cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // High frequency commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <string.h>
  13 #include "proxmark3.h"
  14 #include "graph.h"
  15 #include "ui.h"
  16 #include "cmdparser.h"
  17 #include "cmdhf.h"
  18 #include "cmdhf14a.h"
  19 #include "cmdhf14b.h"
  20 #include "cmdhf15.h"
  21 #include "cmdhfepa.h"
  22 #include "cmdhflegic.h"
  23 #include "cmdhficlass.h"
  24 #include "cmdhfmf.h"
  25 #include "cmdhfmfu.h"
  26 #include "cmdhfmfdes.h"
  27 #include "cmdhfdes.h"
  28
  29 static int CmdHelp(const char *Cmd);
  30
  31 int CmdHFTune(const char *Cmd)
  32 {
  33   UsbCommand c={CMD_MEASURE_ANTENNA_TUNING_HF};
  34   SendCommand(&c);
  35   return 0;
  36 }
  37 // for the time being. Need better Bigbuf handling.
  38 #define TRACE_SIZE 3000
  39
  40 #define ICLASS_CMD_ACTALL 0x0A
  41 #define ICLASS_CMD_IDENTIFY 0x0C
  42 #define ICLASS_CMD_READ 0x0C
  43 #define ICLASS_CMD_SELECT 0x81
  44 #define ICLASS_CMD_PAGESEL 0x84
  45 #define ICLASS_CMD_READCHECK 0x88
  46 #define ICLASS_CMD_CHECK 0x05
  47 #define ICLASS_CMD_SOF 0x0F
  48 #define ICLASS_CMD_HALT 0x00
  49
  50 #define iso14443_CMD_WUPA       0x52
  51 #define iso14443_CMD_SELECT     0x93
  52 #define iso14443_CMD_SELECT_2   0x95
  53 #define iso14443_CMD_SELECT_3   0x97
  54 #define iso14443_CMD_REQ        0x26
  55 #define iso14443_CMD_READBLOCK  0x30
  56 #define iso14443_CMD_WRITEBLOCK 0xA0
  57 #define iso14443_CMD_WRITE              0xA2
  58 #define iso14443_CMD_INC        0xC0
  59 #define iso14443_CMD_DEC        0xC1
  60 #define iso14443_CMD_RESTORE    0xC2
  61 #define iso14443_CMD_TRANSFER   0xB0
  62 #define iso14443_CMD_HALT       0x50
  63 #define iso14443_CMD_RATS       0xE0
  64
  65 #define iso14443_CMD_AUTH_KEYA  0x60
  66 #define iso14443_CMD_AUTH_KEYB  0x61
  67
  68 #define iso14443_CMD_AUTH_STEP1 0x1A
  69 #define iso14443_CMD_AUTH_STEP2 0xAA
  70 #define iso14443_CMD_AUTH_RESPONSE      0xAF
  71
  72 #define CHINESE_BACKDOOR_INIT   0x40
  73 #define CHINESE_BACKDOOR_STEP2   0x43
  74
  75 void annotateIso14443a(char *exp, size_t size, uint8_t* cmd, uint8_t cmdsize)
  76 {
  77         switch(cmd[0])
  78         {
  79         case iso14443_CMD_WUPA:            snprintf(exp,size,"WUPA"); break;
  80         case iso14443_CMD_SELECT:{
  81                 if(cmdsize > 2)
  82                 {
  83                         snprintf(exp,size,"SELECT_UID"); break;
  84                 }else
  85                 {
  86                         snprintf(exp,size,"SELECT_ALL"); break;
  87                 }
  88         }
  89         case iso14443_CMD_SELECT_2:    snprintf(exp,size,"SELECT_2"); break;
  90         case iso14443_CMD_REQ:         snprintf(exp,size,"REW"); break;
  91         case iso14443_CMD_READBLOCK:   snprintf(exp,size,"READBLOCK(%d)",cmd[1]); break;
  92         case iso14443_CMD_WRITEBLOCK:  snprintf(exp,size,"WRITEBLOCK(%d)",cmd[1]); break;
  93         case iso14443_CMD_WRITE:           snprintf(exp,size,"WRITE"); break;
  94         case iso14443_CMD_INC:         snprintf(exp,size,"INC(%d)",cmd[1]); break;
  95         case iso14443_CMD_DEC:         snprintf(exp,size,"DEC(%d)",cmd[1]); break;
  96         case iso14443_CMD_RESTORE:     snprintf(exp,size,"RESTORE(%d)",cmd[1]); break;
  97         case iso14443_CMD_TRANSFER:    snprintf(exp,size,"TRANSFER(%d)",cmd[1]); break;
  98         case iso14443_CMD_HALT:        snprintf(exp,size,"HALT"); break;
  99         case iso14443_CMD_RATS:        snprintf(exp,size,"RATS"); break;
 100
 101         case iso14443_CMD_AUTH_KEYA:   snprintf(exp,size,"AUTH KEY A"); break;
 102         case iso14443_CMD_AUTH_KEYB:   snprintf(exp,size,"AUTH KEY B"); break;
 103         case iso14443_CMD_AUTH_STEP1:  snprintf(exp,size,"AUTH REQ NONCE"); break;
 104         case iso14443_CMD_AUTH_STEP2:  snprintf(exp,size,"AUTH STEP 2"); break;
 105         case iso14443_CMD_AUTH_RESPONSE:  snprintf(exp,size,"AUTH RESPONSE"); break;
 106
 107         case CHINESE_BACKDOOR_INIT:    snprintf(exp,size,"BACKDOOR INIT");break;
 108         case CHINESE_BACKDOOR_STEP2:    snprintf(exp,size,"BACKDOOR STEP2");break;
 109         default:                       snprintf(exp,size,"?"); break;
 110         }
 111         return;
 112 }
 113
 114 void annotateIclass(char *exp, size_t size, uint8_t* cmd, uint8_t cmdsize)
 115 {
 116         if(cmdsize > 1 && cmd[0] == ICLASS_CMD_READ)
 117         {
 118                   snprintf(exp,size,"READ(%d)",cmd[1]);
 119                   return;
 120         }
 121
 122         switch(cmd[0])
 123         {
 124         case ICLASS_CMD_ACTALL:      snprintf(exp,size,"ACTALL"); break;
 125         case ICLASS_CMD_IDENTIFY:    snprintf(exp,size,"IDENTIFY"); break;
 126         case ICLASS_CMD_SELECT:      snprintf(exp,size,"SELECT"); break;
 127         case ICLASS_CMD_PAGESEL:     snprintf(exp,size,"PAGESEL"); break;
 128         case ICLASS_CMD_READCHECK:   snprintf(exp,size,"READCHECK"); break;
 129         case ICLASS_CMD_CHECK:       snprintf(exp,size,"CHECK"); break;
 130         case ICLASS_CMD_SOF:         snprintf(exp,size,"SOF"); break;
 131         case ICLASS_CMD_HALT:        snprintf(exp,size,"HALT"); break;
 132         default:                     snprintf(exp,size,"?"); break;
 133         }
 134         return;
 135 }
 136
 137
 138 uint16_t printTraceLine(uint16_t tracepos, uint8_t* trace, bool iclass, bool showWaitCycles)
 139 {
 140         bool isResponse;
 141         uint16_t duration, data_len,parity_len;
 142
 143         uint32_t timestamp, first_timestamp, EndOfTransmissionTimestamp;
 144         char explanation[30] = {0};
 145
 146         first_timestamp = *((uint32_t *)(trace));
 147         timestamp = *((uint32_t *)(trace + tracepos));
 148         // Break and stick with current result if buffer was not completely full
 149         if (timestamp == 0x44444444) return TRACE_SIZE;
 150
 151         tracepos += 4;
 152         duration = *((uint16_t *)(trace + tracepos));
 153         tracepos += 2;
 154         data_len = *((uint16_t *)(trace + tracepos));
 155         tracepos += 2;
 156
 157         if (data_len & 0x8000) {
 158           data_len &= 0x7fff;
 159           isResponse = true;
 160         } else {
 161           isResponse = false;
 162         }
 163         parity_len = (data_len-1)/8 + 1;
 164
 165         if (tracepos + data_len + parity_len >= TRACE_SIZE) {
 166                 return TRACE_SIZE;
 167         }
 168
 169         uint8_t *frame = trace + tracepos;
 170         tracepos += data_len;
 171         uint8_t *parityBytes = trace + tracepos;
 172         tracepos += parity_len;
 173
 174         //--- Draw the data column
 175         char line[16][110];
 176         for (int j = 0; j < data_len; j++) {
 177                 int oddparity = 0x01;
 178                 int k;
 179
 180                 for (k=0 ; k<8 ; k++) {
 181                         oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
 182                 }
 183
 184                 uint8_t parityBits = parityBytes[j>>3];
 185
 186                 if (isResponse && (oddparity != ((parityBits >> (7-(j&0x0007))) & 0x01))) {
 187                         sprintf(line[j/16]+((j%16)*4), "%02x! ", frame[j]);
 188                 } else {
 189                         sprintf(line[j/16]+((j%16)*4), "%02x  ", frame[j]);
 190                 }
 191         }
 192         //--- Draw the CRC column
 193         bool crcError = false;
 194
 195         if (data_len > 2) {
 196                 uint8_t b1, b2;
 197                 if(iclass)
 198                 {
 199                         if(!isResponse && data_len == 4 ) {
 200                                 // Rough guess that this is a command from the reader
 201                                 // For iClass the command byte is not part of the CRC
 202                                 ComputeCrc14443(CRC_ICLASS, &frame[1], data_len-3, &b1, &b2);
 203                         } else {
 204                                 // For other data.. CRC might not be applicable (UPDATE commands etc.)
 205                                 ComputeCrc14443(CRC_ICLASS, frame, data_len-2, &b1, &b2);
 206                         }
 207
 208                         if (b1 != frame[data_len-2] || b2 != frame[data_len-1]) {
 209                                 crcError = true;
 210                         }
 211
 212                 } else {//Iso 14443a
 213
 214                         ComputeCrc14443(CRC_14443_A, frame, data_len-2, &b1, &b2);
 215
 216                         if (b1 != frame[data_len-2] || b2 != frame[data_len-1]) {
 217                                 if(!(isResponse & (data_len < 6)))
 218                                 {
 219                                                 crcError = true;
 220                                 }
 221                         }
 222                 }
 223         }
 224         char *crc = crcError ? "!crc" :"    ";
 225
 226         EndOfTransmissionTimestamp = timestamp + duration;
 227
 228         if(!isResponse)
 229         {
 230                 if(iclass)
 231                         annotateIclass(explanation,sizeof(explanation),frame,data_len);
 232                 else
 233                         annotateIso14443a(explanation,sizeof(explanation),frame,data_len);
 234         }
 235
 236         int num_lines = (data_len - 1)/16 + 1;
 237         for (int j = 0; j < num_lines; j++) {
 238                 if (j == 0) {
 239                         PrintAndLog(" %9d | %9d | %s | %-64s| %s| %s",
 240                                 (timestamp - first_timestamp),
 241                                 (EndOfTransmissionTimestamp - first_timestamp),
 242                                 (isResponse ? "Tag" : "Rdr"),
 243                                 line[j],
 244                                 (j == num_lines-1) ? crc : "    ",
 245                                 (j == num_lines-1) ? explanation : "");
 246                 } else {
 247                         PrintAndLog("           |           |     | %-64s| %s| %s",
 248                                 line[j],
 249                                 (j == num_lines-1) ? crc : "    ",
 250                                 (j == num_lines-1) ? explanation : "");
 251                 }
 252         }
 253
 254         bool next_isResponse = *((uint16_t *)(trace + tracepos + 6)) & 0x8000;
 255
 256         if (showWaitCycles && !isResponse && next_isResponse) {
 257                 uint32_t next_timestamp = *((uint32_t *)(trace + tracepos));
 258                 if (next_timestamp != 0x44444444) {
 259                         PrintAndLog(" %9d | %9d | %s | fdt (Frame Delay Time): %d",
 260                                 (EndOfTransmissionTimestamp - first_timestamp),
 261                                 (next_timestamp - first_timestamp),
 262                                 "   ",
 263                                 (next_timestamp - EndOfTransmissionTimestamp));
 264                 }
 265         }
 266         return tracepos;
 267 }
 268
 269 int CmdHFList(const char *Cmd)
 270 {
 271         bool showWaitCycles = false;
 272         char type[40] = {0};
 273         int tlen = param_getstr(Cmd,0,type);
 274         char param = param_getchar(Cmd, 1);
 275         bool errors = false;
 276         bool iclass = false;
 277         //Validate params
 278         if(tlen == 0 || (strcmp(type, "iclass") != 0 && strcmp(type,"14a") != 0))
 279         {
 280                 errors = true;
 281         }
 282         if(param == 'h' || (param !=0 && param != 'f'))
 283         {
 284                 errors = true;
 285         }
 286
 287         if (errors) {
 288                 PrintAndLog("List protocol data in trace buffer.");
 289                 PrintAndLog("Usage:  hf list [14a|iclass] [f]");
 290                 PrintAndLog("    14a    - interpret data as iso14443a communications");
 291                 PrintAndLog("    iclass - interpret data as iclass communications");
 292                 PrintAndLog("    f      - show frame delay times as well");
 293                 PrintAndLog("");
 294                 PrintAndLog("example: hf list 14a f");
 295                 PrintAndLog("example: hf list iclass");
 296                 return 0;
 297         }
 298         if(strcmp(type, "iclass") == 0)
 299         {
 300                 iclass = true;
 301         }
 302
 303         if (param == 'f') {
 304                 showWaitCycles = true;
 305         }
 306
 307
 308         uint8_t trace[TRACE_SIZE];
 309         uint16_t tracepos = 0;
 310         GetFromBigBuf(trace, TRACE_SIZE, 0);
 311         WaitForResponse(CMD_ACK, NULL);
 312
 313         PrintAndLog("Recorded Activity");
 314         PrintAndLog("");
 315         PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
 316         PrintAndLog("iso14443a - All times are in carrier periods (1/13.56Mhz)");
 317         PrintAndLog("iClass    - Timings are not as accurate");
 318         PrintAndLog("");
 319         PrintAndLog("     Start |       End | Src | Data (! denotes parity error)                                   | CRC | Annotation         |");
 320         PrintAndLog("-----------|-----------|-----|-----------------------------------------------------------------|-----|--------------------|");
 321
 322         while(tracepos < TRACE_SIZE)
 323         {
 324                 tracepos = printTraceLine(tracepos, trace, iclass, showWaitCycles);
 325         }
 326         return 0;
 327 }
 328
 329
 330 static command_t CommandTable[] =
 331 {
 332   {"help",        CmdHelp,          1, "This help"},
 333   {"14a",         CmdHF14A,         1, "{ ISO14443A RFIDs... }"},
 334   {"14b",         CmdHF14B,         1, "{ ISO14443B RFIDs... }"},
 335   {"15",          CmdHF15,          1, "{ ISO15693 RFIDs... }"},
 336   {"epa",         CmdHFEPA,         1, "{ German Identification Card... }"},
 337   {"legic",       CmdHFLegic,       0, "{ LEGIC RFIDs... }"},
 338   {"iclass",      CmdHFiClass,      1, "{ ICLASS RFIDs... }"},
 339   {"mf",                CmdHFMF,                      1, "{ MIFARE RFIDs... }"},
 340   {"mfu",                       CmdHFMFUltra,           1, "{ MIFARE Ultralight RFIDs... }"},
 341   {"mfdes",                     CmdHFMFDes,                     1, "{ MIFARE Desfire RFIDs... }"},
 342   {"des",         CmdHFDES,         0, "{ MIFARE DESfire}"},
 343   {"tune",        CmdHFTune,        0, "Continuously measure HF antenna tuning"},
 344   {"list",       CmdHFList,         1, "List protocol data in trace buffer"},
 345   {NULL, NULL, 0, NULL}
 346 };
 347
 348 int CmdHF(const char *Cmd)
 349 {
 350   CmdsParse(CommandTable, Cmd);
 351   return 0;
 352 }
 353
 354 int CmdHelp(const char *Cmd)
 355 {
 356   CmdsHelp(CommandTable);
 357   return 0;
 358 }