projects / proxmark3-svn / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
en4rab fixed the 'data samples' command
[proxmark3-svn] / client / cmdhf15.c
CommitLineData
a553f267 1//-----------------------------------------------------------------------------
2// Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
0546b4aa 3// Modified 2010-2012 by <adrian -at- atrox.at>
65a23af2 4// Modified 2012 by <vsza at vsza.hu>
a553f267 5//
6// This code is licensed to you under the terms of the GNU GPL, version 2 or,
7// at your option, any later version. See the LICENSE.txt file for the text of
8// the license.
9//-----------------------------------------------------------------------------
10// High frequency ISO15693 commands
11//-----------------------------------------------------------------------------
9455b51c 12// There are three basic operation modes, depending on which device (proxmark/pc)
13// the signal processing, (de)modulation, transmission protocol and logic is done.
14// Mode 1:
15// All steps are done on the proxmark, the output of the commands is returned via
16// USB-debug-print commands.
17// Mode 2:
18// The protocol is done on the PC, passing only Iso15693 data frames via USB. This
19// allows direct communication with a tag on command level
20// Mode 3:
21// The proxmark just samples the antenna and passes this "analog" data via USB to
22// the client. Signal Processing & decoding is done on the pc. This is the slowest
23// variant, but offers the possibility to analyze the waveforms directly.
a553f267 24
7fe9b0b7 25#include <stdio.h>
26#include <stdlib.h>
27#include <string.h>
28#include <stdint.h>
28fdb04f 29//#include "proxusb.h"
902cb3c0 30#include "proxmark3.h"
7fe9b0b7 31#include "data.h"
32#include "graph.h"
33#include "ui.h"
34#include "cmdparser.h"
35#include "cmdhf15.h"
9455b51c 36#include "iso15693tools.h"
37#include "cmdmain.h"
38
39#define FrameSOF Iso15693FrameSOF
40#define Logic0 Iso15693Logic0
41#define Logic1 Iso15693Logic1
42#define FrameEOF Iso15693FrameEOF
43
44#define Crc(data,datalen) Iso15693Crc(data,datalen)
45#define AddCrc(data,datalen) Iso15693AddCrc(data,datalen)
46#define sprintUID(target,uid) Iso15693sprintUID(target,uid)
7fe9b0b7 47
48static int CmdHelp(const char *Cmd);
49
9455b51c 50// structure and database for uid -> tagtype lookups
51typedef struct {
52 uint64_t uid;
53 int mask; // how many MSB bits used
54 char* desc;
55} productName;
56
57
58const productName uidmapping[] = {
0546b4aa 59 // UID, #significant Bits, "Vendor(+Product)"
c71e7235 60 { 0xE001000000000000LL, 16, "Motorola" },
61 { 0xE002000000000000LL, 16, "ST Microelectronics" },
62 { 0xE003000000000000LL, 16, "Hitachi" },
63 { 0xE004000000000000LL, 16, "Philips" },
64 { 0xE004010000000000LL, 24, "Philips; IC SL2 ICS20" },
65 { 0xE005000000000000LL, 16, "Infineon" },
66 { 0xE005400000000000LL, 24, "Infineon; 56x32bit" },
67 { 0xE006000000000000LL, 16, "Cylinc" },
9455b51c 68 { 0xE007000000000000LL, 16, "Texas Instrument; " },
69 { 0xE007000000000000LL, 20, "Texas Instrument; Tag-it HF-I Plus Inlay; 64x32bit" },
70 { 0xE007100000000000LL, 20, "Texas Instrument; Tag-it HF-I Plus Chip; 64x32bit" },
0546b4aa 71 { 0xE007800000000000LL, 23, "Texas Instrument; Tag-it HF-I Plus (RF-HDT-DVBB tag or Third Party Products)" },
9455b51c 72 { 0xE007C00000000000LL, 23, "Texas Instrument; Tag-it HF-I Standard; 8x32bit" },
73 { 0xE007C40000000000LL, 23, "Texas Instrument; Tag-it HF-I Pro; 8x23bit; password" },
c71e7235 74 { 0xE008000000000000LL, 16, "Fujitsu" },
75 { 0xE009000000000000LL, 16, "Matsushita" },
76 { 0xE00A000000000000LL, 16, "NEC" },
77 { 0xE00B000000000000LL, 16, "Oki Electric" },
78 { 0xE00C000000000000LL, 16, "Toshiba" },
79 { 0xE00D000000000000LL, 16, "Mitsubishi" },
80 { 0xE00E000000000000LL, 16, "Samsung" },
81 { 0xE00F000000000000LL, 16, "Hyundai" },
82 { 0xE010000000000000LL, 16, "LG-Semiconductors" },
83 { 0xE012000000000000LL, 16, "HID Corporation" },
9455b51c 84 { 0xE016000000000000LL, 16, "EM-Marin SA (Skidata)" },
0546b4aa 85 { 0xE016040000000000LL, 24, "EM-Marin SA (Skidata Keycard-eco); EM4034? no 'read', just 'readmulti'" },
86 { 0xE0160c0000000000LL, 24, "EM-Marin SA; EM4035?" },
9455b51c 87 { 0xE016100000000000LL, 24, "EM-Marin SA (Skidata); EM4135; 36x64bit start page 13" },
0546b4aa 88 { 0xE016940000000000LL, 24, "EM-Marin SA (Skidata); 51x64bit" },
9455b51c 89 { 0,0,"no tag-info available" } // must be the last entry
90};
91
92
e4da8ed0 93// fast method to just read the UID of a tag (collission detection not supported)
94// *buf should be large enough to fit the 64bit uid
9455b51c 95// returns 1 if suceeded
96int getUID(uint8_t *buf)
7fe9b0b7 97{
902cb3c0 98 UsbCommand resp;
9455b51c 99 uint8_t *recv;
100 UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv?
101 uint8_t *req=c.d.asBytes;
102 int reqlen=0;
103
104 for (int retry=0;retry<3; retry++) { // don't give up the at the first try
105
106 req[0]= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
107 ISO15_REQ_INVENTORY | ISO15_REQINV_SLOT1;
108 req[1]=ISO15_CMD_INVENTORY;
109 req[2]=0; // mask length
110 reqlen=AddCrc(req,3);
111 c.arg[0]=reqlen;
112
113 SendCommand(&c);
114
902cb3c0 115 if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
116 recv = resp.d.asBytes;
117 if (resp.arg[0]>=12 && ISO15_CRC_CHECK==Crc(recv,12)) {
9455b51c 118 memcpy(buf,&recv[2],8);
119 return 1;
120 }
121 }
122 } // retry
123 return 0;
124}
125
126
7fe9b0b7 127
9455b51c 128// get a product description based on the UID
129// uid[8] tag uid
130// returns description of the best match
131static char* getTagInfo(uint8_t *uid) {
31b6e9af 132 uint64_t myuid,mask;
9455b51c 133 int i=0, best=-1;
134 memcpy(&myuid,uid,sizeof(uint64_t));
135 while (uidmapping[i].mask>0) {
136 mask=(~0LL) <<(64-uidmapping[i].mask);
137 if ((myuid & mask) == uidmapping[i].uid) {
138 if (best==-1) {
139 best=i;
140 } else {
141 if (uidmapping[i].mask>uidmapping[best].mask) {
142 best=i;
143 }
144 }
145 }
146 i++;
147 }
7fe9b0b7 148
9455b51c 149 if (best>=0) return uidmapping[best].desc;
150
151 return uidmapping[i].desc;
7fe9b0b7 152}
153
9455b51c 154
b4a9d841 155// return a clear-text message to an errorcode
9455b51c 156static char* TagErrorStr(uint8_t error) {
b4a9d841 157 switch (error) {
158 case 0x01: return "The command is not supported";
159 case 0x02: return "The command is not recognised";
160 case 0x03: return "The option is not supported.";
161 case 0x0f: return "Unknown error.";
162 case 0x10: return "The specified block is not available (doesn’t exist).";
163 case 0x11: return "The specified block is already -locked and thus cannot be locked again";
164 case 0x12: return "The specified block is locked and its content cannot be changed.";
165 case 0x13: return "The specified block was not successfully programmed.";
166 case 0x14: return "The specified block was not successfully locked.";
167 default: return "Reserved for Future Use or Custom command error.";
168 }
9455b51c 169}
170
171
172// Mode 3
7fe9b0b7 173int CmdHF15Demod(const char *Cmd)
174{
9455b51c 175 // The sampling rate is 106.353 ksps/s, for T = 18.8 us
176
177 int i, j;
178 int max = 0, maxPos = 0;
179
180 int skip = 4;
181
182 if (GraphTraceLen < 1000) return 0;
183
184 // First, correlate for SOF
185 for (i = 0; i < 100; i++) {
186 int corr = 0;
187 for (j = 0; j < arraylen(FrameSOF); j += skip) {
188 corr += FrameSOF[j] * GraphBuffer[i + (j / skip)];
189 }
190 if (corr > max) {
191 max = corr;
192 maxPos = i;
193 }
194 }
195 PrintAndLog("SOF at %d, correlation %d", maxPos,
196 max / (arraylen(FrameSOF) / skip));
197
198 i = maxPos + arraylen(FrameSOF) / skip;
199 int k = 0;
200 uint8_t outBuf[20];
201 memset(outBuf, 0, sizeof(outBuf));
202 uint8_t mask = 0x01;
203 for (;;) {
204 int corr0 = 0, corr1 = 0, corrEOF = 0;
205 for (j = 0; j < arraylen(Logic0); j += skip) {
206 corr0 += Logic0[j] * GraphBuffer[i + (j / skip)];
207 }
208 for (j = 0; j < arraylen(Logic1); j += skip) {
209 corr1 += Logic1[j] * GraphBuffer[i + (j / skip)];
210 }
211 for (j = 0; j < arraylen(FrameEOF); j += skip) {
212 corrEOF += FrameEOF[j] * GraphBuffer[i + (j / skip)];
213 }
214 // Even things out by the length of the target waveform.
215 corr0 *= 4;
216 corr1 *= 4;
217
218 if (corrEOF > corr1 && corrEOF > corr0) {
219 PrintAndLog("EOF at %d", i);
220 break;
221 } else if (corr1 > corr0) {
222 i += arraylen(Logic1) / skip;
223 outBuf[k] |= mask;
224 } else {
225 i += arraylen(Logic0) / skip;
226 }
227 mask <<= 1;
228 if (mask == 0) {
229 k++;
230 mask = 0x01;
231 }
232 if ((i + (int)arraylen(FrameEOF)) >= GraphTraceLen) {
233 PrintAndLog("ran off end!");
234 break;
235 }
236 }
237 if (mask != 0x01) {
238 PrintAndLog("error, uneven octet! (discard extra bits!)");
239 PrintAndLog(" mask=%02x", mask);
240 }
241 PrintAndLog("%d octets", k);
242
243 for (i = 0; i < k; i++) {
244 PrintAndLog("# %2d: %02x ", i, outBuf[i]);
245 }
246 PrintAndLog("CRC=%04x", Iso15693Crc(outBuf, k - 2));
247 return 0;
7fe9b0b7 248}
249
9455b51c 250
251
252// * Acquire Samples as Reader (enables carrier, sends inquiry)
7fe9b0b7 253int CmdHF15Read(const char *Cmd)
254{
9455b51c 255 UsbCommand c = {CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693};
256 SendCommand(&c);
257 return 0;
258}
259
260// Record Activity without enabeling carrier
261int CmdHF15Record(const char *Cmd)
262{
263 UsbCommand c = {CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693};
264 SendCommand(&c);
265 return 0;
7fe9b0b7 266}
267
268int CmdHF15Reader(const char *Cmd)
269{
9455b51c 270 UsbCommand c = {CMD_READER_ISO_15693, {strtol(Cmd, NULL, 0), 0, 0}};
271 SendCommand(&c);
272 return 0;
7fe9b0b7 273}
274
9455b51c 275// Simulation is still not working very good
7fe9b0b7 276int CmdHF15Sim(const char *Cmd)
277{
9455b51c 278 UsbCommand c = {CMD_SIMTAG_ISO_15693, {strtol(Cmd, NULL, 0), 0, 0}};
279 SendCommand(&c);
280 return 0;
7fe9b0b7 281}
282
9455b51c 283// finds the AFI (Application Family Idendifier) of a card, by trying all values
284// (There is no standard way of reading the AFI, allthough some tags support this)
285int CmdHF15Afi(const char *Cmd)
7fe9b0b7 286{
9455b51c 287 UsbCommand c = {CMD_ISO_15693_FIND_AFI, {strtol(Cmd, NULL, 0), 0, 0}};
288 SendCommand(&c);
289 return 0;
290}
291
292// Reads all memory pages
293int CmdHF15DumpMem(const char*Cmd) {
902cb3c0 294 UsbCommand resp;
9455b51c 295 uint8_t uid[8];
296 uint8_t *recv=NULL;
297 UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv?
298 uint8_t *req=c.d.asBytes;
299 int reqlen=0;
300 int blocknum=0;
301 char output[80];
302
303 if (!getUID(uid)) {
304 PrintAndLog("No Tag found.");
305 return 0;
306 }
307
308 PrintAndLog("Reading memory from tag UID=%s",sprintUID(NULL,uid));
309 PrintAndLog("Tag Info: %s",getTagInfo(uid));
310
311 for (int retry=0; retry<5; retry++) {
312
313 req[0]= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
314 ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS;
315 req[1]=ISO15_CMD_READ;
316 memcpy(&req[2],uid,8);
317 req[10]=blocknum;
318 reqlen=AddCrc(req,11);
319 c.arg[0]=reqlen;
320
321 SendCommand(&c);
322
902cb3c0 323 if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
324 recv = resp.d.asBytes;
325 if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) {
9455b51c 326 if (!(recv[0] & ISO15_RES_ERROR)) {
327 retry=0;
328 *output=0; // reset outputstring
329 sprintf(output, "Block %2i ",blocknum);
902cb3c0 330 for ( int i=1; i<resp.arg[0]-2; i++) { // data in hex
9455b51c 331 sprintf(output+strlen(output),"%02hX ",recv[i]);
332 }
333 strcat(output," ");
902cb3c0 334 for ( int i=1; i<resp.arg[0]-2; i++) { // data in cleaned ascii
9455b51c 335 sprintf(output+strlen(output),"%c",(recv[i]>31 && recv[i]<127)?recv[i]:'.');
336 }
337 PrintAndLog("%s",output);
338 blocknum++;
339 // PrintAndLog("bn=%i",blocknum);
340 } else {
b4a9d841 341 PrintAndLog("Tag returned Error %i: %s",recv[1],TagErrorStr(recv[1]));
9455b51c 342 return 0;
343 }
344 } // else PrintAndLog("crc");
345 } // else PrintAndLog("r null");
9455b51c 346 } // retry
902cb3c0 347 // TODO: need fix
348// if (resp.arg[0]<3)
349// PrintAndLog("Lost Connection");
350// else if (ISO15_CRC_CHECK!=Crc(resp.d.asBytes,resp.arg[0]))
351// PrintAndLog("CRC Failed");
352// else
353// PrintAndLog("Tag returned Error %i: %s",recv[1],TagErrorStr(recv[1]));
9455b51c 354 return 0;
355}
356
357
358// "HF 15" interface
359
360static command_t CommandTable15[] =
361{
362 {"help", CmdHF15Help, 1, "This help"},
363 {"demod", CmdHF15Demod, 1, "Demodulate ISO15693 from tag"},
364 {"read", CmdHF15Read, 0, "Read HF tag (ISO 15693)"},
365 {"record", CmdHF15Record, 0, "Record Samples (ISO 15693)"}, // atrox
366 {"reader", CmdHF15Reader, 0, "Act like an ISO15693 reader"},
367 {"sim", CmdHF15Sim, 0, "Fake an ISO15693 tag"},
368 {"cmd", CmdHF15Cmd, 0, "Send direct commands to ISO15693 tag"},
369 {"findafi", CmdHF15Afi, 0, "Brute force AFI of an ISO15693 tag"},
370 {"dumpmemory", CmdHF15DumpMem, 0, "Read all memory pages of an ISO15693 tag"},
371 {NULL, NULL, 0, NULL}
7fe9b0b7 372};
373
374int CmdHF15(const char *Cmd)
375{
9455b51c 376 CmdsParse(CommandTable15, Cmd);
377 return 0;
7fe9b0b7 378}
379
9455b51c 380int CmdHF15Help(const char *Cmd)
7fe9b0b7 381{
9455b51c 382 CmdsHelp(CommandTable15);
383 return 0;
7fe9b0b7 384}
9455b51c 385
386
387// "HF 15 Cmd" Interface
388// Allows direct communication with the tag on command level
389
390int CmdHF15CmdInquiry(const char *Cmd)
391{
902cb3c0 392 UsbCommand resp;
9455b51c 393 uint8_t *recv;
394 UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv?
395 uint8_t *req=c.d.asBytes;
396 int reqlen=0;
397
398 req[0]= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
399 ISO15_REQ_INVENTORY | ISO15_REQINV_SLOT1;
400 req[1]=ISO15_CMD_INVENTORY;
401 req[2]=0; // mask length
402 reqlen=AddCrc(req,3);
403 c.arg[0]=reqlen;
404
405 SendCommand(&c);
406
902cb3c0 407 if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
408 if (resp.arg[0]>=12) {
409 recv = resp.d.asBytes;
9455b51c 410 PrintAndLog("UID=%s",sprintUID(NULL,&recv[2]));
411 PrintAndLog("Tag Info: %s",getTagInfo(&recv[2]));
412 } else {
902cb3c0 413 PrintAndLog("Response to short, just %i bytes. No tag?\n",resp.arg[0]);
9455b51c 414 }
415 } else {
416 PrintAndLog("timeout.");
417 }
418 return 0;
419}
420
421
422// Turns debugging on(1)/off(0)
423int CmdHF15CmdDebug( const char *cmd) {
424 int debug=atoi(cmd);
425 if (strlen(cmd)<1) {
426 PrintAndLog("Usage: hf 15 cmd debug <0/1>");
427 PrintAndLog(" 0..no debugging output 1..turn debugging on");
428 return 0;
429 }
430
431 UsbCommand c = {CMD_ISO_15693_DEBUG, {debug, 0, 0}};
432 SendCommand(&c);
433 return 0;
434}
435
436
437int CmdHF15CmdRaw (const char *cmd) {
902cb3c0 438 UsbCommand resp;
9455b51c 439 uint8_t *recv;
440 UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv?
441 int reply=1;
442 int fast=1;
443 int crc=0;
444 char buf[5]="";
445 int i=0;
446 uint8_t data[100];
447 unsigned int datalen=0, temp;
fdb67f1c 448 char *hexout;
9455b51c 449
450
451 if (strlen(cmd)<3) {
452 PrintAndLog("Usage: hf 15 cmd raw [-r] [-2] [-c] <0A 0B 0C ... hex>");
453 PrintAndLog(" -r do not read response");
454 PrintAndLog(" -2 use slower '1 out of 256' mode");
455 PrintAndLog(" -c calculate and append CRC");
456 PrintAndLog(" Tip: turn on debugging for verbose output");
457 return 0;
458 }
459
460 // strip
461 while (*cmd==' ' || *cmd=='\t') cmd++;
462
463 while (cmd[i]!='\0') {
464 if (cmd[i]==' ' || cmd[i]=='\t') { i++; continue; }
465 if (cmd[i]=='-') {
466 switch (cmd[i+1]) {
467 case 'r':
468 case 'R':
469 reply=0;
470 break;
471 case '2':
472 fast=0;
473 break;
474 case 'c':
475 case 'C':
476 crc=1;
477 break;
478 default:
479 PrintAndLog("Invalid option");
480 return 0;
481 }
482 i+=2;
483 continue;
484 }
485 if ((cmd[i]>='0' && cmd[i]<='9') ||
486 (cmd[i]>='a' && cmd[i]<='f') ||
487 (cmd[i]>='A' && cmd[i]<='F') ) {
488 buf[strlen(buf)+1]=0;
489 buf[strlen(buf)]=cmd[i];
490 i++;
491
492 if (strlen(buf)>=2) {
493 sscanf(buf,"%x",&temp);
494 data[datalen]=(uint8_t)(temp & 0xff);
495 datalen++;
496 *buf=0;
497 }
498 continue;
499 }
500 PrintAndLog("Invalid char on input");
501 return 0;
502 }
503 if (crc) datalen=AddCrc(data,datalen);
504
505 c.arg[0]=datalen;
506 c.arg[1]=fast;
507 c.arg[2]=reply;
508 memcpy(c.d.asBytes,data,datalen);
509
510 SendCommand(&c);
511
512 if (reply) {
902cb3c0 513 if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
514 recv = resp.d.asBytes;
515 PrintAndLog("received %i octets",resp.arg[0]);
516 hexout = (char *)malloc(resp.arg[0] * 3 + 1);
fdb67f1c 517 if (hexout != NULL) {
902cb3c0 518 for (int i = 0; i < resp.arg[0]; i++) { // data in hex
fdb67f1c 519 sprintf(&hexout[i * 3], "%02hX ", recv[i]);
520 }
521 PrintAndLog("%s", hexout);
522 free(hexout);
523 }
9455b51c 524 } else {
525 PrintAndLog("timeout while waiting for reply.");
526 }
527
528 } // if reply
529 return 0;
530}
531
532
0546b4aa 533/**
534 * parses common HF 15 CMD parameters and prepares some data structures
535 * Parameters:
536 * **cmd command line
537 */
9455b51c 538int prepareHF15Cmd(char **cmd, UsbCommand *c, uint8_t iso15cmd[], int iso15cmdlen) {
539 int temp;
540 uint8_t *req=c->d.asBytes, uid[8];
541 uint32_t reqlen=0;
542
543 // strip
544 while (**cmd==' ' || **cmd=='\t') (*cmd)++;
545
546 if (strstr(*cmd,"-2")==*cmd) {
c43897de 547 c->arg[1]=0; // use 1of256
9455b51c 548 (*cmd)+=2;
549 }
550
551 // strip
552 while (**cmd==' ' || **cmd=='\t') (*cmd)++;
553
554 if (strstr(*cmd,"-o")==*cmd) {
555 req[reqlen]=ISO15_REQ_OPTION;
556 (*cmd)+=2;
557 }
558
559 // strip
560 while (**cmd==' ' || **cmd=='\t') (*cmd)++;
561
562 switch (**cmd) {
563 case 0:
564 PrintAndLog("missing addr");
565 return 0;
566 break;
567 case 's':
568 case 'S':
569 // you must have selected the tag earlier
570 req[reqlen++]|= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
571 ISO15_REQ_NONINVENTORY | ISO15_REQ_SELECT;
572 memcpy(&req[reqlen],&iso15cmd[0],iso15cmdlen);
573 reqlen+=iso15cmdlen;
574 break;
575 case 'u':
576 case 'U':
577 // unaddressed mode may not be supported by all vendors
578 req[reqlen++]|= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
579 ISO15_REQ_NONINVENTORY;
580 memcpy(&req[reqlen],&iso15cmd[0],iso15cmdlen);
581 reqlen+=iso15cmdlen;
582 break;
583 case '*':
65a23af2 584 // we scan for the UID ourself
9455b51c 585 req[reqlen++]|= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
586 ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS;
587 memcpy(&req[reqlen],&iso15cmd[0],iso15cmdlen);
588 reqlen+=iso15cmdlen;
589 if (!getUID(uid)) {
590 PrintAndLog("No Tag found");
591 return 0;
592 }
593 memcpy(req+reqlen,uid,8);
594 PrintAndLog("Detected UID %s",sprintUID(NULL,uid));
595 reqlen+=8;
596 break;
597 default:
598 req[reqlen++]|= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH |
599 ISO15_REQ_NONINVENTORY | ISO15_REQ_ADDRESS;
600 memcpy(&req[reqlen],&iso15cmd[0],iso15cmdlen);
601 reqlen+=iso15cmdlen;
602
603/* sscanf(cmd,"%hX%hX%hX%hX%hX%hX%hX%hX",
604 (short unsigned int *)&uid[7],(short unsigned int *)&uid[6],
605 (short unsigned int *)&uid[5],(short unsigned int *)&uid[4],
606 (short unsigned int *)&uid[3],(short unsigned int *)&uid[2],
607 (short unsigned int *)&uid[1],(short unsigned int *)&uid[0]); */
608 for (int i=0;i<8 && (*cmd)[i*2] && (*cmd)[i*2+1];i++) { // parse UID
609 sscanf((char[]){(*cmd)[i*2],(*cmd)[i*2+1],0},"%X",&temp);
610 uid[7-i]=temp&0xff;
611 }
612
613 PrintAndLog("Using UID %s",sprintUID(NULL,uid));
614 memcpy(&req[reqlen],&uid[0],8);
615 reqlen+=8;
616 }
617 // skip to next space
618 while (**cmd!=' ' && **cmd!='\t') (*cmd)++;
619 // skip over the space
620 while (**cmd==' ' || **cmd=='\t') (*cmd)++;
621
622 c->arg[0]=reqlen;
623 return 1;
624}
625
6d7234cd 626/**
627 * Commandline handling: HF15 CMD SYSINFO
628 * get system information from tag/VICC
629 */
630int CmdHF15CmdSysinfo(const char *Cmd) {
902cb3c0 631 UsbCommand resp;
6d7234cd 632 uint8_t *recv;
633 UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv?
634 uint8_t *req=c.d.asBytes;
635 int reqlen=0;
636 char cmdbuf[100];
637 char *cmd=cmdbuf;
638 char output[2048]="";
639 int i;
640
641 strncpy(cmd,Cmd,99);
642
643 // usage:
644 if (strlen(cmd)<1) {
0546b4aa 645 PrintAndLog("Usage: hf 15 cmd sysinfo [options] <uid|s|u|*>");
6d7234cd 646 PrintAndLog(" options:");
647 PrintAndLog(" -2 use slower '1 out of 256' mode");
648 PrintAndLog(" uid (either): ");
649 PrintAndLog(" <8B hex> full UID eg E011223344556677");
650 PrintAndLog(" s selected tag");
651 PrintAndLog(" u unaddressed mode");
652 PrintAndLog(" * scan for tag");
653 PrintAndLog(" start#: page number to start 0-255");
654 PrintAndLog(" count#: number of pages");
655 return 0;
656 }
657
658 prepareHF15Cmd(&cmd, &c,(uint8_t[]){ISO15_CMD_SYSINFO},1);
659 reqlen=c.arg[0];
660
661 reqlen=AddCrc(req,reqlen);
662 c.arg[0]=reqlen;
663
664 SendCommand(&c);
665
902cb3c0 666 if (WaitForResponseTimeout(CMD_ACK,&resp,1000) && resp.arg[0]>2) {
667 recv = resp.d.asBytes;
668 if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) {
6d7234cd 669 if (!(recv[0] & ISO15_RES_ERROR)) {
670 *output=0; // reset outputstring
902cb3c0 671 for ( i=1; i<resp.arg[0]-2; i++) {
6d7234cd 672 sprintf(output+strlen(output),"%02hX ",recv[i]);
673 }
674 strcat(output,"\n\r");
675 strcat(output,"UID = ");
676 strcat(output,sprintUID(NULL,recv+2));
677 strcat(output,"\n\r");
678 strcat(output,getTagInfo(recv+2)); //ABC
679 strcat(output,"\n\r");
680 i=10;
681 if (recv[1] & 0x01)
682 sprintf(output+strlen(output),"DSFID supported, set to %02hX\n\r",recv[i++]);
683 else
684 strcat(output,"DSFID not supported\n\r");
685 if (recv[1] & 0x02)
686 sprintf(output+strlen(output),"AFI supported, set to %03hX\n\r",recv[i++]);
687 else
688 strcat(output,"AFI not supported\n\r");
689 if (recv[1] & 0x04) {
690 strcat(output,"Tag provides info on memory layout (vendor dependent)\n\r");
691 sprintf(output+strlen(output)," %i (or %i) bytes/page x %i pages \n\r",
692 (recv[i+1]&0x1F)+1, (recv[i+1]&0x1F), recv[i]+1);
693 i+=2;
694 } else
695 strcat(output,"Tag does not provide information on memory layout\n\r");
696 if (recv[1] & 0x08) sprintf(output+strlen(output),"IC reference given: %02hX\n\r",recv[i++]);
697 else strcat(output,"IC reference not given\n\r");
698
699
700 PrintAndLog("%s",output);
701 } else {
702 PrintAndLog("Tag returned Error %i: %s",recv[0],TagErrorStr(recv[0]));
703 }
704 } else {
705 PrintAndLog("CRC failed");
706 }
707 } else {
eba61a56 708 PrintAndLog("timeout: no answer");
6d7234cd 709 }
710
711 return 0;
712}
713
7853775e 714/**
715 * Commandline handling: HF15 CMD READMULTI
716 * Read multiple blocks at once (not all tags support this)
717 */
718int CmdHF15CmdReadmulti(const char *Cmd) {
902cb3c0 719 UsbCommand resp;
7853775e 720 uint8_t *recv;
721 UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv?
722 uint8_t *req=c.d.asBytes;
723 int reqlen=0, pagenum,pagecount;
724 char cmdbuf[100];
725 char *cmd=cmdbuf;
726 char output[2048]="";
727
728 strncpy(cmd,Cmd,99);
729
730 // usage:
731 if (strlen(cmd)<3) {
0546b4aa 732 PrintAndLog("Usage: hf 15 cmd readmulti [options] <uid|s|u|*> <start#> <count#>");
7853775e 733 PrintAndLog(" options:");
734 PrintAndLog(" -2 use slower '1 out of 256' mode");
735 PrintAndLog(" uid (either): ");
736 PrintAndLog(" <8B hex> full UID eg E011223344556677");
737 PrintAndLog(" s selected tag");
738 PrintAndLog(" u unaddressed mode");
739 PrintAndLog(" * scan for tag");
740 PrintAndLog(" start#: page number to start 0-255");
741 PrintAndLog(" count#: number of pages");
742 return 0;
743 }
744
745 prepareHF15Cmd(&cmd, &c,(uint8_t[]){ISO15_CMD_READMULTI},1);
746 reqlen=c.arg[0];
747
748 pagenum=strtol(cmd,NULL,0);
749
750 // skip to next space
751 while (*cmd!=' ' && *cmd!='\t') cmd++;
752 // skip over the space
753 while (*cmd==' ' || *cmd=='\t') cmd++;
754
755 pagecount=strtol(cmd,NULL,0);
756 if (pagecount>0) pagecount--; // 0 means 1 page, 1 means 2 pages, ...
757
758 req[reqlen++]=(uint8_t)pagenum;
759 req[reqlen++]=(uint8_t)pagecount;
760
761 reqlen=AddCrc(req,reqlen);
762
763 c.arg[0]=reqlen;
764
765 SendCommand(&c);
0546b4aa 766
902cb3c0 767 if (WaitForResponseTimeout(CMD_ACK,&resp,1000) && resp.arg[0]>2) {
768 recv = resp.d.asBytes;
769 if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) {
7853775e 770 if (!(recv[0] & ISO15_RES_ERROR)) {
771 *output=0; // reset outputstring
902cb3c0 772 for ( int i=1; i<resp.arg[0]-2; i++) {
7853775e 773 sprintf(output+strlen(output),"%02hX ",recv[i]);
774 }
775 strcat(output," ");
902cb3c0 776 for ( int i=1; i<resp.arg[0]-2; i++) {
7853775e 777 sprintf(output+strlen(output),"%c",recv[i]>31 && recv[i]<127?recv[i]:'.');
778 }
779 PrintAndLog("%s",output);
780 } else {
781 PrintAndLog("Tag returned Error %i: %s",recv[0],TagErrorStr(recv[0]));
782 }
783 } else {
784 PrintAndLog("CRC failed");
785 }
786 } else {
787 PrintAndLog("no answer");
788 }
789
790 return 0;
791}
792
05151b6f 793/**
794 * Commandline handling: HF15 CMD READ
795 * Reads a single Block
796 */
9455b51c 797int CmdHF15CmdRead(const char *Cmd) {
902cb3c0 798 UsbCommand resp;
9455b51c 799 uint8_t *recv;
800 UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv?
801 uint8_t *req=c.d.asBytes;
802 int reqlen=0, pagenum;
803 char cmdbuf[100];
804 char *cmd=cmdbuf;
805 char output[100]="";
806
807 strncpy(cmd,Cmd,99);
808
809 // usage:
810 if (strlen(cmd)<3) {
0546b4aa 811 PrintAndLog("Usage: hf 15 cmd read [options] <uid|s|u|*> <page#>");
9455b51c 812 PrintAndLog(" options:");
813 PrintAndLog(" -2 use slower '1 out of 256' mode");
814 PrintAndLog(" uid (either): ");
815 PrintAndLog(" <8B hex> full UID eg E011223344556677");
816 PrintAndLog(" s selected tag");
817 PrintAndLog(" u unaddressed mode");
818 PrintAndLog(" * scan for tag");
819 PrintAndLog(" page#: page number 0-255");
820 return 0;
821 }
822
823 prepareHF15Cmd(&cmd, &c,(uint8_t[]){ISO15_CMD_READ},1);
824 reqlen=c.arg[0];
825
826 pagenum=strtol(cmd,NULL,0);
827 /*if (pagenum<0) {
828 PrintAndLog("invalid pagenum");
829 return 0;
830 } */
831
832 req[reqlen++]=(uint8_t)pagenum;
833
834 reqlen=AddCrc(req,reqlen);
835
836 c.arg[0]=reqlen;
837
838 SendCommand(&c);
839
902cb3c0 840 if (WaitForResponseTimeout(CMD_ACK,&resp,1000) && resp.arg[0]>2) {
841 recv = resp.d.asBytes;
842 if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) {
9455b51c 843 if (!(recv[0] & ISO15_RES_ERROR)) {
844 *output=0; // reset outputstring
845 //sprintf(output, "Block %2i ",blocknum);
902cb3c0 846 for ( int i=1; i<resp.arg[0]-2; i++) {
9455b51c 847 sprintf(output+strlen(output),"%02hX ",recv[i]);
848 }
849 strcat(output," ");
902cb3c0 850 for ( int i=1; i<resp.arg[0]-2; i++) {
e8da7740 851 sprintf(output+strlen(output),"%c",recv[i]>31 && recv[i]<127?recv[i]:'.');
9455b51c 852 }
853 PrintAndLog("%s",output);
854 } else {
b4a9d841 855 PrintAndLog("Tag returned Error %i: %s",recv[1],TagErrorStr(recv[1]));
9455b51c 856 }
857 } else {
858 PrintAndLog("CRC failed");
859 }
860 } else {
861 PrintAndLog("no answer");
862 }
863
864 return 0;
865}
866
867
05151b6f 868/**
869 * Commandline handling: HF15 CMD WRITE
870 * Writes a single Block - might run into timeout, even when successful
871 */
9455b51c 872int CmdHF15CmdWrite(const char *Cmd) {
902cb3c0 873 UsbCommand resp;
9455b51c 874 uint8_t *recv;
875 UsbCommand c = {CMD_ISO_15693_COMMAND, {0, 1, 1}}; // len,speed,recv?
876 uint8_t *req=c.d.asBytes;
877 int reqlen=0, pagenum, temp;
878 char cmdbuf[100];
879 char *cmd=cmdbuf;
880 char *cmd2;
881
882 strncpy(cmd,Cmd,99);
883
884 // usage:
885 if (strlen(cmd)<3) {
0546b4aa 886 PrintAndLog("Usage: hf 15 cmd write [options] <uid|s|u|*> <page#> <hexdata>");
9455b51c 887 PrintAndLog(" options:");
888 PrintAndLog(" -2 use slower '1 out of 256' mode");
889 PrintAndLog(" -o set OPTION Flag (needed for TI)");
890 PrintAndLog(" uid (either): ");
891 PrintAndLog(" <8B hex> full UID eg E011223344556677");
892 PrintAndLog(" s selected tag");
893 PrintAndLog(" u unaddressed mode");
894 PrintAndLog(" * scan for tag");
895 PrintAndLog(" page#: page number 0-255");
896 PrintAndLog(" hexdata: data to be written eg AA BB CC DD");
897 return 0;
898 }
899
900 prepareHF15Cmd(&cmd, &c,(uint8_t[]){ISO15_CMD_WRITE},1);
901 reqlen=c.arg[0];
902
903 // *cmd -> page num ; *cmd2 -> data
904 cmd2=cmd;
905 while (*cmd2!=' ' && *cmd2!='\t' && *cmd2) cmd2++;
906 *cmd2=0;
907 cmd2++;
908
909 pagenum=strtol(cmd,NULL,0);
910 /*if (pagenum<0) {
911 PrintAndLog("invalid pagenum");
912 return 0;
913 } */
914 req[reqlen++]=(uint8_t)pagenum;
915
916
917 while (cmd2[0] && cmd2[1]) { // hexdata, read by 2 hexchars
918 if (*cmd2==' ') {
919 cmd2++;
920 continue;
921 }
922 sscanf((char[]){cmd2[0],cmd2[1],0},"%X",&temp);
923 req[reqlen++]=temp & 0xff;
924 cmd2+=2;
925 }
926
927 reqlen=AddCrc(req,reqlen);
928
929 c.arg[0]=reqlen;
930
931 SendCommand(&c);
932
902cb3c0 933 if (WaitForResponseTimeout(CMD_ACK,&resp,2000) && resp.arg[0]>2) {
934 recv = resp.d.asBytes;
935 if (ISO15_CRC_CHECK==Crc(recv,resp.arg[0])) {
9455b51c 936 if (!(recv[0] & ISO15_RES_ERROR)) {
937 PrintAndLog("OK");
938 } else {
b4a9d841 939 PrintAndLog("Tag returned Error %i: %s",recv[1],TagErrorStr(recv[1]));
9455b51c 940 }
941 } else {
942 PrintAndLog("CRC failed");
943 }
944 } else {
65a23af2 945 PrintAndLog("timeout: no answer - data may be written anyway");
9455b51c 946 }
947
948 return 0;
949}
950
951
952
953static command_t CommandTable15Cmd[] =
954{
955 {"help", CmdHF15CmdHelp, 1, "This Help"},
956 {"inquiry", CmdHF15CmdInquiry, 0, "Search for tags in range"},
957 /*
958 {"select", CmdHF15CmdSelect, 0, "Select an tag with a specific UID for further commands"},
959 */
960 {"read", CmdHF15CmdRead, 0, "Read a block"},
961 {"write", CmdHF15CmdWrite, 0, "Write a block"},
9455b51c 962 {"readmulti",CmdHF15CmdReadmulti, 0, "Reads multiple Blocks"},
0546b4aa 963 {"sysinfo",CmdHF15CmdSysinfo, 0, "Get Card Information"},
9455b51c 964 {"raw", CmdHF15CmdRaw, 0, "Send raw hex data to tag"},
965 {"debug", CmdHF15CmdDebug, 0, "Turn debugging on/off"},
966 {NULL, NULL, 0, NULL}
967};
968
969int CmdHF15Cmd(const char *Cmd)
970{
971 CmdsParse(CommandTable15Cmd, Cmd);
972 return 0;
973}
974
975int CmdHF15CmdHelp(const char *Cmd)
976{
977 CmdsHelp(CommandTable15Cmd);
978 return 0;
979}
980
Proxmark3 GIT tracking
Impressum, Datenschutz