1 //-----------------------------------------------------------------------------
3 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
8 //-----------------------------------------------------------------------------
9 // High frequency ISO14443A commands
10 //-----------------------------------------------------------------------------
17 #include "iso14443crc.h"
19 #include "proxmark3.h"
21 #include "cmdparser.h"
27 static int CmdHelp(const char *Cmd
);
28 static void waitCmd(uint8_t iLen
);
30 int CmdHF14AList(const char *Cmd
)
32 bool ShowWaitCycles
= false;
33 char param
= param_getchar(Cmd
, 0);
35 if (param
== 'h' || (param
!= 0 && param
!= 'f')) {
36 PrintAndLog("List data in trace buffer.");
37 PrintAndLog("Usage: hf 14a list [f]");
38 PrintAndLog("f - show frame delay times as well");
39 PrintAndLog("sample: hf 14a list f");
44 ShowWaitCycles
= true;
47 // for the time being. Need better Bigbuf handling.
48 #define TRACE_SIZE 3000
50 uint8_t trace
[TRACE_SIZE
];
51 GetFromBigBuf(trace
, TRACE_SIZE
, 0);
52 WaitForResponse(CMD_ACK
, NULL
);
54 PrintAndLog("Recorded Activity");
56 PrintAndLog("Start = Start of Start Bit, End = End of last modulation. Src = Source of Transfer");
57 PrintAndLog("All times are in carrier periods (1/13.56Mhz)");
59 PrintAndLog(" Start | End | Src | Data (! denotes parity error) | CRC ");
60 PrintAndLog("-----------|-----------|-----|-----------------------------------------------------------------------");
62 uint16_t tracepos
= 0;
68 uint32_t first_timestamp
;
69 uint32_t EndOfTransmissionTimestamp
;
73 if(tracepos
>= TRACE_SIZE
) {
77 timestamp
= *((uint32_t *)(trace
+ tracepos
));
79 first_timestamp
= timestamp
;
82 // Break and stick with current result if buffer was not completely full
83 if (timestamp
== 0x44444444) break;
86 duration
= *((uint16_t *)(trace
+ tracepos
));
88 data_len
= *((uint16_t *)(trace
+ tracepos
));
91 if (data_len
& 0x8000) {
98 parity_len
= (data_len
-1)/8 + 1;
100 if (tracepos
+ data_len
+ parity_len
>= TRACE_SIZE
) {
104 uint8_t *frame
= trace
+ tracepos
;
105 tracepos
+= data_len
;
106 uint8_t *parityBytes
= trace
+ tracepos
;
107 tracepos
+= parity_len
;
110 for (int j
= 0; j
< data_len
; j
++) {
111 int oddparity
= 0x01;
115 oddparity
^= (((frame
[j
] & 0xFF) >> k
) & 0x01);
118 uint8_t parityBits
= parityBytes
[j
>>3];
119 if (isResponse
&& (oddparity
!= ((parityBits
>> (7-(j
&0x0007))) & 0x01))) {
120 sprintf(line
[j
/16]+((j
%16)*4), "%02x! ", frame
[j
]);
122 sprintf(line
[j
/16]+((j
%16)*4), "%02x ", frame
[j
]);
130 ComputeCrc14443(CRC_14443_A
, frame
, data_len
-2, &b1
, &b2
);
131 if (b1
!= frame
[data_len
-2] || b2
!= frame
[data_len
-1]) {
132 sprintf(crc
, (isResponse
& (data_len
< 6)) ? "" : "!crc");
138 EndOfTransmissionTimestamp
= timestamp
+ duration
;
140 int num_lines
= (data_len
- 1)/16 + 1;
141 for (int j
= 0; j
< num_lines
; j
++) {
143 PrintAndLog(" %9d | %9d | %s | %-64s| %s",
144 (timestamp
- first_timestamp
),
145 (EndOfTransmissionTimestamp
- first_timestamp
),
146 (isResponse
? "Tag" : "Rdr"),
148 (j
== num_lines
-1)?crc
:"");
150 PrintAndLog(" | | | %-64s| %s",
152 (j
== num_lines
-1)?crc
:"");
156 bool next_isResponse
= *((uint16_t *)(trace
+ tracepos
+ 6)) & 0x8000;
158 if (ShowWaitCycles
&& !isResponse
&& next_isResponse
) {
159 uint32_t next_timestamp
= *((uint32_t *)(trace
+ tracepos
));
160 if (next_timestamp
!= 0x44444444) {
161 PrintAndLog(" %9d | %9d | %s | fdt (Frame Delay Time): %d",
162 (EndOfTransmissionTimestamp
- first_timestamp
),
163 (next_timestamp
- first_timestamp
),
165 (next_timestamp
- EndOfTransmissionTimestamp
));
174 void iso14a_set_timeout(uint32_t timeout
) {
175 UsbCommand c
= {CMD_READER_ISO_14443a
, {ISO14A_SET_TIMEOUT
, 0, timeout
}};
179 int CmdHF14AReader(const char *Cmd
)
181 UsbCommand c
= {CMD_READER_ISO_14443a
, {ISO14A_CONNECT
| ISO14A_NO_DISCONNECT
, 0, 0}};
185 WaitForResponse(CMD_ACK
,&resp
);
187 iso14a_card_select_t card
;
188 memcpy(&card
, (iso14a_card_select_t
*)resp
.d
.asBytes
, sizeof(iso14a_card_select_t
));
190 uint64_t select_status
= resp
.arg
[0]; // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS
192 if(select_status
== 0) {
193 PrintAndLog("iso14443a card select failed");
197 PrintAndLog("ATQA : %02x %02x", card
.atqa
[1], card
.atqa
[0]);
198 PrintAndLog(" UID : %s", sprint_hex(card
.uid
, card
.uidlen
));
199 PrintAndLog(" SAK : %02x [%d]", card
.sak
, resp
.arg
[0]);
202 case 0x00: PrintAndLog("TYPE : NXP MIFARE Ultralight | Ultralight C"); break;
203 case 0x04: PrintAndLog("TYPE : NXP MIFARE (various !DESFire !DESFire EV1)"); break;
204 case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1"); break;
205 case 0x09: PrintAndLog("TYPE : NXP MIFARE Mini 0.3k"); break;
206 case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k SL2"); break;
207 case 0x11: PrintAndLog("TYPE : NXP MIFARE Plus 4k SL2"); break;
208 case 0x18: PrintAndLog("TYPE : NXP MIFARE Classic 4k | Plus 4k SL1"); break;
209 case 0x20: PrintAndLog("TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41"); break;
210 case 0x24: PrintAndLog("TYPE : NXP MIFARE DESFire | DESFire EV1"); break;
211 case 0x28: PrintAndLog("TYPE : JCOP31 or JCOP41 v2.3.1"); break;
212 case 0x38: PrintAndLog("TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K"); break;
213 case 0x88: PrintAndLog("TYPE : Infineon MIFARE CLASSIC 1K"); break;
214 case 0x98: PrintAndLog("TYPE : Gemplus MPCOS"); break;
219 // try to request ATS even if tag claims not to support it
220 if (select_status
== 2) {
221 uint8_t rats
[] = { 0xE0, 0x80 }; // FSDI=8 (FSD=256), CID=0
222 c
.arg
[0] = ISO14A_RAW
| ISO14A_APPEND_CRC
| ISO14A_NO_DISCONNECT
;
225 memcpy(c
.d
.asBytes
, rats
, 2);
227 WaitForResponse(CMD_ACK
,&resp
);
229 memcpy(&card
.ats
, resp
.d
.asBytes
, resp
.arg
[0]);
230 card
.ats_len
= resp
.arg
[0]; // note: ats_len includes CRC Bytes
240 if(card
.ats_len
>= 3) { // a valid ATS consists of at least the length byte (TL) and 2 CRC bytes
241 bool ta1
= 0, tb1
= 0, tc1
= 0;
244 if (select_status
== 2) {
245 PrintAndLog("SAK incorrectly claims that card doesn't support RATS");
247 PrintAndLog(" ATS : %s", sprint_hex(card
.ats
, card
.ats_len
));
248 PrintAndLog(" - TL : length is %d bytes", card
.ats
[0]);
249 if (card
.ats
[0] != card
.ats_len
- 2) {
250 PrintAndLog("ATS may be corrupted. Length of ATS (%d bytes incl. 2 Bytes CRC) doesn't match TL", card
.ats_len
);
253 if (card
.ats
[0] > 1) { // there is a format byte (T0)
254 ta1
= (card
.ats
[1] & 0x10) == 0x10;
255 tb1
= (card
.ats
[1] & 0x20) == 0x20;
256 tc1
= (card
.ats
[1] & 0x40) == 0x40;
257 int16_t fsci
= card
.ats
[1] & 0x0f;
258 PrintAndLog(" - T0 : TA1 is%s present, TB1 is%s present, "
259 "TC1 is%s present, FSCI is %d (FSC = %ld)",
260 (ta1
? "" : " NOT"), (tb1
? "" : " NOT"), (tc1
? "" : " NOT"),
262 fsci
< 5 ? (fsci
- 2) * 8 :
263 fsci
< 8 ? (fsci
- 3) * 32 :
271 dr
[0] = ds
[0] = '\0';
272 if (card
.ats
[pos
] & 0x10) strcat(ds
, "2, ");
273 if (card
.ats
[pos
] & 0x20) strcat(ds
, "4, ");
274 if (card
.ats
[pos
] & 0x40) strcat(ds
, "8, ");
275 if (card
.ats
[pos
] & 0x01) strcat(dr
, "2, ");
276 if (card
.ats
[pos
] & 0x02) strcat(dr
, "4, ");
277 if (card
.ats
[pos
] & 0x04) strcat(dr
, "8, ");
278 if (strlen(ds
) != 0) ds
[strlen(ds
) - 2] = '\0';
279 if (strlen(dr
) != 0) dr
[strlen(dr
) - 2] = '\0';
280 PrintAndLog(" - TA1 : different divisors are%s supported, "
281 "DR: [%s], DS: [%s]",
282 (card
.ats
[pos
] & 0x80 ? " NOT" : ""), dr
, ds
);
286 uint32_t sfgi
= card
.ats
[pos
] & 0x0F;
287 uint32_t fwi
= card
.ats
[pos
] >> 4;
288 PrintAndLog(" - TB1 : SFGI = %d (SFGT = %s%ld/fc), FWI = %d (FWT = %ld/fc)",
290 sfgi
? "" : "(not needed) ",
291 sfgi
? (1 << 12) << sfgi
: 0,
298 PrintAndLog(" - TC1 : NAD is%s supported, CID is%s supported",
299 (card
.ats
[pos
] & 0x01) ? "" : " NOT",
300 (card
.ats
[pos
] & 0x02) ? "" : " NOT");
303 if (card
.ats
[0] > pos
) {
305 if (card
.ats
[0] - pos
>= 7) {
306 if (memcmp(card
.ats
+ pos
, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) {
307 tip
= "-> MIFARE Plus X 2K or 4K";
308 } else if (memcmp(card
.ats
+ pos
, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) {
309 tip
= "-> MIFARE Plus S 2K or 4K";
312 PrintAndLog(" - HB : %s%s", sprint_hex(card
.ats
+ pos
, card
.ats
[0] - pos
), tip
);
313 if (card
.ats
[pos
] == 0xC1) {
314 PrintAndLog(" c1 -> Mifare or (multiple) virtual cards of various type");
315 PrintAndLog(" %02x -> Length is %d bytes",
316 card
.ats
[pos
+ 1], card
.ats
[pos
+ 1]);
317 switch (card
.ats
[pos
+ 2] & 0xf0) {
319 PrintAndLog(" 1x -> MIFARE DESFire");
322 PrintAndLog(" 2x -> MIFARE Plus");
325 switch (card
.ats
[pos
+ 2] & 0x0f) {
327 PrintAndLog(" x0 -> <1 kByte");
330 PrintAndLog(" x0 -> 1 kByte");
333 PrintAndLog(" x0 -> 2 kByte");
336 PrintAndLog(" x0 -> 4 kByte");
339 PrintAndLog(" x0 -> 8 kByte");
342 switch (card
.ats
[pos
+ 3] & 0xf0) {
344 PrintAndLog(" 0x -> Engineering sample");
347 PrintAndLog(" 2x -> Released");
350 switch (card
.ats
[pos
+ 3] & 0x0f) {
352 PrintAndLog(" x0 -> Generation 1");
355 PrintAndLog(" x1 -> Generation 2");
358 PrintAndLog(" x2 -> Generation 3");
361 switch (card
.ats
[pos
+ 4] & 0x0f) {
363 PrintAndLog(" x0 -> Only VCSL supported");
366 PrintAndLog(" x1 -> VCS, VCSL, and SVC supported");
369 PrintAndLog(" xE -> no VCS command supported");
375 PrintAndLog("proprietary non iso14443-4 card found, RATS not supported");
378 return select_status
;
381 // Collect ISO14443 Type A UIDs
382 int CmdHF14ACUIDs(const char *Cmd
)
384 // requested number of UIDs
386 // collect at least 1 (e.g. if no parameter was given)
389 PrintAndLog("Collecting %d UIDs", n
);
390 PrintAndLog("Start: %u", time(NULL
));
392 for (int i
= 0; i
< n
; i
++) {
393 // execute anticollision procedure
394 UsbCommand c
= {CMD_READER_ISO_14443a
, {ISO14A_CONNECT
, 0, 0}};
398 WaitForResponse(CMD_ACK
,&resp
);
400 iso14a_card_select_t
*card
= (iso14a_card_select_t
*) resp
.d
.asBytes
;
402 // check if command failed
403 if (resp
.arg
[0] == 0) {
404 PrintAndLog("Card select failed.");
407 for (uint16_t i
= 0; i
< card
->uidlen
; i
++) {
408 sprintf(&uid_string
[2*i
], "%02X", card
->uid
[i
]);
410 PrintAndLog("%s", uid_string
);
413 PrintAndLog("End: %u", time(NULL
));
418 // ## simulate iso14443a tag
419 // ## greg - added ability to specify tag UID
420 int CmdHF14ASim(const char *Cmd
)
422 UsbCommand c
= {CMD_SIMULATE_TAG_ISO_14443a
,{0,0,0}};
424 // Retrieve the tag type
425 uint8_t tagtype
= param_get8ex(Cmd
,0,0,10);
427 // When no argument was given, just print help message
430 PrintAndLog(" Emulating ISO/IEC 14443 type A tag with 4 or 7 byte UID");
432 PrintAndLog(" syntax: hf 14a sim <type> <uid>");
433 PrintAndLog(" types: 1 = MIFARE Classic");
434 PrintAndLog(" 2 = MIFARE Ultralight");
435 PrintAndLog(" 3 = MIFARE DESFIRE");
436 PrintAndLog(" 4 = ISO/IEC 14443-4");
441 // Store the tag type
444 // Retrieve the full 4 or 7 byte long uid
445 uint64_t long_uid
= param_get64ex(Cmd
,1,0,16);
447 // Are we handling the (optional) second part uid?
448 if (long_uid
> 0xffffffff) {
449 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 7 byte UID (%014"llx
")",long_uid
);
450 // Store the second part
451 c
.arg
[2] = (long_uid
& 0xffffffff);
453 // Store the first part, ignore the first byte, it is replaced by cascade byte (0x88)
454 c
.arg
[1] = (long_uid
& 0xffffff);
456 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 4 byte UID (%08x)",long_uid
);
457 // Only store the first part
458 c
.arg
[1] = long_uid
& 0xffffffff;
461 // At lease save the mandatory first part of the UID
462 c.arg[0] = long_uid & 0xffffffff;
465 // At lease save the mandatory first part of the UID
466 c.arg[0] = long_uid & 0xffffffff;
469 PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
474 PrintAndLog("Emulating ISO/IEC 14443-3 type A tag with 4 byte UID");
475 UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
478 PrintAndLog("Emulating ISO/IEC 14443-4 type A tag with 7 byte UID");
481 PrintAndLog("Error: unkown tag type (%d)",c.arg[0]);
482 PrintAndLog("syntax: hf 14a sim <uid>",c.arg[0]);
483 PrintAndLog(" type1: 4 ",c.arg[0]);
490 unsigned int hi = 0, lo = 0;
492 while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
493 hi= (hi << 4) | (lo >> 28);
494 lo= (lo << 4) | (n & 0xf);
497 // UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
498 // PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
503 int CmdHF14ASnoop(const char *Cmd
) {
506 if (param_getchar(Cmd
, 0) == 'h') {
507 PrintAndLog("It get data from the field and saves it into command buffer.");
508 PrintAndLog("Buffer accessible from command hf 14a list.");
509 PrintAndLog("Usage: hf 14a snoop [c][r]");
510 PrintAndLog("c - triggered by first data from card");
511 PrintAndLog("r - triggered by first 7-bit request from reader (REQ,WUP,...)");
512 PrintAndLog("sample: hf 14a snoop c r");
516 for (int i
= 0; i
< 2; i
++) {
517 char ctmp
= param_getchar(Cmd
, i
);
518 if (ctmp
== 'c' || ctmp
== 'C') param
|= 0x01;
519 if (ctmp
== 'r' || ctmp
== 'R') param
|= 0x02;
522 UsbCommand c
= {CMD_SNOOP_ISO_14443a
, {param
, 0, 0}};
527 int CmdHF14ACmdRaw(const char *cmd
) {
528 UsbCommand c
= {CMD_READER_ISO_14443a
, {0, 0, 0}};
533 uint8_t active_select
=0;
538 unsigned int datalen
=0, temp
;
541 PrintAndLog("Usage: hf 14a raw [-r] [-c] [-p] [-f] [-b] <number of bits> <0A 0B 0C ... hex>");
542 PrintAndLog(" -r do not read response");
543 PrintAndLog(" -c calculate and append CRC");
544 PrintAndLog(" -p leave the signal field ON after receive");
545 PrintAndLog(" -a active signal field ON without select");
546 PrintAndLog(" -s active signal field ON with select");
547 PrintAndLog(" -b number of bits to send. Useful for send partial byte");
552 while (*cmd
==' ' || *cmd
=='\t') cmd
++;
554 while (cmd
[i
]!='\0') {
555 if (cmd
[i
]==' ' || cmd
[i
]=='\t') { i
++; continue; }
574 sscanf(cmd
+i
+2,"%d",&temp
);
575 numbits
= temp
& 0xFFFF;
577 while(cmd
[i
]!=' ' && cmd
[i
]!='\0') { i
++; }
581 PrintAndLog("Invalid option");
587 if ((cmd
[i
]>='0' && cmd
[i
]<='9') ||
588 (cmd
[i
]>='a' && cmd
[i
]<='f') ||
589 (cmd
[i
]>='A' && cmd
[i
]<='F') ) {
590 buf
[strlen(buf
)+1]=0;
591 buf
[strlen(buf
)]=cmd
[i
];
594 if (strlen(buf
)>=2) {
595 sscanf(buf
,"%x",&temp
);
596 data
[datalen
]=(uint8_t)(temp
& 0xff);
602 PrintAndLog("Invalid char on input");
607 uint8_t first
, second
;
608 ComputeCrc14443(CRC_14443_A
, data
, datalen
, &first
, &second
);
609 data
[datalen
++] = first
;
610 data
[datalen
++] = second
;
613 if(active
|| active_select
)
615 c
.arg
[0] |= ISO14A_CONNECT
;
617 c
.arg
[0] |= ISO14A_NO_SELECT
;
620 c
.arg
[0] |= ISO14A_NO_DISCONNECT
;
622 c
.arg
[0] |= ISO14A_RAW
;
626 memcpy(c
.d
.asBytes
,data
,datalen
);
639 static void waitCmd(uint8_t iSelect
)
645 if (WaitForResponseTimeout(CMD_ACK
,&resp
,1000)) {
646 recv
= resp
.d
.asBytes
;
647 uint8_t iLen
= iSelect
? resp
.arg
[1] : resp
.arg
[0];
648 PrintAndLog("received %i octets",iLen
);
651 hexout
= (char *)malloc(iLen
* 3 + 1);
652 if (hexout
!= NULL
) {
653 for (int i
= 0; i
< iLen
; i
++) { // data in hex
654 sprintf(&hexout
[i
* 3], "%02X ", recv
[i
]);
656 PrintAndLog("%s", hexout
);
659 PrintAndLog("malloc failed your client has low memory?");
662 PrintAndLog("timeout while waiting for reply.");
666 static command_t CommandTable
[] =
668 {"help", CmdHelp
, 1, "This help"},
669 {"list", CmdHF14AList
, 0, "List ISO 14443a history"},
670 {"reader", CmdHF14AReader
, 0, "Act like an ISO14443 Type A reader"},
671 {"cuids", CmdHF14ACUIDs
, 0, "<n> Collect n>0 ISO14443 Type A UIDs in one go"},
672 {"sim", CmdHF14ASim
, 0, "<UID> -- Fake ISO 14443a tag"},
673 {"snoop", CmdHF14ASnoop
, 0, "Eavesdrop ISO 14443 Type A"},
674 {"raw", CmdHF14ACmdRaw
, 0, "Send raw hex data to tag"},
675 {NULL
, NULL
, 0, NULL
}
678 int CmdHF14A(const char *Cmd
) {
680 WaitForResponseTimeout(CMD_ACK
,NULL
,100);
683 CmdsParse(CommandTable
, Cmd
);
687 int CmdHelp(const char *Cmd
)
689 CmdsHelp(CommandTable
);