]> cvs.zerfleddert.de Git - proxmark3-svn/blame - client/cmdhftopaz.c
Merge branch 'master' into topaz
[proxmark3-svn] / client / cmdhftopaz.c
CommitLineData
05ddb52c 1//-----------------------------------------------------------------------------
2// Copyright (C) 2015 Piwi
3//
4// This code is licensed to you under the terms of the GNU GPL, version 2 or,
5// at your option, any later version. See the LICENSE.txt file for the text of
6// the license.
7//-----------------------------------------------------------------------------
8// High frequency Topaz (NFC Type 1) commands
9//-----------------------------------------------------------------------------
10
11#include <stdio.h>
12#include <stdlib.h>
13#include <string.h>
14#include <unistd.h>
15#include "cmdmain.h"
16#include "cmdparser.h"
17#include "cmdhftopaz.h"
18#include "cmdhf14a.h"
19#include "ui.h"
48ece4a7 20#include "mifare.h"
21#include "proxmark3.h"
22#include "iso14443crc.h"
23#include "protocols.h"
24
6e6f1099 25#define TOPAZ_STATIC_MEMORY (0x0f * 8)
26
27typedef struct dynamic_lock_area {
28 struct dynamic_lock_area *next;
29 uint16_t byte_offset;
30 uint16_t size_in_bits;
31 uint16_t first_locked_byte;
32 uint16_t bytes_locked_per_bit;
33} dynamic_lock_area_t;
34
48ece4a7 35
c5847ae8 36static struct {
37 uint8_t HR01[2];
38 uint8_t uid[7];
39 uint8_t size;
6e6f1099 40 uint8_t data_blocks[TOPAZ_STATIC_MEMORY/8][8];
41 dynamic_lock_area_t *dynamic_lock_areas;
c5847ae8 42 uint8_t *dynamic_reserved_areas;
6e6f1099 43 uint8_t *dynamic_memory;
c5847ae8 44} topaz_tag;
48ece4a7 45
de15fc5f 46
48ece4a7 47static void topaz_switch_on_field(void)
48{
49 UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT | ISO14A_NO_SELECT | ISO14A_NO_DISCONNECT | ISO14A_TOPAZMODE, 0, 0}};
50 SendCommand(&c);
48ece4a7 51}
52
53
54static void topaz_switch_off_field(void)
55{
56 UsbCommand c = {CMD_READER_ISO_14443a, {0, 0, 0}};
57 SendCommand(&c);
48ece4a7 58}
59
60
de15fc5f 61static int topaz_send_cmd_raw(uint8_t *cmd, uint8_t len, uint8_t *response)
48ece4a7 62{
63 UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_RAW | ISO14A_NO_DISCONNECT | ISO14A_TOPAZMODE, len, 0}};
64 memcpy(c.d.asBytes, cmd, len);
65 SendCommand(&c);
66
67 UsbCommand resp;
68 WaitForResponse(CMD_ACK, &resp);
69
de15fc5f 70 if (resp.arg[0] > 0) {
71 memcpy(response, resp.d.asBytes, resp.arg[0]);
72 }
73
74 return resp.arg[0];
48ece4a7 75}
76
77
de15fc5f 78static int topaz_send_cmd(uint8_t *cmd, uint8_t len, uint8_t *response)
48ece4a7 79{
80 if (len > 1) {
81 uint8_t first, second;
de15fc5f 82 ComputeCrc14443(CRC_14443_B, cmd, len-2, &first, &second);
83 cmd[len-2] = first;
84 cmd[len-1] = second;
48ece4a7 85 }
86
de15fc5f 87 return topaz_send_cmd_raw(cmd, len, response);
48ece4a7 88}
89
90
de15fc5f 91static int topaz_select(uint8_t *atqa, uint8_t *rid_response)
48ece4a7 92{
93 // ToDo: implement anticollision
de15fc5f 94
48ece4a7 95 uint8_t wupa_cmd[] = {TOPAZ_WUPA};
de15fc5f 96 uint8_t rid_cmd[] = {TOPAZ_RID, 0, 0, 0, 0, 0, 0, 0, 0};
97
48ece4a7 98 topaz_switch_on_field();
de15fc5f 99
100 if (!topaz_send_cmd(wupa_cmd, sizeof(wupa_cmd), atqa)) {
101 topaz_switch_off_field();
102 return -1; // WUPA failed
103 }
104
105 if (!topaz_send_cmd(rid_cmd, sizeof(rid_cmd), rid_response)) {
106 topaz_switch_off_field();
107 return -2; // RID failed
108 }
109
110 return 0; // OK
111}
112
113
c5847ae8 114static int topaz_rall(uint8_t *uid, uint8_t *response)
de15fc5f 115{
116 uint8_t rall_cmd[] = {TOPAZ_RALL, 0, 0, 0, 0, 0, 0, 0, 0};
117
118 memcpy(&rall_cmd[3], uid, 4);
c5847ae8 119 if (!topaz_send_cmd(rall_cmd, sizeof(rall_cmd), response)) {
de15fc5f 120 topaz_switch_off_field();
121 return -1; // RALL failed
122 }
123
124 return 0;
48ece4a7 125}
126
05ddb52c 127
6e6f1099 128static dynamic_lock_area_t *get_dynamic_lock_area(uint16_t byteno)
129{
130 dynamic_lock_area_t *lock_area;
131
132 lock_area = topaz_tag.dynamic_lock_areas;
133
134 while (lock_area != NULL) {
135 if (byteno < lock_area->first_locked_byte) {
136 lock_area = lock_area->next;
137 } else {
138 return lock_area;
139 }
140 }
141
142 return NULL;
143}
144
145
146// check if a memory block (8 Bytes) is locked.
147// TODO: support other sizes of locked_bytes_per_bit (current assumption: each lock bit locks 8 Bytes)
148static bool topaz_byte_is_locked(uint16_t byteno)
de15fc5f 149{
6e6f1099 150 uint8_t *lockbits;
151 uint16_t locked_bytes_per_bit;
152 dynamic_lock_area_t *lock_area;
153
154 if (byteno < TOPAZ_STATIC_MEMORY) {
155 lockbits = &topaz_tag.data_blocks[0x0e][0];
156 locked_bytes_per_bit = 8;
157 } else {
158 lock_area = get_dynamic_lock_area(byteno);
159 if (lock_area == NULL) {
160 return false;
161 }
162 locked_bytes_per_bit = lock_area->bytes_locked_per_bit;
163 byteno = byteno - lock_area->first_locked_byte;
164 lockbits = &topaz_tag.dynamic_memory[lock_area->byte_offset - TOPAZ_STATIC_MEMORY];
165 }
166
167 uint16_t blockno = byteno / locked_bytes_per_bit;
de15fc5f 168 if(lockbits[blockno/8] >> (blockno % 8) & 0x01) {
169 return true;
170 } else {
171 return false;
172 }
173}
174
175
176static int topaz_print_CC(uint8_t *data)
177{
178 if(data[0] != 0xe1) {
179 return -1; // no NDEF message
180 }
181
182 PrintAndLog("Capability Container: %02x %02x %02x %02x", data[0], data[1], data[2], data[3]);
183 PrintAndLog(" %02x: NDEF Magic Number", data[0]);
184 PrintAndLog(" %02x: version %d.%d supported by tag", data[1], (data[1] & 0xF0) >> 4, data[1] & 0x0f);
6e6f1099 185 uint16_t memsize = (data[2] + 1) * 8;
186 topaz_tag.dynamic_memory = malloc(memsize - TOPAZ_STATIC_MEMORY);
187 PrintAndLog(" %02x: Physical Memory Size of this tag: %d bytes", data[2], memsize);
de15fc5f 188 PrintAndLog(" %02x: %s / %s", data[3],
189 (data[3] & 0xF0) ? "(RFU)" : "Read access granted without any security",
190 (data[3] & 0x0F)==0 ? "Write access granted without any security" : (data[3] & 0x0F)==0x0F ? "No write access granted at all" : "(RFU)");
191 return 0;
192}
193
194
195static void get_TLV(uint8_t **TLV_ptr, uint8_t *tag, uint16_t *length, uint8_t **value)
196{
197 *length = 0;
198 *value = NULL;
199
200 *tag = **TLV_ptr;
201 *TLV_ptr += 1;
202 switch (*tag) {
203 case 0x00: // NULL TLV.
204 case 0xFE: // Terminator TLV.
205 break;
206 case 0x01: // Lock Control TLV
207 case 0x02: // Reserved Memory TLV
208 case 0x03: // NDEF message TLV
209 case 0xFD: // proprietary TLV
210 *length = **TLV_ptr;
211 *TLV_ptr += 1;
212 if (*length == 0xff) {
213 *length = **TLV_ptr << 8;
214 *TLV_ptr += 1;
215 *length |= **TLV_ptr;
216 *TLV_ptr += 1;
217 }
218 *value = *TLV_ptr;
219 *TLV_ptr += *length;
220 break;
221 default: // RFU
222 break;
223 }
224}
225
226
227static bool topaz_print_lock_control_TLVs(uint8_t *memory)
228{
229 uint8_t *TLV_ptr = memory;
230 uint8_t tag = 0;
231 uint16_t length;
232 uint8_t *value;
233 bool lock_TLV_present = false;
6e6f1099 234 uint16_t first_locked_byte = 0x0f * 8;
de15fc5f 235
236 while(*TLV_ptr != 0x03 && *TLV_ptr != 0xFD && *TLV_ptr != 0xFE) {
237 // all Lock Control TLVs shall be present before the NDEF message TLV, the proprietary TLV (and the Terminator TLV)
238 get_TLV(&TLV_ptr, &tag, &length, &value);
239 if (tag == 0x01) { // the Lock Control TLV
240 uint8_t pages_addr = value[0] >> 4;
241 uint8_t byte_offset = value[0] & 0x0f;
6e6f1099 242 uint16_t size_in_bits = value[1] ? value[1] : 256;
243 uint16_t bytes_per_page = 1 << (value[2] & 0x0f);
244 uint16_t bytes_locked_per_bit = 1 << (value[2] >> 4);
245 PrintAndLog("Lock Area of %d bits at byte offset 0x%04x. Each Lock Bit locks %d bytes.",
de15fc5f 246 size_in_bits,
247 pages_addr * bytes_per_page + byte_offset,
248 bytes_locked_per_bit);
249 lock_TLV_present = true;
6e6f1099 250 dynamic_lock_area_t *old = topaz_tag.dynamic_lock_areas;
251 dynamic_lock_area_t *new = topaz_tag.dynamic_lock_areas;
252 if (old == NULL) {
253 new = topaz_tag.dynamic_lock_areas = (dynamic_lock_area_t *)malloc(sizeof(dynamic_lock_area_t));
254 } else {
255 while(old->next != NULL) {
256 old = old->next;
257 }
258 new = old->next = (dynamic_lock_area_t *)malloc(sizeof(dynamic_lock_area_t));
259 }
260 new->next = NULL;
261 new->first_locked_byte = first_locked_byte;
262 new->byte_offset = pages_addr * bytes_per_page + byte_offset;
263 new->size_in_bits = size_in_bits;
264 new->bytes_locked_per_bit = bytes_locked_per_bit;
265 first_locked_byte = first_locked_byte + size_in_bits*bytes_locked_per_bit;
de15fc5f 266 }
267 }
268
269 if (!lock_TLV_present) {
270 PrintAndLog("(No Lock Control TLV present)");
271 return -1;
272 } else {
273 return 0;
274 }
275}
276
277
278static int topaz_print_reserved_memory_control_TLVs(uint8_t *memory)
279{
280 uint8_t *TLV_ptr = memory;
281 uint8_t tag = 0;
282 uint16_t length;
283 uint8_t *value;
284 bool reserved_memory_control_TLV_present = false;
285
286 while(*TLV_ptr != 0x03 && *TLV_ptr != 0xFD && *TLV_ptr != 0xFE) {
287 // all Reserved Memory Control TLVs shall be present before the NDEF message TLV, the proprietary TLV (and the Terminator TLV)
288 get_TLV(&TLV_ptr, &tag, &length, &value);
289 if (tag == 0x02) { // the Reserved Memory Control TLV
290 uint8_t pages_addr = value[0] >> 4;
291 uint8_t byte_offset = value[0] & 0x0f;
292 uint8_t size_in_bytes = value[1] ? value[1] : 256;
293 uint8_t bytes_per_page = 1 << (value[2] & 0x0f);
294 PrintAndLog("Reserved Memory of %d bytes at byte offset 0x%02x.",
295 size_in_bytes,
296 pages_addr * bytes_per_page + byte_offset);
297 reserved_memory_control_TLV_present = true;
298 }
299 }
300
301 if (!reserved_memory_control_TLV_present) {
302 PrintAndLog("(No Reserved Memory Control TLV present)");
303 return -1;
304 } else {
305 return 0;
306 }
307}
308
309
310static void topaz_print_lifecycle_state(uint8_t *data)
311{
312
313}
314
315
316static void topaz_print_NDEF(uint8_t *data)
317{
318
319}
320
321
05ddb52c 322int CmdHFTopazReader(const char *Cmd)
323{
de15fc5f 324 int status;
325 uint8_t atqa[2];
326 uint8_t rid_response[8];
327 uint8_t *uid_echo = &rid_response[2];
c5847ae8 328 uint8_t rall_response[124];
de15fc5f 329
330 status = topaz_select(atqa, rid_response);
331
332 if (status == -1) {
333 PrintAndLog("Error: couldn't receive ATQA");
334 return -1;
335 }
336
337 PrintAndLog("ATQA : %02x %02x", atqa[1], atqa[0]);
338 if (atqa[1] != 0x0c && atqa[0] != 0x00) {
339 PrintAndLog("Tag doesn't support the Topaz protocol.");
340 topaz_switch_off_field();
341 return -1;
342 }
343
344 if (status == -2) {
345 PrintAndLog("Error: tag didn't answer to RID");
346 topaz_switch_off_field();
347 return -1;
348 }
349
c5847ae8 350 topaz_tag.HR01[0] = rid_response[0];
351 topaz_tag.HR01[1] = rid_response[1];
352
de15fc5f 353 // ToDo: CRC check
354 PrintAndLog("HR0 : %02x (%sa Topaz tag (%scapable of carrying a NDEF message), %s memory map)", rid_response[0],
355 (rid_response[0] & 0xF0) == 0x10 ? "" : "not ",
356 (rid_response[0] & 0xF0) == 0x10 ? "" : "not ",
357 (rid_response[0] & 0x0F) == 0x10 ? "static" : "dynamic");
358 PrintAndLog("HR1 : %02x", rid_response[1]);
359
c5847ae8 360 status = topaz_rall(uid_echo, rall_response);
de15fc5f 361
362 if(status == -1) {
363 PrintAndLog("Error: tag didn't answer to RALL");
364 topaz_switch_off_field();
365 return -1;
366 }
367
c5847ae8 368 memcpy(topaz_tag.uid, rall_response+2, 7);
de15fc5f 369 PrintAndLog("UID : %02x %02x %02x %02x %02x %02x %02x",
c5847ae8 370 topaz_tag.uid[6],
371 topaz_tag.uid[5],
372 topaz_tag.uid[4],
373 topaz_tag.uid[3],
374 topaz_tag.uid[2],
375 topaz_tag.uid[1],
376 topaz_tag.uid[0]);
de15fc5f 377 PrintAndLog(" UID[6] (Manufacturer Byte) = %02x, Manufacturer: %s",
c5847ae8 378 topaz_tag.uid[6],
379 getTagInfo(topaz_tag.uid[6]));
380
381 memcpy(topaz_tag.data_blocks, rall_response+2, 0x10*8);
de15fc5f 382 PrintAndLog("");
383 PrintAndLog("Static Data blocks 00 to 0c:");
6e6f1099 384 PrintAndLog("block# | offset | Data | Locked(y/n)");
de15fc5f 385 char line[80];
386 for (uint16_t i = 0; i <= 0x0c; i++) {
387 for (uint16_t j = 0; j < 8; j++) {
c5847ae8 388 sprintf(&line[3*j], "%02x ", topaz_tag.data_blocks[i][j] /*rall_response[2 + 8*i + j]*/);
de15fc5f 389 }
6e6f1099 390 PrintAndLog(" 0x%02x | 0x%04x | %s| %-3s", i, i*8, line, topaz_byte_is_locked(i*8) ? "yyyyyyyy" : "nnnnnnnn");
de15fc5f 391 }
392
393 PrintAndLog("");
394 PrintAndLog("Static Reserved block 0d:");
395 for (uint16_t j = 0; j < 8; j++) {
c5847ae8 396 sprintf(&line[3*j], "%02x ", topaz_tag.data_blocks[0x0d][j]);
de15fc5f 397 }
6e6f1099 398 PrintAndLog(" 0x%02x | 0x%04x | %s| %-3s", 0x0d, 0x0d*8, line, "n/a");
de15fc5f 399
400 PrintAndLog("");
c5847ae8 401 PrintAndLog("Static Lockbits and OTP Bytes:");
de15fc5f 402 for (uint16_t j = 0; j < 8; j++) {
c5847ae8 403 sprintf(&line[3*j], "%02x ", topaz_tag.data_blocks[0x0e][j]);
de15fc5f 404 }
6e6f1099 405 PrintAndLog(" 0x%02x | 0x%04x | %s| %-3s", 0x0e, 0x0e*8, line, "n/a");
de15fc5f 406
407 PrintAndLog("");
408
c5847ae8 409 status = topaz_print_CC(&topaz_tag.data_blocks[1][0]);
de15fc5f 410
411 if (status == -1) {
412 PrintAndLog("No NDEF message present");
413 topaz_switch_off_field();
414 return 0;
415 }
416
417 PrintAndLog("");
c5847ae8 418 bool lock_TLV_present = topaz_print_lock_control_TLVs(&topaz_tag.data_blocks[1][4]);
de15fc5f 419
420 PrintAndLog("");
c5847ae8 421 bool reserved_mem_present = topaz_print_reserved_memory_control_TLVs(&topaz_tag.data_blocks[1][4]);
de15fc5f 422
c5847ae8 423 topaz_print_lifecycle_state(&topaz_tag.data_blocks[1][0]);
de15fc5f 424
c5847ae8 425 topaz_print_NDEF(&topaz_tag.data_blocks[1][0]);
de15fc5f 426
427 topaz_switch_off_field();
05ddb52c 428 return 0;
429}
430
431
432int CmdHFTopazSim(const char *Cmd)
433{
434 PrintAndLog("not yet implemented");
435 return 0;
436}
437
438
439int CmdHFTopazCmdRaw(const char *Cmd)
440{
441 PrintAndLog("not yet implemented");
442 return 0;
443}
444
445
446static int CmdHelp(const char *Cmd);
447
448
449static command_t CommandTable[] =
450{
451 {"help", CmdHelp, 1, "This help"},
452 {"reader", CmdHFTopazReader, 0, "Act like a Topaz reader"},
453 {"sim", CmdHFTopazSim, 0, "<UID> -- Simulate Topaz tag"},
454 {"snoop", CmdHF14ASnoop, 0, "Eavesdrop a Topaz reader-tag communication"},
455 {"raw", CmdHFTopazCmdRaw, 0, "Send raw hex data to tag"},
456 {NULL, NULL, 0, NULL}
457};
458
459
460int CmdHFTopaz(const char *Cmd) {
461 // flush
462 WaitForResponseTimeout(CMD_ACK,NULL,100);
463
464 // parse
465 CmdsParse(CommandTable, Cmd);
466 return 0;
467}
468
469static int CmdHelp(const char *Cmd)
470{
471 CmdsHelp(CommandTable);
472 return 0;
473}
474
475
Impressum, Datenschutz