client/cmdhf14a.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) 2010 iZsh <izsh at fail0verflow.com>, Hagen Fritsch
   3 // 2011, 2017 - 2019 Merlok
   4 //
   5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   6 // at your option, any later version. See the LICENSE.txt file for the text of
   7 // the license.
   8 //-----------------------------------------------------------------------------
   9 // High frequency ISO14443A commands
  10 //-----------------------------------------------------------------------------
  11
  12 #include "cmdhf14a.h"
  13
  14 #include <stdio.h>
  15 #include <stdlib.h>
  16 #include <inttypes.h>
  17 #include <string.h>
  18 #include <unistd.h>
  19 #include <ctype.h>
  20 #include "util.h"
  21 #include "util_posix.h"
  22 #include "iso14443crc.h"
  23 #include "comms.h"
  24 #include "ui.h"
  25 #include "cmdparser.h"
  26 #include "common.h"
  27 #include "cmdmain.h"
  28 #include "mifare.h"
  29 #include "cmdhfmfu.h"
  30 #include "mifare/mifarehost.h"
  31 #include "cliparser/cliparser.h"
  32 #include "emv/apduinfo.h"
  33 #include "emv/emvcore.h"
  34 #include "taginfo.h"
  35
  36 static int CmdHelp(const char *Cmd);
  37 static int waitCmd(uint8_t iLen);
  38
  39 // iso14a apdu input frame length
  40 static uint16_t frameLength = 0;
  41 uint16_t atsFSC[] = {16, 24, 32, 40, 48, 64, 96, 128, 256};
  42
  43 int CmdHF14AList(const char *Cmd)
  44 {
  45         PrintAndLog("Deprecated command, use 'hf list 14a' instead");
  46         return 0;
  47 }
  48
  49 int Hf14443_4aGetCardData(iso14a_card_select_t *card) {
  50         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT, 0, 0}};
  51         SendCommand(&c);
  52
  53         UsbCommand resp;
  54         WaitForResponse(CMD_NACK, &resp);
  55
  56         memcpy(card, (iso14a_card_select_t *)resp.d.asBytes, sizeof(iso14a_card_select_t));
  57
  58         uint64_t select_status = resp.arg[0];       // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS, 3: proprietary Anticollision
  59
  60         if (select_status == 0) {
  61                 PrintAndLog("E->iso14443a card select failed");
  62                 return 1;
  63         }
  64
  65         if (select_status == 2) {
  66                 PrintAndLog("E->Card doesn't support iso14443-4 mode");
  67                 return 1;
  68         }
  69
  70         if (select_status == 3) {
  71                 PrintAndLog("E->Card doesn't support standard iso14443-3 anticollision");
  72                 PrintAndLog("\tATQA : %02x %02x", card->atqa[1], card->atqa[0]);
  73                 return 1;
  74         }
  75
  76         PrintAndLog(" UID: %s", sprint_hex(card->uid, card->uidlen));
  77         PrintAndLog("ATQA: %02x %02x", card->atqa[1], card->atqa[0]);
  78         PrintAndLog(" SAK: %02x [%" PRIu64 "]", card->sak, resp.arg[0]);
  79         if(card->ats_len < 3) {         // a valid ATS consists of at least the length byte (TL) and 2 CRC bytes
  80                 PrintAndLog("E-> Error ATS length(%d) : %s", card->ats_len, sprint_hex(card->ats, card->ats_len));
  81                 return 1;
  82         }
  83         PrintAndLog(" ATS: %s", sprint_hex(card->ats, card->ats_len));
  84
  85         return 0;
  86 }
  87
  88 int CmdHF14AReader(const char *Cmd) {
  89         uint32_t cm = ISO14A_CONNECT;
  90         bool leaveSignalON = false;
  91
  92         CLIParserInit("hf 14a reader", "Executes ISO1443A anticollision-select group of commands.", NULL);
  93         void* argtable[] = {
  94                 arg_param_begin,
  95                 arg_lit0("kK",  "keep",    "keep the field active after command executed"),
  96                 arg_lit0("xX",  "drop",    "just drop the signal field"),
  97                 arg_lit0("3",   NULL,      "ISO14443-3 select only (skip RATS)"),
  98                 arg_param_end
  99         };
 100         if (CLIParserParseString(Cmd, argtable, arg_getsize(argtable), true)){
 101                 CLIParserFree();
 102                 return 0;
 103         }
 104
 105         leaveSignalON = arg_get_lit(1);
 106         if (arg_get_lit(2)) {
 107                 cm = cm - ISO14A_CONNECT;
 108         }
 109         if (arg_get_lit(3)) {
 110                 cm |= ISO14A_NO_RATS;
 111         }
 112
 113         CLIParserFree();
 114
 115         if (leaveSignalON)
 116                 cm |= ISO14A_NO_DISCONNECT;
 117
 118         UsbCommand c = {CMD_READER_ISO_14443a, {cm, 0, 0}};
 119         SendCommand(&c);
 120
 121         if (ISO14A_CONNECT & cm) {
 122                 UsbCommand resp;
 123                 WaitForResponse(CMD_ACK,&resp);
 124
 125                 iso14a_card_select_t card;
 126                 memcpy(&card, (iso14a_card_select_t *)resp.d.asBytes, sizeof(iso14a_card_select_t));
 127
 128                 uint64_t select_status = resp.arg[0];       // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS, 3: proprietary Anticollision
 129
 130                 if(select_status == 0) {
 131                         PrintAndLog("iso14443a card select failed");
 132                         return 1;
 133                 }
 134
 135                 if(select_status == 3) {
 136                         PrintAndLog("Card doesn't support standard iso14443-3 anticollision");
 137                         PrintAndLog("ATQA : %02x %02x", card.atqa[1], card.atqa[0]);
 138                         return 1;
 139                 }
 140
 141                 PrintAndLog(" UID : %s", sprint_hex(card.uid, card.uidlen));
 142                 PrintAndLog("ATQA : %02x %02x", card.atqa[1], card.atqa[0]);
 143                 PrintAndLog(" SAK : %02x [%" PRIu64 "]", card.sak, resp.arg[0]);
 144                 if(card.ats_len >= 3) {         // a valid ATS consists of at least the length byte (TL) and 2 CRC bytes
 145                         PrintAndLog(" ATS : %s", sprint_hex(card.ats, card.ats_len));
 146                 }
 147                 if (leaveSignalON) {
 148                         PrintAndLog("Card is selected. You can now start sending commands");
 149                 }
 150         }
 151
 152         if (!leaveSignalON) {
 153                 PrintAndLog("Field dropped.");
 154         }
 155
 156         return 0;
 157 }
 158
 159
 160 int CmdHF14AInfo(const char *Cmd) {
 161
 162         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT | ISO14A_NO_DISCONNECT, 0, 0}};
 163         SendCommand(&c);
 164
 165         UsbCommand resp;
 166         if (!WaitForResponseTimeout(CMD_NACK, &resp, 500)) {
 167                 if (Cmd[0] != 's') PrintAndLog("Error: No response from Proxmark.\n");
 168                 return 0;
 169         }
 170
 171         iso14a_card_select_t card;
 172         memcpy(&card, (iso14a_card_select_t *)resp.d.asBytes, sizeof(iso14a_card_select_t));
 173
 174         uint64_t select_status = resp.arg[0];       // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS, 3: proprietary Anticollision
 175
 176         if (select_status == 0) {
 177                 if (Cmd[0] != 's') PrintAndLog("iso14443a card select failed");
 178                 // disconnect
 179                 c.arg[0] = 0;
 180                 c.arg[1] = 0;
 181                 c.arg[2] = 0;
 182                 SendCommand(&c);
 183                 return 0;
 184         }
 185
 186         if(select_status == 3) {
 187                 PrintAndLog("Card doesn't support standard iso14443-3 anticollision");
 188                 PrintAndLog("ATQA : %02x %02x", card.atqa[1], card.atqa[0]);
 189                 // disconnect
 190                 c.arg[0] = 0;
 191                 c.arg[1] = 0;
 192                 c.arg[2] = 0;
 193                 SendCommand(&c);
 194                 return 0;
 195         }
 196
 197         PrintAndLog(" UID : %s", sprint_hex(card.uid, card.uidlen));
 198         PrintAndLog("ATQA : %02x %02x", card.atqa[1], card.atqa[0]);
 199         PrintAndLog(" SAK : %02x [%" PRIu64 "]", card.sak, resp.arg[0]);
 200
 201         bool isMifareClassic = true;
 202         switch (card.sak) {
 203                 case 0x00:
 204                         isMifareClassic = false;
 205
 206                         //***************************************test****************
 207                         // disconnect
 208                         c.arg[0] = 0;
 209                         c.arg[1] = 0;
 210                         c.arg[2] = 0;
 211                         SendCommand(&c);
 212
 213                         uint32_t tagT = GetHF14AMfU_Type();
 214                         ul_print_type(tagT, 0);
 215
 216                         //reconnect for further tests
 217                         c.arg[0] = ISO14A_CONNECT | ISO14A_NO_DISCONNECT;
 218                         c.arg[1] = 0;
 219                         c.arg[2] = 0;
 220
 221                         SendCommand(&c);
 222
 223                         UsbCommand resp;
 224                         WaitForResponse(CMD_NACK,&resp);
 225
 226                         memcpy(&card, (iso14a_card_select_t *)resp.d.asBytes, sizeof(iso14a_card_select_t));
 227
 228                         select_status = resp.arg[0];        // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS
 229
 230                         if (select_status == 0) {
 231                                 //PrintAndLog("iso14443a card select failed");
 232                                 // disconnect
 233                                 c.arg[0] = 0;
 234                                 c.arg[1] = 0;
 235                                 c.arg[2] = 0;
 236                                 SendCommand(&c);
 237                                 return 0;
 238                         }
 239
 240                         /*  orig
 241                         // check if the tag answers to GETVERSION (0x60)
 242                         c.arg[0] = ISO14A_RAW | ISO14A_APPEND_CRC | ISO14A_NO_DISCONNECT;
 243                         c.arg[1] = 1;
 244                         c.arg[2] = 0;
 245                         c.d.asBytes[0] = 0x60;
 246                         SendCommand(&c);
 247                         WaitForResponse(CMD_ACK,&resp);
 248
 249                         uint8_t version[10] = {0};
 250                         memcpy(version, resp.d.asBytes, resp.arg[0] < sizeof(version) ? resp.arg[0] : sizeof(version));
 251                         uint8_t len = resp.arg[0] & 0xff;
 252                         switch ( len ){
 253                                 // todo, identify "Magic UL-C tags". // they usually have a static nonce response to 0x1A command.
 254                                 // UL-EV1, size, check version[6] == 0x0b (smaller)  0x0b * 4 == 48
 255                                 case 0x0A:PrintAndLog("TYPE : NXP MIFARE Ultralight EV1 %d bytes", (version[6] == 0xB) ? 48 : 128);break;
 256                                 case 0x01:PrintAndLog("TYPE : NXP MIFARE Ultralight C");break;
 257                                 case 0x00:PrintAndLog("TYPE : NXP MIFARE Ultralight");break;
 258                         }
 259                         */
 260                         break;
 261                 case 0x01: PrintAndLog("TYPE : NXP TNP3xxx Activision Game Appliance"); break;
 262                 case 0x04: PrintAndLog("TYPE : NXP MIFARE (various !DESFire !DESFire EV1)"); break;
 263                 case 0x08: PrintAndLog("TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1"); break;
 264                 case 0x09: PrintAndLog("TYPE : NXP MIFARE Mini 0.3k"); break;
 265                 case 0x10: PrintAndLog("TYPE : NXP MIFARE Plus 2k SL2"); break;
 266                 case 0x11: PrintAndLog("TYPE : NXP MIFARE Plus 4k SL2"); break;
 267                 case 0x18: PrintAndLog("TYPE : NXP MIFARE Classic 4k | Plus 4k SL1"); break;
 268                 case 0x20: PrintAndLog("TYPE : NXP MIFARE DESFire 4k | DESFire EV1 2k/4k/8k | Plus 2k/4k SL3 | JCOP 31/41"); break;
 269                 case 0x24: PrintAndLog("TYPE : NXP MIFARE DESFire | DESFire EV1"); break;
 270                 case 0x28: PrintAndLog("TYPE : JCOP31 or JCOP41 v2.3.1"); break;
 271                 case 0x38: PrintAndLog("TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K"); break;
 272                 case 0x88: PrintAndLog("TYPE : Infineon MIFARE CLASSIC 1K"); break;
 273                 case 0x98: PrintAndLog("TYPE : Gemplus MPCOS"); break;
 274                 default: ;
 275         }
 276
 277         // Double & triple sized UID, can be mapped to a manufacturer.
 278         // HACK: does this apply for Ultralight cards?
 279         if (card.uidlen > 4) {
 280                 PrintAndLog("MANUFACTURER : %s", getManufacturerName(card.uid[0]));
 281         }
 282
 283         // try to request ATS even if tag claims not to support it
 284         if (select_status == 2) {
 285                 uint8_t rats[] = { 0xE0, 0x80 }; // FSDI=8 (FSD=256), CID=0
 286                 c.arg[0] = ISO14A_RAW | ISO14A_APPEND_CRC | ISO14A_NO_DISCONNECT;
 287                 c.arg[1] = 2;
 288                 c.arg[2] = 0;
 289                 memcpy(c.d.asBytes, rats, 2);
 290                 SendCommand(&c);
 291                 WaitForResponse(CMD_ACK,&resp);
 292
 293                 memcpy(card.ats, resp.d.asBytes, resp.arg[0]);
 294                 card.ats_len = resp.arg[0];             // note: ats_len includes CRC Bytes
 295         }
 296
 297         if(card.ats_len >= 3) {         // a valid ATS consists of at least the length byte (TL) and 2 CRC bytes
 298                 bool ta1 = 0, tb1 = 0, tc1 = 0;
 299                 int pos;
 300
 301                 if (select_status == 2) {
 302                         PrintAndLog("SAK incorrectly claims that card doesn't support RATS");
 303                 }
 304                 PrintAndLog(" ATS : %s", sprint_hex(card.ats, card.ats_len));
 305                 PrintAndLog("       -  TL : length is %d bytes", card.ats[0]);
 306                 if (card.ats[0] != card.ats_len - 2) {
 307                         PrintAndLog("ATS may be corrupted. Length of ATS (%d bytes incl. 2 Bytes CRC) doesn't match TL", card.ats_len);
 308                 }
 309
 310                 if (card.ats[0] > 1) {      // there is a format byte (T0)
 311                         ta1 = (card.ats[1] & 0x10) == 0x10;
 312                         tb1 = (card.ats[1] & 0x20) == 0x20;
 313                         tc1 = (card.ats[1] & 0x40) == 0x40;
 314                         int16_t fsci = card.ats[1] & 0x0f;
 315                         PrintAndLog("       -  T0 : TA1 is%s present, TB1 is%s present, "
 316                                         "TC1 is%s present, FSCI is %d (FSC = %ld)",
 317                                 (ta1 ? "" : " NOT"), (tb1 ? "" : " NOT"), (tc1 ? "" : " NOT"),
 318                                 fsci,
 319                                 fsci < sizeof(atsFSC) ? atsFSC[fsci] : -1
 320                                 );
 321                 }
 322                 pos = 2;
 323                 if (ta1) {
 324                         char dr[16], ds[16];
 325                         dr[0] = ds[0] = '\0';
 326                         if (card.ats[pos] & 0x10) strcat(ds, "2, ");
 327                         if (card.ats[pos] & 0x20) strcat(ds, "4, ");
 328                         if (card.ats[pos] & 0x40) strcat(ds, "8, ");
 329                         if (card.ats[pos] & 0x01) strcat(dr, "2, ");
 330                         if (card.ats[pos] & 0x02) strcat(dr, "4, ");
 331                         if (card.ats[pos] & 0x04) strcat(dr, "8, ");
 332                         if (strlen(ds) != 0) ds[strlen(ds) - 2] = '\0';
 333                         if (strlen(dr) != 0) dr[strlen(dr) - 2] = '\0';
 334                         PrintAndLog("       - TA1 : different divisors are%s supported, "
 335                                         "DR: [%s], DS: [%s]",
 336                                         (card.ats[pos] & 0x80 ? " NOT" : ""), dr, ds);
 337                         pos++;
 338                 }
 339                 if (tb1) {
 340                         uint32_t sfgi = card.ats[pos] & 0x0F;
 341                         uint32_t fwi = card.ats[pos] >> 4;
 342                         PrintAndLog("       - TB1 : SFGI = %d (SFGT = %s%ld/fc), FWI = %d (FWT = %ld/fc)",
 343                                         (sfgi),
 344                                         sfgi ? "" : "(not needed) ",
 345                                         sfgi ? (1 << 12) << sfgi : 0,
 346                                         fwi,
 347                                         (1 << 12) << fwi
 348                                         );
 349                         pos++;
 350                 }
 351                 if (tc1) {
 352                         PrintAndLog("       - TC1 : NAD is%s supported, CID is%s supported",
 353                                         (card.ats[pos] & 0x01) ? "" : " NOT",
 354                                         (card.ats[pos] & 0x02) ? "" : " NOT");
 355                         pos++;
 356                 }
 357                 if (card.ats[0] > pos) {
 358                         char *tip = "";
 359                         if (card.ats[0] - pos >= 7) {
 360                                 if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) {
 361                                         tip = "-> MIFARE Plus X 2K or 4K";
 362                                 } else if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) {
 363                                         tip = "-> MIFARE Plus S 2K or 4K";
 364                                 }
 365                         }
 366                         PrintAndLog("       -  HB : %s%s", sprint_hex(card.ats + pos, card.ats[0] - pos), tip);
 367                         if (card.ats[pos] == 0xC1) {
 368                                 PrintAndLog("               c1 -> Mifare or (multiple) virtual cards of various type");
 369                                 PrintAndLog("                  %02x -> Length is %d bytes",
 370                                                 card.ats[pos + 1], card.ats[pos + 1]);
 371                                 switch (card.ats[pos + 2] & 0xf0) {
 372                                         case 0x10:
 373                                                 PrintAndLog("                     1x -> MIFARE DESFire");
 374                                                 break;
 375                                         case 0x20:
 376                                                 PrintAndLog("                     2x -> MIFARE Plus");
 377                                                 break;
 378                                 }
 379                                 switch (card.ats[pos + 2] & 0x0f) {
 380                                         case 0x00:
 381                                                 PrintAndLog("                     x0 -> <1 kByte");
 382                                                 break;
 383                                         case 0x01:
 384                                                 PrintAndLog("                     x1 -> 1 kByte");
 385                                                 break;
 386                                         case 0x02:
 387                                                 PrintAndLog("                     x2 -> 2 kByte");
 388                                                 break;
 389                                         case 0x03:
 390                                                 PrintAndLog("                     x3 -> 4 kByte");
 391                                                 break;
 392                                         case 0x04:
 393                                                 PrintAndLog("                     x4 -> 8 kByte");
 394                                                 break;
 395                                 }
 396                                 switch (card.ats[pos + 3] & 0xf0) {
 397                                         case 0x00:
 398                                                 PrintAndLog("                        0x -> Engineering sample");
 399                                                 break;
 400                                         case 0x20:
 401                                                 PrintAndLog("                        2x -> Released");
 402                                                 break;
 403                                 }
 404                                 switch (card.ats[pos + 3] & 0x0f) {
 405                                         case 0x00:
 406                                                 PrintAndLog("                        x0 -> Generation 1");
 407                                                 break;
 408                                         case 0x01:
 409                                                 PrintAndLog("                        x1 -> Generation 2");
 410                                                 break;
 411                                         case 0x02:
 412                                                 PrintAndLog("                        x2 -> Generation 3");
 413                                                 break;
 414                                 }
 415                                 switch (card.ats[pos + 4] & 0x0f) {
 416                                         case 0x00:
 417                                                 PrintAndLog("                           x0 -> Only VCSL supported");
 418                                                 break;
 419                                         case 0x01:
 420                                                 PrintAndLog("                           x1 -> VCS, VCSL, and SVC supported");
 421                                                 break;
 422                                         case 0x0E:
 423                                                 PrintAndLog("                           xE -> no VCS command supported");
 424                                                 break;
 425                                 }
 426                         }
 427                 }
 428         } else {
 429                 PrintAndLog("proprietary non iso14443-4 card found, RATS not supported");
 430         }
 431
 432
 433         // try to see if card responses to "chinese magic backdoor" commands.
 434         (void)mfCIdentify();
 435
 436         if (isMifareClassic) {
 437                 switch (DetectClassicPrng()) {
 438                 case 0:
 439                         PrintAndLog("Prng detection: HARDENED (hardnested)");
 440                         break;
 441                 case 1:
 442                         PrintAndLog("Prng detection: WEAK");
 443                         break;
 444                 default:
 445                         PrintAndLog("Prng detection error.");
 446                 }
 447         }
 448
 449         return select_status;
 450 }
 451
 452 // Collect ISO14443 Type A UIDs
 453 int CmdHF14ACUIDs(const char *Cmd)
 454 {
 455         // requested number of UIDs
 456         int n = atoi(Cmd);
 457         // collect at least 1 (e.g. if no parameter was given)
 458         n = n > 0 ? n : 1;
 459
 460         PrintAndLog("Collecting %d UIDs", n);
 461         PrintAndLog("Start: %" PRIu64, msclock()/1000);
 462         // repeat n times
 463         for (int i = 0; i < n; i++) {
 464                 // execute anticollision procedure
 465                 UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_CONNECT | ISO14A_NO_RATS, 0, 0}};
 466                 SendCommand(&c);
 467
 468                 UsbCommand resp;
 469                 WaitForResponse(CMD_NACK,&resp);
 470
 471                 iso14a_card_select_t *card = (iso14a_card_select_t *) resp.d.asBytes;
 472
 473                 // check if command failed
 474                 if (resp.arg[0] == 0) {
 475                         PrintAndLog("Card select failed.");
 476                 } else {
 477                         char uid_string[20];
 478                         for (uint16_t i = 0; i < card->uidlen; i++) {
 479                                 sprintf(&uid_string[2*i], "%02X", card->uid[i]);
 480                         }
 481                         PrintAndLog("%s", uid_string);
 482                 }
 483         }
 484         PrintAndLog("End: %" PRIu64, msclock()/1000);
 485
 486         return 1;
 487 }
 488
 489 // ## simulate iso14443a tag
 490 // ## greg - added ability to specify tag UID
 491 int CmdHF14ASim(const char *Cmd)
 492 {
 493         UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,{0,0,0}};
 494
 495         // Retrieve the tag type
 496         uint8_t tagtype = param_get8ex(Cmd,0,0,10);
 497
 498         // When no argument was given, just print help message
 499         if (tagtype == 0) {
 500                 PrintAndLog("");
 501                 PrintAndLog(" Emulating ISO/IEC 14443 type A tag with 4 or 7 byte UID");
 502                 PrintAndLog("");
 503                 PrintAndLog("   syntax: hf 14a sim <type> <uid>");
 504                 PrintAndLog("    types: 1 = MIFARE Classic");
 505                 PrintAndLog("           2 = MIFARE Ultralight");
 506                 PrintAndLog("           3 = MIFARE Desfire");
 507                 PrintAndLog("           4 = ISO/IEC 14443-4");
 508                 PrintAndLog("           5 = MIFARE Tnp3xxx");
 509                 PrintAndLog("");
 510                 return 1;
 511         }
 512
 513         // Store the tag type
 514         c.arg[0] = tagtype;
 515
 516         // Retrieve the full 4 or 7 byte long uid
 517         uint64_t long_uid = param_get64ex(Cmd,1,0,16);
 518
 519         // Are we handling the (optional) second part uid?
 520         if (long_uid > 0xffffffff) {
 521                 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 7 byte UID (%014" PRIx64 ")",long_uid);
 522                 // Store the second part
 523                 c.arg[2] = (long_uid & 0xffffffff);
 524                 long_uid >>= 32;
 525                 // Store the first part, ignore the first byte, it is replaced by cascade byte (0x88)
 526                 c.arg[1] = (long_uid & 0xffffff);
 527         } else {
 528                 PrintAndLog("Emulating ISO/IEC 14443 type A tag with 4 byte UID (%08x)",long_uid);
 529                 // Only store the first part
 530                 c.arg[1] = long_uid & 0xffffffff;
 531         }
 532 /*
 533                 // At lease save the mandatory first part of the UID
 534                 c.arg[0] = long_uid & 0xffffffff;
 535
 536         if (c.arg[1] == 0) {
 537                 PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
 538         }
 539
 540         switch (c.arg[0]) {
 541                 case 1: {
 542                         PrintAndLog("Emulating ISO/IEC 14443-3 type A tag with 4 byte UID");
 543                         UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
 544                 } break;
 545                 case 2: {
 546                         PrintAndLog("Emulating ISO/IEC 14443-4 type A tag with 7 byte UID");
 547                 } break;
 548                 default: {
 549                         PrintAndLog("Error: unkown tag type (%d)",c.arg[0]);
 550                         PrintAndLog("syntax: hf 14a sim <uid>",c.arg[0]);
 551                         PrintAndLog(" type1: 4 ",c.arg[0]);
 552
 553                         return 1;
 554                 } break;
 555         }
 556 */
 557 /*
 558   unsigned int hi = 0, lo = 0;
 559   int n = 0, i = 0;
 560   while (sscanf(&Cmd[i++], "%1x", &n ) == 1) {
 561         hi= (hi << 4) | (lo >> 28);
 562         lo= (lo << 4) | (n & 0xf);
 563   }
 564 */
 565 //  UsbCommand c = {CMD_SIMULATE_TAG_ISO_14443a,param_get32ex(Cmd,0,0,10),param_get32ex(Cmd,1,0,16),param_get32ex(Cmd,2,0,16)};
 566 //  PrintAndLog("Emulating ISO/IEC 14443 type A tag with UID %01d %08x %08x",c.arg[0],c.arg[1],c.arg[2]);
 567   SendCommand(&c);
 568   return 0;
 569 }
 570
 571
 572 int CmdHF14ASnoop(const char *Cmd) {
 573         int param = 0;
 574
 575         uint8_t ctmp = param_getchar(Cmd, 0) ;
 576         if (ctmp == 'h' || ctmp == 'H') {
 577                 PrintAndLog("It get data from the field and saves it into command buffer.");
 578                 PrintAndLog("Buffer accessible from command hf list 14a.");
 579                 PrintAndLog("Usage:  hf 14a snoop [c][r]");
 580                 PrintAndLog("c - triggered by first data from card");
 581                 PrintAndLog("r - triggered by first 7-bit request from reader (REQ,WUP,...)");
 582                 PrintAndLog("sample: hf 14a snoop c r");
 583                 return 0;
 584         }
 585
 586         for (int i = 0; i < 2; i++) {
 587                 ctmp = param_getchar(Cmd, i);
 588                 if (ctmp == 'c' || ctmp == 'C') param |= 0x01;
 589                 if (ctmp == 'r' || ctmp == 'R') param |= 0x02;
 590         }
 591
 592         UsbCommand c = {CMD_SNOOP_ISO_14443a, {param, 0, 0}};
 593         SendCommand(&c);
 594         return 0;
 595 }
 596
 597
 598 void DropField() {
 599         UsbCommand c = {CMD_READER_ISO_14443a, {0, 0, 0}};
 600         SendCommand(&c);
 601 }
 602
 603
 604 int ExchangeRAW14a(uint8_t *datain, int datainlen, bool activateField, bool leaveSignalON, uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
 605         static bool responseNum = false;
 606         uint16_t cmdc = 0;
 607         *dataoutlen = 0;
 608
 609         if (activateField) {
 610                 responseNum = false;
 611                 UsbCommand resp;
 612
 613                 // Anticollision + SELECT card
 614                 UsbCommand ca = {CMD_READER_ISO_14443a, {ISO14A_CONNECT | ISO14A_NO_DISCONNECT | ISO14A_CLEAR_TRACE, 0, 0}};
 615                 SendCommand(&ca);
 616                 if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
 617                         PrintAndLog("14aRAW ERROR: Proxmark connection timeout.");
 618                         return 1;
 619                 }
 620
 621                 // check result
 622                 if (resp.arg[0] == 0) {
 623                         PrintAndLog("14aRAW ERROR: No card in field.");
 624                         return 1;
 625                 }
 626
 627                 if (resp.arg[0] != 1 && resp.arg[0] != 2) {
 628                         PrintAndLog("14aRAW ERROR: card not in iso14443-4. res=%d.", resp.arg[0]);
 629                         return 1;
 630                 }
 631
 632                 if (resp.arg[0] == 2) {     // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS, 3: proprietary Anticollision
 633                         // get ATS
 634                         UsbCommand cr = {CMD_READER_ISO_14443a, {ISO14A_RAW | ISO14A_APPEND_CRC | ISO14A_NO_DISCONNECT, 2, 0}};
 635                         uint8_t rats[] = { 0xE0, 0x80 }; // FSDI=8 (FSD=256), CID=0
 636                         memcpy(cr.d.asBytes, rats, 2);
 637                         SendCommand(&cr);
 638                         if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
 639                                 PrintAndLog("14aRAW ERROR: Proxmark connection timeout.");
 640                                 return 1;
 641                         }
 642
 643                         if (resp.arg[0] <= 0) { // ats_len
 644                                 PrintAndLog("14aRAW ERROR: Can't get ATS.");
 645                                 return 1;
 646                         }
 647                 }
 648         }
 649
 650         if (leaveSignalON)
 651                 cmdc |= ISO14A_NO_DISCONNECT;
 652
 653         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_RAW | ISO14A_APPEND_CRC | cmdc, (datainlen & 0xFFFF) + 2, 0}};
 654         uint8_t header[] = {0x0a | responseNum, 0x00};
 655         responseNum ^= 1;
 656         memcpy(c.d.asBytes, header, 2);
 657         memcpy(&c.d.asBytes[2], datain, datainlen);
 658         SendCommand(&c);
 659
 660         uint8_t *recv;
 661         UsbCommand resp;
 662
 663         if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
 664                 recv = resp.d.asBytes;
 665                 int iLen = resp.arg[0];
 666
 667                 if(!iLen) {
 668                         PrintAndLog("14aRAW ERROR: No card response.");
 669                         return 1;
 670                 }
 671
 672                 *dataoutlen = iLen - 2;
 673                 if (*dataoutlen < 0)
 674                         *dataoutlen = 0;
 675
 676                 if (maxdataoutlen && *dataoutlen > maxdataoutlen) {
 677                         PrintAndLog("14aRAW ERROR: Buffer too small(%d). Needs %d bytes", *dataoutlen, maxdataoutlen);
 678                         return 2;
 679                 }
 680
 681                 if (recv[0] != header[0]) {
 682                         PrintAndLog("14aRAW ERROR: iso14443-4 framing error. Card send %2x must be %2x", dataout[0], header[0]);
 683                         return 2;
 684                 }
 685
 686                 memcpy(dataout, &recv[2], *dataoutlen);
 687
 688                 // CRC Check
 689                 if (iLen == -1) {
 690                         PrintAndLog("14aRAW ERROR: ISO 14443A CRC error.");
 691                         return 3;
 692                 }
 693
 694
 695         } else {
 696                 PrintAndLog("14aRAW ERROR: Reply timeout.");
 697                 return 4;
 698         }
 699
 700         return 0;
 701 }
 702
 703
 704 static int SelectCard14443_4(bool disconnect, iso14a_card_select_t *card) {
 705         UsbCommand resp;
 706
 707         frameLength = 0;
 708
 709         if (card)
 710                 memset(card, 0, sizeof(iso14a_card_select_t));
 711
 712         DropField();
 713
 714         // Anticollision + SELECT card
 715         UsbCommand ca = {CMD_READER_ISO_14443a, {ISO14A_CONNECT | ISO14A_NO_DISCONNECT, 0, 0}};
 716         SendCommand(&ca);
 717         if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
 718                 PrintAndLogEx(ERR, "Proxmark connection timeout.");
 719                 return 1;
 720         }
 721
 722         // check result
 723         if (resp.arg[0] == 0) {
 724                 PrintAndLogEx(ERR, "No card in field.");
 725                 return 1;
 726         }
 727
 728         if (resp.arg[0] != 1 && resp.arg[0] != 2) {
 729                 PrintAndLogEx(ERR, "Card not in iso14443-4. res=%d.", resp.arg[0]);
 730                 return 1;
 731         }
 732
 733         if (resp.arg[0] == 2) {     // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS, 3: proprietary Anticollision
 734                 // try to get ATS although SAK indicated that it is not ISO14443-4 compliant
 735                 UsbCommand cr = {CMD_READER_ISO_14443a, {ISO14A_RAW | ISO14A_APPEND_CRC | ISO14A_NO_DISCONNECT, 2, 0}};
 736                 uint8_t rats[] = { 0xE0, 0x80 }; // FSDI=8 (FSD=256), CID=0
 737                 memcpy(cr.d.asBytes, rats, 2);
 738                 SendCommand(&cr);
 739                 if (!WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
 740                         PrintAndLogEx(ERR, "Proxmark connection timeout.");
 741                         return 1;
 742                 }
 743
 744                 if (resp.arg[0] <= 0) { // ats_len
 745                         PrintAndLogEx(ERR, "Can't get ATS.");
 746                         return 1;
 747                 }
 748         }
 749
 750         // get frame length from ATS
 751         iso14a_card_select_t *vcard = (iso14a_card_select_t *) resp.d.asBytes;
 752         if (vcard->ats_len > 1) {
 753                 uint8_t fsci = vcard->ats[1] & 0x0f;
 754                 if (fsci < sizeof(atsFSC))
 755                         frameLength = atsFSC[fsci];
 756         }
 757
 758         if (card) {
 759                 memcpy(card, vcard, sizeof(iso14a_card_select_t));
 760         }
 761
 762         if (disconnect) {
 763                 DropField();
 764         }
 765
 766         return 0;
 767 }
 768
 769
 770 static int ExchangeAPDU(bool chainingin, uint8_t *datain, int datainlen, bool activateField, uint8_t *dataout, int maxdataoutlen, int *dataoutlen, bool *chainingout)
 771 {
 772         *chainingout = false;
 773
 774         if (activateField) {
 775                 // select with no disconnect and set frameLength
 776                 int selres = SelectCard14443_4(false, NULL);
 777                 if (selres)
 778                         return selres;
 779         }
 780
 781         uint16_t cmdc = 0;
 782         if (chainingin)
 783                 cmdc = ISO14A_SEND_CHAINING;
 784
 785         // "Command APDU" length should be 5+255+1, but javacard's APDU buffer might be smaller - 133 bytes
 786         // https://stackoverflow.com/questions/32994936/safe-max-java-card-apdu-data-command-and-respond-size
 787         // here length USB_CMD_DATA_SIZE=512
 788         // timeout must be authomatically set by "get ATS"
 789         UsbCommand c = {CMD_READER_ISO_14443a, {ISO14A_APDU | ISO14A_NO_DISCONNECT | cmdc, (datainlen & 0xFFFF), 0}};
 790         memcpy(c.d.asBytes, datain, datainlen);
 791         SendCommand(&c);
 792
 793         uint8_t *recv;
 794         UsbCommand resp;
 795
 796         if (WaitForResponseTimeout(CMD_ACK, &resp, 1500)) {
 797                 recv = resp.d.asBytes;
 798                 int iLen = resp.arg[0];
 799                 uint8_t res = resp.arg[1];
 800
 801                 int dlen = iLen - 2;
 802                 if (dlen < 0)
 803                         dlen = 0;
 804                 *dataoutlen += dlen;
 805
 806                 if (maxdataoutlen && *dataoutlen > maxdataoutlen) {
 807                         PrintAndLog("APDU ERROR: Buffer too small(%d). Needs %d bytes", *dataoutlen, maxdataoutlen);
 808                         return 2;
 809                 }
 810
 811                 // I-block ACK
 812                 if ((res & 0xf2) == 0xa2) {
 813                         *dataoutlen = 0;
 814                         *chainingout = true;
 815                         return 0;
 816                 }
 817
 818                 if(!iLen) {
 819                         PrintAndLog("APDU ERROR: No APDU response.");
 820                         return 1;
 821                 }
 822
 823                 // check apdu length
 824                 if (iLen < 2 && iLen >= 0) {
 825                         PrintAndLog("APDU ERROR: Small APDU response. Len=%d", iLen);
 826                         return 2;
 827                 }
 828
 829                 // check block TODO
 830                 if (iLen == -2) {
 831                         PrintAndLog("APDU ERROR: Block type mismatch.");
 832                         return 2;
 833                 }
 834
 835                 memcpy(dataout, recv, dlen);
 836
 837                 // chaining
 838                 if ((res & 0x10) != 0) {
 839                         *chainingout = true;
 840                 }
 841
 842                 // CRC Check
 843                 if (iLen == -1) {
 844                         PrintAndLog("APDU ERROR: ISO 14443A CRC error.");
 845                         return 3;
 846                 }
 847         } else {
 848                 PrintAndLog("APDU ERROR: Reply timeout.");
 849                 return 4;
 850         }
 851
 852         return 0;
 853 }
 854
 855
 856 int ExchangeAPDU14a(uint8_t *datain, int datainlen, bool activateField, bool leaveSignalON, uint8_t *dataout, int maxdataoutlen, int *dataoutlen) {
 857         *dataoutlen = 0;
 858         bool chaining = false;
 859         int res;
 860
 861         // 3 byte here - 1b framing header, 2b crc16
 862         if ( (frameLength && (datainlen > frameLength - 3)) || (datainlen > USB_CMD_DATA_SIZE - 3) ) {
 863                 int clen = 0;
 864
 865                 bool vActivateField = activateField;
 866
 867                 do {
 868                         int vlen = MIN(frameLength - 3, datainlen - clen);
 869                         bool chainBlockNotLast = ((clen + vlen) < datainlen);
 870
 871                         *dataoutlen = 0;
 872                         res = ExchangeAPDU(chainBlockNotLast, &datain[clen], vlen, vActivateField, dataout, maxdataoutlen, dataoutlen, &chaining);
 873                         if (res) {
 874                                 if (!leaveSignalON)
 875                                         DropField();
 876
 877                                 return 200;
 878                         }
 879
 880                         // check R-block ACK
 881                         if ((*dataoutlen == 0) && (*dataoutlen != 0 || chaining != chainBlockNotLast)) {
 882                                 if (!leaveSignalON)
 883                                         DropField();
 884
 885                                 return 201;
 886                         }
 887
 888                         clen += vlen;
 889                         vActivateField = false;
 890                         if (*dataoutlen) {
 891                                 if (clen != datainlen)
 892                                         PrintAndLogEx(WARNING, "APDU: I-block/R-block sequence error. Data len=%d, Sent=%d, Last packet len=%d", datainlen, clen, *dataoutlen);
 893                                 break;
 894                         }
 895                 } while (clen < datainlen);
 896         } else {
 897                 res = ExchangeAPDU(false, datain, datainlen, activateField, dataout, maxdataoutlen, dataoutlen, &chaining);
 898                 if (res) {
 899                         if (!leaveSignalON)
 900                                 DropField();
 901
 902                         return res;
 903                 }
 904         }
 905
 906         while (chaining) {
 907                 // I-block with chaining
 908                 res = ExchangeAPDU(false, NULL, 0, false, &dataout[*dataoutlen], maxdataoutlen, dataoutlen, &chaining);
 909
 910                 if (res) {
 911                         if (!leaveSignalON)
 912                                 DropField();
 913
 914                         return 100;
 915                 }
 916         }
 917
 918         if (!leaveSignalON)
 919                 DropField();
 920
 921         return 0;
 922 }
 923
 924 // ISO14443-4. 7. Half-duplex block transmission protocol
 925 int CmdHF14AAPDU(const char *cmd) {
 926         uint8_t data[USB_CMD_DATA_SIZE];
 927         int datalen = 0;
 928         uint8_t header[5];
 929         int headerlen = 0;
 930         bool activateField = false;
 931         bool leaveSignalON = false;
 932         bool decodeTLV = false;
 933         bool decodeAPDU = false;
 934         bool makeAPDU = false;
 935         bool extendedAPDU = false;
 936         int le = 0;
 937         int res = 0;
 938
 939         CLIParserInit("hf 14a apdu",
 940                                   "Sends an ISO 7816-4 APDU via ISO 14443-4 block transmission protocol (T=CL). Works with all APDU types from ISO 7816-4:2013",
 941                                   "Examples:\n\thf 14a apdu -st 00A404000E325041592E5359532E444446303100\n"
 942                                   "\thf 14a apdu -sd 00A404000E325041592E5359532E444446303100 - decode APDU\n"
 943                                   "\thf 14a apdu -sm 00A40400 325041592E5359532E4444463031 -l 256 - encode standard APDU\n"
 944                                   "\thf 14a apdu -sm 00A40400 325041592E5359532E4444463031 -el 65536 - encode extended APDU\n");
 945
 946         void* argtable[] = {
 947                 arg_param_begin,
 948                 arg_lit0("sS",  "select",   "activate field and select card"),
 949                 arg_lit0("kK",  "keep",     "leave the signal field ON after receive response"),
 950                 arg_lit0("tT",  "tlv",      "executes TLV decoder if it possible"),
 951                 arg_lit0("dD",  "decapdu",  "decode APDU request if it possible"),
 952                 arg_str0("mM",  "make",     "<head (CLA INS P1 P2) hex>", "make APDU with head from this field and data from data field. Must be 4 bytes length: <CLA INS P1 P2>"),
 953                 arg_lit0("eE",  "extended", "make extended length APDU (requires `-m`)"),
 954                 arg_int0("lL",  "le",       "<Le (int)>", "Le APDU parameter (requires `-m`)"),
 955                 arg_strx1(NULL, NULL,       "<APDU (hex) | data (hex)>", "APDU (without `-m`), or data (with `-m`)"),
 956                 arg_param_end
 957         };
 958         CLIExecWithReturn(cmd, argtable, false);
 959
 960         activateField = arg_get_lit(1);
 961         leaveSignalON = arg_get_lit(2);
 962         decodeTLV = arg_get_lit(3);
 963         decodeAPDU = arg_get_lit(4);
 964
 965         res = CLIParamHexToBuf(arg_get_str(5), header, sizeof(header), &headerlen);
 966         makeAPDU = headerlen > 0;
 967         if (res || (makeAPDU && headerlen != 4)) {
 968                 PrintAndLogEx(ERR, "header length must be exactly 4 bytes");
 969                 CLIParserFree();
 970                 return 1;
 971         }
 972         extendedAPDU = arg_get_lit(6);
 973         le = arg_get_int_def(7, 0);
 974
 975         if (makeAPDU) {
 976                 uint8_t apdudata[USB_CMD_DATA_SIZE] = {0};
 977                 int apdudatalen = 0;
 978
 979                 CLIGetHexBLessWithReturn(8, apdudata, &apdudatalen, 1 + 2);
 980
 981                 APDUStruct apdu;
 982                 apdu.cla = header[0];
 983                 apdu.ins = header[1];
 984                 apdu.p1 = header[2];
 985                 apdu.p2 = header[3];
 986
 987                 apdu.lc = apdudatalen;
 988                 apdu.data = apdudata;
 989
 990                 apdu.extended_apdu = extendedAPDU;
 991                 apdu.le = le;
 992
 993                 if (APDUEncode(&apdu, data, &datalen)) {
 994                         PrintAndLogEx(ERR, "can't make apdu with provided parameters.");
 995                         CLIParserFree();
 996                         return 2;
 997                 }
 998         } else {
 999                 if (extendedAPDU) {
1000                         PrintAndLogEx(ERR, "`-e` without `-m`.");
1001                         CLIParserFree();
1002                         return 3;
1003                 }
1004                 if (le > 0) {
1005                         PrintAndLogEx(ERR, "`-l` without `-m`.");
1006                         CLIParserFree();
1007                         return 3;
1008                 }
1009
1010                 // len = data + PCB(1b) + CRC(2b)
1011                 CLIGetHexBLessWithReturn(8, data, &datalen, 1 + 2);
1012         }
1013
1014         CLIParserFree();
1015 //  PrintAndLog("---str [%d] %s", arg_get_str(4)->count, arg_get_str(4)->sval[0]);
1016         PrintAndLogEx(NORMAL, ">>>>[%s%s%s] %s", activateField ? "sel ": "", leaveSignalON ? "keep ": "", decodeTLV ? "TLV": "", sprint_hex(data, datalen));
1017
1018         if (decodeAPDU) {
1019                 APDUStruct apdu;
1020
1021                 if (APDUDecode(data, datalen, &apdu) == 0)
1022                         APDUPrint(apdu);
1023                 else
1024                         PrintAndLogEx(WARNING, "can't decode APDU.");
1025         }
1026
1027         res = ExchangeAPDU14a(data, datalen, activateField, leaveSignalON, data, USB_CMD_DATA_SIZE, &datalen);
1028
1029         if (res)
1030                 return res;
1031
1032         PrintAndLog("<<<< %s", sprint_hex(data, datalen));
1033
1034         PrintAndLog("APDU response: %02x %02x - %s", data[datalen - 2], data[datalen - 1], GetAPDUCodeDescription(data[datalen - 2], data[datalen - 1]));
1035
1036         // TLV decoder
1037         if (decodeTLV && datalen > 4) {
1038                 TLVPrintFromBuffer(data, datalen - 2);
1039         }
1040
1041         return 0;
1042 }
1043
1044 int CmdHF14ACmdRaw(const char *cmd) {
1045         UsbCommand c = {CMD_READER_ISO_14443a, {0, 0, 0}};
1046         bool reply=1;
1047         bool crc = false;
1048         bool power = false;
1049         bool active = false;
1050         bool active_select = false;
1051         bool no_rats = false;
1052         uint16_t numbits = 0;
1053         bool bTimeout = false;
1054         uint32_t timeout = 0;
1055         bool topazmode = false;
1056         uint8_t data[USB_CMD_DATA_SIZE];
1057         int datalen = 0;
1058
1059         // extract parameters
1060         CLIParserInit("hf 14a raw", "Send raw hex data to tag",
1061                 "Sample:\n"\
1062                 "\thf 14a raw -pa -b7 -t1000 52  -- execute WUPA\n"\
1063                 "\thf 14a raw -p 9320            -- anticollision\n"\
1064                 "\thf 14a raw -psc 60 00         -- select and mifare AUTH\n");
1065         void* argtable[] = {
1066                 arg_param_begin,
1067                 arg_lit0("rR",  "nreply",  "do not read response"),
1068                 arg_lit0("cC",  "crc",     "calculate and append CRC"),
1069                 arg_lit0("pP",  "power",   "leave the signal field ON after receive"),
1070                 arg_lit0("aA",  "active",  "active signal field ON without select"),
1071                 arg_lit0("sS",  "actives", "active signal field ON with select"),
1072                 arg_int0("bB",  "bits",    NULL, "number of bits to send. Useful for send partial byte"),
1073                 arg_int0("t",   "timeout", NULL, "timeout in ms"),
1074                 arg_lit0("T",   "topaz",   "use Topaz protocol to send command"),
1075                 arg_lit0("3",   NULL,      "ISO14443-3 select only (skip RATS)"),
1076                 arg_strx1(NULL, NULL,      "<data (hex)>", NULL),
1077                 arg_param_end
1078         };
1079         // defaults
1080         arg_get_int(6) = 0;
1081         arg_get_int(7) = 0;
1082
1083         if (CLIParserParseString(cmd, argtable, arg_getsize(argtable), false)){
1084                 CLIParserFree();
1085                 return 0;
1086         }
1087
1088         reply = !arg_get_lit(1);
1089         crc = arg_get_lit(2);
1090         power = arg_get_lit(3);
1091         active = arg_get_lit(4);
1092         active_select = arg_get_lit(5);
1093         numbits = arg_get_int(6) & 0xFFFF;
1094         timeout = arg_get_int(7);
1095         bTimeout = (timeout > 0);
1096         topazmode = arg_get_lit(8);
1097         no_rats = arg_get_lit(9);
1098         // len = data + CRC(2b)
1099         if (CLIParamHexToBuf(arg_get_str(10), data, sizeof(data) -2, &datalen)) {
1100                 CLIParserFree();
1101                 return 1;
1102         }
1103
1104         CLIParserFree();
1105
1106         // logic
1107         if(crc && datalen>0 && datalen<sizeof(data)-2)
1108         {
1109                 uint8_t first, second;
1110                 if (topazmode) {
1111                         ComputeCrc14443(CRC_14443_B, data, datalen, &first, &second);
1112                 } else {
1113                         ComputeCrc14443(CRC_14443_A, data, datalen, &first, &second);
1114                 }
1115                 data[datalen++] = first;
1116                 data[datalen++] = second;
1117         }
1118
1119         if(active || active_select)
1120         {
1121                 c.arg[0] |= ISO14A_CONNECT | ISO14A_CLEAR_TRACE;
1122                 if(active)
1123                         c.arg[0] |= ISO14A_NO_SELECT;
1124         }
1125
1126         if(bTimeout){
1127                 #define MAX_TIMEOUT 40542464    // = (2^32-1) * (8*16) / 13560000Hz * 1000ms/s
1128                 c.arg[0] |= ISO14A_SET_TIMEOUT;
1129                 if(timeout > MAX_TIMEOUT) {
1130                         timeout = MAX_TIMEOUT;
1131                         PrintAndLog("Set timeout to 40542 seconds (11.26 hours). The max we can wait for response");
1132                 }
1133                 c.arg[2] = 13560000 / 1000 / (8*16) * timeout; // timeout in ETUs (time to transfer 1 bit, approx. 9.4 us)
1134         }
1135
1136         if(power) {
1137                 c.arg[0] |= ISO14A_NO_DISCONNECT;
1138         }
1139
1140         if(datalen > 0) {
1141                 c.arg[0] |= ISO14A_RAW;
1142         }
1143
1144         if(topazmode) {
1145                 c.arg[0] |= ISO14A_TOPAZMODE;
1146         }
1147
1148         if(no_rats) {
1149                 c.arg[0] |= ISO14A_NO_RATS;
1150         }
1151
1152         // Max buffer is USB_CMD_DATA_SIZE (512)
1153         c.arg[1] = (datalen & 0xFFFF) | ((uint32_t)numbits << 16);
1154         memcpy(c.d.asBytes,data,datalen);
1155
1156         SendCommand(&c);
1157
1158         if (reply) {
1159                 int res = 0;
1160                 if (active_select)
1161                         res = waitCmd(1);
1162                 if (!res && datalen > 0)
1163                         waitCmd(0);
1164         } // if reply
1165         return 0;
1166 }
1167
1168
1169 static int waitCmd(uint8_t iSelect) {
1170         uint8_t *recv;
1171         UsbCommand resp;
1172         char *hexout;
1173
1174         if (WaitForResponseTimeout(CMD_ACK,&resp,1500)) {
1175                 recv = resp.d.asBytes;
1176                 uint8_t iLen = resp.arg[0];
1177                 if (iSelect){
1178                         iLen = resp.arg[1];
1179                         if (iLen){
1180                                 PrintAndLog("Card selected. UID[%i]:", iLen);
1181                         } else {
1182                                 PrintAndLog("Can't select card.");
1183                         }
1184                 } else {
1185                         PrintAndLog("received %i bytes:", iLen);
1186                 }
1187                 if(!iLen)
1188                         return 1;
1189                 hexout = (char *)malloc(iLen * 3 + 1);
1190                 if (hexout != NULL) {
1191                         for (int i = 0; i < iLen; i++) { // data in hex
1192                                 sprintf(&hexout[i * 3], "%02X ", recv[i]);
1193                         }
1194                         PrintAndLog("%s", hexout);
1195                         free(hexout);
1196                 } else {
1197                         PrintAndLog("malloc failed your client has low memory?");
1198                         return 2;
1199                 }
1200         } else {
1201                 PrintAndLog("timeout while waiting for reply.");
1202                 return 3;
1203         }
1204         return 0;
1205 }
1206
1207 static command_t CommandTable[] =
1208 {
1209         {"help",     CmdHelp,              1, "This help"},
1210         {"list",     CmdHF14AList,         0, "[Deprecated] List ISO 14443a history"},
1211         {"reader",   CmdHF14AReader,       0, "Start acting like an ISO14443 Type A reader"},
1212         {"info",     CmdHF14AInfo,         0, "Reads card and shows information about it"},
1213         {"cuids",    CmdHF14ACUIDs,        0, "<n> Collect n>0 ISO14443 Type A UIDs in one go"},
1214         {"sim",      CmdHF14ASim,          0, "<UID> -- Simulate ISO 14443a tag"},
1215         {"snoop",    CmdHF14ASnoop,        0, "Eavesdrop ISO 14443 Type A"},
1216         {"apdu",     CmdHF14AAPDU,         0, "Send an ISO 7816-4 APDU via ISO 14443-4 block transmission protocol"},
1217         {"raw",      CmdHF14ACmdRaw,       0, "Send raw hex data to tag"},
1218         {NULL,       NULL,                 0, NULL}
1219 };
1220
1221 int CmdHF14A(const char *Cmd) {
1222         (void)WaitForResponseTimeout(CMD_ACK,NULL,100);
1223         CmdsParse(CommandTable, Cmd);
1224         return 0;
1225 }
1226
1227 int CmdHelp(const char *Cmd)
1228 {
1229   CmdsHelp(CommandTable);
1230   return 0;
1231 }