mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2024-09-20 15:26:13 +08:00
had to keep track if the field is on or off on deviceside for 14b raw.\nAdded picopass ISO14443-B anticollision. It allows us to send raw packages over 14b.
This commit is contained in:
iceman1001
parent
aa173ce94f
commit
2981dd94f7
|
|
@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
|
|||
This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
|
||||
|
||||
## [unreleased][unreleased]
|
||||
- Added `hf 14b raw --pico` - now supports picopass anticollision over ISO14443-B (@iceman1001)
|
||||
- Changed `hf 14b *` - worked apdu and comms. Improved output. Uses NG packets (@iceman1001)
|
||||
- Fixed `data manrawdecode` - now copy to demodbuf even if em4100 decode fails (@iceman1001)
|
||||
- Changed `nfc decode` - now supports Android Managed Provision NDEF message decoding (@iceman1001)
|
||||
|
|
|
|||
|
|
@ -43,11 +43,6 @@ uint8_t get_pagemap(const picopass_hdr_t *hdr) {
|
|||
return (hdr->conf.fuses & (FUSE_CRYPT0 | FUSE_CRYPT1)) >> 3;
|
||||
}
|
||||
|
||||
// The length of a received command will in most cases be no more than 18 bytes.
|
||||
// we expect max 34 (32+2) bytes as tag answer (response to READ4)
|
||||
#ifndef ICLASS_BUFFER_SIZE
|
||||
#define ICLASS_BUFFER_SIZE 34 + 2
|
||||
#endif
|
||||
|
||||
#ifndef ICLASS_16KS_SIZE
|
||||
#define ICLASS_16KS_SIZE 0x100 * 8
|
||||
|
|
|
|||
|
|
@ -36,6 +36,13 @@
|
|||
#define ICLASS_READER_TIMEOUT_UPDATE 3390 // 16000us, nominal 4-15ms
|
||||
#define ICLASS_READER_TIMEOUT_OTHERS 80 // 380us, nominal 330us
|
||||
|
||||
// The length of a received command will in most cases be no more than 18 bytes.
|
||||
// we expect max 34 (32+2) bytes as tag answer (response to READ4)
|
||||
#ifndef ICLASS_BUFFER_SIZE
|
||||
#define ICLASS_BUFFER_SIZE 34 + 2
|
||||
#endif
|
||||
|
||||
|
||||
#define AddCrc(data, len) compute_crc(CRC_ICLASS, (data), (len), (data)+(len), (data)+(len)+1)
|
||||
|
||||
void SniffIClass(uint8_t jam_search_len, uint8_t *jam_search_string);
|
||||
|
|
|
|||
|
|
@ -34,6 +34,7 @@
|
|||
#include "dbprint.h"
|
||||
#include "ticks.h"
|
||||
#include "iso14b.h" // defines for ETU conversions
|
||||
#include "iclass.h" // picopass buffer defines
|
||||
|
||||
/*
|
||||
* Current timing issues with ISO14443-b implementation
|
||||
|
|
@ -196,6 +197,8 @@ static uint8_t s_iso14b_pcb_blocknum = 0;
|
|||
static uint8_t s_iso14b_fwt = 9;
|
||||
static uint32_t s_iso14b_timeout = MAX_14B_TIMEOUT;
|
||||
|
||||
static bool s_field_on = false;
|
||||
|
||||
/*
|
||||
* ISO 14443-B communications
|
||||
* --------------------------
|
||||
|
|
@ -2115,6 +2118,132 @@ int iso14443b_select_card(iso14b_card_select_t *card) {
|
|||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
static int iso14443b_select_picopass_card(picopass_hdr_t *hdr) {
|
||||
|
||||
static uint8_t act_all[] = { ICLASS_CMD_ACTALL };
|
||||
static uint8_t identify[] = { ICLASS_CMD_READ_OR_IDENTIFY };
|
||||
static uint8_t read_conf[] = { ICLASS_CMD_READ_OR_IDENTIFY, 0x01, 0xfa, 0x22 };
|
||||
uint8_t select[] = { 0x80 | ICLASS_CMD_SELECT, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
|
||||
uint8_t read_aia[] = { ICLASS_CMD_READ_OR_IDENTIFY, 0x05, 0xde, 0x64};
|
||||
uint8_t read_check_cc[] = { 0x80 | ICLASS_CMD_READCHECK, 0x02 };
|
||||
uint8_t resp[ICLASS_BUFFER_SIZE] = {0};
|
||||
|
||||
uint32_t start_time = 0;
|
||||
uint32_t eof_time = 0;
|
||||
uint16_t retlen = 0;
|
||||
|
||||
// first, wake up the tag 0x0A
|
||||
CodeAndTransmit14443bAsReader(act_all, sizeof(act_all), &start_time, &eof_time, true);
|
||||
eof_time += DELAY_ISO14443B_PCD_TO_PICC_READER;
|
||||
|
||||
// 0x0C
|
||||
// start_time = eof_time + ISO14B_TR2;
|
||||
start_time = eof_time + US_TO_SSP(1000); // 330ms before next cmd
|
||||
CodeAndTransmit14443bAsReader(identify, sizeof(identify), &start_time, &eof_time, true);
|
||||
eof_time += DELAY_ISO14443B_PCD_TO_PICC_READER;
|
||||
|
||||
// expect a 10-byte response here, 8 byte anticollision-CSN and 2 byte CRC
|
||||
if (Get14443bAnswerFromTag(resp, sizeof(resp), s_iso14b_timeout, &eof_time, &retlen) != PM3_SUCCESS) {
|
||||
return PM3_ECARDEXCHANGE;
|
||||
}
|
||||
if (retlen != 10) {
|
||||
return PM3_ELENGTH;
|
||||
}
|
||||
|
||||
// copy the Anti-collision CSN to our select-packet
|
||||
memcpy(&select[1], resp, 8);
|
||||
|
||||
// select the card
|
||||
start_time = eof_time + ISO14B_TR2;
|
||||
CodeAndTransmit14443bAsReader(select, sizeof(select), &start_time, &eof_time, true);
|
||||
eof_time += DELAY_ISO14443B_PCD_TO_PICC_READER;
|
||||
|
||||
// expect a 10-byte response here, 8 byte CSN and 2 byte CRC
|
||||
if (Get14443bAnswerFromTag(resp, sizeof(resp), s_iso14b_timeout, &eof_time, &retlen) != PM3_SUCCESS) {
|
||||
return PM3_ECARDEXCHANGE;
|
||||
}
|
||||
if (retlen != 10) {
|
||||
return PM3_ELENGTH;
|
||||
}
|
||||
|
||||
// save CSN
|
||||
memcpy(hdr->csn, resp, sizeof(hdr->csn));
|
||||
|
||||
// card selected, now read config (block1) (only 8 bytes no CRC)
|
||||
start_time = eof_time + ISO14B_TR2;
|
||||
CodeAndTransmit14443bAsReader(read_conf, sizeof(read_conf), &start_time, &eof_time, true);
|
||||
eof_time += DELAY_ISO14443B_PCD_TO_PICC_READER;
|
||||
|
||||
// expect a 10-byte response here, 8 bytes CONFIGURATION and 2 byte CRC)
|
||||
if (Get14443bAnswerFromTag(resp, sizeof(resp), s_iso14b_timeout, &eof_time, &retlen) != PM3_SUCCESS) {
|
||||
return PM3_ECARDEXCHANGE;
|
||||
}
|
||||
if (retlen != 10) {
|
||||
return PM3_ELENGTH;
|
||||
}
|
||||
|
||||
// save CONF
|
||||
memcpy((uint8_t *)&hdr->conf, resp, sizeof(hdr->conf));
|
||||
|
||||
uint8_t pagemap = get_pagemap(hdr);
|
||||
if (pagemap != PICOPASS_NON_SECURE_PAGEMODE) {
|
||||
|
||||
// read App Issuer Area block 5
|
||||
start_time = eof_time + ISO14B_TR2;
|
||||
CodeAndTransmit14443bAsReader(read_aia, sizeof(read_aia), &start_time, &eof_time, true);
|
||||
eof_time += DELAY_ISO14443B_PCD_TO_PICC_READER;
|
||||
|
||||
// expect AIA, a 10-byte response here
|
||||
if (Get14443bAnswerFromTag(resp, sizeof(resp), s_iso14b_timeout, &eof_time, &retlen) != PM3_SUCCESS) {
|
||||
return PM3_ECARDEXCHANGE;
|
||||
}
|
||||
if (retlen != 10) {
|
||||
return PM3_ELENGTH;
|
||||
}
|
||||
|
||||
memcpy(hdr->app_issuer_area, resp, sizeof(hdr->app_issuer_area));
|
||||
|
||||
// card selected, now read e-purse (cc) (block2) (only 8 bytes no CRC)
|
||||
start_time = eof_time + ISO14B_TR2;
|
||||
CodeAndTransmit14443bAsReader(read_check_cc, sizeof(read_check_cc), &start_time, &eof_time, true);
|
||||
eof_time += DELAY_ISO14443B_PCD_TO_PICC_READER;
|
||||
|
||||
// expect EPURSE, a 8 byte response here
|
||||
if (Get14443bAnswerFromTag(resp, sizeof(resp), s_iso14b_timeout, &eof_time, &retlen) != PM3_SUCCESS) {
|
||||
return PM3_ECARDEXCHANGE;
|
||||
}
|
||||
if (retlen != 8) {
|
||||
return PM3_ELENGTH;
|
||||
}
|
||||
|
||||
memcpy(hdr->epurse, resp, sizeof(hdr->epurse));
|
||||
|
||||
} else {
|
||||
|
||||
// on NON_SECURE_PAGEMODE cards, AIA is on block2..
|
||||
|
||||
// read App Issuer Area block 2
|
||||
read_aia[1] = 0x02;
|
||||
read_aia[2] = 0x61;
|
||||
read_aia[3] = 0x10;
|
||||
|
||||
start_time = eof_time + ISO14B_TR2;
|
||||
CodeAndTransmit14443bAsReader(read_aia, sizeof(read_aia), &start_time, &eof_time, true);
|
||||
eof_time += DELAY_ISO14443B_PCD_TO_PICC_READER;
|
||||
|
||||
// expect AIA, a 10-byte response here
|
||||
if (Get14443bAnswerFromTag(resp, sizeof(resp), s_iso14b_timeout, &eof_time, &retlen) != PM3_SUCCESS) {
|
||||
return PM3_ECARDEXCHANGE;
|
||||
}
|
||||
if (retlen != 10) {
|
||||
return PM3_ELENGTH;
|
||||
}
|
||||
|
||||
memcpy(hdr->epurse, resp, sizeof(hdr->epurse));
|
||||
}
|
||||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
// Set up ISO 14443 Type B communication (similar to iso14443a_setup)
|
||||
// field is setup for "Sending as Reader"
|
||||
void iso14443b_setup(void) {
|
||||
|
|
@ -2152,6 +2281,8 @@ void iso14443b_setup(void) {
|
|||
// reset timeout
|
||||
iso14b_set_fwt(8);
|
||||
|
||||
s_field_on = true;
|
||||
|
||||
LED_D_ON();
|
||||
}
|
||||
|
||||
|
|
@ -2471,7 +2602,23 @@ void SendRawCommand14443B(iso14b_raw_cmd_t *p) {
|
|||
sendlen = sizeof(iso14b_cts_card_select_t);
|
||||
status = iso14443b_select_cts_card(cts);
|
||||
reply_ng(CMD_HF_ISO14443B_COMMAND, status, (uint8_t *)cts, sendlen);
|
||||
if (status > PM3_SUCCESS) goto out;
|
||||
if (status != PM3_SUCCESS) goto out;
|
||||
}
|
||||
|
||||
if ((p->flags & ISO14B_SELECT_PICOPASS) == ISO14B_SELECT_PICOPASS) {
|
||||
picopass_hdr_t *hdr = (picopass_hdr_t *)buf;
|
||||
memset(hdr, 0, sizeof(picopass_hdr_t));
|
||||
sendlen = sizeof(picopass_hdr_t);
|
||||
status = iso14443b_select_picopass_card(hdr);
|
||||
reply_ng(CMD_HF_ISO14443B_COMMAND, status, (uint8_t *)hdr, sendlen);
|
||||
if (status != PM3_SUCCESS) goto out;
|
||||
}
|
||||
|
||||
// if field is off...
|
||||
if (s_field_on == false) {
|
||||
DbpString("Field is off");
|
||||
reply_ng(CMD_HF_ISO14443B_COMMAND, PM3_ERFTRANS, NULL, 0);
|
||||
goto out;
|
||||
}
|
||||
|
||||
if ((p->flags & ISO14B_APDU) == ISO14B_APDU) {
|
||||
|
|
@ -2533,5 +2680,6 @@ out:
|
|||
switch_off(); // disconnect raw
|
||||
SpinDelay(20);
|
||||
BigBuf_free_keep_EM();
|
||||
s_field_on = false;
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -20,19 +20,20 @@
|
|||
#include <ctype.h>
|
||||
#include "iso14b.h"
|
||||
#include "fileutils.h"
|
||||
#include "cmdparser.h" // command_t
|
||||
#include "commonutil.h" // ARRAYLEN
|
||||
#include "comms.h" // clearCommandBuffer
|
||||
#include "emv/emvcore.h" // TLVPrintFromBuffer
|
||||
#include "cmdparser.h" // command_t
|
||||
#include "commonutil.h" // ARRAYLEN
|
||||
#include "comms.h" // clearCommandBuffer
|
||||
#include "emv/emvcore.h" // TLVPrintFromBuffer
|
||||
#include "cmdtrace.h"
|
||||
#include "cliparser.h"
|
||||
#include "crc16.h"
|
||||
#include "cmdhf14a.h"
|
||||
#include "protocols.h" // definitions of ISO14B/7816 protocol
|
||||
#include "iso7816/apduinfo.h" // GetAPDUCodeDescription
|
||||
#include "nfc/ndef.h" // NDEFRecordsDecodeAndPrint
|
||||
#include "protocols.h" // definitions of ISO14B/7816 protocol
|
||||
#include "iso7816/apduinfo.h" // GetAPDUCodeDescription
|
||||
#include "nfc/ndef.h" // NDEFRecordsDecodeAndPrint
|
||||
#include "aidsearch.h"
|
||||
#include "fileutils.h" // saveFile
|
||||
#include "fileutils.h" // saveFile
|
||||
#include "iclass_cmd.h" // picopass defines
|
||||
|
||||
#define MAX_14B_TIMEOUT_MS (4949U)
|
||||
|
||||
|
|
@ -849,7 +850,7 @@ static int CmdHF14BSniff(const char *Cmd) {
|
|||
return PM3_SUCCESS;
|
||||
}
|
||||
|
||||
static int CmdHF14BCmdRaw(const char *Cmd) {
|
||||
static int CmdHF14BRaw(const char *Cmd) {
|
||||
CLIParserContext *ctx;
|
||||
CLIParserInit(&ctx, "hf 14b raw",
|
||||
"Sends raw bytes to card. Activates field by default",
|
||||
|
|
@ -872,10 +873,9 @@ static int CmdHF14BCmdRaw(const char *Cmd) {
|
|||
arg_lit0(NULL, "sr", "use SRx ST select"),
|
||||
arg_lit0(NULL, "cts", "use ASK C-ticket select"),
|
||||
arg_lit0(NULL, "xrx", "use Fuji/Xerox select"),
|
||||
arg_lit0(NULL, "pico", "use Picopass select"),
|
||||
|
||||
arg_lit0("v", "verbose", "verbose output"),
|
||||
|
||||
|
||||
arg_param_end
|
||||
};
|
||||
CLIExecWithReturn(ctx, Cmd, argtable, false);
|
||||
|
|
@ -894,7 +894,8 @@ static int CmdHF14BCmdRaw(const char *Cmd) {
|
|||
bool select_sr = arg_get_lit(ctx, 8);
|
||||
bool select_cts = arg_get_lit(ctx, 9);
|
||||
bool select_xrx = arg_get_lit(ctx, 10);
|
||||
bool verbose = arg_get_lit(ctx, 11);
|
||||
bool select_pico = arg_get_lit(ctx, 11);
|
||||
bool verbose = arg_get_lit(ctx, 12);
|
||||
CLIParserFree(ctx);
|
||||
|
||||
// FLAGS for device side
|
||||
|
|
@ -928,6 +929,11 @@ static int CmdHF14BCmdRaw(const char *Cmd) {
|
|||
if (verbose) {
|
||||
PrintAndLogEx(INFO, "using Fuji/Xerox select");
|
||||
}
|
||||
} else if (select_pico) {
|
||||
flags |= (ISO14B_CONNECT | ISO14B_SELECT_PICOPASS | ISO14B_CLEARTRACE);
|
||||
if (verbose) {
|
||||
PrintAndLogEx(INFO, "using Picopass select");
|
||||
}
|
||||
}
|
||||
|
||||
uint32_t time_wait = 0;
|
||||
|
|
@ -1008,6 +1014,13 @@ static int CmdHF14BCmdRaw(const char *Cmd) {
|
|||
}
|
||||
}
|
||||
|
||||
if (select_pico) {
|
||||
success = wait_cmd_14b(verbose, true, user_timeout);
|
||||
if (verbose && success) {
|
||||
PrintAndLogEx(SUCCESS, "Got response for Picopass select");
|
||||
}
|
||||
}
|
||||
|
||||
// get back response from the raw bytes you sent.
|
||||
if (success && datalen > 0) {
|
||||
wait_cmd_14b(true, false, user_timeout);
|
||||
|
|
@ -1315,6 +1328,53 @@ static bool HF14B_ask_ct_reader(bool verbose) {
|
|||
return false;
|
||||
}
|
||||
|
||||
static bool HF14B_picopass_reader(bool verbose) {
|
||||
|
||||
iso14b_raw_cmd_t packet = {
|
||||
.flags = (ISO14B_CONNECT | ISO14B_SELECT_PICOPASS | ISO14B_DISCONNECT),
|
||||
.timeout = 0,
|
||||
.rawlen = 0,
|
||||
};
|
||||
|
||||
// 14b get and print UID only (general info)
|
||||
clearCommandBuffer();
|
||||
PacketResponseNG resp;
|
||||
SendCommandNG(CMD_HF_ISO14443B_COMMAND, (uint8_t *)&packet, sizeof(iso14b_raw_cmd_t));
|
||||
if (WaitForResponseTimeout(CMD_HF_ISO14443B_COMMAND, &resp, TIMEOUT) == false) {
|
||||
if (verbose) PrintAndLogEx(WARNING, "timeout while waiting for reply");
|
||||
return false;
|
||||
}
|
||||
|
||||
switch (resp.status) {
|
||||
case PM3_SUCCESS: {
|
||||
|
||||
picopass_hdr_t *card = calloc(1, sizeof(picopass_hdr_t));
|
||||
if (card == NULL) {
|
||||
PrintAndLogEx(FAILED, "failed to allocate memory");
|
||||
return false;
|
||||
}
|
||||
memcpy(card, resp.data.asBytes, sizeof(picopass_hdr_t));
|
||||
PrintAndLogEx(NORMAL, "");
|
||||
PrintAndLogEx(SUCCESS, "iCLASS / Picopass CSN: " _GREEN_("%s"), sprint_hex(card->csn, sizeof(card->csn)));
|
||||
free(card);
|
||||
return true;
|
||||
}
|
||||
case PM3_ELENGTH: {
|
||||
if (verbose) PrintAndLogEx(FAILED, "ISO 14443-3 wrong length");
|
||||
break;
|
||||
}
|
||||
case PM3_ECRC: {
|
||||
if (verbose) PrintAndLogEx(FAILED, "ISO 14443-3 CRC fail");
|
||||
break;
|
||||
}
|
||||
default: {
|
||||
if (verbose) PrintAndLogEx(FAILED, "ISO 14443-b Picopass select failed");
|
||||
break;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
// test for other 14b type tags (mimic another reader - don't have tags to identify)
|
||||
static bool HF14B_other_reader(bool verbose) {
|
||||
|
||||
|
|
@ -2422,7 +2482,7 @@ static command_t CommandTable[] = {
|
|||
{"dump", CmdHF14BDump, IfPm3Iso14443b, "Read all memory pages of an ISO-14443-B tag, save to file"},
|
||||
{"info", CmdHF14Binfo, IfPm3Iso14443b, "Tag information"},
|
||||
{"ndefread", CmdHF14BNdefRead, IfPm3Iso14443b, "Read NDEF file on tag"},
|
||||
{"raw", CmdHF14BCmdRaw, IfPm3Iso14443b, "Send raw hex data to tag"},
|
||||
{"raw", CmdHF14BRaw, IfPm3Iso14443b, "Send raw hex data to tag"},
|
||||
{"rdbl", CmdHF14BSriRdBl, IfPm3Iso14443b, "Read SRI512/SRIX4 block"},
|
||||
{"reader", CmdHF14BReader, IfPm3Iso14443b, "Act as a ISO-14443-B reader to identify a tag"},
|
||||
// {"restore", CmdHF14BRestore, IfPm3Iso14443b, "Restore from file to all memory pages of an ISO-14443-B tag"},
|
||||
|
|
@ -2497,6 +2557,13 @@ int readHF14B(bool loop, bool verbose) {
|
|||
else if (found)
|
||||
return PM3_SUCCESS;
|
||||
|
||||
// Picopass
|
||||
found |= HF14B_picopass_reader(verbose) ;
|
||||
if (found && loop)
|
||||
continue;
|
||||
else if (found)
|
||||
return PM3_SUCCESS;
|
||||
|
||||
} while (loop && kbd_enter_pressed() == false);
|
||||
|
||||
if (verbose && found == false) {
|
||||
|
|
|
|||
|
|
@ -1009,7 +1009,7 @@ int read_iclass_csn(bool loop, bool verbose, bool shallow_mod) {
|
|||
} else {
|
||||
|
||||
if (r->status == FLAG_ICLASS_NULL || resp.status == PM3_ERFTRANS) {
|
||||
if (verbose) PrintAndLogEx(WARNING, "iCLASS / Picopass card select failed ( %d )", r->status);
|
||||
if (verbose) PrintAndLogEx(WARNING, "iCLASS / Picopass card select failed ( %d , %d)", r->status, resp.status);
|
||||
res = PM3_EOPABORTED;
|
||||
break;
|
||||
}
|
||||
|
|
@ -1059,7 +1059,7 @@ static int CmdHFiClassReader(const char *Cmd) {
|
|||
PrintAndLogEx(INFO, "Press " _GREEN_("<Enter>") " to exit");
|
||||
}
|
||||
|
||||
return read_iclass_csn(cm, true, shallow_mod);
|
||||
return read_iclass_csn(cm, false, shallow_mod);
|
||||
}
|
||||
|
||||
static int CmdHFiClassELoad(const char *Cmd) {
|
||||
|
|
|
|||
Loading…
Reference in a new issue