+static int ulev1_readCounter( uint8_t counter, uint8_t *response, uint16_t responseLength ){
+
+ uint8_t cmd[] = {MIFARE_ULEV1_READ_CNT, counter};
+ int len = ul_send_cmd_raw(cmd, sizeof(cmd), response, responseLength);
+ return len;
+}
+
+static int ulev1_readTearing( uint8_t counter, uint8_t *response, uint16_t responseLength ){
+
+ uint8_t cmd[] = {MIFARE_ULEV1_CHECKTEAR, counter};
+ int len = ul_send_cmd_raw(cmd, sizeof(cmd), response, responseLength);
+ return len;
+}
+
+static int ulev1_readSignature( uint8_t *response, uint16_t responseLength ){
+
+ uint8_t cmd[] = {MIFARE_ULEV1_READSIG, 0x00};
+ int len = ul_send_cmd_raw(cmd, sizeof(cmd), response, responseLength);
+ return len;
+}
+
+
+// Fudan check checks for which error is given for a command with incorrect crc
+// NXP UL chip responds with 01, fudan 00.
+// other possible checks:
+// send a0 + crc
+// UL responds with 00, fudan doesn't respond
+// or
+// send a200 + crc
+// UL doesn't respond, fudan responds with 00
+// or
+// send 300000 + crc (read with extra byte(s))
+// UL responds with read of page 0, fudan doesn't respond.
+//
+// make sure field is off before calling this function
+static int ul_fudan_check( void ){
+ iso14a_card_select_t card;
+ if ( !ul_select(&card) )
+ return UL_ERROR;
+
+ UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_RAW | ISO14A_NO_DISCONNECT, 4, 0}};
+
+ uint8_t cmd[4] = {0x30,0x00,0x02,0xa7}; //wrong crc on purpose should be 0xa8
+ memcpy(c.d.asBytes, cmd, 4);
+ clearCommandBuffer();
+ SendCommand(&c);
+ UsbCommand resp;
+ if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) return UL_ERROR;
+ if (resp.arg[0] != 1) return UL_ERROR;
+
+ return (!resp.d.asBytes[0]) ? FUDAN_UL : UL; //if response == 0x00 then Fudan, else Genuine NXP
+}
+
+static int ul_print_default( uint8_t *data){
+
+ uint8_t uid[7];
+ uid[0] = data[0];
+ uid[1] = data[1];
+ uid[2] = data[2];
+ uid[3] = data[4];
+ uid[4] = data[5];
+ uid[5] = data[6];
+ uid[6] = data[7];
+
+ PrintAndLog(" UID : %s ", sprint_hex(uid, 7));
+ PrintAndLog(" UID[0] : %02X, %s", uid[0], getTagInfo(uid[0]) );
+ if ( uid[0] == 0x05 && ((uid[1] & 0xf0) >> 4) == 2 ) { // is infineon and 66RxxP
+ uint8_t chip = (data[8] & 0xC7); // 11000111 mask, bit 3,4,5 RFU
+ switch (chip){
+ case 0xc2: PrintAndLog(" IC type : SLE 66R04P 770 Bytes"); break; //77 pages
+ case 0xc4: PrintAndLog(" IC type : SLE 66R16P 2560 Bytes"); break; //256 pages
+ case 0xc6: PrintAndLog(" IC type : SLE 66R32P 5120 Bytes"); break; //512 pages /2 sectors
+ }
+ }
+ // CT (cascade tag byte) 0x88 xor SN0 xor SN1 xor SN2
+ int crc0 = 0x88 ^ data[0] ^ data[1] ^data[2];
+ if ( data[3] == crc0 )
+ PrintAndLog(" BCC0 : %02X, Ok", data[3]);
+ else
+ PrintAndLog(" BCC0 : %02X, crc should be %02X", data[3], crc0);
+
+ int crc1 = data[4] ^ data[5] ^ data[6] ^data[7];
+ if ( data[8] == crc1 )
+ PrintAndLog(" BCC1 : %02X, Ok", data[8]);
+ else
+ PrintAndLog(" BCC1 : %02X, crc should be %02X", data[8], crc1 );
+
+ PrintAndLog(" Internal : %02X, %sdefault", data[9], (data[9]==0x48)?"":"not " );
+
+ PrintAndLog(" Lock : %s - %s",
+ sprint_hex(data+10, 2),
+ printBits(2, data+10)
+ );
+
+ PrintAndLog("OneTimePad : %s - %s\n",
+ sprint_hex(data + 12, 4),
+ printBits(4, data+12)
+ );
+
+ return 0;
+}
+
+static int ndef_print_CC(uint8_t *data) {
+ // no NDEF message
+ if(data[0] != 0xe1)
+ return -1;
+
+ PrintAndLog("--- NDEF Message");
+ PrintAndLog("Capability Container: %s", sprint_hex(data,4) );
+ PrintAndLog(" %02X : NDEF Magic Number", data[0]);
+ PrintAndLog(" %02X : version %d.%d supported by tag", data[1], (data[1] & 0xF0) >> 4, data[1] & 0x0f);
+ PrintAndLog(" %02X : Physical Memory Size: %d bytes", data[2], (data[2] + 1) * 8);
+ if ( data[2] == 0x96 )
+ PrintAndLog(" %02X : NDEF Memory Size: %d bytes", data[2], 48);
+ else if ( data[2] == 0x12 )
+ PrintAndLog(" %02X : NDEF Memory Size: %d bytes", data[2], 144);
+ else if ( data[2] == 0x3e )
+ PrintAndLog(" %02X : NDEF Memory Size: %d bytes", data[2], 496);
+ else if ( data[2] == 0x6d )
+ PrintAndLog(" %02X : NDEF Memory Size: %d bytes", data[2], 872);
+
+ PrintAndLog(" %02X : %s / %s", data[3],
+ (data[3] & 0xF0) ? "(RFU)" : "Read access granted without any security",
+ (data[3] & 0x0F)==0 ? "Write access granted without any security" : (data[3] & 0x0F)==0x0F ? "No write access granted at all" : "(RFU)");
+ return 0;
+}
+
+int ul_print_type(uint32_t tagtype, uint8_t spaces){
+ char spc[11] = " ";
+ spc[10]=0x00;
+ char *spacer = spc + (10-spaces);
+
+ if ( tagtype & UL )
+ PrintAndLog("%sTYPE : MIFARE Ultralight (MF0ICU1) %s", spacer, (tagtype & MAGIC) ? "<magic>" : "" );
+ else if ( tagtype & UL_C)
+ PrintAndLog("%sTYPE : MIFARE Ultralight C (MF0ULC) %s", spacer, (tagtype & MAGIC) ? "<magic>" : "" );
+ else if ( tagtype & UL_EV1_48)
+ PrintAndLog("%sTYPE : MIFARE Ultralight EV1 48bytes (MF0UL1101)", spacer);
+ else if ( tagtype & UL_EV1_128)
+ PrintAndLog("%sTYPE : MIFARE Ultralight EV1 128bytes (MF0UL2101)", spacer);
+ else if ( tagtype & NTAG )
+ PrintAndLog("%sTYPE : NTAG UNKNOWN", spacer);
+ else if ( tagtype & NTAG_203 )
+ PrintAndLog("%sTYPE : NTAG 203 144bytes (NT2H0301F0DT)", spacer);
+ else if ( tagtype & NTAG_210 )
+ PrintAndLog("%sTYPE : NTAG 210 48bytes (NT2L1011G0DU)", spacer);
+ else if ( tagtype & NTAG_212 )
+ PrintAndLog("%sTYPE : NTAG 212 128bytes (NT2L1211G0DU)", spacer);
+ else if ( tagtype & NTAG_213 )
+ PrintAndLog("%sTYPE : NTAG 213 144bytes (NT2H1311G0DU)", spacer);
+ else if ( tagtype & NTAG_215 )
+ PrintAndLog("%sTYPE : NTAG 215 504bytes (NT2H1511G0DU)", spacer);
+ else if ( tagtype & NTAG_216 )
+ PrintAndLog("%sTYPE : NTAG 216 888bytes (NT2H1611G0DU)", spacer);
+ else if ( tagtype & NTAG_I2C_1K )
+ PrintAndLog("%sTYPE : NTAG I%sC 888bytes (NT3H1101FHK)", spacer, "\xFD");
+ else if ( tagtype & NTAG_I2C_2K )
+ PrintAndLog("%sTYPE : NTAG I%sC 1904bytes (NT3H1201FHK)", spacer, "\xFD");
+ else if ( tagtype & MY_D )
+ PrintAndLog("%sTYPE : INFINEON my-d\x99 (SLE 66RxxS)", spacer);
+ else if ( tagtype & MY_D_NFC )
+ PrintAndLog("%sTYPE : INFINEON my-d\x99 NFC (SLE 66RxxP)", spacer);
+ else if ( tagtype & MY_D_MOVE )
+ PrintAndLog("%sTYPE : INFINEON my-d\x99 move (SLE 66R01P)", spacer);
+ else if ( tagtype & MY_D_MOVE_NFC )
+ PrintAndLog("%sTYPE : INFINEON my-d\x99 move NFC (SLE 66R01P)", spacer);
+ else if ( tagtype & MY_D_MOVE_LEAN )
+ PrintAndLog("%sTYPE : INFINEON my-d\x99 move lean (SLE 66R01L)", spacer);
+ else if ( tagtype & FUDAN_UL )
+ PrintAndLog("%sTYPE : FUDAN Ultralight Compatible (or other compatible) %s", spacer, (tagtype & MAGIC) ? "<magic>" : "" );
+ else
+ PrintAndLog("%sTYPE : Unknown %06x", spacer, tagtype);
+ return 0;
+}
+
+static int ulc_print_3deskey( uint8_t *data){
+ PrintAndLog(" deskey1 [44/0x2C] : %s [%.4s]", sprint_hex(data ,4),data);
+ PrintAndLog(" deskey1 [45/0x2D] : %s [%.4s]", sprint_hex(data+4 ,4),data+4);
+ PrintAndLog(" deskey2 [46/0x2E] : %s [%.4s]", sprint_hex(data+8 ,4),data+8);
+ PrintAndLog(" deskey2 [47/0x2F] : %s [%.4s]", sprint_hex(data+12,4),data+12);
+ PrintAndLog("\n 3des key : %s", sprint_hex(SwapEndian64(data, 16, 8), 16));
+ return 0;
+}
+
+static int ulc_print_configuration( uint8_t *data){
+
+ PrintAndLog("--- UL-C Configuration");
+ PrintAndLog(" Higher Lockbits [40/0x28] : %s - %s", sprint_hex(data, 4), printBits(2, data));
+ PrintAndLog(" Counter [41/0x29] : %s - %s", sprint_hex(data+4, 4), printBits(2, data+4));
+
+ bool validAuth = (data[8] >= 0x03 && data[8] <= 0x30);
+ if ( validAuth )
+ PrintAndLog(" Auth0 [42/0x2A] : %s page %d/0x%02X and above need authentication", sprint_hex(data+8, 4), data[8],data[8] );
+ else{
+ if ( data[8] == 0){
+ PrintAndLog(" Auth0 [42/0x2A] : %s default", sprint_hex(data+8, 4) );
+ } else {
+ PrintAndLog(" Auth0 [42/0x2A] : %s auth byte is out-of-range", sprint_hex(data+8, 4) );
projects / proxmark3-svn / blobdiff