cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf14b.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // High frequency ISO14443B commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include "cmdhf14b.h"
  12
  13 #include <stdio.h>
  14 #include <stdlib.h>
  15 #include <stdbool.h>
  16 #include <string.h>
  17 #include <stdint.h>
  18 #include <ctype.h>
  19 #include "iso14443crc.h"
  20 #include "comms.h"
  21 #include "graph.h"
  22 #include "util.h"
  23 #include "ui.h"
  24 #include "cmdparser.h"
  25 #include "cmdmain.h"
  26 #include "taginfo.h"
  27
  28
  29 int CmdHF14BList(const char *Cmd) {
  30         PrintAndLog("Deprecated command, use 'hf list 14b' instead");
  31         return 0;
  32 }
  33
  34
  35 int CmdHF14BSim(const char *Cmd) {
  36   UsbCommand c={CMD_SIMULATE_TAG_ISO_14443B};
  37   clearCommandBuffer();
  38   SendCommand(&c);
  39   return 0;
  40 }
  41
  42
  43 int CmdHF14BSnoop(const char *Cmd) {
  44   UsbCommand c = {CMD_SNOOP_ISO_14443B};
  45   clearCommandBuffer();
  46   SendCommand(&c);
  47   return 0;
  48 }
  49
  50
  51 /* New command to read the contents of a SRI512 tag
  52  * SRI512 tags are ISO14443-B modulated memory tags,
  53  * this command just dumps the contents of the memory
  54  */
  55 int CmdSri512Read(const char *Cmd) {
  56   UsbCommand c = {CMD_READ_SRI512_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
  57   clearCommandBuffer();
  58   SendCommand(&c);
  59   return 0;
  60 }
  61
  62
  63 /* New command to read the contents of a SRIX4K tag
  64  * SRIX4K tags are ISO14443-B modulated memory tags,
  65  * this command just dumps the contents of the memory/
  66  */
  67 int CmdSrix4kRead(const char *Cmd) {
  68   UsbCommand c = {CMD_READ_SRIX4K_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
  69   clearCommandBuffer();
  70   SendCommand(&c);
  71   return 0;
  72 }
  73
  74
  75 static bool switch_off_field_14b(void) {
  76         UsbCommand resp;
  77         UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}};
  78         clearCommandBuffer();
  79         SendCommand(&c);
  80         if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)) {
  81                 return false;
  82         }
  83         return false;
  84 }
  85
  86
  87 int HF14BCmdRaw(bool reply, bool *crc, bool power, uint8_t *data, uint8_t *datalen, bool verbose) {
  88         UsbCommand resp;
  89         UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; // len,recv,power
  90         if (*crc) {
  91                 uint8_t first, second;
  92                 ComputeCrc14443(CRC_14443_B, data, *datalen, &first, &second);
  93                 data[*datalen] = first;
  94                 data[*datalen + 1] = second;
  95                 *datalen += 2;
  96         }
  97
  98         c.arg[0] = *datalen;
  99         c.arg[1] = reply;
 100         c.arg[2] = power;
 101         memcpy(c.d.asBytes,data, *datalen);
 102         clearCommandBuffer();
 103         SendCommand(&c);
 104
 105         if (!reply) return 1;
 106
 107         if (!WaitForResponseTimeout(CMD_ACK, &resp, 1000)) {
 108                 if (verbose) PrintAndLog("timeout while waiting for reply.");
 109                 return 0;
 110         }
 111
 112         int ret = resp.arg[0];
 113         if (verbose) {
 114                 if (ret < 0) {
 115                         PrintAndLog("tag didn't respond");
 116                 } else if (ret == 0) {
 117                         PrintAndLog("received SOF only (maybe iCLASS/Picopass)");
 118                 } else {
 119                         PrintAndLog("received %u octets", ret);
 120                 }
 121         }
 122
 123         *datalen = ret;
 124
 125         if (ret < 2) return 0;
 126
 127         memcpy(data, resp.d.asBytes, *datalen);
 128         if (verbose) PrintAndLog("%s", sprint_hex(data, *datalen));
 129
 130         uint8_t first, second;
 131         ComputeCrc14443(CRC_14443_B, data, *datalen-2, &first, &second);
 132         if (data[*datalen-2] == first && data[*datalen-1] == second) {
 133                 if (verbose) PrintAndLog("CRC OK");
 134                 *crc = true;
 135         } else {
 136                 if (verbose) PrintAndLog("CRC failed");
 137                 *crc = false;
 138         }
 139         return 1;
 140 }
 141
 142
 143 static int CmdHF14BCmdRaw (const char *Cmd) {
 144         bool reply = true;
 145         bool crc = false;
 146         bool power = false;
 147         bool select = false;
 148         bool SRx = false;
 149         char buf[5] = "";
 150         uint8_t data[100] = {0x00};
 151         uint8_t datalen = 0;
 152         unsigned int temp;
 153         int i = 0;
 154         if (strlen(Cmd) < 2) {
 155                         PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] [-s || -ss] <0A 0B 0C ... hex>");
 156                         PrintAndLog("       -r    do not read response");
 157                         PrintAndLog("       -c    calculate and append CRC");
 158                         PrintAndLog("       -p    leave the field on after receive");
 159                         PrintAndLog("       -s    active signal field ON with select");
 160                         PrintAndLog("       -ss   active signal field ON with select for SRx ST Microelectronics tags");
 161                         return 0;
 162         }
 163
 164         // strip
 165         while (*Cmd == ' ' || *Cmd == '\t') Cmd++;
 166
 167         while (Cmd[i] != '\0') {
 168                 if (Cmd[i] == ' ' || Cmd[i] == '\t') { i++; continue; }
 169                 if (Cmd[i] == '-') {
 170                         switch (Cmd[i+1]) {
 171                                 case 'r':
 172                                 case 'R':
 173                                         reply = false;
 174                                         break;
 175                                 case 'c':
 176                                 case 'C':
 177                                         crc = true;
 178                                         break;
 179                                 case 'p':
 180                                 case 'P':
 181                                         power = true;
 182                                         break;
 183                                 case 's':
 184                                 case 'S':
 185                                         select = true;
 186                                         if (Cmd[i+2] == 's' || Cmd[i+2] == 'S') {
 187                                                 SRx = true;
 188                                                 i++;
 189                                         }
 190                                         break;
 191                                 default:
 192                                         PrintAndLog("Invalid option");
 193                                         return 0;
 194                         }
 195                         i += 2;
 196                         continue;
 197                 }
 198                 if ((Cmd[i] >= '0' && Cmd[i] <= '9') ||
 199                         (Cmd[i] >= 'a' && Cmd[i] <= 'f') ||
 200                         (Cmd[i] >= 'A' && Cmd[i] <= 'F') ) {
 201                         buf[strlen(buf)+1] = 0;
 202                         buf[strlen(buf)] = Cmd[i];
 203                         i++;
 204
 205                         if (strlen(buf) >= 2) {
 206                                 sscanf(buf, "%x", &temp);
 207                                 data[datalen++] = (uint8_t)(temp & 0xff);
 208                                 *buf = 0;
 209                         }
 210                         continue;
 211                 }
 212                 PrintAndLog("Invalid char on input");
 213                 return 0;
 214         }
 215         if (datalen == 0) {
 216                 PrintAndLog("Missing data input");
 217                 return 0;
 218         }
 219
 220         if (select) { //auto select 14b tag
 221                 uint8_t cmd2[16];
 222                 bool crc2 = true;
 223                 uint8_t cmdLen;
 224
 225                 if (SRx) {
 226                         // REQ SRx
 227                         cmdLen = 2;
 228                         cmd2[0] = 0x06;
 229                         cmd2[1] = 0x00;
 230                 } else {
 231                         cmdLen = 3;
 232                         // REQB
 233                         cmd2[0] = 0x05;
 234                         cmd2[1] = 0x00;
 235                         cmd2[2] = 0x08;
 236                 }
 237
 238                 if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false) == 0) return switch_off_field_14b();
 239
 240                 if (SRx) {
 241                         if (cmdLen != 3 || !crc2) return switch_off_field_14b();
 242                 } else {
 243                         if (cmd2[0] != 0x50 || cmdLen != 14 || !crc2) return switch_off_field_14b();
 244                 }
 245
 246                 uint8_t chipID = 0;
 247                 if (SRx) {
 248                         // select
 249                         chipID = cmd2[0];
 250                         cmd2[0] = 0x0E;
 251                         cmd2[1] = chipID;
 252                         cmdLen = 2;
 253                 } else {
 254                         // attrib
 255                         cmd2[0] = 0x1D;
 256                         // UID from cmd2[1 - 4]
 257                         cmd2[5] = 0x00;
 258                         cmd2[6] = 0x08;
 259                         cmd2[7] = 0x01;
 260                         cmd2[8] = 0x00;
 261                         cmdLen = 9;
 262                 }
 263
 264                 if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false) == 0) return switch_off_field_14b();
 265
 266                 if (cmdLen != 3 || !crc2) return switch_off_field_14b();
 267                 if (SRx && cmd2[0] != chipID) return switch_off_field_14b();
 268         }
 269
 270         return HF14BCmdRaw(reply, &crc, power, data, &datalen, true);
 271
 272 }
 273
 274
 275 // print full atqb info
 276 static void print_atqb_resp(uint8_t *data) {
 277         //PrintAndLog ("           UID: %s", sprint_hex(data+1,4));
 278         PrintAndLog("      App Data: %s", sprint_hex(data+5,4));
 279         PrintAndLog("      Protocol: %s", sprint_hex(data+9,3));
 280         uint8_t BitRate = data[9];
 281         if (!BitRate)
 282                 PrintAndLog ("      Bit Rate: 106 kbit/s only PICC <-> PCD");
 283         if (BitRate & 0x10)
 284                 PrintAndLog ("      Bit Rate: 212 kbit/s PICC -> PCD supported");
 285         if (BitRate & 0x20)
 286                 PrintAndLog ("      Bit Rate: 424 kbit/s PICC -> PCD supported");
 287         if (BitRate & 0x40)
 288                 PrintAndLog ("      Bit Rate: 847 kbit/s PICC -> PCD supported");
 289         if (BitRate & 0x01)
 290                 PrintAndLog ("      Bit Rate: 212 kbit/s PICC <- PCD supported");
 291         if (BitRate & 0x02)
 292                 PrintAndLog ("      Bit Rate: 424 kbit/s PICC <- PCD supported");
 293         if (BitRate & 0x04)
 294                 PrintAndLog ("      Bit Rate: 847 kbit/s PICC <- PCD supported");
 295         if (BitRate & 0x80)
 296                 PrintAndLog ("                Same bit rate <-> required");
 297
 298         uint16_t maxFrame = data[10] >> 4;
 299         if (maxFrame < 5)
 300                 maxFrame = 8*maxFrame + 16;
 301         else if (maxFrame == 5)
 302                 maxFrame = 64;
 303         else if (maxFrame == 6)
 304                 maxFrame = 96;
 305         else if (maxFrame == 7)
 306                 maxFrame = 128;
 307         else if (maxFrame == 8)
 308                 maxFrame = 256;
 309         else
 310                 maxFrame = 257;
 311
 312         PrintAndLog ("Max Frame Size: %u%s", maxFrame, (maxFrame == 257) ? "+ RFU" : "");
 313
 314         uint8_t protocolT = data[10] & 0xF;
 315         PrintAndLog (" Protocol Type: Protocol is %scompliant with ISO/IEC 14443-4",(protocolT) ? "" : "not " );
 316         PrintAndLog ("Frame Wait Int: %u", data[11]>>4);
 317         PrintAndLog (" App Data Code: Application is %s",(data[11]&4) ? "Standard" : "Proprietary");
 318         PrintAndLog (" Frame Options: NAD is %ssupported",(data[11]&2) ? "" : "not ");
 319         PrintAndLog (" Frame Options: CID is %ssupported",(data[11]&1) ? "" : "not ");
 320         PrintAndLog ("Max Buf Length: %u (MBLI) %s",data[14]>>4, (data[14] & 0xF0) ? "" : "not supported");
 321
 322         return;
 323 }
 324
 325
 326 int print_ST_Lock_info(uint8_t model) {
 327         //assume connection open and tag selected...
 328         uint8_t data[16] = {0x00};
 329         uint8_t datalen = 2;
 330         bool crc = true;
 331         uint8_t resplen;
 332         uint8_t blk1;
 333         data[0] = 0x08;
 334
 335         if (model == 0x02) { //SR176 has special command:
 336                 data[1] = 0x0f;
 337                 resplen = 4;
 338         } else {
 339                 data[1] = 0xff;
 340                 resplen = 6;
 341         }
 342
 343         //std read cmd
 344         if (HF14BCmdRaw(true, &crc, true, data, &datalen, false) == 0) return switch_off_field_14b();
 345
 346         if (datalen != resplen || !crc) return switch_off_field_14b();
 347
 348         PrintAndLog("Chip Write Protection Bits:");
 349         // now interpret the data
 350         switch (model){
 351                 case 0x0: //fall through (SRIX4K special)
 352                 case 0x3: //fall through (SRIx4K)
 353                 case 0x7: //             (SRI4K)
 354                         //only need data[3]
 355                         blk1 = 9;
 356                         PrintAndLog("   raw: %s",printBits(1,data+3));
 357                         PrintAndLog(" 07/08:%slocked", (data[3] & 1) ? " not " : " " );
 358                         for (uint8_t i = 1; i < 8; i++){
 359                                 PrintAndLog("    %02u:%slocked", blk1, (data[3] & (1 << i)) ? " not " : " " );
 360                                 blk1++;
 361                         }
 362                         break;
 363                 case 0x4: //fall through (SRIX512)
 364                 case 0x6: //fall through (SRI512)
 365                 case 0xC: //             (SRT512)
 366                         //need data[2] and data[3]
 367                         blk1 = 0;
 368                         PrintAndLog("   raw: %s", printBits(2,data+2));
 369                         for (uint8_t b = 2; b < 4; b++) {
 370                                 for (uint8_t i = 0; i < 8; i++) {
 371                                         PrintAndLog("    %02u:%slocked", blk1, (data[b] & (1 << i)) ? " not " : " " );
 372                                         blk1++;
 373                                 }
 374                         }
 375                         break;
 376                 case 0x2: //             (SR176)
 377                         //need data[2]
 378                         blk1 = 0;
 379                         PrintAndLog("   raw: %s",printBits(1, data+2));
 380                         for (uint8_t i = 0; i < 8; i++){
 381                                 PrintAndLog(" %02u/%02u:%slocked", blk1, blk1+1, (data[2] & (1 << i)) ? " " : " not " );
 382                                 blk1 += 2;
 383                         }
 384                         break;
 385                 default:
 386                         return switch_off_field_14b();
 387         }
 388         return 1;
 389 }
 390
 391
 392 // print UID info from SRx chips (ST Microelectronics)
 393 static void print_st_general_info(uint8_t *data) {
 394         //uid = first 8 bytes in data
 395         PrintAndLog("   UID: %s", sprint_hex(SwapEndian64(data, 8, 8), 8));
 396         PrintAndLog("   MFG: %02X, %s", data[6], getManufacturerName(data[6]));
 397         PrintAndLog("  Chip: %02X, %s", data[5], getChipInfo(data[6], data[5]));
 398         return;
 399 }
 400
 401
 402 // 14b get and print UID only (general info)
 403 int HF14BStdReader(uint8_t *data, uint8_t *datalen) {
 404         //05 00 00 = find one tag in field
 405         //1d xx xx xx xx 00 08 01 00 = attrib xx=UID (resp 10 [f9 e0])
 406         //a3 = ?  (resp 03 [e2 c2])
 407         //02 = ?  (resp 02 [6a d3])
 408         // 022b (resp 02 67 00 [29  5b])
 409         // 0200a40400 (resp 02 67 00 [29 5b])
 410         // 0200a4040c07a0000002480300 (resp 02 67 00 [29 5b])
 411         // 0200a4040c07a0000002480200 (resp 02 67 00 [29 5b])
 412         // 0200a4040006a0000000010100 (resp 02 6a 82 [4b 4c])
 413         // 0200a4040c09d27600002545500200 (resp 02 67 00 [29 5b])
 414         // 0200a404000cd2760001354b414e4d30310000 (resp 02 6a 82 [4b 4c])
 415         // 0200a404000ca000000063504b43532d313500 (resp 02 6a 82 [4b 4c])
 416         // 0200a4040010a000000018300301000000000000000000 (resp 02 6a 82 [4b 4c])
 417         //03 = ?  (resp 03 [e3 c2])
 418         //c2 = ?  (resp c2 [66 15])
 419         //b2 = ?  (resp a3 [e9 67])
 420         //a2 = ?  (resp 02 [6a d3])
 421         bool crc = true;
 422         *datalen = 3;
 423         //std read cmd
 424         data[0] = 0x05;
 425         data[1] = 0x00;
 426         data[2] = 0x08;
 427
 428         if (HF14BCmdRaw(true, &crc, true, data, datalen, false) == 0) return switch_off_field_14b();
 429
 430         if (data[0] != 0x50 || *datalen != 14 || !crc) return switch_off_field_14b();
 431
 432         PrintAndLog ("\n14443-3b tag found:");
 433         PrintAndLog ("           UID: %s", sprint_hex(data+1, 4));
 434
 435         uint8_t cmd2[16];
 436         uint8_t cmdLen = 3;
 437         bool crc2 = true;
 438
 439         cmd2[0] = 0x1D;
 440         // UID from data[1 - 4]
 441         cmd2[1] = data[1];
 442         cmd2[2] = data[2];
 443         cmd2[3] = data[3];
 444         cmd2[4] = data[4];
 445         cmd2[5] = 0x00;
 446         cmd2[6] = 0x08;
 447         cmd2[7] = 0x01;
 448         cmd2[8] = 0x00;
 449         cmdLen = 9;
 450
 451         // attrib
 452         if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false) == 0) return switch_off_field_14b();
 453
 454         if (cmdLen != 3 || !crc2) return switch_off_field_14b();
 455         // add attrib responce to data
 456         data[14] = cmd2[0];
 457         switch_off_field_14b();
 458         return 1;
 459 }
 460
 461
 462 // 14b get and print Full Info (as much as we know)
 463 static bool HF14B_Std_Info(uint8_t *data, uint8_t *datalen) {
 464         if (!HF14BStdReader(data, datalen)) return false;
 465
 466         //add more info here
 467         print_atqb_resp(data);
 468
 469         return true;
 470 }
 471
 472
 473 // SRx get and print general info about SRx chip from UID
 474 static bool HF14B_ST_Reader(uint8_t *data, uint8_t *datalen, bool closeCon){
 475         bool crc = true;
 476         *datalen = 2;
 477         //wake cmd
 478         data[0] = 0x06;
 479         data[1] = 0x00;
 480
 481         //leave power on
 482         // verbose on for now for testing - turn off when functional
 483         if (HF14BCmdRaw(true, &crc, true, data, datalen, false) == 0) return switch_off_field_14b();
 484
 485         if (*datalen != 3 || !crc) return switch_off_field_14b();
 486
 487         uint8_t chipID = data[0];
 488         // select
 489         data[0] = 0x0E;
 490         data[1] = chipID;
 491         *datalen = 2;
 492
 493         //leave power on
 494         if (HF14BCmdRaw(true, &crc, true, data, datalen, false) == 0) return switch_off_field_14b();
 495
 496         if (*datalen != 3 || !crc || data[0] != chipID) return switch_off_field_14b();
 497
 498         // get uid
 499         data[0] = 0x0B;
 500         *datalen = 1;
 501
 502         //leave power on
 503         if (HF14BCmdRaw(true, &crc, true, data, datalen, false) == 0) return switch_off_field_14b();
 504
 505         if (*datalen != 10 || !crc) return switch_off_field_14b();
 506
 507         //power off ?
 508         if (closeCon) switch_off_field_14b();
 509
 510         PrintAndLog("\n14443-3b ST tag found:");
 511         print_st_general_info(data);
 512         return 1;
 513 }
 514
 515
 516 // SRx get and print full info (needs more info...)
 517 static bool HF14B_ST_Info(bool verbose) {
 518         uint8_t data[100];
 519         uint8_t datalen;
 520
 521         if (!HF14B_ST_Reader(data, &datalen, false)) return false;
 522
 523         //add locking bit information here.
 524         if (print_ST_Lock_info(data[5] >> 2))
 525                 switch_off_field_14b();
 526
 527         return true;
 528 }
 529
 530
 531 // test for other 14b type tags (mimic another reader - don't have tags to identify)
 532 static bool HF14B_Other_Reader(uint8_t *data, bool verbose) {
 533         uint8_t datalen;
 534         bool crc = true;
 535
 536         //std read cmd
 537         data[0] = 0x00;
 538         data[1] = 0x0b;
 539         data[2] = 0x3f;
 540         data[3] = 0x80;
 541         datalen = 4;
 542
 543         if (HF14BCmdRaw(true, &crc, true, data, &datalen, false) != 0) {
 544                 if (datalen > 2 || !crc) {
 545                         PrintAndLog ("\n14443-3b tag found:");
 546                         PrintAndLog ("Unknown tag type answered to a 0x000b3f80 command:");
 547                         PrintAndLog ("%s", sprint_hex(data, datalen));
 548                         switch_off_field_14b();
 549                         return true;
 550                 }
 551         }
 552
 553         crc = false;
 554         datalen = 1;
 555         data[0] = 0x0a;
 556
 557         if (HF14BCmdRaw(true, &crc, true, data, &datalen, false) != 0) {
 558                 if (datalen > 0) {
 559                         PrintAndLog ("\n14443-3b tag found:");
 560                         PrintAndLog ("Unknown tag type answered to a 0x0A command:");
 561                         PrintAndLog ("%s", sprint_hex(data, datalen));
 562                         switch_off_field_14b();
 563                         return true;
 564                 }
 565         }
 566
 567         crc = false;
 568         datalen = 1;
 569         data[0] = 0x0c;
 570
 571         if (HF14BCmdRaw(true, &crc, true, data, &datalen, false) != 0) {
 572                 if (datalen > 0) {
 573                         PrintAndLog ("\n14443-3b tag found:");
 574                         PrintAndLog ("Unknown tag type answered to a 0x0C command:");
 575                         PrintAndLog ("%s", sprint_hex(data, datalen));
 576                         switch_off_field_14b();
 577                         return true;
 578                 }
 579         }
 580         switch_off_field_14b();
 581         return false;
 582 }
 583
 584
 585 // get and print all info known about any known 14b tag
 586 static int usage_hf_14b_info(void) {
 587         PrintAndLogEx(NORMAL, "Usage: hf 14b info [h] [s]");
 588         PrintAndLogEx(NORMAL, "Options:");
 589         PrintAndLogEx(NORMAL, "       h    this help");
 590         PrintAndLogEx(NORMAL, "       s    silently");
 591         PrintAndLogEx(NORMAL, "Example:");
 592         PrintAndLogEx(NORMAL, "       hf 14b info");
 593         return 0;
 594 }
 595
 596 int infoHF14B(bool verbose) {
 597         uint8_t data[100];
 598         uint8_t datalen;
 599
 600         // try std 14b (atqb)
 601         if (HF14B_Std_Info(data, &datalen)) return 1;
 602
 603         // try st 14b
 604         if (HF14B_ST_Info(verbose)) return 1;
 605
 606         // try unknown 14b read commands (to be identified later)
 607         //   could be read of calypso, CEPAS, moneo, or pico pass.
 608         if (HF14B_Other_Reader(data, verbose)) return 1;
 609
 610         if (verbose) PrintAndLog("no 14443B tag found");
 611         return 0;
 612 }
 613
 614
 615 // menu command to get and print all info known about any known 14b tag
 616 static int CmdHF14Binfo(const char *Cmd){
 617         char cmdp = tolower(param_getchar(Cmd, 0));
 618         if (cmdp == 'h') return usage_hf_14b_info();
 619
 620         bool verbose = !(cmdp == 's');
 621         return infoHF14B(verbose);
 622 }
 623
 624
 625 // get and print general info about all known 14b chips
 626 int readHF14B(bool verbose){
 627         uint8_t data[100];
 628         uint8_t datalen = 5;
 629
 630         // try std 14b (atqb)
 631         if (HF14BStdReader(data, &datalen)) return 1;
 632
 633         // try st 14b
 634         if (HF14B_ST_Reader(data, &datalen, true)) return 1;
 635
 636         // try unknown 14b read commands (to be identified later)
 637         //   could be read of calypso, CEPAS, moneo, or pico pass.
 638         if (HF14B_Other_Reader(data, verbose)) return 1;
 639
 640         if (verbose) PrintAndLog("no 14443B tag found");
 641         return 0;
 642 }
 643
 644
 645 // menu command to get and print general info about all known 14b chips
 646 static int usage_hf_14b_reader(void) {
 647         PrintAndLogEx(NORMAL, "Usage: hf 14b reader [h] [s]");
 648         PrintAndLogEx(NORMAL, "Options:");
 649         PrintAndLogEx(NORMAL, "       h    this help");
 650         PrintAndLogEx(NORMAL, "       s    silently");
 651         PrintAndLogEx(NORMAL, "Example:");
 652         PrintAndLogEx(NORMAL, "       hf 14b reader");
 653         return 0;
 654 }
 655
 656
 657 static int CmdHF14BReader(const char *Cmd) {
 658         char cmdp = tolower(param_getchar(Cmd, 0));
 659         if (cmdp == 'h') return usage_hf_14b_reader();
 660
 661         bool verbose = !(cmdp == 's');
 662         return readHF14B(verbose);
 663 }
 664
 665
 666 int CmdSriWrite(const char *Cmd) {
 667 /*
 668  * For SRIX4K  blocks 00 - 7F
 669  * hf 14b raw -c -p 09 $srix4kwblock $srix4kwdata
 670  *
 671  * For SR512  blocks 00 - 0F
 672  * hf 14b raw -c -p 09 $sr512wblock $sr512wdata
 673  *
 674  * Special block FF =  otp_lock_reg block.
 675  * Data len 4 bytes-
 676  */
 677         char cmdp = param_getchar(Cmd, 0);
 678         uint8_t blockno = -1;
 679         uint8_t data[4] = {0x00};
 680         bool isSrix4k = true;
 681
 682         if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') {
 683                 PrintAndLog("Usage:  hf 14b write <1|2> <BLOCK> <DATA>");
 684                 PrintAndLog("    [1 = SRIX4K]");
 685                 PrintAndLog("    [2 = SRI512]");
 686                 PrintAndLog("    [BLOCK number depends on tag, special block == FF]");
 687                 PrintAndLog("     sample: hf 14b write 1 7F 11223344");
 688                 PrintAndLog("           : hf 14b write 1 FF 11223344");
 689                 PrintAndLog("           : hf 14b write 2 15 11223344");
 690                 PrintAndLog("           : hf 14b write 2 FF 11223344");
 691                 return 0;
 692         }
 693
 694         if ( cmdp == '2' )
 695                 isSrix4k = false;
 696
 697         //blockno = param_get8(Cmd, 1);
 698
 699         if (param_gethex(Cmd,1, &blockno, 2) ) {
 700                 PrintAndLog("Block number must include 2 HEX symbols");
 701                 return 0;
 702         }
 703
 704         if (isSrix4k) {
 705                 if (blockno > 0x7f && blockno != 0xff){
 706                         PrintAndLog("Block number out of range");
 707                         return 0;
 708                 }
 709         } else {
 710                 if (blockno > 0x0f && blockno != 0xff){
 711                         PrintAndLog("Block number out of range");
 712                         return 0;
 713                 }
 714         }
 715
 716         if (param_gethex(Cmd, 2, data, 8)) {
 717                 PrintAndLog("Data must include 8 HEX symbols");
 718                 return 0;
 719         }
 720
 721         if (blockno == 0xff)
 722                 PrintAndLog("[%s] Write special block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512", blockno, sprint_hex(data, 4));
 723         else
 724                 PrintAndLog("[%s] Write block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512", blockno, sprint_hex(data, 4));
 725
 726         char str[22];
 727         sprintf(str, "-ss -c 09 %02x %02x%02x%02x%02x", blockno, data[0], data[1], data[2], data[3]);
 728
 729         CmdHF14BCmdRaw(str);
 730         return 0;
 731 }
 732
 733
 734 static int CmdHelp(const char *Cmd);
 735
 736 static command_t CommandTable[] =
 737 {
 738   {"help",        CmdHelp,        1, "This help"},
 739   {"info",        CmdHF14Binfo,   0, "Find and print details about a 14443B tag"},
 740   {"list",        CmdHF14BList,   0, "[Deprecated] List ISO 14443B history"},
 741   {"reader",      CmdHF14BReader, 0, "Act as a 14443B reader to identify a tag"},
 742   {"sim",         CmdHF14BSim,    0, "Fake ISO 14443B tag"},
 743   {"snoop",       CmdHF14BSnoop,  0, "Eavesdrop ISO 14443B"},
 744   {"sri512read",  CmdSri512Read,  0, "Read contents of a SRI512 tag"},
 745   {"srix4kread",  CmdSrix4kRead,  0, "Read contents of a SRIX4K tag"},
 746   {"sriwrite",    CmdSriWrite,    0, "Write data to a SRI512 | SRIX4K tag"},
 747   {"raw",         CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},
 748   {NULL, NULL, 0, NULL}
 749 };
 750
 751 int CmdHF14B(const char *Cmd)
 752 {
 753   CmdsParse(CommandTable, Cmd);
 754   return 0;
 755 }
 756
 757 int CmdHelp(const char *Cmd)
 758 {
 759   CmdsHelp(CommandTable);
 760   return 0;
 761 }