cvs.zerfleddert.de Git - proxmark3-svn/blob - client/cmdhf14b.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>
   3 //
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   5 // at your option, any later version. See the LICENSE.txt file for the text of
   6 // the license.
   7 //-----------------------------------------------------------------------------
   8 // High frequency ISO14443B commands
   9 //-----------------------------------------------------------------------------
  10
  11 #include <stdio.h>
  12 #include <stdlib.h>
  13 #include <stdbool.h>
  14 #include <stdint.h>
  15 #include "iso14443crc.h"
  16 #include "proxmark3.h"
  17 #include "data.h"
  18 #include "graph.h"
  19 #include "util.h"
  20 #include "ui.h"
  21 #include "cmdparser.h"
  22 #include "cmdhf14b.h"
  23 #include "cmdmain.h"
  24 #include "cmdhf14a.h"
  25
  26 static int CmdHelp(const char *Cmd);
  27
  28 int CmdHF14BList(const char *Cmd)
  29 {
  30         PrintAndLog("Deprecated command, use 'hf list 14b' instead");
  31
  32         return 0;
  33 }
  34
  35 int CmdHF14BSim(const char *Cmd)
  36 {
  37         UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443B};
  38         clearCommandBuffer();
  39         SendCommand(&c);
  40         return 0;
  41 }
  42
  43 int CmdHF14BSnoop(const char *Cmd)
  44 {
  45         UsbCommand c = {CMD_SNOOP_ISO_14443B};
  46         clearCommandBuffer();
  47         SendCommand(&c);
  48         return 0;
  49 }
  50
  51 /* New command to read the contents of a SRI512 tag
  52  * SRI512 tags are ISO14443-B modulated memory tags,
  53  * this command just dumps the contents of the memory
  54  */
  55 int CmdSri512Read(const char *Cmd)
  56 {
  57         UsbCommand c = {CMD_READ_SRI512_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
  58         clearCommandBuffer();
  59         SendCommand(&c);
  60         return 0;
  61 }
  62
  63 /* New command to read the contents of a SRIX4K tag
  64  * SRIX4K tags are ISO14443-B modulated memory tags,
  65  * this command just dumps the contents of the memory/
  66  */
  67 int CmdSrix4kRead(const char *Cmd)
  68 {
  69         UsbCommand c = {CMD_READ_SRIX4K_TAG, {strtol(Cmd, NULL, 0), 0, 0}};
  70         clearCommandBuffer();
  71         SendCommand(&c);
  72         return 0;
  73 }
  74
  75
  76 int rawClose(void){
  77         UsbCommand resp;
  78         UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}};
  79         clearCommandBuffer();
  80         SendCommand(&c);
  81         if (!WaitForResponseTimeout(CMD_ACK,&resp,1000)) {
  82         return 0;
  83         }
  84         return 0;
  85 }
  86
  87 int HF14BCmdRaw(bool reply, bool *crc, bool power, uint8_t *data, uint8_t *datalen, bool verbose){
  88
  89         if(*crc) {
  90                 ComputeCrc14443(CRC_14443_B, data, *datalen, data+*datalen, data+*datalen+1);
  91                 *datalen += 2;
  92         }
  93
  94         UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; // len,recv,power
  95         c.arg[0] = *datalen;
  96         c.arg[1] = reply;
  97         c.arg[2] = power;
  98         memcpy(c.d.asBytes, data, *datalen);
  99         clearCommandBuffer();
 100         SendCommand(&c);
 101
 102         if (!reply) return 1;
 103
 104         UsbCommand resp;
 105         if (!WaitForResponseTimeout(CMD_ACK, &resp, 2000)) {
 106                 if (verbose) PrintAndLog("timeout while waiting for reply.");
 107                 return 0;
 108         }
 109
 110         *datalen = resp.arg[0];
 111         if (verbose) PrintAndLog("received %u octets", *datalen);
 112         if(*datalen<3) return 0;
 113
 114         memcpy(data, resp.d.asBytes, *datalen);
 115
 116         uint8_t first = 0, second = 0;
 117         ComputeCrc14443(CRC_14443_B, data, *datalen-2, &first, &second);
 118         *crc = ( data[*datalen-2] == first && data[*datalen-1] == second);
 119
 120         if (verbose)
 121                 PrintAndLog("[LEN %u] %s[%02X %02X] %s",
 122                                 *datalen,
 123                                 sprint_hex(data, *datalen-2),
 124                                 data[*datalen-2],
 125                                 data[*datalen-1],
 126                                 (*crc)?"OK":"FAIL"
 127                                 );
 128
 129         return 1;
 130 }
 131
 132 int CmdHF14BCmdRaw (const char *Cmd) {
 133     bool reply = true;
 134     bool crc = false;
 135         bool power = false;
 136         bool select = false;
 137         bool SRx = false;
 138     char buf[5]="";
 139     uint8_t data[USB_CMD_DATA_SIZE] = {0x00};
 140     uint8_t datalen = 0;
 141     unsigned int temp;
 142     int i = 0;
 143     if (strlen(Cmd)<3) {
 144                 PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] [-s || -ss] <0A 0B 0C ... hex>");
 145         PrintAndLog("       -r    do not read response");
 146         PrintAndLog("       -c    calculate and append CRC");
 147         PrintAndLog("       -p    leave the field on after receive");
 148                 PrintAndLog("       -s    active signal field ON with select");
 149                 PrintAndLog("       -ss   active signal field ON with select for SRx ST Microelectronics tags");
 150         return 0;
 151     }
 152
 153     // strip
 154     while (*Cmd==' ' || *Cmd=='\t') Cmd++;
 155
 156     while (Cmd[i]!='\0') {
 157         if (Cmd[i]==' ' || Cmd[i]=='\t') { i++; continue; }
 158         if (Cmd[i]=='-') {
 159             switch (Cmd[i+1]) {
 160                 case 'r':
 161                 case 'R':
 162                     reply = false;
 163                     break;
 164                 case 'c':
 165                 case 'C':
 166                     crc = true;
 167                     break;
 168                 case 'p':
 169                 case 'P':
 170                                         power = true;
 171                     break;
 172                                 case 's':
 173                                 case 'S':
 174                                         select = true;
 175                                         if (Cmd[i+2]=='s' || Cmd[i+2]=='S') {
 176                                                 SRx = true;
 177                                                 i++;
 178                                         }
 179                                         break;
 180                 default:
 181                     PrintAndLog("Invalid option");
 182                     return 0;
 183             }
 184             i+=2;
 185             continue;
 186         }
 187         if ((Cmd[i]>='0' && Cmd[i]<='9') ||
 188             (Cmd[i]>='a' && Cmd[i]<='f') ||
 189             (Cmd[i]>='A' && Cmd[i]<='F') ) {
 190             buf[strlen(buf)+1]=0;
 191             buf[strlen(buf)]=Cmd[i];
 192             i++;
 193
 194             if (strlen(buf)>=2) {
 195                 sscanf(buf,"%x",&temp);
 196                 data[datalen++]=(uint8_t)(temp & 0xff);
 197                 *buf=0;
 198                                 memset(buf, 0x00, sizeof(buf));
 199             }
 200             continue;
 201         }
 202         PrintAndLog("Invalid char on input");
 203                 return 0;
 204     }
 205     if (datalen == 0)
 206     {
 207       PrintAndLog("Missing data input");
 208       return 0;
 209     }
 210
 211         if (select){ //auto select 14b tag
 212                 uint8_t cmd2[16];
 213                 bool crc2 = true;
 214                 uint8_t cmdLen;
 215
 216                 if (SRx) {
 217                         // REQ SRx
 218                         cmdLen = 2;
 219                         cmd2[0] = 0x06;
 220                         cmd2[1] = 0x00;
 221                 } else {
 222                         // REQB
 223                         cmdLen = 3;
 224                         cmd2[0] = 0x05;
 225                         cmd2[1] = 0x00;
 226                         cmd2[2] = 0x08;
 227                 }
 228
 229                 // REQB
 230                 if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose();
 231
 232                 PrintAndLog("REQB   : %s", sprint_hex(cmd2, cmdLen));
 233
 234                 if ( SRx && (cmdLen != 3 || !crc2) ) return rawClose();
 235                 else if (cmd2[0] != 0x50 || cmdLen != 14 || !crc2) return rawClose();
 236
 237                 uint8_t chipID = 0;
 238                 if (SRx) {
 239                         // select
 240                         chipID = cmd2[0];
 241                         cmd2[0] = 0x0E;
 242                         cmd2[1] = chipID;
 243                         cmdLen = 2;
 244                 } else {
 245                         // attrib
 246                         cmd2[0] = 0x1D;
 247                         // UID from cmd2[1 - 4]
 248                         cmd2[5] = 0x00;
 249                         cmd2[6] = 0x08;
 250                         cmd2[7] = 0x01;
 251                         cmd2[8] = 0x00;
 252                         cmdLen = 9;
 253                 }
 254                 // wait
 255
 256                 // attrib
 257                 if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose();
 258                 PrintAndLog("ATTRIB : %s", sprint_hex(cmd2, cmdLen));
 259
 260                 if (cmdLen != 3 || !crc2) return rawClose();
 261                 if (SRx && cmd2[0] != chipID) return rawClose();
 262
 263         }
 264         return HF14BCmdRaw(reply, &crc, power, data, &datalen, true);
 265 }
 266
 267 // print full atqb info
 268 static void print_atqb_resp(uint8_t *data){
 269         //PrintAndLog ("           UID: %s", sprint_hex(data+1,4));
 270         PrintAndLog ("      App Data: %s", sprint_hex(data+5,4));
 271         PrintAndLog ("      Protocol: %s", sprint_hex(data+9,3));
 272         uint8_t BitRate = data[9];
 273         if (!BitRate) PrintAndLog ("      Bit Rate: 106 kbit/s only PICC <-> PCD");
 274         if (BitRate & 0x10)     PrintAndLog ("      Bit Rate: 212 kbit/s PICC -> PCD supported");
 275         if (BitRate & 0x20)     PrintAndLog ("      Bit Rate: 424 kbit/s PICC -> PCD supported");
 276         if (BitRate & 0x40)     PrintAndLog ("      Bit Rate: 847 kbit/s PICC -> PCD supported");
 277         if (BitRate & 0x01)     PrintAndLog ("      Bit Rate: 212 kbit/s PICC <- PCD supported");
 278         if (BitRate & 0x02)     PrintAndLog ("      Bit Rate: 424 kbit/s PICC <- PCD supported");
 279         if (BitRate & 0x04)     PrintAndLog ("      Bit Rate: 847 kbit/s PICC <- PCD supported");
 280         if (BitRate & 0x80)     PrintAndLog ("                Same bit rate <-> required");
 281
 282         uint16_t maxFrame = data[10]>>4;
 283         if (maxFrame < 5)               maxFrame = 8 * maxFrame + 16;
 284         else if (maxFrame == 5) maxFrame = 64;
 285         else if (maxFrame == 6) maxFrame = 96;
 286         else if (maxFrame == 7) maxFrame = 128;
 287         else if (maxFrame == 8) maxFrame = 256;
 288         else maxFrame = 257;
 289
 290         PrintAndLog ("Max Frame Size: %u%s",maxFrame, (maxFrame == 257) ? "+ RFU" : "");
 291
 292         uint8_t protocolT = data[10] & 0xF;
 293         PrintAndLog (" Protocol Type: Protocol is %scompliant with ISO/IEC 14443-4",(protocolT) ? "" : "not " );
 294         PrintAndLog ("Frame Wait Int: %u", data[11]>>4);
 295         PrintAndLog (" App Data Code: Application is %s",(data[11]&4) ? "Standard" : "Proprietary");
 296         PrintAndLog (" Frame Options: NAD is %ssupported",(data[11]&2) ? "" : "not ");
 297         PrintAndLog (" Frame Options: CID is %ssupported",(data[11]&1) ? "" : "not ");
 298         PrintAndLog ("Max Buf Length: %u (MBLI) %s",data[14]>>4, (data[14] & 0xF0) ? "" : "not supported");
 299
 300         return;
 301 }
 302
 303 // get SRx chip model (from UID) // from ST Microelectronics
 304 char *get_ST_Chip_Model(uint8_t data){
 305         static char model[20];
 306         char *retStr = model;
 307         memset(model,0, sizeof(model));
 308
 309         switch (data) {
 310                 case 0x0: sprintf(retStr, "SRIX4K (Special)"); break;
 311                 case 0x2: sprintf(retStr, "SR176"); break;
 312                 case 0x3: sprintf(retStr, "SRIX4K"); break;
 313                 case 0x4: sprintf(retStr, "SRIX512"); break;
 314                 case 0x6: sprintf(retStr, "SRI512"); break;
 315                 case 0x7: sprintf(retStr, "SRI4K"); break;
 316                 case 0xC: sprintf(retStr, "SRT512"); break;
 317                 default : sprintf(retStr, "Unknown"); break;
 318         }
 319         return retStr;
 320 }
 321
 322 int print_ST_Lock_info(uint8_t model){
 323         //assume connection open and tag selected...
 324         uint8_t data[16] = {0x00};
 325         uint8_t datalen = 2;
 326         bool crc = true;
 327         uint8_t resplen;
 328         uint8_t blk1;
 329         data[0] = 0x08;
 330
 331         if (model == 0x2) { //SR176 has special command:
 332                 data[1] = 0xf;
 333                 resplen = 4;
 334         } else {
 335                 data[1] = 0xff;
 336                 resplen = 6;
 337         }
 338
 339         //std read cmd
 340         if (HF14BCmdRaw(true, &crc, true, data, &datalen, false)==0) return rawClose();
 341
 342         if (datalen != resplen || !crc) return rawClose();
 343
 344         PrintAndLog("Chip Write Protection Bits:");
 345         // now interpret the data
 346         switch (model){
 347                 case 0x0: //fall through (SRIX4K special)
 348                 case 0x3: //fall through (SRIx4K)
 349                 case 0x7: //             (SRI4K)
 350                         //only need data[3]
 351                         blk1 = 9;
 352                         PrintAndLog("   raw: %s",printBits(1,data+3));
 353                         PrintAndLog(" 07/08:%slocked", (data[3] & 1) ? " not " : " " );
 354                         for (uint8_t i = 1; i<8; i++){
 355                                 PrintAndLog("    %02u:%slocked", blk1, (data[3] & (1 << i)) ? " not " : " " );
 356                                 blk1++;
 357                         }
 358                         break;
 359                 case 0x4: //fall through (SRIX512)
 360                 case 0x6: //fall through (SRI512)
 361                 case 0xC: //             (SRT512)
 362                         //need data[2] and data[3]
 363                         blk1 = 0;
 364                         PrintAndLog("   raw: %s",printBits(2,data+2));
 365                         for (uint8_t b=2; b<4; b++){
 366                                 for (uint8_t i=0; i<8; i++){
 367                                         PrintAndLog("    %02u:%slocked", blk1, (data[b] & (1 << i)) ? " not " : " " );
 368                                         blk1++;
 369                                 }
 370                         }
 371                         break;
 372                 case 0x2: //             (SR176)
 373                         //need data[2]
 374                         blk1 = 0;
 375                         PrintAndLog("   raw: %s",printBits(1,data+2));
 376                         for (uint8_t i = 0; i<8; i++){
 377                                 PrintAndLog(" %02u/%02u:%slocked", blk1, blk1+1, (data[2] & (1 << i)) ? " " : " not " );
 378                                 blk1+=2;
 379                         }
 380                         break;
 381                 default:
 382                         return rawClose();
 383         }
 384         return 1;
 385 }
 386
 387 // print UID info from SRx chips (ST Microelectronics)
 388 static void print_st_general_info(uint8_t *data){
 389         //uid = first 8 bytes in data
 390         PrintAndLog(" UID: %s", sprint_hex(SwapEndian64(data,8,8),8));
 391         PrintAndLog(" MFG: %02X, %s", data[6], getTagInfo(data[6]));
 392         PrintAndLog("Chip: %02X, %s", data[5]>>2, get_ST_Chip_Model(data[5]>>2));
 393         return;
 394 }
 395
 396 // 14b get and print UID only (general info)
 397 int HF14BStdReader(uint8_t *data, uint8_t *datalen){
 398         //05 00 00 = find one tag in field
 399         //1d xx xx xx xx 00 08 01 00 = attrib xx=UID (resp 10 [f9 e0])
 400         //a3 = ?  (resp 03 [e2 c2])
 401         //02 = ?  (resp 02 [6a d3])
 402         // 022b (resp 02 67 00 [29  5b])
 403         // 0200a40400 (resp 02 67 00 [29 5b])
 404         // 0200a4040c07a0000002480300 (resp 02 67 00 [29 5b])
 405         // 0200a4040c07a0000002480200 (resp 02 67 00 [29 5b])
 406         // 0200a4040006a0000000010100 (resp 02 6a 82 [4b 4c])
 407         // 0200a4040c09d27600002545500200 (resp 02 67 00 [29 5b])
 408         // 0200a404000cd2760001354b414e4d30310000 (resp 02 6a 82 [4b 4c])
 409         // 0200a404000ca000000063504b43532d313500 (resp 02 6a 82 [4b 4c])
 410         // 0200a4040010a000000018300301000000000000000000 (resp 02 6a 82 [4b 4c])
 411         //03 = ?  (resp 03 [e3 c2])
 412         //c2 = ?  (resp c2 [66 15])
 413         //b2 = ?  (resp a3 [e9 67])
 414         //a2 = ?  (resp 02 [6a d3])
 415         bool crc = true;
 416         *datalen = 3;
 417         //std read cmd
 418         data[0] = 0x05;
 419         data[1] = 0x00;
 420         data[2] = 0x08;
 421
 422         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 423
 424         if (data[0] != 0x50 || *datalen != 14 || !crc) return rawClose();
 425
 426         PrintAndLog ("\n14443-3b tag found:");
 427         PrintAndLog ("           UID: %s", sprint_hex(data+1,4));
 428
 429         uint8_t cmd2[16];
 430         uint8_t cmdLen = 3;
 431         bool crc2 = true;
 432
 433         cmd2[0] = 0x1D;
 434         // UID from data[1 - 4]
 435         cmd2[1] = data[1];
 436         cmd2[2] = data[2];
 437         cmd2[3] = data[3];
 438         cmd2[4] = data[4];
 439         cmd2[5] = 0x00;
 440         cmd2[6] = 0x08;
 441         cmd2[7] = 0x01;
 442         cmd2[8] = 0x00;
 443         cmdLen = 9;
 444
 445         // attrib
 446         if (HF14BCmdRaw(true, &crc2, true, cmd2, &cmdLen, false)==0) return rawClose();
 447
 448         if (cmdLen != 3 || !crc2) return rawClose();
 449         // add attrib responce to data
 450         data[14] = cmd2[0];
 451         rawClose();
 452         return 1;
 453 }
 454
 455 // 14b get and print Full Info (as much as we know)
 456 int HF14BStdInfo(uint8_t *data, uint8_t *datalen){
 457         if (!HF14BStdReader(data,datalen)) return 0;
 458
 459         //add more info here
 460         print_atqb_resp(data);
 461         return 1;
 462 }
 463
 464 // SRx get and print general info about SRx chip from UID
 465 int HF14B_ST_Reader(uint8_t *data, uint8_t *datalen, bool closeCon){
 466         bool crc = true;
 467         *datalen = 2;
 468         //wake cmd
 469         data[0] = 0x06;
 470         data[1] = 0x00;
 471
 472         //leave power on
 473         // verbose on for now for testing - turn off when functional
 474         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 475
 476         if (*datalen != 3 || !crc) return rawClose();
 477
 478         uint8_t chipID = data[0];
 479         // select
 480         data[0] = 0x0E;
 481         data[1] = chipID;
 482         *datalen = 2;
 483
 484         //leave power on
 485         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 486
 487         if (*datalen != 3 || !crc || data[0] != chipID) return rawClose();
 488
 489         // get uid
 490         data[0] = 0x0B;
 491         *datalen = 1;
 492
 493         //leave power on
 494         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)==0) return rawClose();
 495
 496         if (*datalen != 10 || !crc) return rawClose();
 497
 498         //power off ?
 499         if (closeCon) rawClose();
 500
 501         PrintAndLog("\n14443-3b ST tag found:");
 502         print_st_general_info(data);
 503         return 1;
 504 }
 505
 506 // SRx get and print full info (needs more info...)
 507 int HF14B_ST_Info(uint8_t *data, uint8_t *datalen){
 508         if (!HF14B_ST_Reader(data, datalen, false)) return 0;
 509
 510         //add locking bit information here.
 511         if (print_ST_Lock_info(data[5]>>2))
 512                 rawClose();
 513
 514         return 1;
 515 }
 516
 517 // test for other 14b type tags (mimic another reader - don't have tags to identify)
 518 int HF14B_Other_Reader(uint8_t *data, uint8_t *datalen){
 519         bool crc = true;
 520         *datalen = 4;
 521         //std read cmd
 522         data[0] = 0x00;
 523         data[1] = 0x0b;
 524         data[2] = 0x3f;
 525         data[3] = 0x80;
 526
 527         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)!=0) {
 528                 if (*datalen > 2 || !crc) {
 529                         PrintAndLog ("\n14443-3b tag found:");
 530                         PrintAndLog ("Unknown tag type answered to a 0x000b3f80 command ans:");
 531                         PrintAndLog ("%s",sprint_hex(data,*datalen));
 532                         rawClose();
 533                         return 1;
 534                 }
 535         }
 536
 537         crc = false;
 538         *datalen = 1;
 539         data[0] = 0x0a;
 540
 541         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)!=0) {
 542                 if (*datalen > 0) {
 543                         PrintAndLog ("\n14443-3b tag found:");
 544                         PrintAndLog ("Unknown tag type answered to a 0x0A command ans:");
 545                         PrintAndLog ("%s",sprint_hex(data,*datalen));
 546                         rawClose();
 547                         return 1;
 548                 }
 549         }
 550
 551         crc = false;
 552         *datalen = 1;
 553         data[0] = 0x0c;
 554
 555         if (HF14BCmdRaw(true, &crc, true, data, datalen, false)!=0) {
 556                 if (*datalen > 0) {
 557                         PrintAndLog ("\n14443-3b tag found:");
 558                         PrintAndLog ("Unknown tag type answered to a 0x0C command ans:");
 559                         PrintAndLog ("%s",sprint_hex(data,*datalen));
 560                         rawClose();
 561                         return 1;
 562                 }
 563         }
 564         rawClose();
 565         return 0;
 566 }
 567
 568 // get and print all info known about any known 14b tag
 569 int HF14BInfo(bool verbose){
 570         uint8_t data[USB_CMD_DATA_SIZE];
 571         uint8_t datalen = 5;
 572
 573         // try std 14b (atqb)
 574         if (HF14BStdInfo(data, &datalen)) return 1;
 575
 576         // try st 14b
 577         if (HF14B_ST_Info(data, &datalen)) return 1;
 578
 579         // try unknown 14b read commands (to be identified later)
 580         //   could be read of calypso, CEPAS, moneo, or pico pass.
 581         if (HF14B_Other_Reader(data, &datalen)) return 1;
 582
 583         if (verbose) PrintAndLog("no 14443B tag found");
 584         return 0;
 585 }
 586
 587 // menu command to get and print all info known about any known 14b tag
 588 int CmdHF14Binfo(const char *Cmd){
 589         return HF14BInfo(true);
 590 }
 591
 592 // get and print general info about all known 14b chips
 593 int HF14BReader(bool verbose){
 594         uint8_t data[USB_CMD_DATA_SIZE];
 595         uint8_t datalen = 5;
 596
 597         // try std 14b (atqb)
 598         if (HF14BStdReader(data, &datalen)) return 1;
 599
 600         // try st 14b
 601         if (HF14B_ST_Reader(data, &datalen, true)) return 1;
 602
 603         // try unknown 14b read commands (to be identified later)
 604         //   could be read of calypso, CEPAS, moneo, or pico pass.
 605         if (HF14B_Other_Reader(data, &datalen)) return 1;
 606
 607         if (verbose) PrintAndLog("no 14443B tag found");
 608         return 0;
 609 }
 610
 611 // menu command to get and print general info about all known 14b chips
 612 int CmdHF14BReader(const char *Cmd){
 613         return HF14BReader(true);
 614 }
 615
 616 int CmdSriWrite( const char *Cmd){
 617 /*
 618  * For SRIX4K  blocks 00 - 7F
 619  * hf 14b raw -c -p 09 $srix4kwblock $srix4kwdata
 620  *
 621  * For SR512  blocks 00 - 0F
 622  * hf 14b raw -c -p 09 $sr512wblock $sr512wdata
 623  *
 624  * Special block FF =  otp_lock_reg block.
 625  * Data len 4 bytes-
 626  */
 627         char cmdp = param_getchar(Cmd, 0);
 628         uint8_t blockno = -1;
 629         uint8_t data[4] = {0x00};
 630         bool isSrix4k = true;
 631         char str[20];
 632
 633         if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') {
 634                 PrintAndLog("Usage:  hf 14b write <1|2> <BLOCK> <DATA>");
 635                 PrintAndLog("    [1 = SRIX4K]");
 636                 PrintAndLog("    [2 = SRI512]");
 637                 PrintAndLog("    [BLOCK number depends on tag, special block == FF]");
 638                 PrintAndLog("     sample: hf 14b write 1 7F 11223344");
 639                 PrintAndLog("           : hf 14b write 1 FF 11223344");
 640                 PrintAndLog("           : hf 14b write 2 15 11223344");
 641                 PrintAndLog("           : hf 14b write 2 FF 11223344");
 642                 return 0;
 643         }
 644
 645         if ( cmdp == '2' )
 646                 isSrix4k = false;
 647
 648         //blockno = param_get8(Cmd, 1);
 649
 650         if ( param_gethex(Cmd,1, &blockno, 2) ) {
 651                 PrintAndLog("Block number must include 2 HEX symbols");
 652                 return 0;
 653         }
 654
 655         if ( isSrix4k ){
 656                 if ( blockno > 0x7f && blockno != 0xff ){
 657                         PrintAndLog("Block number out of range");
 658                         return 0;
 659                 }
 660         } else {
 661                 if ( blockno > 0x0f && blockno != 0xff ){
 662                         PrintAndLog("Block number out of range");
 663                         return 0;
 664                 }
 665         }
 666
 667         if (param_gethex(Cmd, 2, data, 8)) {
 668                 PrintAndLog("Data must include 8 HEX symbols");
 669                 return 0;
 670         }
 671
 672         if ( blockno == 0xff)
 673                 PrintAndLog("[%s] Write special block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512" , blockno,  sprint_hex(data,4) );
 674         else
 675                 PrintAndLog("[%s] Write block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512", blockno,  sprint_hex(data,4) );
 676
 677         sprintf(str, "-c 09 %02x %02x%02x%02x%02x", blockno, data[0], data[1], data[2], data[3]);
 678
 679         CmdHF14BCmdRaw(str);
 680         return 0;
 681 }
 682
 683 int srix4kChecksum(uint32_t value) {
 684 /*
 685 // vv = value
 686 // pp = position
 687 //                vv vv vv pp
 688 4 bytes                 : 00 1A 20 01
 689 */
 690
 691 #define NibbleHigh(b) ( (b & 0xF0) >> 4 )
 692 #define NibbleLow(b)  ( b & 0x0F )
 693 #define Crumb(b,p)    (((b & (0x3 << p) ) >> p ) & 0xF)
 694
 695         // only the lower crumbs.
 696         uint8_t block = (value & 0xFF);
 697         uint8_t i = 0;
 698         uint8_t valuebytes[] = {0,0,0};
 699
 700         // if ( strlen(Cmd) > 0){
 701                 // value = param_get32ex(Cmd, 0, 0, 16);
 702
 703                 // block = value & 0xFF;
 704
 705                 // value &= 0xFFFFFF00;
 706                 // value >>=8;
 707         // }
 708
 709         num_to_bytes(value, 3, valuebytes);
 710
 711         // Scrambled part
 712         // Crumb swapping of value.
 713         uint8_t temp[] = {0,0};
 714         temp[0] = (Crumb(value, 22) << 4 | Crumb(value, 14 ) << 2 | Crumb(value, 6)) << 4;
 715         temp[0] |= Crumb(value, 20) << 4 | Crumb(value, 12 ) << 2 | Crumb(value, 4);
 716         temp[1] = (Crumb(value, 18) << 4 | Crumb(value, 10 ) << 2 | Crumb(value, 2)) << 4;
 717         temp[1] |= Crumb(value, 16) << 4 | Crumb(value, 8  ) << 2 | Crumb(value, 0);
 718
 719         // chksum part
 720         uint32_t chksum = 0xFF - block;
 721
 722         // chksum is reduced by each nibbles of value.
 723         for (i = 0; i < 3; ++i){
 724                 chksum -= NibbleHigh(valuebytes[i]);
 725                 chksum -= NibbleLow(valuebytes[i]);
 726         }
 727
 728         // base4 conversion
 729         // and left shift twice
 730         i = 3;
 731         uint8_t base4[] = {0,0,0,0};
 732         while( chksum !=0 ){
 733         base4[i--] = (chksum % 4 << 2);
 734                 chksum /= 4;
 735     }
 736
 737         // merge scambled and chksum parts
 738         uint32_t encvalue =
 739                 ( NibbleLow ( base4[0]) << 28 ) |
 740                 ( NibbleHigh( temp[0])  << 24 ) |
 741
 742                 ( NibbleLow ( base4[1]) << 20 ) |
 743                 ( NibbleLow ( temp[0])  << 16 ) |
 744
 745                 ( NibbleLow ( base4[2]) << 12 ) |
 746                 ( NibbleHigh( temp[1])  << 8 ) |
 747
 748                 ( NibbleLow ( base4[3]) << 4 ) |
 749                   NibbleLow ( temp[1] );
 750
 751         PrintAndLog("ICE | %08X", encvalue);
 752         return 0;
 753 }
 754 int srix4kMagicbytes(){
 755         return 0;
 756 }
 757 int srix4kValid(){
 758         return 0;
 759 }
 760
 761 static command_t CommandTable[] =
 762 {
 763         {"help",        CmdHelp,        1, "This help"},
 764         {"info",        CmdHF14Binfo,   0, "Find and print details about a 14443B tag"},
 765         {"list",        CmdHF14BList,   0, "[Deprecated] List ISO 14443B history"},
 766         {"reader",      CmdHF14BReader, 0, "Act as a 14443B reader to identify a tag"},
 767         {"sim",         CmdHF14BSim,    0, "Fake ISO 14443B tag"},
 768         {"snoop",       CmdHF14BSnoop,  0, "Eavesdrop ISO 14443B"},
 769         {"sri512read",  CmdSri512Read,  0, "Read contents of a SRI512 tag"},
 770         {"srix4kread",  CmdSrix4kRead,  0, "Read contents of a SRIX4K tag"},
 771         {"sriwrite",    CmdSriWrite,    0, "Write data to a SRI512 | SRIX4K tag"},
 772         {"raw",         CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},
 773         //{"calcSrix4",   srix4kchksum, 1, "a srix4k checksum test"},
 774         {NULL, NULL, 0, NULL}
 775 };
 776
 777 int CmdHF14B(const char *Cmd)
 778 {
 779         CmdsParse(CommandTable, Cmd);
 780         return 0;
 781 }
 782
 783 int CmdHelp(const char *Cmd)
 784 {
 785         CmdsHelp(CommandTable);
 786         return 0;
 787 }