?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge pull request #2654 from Antiklesys/master
[RRG-proxmark3.git] / client / src / cmdhf14b.c
blob189b1f15be4542a2115445fe0de76938c0bfeb7b
1 //-----------------------------------------------------------------------------
2 // Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
3 //
4 // This program is free software: you can redistribute it and/or modify
5 // it under the terms of the GNU General Public License as published by
6 // the Free Software Foundation, either version 3 of the License, or
7 // (at your option) any later version.
8 //
9 // This program is distributed in the hope that it will be useful,
10 // but WITHOUT ANY WARRANTY; without even the implied warranty of
11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 // GNU General Public License for more details.
13 //
14 // See LICENSE.txt for the text of the license.
15 //-----------------------------------------------------------------------------
16 // High frequency ISO14443B commands
17 //-----------------------------------------------------------------------------
18
19 #include "cmdhf14b.h"
20 #include <ctype.h>
21 #include "iso14b.h"
22 #include "fileutils.h"
23 #include "cmdparser.h" // command_t
24 #include "commonutil.h" // ARRAYLEN
25 #include "comms.h" // clearCommandBuffer
26 #include "emv/emvcore.h" // TLVPrintFromBuffer
27 #include "cmdtrace.h"
28 #include "cliparser.h"
29 #include "crc16.h"
30 #include "cmdhf14a.h"
31 #include "protocols.h" // definitions of ISO14B/7816 protocol
32 #include "iso7816/apduinfo.h" // GetAPDUCodeDescription
33 #include "nfc/ndef.h" // NDEFRecordsDecodeAndPrint
34 #include "aidsearch.h"
35 #include "fileutils.h" // saveFile
36 #include "iclass_cmd.h" // picopass defines
37 #include "cmdhf.h" // handle HF plot
38
39 #define MAX_14B_TIMEOUT_MS (4949U)
40
41 // client side time out, waiting for device to ask tag.
42 #define TIMEOUT 1000
43
44 // client side time out, waiting for device to ask tag a APDU to answer
45 #define APDU_TIMEOUT 2000
46
47 // for static arrays
48 #define ST25TB_SR_BLOCK_SIZE 4
49
50
51 // SR memory sizes
52 #define SR_SIZE_512 1
53 #define SR_SIZE_4K 2
54 // ST235 memory sizes
55 #define ST25_SIZE_512 3
56 #define ST25_SIZE_2K 4
57 #define ST25_SIZE_4K 5
58
59
60 typedef struct {
61 const char *desc;
62 const char *apdu;
63 const uint8_t apdulen;
64 } transport_14b_apdu_t;
65
66
67 // iso14b apdu input frame length
68 static uint16_t apdu_frame_length = 0;
69 //static uint16_t ats_fsc[] = {16, 24, 32, 40, 48, 64, 96, 128, 256};
70 static bool apdu_in_framing_enable = true;
71
72 static int CmdHelp(const char *Cmd);
73
74 static int switch_off_field_14b(void) {
75 SetISODEPState(ISODEP_INACTIVE);
76 iso14b_raw_cmd_t packet = {
77 .flags = ISO14B_DISCONNECT,
78 .timeout = 0,
79 .rawlen = 0,
80 };
81 clearCommandBuffer();
82 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)&packet, sizeof(iso14b_raw_cmd_t));
83 return PM3_SUCCESS;
84 }
85
86 static int clear_trace_14b(void) {
87 iso14b_raw_cmd_t packet = {
88 .flags = ISO14B_CLEARTRACE,
89 .timeout = 0,
90 .rawlen = 0,
91 };
92 clearCommandBuffer();
93 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)&packet, sizeof(iso14b_raw_cmd_t));
94 return PM3_SUCCESS;
95 }
96
97 static void hf14b_aid_search(bool verbose) {
98
99 json_t *root = AIDSearchInit(verbose);
100 if (root == NULL) {
101 switch_off_field_14b();
102 return;
103 }
104
105 PrintAndLogEx(INFO, "-------------------- " _CYAN_("AID Search") " --------------------");
106
107 bool found = false;
108 bool leave_signal_on = true;
109 bool activate_field = true;
110 for (size_t elmindx = 0; elmindx < json_array_size(root); elmindx++) {
111
112 if (kbd_enter_pressed()) {
113 break;
114 }
115
116 json_t *data = AIDSearchGetElm(root, elmindx);
117 uint8_t vaid[200] = {0};
118 int vaidlen = 0;
119
120 if ((AIDGetFromElm(data, vaid, sizeof(vaid), &vaidlen) == false) || (vaidlen == 0)) {
121 continue;
122 }
123
124
125 // COMPUTE APDU
126 uint8_t apdu_data[PM3_CMD_DATA_SIZE] = {0};
127 int apdu_len = 0;
128 sAPDU_t apdu = (sAPDU_t) {0x00, 0xa4, 0x04, 0x00, vaidlen, vaid};
129
130 if (APDUEncodeS(&apdu, false, 0x00, apdu_data, &apdu_len)) {
131 PrintAndLogEx(ERR, "APDU encoding error");
132 return;
133 }
134
135 PrintAndLogEx(DEBUG, ">>>> %s", sprint_hex(apdu_data, apdu_len));
136
137 int resultlen = 0;
138 uint8_t result[1024] = {0};
139 int res = exchange_14b_apdu(apdu_data, apdu_len, activate_field, leave_signal_on, result, sizeof(result), &resultlen, -1);
140 activate_field = false;
141 if (res) {
142 continue;
143 }
144
145 uint16_t sw = get_sw(result, resultlen);
146
147 uint8_t dfname[200] = {0};
148 size_t dfnamelen = 0;
149 if (resultlen > 3) {
150 struct tlvdb *tlv = tlvdb_parse_multi(result, resultlen);
151 if (tlv) {
152 // 0x84 Dedicated File (DF) Name
153 const struct tlv *dfnametlv = tlvdb_get_tlv(tlvdb_find_full(tlv, 0x84));
154 if (dfnametlv) {
155 dfnamelen = dfnametlv->len;
156 memcpy(dfname, dfnametlv->value, dfnamelen);
157 }
158 tlvdb_free(tlv);
159 }
160 }
161
162 if (sw == ISO7816_OK || sw == ISO7816_INVALID_DF || sw == ISO7816_FILE_TERMINATED) {
163 if (sw == ISO7816_OK) {
164 if (verbose) {
165 PrintAndLogEx(SUCCESS, "Application ( " _GREEN_("ok") " )");
166 }
167 } else {
168 if (verbose) {
169 PrintAndLogEx(WARNING, "Application ( " _RED_("blocked") " )");
170 }
171 }
172
173 PrintAIDDescriptionBuf(root, vaid, vaidlen, verbose);
174
175 if (dfnamelen) {
176 if (dfnamelen == vaidlen) {
177 if (memcmp(dfname, vaid, vaidlen) == 0) {
178 if (verbose) {
179 PrintAndLogEx(INFO, "(DF) Name found and equal to AID");
180 }
181 } else {
182 PrintAndLogEx(INFO, "(DF) Name not equal to AID: %s :", sprint_hex(dfname, dfnamelen));
183 PrintAIDDescriptionBuf(root, dfname, dfnamelen, verbose);
184 }
185 } else {
186 PrintAndLogEx(INFO, "(DF) Name not equal to AID: %s :", sprint_hex(dfname, dfnamelen));
187 PrintAIDDescriptionBuf(root, dfname, dfnamelen, verbose);
188 }
189 } else {
190 if (verbose) {
191 PrintAndLogEx(INFO, "(DF) Name not found");
192 }
193 }
194
195 if (verbose) {
196 PrintAndLogEx(SUCCESS, "----------------------------------------------------");
197 }
198 found = true;
199 }
200 }
201 switch_off_field_14b();
202 if (verbose == false && found) {
203 PrintAndLogEx(INFO, "----------------------------------------------------");
204 }
205 }
206
207 static bool wait_14b_response(bool only_first, uint8_t *datalen, uint8_t *data) {
208
209 /* We have scenarios.
210 A - only select
211 B - only normal respose
212 C - both select and response
213 */
214
215 PacketResponseNG resp;
216 if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, TIMEOUT) == false) {
217 PrintAndLogEx(WARNING, "timeout while waiting for reply (first)");
218 return false;
219 }
220
221 if (resp.status == PM3_ETEAROFF) {
222 PrintAndLogEx(INFO, "Writing tear off triggered");
223 return true;
224 }
225
226 if (resp.status != PM3_SUCCESS) {
227 PrintAndLogEx(DEBUG, "first response failed... %d", resp.status);
228 return false;
229 }
230
231 // treat first reponse as same.
232 if (only_first) {
233
234 if (datalen) {
235 *datalen = resp.length;
236 }
237
238 if (data) {
239 memcpy(data, resp.data.asBytes, resp.length);
240 }
241 return true;
242 }
243
244 // wait a second time.
245 if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, TIMEOUT) == false) {
246 PrintAndLogEx(WARNING, "timeout while waiting for reply");
247 return false;
248 }
249
250 if (resp.status != PM3_SUCCESS) {
251 PrintAndLogEx(DEBUG, "second response failed... %d", resp.status);
252 return false;
253 }
254
255 if (datalen) {
256 *datalen = resp.length;
257 }
258 if (data) {
259 memcpy(data, resp.data.asBytes, resp.length);
260 }
261
262 return true;
263 }
264
265 static bool wait_cmd_14b(bool verbose, bool is_select, uint32_t timeout) {
266
267 PacketResponseNG resp;
268 if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, MAX(TIMEOUT, timeout)) == false) {
269 PrintAndLogEx(WARNING, "timeout while waiting for reply");
270 return false;
271 }
272
273 if (resp.status == PM3_ETEAROFF) {
274 PrintAndLogEx(INFO, "Writing tear off triggered");
275 return true;
276 }
277
278 if (is_select) {
279 if (resp.status == PM3_ECARDEXCHANGE) {
280 PrintAndLogEx(INFO, "no response from tag");
281 return false;
282 }
283 if (resp.status != PM3_SUCCESS) {
284 if (verbose) {
285 PrintAndLogEx(INFO, "failed status value... %d", resp.status);
286 }
287 return false;
288 }
289 }
290
291 uint16_t len = resp.length;
292 uint8_t *data = resp.data.asBytes;
293
294 // handle select responses OK
295 if (is_select && verbose) {
296 PrintAndLogEx(SUCCESS, "received " _YELLOW_("%u") " bytes", len);
297 PrintAndLogEx(SUCCESS, "%s", sprint_hex(data, len));
298 return true;
299 }
300
301 // handle raw bytes responses
302 if (verbose) {
303 if (len >= 3) {
304 bool crc = check_crc(CRC_14443_B, data, len);
305
306 PrintAndLogEx(SUCCESS, "received " _YELLOW_("%u") " bytes", len);
307 PrintAndLogEx(SUCCESS, "%s[ " _YELLOW_("%02X %02X") " ] ( %s )",
308 sprint_hex(data, len - 2),
309 data[len - 2],
310 data[len - 1],
311 (crc) ? _GREEN_("ok") : _RED_("fail")
312 );
313 } else if (len == 0) {
314 PrintAndLogEx(INFO, "no response from tag");
315 } else {
316 PrintAndLogEx(SUCCESS, "%s", sprint_hex(data, len));
317 }
318 }
319 return true;
320 }
321
322 static bool get_14b_UID(uint8_t *d, iso14b_type_t *found_type) {
323
324 // sanity checks
325 if (d == NULL || found_type == NULL) {
326 return false;
327 }
328
329 *found_type = ISO14B_NONE;
330
331 iso14b_raw_cmd_t packet = {
332 .flags = (ISO14B_CONNECT | ISO14B_SELECT_SR | ISO14B_DISCONNECT),
333 .timeout = 0,
334 .rawlen = 0,
335 };
336
337 PacketResponseNG resp;
338 clearCommandBuffer();
339 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)&packet, sizeof(iso14b_raw_cmd_t));
340 if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, TIMEOUT)) {
341
342 if (resp.status == PM3_SUCCESS) {
343 memcpy(d, resp.data.asBytes, sizeof(iso14b_card_select_t));
344
345 iso14b_card_select_t *card = (iso14b_card_select_t *)d;
346 uint8_t empty[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
347 if (memcmp(card->uid, empty, card->uidlen) == 0) {
348 return false;
349 }
350 *found_type = ISO14B_SR;
351 return true;
352 }
353 }
354
355 // test 14b standard
356 packet.flags = (ISO14B_CONNECT | ISO14B_SELECT_STD | ISO14B_DISCONNECT);
357
358 clearCommandBuffer();
359 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)&packet, sizeof(iso14b_raw_cmd_t));
360 if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, TIMEOUT)) {
361
362 if (resp.status == PM3_SUCCESS) {
363 memcpy(d, resp.data.asBytes, sizeof(iso14b_card_select_t));
364 *found_type = ISO14B_STANDARD;
365 return true;
366 }
367 }
368
369 // test CT
370 packet.flags = (ISO14B_CONNECT | ISO14B_SELECT_CTS | ISO14B_DISCONNECT);
371 clearCommandBuffer();
372 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)&packet, sizeof(iso14b_raw_cmd_t));
373 if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, TIMEOUT)) {
374
375 if (resp.status == PM3_SUCCESS) {
376 memcpy(d, resp.data.asBytes, sizeof(iso14b_cts_card_select_t));
377 *found_type = ISO14B_CT;
378 return true;
379 }
380 }
381
382 PrintAndLogEx(WARNING, "timeout while waiting for reply");
383 return false;
384 }
385
386 /* extract uid from filename
387 * filename must match '^hf-14b-[0-9A-F]{16}'
388 */
389 uint8_t *get_uid_from_filename(const char *filename) {
390
391 static uint8_t uid[8];
392 memset(uid, 0, 8);
393
394 if (strlen(filename) < 23) {
395 PrintAndLogEx(ERR, "can't get uid from filename '%s'. Expected format is hf-14b-<uid>...", filename);
396 return uid;
397 }
398
399 char *found = strstr(filename, "hf-14b-");
400 if (found == NULL) {
401 PrintAndLogEx(ERR, "can't get uid from filename '%s'. Expected format is hf-14b-<uid>...", filename);
402 return uid;
403 }
404
405 // extract uid part from filename
406 char uidinhex[17] = {0};
407 strncpy(uidinhex, found + 7, 16);
408
409 uidinhex[16] = '\0';
410 int len = hex_to_bytes(uidinhex, uid, 8);
411 if (len == 8) {
412 return SwapEndian64(uid, 8, 8);
413 } else {
414 PrintAndLogEx(ERR, "get_uid_from_filename failed: hex_to_bytes returned %d", len);
415 memset(uid, 0, 8);
416 }
417 return uid;
418 }
419
420 // print full atqb info
421 // bytes
422 // 0,1,2,3 = application data
423 // 4 = bit rate capacity
424 // 5 = max frame size / -4 info
425 // 6 = FWI / Coding options
426 static int print_atqb_resp(uint8_t *data, uint8_t cid) {
427 //PrintAndLogEx(SUCCESS, " UID: %s", sprint_hex(data+1,4));
428 PrintAndLogEx(SUCCESS, " App Data: %s", sprint_hex(data, 4));
429 PrintAndLogEx(SUCCESS, " Protocol: %s", sprint_hex(data + 4, 3));
430 uint8_t BitRate = data[4];
431 if (!BitRate) PrintAndLogEx(SUCCESS, " Bit Rate: 106 kbit/s only PICC <-> PCD");
432 if (BitRate & 0x10) PrintAndLogEx(SUCCESS, " Bit Rate: 212 kbit/s PICC -> PCD supported");
433 if (BitRate & 0x20) PrintAndLogEx(SUCCESS, " Bit Rate: 424 kbit/s PICC -> PCD supported");
434 if (BitRate & 0x40) PrintAndLogEx(SUCCESS, " Bit Rate: 847 kbit/s PICC -> PCD supported");
435 if (BitRate & 0x01) PrintAndLogEx(SUCCESS, " Bit Rate: 212 kbit/s PICC <- PCD supported");
436 if (BitRate & 0x02) PrintAndLogEx(SUCCESS, " Bit Rate: 424 kbit/s PICC <- PCD supported");
437 if (BitRate & 0x04) PrintAndLogEx(SUCCESS, " Bit Rate: 847 kbit/s PICC <- PCD supported");
438 if (BitRate & 0x80) PrintAndLogEx(SUCCESS, " Same bit rate <-> required");
439
440 uint16_t maxFrame = data[5] >> 4;
441 if (maxFrame < 5) maxFrame = 8 * maxFrame + 16;
442 else if (maxFrame == 5) maxFrame = 64;
443 else if (maxFrame == 6) maxFrame = 96;
444 else if (maxFrame == 7) maxFrame = 128;
445 else if (maxFrame == 8) maxFrame = 256;
446 else maxFrame = 257;
447
448 PrintAndLogEx(SUCCESS, "Max Frame Size: %u%s bytes", maxFrame, (maxFrame == 257) ? "+ RFU" : "");
449
450 uint8_t protocolT = data[5] & 0xF;
451 PrintAndLogEx(SUCCESS, " Protocol Type: Protocol is %scompliant with ISO/IEC 14443-4", (protocolT) ? "" : "not ");
452
453 uint8_t fwt = data[6] >> 4;
454 if (fwt < 15) {
455 uint32_t etus = (32 << fwt);
456 uint32_t fwt_time = (302 << fwt);
457 PrintAndLogEx(SUCCESS, "Frame Wait Integer: %u - %u ETUs | %u us", fwt, etus, fwt_time);
458 } else {
459 PrintAndLogEx(SUCCESS, "Frame Wait Integer: %u - RFU", fwt);
460 }
461
462 PrintAndLogEx(SUCCESS, " App Data Code: Application is %s", (data[6] & 4) ? "Standard" : "Proprietary");
463 PrintAndLogEx(SUCCESS, " Frame Options: NAD is %ssupported", (data[6] & 2) ? "" : "not ");
464 PrintAndLogEx(SUCCESS, " Frame Options: CID is %ssupported", (data[6] & 1) ? "" : "not ");
465 PrintAndLogEx(SUCCESS, "Tag :");
466 PrintAndLogEx(SUCCESS, " Max Buf Length: %u (MBLI) %s", cid >> 4, (cid & 0xF0) ? "" : "chained frames not supported");
467 PrintAndLogEx(SUCCESS, " CID : %u", cid & 0x0f);
468 PrintAndLogEx(NORMAL, "");
469
470 PrintAndLogEx(INFO, "--- " _CYAN_("Fingerprint"));
471 if (memcmp(data, "\x54\x43\x4F\x53", 4) == 0) {
472
473 int outlen = 0;
474 uint8_t out[PM3_CMD_DATA_SIZE] = {0};
475 uint8_t tcos_version[] = {0x90, 0xB2, 0x90, 0x00, 0x00};
476 if (exchange_14b_apdu(tcos_version, sizeof(tcos_version), true, false, out, PM3_CMD_DATA_SIZE, &outlen, -1) == PM3_SUCCESS) {
477 if (outlen > 2) {
478 PrintAndLogEx(SUCCESS, "Tiananxin TCOS CPU card... " _YELLOW_("%s"), sprint_ascii(out, outlen - 2));
479 } else {
480 PrintAndLogEx(SUCCESS, "Tiananxin TCOS CPU card... " _RED_("n/a"));
481 }
482 PrintAndLogEx(SUCCESS, "Magic capabilities........ most likely");
483 }
484
485 } else {
486 PrintAndLogEx(INFO, "n/a");
487 }
488 PrintAndLogEx(NORMAL, "");
489 return PM3_SUCCESS;
490 }
491
492 // get SRx chip model (from UID) // from ST Microelectronics
493 static const char *get_st_chip_model(uint8_t id) {
494 switch (id) {
495 case 0x0:
496 return "SRIX4K (Special)";
497 case 0x2:
498 return "SR176";
499 case 0x3:
500 return "SRIX4K";
501 case 0x4:
502 return "SRIX512";
503 case 0x6:
504 return "SRI512";
505 case 0x7:
506 return "SRI4K";
507 case 0xC:
508 return "SRT512";
509 default :
510 return "";
511 }
512 }
513
514 /*
515 static const char *get_st25_chip_model(uint8_t id) {
516 switch (id) {
517 case 0x1B:
518 return "ST25TB512-AC";
519 case 0x33:
520 return "ST25TB512-AT";
521 case 0x3F:
522 return "ST25TB02K";
523 case 0x1F:
524 return "ST25TB04K";
525 default:
526 return "";
527 }
528 }
529 */
530
531 #define ST_LOCK_INFO_EMPTY " "
532 static const char *get_st_lock_info(uint8_t model, const uint8_t *lockbytes, uint8_t blk) {
533 if (blk > 15) {
534 return ST_LOCK_INFO_EMPTY;
535 }
536
537 uint8_t mask = 0;
538 switch (model) {
539 case 0x0: // SRIX4K special
540 case 0x3: // SRIx4K
541 case 0x7: { // SRI4K
542 //only need data[3]
543 switch (blk) {
544 case 7:
545 case 8:
546 mask = 0x01;
547 break;
548 case 9:
549 mask = 0x02;
550 break;
551 case 10:
552 mask = 0x04;
553 break;
554 case 11:
555 mask = 0x08;
556 break;
557 case 12:
558 mask = 0x10;
559 break;
560 case 13:
561 mask = 0x20;
562 break;
563 case 14:
564 mask = 0x40;
565 break;
566 case 15:
567 mask = 0x80;
568 break;
569 default:
570 return ST_LOCK_INFO_EMPTY;
571 }
572 if ((lockbytes[1] & mask) == 0) {
573 return _RED_("1");
574 }
575 return ST_LOCK_INFO_EMPTY;
576 }
577 case 0x4: // SRIX512
578 case 0x6: // SRI512
579 case 0xC: { // SRT512
580 //need data[2] and data[3]
581 uint8_t b = 1;
582 switch (blk) {
583 case 0:
584 mask = 0x01;
585 break;
586 case 1:
587 mask = 0x02;
588 break;
589 case 2:
590 mask = 0x04;
591 break;
592 case 3:
593 mask = 0x08;
594 break;
595 case 4:
596 mask = 0x10;
597 break;
598 case 5:
599 mask = 0x20;
600 break;
601 case 6:
602 mask = 0x40;
603 break;
604 case 7:
605 mask = 0x80;
606 break;
607 case 8:
608 mask = 0x01;
609 b = 0;
610 break;
611 case 9:
612 mask = 0x02;
613 b = 0;
614 break;
615 case 10:
616 mask = 0x04;
617 b = 0;
618 break;
619 case 11:
620 mask = 0x08;
621 b = 0;
622 break;
623 case 12:
624 mask = 0x10;
625 b = 0;
626 break;
627 case 13:
628 mask = 0x20;
629 b = 0;
630 break;
631 case 14:
632 mask = 0x40;
633 b = 0;
634 break;
635 case 15:
636 mask = 0x80;
637 b = 0;
638 break;
639 }
640 if ((lockbytes[b] & mask) == 0) {
641 return _RED_("1");
642 }
643 return ST_LOCK_INFO_EMPTY;
644 }
645 case 0x2: { // SR176
646 //need data[2]
647 switch (blk) {
648 case 0:
649 case 1:
650 mask = 0x1;
651 break;
652 case 2:
653 case 3:
654 mask = 0x2;
655 break;
656 case 4:
657 case 5:
658 mask = 0x4;
659 break;
660 case 6:
661 case 7:
662 mask = 0x8;
663 break;
664 case 8:
665 case 9:
666 mask = 0x10;
667 break;
668 case 10:
669 case 11:
670 mask = 0x20;
671 break;
672 case 12:
673 case 13:
674 mask = 0x40;
675 break;
676 case 14:
677 case 15:
678 mask = 0x80;
679 break;
680 }
681 // iceman: this is opposite! need sample to test with.
682 if ((lockbytes[0] & mask)) {
683 return _RED_("1");
684 }
685 return ST_LOCK_INFO_EMPTY;
686 }
687 default:
688 break;
689 }
690 return ST_LOCK_INFO_EMPTY;
691 }
692
693 static uint8_t get_st_chipid(const uint8_t *uid) {
694 return uid[5] >> 2;
695 }
696
697 /*
698 static uint8_t get_st25_chipid(const uint8_t *uid) {
699 return uid[5];
700 }
701 */
702
703 static uint8_t get_st_cardsize(const uint8_t *uid) {
704 uint8_t chipid = get_st_chipid(uid);
705 switch (chipid) {
706 case 0x0:
707 case 0x3:
708 case 0x7:
709 return SR_SIZE_4K;
710 case 0x4:
711 case 0x6:
712 case 0xC:
713 return SR_SIZE_512;
714 default:
715 return 0;
716 }
717 }
718
719 /*
720
721 static uint8_t get_st25_cardsize(const uint8_t *uid) {
722 uint8_t chipid = get_st25_chipid(uid);
723 switch (chipid) {
724 case 0x1B:
725 case 0x33:
726 return ST25_SIZE_512;
727 case 0x1F:
728 return ST25_SIZE_4K;
729 case 0x3F:
730 return ST25_SIZE_2K;
731 default:
732 return 0;
733 }
734 }
735 */
736
737 // print UID info from SRx chips (ST Microelectronics)
738 static void print_st_general_info(uint8_t *data, uint8_t len) {
739 //uid = first 8 bytes in data
740 uint8_t mfgid = data[6];
741 uint8_t chipid = get_st_chipid(data);
742 PrintAndLogEx(NORMAL, "");
743 PrintAndLogEx(SUCCESS, " UID: " _GREEN_("%s"), sprint_hex(SwapEndian64(data, 8, 8), len));
744 PrintAndLogEx(SUCCESS, " MFG: %02X, " _YELLOW_("%s"), mfgid, getTagInfo(mfgid));
745 PrintAndLogEx(SUCCESS, "Chip: %02X, " _YELLOW_("%s"), chipid, get_st_chip_model(chipid));
746 }
747
748 // print UID info from ASK CT chips
749 static void print_ct_general_info(void *vcard) {
750 iso14b_cts_card_select_t card;
751 memcpy(&card, (iso14b_cts_card_select_t *)vcard, sizeof(iso14b_cts_card_select_t));
752
753 uint32_t uid32 = MemLeToUint4byte(card.uid);
754 PrintAndLogEx(NORMAL, "");
755 PrintAndLogEx(SUCCESS, "ASK C-Ticket");
756 PrintAndLogEx(SUCCESS, " UID: " _GREEN_("%s") " ( " _YELLOW_("%010u") " )", sprint_hex(card.uid, sizeof(card.uid)), uid32);
757 PrintAndLogEx(SUCCESS, " Product Code: %02X", card.pc);
758 PrintAndLogEx(SUCCESS, " Facility Code: %02X", card.fc);
759 PrintAndLogEx(NORMAL, "");
760 }
761
762 static void print_hdr(void) {
763 PrintAndLogEx(NORMAL, "");
764 PrintAndLogEx(INFO, " block# | data |lck| ascii");
765 PrintAndLogEx(INFO, "---------+-------------+---+------");
766 }
767
768 static void print_footer(void) {
769 PrintAndLogEx(INFO, "---------+-------------+---+------");
770 PrintAndLogEx(NORMAL, "");
771 }
772
773 /*
774 static void print_ct_blocks(uint8_t *data, size_t len) {
775
776 size_t blocks = len / ST25TB_SR_BLOCK_SIZE;
777
778 print_hdr();
779
780 for (int i = 0; i <= blocks; i++) {
781 PrintAndLogEx(INFO,
782 "%3d/0x%02X | %s | %s | %s",
783 i,
784 i,
785 sprint_hex(data + (i * 4), 4),
786 " ",
787 sprint_ascii(data + (i * 4), 4)
788 );
789 }
790 print_footer();
791 }
792 */
793
794 static void print_sr_blocks(uint8_t *data, size_t len, const uint8_t *uid, bool dense_output) {
795
796 size_t blocks = (len / ST25TB_SR_BLOCK_SIZE) - 1 ;
797 uint8_t *systemblock = data + blocks * ST25TB_SR_BLOCK_SIZE ;
798 uint8_t chipid = get_st_chipid(uid);
799
800 PrintAndLogEx(NORMAL, "");
801 PrintAndLogEx(INFO, "-------- " _CYAN_("%s tag memory") " ---------", get_st_chip_model(chipid));
802 PrintAndLogEx(DEBUG, "systemblock... " _YELLOW_("%s"), sprint_hex(systemblock, ST25TB_SR_BLOCK_SIZE));
803 PrintAndLogEx(DEBUG, " otp lock... " _YELLOW_("%02x %02x"), *systemblock, *(systemblock + 1));
804
805 print_hdr();
806
807 bool in_repeated_block = false;
808
809
810 for (int i = 0; i < blocks; i++) {
811
812 // suppress repeating blocks, truncate as such that the first and last block with the same data is shown
813 // but the blocks in between are replaced with a single line of "......" if dense_output is enabled
814 uint8_t *blk = data + (i * ST25TB_SR_BLOCK_SIZE);
815 if (dense_output &&
816 (i > 3) &&
817 (i < (blocks - 1)) &&
818 (in_repeated_block == false) &&
819 (memcmp(blk, blk - ST25TB_SR_BLOCK_SIZE, ST25TB_SR_BLOCK_SIZE) == 0) &&
820 (memcmp(blk, blk + ST25TB_SR_BLOCK_SIZE, ST25TB_SR_BLOCK_SIZE) == 0) &&
821 (memcmp(blk, blk + (ST25TB_SR_BLOCK_SIZE * 2), ST25TB_SR_BLOCK_SIZE) == 0)
822 ) {
823 // we're in a user block that isn't the first user block nor last two user blocks,
824 // and the current block data is the same as the previous and next two block
825 in_repeated_block = true;
826 PrintAndLogEx(INFO, " ......");
827 } else if (in_repeated_block &&
828 (memcmp(blk, blk + ST25TB_SR_BLOCK_SIZE, ST25TB_SR_BLOCK_SIZE) || i == blocks)
829 ) {
830 // in a repeating block, but the next block doesn't match anymore, or we're at the end block
831 in_repeated_block = false;
832 }
833
834 if (in_repeated_block == false) {
835 PrintAndLogEx(INFO,
836 "%3d/0x%02X | %s| %s | %s",
837 i,
838 i,
839 sprint_hex(data + (i * ST25TB_SR_BLOCK_SIZE), ST25TB_SR_BLOCK_SIZE),
840 get_st_lock_info(chipid, systemblock, i),
841 sprint_ascii(data + (i * ST25TB_SR_BLOCK_SIZE), ST25TB_SR_BLOCK_SIZE)
842 );
843 }
844 }
845
846 PrintAndLogEx(INFO,
847 "%3d/0x%02X | %s| %s | %s",
848 0xFF,
849 0xFF,
850 sprint_hex(systemblock, ST25TB_SR_BLOCK_SIZE),
851 get_st_lock_info(chipid, systemblock, 0xFF),
852 sprint_ascii(systemblock, ST25TB_SR_BLOCK_SIZE)
853 );
854
855 print_footer();
856 }
857
858 // iceman, calypso?
859 // 05 00 00 = find one tag in field
860 // 1d xx xx xx xx 00 08 01 00 = attrib xx=UID (resp 10 [f9 e0])
861 // 0200a40400 (resp 02 67 00 [29 5b])
862 // 0200a4040c07a0000002480300 (resp 02 67 00 [29 5b])
863 // 0200a4040c07a0000002480200 (resp 02 67 00 [29 5b])
864 // 0200a4040006a0000000010100 (resp 02 6a 82 [4b 4c])
865 // 0200a4040c09d27600002545500200 (resp 02 67 00 [29 5b])
866 // 0200a404000cd2760001354b414e4d30310000 (resp 02 6a 82 [4b 4c])
867 // 0200a404000ca000000063504b43532d313500 (resp 02 6a 82 [4b 4c])
868 // 0200a4040010a000000018300301000000000000000000 (resp 02 6a 82 [4b 4c])
869
870 static int CmdHF14BList(const char *Cmd) {
871 return CmdTraceListAlias(Cmd, "hf 14b", "14b -c");
872 }
873
874 static int CmdHF14BSim(const char *Cmd) {
875
876 CLIParserContext *ctx;
877 CLIParserInit(&ctx, "hf 14b sim",
878 "Simulate a ISO/IEC 14443 type B tag with 4 byte UID / PUPI",
879 "hf 14b sim -u 11AA33BB"
880 );
881
882 void *argtable[] = {
883 arg_param_begin,
884 arg_str1("u", "uid", "hex", "4byte UID/PUPI"),
885 arg_param_end
886 };
887 CLIExecWithReturn(ctx, Cmd, argtable, false);
888
889 uint8_t pupi[4];
890 int n = 0;
891 int res = CLIParamHexToBuf(arg_get_str(ctx, 1), pupi, sizeof(pupi), &n);
892 CLIParserFree(ctx);
893
894 if (res) {
895 PrintAndLogEx(FAILED, "failed to read pupi");
896 return PM3_EINVARG;
897 }
898
899 PrintAndLogEx(INFO, "Simulate with PUPI : " _GREEN_("%s"), sprint_hex_inrow(pupi, sizeof(pupi)));
900 PrintAndLogEx(INFO, "Press " _GREEN_("pm3 button") " to abort simulation");
901 clearCommandBuffer();
902 SendCommandNG(CMD_HF_ISO14443B_SIMULATE, pupi, sizeof(pupi));
903 return PM3_SUCCESS;
904 }
905
906 static int CmdHF14BSniff(const char *Cmd) {
907
908 CLIParserContext *ctx;
909 CLIParserInit(&ctx, "hf 14b sniff",
910 "Sniff the communication between reader and tag\n"
911 "Use `hf 14b list` to view collected data.",
912 "hf 14b sniff"
913 );
914
915 void *argtable[] = {
916 arg_param_begin,
917 arg_param_end
918 };
919 CLIExecWithReturn(ctx, Cmd, argtable, true);
920 CLIParserFree(ctx);
921
922 PrintAndLogEx(INFO, "Press " _GREEN_("pm3 button") " to abort sniffing");
923
924 PacketResponseNG resp;
925 clearCommandBuffer();
926 SendCommandNG(CMD_HF_ISO14443B_SNIFF, NULL, 0);
927 WaitForResponse(CMD_HF_ISO14443B_SNIFF, &resp);
928 PrintAndLogEx(HINT, "Try `" _YELLOW_("hf 14b list") "` to view captured tracelog");
929 PrintAndLogEx(HINT, "Try `" _YELLOW_("trace save -h") "` to save tracelog for later analysing");
930 return PM3_SUCCESS;
931 }
932
933 static int CmdHF14BRaw(const char *Cmd) {
934 CLIParserContext *ctx;
935 CLIParserInit(&ctx, "hf 14b raw",
936 "Sends raw bytes to card. Activates field by default",
937 "hf 14b raw -cks --data 0200a40400 -> standard select, apdu 0200a4000 (7816)\n"
938 "hf 14b raw -ck --sr --data 0200a40400 -> SRx select\n"
939 "hf 14b raw -ck --cts --data 0200a40400 -> C-ticket select\n"
940 );
941
942 void *argtable[] = {
943 arg_param_begin,
944 arg_lit0("a", NULL, "active signal field ON without select"),
945 arg_lit0("c", "crc", "calculate and append CRC"),
946 arg_lit0("k", "keep", "leave the signal field ON after receive response"),
947
948 arg_str0("d", "data", "<hex>", "data, bytes to send"),
949 arg_lit0("r", NULL, "do not read response from card"),
950 arg_int0("t", "timeout", "<dec>", "timeout in ms"),
951
952 arg_lit0("s", "std", "use ISO14B select"),
953 arg_lit0(NULL, "sr", "use SRx ST select"),
954 arg_lit0(NULL, "cts", "use ASK C-ticket select"),
955 arg_lit0(NULL, "xrx", "use Fuji/Xerox select"),
956 arg_lit0(NULL, "pico", "use Picopass select"),
957
958 arg_lit0("v", "verbose", "verbose output"),
959 arg_param_end
960 };
961 CLIExecWithReturn(ctx, Cmd, argtable, false);
962
963 bool activate_field = arg_get_lit(ctx, 1);
964 bool add_crc = arg_get_lit(ctx, 2);
965 bool keep_field_on = arg_get_lit(ctx, 3);
966
967 uint8_t data[PM3_CMD_DATA_SIZE] = {0x00};
968 int datalen = 0;
969 CLIParamHexToBuf(arg_get_str(ctx, 4), data, sizeof(data), &datalen);
970
971 bool read_reply = (arg_get_lit(ctx, 5) == false);
972 int user_timeout = arg_get_int_def(ctx, 6, -1);
973 bool select_std = arg_get_lit(ctx, 7);
974 bool select_sr = arg_get_lit(ctx, 8);
975 bool select_cts = arg_get_lit(ctx, 9);
976 bool select_xrx = arg_get_lit(ctx, 10);
977 bool select_pico = arg_get_lit(ctx, 11);
978 bool verbose = arg_get_lit(ctx, 12);
979 CLIParserFree(ctx);
980
981 // FLAGS for device side
982 uint32_t flags = 0;
983
984 if (activate_field) {
985 flags |= ISO14B_CONNECT;
986 }
987
988 if (add_crc) {
989 flags |= ISO14B_APPEND_CRC;
990 }
991
992 if (select_std) {
993 flags |= (ISO14B_CONNECT | ISO14B_SELECT_STD | ISO14B_CLEARTRACE);
994 if (verbose) {
995 PrintAndLogEx(INFO, "using ISO14443-B select");
996 }
997 } else if (select_sr) {
998 flags |= (ISO14B_CONNECT | ISO14B_SELECT_SR | ISO14B_CLEARTRACE);
999 if (verbose) {
1000 PrintAndLogEx(INFO, "using ST/SRx select");
1001 }
1002 } else if (select_cts) {
1003 flags |= (ISO14B_CONNECT | ISO14B_SELECT_CTS | ISO14B_CLEARTRACE);
1004 if (verbose) {
1005 PrintAndLogEx(INFO, "using ASK/C-ticket select");
1006 }
1007 } else if (select_xrx) {
1008 flags |= (ISO14B_CONNECT | ISO14B_SELECT_XRX | ISO14B_CLEARTRACE);
1009 if (verbose) {
1010 PrintAndLogEx(INFO, "using Fuji/Xerox select");
1011 }
1012 } else if (select_pico) {
1013 flags |= (ISO14B_CONNECT | ISO14B_SELECT_PICOPASS | ISO14B_CLEARTRACE);
1014 if (verbose) {
1015 PrintAndLogEx(INFO, "using Picopass select");
1016 }
1017 }
1018
1019 uint32_t time_wait = 0;
1020 if (user_timeout > 0) {
1021
1022 flags |= ISO14B_SET_TIMEOUT;
1023
1024 if (user_timeout > MAX_14B_TIMEOUT_MS) {
1025 user_timeout = MAX_14B_TIMEOUT_MS;
1026 PrintAndLogEx(INFO, "set timeout to 4.9 seconds. The max we can wait for response");
1027 }
1028
1029 // timeout in ETUs (time to transfer 1 bit, approx. 9.4 us)
1030 time_wait = (uint32_t)((13560 / 128) * user_timeout);
1031 if (verbose)
1032 PrintAndLogEx(INFO, " new raw timeout : %u ETU ( %u ms )", time_wait, user_timeout);
1033 }
1034
1035 if (keep_field_on == false) {
1036 flags |= ISO14B_DISCONNECT;
1037 }
1038
1039 if (datalen > 0) {
1040 flags |= ISO14B_RAW;
1041 }
1042
1043 // Max buffer is PM3_CMD_DATA_SIZE
1044 datalen = (datalen > PM3_CMD_DATA_SIZE) ? PM3_CMD_DATA_SIZE : datalen;
1045
1046 iso14b_raw_cmd_t *packet = (iso14b_raw_cmd_t *)calloc(1, sizeof(iso14b_raw_cmd_t) + datalen);
1047 if (packet == NULL) {
1048 PrintAndLogEx(FAILED, "failed to allocate memory");
1049 return PM3_EMALLOC;
1050 }
1051
1052 packet->flags = flags;
1053 packet->timeout = time_wait;
1054 packet->rawlen = datalen;
1055 memcpy(packet->raw, data, datalen);
1056
1057 clearCommandBuffer();
1058 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)packet, sizeof(iso14b_raw_cmd_t) + packet->rawlen);
1059 free(packet);
1060
1061 if (read_reply == false) {
1062 clearCommandBuffer();
1063 return PM3_SUCCESS;
1064 }
1065
1066 bool success = true;
1067
1068 // Select, device will send back iso14b_card_select_t, don't print it.
1069 if (select_std) {
1070 success = wait_cmd_14b(verbose, true, user_timeout);
1071 if (verbose && success) {
1072 PrintAndLogEx(SUCCESS, "Got response for standard select");
1073 }
1074 }
1075
1076 if (select_sr) {
1077 success = wait_cmd_14b(verbose, true, user_timeout);
1078 if (verbose && success) {
1079 PrintAndLogEx(SUCCESS, "Got response for ST/SRx select");
1080 }
1081 }
1082
1083 if (select_cts) {
1084 success = wait_cmd_14b(verbose, true, user_timeout);
1085 if (verbose && success) {
1086 PrintAndLogEx(SUCCESS, "Got response for ASK/C-ticket select");
1087 }
1088 }
1089
1090 if (select_xrx) {
1091 success = wait_cmd_14b(verbose, true, user_timeout);
1092 if (verbose && success) {
1093 PrintAndLogEx(SUCCESS, "Got response for Fuji/Xerox select");
1094 }
1095 }
1096
1097 if (select_pico) {
1098 success = wait_cmd_14b(verbose, true, user_timeout);
1099 if (verbose && success) {
1100 PrintAndLogEx(SUCCESS, "Got response for Picopass select");
1101 }
1102 }
1103
1104 // get back response from the raw bytes you sent.
1105 if (success && datalen > 0) {
1106 wait_cmd_14b(true, false, user_timeout);
1107 }
1108
1109 return PM3_SUCCESS;
1110 }
1111
1112 // 14b get and print Full Info (as much as we know)
1113 static bool HF14B_Std_Info(bool verbose, bool do_aid_search) {
1114 // 14b get and print UID only (general info)
1115 iso14b_raw_cmd_t packet = {
1116 .flags = (ISO14B_CONNECT | ISO14B_SELECT_STD | ISO14B_DISCONNECT),
1117 .timeout = 0,
1118 .rawlen = 0,
1119 };
1120
1121 clearCommandBuffer();
1122 PacketResponseNG resp;
1123 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)&packet, sizeof(iso14b_raw_cmd_t));
1124 if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, TIMEOUT) == false) {
1125 if (verbose) {
1126 PrintAndLogEx(WARNING, "timeout while waiting for reply");
1127 }
1128 switch_off_field_14b();
1129 return false;
1130 }
1131
1132 switch (resp.status) {
1133 case PM3_SUCCESS: {
1134
1135 iso14b_card_select_t card;
1136 memcpy(&card, (iso14b_card_select_t *)resp.data.asBytes, sizeof(iso14b_card_select_t));
1137
1138 PrintAndLogEx(NORMAL, "");
1139 PrintAndLogEx(INFO, "--- " _CYAN_("Tag Information") " ---------------------------");
1140 PrintAndLogEx(SUCCESS, " UID : " _GREEN_("%s"), sprint_hex(card.uid, card.uidlen));
1141 PrintAndLogEx(SUCCESS, " ATQB : %s", sprint_hex(card.atqb, sizeof(card.atqb)));
1142 PrintAndLogEx(SUCCESS, " CHIPID : %02X", card.chipid);
1143 print_atqb_resp(card.atqb, card.cid);
1144
1145 if (do_aid_search) {
1146 hf14b_aid_search(verbose);
1147 }
1148
1149 return true;
1150 }
1151 case PM3_ELENGTH:
1152 if (verbose) PrintAndLogEx(FAILED, "ISO 14443-3 STD ATTRIB fail");
1153 break;
1154 case PM3_ECRC:
1155 if (verbose) PrintAndLogEx(FAILED, "ISO 14443-3 STD CRC fail");
1156 break;
1157 default:
1158 if (verbose) PrintAndLogEx(FAILED, "ISO 14443-b STD select failed");
1159 break;
1160 }
1161
1162 return false;
1163 }
1164
1165 // SRx get and print full info (needs more info...)
1166 static bool HF14B_ST_Info(bool verbose, bool do_aid_search) {
1167
1168 iso14b_raw_cmd_t packet = {
1169 .flags = (ISO14B_CONNECT | ISO14B_SELECT_SR | ISO14B_DISCONNECT),
1170 .timeout = 0,
1171 .rawlen = 0,
1172 };
1173
1174 clearCommandBuffer();
1175 PacketResponseNG resp;
1176 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)&packet, sizeof(iso14b_raw_cmd_t));
1177 if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, TIMEOUT) == false) {
1178 if (verbose) {
1179 PrintAndLogEx(WARNING, "timeout while waiting for reply");
1180 }
1181 return false;
1182 }
1183
1184 if (resp.status != PM3_SUCCESS) {
1185 return false;
1186 }
1187
1188 iso14b_card_select_t card;
1189 memcpy(&card, (iso14b_card_select_t *)resp.data.asBytes, sizeof(iso14b_card_select_t));
1190
1191 uint8_t empty[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
1192 if ((card.uidlen != 8) || (memcmp(card.uid, empty, card.uidlen) == 0)) {
1193 return false;
1194 }
1195
1196 print_st_general_info(card.uid, card.uidlen);
1197
1198 if (do_aid_search) {
1199 hf14b_aid_search(verbose);
1200 }
1201 return true;
1202 }
1203
1204 // menu command to get and print all info known about any known 14b tag
1205 static int CmdHF14Binfo(const char *Cmd) {
1206 CLIParserContext *ctx;
1207 CLIParserInit(&ctx, "hf 14b info",
1208 "Tag information for ISO/IEC 14443 type B based tags",
1209 "hf 14b info\n"
1210 );
1211
1212 void *argtable[] = {
1213 arg_param_begin,
1214 arg_lit0("s", "aidsearch", "checks if AIDs from aidlist.json is present on the card and prints information about found AIDs"),
1215 arg_lit0("v", "verbose", "verbose output"),
1216 arg_param_end
1217 };
1218 CLIExecWithReturn(ctx, Cmd, argtable, true);
1219 bool do_aid_search = arg_get_lit(ctx, 1);
1220 bool verbose = arg_get_lit(ctx, 2);
1221 CLIParserFree(ctx);
1222 return infoHF14B(verbose, do_aid_search);
1223 }
1224
1225 // #define ISO14443B_READ_BLK 0x08
1226 // #define ISO14443B_WRITE_BLK 0x09
1227
1228 static int read_sr_block(uint8_t blockno, uint8_t *out, uint16_t out_len) {
1229 struct {
1230 uint8_t blockno;
1231 } PACKED payload;
1232
1233 payload.blockno = blockno;
1234
1235 PacketResponseNG resp;
1236 clearCommandBuffer();
1237 SendCommandNG(CMD_HF_SRI_READ, (uint8_t *)&payload, sizeof(payload));
1238 if (WaitForResponseTimeout(CMD_HF_SRI_READ, &resp, TIMEOUT) == false) {
1239 return PM3_ETIMEOUT;
1240 }
1241
1242 if (resp.status == PM3_SUCCESS && out) {
1243 memcpy(out, resp.data.asBytes, MIN(out_len, resp.length));
1244 }
1245 return resp.status;
1246 }
1247
1248 static int write_sr_block(uint8_t blockno, uint8_t datalen, uint8_t *data) {
1249
1250 uint8_t psize = sizeof(iso14b_raw_cmd_t) + datalen + 2;
1251 iso14b_raw_cmd_t *packet = (iso14b_raw_cmd_t *)calloc(1, psize);
1252 if (packet == NULL) {
1253 PrintAndLogEx(FAILED, "failed to allocate memory");
1254 return PM3_EMALLOC;
1255 }
1256
1257 packet->flags = (ISO14B_CONNECT | ISO14B_SELECT_SR | ISO14B_RAW | ISO14B_APPEND_CRC | ISO14B_DISCONNECT);
1258 packet->timeout = 0;
1259 packet->rawlen = 6;
1260 packet->raw[0] = ISO14443B_WRITE_BLK;
1261 packet->raw[1] = blockno;
1262 packet->raw[2] = data[0];
1263 packet->raw[3] = data[1];
1264 packet->raw[4] = data[2];
1265 packet->raw[5] = data[3];
1266
1267 // SRx get and print general info about SRx chip from UID
1268 clearCommandBuffer();
1269 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)packet, psize);
1270 free(packet);
1271
1272 if (wait_14b_response(true, NULL, NULL) == false) {
1273 PrintAndLogEx(FAILED, "SRx write block ( " _RED_("failed") " )");
1274 return PM3_ESOFT;
1275 }
1276 return PM3_SUCCESS;
1277 }
1278
1279 static bool HF14B_st_reader(bool verbose) {
1280
1281 iso14b_raw_cmd_t packet = {
1282 .flags = (ISO14B_CONNECT | ISO14B_SELECT_SR | ISO14B_DISCONNECT),
1283 .timeout = 0,
1284 .rawlen = 0,
1285 };
1286
1287 // SRx get and print general info about SRx chip from UID
1288 clearCommandBuffer();
1289 PacketResponseNG resp;
1290 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)&packet, sizeof(iso14b_raw_cmd_t));
1291 if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, TIMEOUT) == false) {
1292 if (verbose) {
1293 PrintAndLogEx(WARNING, "timeout while waiting for reply");
1294 }
1295 return false;
1296 }
1297
1298 switch (resp.status) {
1299 case PM3_SUCCESS: {
1300 iso14b_card_select_t card;
1301 memcpy(&card, (iso14b_card_select_t *)resp.data.asBytes, sizeof(iso14b_card_select_t));
1302
1303 uint8_t empty[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
1304 if ((card.uidlen != 8) || (memcmp(card.uid, empty, card.uidlen) == 0)) {
1305 return false;
1306 }
1307 print_st_general_info(card.uid, card.uidlen);
1308 return true;
1309 }
1310 case PM3_ELENGTH:
1311 if (verbose) PrintAndLogEx(FAILED, "ISO 14443-3 ST ATTRIB fail");
1312 break;
1313 case PM3_ECRC:
1314 if (verbose) PrintAndLogEx(FAILED, "ISO 14443-3 ST CRC fail");
1315 break;
1316 case PM3_EWRONGANSWER:
1317 if (verbose) PrintAndLogEx(FAILED, "ISO 14443-3 ST random chip id fail");
1318 break;
1319 default:
1320 if (verbose) PrintAndLogEx(FAILED, "ISO 14443-b ST select SRx failed");
1321 break;
1322 }
1323 return false;
1324 }
1325
1326 static bool HF14B_std_reader(bool verbose) {
1327 iso14b_raw_cmd_t packet = {
1328 .flags = (ISO14B_CONNECT | ISO14B_SELECT_STD | ISO14B_DISCONNECT),
1329 .timeout = 0,
1330 .rawlen = 0,
1331 };
1332
1333 // 14b get and print UID only (general info)
1334 clearCommandBuffer();
1335 PacketResponseNG resp;
1336 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)&packet, sizeof(iso14b_raw_cmd_t));
1337 if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, TIMEOUT) == false) {
1338 if (verbose) {
1339 PrintAndLogEx(WARNING, "timeout while waiting for reply");
1340 }
1341 return false;
1342 }
1343
1344 switch (resp.status) {
1345 case PM3_SUCCESS: {
1346 iso14b_card_select_t card;
1347 memcpy(&card, (iso14b_card_select_t *)resp.data.asBytes, sizeof(iso14b_card_select_t));
1348
1349 uint8_t empty[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
1350 if (memcmp(card.uid, empty, card.uidlen) == 0) {
1351 return false;
1352 }
1353 PrintAndLogEx(NORMAL, "");
1354 PrintAndLogEx(SUCCESS, " UID : " _GREEN_("%s"), sprint_hex(card.uid, card.uidlen));
1355 PrintAndLogEx(SUCCESS, " ATQB : %s", sprint_hex(card.atqb, sizeof(card.atqb)));
1356 PrintAndLogEx(SUCCESS, " CHIPID : %02X", card.chipid);
1357 print_atqb_resp(card.atqb, card.cid);
1358 return true;
1359 }
1360 case PM3_ELENGTH: {
1361 if (verbose) PrintAndLogEx(FAILED, "ISO 14443-3 ATTRIB fail");
1362 break;
1363 }
1364 case PM3_ECRC: {
1365 if (verbose) PrintAndLogEx(FAILED, "ISO 14443-3 CRC fail");
1366 break;
1367 }
1368 default: {
1369 if (verbose) PrintAndLogEx(FAILED, "ISO 14443-b card select failed");
1370 break;
1371 }
1372 }
1373 return false;
1374 }
1375
1376 static bool HF14B_ask_ct_reader(bool verbose) {
1377
1378 iso14b_raw_cmd_t packet = {
1379 .flags = (ISO14B_CONNECT | ISO14B_SELECT_CTS | ISO14B_DISCONNECT),
1380 .timeout = 0,
1381 .rawlen = 0,
1382 };
1383
1384 // 14b get and print UID only (general info)
1385 clearCommandBuffer();
1386 PacketResponseNG resp;
1387 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)&packet, sizeof(iso14b_raw_cmd_t));
1388 if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, TIMEOUT) == false) {
1389 if (verbose) PrintAndLogEx(WARNING, "timeout while waiting for reply");
1390 return false;
1391 }
1392
1393 switch (resp.status) {
1394 case PM3_SUCCESS: {
1395 print_ct_general_info(resp.data.asBytes);
1396 return true;
1397 }
1398 case PM3_ELENGTH: {
1399 if (verbose) PrintAndLogEx(FAILED, "ISO 14443-3 CTS wrong length");
1400 break;
1401 }
1402 case PM3_ECRC: {
1403 if (verbose) PrintAndLogEx(FAILED, "ISO 14443-3 CTS CRC fail");
1404 break;
1405 }
1406 default: {
1407 if (verbose) PrintAndLogEx(FAILED, "ISO 14443-b CTS select failed");
1408 break;
1409 }
1410 }
1411 return false;
1412 }
1413
1414 bool HF14B_picopass_reader(bool verbose, bool info) {
1415
1416 iso14b_raw_cmd_t packet = {
1417 .flags = (ISO14B_CONNECT | ISO14B_SELECT_PICOPASS | ISO14B_DISCONNECT),
1418 .timeout = 0,
1419 .rawlen = 0,
1420 };
1421
1422 // 14b get and print UID only (general info)
1423 clearCommandBuffer();
1424 PacketResponseNG resp;
1425 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)&packet, sizeof(iso14b_raw_cmd_t));
1426 if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, TIMEOUT) == false) {
1427 if (verbose) PrintAndLogEx(WARNING, "timeout while waiting for reply");
1428 return false;
1429 }
1430
1431 switch (resp.status) {
1432 case PM3_SUCCESS: {
1433
1434 picopass_hdr_t *card = calloc(1, sizeof(picopass_hdr_t));
1435 if (card == NULL) {
1436 PrintAndLogEx(FAILED, "failed to allocate memory");
1437 return false;
1438 }
1439 memcpy(card, resp.data.asBytes, sizeof(picopass_hdr_t));
1440 if (info) {
1441 PrintAndLogEx(NORMAL, "");
1442 PrintAndLogEx(SUCCESS, "iCLASS / Picopass CSN: " _GREEN_("%s"), sprint_hex(card->csn, sizeof(card->csn)));
1443 }
1444 free(card);
1445 return true;
1446 }
1447 case PM3_ELENGTH: {
1448 if (verbose) PrintAndLogEx(FAILED, "ISO 14443-3 wrong length");
1449 break;
1450 }
1451 case PM3_ECRC: {
1452 if (verbose) PrintAndLogEx(FAILED, "ISO 14443-3 CRC fail");
1453 break;
1454 }
1455 default: {
1456 if (verbose) PrintAndLogEx(FAILED, "ISO 14443-b Picopass select failed");
1457 break;
1458 }
1459 }
1460 return false;
1461 }
1462
1463 // test for other 14b type tags (mimic another reader - don't have tags to identify)
1464 static bool HF14B_other_reader(bool verbose) {
1465
1466 iso14b_raw_cmd_t *packet = (iso14b_raw_cmd_t *)calloc(1, sizeof(iso14b_raw_cmd_t) + 4);
1467 if (packet == NULL) {
1468 PrintAndLogEx(FAILED, "failed to allocate memory");
1469 return false;
1470 }
1471 packet->flags = (ISO14B_CONNECT | ISO14B_SELECT_STD | ISO14B_RAW | ISO14B_APPEND_CRC);
1472 packet->timeout = 0;
1473 packet->rawlen = 4;
1474 memcpy(packet->raw, "\x00\x0b\x3f\x80", 4);
1475
1476 // 14b get and print UID only (general info)
1477
1478 clearCommandBuffer();
1479 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)packet, sizeof(iso14b_raw_cmd_t) + packet->rawlen);
1480
1481 // wait for the select message and wait for response
1482 if (wait_14b_response(false, NULL, NULL)) {
1483 PrintAndLogEx(SUCCESS, "\n14443-3b tag found:");
1484 PrintAndLogEx(SUCCESS, "unknown tag type answered to a " _YELLOW_("0x000b3f80") " command");
1485 switch_off_field_14b();
1486 free(packet);
1487 return true;
1488 }
1489
1490 packet->rawlen = 1;
1491 packet->raw[0] = ISO14443B_AUTHENTICATE;
1492 clearCommandBuffer();
1493 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)packet, sizeof(iso14b_raw_cmd_t) + packet->rawlen);
1494
1495 if (wait_14b_response(false, NULL, NULL)) {
1496 PrintAndLogEx(SUCCESS, "\n14443-3b tag found:");
1497 PrintAndLogEx(SUCCESS, "Unknown tag type answered to a " _YELLOW_("0x0A") " command");
1498 switch_off_field_14b();
1499 free(packet);
1500 return true;
1501 }
1502
1503 packet->raw[0] = ISO14443B_RESET;
1504 clearCommandBuffer();
1505 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)packet, sizeof(iso14b_raw_cmd_t) + packet->rawlen);
1506 free(packet);
1507 if (wait_14b_response(false, NULL, NULL)) {
1508 PrintAndLogEx(SUCCESS, "\n14443-3b tag found:");
1509 PrintAndLogEx(SUCCESS, "Unknown tag type answered to a " _YELLOW_("0x0C") " command");
1510 switch_off_field_14b();
1511 return true;
1512 }
1513
1514 switch_off_field_14b();
1515 return false;
1516 }
1517
1518 // menu command to get and print general info about all known 14b chips
1519 static int CmdHF14BReader(const char *Cmd) {
1520 CLIParserContext *ctx;
1521 CLIParserInit(&ctx, "hf 14b reader",
1522 "Act as a 14443B reader to identify a tag",
1523 "hf 14b reader\n"
1524 "hf 14b reader -@ -> continuous reader mode"
1525 );
1526
1527 void *argtable[] = {
1528 arg_param_begin,
1529 arg_lit0(NULL, "plot", "show anticollision signal trace in plot window"),
1530 arg_lit0("v", "verbose", "verbose output"),
1531 arg_lit0("@", NULL, "optional - continuous reader mode"),
1532 arg_param_end
1533 };
1534 CLIExecWithReturn(ctx, Cmd, argtable, true);
1535 bool read_plot = arg_get_lit(ctx, 1);
1536 bool verbose = arg_get_lit(ctx, 2);
1537 bool cm = arg_get_lit(ctx, 3);
1538 CLIParserFree(ctx);
1539
1540 if (cm) {
1541 PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
1542 }
1543
1544 clear_trace_14b();
1545
1546 return readHF14B(cm, verbose, read_plot);
1547 }
1548
1549 // Read SRI512|SRIX4K block
1550 static int CmdHF14BSriRdBl(const char *Cmd) {
1551
1552 CLIParserContext *ctx;
1553 CLIParserInit(&ctx, "hf 14b rdbl",
1554 "Read SRI512 | SRIX4K block",
1555 "hf 14b rdbl -b 06\n"
1556 );
1557
1558 void *argtable[] = {
1559 arg_param_begin,
1560 arg_int0("b", "block", "<dec>", "block number"),
1561 arg_param_end
1562 };
1563 CLIExecWithReturn(ctx, Cmd, argtable, false);
1564 int blockno = arg_get_int_def(ctx, 1, -1);
1565 CLIParserFree(ctx);
1566
1567 /*
1568 iso14b_card_select_t card;
1569 if (get_14b_UID(&card) == false) {
1570 PrintAndLogEx(WARNING, "no tag found");
1571 return PM3_SUCCESS;
1572 }
1573
1574 if (card.uidlen != 8) {
1575 PrintAndLogEx(FAILED, "current read command only work with SRI4K / SRI512 tags");
1576 return PM3_SUCCESS;
1577 }
1578
1579 // detect cardsize
1580 // 1 = 4096
1581 // 2 = 512
1582 uint8_t cardtype = get_st_cardsize(card.uid);
1583 uint8_t blocks = (cardtype == 1) ? 0x7F : 0x0F;
1584 */
1585
1586 uint8_t out[ST25TB_SR_BLOCK_SIZE] = {0};
1587 int status = read_sr_block(blockno, out, sizeof(out));
1588 if (status == PM3_SUCCESS) {
1589 PrintAndLogEx(SUCCESS, "block %02u... " _GREEN_("%s") " | " _GREEN_("%s"), blockno, sprint_hex(out, sizeof(out)), sprint_ascii(out, sizeof(out)));
1590 }
1591 return status;
1592 }
1593
1594 // New command to write a SRI512/SRIX4K tag.
1595 static int CmdHF14BSriWrbl(const char *Cmd) {
1596 /*
1597 * For SRIX4K blocks 00 - 7F
1598 * hf 14b raw --sr -c --data [09 $srix4kwblock $srix4kwdata
1599 *
1600 * For SR512 blocks 00 - 0F
1601 * hf 14b raw --sr -c --data [09 $sr512wblock $sr512wdata]
1602 *
1603 * Special block FF = otp_lock_reg block.
1604 * Data len 4 bytes-
1605 */
1606
1607 CLIParserContext *ctx;
1608 CLIParserInit(&ctx, "hf 14b wrbl",
1609 "Write data to a SRI512 or SRIX4K block\n"
1610 "If writing to a block out-of-range, use `--force` to override checks\n"
1611 "Special block at end denots OTP and lock bits among others",
1612 "hf 14b wrbl --4k -b 100 -d 11223344\n"
1613 "hf 14b wrbl --4k --sb -d 11223344 --> special block write\n"
1614 "hf 14b wrbl --512 -b 15 -d 11223344\n"
1615 "hf 14b wrbl --512 --sb -d 11223344 --> special block write\n"
1616 );
1617
1618 void *argtable[] = {
1619 arg_param_begin,
1620 arg_int0("b", "block", "<dec>", "block number"),
1621 arg_str1("d", "data", "<hex>", "4 hex bytes"),
1622 arg_lit0(NULL, "512", "target SRI 512 tag"),
1623 arg_lit0(NULL, "4k", "target SRIX 4k tag (def)"),
1624 arg_lit0(NULL, "sb", "special block write at end of memory (0xFF)"),
1625 arg_lit0(NULL, "force", "overrides block range checks"),
1626 arg_param_end
1627 };
1628 CLIExecWithReturn(ctx, Cmd, argtable, false);
1629 int blockno = arg_get_int_def(ctx, 1, -1);
1630 int dlen = 0;
1631 uint8_t data[ST25TB_SR_BLOCK_SIZE] = {0, 0, 0, 0};
1632 int res = CLIParamHexToBuf(arg_get_str(ctx, 2), data, sizeof(data), &dlen);
1633 if (res) {
1634 CLIParserFree(ctx);
1635 return PM3_EINVARG;
1636 }
1637
1638 bool use_sri512 = arg_get_lit(ctx, 3);
1639 bool use_srix4k = arg_get_lit(ctx, 4);
1640 bool special = arg_get_lit(ctx, 5);
1641 bool override = arg_get_lit(ctx, 6);
1642 CLIParserFree(ctx);
1643
1644 if (dlen != sizeof(data)) {
1645 PrintAndLogEx(FAILED, "data must be 4 hex bytes, got %d", dlen);
1646 return PM3_EINVARG;
1647 }
1648
1649 if (use_sri512 + use_srix4k > 1) {
1650 PrintAndLogEx(FAILED, "Select only one card type");
1651 return PM3_EINVARG;
1652 }
1653
1654 // Set default
1655 if (use_sri512 == false) {
1656 use_srix4k = true;
1657 }
1658
1659 if (use_srix4k && blockno > 0x7F) {
1660 PrintAndLogEx(FAILED, "block number out of range, max 127 (0x7F), got " _RED_("%u"), blockno);
1661 if (override) {
1662 PrintAndLogEx(INFO, "overriding block check");
1663 } else {
1664 return PM3_EINVARG;
1665 }
1666 }
1667
1668 if (use_sri512 && blockno > 0x0F) {
1669 PrintAndLogEx(FAILED, "block number out of range, max 15 (0x0F), got " _RED_("%u"), blockno);
1670 if (override) {
1671 PrintAndLogEx(INFO, "overriding block check");
1672 } else {
1673 return PM3_EINVARG;
1674 }
1675 }
1676
1677 // special block at end of memory
1678 if (special) {
1679 blockno = 0xFF;
1680 PrintAndLogEx(SUCCESS, _YELLOW_("%s") " Write special block %02X - " _YELLOW_("%s"),
1681 (use_srix4k) ? "SRIX4K" : "SRI512",
1682 blockno,
1683 sprint_hex(data, sizeof(data))
1684 );
1685 } else {
1686 PrintAndLogEx(SUCCESS, _YELLOW_("%s") " Write block %02X - " _YELLOW_("%s"),
1687 (use_srix4k) ? "SRIX4K" : "SRI512",
1688 blockno,
1689 sprint_hex(data, sizeof(data))
1690 );
1691 }
1692
1693 int status = write_sr_block(blockno, ST25TB_SR_BLOCK_SIZE, data);
1694 if (status != PM3_SUCCESS) {
1695 return status;
1696 }
1697
1698 // verify
1699 uint8_t out[ST25TB_SR_BLOCK_SIZE] = {0};
1700 status = read_sr_block(blockno, out, sizeof(out));
1701 if (status == PM3_SUCCESS) {
1702 if (memcmp(data, out, 4) == 0) {
1703 PrintAndLogEx(SUCCESS, "SRx write block ( " _GREEN_("ok") " )");
1704 }
1705 } else {
1706 PrintAndLogEx(INFO, "Verifying block ( " _RED_("failed") " )");
1707 }
1708 return status;
1709 }
1710
1711 // need to write to file
1712 static int CmdHF14BDump(const char *Cmd) {
1713
1714 CLIParserContext *ctx;
1715 CLIParserInit(&ctx, "hf 14b dump",
1716 "This command dumps the contents of a ISO-14443-B tag and save it to file\n"
1717 "Tries to autodetect cardtype, memory size defaults to SRI4K",
1718 "hf 14b dump\n"
1719 "hf 14b dump -f myfilename\n"
1720 );
1721
1722 void *argtable[] = {
1723 arg_param_begin,
1724 arg_str0("f", "file", "<fn>", "(optional) filename, if no <name> UID will be used as filename"),
1725 arg_lit0(NULL, "ns", "no save to file"),
1726 arg_lit0("z", "dense", "dense dump output style"),
1727 arg_param_end
1728 };
1729 CLIExecWithReturn(ctx, Cmd, argtable, true);
1730
1731 int fnlen = 0;
1732 char filename[FILE_PATH_SIZE] = {0};
1733 CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
1734 bool nosave = arg_get_lit(ctx, 2);
1735 bool dense_output = (g_session.dense_output || arg_get_lit(ctx, 3));
1736 CLIParserFree(ctx);
1737
1738
1739 uint8_t select[sizeof(iso14b_card_select_t)] = {0};
1740 iso14b_type_t select_cardtype = ISO14B_NONE;
1741 if (get_14b_UID(select, &select_cardtype) == false) {
1742 PrintAndLogEx(WARNING, "no tag found");
1743 return PM3_SUCCESS;
1744 }
1745
1746 if (select_cardtype == ISO14B_CT) {
1747 iso14b_cts_card_select_t ct_card;
1748 memcpy(&ct_card, (iso14b_cts_card_select_t *)&select, sizeof(iso14b_cts_card_select_t));
1749
1750 uint32_t uid32 = MemLeToUint4byte(ct_card.uid);
1751 PrintAndLogEx(SUCCESS, "UID: " _GREEN_("%s") " ( " _YELLOW_("%010u") " )", sprint_hex(ct_card.uid, 4), uid32);
1752
1753 // Have to figure out how large one of these are..
1754 PrintAndLogEx(FAILED, "Dumping CT tags is not implemented yet.");
1755
1756 // print_ct_blocks(data, cardsize);
1757 return switch_off_field_14b();
1758 }
1759
1760 if (select_cardtype == ISO14B_STANDARD) {
1761 // Have to figure out how large one of these are..
1762 PrintAndLogEx(FAILED, "Dumping Standard ISO14443-B tags is not implemented yet.");
1763 // print_std_blocks(data, cardsize);
1764 return switch_off_field_14b();
1765 }
1766
1767 if (select_cardtype == ISO14B_SR) {
1768 iso14b_card_select_t card;
1769 memcpy(&card, (iso14b_card_select_t *)&select, sizeof(iso14b_card_select_t));
1770
1771 // detect cardsize
1772 // 1 = 4096
1773 // 2 = 512
1774 uint8_t cardtype = get_st_cardsize(card.uid);
1775 uint8_t lastblock = 0;
1776 uint16_t cardsize = 0;
1777
1778 switch (cardtype) {
1779 case SR_SIZE_512:
1780 cardsize = (512 / 8) + ST25TB_SR_BLOCK_SIZE;
1781 lastblock = 0x0F;
1782 break;
1783 case SR_SIZE_4K:
1784 default:
1785 cardsize = (4096 / 8) + ST25TB_SR_BLOCK_SIZE;
1786 lastblock = 0x7F;
1787 break;
1788 }
1789
1790 uint8_t chipid = get_st_chipid(card.uid);
1791 PrintAndLogEx(SUCCESS, "found a " _GREEN_("%s") " tag", get_st_chip_model(chipid));
1792
1793 // detect blocksize from card :)
1794 PrintAndLogEx(INFO, "reading tag memory");
1795
1796 iso14b_raw_cmd_t *packet = (iso14b_raw_cmd_t *)calloc(1, sizeof(iso14b_raw_cmd_t) + 2);
1797 if (packet == NULL) {
1798 PrintAndLogEx(FAILED, "failed to allocate memory");
1799 return PM3_EMALLOC;
1800 }
1801 packet->flags = (ISO14B_CONNECT | ISO14B_SELECT_SR);
1802 packet->timeout = 0;
1803 packet->rawlen = 0;
1804
1805 clearCommandBuffer();
1806 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)packet, sizeof(iso14b_raw_cmd_t));
1807 PacketResponseNG resp;
1808
1809 // select SR tag
1810 if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, 2000)) {
1811 if (resp.status != PM3_SUCCESS) {
1812 PrintAndLogEx(FAILED, "failed to select ( " _RED_("%d") " )", resp.status);
1813 free(packet);
1814 return switch_off_field_14b();
1815 }
1816 }
1817
1818 PrintAndLogEx(INFO, "." NOLF);
1819
1820 uint8_t data[cardsize];
1821 memset(data, 0, sizeof(data));
1822 uint16_t blocknum = 0;
1823
1824 for (int retry = 0; retry < 3; retry++) {
1825
1826 // set up the read command
1827 packet->flags = (ISO14B_APPEND_CRC | ISO14B_RAW);
1828 packet->rawlen = 2;
1829 packet->raw[0] = ISO14443B_READ_BLK;
1830 packet->raw[1] = blocknum & 0xFF;
1831
1832 clearCommandBuffer();
1833 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)packet, sizeof(iso14b_raw_cmd_t) + 2);
1834 if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, 2000)) {
1835
1836 if (resp.status != PM3_SUCCESS) {
1837 PrintAndLogEx(FAILED, "retrying one more time");
1838 continue;
1839 }
1840
1841 uint8_t *recv = resp.data.asBytes;
1842
1843 if (check_crc(CRC_14443_B, recv, resp.length) == false) {
1844 PrintAndLogEx(FAILED, "crc fail, retrying one more time");
1845 continue;
1846 }
1847
1848 // last read
1849 if (blocknum == 0xFF) {
1850 // we reserved space for this block after 0x0F and 0x7F, ie 0x10, 0x80
1851 memcpy(data + ((lastblock + 1) * ST25TB_SR_BLOCK_SIZE), recv, ST25TB_SR_BLOCK_SIZE);
1852 break;
1853 }
1854 memcpy(data + (blocknum * ST25TB_SR_BLOCK_SIZE), recv, ST25TB_SR_BLOCK_SIZE);
1855
1856
1857 retry = 0;
1858 blocknum++;
1859 if (blocknum > lastblock) {
1860 // read config block
1861 blocknum = 0xFF;
1862 }
1863
1864 PrintAndLogEx(NORMAL, "." NOLF);
1865 fflush(stdout);
1866 }
1867 }
1868 free(packet);
1869
1870 PrintAndLogEx(NORMAL, "");
1871 switch_off_field_14b();
1872
1873 if (blocknum != 0xFF) {
1874 PrintAndLogEx(FAILED, "dump failed");
1875 return PM3_ESOFT;
1876 }
1877
1878 print_sr_blocks(data, cardsize, card.uid, dense_output);
1879
1880 if (nosave) {
1881 PrintAndLogEx(INFO, "Called with no save option");
1882 PrintAndLogEx(NORMAL, "");
1883 return PM3_SUCCESS;
1884 }
1885
1886 // save to file
1887 if (fnlen < 1) {
1888 PrintAndLogEx(INFO, "using UID as filename");
1889 char *fptr = filename + snprintf(filename, sizeof(filename), "hf-14b-");
1890 FillFileNameByUID(fptr, SwapEndian64(card.uid, card.uidlen, 8), "-dump", card.uidlen);
1891 }
1892
1893 size_t datalen = (lastblock + 2) * ST25TB_SR_BLOCK_SIZE;
1894 pm3_save_dump(filename, data, datalen, jsf14b_v2);
1895 }
1896
1897 return PM3_ESOFT;
1898 }
1899
1900 static int CmdHF14BRestore(const char *Cmd) {
1901
1902 CLIParserContext *ctx;
1903 CLIParserInit(&ctx, "hf 14b restore",
1904 "Restore data from (bin/eml/json) dump file to tag\n"
1905 "If the dump file includes the special block at the end it will be ignored\n",
1906 "hf 14b restore --4k -f myfilename\n"
1907 "hf 14b restore --512 -f myfilename\n"
1908 );
1909
1910 void *argtable[] = {
1911 arg_param_begin,
1912 arg_str0("f", "file", "<fn>", "(optional) filename, if no <name> UID will be used as filename"),
1913 arg_lit0(NULL, "512", "target SRI 512 tag"),
1914 arg_lit0(NULL, "4k", "target SRIX 4k tag (def)"),
1915 arg_param_end
1916 };
1917 CLIExecWithReturn(ctx, Cmd, argtable, true);
1918
1919 int fnlen = 0;
1920 char filename[FILE_PATH_SIZE] = {0};
1921 CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
1922 bool use_sri512 = arg_get_lit(ctx, 2);
1923 bool use_srix4k = arg_get_lit(ctx, 3);
1924 CLIParserFree(ctx);
1925
1926 if (use_sri512 + use_srix4k > 1) {
1927 PrintAndLogEx(FAILED, "Select only one card type");
1928 return PM3_EINVARG;
1929 }
1930
1931 // Set default
1932 if (use_sri512 == false) {
1933 use_srix4k = true;
1934 }
1935
1936 char s[7];
1937 memset(s, 0, sizeof(s));
1938 uint16_t block_cnt = 0;
1939 if (use_sri512) {
1940 block_cnt = 16;
1941 memcpy(s, "SRI512", 7);
1942 } else if (use_srix4k) {
1943 block_cnt = 128;
1944 memcpy(s, "SRIX4K", 7);
1945 }
1946
1947 // reserve memory
1948 uint8_t *data = NULL;
1949 size_t bytes_read = 0;
1950 int res = pm3_load_dump(filename, (void **)&data, &bytes_read, (ST25TB_SR_BLOCK_SIZE * block_cnt));
1951 if (res != PM3_SUCCESS) {
1952 PrintAndLogEx(FAILED, "Failed to load file");
1953 return res;
1954 }
1955
1956 // Ignore remaining block if the file is 1 block larger than the expected size
1957 // (because hf 14b dump also saves the special block at the end of the memory, it will be ignored by the restore command)
1958 if (bytes_read != (block_cnt * ST25TB_SR_BLOCK_SIZE) && bytes_read != ((block_cnt + 1) * ST25TB_SR_BLOCK_SIZE)) {
1959 PrintAndLogEx(ERR, "File content error. Read %zu", bytes_read);
1960 free(data);
1961 return PM3_EFILE;
1962 }
1963 PrintAndLogEx(INFO, "Copying to %s", s);
1964
1965 int blockno = 0;
1966 while (bytes_read) {
1967
1968 int status = write_sr_block(blockno, ST25TB_SR_BLOCK_SIZE, data + blockno * ST25TB_SR_BLOCK_SIZE);
1969 if (status != PM3_SUCCESS) {
1970 PrintAndLogEx(FAILED, "Write failed");
1971 free(data);
1972 return status;
1973 }
1974
1975 // verify
1976 uint8_t out[ST25TB_SR_BLOCK_SIZE] = {0};
1977 status = read_sr_block(blockno, out, sizeof(out));
1978 if (status == PM3_SUCCESS) {
1979 if (memcmp(data + blockno * ST25TB_SR_BLOCK_SIZE, out, ST25TB_SR_BLOCK_SIZE) == 0) {
1980 printf("\33[2K\r");
1981 PrintAndLogEx(INFO, "SRx write block %d/%d ( " _GREEN_("ok") " )" NOLF, blockno, block_cnt - 1);
1982 } else {
1983 printf("\n");
1984 PrintAndLogEx(INFO, "SRx write block %d/%d ( " _RED_("different") " )", blockno, block_cnt - 1);
1985 }
1986 } else {
1987 printf("\n");
1988 PrintAndLogEx(INFO, "Verifying block %d/%d ( " _RED_("failed") " )", blockno, block_cnt - 1);
1989 }
1990
1991 fflush(stdout);
1992
1993 bytes_read -= ST25TB_SR_BLOCK_SIZE;
1994 blockno++;
1995 if (blockno >= block_cnt) break;
1996 }
1997
1998 PrintAndLogEx(NORMAL, "\n");
1999 free(data);
2000
2001 // confirm number written blocks.
2002 if (blockno != block_cnt) {
2003 PrintAndLogEx(ERR, "File content error. There must be %d blocks", block_cnt);
2004 return PM3_EFILE;
2005 }
2006
2007 PrintAndLogEx(SUCCESS, "Card loaded " _YELLOW_("%d") " blocks from file", block_cnt);
2008 PrintAndLogEx(INFO, "Done!");
2009
2010
2011 return PM3_SUCCESS;
2012 }
2013
2014 /*
2015
2016 static uint32_t srix4kEncode(uint32_t value) {
2017 // vv = value
2018 // pp = position
2019 // vv vv vv pp
2020 // 4 bytes : 00 1A 20 01
2021 // only the lower crumbs.
2022 uint8_t block = (value & 0xFF);
2023 uint8_t i = 0;
2024 uint8_t valuebytes[] = {0, 0, 0};
2025 Uint3byteToMemBe(valuebytes, value >> 8);
2026
2027 uint32_t value_x = (value >> 8);
2028 PrintAndLogEx(INFO, "value...... %08x %06x", value, value_x);
2029 PrintAndLogEx(INFO, "3b value... %s", sprint_hex_inrow(valuebytes, sizeof(valuebytes)));
2030 PrintAndLogEx(INFO, "block no... %02x", block);
2031
2032 // Scrambled part
2033 // Crumb swapping of value.
2034 uint32_t foo = 0;
2035 foo |= CRUMB(value_x, 22) << 28;
2036 foo |= CRUMB(value_x, 14) << 26;
2037 foo |= CRUMB(value_x, 6) << 24;
2038
2039 foo |= CRUMB(value_x, 20) << 20;
2040 foo |= CRUMB(value_x, 12) << 18;
2041 foo |= CRUMB(value_x, 4) << 16;
2042
2043 foo |= CRUMB(value_x, 18) << 12;
2044 foo |= CRUMB(value_x, 10) << 10;
2045 foo |= CRUMB(value_x, 2) << 8;
2046
2047 foo |= CRUMB(value_x, 16) << 4;
2048 foo |= CRUMB(value_x, 8) << 2;
2049 foo |= CRUMB(value_x, 0) << 0;
2050
2051 PrintAndLogEx(INFO, "hex........ %02x %02x %02x", CRUMB(value_x, 22), CRUMB(value_x, 14), CRUMB(value_x, 6));
2052 PrintAndLogEx(INFO, "hex........ %02x %02x %02x", CRUMB(value_x, 20), CRUMB(value_x, 12), CRUMB(value_x, 4));
2053 PrintAndLogEx(INFO, "hex........ %02x %02x %02x", CRUMB(value_x, 18), CRUMB(value_x, 10), CRUMB(value_x, 2));
2054 PrintAndLogEx(INFO, "hex........ %02x %02x %02x", CRUMB(value_x, 16), CRUMB(value_x, 8), CRUMB(value_x, 0));
2055
2056 PrintAndLogEx(INFO, "hex........ %08x", foo);
2057
2058 // chksum part
2059 uint32_t chksum = 0xFF - block;
2060
2061 // chksum is reduced by each nibbles of value.
2062 for (i = 0; i < 3; ++i) {
2063 chksum -= NIBBLE_HIGH(valuebytes[i]);
2064 chksum -= NIBBLE_LOW(valuebytes[i]);
2065 }
2066
2067 // base4 conversion and left shift twice
2068 i = 3;
2069 uint8_t base4[] = {0, 0, 0, 0};
2070 while (chksum != 0) {
2071 base4[i--] = (chksum % 4 << 2);
2072 chksum /= 4;
2073 }
2074 PrintAndLogEx(INFO, "%s", sprint_hex_inrow(base4, sizeof(base4)));
2075
2076 // merge scambled and chksum parts
2077 uint32_t encvalue = 0;
2078
2079 (NIBBLE_LOW(base4[0]) << 28) |
2080 (NIBBLE_HIGH(temp[0]) << 24) |
2081
2082 (NIBBLE_LOW(base4[1]) << 20) |
2083 (NIBBLE_LOW(temp[0]) << 16) |
2084
2085 (NIBBLE_LOW(base4[2]) << 12) |
2086 (NIBBLE_HIGH(temp[1]) << 8) |
2087
2088 (NIBBLE_LOW(base4[3]) << 4) |
2089 NIBBLE_LOW(temp[1]);
2090
2091 PrintAndLogEx(NORMAL, "ICE encoded | %08X -> %08X", value, encvalue);
2092 return encvalue;
2093 }
2094 */
2095
2096 static uint32_t srix4k_decode_counter(uint32_t num) {
2097 uint32_t value = ~num;
2098 ++value;
2099 return value;
2100 }
2101 /*
2102 static uint32_t srix4kDecode(uint32_t value) {
2103 switch (value) {
2104 case 0xC04F42C5:
2105 return 0x003139;
2106 case 0xC1484807:
2107 return 0x002943;
2108 case 0xC0C60848:
2109 return 0x001A20;
2110 }
2111 return 0;
2112 }
2113 */
2114
2115 static uint32_t srix4k_get_magicbytes(uint64_t uid, uint32_t block6, uint32_t block18, uint32_t block19) {
2116 #define MASK 0xFFFFFFFF;
2117 uint32_t uid32 = uid & MASK;
2118 uint32_t counter = srix4k_decode_counter(block6);
2119 uint32_t decodedBlock18 = 0;
2120 uint32_t decodedBlock19 = 0;
2121 // uint32_t decodedBlock18 = srix4kDecode(block18);
2122 // uint32_t decodedBlock19 = srix4kDecode(block19);
2123 uint32_t doubleBlock = (decodedBlock18 << 16 | decodedBlock19) + 1;
2124
2125 uint32_t result = (uid32 * doubleBlock * counter) & MASK;
2126 PrintAndLogEx(SUCCESS, "Magic bytes | %08X", result);
2127 return result;
2128 }
2129
2130 static int CmdSRIX4kValid(const char *Cmd) {
2131 CLIParserContext *ctx;
2132 CLIParserInit(&ctx, "hf 14b valid",
2133 "SRIX checksum test",
2134 "hf 14b valid\n"
2135 );
2136
2137 void *argtable[] = {
2138 arg_param_begin,
2139 arg_param_end
2140 };
2141 CLIExecWithReturn(ctx, Cmd, argtable, false);
2142 CLIParserFree(ctx);
2143
2144 uint64_t uid = 0xD00202501A4532F9;
2145 uint32_t block6 = 0xFFFFFFFF;
2146 uint32_t block18 = 0xC04F42C5;
2147 uint32_t block19 = 0xC1484807;
2148 uint32_t block21 = 0xD1BCABA4;
2149
2150 uint32_t test_b18 = 0x001A2001; // 0x00313918;
2151 uint32_t test_b18_enc = 0;
2152 // uint32_t test_b18_enc = srix4kEncode(test_b18);
2153 // uint32_t test_b18_dec = srix4kDecode(test_b18_enc);
2154 PrintAndLogEx(SUCCESS, "ENCODE & CHECKSUM | %08X -> %08X (%s)", test_b18, test_b18_enc, "");
2155
2156 uint32_t magic = srix4k_get_magicbytes(uid, block6, block18, block19);
2157 PrintAndLogEx(SUCCESS, "BLOCK 21 | %08X -> %08X (no XOR)", block21, magic ^ block21);
2158 return PM3_SUCCESS;
2159 }
2160
2161 int select_card_14443b_4(bool disconnect, iso14b_card_select_t *card) {
2162 if (card) {
2163 memset(card, 0, sizeof(iso14b_card_select_t));
2164 }
2165
2166 switch_off_field_14b();
2167
2168 iso14b_raw_cmd_t packet = {
2169 .flags = (ISO14B_CONNECT | ISO14B_SELECT_STD | ISO14B_CLEARTRACE),
2170 .timeout = 0,
2171 .rawlen = 0,
2172 };
2173 // Anticollision + SELECT STD card
2174 PacketResponseNG resp;
2175 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)&packet, sizeof(iso14b_raw_cmd_t));
2176 if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, TIMEOUT) == false) {
2177
2178 PrintAndLogEx(INFO, "Trying 14B Select SRx");
2179 // Anticollision + SELECT SR card
2180 packet.flags = (ISO14B_CONNECT | ISO14B_SELECT_SR | ISO14B_CLEARTRACE);
2181 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)&packet, sizeof(iso14b_raw_cmd_t));
2182 if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, TIMEOUT) == false) {
2183
2184 PrintAndLogEx(INFO, "Trying 14B Select CTS");
2185 // Anticollision + SELECT ASK C-Ticket card
2186 packet.flags = (ISO14B_CONNECT | ISO14B_SELECT_CTS | ISO14B_CLEARTRACE);
2187 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)&packet, sizeof(iso14b_raw_cmd_t));
2188 if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, TIMEOUT) == false) {
2189 PrintAndLogEx(ERR, "connection timeout");
2190 switch_off_field_14b();
2191 return PM3_ESOFT;
2192 }
2193 }
2194 }
2195
2196 // check result
2197 if (resp.status != PM3_SUCCESS) {
2198 PrintAndLogEx(WARNING, "No ISO14443-B Card in field");
2199 switch_off_field_14b();
2200 return PM3_ESOFT;
2201 }
2202
2203 SetISODEPState(ISODEP_NFCB);
2204 apdu_frame_length = 0;
2205 // get frame length from ATS in card data structure
2206 iso14b_card_select_t *vcard = (iso14b_card_select_t *) resp.data.asBytes;
2207 // uint8_t fsci = vcard->atqb[1] & 0x0f;
2208 // if (fsci < ARRAYLEN(ats_fsc)) {
2209 // apdu_frame_length = ats_fsc[fsci];
2210 // }
2211
2212 if (card) {
2213 memcpy(card, vcard, sizeof(iso14b_card_select_t));
2214 }
2215
2216 if (disconnect) {
2217 switch_off_field_14b();
2218 }
2219 return PM3_SUCCESS;
2220 }
2221
2222 static int handle_14b_apdu(bool chainingin, uint8_t *datain, int datainlen,
2223 bool activateField, uint8_t *dataout, int maxdataoutlen,
2224 int *dataoutlen, bool *chainingout, int user_timeout) {
2225
2226 *chainingout = false;
2227
2228 if (activateField) {
2229 // select with no disconnect and set frameLength
2230 int selres = select_card_14443b_4(false, NULL);
2231 if (selres != PM3_SUCCESS) {
2232 return selres;
2233 }
2234 }
2235
2236 iso14b_raw_cmd_t *packet = (iso14b_raw_cmd_t *)calloc(1, sizeof(iso14b_raw_cmd_t) + datainlen);
2237 if (packet == NULL) {
2238 PrintAndLogEx(FAILED, "APDU: failed to allocate memory");
2239 return PM3_EMALLOC;
2240 }
2241 packet->flags = (ISO14B_APDU);
2242 packet->timeout = 0;
2243 packet->rawlen = 0;
2244
2245 if (chainingin) {
2246 packet->flags = (ISO14B_SEND_CHAINING | ISO14B_APDU);
2247 }
2248
2249 if (user_timeout > 0) {
2250 packet->flags |= ISO14B_SET_TIMEOUT;
2251 if (user_timeout > MAX_14B_TIMEOUT_MS) {
2252 user_timeout = MAX_14B_TIMEOUT_MS;
2253 PrintAndLogEx(INFO, "set timeout to 4.9 seconds. The max we can wait for response");
2254 }
2255
2256 // timeout in ETU
2257 packet->timeout = (uint32_t)((13560 / 128) * user_timeout);
2258 }
2259
2260 // "Command APDU" length should be 5+255+1, but javacard's APDU buffer might be smaller - 133 bytes
2261 // https://stackoverflow.com/questions/32994936/safe-max-java-card-apdu-data-command-and-respond-size
2262 // here length PM3_CMD_DATA_SIZE=512
2263 if (datain) {
2264 packet->rawlen = datainlen;
2265 memcpy(packet->raw, datain, datainlen);
2266 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)packet, sizeof(iso14b_raw_cmd_t) + packet->rawlen);
2267 } else {
2268 SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)packet, sizeof(iso14b_raw_cmd_t));
2269 }
2270 free(packet);
2271 PacketResponseNG resp;
2272 if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, MAX(APDU_TIMEOUT, user_timeout)) == false) {
2273 PrintAndLogEx(ERR, "APDU: reply timeout");
2274 return PM3_ETIMEOUT;
2275 }
2276
2277 if (resp.status != PM3_SUCCESS) {
2278 PrintAndLogEx(ERR, "APDU: no APDU response");
2279 return resp.status;
2280 }
2281
2282 iso14b_raw_apdu_response_t *apdu = (iso14b_raw_apdu_response_t *)resp.data.asBytes;
2283
2284 // remove crc bytes
2285 int dlen = apdu->datalen - 2;
2286 if (dlen < 0) {
2287 dlen = 0;
2288 }
2289
2290 *dataoutlen += dlen;
2291
2292 if (maxdataoutlen && *dataoutlen > maxdataoutlen) {
2293 PrintAndLogEx(ERR, "APDU: buffer too small ( " _RED_("%d") " ), needs " _YELLOW_("%d") " bytes", maxdataoutlen, *dataoutlen);
2294 return PM3_ESOFT;
2295 }
2296
2297 // I-block ACK
2298 if ((apdu->response_byte & 0xF2) == 0xA2) {
2299 *dataoutlen = 0;
2300 *chainingout = true;
2301 return PM3_SUCCESS;
2302 }
2303
2304 // check apdu length
2305 if (apdu->datalen < 2) {
2306 PrintAndLogEx(ERR, "APDU: small APDU response, len " _RED_("%d"), apdu->datalen);
2307 return PM3_ESOFT;
2308 }
2309
2310 // copy to output array
2311 memcpy(dataout, apdu->data, dlen);
2312
2313 // chaining
2314 if ((apdu->response_byte & 0x10) != 0) {
2315 *chainingout = true;
2316 }
2317 return PM3_SUCCESS;
2318 }
2319
2320 int exchange_14b_apdu(uint8_t *datain, int datainlen, bool activate_field,
2321 bool leave_signal_on, uint8_t *dataout, int maxdataoutlen,
2322 int *dataoutlen, int user_timeout) {
2323
2324 *dataoutlen = 0;
2325 bool chaining = false;
2326 int res;
2327
2328 // 3 byte here - 1b framing header, 2b crc16
2329 if (apdu_in_framing_enable &&
2330 ((apdu_frame_length && (datainlen > apdu_frame_length - 3)) || (datainlen > PM3_CMD_DATA_SIZE - 3))) {
2331
2332 int clen = 0;
2333 bool v_activate_field = activate_field;
2334
2335 do {
2336 int vlen = MIN(apdu_frame_length - 3, datainlen - clen);
2337 bool chainBlockNotLast = ((clen + vlen) < datainlen);
2338
2339 *dataoutlen = 0;
2340 res = handle_14b_apdu(chainBlockNotLast, &datain[clen], vlen, v_activate_field, dataout, maxdataoutlen, dataoutlen, &chaining, user_timeout);
2341 if (res) {
2342 if (leave_signal_on == false) {
2343 switch_off_field_14b();
2344 }
2345
2346 return 200;
2347 }
2348
2349 // TODO check this one...
2350 // check R-block ACK
2351 // *dataoutlen!=0. 'A && (!A || B)' is equivalent to 'A && B'
2352 if ((*dataoutlen == 0) && (chaining != chainBlockNotLast)) {
2353 if (leave_signal_on == false) {
2354 switch_off_field_14b();
2355 }
2356 return 201;
2357 }
2358
2359 clen += vlen;
2360 v_activate_field = false;
2361 if (*dataoutlen) {
2362 if (clen != datainlen) {
2363 PrintAndLogEx(ERR, "APDU: I-block/R-block sequence error. Data len=%d, Sent=%d, Last packet len=%d", datainlen, clen, *dataoutlen);
2364 }
2365 break;
2366 }
2367 } while (clen < datainlen);
2368
2369 } else {
2370 res = handle_14b_apdu(false, datain, datainlen, activate_field, dataout, maxdataoutlen, dataoutlen, &chaining, user_timeout);
2371 if (res != PM3_SUCCESS) {
2372 if (leave_signal_on == false) {
2373 switch_off_field_14b();
2374 }
2375 return res;
2376 }
2377 }
2378
2379 while (chaining) {
2380 // I-block with chaining
2381 res = handle_14b_apdu(false, NULL, 0, false, &dataout[*dataoutlen], maxdataoutlen, dataoutlen, &chaining, user_timeout);
2382 if (res != PM3_SUCCESS) {
2383 if (leave_signal_on == false) {
2384 switch_off_field_14b();
2385 }
2386 return 100;
2387 }
2388 }
2389
2390 if (leave_signal_on == false) {
2391 switch_off_field_14b();
2392 }
2393
2394 return PM3_SUCCESS;
2395 }
2396
2397 // ISO14443-4. 7. Half-duplex block transmission protocol
2398 static int CmdHF14BAPDU(const char *Cmd) {
2399 CLIParserContext *ctx;
2400 CLIParserInit(&ctx, "hf 14b apdu",
2401 "Sends an ISO 7816-4 APDU via ISO 14443-4 block transmission protocol (T=CL).\n"
2402 "works with all apdu types from ISO 7816-4:2013",
2403 "hf 14b apdu -s -d 94a40800043f000002\n"
2404 "hf 14b apdu -s --decode -d 00A404000E325041592E5359532E444446303100 -> decode apdu\n"
2405 "hf 14b apdu -sm 00A40400 -l 256 -d 325041592E5359532E4444463031 -> encode standard apdu\n"
2406 "hf 14b apdu -sm 00A40400 -el 65536 -d 325041592E5359532E4444463031 -> encode extended apdu\n");
2407
2408 void *argtable[] = {
2409 arg_param_begin,
2410 arg_lit0("s", "select", "activate field and select card"),
2411 arg_lit0("k", "keep", "leave the signal field ON after receive response"),
2412 arg_lit0("t", "tlv", "executes TLV decoder if it possible"),
2413 arg_lit0(NULL, "decode", "decode apdu request if it possible"),
2414 arg_str0("m", "make", "<hex>", "make apdu with head from this field and data from data field.\n"
2415 " must be 4 bytes: <CLA INS P1 P2>"),
2416 arg_lit0("e", "extended", "make extended length apdu if `m` parameter included"),
2417 arg_int0("l", "le", "<int>", "Le apdu parameter if `m` parameter included"),
2418 arg_str1("d", "data", "<hex>", "<APDU | data> if `m` parameter included"),
2419 arg_int0(NULL, "timeout", "<dec>", "timeout in ms"),
2420 arg_param_end
2421 };
2422 CLIExecWithReturn(ctx, Cmd, argtable, false);
2423
2424 bool activate_field = arg_get_lit(ctx, 1);
2425 bool leave_signal_on = arg_get_lit(ctx, 2);
2426 bool decode_TLV = arg_get_lit(ctx, 3);
2427 bool decode_APDU = arg_get_lit(ctx, 4);
2428
2429 uint8_t header[PM3_CMD_DATA_SIZE] = {0x00};
2430 int headerlen = 0;
2431 CLIGetHexWithReturn(ctx, 5, header, &headerlen);
2432
2433 bool make_APDU = (headerlen > 0);
2434 if (make_APDU && headerlen != 4) {
2435 PrintAndLogEx(ERR, "header length must be 4 bytes, got " _RED_("%d"), headerlen);
2436 CLIParserFree(ctx);
2437 return PM3_EINVARG;
2438 }
2439
2440 bool extended_APDU = arg_get_lit(ctx, 6);
2441 int le = arg_get_int_def(ctx, 7, 0);
2442
2443 uint8_t data[PM3_CMD_DATA_SIZE] = {0x00};
2444 int datalen = 0;
2445
2446 if (make_APDU) {
2447 uint8_t apdudata[PM3_CMD_DATA_SIZE] = {0};
2448 int apdudatalen = 0;
2449
2450 CLIGetHexBLessWithReturn(ctx, 8, apdudata, &apdudatalen, 1 + 2);
2451
2452 APDU_t apdu;
2453 apdu.cla = header[0];
2454 apdu.ins = header[1];
2455 apdu.p1 = header[2];
2456 apdu.p2 = header[3];
2457
2458 apdu.lc = apdudatalen;
2459 apdu.data = apdudata;
2460
2461 apdu.extended_apdu = extended_APDU;
2462 apdu.le = le;
2463
2464 if (APDUEncode(&apdu, data, &datalen)) {
2465 PrintAndLogEx(ERR, "can't make apdu with provided parameters.");
2466 CLIParserFree(ctx);
2467 return PM3_EINVARG;
2468 }
2469
2470 } else {
2471 if (extended_APDU) {
2472 PrintAndLogEx(ERR, "make mode not set but here `e` option.");
2473 CLIParserFree(ctx);
2474 return PM3_EINVARG;
2475 }
2476 if (le > 0) {
2477 PrintAndLogEx(ERR, "make mode not set but here `l` option.");
2478 CLIParserFree(ctx);
2479 return PM3_EINVARG;
2480 }
2481
2482 // len = data + PCB(1b) + CRC(2b)
2483 CLIGetHexBLessWithReturn(ctx, 8, data, &datalen, 1 + 2);
2484 }
2485 int user_timeout = arg_get_int_def(ctx, 9, -1);
2486 CLIParserFree(ctx);
2487
2488 PrintAndLogEx(SUCCESS, _YELLOW_("%s%s%s"),
2489 activate_field ? "select card" : "",
2490 leave_signal_on ? ", keep field on" : "",
2491 decode_TLV ? ", TLV" : ""
2492 );
2493 PrintAndLogEx(SUCCESS, ">>> %s", sprint_hex_inrow(data, datalen));
2494
2495 if (decode_APDU) {
2496 APDU_t apdu;
2497 if (APDUDecode(data, datalen, &apdu) == 0)
2498 APDUPrint(apdu);
2499 else
2500 PrintAndLogEx(WARNING, "can't decode APDU.");
2501 }
2502
2503 int res = exchange_14b_apdu(data, datalen, activate_field, leave_signal_on, data, PM3_CMD_DATA_SIZE, &datalen, user_timeout);
2504 if (res != PM3_SUCCESS) {
2505 return res;
2506 }
2507
2508 PrintAndLogEx(INFO, "<<<< %s - %s", sprint_hex_inrow(data, datalen), sprint_ascii(data, datalen));
2509 uint16_t sw = get_sw(data, datalen);
2510 if (sw != ISO7816_OK) {
2511 PrintAndLogEx(SUCCESS, "APDU response: " _YELLOW_("%02x %02x") " - %s"
2512 , data[datalen - 2]
2513 , data[datalen - 1]
2514 , GetAPDUCodeDescription(data[datalen - 2], data[datalen - 1])
2515 );
2516 } else {
2517 PrintAndLogEx(SUCCESS, "APDU response: " _GREEN_("%02x %02x") " - %s"
2518 , data[datalen - 2]
2519 , data[datalen - 1]
2520 , GetAPDUCodeDescription(data[datalen - 2], data[datalen - 1])
2521 );
2522 }
2523
2524 // TLV decoder
2525 if (decode_TLV && datalen > 4) {
2526 TLVPrintFromBuffer(data, datalen - 2);
2527 }
2528
2529 return PM3_SUCCESS;
2530 }
2531
2532 int CmdHF14BNdefRead(const char *Cmd) {
2533
2534 CLIParserContext *ctx;
2535 CLIParserInit(&ctx, "hf 14b ndefread",
2536 "Print NFC Data Exchange Format (NDEF)",
2537 "hf 14b ndefread\n"
2538 "hf 14b ndefread -f myfilename -> save raw NDEF to file"
2539 );
2540 void *argtable[] = {
2541 arg_param_begin,
2542 arg_str0("f", "file", "<fn>", "Save raw NDEF to file"),
2543 arg_lit0("v", "verbose", "Verbose output"),
2544 arg_param_end
2545 };
2546 CLIExecWithReturn(ctx, Cmd, argtable, true);
2547 int fnlen = 0;
2548 char filename[FILE_PATH_SIZE] = {0};
2549 CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
2550
2551 bool verbose = arg_get_lit(ctx, 2);
2552 CLIParserFree(ctx);
2553
2554 bool activate_field = true;
2555 bool keep_field_on = true;
2556 uint8_t response[PM3_CMD_DATA_SIZE];
2557 int resplen = 0;
2558
2559 // --------------- Select NDEF Tag application ----------------
2560 uint8_t aSELECT_AID[80];
2561 int aSELECT_AID_n = 0;
2562 param_gethex_to_eol("00a4040007d276000085010100", 0, aSELECT_AID, sizeof(aSELECT_AID), &aSELECT_AID_n);
2563 int res = exchange_14b_apdu(aSELECT_AID, aSELECT_AID_n, activate_field, keep_field_on, response, sizeof(response), &resplen, -1);
2564 if (res) {
2565 goto out;
2566 }
2567
2568 if (resplen < 2) {
2569 res = PM3_ESOFT;
2570 goto out;
2571 }
2572
2573 uint16_t sw = get_sw(response, resplen);
2574 if (sw != ISO7816_OK) {
2575 PrintAndLogEx(ERR, "Selecting NDEF aid failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
2576 res = PM3_ESOFT;
2577 goto out;
2578 }
2579
2580 activate_field = false;
2581 keep_field_on = true;
2582 // --------------- Send CC select ----------------
2583 // --------------- Read binary ----------------
2584
2585 // --------------- NDEF file reading ----------------
2586 uint8_t aSELECT_FILE_NDEF[30];
2587 int aSELECT_FILE_NDEF_n = 0;
2588 param_gethex_to_eol("00a4000c020001", 0, aSELECT_FILE_NDEF, sizeof(aSELECT_FILE_NDEF), &aSELECT_FILE_NDEF_n);
2589 res = exchange_14b_apdu(aSELECT_FILE_NDEF, aSELECT_FILE_NDEF_n, activate_field, keep_field_on, response, sizeof(response), &resplen, -1);
2590 if (res)
2591 goto out;
2592
2593 sw = get_sw(response, resplen);
2594 if (sw != ISO7816_OK) {
2595 PrintAndLogEx(ERR, "Selecting NDEF file failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
2596 res = PM3_ESOFT;
2597 goto out;
2598 }
2599
2600 // --------------- Read binary ----------------
2601 uint8_t aREAD_NDEF[30];
2602 int aREAD_NDEF_n = 0;
2603 param_gethex_to_eol("00b0000002", 0, aREAD_NDEF, sizeof(aREAD_NDEF), &aREAD_NDEF_n);
2604 res = exchange_14b_apdu(aREAD_NDEF, aREAD_NDEF_n, activate_field, keep_field_on, response, sizeof(response), &resplen, -1);
2605 if (res) {
2606 goto out;
2607 }
2608
2609 sw = get_sw(response, resplen);
2610 if (sw != ISO7816_OK) {
2611 PrintAndLogEx(ERR, "reading NDEF file failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
2612 res = PM3_ESOFT;
2613 goto out;
2614 }
2615 // take offset from response
2616 uint8_t offset = response[1];
2617
2618 // --------------- Read binary w offset ----------------
2619 keep_field_on = false;
2620 aREAD_NDEF_n = 0;
2621 param_gethex_to_eol("00b00002", 0, aREAD_NDEF, sizeof(aREAD_NDEF), &aREAD_NDEF_n);
2622 aREAD_NDEF[4] = offset;
2623 res = exchange_14b_apdu(aREAD_NDEF, aREAD_NDEF_n, activate_field, keep_field_on, response, sizeof(response), &resplen, -1);
2624 if (res) {
2625 goto out;
2626 }
2627
2628 sw = get_sw(response, resplen);
2629 if (sw != ISO7816_OK) {
2630 PrintAndLogEx(ERR, "reading NDEF file failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
2631 res = PM3_ESOFT;
2632 goto out;
2633 }
2634
2635 // get total NDEF length before save. If fails, we save it all
2636 size_t n = 0;
2637 if (NDEFGetTotalLength(response + 2, resplen - 4, &n) != PM3_SUCCESS)
2638 n = resplen - 4;
2639
2640 pm3_save_dump(filename, response + 2, n, jsfNDEF);
2641
2642 res = NDEFRecordsDecodeAndPrint(response + 2, resplen - 4, verbose);
2643
2644 out:
2645 switch_off_field_14b();
2646 return res;
2647 }
2648
2649 static int CmdHF14BView(const char *Cmd) {
2650
2651 CLIParserContext *ctx;
2652 CLIParserInit(&ctx, "hf 14b view",
2653 "Print a ISO14443-B dump file (bin/eml/json)\n"
2654 "note:\n"
2655 " - command expects the filename to contain a UID\n"
2656 " which is needed to determine card memory type",
2657 "hf 14b view -f hf-14b-01020304-dump.bin"
2658 );
2659 void *argtable[] = {
2660 arg_param_begin,
2661 arg_str1("f", "file", "<fn>", "Specify a filename for dump file"),
2662 arg_lit0("v", "verbose", "verbose output"),
2663 arg_lit0("z", "dense", "dense dump output style"),
2664 arg_param_end
2665 };
2666 CLIExecWithReturn(ctx, Cmd, argtable, false);
2667 int fnlen = 0;
2668 char filename[FILE_PATH_SIZE];
2669 CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
2670 bool verbose = arg_get_lit(ctx, 2);
2671 bool dense_output = (g_session.dense_output || arg_get_lit(ctx, 3));
2672 CLIParserFree(ctx);
2673
2674 // read dump file
2675 uint8_t *dump = NULL;
2676 size_t bytes_read = (ST25TB_SR_BLOCK_SIZE * 0x100);
2677 int res = pm3_load_dump(filename, (void **)&dump, &bytes_read, (ST25TB_SR_BLOCK_SIZE * 0x100));
2678 if (res != PM3_SUCCESS) {
2679 return res;
2680 }
2681
2682 uint16_t block_cnt = bytes_read / ST25TB_SR_BLOCK_SIZE;
2683
2684 if (verbose) {
2685 PrintAndLogEx(INFO, "File size %zu bytes, file blocks %d (0x%x)", bytes_read, block_cnt, block_cnt);
2686 }
2687
2688 // figure out a way to identify the different dump files.
2689 // STD/SR/CT is difference
2690 print_sr_blocks(dump, bytes_read, get_uid_from_filename(filename), dense_output);
2691 //print_std_blocks(dump, bytes_read);
2692 //print_ct_blocks(dump, bytes_read);
2693
2694 free(dump);
2695 return PM3_SUCCESS;
2696 }
2697
2698 static int CmdHF14BCalypsoRead(const char *Cmd) {
2699
2700 CLIParserContext *ctx;
2701 CLIParserInit(&ctx, "hf 14b calypso",
2702 "Reads out the contents of a ISO14443B Calypso card\n",
2703 "hf 14b calypso"
2704 );
2705 void *argtable[] = {
2706 arg_param_begin,
2707 arg_param_end
2708 };
2709 CLIExecWithReturn(ctx, Cmd, argtable, true);
2710 CLIParserFree(ctx);
2711
2712 transport_14b_apdu_t cmds[] = {
2713 {"01.Select ICC file", "\x94\xa4\x08\x00\x04\x3f\x00\x00\x02", 9},
2714 {"02.ICC", "\x94\xb2\x01\x04\x1d", 5},
2715 {"03.Select EnvHol file", "\x94\xa4\x08\x00\x04\x20\x00\x20\x01", 9},
2716 {"04.EnvHol1", "\x94\xb2\x01\x04\x1d", 5},
2717 {"05.Select EvLog file", "\x94\xa4\x08\x00\x04\x20\x00\x20\x10", 9},
2718 {"06.EvLog1", "\x94\xb2\x01\x04\x1d", 5},
2719 {"07.EvLog2", "\x94\xb2\x02\x04\x1d", 5},
2720 {"08.EvLog3", "\x94\xb2\x03\x04\x1d", 5},
2721 {"09.Select ConList file", "\x94\xa4\x08\x00\x04\x20\x00\x20\x50", 9},
2722 {"10.ConList", "\x94\xb2\x01\x04\x1d", 5},
2723 {"11.Select Contra file", "\x94\xa4\x08\x00\x04\x20\x00\x20\x20", 9},
2724 {"12.Contra1", "\x94\xb2\x01\x04\x1d", 5},
2725 {"13.Contra2", "\x94\xb2\x02\x04\x1d", 5},
2726 {"14.Contra3", "\x94\xb2\x03\x04\x1d", 5},
2727 {"15.Contra4", "\x94\xb2\x04\x04\x1d", 5},
2728 {"16.Select Counter file", "\x94\xa4\x08\x00\x04\x20\x00\x20\x69", 9},
2729 {"17.Counter", "\x94\xb2\x01\x04\x1d", 5},
2730 {"18.Select SpecEv file", "\x94\xa4\x08\x00\x04\x20\x00\x20\x40", 9},
2731 {"19.SpecEv1", "\x94\xb2\x01\x04\x1d", 5},
2732 };
2733
2734 /*
2735 local CLA = '94'
2736 local _calypso_cmds = {
2737
2738 -- Break down of command bytes:
2739 -- A4 = select
2740 -- Master File 3F00
2741 -- 0x3F = master file
2742 -- 0x00 = master file id, is constant to 0x00.
2743
2744 -- DF Dedicated File 38nn
2745 -- can be seen as directories
2746 -- 0x38
2747 -- 0xNN id
2748 -- ["01.Select ICC file"] = '0294 a4 080004 3f00 0002',
2749
2750 -- EF Elementary File
2751 -- EF1 Pin file
2752 -- EF2 Key file
2753 -- Grey Lock file
2754 -- Electronic deposit file
2755 -- Electronic Purse file
2756 -- Electronic Transaction log file
2757 */
2758 bool activate_field = true;
2759 bool leave_signal_on = true;
2760 uint8_t response[PM3_CMD_DATA_SIZE] = { 0x00 };
2761
2762 for (int i = 0; i < ARRAYLEN(cmds); i++) {
2763
2764 int user_timeout = -1;
2765 int resplen = 0;
2766 int res = exchange_14b_apdu(
2767 (uint8_t *)cmds[i].apdu,
2768 cmds[i].apdulen,
2769 activate_field,
2770 leave_signal_on,
2771 response,
2772 PM3_CMD_DATA_SIZE,
2773 &resplen,
2774 user_timeout
2775 );
2776
2777 if (res != PM3_SUCCESS) {
2778 PrintAndLogEx(FAILED, "sending command failed, aborting!");
2779 switch_off_field_14b();
2780 return res;
2781 }
2782
2783 uint16_t sw = get_sw(response, resplen);
2784 if (sw != ISO7816_OK) {
2785 PrintAndLogEx(ERR, "Sending command failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
2786 switch_off_field_14b();
2787 return PM3_ESOFT;
2788 }
2789
2790 PrintAndLogEx(INFO, "%s - %s", cmds[i].desc, sprint_hex(response, resplen));
2791 activate_field = false;
2792 }
2793
2794 switch_off_field_14b();
2795 return PM3_SUCCESS;
2796 }
2797
2798 static int CmdHF14BMobibRead(const char *Cmd) {
2799
2800 CLIParserContext *ctx;
2801 CLIParserInit(&ctx, "hf 14b mobib",
2802 "Reads out the contents of a ISO14443B Mobib card\n",
2803 "hf 14b mobib"
2804 );
2805 void *argtable[] = {
2806 arg_param_begin,
2807 arg_param_end
2808 };
2809 CLIExecWithReturn(ctx, Cmd, argtable, true);
2810 CLIParserFree(ctx);
2811
2812 transport_14b_apdu_t cmds[] = {
2813 {"01.SELECT AID 1TIC.ICA", "\x00\xa4\x04\x00\x08\x31\x54\x49\x43\x2e\x49\x43\x41", 13},
2814 {"02.Select ICC file a", "\x00\xa4\x00\x00\x02\x3f\x00", 7},
2815 {"03.Select ICC file b", "\x00\xa4\x00\x00\x02\x00\x02", 7},
2816 {"04.ICC", "\x00\xb2\x01\x04\x1d", 5},
2817 {"05.Select Holder file", "\x00\xa4\x00\x00\x02\x3f\x1c", 7},
2818 {"06.Holder1", "\x00\xb2\x01\x04\x1d", 5},
2819 {"07.Holder2", "\x00\xb2\x02\x04\x1d", 5},
2820 {"08.Select EnvHol file a", "\x00\xa4\x00\x00\x00", 5},
2821 {"09.Select EnvHol file b", "\x00\xa4\x00\x00\x02\x20\x00", 7},
2822 {"10.Select EnvHol file c", "\x00\xa4\x00\x00\x02\x20\x01", 7},
2823 {"11.EnvHol1", "\x00\xb2\x01\x04\x1D", 5},
2824 {"11.EnvHol2", "\x00\xb2\x02\x04\x1D", 5},
2825 {"12.Select EvLog file", "\x00\xa4\x00\x00\x02\x20\x10", 7},
2826 {"13.EvLog1", "\x00\xb2\x01\x04\x1D", 5},
2827 {"14.EvLog2", "\x00\xb2\x02\x04\x1D", 5},
2828 {"15.EvLog3", "\x00\xb2\x03\x04\x1D", 5},
2829 {"16.Select ConList file", "\x00\xa4\x00\x00\x02\x20\x50", 7},
2830 {"17.ConList", "\x00\xb2\x01\x04\x1D", 5},
2831 {"18.Select Contra file", "\x00\xa4\x00\x00\x02\x20\x20", 7},
2832 {"19.Contra1", "\x00\xb2\x01\x04\x1D", 5},
2833 {"20.Contra2", "\x00\xb2\x02\x04\x1D", 5},
2834 {"21.Contra3", "\x00\xb2\x03\x04\x1D", 5},
2835 {"22.Contra4", "\x00\xb2\x04\x04\x1D", 5},
2836 {"23.Contra5", "\x00\xb2\x05\x04\x1D", 5},
2837 {"24.Contra6", "\x00\xb2\x06\x04\x1D", 5},
2838 {"25.Contra7", "\x00\xb2\x07\x04\x1D", 5},
2839 {"26.Contra8", "\x00\xb2\x08\x04\x1D", 5},
2840 {"27.Contra9", "\x00\xb2\x09\x04\x1D", 5},
2841 {"28.ContraA", "\x00\xb2\x0a\x04\x1D", 5},
2842 {"29.ContraB", "\x00\xb2\x0b\x04\x1D", 5},
2843 {"30.ContraC", "\x00\xb2\x0c\x04\x1D", 5},
2844 {"31.Select Counter file", "\x00\xa4\x00\x00\x02\x20\x69", 7},
2845 {"32.Counter", "\x00\xb2\x01\x04\x1D", 5},
2846 {"33.Select LoadLog file a", "\x00\xa4\x00\x00\x00", 5},
2847 {"34.Select LoadLog file b", "\x00\xa4\x00\x00\x02\x10\x00", 7},
2848 {"35.Select LoadLog file c", "\x00\xa4\x00\x00\x02\x10\x14", 7},
2849 {"36.LoadLog", "\x00\xb2\x01\x04\x1D", 5},
2850 {"37.Select Purcha file", "\x00\xa4\x00\x00\x02\x10\x15", 7},
2851 {"38.Purcha1", "\x00\xb2\x01\x04\x1D", 5},
2852 {"39.Purcha2", "\x00\xb2\x02\x04\x1D", 5},
2853 {"40.Purcha3", "\x00\xb2\x03\x04\x1D", 5},
2854 {"41.Select SpecEv file a", "\x00\xa4\x00\x00\x00", 5},
2855 {"42.Select SpecEv file b", "\x00\xa4\x00\x00\x02\x20\x00", 7},
2856 {"43.Select SpecEv file c", "\x00\xa4\x00\x00\x02\x20\x40", 7},
2857 {"44.SpecEv1", "\x00\xb2\x01\x04\x1D", 5},
2858 {"45.SpecEv2", "\x00\xb2\x02\x04\x1D", 5},
2859 {"46.SpecEv3", "\x00\xb2\x03\x04\x1D", 5},
2860 {"47.SpecEv4", "\x00\xb2\x04\x04\x1d", 5},
2861 };
2862
2863 bool activate_field = true;
2864 bool leave_signal_on = true;
2865 uint8_t response[PM3_CMD_DATA_SIZE] = { 0x00 };
2866
2867 for (int i = 0; i < ARRAYLEN(cmds); i++) {
2868
2869 int user_timeout = -1;
2870 int resplen = 0;
2871 int res = exchange_14b_apdu(
2872 (uint8_t *)cmds[i].apdu,
2873 cmds[i].apdulen,
2874 activate_field,
2875 leave_signal_on,
2876 response,
2877 PM3_CMD_DATA_SIZE,
2878 &resplen,
2879 user_timeout
2880 );
2881
2882 if (res != PM3_SUCCESS) {
2883 PrintAndLogEx(FAILED, "sending command failed, aborting!");
2884 switch_off_field_14b();
2885 return res;
2886 }
2887
2888 uint16_t sw = get_sw(response, resplen);
2889 if (sw != ISO7816_OK) {
2890 PrintAndLogEx(ERR, "Sending command failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff));
2891 switch_off_field_14b();
2892 return PM3_ESOFT;
2893 }
2894
2895 PrintAndLogEx(INFO, "%s - %s", cmds[i].desc, sprint_hex(response, resplen));
2896 activate_field = false;
2897 }
2898
2899 switch_off_field_14b();
2900 return PM3_SUCCESS;
2901 }
2902
2903 static int CmdHF14BSetUID(const char *Cmd) {
2904
2905 CLIParserContext *ctx;
2906 CLIParserInit(&ctx, "hf 14b setuid",
2907 "Set UID for magic card (only works with such cards)\n",
2908 "hf 14b setuid -u 11223344\n"
2909 );
2910
2911 void *argtable[] = {
2912 arg_param_begin,
2913 arg_str1("u", "uid", "<hex>", "UID, 4 hex bytes"),
2914 arg_param_end
2915 };
2916 CLIExecWithReturn(ctx, Cmd, argtable, false);
2917
2918 uint8_t uid[20] = {0};
2919 int uidlen = 20;
2920 CLIGetHexWithReturn(ctx, 1, uid, &uidlen);
2921 CLIParserFree(ctx);
2922
2923 if (uidlen != 4) {
2924 PrintAndLogEx(WARNING, "UID len must be 4 bytes, got " _RED_("%i"), uidlen);
2925 return PM3_EINVARG;
2926 }
2927
2928 uint8_t select[sizeof(iso14b_card_select_t)] = {0};
2929 iso14b_type_t select_cardtype = ISO14B_NONE;
2930 if (get_14b_UID(select, &select_cardtype) == false) {
2931 PrintAndLogEx(WARNING, "no tag found");
2932 return PM3_SUCCESS;
2933 }
2934
2935 if (select_cardtype != ISO14B_STANDARD) {
2936 PrintAndLogEx(FAILED, "None supported tag");
2937 return switch_off_field_14b();
2938 }
2939
2940 iso14b_card_select_t *card = (iso14b_card_select_t *)select;
2941 if (memcmp(card->atqb, "\x54\x43\x4F\x53", 4)) {
2942 PrintAndLogEx(FAILED, "None supported tag");
2943 PrintAndLogEx(NORMAL, "");
2944 return switch_off_field_14b();
2945 }
2946
2947 int outlen = 0;
2948 uint8_t out[PM3_CMD_DATA_SIZE] = {0};
2949 uint8_t tcos_version[] = {0x90, 0xB2, 0x90, 0x00, 0x00};
2950 if (exchange_14b_apdu(tcos_version, sizeof(tcos_version), true, false, out, PM3_CMD_DATA_SIZE, &outlen, -1) != PM3_SUCCESS) {
2951 PrintAndLogEx(FAILED, "None supported tag");
2952 return PM3_EFAILED;
2953 }
2954
2955 uint8_t cmd[] = { 0x90, 0xF8, 0xEE, 0xEE, 0x0B, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
2956 memcpy(cmd + 6, uid, uidlen);
2957 if (exchange_14b_apdu(cmd, sizeof(cmd), true, false, out, PM3_CMD_DATA_SIZE, &outlen, -1) != PM3_SUCCESS) {
2958 PrintAndLogEx(WARNING, "timeout while waiting for reply");
2959 return PM3_EFAILED;
2960 }
2961
2962 PrintAndLogEx(INFO, "Verifying...");
2963
2964 // verify
2965 if (get_14b_UID(select, &select_cardtype) == false) {
2966 PrintAndLogEx(WARNING, "no tag found");
2967 return PM3_SUCCESS;
2968 }
2969
2970 if (memcmp(card->uid, uid, uidlen) == 0) {
2971 PrintAndLogEx(SUCCESS, "Setting new UID ( " _GREEN_("ok") " )");
2972 PrintAndLogEx(HINT, "try `" _YELLOW_("hf 14b reader") "` to verify");
2973 PrintAndLogEx(NORMAL, "");
2974 return PM3_SUCCESS;;
2975 }
2976
2977 PrintAndLogEx(FAILED, "Setting new UID ( " _RED_("fail") " )");
2978 PrintAndLogEx(NORMAL, "");
2979 return PM3_SUCCESS;
2980 }
2981
2982 static command_t CommandTable[] = {
2983 {"---------", CmdHelp, AlwaysAvailable, "----------------------- " _CYAN_("General") " -----------------------"},
2984 {"help", CmdHelp, AlwaysAvailable, "This help"},
2985 {"list", CmdHF14BList, AlwaysAvailable, "List ISO-14443-B history"},
2986 {"---------", CmdHelp, AlwaysAvailable, "----------------------- " _CYAN_("Operations") " -----------------------"},
2987 {"apdu", CmdHF14BAPDU, IfPm3Iso14443b, "Send ISO 14443-4 APDU to tag"},
2988 {"dump", CmdHF14BDump, IfPm3Iso14443b, "Read all memory pages of an ISO-14443-B tag, save to file"},
2989 {"info", CmdHF14Binfo, IfPm3Iso14443b, "Tag information"},
2990 {"ndefread", CmdHF14BNdefRead, IfPm3Iso14443b, "Read NDEF file on tag"},
2991 {"raw", CmdHF14BRaw, IfPm3Iso14443b, "Send raw hex data to tag"},
2992 {"rdbl", CmdHF14BSriRdBl, IfPm3Iso14443b, "Read SRI512/SRIX4 block"},
2993 {"reader", CmdHF14BReader, IfPm3Iso14443b, "Act as a ISO-14443-B reader to identify a tag"},
2994 {"restore", CmdHF14BRestore, IfPm3Iso14443b, "Restore from file to all memory pages of an ISO-14443-B tag"},
2995 {"sim", CmdHF14BSim, IfPm3Iso14443b, "Fake ISO ISO-14443-B tag"},
2996 {"sniff", CmdHF14BSniff, IfPm3Iso14443b, "Eavesdrop ISO-14443-B"},
2997 {"wrbl", CmdHF14BSriWrbl, IfPm3Iso14443b, "Write data to a SRI512/SRIX4 tag"},
2998 {"view", CmdHF14BView, AlwaysAvailable, "Display content from tag dump file"},
2999 {"valid", CmdSRIX4kValid, AlwaysAvailable, "SRIX4 checksum test"},
3000 {"---------", CmdHelp, AlwaysAvailable, "------------------ " _CYAN_("Calypso / Mobib") " ------------------"},
3001 {"calypso", CmdHF14BCalypsoRead, IfPm3Iso14443b, "Read contents of a Calypso card"},
3002 {"mobib", CmdHF14BMobibRead, IfPm3Iso14443b, "Read contents of a Mobib card"},
3003 {"---------", CmdHelp, IfPm3Iso14443b, "------------------------- " _CYAN_("Magic") " -----------------------"},
3004 {"setuid", CmdHF14BSetUID, IfPm3Iso14443b, "Set UID for magic card"},
3005 {NULL, NULL, NULL, NULL}
3006 };
3007
3008 static int CmdHelp(const char *Cmd) {
3009 (void)Cmd; // Cmd is not used so far
3010 CmdsHelp(CommandTable);
3011 return PM3_SUCCESS;
3012 }
3013
3014 int CmdHF14B(const char *Cmd) {
3015 clearCommandBuffer();
3016 return CmdsParse(CommandTable, Cmd);
3017 }
3018
3019 // get and print all info known about any known 14b tag
3020 int infoHF14B(bool verbose, bool do_aid_search) {
3021
3022 // try std 14b (atqb)
3023 if (HF14B_Std_Info(verbose, do_aid_search))
3024 return PM3_SUCCESS;
3025
3026 // try ST 14b
3027 if (HF14B_ST_Info(verbose, do_aid_search))
3028 return PM3_SUCCESS;
3029
3030 // try unknown 14b read commands (to be identified later)
3031 // could be read of calypso, CEPAS, moneo, or pico pass.
3032 if (verbose) PrintAndLogEx(FAILED, "no 14443-B tag found");
3033 return PM3_EOPABORTED;
3034 }
3035
3036 // get and print general info about all known 14b chips
3037 int readHF14B(bool loop, bool verbose, bool read_plot) {
3038 bool found = false;
3039 bool info = true;
3040 int res = PM3_SUCCESS;
3041 do {
3042 found = false;
3043
3044 // try std 14b (atqb)
3045 found |= HF14B_std_reader(verbose);
3046 if (found)
3047 goto plot;
3048
3049 // try ST Microelectronics 14b
3050 found |= HF14B_st_reader(verbose);
3051 if (found)
3052 goto plot;
3053
3054 // Picopass
3055 found |= HF14B_picopass_reader(verbose, info);
3056 if (found)
3057 goto plot;
3058
3059 // try ASK CT 14b
3060 found |= HF14B_ask_ct_reader(verbose);
3061 if (found)
3062 goto plot;
3063
3064 // try unknown 14b read commands (to be identified later)
3065 // could be read of calypso, CEPAS, moneo, or pico pass.
3066 found |= HF14B_other_reader(verbose);
3067 if (found)
3068 goto plot;
3069 plot:
3070 if (read_plot) {
3071 res = handle_hf_plot(verbose);
3072 if (res != PM3_SUCCESS) {
3073 PrintAndLogEx(DEBUG, "plot failed");
3074 }
3075 }
3076
3077 } while (loop && kbd_enter_pressed() == false);
3078
3079 if (verbose && found == false) {
3080 PrintAndLogEx(FAILED, "no ISO 14443-B tag found");
3081 }
3082 return (found) ? PM3_SUCCESS : PM3_EOPABORTED;
3083 }
Proxmark3 - the RFID research Swiss army knife. Iceman firmware