cvs.zerfleddert.de Git - proxmark3-svn/blob

1 //-----------------------------------------------------------------------------

3 //

4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,

5 // at your option, any later version. See the LICENSE.txt file for the text of

6 // the license.

7 //-----------------------------------------------------------------------------

8 // High frequency ISO14443B commands

9 //-----------------------------------------------------------------------------

11 #include <stdio.h>

12 #include <stdlib.h>

13 #include <stdbool.h>

14 #include <string.h>

15 #include <stdint.h>

16 #include "iso14443crc.h"

17 #include "proxmark3.h"

18 #include "data.h"

19 #include "graph.h"

20 #include "util.h"

21 #include "ui.h"

22 #include "cmdparser.h"

23 #include "cmdhf14b.h"

24 #include "cmdmain.h"

 static int CmdHelp(const char *Cmd);

 int CmdHF14BDemod(const char *Cmd)

29 {

30 int i, j, iold;

31 int isum, qsum;

32 int outOfWeakAt;

33 bool negateI, negateQ;

35 uint8_t data[256];

36 int dataLen = 0;

38 // As received, the samples are pairs, correlations against I and Q

39 // square waves. So estimate angle of initial carrier (or just

40 // quadrant, actually), and then do the demod.

42 // First, estimate where the tag starts modulating.

   for (i = 0; i < GraphTraceLen; i += 2) {

     if (abs(GraphBuffer[i]) + abs(GraphBuffer[i + 1]) > 40) {

45 break;

46 }

47 }

48 if (i >= GraphTraceLen) {

49 PrintAndLog("too weak to sync");

50 return 0;

51 }

   PrintAndLog("out of weak at %d", i);

53 outOfWeakAt = i;

55 // Now, estimate the phase in the initial modulation of the tag

56 isum = 0;

57 qsum = 0;

   for (; i < (outOfWeakAt + 16); i += 2) {

     isum += GraphBuffer[i + 0];

     qsum += GraphBuffer[i + 1];

61 }

62 negateI = (isum < 0);

63 negateQ = (qsum < 0);

65 // Turn the correlation pairs into soft decisions on the bit.

66 j = 0;

   for (i = 0; i < GraphTraceLen / 2; i++) {

68 int si = GraphBuffer[j];

     int sq = GraphBuffer[j + 1];

     if (negateI) si = -si;

     if (negateQ) sq = -sq;

72 GraphBuffer[i] = si + sq;

73 j += 2;

74 }

75 GraphTraceLen = i;

77 i = outOfWeakAt / 2;

   while (GraphBuffer[i] > 0 && i < GraphTraceLen)

79 i++;

   if (i >= GraphTraceLen) goto demodError;

82 iold = i;

   while (GraphBuffer[i] < 0 && i < GraphTraceLen)

84 i++;

   if (i >= GraphTraceLen) goto demodError;

   if ((i - iold) > 23) goto demodError;

88 PrintAndLog("make it to demod loop");

90 for (;;) {

91 iold = i;

     while (GraphBuffer[i] >= 0 && i < GraphTraceLen)

93 i++;

     if (i >= GraphTraceLen) goto demodError;

     if ((i - iold) > 6) goto demodError;

97 uint16_t shiftReg = 0;

     if (i + 20 >= GraphTraceLen) goto demodError;

     for (j = 0; j < 10; j++) {

       int soft = GraphBuffer[i] + GraphBuffer[i + 1];

102

       if (abs(soft) < (abs(isum) + abs(qsum)) / 20) {

104 PrintAndLog("weak bit");

105 }

106

107 shiftReg >>= 1;

       if(GraphBuffer[i] + GraphBuffer[i+1] >= 0) {

109 shiftReg |= 0x200;

110 }

111

112 i+= 2;

113 }

114

     if ((shiftReg & 0x200) && !(shiftReg & 0x001))

116 {

117 // valid data byte, start and stop bits okay

       PrintAndLog("   %02x", (shiftReg >> 1) & 0xff);

       data[dataLen++] = (shiftReg >> 1) & 0xff;

       if (dataLen >= sizeof(data)) {

121 return 0;

122 }

     } else if (shiftReg == 0x000) {

124 // this is EOF

125 break;

126 } else {

127 goto demodError;

128 }

129 }

130

131 uint8_t first, second;

   ComputeCrc14443(CRC_14443_B, data, dataLen-2, &first, &second);

   PrintAndLog("CRC: %02x %02x (%s)\n", first, second,

     (first == data[dataLen-2] && second == data[dataLen-1]) ?

135 "ok" : "****FAIL****");

136

137 RepaintGraphWindow();

138 return 0;

139

140 demodError:

141 PrintAndLog("demod error");

142 RepaintGraphWindow();

143 return 0;

144 }

145

 int CmdHF14BList(const char *Cmd)

147 {

148 uint8_t got[TRACE_BUFFER_SIZE];

   GetFromBigBuf(got,sizeof(got),0);

150 WaitForResponse(CMD_ACK,NULL);

151

152 PrintAndLog("recorded activity:");

153 PrintAndLog(" time :rssi: who bytes");

154 PrintAndLog("---------+----+----+-----------");

155

156 int i = 0;

157 int prev = -1;

158

159 for(;;) {

160

         if(i >= TRACE_BUFFER_SIZE) { break; }

162

163 bool isResponse;

     int timestamp = *((uint32_t *)(got+i));

     if(timestamp & 0x80000000) {

166 timestamp &= 0x7fffffff;

167 isResponse = 1;

168 } else {

169 isResponse = 0;

170 }

     int metric = *((uint32_t *)(got+i+4));

172

     int len = got[i+8];

174

     if(len > 100) {

176 break;

177 }

     if(i + len >= TRACE_BUFFER_SIZE) {

179 break;

180 }

181

     uint8_t *frame = (got+i+9);

183

184 // Break and stick with current result if buffer was not completely full

         if (frame[0] == 0x44 && frame[1] == 0x44 && frame[2] == 0x44 && frame[3] == 0x44) break; 

186

     char line[1000] = "";

188 int j;

     for(j = 0; j < len; j++) {

       sprintf(line+(j*3), "%02x  ", frame[j]);

191 }

192

193 char *crc;

     if(len > 2) {

195 uint8_t b1, b2;

       ComputeCrc14443(CRC_14443_B, frame, len-2, &b1, &b2);

       if(b1 != frame[len-2] || b2 != frame[len-1]) {

198 crc = "**FAIL CRC**";

199 } else {

200 crc = "";

201 }

202 } else {

203 crc = "(SHORT)";

204 }

205

206 char metricString[100];

207 if(isResponse) {

       sprintf(metricString, "%3d", metric);

209 } else {

       strcpy(metricString, "   ");

211 }

212

213 PrintAndLog(" +%7d: %s: %s %s %s",

       (prev < 0 ? 0 : timestamp - prev),

215 metricString,

       (isResponse ? "TAG" : "   "), line, crc);

217

218 prev = timestamp;

219 i += (len + 9);

220 }

221 return 0;

222 }

223

 int CmdHF14BRead(const char *Cmd)

225 {

   UsbCommand c = {CMD_ACQUIRE_RAW_ADC_SAMPLES_ISO_14443, {strtol(Cmd, NULL, 0), 0, 0}};

227 SendCommand(&c);

228 return 0;

229 }

230

 int CmdHF14Sim(const char *Cmd)

232 {

233 UsbCommand c={CMD_SIMULATE_TAG_ISO_14443};

234 SendCommand(&c);

235 return 0;

236 }

237

 int CmdHFSimlisten(const char *Cmd)

239 {

240 UsbCommand c = {CMD_SIMULATE_TAG_HF_LISTEN};

241 SendCommand(&c);

242 return 0;

243 }

244

 int CmdHF14BSnoop(const char *Cmd)

246 {

247 UsbCommand c = {CMD_SNOOP_ISO_14443};

248 SendCommand(&c);

249 return 0;

250 }

251

252 /* New command to read the contents of a SRI512 tag

253 * SRI512 tags are ISO14443-B modulated memory tags,

254 * this command just dumps the contents of the memory

255 */

 int CmdSri512Read(const char *Cmd)

257 {

   UsbCommand c = {CMD_READ_SRI512_TAG, {strtol(Cmd, NULL, 0), 0, 0}};

259 SendCommand(&c);

260 return 0;

261 }

262

263 /* New command to read the contents of a SRIX4K tag

264 * SRIX4K tags are ISO14443-B modulated memory tags,

265 * this command just dumps the contents of the memory/

266 */

 int CmdSrix4kRead(const char *Cmd)

268 {

   UsbCommand c = {CMD_READ_SRIX4K_TAG, {strtol(Cmd, NULL, 0), 0, 0}};

270 SendCommand(&c);

271 return 0;

272 }

273

 int CmdHF14BCmdRaw (const char *cmd) {

275 UsbCommand resp;

276 uint8_t *recv;

     UsbCommand c = {CMD_ISO_14443B_COMMAND, {0, 0, 0}}; // len,recv?

278 uint8_t reply=1;

279 uint8_t crc=0;

280 uint8_t power=0;

     char buf[5]="";

282 int i=0;

     uint8_t data[100] = {0x00};

     unsigned int datalen=0, temp;

285 char *hexout;

286

     if (strlen(cmd)<3) {

288 PrintAndLog("Usage: hf 14b raw [-r] [-c] [-p] <0A 0B 0C ... hex>");

289 PrintAndLog(" -r do not read response");

290 PrintAndLog(" -c calculate and append CRC");

291 PrintAndLog(" -p leave the field on after receive");

292 return 0;

293 }

294

295 // strip

     while (*cmd==' ' || *cmd=='\t') cmd++;

297

     while (cmd[i]!='\0') {

         if (cmd[i]==' ' || cmd[i]=='\t') { i++; continue; }

         if (cmd[i]=='-') {

             switch (cmd[i+1]) {

302 case 'r':

303 case 'R':

304 reply=0;

305 break;

306 case 'c':

307 case 'C':

308 crc=1;

309 break;

310 case 'p':

311 case 'P':

312 power=1;

313 break;

314 default:

315 PrintAndLog("Invalid option");

316 return 0;

317 }

318 i+=2;

319 continue;

320 }

         if ((cmd[i]>='0' && cmd[i]<='9') ||

             (cmd[i]>='a' && cmd[i]<='f') ||

             (cmd[i]>='A' && cmd[i]<='F') ) {

             buf[strlen(buf)+1]=0;

             buf[strlen(buf)]=cmd[i];

326 i++;

327

             if (strlen(buf)>=2) {

                 sscanf(buf,"%x",&temp);

                 data[datalen]=(uint8_t)(temp & 0xff);

331 datalen++;

332 *buf=0;

333 }

334 continue;

335 }

336 PrintAndLog("Invalid char on input");

337 return 1;

338 }

     if (datalen == 0)

340 {

341 PrintAndLog("Missing data input");

342 return 0;

343 }

344 if(crc)

345 {

346 uint8_t first, second;

         ComputeCrc14443(CRC_14443_B, data, datalen, &first, &second);

348 data[datalen++] = first;

349 data[datalen++] = second;

350 }

351

     c.arg[0] = datalen;

     c.arg[1] = reply;

     c.arg[2] = power;

     memcpy(c.d.asBytes,data,datalen);

356

357 SendCommand(&c);

358

359 if (reply) {

         if (WaitForResponseTimeout(CMD_ACK,&resp,1000)) {

361 recv = resp.d.asBytes;

             PrintAndLog("received %i octets",resp.arg[0]);

             if(!resp.arg[0])

364 return 0;

             hexout = (char *)malloc(resp.arg[0] * 3 + 1);

366 if (hexout != NULL) {

367 uint8_t first, second;

                 for (int i = 0; i < resp.arg[0]; i++) { // data in hex

                     sprintf(&hexout[i * 3], "%02X ", recv[i]);

370 }

                 PrintAndLog("%s", hexout);

372 free(hexout);

                 ComputeCrc14443(CRC_14443_B, recv, resp.arg[0]-2, &first, &second);

                 if(recv[resp.arg[0]-2]==first && recv[resp.arg[0]-1]==second) {

375 PrintAndLog("CRC OK");

376 } else {

377 PrintAndLog("CRC failed");

378 }

379 } else {

380 PrintAndLog("malloc failed your client has low memory?");

381 }

382 } else {

383 PrintAndLog("timeout while waiting for reply.");

384 }

385 } // if reply

386 return 0;

387 }

388

 int CmdHF14BWrite( const char *Cmd){

390

391 /*

392 * For SRIX4K blocks 00 - 7F

393 * hf 14b raw -c -p 09 $srix4kwblock $srix4kwdata

394 *

395 * For SR512 blocks 00 - 0F

396 * hf 14b raw -c -p 09 $sr512wblock $sr512wdata

397 *

398 * Special block FF = otp_lock_reg block.

399 * Data len 4 bytes-

400 */

         char cmdp = param_getchar(Cmd, 0);

402 uint8_t blockno = -1;

         uint8_t data[4] = {0x00};

404 bool isSrix4k = true;

405 char str[20];

406

         if (strlen(Cmd) < 1 || cmdp == 'h' || cmdp == 'H') {

408 PrintAndLog("Usage: hf 14b write <1|2> <BLOCK> <DATA>");

409 PrintAndLog(" [1 = SRIX4K]");

410 PrintAndLog(" [2 = SRI512]");

411 PrintAndLog(" [BLOCK number depends on tag, special block == FF]");

412 PrintAndLog(" sample: hf 14b write 1 7F 11223344");

413 PrintAndLog(" : hf 14b write 1 FF 11223344");

414 PrintAndLog(" : hf 14b write 2 15 11223344");

415 PrintAndLog(" : hf 14b write 2 FF 11223344");

416 return 0;

417 }

418

         if ( cmdp == '2' )

420 isSrix4k = false;

421

422 //blockno = param_get8(Cmd, 1);

423

         if ( param_gethex(Cmd,1, &blockno, 2) ) {

425 PrintAndLog("Block number must include 2 HEX symbols");

426 return 0;

427 }

428

429 if ( isSrix4k ){

                 if ( blockno > 0x7f && blockno != 0xff ){

431 PrintAndLog("Block number out of range");

432 return 0;

433 }

434 } else {

                 if ( blockno > 0x0f && blockno != 0xff ){

436 PrintAndLog("Block number out of range");

437 return 0;

438 }

439 }

440

         if (param_gethex(Cmd, 2, data, 8)) {

442 PrintAndLog("Data must include 8 HEX symbols");

443 return 0;

444 }

445

         if ( blockno == 0xff)

                 PrintAndLog("[%s] Write special block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512" , blockno,  sprint_hex(data,4) );

448 else

                 PrintAndLog("[%s] Write block %02X [ %s ]", (isSrix4k)?"SRIX4K":"SRI512", blockno,  sprint_hex(data,4) );

450

         sprintf(str, "-c 09 %02x %02x%02x%02x%02x", blockno, data[0], data[1], data[2], data[3]);

452

453 CmdHF14BCmdRaw(str);

454 return 0;

455 }

456

457 static command_t CommandTable[] =

458 {

   {"help",        CmdHelp,        1, "This help"},

   {"demod",       CmdHF14BDemod,  1, "Demodulate ISO14443 Type B from tag"},

   {"list",        CmdHF14BList,   0, "List ISO 14443 history"},

   {"read",        CmdHF14BRead,   0, "Read HF tag (ISO 14443)"},

   {"sim",         CmdHF14Sim,     0, "Fake ISO 14443 tag"},

   {"simlisten",   CmdHFSimlisten, 0, "Get HF samples as fake tag"},

   {"snoop",       CmdHF14BSnoop,  0, "Eavesdrop ISO 14443"},

   {"sri512read",  CmdSri512Read,  0, "Read contents of a SRI512 tag"},

   {"srix4kread",  CmdSrix4kRead,  0, "Read contents of a SRIX4K tag"},

   {"raw",         CmdHF14BCmdRaw, 0, "Send raw hex data to tag"},

   {"write",       CmdHF14BWrite,  0, "Write data to a SRI512 | SRIX4K tag"},

   {NULL, NULL, 0, NULL}

471 };

472

 int CmdHF14B(const char *Cmd)

474 {

475 CmdsParse(CommandTable, Cmd);

476 return 0;

477 }

478

 int CmdHelp(const char *Cmd)

480 {

481 CmdsHelp(CommandTable);

482 return 0;

483 }