cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhficlass.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
   3 // Copyright (C) 2011 Gerhard de Koning Gans
   4 // Copyright (C) 2014 Midnitesnake & Andy Davies & Martin Holst Swende
   5 //
   6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   7 // at your option, any later version. See the LICENSE.txt file for the text of
   8 // the license.
   9 //-----------------------------------------------------------------------------
  10 // High frequency iClass commands
  11 //-----------------------------------------------------------------------------
  12
  13 #include <stdio.h>
  14 #include <stdlib.h>
  15 #include <string.h>
  16 #include <sys/stat.h>
  17 #include "iso14443crc.h" // Can also be used for iClass, using 0xE012 as CRC-type
  18 #include "data.h"
  19 #include "proxmark3.h"
  20 #include "ui.h"
  21 #include "cmdparser.h"
  22 #include "cmdhficlass.h"
  23 #include "../include/common.h"
  24 #include "util.h"
  25 #include "cmdmain.h"
  26 #include "loclass/des.h"
  27 #include "loclass/cipherutils.h"
  28 #include "loclass/cipher.h"
  29 #include "loclass/ikeys.h"
  30 #include "loclass/elite_crack.h"
  31 #include "loclass/fileutils.h"
  32
  33 static int CmdHelp(const char *Cmd);
  34
  35 int xorbits_8(uint8_t val)
  36 {
  37         uint8_t res = val ^ (val >> 1); //1st pass
  38         res = res ^ (res >> 1);                 // 2nd pass
  39         res = res ^ (res >> 2);                 // 3rd pass
  40         res = res ^ (res >> 4);                         // 4th pass
  41         return res & 1;
  42 }
  43
  44 int CmdHFiClassList(const char *Cmd)
  45 {
  46
  47         bool ShowWaitCycles = false;
  48         char param = param_getchar(Cmd, 0);
  49
  50         if (param != 0) {
  51                 PrintAndLog("List data in trace buffer.");
  52                 PrintAndLog("Usage:  hf iclass list");
  53                 PrintAndLog("h - help");
  54                 PrintAndLog("sample: hf iclass list");
  55                 return 0;
  56         }
  57
  58         uint8_t got[TRACE_BUFFER_SIZE];
  59         GetFromBigBuf(got,sizeof(got),0);
  60         WaitForResponse(CMD_ACK,NULL);
  61
  62         PrintAndLog("Recorded Activity");
  63         PrintAndLog("");
  64         PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
  65         PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
  66         PrintAndLog("");
  67         PrintAndLog("     Start |       End | Src | Data");
  68         PrintAndLog("-----------|-----------|-----|--------");
  69
  70         int i;
  71         uint32_t first_timestamp = 0;
  72         uint32_t timestamp;
  73         bool tagToReader;
  74         uint32_t parityBits;
  75         uint8_t len;
  76         uint8_t *frame;
  77         uint32_t EndOfTransmissionTimestamp = 0;
  78
  79
  80         for( i=0; i < TRACE_BUFFER_SIZE;)
  81         {
  82                 //First 32 bits contain
  83                 // isResponse (1 bit)
  84                 // timestamp (remaining)
  85                 //Then paritybits
  86                 //Then length
  87                 timestamp = *((uint32_t *)(got+i));
  88                 parityBits = *((uint32_t *)(got+i+4));
  89                 len = got[i+8];
  90                 frame = (got+i+9);
  91                 uint32_t next_timestamp = (*((uint32_t *)(got+i+9))) & 0x7fffffff;
  92
  93                 tagToReader = timestamp & 0x80000000;
  94                 timestamp &= 0x7fffffff;
  95
  96                 if(i==0) {
  97                         first_timestamp = timestamp;
  98                 }
  99
 100         // Break and stick with current result idf buffer was not completely full
 101                 if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;
 102
 103                 char line[1000] = "";
 104
 105                 if(len)//We have some data to display
 106                 {
 107                         int j,oddparity;
 108
 109                         for(j = 0; j < len ; j++)
 110                         {
 111                                 oddparity = 0x01 ^ xorbits_8(frame[j] & 0xFF);
 112
 113                                 if (tagToReader && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
 114                                         sprintf(line+(j*4), "%02x!  ", frame[j]);
 115                                 } else {
 116                                         sprintf(line+(j*4), "%02x   ", frame[j]);
 117                                 }
 118                         }
 119                 }else
 120                 {
 121                         if (ShowWaitCycles) {
 122                                 sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
 123                         }
 124                 }
 125
 126                 char *crc = "";
 127
 128                 if(len > 2)
 129                 {
 130                         uint8_t b1, b2;
 131                         if(!tagToReader && len == 4) {
 132                                 // Rough guess that this is a command from the reader
 133                                 // For iClass the command byte is not part of the CRC
 134                                         ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
 135                         }
 136                         else {
 137                                   // For other data.. CRC might not be applicable (UPDATE commands etc.)
 138                                 ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
 139                         }
 140
 141                         if (b1 != frame[len-2] || b2 != frame[len-1]) {
 142                                 crc = (tagToReader & (len < 8)) ? "" : " !crc";
 143                         }
 144                 }
 145
 146                 i += (len + 9);
 147                 EndOfTransmissionTimestamp = (*((uint32_t *)(got+i))) & 0x7fffffff;
 148
 149                 // Not implemented for iclass on the ARM-side
 150                 //if (!ShowWaitCycles) i += 9;
 151
 152                 PrintAndLog(" %9d | %9d | %s | %s %s",
 153                         (timestamp - first_timestamp),
 154                         (EndOfTransmissionTimestamp - first_timestamp),
 155                         (len?(tagToReader ? "Tag" : "Rdr"):"   "),
 156                         line, crc);
 157         }
 158         return 0;
 159 }
 160
 161 int CmdHFiClassListOld(const char *Cmd)
 162 {
 163   uint8_t got[1920];
 164   GetFromBigBuf(got,sizeof(got),0);
 165
 166   PrintAndLog("recorded activity:");
 167   PrintAndLog(" ETU     :rssi: who bytes");
 168   PrintAndLog("---------+----+----+-----------");
 169
 170   int i = 0;
 171   int prev = -1;
 172
 173   for (;;) {
 174     if(i >= 1900) {
 175       break;
 176     }
 177
 178     bool isResponse;
 179     int timestamp = *((uint32_t *)(got+i));
 180     if (timestamp & 0x80000000) {
 181       timestamp &= 0x7fffffff;
 182       isResponse = 1;
 183     } else {
 184       isResponse = 0;
 185     }
 186
 187
 188     int metric = 0;
 189
 190     int parityBits = *((uint32_t *)(got+i+4));
 191     // 4 bytes of additional information...
 192     // maximum of 32 additional parity bit information
 193     //
 194     // TODO:
 195     // at each quarter bit period we can send power level (16 levels)
 196     // or each half bit period in 256 levels.
 197
 198
 199     int len = got[i+8];
 200
 201     if (len > 100) {
 202       break;
 203     }
 204     if (i + len >= 1900) {
 205       break;
 206     }
 207
 208     uint8_t *frame = (got+i+9);
 209
 210     // Break and stick with current result if buffer was not completely full
 211     if (frame[0] == 0x44 && frame[1] == 0x44 && frame[3] == 0x44) { break; }
 212
 213     char line[1000] = "";
 214     int j;
 215     for (j = 0; j < len; j++) {
 216       int oddparity = 0x01;
 217       int k;
 218
 219       for (k=0;k<8;k++) {
 220         oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
 221       }
 222
 223       //if((parityBits >> (len - j - 1)) & 0x01) {
 224       if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
 225         sprintf(line+(j*4), "%02x!  ", frame[j]);
 226       }
 227       else {
 228         sprintf(line+(j*4), "%02x   ", frame[j]);
 229       }
 230     }
 231
 232     char *crc;
 233     crc = "";
 234     if (len > 2) {
 235       uint8_t b1, b2;
 236       for (j = 0; j < (len - 1); j++) {
 237         // gives problems... search for the reason..
 238         /*if(frame[j] == 0xAA) {
 239           switch(frame[j+1]) {
 240             case 0x01:
 241               crc = "[1] Two drops close after each other";
 242             break;
 243             case 0x02:
 244               crc = "[2] Potential SOC with a drop in second half of bitperiod";
 245               break;
 246             case 0x03:
 247               crc = "[3] Segment Z after segment X is not possible";
 248               break;
 249             case 0x04:
 250               crc = "[4] Parity bit of a fully received byte was wrong";
 251               break;
 252             default:
 253               crc = "[?] Unknown error";
 254               break;
 255           }
 256           break;
 257         }*/
 258       }
 259
 260       if (strlen(crc)==0) {
 261         if(!isResponse && len == 4) {
 262                 // Rough guess that this is a command from the reader
 263                 // For iClass the command byte is not part of the CRC
 264                 ComputeCrc14443(CRC_ICLASS, &frame[1], len-3, &b1, &b2);
 265         }
 266         else {
 267                 // For other data.. CRC might not be applicable (UPDATE commands etc.)
 268                 ComputeCrc14443(CRC_ICLASS, frame, len-2, &b1, &b2);
 269         }
 270         //printf("%1x %1x",(unsigned)b1,(unsigned)b2);
 271         if (b1 != frame[len-2] || b2 != frame[len-1]) {
 272           crc = (isResponse & (len < 8)) ? "" : " !crc";
 273         } else {
 274           crc = "";
 275         }
 276       }
 277     } else {
 278       crc = ""; // SHORT
 279     }
 280
 281     char metricString[100];
 282     if (isResponse) {
 283       sprintf(metricString, "%3d", metric);
 284     } else {
 285       strcpy(metricString, "   ");
 286     }
 287
 288     PrintAndLog(" +%7d: %s: %s %s %s",
 289       (prev < 0 ? 0 : (timestamp - prev)),
 290       metricString,
 291       (isResponse ? "TAG" : "   "), line, crc);
 292
 293     prev = timestamp;
 294     i += (len + 9);
 295   }
 296   return 0;
 297 }
 298
 299 int CmdHFiClassSnoop(const char *Cmd)
 300 {
 301   UsbCommand c = {CMD_SNOOP_ICLASS};
 302   SendCommand(&c);
 303   return 0;
 304 }
 305
 306 int CmdHFiClassSim(const char *Cmd)
 307 {
 308   uint8_t simType = 0;
 309   uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
 310
 311   if (strlen(Cmd)<1) {
 312         PrintAndLog("Usage:  hf iclass sim [0 <CSN>] | x");
 313         PrintAndLog("        options");
 314         PrintAndLog("                0 <CSN> simulate the given CSN");
 315         PrintAndLog("                1       simulate default CSN");
 316         PrintAndLog("                2       iterate CSNs, gather MACs");
 317         PrintAndLog("        sample: hf iclass sim 0 031FEC8AF7FF12E0");
 318         PrintAndLog("        sample: hf iclass sim 2");
 319         return 0;
 320   }
 321
 322   simType = param_get8(Cmd, 0);
 323
 324   if(simType == 0)
 325   {
 326           if (param_gethex(Cmd, 1, CSN, 16)) {
 327                   PrintAndLog("A CSN should consist of 16 HEX symbols");
 328                   return 1;
 329           }
 330           PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
 331
 332   }
 333   if(simType > 2)
 334   {
 335           PrintAndLog("Undefined simptype %d", simType);
 336           return 1;
 337   }
 338   uint8_t numberOfCSNs=0;
 339
 340         if(simType == 2)
 341         {
 342                 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,63}};
 343                 UsbCommand resp = {0};
 344
 345                 uint8_t csns[64] = {
 346                          0x00,0x0B,0x0F,0xFF,0xF7,0xFF,0x12,0xE0 ,
 347                          0x00,0x13,0x94,0x7e,0x76,0xff,0x12,0xe0 ,
 348                          0x2a,0x99,0xac,0x79,0xec,0xff,0x12,0xe0 ,
 349                          0x17,0x12,0x01,0xfd,0xf7,0xff,0x12,0xe0 ,
 350                          0xcd,0x56,0x01,0x7c,0x6f,0xff,0x12,0xe0 ,
 351                          0x4b,0x5e,0x0b,0x72,0xef,0xff,0x12,0xe0 ,
 352                          0x00,0x73,0xd8,0x75,0x58,0xff,0x12,0xe0 ,
 353                          0x0c,0x90,0x32,0xf3,0x5d,0xff,0x12,0xe0 };
 354
 355                 memcpy(c.d.asBytes, csns, 64);
 356
 357                 SendCommand(&c);
 358                 if (!WaitForResponseTimeout(CMD_ACK, &resp, -1)) {
 359                         PrintAndLog("Command timed out");
 360                         return 0;
 361                 }
 362
 363                 uint8_t num_mac_responses  = resp.arg[1];
 364                 PrintAndLog("Mac responses: %d MACs obtained (should be 8)", num_mac_responses);
 365
 366                 size_t datalen = 8*24;
 367                 /*
 368                  * Now, time to dump to file. We'll use this format:
 369                  * <8-byte CSN><8-byte CC><4 byte NR><4 byte MAC>....
 370                  * So, it should wind up as
 371                  * 8 * 24 bytes.
 372                  *
 373                  * The returndata from the pm3 is on the following format
 374                  * <4 byte NR><4 byte MAC>
 375                  * CC are all zeroes, CSN is the same as was sent in
 376                  **/
 377                 void* dump = malloc(datalen);
 378                 memset(dump,0,datalen);//<-- Need zeroes for the CC-field
 379                 uint8_t i = 0;
 380                 for(i = 0 ; i < 8 ; i++)
 381                 {
 382                         memcpy(dump+i*24, csns+i*8,8); //CSN
 383                         //8 zero bytes here...
 384                         //Then comes NR_MAC (eight bytes from the response)
 385                         memcpy(dump+i*24+16,resp.d.asBytes+i*8,8);
 386
 387                 }
 388                 /** Now, save to dumpfile **/
 389                 saveFile("iclass_mac_attack", "bin", dump,datalen);
 390                 free(dump);
 391         }else
 392         {
 393                 UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType,numberOfCSNs}};
 394                 memcpy(c.d.asBytes, CSN, 8);
 395                 SendCommand(&c);
 396         }
 397
 398   return 0;
 399 }
 400
 401 int CmdHFiClassReader(const char *Cmd)
 402 {
 403   UsbCommand c = {CMD_READER_ICLASS, {0}};
 404   SendCommand(&c);
 405     UsbCommand resp;
 406   while(!ukbhit()){
 407       if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
 408             uint8_t isOK    = resp.arg[0] & 0xff;
 409             uint8_t * data  = resp.d.asBytes;
 410
 411             PrintAndLog("isOk:%02x", isOK);
 412
 413             if(isOK > 0)
 414             {
 415                 PrintAndLog("CSN: %s",sprint_hex(data,8));
 416             }
 417             if(isOK >= 1)
 418             {
 419                 PrintAndLog("CC: %s",sprint_hex(data+8,8));
 420             }else{
 421                 PrintAndLog("No CC obtained");
 422             }
 423         } else {
 424             PrintAndLog("Command execute timeout");
 425         }
 426     }
 427
 428   return 0;
 429 }
 430
 431 int CmdHFiClassReader_Replay(const char *Cmd)
 432 {
 433   uint8_t readerType = 0;
 434   uint8_t MAC[4]={0x00, 0x00, 0x00, 0x00};
 435
 436   if (strlen(Cmd)<1) {
 437     PrintAndLog("Usage:  hf iclass replay <MAC>");
 438     PrintAndLog("        sample: hf iclass replay 00112233");
 439         return 0;
 440   }
 441
 442   if (param_gethex(Cmd, 0, MAC, 8)) {
 443     PrintAndLog("MAC must include 8 HEX symbols");
 444     return 1;
 445   }
 446
 447   UsbCommand c = {CMD_READER_ICLASS_REPLAY, {readerType}};
 448   memcpy(c.d.asBytes, MAC, 4);
 449   SendCommand(&c);
 450
 451   return 0;
 452 }
 453
 454 int CmdHFiClassReader_Dump(const char *Cmd)
 455 {
 456   uint8_t readerType = 0;
 457   uint8_t MAC[4]={0x00,0x00,0x00,0x00};
 458   uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 459   uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 460   uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 461   //uint8_t CC_temp[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 462   uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 463   uint8_t keytable[128] = {0};
 464   int elite = 0;
 465   uint8_t *used_key;
 466   int i;
 467   if (strlen(Cmd)<1)
 468   {
 469     PrintAndLog("Usage:  hf iclass dump <Key> [e]");
 470     PrintAndLog("        Key    - A 16 byte master key");
 471     PrintAndLog("        e      - If 'e' is specified, the key is interpreted as the 16 byte");
 472     PrintAndLog("                 Custom Key (KCus), which can be obtained via reader-attack");
 473     PrintAndLog("                 See 'hf iclass sim 2'. This key should be on iclass-format");
 474     PrintAndLog("        sample: hf iclass dump 0011223344556677");
 475
 476
 477     return 0;
 478   }
 479
 480   if (param_gethex(Cmd, 0, KEY, 16))
 481   {
 482     PrintAndLog("KEY must include 16 HEX symbols");
 483     return 1;
 484   }
 485
 486   if (param_getchar(Cmd, 1) == 'e')
 487   {
 488     PrintAndLog("Elite switch on");
 489     elite = 1;
 490
 491     //calc h2
 492     hash2(KEY, keytable);
 493     printarr_human_readable("keytable", keytable, 128);
 494
 495   }
 496
 497
 498   UsbCommand c = {CMD_READER_ICLASS, {0}};
 499   c.arg[0] = FLAG_ICLASS_READER_ONLY_ONCE;
 500
 501   SendCommand(&c);
 502
 503   UsbCommand resp;
 504   uint8_t key_sel[8] = {0x00};
 505   uint8_t key_sel_p[8] = {0x00};
 506
 507   if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
 508         uint8_t isOK    = resp.arg[0] & 0xff;
 509         uint8_t * data  = resp.d.asBytes;
 510
 511         memcpy(CSN,data,8);
 512         memcpy(CCNR,data+8,8);
 513
 514         PrintAndLog("isOk:%02x", isOK);
 515
 516         if(isOK > 0)
 517         {
 518             PrintAndLog("CSN: %s",sprint_hex(CSN,8));
 519         }
 520         if(isOK > 1)
 521         {
 522             if(elite)
 523             {
 524
 525                 //Get the key index (hash1)
 526                 uint8_t key_index[8] = {0};
 527
 528                 hash1(CSN, key_index);
 529                 printvar("hash1", key_index,8);
 530                 for(i = 0; i < 8 ; i++)
 531                     key_sel[i] = keytable[key_index[i]] & 0xFF;
 532                 printvar("k_sel", key_sel,8);
 533                 //Permute from iclass format to standard format
 534                 permutekey_rev(key_sel,key_sel_p);
 535                 used_key = key_sel_p;
 536             }else{
 537                 //Perhaps this should also be permuted to std format?
 538                 // Something like the code below? I have no std system
 539                 // to test this with /Martin
 540
 541                 //uint8_t key_sel_p[8] = { 0 };
 542                 //permutekey_rev(KEY,key_sel_p);
 543                 //used_key = key_sel_p;
 544
 545                 used_key = KEY;
 546
 547             }
 548             printvar("Used key",used_key,8);
 549             diversifyKey(CSN,used_key, div_key);
 550             printvar("Div key", div_key, 8);
 551             printvar("CC_NR:",CCNR,12);
 552             doMAC(CCNR,12,div_key, MAC);
 553             printvar("MAC", MAC, 4);
 554
 555             UsbCommand d = {CMD_READER_ICLASS_REPLAY, {readerType}};
 556             memcpy(d.d.asBytes, MAC, 4);
 557             SendCommand(&d);
 558
 559         }else{
 560             PrintAndLog("Failed to obtain CC! Aborting");
 561         }
 562     } else {
 563         PrintAndLog("Command execute timeout");
 564     }
 565
 566   return 0;
 567 }
 568
 569 int CmdHFiClass_iso14443A_write(const char *Cmd)
 570 {
 571   uint8_t readerType = 0;
 572   uint8_t MAC[4]={0x00,0x00,0x00,0x00};
 573   uint8_t KEY[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 574   uint8_t CSN[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 575   uint8_t CCNR[12]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 576   uint8_t div_key[8]={0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
 577
 578   uint8_t blockNo=0;
 579   uint8_t bldata[8]={0};
 580
 581   if (strlen(Cmd)<3)
 582   {
 583     PrintAndLog("Usage:  hf iclass write <Key> <Block> <Data>");
 584     PrintAndLog("        sample: hf iclass write 0011223344556677 10 AAAAAAAAAAAAAAAA");
 585     return 0;
 586   }
 587
 588   if (param_gethex(Cmd, 0, KEY, 16))
 589   {
 590     PrintAndLog("KEY must include 16 HEX symbols");
 591     return 1;
 592   }
 593
 594   blockNo = param_get8(Cmd, 1);
 595   if (blockNo>32)
 596   {
 597         PrintAndLog("Error: Maximum number of blocks is 32 for iClass 2K Cards!");
 598         return 1;
 599   }
 600   if (param_gethex(Cmd, 2, bldata, 8))
 601   {
 602         PrintAndLog("Block data must include 8 HEX symbols");
 603         return 1;
 604   }
 605
 606   UsbCommand c = {CMD_ICLASS_ISO14443A_WRITE, {0}};
 607   SendCommand(&c);
 608   UsbCommand resp;
 609
 610   if (WaitForResponseTimeout(CMD_ACK,&resp,4500)) {
 611     uint8_t isOK    = resp.arg[0] & 0xff;
 612     uint8_t * data  = resp.d.asBytes;
 613
 614     memcpy(CSN,data,8);
 615     memcpy(CCNR,data+8,8);
 616     PrintAndLog("DEBUG: %s",sprint_hex(CSN,8));
 617     PrintAndLog("DEBUG: %s",sprint_hex(CCNR,8));
 618         PrintAndLog("isOk:%02x", isOK);
 619   } else {
 620         PrintAndLog("Command execute timeout");
 621   }
 622
 623   diversifyKey(CSN,KEY, div_key);
 624
 625   PrintAndLog("Div Key: %s",sprint_hex(div_key,8));
 626   doMAC(CCNR, 12,div_key, MAC);
 627
 628   UsbCommand c2 = {CMD_ICLASS_ISO14443A_WRITE, {readerType,blockNo}};
 629   memcpy(c2.d.asBytes, bldata, 8);
 630   memcpy(c2.d.asBytes+8, MAC, 4);
 631   SendCommand(&c2);
 632
 633   if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
 634     uint8_t isOK    = resp.arg[0] & 0xff;
 635     uint8_t * data  = resp.d.asBytes;
 636
 637     if (isOK)
 638       PrintAndLog("isOk:%02x data:%s", isOK, sprint_hex(data, 4));
 639     else
 640       PrintAndLog("isOk:%02x", isOK);
 641   } else {
 642       PrintAndLog("Command execute timeout");
 643   }
 644   return 0;
 645 }
 646
 647
 648 static command_t CommandTable[] =
 649 {
 650   {"help",    CmdHelp,        1, "This help"},
 651   {"list",    CmdHFiClassList,   0, "List iClass history"},
 652   {"snoop",   CmdHFiClassSnoop,  0, "Eavesdrop iClass communication"},
 653   {"sim",     CmdHFiClassSim,    0, "Simulate iClass tag"},
 654   {"reader",CmdHFiClassReader,  0,      "Read an iClass tag"},
 655   {"replay",CmdHFiClassReader_Replay,   0,      "Read an iClass tag via Reply Attack"},
 656   {"dump",      CmdHFiClassReader_Dump, 0,              "Authenticate and Dump iClass tag"},
 657   {"write",     CmdHFiClass_iso14443A_write,    0,      "Authenticate and Write iClass block"},
 658   {"replay",  CmdHFiClassReader_Replay, 0, "Read an iClass tag via Reply Attack"},
 659   {"dump",        CmdHFiClassReader_Dump, 0, "Authenticate and Dump iClass tag"},
 660   {"write",     CmdHFiClass_iso14443A_write,    0,      "Authenticate and Write iClass block"},
 661   {NULL, NULL, 0, NULL}
 662 };
 663
 664 int CmdHFiClass(const char *Cmd)
 665 {
 666   CmdsParse(CommandTable, Cmd);
 667   return 0;
 668 }
 669
 670 int CmdHelp(const char *Cmd)
 671 {
 672   CmdsHelp(CommandTable);
 673         return 0;
 674 }