1 //-----------------------------------------------------------------------------
3 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
8 //-----------------------------------------------------------------------------
9 // High frequency ISO14443A commands
10 //-----------------------------------------------------------------------------
17 #include "../common/iso14443crc.h"
19 #include "proxmark3.h"
21 #include "cmdparser.h"
23 #include "../include/common.h"
25 #include "../include/mifare.h"
27 static int CmdHelp(const char *Cmd
);
28 static void waitCmd(uint8_t iLen
);
30 int CmdHF14AList(const char *Cmd
)
32 bool ShowWaitCycles
= false;
33 char param
= param_getchar(Cmd
, 0);
35 if (param
== 'h' || (param
!= 0 && param
!= 'f')) {
36 PrintAndLog("List data in trace buffer.");
37 PrintAndLog("Usage: hf 14a list [f]");
38 PrintAndLog("f - show frame delay times as well");
39 PrintAndLog("sample: hf 14a list f");
44 ShowWaitCycles
= true;
48 GetFromBigBuf(got
,sizeof(got
),0);
49 WaitForResponse(CMD_ACK
,NULL
);
51 PrintAndLog("Recorded Activity");
53 PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
54 PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
56 PrintAndLog(" Start | End | Src | Data");
57 PrintAndLog("-----------|-----------|-----|--------");
60 uint32_t first_timestamp
= 0;
62 uint32_t EndOfTransmissionTimestamp
= 0;
70 timestamp
= *((uint32_t *)(got
+i
));
71 if (timestamp
& 0x80000000) {
72 timestamp
&= 0x7fffffff;
79 first_timestamp
= timestamp
;
82 int parityBits
= *((uint32_t *)(got
+i
+4));
89 if (i
+ len
>= 1900) {
93 uint8_t *frame
= (got
+i
+9);
95 // Break and stick with current result if buffer was not completely full
96 if (frame
[0] == 0x44 && frame
[1] == 0x44 && frame
[2] == 0x44 && frame
[3] == 0x44) break;
101 for (j
= 0; j
< len
; j
++) {
102 int oddparity
= 0x01;
106 oddparity
^= (((frame
[j
] & 0xFF) >> k
) & 0x01);
109 //if((parityBits >> (len - j - 1)) & 0x01) {
110 if (isResponse
&& (oddparity
!= ((parityBits
>> (len
- j
- 1)) & 0x01))) {
111 sprintf(line
+(j
*4), "%02x! ", frame
[j
]);
113 sprintf(line
+(j
*4), "%02x ", frame
[j
]);
117 if (ShowWaitCycles
) {
118 uint32_t next_timestamp
= (*((uint32_t *)(got
+i
+9))) & 0x7fffffff;
119 sprintf(line
, "fdt (Frame Delay Time): %d", (next_timestamp
- timestamp
));
127 for (j
= 0; j
< (len
- 1); j
++) {
128 // gives problems... search for the reason..
129 /*if(frame[j] == 0xAA) {
132 crc = "[1] Two drops close after each other";
135 crc = "[2] Potential SOC with a drop in second half of bitperiod";
138 crc = "[3] Segment Z after segment X is not possible";
141 crc = "[4] Parity bit of a fully received byte was wrong";
144 crc = "[?] Unknown error";
151 if (strlen(crc
)==0) {
152 ComputeCrc14443(CRC_14443_A
, frame
, len
-2, &b1
, &b2
);
153 if (b1
!= frame
[len
-2] || b2
!= frame
[len
-1]) {
154 crc
= (isResponse
& (len
< 6)) ? "" : " !crc";
165 EndOfTransmissionTimestamp
= (*((uint32_t *)(got
+i
))) & 0x7fffffff;
167 if (!ShowWaitCycles
) i
+= 9;
169 PrintAndLog(" %9d | %9d | %s | %s %s",
170 (timestamp
- first_timestamp
),
171 (EndOfTransmissionTimestamp
- first_timestamp
),
172 (len
?(isResponse
? "Tag" : "Rdr"):" "),
179 void iso14a_set_timeout(uint32_t timeout
) {
180 UsbCommand c
= {CMD_READER_ISO_14443a
, {ISO14A_SET_TIMEOUT
, 0, timeout
}};
184 int CmdHF14AReader(const char *Cmd
)
186 UsbCommand c
= {CMD_READER_ISO_14443a
, {ISO14A_CONNECT
, 0, 0}};
190 WaitForResponse(CMD_ACK
,&resp
);
192 iso14a_card_select_t
*card
= (iso14a_card_select_t
*)resp
.d
.asBytes
;
194 if(resp
.arg
[0] == 0) {
195 PrintAndLog("iso14443a card select failed");
199 PrintAndLog("ATQA : %02x %02x", card
->atqa
[0], card
->atqa
[1]);
200 PrintAndLog(" UID : %s", sprint_hex(card
->uid
, card
->uidlen
));
201 PrintAndLog(" SAK : %02x [%d]", card
->sak
, resp
.arg
[0]);
204 case 0x00: PrintAndLog("TYPE : NXP MIFARE Ultralight | Ultralight C"); break;
205 case 0x01: PrintAndLog("TYPE : NXP TNP3xxx Activision Game Appliance"); break;
206 case 0x04: PrintAndLog("TYPE : NXP MIFARE (various !DESFire !DESFire EV1)"); break;
207 case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1"); break;
208 case 0x09: PrintAndLog("TYPE : NXP MIFARE Mini 0.3k"); break;
209 case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k SL2"); break;
210 case 0x11: PrintAndLog("TYPE : NXP MIFARE Plus 4k SL2"); break;
211 case 0x18: PrintAndLog("TYPE : NXP MIFARE Classic 4k | Plus 4k SL1"); break;
212 case 0x20: PrintAndLog("TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41"); break;
213 case 0x24: PrintAndLog("TYPE : NXP MIFARE DESFire | DESFire EV1"); break;
214 case 0x28: PrintAndLog("TYPE : JCOP31 or JCOP41 v2.3.1"); break;
215 case 0x38: PrintAndLog("TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K"); break;
216 case 0x88: PrintAndLog("TYPE : Infineon MIFARE CLASSIC 1K"); break;
217 case 0x98: PrintAndLog("TYPE : Gemplus MPCOS"); break;
220 if(resp
.arg
[0] == 1) {
221 bool ta1
= 0, tb1
= 0, tc1
= 0;
224 PrintAndLog(" ATS : %s", sprint_hex(card
->ats
, card
->ats_len
));
225 if (card
->ats_len
> 0) {
226 PrintAndLog(" - TL : length is %d bytes", card
->ats
[0]);
228 if (card
->ats_len
> 1) {
229 ta1
= (card
->ats
[1] & 0x10) == 0x10;
230 tb1
= (card
->ats
[1] & 0x20) == 0x20;
231 tc1
= (card
->ats
[1] & 0x40) == 0x40;
232 PrintAndLog(" - T0 : TA1 is%s present, TB1 is%s present, "
233 "TC1 is%s present, FSCI is %d",
234 (ta1
? "" : " NOT"), (tb1
? "" : " NOT"), (tc1
? "" : " NOT"),
235 (card
->ats
[1] & 0x0f));
238 if (ta1
&& card
->ats_len
> pos
) {
240 dr
[0] = ds
[0] = '\0';
241 if (card
->ats
[pos
] & 0x10) strcat(ds
, "2, ");
242 if (card
->ats
[pos
] & 0x20) strcat(ds
, "4, ");
243 if (card
->ats
[pos
] & 0x40) strcat(ds
, "8, ");
244 if (card
->ats
[pos
] & 0x01) strcat(dr
, "2, ");
245 if (card
->ats
[pos
] & 0x02) strcat(dr
, "4, ");
246 if (card
->ats
[pos
] & 0x04) strcat(dr
, "8, ");
247 if (strlen(ds
) != 0) ds
[strlen(ds
) - 2] = '\0';
248 if (strlen(dr
) != 0) dr
[strlen(dr
) - 2] = '\0';
249 PrintAndLog(" - TA1 : different divisors are%s supported, "
250 "DR: [%s], DS: [%s]",
251 (card
->ats
[pos
] & 0x80 ? " NOT" : ""), dr
, ds
);
254 if (tb1
&& card
->ats_len
> pos
) {
255 PrintAndLog(" - TB1 : SFGI = %d, FWI = %d",
256 (card
->ats
[pos
] & 0x08),
257 (card
->ats
[pos
] & 0x80) >> 4);
260 if (tc1
&& card
->ats_len
> pos
) {
261 PrintAndLog(" - TC1 : NAD is%s supported, CID is%s supported",
262 (card
->ats
[pos
] & 0x01) ? "" : " NOT",
263 (card
->ats
[pos
] & 0x02) ? "" : " NOT");
266 if (card
->ats_len
> pos
) {
268 if (card
->ats_len
- pos
> 7) {
269 if (memcmp(card
->ats
+ pos
, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) {
270 tip
= "-> MIFARE Plus X 2K or 4K";
271 } else if (memcmp(card
->ats
+ pos
, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) {
272 tip
= "-> MIFARE Plus S 2K or 4K";
275 PrintAndLog(" - HB : %s%s", sprint_hex(card
->ats
+ pos
, card
->ats_len
- pos
- 2), tip
);
276 if (card
->ats
[pos
] == 0xC1) {
277 PrintAndLog(" c1 -> Mifare or (multiple) virtual cards of various type");
278 PrintAndLog(" %02x -> Length is %d bytes",
279 card
->ats
[pos
+ 1], card
->ats
[pos
+ 1]);
280 switch (card
->ats
[pos
+ 2] & 0xf0) {
282 PrintAndLog(" 1x -> MIFARE DESFire");
285 PrintAndLog(" 2x -> MIFARE Plus");
288 switch (card
->ats
[pos
+ 2] & 0x0f) {
290 PrintAndLog(" x0 -> <1 kByte");
293 PrintAndLog(" x0 -> 1 kByte");
296 PrintAndLog(" x0 -> 2 kByte");
299 PrintAndLog(" x0 -> 4 kByte");
302 PrintAndLog(" x0 -> 8 kByte");
305 switch (card
->ats
[pos
+ 3] & 0xf0) {
307 PrintAndLog(" 0x -> Engineering sample");
310 PrintAndLog(" 2x -> Released");
313 switch (card
->ats
[pos
+ 3] & 0x0f) {
315 PrintAndLog(" x0 -> Generation 1");
318 PrintAndLog(" x1 -> Generation 2");
321 PrintAndLog(" x2 -> Generation 3");
324 switch (card
->ats
[pos
+ 4] & 0x0f) {
326 PrintAndLog(" x0 -> Only VCSL supported");
329 PrintAndLog(" x1 -> VCS, VCSL, and SVC supported");
332 PrintAndLog(" xE -> no VCS command supported");
338 PrintAndLog("proprietary non iso14443a-4 card found, RATS not supported");
344 // Collect ISO14443 Type A UIDs
345 int CmdHF14ACUIDs(const char *Cmd
)
347 // requested number of UIDs
349 // collect at least 1 (e.g. if no parameter was given)
352 PrintAndLog("Collecting %d UIDs", n
);
353 PrintAndLog("Start: %u", time(NULL
));
355 for (int i
= 0; i
< n
; i
++) {
356 // execute anticollision procedure
357 UsbCommand c
= {CMD_READER_ISO_14443a
, {ISO14A_CONNECT
, 0, 0}};
361 WaitForResponse(CMD_ACK
,&resp
);
363 uint8_t *uid
= resp
.d
.asBytes
;
364 iso14a_card_select_t
*card
= (iso14a_card_select_t
*)(uid
+ 12);
366 // check if command failed
367 if (resp
.arg
[0] == 0) {
368 PrintAndLog("Card select failed.");
370 // check if UID is 4 bytes
371 if ((card
->atqa
[1] & 0xC0) == 0) {
372 PrintAndLog("%02X%02X%02X%02X",
373 *uid
, *(uid
+ 1), *(uid
+ 2), *(uid
+ 3));
375 PrintAndLog("UID longer than 4 bytes");
379 PrintAndLog("End: %u", time(NULL
));
384 // ## simulate iso14443a tag
385 // ## greg - added ability to specify tag UID
386 int CmdHF14ASim(const char *Cmd
)
388 UsbCommand c
= {CMD_SIMULATE_TAG_ISO_14443a
,{0,0,0}};
390 // Retrieve the tag type
391 uint8_t tagtype
= param_get8ex(Cmd
,0,0,10);
393 // When no argument was given, just print help message
396 PrintAndLog(" Emulating ISO/IEC 14443 type A tag with 4 or 7 byte UID");
398 PrintAndLog(" syntax: hf 14a sim <type> <uid>");
399 PrintAndLog(" types: 1 = MIFARE Classic");
400 PrintAndLog(" 2 = MIFARE Ultralight");
401 PrintAndLog(" 3 = MIFARE DESFIRE");
402 PrintAndLog(" 4 = ISO/IEC 14443-4");
407 // Store the tag type
410 // Retrieve the full 4 or 7 byte long uid
411 uint64_t long_uid
= param_get64ex(Cmd
,1,0,16);
413 // Are we handling the (optional) second part uid?
414 if (long_uid
> 0xffffffff) {
415 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 7 byte UID (%014"llx
")",long_uid
);
416 // Store the second part
417 c
.arg
[2] = (long_uid
& 0xffffffff);
419 // Store the first part, ignore the first byte, it is replaced by cascade byte (0x88)
420 c
.arg
[1] = (long_uid
& 0xffffff);
422 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 4 byte UID (%08x)",long_uid
);
423 // Only store the first part
424 c
.arg
[1] = long_uid
& 0xffffffff;
427 // At lease save the mandatory first part of the UID
428 c.arg[0] = long_uid & 0xffffffff;
431 PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
436 PrintAndLog("Emulating ISO/IEC 14443-3 type A tag with 4 byte UID");
437 UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
440 PrintAndLog("Emulating ISO/IEC 14443-4 type A tag with 7 byte UID");
443 PrintAndLog("Error: unkown tag type (%d)",c.arg[0]);
444 PrintAndLog("syntax: hf 14a sim <uid>",c.arg[0]);
445 PrintAndLog(" type1: 4 ",c.arg[0]);
452 unsigned int hi = 0, lo = 0;
454 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
455 hi= (hi << 4) | (lo >> 28);
456 lo= (lo << 4) | (n & 0xf);
459 // UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
460 // PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
465 int CmdHF14ASnoop(const char *Cmd
) {
468 if (param_getchar(Cmd
, 0) == 'h') {
469 PrintAndLog("It get data from the field and saves it into command buffer.");
470 PrintAndLog("Buffer accessible from command hf 14a list.");
471 PrintAndLog("Usage: hf 14a snoop [c][r]");
472 PrintAndLog("c - triggered by first data from card");
473 PrintAndLog("r - triggered by first 7-bit request from reader (REQ,WUP,...)");
474 PrintAndLog("sample: hf 14a snoop c r");
478 for (int i
= 0; i
< 2; i
++) {
479 char ctmp
= param_getchar(Cmd
, i
);
480 if (ctmp
== 'c' || ctmp
== 'C') param
|= 0x01;
481 if (ctmp
== 'r' || ctmp
== 'R') param
|= 0x02;
484 UsbCommand c
= {CMD_SNOOP_ISO_14443a
, {param
, 0, 0}};
489 int CmdHF14ACmdRaw(const char *cmd
) {
490 UsbCommand c
= {CMD_READER_ISO_14443a
, {0, 0, 0}};
495 uint8_t active_select
=0;
501 uint8_t data
[USB_CMD_DATA_SIZE
];
502 unsigned int datalen
=0, temp
;
505 PrintAndLog("Usage: hf 14a raw [-r] [-c] [-p] [-f] [-b] [-t] <number of bits> <0A 0B 0C ... hex>");
506 PrintAndLog(" -r do not read response");
507 PrintAndLog(" -c calculate and append CRC");
508 PrintAndLog(" -p leave the signal field ON after receive");
509 PrintAndLog(" -a active signal field ON without select");
510 PrintAndLog(" -s active signal field ON with select");
511 PrintAndLog(" -b number of bits to send. Useful for send partial byte");
512 PrintAndLog(" -t timeout");
517 while (*cmd
==' ' || *cmd
=='\t') cmd
++;
519 while (cmd
[i
]!='\0') {
520 if (cmd
[i
]==' ' || cmd
[i
]=='\t') { i
++; continue; }
539 sscanf(cmd
+i
+2,"%d",&temp
);
540 numbits
= temp
& 0xFFFF;
542 while(cmd
[i
]!=' ' && cmd
[i
]!='\0') { i
++; }
547 sscanf(cmd
+i
+2,"%d",&temp
);
548 timeout
= temp
& 0xFFFF;
550 while(cmd
[i
]!=' ' && cmd
[i
]!='\0') { i
++; }
554 PrintAndLog("Invalid option");
560 if ((cmd
[i
]>='0' && cmd
[i
]<='9') ||
561 (cmd
[i
]>='a' && cmd
[i
]<='f') ||
562 (cmd
[i
]>='A' && cmd
[i
]<='F') ) {
563 buf
[strlen(buf
)+1]=0;
564 buf
[strlen(buf
)]=cmd
[i
];
567 if (strlen(buf
)>=2) {
568 sscanf(buf
,"%x",&temp
);
569 data
[datalen
]=(uint8_t)(temp
& 0xff);
571 if (++datalen
>sizeof(data
)){
573 PrintAndLog("Buffer is full, we can't add CRC to your data");
579 PrintAndLog("Invalid char on input");
582 if(crc
&& datalen
>0 && datalen
<sizeof(data
)-2)
584 uint8_t first
, second
;
585 ComputeCrc14443(CRC_14443_A
, data
, datalen
, &first
, &second
);
586 data
[datalen
++] = first
;
587 data
[datalen
++] = second
;
590 if(active
|| active_select
)
592 c
.arg
[0] |= ISO14A_CONNECT
;
594 c
.arg
[0] |= ISO14A_NO_SELECT
;
597 #define MAX_TIMEOUT 624*105 // max timeout is 624 ms
598 c
.arg
[0] |= ISO14A_SET_TIMEOUT
;
599 c
.arg
[2] = timeout
* 105; // each bit is about 9.4 us
600 if(c
.arg
[2]>MAX_TIMEOUT
) {
601 c
.arg
[2] = MAX_TIMEOUT
;
602 PrintAndLog("Set timeout to 624 ms. The max we can wait for response");
606 c
.arg
[0] |= ISO14A_NO_DISCONNECT
;
608 c
.arg
[0] |= ISO14A_RAW
;
610 // Max buffer is USB_CMD_DATA_SIZE
611 c
.arg
[1] = (datalen
& 0xFFFF) | (numbits
<< 16);
612 memcpy(c
.d
.asBytes
,data
,datalen
);
625 static void waitCmd(uint8_t iSelect
)
631 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1000)) {
632 recv
= resp
.d
.asBytes
;
633 uint8_t iLen
= iSelect
? resp
.arg
[1] : resp
.arg
[0];
634 PrintAndLog("received %i octets",iLen
);
637 hexout
= (char *)malloc(iLen
* 3 + 1);
638 if (hexout
!= NULL
) {
639 for (int i
= 0; i
< iLen
; i
++) { // data in hex
640 sprintf(&hexout
[i
* 3], "%02X ", recv
[i
]);
642 PrintAndLog("%s", hexout
);
645 PrintAndLog("malloc failed your client has low memory?");
648 PrintAndLog("timeout while waiting for reply.");
652 static command_t CommandTable
[] =
654 {"help", CmdHelp
, 1, "This help"},
655 {"list", CmdHF14AList
, 0, "List ISO 14443a history"},
656 {"reader", CmdHF14AReader
, 0, "Act like an ISO14443 Type A reader"},
657 {"cuids", CmdHF14ACUIDs
, 0, "<n> Collect n>0 ISO14443 Type A UIDs in one go"},
658 {"sim", CmdHF14ASim
, 0, "<UID> -- Fake ISO 14443a tag"},
659 {"snoop", CmdHF14ASnoop
, 0, "Eavesdrop ISO 14443 Type A"},
660 {"raw", CmdHF14ACmdRaw
, 0, "Send raw hex data to tag"},
661 {NULL
, NULL
, 0, NULL
}
664 int CmdHF14A(const char *Cmd
) {
666 WaitForResponseTimeout(CMD_ACK
,NULL
,100);
669 CmdsParse(CommandTable
, Cmd
);
673 int CmdHelp(const char *Cmd
)
675 CmdsHelp(CommandTable
);