1 //----------------------------------------------------------------------------- 
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com> 
   4 // This code is licensed to you under the terms of the GNU GPL, version 2 or, 
   5 // at your option, any later version. See the LICENSE.txt file for the text of 
   7 //----------------------------------------------------------------------------- 
   8 // High frequency commands 
   9 //----------------------------------------------------------------------------- 
  14 #include "proxmark3.h" 
  18 #include "iso14443crc.h" 
  21 #include "cmdparser.h" 
  27 #include "cmdhflegic.h" 
  28 #include "cmdhficlass.h" 
  31 #include "cmdhftopaz.h" 
  32 #include "protocols.h" 
  34 static int CmdHelp(const char *Cmd
); 
  36 int CmdHFTune(const char *Cmd
) 
  38   UsbCommand c
={CMD_MEASURE_ANTENNA_TUNING_HF
}; 
  44 void annotateIso14443a(char *exp
, size_t size
, uint8_t* cmd
, uint8_t cmdsize
) 
  48         case ISO14443A_CMD_WUPA
:        snprintf(exp
,size
,"WUPA"); break; 
  49         case ISO14443A_CMD_ANTICOLL_OR_SELECT
:{ 
  50                 // 93 20 = Anticollision (usage: 9320 - answer: 4bytes UID+1byte UID-bytes-xor) 
  51                 // 93 70 = Select (usage: 9370+5bytes 9320 answer - answer: 1byte SAK) 
  54                         snprintf(exp
,size
,"SELECT_UID"); break; 
  57                         snprintf(exp
,size
,"ANTICOLL"); break; 
  60         case ISO14443A_CMD_ANTICOLL_OR_SELECT_2
:{ 
  61                 //95 20 = Anticollision of cascade level2 
  62                 //95 70 = Select of cascade level2 
  65                         snprintf(exp
,size
,"SELECT_UID-2"); break; 
  68                         snprintf(exp
,size
,"ANTICOLL-2"); break; 
  71         case ISO14443A_CMD_REQA
:                snprintf(exp
,size
,"REQA"); break; 
  72         case ISO14443A_CMD_READBLOCK
:   snprintf(exp
,size
,"READBLOCK(%d)",cmd
[1]); break; 
  73         case ISO14443A_CMD_WRITEBLOCK
:  snprintf(exp
,size
,"WRITEBLOCK(%d)",cmd
[1]); break; 
  74         case ISO14443A_CMD_HALT
:                snprintf(exp
,size
,"HALT"); break; 
  75         case ISO14443A_CMD_RATS
:                snprintf(exp
,size
,"RATS"); break; 
  76         case MIFARE_CMD_INC
:                    snprintf(exp
,size
,"INC(%d)",cmd
[1]); break; 
  77         case MIFARE_CMD_DEC
:                    snprintf(exp
,size
,"DEC(%d)",cmd
[1]); break; 
  78         case MIFARE_CMD_RESTORE
:                snprintf(exp
,size
,"RESTORE(%d)",cmd
[1]); break; 
  79         case MIFARE_CMD_TRANSFER
:               snprintf(exp
,size
,"TRANSFER(%d)",cmd
[1]); break; 
  80         case MIFARE_AUTH_KEYA
:{ 
  82                         snprintf(exp
,size
,"AUTH-A(%d)",cmd
[1]);  
  84                         //      case MIFARE_ULEV1_VERSION :  both 0x60. 
  85                         snprintf(exp
,size
,"EV1 VERSION"); 
  88         case MIFARE_AUTH_KEYB
:                  snprintf(exp
,size
,"AUTH-B(%d)",cmd
[1]); break; 
  89         case MIFARE_MAGICWUPC1
:                 snprintf(exp
,size
,"MAGIC WUPC1"); break; 
  90         case MIFARE_MAGICWUPC2
:                 snprintf(exp
,size
,"MAGIC WUPC2"); break; 
  91         case MIFARE_MAGICWIPEC
:                 snprintf(exp
,size
,"MAGIC WIPEC"); break; 
  92         case MIFARE_ULC_AUTH_1
:         snprintf(exp
,size
,"AUTH "); break; 
  93         case MIFARE_ULC_AUTH_2
:         snprintf(exp
,size
,"AUTH_ANSW"); break; 
  94         case MIFARE_ULEV1_AUTH
: 
  96                         snprintf(exp
,size
,"PWD-AUTH KEY: 0x%02x%02x%02x%02x", cmd
[1], cmd
[2], cmd
[3], cmd
[4] ); 
  98                         snprintf(exp
,size
,"PWD-AUTH"); 
 100         case MIFARE_ULEV1_FASTREAD
:{ 
 101                 if ( cmdsize 
>=3 && cmd
[2] <= 0xE6) 
 102                         snprintf(exp
,size
,"READ RANGE (%d-%d)",cmd
[1],cmd
[2]);  
 104                         snprintf(exp
,size
,"?"); 
 107         case MIFARE_ULC_WRITE
:{ 
 109                         snprintf(exp
,size
,"WRITEBLOCK(%d)",cmd
[1]);  
 111                         snprintf(exp
,size
,"?"); 
 114         case MIFARE_ULEV1_READ_CNT
:{ 
 116                         snprintf(exp
,size
,"READ CNT(%d)",cmd
[1]); 
 118                         snprintf(exp
,size
,"?"); 
 121         case MIFARE_ULEV1_INCR_CNT
:{ 
 123                         snprintf(exp
,size
,"INCR(%d)",cmd
[1]); 
 125                         snprintf(exp
,size
,"?"); 
 128         case MIFARE_ULEV1_READSIG
:              snprintf(exp
,size
,"READ_SIG"); break; 
 129         case MIFARE_ULEV1_CHECKTEAR
:    snprintf(exp
,size
,"CHK_TEARING(%d)",cmd
[1]); break; 
 130         case MIFARE_ULEV1_VCSL
:         snprintf(exp
,size
,"VCSL"); break; 
 131         default:                                                snprintf(exp
,size
,"?"); break; 
 136 void annotateIclass(char *exp
, size_t size
, uint8_t* cmd
, uint8_t cmdsize
) 
 140         case ICLASS_CMD_ACTALL
:      snprintf(exp
,size
,"ACTALL"); break; 
 141         case ICLASS_CMD_READ_OR_IDENTIFY
:{ 
 143                         snprintf(exp
,size
,"READ(%d)",cmd
[1]); 
 145                         snprintf(exp
,size
,"IDENTIFY"); 
 149         case ICLASS_CMD_SELECT
:      snprintf(exp
,size
,"SELECT"); break; 
 150         case ICLASS_CMD_PAGESEL
:     snprintf(exp
,size
,"PAGESEL(%d)", cmd
[1]); break; 
 151         case ICLASS_CMD_READCHECK_KC
:snprintf(exp
,size
,"READCHECK[Kc](%d)", cmd
[1]); break; 
 152         case ICLASS_CMD_READCHECK_KD
:snprintf(exp
,size
,"READCHECK[Kd](%d)", cmd
[1]); break; 
 153         case ICLASS_CMD_CHECK
:       snprintf(exp
,size
,"CHECK"); break; 
 154         case ICLASS_CMD_DETECT
:      snprintf(exp
,size
,"DETECT"); break; 
 155         case ICLASS_CMD_HALT
:        snprintf(exp
,size
,"HALT"); break; 
 156         case ICLASS_CMD_UPDATE
:      snprintf(exp
,size
,"UPDATE(%d)",cmd
[1]); break; 
 157         case ICLASS_CMD_ACT
:         snprintf(exp
,size
,"ACT"); break; 
 158         case ICLASS_CMD_READ4
:       snprintf(exp
,size
,"READ4(%d)",cmd
[1]); break; 
 159         default:                     snprintf(exp
,size
,"?"); break; 
 164 void annotateIso15693(char *exp
, size_t size
, uint8_t* cmd
, uint8_t cmdsize
) 
 170                 case ISO15693_INVENTORY           
:snprintf(exp
, size
, "INVENTORY");break; 
 171                 case ISO15693_STAYQUIET           
:snprintf(exp
, size
, "STAY_QUIET");break; 
 172                 default:                     snprintf(exp
,size
,"?"); break; 
 175         }else if(cmd
[0] == 0x02) 
 179                 case ISO15693_READBLOCK            
:snprintf(exp
, size
, "READBLOCK");break; 
 180                 case ISO15693_WRITEBLOCK           
:snprintf(exp
, size
, "WRITEBLOCK");break; 
 181                 case ISO15693_LOCKBLOCK            
:snprintf(exp
, size
, "LOCKBLOCK");break; 
 182                 case ISO15693_READ_MULTI_BLOCK     
:snprintf(exp
, size
, "READ_MULTI_BLOCK");break; 
 183                 case ISO15693_SELECT               
:snprintf(exp
, size
, "SELECT");break; 
 184                 case ISO15693_RESET_TO_READY       
:snprintf(exp
, size
, "RESET_TO_READY");break; 
 185                 case ISO15693_WRITE_AFI            
:snprintf(exp
, size
, "WRITE_AFI");break; 
 186                 case ISO15693_LOCK_AFI             
:snprintf(exp
, size
, "LOCK_AFI");break; 
 187                 case ISO15693_WRITE_DSFID          
:snprintf(exp
, size
, "WRITE_DSFID");break; 
 188                 case ISO15693_LOCK_DSFID           
:snprintf(exp
, size
, "LOCK_DSFID");break; 
 189                 case ISO15693_GET_SYSTEM_INFO      
:snprintf(exp
, size
, "GET_SYSTEM_INFO");break; 
 190                 case ISO15693_READ_MULTI_SECSTATUS 
:snprintf(exp
, size
, "READ_MULTI_SECSTATUS");break; 
 191                 default:                            snprintf(exp
,size
,"?"); break; 
 197 void annotateTopaz(char *exp
, size_t size
, uint8_t* cmd
, uint8_t cmdsize
) 
 200                 case TOPAZ_REQA                                         
:snprintf(exp
, size
, "REQA");break; 
 201                 case TOPAZ_WUPA                                         
:snprintf(exp
, size
, "WUPA");break; 
 202                 case TOPAZ_RID                                          
:snprintf(exp
, size
, "RID");break; 
 203                 case TOPAZ_RALL                                         
:snprintf(exp
, size
, "RALL");break; 
 204                 case TOPAZ_READ                                         
:snprintf(exp
, size
, "READ");break; 
 205                 case TOPAZ_WRITE_E                                      
:snprintf(exp
, size
, "WRITE-E");break; 
 206                 case TOPAZ_WRITE_NE                                     
:snprintf(exp
, size
, "WRITE-NE");break; 
 207                 case TOPAZ_RSEG                                         
:snprintf(exp
, size
, "RSEG");break; 
 208                 case TOPAZ_READ8                                        
:snprintf(exp
, size
, "READ8");break; 
 209                 case TOPAZ_WRITE_E8                                     
:snprintf(exp
, size
, "WRITE-E8");break; 
 210                 case TOPAZ_WRITE_NE8                            
:snprintf(exp
, size
, "WRITE-NE8");break; 
 211                 default:                            snprintf(exp
,size
,"?"); break; 
 218 0E xx = SELECT ID (xx = Chip-ID) 
 220 08 yy = Read Block (yy = block number) 
 221 09 yy dd dd dd dd = Write Block (yy = block number; dd dd dd dd = data to be written) 
 222 0C = Reset to Inventory 
 224 0A 11 22 33 44 55 66 = Authenticate (11 22 33 44 55 66 = data to authenticate) 
 227 void annotateIso14443b(char *exp
, size_t size
, uint8_t* cmd
, uint8_t cmdsize
) 
 230         case ISO14443B_REQB   
: snprintf(exp
,size
,"REQB");break; 
 231         case ISO14443B_ATTRIB 
: snprintf(exp
,size
,"ATTRIB");break; 
 232         case ISO14443B_HALT   
: snprintf(exp
,size
,"HALT");break; 
 233         case ISO14443B_INITIATE     
: snprintf(exp
,size
,"INITIATE");break; 
 234         case ISO14443B_SELECT       
: snprintf(exp
,size
,"SELECT(%d)",cmd
[1]);break; 
 235         case ISO14443B_GET_UID      
: snprintf(exp
,size
,"GET UID");break; 
 236         case ISO14443B_READ_BLK     
: snprintf(exp
,size
,"READ_BLK(%d)", cmd
[1]);break; 
 237         case ISO14443B_WRITE_BLK    
: snprintf(exp
,size
,"WRITE_BLK(%d)",cmd
[1]);break; 
 238         case ISO14443B_RESET        
: snprintf(exp
,size
,"RESET");break; 
 239         case ISO14443B_COMPLETION   
: snprintf(exp
,size
,"COMPLETION");break; 
 240         case ISO14443B_AUTHENTICATE 
: snprintf(exp
,size
,"AUTHENTICATE");break; 
 241         default                     : snprintf(exp
,size 
,"?");break; 
 247  * @brief iso14443A_CRC_check Checks CRC in command or response 
 251  * @return  0 : CRC-command, CRC not ok 
 252  *          1 : CRC-command, CRC ok 
 253  *          2 : Not crc-command 
 256 uint8_t iso14443A_CRC_check(bool isResponse
, uint8_t* data
, uint8_t len
) 
 260         if(len 
<= 2) return 2; 
 262         if(isResponse 
& (len 
< 6)) return 2; 
 264         ComputeCrc14443(CRC_14443_A
, data
, len
-2, &b1
, &b2
); 
 265         if (b1 
!= data
[len
-2] || b2 
!= data
[len
-1]) { 
 274  * @brief iso14443B_CRC_check Checks CRC in command or response 
 278  * @return  0 : CRC-command, CRC not ok 
 279  *          1 : CRC-command, CRC ok 
 280  *          2 : Not crc-command 
 283 uint8_t iso14443B_CRC_check(bool isResponse
, uint8_t* data
, uint8_t len
) 
 287         if(len 
<= 2) return 2; 
 289         ComputeCrc14443(CRC_14443_B
, data
, len
-2, &b1
, &b2
); 
 290         if(b1 
!= data
[len
-2] || b2 
!= data
[len
-1]) { 
 298  * @brief iclass_CRC_Ok Checks CRC in command or response 
 302  * @return  0 : CRC-command, CRC not ok 
 303  *              1 : CRC-command, CRC ok 
 304  *          2 : Not crc-command 
 306 uint8_t iclass_CRC_check(bool isResponse
, uint8_t* data
, uint8_t len
) 
 308         if(len 
< 4) return 2;//CRC commands (and responses) are all at least 4 bytes 
 312         if(!isResponse
)//Commands to tag 
 315                   These commands should have CRC. Total length leftmost 
 318                   12 UPDATE - unsecured, ends with CRC16 
 319                   14 UPDATE - secured, ends with signature instead 
 322                 if(len 
== 4 || len 
== 12)//Covers three of them 
 324                         //Don't include the command byte 
 325                         ComputeCrc14443(CRC_ICLASS
, (data
+1), len
-3, &b1
, &b2
); 
 326                         return b1 
== data
[len 
-2] && b2 
== data
[len
-1]; 
 331                 These tag responses should have CRC. Total length leftmost 
 333                 10  READ                data[8] crc[2] 
 334                 34  READ4               data[32]crc[2] 
 335                 10  UPDATE      data[8] crc[2] 
 336                 10 SELECT       csn[8] crc[2] 
 337                 10  IDENTIFY  asnb[8] crc[2] 
 338                 10  PAGESEL   block1[8] crc[2] 
 339                 10  DETECT    csn[8] crc[2] 
 343                 4  CHECK                chip_response[4] 
 348                 In conclusion, without looking at the command; any response 
 349                 of length 10 or 34 should have CRC 
 351                 if(len 
!= 10 && len 
!= 34) return true; 
 353                 ComputeCrc14443(CRC_ICLASS
, data
, len
-2, &b1
, &b2
); 
 354                 return b1 
== data
[len 
-2] && b2 
== data
[len
-1]; 
 359 bool is_last_record(uint16_t tracepos
, uint8_t *trace
, uint16_t traceLen
) 
 361         return(tracepos 
+ sizeof(uint32_t) + sizeof(uint16_t) + sizeof(uint16_t) >= traceLen
); 
 365 bool next_record_is_response(uint16_t tracepos
, uint8_t *trace
) 
 367         uint16_t next_records_datalen 
= *((uint16_t *)(trace 
+ tracepos 
+ sizeof(uint32_t) + sizeof(uint16_t))); 
 369         return(next_records_datalen 
& 0x8000); 
 373 bool merge_topaz_reader_frames(uint32_t timestamp
, uint32_t *duration
, uint16_t *tracepos
, uint16_t traceLen
, uint8_t *trace
, uint8_t *frame
, uint8_t *topaz_reader_command
, uint16_t *data_len
) 
 376 #define MAX_TOPAZ_READER_CMD_LEN        16 
 378         uint32_t last_timestamp 
= timestamp 
+ *duration
; 
 380         if ((*data_len 
!= 1) || (frame
[0] == TOPAZ_WUPA
) || (frame
[0] == TOPAZ_REQA
)) return false; 
 382         memcpy(topaz_reader_command
, frame
, *data_len
); 
 384         while (!is_last_record(*tracepos
, trace
, traceLen
) && !next_record_is_response(*tracepos
, trace
)) { 
 385                 uint32_t next_timestamp 
= *((uint32_t *)(trace 
+ *tracepos
)); 
 386                 *tracepos 
+= sizeof(uint32_t); 
 387                 uint16_t next_duration 
= *((uint16_t *)(trace 
+ *tracepos
)); 
 388                 *tracepos 
+= sizeof(uint16_t); 
 389                 uint16_t next_data_len 
= *((uint16_t *)(trace 
+ *tracepos
)) & 0x7FFF; 
 390                 *tracepos 
+= sizeof(uint16_t); 
 391                 uint8_t *next_frame 
= (trace 
+ *tracepos
); 
 392                 *tracepos 
+= next_data_len
; 
 393                 if ((next_data_len 
== 1) && (*data_len 
+ next_data_len 
<= MAX_TOPAZ_READER_CMD_LEN
)) { 
 394                         memcpy(topaz_reader_command 
+ *data_len
, next_frame
, next_data_len
); 
 395                         *data_len 
+= next_data_len
; 
 396                         last_timestamp 
= next_timestamp 
+ next_duration
; 
 399                         *tracepos 
= *tracepos 
- next_data_len 
- sizeof(uint16_t) - sizeof(uint16_t) - sizeof(uint32_t); 
 402                 uint16_t next_parity_len 
= (next_data_len
-1)/8 + 1; 
 403                 *tracepos 
+= next_parity_len
; 
 406         *duration 
= last_timestamp 
- timestamp
; 
 412 uint16_t printTraceLine(uint16_t tracepos
, uint16_t traceLen
, uint8_t *trace
, uint8_t protocol
, bool showWaitCycles
, bool markCRCBytes
) 
 415         uint16_t data_len
, parity_len
; 
 417         uint8_t topaz_reader_command
[9]; 
 418         uint32_t timestamp
, first_timestamp
, EndOfTransmissionTimestamp
; 
 419         char explanation
[30] = {0}; 
 421         if (tracepos 
+ sizeof(uint32_t) + sizeof(uint16_t) + sizeof(uint16_t) > traceLen
) return traceLen
; 
 423         first_timestamp 
= *((uint32_t *)(trace
)); 
 424         timestamp 
= *((uint32_t *)(trace 
+ tracepos
)); 
 427         duration 
= *((uint16_t *)(trace 
+ tracepos
)); 
 429         data_len 
= *((uint16_t *)(trace 
+ tracepos
)); 
 432         if (data_len 
& 0x8000) { 
 438         parity_len 
= (data_len
-1)/8 + 1; 
 440         if (tracepos 
+ data_len 
+ parity_len 
> traceLen
) { 
 443         uint8_t *frame 
= trace 
+ tracepos
; 
 444         tracepos 
+= data_len
; 
 445         uint8_t *parityBytes 
= trace 
+ tracepos
; 
 446         tracepos 
+= parity_len
; 
 448         if (protocol 
== TOPAZ 
&& !isResponse
) { 
 449                 // topaz reader commands come in 1 or 9 separate frames with 7 or 8 Bits each. 
 451                 if (merge_topaz_reader_frames(timestamp
, &duration
, &tracepos
, traceLen
, trace
, frame
, topaz_reader_command
, &data_len
)) { 
 452                         frame 
= topaz_reader_command
; 
 456         //Check the CRC status 
 457         uint8_t crcStatus 
= 2; 
 462                                 crcStatus 
= iclass_CRC_check(isResponse
, frame
, data_len
); 
 466                                 crcStatus 
= iso14443B_CRC_check(isResponse
, frame
, data_len
);  
 469                                 crcStatus 
= iso14443A_CRC_check(isResponse
, frame
, data_len
); 
 475         //0 CRC-command, CRC not ok 
 476         //1 CRC-command, CRC ok 
 479         //--- Draw the data column 
 480         //char line[16][110]; 
 483         for (int j 
= 0; j 
< data_len 
&& j
/16 < 16; j
++) { 
 485                 uint8_t parityBits 
= parityBytes
[j
>>3]; 
 486                 if (protocol 
!= ISO_14443B 
&& (isResponse 
|| protocol 
== ISO_14443A
) && (oddparity8(frame
[j
]) != ((parityBits 
>> (7-(j
&0x0007))) & 0x01))) { 
 487                         snprintf(line
[j
/16]+(( j 
% 16) * 4),110, "%02x! ", frame
[j
]); 
 489                         snprintf(line
[j
/16]+(( j 
% 16) * 4), 110, " %02x ", frame
[j
]); 
 495                 if(crcStatus 
== 0 || crcStatus 
== 1) 
 497                         char *pos1 
= line
[(data_len
-2)/16]+(((data_len
-2) % 16) * 4); 
 499                         char *pos2 
= line
[(data_len
)/16]+(((data_len
) % 16) * 4); 
 500                         sprintf(pos2
, "%c", ']'); 
 507                         sprintf(line
[0],"<empty trace - possible error>"); 
 510         //--- Draw the CRC column 
 512         char *crc 
= (crcStatus 
== 0 ? "!crc" : (crcStatus 
== 1 ? " ok " : "    ")); 
 514         EndOfTransmissionTimestamp 
= timestamp 
+ duration
; 
 519                         case ICLASS
:            annotateIclass(explanation
,sizeof(explanation
),frame
,data_len
); break; 
 520                         case ISO_14443A
:        annotateIso14443a(explanation
,sizeof(explanation
),frame
,data_len
); break; 
 521                         case ISO_14443B
:        annotateIso14443b(explanation
,sizeof(explanation
),frame
,data_len
); break; 
 522                         case TOPAZ
:                     annotateTopaz(explanation
,sizeof(explanation
),frame
,data_len
); break; 
 527         int num_lines 
= MIN((data_len 
- 1)/16 + 1, 16); 
 528         for (int j 
= 0; j 
< num_lines 
; j
++) { 
 530                         PrintAndLog(" %10d | %10d | %s |%-64s | %s| %s", 
 531                                 (timestamp 
- first_timestamp
), 
 532                                 (EndOfTransmissionTimestamp 
- first_timestamp
), 
 533                                 (isResponse 
? "Tag" : "Rdr"), 
 535                                 (j 
== num_lines
-1) ? crc 
: "    ", 
 536                                 (j 
== num_lines
-1) ? explanation 
: ""); 
 538                         PrintAndLog("            |            |     |%-64s | %s| %s", 
 540                                 (j 
== num_lines
-1) ? crc 
: "    ", 
 541                                 (j 
== num_lines
-1) ? explanation 
: ""); 
 545         if (is_last_record(tracepos
, trace
, traceLen
)) return traceLen
; 
 547         if (showWaitCycles 
&& !isResponse 
&& next_record_is_response(tracepos
, trace
)) { 
 548                 uint32_t next_timestamp 
= *((uint32_t *)(trace 
+ tracepos
)); 
 549                 PrintAndLog(" %9d | %9d | %s | fdt (Frame Delay Time): %d", 
 550                         (EndOfTransmissionTimestamp 
- first_timestamp
), 
 551                         (next_timestamp 
- first_timestamp
), 
 553                         (next_timestamp 
- EndOfTransmissionTimestamp
)); 
 560 int CmdHFList(const char *Cmd
) 
 562         bool showWaitCycles 
= false; 
 563         bool markCRCBytes 
= false; 
 565         int tlen 
= param_getstr(Cmd
,0,type
); 
 566         char param1 
= param_getchar(Cmd
, 1); 
 567         char param2 
= param_getchar(Cmd
, 2); 
 569         uint8_t protocol 
= 0; 
 577                         || (param1 
!= 0 && param1 
!= 'f' && param1 
!= 'c') 
 578                         || (param2 
!= 0 && param2 
!= 'f' && param2 
!= 'c')) { 
 583                 if(strcmp(type
, "iclass") == 0) { 
 585                 } else if(strcmp(type
, "14a") == 0) { 
 586                         protocol 
= ISO_14443A
; 
 587                 } else if(strcmp(type
, "14b") == 0)     { 
 588                         protocol 
= ISO_14443B
; 
 589                 } else if(strcmp(type
,"topaz")== 0) { 
 591                 } else if(strcmp(type
,"raw")== 0) { 
 592                         protocol 
= -1;//No crc, no annotations 
 599                 PrintAndLog("List protocol data in trace buffer."); 
 600                 PrintAndLog("Usage:  hf list <protocol> [f][c]"); 
 601                 PrintAndLog("    f      - show frame delay times as well"); 
 602                 PrintAndLog("    c      - mark CRC bytes"); 
 603                 PrintAndLog("Supported <protocol> values:"); 
 604                 PrintAndLog("    raw    - just show raw data without annotations"); 
 605                 PrintAndLog("    14a    - interpret data as iso14443a communications"); 
 606                 PrintAndLog("    14b    - interpret data as iso14443b communications"); 
 607                 PrintAndLog("    iclass - interpret data as iclass communications"); 
 608                 PrintAndLog("    topaz  - interpret data as topaz communications"); 
 610                 PrintAndLog("example: hf list 14a f"); 
 611                 PrintAndLog("example: hf list iclass"); 
 616         if (param1 
== 'f' || param2 
== 'f') { 
 617                 showWaitCycles 
= true; 
 620         if (param1 
== 'c' || param2 
== 'c') { 
 625         uint16_t tracepos 
= 0; 
 626         trace 
= malloc(USB_CMD_DATA_SIZE
); 
 628         // Query for the size of the trace 
 630         GetFromBigBuf(trace
, USB_CMD_DATA_SIZE
, 0); 
 631         WaitForResponse(CMD_ACK
, &response
); 
 632         uint16_t traceLen 
= response
.arg
[2]; 
 633         if (traceLen 
> USB_CMD_DATA_SIZE
) { 
 634                 uint8_t *p 
= realloc(trace
, traceLen
); 
 636                         PrintAndLog("Cannot allocate memory for trace"); 
 641                 GetFromBigBuf(trace
, traceLen
, 0); 
 642                 WaitForResponse(CMD_ACK
, NULL
); 
 645         PrintAndLog("Recorded Activity (TraceLen = %d bytes)", traceLen
); 
 647         PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer"); 
 648         PrintAndLog("iso14443a - All times are in carrier periods (1/13.56Mhz)"); 
 649         PrintAndLog("iClass    - Timings are not as accurate"); 
 651         PrintAndLog("      Start |        End | Src | Data (! denotes parity error)                                   | CRC | Annotation         |"); 
 652         PrintAndLog("------------|------------|-----|-----------------------------------------------------------------|-----|--------------------|"); 
 654         while(tracepos 
< traceLen
) 
 656                 tracepos 
= printTraceLine(tracepos
, traceLen
, trace
, protocol
, showWaitCycles
, markCRCBytes
); 
 663 int CmdHFSearch(const char *Cmd
){ 
 666         ans 
= CmdHF14AReader("s"); 
 668                 PrintAndLog("\nValid ISO14443A Tag Found - Quiting Search\n"); 
 671         ans 
= HFiClassReader("", false, false); 
 673                 PrintAndLog("\nValid iClass Tag (or PicoPass Tag) Found - Quiting Search\n"); 
 676         ans 
= HF14BInfo(false); 
 678                 PrintAndLog("\nValid ISO14443B Tag Found - Quiting Search\n"); 
 681         ans 
= HF15Reader("", false); 
 683                 PrintAndLog("\nValid ISO15693 Tag Found - Quiting Search\n"); 
 686         PrintAndLog("\nno known/supported 13.56 MHz tags found\n"); 
 690 int CmdHFSnoop(const char *Cmd
) 
 693         UsbCommand c 
= {CMD_HF_SNIFFER
, {strtol(Cmd
, &pEnd
,0),strtol(pEnd
, &pEnd
,0),0}}; 
 698 static command_t CommandTable
[] =  
 700         {"help",        CmdHelp
,                1, "This help"}, 
 701         {"14a",         CmdHF14A
,               1, "{ ISO14443A RFIDs... }"}, 
 702         {"14b",         CmdHF14B
,               1, "{ ISO14443B RFIDs... }"}, 
 703         {"15",          CmdHF15
,                1, "{ ISO15693 RFIDs... }"}, 
 704         {"epa",         CmdHFEPA
,               1, "{ German Identification Card... }"}, 
 705         {"legic",       CmdHFLegic
,             0, "{ LEGIC RFIDs... }"}, 
 706         {"iclass",      CmdHFiClass
,    1, "{ ICLASS RFIDs... }"}, 
 707         {"mf",          CmdHFMF
,                1, "{ MIFARE RFIDs... }"}, 
 708         {"mfu",         CmdHFMFUltra
,   1, "{ MIFARE Ultralight RFIDs... }"}, 
 709         {"topaz",       CmdHFTopaz
,             1, "{ TOPAZ (NFC Type 1) RFIDs... }"}, 
 710         {"tune",        CmdHFTune
,              0, "Continuously measure HF antenna tuning"}, 
 711         {"list",        CmdHFList
,              1, "List protocol data in trace buffer"}, 
 712         {"search",      CmdHFSearch
,    1, "Search for known HF tags [preliminary]"}, 
 713         {"snoop",   CmdHFSnoop
,     0, "<samples to skip (10000)> <triggers to skip (1)> Generic HF Snoop"}, 
 714         {NULL
,          NULL
,                   0, NULL
} 
 717 int CmdHF(const char *Cmd
) 
 719   CmdsParse(CommandTable
, Cmd
); 
 723 int CmdHelp(const char *Cmd
) 
 725   CmdsHelp(CommandTable
);