cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf14a.c

   1 //-----------------------------------------------------------------------------
   2 // 2011, Merlok
   3 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
   4 //
   5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   6 // at your option, any later version. See the LICENSE.txt file for the text of
   7 // the license.
   8 //-----------------------------------------------------------------------------
   9 // High frequency ISO14443A commands
  10 //-----------------------------------------------------------------------------
  11
  12 #include <stdio.h>
  13 #include <stdlib.h>
  14 #include <string.h>
  15 #include <unistd.h>
  16 #include "util.h"
  17 #include "iso14443crc.h"
  18 #include "data.h"
  19 #include "proxmark3.h"
  20 #include "ui.h"
  21 #include "cmdparser.h"
  22 #include "cmdhf14a.h"
  23 #include "common.h"
  24 #include "cmdmain.h"
  25 #include "mifare.h"
  26
  27 static int CmdHelp(const char *Cmd);
  28 static void waitCmd(uint8_t iLen);
  29
  30 int CmdHF14AList(const char *Cmd)
  31 {
  32         bool ShowWaitCycles = false;
  33         char param = param_getchar(Cmd, 0);
  34
  35         if (param == 'h' || (param != 0 && param != 'f')) {
  36                 PrintAndLog("List data in trace buffer.");
  37                 PrintAndLog("Usage:  hf 14a list [f]");
  38                 PrintAndLog("f - show frame delay times as well");
  39                 PrintAndLog("sample: hf 14a list f");
  40                 return 0;
  41         }
  42
  43         if (param == 'f') {
  44                 ShowWaitCycles = true;
  45         }
  46
  47         uint8_t got[1920];
  48         GetFromBigBuf(got,sizeof(got),0);
  49         WaitForResponse(CMD_ACK,NULL);
  50
  51         PrintAndLog("Recorded Activity");
  52         PrintAndLog("");
  53         PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
  54         PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
  55         PrintAndLog("");
  56         PrintAndLog("     Start |       End | Src | Data");
  57         PrintAndLog("-----------|-----------|-----|--------");
  58
  59         int i = 0;
  60         uint32_t first_timestamp = 0;
  61         uint32_t timestamp;
  62         uint32_t EndOfTransmissionTimestamp = 0;
  63
  64         for (;;) {
  65                 if(i >= 1900) {
  66                         break;
  67                 }
  68
  69                 bool isResponse;
  70                 timestamp = *((uint32_t *)(got+i));
  71                 if (timestamp & 0x80000000) {
  72                   timestamp &= 0x7fffffff;
  73                   isResponse = true;
  74                 } else {
  75                   isResponse = false;
  76                 }
  77
  78                 if(i==0) {
  79                         first_timestamp = timestamp;
  80                 }
  81
  82                 int parityBits = *((uint32_t *)(got+i+4));
  83
  84                 int len = got[i+8];
  85
  86                 if (len > 100) {
  87                         break;
  88                 }
  89                 if (i + len >= 1900) {
  90                         break;
  91                 }
  92
  93                 uint8_t *frame = (got+i+9);
  94
  95                 // Break and stick with current result if buffer was not completely full
  96                 if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break;
  97
  98                 char line[1000] = "";
  99                 int j;
 100                 if (len) {
 101                         for (j = 0; j < len; j++) {
 102                                 int oddparity = 0x01;
 103                                 int k;
 104
 105                                 for (k=0;k<8;k++) {
 106                                         oddparity ^= (((frame[j] & 0xFF) >> k) & 0x01);
 107                                 }
 108
 109                                 //if((parityBits >> (len - j - 1)) & 0x01) {
 110                                 if (isResponse && (oddparity != ((parityBits >> (len - j - 1)) & 0x01))) {
 111                                         sprintf(line+(j*4), "%02x!  ", frame[j]);
 112                                 } else {
 113                                         sprintf(line+(j*4), "%02x   ", frame[j]);
 114                                 }
 115                         }
 116                 } else {
 117                         if (ShowWaitCycles) {
 118                                 uint32_t next_timestamp = (*((uint32_t *)(got+i+9))) & 0x7fffffff;
 119                                 sprintf(line, "fdt (Frame Delay Time): %d", (next_timestamp - timestamp));
 120                         }
 121                 }
 122
 123                 char *crc;
 124                 crc = "";
 125                 if (len > 2) {
 126                         uint8_t b1, b2;
 127                         for (j = 0; j < (len - 1); j++) {
 128                                 // gives problems... search for the reason..
 129                                 /*if(frame[j] == 0xAA) {
 130                                         switch(frame[j+1]) {
 131                                                 case 0x01:
 132                                                         crc = "[1] Two drops close after each other";
 133                                                         break;
 134                                                 case 0x02:
 135                                                         crc = "[2] Potential SOC with a drop in second half of bitperiod";
 136                                                         break;
 137                                                 case 0x03:
 138                                                         crc = "[3] Segment Z after segment X is not possible";
 139                                                         break;
 140                                                 case 0x04:
 141                                                         crc = "[4] Parity bit of a fully received byte was wrong";
 142                                                         break;
 143                                                 default:
 144                                                         crc = "[?] Unknown error";
 145                                                         break;
 146                                         }
 147                                         break;
 148                                 }*/
 149                         }
 150
 151                         if (strlen(crc)==0) {
 152                                 ComputeCrc14443(CRC_14443_A, frame, len-2, &b1, &b2);
 153                                 if (b1 != frame[len-2] || b2 != frame[len-1]) {
 154                                         crc = (isResponse & (len < 6)) ? "" : " !crc";
 155                                 } else {
 156                                         crc = "";
 157                                 }
 158                         }
 159                 } else {
 160                         crc = ""; // SHORT
 161                 }
 162
 163                 i += (len + 9);
 164
 165                 EndOfTransmissionTimestamp = (*((uint32_t *)(got+i))) & 0x7fffffff;
 166
 167                 if (!ShowWaitCycles) i += 9;
 168
 169                 PrintAndLog(" %9d | %9d | %s | %s %s",
 170                         (timestamp - first_timestamp),
 171                         (EndOfTransmissionTimestamp - first_timestamp),
 172                         (len?(isResponse ? "Tag" : "Rdr"):"   "),
 173                         line, crc);
 174
 175         }
 176         return 0;
 177 }
 178
 179 void iso14a_set_timeout(uint32_t timeout) {
 180         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_SET_TIMEOUT, 0, timeout}};
 181         SendCommand(&c);
 182 }
 183
 184 int CmdHF14AReader(const char *Cmd)
 185 {
 186         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT, 0, 0}};
 187         SendCommand(&c);
 188
 189         UsbCommand resp;
 190         WaitForResponse(CMD_ACK,&resp);
 191
 192         iso14a_card_select_t *card = (iso14a_card_select_t *)resp.d.asBytes;
 193
 194         if(resp.arg[0] == 0) {
 195                 PrintAndLog("iso14443a card select failed");
 196                 return 0;
 197         }
 198
 199         PrintAndLog("ATQA : %02x %02x", card->atqa[0], card->atqa[1]);
 200         PrintAndLog(" UID : %s", sprint_hex(card->uid, card->uidlen));
 201         PrintAndLog(" SAK : %02x [%d]", card->sak, resp.arg[0]);
 202
 203         switch (card->sak) {
 204                 case 0x00: PrintAndLog("TYPE : NXP MIFARE Ultralight | Ultralight C"); break;
 205                 case 0x04: PrintAndLog("TYPE : NXP MIFARE (various !DESFire !DESFire EV1)"); break;
 206
 207                 case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1"); break;
 208                 case 0x09: PrintAndLog("TYPE : NXP MIFARE Mini 0.3k"); break;
 209                 case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k SL2"); break;
 210                 case 0x11: PrintAndLog("TYPE : NXP MIFARE Plus 4k SL2"); break;
 211                 case 0x18: PrintAndLog("TYPE : NXP MIFARE Classic 4k | Plus 4k SL1"); break;
 212                 case 0x20: PrintAndLog("TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41"); break;
 213                 case 0x24: PrintAndLog("TYPE : NXP MIFARE DESFire | DESFire EV1"); break;
 214                 case 0x28: PrintAndLog("TYPE : JCOP31 or JCOP41 v2.3.1"); break;
 215                 case 0x38: PrintAndLog("TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K"); break;
 216                 case 0x88: PrintAndLog("TYPE : Infineon MIFARE CLASSIC 1K"); break;
 217                 case 0x98: PrintAndLog("TYPE : Gemplus MPCOS"); break;
 218                 default: ;
 219         }
 220         if(resp.arg[0] == 1) {
 221                 bool ta1 = 0, tb1 = 0, tc1 = 0;
 222                 int pos;
 223
 224                 PrintAndLog(" ATS : %s", sprint_hex(card->ats, card->ats_len));
 225                 if (card->ats_len > 0) {
 226                         PrintAndLog("       -  TL : length is %d bytes", card->ats[0]);
 227                 }
 228                 if (card->ats_len > 1) {
 229                         ta1 = (card->ats[1] & 0x10) == 0x10;
 230                         tb1 = (card->ats[1] & 0x20) == 0x20;
 231                         tc1 = (card->ats[1] & 0x40) == 0x40;
 232                         PrintAndLog("       -  T0 : TA1 is%s present, TB1 is%s present, "
 233                                         "TC1 is%s present, FSCI is %d",
 234                                 (ta1 ? "" : " NOT"), (tb1 ? "" : " NOT"), (tc1 ? "" : " NOT"),
 235                                 (card->ats[1] & 0x0f));
 236                 }
 237                 pos = 2;
 238                 if (ta1 && card->ats_len > pos) {
 239                         char dr[16], ds[16];
 240                         dr[0] = ds[0] = '\0';
 241                         if (card->ats[pos] & 0x10) strcat(ds, "2, ");
 242                         if (card->ats[pos] & 0x20) strcat(ds, "4, ");
 243                         if (card->ats[pos] & 0x40) strcat(ds, "8, ");
 244                         if (card->ats[pos] & 0x01) strcat(dr, "2, ");
 245                         if (card->ats[pos] & 0x02) strcat(dr, "4, ");
 246                         if (card->ats[pos] & 0x04) strcat(dr, "8, ");
 247                         if (strlen(ds) != 0) ds[strlen(ds) - 2] = '\0';
 248                         if (strlen(dr) != 0) dr[strlen(dr) - 2] = '\0';
 249                         PrintAndLog("       - TA1 : different divisors are%s supported, "
 250                                         "DR: [%s], DS: [%s]",
 251                                         (card->ats[pos] & 0x80 ? " NOT" : ""), dr, ds);
 252                         pos++;
 253                 }
 254                 if (tb1 && card->ats_len > pos) {
 255                         PrintAndLog("       - TB1 : SFGI = %d, FWI = %d",
 256                                         (card->ats[pos] & 0x08),
 257                                         (card->ats[pos] & 0x80) >> 4);
 258                         pos++;
 259                 }
 260                 if (tc1 && card->ats_len > pos) {
 261                         PrintAndLog("       - TC1 : NAD is%s supported, CID is%s supported",
 262                                         (card->ats[pos] & 0x01) ? "" : " NOT",
 263                                         (card->ats[pos] & 0x02) ? "" : " NOT");
 264                         pos++;
 265                 }
 266                 if (card->ats_len > pos) {
 267                         char *tip = "";
 268                         if (card->ats_len - pos > 7) {
 269                                 if (memcmp(card->ats + pos, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) {
 270                                         tip = "-> MIFARE Plus X 2K or 4K";
 271                                 } else if (memcmp(card->ats + pos, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) {
 272                                         tip = "-> MIFARE Plus S 2K or 4K";
 273                                 }
 274                         }
 275                         PrintAndLog("       -  HB : %s%s", sprint_hex(card->ats + pos, card->ats_len - pos - 2), tip);
 276                         if (card->ats[pos] == 0xC1) {
 277                                 PrintAndLog("               c1 -> Mifare or (multiple) virtual cards of various type");
 278                                 PrintAndLog("                  %02x -> Length is %d bytes",
 279                                                 card->ats[pos + 1], card->ats[pos + 1]);
 280                                 switch (card->ats[pos + 2] & 0xf0) {
 281                                         case 0x10:
 282                                                 PrintAndLog("                     1x -> MIFARE DESFire");
 283                                                 break;
 284                                         case 0x20:
 285                                                 PrintAndLog("                     2x -> MIFARE Plus");
 286                                                 break;
 287                                 }
 288                                 switch (card->ats[pos + 2] & 0x0f) {
 289                                         case 0x00:
 290                                                 PrintAndLog("                     x0 -> <1 kByte");
 291                                                 break;
 292                                         case 0x01:
 293                                                 PrintAndLog("                     x0 -> 1 kByte");
 294                                                 break;
 295                                         case 0x02:
 296                                                 PrintAndLog("                     x0 -> 2 kByte");
 297                                                 break;
 298                                         case 0x03:
 299                                                 PrintAndLog("                     x0 -> 4 kByte");
 300                                                 break;
 301                                         case 0x04:
 302                                                 PrintAndLog("                     x0 -> 8 kByte");
 303                                                 break;
 304                                 }
 305                                 switch (card->ats[pos + 3] & 0xf0) {
 306                                         case 0x00:
 307                                                 PrintAndLog("                        0x -> Engineering sample");
 308                                                 break;
 309                                         case 0x20:
 310                                                 PrintAndLog("                        2x -> Released");
 311                                                 break;
 312                                 }
 313                                 switch (card->ats[pos + 3] & 0x0f) {
 314                                         case 0x00:
 315                                                 PrintAndLog("                        x0 -> Generation 1");
 316                                                 break;
 317                                         case 0x01:
 318                                                 PrintAndLog("                        x1 -> Generation 2");
 319                                                 break;
 320                                         case 0x02:
 321                                                 PrintAndLog("                        x2 -> Generation 3");
 322                                                 break;
 323                                 }
 324                                 switch (card->ats[pos + 4] & 0x0f) {
 325                                         case 0x00:
 326                                                 PrintAndLog("                           x0 -> Only VCSL supported");
 327                                                 break;
 328                                         case 0x01:
 329                                                 PrintAndLog("                           x1 -> VCS, VCSL, and SVC supported");
 330                                                 break;
 331                                         case 0x0E:
 332                                                 PrintAndLog("                           xE -> no VCS command supported");
 333                                                 break;
 334                                 }
 335                         }
 336                 }
 337         } else {
 338                 PrintAndLog("proprietary non iso14443a-4 card found, RATS not supported");
 339   }
 340
 341         return resp.arg[0];
 342 }
 343
 344 // Collect ISO14443 Type A UIDs
 345 int CmdHF14ACUIDs(const char *Cmd)
 346 {
 347         // requested number of UIDs
 348         int n = atoi(Cmd);
 349         // collect at least 1 (e.g. if no parameter was given)
 350         n = n > 0 ? n : 1;
 351
 352         PrintAndLog("Collecting %d UIDs", n);
 353         PrintAndLog("Start: %u", time(NULL));
 354         // repeat n times
 355         for (int i = 0; i < n; i++) {
 356                 // execute anticollision procedure
 357                 UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT, 0, 0}};
 358                 SendCommand(&c);
 359
 360     UsbCommand resp;
 361     WaitForResponse(CMD_ACK,&resp);
 362
 363                 uint8_t *uid  = resp.d.asBytes;
 364                 iso14a_card_select_t *card = (iso14a_card_select_t *)(uid + 12);
 365
 366                 // check if command failed
 367                 if (resp.arg[0] == 0) {
 368                         PrintAndLog("Card select failed.");
 369                 } else {
 370                         // check if UID is 4 bytes
 371                         if ((card->atqa[1] & 0xC0) == 0) {
 372                                 PrintAndLog("%02X%02X%02X%02X",
 373                                             *uid, *(uid + 1), *(uid + 2), *(uid + 3));
 374                         } else {
 375                                 PrintAndLog("UID longer than 4 bytes");
 376                         }
 377                 }
 378         }
 379         PrintAndLog("End: %u", time(NULL));
 380
 381         return 1;
 382 }
 383
 384 // ## simulate iso14443a tag
 385 // ## greg - added ability to specify tag UID
 386 int CmdHF14ASim(const char *Cmd)
 387 {
 388         UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,{0,0,0}};
 389
 390         // Retrieve the tag type
 391         uint8_t tagtype = param_get8ex(Cmd,0,0,10);
 392
 393         // When no argument was given, just print help message
 394         if (tagtype == 0) {
 395                 PrintAndLog("");
 396                 PrintAndLog(" Emulating ISO/IEC 14443 type A tag with 4 or 7 byte UID");
 397                 PrintAndLog("");
 398                 PrintAndLog("   syntax: hf 14a sim <type> <uid>");
 399                 PrintAndLog("    types: 1 = MIFARE Classic");
 400                 PrintAndLog("           2 = MIFARE Ultralight");
 401                 PrintAndLog("           3 = MIFARE DESFIRE");
 402                 PrintAndLog("           4 = ISO/IEC 14443-4");
 403                 PrintAndLog("");
 404                 return 1;
 405         }
 406
 407         // Store the tag type
 408         c.arg[0] = tagtype;
 409
 410         // Retrieve the full 4 or 7 byte long uid
 411         uint64_t long_uid = param_get64ex(Cmd,1,0,16);
 412
 413         // Are we handling the (optional) second part uid?
 414         if (long_uid > 0xffffffff) {
 415                 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 7 byte UID (%014"llx")",long_uid);
 416                 // Store the second part
 417                 c.arg[2] = (long_uid & 0xffffffff);
 418                 long_uid >>= 32;
 419                 // Store the first part, ignore the first byte, it is replaced by cascade byte (0x88)
 420                 c.arg[1] = (long_uid & 0xffffff);
 421         } else {
 422                 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 4 byte UID (%08x)",long_uid);
 423                 // Only store the first part
 424                 c.arg[1] = long_uid & 0xffffffff;
 425         }
 426 /*
 427                 // At lease save the mandatory first part of the UID
 428                 c.arg[0] = long_uid & 0xffffffff;
 429
 430
 431         // At lease save the mandatory first part of the UID
 432         c.arg[0] = long_uid & 0xffffffff;
 433
 434         if (c.arg[1] == 0) {
 435                 PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
 436         }
 437
 438         switch (c.arg[0]) {
 439                 case 1: {
 440                         PrintAndLog("Emulating ISO/IEC 14443-3 type A tag with 4 byte UID");
 441                         UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
 442                 } break;
 443                 case 2: {
 444                         PrintAndLog("Emulating ISO/IEC 14443-4 type A tag with 7 byte UID");
 445                 } break;
 446                 default: {
 447                         PrintAndLog("Error: unkown tag type (%d)",c.arg[0]);
 448                         PrintAndLog("syntax: hf 14a sim <uid>",c.arg[0]);
 449                         PrintAndLog(" type1: 4 ",c.arg[0]);
 450
 451                         return 1;
 452                 } break;
 453         }
 454 */
 455 /*
 456   unsigned int hi = 0, lo = 0;
 457   int n = 0, i = 0;
 458   while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
 459     hi= (hi << 4) | (lo >> 28);
 460     lo= (lo << 4) | (n & 0xf);
 461   }
 462 */
 463 //      UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
 464 //  PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
 465   SendCommand(&c);
 466   return 0;
 467 }
 468
 469 int CmdHF14ASnoop(const char *Cmd) {
 470         int param = 0;
 471
 472         if (param_getchar(Cmd, 0) == 'h') {
 473                 PrintAndLog("It get data from the field and saves it into command buffer.");
 474                 PrintAndLog("Buffer accessible from command hf 14a list.");
 475                 PrintAndLog("Usage:  hf 14a snoop [c][r]");
 476                 PrintAndLog("c - triggered by first data from card");
 477                 PrintAndLog("r - triggered by first 7-bit request from reader (REQ,WUP,...)");
 478                 PrintAndLog("sample: hf 14a snoop c r");
 479                 return 0;
 480         }
 481
 482         for (int i = 0; i < 2; i++) {
 483                 char ctmp = param_getchar(Cmd, i);
 484                 if (ctmp == 'c' || ctmp == 'C') param |= 0x01;
 485                 if (ctmp == 'r' || ctmp == 'R') param |= 0x02;
 486         }
 487
 488   UsbCommand c = {CMD_SNOOP_ISO_14443a, {param, 0, 0}};
 489   SendCommand(&c);
 490   return 0;
 491 }
 492
 493 int CmdHF14ACmdRaw(const char *cmd) {
 494     UsbCommand c = {CMD_READER_ISO_14443a, {0, 0, 0}};
 495     uint8_t reply=1;
 496     uint8_t crc=0;
 497     uint8_t power=0;
 498     uint8_t active=0;
 499     uint8_t active_select=0;
 500     uint16_t numbits=0;
 501     char buf[5]="";
 502     int i=0;
 503     uint8_t data[100];
 504     unsigned int datalen=0, temp;
 505
 506     if (strlen(cmd)<2) {
 507         PrintAndLog("Usage: hf 14a raw [-r] [-c] [-p] [-f] [-b] <number of bits> <0A 0B 0C ... hex>");
 508         PrintAndLog("       -r    do not read response");
 509         PrintAndLog("       -c    calculate and append CRC");
 510         PrintAndLog("       -p    leave the signal field ON after receive");
 511         PrintAndLog("       -a    active signal field ON without select");
 512         PrintAndLog("       -s    active signal field ON with select");
 513         PrintAndLog("       -b    number of bits to send. Useful for send partial byte");
 514         return 0;
 515     }
 516
 517     // strip
 518     while (*cmd==' ' || *cmd=='\t') cmd++;
 519
 520     while (cmd[i]!='\0') {
 521         if (cmd[i]==' ' || cmd[i]=='\t') { i++; continue; }
 522         if (cmd[i]=='-') {
 523             switch (cmd[i+1]) {
 524                 case 'r':
 525                     reply=0;
 526                     break;
 527                 case 'c':
 528                     crc=1;
 529                     break;
 530                 case 'p':
 531                     power=1;
 532                     break;
 533                 case 'a':
 534                     active=1;
 535                     break;
 536                 case 's':
 537                     active_select=1;
 538                     break;
 539                 case 'b':
 540                     sscanf(cmd+i+2,"%d",&temp);
 541                     numbits = temp & 0xFFFF;
 542                     i+=3;
 543                     while(cmd[i]!=' ' && cmd[i]!='\0') { i++; }
 544                     i-=2;
 545                     break;
 546                 default:
 547                     PrintAndLog("Invalid option");
 548                     return 0;
 549             }
 550             i+=2;
 551             continue;
 552         }
 553         if ((cmd[i]>='0' && cmd[i]<='9') ||
 554             (cmd[i]>='a' && cmd[i]<='f') ||
 555             (cmd[i]>='A' && cmd[i]<='F') ) {
 556             buf[strlen(buf)+1]=0;
 557             buf[strlen(buf)]=cmd[i];
 558             i++;
 559
 560             if (strlen(buf)>=2) {
 561                 sscanf(buf,"%x",&temp);
 562                 data[datalen]=(uint8_t)(temp & 0xff);
 563                 datalen++;
 564                 *buf=0;
 565             }
 566             continue;
 567         }
 568         PrintAndLog("Invalid char on input");
 569         return 0;
 570     }
 571     if(crc && datalen>0)
 572     {
 573         uint8_t first, second;
 574         ComputeCrc14443(CRC_14443_A, data, datalen, &first, &second);
 575         data[datalen++] = first;
 576         data[datalen++] = second;
 577     }
 578
 579     if(active || active_select)
 580     {
 581         c.arg[0] |= ISO14A_CONNECT;
 582         if(active)
 583             c.arg[0] |= ISO14A_NO_SELECT;
 584     }
 585     if(power)
 586         c.arg[0] |= ISO14A_NO_DISCONNECT;
 587     if(datalen>0)
 588         c.arg[0] |= ISO14A_RAW;
 589
 590     c.arg[1] = datalen;
 591     c.arg[2] = numbits;
 592     memcpy(c.d.asBytes,data,datalen);
 593
 594     SendCommand(&c);
 595
 596     if (reply) {
 597         if(active_select)
 598             waitCmd(1);
 599         if(datalen>0)
 600             waitCmd(0);
 601     } // if reply
 602     return 0;
 603 }
 604
 605 static void waitCmd(uint8_t iSelect)
 606 {
 607     uint8_t *recv;
 608     UsbCommand resp;
 609     char *hexout;
 610
 611     if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
 612         recv = resp.d.asBytes;
 613         uint8_t iLen = iSelect ? resp.arg[1] : resp.arg[0];
 614         PrintAndLog("received %i octets",iLen);
 615         if(!iLen)
 616             return;
 617         hexout = (char *)malloc(iLen * 3 + 1);
 618         if (hexout != NULL) {
 619             for (int i = 0; i < iLen; i++) { // data in hex
 620                 sprintf(&hexout[i * 3], "%02X ", recv[i]);
 621             }
 622             PrintAndLog("%s", hexout);
 623             free(hexout);
 624         } else {
 625             PrintAndLog("malloc failed your client has low memory?");
 626         }
 627     } else {
 628         PrintAndLog("timeout while waiting for reply.");
 629     }
 630 }
 631
 632 static command_t CommandTable[] =
 633 {
 634   {"help",   CmdHelp,              1, "This help"},
 635   {"list",   CmdHF14AList,         0, "List ISO 14443a history"},
 636   {"reader", CmdHF14AReader,       0, "Act like an ISO14443 Type A reader"},
 637   {"cuids",  CmdHF14ACUIDs,        0, "<n> Collect n>0 ISO14443 Type A UIDs in one go"},
 638   {"sim",    CmdHF14ASim,          0, "<UID> -- Fake ISO 14443a tag"},
 639   {"snoop",  CmdHF14ASnoop,        0, "Eavesdrop ISO 14443 Type A"},
 640   {"raw",    CmdHF14ACmdRaw,       0, "Send raw hex data to tag"},
 641   {NULL, NULL, 0, NULL}
 642 };
 643
 644 int CmdHF14A(const char *Cmd) {
 645         // flush
 646         WaitForResponseTimeout(CMD_ACK,NULL,100);
 647
 648         // parse
 649   CmdsParse(CommandTable, Cmd);
 650   return 0;
 651 }
 652
 653 int CmdHelp(const char *Cmd)
 654 {
 655   CmdsHelp(CommandTable);
 656   return 0;
 657 }