Issue 20 patch (refactored code of the iso15693 implementation as well as several enhancements) [Adrian Dabrowski "atrox"]

COMPILING.txt

@@ -87,4 +87,24 @@ macport stuff should do ;)
 =   Linux  =
 ============
 
+1 - Download 
+
+A precompiled DevKitARM cross compiler tool chain package can be found at 
+http://sourceforge.net/projects/devkitpro/files/devkitARM
+Select the one you need (32bit or 64bit) and unpack to a convinient place, eg 
+$HOME/proxmark3/. It will create a devkitARM/ subdirectory.
+
+Of course, you will need a general compiling environment on your computer for
+the client and the libusb headers. In most distributions you will get all you 
+need with the lsb-package (Linux Standard Base). In debian/ubuntu you simply 
+call `aptitude install lsb libusb-dev`. 
+
+For the graphical plot view, you might need the qtlibs (debian/ubuntu: 
+libqt4-dev), too.
+
+2 - Set Environment
+
+export DEVKITPRO=$HOME/proxmark3/
+export DEVKITARM=$DEVKITPRO/devkitARM
+export PATH=${PATH}:${DEVKITARM}/bin
 

armsrc/Makefile

@@ -15,7 +15,7 @@ APP_CFLAGS	= -O2 -DWITH_LF -DWITH_ISO15693 -DWITH_ISO14443a -DWITH_ISO14443b
 
 #SRC_LCD = fonts.c LCD.c
 SRC_LF = lfops.c hitag2.c
-SRC_ISO15693 = iso15693.c
+SRC_ISO15693 = iso15693.c iso15693tools.c 
 SRC_ISO14443a = iso14443a.c
 SRC_ISO14443b = iso14443.c
 
@@ -35,7 +35,7 @@ ARMSRC = fpgaloader.c \
 	crc16.c \
 	$(SRC_ISO14443a) \
 	$(SRC_ISO14443b) \
-        legic_prng.c \
+	legic_prng.c \
 	crc.c
 
 # stdint.h provided locally until GCC 4.5 becomes C99 compliant

armsrc/appmain.c

@@ -124,6 +124,29 @@ void Dbprintf(const char *fmt, ...) {
 	DbpString(output_string);
 }
 
+// prints HEX & ASCII
+void Dbhexdump(int len, uint8_t *d) {
+	int l=0,i;
+	char ascii[9];
+
+	while (len>0) {
+		if (len>8) l=8;
+		else l=len;
+		
+		memcpy(ascii,d,l);
+		ascii[l]=0;	
+		
+		// filter safe ascii
+		for (i=0;i<l;i++) 
+			if (ascii[i]<32 || ascii[i]>126) ascii[i]='.';
+
+		Dbprintf("%-8s %*D",ascii,l,d," ");
+
+		len-=8;
+		d+=8;		
+	}
+}
+
 //-----------------------------------------------------------------------------
 // Read an ADC channel and block till it completes, then return the result
 // in ADC units (0 to 1023). Also a routine to average 32 samples and
@@ -598,6 +621,24 @@ void UsbPacketReceived(uint8_t *packet, int len)
 			break;
 #endif
 
+#ifdef WITH_ISO15693
+		case CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693:
+			RecordRawAdcSamplesIso15693();
+			break;
+			
+		case CMD_ISO_15693_COMMAND:
+			DirectTag15693Command(c->arg[0],c->arg[1],c->arg[2],c->d.asBytes);
+			break;
+					
+		case CMD_ISO_15693_FIND_AFI:
+			BruteforceIso15693Afi(c->arg[0]);
+			break;	
+			
+		case CMD_ISO_15693_DEBUG:
+			SetDebugIso15693(c->arg[0]);
+			break;
+			
+#endif
 		case CMD_BUFF_CLEAR:
 			BufferClear();
 			break;

armsrc/apps.h

@@ -31,6 +31,7 @@ void SamyRun(void);
 //void DbpIntegers(int a, int b, int c);
 void DbpString(char *str);
 void Dbprintf(const char *fmt, ...);
+void Dbhexdump(int len, uint8_t *d);
 
 void ToSendStuffBit(int b);
 void ToSendReset(void);
@@ -107,9 +108,13 @@ void ReaderIso14443a(UsbCommand * c, UsbCommand * ack);
 void ReaderMifare(uint32_t parameter);
 
 /// iso15693.h
+void RecordRawAdcSamplesIso15693(void);
 void AcquireRawAdcSamplesIso15693(void);
 void ReaderIso15693(uint32_t parameter);	// Simulate an ISO15693 reader - greg
 void SimTagIso15693(uint32_t parameter);	// simulate an ISO15693 tag - greg
+void BruteforceIso15693Afi(uint32_t speed); // find an AFI of a tag - atrox
+void DirectTag15693Command(uint32_t datalen,uint32_t speed, uint32_t recv, uint8_t data[]); // send arbitrary commands from CLI - atrox 
+void SetDebugIso15693(uint32_t flag);
 
 /// util.h
 

armsrc/string.c

@@ -69,3 +69,47 @@ char* strncat(char *dest, const char *src, unsigned int n)
 
 	return dest;
 }
+
+char* strcat(char *dest, const char *src)
+{
+	unsigned int dest_len = strlen(dest);
+	unsigned int i;
+
+	for (i = 0 ; src[i] != '\0' ; i++)
+		dest[dest_len + i] = src[i];
+	dest[dest_len + i] = '\0';
+
+	return dest;
+}
+////////////////////////////////////////// code to do 'itoa'
+
+/* reverse:  reverse string s in place */
+void strreverse(char s[])
+{
+    int c, i, j;
+
+    for (i = 0, j = strlen(s)-1; i<j; i++, j--) {
+        c = s[i];
+        s[i] = s[j];
+        s[j] = c;
+    }
+}
+
+/* itoa:  convert n to characters in s */
+void itoa(int n, char s[])
+{
+    int i, sign;
+
+    if ((sign = n) < 0)  /* record sign */
+        n = -n;          /* make n positive */
+    i = 0;
+    do {       /* generate digits in reverse order */
+        s[i++] = n % 10 + '0';   /* get next digit */
+    } while ((n /= 10) > 0);     /* delete it */
+    if (sign < 0)
+        s[i++] = '-';
+    s[i] = '\0';
+    strreverse(s);
+}
+
+//////////////////////////////////////// END 'itoa' CODE

armsrc/string.h

@@ -17,5 +17,9 @@ void *memcpy(void *dest, const void *src, int len);
 void *memset(void *dest, int c, int len);
 int memcmp(const void *av, const void *bv, int len);
 char *strncat(char *dest, const char *src, unsigned int n);
+char *strcat(char *dest, const char *src);
+void strreverse(char s[]);
+void itoa(int n, char s[]);
+
 
 #endif /* __STRING_H */

client/Makefile

@@ -42,6 +42,7 @@ endif
 CMDSRCS = \
 			crc16.c \
 			iso14443crc.c \
+			iso15693tools.c \
 			data.c \
 			graph.c \
 			ui.c \

client/cmdhf15.h

@@ -17,5 +17,9 @@ int CmdHF15Demod(const char *Cmd);
 int CmdHF15Read(const char *Cmd);
 int CmdHF15Reader(const char *Cmd);
 int CmdHF15Sim(const char *Cmd);
+int CmdHF15Record(const char *Cmd);
+int CmdHF15Cmd(const char*Cmd);
+int CmdHF15CmdHelp(const char*Cmd);
+int CmdHF15Help(const char*Cmd);
 
 #endif

common/iso15693tools.c

@@ -0,0 +1,67 @@
+//-----------------------------------------------------------------------------
+// This code is licensed to you under the terms of the GNU GPL, version 2 or,
+// at your option, any later version. See the LICENSE.txt file for the text of
+// the license.
+//-----------------------------------------------------------------------------
+// ISO15693 CRC & other commons
+//-----------------------------------------------------------------------------
+
+
+#include "proxmark3.h"
+#include <stdint.h>
+#include <stdlib.h>
+//#include "iso15693tools.h"
+
+// The CRC as described in ISO 15693-Part 3-Annex C
+// 	v	buffer with data
+//		n	length
+//	returns crc as 16bit value
+uint16_t Iso15693Crc(uint8_t *v, int n)
+{
+	uint32_t reg;
+	int i, j;
+
+	reg = 0xffff;
+	for(i = 0; i < n; i++) {
+		reg = reg ^ ((uint32_t)v[i]);
+		for (j = 0; j < 8; j++) {
+			if (reg & 0x0001) {
+				reg = (reg >> 1) ^ 0x8408;
+			} else {
+				reg = (reg >> 1);
+			}
+		}
+	}
+
+	return ~(uint16_t)(reg & 0xffff);
+}
+
+// adds a CRC to a dataframe
+// 	req[]   iso15963 frame without crc
+//		n       length without crc
+// returns the new length of the dataframe.
+int Iso15693AddCrc(uint8_t *req, int n) {
+	uint16_t crc=Iso15693Crc(req,n);
+	req[n] = crc & 0xff;
+	req[n+1] = crc >> 8;
+	return n+2;
+}
+
+
+int sprintf(char *str, const char *format, ...);
+
+// returns a string representation of the UID
+// UID is transmitted and stored LSB first, displayed MSB first
+//		target    char* buffer, where to put the UID, if NULL a static buffer is returned
+//		uid[]		the UID in transmission order
+//	return: ptr to string
+char* Iso15693sprintUID(char *target,uint8_t *uid) {
+  static char tempbuf[9]="";
+  if (target==NULL) target=tempbuf;
+  sprintf(target,"%02hX%02hX%02hX%02hX%02hX%02hX%02hX%02hX",
+  				uid[7],uid[6],uid[5],uid[4],uid[3],uid[2],uid[1],uid[0]);
+  return target;
+}
+
+
+

common/iso15693tools.h

@@ -0,0 +1,127 @@
+// ISO15693 commons
+// Adrian Dabrowski 2010, GPLv2
+
+#ifndef ISO15693_H__
+#define ISO15693_H__
+
+// ISO15693 CRC
+#define ISO15_CRC_PRESET	(uint16_t)0xFFFF
+#define ISO15_CRC_POLY		(uint16_t)0x8408
+#define ISO15_CRC_CHECK		((uint16_t)(~0xF0B8 & 0xFFFF)) 	// use this for checking of a correct crc
+
+// REQUEST FLAGS
+
+#define ISO15_REQ_SUBCARRIER_SINGLE	0x00	// Tag should respond using one subcarrier (ASK)
+#define ISO15_REQ_SUBCARRIER_TWO		0x01	// Tag should respond using two subcarriers (FSK)
+#define ISO15_REQ_DATARATE_LOW		0x00	// Tag should respond using low data rate
+#define ISO15_REQ_DATARATE_HIGH		0x02	// Tag should respond using high data rate
+#define ISO15_REQ_NONINVENTORY		0x00
+#define ISO15_REQ_INVENTORY		0x04	// This is an inventory request - see inventory flags
+#define ISO15_REQ_PROTOCOL_NONEXT		0x00
+#define ISO15_REQ_PROTOCOL_EXT		0x08	// RFU
+
+// REQUEST FLAGS when INVENTORY is not set
+
+#define ISO15_REQ_SELECT			0x10	// only selected cards response
+#define ISO15_REQ_ADDRESS			0x20	// this req contains an address
+#define ISO15_REQ_OPTION			0x40	// Command specific option selector
+
+//REQUEST FLAGS when INVENTORY is set
+
+#define ISO15_REQINV_AFI			0x10	// AFI Field is present
+#define ISO15_REQINV_SLOT1		0x20	// 1 Slot
+#define ISO15_REQINV_SLOT16		0x00	// 16 Slots
+#define ISO15_REQINV_OPTION		0x40	// Command specific option selector
+
+//RESPONSE FLAGS
+#define ISO15_RES_ERROR			0x01
+#define ISO15_RES_EXT			0x08	// Protocol Extention	
+
+// RESPONSE ERROR CODES
+#define ISO15_NOERROR			0x00
+#define ISO15_ERROR_CMD_NOT_SUP		0x01	// Command not supported
+#define ISO15_ERROR_CMD_NOT_REC		0x02	// Command not recognized (eg. parameter error)
+#define ISO15_ERROR_CMD_OPTION		0x03	// Command option not supported
+#define ISO15_ERROR_GENERIC		0x0F	// No additional Info about this error
+#define ISO15_ERROR_BLOCK_UNAVAILABLE	0x10	
+#define ISO15_ERROR_BLOCK_LOCKED_ALREADY	0x11	// cannot lock again
+#define ISO15_ERROR_BLOCK_LOCKED		0x12	// cannot be changed
+#define ISO15_ERROR_BLOCK_WRITE		0x13	// Writing was unsuccessful
+#define ISO15_ERROR_BLOCL_WRITELOCK	0x14	// Locking was unsuccessful
+
+// COMMAND CODES
+#define ISO15_CMD_INVENTORY			0x01
+#define ISO15_CMD_STAYQUIET			0x02
+#define ISO15_CMD_READ					0x20
+#define ISO15_CMD_WRITE					0x21
+#define ISO15_CMD_LOCK					0x22
+#define ISO15_CMD_READMULTI			0x23
+#define ISO15_CMD_WRITEMULTI			0x24
+#define ISO15_CMD_SELECT				0x25
+#define ISO15_CMD_RESET					0x26
+#define ISO15_CMD_WRITEAFI				0x27
+#define ISO15_CMD_LOCKAFI				0x28
+#define ISO15_CMD_WRITEDSFID			0x29
+#define ISO15_CMD_LOCKDSFID			0x2A
+#define ISO15_CMD_SYSINFO				0x2B
+#define ISO15_CMD_SECSTATUS			0x2C
+
+
+uint16_t Iso15693Crc(uint8_t *v, int n);
+int Iso15693AddCrc(uint8_t *req, int n);
+char* Iso15693sprintUID(char *target,uint8_t *uid);
+
+//-----------------------------------------------------------------------------
+// Map a sequence of octets (~layer 2 command) into the set of bits to feed
+// to the FPGA, to transmit that command to the tag.
+// Mode: highspeed && one subcarrier (ASK)
+//-----------------------------------------------------------------------------
+
+	// The sampling rate is 106.353 ksps/s, for T = 18.8 us
+
+	// SOF defined as
+	// 1) Unmodulated time of 56.64us
+	// 2) 24 pulses of 423.75khz
+	// 3) logic '1' (unmodulated for 18.88us followed by 8 pulses of 423.75khz)
+
+	static const int Iso15693FrameSOF[] = {
+		-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+		-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+		 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,
+		 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,
+		-1, -1, -1, -1,
+		-1, -1, -1, -1,
+		 1,  1,  1,  1,
+		 1,  1,  1,  1
+	};
+	static const int Iso15693Logic0[] = {
+		 1,  1,  1,  1,
+		 1,  1,  1,  1,
+		-1, -1, -1, -1,
+		-1, -1, -1, -1
+	};
+	static const int Iso15693Logic1[] = {
+		-1, -1, -1, -1,
+		-1, -1, -1, -1,
+		 1,  1,  1,  1,
+		 1,  1,  1,  1
+	};
+
+	// EOF defined as
+	// 1) logic '0' (8 pulses of 423.75khz followed by unmodulated for 18.88us)
+	// 2) 24 pulses of 423.75khz
+	// 3) Unmodulated time of 56.64us
+
+	static const int Iso15693FrameEOF[] = {
+		 1,  1,  1,  1,
+		 1,  1,  1,  1,
+		-1, -1, -1, -1,
+		-1, -1, -1, -1,
+		 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,
+		 1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,  1,
+		-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+		-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1
+	};
+
+
+#endif

include/usb_cmd.h

@@ -75,6 +75,11 @@ typedef struct {
 #define CMD_READ_SRIX4K_TAG				0x0304
 #define CMD_READER_ISO_15693				0x0310
 #define CMD_SIMTAG_ISO_15693				0x0311
+#define CMD_RECORD_RAW_ADC_SAMPLES_ISO_15693		0x0312
+#define CMD_ISO_15693_COMMAND				0x0313
+#define CMD_ISO_15693_COMMAND_DONE		0x0314
+#define CMD_ISO_15693_FIND_AFI			0x0315
+#define CMD_ISO_15693_DEBUG				0x0316
 #define CMD_SIMULATE_TAG_HF_LISTEN			0x0380
 #define CMD_SIMULATE_TAG_ISO_14443			0x0381
 #define CMD_SNOOP_ISO_14443				0x0382

tools/findbits.py

@@ -37,7 +37,7 @@ def invert(data):
 	return out
 
 # do the actual search
-def search(data,target):
+def search(target,data):
 	location= string.find(data,target)
 	if location >= 0:
 		print '*** Match at bit %d:' % location,