1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
3 // Modified 2010-2012 by <adrian -at- atrox.at>
4 // Modified 2012 by <vsza at vsza.hu>
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
9 //-----------------------------------------------------------------------------
10 // High frequency ISO15693 commands
11 //-----------------------------------------------------------------------------
12 // There are three basic operation modes, depending on which device (proxmark/pc)
13 // the signal processing, (de)modulation, transmission protocol and logic is done.
15 // All steps are done on the proxmark, the output of the commands is returned via
16 // USB-debug-print commands.
18 // The protocol is done on the PC, passing only Iso15693 data frames via USB. This
19 // allows direct communication with a tag on command level
21 // The proxmark just samples the antenna and passes this "analog" data via USB to
22 // the client. Signal Processing & decoding is done on the pc. This is the slowest
23 // variant, but offers the possibility to analyze the waveforms directly.
29 //#include "proxusb.h"
30 #include "proxmark3.h"
34 #include "cmdparser.h"
36 #include "iso15693tools.h"
39 #define FrameSOF Iso15693FrameSOF
40 #define Logic0 Iso15693Logic0
41 #define Logic1 Iso15693Logic1
42 #define FrameEOF Iso15693FrameEOF
44 #define Crc(data,datalen) Iso15693Crc(data,datalen)
45 #define AddCrc(data,datalen) Iso15693AddCrc(data,datalen)
46 #define sprintUID(target,uid) Iso15693sprintUID(target,uid)
48 static int CmdHelp(const char *Cmd
);
50 // structure and database for uid -> tagtype lookups
53 int mask
; // how many MSB bits used
58 const productName uidmapping
[] = {
59 // UID, #significant Bits, "Vendor(+Product)"
60 { 0xE001000000000000LL
, 16, "Motorola" },
61 { 0xE002000000000000LL
, 16, "ST Microelectronics" },
62 { 0xE003000000000000LL
, 16, "Hitachi" },
63 { 0xE004000000000000LL
, 16, "Philips" },
64 { 0xE004010000000000LL
, 24, "Philips; IC SL2 ICS20" },
65 { 0xE005000000000000LL
, 16, "Infineon" },
66 { 0xE005400000000000LL
, 24, "Infineon; 56x32bit" },
67 { 0xE006000000000000LL
, 16, "Cylinc" },
68 { 0xE007000000000000LL
, 16, "Texas Instrument; " },
69 { 0xE007000000000000LL
, 20, "Texas Instrument; Tag-it HF-I Plus Inlay; 64x32bit" },
70 { 0xE007100000000000LL
, 20, "Texas Instrument; Tag-it HF-I Plus Chip; 64x32bit" },
71 { 0xE007800000000000LL
, 23, "Texas Instrument; Tag-it HF-I Plus (RF-HDT-DVBB tag or Third Party Products)" },
72 { 0xE007C00000000000LL
, 23, "Texas Instrument; Tag-it HF-I Standard; 8x32bit" },
73 { 0xE007C40000000000LL
, 23, "Texas Instrument; Tag-it HF-I Pro; 8x23bit; password" },
74 { 0xE008000000000000LL
, 16, "Fujitsu" },
75 { 0xE009000000000000LL
, 16, "Matsushita" },
76 { 0xE00A000000000000LL
, 16, "NEC" },
77 { 0xE00B000000000000LL
, 16, "Oki Electric" },
78 { 0xE00C000000000000LL
, 16, "Toshiba" },
79 { 0xE00D000000000000LL
, 16, "Mitsubishi" },
80 { 0xE00E000000000000LL
, 16, "Samsung" },
81 { 0xE00F000000000000LL
, 16, "Hyundai" },
82 { 0xE010000000000000LL
, 16, "LG-Semiconductors" },
83 { 0xE012000000000000LL
, 16, "HID Corporation" },
84 { 0xE016000000000000LL
, 16, "EM-Marin SA (Skidata)" },
85 { 0xE016040000000000LL
, 24, "EM-Marin SA (Skidata Keycard-eco); EM4034? no 'read', just 'readmulti'" },
86 { 0xE0160c0000000000LL
, 24, "EM-Marin SA; EM4035?" },
87 { 0xE016100000000000LL
, 24, "EM-Marin SA (Skidata); EM4135; 36x64bit start page 13" },
88 { 0xE016940000000000LL
, 24, "EM-Marin SA (Skidata); 51x64bit" },
89 { 0,0,"no tag-info available" } // must be the last entry
93 // fast method to just read the UID of a tag (collission detection not supported)
94 // *buf should be large enough to fit the 64bit uid
95 // returns 1 if suceeded
96 int getUID(uint8_t *buf
)
100 UsbCommand c
= {CMD_ISO_15693_COMMAND
, {0, 1, 1}}; // len,speed,recv?
101 uint8_t *req
=c
.d
.asBytes
;
104 for (int retry
=0;retry
<3; retry
++) { // don't give up the at the first try
106 req
[0]= ISO15_REQ_SUBCARRIER_SINGLE
| ISO15_REQ_DATARATE_HIGH
|
107 ISO15_REQ_INVENTORY
| ISO15_REQINV_SLOT1
;
108 req
[1]=ISO15_CMD_INVENTORY
;
109 req
[2]=0; // mask length
110 reqlen
=AddCrc(req
,3);
115 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1000)) {
116 recv
= resp
.d
.asBytes
;
117 if (resp
.arg
[0]>=12 && ISO15_CRC_CHECK
==Crc(recv
,12)) {
118 memcpy(buf
,&recv
[2],8);
128 // get a product description based on the UID
130 // returns description of the best match
131 static char* getTagInfo(uint8_t *uid
) {
134 memcpy(&myuid
,uid
,sizeof(uint64_t));
135 while (uidmapping
[i
].mask
>0) {
136 mask
=(~0LL) <<(64-uidmapping
[i
].mask
);
137 if ((myuid
& mask
) == uidmapping
[i
].uid
) {
141 if (uidmapping
[i
].mask
>uidmapping
[best
].mask
) {
149 if (best
>=0) return uidmapping
[best
].desc
;
151 return uidmapping
[i
].desc
;
155 // return a clear-text message to an errorcode
156 static char* TagErrorStr(uint8_t error
) {
158 case 0x01: return "The command is not supported";
159 case 0x02: return "The command is not recognised";
160 case 0x03: return "The option is not supported.";
161 case 0x0f: return "Unknown error.";
162 case 0x10: return "The specified block is not available (doesn’t exist).";
163 case 0x11: return "The specified block is already -locked and thus cannot be locked again";
164 case 0x12: return "The specified block is locked and its content cannot be changed.";
165 case 0x13: return "The specified block was not successfully programmed.";
166 case 0x14: return "The specified block was not successfully locked.";
167 default: return "Reserved for Future Use or Custom command error.";
173 int CmdHF15Demod(const char *Cmd
)
175 // The sampling rate is 106.353 ksps/s, for T = 18.8 us
178 int max
= 0, maxPos
= 0;
182 if (GraphTraceLen
< 1000) return 0;
184 // First, correlate for SOF
185 for (i
= 0; i
< 100; i
++) {
187 for (j
= 0; j
< arraylen(FrameSOF
); j
+= skip
) {
188 corr
+= FrameSOF
[j
] * GraphBuffer
[i
+ (j
/ skip
)];
195 PrintAndLog("SOF at %d, correlation %d", maxPos
,
196 max
/ (arraylen(FrameSOF
) / skip
));
198 i
= maxPos
+ arraylen(FrameSOF
) / skip
;
201 memset(outBuf
, 0, sizeof(outBuf
));
204 int corr0
= 0, corr1
= 0, corrEOF
= 0;
205 for (j
= 0; j
< arraylen(Logic0
); j
+= skip
) {
206 corr0
+= Logic0
[j
] * GraphBuffer
[i
+ (j
/ skip
)];
208 for (j
= 0; j
< arraylen(Logic1
); j
+= skip
) {
209 corr1
+= Logic1
[j
] * GraphBuffer
[i
+ (j
/ skip
)];
211 for (j
= 0; j
< arraylen(FrameEOF
); j
+= skip
) {
212 corrEOF
+= FrameEOF
[j
] * GraphBuffer
[i
+ (j
/ skip
)];
214 // Even things out by the length of the target waveform.
218 if (corrEOF
> corr1
&& corrEOF
> corr0
) {
219 PrintAndLog("EOF at %d", i
);
221 } else if (corr1
> corr0
) {
222 i
+= arraylen(Logic1
) / skip
;
225 i
+= arraylen(Logic0
) / skip
;
232 if ((i
+ (int)arraylen(FrameEOF
)) >= GraphTraceLen
) {
233 PrintAndLog("ran off end!");
238 PrintAndLog("error, uneven octet! (discard extra bits!)");
239 PrintAndLog(" mask=%02x", mask
);
241 PrintAndLog("%d octets", k
);
243 for (i
= 0; i
< k
; i
++) {
244 PrintAndLog("# %2d: %02x ", i
, outBuf
[i
]);
246 PrintAndLog("CRC=%04x", Iso15693Crc(outBuf
, k
- 2));
252 // * Acquire Samples as Reader (enables carrier, sends inquiry)
253 int CmdHF15Read(const char *Cmd
)
255 UsbCommand c
= {CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_15693
};
260 // Record Activity without enabeling carrier
261 int CmdHF15Record(const char *Cmd
)
263 UsbCommand c
= {CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693
};
268 int CmdHF15Reader(const char *Cmd
)
270 UsbCommand c
= {CMD_READER_ISO_15693
, {strtol(Cmd
, NULL
, 0), 0, 0}};
275 // Simulation is still not working very good
276 int CmdHF15Sim(const char *Cmd
)
278 UsbCommand c
= {CMD_SIMTAG_ISO_15693
, {strtol(Cmd
, NULL
, 0), 0, 0}};
283 // finds the AFI (Application Family Idendifier) of a card, by trying all values
284 // (There is no standard way of reading the AFI, allthough some tags support this)
285 int CmdHF15Afi(const char *Cmd
)
287 UsbCommand c
= {CMD_ISO_15693_FIND_AFI
, {strtol(Cmd
, NULL
, 0), 0, 0}};
292 // Reads all memory pages
293 int CmdHF15DumpMem(const char*Cmd
) {
297 UsbCommand c
= {CMD_ISO_15693_COMMAND
, {0, 1, 1}}; // len,speed,recv?
298 uint8_t *req
=c
.d
.asBytes
;
304 PrintAndLog("No Tag found.");
308 PrintAndLog("Reading memory from tag UID=%s",sprintUID(NULL
,uid
));
309 PrintAndLog("Tag Info: %s",getTagInfo(uid
));
311 for (int retry
=0; retry
<5; retry
++) {
313 req
[0]= ISO15_REQ_SUBCARRIER_SINGLE
| ISO15_REQ_DATARATE_HIGH
|
314 ISO15_REQ_NONINVENTORY
| ISO15_REQ_ADDRESS
;
315 req
[1]=ISO15_CMD_READ
;
316 memcpy(&req
[2],uid
,8);
318 reqlen
=AddCrc(req
,11);
323 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1000)) {
324 recv
= resp
.d
.asBytes
;
325 if (ISO15_CRC_CHECK
==Crc(recv
,resp
.arg
[0])) {
326 if (!(recv
[0] & ISO15_RES_ERROR
)) {
328 *output
=0; // reset outputstring
329 sprintf(output
, "Block %2i ",blocknum
);
330 for ( int i
=1; i
<resp
.arg
[0]-2; i
++) { // data in hex
331 sprintf(output
+strlen(output
),"%02hX ",recv
[i
]);
334 for ( int i
=1; i
<resp
.arg
[0]-2; i
++) { // data in cleaned ascii
335 sprintf(output
+strlen(output
),"%c",(recv
[i
]>31 && recv
[i
]<127)?recv
[i
]:'.');
337 PrintAndLog("%s",output
);
339 // PrintAndLog("bn=%i",blocknum);
341 PrintAndLog("Tag returned Error %i: %s",recv
[1],TagErrorStr(recv
[1]));
344 } // else PrintAndLog("crc");
345 } // else PrintAndLog("r null");
348 // if (resp.arg[0]<3)
349 // PrintAndLog("Lost Connection");
350 // else if (ISO15_CRC_CHECK!=Crc(resp.d.asBytes,resp.arg[0]))
351 // PrintAndLog("CRC Failed");
353 // PrintAndLog("Tag returned Error %i: %s",recv[1],TagErrorStr(recv[1]));
360 static command_t CommandTable15
[] =
362 {"help", CmdHF15Help
, 1, "This help"},
363 {"demod", CmdHF15Demod
, 1, "Demodulate ISO15693 from tag"},
364 {"read", CmdHF15Read
, 0, "Read HF tag (ISO 15693)"},
365 {"record", CmdHF15Record
, 0, "Record Samples (ISO 15693)"}, // atrox
366 {"reader", CmdHF15Reader
, 0, "Act like an ISO15693 reader"},
367 {"sim", CmdHF15Sim
, 0, "Fake an ISO15693 tag"},
368 {"cmd", CmdHF15Cmd
, 0, "Send direct commands to ISO15693 tag"},
369 {"findafi", CmdHF15Afi
, 0, "Brute force AFI of an ISO15693 tag"},
370 {"dumpmemory", CmdHF15DumpMem
, 0, "Read all memory pages of an ISO15693 tag"},
371 {NULL
, NULL
, 0, NULL
}
374 int CmdHF15(const char *Cmd
)
376 CmdsParse(CommandTable15
, Cmd
);
380 int CmdHF15Help(const char *Cmd
)
382 CmdsHelp(CommandTable15
);
387 // "HF 15 Cmd" Interface
388 // Allows direct communication with the tag on command level
390 int CmdHF15CmdInquiry(const char *Cmd
)
394 UsbCommand c
= {CMD_ISO_15693_COMMAND
, {0, 1, 1}}; // len,speed,recv?
395 uint8_t *req
=c
.d
.asBytes
;
398 req
[0]= ISO15_REQ_SUBCARRIER_SINGLE
| ISO15_REQ_DATARATE_HIGH
|
399 ISO15_REQ_INVENTORY
| ISO15_REQINV_SLOT1
;
400 req
[1]=ISO15_CMD_INVENTORY
;
401 req
[2]=0; // mask length
402 reqlen
=AddCrc(req
,3);
407 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1000)) {
408 if (resp
.arg
[0]>=12) {
409 recv
= resp
.d
.asBytes
;
410 PrintAndLog("UID=%s",sprintUID(NULL
,&recv
[2]));
411 PrintAndLog("Tag Info: %s",getTagInfo(&recv
[2]));
413 PrintAndLog("Response to short, just %i bytes. No tag?\n",resp
.arg
[0]);
416 PrintAndLog("timeout.");
422 // Turns debugging on(1)/off(0)
423 int CmdHF15CmdDebug( const char *cmd
) {
426 PrintAndLog("Usage: hf 15 cmd debug <0/1>");
427 PrintAndLog(" 0..no debugging output 1..turn debugging on");
431 UsbCommand c
= {CMD_ISO_15693_DEBUG
, {debug
, 0, 0}};
437 int CmdHF15CmdRaw (const char *cmd
) {
440 UsbCommand c
= {CMD_ISO_15693_COMMAND
, {0, 1, 1}}; // len,speed,recv?
447 unsigned int datalen
=0, temp
;
452 PrintAndLog("Usage: hf 15 cmd raw [-r] [-2] [-c] <0A 0B 0C ... hex>");
453 PrintAndLog(" -r do not read response");
454 PrintAndLog(" -2 use slower '1 out of 256' mode");
455 PrintAndLog(" -c calculate and append CRC");
456 PrintAndLog(" Tip: turn on debugging for verbose output");
461 while (*cmd
==' ' || *cmd
=='\t') cmd
++;
463 while (cmd
[i
]!='\0') {
464 if (cmd
[i
]==' ' || cmd
[i
]=='\t') { i
++; continue; }
479 PrintAndLog("Invalid option");
485 if ((cmd
[i
]>='0' && cmd
[i
]<='9') ||
486 (cmd
[i
]>='a' && cmd
[i
]<='f') ||
487 (cmd
[i
]>='A' && cmd
[i
]<='F') ) {
488 buf
[strlen(buf
)+1]=0;
489 buf
[strlen(buf
)]=cmd
[i
];
492 if (strlen(buf
)>=2) {
493 sscanf(buf
,"%x",&temp
);
494 data
[datalen
]=(uint8_t)(temp
& 0xff);
500 PrintAndLog("Invalid char on input");
503 if (crc
) datalen
=AddCrc(data
,datalen
);
508 memcpy(c
.d
.asBytes
,data
,datalen
);
513 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1000)) {
514 recv
= resp
.d
.asBytes
;
515 PrintAndLog("received %i octets",resp
.arg
[0]);
516 hexout
= (char *)malloc(resp
.arg
[0] * 3 + 1);
517 if (hexout
!= NULL
) {
518 for (int i
= 0; i
< resp
.arg
[0]; i
++) { // data in hex
519 sprintf(&hexout
[i
* 3], "%02hX ", recv
[i
]);
521 PrintAndLog("%s", hexout
);
525 PrintAndLog("timeout while waiting for reply.");
534 * parses common HF 15 CMD parameters and prepares some data structures
538 int prepareHF15Cmd(char **cmd
, UsbCommand
*c
, uint8_t iso15cmd
[], int iso15cmdlen
) {
540 uint8_t *req
=c
->d
.asBytes
, uid
[8];
544 while (**cmd
==' ' || **cmd
=='\t') (*cmd
)++;
546 if (strstr(*cmd
,"-2")==*cmd
) {
547 c
->arg
[1]=0; // use 1of256
552 while (**cmd
==' ' || **cmd
=='\t') (*cmd
)++;
554 if (strstr(*cmd
,"-o")==*cmd
) {
555 req
[reqlen
]=ISO15_REQ_OPTION
;
560 while (**cmd
==' ' || **cmd
=='\t') (*cmd
)++;
564 PrintAndLog("missing addr");
569 // you must have selected the tag earlier
570 req
[reqlen
++]|= ISO15_REQ_SUBCARRIER_SINGLE
| ISO15_REQ_DATARATE_HIGH
|
571 ISO15_REQ_NONINVENTORY
| ISO15_REQ_SELECT
;
572 memcpy(&req
[reqlen
],&iso15cmd
[0],iso15cmdlen
);
577 // unaddressed mode may not be supported by all vendors
578 req
[reqlen
++]|= ISO15_REQ_SUBCARRIER_SINGLE
| ISO15_REQ_DATARATE_HIGH
|
579 ISO15_REQ_NONINVENTORY
;
580 memcpy(&req
[reqlen
],&iso15cmd
[0],iso15cmdlen
);
584 // we scan for the UID ourself
585 req
[reqlen
++]|= ISO15_REQ_SUBCARRIER_SINGLE
| ISO15_REQ_DATARATE_HIGH
|
586 ISO15_REQ_NONINVENTORY
| ISO15_REQ_ADDRESS
;
587 memcpy(&req
[reqlen
],&iso15cmd
[0],iso15cmdlen
);
590 PrintAndLog("No Tag found");
593 memcpy(req
+reqlen
,uid
,8);
594 PrintAndLog("Detected UID %s",sprintUID(NULL
,uid
));
598 req
[reqlen
++]|= ISO15_REQ_SUBCARRIER_SINGLE
| ISO15_REQ_DATARATE_HIGH
|
599 ISO15_REQ_NONINVENTORY
| ISO15_REQ_ADDRESS
;
600 memcpy(&req
[reqlen
],&iso15cmd
[0],iso15cmdlen
);
603 /* sscanf(cmd,"%hX%hX%hX%hX%hX%hX%hX%hX",
604 (short unsigned int *)&uid[7],(short unsigned int *)&uid[6],
605 (short unsigned int *)&uid[5],(short unsigned int *)&uid[4],
606 (short unsigned int *)&uid[3],(short unsigned int *)&uid[2],
607 (short unsigned int *)&uid[1],(short unsigned int *)&uid[0]); */
608 for (int i
=0;i
<8 && (*cmd
)[i
*2] && (*cmd
)[i
*2+1];i
++) { // parse UID
609 sscanf((char[]){(*cmd
)[i
*2],(*cmd
)[i
*2+1],0},"%X",&temp
);
613 PrintAndLog("Using UID %s",sprintUID(NULL
,uid
));
614 memcpy(&req
[reqlen
],&uid
[0],8);
617 // skip to next space
618 while (**cmd
!=' ' && **cmd
!='\t') (*cmd
)++;
619 // skip over the space
620 while (**cmd
==' ' || **cmd
=='\t') (*cmd
)++;
627 * Commandline handling: HF15 CMD SYSINFO
628 * get system information from tag/VICC
630 int CmdHF15CmdSysinfo(const char *Cmd
) {
633 UsbCommand c
= {CMD_ISO_15693_COMMAND
, {0, 1, 1}}; // len,speed,recv?
634 uint8_t *req
=c
.d
.asBytes
;
638 char output
[2048]="";
645 PrintAndLog("Usage: hf 15 cmd sysinfo [options] <uid|s|u|*>");
646 PrintAndLog(" options:");
647 PrintAndLog(" -2 use slower '1 out of 256' mode");
648 PrintAndLog(" uid (either): ");
649 PrintAndLog(" <8B hex> full UID eg E011223344556677");
650 PrintAndLog(" s selected tag");
651 PrintAndLog(" u unaddressed mode");
652 PrintAndLog(" * scan for tag");
653 PrintAndLog(" start#: page number to start 0-255");
654 PrintAndLog(" count#: number of pages");
658 prepareHF15Cmd(&cmd
, &c
,(uint8_t[]){ISO15_CMD_SYSINFO
},1);
661 reqlen
=AddCrc(req
,reqlen
);
666 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1000) && resp
.arg
[0]>2) {
667 recv
= resp
.d
.asBytes
;
668 if (ISO15_CRC_CHECK
==Crc(recv
,resp
.arg
[0])) {
669 if (!(recv
[0] & ISO15_RES_ERROR
)) {
670 *output
=0; // reset outputstring
671 for ( i
=1; i
<resp
.arg
[0]-2; i
++) {
672 sprintf(output
+strlen(output
),"%02hX ",recv
[i
]);
674 strcat(output
,"\n\r");
675 strcat(output
,"UID = ");
676 strcat(output
,sprintUID(NULL
,recv
+2));
677 strcat(output
,"\n\r");
678 strcat(output
,getTagInfo(recv
+2)); //ABC
679 strcat(output
,"\n\r");
682 sprintf(output
+strlen(output
),"DSFID supported, set to %02hX\n\r",recv
[i
++]);
684 strcat(output
,"DSFID not supported\n\r");
686 sprintf(output
+strlen(output
),"AFI supported, set to %03hX\n\r",recv
[i
++]);
688 strcat(output
,"AFI not supported\n\r");
689 if (recv
[1] & 0x04) {
690 strcat(output
,"Tag provides info on memory layout (vendor dependent)\n\r");
691 sprintf(output
+strlen(output
)," %i (or %i) bytes/page x %i pages \n\r",
692 (recv
[i
+1]&0x1F)+1, (recv
[i
+1]&0x1F), recv
[i
]+1);
695 strcat(output
,"Tag does not provide information on memory layout\n\r");
696 if (recv
[1] & 0x08) sprintf(output
+strlen(output
),"IC reference given: %02hX\n\r",recv
[i
++]);
697 else strcat(output
,"IC reference not given\n\r");
700 PrintAndLog("%s",output
);
702 PrintAndLog("Tag returned Error %i: %s",recv
[0],TagErrorStr(recv
[0]));
705 PrintAndLog("CRC failed");
708 PrintAndLog("timeout: no answer");
715 * Commandline handling: HF15 CMD READMULTI
716 * Read multiple blocks at once (not all tags support this)
718 int CmdHF15CmdReadmulti(const char *Cmd
) {
721 UsbCommand c
= {CMD_ISO_15693_COMMAND
, {0, 1, 1}}; // len,speed,recv?
722 uint8_t *req
=c
.d
.asBytes
;
723 int reqlen
=0, pagenum
,pagecount
;
726 char output
[2048]="";
732 PrintAndLog("Usage: hf 15 cmd readmulti [options] <uid|s|u|*> <start#> <count#>");
733 PrintAndLog(" options:");
734 PrintAndLog(" -2 use slower '1 out of 256' mode");
735 PrintAndLog(" uid (either): ");
736 PrintAndLog(" <8B hex> full UID eg E011223344556677");
737 PrintAndLog(" s selected tag");
738 PrintAndLog(" u unaddressed mode");
739 PrintAndLog(" * scan for tag");
740 PrintAndLog(" start#: page number to start 0-255");
741 PrintAndLog(" count#: number of pages");
745 prepareHF15Cmd(&cmd
, &c
,(uint8_t[]){ISO15_CMD_READMULTI
},1);
748 pagenum
=strtol(cmd
,NULL
,0);
750 // skip to next space
751 while (*cmd
!=' ' && *cmd
!='\t') cmd
++;
752 // skip over the space
753 while (*cmd
==' ' || *cmd
=='\t') cmd
++;
755 pagecount
=strtol(cmd
,NULL
,0);
756 if (pagecount
>0) pagecount
--; // 0 means 1 page, 1 means 2 pages, ...
758 req
[reqlen
++]=(uint8_t)pagenum
;
759 req
[reqlen
++]=(uint8_t)pagecount
;
761 reqlen
=AddCrc(req
,reqlen
);
767 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1000) && resp
.arg
[0]>2) {
768 recv
= resp
.d
.asBytes
;
769 if (ISO15_CRC_CHECK
==Crc(recv
,resp
.arg
[0])) {
770 if (!(recv
[0] & ISO15_RES_ERROR
)) {
771 *output
=0; // reset outputstring
772 for ( int i
=1; i
<resp
.arg
[0]-2; i
++) {
773 sprintf(output
+strlen(output
),"%02hX ",recv
[i
]);
776 for ( int i
=1; i
<resp
.arg
[0]-2; i
++) {
777 sprintf(output
+strlen(output
),"%c",recv
[i
]>31 && recv
[i
]<127?recv
[i
]:'.');
779 PrintAndLog("%s",output
);
781 PrintAndLog("Tag returned Error %i: %s",recv
[0],TagErrorStr(recv
[0]));
784 PrintAndLog("CRC failed");
787 PrintAndLog("no answer");
794 * Commandline handling: HF15 CMD READ
795 * Reads a single Block
797 int CmdHF15CmdRead(const char *Cmd
) {
800 UsbCommand c
= {CMD_ISO_15693_COMMAND
, {0, 1, 1}}; // len,speed,recv?
801 uint8_t *req
=c
.d
.asBytes
;
802 int reqlen
=0, pagenum
;
811 PrintAndLog("Usage: hf 15 cmd read [options] <uid|s|u|*> <page#>");
812 PrintAndLog(" options:");
813 PrintAndLog(" -2 use slower '1 out of 256' mode");
814 PrintAndLog(" uid (either): ");
815 PrintAndLog(" <8B hex> full UID eg E011223344556677");
816 PrintAndLog(" s selected tag");
817 PrintAndLog(" u unaddressed mode");
818 PrintAndLog(" * scan for tag");
819 PrintAndLog(" page#: page number 0-255");
823 prepareHF15Cmd(&cmd
, &c
,(uint8_t[]){ISO15_CMD_READ
},1);
826 pagenum
=strtol(cmd
,NULL
,0);
828 PrintAndLog("invalid pagenum");
832 req
[reqlen
++]=(uint8_t)pagenum
;
834 reqlen
=AddCrc(req
,reqlen
);
840 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1000) && resp
.arg
[0]>2) {
841 recv
= resp
.d
.asBytes
;
842 if (ISO15_CRC_CHECK
==Crc(recv
,resp
.arg
[0])) {
843 if (!(recv
[0] & ISO15_RES_ERROR
)) {
844 *output
=0; // reset outputstring
845 //sprintf(output, "Block %2i ",blocknum);
846 for ( int i
=1; i
<resp
.arg
[0]-2; i
++) {
847 sprintf(output
+strlen(output
),"%02hX ",recv
[i
]);
850 for ( int i
=1; i
<resp
.arg
[0]-2; i
++) {
851 sprintf(output
+strlen(output
),"%c",recv
[i
]>31 && recv
[i
]<127?recv
[i
]:'.');
853 PrintAndLog("%s",output
);
855 PrintAndLog("Tag returned Error %i: %s",recv
[1],TagErrorStr(recv
[1]));
858 PrintAndLog("CRC failed");
861 PrintAndLog("no answer");
869 * Commandline handling: HF15 CMD WRITE
870 * Writes a single Block - might run into timeout, even when successful
872 int CmdHF15CmdWrite(const char *Cmd
) {
875 UsbCommand c
= {CMD_ISO_15693_COMMAND
, {0, 1, 1}}; // len,speed,recv?
876 uint8_t *req
=c
.d
.asBytes
;
877 int reqlen
=0, pagenum
, temp
;
886 PrintAndLog("Usage: hf 15 cmd write [options] <uid|s|u|*> <page#> <hexdata>");
887 PrintAndLog(" options:");
888 PrintAndLog(" -2 use slower '1 out of 256' mode");
889 PrintAndLog(" -o set OPTION Flag (needed for TI)");
890 PrintAndLog(" uid (either): ");
891 PrintAndLog(" <8B hex> full UID eg E011223344556677");
892 PrintAndLog(" s selected tag");
893 PrintAndLog(" u unaddressed mode");
894 PrintAndLog(" * scan for tag");
895 PrintAndLog(" page#: page number 0-255");
896 PrintAndLog(" hexdata: data to be written eg AA BB CC DD");
900 prepareHF15Cmd(&cmd
, &c
,(uint8_t[]){ISO15_CMD_WRITE
},1);
903 // *cmd -> page num ; *cmd2 -> data
905 while (*cmd2
!=' ' && *cmd2
!='\t' && *cmd2
) cmd2
++;
909 pagenum
=strtol(cmd
,NULL
,0);
911 PrintAndLog("invalid pagenum");
914 req
[reqlen
++]=(uint8_t)pagenum
;
917 while (cmd2
[0] && cmd2
[1]) { // hexdata, read by 2 hexchars
922 sscanf((char[]){cmd2
[0],cmd2
[1],0},"%X",&temp
);
923 req
[reqlen
++]=temp
& 0xff;
927 reqlen
=AddCrc(req
,reqlen
);
933 if (WaitForResponseTimeout(CMD_ACK
,&resp
,2000) && resp
.arg
[0]>2) {
934 recv
= resp
.d
.asBytes
;
935 if (ISO15_CRC_CHECK
==Crc(recv
,resp
.arg
[0])) {
936 if (!(recv
[0] & ISO15_RES_ERROR
)) {
939 PrintAndLog("Tag returned Error %i: %s",recv
[1],TagErrorStr(recv
[1]));
942 PrintAndLog("CRC failed");
945 PrintAndLog("timeout: no answer - data may be written anyway");
953 static command_t CommandTable15Cmd
[] =
955 {"help", CmdHF15CmdHelp
, 1, "This Help"},
956 {"inquiry", CmdHF15CmdInquiry
, 0, "Search for tags in range"},
958 {"select", CmdHF15CmdSelect, 0, "Select an tag with a specific UID for further commands"},
960 {"read", CmdHF15CmdRead
, 0, "Read a block"},
961 {"write", CmdHF15CmdWrite
, 0, "Write a block"},
962 {"readmulti",CmdHF15CmdReadmulti
, 0, "Reads multiple Blocks"},
963 {"sysinfo",CmdHF15CmdSysinfo
, 0, "Get Card Information"},
964 {"raw", CmdHF15CmdRaw
, 0, "Send raw hex data to tag"},
965 {"debug", CmdHF15CmdDebug
, 0, "Turn debugging on/off"},
966 {NULL
, NULL
, 0, NULL
}
969 int CmdHF15Cmd(const char *Cmd
)
971 CmdsParse(CommandTable15Cmd
, Cmd
);
975 int CmdHF15CmdHelp(const char *Cmd
)
977 CmdsHelp(CommandTable15Cmd
);