]> cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf14b.c
projects / proxmark3-svn / blob
? search:


52888bfdfbd9d83781ce5dd57e095907a5631158
[proxmark3-svn] / client / cmdhf14b.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // High frequency ISO14443B commands
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <stdlib.h>
13 #include <stdbool.h>
14 #include <string.h>
15 #include <stdint.h>
16 #include "iso14443crc.h"
17 #include "proxmark3.h"
18 #include "data.h"
19 #include "graph.h"
20 #include "util.h"
21 #include "ui.h"
22 #include "cmdparser.h"
23 #include "cmdhf14b.h"
24 #include "cmdmain.h"
25 #include "cmdhf14a.h"
26 //#include "sleep.h"
27 #include "cmddata.h"
28
29 static int CmdHelp(const char *Cmd);
30
31 int CmdHF14BDemod(const char *Cmd)
32 {
33 int i, j, iold;
34 int isum, qsum;
35 int outOfWeakAt;
36 bool negateI, negateQ;
37
38 uint8_t data[256];
39 int dataLen = 0;
40
41 // As received, the samples are pairs, correlations against I and Q
42 // square waves. So estimate angle of initial carrier (or just
43 // quadrant, actually), and then do the demod.
44
45 // First, estimate where the tag starts modulating.
46 for (i = 0; i < GraphTraceLen; i += 2) {
47 if (abs(GraphBuffer[i]) + abs(GraphBuffer[i + 1]) > 40) {
48 break;
49 }
50 }
51 if (i >= GraphTraceLen) {
52 PrintAndLog("too weak to sync");
53 return 0;
54 }
55 PrintAndLog("out of weak at %d", i);
56 outOfWeakAt = i;
57
58 // Now, estimate the phase in the initial modulation of the tag
59 isum = 0;
60 qsum = 0;
61 for (; i < (outOfWeakAt + 16); i += 2) {
62 isum += GraphBuffer[i + 0];
63 qsum += GraphBuffer[i + 1];
64 }
65 negateI = (isum < 0);
66 negateQ = (qsum < 0);
67
68 // Turn the correlation pairs into soft decisions on the bit.
69 j = 0;
70 for (i = 0; i < GraphTraceLen / 2; i++) {
71 int si = GraphBuffer[j];
72 int sq = GraphBuffer[j + 1];
73 if (negateI) si = -si;
74 if (negateQ) sq = -sq;
75 GraphBuffer[i] = si + sq;
76 j += 2;
77 }
78 GraphTraceLen = i;
79
80 i = outOfWeakAt / 2;
81 while (GraphBuffer[i] > 0 && i < GraphTraceLen)
82 i++;
83 if (i >= GraphTraceLen) goto demodError;
84
85 iold = i;
86 while (GraphBuffer[i] < 0 && i < GraphTraceLen)
87 i++;
88 if (i >= GraphTraceLen) goto demodError;
89 if ((i - iold) > 23) goto demodError;
90
91 PrintAndLog("make it to demod loop");
92
93 for (;;) {
94 iold = i;
95 while (GraphBuffer[i] >= 0 && i < GraphTraceLen)
96 i++;
97 if (i >= GraphTraceLen) goto demodError;
98 if ((i - iold) > 6) goto demodError;
99
100 uint16_t shiftReg = 0;
101 if (i + 20 >= GraphTraceLen) goto demodError;
102
103 for (j = 0; j < 10; j++) {
104 int soft = GraphBuffer[i] + GraphBuffer[i + 1];
105
106 if (abs(soft) < (abs(isum) + abs(qsum)) / 20) {
107 PrintAndLog("weak bit");
108 }
109
110 shiftReg >>= 1;
111 if(GraphBuffer[i] + GraphBuffer[i+1] >= 0) {
112 shiftReg |= 0x200;
113 }
114
115 i+= 2;
116 }
117
118 if ((shiftReg & 0x200) && !(shiftReg & 0x001))
119 {
120 // valid data byte, start and stop bits okay
121 PrintAndLog(" %02x", (shiftReg >> 1) & 0xff);
122 data[dataLen++] = (shiftReg >> 1) & 0xff;
123 if (dataLen >= sizeof(data)) {
124 return 0;
125 }
126 } else if (shiftReg == 0x000) {
127 // this is EOF
128 break;
129 } else {
130 goto demodError;
131 }
132 }
133
134 uint8_t first, second;
135 ComputeCrc14443(CRC_14443_B, data, dataLen-2, &first, &second);
136 PrintAndLog("CRC: %02x %02x (%s)\n", first, second,
137 (first == data[dataLen-2] && second == data[dataLen-1]) ?
138 "ok" : "****FAIL****");
139
140 RepaintGraphWindow();
141 return 0;
142
143 demodError:
144 PrintAndLog("demod error");
145 RepaintGraphWindow();
146 return 0;
147 }
148
149 int CmdHF14BList(const char *Cmd)
150 {
151 PrintAndLog("Deprecated command, use 'hf list 14b' instead");
152
153 return 0;
154 }
155
156 int CmdHF14Sim(const char *Cmd)
157 {
158 UsbCommand c={CMD_SIMULATE_TAG_ISO_14443};
159 clearCommandBuffer();
160 SendCommand(&c);
161 return 0;
162 }
163
164 int CmdHFSimlisten(const char *Cmd)
165 {
166 UsbCommand c = {CMD_SIMULATE_TAG_HF_LISTEN};
167 clearCommandBuffer();
168 SendCommand(&c);
169 return 0;
170 }
171
172 int CmdHF14BSnoop(const char *Cmd)
173 {
174 UsbCommand c = {CMD_SNOOP_ISO_14443};
175 clearCommandBuffer();
176 SendCommand(&c);
177 return 0;
178 }
179
180 /* New command to read the contents of a SRI512 tag
181 * SRI512 tags are ISO14443-B modulated memory tags,
182 * this command just dumps the contents of the memory
183 */
184 int CmdSri512Read(const char *Cmd)
185 {
186 UsbCommand c = {CMD_READ_SRI512_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
187 clearCommandBuffer();
188 SendCommand(&c);
189 return 0;
190 }
191
192 /* New command to read the contents of a SRIX4K tag
193 * SRIX4K tags are ISO14443-B modulated memory tags,
194 * this command just dumps the contents of the memory/
195 */
196 int CmdSrix4kRead(const char *Cmd)
197 {
198 UsbCommand c = {CMD_READ_SRIX4K_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
199 clearCommandBuffer();
200 SendCommand(&c);
201 return 0;
202 }
203
204 int rawClose(void){
205 UsbCommand resp;
206 UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}};
207 clearCommandBuffer();
208 SendCommand(&c);
209 if (!WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
210 return 0;
211 }
212 return 0;
213 }
214
215 int HF14BCmdRaw(bool reply, bool *crc, uint8_t power_trace, uint8_t *data, uint8_t *datalen, bool verbose){
216 UsbCommand resp;
217 UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; // len,recv,power/trace
218 if(*crc)
219 {
220 uint8_t first, second;
221 ComputeCrc14443(CRC_14443_B, data, *datalen, &first, &second);
222 data[*datalen] = first;
223 data[*datalen + 1] = second;
224 *datalen += 2;
225 }
226
227 c.arg[0] = *datalen;
228 c.arg[1] = reply;
229 c.arg[2] = power_trace;
230 memcpy(c.d.asBytes,data,*datalen);
231 clearCommandBuffer();
232 SendCommand(&c);
233
234 if (!reply) return 1;
235
236 if (!WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
237 if (verbose) PrintAndLog("timeout while waiting for reply.");
238 return 0;
239 }
240 *datalen = resp.arg[0];
241 if (verbose) PrintAndLog("received %u octets", *datalen);
242 if(*datalen<2) return 0;
243
244 memcpy(data, resp.d.asBytes, *datalen);
245 if (verbose) PrintAndLog("%s", sprint_hex(data, *datalen));
246
247 uint8_t first, second;
248 ComputeCrc14443(CRC_14443_B, data, *datalen-2, &first, &second);
249 if(data[*datalen-2] == first && data[*datalen-1] == second) {
250 if (verbose) PrintAndLog("CRC OK");
251 *crc = true;
252 } else {
253 if (verbose) PrintAndLog("CRC failed");
254 *crc = false;
255 }
256 return 1;
257 }
258
259 int CmdHF14BCmdRaw (const char *Cmd) {
260 bool reply = true;
261 bool crc = false;
262 uint8_t power_trace = 0;
263 char buf[5]="";
264 uint8_t data[100] = {0x00};
265 uint8_t datalen = 0;
266 unsigned int temp;
267 int i = 0;
268 if (strlen(Cmd)<3) {
269 PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] <0A 0B 0C ... hex>");
270 PrintAndLog(" -r do not read response");
271 PrintAndLog(" -c calculate and append CRC");
272 PrintAndLog(" -p leave the field on after receive");
273 return 0;
274 }
275
276 // strip
277 while (*Cmd==' ' || *Cmd=='\t') Cmd++;
278
279 while (Cmd[i]!='\0') {
280 if (Cmd[i]==' ' || Cmd[i]=='\t') { i++; continue; }
281 if (Cmd[i]=='-') {
282 switch (Cmd[i+1]) {
283 case 'r':
284 case 'R':
285 reply = false;
286 break;
287 case 'c':
288 case 'C':
289 crc = true;
290 break;
291 case 'p':
292 case 'P':
293 power_trace |= 1;
294 break;
295 default:
296 PrintAndLog("Invalid option");
297 return 0;
298 }
299 i+=2;
300 continue;
301 }
302 if ((Cmd[i]>='0' && Cmd[i]<='9') ||
303 (Cmd[i]>='a' && Cmd[i]<='f') ||
304 (Cmd[i]>='A' && Cmd[i]<='F') ) {
305 buf[strlen(buf)+1]=0;
306 buf[strlen(buf)]=Cmd[i];
307 i++;
308
309 if (strlen(buf)>=2) {
310 sscanf(buf,"%x",&temp);
311 data[datalen++]=(uint8_t)(temp & 0xff);
312 *buf=0;
313 }
314 continue;
315 }
316 PrintAndLog("Invalid char on input");
317 return 1;
318 }
319 if (datalen == 0)
320 {
321 PrintAndLog("Missing data input");
322 return 0;
323 }
324
325 return HF14BCmdRaw(reply, &crc, power_trace, data, &datalen, true);
326 }
327
328 static void print_atqb_resp(uint8_t *data){
329 PrintAndLog (" UID: %s", sprint_hex(data+1,4));
330 PrintAndLog (" App Data: %s", sprint_hex(data+5,4));
331 PrintAndLog (" Protocol: %s", sprint_hex(data+9,3));
332 uint8_t BitRate = data[9];
333 if (!BitRate)
334 PrintAndLog (" Bit Rate: 106 kbit/s only PICC <-> PCD");
335 if (BitRate & 0x10)
336 PrintAndLog (" Bit Rate: 212 kbit/s PICC -> PCD supported");
337 if (BitRate & 0x20)
338 PrintAndLog (" Bit Rate: 424 kbit/s PICC -> PCD supported");
339 if (BitRate & 0x40)
340 PrintAndLog (" Bit Rate: 847 kbit/s PICC -> PCD supported");
341 if (BitRate & 0x01)
342 PrintAndLog (" Bit Rate: 212 kbit/s PICC <- PCD supported");
343 if (BitRate & 0x02)
344 PrintAndLog (" Bit Rate: 424 kbit/s PICC <- PCD supported");
345 if (BitRate & 0x04)
346 PrintAndLog (" Bit Rate: 847 kbit/s PICC <- PCD supported");
347 if (BitRate & 0x80)
348 PrintAndLog (" Same bit rate <-> required");
349
350 uint16_t maxFrame = data[10]>>4;
351 if (maxFrame < 5)
352 maxFrame = 8*maxFrame + 16;
353 else if (maxFrame == 5)
354 maxFrame = 64;
355 else if (maxFrame == 6)
356 maxFrame = 96;
357 else if (maxFrame == 7)
358 maxFrame = 128;
359 else if (maxFrame == 8)
360 maxFrame = 256;
361 else
362 maxFrame = 257;
363
364 PrintAndLog ("Max Frame Size: %d%s",maxFrame, (maxFrame == 257) ? "+ RFU" : "");
365
366 uint8_t protocolT = data[10] & 0xF;
367 PrintAndLog (" Protocol Type: Protocol is %scompliant with ISO/IEC 14443-4",(protocolT) ? "" : "not " );
368 PrintAndLog ("Frame Wait Int: %d", data[11]>>4);
369 PrintAndLog (" App Data Code: Application is %s",(data[11]&4) ? "Standard" : "Proprietary");
370 PrintAndLog (" Frame Options: NAD is %ssupported",(data[11]&2) ? "" : "not ");
371 PrintAndLog (" Frame Options: CID is %ssupported",(data[11]&1) ? "" : "not ");
372
373 return;
374 }
375
376 char *get_ST_Chip_Model(uint8_t data){
377 static char model[20];
378 char *retStr = model;
379 memset(model,0, sizeof(model));
380
381 switch (data) {
382 case 0x0: sprintf(retStr, "SRIX4K (Special)"); break;
383 case 0x2: sprintf(retStr, "SR176"); break;
384 case 0x3: sprintf(retStr, "SRIX4K"); break;
385 case 0x4: sprintf(retStr, "SRIX512"); break;
386 case 0x6: sprintf(retStr, "SRI512"); break;
387 case 0x7: sprintf(retStr, "SRI4K"); break;
388 case 0xC: sprintf(retStr, "SRT512"); break;
389 default: sprintf(retStr, "Unknown"); break;
390 }
391 return retStr;
392 }
393
394 static void print_st_info(uint8_t *data){
395 //uid = first 8 bytes in data
396 PrintAndLog(" UID: %s", sprint_hex(data,8));
397 PrintAndLog(" MFG: %02X, %s", data[1], getTagInfo(data[1]));
398 PrintAndLog("Chip: %02X, %s", data[2]>>2, get_ST_Chip_Model(data[2]>>2));
399 return;
400 }
401
402 int HF14BStdRead(uint8_t *data, uint8_t *datalen){
403 bool crc = true;
404 *datalen = 3;
405 //std read cmd
406 data[0] = 0x05;
407 data[1] = 0x00;
408 data[2] = 0x08;
409
410 if (HF14BCmdRaw(true, &crc, 0, data, datalen, false)==0) return 0;
411
412 if (data[0] != 0x50 || *datalen != 14 || !crc) return 0;
413
414 PrintAndLog ("\n14443-3b tag found:");
415 print_atqb_resp(data);
416
417 return 1;
418 }
419
420 int HF14B_ST_Read(uint8_t *data, uint8_t *datalen){
421 bool crc = true;
422 *datalen = 2;
423 //wake cmd
424 data[0] = 0x06;
425 data[1] = 0x00;
426
427 //leave power on
428 // verbose on for now for testing - turn off when functional
429 if (HF14BCmdRaw(true, &crc, 1, data, datalen, true)==0) return rawClose();
430
431 if (*datalen != 3 || !crc) return rawClose();
432
433 uint8_t chipID = data[0];
434 // select
435 data[0] = 0x0E;
436 data[1] = chipID;
437 *datalen = 2;
438
439 //leave power on
440 // verbose on for now for testing - turn off when functional
441 if (HF14BCmdRaw(true, &crc, 1, data, datalen, true)==0) return rawClose();
442
443 if (*datalen != 3 || !crc || data[0] != chipID) return rawClose();
444
445 // get uid
446 data[0] = 0x0B;
447 *datalen = 1;
448
449 //power off
450 // verbose on for now for testing - turn off when functional
451 if (HF14BCmdRaw(true, &crc, 1, data, datalen, true)==0) return 0;
452 rawClose();
453 if (*datalen != 10 || !crc) return 0;
454
455 PrintAndLog("\n14443-3b ST tag found:");
456 print_st_info(data);
457 return 1;
458 }
459
460 int HF14BReader(bool verbose){
461 uint8_t data[100];
462 uint8_t datalen = 5;
463
464 // try std 14b (atqb)
465 if (HF14BStdRead(data, &datalen)) return 1;
466
467 // try st 14b
468 if (HF14B_ST_Read(data, &datalen)) return 1;
469
470 if (verbose) PrintAndLog("no 14443B tag found");
471 return 0;
472 }
473
474 int CmdHF14BReader(const char *Cmd){
475 return HF14BReader(true);
476 }
477
478 int CmdHFRawSamples(const char *Cmd){
479 UsbCommand resp;
480 UsbCommand c = {CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443, {strtol(Cmd,NULL,0), 0, 0}};
481 SendCommand(&c);
482
483 if (!WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
484 PrintAndLog("timeout while waiting for reply.");
485 return 0;
486 }
487 getSamples("39999", true);
488 return 1;
489 }
490
491 int CmdHF14BWrite( const char *Cmd){
492 /*
493 * For SRIX4K blocks 00 - 7F
494 * hf 14b raw -c -p 09 $srix4kwblock $srix4kwdata
495 *
496 * For SR512 blocks 00 - 0F
497 * hf 14b raw -c -p 09 $sr512wblock $sr512wdata
498 *
499 * Special block FF = otp_lock_reg block.
500 * Data len 4 bytes-
501 */
502 char cmdp = param_getchar(Cmd, 0);
503 uint8_t blockno = -1;
504 uint8_t data[4] = {0x00};
505 bool isSrix4k = true;
506 char str[20];
507
508 if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') {
509 PrintAndLog("Usage: hf 14b write <1|2> <BLOCK> <DATA>");
510 PrintAndLog(" [1 = SRIX4K]");
511 PrintAndLog(" [2 = SRI512]");
512 PrintAndLog(" [BLOCK number depends on tag, special block == FF]");
513 PrintAndLog(" sample: hf 14b write 1 7F 11223344");
514 PrintAndLog(" : hf 14b write 1 FF 11223344");
515 PrintAndLog(" : hf 14b write 2 15 11223344");
516 PrintAndLog(" : hf 14b write 2 FF 11223344");
517 return 0;
518 }
519
520 if ( cmdp == '2' )
521 isSrix4k = false;
522
523 //blockno = param_get8(Cmd, 1);
524
525 if ( param_gethex(Cmd,1, &blockno, 2) ) {
526 PrintAndLog("Block number must include 2 HEX symbols");
527 return 0;
528 }
529
530 if ( isSrix4k ){
531 if ( blockno > 0x7f && blockno != 0xff ){
532 PrintAndLog("Block number out of range");
533 return 0;
534 }
535 } else {
536 if ( blockno > 0x0f && blockno != 0xff ){
537 PrintAndLog("Block number out of range");
538 return 0;
539 }
540 }
541
542 if (param_gethex(Cmd, 2, data, 8)) {
543 PrintAndLog("Data must include 8 HEX symbols");
544 return 0;
545 }
546
547 if ( blockno == 0xff)
548 PrintAndLog("[%s] Write special block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512" , blockno, sprint_hex(data,4) );
549 else
550 PrintAndLog("[%s] Write block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512", blockno, sprint_hex(data,4) );
551
552 sprintf(str, "-c 09 %02x %02x%02x%02x%02x", blockno, data[0], data[1], data[2], data[3]);
553
554 CmdHF14BCmdRaw(str);
555 return 0;
556 }
557
558 static command_t CommandTable[] =
559 {
560 {"help", CmdHelp, 1, "This help"},
561 {"demod", CmdHF14BDemod, 1, "Demodulate ISO14443 Type B from tag"},
562 {"getsamples", CmdHFRawSamples,0, "[atqb=0 or ST=1] Send wake cmd and Get raw HF samples to GraphBuffer"},
563 {"list", CmdHF14BList, 0, "[Deprecated] List ISO 14443b history"},
564 {"reader", CmdHF14BReader, 0, "Find 14b tag (HF ISO 14443b)"},
565 {"sim", CmdHF14Sim, 0, "Fake ISO 14443 tag"},
566 {"simlisten", CmdHFSimlisten, 0, "Get HF samples as fake tag"},
567 {"snoop", CmdHF14BSnoop, 0, "Eavesdrop ISO 14443"},
568 {"sri512read", CmdSri512Read, 0, "Read contents of a SRI512 tag"},
569 {"srix4kread", CmdSrix4kRead, 0, "Read contents of a SRIX4K tag"},
570 {"raw", CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},
571 {"write", CmdHF14BWrite, 0, "Write data to a SRI512 | SRIX4K tag"},
572 {NULL, NULL, 0, NULL}
573 };
574
575 int CmdHF14B(const char *Cmd)
576 {
577 CmdsParse(CommandTable, Cmd);
578 return 0;
579 }
580
581 int CmdHelp(const char *Cmd)
582 {
583 CmdsHelp(CommandTable);
584 return 0;
585 }
Proxmark3 GIT tracking
Impressum, Datenschutz