Extended iClass support with Card and Reader emulation!

armsrc/appmain.c

@@ -754,6 +754,12 @@ void UsbPacketReceived(uint8_t *packet, int len)
 		case CMD_SNOOP_ICLASS:
 			SnoopIClass();
 			break;
+		case CMD_SIMULATE_TAG_ICLASS:
+			SimulateIClass(c->arg[0], c->d.asBytes);
+			break;
+		case CMD_READER_ICLASS:
+			ReaderIClass(c->arg[0]);
+			break;
 #endif
 
 		case CMD_SIMULATE_TAG_HF_LISTEN:

armsrc/apps.h

@@ -19,6 +19,12 @@ typedef unsigned char byte_t;
 // The large multi-purpose buffer, typically used to hold A/D samples,
 // maybe processed in some way.
 uint32_t BigBuf[8000];
+extern const uint8_t OddByteParity[256];
+extern uint8_t *trace; // = (uint8_t *) BigBuf;
+extern int traceLen;   // = 0;
+extern int rsamples;   // = 0;
+extern int tracing;    // = TRUE;
+extern uint8_t trigger;
 
 // This may be used (sparingly) to declare a function to be copied to
 // and executed from RAM
@@ -109,6 +115,12 @@ void RAMFUNC SnoopIso14443(void);
 void RAMFUNC SnoopIso14443a(void);
 void SimulateIso14443aTag(int tagType, int TagUid);	// ## simulate iso14443a tag
 void ReaderIso14443a(UsbCommand * c, UsbCommand * ack);
+// Also used in iclass.c
+int LogTrace(const uint8_t * btBytes, int iLen, int iSamples, uint32_t dwParity, int bReader);
+uint32_t GetParity(const uint8_t * pbtCmd, int iLen);
+void iso14a_set_trigger(int enable);
+void iso14a_clear_tracelen(void);
+void iso14a_set_tracing(int enable);
 
 // mifarecmd.h
 void ReaderMifare(uint32_t parameter);
@@ -135,6 +147,8 @@ void SetDebugIso15693(uint32_t flag);
 
 /// iclass.h
 void RAMFUNC SnoopIClass(void);
+void SimulateIClass(uint8_t arg0, uint8_t *datain);
+void ReaderIClass(uint8_t arg0);
 
 /// util.h
 

armsrc/iso14443a.c

@@ -20,11 +20,12 @@
 #include "crapto1.h"
 #include "mifareutil.h"
 
-static uint8_t *trace = (uint8_t *) BigBuf;
-static int traceLen = 0;
-static int rsamples = 0;
-static int tracing = TRUE;
 static uint32_t iso14a_timeout;
+uint8_t *trace = (uint8_t *) BigBuf;
+int traceLen = 0;
+int rsamples = 0;
+int tracing = TRUE;
+uint8_t trigger = 0;
 
 // CARD TO READER - manchester
 // Sequence D: 11110000 modulation with subcarrier during first half
@@ -41,7 +42,7 @@ static uint32_t iso14a_timeout;
 #define	SEC_Y 0x00
 #define	SEC_Z 0xc0
 
-static const uint8_t OddByteParity[256] = {
+const uint8_t OddByteParity[256] = {
   1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
   0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
   0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
@@ -60,7 +61,7 @@ static const uint8_t OddByteParity[256] = {
   1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
 };
 
-uint8_t trigger = 0;
+
 void iso14a_set_trigger(int enable) {
 	trigger = enable;
 }
@@ -99,6 +100,7 @@ void AppendCrc14443a(uint8_t* data, int len)
   ComputeCrc14443(CRC_14443_A,data,len,data+len,data+len+1);
 }
 
+// The function LogTrace() is also used by the iClass implementation in iClass.c
 int LogTrace(const uint8_t * btBytes, int iLen, int iSamples, uint32_t dwParity, int bReader)
 {
   // Return when trace is full

client/cmdhficlass.c

@@ -170,11 +170,74 @@ int CmdHFiClassSnoop(const char *Cmd)
   return 0;
 }
 
+int CmdHFiClassSim(const char *Cmd)
+{
+  uint8_t simType = 0;
+  uint8_t CSN[8] = {0, 0, 0, 0, 0, 0, 0, 0};
+
+  if (strlen(Cmd)<2) {
+	PrintAndLog("Usage:  hf iclass sim    <sim type> <CSN (16 hex symbols)>");
+	PrintAndLog("        sample: hf iclass sim 0 031FEC8AF7FF12E0");
+	return 0;
+  }	
+
+  simType = param_get8(Cmd, 0);
+  if (param_gethex(Cmd, 1, CSN, 16)) {
+	PrintAndLog("A CSN should consist of 16 HEX symbols");
+	return 1;
+  }
+  PrintAndLog("--simtype:%02x csn:%s", simType, sprint_hex(CSN, 8));
+
+  UsbCommand c = {CMD_SIMULATE_TAG_ICLASS, {simType}};
+  memcpy(c.d.asBytes, CSN, 8);
+  SendCommand(&c);
+
+  /*UsbCommand * resp = WaitForResponseTimeout(CMD_ACK, 1500);
+  if (resp != NULL) {
+	uint8_t                isOK  = resp->arg[0] & 0xff;
+	PrintAndLog("isOk:%02x", isOK);
+  } else {
+	PrintAndLog("Command execute timeout");
+  }*/
+
+  return 0;
+}
+
+int CmdHFiClassReader(const char *Cmd)
+{
+  uint8_t readerType = 0;
+
+  if (strlen(Cmd)<1) {
+	PrintAndLog("Usage:  hf iclass reader    <reader type>");
+	PrintAndLog("        sample: hf iclass reader 0");
+	return 0;
+  }	
+
+  readerType = param_get8(Cmd, 0);
+  PrintAndLog("--readertype:%02x", readerType);
+
+  UsbCommand c = {CMD_READER_ICLASS, {readerType}};
+  //memcpy(c.d.asBytes, CSN, 8);
+  SendCommand(&c);
+
+  /*UsbCommand * resp = WaitForResponseTimeout(CMD_ACK, 1500);
+  if (resp != NULL) {
+	uint8_t                isOK  = resp->arg[0] & 0xff;
+	PrintAndLog("isOk:%02x", isOK);
+  } else {
+	PrintAndLog("Command execute timeout");
+  }*/
+
+  return 0;
+}
+
 static command_t CommandTable[] = 
 {
   {"help",    CmdHelp,        1, "This help"},
   {"list",    CmdHFiClassList,   0, "List iClass history"},
   {"snoop",   CmdHFiClassSnoop,  0, "Eavesdrop iClass communication"},
+  {"sim",     CmdHFiClassSim,    0, "Simulate iClass tag"},
+  {"reader",  CmdHFiClassReader, 0, "Read an iClass tag"},
   {NULL, NULL, 0, NULL}
 };
 

client/cmdhficlass.h

@@ -15,6 +15,8 @@
 int CmdHFiClass(const char *Cmd);
 
 int CmdHFiClassSnoop(const char *Cmd);
+int CmdHFiClassSim(const char *Cmd);
 int CmdHFiClassList(const char *Cmd);
+int CmdHFiClassReader(const char *Cmd);
 
 #endif

include/usb_cmd.h

@@ -94,6 +94,8 @@ typedef struct {
 #define CMD_WRITER_LEGIC_RF							0x0399
 
 #define CMD_SNOOP_ICLASS								0x0392
+#define CMD_SIMULATE_TAG_ICLASS								0x0393
+#define CMD_READER_ICLASS								0x0394
 
 // For measurements of the antenna tuning
 #define CMD_MEASURE_ANTENNA_TUNING			0x0400