cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf14b.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // High frequency ISO14443B commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include "cmdhf14b.h"
  12
  13 #include <stdio.h>
  14 #include <stdlib.h>
  15 #include <stdbool.h>
  16 #include <string.h>
  17 #include <stdint.h>
  18 #include "iso14443crc.h"
  19 #include "comms.h"
  20 #include "graph.h"
  21 #include "util.h"
  22 #include "ui.h"
  23 #include "cmdparser.h"
  24 #include "cmdmain.h"
  25 #include "taginfo.h"
  26
  27
  28 static int CmdHelp(const char *Cmd);
  29
  30 int CmdHF14BList(const char *Cmd)
  31 {
  32         PrintAndLog("Deprecated command, use 'hf list 14b' instead");
  33
  34         return 0;
  35 }
  36
  37 int CmdHF14BSim(const char *Cmd)
  38 {
  39   UsbCommand c={CMD_SIMULATE_TAG_ISO_14443B};
  40   clearCommandBuffer();
  41   SendCommand(&c);
  42   return 0;
  43 }
  44
  45 int CmdHF14BSnoop(const char *Cmd)
  46 {
  47   UsbCommand c = {CMD_SNOOP_ISO_14443B};
  48   clearCommandBuffer();
  49   SendCommand(&c);
  50   return 0;
  51 }
  52
  53 /* New command to read the contents of a SRI512 tag
  54  * SRI512 tags are ISO14443-B modulated memory tags,
  55  * this command just dumps the contents of the memory
  56  */
  57 int CmdSri512Read(const char *Cmd)
  58 {
  59   UsbCommand c = {CMD_READ_SRI512_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
  60   clearCommandBuffer();
  61   SendCommand(&c);
  62   return 0;
  63 }
  64
  65 /* New command to read the contents of a SRIX4K tag
  66  * SRIX4K tags are ISO14443-B modulated memory tags,
  67  * this command just dumps the contents of the memory/
  68  */
  69 int CmdSrix4kRead(const char *Cmd)
  70 {
  71   UsbCommand c = {CMD_READ_SRIX4K_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
  72   clearCommandBuffer();
  73   SendCommand(&c);
  74   return 0;
  75 }
  76
  77 int rawClose(void){
  78         UsbCommand resp;
  79         UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}};
  80         clearCommandBuffer();
  81         SendCommand(&c);
  82         if (!WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
  83                 return 0;
  84         }
  85         return 0;
  86 }
  87
  88 int HF14BCmdRaw(bool reply, bool *crc, bool power, uint8_t *data, uint8_t *datalen, bool verbose){
  89         UsbCommand resp;
  90         UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; // len,recv,power
  91         if(*crc)
  92         {
  93                 uint8_t first, second;
  94                 ComputeCrc14443(CRC_14443_B, data, *datalen, &first, &second);
  95                 data[*datalen] = first;
  96                 data[*datalen + 1] = second;
  97                 *datalen += 2;
  98         }
  99
 100         c.arg[0] = *datalen;
 101         c.arg[1] = reply;
 102         c.arg[2] = power;
 103         memcpy(c.d.asBytes,data,*datalen);
 104         clearCommandBuffer();
 105         SendCommand(&c);
 106
 107         if (!reply) return 1;
 108
 109         if (!WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
 110                 if (verbose) PrintAndLog("timeout while waiting for reply.");
 111                 return 0;
 112         }
 113         *datalen = resp.arg[0];
 114         if (verbose) PrintAndLog("received %u octets", *datalen);
 115         if(*datalen<2) return 0;
 116
 117         memcpy(data, resp.d.asBytes, *datalen);
 118         if (verbose) PrintAndLog("%s", sprint_hex(data, *datalen));
 119
 120         uint8_t first, second;
 121         ComputeCrc14443(CRC_14443_B, data, *datalen-2, &first, &second);
 122         if(data[*datalen-2] == first && data[*datalen-1] == second) {
 123                 if (verbose) PrintAndLog("CRC OK");
 124                 *crc = true;
 125         } else {
 126                 if (verbose) PrintAndLog("CRC failed");
 127                 *crc = false;
 128         }
 129         return 1;
 130 }
 131
 132 int CmdHF14BCmdRaw (const char *Cmd) {
 133         bool reply = true;
 134         bool crc = false;
 135         bool power = false;
 136         bool select = false;
 137         bool SRx = false;
 138         char buf[5] = "";
 139         uint8_t data[100] = {0x00};
 140         uint8_t datalen = 0;
 141         unsigned int temp;
 142         int i = 0;
 143         if (strlen(Cmd)<3) {
 144                         PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] [-s || -ss] <0A 0B 0C ... hex>");
 145                         PrintAndLog("       -r    do not read response");
 146                         PrintAndLog("       -c    calculate and append CRC");
 147                         PrintAndLog("       -p    leave the field on after receive");
 148                         PrintAndLog("       -s    active signal field ON with select");
 149                         PrintAndLog("       -ss   active signal field ON with select for SRx ST Microelectronics tags");
 150                         return 0;
 151         }
 152
 153         // strip
 154         while (*Cmd==' ' || *Cmd=='\t') Cmd++;
 155
 156         while (Cmd[i]!='\0') {
 157                 if (Cmd[i]==' ' || Cmd[i]=='\t') { i++; continue; }
 158                 if (Cmd[i]=='-') {
 159                         switch (Cmd[i+1]) {
 160                                 case 'r':
 161                                 case 'R':
 162                                         reply = false;
 163                                         break;
 164                                 case 'c':
 165                                 case 'C':
 166                                         crc = true;
 167                                         break;
 168                                 case 'p':
 169                                 case 'P':
 170                                         power = true;
 171                                         break;
 172                                 case 's':
 173                                 case 'S':
 174                                         select = true;
 175                                         if (Cmd[i+2]=='s' || Cmd[i+2]=='S') {
 176                                                 SRx = true;
 177                                                 i++;
 178                                         }
 179                                         break;
 180                                 default:
 181                                         PrintAndLog("Invalid option");
 182                                         return 0;
 183                         }
 184                         i+=2;
 185                         continue;
 186                 }
 187                 if ((Cmd[i]>='0' && Cmd[i]<='9') ||
 188                     (Cmd[i]>='a' && Cmd[i]<='f') ||
 189                     (Cmd[i]>='A' && Cmd[i]<='F') ) {
 190                         buf[strlen(buf)+1]=0;
 191                         buf[strlen(buf)]=Cmd[i];
 192                         i++;
 193
 194                         if (strlen(buf)>=2) {
 195                                 sscanf(buf,"%x",&temp);
 196                                 data[datalen++]=(uint8_t)(temp & 0xff);
 197                                 *buf=0;
 198                         }
 199                         continue;
 200                 }
 201                 PrintAndLog("Invalid char on input");
 202                 return 0;
 203         }
 204         if (datalen == 0)
 205         {
 206                 PrintAndLog("Missing data input");
 207                 return 0;
 208         }
 209
 210         if (select){ //auto select 14b tag
 211                 uint8_t cmd2[16];
 212                 bool crc2 = true;
 213                 uint8_t cmdLen;
 214
 215                 if (SRx) {
 216                         // REQ SRx
 217                         cmdLen = 2;
 218                         cmd2[0] = 0x06;
 219                         cmd2[1] = 0x00;
 220                 } else {
 221                         cmdLen = 3;
 222                         // REQB
 223                         cmd2[0] = 0x05;
 224                         cmd2[1] = 0x00;
 225                         cmd2[2] = 0x08;
 226                 }
 227
 228                 if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose();
 229
 230                 if ( SRx && (cmdLen != 3 || !crc2) ) return rawClose();
 231                 else if (cmd2[0] != 0x50 || cmdLen != 14 || !crc2) return rawClose();
 232
 233                 uint8_t chipID = 0;
 234                 if (SRx) {
 235                         // select
 236                         chipID = cmd2[0];
 237                         cmd2[0] = 0x0E;
 238                         cmd2[1] = chipID;
 239                         cmdLen = 2;
 240                 } else {
 241                         // attrib
 242                         cmd2[0] = 0x1D;
 243                         // UID from cmd2[1 - 4]
 244                         cmd2[5] = 0x00;
 245                         cmd2[6] = 0x08;
 246                         cmd2[7] = 0x01;
 247                         cmd2[8] = 0x00;
 248                         cmdLen = 9;
 249                 }
 250
 251                 if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose();
 252
 253                 if (cmdLen != 3 || !crc2) return rawClose();
 254                 if (SRx && cmd2[0] != chipID) return rawClose();
 255         }
 256         return HF14BCmdRaw(reply, &crc, power, data, &datalen, true);
 257 }
 258
 259 // print full atqb info
 260 static void print_atqb_resp(uint8_t *data){
 261         //PrintAndLog ("           UID: %s", sprint_hex(data+1,4));
 262         PrintAndLog ("      App Data: %s", sprint_hex(data+5,4));
 263         PrintAndLog ("      Protocol: %s", sprint_hex(data+9,3));
 264         uint8_t BitRate = data[9];
 265         if (!BitRate)
 266                 PrintAndLog ("      Bit Rate: 106 kbit/s only PICC <-> PCD");
 267         if (BitRate & 0x10)
 268                 PrintAndLog ("      Bit Rate: 212 kbit/s PICC -> PCD supported");
 269         if (BitRate & 0x20)
 270                 PrintAndLog ("      Bit Rate: 424 kbit/s PICC -> PCD supported");
 271         if (BitRate & 0x40)
 272                 PrintAndLog ("      Bit Rate: 847 kbit/s PICC -> PCD supported");
 273         if (BitRate & 0x01)
 274                 PrintAndLog ("      Bit Rate: 212 kbit/s PICC <- PCD supported");
 275         if (BitRate & 0x02)
 276                 PrintAndLog ("      Bit Rate: 424 kbit/s PICC <- PCD supported");
 277         if (BitRate & 0x04)
 278                 PrintAndLog ("      Bit Rate: 847 kbit/s PICC <- PCD supported");
 279         if (BitRate & 0x80)
 280                 PrintAndLog ("                Same bit rate <-> required");
 281
 282         uint16_t maxFrame = data[10]>>4;
 283         if (maxFrame < 5)
 284                 maxFrame = 8*maxFrame + 16;
 285         else if (maxFrame == 5)
 286                 maxFrame = 64;
 287         else if (maxFrame == 6)
 288                 maxFrame = 96;
 289         else if (maxFrame == 7)
 290                 maxFrame = 128;
 291         else if (maxFrame == 8)
 292                 maxFrame = 256;
 293         else
 294                 maxFrame = 257;
 295
 296         PrintAndLog ("Max Frame Size: %u%s",maxFrame, (maxFrame == 257) ? "+ RFU" : "");
 297
 298         uint8_t protocolT = data[10] & 0xF;
 299         PrintAndLog (" Protocol Type: Protocol is %scompliant with ISO/IEC 14443-4",(protocolT) ? "" : "not " );
 300         PrintAndLog ("Frame Wait Int: %u", data[11]>>4);
 301         PrintAndLog (" App Data Code: Application is %s",(data[11]&4) ? "Standard" : "Proprietary");
 302         PrintAndLog (" Frame Options: NAD is %ssupported",(data[11]&2) ? "" : "not ");
 303         PrintAndLog (" Frame Options: CID is %ssupported",(data[11]&1) ? "" : "not ");
 304         PrintAndLog ("Max Buf Length: %u (MBLI) %s",data[14]>>4, (data[14] & 0xF0) ? "" : "not supported");
 305
 306         return;
 307 }
 308
 309
 310 int print_ST_Lock_info(uint8_t model){
 311         //assume connection open and tag selected...
 312         uint8_t data[16] = {0x00};
 313         uint8_t datalen = 2;
 314         bool crc = true;
 315         uint8_t resplen;
 316         uint8_t blk1;
 317         data[0] = 0x08;
 318
 319         if (model == 0x2) { //SR176 has special command:
 320                 data[1] = 0xf;
 321                 resplen = 4;
 322         } else {
 323                 data[1] = 0xff;
 324                 resplen = 6;
 325         }
 326
 327         //std read cmd
 328         if (HF14BCmdRaw(true, &crc, true, data, &datalen, false)==0) return rawClose();
 329
 330         if (datalen != resplen || !crc) return rawClose();
 331
 332         PrintAndLog("Chip Write Protection Bits:");
 333         // now interpret the data
 334         switch (model){
 335                 case 0x0: //fall through (SRIX4K special)
 336                 case 0x3: //fall through (SRIx4K)
 337                 case 0x7: //             (SRI4K)
 338                         //only need data[3]
 339                         blk1 = 9;
 340                         PrintAndLog("   raw: %s",printBits(1,data+3));
 341                         PrintAndLog(" 07/08:%slocked", (data[3] & 1) ? " not " : " " );
 342                         for (uint8_t i = 1; i<8; i++){
 343                                 PrintAndLog("    %02u:%slocked", blk1, (data[3] & (1 << i)) ? " not " : " " );
 344                                 blk1++;
 345                         }
 346                         break;
 347                 case 0x4: //fall through (SRIX512)
 348                 case 0x6: //fall through (SRI512)
 349                 case 0xC: //             (SRT512)
 350                         //need data[2] and data[3]
 351                         blk1 = 0;
 352                         PrintAndLog("   raw: %s",printBits(2,data+2));
 353                         for (uint8_t b=2; b<4; b++){
 354                                 for (uint8_t i=0; i<8; i++){
 355                                         PrintAndLog("    %02u:%slocked", blk1, (data[b] & (1 << i)) ? " not " : " " );
 356                                         blk1++;
 357                                 }
 358                         }
 359                         break;
 360                 case 0x2: //             (SR176)
 361                         //need data[2]
 362                         blk1 = 0;
 363                         PrintAndLog("   raw: %s",printBits(1,data+2));
 364                         for (uint8_t i = 0; i<8; i++){
 365                                 PrintAndLog(" %02u/%02u:%slocked", blk1, blk1+1, (data[2] & (1 << i)) ? " " : " not " );
 366                                 blk1+=2;
 367                         }
 368                         break;
 369                 default:
 370                         return rawClose();
 371         }
 372         return 1;
 373 }
 374
 375 // print UID info from SRx chips (ST Microelectronics)
 376 static void print_st_general_info(uint8_t *data){
 377         //uid = first 8 bytes in data
 378         PrintAndLog("   UID: %s", sprint_hex(SwapEndian64(data,8,8),8));
 379         PrintAndLog("   MFG: %02X, %s", data[6], getManufacturerName(data[6]));
 380         PrintAndLog("  Chip: %02X, %s", data[5], getChipInfo(data[6], data[5]));
 381         return;
 382 }
 383
 384 // 14b get and print UID only (general info)
 385 int HF14BStdReader(uint8_t *data, uint8_t *datalen){
 386         //05 00 00 = find one tag in field
 387         //1d xx xx xx xx 00 08 01 00 = attrib xx=UID (resp 10 [f9 e0])
 388         //a3 = ?  (resp 03 [e2 c2])
 389         //02 = ?  (resp 02 [6a d3])
 390         // 022b (resp 02 67 00 [29  5b])
 391         // 0200a40400 (resp 02 67 00 [29 5b])
 392         // 0200a4040c07a0000002480300 (resp 02 67 00 [29 5b])
 393         // 0200a4040c07a0000002480200 (resp 02 67 00 [29 5b])
 394         // 0200a4040006a0000000010100 (resp 02 6a 82 [4b 4c])
 395         // 0200a4040c09d27600002545500200 (resp 02 67 00 [29 5b])
 396         // 0200a404000cd2760001354b414e4d30310000 (resp 02 6a 82 [4b 4c])
 397         // 0200a404000ca000000063504b43532d313500 (resp 02 6a 82 [4b 4c])
 398         // 0200a4040010a000000018300301000000000000000000 (resp 02 6a 82 [4b 4c])
 399         //03 = ?  (resp 03 [e3 c2])
 400         //c2 = ?  (resp c2 [66 15])
 401         //b2 = ?  (resp a3 [e9 67])
 402         //a2 = ?  (resp 02 [6a d3])
 403         bool crc = true;
 404         *datalen = 3;
 405         //std read cmd
 406         data[0] = 0x05;
 407         data[1] = 0x00;
 408         data[2] = 0x08;
 409
 410         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 411
 412         if (data[0] != 0x50 || *datalen != 14 || !crc) return rawClose();
 413
 414         PrintAndLog ("\n14443-3b tag found:");
 415         PrintAndLog ("           UID: %s", sprint_hex(data+1,4));
 416
 417         uint8_t cmd2[16];
 418         uint8_t cmdLen = 3;
 419         bool crc2 = true;
 420
 421         cmd2[0] = 0x1D;
 422         // UID from data[1 - 4]
 423         cmd2[1] = data[1];
 424         cmd2[2] = data[2];
 425         cmd2[3] = data[3];
 426         cmd2[4] = data[4];
 427         cmd2[5] = 0x00;
 428         cmd2[6] = 0x08;
 429         cmd2[7] = 0x01;
 430         cmd2[8] = 0x00;
 431         cmdLen = 9;
 432
 433         // attrib
 434         if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose();
 435
 436         if (cmdLen != 3 || !crc2) return rawClose();
 437         // add attrib responce to data
 438         data[14] = cmd2[0];
 439         rawClose();
 440         return 1;
 441 }
 442
 443 // 14b get and print Full Info (as much as we know)
 444 int HF14BStdInfo(uint8_t *data, uint8_t *datalen){
 445         if (!HF14BStdReader(data,datalen)) return 0;
 446
 447         //add more info here
 448         print_atqb_resp(data);
 449
 450
 451         return 1;
 452 }
 453
 454 // SRx get and print general info about SRx chip from UID
 455 int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen, bool closeCon){
 456         bool crc = true;
 457         *datalen = 2;
 458         //wake cmd
 459         data[0] = 0x06;
 460         data[1] = 0x00;
 461
 462         //leave power on
 463         // verbose on for now for testing - turn off when functional
 464         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 465
 466         if (*datalen != 3 || !crc) return rawClose();
 467
 468         uint8_t chipID = data[0];
 469         // select
 470         data[0] = 0x0E;
 471         data[1] = chipID;
 472         *datalen = 2;
 473
 474         //leave power on
 475         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 476
 477         if (*datalen != 3 || !crc || data[0] != chipID) return rawClose();
 478
 479         // get uid
 480         data[0] = 0x0B;
 481         *datalen = 1;
 482
 483         //leave power on
 484         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 485
 486         if (*datalen != 10 || !crc) return rawClose();
 487
 488         //power off ?
 489         if (closeCon) rawClose();
 490
 491         PrintAndLog("\n14443-3b ST tag found:");
 492         print_st_general_info(data);
 493         return 1;
 494 }
 495
 496 // SRx get and print full info (needs more info...)
 497 int HF14B_ST_Info(uint8_t *data, uint8_t *datalen){
 498         if (!HF14B_ST_Reader(data, datalen, false)) return 0;
 499
 500         //add locking bit information here.
 501         if (print_ST_Lock_info(data[5]>>2))
 502                 rawClose();
 503
 504         return 1;
 505 }
 506
 507 // test for other 14b type tags (mimic another reader - don't have tags to identify)
 508 int HF14B_Other_Reader(uint8_t *data, uint8_t *datalen){
 509         bool crc = true;
 510         *datalen = 4;
 511         //std read cmd
 512         data[0] = 0x00;
 513         data[1] = 0x0b;
 514         data[2] = 0x3f;
 515         data[3] = 0x80;
 516
 517         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)!=0) {
 518                 if (*datalen > 2 || !crc) {
 519                         PrintAndLog ("\n14443-3b tag found:");
 520                         PrintAndLog ("Unknown tag type answered to a 0x000b3f80 command ans:");
 521                         PrintAndLog ("%s",sprint_hex(data,*datalen));
 522                         rawClose();
 523                         return 1;
 524                 }
 525         }
 526
 527         crc = false;
 528         *datalen = 1;
 529         data[0] = 0x0a;
 530
 531         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)!=0) {
 532                 if (*datalen > 0) {
 533                         PrintAndLog ("\n14443-3b tag found:");
 534                         PrintAndLog ("Unknown tag type answered to a 0x0A command ans:");
 535                         PrintAndLog ("%s",sprint_hex(data,*datalen));
 536                         rawClose();
 537                         return 1;
 538                 }
 539         }
 540
 541         crc = false;
 542         *datalen = 1;
 543         data[0] = 0x0c;
 544
 545         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)!=0) {
 546                 if (*datalen > 0) {
 547                         PrintAndLog ("\n14443-3b tag found:");
 548                         PrintAndLog ("Unknown tag type answered to a 0x0C command ans:");
 549                         PrintAndLog ("%s",sprint_hex(data,*datalen));
 550                         rawClose();
 551                         return 1;
 552                 }
 553         }
 554         rawClose();
 555         return 0;
 556 }
 557
 558 // get and print all info known about any known 14b tag
 559 int HF14BInfo(bool verbose){
 560         uint8_t data[100];
 561         uint8_t datalen = 5;
 562
 563         // try std 14b (atqb)
 564         if (HF14BStdInfo(data, &datalen)) return 1;
 565
 566         // try st 14b
 567         if (HF14B_ST_Info(data, &datalen)) return 1;
 568
 569         // try unknown 14b read commands (to be identified later)
 570         //   could be read of calypso, CEPAS, moneo, or pico pass.
 571         if (HF14B_Other_Reader(data, &datalen)) return 1;
 572
 573         if (verbose) PrintAndLog("no 14443B tag found");
 574         return 0;
 575 }
 576
 577 // menu command to get and print all info known about any known 14b tag
 578 int CmdHF14Binfo(const char *Cmd){
 579         return HF14BInfo(true);
 580 }
 581
 582 // get and print general info about all known 14b chips
 583 int HF14BReader(bool verbose){
 584         uint8_t data[100];
 585         uint8_t datalen = 5;
 586
 587         // try std 14b (atqb)
 588         if (HF14BStdReader(data, &datalen)) return 1;
 589
 590         // try st 14b
 591         if (HF14B_ST_Reader(data, &datalen, true)) return 1;
 592
 593         // try unknown 14b read commands (to be identified later)
 594         //   could be read of calypso, CEPAS, moneo, or pico pass.
 595         if (HF14B_Other_Reader(data, &datalen)) return 1;
 596
 597         if (verbose) PrintAndLog("no 14443B tag found");
 598         return 0;
 599 }
 600
 601 // menu command to get and print general info about all known 14b chips
 602 int CmdHF14BReader(const char *Cmd){
 603         return HF14BReader(true);
 604 }
 605
 606 int CmdSriWrite( const char *Cmd){
 607 /*
 608  * For SRIX4K  blocks 00 - 7F
 609  * hf 14b raw -c -p 09 $srix4kwblock $srix4kwdata
 610  *
 611  * For SR512  blocks 00 - 0F
 612  * hf 14b raw -c -p 09 $sr512wblock $sr512wdata
 613  *
 614  * Special block FF =  otp_lock_reg block.
 615  * Data len 4 bytes-
 616  */
 617         char cmdp = param_getchar(Cmd, 0);
 618         uint8_t blockno = -1;
 619         uint8_t data[4] = {0x00};
 620         bool isSrix4k = true;
 621         char str[20];
 622
 623         if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') {
 624                 PrintAndLog("Usage:  hf 14b write <1|2> <BLOCK> <DATA>");
 625                 PrintAndLog("    [1 = SRIX4K]");
 626                 PrintAndLog("    [2 = SRI512]");
 627                 PrintAndLog("    [BLOCK number depends on tag, special block == FF]");
 628                 PrintAndLog("     sample: hf 14b write 1 7F 11223344");
 629                 PrintAndLog("           : hf 14b write 1 FF 11223344");
 630                 PrintAndLog("           : hf 14b write 2 15 11223344");
 631                 PrintAndLog("           : hf 14b write 2 FF 11223344");
 632                 return 0;
 633         }
 634
 635         if ( cmdp == '2' )
 636                 isSrix4k = false;
 637
 638         //blockno = param_get8(Cmd, 1);
 639
 640         if ( param_gethex(Cmd,1, &blockno, 2) ) {
 641                 PrintAndLog("Block number must include 2 HEX symbols");
 642                 return 0;
 643         }
 644
 645         if ( isSrix4k ){
 646                 if ( blockno > 0x7f && blockno != 0xff ){
 647                         PrintAndLog("Block number out of range");
 648                         return 0;
 649                 }
 650         } else {
 651                 if ( blockno > 0x0f && blockno != 0xff ){
 652                         PrintAndLog("Block number out of range");
 653                         return 0;
 654                 }
 655         }
 656
 657         if (param_gethex(Cmd, 2, data, 8)) {
 658                 PrintAndLog("Data must include 8 HEX symbols");
 659                 return 0;
 660         }
 661
 662         if ( blockno == 0xff)
 663                 PrintAndLog("[%s] Write special block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512" , blockno,  sprint_hex(data,4) );
 664         else
 665                 PrintAndLog("[%s] Write block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512", blockno,  sprint_hex(data,4) );
 666
 667         sprintf(str, "-c 09 %02x %02x%02x%02x%02x", blockno, data[0], data[1], data[2], data[3]);
 668
 669         CmdHF14BCmdRaw(str);
 670         return 0;
 671 }
 672
 673 static command_t CommandTable[] =
 674 {
 675   {"help",        CmdHelp,        1, "This help"},
 676   {"info",        CmdHF14Binfo,   0, "Find and print details about a 14443B tag"},
 677   {"list",        CmdHF14BList,   0, "[Deprecated] List ISO 14443B history"},
 678   {"reader",      CmdHF14BReader, 0, "Act as a 14443B reader to identify a tag"},
 679   {"sim",         CmdHF14BSim,    0, "Fake ISO 14443B tag"},
 680   {"snoop",       CmdHF14BSnoop,  0, "Eavesdrop ISO 14443B"},
 681   {"sri512read",  CmdSri512Read,  0, "Read contents of a SRI512 tag"},
 682   {"srix4kread",  CmdSrix4kRead,  0, "Read contents of a SRIX4K tag"},
 683   {"sriwrite",    CmdSriWrite,    0, "Write data to a SRI512 | SRIX4K tag"},
 684   {"raw",         CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},
 685   {NULL, NULL, 0, NULL}
 686 };
 687
 688 int CmdHF14B(const char *Cmd)
 689 {
 690   CmdsParse(CommandTable, Cmd);
 691   return 0;
 692 }
 693
 694 int CmdHelp(const char *Cmd)
 695 {
 696   CmdsHelp(CommandTable);
 697   return 0;
 698 }