {
 683         {"help",        CmdHelp,        1, "This help"},
 684         {"info",        CmdHF14Binfo,   0, "Find and print details about a 14443B tag"},
 685         {"list",        CmdHF14BList,   0, "[Deprecated] List ISO 14443B history"},
 686         {"reader",      CmdHF14BReader, 0, "Act as a 14443B reader to identify a tag"},
 687         {"sim",         CmdHF14BSim,    0, "Fake ISO 14443B tag"},
 688         {"snoop",       CmdHF14BSnoop,  0, "Eavesdrop ISO 14443B"},
 689         {"sri512read",  CmdSri512Read,  0, "Read contents of a SRI512 tag"},
 690         {"srix4kread",  CmdSrix4kRead,  0, "Read contents of a SRIX4K tag"},
 691         {"sriwrite",    CmdSriWrite,    0, "Write data to a SRI512 | SRIX4K tag"},
 692         {"raw",         CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},
 693         {NULL, NULL, 0, NULL}
 694 };
 695
 696 int CmdHF14B(const char *Cmd)
 697 {
 698         CmdsParse(CommandTable, Cmd);
 699         return 0;
 700 }
 701
 702 int CmdHelp(const char *Cmd)
 703 {
 704         CmdsHelp(CommandTable);
 705         return 0;
 706 }