a553f267 |
1 | //----------------------------------------------------------------------------- |
2 | // Copyright (C) 2010 iZsh <izsh at fail0verflow.com> |
3 | // |
4 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, |
5 | // at your option, any later version. See the LICENSE.txt file for the text of |
6 | // the license. |
7 | //----------------------------------------------------------------------------- |
8 | // High frequency commands |
9 | //----------------------------------------------------------------------------- |
10 | |
7fe9b0b7 |
11 | #include <stdio.h> |
d3a22c7d |
12 | #include <string.h> |
902cb3c0 |
13 | #include "proxmark3.h" |
7fe9b0b7 |
14 | #include "graph.h" |
15 | #include "ui.h" |
16 | #include "cmdparser.h" |
17 | #include "cmdhf.h" |
18 | #include "cmdhf14a.h" |
19 | #include "cmdhf14b.h" |
20 | #include "cmdhf15.h" |
5acd09bd |
21 | #include "cmdhfepa.h" |
7fe9b0b7 |
22 | #include "cmdhflegic.h" |
cee5a30d |
23 | #include "cmdhficlass.h" |
9ca155ba |
24 | #include "cmdhfmf.h" |
f38a1528 |
25 | #include "cmdhfmfu.h" |
26 | #include "cmdhfmfdes.h" |
27 | #include "cmdhfdes.h" |
7fe9b0b7 |
28 | |
29 | static int CmdHelp(const char *Cmd); |
30 | |
31 | int CmdHFTune(const char *Cmd) |
32 | { |
33 | UsbCommand c={CMD_MEASURE_ANTENNA_TUNING_HF}; |
34 | SendCommand(&c); |
35 | return 0; |
36 | } |
d3a22c7d |
37 | // for the time being. Need better Bigbuf handling. |
38 | #define TRACE_SIZE 3000 |
39 | |
40 | #define ICLASS_CMD_ACTALL 0x0A |
41 | #define ICLASS_CMD_IDENTIFY 0x0C |
42 | #define ICLASS_CMD_READ 0x0C |
43 | #define ICLASS_CMD_SELECT 0x81 |
44 | #define ICLASS_CMD_PAGESEL 0x84 |
45 | #define ICLASS_CMD_READCHECK 0x88 |
46 | #define ICLASS_CMD_CHECK 0x05 |
47 | #define ICLASS_CMD_SOF 0x0F |
48 | #define ICLASS_CMD_HALT 0x00 |
49 | |
50 | #define iso14443_CMD_WUPA 0x52 |
51 | #define iso14443_CMD_SELECT 0x93 |
52 | #define iso14443_CMD_SELECT_2 0x95 |
225ccb91 |
53 | #define iso14443_CMD_SELECT_3 0x97 |
d3a22c7d |
54 | #define iso14443_CMD_REQ 0x26 |
55 | #define iso14443_CMD_READBLOCK 0x30 |
56 | #define iso14443_CMD_WRITEBLOCK 0xA0 |
225ccb91 |
57 | #define iso14443_CMD_WRITE 0xA2 |
d3a22c7d |
58 | #define iso14443_CMD_INC 0xC0 |
59 | #define iso14443_CMD_DEC 0xC1 |
60 | #define iso14443_CMD_RESTORE 0xC2 |
61 | #define iso14443_CMD_TRANSFER 0xB0 |
62 | #define iso14443_CMD_HALT 0x50 |
63 | #define iso14443_CMD_RATS 0xE0 |
64 | |
225ccb91 |
65 | #define iso14443_CMD_AUTH_KEYA 0x60 |
66 | #define iso14443_CMD_AUTH_KEYB 0x61 |
67 | |
68 | #define iso14443_CMD_AUTH_STEP1 0x1A |
69 | #define iso14443_CMD_AUTH_STEP2 0xAA |
70 | #define iso14443_CMD_AUTH_RESPONSE 0xAF |
71 | |
72 | #define CHINESE_BACKDOOR_INIT 0x40 |
73 | #define CHINESE_BACKDOOR_STEP2 0x43 |
d3a22c7d |
74 | |
75 | void annotateIso14443a(char *exp, size_t size, uint8_t* cmd, uint8_t cmdsize) |
76 | { |
77 | switch(cmd[0]) |
78 | { |
79 | case iso14443_CMD_WUPA: snprintf(exp,size,"WUPA"); break; |
80 | case iso14443_CMD_SELECT:{ |
81 | if(cmdsize > 2) |
82 | { |
83 | snprintf(exp,size,"SELECT_UID"); break; |
84 | }else |
85 | { |
86 | snprintf(exp,size,"SELECT_ALL"); break; |
87 | } |
88 | } |
89 | case iso14443_CMD_SELECT_2: snprintf(exp,size,"SELECT_2"); break; |
90 | case iso14443_CMD_REQ: snprintf(exp,size,"REW"); break; |
91 | case iso14443_CMD_READBLOCK: snprintf(exp,size,"READBLOCK(%d)",cmd[1]); break; |
92 | case iso14443_CMD_WRITEBLOCK: snprintf(exp,size,"WRITEBLOCK(%d)",cmd[1]); break; |
225ccb91 |
93 | case iso14443_CMD_WRITE: snprintf(exp,size,"WRITE"); break; |
d3a22c7d |
94 | case iso14443_CMD_INC: snprintf(exp,size,"INC(%d)",cmd[1]); break; |
95 | case iso14443_CMD_DEC: snprintf(exp,size,"DEC(%d)",cmd[1]); break; |
96 | case iso14443_CMD_RESTORE: snprintf(exp,size,"RESTORE(%d)",cmd[1]); break; |
97 | case iso14443_CMD_TRANSFER: snprintf(exp,size,"TRANSFER(%d)",cmd[1]); break; |
98 | case iso14443_CMD_HALT: snprintf(exp,size,"HALT"); break; |
99 | case iso14443_CMD_RATS: snprintf(exp,size,"RATS"); break; |
225ccb91 |
100 | |
101 | case iso14443_CMD_AUTH_KEYA: snprintf(exp,size,"AUTH KEY A"); break; |
102 | case iso14443_CMD_AUTH_KEYB: snprintf(exp,size,"AUTH KEY B"); break; |
103 | case iso14443_CMD_AUTH_STEP1: snprintf(exp,size,"AUTH REQ NONCE"); break; |
104 | case iso14443_CMD_AUTH_STEP2: snprintf(exp,size,"AUTH STEP 2"); break; |
105 | case iso14443_CMD_AUTH_RESPONSE: snprintf(exp,size,"AUTH RESPONSE"); break; |
106 | |
107 | case CHINESE_BACKDOOR_INIT: snprintf(exp,size,"BACKDOOR INIT");break; |
108 | case CHINESE_BACKDOOR_STEP2: snprintf(exp,size,"BACKDOOR STEP2");break; |
d3a22c7d |
109 | default: snprintf(exp,size,"?"); break; |
110 | } |
111 | return; |
112 | } |
113 | |
114 | void annotateIclass(char *exp, size_t size, uint8_t* cmd, uint8_t cmdsize) |
115 | { |
d3a22c7d |
116 | if(cmdsize > 1 && cmd[0] == ICLASS_CMD_READ) |
117 | { |
118 | snprintf(exp,size,"READ(%d)",cmd[1]); |
119 | return; |
120 | } |
121 | |
122 | switch(cmd[0]) |
123 | { |
124 | case ICLASS_CMD_ACTALL: snprintf(exp,size,"ACTALL"); break; |
125 | case ICLASS_CMD_IDENTIFY: snprintf(exp,size,"IDENTIFY"); break; |
126 | case ICLASS_CMD_SELECT: snprintf(exp,size,"SELECT"); break; |
127 | case ICLASS_CMD_PAGESEL: snprintf(exp,size,"PAGESEL"); break; |
128 | case ICLASS_CMD_READCHECK: snprintf(exp,size,"READCHECK"); break; |
129 | case ICLASS_CMD_CHECK: snprintf(exp,size,"CHECK"); break; |
130 | case ICLASS_CMD_SOF: snprintf(exp,size,"SOF"); break; |
131 | case ICLASS_CMD_HALT: snprintf(exp,size,"HALT"); break; |
132 | default: snprintf(exp,size,"?"); break; |
133 | } |
134 | return; |
135 | } |
136 | |
137 | |
d3a22c7d |
138 | uint16_t printTraceLine(uint16_t tracepos, uint8_t* trace, bool iclass, bool showWaitCycles) |
139 | { |
140 | bool isResponse; |
141 | uint16_t duration, data_len,parity_len; |
142 | |
143 | uint32_t timestamp, first_timestamp, EndOfTransmissionTimestamp; |
144 | char explanation[30] = {0}; |
145 | |
146 | first_timestamp = *((uint32_t *)(trace)); |
147 | timestamp = *((uint32_t *)(trace + tracepos)); |
148 | // Break and stick with current result if buffer was not completely full |
149 | if (timestamp == 0x44444444) return TRACE_SIZE; |
150 | |
151 | tracepos += 4; |
152 | duration = *((uint16_t *)(trace + tracepos)); |
153 | tracepos += 2; |
154 | data_len = *((uint16_t *)(trace + tracepos)); |
155 | tracepos += 2; |
156 | |
157 | if (data_len & 0x8000) { |
158 | data_len &= 0x7fff; |
159 | isResponse = true; |
160 | } else { |
161 | isResponse = false; |
162 | } |
163 | parity_len = (data_len-1)/8 + 1; |
164 | |
165 | if (tracepos + data_len + parity_len >= TRACE_SIZE) { |
166 | return TRACE_SIZE; |
167 | } |
168 | |
169 | uint8_t *frame = trace + tracepos; |
170 | tracepos += data_len; |
171 | uint8_t *parityBytes = trace + tracepos; |
172 | tracepos += parity_len; |
173 | |
174 | //--- Draw the data column |
175 | char line[16][110]; |
176 | for (int j = 0; j < data_len; j++) { |
177 | int oddparity = 0x01; |
178 | int k; |
179 | |
180 | for (k=0 ; k<8 ; k++) { |
181 | oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01); |
182 | } |
183 | |
184 | uint8_t parityBits = parityBytes[j>>3]; |
185 | |
186 | if (isResponse && (oddparity != ((parityBits >> (7-(j&0x0007))) & 0x01))) { |
187 | sprintf(line[j/16]+((j%16)*4), "%02x! ", frame[j]); |
188 | } else { |
189 | sprintf(line[j/16]+((j%16)*4), "%02x ", frame[j]); |
190 | } |
191 | } |
192 | //--- Draw the CRC column |
193 | bool crcError = false; |
194 | |
195 | if (data_len > 2) { |
196 | uint8_t b1, b2; |
197 | if(iclass) |
198 | { |
199 | if(!isResponse && data_len == 4 ) { |
200 | // Rough guess that this is a command from the reader |
201 | // For iClass the command byte is not part of the CRC |
202 | ComputeCrc14443(CRC_ICLASS, &frame[1], data_len-3, &b1, &b2); |
225ccb91 |
203 | } else { |
d3a22c7d |
204 | // For other data.. CRC might not be applicable (UPDATE commands etc.) |
205 | ComputeCrc14443(CRC_ICLASS, frame, data_len-2, &b1, &b2); |
206 | } |
207 | |
208 | if (b1 != frame[data_len-2] || b2 != frame[data_len-1]) { |
209 | crcError = true; |
210 | } |
211 | |
225ccb91 |
212 | } else {//Iso 14443a |
d3a22c7d |
213 | |
214 | ComputeCrc14443(CRC_14443_A, frame, data_len-2, &b1, &b2); |
215 | |
216 | if (b1 != frame[data_len-2] || b2 != frame[data_len-1]) { |
217 | if(!(isResponse & (data_len < 6))) |
218 | { |
219 | crcError = true; |
220 | } |
221 | } |
222 | } |
d3a22c7d |
223 | } |
224 | char *crc = crcError ? "!crc" :" "; |
225 | |
226 | EndOfTransmissionTimestamp = timestamp + duration; |
227 | |
228 | if(!isResponse) |
229 | { |
225ccb91 |
230 | if(iclass) |
231 | annotateIclass(explanation,sizeof(explanation),frame,data_len); |
232 | else |
233 | annotateIso14443a(explanation,sizeof(explanation),frame,data_len); |
d3a22c7d |
234 | } |
235 | |
236 | int num_lines = (data_len - 1)/16 + 1; |
237 | for (int j = 0; j < num_lines; j++) { |
238 | if (j == 0) { |
239 | PrintAndLog(" %9d | %9d | %s | %-64s| %s| %s", |
240 | (timestamp - first_timestamp), |
241 | (EndOfTransmissionTimestamp - first_timestamp), |
242 | (isResponse ? "Tag" : "Rdr"), |
243 | line[j], |
244 | (j == num_lines-1) ? crc : " ", |
245 | (j == num_lines-1) ? explanation : ""); |
246 | } else { |
247 | PrintAndLog(" | | | %-64s| %s| %s", |
248 | line[j], |
225ccb91 |
249 | (j == num_lines-1) ? crc : " ", |
d3a22c7d |
250 | (j == num_lines-1) ? explanation : ""); |
251 | } |
252 | } |
253 | |
254 | bool next_isResponse = *((uint16_t *)(trace + tracepos + 6)) & 0x8000; |
255 | |
256 | if (showWaitCycles && !isResponse && next_isResponse) { |
257 | uint32_t next_timestamp = *((uint32_t *)(trace + tracepos)); |
258 | if (next_timestamp != 0x44444444) { |
259 | PrintAndLog(" %9d | %9d | %s | fdt (Frame Delay Time): %d", |
260 | (EndOfTransmissionTimestamp - first_timestamp), |
261 | (next_timestamp - first_timestamp), |
262 | " ", |
263 | (next_timestamp - EndOfTransmissionTimestamp)); |
264 | } |
265 | } |
266 | return tracepos; |
267 | } |
268 | |
269 | int CmdHFList(const char *Cmd) |
270 | { |
271 | bool showWaitCycles = false; |
272 | char type[40] = {0}; |
273 | int tlen = param_getstr(Cmd,0,type); |
274 | char param = param_getchar(Cmd, 1); |
275 | bool errors = false; |
276 | bool iclass = false; |
277 | //Validate params |
278 | if(tlen == 0 || (strcmp(type, "iclass") != 0 && strcmp(type,"14a") != 0)) |
279 | { |
280 | errors = true; |
281 | } |
282 | if(param == 'h' || (param !=0 && param != 'f')) |
283 | { |
284 | errors = true; |
285 | } |
286 | |
287 | if (errors) { |
288 | PrintAndLog("List protocol data in trace buffer."); |
289 | PrintAndLog("Usage: hf list [14a|iclass] [f]"); |
290 | PrintAndLog(" 14a - interpret data as iso14443a communications"); |
291 | PrintAndLog(" iclass - interpret data as iclass communications"); |
292 | PrintAndLog(" f - show frame delay times as well"); |
293 | PrintAndLog(""); |
294 | PrintAndLog("example: hf list 14a f"); |
295 | PrintAndLog("example: hf list iclass"); |
296 | return 0; |
297 | } |
298 | if(strcmp(type, "iclass") == 0) |
299 | { |
300 | iclass = true; |
301 | } |
302 | |
303 | if (param == 'f') { |
304 | showWaitCycles = true; |
305 | } |
306 | |
307 | |
308 | uint8_t trace[TRACE_SIZE]; |
309 | uint16_t tracepos = 0; |
310 | GetFromBigBuf(trace, TRACE_SIZE, 0); |
311 | WaitForResponse(CMD_ACK, NULL); |
312 | |
313 | PrintAndLog("Recorded Activity"); |
314 | PrintAndLog(""); |
315 | PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer"); |
316 | PrintAndLog("iso14443a - All times are in carrier periods (1/13.56Mhz)"); |
317 | PrintAndLog("iClass - Timings are not as accurate"); |
318 | PrintAndLog(""); |
319 | PrintAndLog(" Start | End | Src | Data (! denotes parity error) | CRC | Annotation |"); |
320 | PrintAndLog("-----------|-----------|-----|-----------------------------------------------------------------|-----|--------------------|"); |
321 | |
322 | while(tracepos < TRACE_SIZE) |
323 | { |
324 | tracepos = printTraceLine(tracepos, trace, iclass, showWaitCycles); |
325 | } |
326 | return 0; |
327 | } |
328 | |
7fe9b0b7 |
329 | |
330 | static command_t CommandTable[] = |
331 | { |
332 | {"help", CmdHelp, 1, "This help"}, |
37239a7c |
333 | {"14a", CmdHF14A, 1, "{ ISO14443A RFIDs... }"}, |
334 | {"14b", CmdHF14B, 1, "{ ISO14443B RFIDs... }"}, |
335 | {"15", CmdHF15, 1, "{ ISO15693 RFIDs... }"}, |
5acd09bd |
336 | {"epa", CmdHFEPA, 1, "{ German Identification Card... }"}, |
8e220a91 |
337 | {"legic", CmdHFLegic, 0, "{ LEGIC RFIDs... }"}, |
cee5a30d |
338 | {"iclass", CmdHFiClass, 1, "{ ICLASS RFIDs... }"}, |
9ca155ba |
339 | {"mf", CmdHFMF, 1, "{ MIFARE RFIDs... }"}, |
d3a22c7d |
340 | {"mfu", CmdHFMFUltra, 1, "{ MIFARE Ultralight RFIDs... }"}, |
341 | {"mfdes", CmdHFMFDes, 1, "{ MIFARE Desfire RFIDs... }"}, |
f38a1528 |
342 | {"des", CmdHFDES, 0, "{ MIFARE DESfire}"}, |
c59c3405 |
343 | {"tune", CmdHFTune, 0, "Continuously measure HF antenna tuning"}, |
d3a22c7d |
344 | {"list", CmdHFList, 1, "List protocol data in trace buffer"}, |
7fe9b0b7 |
345 | {NULL, NULL, 0, NULL} |
346 | }; |
347 | |
348 | int CmdHF(const char *Cmd) |
349 | { |
350 | CmdsParse(CommandTable, Cmd); |
351 | return 0; |
352 | } |
353 | |
354 | int CmdHelp(const char *Cmd) |
355 | { |
356 | CmdsHelp(CommandTable); |
357 | return 0; |
358 | } |