projects / proxmark3-svn / blame
| Commit | Line | Data |
|---|---|---|
| b67f7ec3 MHS |
1 | #ifndef PROTOCOLS_H |
| 2 | #define PROTOCOLS_H | |
| 3 | ||
| 4 | //The following data is taken from http://www.proxmark.org/forum/viewtopic.php?pid=13501#p13501 | |
| 5 | /* | |
| 6 | ISO14443A (usually NFC tags) | |
| 7 | 26 (7bits) = REQA | |
| 8 | 30 = Read (usage: 30+1byte block number+2bytes ISO14443A-CRC - answer: 16bytes) | |
| 9 | A2 = Write (usage: A2+1byte block number+4bytes data+2bytes ISO14443A-CRC - answer: 0A [ACK] or 00 [NAK]) | |
| 10 | 52 (7bits) = WUPA (usage: 52(7bits) - answer: 2bytes ATQA) | |
| 11 | 93 20 = Anticollision (usage: 9320 - answer: 4bytes UID+1byte UID-bytes-xor) | |
| 12 | 93 70 = Select (usage: 9370+5bytes 9320 answer - answer: 1byte SAK) | |
| 13 | 95 20 = Anticollision of cascade level2 | |
| 14 | 95 70 = Select of cascade level2 | |
| 15 | 50 00 = Halt (usage: 5000+2bytes ISO14443A-CRC - no answer from card) | |
| 16 | Mifare | |
| 17 | 60 = Authenticate with KeyA | |
| 18 | 61 = Authenticate with KeyB | |
| 19 | 40 (7bits) = Used to put Chinese Changeable UID cards in special mode (must be followed by 43 (8bits) - answer: 0A) | |
| 20 | C0 = Decrement | |
| 21 | C1 = Increment | |
| 22 | C2 = Restore | |
| 23 | B0 = Transfer | |
| 24 | Ultralight C | |
| 25 | A0 = Compatibility Write (to accomodate MIFARE commands) | |
| 26 | 1A = Step1 Authenticate | |
| 27 | AF = Step2 Authenticate | |
| 28 | ||
| 29 | ||
| 30 | ISO14443B | |
| 31 | 05 = REQB | |
| 32 | 1D = ATTRIB | |
| 33 | 50 = HALT | |
| c5f8c67a | 34 | |
| 35 | BA = PING (reader -> tag) | |
| 36 | AB = PONG (tag -> reader) | |
| b67f7ec3 MHS |
37 | SRIX4K (tag does not respond to 05) |
| 38 | 06 00 = INITIATE | |
| 39 | 0E xx = SELECT ID (xx = Chip-ID) | |
| 40 | 0B = Get UID | |
| 41 | 08 yy = Read Block (yy = block number) | |
| 42 | 09 yy dd dd dd dd = Write Block (yy = block number; dd dd dd dd = data to be written) | |
| 43 | 0C = Reset to Inventory | |
| 44 | 0F = Completion | |
| 45 | 0A 11 22 33 44 55 66 = Authenticate (11 22 33 44 55 66 = data to authenticate) | |
| 46 | ||
| 47 | ||
| 48 | ISO15693 | |
| 49 | MANDATORY COMMANDS (all ISO15693 tags must support those) | |
| 50 | 01 = Inventory (usage: 260100+2bytes ISO15693-CRC - answer: 12bytes) | |
| 51 | 02 = Stay Quiet | |
| 52 | OPTIONAL COMMANDS (not all tags support them) | |
| 53 | 20 = Read Block (usage: 0220+1byte block number+2bytes ISO15693-CRC - answer: 4bytes) | |
| 54 | 21 = Write Block (usage: 0221+1byte block number+4bytes data+2bytes ISO15693-CRC - answer: 4bytes) | |
| 55 | 22 = Lock Block | |
| 56 | 23 = Read Multiple Blocks (usage: 0223+1byte 1st block to read+1byte last block to read+2bytes ISO15693-CRC) | |
| 57 | 25 = Select | |
| 58 | 26 = Reset to Ready | |
| 59 | 27 = Write AFI | |
| 60 | 28 = Lock AFI | |
| 61 | 29 = Write DSFID | |
| 62 | 2A = Lock DSFID | |
| 63 | 2B = Get_System_Info (usage: 022B+2bytes ISO15693-CRC - answer: 14 or more bytes) | |
| 64 | 2C = Read Multiple Block Security Status (usage: 022C+1byte 1st block security to read+1byte last block security to read+2bytes ISO15693-CRC) | |
| 65 | ||
| 66 | EM Microelectronic CUSTOM COMMANDS | |
| 67 | A5 = Active EAS (followed by 1byte IC Manufacturer code+1byte EAS type) | |
| 68 | A7 = Write EAS ID (followed by 1byte IC Manufacturer code+2bytes EAS value) | |
| 69 | B8 = Get Protection Status for a specific block (followed by 1byte IC Manufacturer code+1byte block number+1byte of how many blocks after the previous is needed the info) | |
| 70 | E4 = Login (followed by 1byte IC Manufacturer code+4bytes password) | |
| 71 | NXP/Philips CUSTOM COMMANDS | |
| 72 | A0 = Inventory Read | |
| 73 | A1 = Fast Inventory Read | |
| 74 | A2 = Set EAS | |
| 75 | A3 = Reset EAS | |
| 76 | A4 = Lock EAS | |
| 77 | A5 = EAS Alarm | |
| 78 | A6 = Password Protect EAS | |
| 79 | A7 = Write EAS ID | |
| 80 | A8 = Read EPC | |
| 81 | B0 = Inventory Page Read | |
| 82 | B1 = Fast Inventory Page Read | |
| 83 | B2 = Get Random Number | |
| 84 | B3 = Set Password | |
| 85 | B4 = Write Password | |
| 86 | B5 = Lock Password | |
| 87 | B6 = Bit Password Protection | |
| 88 | B7 = Lock Page Protection Condition | |
| 89 | B8 = Get Multiple Block Protection Status | |
| 90 | B9 = Destroy SLI | |
| 91 | BA = Enable Privacy | |
| 92 | BB = 64bit Password Protection | |
| 93 | 40 = Long Range CMD (Standard ISO/TR7003:1990) | |
| c5f8c67a | 94 | |
| 95 | ISO 7816-4 Basic interindustry commands. For command APDU's. | |
| 96 | B0 = READ BINARY | |
| 97 | D0 = WRITE BINARY | |
| 98 | D6 = UPDATE BINARY | |
| 99 | 0E = ERASE BINARY | |
| 100 | B2 = READ RECORDS | |
| 101 | D2 = WRITE RECORDS | |
| 102 | E2 = APPEND RECORD | |
| 103 | DC = UPDATE RECORD | |
| 104 | CA = GET DATA | |
| 105 | DA = PUT DATA | |
| 106 | A4 = SELECT FILE | |
| 107 | 20 = VERIFY | |
| 108 | 88 = INTERNAL AUTHENTICATION | |
| 109 | 82 = EXTERNAL AUTHENTICATION | |
| 110 | B4 = GET CHALLENGE | |
| 111 | 70 = MANAGE CHANNEL | |
| 112 | ||
| 113 | For response APDU's | |
| 114 | 90 00 = OK | |
| 115 | 6x xx = ERROR | |
| 116 | */ | |
| b67f7ec3 MHS |
117 | |
| 118 | #define ICLASS_CMD_ACTALL 0x0A | |
| 119 | #define ICLASS_CMD_READ_OR_IDENTIFY 0x0C | |
| 120 | #define ICLASS_CMD_SELECT 0x81 | |
| 121 | #define ICLASS_CMD_PAGESEL 0x84 | |
| 122 | #define ICLASS_CMD_READCHECK_KD 0x88 | |
| 123 | #define ICLASS_CMD_READCHECK_KC 0x18 | |
| 124 | #define ICLASS_CMD_CHECK 0x05 | |
| 125 | #define ICLASS_CMD_DETECT 0x0F | |
| 126 | #define ICLASS_CMD_HALT 0x00 | |
| 127 | #define ICLASS_CMD_UPDATE 0x87 | |
| 128 | #define ICLASS_CMD_ACT 0x8E | |
| 129 | #define ICLASS_CMD_READ4 0x06 | |
| 130 | ||
| 131 | ||
| 132 | #define ISO14443A_CMD_REQA 0x26 | |
| 133 | #define ISO14443A_CMD_READBLOCK 0x30 | |
| 134 | #define ISO14443A_CMD_WUPA 0x52 | |
| 135 | #define ISO14443A_CMD_ANTICOLL_OR_SELECT 0x93 | |
| 136 | #define ISO14443A_CMD_ANTICOLL_OR_SELECT_2 0x95 | |
| 2c39c25c | 137 | #define ISO14443A_CMD_WRITEBLOCK 0xA0 |
| b67f7ec3 MHS |
138 | #define ISO14443A_CMD_HALT 0x50 |
| 139 | #define ISO14443A_CMD_RATS 0xE0 | |
| 140 | ||
| 141 | #define MIFARE_AUTH_KEYA 0x60 | |
| 142 | #define MIFARE_AUTH_KEYB 0x61 | |
| 16a95d76 | 143 | #define MIFARE_MAGICWUPC1 0x40 |
| 144 | #define MIFARE_MAGICWUPC2 0x43 | |
| 145 | #define MIFARE_MAGICWIPEC 0x41 | |
| b67f7ec3 MHS |
146 | #define MIFARE_CMD_INC 0xC0 |
| 147 | #define MIFARE_CMD_DEC 0xC1 | |
| 148 | #define MIFARE_CMD_RESTORE 0xC2 | |
| 149 | #define MIFARE_CMD_TRANSFER 0xB0 | |
| 150 | ||
| e98572a1 | 151 | #define MIFARE_EV1_PERSONAL_UID 0x40 |
| 152 | #define MIFARE_EV1_SETMODE 0x43 | |
| 153 | ||
| 154 | ||
| a98b05b7 | 155 | #define MIFARE_ULC_WRITE 0xA2 |
| 156 | //#define MIFARE_ULC__COMP_WRITE 0xA0 | |
| b67f7ec3 | 157 | #define MIFARE_ULC_AUTH_1 0x1A |
| 11b1e2e5 | 158 | #define MIFARE_ULC_AUTH_2 0xAF |
| 7d010c49 | 159 | |
| 11b1e2e5 | 160 | #define MIFARE_ULEV1_AUTH 0x1B |
| 7d010c49 | 161 | #define MIFARE_ULEV1_VERSION 0x60 |
| 11b1e2e5 | 162 | #define MIFARE_ULEV1_FASTREAD 0x3A |
| 11b1e2e5 | 163 | #define MIFARE_ULEV1_READ_CNT 0x39 |
| 164 | #define MIFARE_ULEV1_INCR_CNT 0xA5 | |
| 165 | #define MIFARE_ULEV1_READSIG 0x3C | |
| 166 | #define MIFARE_ULEV1_CHECKTEAR 0x3E | |
| 167 | #define MIFARE_ULEV1_VCSL 0x4B | |
| b67f7ec3 | 168 | |
| e98572a1 | 169 | |
| c2731f37 | 170 | // Magic Generation 1, parameter "work flags" |
| 171 | // bit 0 - need get UID | |
| 172 | // bit 1 - send wupC (wakeup chinese) | |
| 173 | // bit 2 - send HALT cmd after sequence | |
| 174 | // bit 3 - turn on FPGA | |
| 175 | // bit 4 - turn off FPGA | |
| 176 | // bit 5 - set datain instead of issuing USB reply (called via ARM for StandAloneMode14a) | |
| 177 | #define MAGIC_UID 0x01 | |
| 178 | #define MAGIC_WUPC 0x02 | |
| 179 | #define MAGIC_HALT 0x04 | |
| 180 | #define MAGIC_INIT 0x08 | |
| 181 | #define MAGIC_OFF 0x10 | |
| 182 | #define MAGIC_DATAIN 0x20 | |
| 183 | #define MAGIC_WIPE 0x40 | |
| 184 | #define MAGIC_SINGLE (MAGIC_WUPC | MAGIC_HALT | MAGIC_INIT | MAGIC_OFF) //0x1E | |
| e98572a1 | 185 | |
| b67f7ec3 MHS |
186 | /** |
| 187 | 06 00 = INITIATE | |
| 188 | 0E xx = SELECT ID (xx = Chip-ID) | |
| 189 | 0B = Get UID | |
| 190 | 08 yy = Read Block (yy = block number) | |
| 191 | 09 yy dd dd dd dd = Write Block (yy = block number; dd dd dd dd = data to be written) | |
| 192 | 0C = Reset to Inventory | |
| 193 | 0F = Completion | |
| 194 | 0A 11 22 33 44 55 66 = Authenticate (11 22 33 44 55 66 = data to authenticate) | |
| 195 | **/ | |
| 196 | ||
| 197 | #define ISO14443B_REQB 0x05 | |
| 198 | #define ISO14443B_ATTRIB 0x1D | |
| 199 | #define ISO14443B_HALT 0x50 | |
| 200 | #define ISO14443B_INITIATE 0x06 | |
| 201 | #define ISO14443B_SELECT 0x0E | |
| 202 | #define ISO14443B_GET_UID 0x0B | |
| 203 | #define ISO14443B_READ_BLK 0x08 | |
| 204 | #define ISO14443B_WRITE_BLK 0x09 | |
| 205 | #define ISO14443B_RESET 0x0C | |
| 206 | #define ISO14443B_COMPLETION 0x0F | |
| 207 | #define ISO14443B_AUTHENTICATE 0x0A | |
| c5f8c67a | 208 | #define ISO14443B_PING 0xBA |
| 209 | #define ISO14443B_PONG 0xAB | |
| b67f7ec3 MHS |
210 | |
| 211 | //First byte is 26 | |
| 212 | #define ISO15693_INVENTORY 0x01 | |
| 213 | #define ISO15693_STAYQUIET 0x02 | |
| 214 | //First byte is 02 | |
| 215 | #define ISO15693_READBLOCK 0x20 | |
| 216 | #define ISO15693_WRITEBLOCK 0x21 | |
| 217 | #define ISO15693_LOCKBLOCK 0x22 | |
| 218 | #define ISO15693_READ_MULTI_BLOCK 0x23 | |
| 219 | #define ISO15693_SELECT 0x25 | |
| 220 | #define ISO15693_RESET_TO_READY 0x26 | |
| 221 | #define ISO15693_WRITE_AFI 0x27 | |
| 222 | #define ISO15693_LOCK_AFI 0x28 | |
| 223 | #define ISO15693_WRITE_DSFID 0x29 | |
| 224 | #define ISO15693_LOCK_DSFID 0x2A | |
| 225 | #define ISO15693_GET_SYSTEM_INFO 0x2B | |
| 226 | #define ISO15693_READ_MULTI_SECSTATUS 0x2C | |
| 227 | ||
| 228 | ||
| 0ec548dc | 229 | // Topaz command set: |
| 230 | #define TOPAZ_REQA 0x26 // Request | |
| 231 | #define TOPAZ_WUPA 0x52 // WakeUp | |
| 232 | #define TOPAZ_RID 0x78 // Read ID | |
| 233 | #define TOPAZ_RALL 0x00 // Read All (all bytes) | |
| 234 | #define TOPAZ_READ 0x01 // Read (a single byte) | |
| 235 | #define TOPAZ_WRITE_E 0x53 // Write-with-erase (a single byte) | |
| 236 | #define TOPAZ_WRITE_NE 0x1a // Write-no-erase (a single byte) | |
| 237 | // additional commands for Dynamic Memory Model | |
| 238 | #define TOPAZ_RSEG 0x10 // Read segment | |
| 239 | #define TOPAZ_READ8 0x02 // Read (eight bytes) | |
| 240 | #define TOPAZ_WRITE_E8 0x54 // Write-with-erase (eight bytes) | |
| 241 | #define TOPAZ_WRITE_NE8 0x1B // Write-no-erase (eight bytes) | |
| 242 | ||
| 243 | ||
| c5f8c67a | 244 | #define ISO_14443A 0 |
| 245 | #define ICLASS 1 | |
| 246 | #define ISO_14443B 2 | |
| 0ec548dc | 247 | #define TOPAZ 3 |
| c5f8c67a | 248 | #define ISO_7816_4 4 |
| b67f7ec3 | 249 | |
| 1defcf60 MHS |
250 | //-- Picopass fuses |
| 251 | #define FUSE_FPERS 0x80 | |
| 252 | #define FUSE_CODING1 0x40 | |
| 253 | #define FUSE_CODING0 0x20 | |
| 254 | #define FUSE_CRYPT1 0x10 | |
| 255 | #define FUSE_CRYPT0 0x08 | |
| 256 | #define FUSE_FPROD1 0x04 | |
| 257 | #define FUSE_FPROD0 0x02 | |
| 258 | #define FUSE_RA 0x01 | |
| 259 | ||
| c5f8c67a | 260 | // ISO 7816-4 Basic interindustry commands. For command APDU's. |
| 261 | #define ISO7816_READ_BINARY 0xB0 | |
| 262 | #define ISO7816_WRITE_BINARY 0xD0 | |
| 263 | #define ISO7816_UPDATE_BINARY 0xD6 | |
| 264 | #define ISO7816_ERASE_BINARY 0x0E | |
| 265 | #define ISO7816_READ_RECORDS 0xB2 | |
| 266 | #define ISO7816_WRITE_RECORDS 0xD2 | |
| 267 | #define ISO7816_APPEND_RECORD 0xE2 | |
| 268 | #define ISO7816_UPDATE_RECORD 0xDC | |
| 269 | #define ISO7816_GET_DATA 0xCA | |
| 270 | #define ISO7816_PUT_DATA 0xDA | |
| 271 | #define ISO7816_SELECT_FILE 0xA4 | |
| 272 | #define ISO7816_VERIFY 0x20 | |
| 273 | #define ISO7816_INTERNAL_AUTHENTICATION 0x88 | |
| 274 | #define ISO7816_EXTERNAL_AUTHENTICATION 0x82 | |
| 275 | #define ISO7816_GET_CHALLENGE 0xB4 | |
| 276 | #define ISO7816_MANAGE_CHANNEL 0x70 | |
| 1defcf60 | 277 | |
| c5f8c67a | 278 | // ISO7816-4 For response APDU's |
| 279 | #define ISO7816_OK 0x9000 | |
| 280 | // 6x xx = ERROR | |
| 281 | ||
| 1defcf60 | 282 | void printIclassDumpInfo(uint8_t* iclass_dump); |
| e98572a1 | 283 | void getMemConfig(uint8_t mem_cfg, uint8_t chip_cfg, uint8_t *max_blk, uint8_t *app_areas, uint8_t *kb); |
| b67f7ec3 | 284 | |
| 1d0ccbe0 | 285 | /* T55x7 configuration register definitions */ |
| 857bc2ff | 286 | #define T55x7_POR_DELAY 0x00000001 |
| 287 | #define T55x7_ST_TERMINATOR 0x00000008 | |
| 288 | #define T55x7_PWD 0x00000010 | |
| 1d0ccbe0 | 289 | #define T55x7_MAXBLOCK_SHIFT 5 |
| 857bc2ff | 290 | #define T55x7_AOR 0x00000200 |
| 291 | #define T55x7_PSKCF_RF_2 0 | |
| 292 | #define T55x7_PSKCF_RF_4 0x00000400 | |
| 293 | #define T55x7_PSKCF_RF_8 0x00000800 | |
| 1d0ccbe0 | 294 | #define T55x7_MODULATION_DIRECT 0 |
| 295 | #define T55x7_MODULATION_PSK1 0x00001000 | |
| 296 | #define T55x7_MODULATION_PSK2 0x00002000 | |
| 297 | #define T55x7_MODULATION_PSK3 0x00003000 | |
| 298 | #define T55x7_MODULATION_FSK1 0x00004000 | |
| 299 | #define T55x7_MODULATION_FSK2 0x00005000 | |
| 300 | #define T55x7_MODULATION_FSK1a 0x00006000 | |
| 301 | #define T55x7_MODULATION_FSK2a 0x00007000 | |
| 302 | #define T55x7_MODULATION_MANCHESTER 0x00008000 | |
| 303 | #define T55x7_MODULATION_BIPHASE 0x00010000 | |
| 304 | #define T55x7_MODULATION_DIPHASE 0x00018000 | |
| 857bc2ff | 305 | #define T55x7_BITRATE_RF_8 0 |
| 306 | #define T55x7_BITRATE_RF_16 0x00040000 | |
| 307 | #define T55x7_BITRATE_RF_32 0x00080000 | |
| 308 | #define T55x7_BITRATE_RF_40 0x000C0000 | |
| 309 | #define T55x7_BITRATE_RF_50 0x00100000 | |
| 310 | #define T55x7_BITRATE_RF_64 0x00140000 | |
| 1d0ccbe0 | 311 | #define T55x7_BITRATE_RF_100 0x00180000 |
| 312 | #define T55x7_BITRATE_RF_128 0x001C0000 | |
| 313 | ||
| 314 | /* T5555 (Q5) configuration register definitions */ | |
| 857bc2ff | 315 | #define T5555_ST_TERMINATOR 0x00000001 |
| 1d0ccbe0 | 316 | #define T5555_MAXBLOCK_SHIFT 0x00000001 |
| 317 | #define T5555_MODULATION_MANCHESTER 0 | |
| 318 | #define T5555_MODULATION_PSK1 0x00000010 | |
| 319 | #define T5555_MODULATION_PSK2 0x00000020 | |
| 320 | #define T5555_MODULATION_PSK3 0x00000030 | |
| 321 | #define T5555_MODULATION_FSK1 0x00000040 | |
| 322 | #define T5555_MODULATION_FSK2 0x00000050 | |
| 323 | #define T5555_MODULATION_BIPHASE 0x00000060 | |
| 324 | #define T5555_MODULATION_DIRECT 0x00000070 | |
| 857bc2ff | 325 | #define T5555_INVERT_OUTPUT 0x00000080 |
| 326 | #define T5555_PSK_RF_2 0 | |
| 327 | #define T5555_PSK_RF_4 0x00000100 | |
| 328 | #define T5555_PSK_RF_8 0x00000200 | |
| 329 | #define T5555_USE_PWD 0x00000400 | |
| 330 | #define T5555_USE_AOR 0x00000800 | |
| c2731f37 | 331 | #define T5555_BITRATE_SHIFT 12 //(RF=2n+2) ie 64=2*0x1F+2 or n = (RF-2)/2 |
| 857bc2ff | 332 | #define T5555_FAST_WRITE 0x00004000 |
| 333 | #define T5555_PAGE_SELECT 0x00008000 | |
| 1d0ccbe0 | 334 | |
| 335 | uint32_t GetT55xxClockBit(uint32_t clock); | |
| 336 | ||
| 337 | #endif | |
| 338 | // PROTOCOLS_H |