1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3 // Modified 2010-2012 by <adrian -at- atrox.at>
4 // Modified 2012 by <vsza at vsza.hu>
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
9 //-----------------------------------------------------------------------------
10 // High frequency ISO15693 commands
11 //-----------------------------------------------------------------------------
12 // There are three basic operation modes, depending on which device (proxmark/pc)
13 // the signal processing, (de)modulation, transmission protocol and logic is done.
15 // All steps are done on the proxmark, the output of the commands is returned via
16 // USB-debug-print commands.
18 // The protocol is done on the PC, passing only Iso15693 data frames via USB. This
19 // allows direct communication with a tag on command level
21 // The proxmark just samples the antenna and passes this "analog" data via USB to
22 // the client. Signal Processing & decoding is done on the pc. This is the slowest
23 // variant, but offers the possibility to analyze the waveforms directly.
29 //#include "proxusb.h"
30 #include "proxmark3.h"
34 #include "cmdparser.h"
36 #include "../common/iso15693tools.h"
39 #define FrameSOF Iso15693FrameSOF
40 #define Logic0 Iso15693Logic0
41 #define Logic1 Iso15693Logic1
42 #define FrameEOF Iso15693FrameEOF
44 #define Crc(data,datalen) Iso15693Crc(data,datalen)
45 #define AddCrc(data,datalen) Iso15693AddCrc(data,datalen)
46 #define sprintUID(target,uid) Iso15693sprintUID(target,uid)
47 #define TRACE_BUFF_SIZE 12000
49 // structure and database for uid -> tagtype lookups
52 int mask
; // how many MSB bits used
57 const productName uidmapping
[] = {
58 // UID, #significant Bits, "Vendor(+Product)"
59 { 0xE001000000000000LL
, 16, "Motorola" },
60 { 0xE002000000000000LL
, 16, "ST Microelectronics" },
61 { 0xE003000000000000LL
, 16, "Hitachi" },
62 { 0xE004000000000000LL
, 16, "NXP(Philips)" },
63 { 0xE004010000000000LL
, 24, "NXP(Philips); IC SL2 ICS20/ICS21(SLI) ICS2002/ICS2102(SLIX)" },
64 { 0xE004020000000000LL
, 24, "NXP(Philips); IC SL2 ICS53/ICS54(SLI-S) ICS5302/ICS5402(SLIX-S)" },
65 { 0xE004030000000000LL
, 24, "NXP(Philips); IC SL2 ICS50/ICS51(SLI-L) ICS5002/ICS5102(SLIX-L)" },
66 { 0xE005000000000000LL
, 16, "Infineon" },
67 { 0xE005400000000000LL
, 24, "Infineon; 56x32bit" },
68 { 0xE006000000000000LL
, 16, "Cylinc" },
69 { 0xE007000000000000LL
, 16, "Texas Instrument; " },
70 { 0xE007000000000000LL
, 20, "Texas Instrument; Tag-it HF-I Plus Inlay; 64x32bit" },
71 { 0xE007100000000000LL
, 20, "Texas Instrument; Tag-it HF-I Plus Chip; 64x32bit" },
72 { 0xE007800000000000LL
, 23, "Texas Instrument; Tag-it HF-I Plus (RF-HDT-DVBB tag or Third Party Products)" },
73 { 0xE007C00000000000LL
, 23, "Texas Instrument; Tag-it HF-I Standard; 8x32bit" },
74 { 0xE007C40000000000LL
, 23, "Texas Instrument; Tag-it HF-I Pro; 8x23bit; password" },
75 { 0xE008000000000000LL
, 16, "Fujitsu" },
76 { 0xE009000000000000LL
, 16, "Matsushita" },
77 { 0xE00A000000000000LL
, 16, "NEC" },
78 { 0xE00B000000000000LL
, 16, "Oki Electric" },
79 { 0xE00C000000000000LL
, 16, "Toshiba" },
80 { 0xE00D000000000000LL
, 16, "Mitsubishi" },
81 { 0xE00E000000000000LL
, 16, "Samsung" },
82 { 0xE00F000000000000LL
, 16, "Hyundai" },
83 { 0xE010000000000000LL
, 16, "LG-Semiconductors" },
84 { 0xE012000000000000LL
, 16, "HID Corporation" },
85 { 0xE016000000000000LL
, 16, "EM-Marin SA (Skidata)" },
86 { 0xE016040000000000LL
, 24, "EM-Marin SA (Skidata Keycard-eco); EM4034? no 'read', just 'readmulti'" },
87 { 0xE0160c0000000000LL
, 24, "EM-Marin SA; EM4035?" },
88 { 0xE016100000000000LL
, 24, "EM-Marin SA (Skidata); EM4135; 36x64bit start page 13" },
89 { 0xE016940000000000LL
, 24, "EM-Marin SA (Skidata); 51x64bit" },
90 { 0,0,"no tag-info available" } // must be the last entry
94 // fast method to just read the UID of a tag (collission detection not supported)
95 // *buf should be large enough to fit the 64bit uid
96 // returns 1 if suceeded
97 int getUID(uint8_t *buf
)
101 UsbCommand c
= {CMD_ISO_15693_COMMAND
, {0, 1, 1}}; // len,speed,recv?
102 uint8_t *req
=c
.d
.asBytes
;
105 for (int retry
=0;retry
<3; retry
++) { // don't give up the at the first try
107 req
[0]= ISO15_REQ_SUBCARRIER_SINGLE
| ISO15_REQ_DATARATE_HIGH
|
108 ISO15_REQ_INVENTORY
| ISO15_REQINV_SLOT1
;
109 req
[1]=ISO15_CMD_INVENTORY
;
110 req
[2]=0; // mask length
111 reqlen
=AddCrc(req
,3);
116 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1000)) {
117 recv
= resp
.d
.asBytes
;
118 if (resp
.arg
[0]>=12 && ISO15_CRC_CHECK
==Crc(recv
,12)) {
119 memcpy(buf
,&recv
[2],8);
129 // get a product description based on the UID
131 // returns description of the best match
132 static char* getTagInfo(uint8_t *uid
) {
135 memcpy(&myuid
,uid
,sizeof(uint64_t));
136 while (uidmapping
[i
].mask
>0) {
137 mask
=(~0LL) <<(64-uidmapping
[i
].mask
);
138 if ((myuid
& mask
) == uidmapping
[i
].uid
) {
142 if (uidmapping
[i
].mask
>uidmapping
[best
].mask
) {
150 if (best
>=0) return uidmapping
[best
].desc
;
152 return uidmapping
[i
].desc
;
156 // return a clear-text message to an errorcode
157 static char* TagErrorStr(uint8_t error
) {
159 case 0x01: return "The command is not supported";
160 case 0x02: return "The command is not recognised";
161 case 0x03: return "The option is not supported.";
162 case 0x0f: return "Unknown error.";
163 case 0x10: return "The specified block is not available (doesn’t exist).";
164 case 0x11: return "The specified block is already -locked and thus cannot be locked again";
165 case 0x12: return "The specified block is locked and its content cannot be changed.";
166 case 0x13: return "The specified block was not successfully programmed.";
167 case 0x14: return "The specified block was not successfully locked.";
168 default: return "Reserved for Future Use or Custom command error.";
174 int CmdHF15Demod(const char *Cmd
)
176 // The sampling rate is 106.353 ksps/s, for T = 18.8 us
179 int max
= 0, maxPos
= 0;
183 if (GraphTraceLen
< 1000) return 0;
185 // First, correlate for SOF
186 for (i
= 0; i
< 100; i
++) {
188 for (j
= 0; j
< arraylen(FrameSOF
); j
+= skip
) {
189 corr
+= FrameSOF
[j
] * GraphBuffer
[i
+ (j
/ skip
)];
196 PrintAndLog("SOF at %d, correlation %d", maxPos
,
197 max
/ (arraylen(FrameSOF
) / skip
));
199 i
= maxPos
+ arraylen(FrameSOF
) / skip
;
202 memset(outBuf
, 0, sizeof(outBuf
));
205 int corr0
= 0, corr1
= 0, corrEOF
= 0;
206 for (j
= 0; j
< arraylen(Logic0
); j
+= skip
) {
207 corr0
+= Logic0
[j
] * GraphBuffer
[i
+ (j
/ skip
)];
209 for (j
= 0; j
< arraylen(Logic1
); j
+= skip
) {
210 corr1
+= Logic1
[j
] * GraphBuffer
[i
+ (j
/ skip
)];
212 for (j
= 0; j
< arraylen(FrameEOF
); j
+= skip
) {
213 corrEOF
+= FrameEOF
[j
] * GraphBuffer
[i
+ (j
/ skip
)];
215 // Even things out by the length of the target waveform.
219 if (corrEOF
> corr1
&& corrEOF
> corr0
) {
220 PrintAndLog("EOF at %d", i
);
222 } else if (corr1
> corr0
) {
223 i
+= arraylen(Logic1
) / skip
;
226 i
+= arraylen(Logic0
) / skip
;
233 if ((i
+ (int)arraylen(FrameEOF
)) >= GraphTraceLen
) {
234 PrintAndLog("ran off end!");
239 PrintAndLog("error, uneven octet! (discard extra bits!)");
240 PrintAndLog(" mask=%02x", mask
);
242 PrintAndLog("%d octets", k
);
244 for (i
= 0; i
< k
; i
++) {
245 PrintAndLog("# %2d: %02x ", i
, outBuf
[i
]);
247 PrintAndLog("CRC=%04x", Iso15693Crc(outBuf
, k
- 2));
253 // * Acquire Samples as Reader (enables carrier, sends inquiry)
254 int CmdHF15Read(const char *Cmd
)
256 UsbCommand c
= {CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693
};
259 uint8_t data
[TRACE_BUFF_SIZE
] = {0x00};
261 GetFromBigBuf(data
,TRACE_BUFF_SIZE
,3560); //3560 -- should be offset..
262 WaitForResponseTimeout(CMD_ACK
,NULL
, 1500);
264 for (int j
= 0; j
< TRACE_BUFF_SIZE
; j
++) {
265 GraphBuffer
[j
] = ((int)data
[j
]) ;
267 GraphTraceLen
= TRACE_BUFF_SIZE
;
268 RepaintGraphWindow();
272 // Record Activity without enabeling carrier
273 int CmdHF15Record(const char *Cmd
)
275 UsbCommand c
= {CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693
};
278 uint8_t data
[TRACE_BUFF_SIZE
] = {0x00};
280 GetFromBigBuf(data
,TRACE_BUFF_SIZE
,3560); //3560 -- should be offset..
281 WaitForResponseTimeout(CMD_ACK
,NULL
, 1500);
283 for (int j
= 0; j
< TRACE_BUFF_SIZE
; j
++) {
284 GraphBuffer
[j
] = ((int)data
[j
]) ;
286 GraphTraceLen
= TRACE_BUFF_SIZE
;
287 RepaintGraphWindow();
291 int CmdHF15Reader(const char *Cmd
)
293 UsbCommand c
= {CMD_READER_ISO_15693
, {strtol(Cmd
, NULL
, 0), 0, 0}};
298 // Simulation is still not working very good
299 int CmdHF15Sim(const char *Cmd
)
301 UsbCommand c
= {CMD_SIMTAG_ISO_15693
, {strtol(Cmd
, NULL
, 0), 0, 0}};
306 // finds the AFI (Application Family Idendifier) of a card, by trying all values
307 // (There is no standard way of reading the AFI, allthough some tags support this)
308 int CmdHF15Afi(const char *Cmd
)
310 UsbCommand c
= {CMD_ISO_15693_FIND_AFI
, {strtol(Cmd
, NULL
, 0), 0, 0}};
315 // Reads all memory pages
316 int CmdHF15DumpMem(const char*Cmd
) {
320 UsbCommand c
= {CMD_ISO_15693_COMMAND
, {0, 1, 1}}; // len,speed,recv?
321 uint8_t *req
=c
.d
.asBytes
;
327 PrintAndLog("No Tag found.");
331 PrintAndLog("Reading memory from tag UID=%s",sprintUID(NULL
,uid
));
332 PrintAndLog("Tag Info: %s",getTagInfo(uid
));
334 for (int retry
=0; retry
<5; retry
++) {
336 req
[0]= ISO15_REQ_SUBCARRIER_SINGLE
| ISO15_REQ_DATARATE_HIGH
|
337 ISO15_REQ_NONINVENTORY
| ISO15_REQ_ADDRESS
;
338 req
[1]=ISO15_CMD_READ
;
339 memcpy(&req
[2],uid
,8);
341 reqlen
=AddCrc(req
,11);
346 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1000)) {
347 recv
= resp
.d
.asBytes
;
348 if (ISO15_CRC_CHECK
==Crc(recv
,resp
.arg
[0])) {
349 if (!(recv
[0] & ISO15_RES_ERROR
)) {
351 *output
=0; // reset outputstring
352 sprintf(output
, "Block %02x ",blocknum
);
353 for ( int i
=1; i
<resp
.arg
[0]-2; i
++) { // data in hex
354 sprintf(output
+strlen(output
),"%02X ",recv
[i
]);
357 for ( int i
=1; i
<resp
.arg
[0]-2; i
++) { // data in cleaned ascii
358 sprintf(output
+strlen(output
),"%c",(recv
[i
]>31 && recv
[i
]<127)?recv
[i
]:'.');
360 PrintAndLog("%s",output
);
362 // PrintAndLog("bn=%i",blocknum);
364 PrintAndLog("Tag returned Error %i: %s",recv
[1],TagErrorStr(recv
[1]));
367 } // else PrintAndLog("crc");
368 } // else PrintAndLog("r null");
371 // if (resp.arg[0]<3)
372 // PrintAndLog("Lost Connection");
373 // else if (ISO15_CRC_CHECK!=Crc(resp.d.asBytes,resp.arg[0]))
374 // PrintAndLog("CRC Failed");
376 // PrintAndLog("Tag returned Error %i: %s",recv[1],TagErrorStr(recv[1]));
383 static command_t CommandTable15
[] =
385 {"help", CmdHF15Help
, 1, "This help"},
386 {"demod", CmdHF15Demod
, 1, "Demodulate ISO15693 from tag"},
387 {"read", CmdHF15Read
, 0, "Read HF tag (ISO 15693)"},
388 {"record", CmdHF15Record
, 0, "Record Samples (ISO 15693)"}, // atrox
389 {"reader", CmdHF15Reader
, 0, "Act like an ISO15693 reader"},
390 {"sim", CmdHF15Sim
, 0, "Fake an ISO15693 tag"},
391 {"cmd", CmdHF15Cmd
, 0, "Send direct commands to ISO15693 tag"},
392 {"findafi", CmdHF15Afi
, 0, "Brute force AFI of an ISO15693 tag"},
393 {"dumpmemory", CmdHF15DumpMem
, 0, "Read all memory pages of an ISO15693 tag"},
394 {NULL
, NULL
, 0, NULL
}
397 int CmdHF15(const char *Cmd
)
399 CmdsParse(CommandTable15
, Cmd
);
403 int CmdHF15Help(const char *Cmd
)
405 CmdsHelp(CommandTable15
);
410 // "HF 15 Cmd" Interface
411 // Allows direct communication with the tag on command level
413 int CmdHF15CmdInquiry(const char *Cmd
)
417 UsbCommand c
= {CMD_ISO_15693_COMMAND
, {0, 1, 1}}; // len,speed,recv?
418 uint8_t *req
=c
.d
.asBytes
;
421 req
[0]= ISO15_REQ_SUBCARRIER_SINGLE
| ISO15_REQ_DATARATE_HIGH
|
422 ISO15_REQ_INVENTORY
| ISO15_REQINV_SLOT1
;
423 req
[1]=ISO15_CMD_INVENTORY
;
424 req
[2]=0; // mask length
425 reqlen
=AddCrc(req
,3);
430 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1000)) {
431 if (resp
.arg
[0]>=12) {
432 recv
= resp
.d
.asBytes
;
433 PrintAndLog("UID=%s",sprintUID(NULL
,&recv
[2]));
434 PrintAndLog("Tag Info: %s",getTagInfo(&recv
[2]));
436 PrintAndLog("Response to short, just %i bytes. No tag?\n",resp
.arg
[0]);
439 PrintAndLog("timeout.");
445 // Turns debugging on(1)/off(0)
446 int CmdHF15CmdDebug( const char *cmd
) {
449 PrintAndLog("Usage: hf 15 cmd debug <0|1>");
450 PrintAndLog(" 0 no debugging");
451 PrintAndLog(" 1 turn debugging on");
455 UsbCommand c
= {CMD_ISO_15693_DEBUG
, {debug
, 0, 0}};
461 int CmdHF15CmdRaw (const char *cmd
) {
464 UsbCommand c
= {CMD_ISO_15693_COMMAND
, {0, 1, 1}}; // len,speed,recv?
471 unsigned int datalen
=0, temp
;
476 PrintAndLog("Usage: hf 15 cmd raw [-r] [-2] [-c] <0A 0B 0C ... hex>");
477 PrintAndLog(" -r do not read response");
478 PrintAndLog(" -2 use slower '1 out of 256' mode");
479 PrintAndLog(" -c calculate and append CRC");
480 PrintAndLog(" Tip: turn on debugging for verbose output");
485 while (*cmd
==' ' || *cmd
=='\t') cmd
++;
487 while (cmd
[i
]!='\0') {
488 if (cmd
[i
]==' ' || cmd
[i
]=='\t') { i
++; continue; }
503 PrintAndLog("Invalid option");
509 if ((cmd
[i
]>='0' && cmd
[i
]<='9') ||
510 (cmd
[i
]>='a' && cmd
[i
]<='f') ||
511 (cmd
[i
]>='A' && cmd
[i
]<='F') ) {
512 buf
[strlen(buf
)+1]=0;
513 buf
[strlen(buf
)]=cmd
[i
];
516 if (strlen(buf
)>=2) {
517 sscanf(buf
,"%x",&temp
);
518 data
[datalen
]=(uint8_t)(temp
& 0xff);
524 PrintAndLog("Invalid char on input");
527 if (crc
) datalen
=AddCrc(data
,datalen
);
532 memcpy(c
.d
.asBytes
,data
,datalen
);
537 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1000)) {
538 recv
= resp
.d
.asBytes
;
539 PrintAndLog("received %i octets",resp
.arg
[0]);
540 hexout
= (char *)malloc(resp
.arg
[0] * 3 + 1);
541 if (hexout
!= NULL
) {
542 for (int i
= 0; i
< resp
.arg
[0]; i
++) { // data in hex
543 sprintf(&hexout
[i
* 3], "%02X ", recv
[i
]);
545 PrintAndLog("%s", hexout
);
549 PrintAndLog("timeout while waiting for reply.");
558 * parses common HF 15 CMD parameters and prepares some data structures
562 int prepareHF15Cmd(char **cmd
, UsbCommand
*c
, uint8_t iso15cmd
[], int iso15cmdlen
) {
564 uint8_t *req
= c
->d
.asBytes
;
565 uint8_t uid
[8] = {0x00};
569 while (**cmd
==' ' || **cmd
=='\t') (*cmd
)++;
571 if (strstr(*cmd
,"-2")==*cmd
) {
572 c
->arg
[1]=0; // use 1of256
577 while (**cmd
==' ' || **cmd
=='\t') (*cmd
)++;
579 if (strstr(*cmd
,"-o")==*cmd
) {
580 req
[reqlen
]=ISO15_REQ_OPTION
;
585 while (**cmd
==' ' || **cmd
=='\t') (*cmd
)++;
589 PrintAndLog("missing addr");
594 // you must have selected the tag earlier
595 req
[reqlen
++]|= ISO15_REQ_SUBCARRIER_SINGLE
| ISO15_REQ_DATARATE_HIGH
|
596 ISO15_REQ_NONINVENTORY
| ISO15_REQ_SELECT
;
597 memcpy(&req
[reqlen
],&iso15cmd
[0],iso15cmdlen
);
602 // unaddressed mode may not be supported by all vendors
603 req
[reqlen
++]|= ISO15_REQ_SUBCARRIER_SINGLE
| ISO15_REQ_DATARATE_HIGH
|
604 ISO15_REQ_NONINVENTORY
;
605 memcpy(&req
[reqlen
],&iso15cmd
[0],iso15cmdlen
);
609 // we scan for the UID ourself
610 req
[reqlen
++]|= ISO15_REQ_SUBCARRIER_SINGLE
| ISO15_REQ_DATARATE_HIGH
|
611 ISO15_REQ_NONINVENTORY
| ISO15_REQ_ADDRESS
;
612 memcpy(&req
[reqlen
],&iso15cmd
[0],iso15cmdlen
);
615 PrintAndLog("No Tag found");
618 memcpy(req
+reqlen
,uid
,8);
619 PrintAndLog("Detected UID %s",sprintUID(NULL
,uid
));
623 req
[reqlen
++]|= ISO15_REQ_SUBCARRIER_SINGLE
| ISO15_REQ_DATARATE_HIGH
|
624 ISO15_REQ_NONINVENTORY
| ISO15_REQ_ADDRESS
;
625 memcpy(&req
[reqlen
],&iso15cmd
[0],iso15cmdlen
);
628 /* sscanf(cmd,"%hX%hX%hX%hX%hX%hX%hX%hX",
629 (short unsigned int *)&uid[7],(short unsigned int *)&uid[6],
630 (short unsigned int *)&uid[5],(short unsigned int *)&uid[4],
631 (short unsigned int *)&uid[3],(short unsigned int *)&uid[2],
632 (short unsigned int *)&uid[1],(short unsigned int *)&uid[0]); */
633 for (int i
=0;i
<8 && (*cmd
)[i
*2] && (*cmd
)[i
*2+1];i
++) { // parse UID
634 sscanf((char[]){(*cmd
)[i
*2],(*cmd
)[i
*2+1],0},"%X",&temp
);
638 PrintAndLog("Using UID %s",sprintUID(NULL
,uid
));
639 memcpy(&req
[reqlen
],&uid
[0],8);
642 // skip to next space
643 while (**cmd
!=' ' && **cmd
!='\t') (*cmd
)++;
644 // skip over the space
645 while (**cmd
==' ' || **cmd
=='\t') (*cmd
)++;
652 * Commandline handling: HF15 CMD SYSINFO
653 * get system information from tag/VICC
655 int CmdHF15CmdSysinfo(const char *Cmd
) {
658 UsbCommand c
= {CMD_ISO_15693_COMMAND
, {0, 1, 1}}; // len,speed,recv?
659 uint8_t *req
=c
.d
.asBytes
;
663 char output
[2048]="";
670 PrintAndLog("Usage: hf 15 cmd sysinfo [options] <uid|s|u|*>");
671 PrintAndLog(" options:");
672 PrintAndLog(" -2 use slower '1 out of 256' mode");
673 PrintAndLog(" uid (either): ");
674 PrintAndLog(" <8B hex> full UID eg E011223344556677");
675 PrintAndLog(" s selected tag");
676 PrintAndLog(" u unaddressed mode");
677 PrintAndLog(" * scan for tag");
678 PrintAndLog(" start#: page number to start 0-255");
679 PrintAndLog(" count#: number of pages");
683 prepareHF15Cmd(&cmd
, &c
,(uint8_t[]){ISO15_CMD_SYSINFO
},1);
686 reqlen
=AddCrc(req
,reqlen
);
691 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1000) && resp
.arg
[0]>2) {
692 recv
= resp
.d
.asBytes
;
693 if (ISO15_CRC_CHECK
==Crc(recv
,resp
.arg
[0])) {
694 if (!(recv
[0] & ISO15_RES_ERROR
)) {
695 *output
=0; // reset outputstring
696 for ( i
=1; i
<resp
.arg
[0]-2; i
++) {
697 sprintf(output
+strlen(output
),"%02X ",recv
[i
]);
699 strcat(output
,"\n\r");
700 strcat(output
,"UID = ");
701 strcat(output
,sprintUID(NULL
,recv
+2));
702 strcat(output
,"\n\r");
703 strcat(output
,getTagInfo(recv
+2)); //ABC
704 strcat(output
,"\n\r");
707 sprintf(output
+strlen(output
),"DSFID supported, set to %02X\n\r",recv
[i
++]);
709 strcat(output
,"DSFID not supported\n\r");
711 sprintf(output
+strlen(output
),"AFI supported, set to %03X\n\r",recv
[i
++]);
713 strcat(output
,"AFI not supported\n\r");
714 if (recv
[1] & 0x04) {
715 strcat(output
,"Tag provides info on memory layout (vendor dependent)\n\r");
716 sprintf(output
+strlen(output
)," %i (or %i) bytes/page x %i pages \n\r",
717 (recv
[i
+1]&0x1F)+1, (recv
[i
+1]&0x1F), recv
[i
]+1);
720 strcat(output
,"Tag does not provide information on memory layout\n\r");
721 if (recv
[1] & 0x08) sprintf(output
+strlen(output
),"IC reference given: %02X\n\r",recv
[i
++]);
722 else strcat(output
,"IC reference not given\n\r");
725 PrintAndLog("%s",output
);
727 PrintAndLog("Tag returned Error %i: %s",recv
[0],TagErrorStr(recv
[0]));
730 PrintAndLog("CRC failed");
733 PrintAndLog("timeout: no answer");
740 * Commandline handling: HF15 CMD READMULTI
741 * Read multiple blocks at once (not all tags support this)
743 int CmdHF15CmdReadmulti(const char *Cmd
) {
746 UsbCommand c
= {CMD_ISO_15693_COMMAND
, {0, 1, 1}}; // len,speed,recv?
747 uint8_t *req
=c
.d
.asBytes
;
748 int reqlen
=0, pagenum
,pagecount
;
751 char output
[2048]="";
757 PrintAndLog("Usage: hf 15 cmd readmulti [options] <uid|s|u|*> <start#> <count#>");
758 PrintAndLog(" options:");
759 PrintAndLog(" -2 use slower '1 out of 256' mode");
760 PrintAndLog(" uid (either): ");
761 PrintAndLog(" <8B hex> full UID eg E011223344556677");
762 PrintAndLog(" s selected tag");
763 PrintAndLog(" u unaddressed mode");
764 PrintAndLog(" * scan for tag");
765 PrintAndLog(" start#: page number to start 0-255");
766 PrintAndLog(" count#: number of pages");
770 prepareHF15Cmd(&cmd
, &c
,(uint8_t[]){ISO15_CMD_READMULTI
},1);
773 pagenum
=strtol(cmd
,NULL
,0);
775 // skip to next space
776 while (*cmd
!=' ' && *cmd
!='\t') cmd
++;
777 // skip over the space
778 while (*cmd
==' ' || *cmd
=='\t') cmd
++;
780 pagecount
=strtol(cmd
,NULL
,0);
781 if (pagecount
>0) pagecount
--; // 0 means 1 page, 1 means 2 pages, ...
783 req
[reqlen
++]=(uint8_t)pagenum
;
784 req
[reqlen
++]=(uint8_t)pagecount
;
786 reqlen
=AddCrc(req
,reqlen
);
792 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1000) && resp
.arg
[0]>2) {
793 recv
= resp
.d
.asBytes
;
794 if (ISO15_CRC_CHECK
==Crc(recv
,resp
.arg
[0])) {
795 if (!(recv
[0] & ISO15_RES_ERROR
)) {
796 *output
=0; // reset outputstring
797 for ( int i
=1; i
<resp
.arg
[0]-2; i
++) {
798 sprintf(output
+strlen(output
),"%02X ",recv
[i
]);
801 for ( int i
=1; i
<resp
.arg
[0]-2; i
++) {
802 sprintf(output
+strlen(output
),"%c",recv
[i
]>31 && recv
[i
]<127?recv
[i
]:'.');
804 PrintAndLog("%s",output
);
806 PrintAndLog("Tag returned Error %i: %s",recv
[0],TagErrorStr(recv
[0]));
809 PrintAndLog("CRC failed");
812 PrintAndLog("no answer");
819 * Commandline handling: HF15 CMD READ
820 * Reads a single Block
822 int CmdHF15CmdRead(const char *Cmd
) {
825 UsbCommand c
= {CMD_ISO_15693_COMMAND
, {0, 1, 1}}; // len,speed,recv?
826 uint8_t *req
=c
.d
.asBytes
;
827 int reqlen
=0, pagenum
;
836 PrintAndLog("Usage: hf 15 cmd read [options] <uid|s|u|*> <page#>");
837 PrintAndLog(" options:");
838 PrintAndLog(" -2 use slower '1 out of 256' mode");
839 PrintAndLog(" uid (either): ");
840 PrintAndLog(" <8B hex> full UID eg E011223344556677");
841 PrintAndLog(" s selected tag");
842 PrintAndLog(" u unaddressed mode");
843 PrintAndLog(" * scan for tag");
844 PrintAndLog(" page#: page number 0-255");
848 prepareHF15Cmd(&cmd
, &c
,(uint8_t[]){ISO15_CMD_READ
},1);
851 pagenum
=strtol(cmd
,NULL
,0);
853 PrintAndLog("invalid pagenum");
857 req
[reqlen
++]=(uint8_t)pagenum
;
859 reqlen
=AddCrc(req
,reqlen
);
865 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1000) && resp
.arg
[0]>2) {
866 recv
= resp
.d
.asBytes
;
867 if (ISO15_CRC_CHECK
==Crc(recv
,resp
.arg
[0])) {
868 if (!(recv
[0] & ISO15_RES_ERROR
)) {
869 *output
=0; // reset outputstring
870 //sprintf(output, "Block %2i ",blocknum);
871 for ( int i
=1; i
<resp
.arg
[0]-2; i
++) {
872 sprintf(output
+strlen(output
),"%02X ",recv
[i
]);
875 for ( int i
=1; i
<resp
.arg
[0]-2; i
++) {
876 sprintf(output
+strlen(output
),"%c",recv
[i
]>31 && recv
[i
]<127?recv
[i
]:'.');
878 PrintAndLog("%s",output
);
880 PrintAndLog("Tag returned Error %i: %s",recv
[1],TagErrorStr(recv
[1]));
883 PrintAndLog("CRC failed");
886 PrintAndLog("no answer");
894 * Commandline handling: HF15 CMD WRITE
895 * Writes a single Block - might run into timeout, even when successful
897 int CmdHF15CmdWrite(const char *Cmd
) {
900 UsbCommand c
= {CMD_ISO_15693_COMMAND
, {0, 1, 1}}; // len,speed,recv?
901 uint8_t *req
=c
.d
.asBytes
;
902 int reqlen
=0, pagenum
, temp
;
911 PrintAndLog("Usage: hf 15 cmd write [options] <uid|s|u|*> <page#> <hexdata>");
912 PrintAndLog(" options:");
913 PrintAndLog(" -2 use slower '1 out of 256' mode");
914 PrintAndLog(" -o set OPTION Flag (needed for TI)");
915 PrintAndLog(" uid (either): ");
916 PrintAndLog(" <8B hex> full UID eg E011223344556677");
917 PrintAndLog(" s selected tag");
918 PrintAndLog(" u unaddressed mode");
919 PrintAndLog(" * scan for tag");
920 PrintAndLog(" page#: page number 0-255");
921 PrintAndLog(" hexdata: data to be written eg AA BB CC DD");
925 prepareHF15Cmd(&cmd
, &c
,(uint8_t[]){ISO15_CMD_WRITE
},1);
928 // *cmd -> page num ; *cmd2 -> data
930 while (*cmd2
!=' ' && *cmd2
!='\t' && *cmd2
) cmd2
++;
934 pagenum
=strtol(cmd
,NULL
,0);
936 PrintAndLog("invalid pagenum");
939 req
[reqlen
++]=(uint8_t)pagenum
;
942 while (cmd2
[0] && cmd2
[1]) { // hexdata, read by 2 hexchars
947 sscanf((char[]){cmd2
[0],cmd2
[1],0},"%X",&temp
);
948 req
[reqlen
++]=temp
& 0xff;
952 reqlen
=AddCrc(req
,reqlen
);
958 if (WaitForResponseTimeout(CMD_ACK
,&resp
,2000) && resp
.arg
[0]>2) {
959 recv
= resp
.d
.asBytes
;
960 if (ISO15_CRC_CHECK
==Crc(recv
,resp
.arg
[0])) {
961 if (!(recv
[0] & ISO15_RES_ERROR
)) {
964 PrintAndLog("Tag returned Error %i: %s",recv
[1],TagErrorStr(recv
[1]));
967 PrintAndLog("CRC failed");
970 PrintAndLog("timeout: no answer - data may be written anyway");
978 static command_t CommandTable15Cmd
[] =
980 {"help", CmdHF15CmdHelp
, 1, "This Help"},
981 {"inquiry", CmdHF15CmdInquiry
, 0, "Search for tags in range"},
983 {"select", CmdHF15CmdSelect, 0, "Select an tag with a specific UID for further commands"},
985 {"read", CmdHF15CmdRead
, 0, "Read a block"},
986 {"write", CmdHF15CmdWrite
, 0, "Write a block"},
987 {"readmulti",CmdHF15CmdReadmulti
, 0, "Reads multiple Blocks"},
988 {"sysinfo",CmdHF15CmdSysinfo
, 0, "Get Card Information"},
989 {"raw", CmdHF15CmdRaw
, 0, "Send raw hex data to tag"},
990 {"debug", CmdHF15CmdDebug
, 0, "Turn debugging on/off"},
991 {NULL
, NULL
, 0, NULL
}
994 int CmdHF15Cmd(const char *Cmd
)
996 CmdsParse(CommandTable15Cmd
, Cmd
);
1000 int CmdHF15CmdHelp(const char *Cmd
)
1002 CmdsHelp(CommandTable15Cmd
);