1 //-----------------------------------------------------------------------------
3 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
8 //-----------------------------------------------------------------------------
9 // High frequency ISO14443A commands
10 //-----------------------------------------------------------------------------
17 #include "iso14443crc.h"
19 //#include "proxusb.h"
20 #include "proxmark3.h"
22 #include "cmdparser.h"
28 static int CmdHelp(const char *Cmd
);
30 int CmdHF14AList(const char *Cmd
)
33 GetFromBigBuf(got
,sizeof(got
),0);
34 WaitForResponse(CMD_ACK
,NULL
);
36 PrintAndLog("recorded activity:");
37 PrintAndLog(" ETU :rssi: who bytes");
38 PrintAndLog("---------+----+----+-----------");
49 int timestamp
= *((uint32_t *)(got
+i
));
50 if (timestamp
& 0x80000000) {
51 timestamp
&= 0x7fffffff;
58 int parityBits
= *((uint32_t *)(got
+i
+4));
59 // 4 bytes of additional information...
60 // maximum of 32 additional parity bit information
63 // at each quarter bit period we can send power level (16 levels)
64 // or each half bit period in 256 levels.
72 if (i
+ len
>= 1900) {
76 uint8_t *frame
= (got
+i
+9);
78 // Break and stick with current result if buffer was not completely full
79 if (frame
[0] == 0x44 && frame
[1] == 0x44 && frame
[3] == 0x44) { break; }
83 for (j
= 0; j
< len
; j
++) {
88 oddparity
^= (((frame
[j
] & 0xFF) >> k
) & 0x01);
91 //if((parityBits >> (len - j - 1)) & 0x01) {
92 if (isResponse
&& (oddparity
!= ((parityBits
>> (len
- j
- 1)) & 0x01))) {
93 sprintf(line
+(j
*4), "%02x! ", frame
[j
]);
96 sprintf(line
+(j
*4), "%02x ", frame
[j
]);
104 for (j
= 0; j
< (len
- 1); j
++) {
105 // gives problems... search for the reason..
106 /*if(frame[j] == 0xAA) {
109 crc = "[1] Two drops close after each other";
112 crc = "[2] Potential SOC with a drop in second half of bitperiod";
115 crc = "[3] Segment Z after segment X is not possible";
118 crc = "[4] Parity bit of a fully received byte was wrong";
121 crc = "[?] Unknown error";
128 if (strlen(crc
)==0) {
129 ComputeCrc14443(CRC_14443_A
, frame
, len
-2, &b1
, &b2
);
130 if (b1
!= frame
[len
-2] || b2
!= frame
[len
-1]) {
131 crc
= (isResponse
& (len
< 6)) ? "" : " !crc";
140 char metricString
[100];
142 sprintf(metricString
, "%3d", metric
);
144 strcpy(metricString
, " ");
147 PrintAndLog(" +%7d: %s: %s %s %s",
148 (prev
< 0 ? 0 : (timestamp
- prev
)),
150 (isResponse
? "TAG" : " "), line
, crc
);
158 void iso14a_set_timeout(uint32_t timeout
) {
159 UsbCommand c
= {CMD_READER_ISO_14443a
, {ISO14A_SET_TIMEOUT
, 0, timeout
}};
163 int CmdHF14AReader(const char *Cmd
)
165 UsbCommand c
= {CMD_READER_ISO_14443a
, {ISO14A_CONNECT
, 0, 0}};
169 WaitForResponse(CMD_ACK
,&resp
);
171 iso14a_card_select_t
*card
= (iso14a_card_select_t
*)resp
.d
.asBytes
;
173 if(resp
.arg
[0] == 0) {
174 PrintAndLog("iso14443a card select failed");
178 PrintAndLog("ATQA : %02x %02x", card
->atqa
[0], card
->atqa
[1]);
179 PrintAndLog(" UID : %s", sprint_hex(card
->uid
, card
->uidlen
));
180 PrintAndLog(" SAK : %02x [%d]", card
->sak
, resp
.arg
[0]);
183 case 0x00: PrintAndLog("TYPE : NXP MIFARE Ultralight | Ultralight C"); break;
184 case 0x04: PrintAndLog("TYPE : NXP MIFARE (various !DESFire !DESFire EV1)"); break;
186 case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k"); break;
187 case 0x09: PrintAndLog("TYPE : NXP MIFARE Mini 0.3k"); break;
188 case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k"); break;
189 case 0x11: PrintAndLog("TYPE : NXP MIFARE Plus 4k"); break;
190 case 0x18: PrintAndLog("TYPE : NXP MIFARE Classic 4k | Plus 4k"); break;
191 case 0x20: PrintAndLog("TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k | JCOP 31/41"); break;
192 case 0x24: PrintAndLog("TYPE : NXP MIFARE DESFire | DESFire EV1"); break;
193 case 0x28: PrintAndLog("TYPE : JCOP31 or JCOP41 v2.3.1"); break;
194 case 0x38: PrintAndLog("TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K"); break;
195 case 0x88: PrintAndLog("TYPE : Infineon MIFARE CLASSIC 1K"); break;
196 case 0x98: PrintAndLog("TYPE : Gemplus MPCOS"); break;
199 if(resp
.arg
[0] == 1) {
200 bool ta1
= 0, tb1
= 0, tc1
= 0;
203 PrintAndLog(" ATS : %s", sprint_hex(card
->ats
, card
->ats_len
));
204 if (card
->ats_len
> 0) {
205 PrintAndLog(" - TL : length is %d bytes", card
->ats
[0]);
207 if (card
->ats_len
> 1) {
208 ta1
= (card
->ats
[1] & 0x10) == 0x10;
209 tb1
= (card
->ats
[1] & 0x20) == 0x20;
210 tc1
= (card
->ats
[1] & 0x40) == 0x40;
211 PrintAndLog(" - T0 : TA1 is%s present, TB1 is%s present, "
212 "TC1 is%s present, FSCI is %d",
213 (ta1
? "" : " NOT"), (tb1
? "" : " NOT"), (tc1
? "" : " NOT"),
214 (card
->ats
[1] & 0x0f));
217 if (ta1
&& card
->ats_len
> pos
) {
219 dr
[0] = ds
[0] = '\0';
220 if (card
->ats
[pos
] & 0x10) strcat(ds
, "2, ");
221 if (card
->ats
[pos
] & 0x20) strcat(ds
, "4, ");
222 if (card
->ats
[pos
] & 0x40) strcat(ds
, "8, ");
223 if (card
->ats
[pos
] & 0x01) strcat(dr
, "2, ");
224 if (card
->ats
[pos
] & 0x02) strcat(dr
, "4, ");
225 if (card
->ats
[pos
] & 0x04) strcat(dr
, "8, ");
226 if (strlen(ds
) != 0) ds
[strlen(ds
) - 2] = '\0';
227 if (strlen(dr
) != 0) dr
[strlen(dr
) - 2] = '\0';
228 PrintAndLog(" - TA1 : different divisors are%s supported, "
229 "DR: [%s], DS: [%s]",
230 (card
->ats
[pos
] & 0x80 ? " NOT" : ""), dr
, ds
);
233 if (tb1
&& card
->ats_len
> pos
) {
234 PrintAndLog(" - TB1 : SFGI = %d, FWI = %d",
235 (card
->ats
[pos
] & 0x08),
236 (card
->ats
[pos
] & 0x80) >> 4);
239 if (tc1
&& card
->ats_len
> pos
) {
240 PrintAndLog(" - TC1 : NAD is%s supported, CID is%s supported",
241 (card
->ats
[pos
] & 0x01) ? "" : " NOT",
242 (card
->ats
[pos
] & 0x02) ? "" : " NOT");
245 if (card
->ats_len
> pos
) {
247 if (card
->ats_len
- pos
> 7) {
248 if (memcmp(card
->ats
+ pos
, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) {
249 tip
= "-> MIFARE Plus X 2K or 4K";
250 } else if (memcmp(card
->ats
+ pos
, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) {
251 tip
= "-> MIFARE Plus S 2K or 4K";
254 PrintAndLog(" - HB : %s%s", sprint_hex(card
->ats
+ pos
, card
->ats_len
- pos
- 2), tip
);
255 if (card
->ats
[pos
] == 0xC1) {
256 PrintAndLog(" c1 -> Mifare or (multiple) virtual cards of various type");
257 PrintAndLog(" %02x -> Length is %d bytes",
258 card
->ats
[pos
+ 1], card
->ats
[pos
+ 1]);
259 switch (card
->ats
[pos
+ 2] & 0xf0) {
261 PrintAndLog(" 1x -> MIFARE DESFire");
264 PrintAndLog(" 2x -> MIFARE Plus");
267 switch (card
->ats
[pos
+ 2] & 0x0f) {
269 PrintAndLog(" x0 -> <1 kByte");
272 PrintAndLog(" x0 -> 1 kByte");
275 PrintAndLog(" x0 -> 2 kByte");
278 PrintAndLog(" x0 -> 4 kByte");
281 PrintAndLog(" x0 -> 8 kByte");
284 switch (card
->ats
[pos
+ 3] & 0xf0) {
286 PrintAndLog(" 0x -> Engineering sample");
289 PrintAndLog(" 2x -> Released");
292 switch (card
->ats
[pos
+ 3] & 0x0f) {
294 PrintAndLog(" x0 -> Generation 1");
297 PrintAndLog(" x1 -> Generation 2");
300 PrintAndLog(" x2 -> Generation 3");
303 switch (card
->ats
[pos
+ 4] & 0x0f) {
305 PrintAndLog(" x0 -> Only VCSL supported");
308 PrintAndLog(" x1 -> VCS, VCSL, and SVC supported");
311 PrintAndLog(" xE -> no VCS command supported");
317 PrintAndLog("proprietary non iso14443a-4 card found, RATS not supported");
323 // Collect ISO14443 Type A UIDs
324 int CmdHF14ACUIDs(const char *Cmd
)
326 // requested number of UIDs
328 // collect at least 1 (e.g. if no parameter was given)
331 PrintAndLog("Collecting %d UIDs", n
);
332 PrintAndLog("Start: %u", time(NULL
));
334 for (int i
= 0; i
< n
; i
++) {
335 // execute anticollision procedure
336 UsbCommand c
= {CMD_READER_ISO_14443a
, {ISO14A_CONNECT
, 0, 0}};
340 WaitForResponse(CMD_ACK
,&resp
);
342 uint8_t *uid
= resp
.d
.asBytes
;
343 iso14a_card_select_t
*card
= (iso14a_card_select_t
*)(uid
+ 12);
345 // check if command failed
346 if (resp
.arg
[0] == 0) {
347 PrintAndLog("Card select failed.");
349 // check if UID is 4 bytes
350 if ((card
->atqa
[1] & 0xC0) == 0) {
351 PrintAndLog("%02X%02X%02X%02X",
352 *uid
, *(uid
+ 1), *(uid
+ 2), *(uid
+ 3));
354 PrintAndLog("UID longer than 4 bytes");
358 PrintAndLog("End: %u", time(NULL
));
363 // ## simulate iso14443a tag
364 // ## greg - added ability to specify tag UID
365 int CmdHF14ASim(const char *Cmd
)
367 UsbCommand c
= {CMD_SIMULATE_TAG_ISO_14443a
,{0,0,0}};
369 // Retrieve the tag type
370 uint8_t tagtype
= param_get8ex(Cmd
,0,0,10);
372 // When no argument was given, just print help message
375 PrintAndLog(" Emulating ISO/IEC 14443 type A tag with 4 or 7 byte UID");
377 PrintAndLog(" syntax: hf 14a sim <type> <uid>");
378 PrintAndLog(" types: 1 = MIFARE Classic");
379 PrintAndLog(" 2 = MIFARE Ultralight");
380 PrintAndLog(" 3 = MIFARE DESFIRE");
381 PrintAndLog(" 4 = ISO/IEC 14443-4");
386 // Store the tag type
389 // Retrieve the full 4 or 7 byte long uid
390 uint64_t long_uid
= param_get64ex(Cmd
,1,0,16);
392 // Are we handling the (optional) second part uid?
393 if (long_uid
> 0xffffffff) {
394 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 7 byte UID (%014llx)",long_uid
);
395 // Store the second part
396 c
.arg
[2] = (long_uid
& 0xffffffff);
398 // Store the first part, ignore the first byte, it is replaced by cascade byte (0x88)
399 c
.arg
[1] = (long_uid
& 0xffffff);
401 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 4 byte UID (%08x)",long_uid
);
402 // Only store the first part
403 c
.arg
[1] = long_uid
& 0xffffffff;
406 // At lease save the mandatory first part of the UID
407 c.arg[0] = long_uid & 0xffffffff;
410 // At lease save the mandatory first part of the UID
411 c.arg[0] = long_uid & 0xffffffff;
414 PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
419 PrintAndLog("Emulating ISO/IEC 14443-3 type A tag with 4 byte UID");
420 UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
423 PrintAndLog("Emulating ISO/IEC 14443-4 type A tag with 7 byte UID");
426 PrintAndLog("Error: unkown tag type (%d)",c.arg[0]);
427 PrintAndLog("syntax: hf 14a sim <uid>",c.arg[0]);
428 PrintAndLog(" type1: 4 ",c.arg[0]);
435 unsigned int hi = 0, lo = 0;
437 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
438 hi= (hi << 4) | (lo >> 28);
439 lo= (lo << 4) | (n & 0xf);
442 // UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
443 // PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
448 int CmdHF14ASnoop(const char *Cmd
) {
451 if (param_getchar(Cmd
, 0) == 'h') {
452 PrintAndLog("It get data from the field and saves it into command buffer.");
453 PrintAndLog("Buffer accessible from command hf 14a list.");
454 PrintAndLog("Usage: hf 14a snoop [c][r]");
455 PrintAndLog("c - triggered by first data from card");
456 PrintAndLog("r - triggered by first 7-bit request from reader (REQ,WUP,...)");
457 PrintAndLog("sample: hf 14a snoop c r");
461 for (int i
= 0; i
< 2; i
++) {
462 char ctmp
= param_getchar(Cmd
, i
);
463 if (ctmp
== 'c' || ctmp
== 'C') param
|= 0x01;
464 if (ctmp
== 'r' || ctmp
== 'R') param
|= 0x02;
467 UsbCommand c
= {CMD_SNOOP_ISO_14443a
, {param
, 0, 0}};
472 static command_t CommandTable
[] =
474 {"help", CmdHelp
, 1, "This help"},
475 {"list", CmdHF14AList
, 0, "List ISO 14443a history"},
476 {"reader", CmdHF14AReader
, 0, "Act like an ISO14443 Type A reader"},
477 {"cuids", CmdHF14ACUIDs
, 0, "<n> Collect n>0 ISO14443 Type A UIDs in one go"},
478 {"sim", CmdHF14ASim
, 0, "<UID> -- Fake ISO 14443a tag"},
479 {"snoop", CmdHF14ASnoop
, 0, "Eavesdrop ISO 14443 Type A"},
480 {NULL
, NULL
, 0, NULL
}
483 int CmdHF14A(const char *Cmd
) {
485 WaitForResponseTimeout(CMD_ACK
,NULL
,100);
488 CmdsParse(CommandTable
, Cmd
);
492 int CmdHelp(const char *Cmd
)
494 CmdsHelp(CommandTable
);