1 //----------------------------------------------------------------------------- 
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com> 
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or, 
   5 // at your option, any later version. See the LICENSE.txt file for the text of 
   7 //----------------------------------------------------------------------------- 
   8 // High frequency commands 
   9 //----------------------------------------------------------------------------- 
  13 #include "proxmark3.h" 
  16 #include "cmdparser.h" 
  22 #include "cmdhflegic.h" 
  23 #include "cmdhficlass.h" 
  26 #include "protocols.h" 
  28 static int CmdHelp(const char *Cmd
); 
  30 int CmdHFTune(const char *Cmd
) 
  32   UsbCommand c
={CMD_MEASURE_ANTENNA_TUNING_HF
}; 
  38 void annotateIso14443a(char *exp
, size_t size
, uint8_t* cmd
, uint8_t cmdsize
) 
  42         case ISO14443A_CMD_WUPA
:        snprintf(exp
,size
,"WUPA"); break; 
  43         case ISO14443A_CMD_ANTICOLL_OR_SELECT
:{ 
  44                 // 93 20 = Anticollision (usage: 9320 - answer: 4bytes UID+1byte UID-bytes-xor) 
  45                 // 93 70 = Select (usage: 9370+5bytes 9320 answer - answer: 1byte SAK) 
  48                         snprintf(exp
,size
,"SELECT_UID"); break; 
  51                         snprintf(exp
,size
,"ANTICOLL"); break; 
  54         case ISO14443A_CMD_ANTICOLL_OR_SELECT_2
:{ 
  55                 //95 20 = Anticollision of cascade level2 
  56                 //95 70 = Select of cascade level2 
  59                         snprintf(exp
,size
,"SELECT_UID-2"); break; 
  62                         snprintf(exp
,size
,"ANTICOLL-2"); break; 
  65         case ISO14443A_CMD_REQA
:                snprintf(exp
,size
,"REQA"); break; 
  66         case ISO14443A_CMD_READBLOCK
:   snprintf(exp
,size
,"READBLOCK(%d)",cmd
[1]); break; 
  67         case ISO14443A_CMD_WRITEBLOCK
:  snprintf(exp
,size
,"WRITEBLOCK(%d)",cmd
[1]); break; 
  68         case ISO14443A_CMD_HALT
:                snprintf(exp
,size
,"HALT"); break; 
  69         case ISO14443A_CMD_RATS
:                snprintf(exp
,size
,"RATS"); break; 
  70         case MIFARE_CMD_INC
:                    snprintf(exp
,size
,"INC(%d)",cmd
[1]); break; 
  71         case MIFARE_CMD_DEC
:                    snprintf(exp
,size
,"DEC(%d)",cmd
[1]); break; 
  72         case MIFARE_CMD_RESTORE
:                snprintf(exp
,size
,"RESTORE(%d)",cmd
[1]); break; 
  73         case MIFARE_CMD_TRANSFER
:               snprintf(exp
,size
,"TRANSFER(%d)",cmd
[1]); break; 
  74         case MIFARE_AUTH_KEYA
:{ 
  76                         snprintf(exp
,size
,"AUTH-A(%d)",cmd
[1]);  
  78                         //      case MIFARE_ULEV1_VERSION :  both 0x60. 
  79                         snprintf(exp
,size
,"EV1 VERSION"); 
  82         case MIFARE_AUTH_KEYB
:                  snprintf(exp
,size
,"AUTH-B(%d)",cmd
[1]); break; 
  83         case MIFARE_MAGICWUPC1
:                 snprintf(exp
,size
,"MAGIC WUPC1"); break; 
  84         case MIFARE_MAGICWUPC2
:                 snprintf(exp
,size
,"MAGIC WUPC2"); break; 
  85         case MIFARE_MAGICWIPEC
:                 snprintf(exp
,size
,"MAGIC WIPEC"); break; 
  86         case MIFARE_ULC_AUTH_1
:         snprintf(exp
,size
,"AUTH "); break; 
  87         case MIFARE_ULC_AUTH_2
:         snprintf(exp
,size
,"AUTH_ANSW"); break; 
  88         case MIFARE_ULEV1_AUTH
: 
  90                         snprintf(exp
,size
,"PWD-AUTH KEY: 0x%02x%02x%02x%02x", cmd
[1], cmd
[2], cmd
[3], cmd
[4] ); 
  92                         snprintf(exp
,size
,"PWD-AUTH"); 
  94         case MIFARE_ULEV1_FASTREAD
:{ 
  95                 if ( cmdsize 
>=3 && cmd
[2] <= 0xE6) 
  96                         snprintf(exp
,size
,"READ RANGE (%d-%d)",cmd
[1],cmd
[2]);  
  98                         snprintf(exp
,size
,"?"); 
 101         case MIFARE_ULC_WRITE
:{ 
 103                         snprintf(exp
,size
,"WRITEBLOCK(%d)",cmd
[1]);  
 105                         snprintf(exp
,size
,"?"); 
 108         case MIFARE_ULEV1_READ_CNT
:{ 
 110                         snprintf(exp
,size
,"READ CNT(%d)",cmd
[1]); 
 112                         snprintf(exp
,size
,"?"); 
 115         case MIFARE_ULEV1_INCR_CNT
:{ 
 117                         snprintf(exp
,size
,"INCR(%d)",cmd
[1]); 
 119                         snprintf(exp
,size
,"?"); 
 122         case MIFARE_ULEV1_READSIG
:              snprintf(exp
,size
,"READ_SIG"); break; 
 123         case MIFARE_ULEV1_CHECKTEAR
:    snprintf(exp
,size
,"CHK_TEARING(%d)",cmd
[1]); break; 
 124         case MIFARE_ULEV1_VCSL
:         snprintf(exp
,size
,"VCSL"); break; 
 125         default:                                                snprintf(exp
,size
,"?"); break; 
 130 void annotateIclass(char *exp
, size_t size
, uint8_t* cmd
, uint8_t cmdsize
) 
 134         case ICLASS_CMD_ACTALL
:      snprintf(exp
,size
,"ACTALL"); break; 
 135         case ICLASS_CMD_READ_OR_IDENTIFY
:{ 
 137                         snprintf(exp
,size
,"READ(%d)",cmd
[1]); 
 139                         snprintf(exp
,size
,"IDENTIFY"); 
 143         case ICLASS_CMD_SELECT
:      snprintf(exp
,size
,"SELECT"); break; 
 144         case ICLASS_CMD_PAGESEL
:     snprintf(exp
,size
,"PAGESEL(%d)", cmd
[1]); break; 
 145         case ICLASS_CMD_READCHECK_KC
:snprintf(exp
,size
,"READCHECK[Kc](%d)", cmd
[1]); break; 
 146         case ICLASS_CMD_READCHECK_KD
:snprintf(exp
,size
,"READCHECK[Kd](%d)", cmd
[1]); break; 
 147         case ICLASS_CMD_CHECK
:       snprintf(exp
,size
,"CHECK"); break; 
 148         case ICLASS_CMD_DETECT
:      snprintf(exp
,size
,"DETECT"); break; 
 149         case ICLASS_CMD_HALT
:        snprintf(exp
,size
,"HALT"); break; 
 150         case ICLASS_CMD_UPDATE
:      snprintf(exp
,size
,"UPDATE(%d)",cmd
[1]); break; 
 151         case ICLASS_CMD_ACT
:         snprintf(exp
,size
,"ACT"); break; 
 152         case ICLASS_CMD_READ4
:       snprintf(exp
,size
,"READ4(%d)",cmd
[1]); break; 
 153         default:                     snprintf(exp
,size
,"?"); break; 
 158 void annotateIso15693(char *exp
, size_t size
, uint8_t* cmd
, uint8_t cmdsize
) 
 164                 case ISO15693_INVENTORY           
:snprintf(exp
, size
, "INVENTORY");break; 
 165                 case ISO15693_STAYQUIET           
:snprintf(exp
, size
, "STAY_QUIET");break; 
 166                 default:                     snprintf(exp
,size
,"?"); break; 
 169         }else if(cmd
[0] == 0x02) 
 173                 case ISO15693_READBLOCK            
:snprintf(exp
, size
, "READBLOCK");break; 
 174                 case ISO15693_WRITEBLOCK           
:snprintf(exp
, size
, "WRITEBLOCK");break; 
 175                 case ISO15693_LOCKBLOCK            
:snprintf(exp
, size
, "LOCKBLOCK");break; 
 176                 case ISO15693_READ_MULTI_BLOCK     
:snprintf(exp
, size
, "READ_MULTI_BLOCK");break; 
 177                 case ISO15693_SELECT               
:snprintf(exp
, size
, "SELECT");break; 
 178                 case ISO15693_RESET_TO_READY       
:snprintf(exp
, size
, "RESET_TO_READY");break; 
 179                 case ISO15693_WRITE_AFI            
:snprintf(exp
, size
, "WRITE_AFI");break; 
 180                 case ISO15693_LOCK_AFI             
:snprintf(exp
, size
, "LOCK_AFI");break; 
 181                 case ISO15693_WRITE_DSFID          
:snprintf(exp
, size
, "WRITE_DSFID");break; 
 182                 case ISO15693_LOCK_DSFID           
:snprintf(exp
, size
, "LOCK_DSFID");break; 
 183                 case ISO15693_GET_SYSTEM_INFO      
:snprintf(exp
, size
, "GET_SYSTEM_INFO");break; 
 184                 case ISO15693_READ_MULTI_SECSTATUS 
:snprintf(exp
, size
, "READ_MULTI_SECSTATUS");break; 
 185                 default:                            snprintf(exp
,size
,"?"); break; 
 192 0E xx = SELECT ID (xx = Chip-ID) 
 194 08 yy = Read Block (yy = block number) 
 195 09 yy dd dd dd dd = Write Block (yy = block number; dd dd dd dd = data to be written) 
 196 0C = Reset to Inventory 
 198 0A 11 22 33 44 55 66 = Authenticate (11 22 33 44 55 66 = data to authenticate) 
 201 void annotateIso14443b(char *exp
, size_t size
, uint8_t* cmd
, uint8_t cmdsize
) 
 204         case ISO14443B_REQB   
: snprintf(exp
,size
,"REQB");break; 
 205         case ISO14443B_ATTRIB 
: snprintf(exp
,size
,"ATTRIB");break; 
 206         case ISO14443B_HALT   
: snprintf(exp
,size
,"HALT");break; 
 207         case ISO14443B_INITIATE     
: snprintf(exp
,size
,"INITIATE");break; 
 208         case ISO14443B_SELECT       
: snprintf(exp
,size
,"SELECT(%d)",cmd
[1]);break; 
 209         case ISO14443B_GET_UID      
: snprintf(exp
,size
,"GET UID");break; 
 210         case ISO14443B_READ_BLK     
: snprintf(exp
,size
,"READ_BLK(%d)", cmd
[1]);break; 
 211         case ISO14443B_WRITE_BLK    
: snprintf(exp
,size
,"WRITE_BLK(%d)",cmd
[1]);break; 
 212         case ISO14443B_RESET        
: snprintf(exp
,size
,"RESET");break; 
 213         case ISO14443B_COMPLETION   
: snprintf(exp
,size
,"COMPLETION");break; 
 214         case ISO14443B_AUTHENTICATE 
: snprintf(exp
,size
,"AUTHENTICATE");break; 
 215         default                     : snprintf(exp
,size 
,"?");break; 
 221  * @brief iso14443B_CRC_Ok Checks CRC in command or response 
 225  * @return  0 : CRC-command, CRC not ok 
 226  *          1 : CRC-command, CRC ok 
 227  *          2 : Not crc-command 
 230 uint8_t iso14443B_CRC_check(bool isResponse
, uint8_t* data
, uint8_t len
) 
 234         if(len 
<= 2) return 2; 
 236         ComputeCrc14443(CRC_14443_B
, data
, len
-2, &b1
, &b2
); 
 237         if(b1 
!= data
[len
-2] || b2 
!= data
[len
-1]) { 
 244  * @brief iclass_CRC_Ok Checks CRC in command or response 
 248  * @return  0 : CRC-command, CRC not ok 
 249  *              1 : CRC-command, CRC ok 
 250  *          2 : Not crc-command 
 252 uint8_t iclass_CRC_check(bool isResponse
, uint8_t* data
, uint8_t len
) 
 254         if(len 
< 4) return 2;//CRC commands (and responses) are all at least 4 bytes 
 258         if(!isResponse
)//Commands to tag 
 261                   These commands should have CRC. Total length leftmost 
 264                   12 UPDATE - unsecured, ends with CRC16 
 265                   14 UPDATE - secured, ends with signature instead 
 268                 if(len 
== 4 || len 
== 12)//Covers three of them 
 270                         //Don't include the command byte 
 271                         ComputeCrc14443(CRC_ICLASS
, (data
+1), len
-3, &b1
, &b2
); 
 272                         return b1 
== data
[len 
-2] && b2 
== data
[len
-1]; 
 277                 These tag responses should have CRC. Total length leftmost 
 279                 10  READ                data[8] crc[2] 
 280                 34  READ4               data[32]crc[2] 
 281                 10  UPDATE      data[8] crc[2] 
 282                 10 SELECT       csn[8] crc[2] 
 283                 10  IDENTIFY  asnb[8] crc[2] 
 284                 10  PAGESEL   block1[8] crc[2] 
 285                 10  DETECT    csn[8] crc[2] 
 289                 4  CHECK                chip_response[4] 
 294                 In conclusion, without looking at the command; any response 
 295                 of length 10 or 34 should have CRC 
 297                 if(len 
!= 10 && len 
!= 34) return true; 
 299                 ComputeCrc14443(CRC_ICLASS
, data
, len
-2, &b1
, &b2
); 
 300                 return b1 
== data
[len 
-2] && b2 
== data
[len
-1]; 
 304 uint16_t printTraceLine(uint16_t tracepos
, uint16_t traceLen
, uint8_t *trace
, uint8_t protocol
, bool showWaitCycles
) 
 307         uint16_t duration
, data_len
, parity_len
; 
 309         uint32_t timestamp
, first_timestamp
, EndOfTransmissionTimestamp
; 
 310         char explanation
[30] = {0}; 
 312         if (tracepos 
+ sizeof(uint32_t) + sizeof(uint16_t) + sizeof(uint16_t) > traceLen
) return traceLen
; 
 314         first_timestamp 
= *((uint32_t *)(trace
)); 
 315         timestamp 
= *((uint32_t *)(trace 
+ tracepos
)); 
 318         duration 
= *((uint16_t *)(trace 
+ tracepos
)); 
 320         data_len 
= *((uint16_t *)(trace 
+ tracepos
)); 
 323         if (data_len 
& 0x8000) { 
 329         parity_len 
= (data_len
-1)/8 + 1; 
 331         if (tracepos 
+ data_len 
+ parity_len 
> traceLen
) { 
 334         uint8_t *frame 
= trace 
+ tracepos
; 
 335         tracepos 
+= data_len
; 
 336         uint8_t *parityBytes 
= trace 
+ tracepos
; 
 337         tracepos 
+= parity_len
; 
 339         //Check the CRC status 
 340         uint8_t crcStatus 
= 2; 
 344                 if(protocol 
== ICLASS
) 
 346                         crcStatus 
= iclass_CRC_check(isResponse
, frame
, data_len
); 
 348                 }else if (protocol 
== ISO_14443B
) 
 350                         crcStatus 
= iso14443B_CRC_check(isResponse
, frame
, data_len
); 
 352                 else if (protocol 
== ISO_14443A
){//Iso 14443a 
 354                         ComputeCrc14443(CRC_14443_A
, frame
, data_len
-2, &b1
, &b2
); 
 356                         if (b1 
!= frame
[data_len
-2] || b2 
!= frame
[data_len
-1]) { 
 357                                 if(!(isResponse 
& (data_len 
< 6))) 
 364         //0 CRC-command, CRC not ok 
 365         //1 CRC-command, CRC ok 
 368         //--- Draw the data column 
 369         //char line[16][110]; 
 372         for (int j 
= 0; j 
< data_len 
&& j
/16 < 16; j
++) { 
 374                 int oddparity 
= 0x01; 
 377                 for (k
=0 ; k
<8 ; k
++) { 
 378                         oddparity 
^= (((frame
[j
] & 0xFF) >> k
) & 0x01); 
 380                 uint8_t parityBits 
= parityBytes
[j
>>3]; 
 381                 if (protocol 
!= ISO_14443B 
&& (isResponse 
|| protocol 
== ISO_14443A
) && (oddparity 
!= ((parityBits 
>> (7-(j
&0x0007))) & 0x01))) { 
 382                         snprintf(line
[j
/16]+(( j 
% 16) * 4),110, "%02x! ", frame
[j
]); 
 385                         snprintf(line
[j
/16]+(( j 
% 16) * 4),110, "%02x  ", frame
[j
]); 
 391                 char *pos1 
= line
[(data_len
-2)/16]+(((data_len
-2) % 16) * 4)-1; 
 393                 char *pos2 
= line
[(data_len
)/16]+(((data_len
) % 16) * 4)-2; 
 399                         sprintf(line
[0],"<empty trace - possible error>"); 
 402         //--- Draw the CRC column 
 404         char *crc 
= (crcStatus 
== 0 ? "!crc" : (crcStatus 
== 1 ? " ok " : "    ")); 
 406         EndOfTransmissionTimestamp 
= timestamp 
+ duration
; 
 410                 if(protocol 
== ICLASS
) 
 411                         annotateIclass(explanation
,sizeof(explanation
),frame
,data_len
); 
 412                 else if (protocol 
== ISO_14443A
) 
 413                         annotateIso14443a(explanation
,sizeof(explanation
),frame
,data_len
); 
 414                 else if(protocol 
== ISO_14443B
) 
 415                         annotateIso14443b(explanation
,sizeof(explanation
),frame
,data_len
); 
 418         int num_lines 
= MIN((data_len 
- 1)/16 + 1, 16); 
 419         for (int j 
= 0; j 
< num_lines 
; j
++) { 
 421                         PrintAndLog(" %9d | %9d | %s | %-64s| %s| %s", 
 422                                 (timestamp 
- first_timestamp
), 
 423                                 (EndOfTransmissionTimestamp 
- first_timestamp
), 
 424                                 (isResponse 
? "Tag" : "Rdr"), 
 426                                 (j 
== num_lines
-1) ? crc 
: "    ", 
 427                                 (j 
== num_lines
-1) ? explanation 
: ""); 
 429                         PrintAndLog("           |           |     | %-64s| %s| %s", 
 431                                 (j 
== num_lines
-1)?crc
:"    ", 
 432                                 (j 
== num_lines
-1) ? explanation 
: ""); 
 436         if (tracepos 
+ sizeof(uint32_t) + sizeof(uint16_t) + sizeof(uint16_t) > traceLen
) return traceLen
; 
 438         bool next_isResponse 
= *((uint16_t *)(trace 
+ tracepos 
+ 6)) & 0x8000; 
 440         if (showWaitCycles 
&& !isResponse 
&& next_isResponse
) { 
 441                 uint32_t next_timestamp 
= *((uint32_t *)(trace 
+ tracepos
)); 
 442                 if (next_timestamp 
!= 0x44444444) { 
 443                         PrintAndLog(" %9d | %9d | %s | fdt (Frame Delay Time): %d", 
 444                                 (EndOfTransmissionTimestamp 
- first_timestamp
), 
 445                                 (next_timestamp 
- first_timestamp
), 
 447                                 (next_timestamp 
- EndOfTransmissionTimestamp
)); 
 455 int CmdHFList(const char *Cmd
) 
 457         bool showWaitCycles 
= false; 
 459         int tlen 
= param_getstr(Cmd
,0,type
); 
 460         char param 
= param_getchar(Cmd
, 1); 
 462         uint8_t protocol 
= 0; 
 468         if(param 
== 'h' || (param 
!=0 && param 
!= 'f')) 
 474                 if(strcmp(type
, "iclass") == 0) 
 477                 }else if(strcmp(type
, "14a") == 0) 
 479                         protocol 
= ISO_14443A
; 
 481                 else if(strcmp(type
, "14b") == 0) 
 483                         protocol 
= ISO_14443B
; 
 484                 }else if(strcmp(type
,"raw")== 0) 
 486                         protocol 
= -1;//No crc, no annotations 
 493                 PrintAndLog("List protocol data in trace buffer."); 
 494                 PrintAndLog("Usage:  hf list <protocol> [f]"); 
 495                 PrintAndLog("    f      - show frame delay times as well"); 
 496                 PrintAndLog("Supported <protocol> values:"); 
 497                 PrintAndLog("    raw    - just show raw data without annotations"); 
 498                 PrintAndLog("    14a    - interpret data as iso14443a communications"); 
 499                 PrintAndLog("    14b    - interpret data as iso14443b communications"); 
 500                 PrintAndLog("    iclass - interpret data as iclass communications"); 
 502                 PrintAndLog("example: hf list 14a f"); 
 503                 PrintAndLog("example: hf list iclass"); 
 509                 showWaitCycles 
= true; 
 514         uint16_t tracepos 
= 0; 
 515         trace 
= malloc(USB_CMD_DATA_SIZE
); 
 517         // Query for the size of the trace 
 519         GetFromBigBuf(trace
, USB_CMD_DATA_SIZE
, 0); 
 520         WaitForResponse(CMD_ACK
, &response
); 
 521         uint16_t traceLen 
= response
.arg
[2]; 
 522         if (traceLen 
> USB_CMD_DATA_SIZE
) { 
 523                 uint8_t *p 
= realloc(trace
, traceLen
); 
 525                         PrintAndLog("Cannot allocate memory for trace"); 
 530                 GetFromBigBuf(trace
, traceLen
, 0); 
 531                 WaitForResponse(CMD_ACK
, NULL
); 
 534         PrintAndLog("Recorded Activity (TraceLen = %d bytes)", traceLen
); 
 536         PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer"); 
 537         PrintAndLog("iso14443a - All times are in carrier periods (1/13.56Mhz)"); 
 538         PrintAndLog("iClass    - Timings are not as accurate"); 
 540         PrintAndLog("     Start |       End | Src | Data (! denotes parity error)                                   | CRC | Annotation         |"); 
 541         PrintAndLog("-----------|-----------|-----|-----------------------------------------------------------------|-----|--------------------|"); 
 543         while(tracepos 
< traceLen
) 
 545                 tracepos 
= printTraceLine(tracepos
, traceLen
, trace
, protocol
, showWaitCycles
); 
 552 int CmdHFSearch(const char *Cmd
){ 
 555         ans 
= CmdHF14AReader("s"); 
 557                 PrintAndLog("\nValid ISO14443A Tag Found - Quiting Search\n"); 
 560         ans 
= HF14BInfo(false); 
 562                 PrintAndLog("\nValid ISO14443B Tag Found - Quiting Search\n"); 
 565         ans 
= HFiClassReader("", false, false); 
 567                 PrintAndLog("\nValid iClass Tag (or PicoPass Tag) Found - Quiting Search\n"); 
 570         ans 
= HF15Reader("", false); 
 572                 PrintAndLog("\nValid ISO15693 Tag Found - Quiting Search\n"); 
 575         PrintAndLog("\nno known/supported 13.56 MHz tags found\n"); 
 579 static command_t CommandTable
[] =  
 581   {"help",        CmdHelp
,          1, "This help"}, 
 582   {"14a",         CmdHF14A
,         1, "{ ISO14443A RFIDs... }"}, 
 583   {"14b",         CmdHF14B
,         1, "{ ISO14443B RFIDs... }"}, 
 584   {"15",          CmdHF15
,          1, "{ ISO15693 RFIDs... }"}, 
 585   {"epa",         CmdHFEPA
,         1, "{ German Identification Card... }"}, 
 586   {"legic",       CmdHFLegic
,       0, "{ LEGIC RFIDs... }"}, 
 587   {"iclass",      CmdHFiClass
,      1, "{ ICLASS RFIDs... }"}, 
 588   {"mf",          CmdHFMF
,          1, "{ MIFARE RFIDs... }"}, 
 589   {"mfu",         CmdHFMFUltra
,     1, "{ MIFARE Ultralight RFIDs... }"}, 
 590   {"tune",        CmdHFTune
,        0, "Continuously measure HF antenna tuning"}, 
 591   {"list",        CmdHFList
,        1, "List protocol data in trace buffer"}, 
 592   {"search",      CmdHFSearch
,      1, "Search for known HF tags [preliminary]"}, 
 593         {NULL
, NULL
, 0, NULL
} 
 596 int CmdHF(const char *Cmd
) 
 598   CmdsParse(CommandTable
, Cmd
); 
 602 int CmdHelp(const char *Cmd
) 
 604   CmdsHelp(CommandTable
);